@volter/world-core 3.0.160 → 3.0.162

package/src/derived-core.ts

@@ -1,3 +1,5 @@
+import { storageTenant } from './request-scope.ts';
+import { isWorldAccountName } from './world-account-name.ts';
 import { parseExactJson, compareExactNumbers, exactInteger, isExactIntegerValue } from './exact-json.ts';
 // THE DERIVED CORE — what a derived pack does for an operation it declares no handler for
 // (docs/contributing/architecture.md, "Protocol 3"). The generated surface says what the
@@ -20,7 +22,7 @@ import { openSessions, socketWrite, type SocketDecl, type SocketSession } from '
 import { liveAccess } from './live/access.ts';
 import type { LiveAccess, LiveDecl } from './live/types.ts';
 import { awaitWrite, awaitCondition, heldReadsWrite } from './held-reads.ts';
-import { MACHINE_POOL, poolFor, guardedMachinePool, type MachinePool, type MachineHttpReply, type LightPoolOptions } from './machines.ts';
+import { MACHINE_POOL, poolFor, guardedMachinePool, type MachinePool, type MachineHttpReply } from './machines.ts';
 import { askApplication, deliverEvents, type ApplicationAnswer, type ApplicationStandIn, type EventRender, type EventScheme, type EventsDecl, type EventValues } from './events.ts';
 import type { RateBudgetDeclaration } from './rateBudget.ts';
 import { handlerCrypto, hmac, ksuidFrom, lettersFrom, sha256, uuidFrom, type HandlerCrypto } from './signing.ts';
@@ -524,7 +526,7 @@ export type DerivedManifest = {
    *  an organization, a team, an account — and a caller reaches only its own tenant's, as a parent's children are
    *  reached under it. `field` holds it on each subject; `semantics/tenant.ts` names the caller's. The core scopes every
    *  read, list, update and delete by it and stamps it on every create, for each resource not `shared`. */
-  tenant?: { field: string };
+  tenant?: { field: string; storage?: 'namespaced' };
   /** The vendor's own lanes behind this manifest's API ("Other wires: lanes"), dispatched by the kernel before the
    *  vendor's own doors, clock and API (LanesDecl). */
   lanes?: LanesDecl;
@@ -744,13 +746,19 @@ function notFound(manifest: DerivedManifest, object: string, id: string, param?:
 
 // ── the tree ─────────────────────────────────────────────────────────────────────────────────
 
-export const storedType = (m: DerivedManifest, resource: string): string => m.resources[resource]?.storedAs ?? resource;
+const TENANT_TYPE = '::account:';
+const accountScope = (m: DerivedManifest): string | undefined => m.tenant?.storage === 'namespaced' ? storageTenant(m.service) : undefined;
+const scopeLabel = (m: DerivedManifest, label: string): string => { const account = accountScope(m); return account && account !== 'default' ? `account:${account}:${label}` : label; };
+export const storedType = (m: DerivedManifest, resource: string): string => {
+  const base = m.resources[resource]?.storedAs ?? resource, account = accountScope(m);
+  return account && account !== 'default' && !m.resources[resource]?.shared ? `${base}${TENANT_TYPE}${encodeURIComponent(account)}` : base;
+};
 
 // A service's resources by type, folded once per World state (the tree's stamp; any write moves it), not on every read:
 // a read of one resource type projected the service's whole tree, so a pack whose tree also holds many subjects of
 // other types (PlanetScale's SQL rows beside its management records) paid for all of them on each read. A read gets its
 // own copy of each resource, as twinResources hands out, with the vendor's own id/type/updatedAt a spread would drop.
-const typeIndexes = new WeakMap<object, Map<string, { stamp: string; byType: Map<string, Map<string, TwinResource>> }>>();
+const typeIndexes = new WeakMap<object, Map<string, { stamp: string; byType: Map<string, Map<string, TwinResource>>; typeByKey: Map<string, string> }>>();
 /** A service's resources of one type, each the reader's own copy: `twinResources` filtered by type, from an index
  *  that follows each write rather than projecting the whole tree per call. */
 export function resourcesOfType(service: string, type: string, root?: string): TwinResource[] {
@@ -764,8 +772,13 @@ export function resourcesOfType(service: string, type: string, root?: string): T
   if (held && delta) {
     // the index keeps the tree's order: a subject updated where it stands stays there, one new to the tree (or made
     // again after a delete) goes to the end in the order the tree holds it
-    for (const k of [...delta.removed, ...delta.appended]) held.byType.get(k.slice(0, k.indexOf(':')))?.delete(k);
+    for (const k of [...delta.removed, ...delta.appended]) {
+      const type = held.typeByKey.get(k);
+      if (type !== undefined) held.byType.get(type)?.delete(k);
+      held.typeByKey.delete(k);
+    }
     const byKey = new Map(delta.changed.map((r) => [`${r.type}:${r.id}`, r]));
+    for (const [k, r] of byKey) held.typeByKey.set(k, r.type);
     for (const [k, r] of byKey) if (!delta.appended.includes(k)) (held.byType.get(r.type) ?? held.byType.set(r.type, new Map()).get(r.type)!).set(k, r);
     for (const k of delta.appended) { const r = byKey.get(k)!; (held.byType.get(r.type) ?? held.byType.set(r.type, new Map()).get(r.type)!).set(k, r); }
     held.stamp = delta.stamp;
@@ -775,7 +788,7 @@ export function resourcesOfType(service: string, type: string, root?: string): T
     if (!held || held.stamp !== stamp) {
       const byType = new Map<string, Map<string, TwinResource>>();
       for (const r of twinResources(service, root)) (byType.get(r.type) ?? byType.set(r.type, new Map()).get(r.type)!).set(`${r.type}:${r.id}`, r);
-      held = { stamp, byType };
+      held = { stamp, byType, typeByKey: new Map([...byType].flatMap(([type, rows]) => [...rows.keys()].map(key => [key, type] as const))) };
       indexes.set(key, held);
     }
   }
@@ -785,7 +798,9 @@ export function resourcesOfType(service: string, type: string, root?: string): T
 function stored(m: DerivedManifest, resource: string, root?: string, opts: { withDeleted?: boolean } = {}): TwinResource[] {
   const type = storedType(m, resource);
   const when = Object.entries(m.resources[resource]?.readableWhen ?? {});
-  return resourcesOfType(m.service, type, root).filter((r) => (opts.withDeleted || r.deleted !== true) && when.every(([k, v]) => (r as Record<string, unknown>)[k] === v));
+  const rows = m.tenant?.storage === 'namespaced' && accountScope(m) === undefined && !m.resources[resource]?.shared
+    ? twinResources(m.service, root).filter(row => row.type === type || row.type.startsWith(`${type}${TENANT_TYPE}`)) : resourcesOfType(m.service, type, root);
+  return rows.filter((r) => (opts.withDeleted || r.deleted !== true) && when.every(([k, v]) => (r as Record<string, unknown>)[k] === v));
 }
 
 /** The subject an item operation names: the manifest's key over the path parameters, or the last one. */
@@ -821,7 +836,7 @@ function missingParent(m: DerivedManifest, resource: string, call: DerivedCall,
   const id = parentValue(parent, call.params);
   const where = Object.entries(parent.where ?? {}).map(([field, template]) => [field, String(fill(template, call.params))] as const);
   const found = (r: TwinResource): boolean => (where.length ? where.every(([field, v]) => String(parentField(r, field)) === v) : r.id === id)
-    && (!m.tenant || m.resources[parent.resource]?.shared || (r as Record<string, unknown>)[m.tenant.field] === tenant);
+    && (!m.tenant || m.tenant.storage === 'namespaced' || m.resources[parent.resource]?.shared || (r as Record<string, unknown>)[m.tenant.field] === tenant);
   return id !== undefined && stored(m, parent.resource, root, { withDeleted: parent.allowDeleted === true }).some(found) ? undefined : notFound(m, parent.resource, String(id), parent.param ?? parent.params?.at(-1));
 }
 
@@ -953,15 +968,34 @@ function worldSeed(service: string, root: string | undefined, at: string): Promi
   const pending = seeding.get(key);
   if (pending) return pending;
   const made = (async () => {
-    const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
-    // the World's own bookkeeping, made on first use whatever the request: a read-only one lands it too (a vendor's move)
-    await runAsVendorMove(() => applyTwinWrite(service, { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } }, root));
+    // The action lock also joins first asks from several renderers/processes to the same seed.
+    const { value } = await runAsVendorMove(() => applyTwinWriteAtomic(service, snapshot => {
+      const existing = snapshot.find(row => row.type === SEED && row.id === 'seed');
+      if (typeof existing?.value === 'string') return { kind: 'skip', value: existing.value };
+      const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
+      return { kind: 'write', value, write: { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } } };
+    }, root));
     return value;
   })().finally(() => seeding.delete(key));
   seeding.set(key, made);
   return made;
 }
 
+/** World-owned generated values use the same private seed and log as pack secrets. */
+export async function worldSecret(service: string, root: string, label: string, at = new Date().toISOString()): Promise<string> {
+  return hmac(await worldSeed(service, root, at), label, 'base64url');
+}
+
+/** The same retained account primitive for pack doors and private native twin fronts. */
+export async function worldAccount(service: string, root: string | undefined, id: unknown = 'default', at = worldNow(), provisioning = false): Promise<string> {
+  if (!isWorldAccountName(id)) throw new Error('Credential account must be a name of at most 128 letters, digits, dots, underscores or hyphens');
+  await applyTwinWriteAtomic(service, (snapshot) => {
+    const held = snapshot.find(row => row.type === '_world_account' && row.id === id);
+    return held ? { kind: 'skip', value: id } : { kind: 'write', value: id, write: { operation: 'world_account.create', subjectType: '_world_account', subjectId: id, fields: { name: id }, ...(provisioning ? { input: { activity: 'provisioning' } } : {}), occurredAt: at, actor: { kind: 'system' } } };
+  }, root);
+  return id;
+}
+
 /** A World's signing key for a label (ctx.signingKey): made once from the platform's random source, then read; the
  *  making is one per service store and label in the process, as the seed's is. */
 const SIGNING_KEY = '_world_signing_key';
@@ -995,7 +1029,13 @@ function worldSigningKey(service: string, root: string | undefined, at: string,
   return made;
 }
 
-function mintId(m: DerivedManifest, resource: string, root?: string, at?: string, snapshot?: readonly TwinResource[]): string {
+/** Vendor ids remain unique across its accounts, including public links that carry an id instead of a key. */
+function mintRows(m: DerivedManifest, resource: string, root?: string, snapshot?: readonly TwinResource[]): readonly TwinResource[] {
+  const base = m.resources[resource]?.storedAs ?? resource;
+  if (m.tenant?.storage === 'namespaced') return (snapshot ?? twinResources(m.service, root)).filter(row => row.type === base || row.type.startsWith(`${base}${TENANT_TYPE}`));
+  return snapshot ? snapshot.filter(row => row.type === base) : resourcesOfType(m.service, base, root);
+}
+function mintId(m: DerivedManifest, resource: string, root: string | undefined, at: string, snapshot?: readonly TwinResource[]): string {
   if (!m.resources[resource]) throw new Error(`mint: ${resource} is not a resource ${m.vendor}'s manifest declares`);
   const prefix = m.resources[resource]!.idPrefix;
   const template = m.resources[resource]!.ids ?? m.ids.template;
@@ -1012,7 +1052,7 @@ function mintId(m: DerivedManifest, resource: string, root?: string, at?: string
   if (digits) {
     const width = Number(digits[1]);
     if (!Number.isInteger(width) || width < 1 || width > 77) throw new Error('mint: decimal width must be between 1 and 77');
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
     const floor = 10n ** BigInt(width - 1);
     for (let n = held.size + 1; ; n++) {
       const id = String(floor + BigInt('0x' + sha256(`${m.service}:${resource}:${n}`)) % (9n * floor));
@@ -1031,7 +1071,7 @@ function mintId(m: DerivedManifest, resource: string, root?: string, at?: string
   const pattern = new RegExp(`^${escapeRe(String(fill(head!, { prefix })))}(\\d+)${escapeRe(String(fill(tail, { prefix })))}$`);
   let max = 0n;
   // the one type, from the index that follows writes (a scan of the whole World per create grew with it)
-  for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root))) {
+  for (const r of mintRows(m, resource, root, snapshot)) {
     const hit = pattern.exec(r.id);
     if (hit && BigInt(hit[1]!) > max) max = BigInt(hit[1]!);
   }
@@ -1045,13 +1085,13 @@ function mintId(m: DerivedManifest, resource: string, root?: string, at?: string
 /** The last snowflake minted per vendor and World in this process: two mints before the first is written (a message
  *  and its attachment) must not meet. */
 const lastSnowflake = new Map<string, bigint>();
-function mintSnowflake(m: DerivedManifest, epoch: bigint, root?: string, at?: string, snapshot?: readonly TwinResource[]): string {
-  const ms = BigInt(Date.parse(at ?? '') || 0);
+function mintSnowflake(m: DerivedManifest, epoch: bigint, root: string | undefined, at: string, snapshot?: readonly TwinResource[]): string {
+  const ms = BigInt(Date.parse(at) || 0);
   const base = ms > epoch ? (ms - epoch) << 22n : 0n;
   let max = -1n;
   for (const [name, decl] of Object.entries(m.resources)) {
     if (!/^\{snowflake:\d+\}$/.test(decl.ids ?? m.ids.template)) continue;
-    for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, name)) : resourcesOfType(m.service, storedType(m, name), root))) if (/^\d+$/.test(r.id)) { const v = BigInt(r.id); if (v > max) max = v; }
+    for (const r of mintRows(m, name, root, snapshot)) if (/^\d+$/.test(r.id)) { const v = BigInt(r.id); if (v > max) max = v; }
   }
   const key = `${m.service}\0${root ?? ''}`;
   const last = lastSnowflake.get(key) ?? -1n;
@@ -1063,9 +1103,9 @@ function mintSnowflake(m: DerivedManifest, epoch: bigint, root?: string, at?: st
 
 /** The next KSUID for a resource (Clerk's and Svix's ids, `ksuidFrom`): the World's instant, then the type's mint
  *  count, so a frozen clock still lists them as made; past any the World already holds. */
-function mintKsuid(m: DerivedManifest, resource: string, at: string | undefined, root?: string, prefix = '', snapshot?: readonly TwinResource[], width = 27): string {
-  const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
-  const seconds = Math.floor((Date.parse(at ?? '') || 0) / 1000);
+function mintKsuid(m: DerivedManifest, resource: string, at: string, root: string | undefined, prefix: string, snapshot: readonly TwinResource[] | undefined, width: number): string {
+  const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
+  const seconds = Math.floor((Date.parse(at) || 0) / 1000);
   for (let n = held.size + 1; ; n++) {
     const id = `${prefix}${ksuidFrom(seconds, n, `${m.service}:${resource}:${n}`, width)}`;
     if (!held.has(id)) return id;
@@ -1074,8 +1114,8 @@ function mintKsuid(m: DerivedManifest, resource: string, at: string | undefined,
 
 /** The next id of `count` lowercase letters for a resource, derived from the resource and the count before it, past
  *  any the World already holds. */
-function mintLetters(m: DerivedManifest, resource: string, count: number, root?: string, prefix = '', snapshot?: readonly TwinResource[]): string {
-  const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+function mintLetters(m: DerivedManifest, resource: string, count: number, root: string | undefined, prefix: string, snapshot?: readonly TwinResource[]): string {
+  const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
     const id = `${prefix}${lettersFrom(`${m.service}:${resource}:${n}`, count)}`;
     if (!held.has(id)) return id;
@@ -1084,8 +1124,8 @@ function mintLetters(m: DerivedManifest, resource: string, count: number, root?:
 
 /** The next hex id for a resource: N hex digits derived from the resource and the count before it, past any the World
  *  already holds (a Cloudflare id, 32). */
-function mintHex(m: DerivedManifest, resource: string, count: number, root?: string, prefix = '', snapshot?: readonly TwinResource[]): string {
-  const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+function mintHex(m: DerivedManifest, resource: string, count: number, root: string | undefined, prefix: string, snapshot?: readonly TwinResource[]): string {
+  const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
     const id = `${prefix}${sha256(`${m.service}:${resource}:${n}`).slice(0, count)}`;
     if (!held.has(id)) return id;
@@ -1095,8 +1135,7 @@ function mintHex(m: DerivedManifest, resource: string, count: number, root?: str
 /** The next UUID for a resource: a version-4-shaped UUID derived from the resource and the count before it, past any
  *  the World already holds. */
 function mintUuid(m: DerivedManifest, resource: string, root?: string, snapshot?: readonly TwinResource[]): string {
-  const type = storedType(m, resource);
-  const held = new Set((snapshot ? snapshot.filter((r) => r.type === type) : resourcesOfType(m.service, type, root)).map((r) => r.id));
+  const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
     const id = uuidFrom(`${m.service}:${resource}:${n}`);
     if (!held.has(id)) return id;
@@ -1352,13 +1391,14 @@ async function finishWrite(m: DerivedManifest, call: DerivedCall, resource: stri
   // the managed database), at the write's moment
   const request = requestOfCall.get(call) ?? call.request;
   const context = (): Promise<SemanticsContext> => contextFor(m, { ...call, request: request.clone() }, { ...(scopeOfCall.get(call) ?? {}), ...(root !== undefined ? { root } : {}), clock: () => occurredAt });
-  if (m.onWrite) await m.onWrite({ operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone(), context });
+  if (m.onWrite) await m.onWrite({ operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone(), context });
   if (m.events) {
-    const events = m.events;
-    const write = { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() };
+    const endpoint = (kind: import('./events.ts').EndpointsDecl): import('./events.ts').EndpointsDecl => ({ ...kind, storedAs: storedType(m, kind.storedAs), ...(kind.joins ? { joins: Object.fromEntries(Object.entries(kind.joins).map(([name, join]) => [name, { ...join, storedAs: storedType(m, join.storedAs) }])) } : {}) });
+    const events = { ...m.events, ...(m.events.store ? { store: storedType(m, m.events.store) } : {}), endpoints: 'storedAs' in m.events.endpoints ? endpoint(m.events.endpoints) : m.events.endpoints.map(endpoint) };
+    const write = { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() };
     await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values!(await context(), write, type) : undefined);
   }
-  if (m.sockets?.length) socketWrite(m.service, root, { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() });
+  if (m.sockets?.length) socketWrite(m.service, root, { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() });
   // a read held until the World writes (held-reads.ts) hears it
   heldReadsWrite(m.service, root, storedType(m, resource));
   // the subject's id as it stands after the write: the vendor's, when a live head minted one
@@ -1517,21 +1557,21 @@ function adoptedPath(m: DerivedManifest, call: DerivedCall, root?: string): Deri
 /** A call's fields with each declared reference that names an adopted subject by its local id moved to the adopted
  *  id. A call (a handler's operation) need not say which subject type it writes, so every reference the pack declares
  *  is tried: a field is rewritten only when its value is a local id the alias map holds for the reference's target. */
-function adoptedInCall(service: string, fields: Record<string, unknown>, root?: string): Record<string, unknown> {
-  const refs = packReferences(service);
+function adoptedInCall(m: DerivedManifest, fields: Record<string, unknown>, root?: string): Record<string, unknown> {
+  const service = m.service, refs = packReferences(service);
   if (refs.length === 0) return fields;
   const aliases = aliasesNow(service, root);
   if (aliases.size === 0) return fields;
   let out = fields;
   for (const ref of refs) {
     const local = ref.key(out as SubjectFields);
-    const adopted = local === undefined ? undefined : aliases.get(`${ref.to}:${local}`);
+    const adopted = local === undefined ? undefined : aliases.get(`${storedType(m, ref.to)}:${local}`);
     if (adopted !== undefined && adopted !== local) out = { ...out, ...ref.adopt(out as SubjectFields, adopted) };
   }
   return out;
 }
 async function boundaryParams(m: DerivedManifest, call: DerivedCall, root?: string): Promise<Record<string, unknown>> {
-  return adoptedInCall(m.service, await readParams(m, call.request, call.operation), root);
+  return adoptedInCall(m, await readParams(m, call.request, call.operation), root);
 }
 
 /** The refusal a subject's fields would draw from its resource's `unique` rules: another live subject (not `except`)
@@ -1726,7 +1766,7 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
   const parent = parentOfCall(decl, call);
   const parentId = parent ? parentValue(parent, call.params) : undefined;
   // the caller's tenant, when the vendor has tenancy and the resource is not shared by every tenant
-  const tenantField = m.tenant && !decl.shared ? m.tenant.field : undefined;
+  const tenantField = m.tenant?.storage !== 'namespaced' && m.tenant && !decl.shared ? m.tenant.field : undefined;
   const tenant = tenantField && scope.tenant ? await scope.tenant(await contextFor(m, { ...call, request: call.request.clone() }, scope)) : undefined;
   if (tenantField && tenant === undefined) return { unmodeled: `the caller names no tenant (semantics/tenant.ts) for ${resource}` };
   const orphan = missingParent(m, resource, call, root, tenant);
@@ -1917,6 +1957,8 @@ export type SemanticsContext = {
    *  random, and keeps as bookkeeping no door answers. The same label gives the same secret for the World's whole life,
    *  and no one can compute it from ids the World shows, as they can a value derived from them alone. */
   secret(label: string): Promise<string>;
+  /** Select an account at a pack's credential door. Packs retain their own vendor account/key semantics. */
+  account(field?: string): Promise<string>;
   /** The World's machine pool (machines.ts), as the pack's `machine-pool` door enrolled it; `none` when none was. */
   machines: MachinePool;
   /** A signing key pair for `label` (an issuer's ID tokens, a provider's JWTs, a CA's or a log's key), PEM: RSA 2048
@@ -1930,7 +1972,7 @@ export type SemanticsContext = {
   /** Allocate a stored occurrence and append its fields under one action lock. The optional field factory is pure. */
   create(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string): Promise<Record<string, unknown>>;
   /** Create under declared unique keys and the action lock; a collision returns the existing own-field view without a write. */
-  createUnique(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string, options?: { input: 'omit' }): Promise<{ created: boolean; row: Record<string, unknown> }>;
+  createUnique(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string, options?: { input?: 'omit'; id?: string }): Promise<{ created: boolean; row: Record<string, unknown> }>;
   /** Decide an update from the current live stored row under the action lock; undefined leaves it unchanged. */
   change(resource: string, id: string, decide: (row: Record<string, unknown>) => Record<string, unknown> | undefined, operation: string, options?: { input: 'omit' }): Promise<Record<string, unknown> | undefined>;
   write(resource: string, id: string, fields: Record<string, unknown>, operation: string): Promise<Record<string, unknown>>;
@@ -2098,7 +2140,7 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
   const raw = !parts && typeof body === 'string' && body !== '' ? await rawBody(call.request) : undefined;
   sentOf.set(call, { ...sentRequest(m, asAsked, parts ? Object.fromEntries(parts.filter((p) => p.filename === null).map((p) => [p.name, new TextDecoder().decode(p.body)])) : raw ?? body), ...(parts ? { parts } : {}), ...(raw ? { type: call.request.headers.get('content-type') ?? undefined } : {}) });
   // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
-  if (body && typeof body === 'object' && !Array.isArray(body)) body = adoptedInCall(m.service, body as Record<string, unknown>, root);
+  if (body && typeof body === 'object' && !Array.isArray(body)) body = adoptedInCall(m, body as Record<string, unknown>, root);
   // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
   // still find it unread, whichever of them reads it first
   const pristine = call.request.clone();
@@ -2114,6 +2156,13 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
   const rawResources = new WeakMap<Record<string, unknown>, string>();
   const rawRow = (resource: string, row: TwinResource): Record<string, unknown> => {
     const name = m.resources[resource] ? resource : Object.keys(m.resources).find((name) => storedType(m, name) === row.type);
+    if (m.tenant?.storage === 'namespaced') {
+      const [base, encoded] = row.type.split(TENANT_TYPE);
+      const owner = m.resources[name ?? resource]?.shared && row[m.tenant.field] !== undefined ? row[m.tenant.field] : encoded ? decodeURIComponent(encoded) : 'default';
+      row = copyResource(row);
+      row.type = base!;
+      row[m.tenant.field] = owner;
+    }
     rawResources.set(row as Record<string, unknown>, name ?? resource);
     return row as Record<string, unknown>;
   };
@@ -2131,7 +2180,7 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     asVendor: (fn) => runAsVendorMove(fn),
     git: (name) => {
       if (!/^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$/.test(name) || name.split('/').some((seg) => seg === '.' || seg === '..')) throw new Error(`semantics: ${name} is not a git repository name`);
-      const plane = `${worldPaths(m.service, root).dir}/git`;
+      const plane = `${worldPaths(m.service, root).dir}/git${accountScope(m) && accountScope(m) !== 'default' ? `/accounts/${encodeURIComponent(accountScope(m)!)}` : ''}`;
       return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/repos/${name}`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
     },
     mail: (route, mail, headers) => sendMail(route, mail, headers),
@@ -2168,16 +2217,20 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
       return value;
     },
     occurredAt: at,
-    secret: async (label) => hmac(await worldSeed(m.service, root, at), label, 'base64url'),
+    secret: async (label) => hmac(await worldSeed(m.service, root, at), scopeLabel(m, label), 'base64url'),
+    account: async (field = 'account') => {
+      const fields = body && typeof body === 'object' && !Array.isArray(body) ? body as Record<string, unknown> : {};
+      return worldAccount(m.service, root, fields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+    },
     record: async (type, fields, id, operation) => {
       if (!type.startsWith('_')) throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
       // a bookkeeping subject a resource counts (`counts` naming it: sentry's issue users) keeps that count as any
       // child does, the parent it left recounted too
-      const keeps = counted(m, type);
+      const keeps = counted(m, type), physicalType = storedType(m, type);
       if (id !== undefined) {
         const before = operation ? stateBeforeWrite(m, type, id, root) : undefined;
-        const prior = keeps ? resourcesOfType(m.service, type, root).find((r) => r.id === id) : undefined;
-        const { resource: row, result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: id, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } }, root);
+        const prior = keeps ? resourcesOfType(m.service, physicalType, root).find((r) => r.id === id) : undefined;
+        const { resource: row, result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: physicalType, subjectId: id, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } }, root);
         if (operation) observeStateWrite(m, result, before, root, stateChecks);
         if (keeps) await keepCounts(m, call, type, row as unknown as Record<string, unknown>, params, root, at, prior && { ...prior } as Record<string, unknown>);
         return id;
@@ -2188,25 +2241,25 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
           const prefix = `${type.slice(1)}_`;
           let max = 0n;
           for (const r of resources) {
-            if (r.type !== type) continue;
+            if (r.type !== physicalType) continue;
             const digits = r.id.startsWith(prefix) ? r.id.slice(prefix.length) : '';
             if (/^\d+$/.test(digits) && BigInt(digits) > max) max = BigInt(digits);
           }
           return `${prefix}${max + 1n}`;
         })();
-        return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } } };
-      }, root, () => resourcesOfType(m.service, type, root));
+        return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: physicalType, subjectId: subject, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } } };
+      }, root, () => resourcesOfType(m.service, physicalType, root));
       if (operation && result) observeStateWrite(m, result, undefined, root, stateChecks);
-      const made = keeps && value !== undefined ? resourcesOfType(m.service, type, root).find((r) => r.id === value) : undefined;
+      const made = keeps && value !== undefined ? resourcesOfType(m.service, physicalType, root).find((r) => r.id === value) : undefined;
       if (made) await keepCounts(m, call, type, made as unknown as Record<string, unknown>, params, root, at);
       return value;
     },
     get machines() {
-      const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool') as unknown as (LightPoolOptions & { kind?: MachinePool['kind']; httpReplies?: MachineHttpReply[] }) | undefined;
-      return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies, { images: enrolled?.images }), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
+      const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool') as unknown as { kind?: MachinePool['kind']; httpReplies?: MachineHttpReply[] } | undefined;
+      return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
     },
-    signingKey: (label, alg) => worldSigningKey(m.service, root, at, label, alg ?? 'RS256'),
-    heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, label, alg ?? 'RS256'),
+    signingKey: (label, alg) => worldSigningKey(m.service, root, at, scopeLabel(m, label), alg ?? 'RS256'),
+    heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, scopeLabel(m, label), alg ?? 'RS256'),
     create: (resource, fields, operation) => atomicWrite(m, call, resource, (snapshot) => {
       const id = mintId(m, resource, root, at, snapshot);
       return { id, fields: typeof fields === 'function' ? fields(id) : fields };
@@ -2217,7 +2270,7 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
       if (!rules?.length) throw new Error('createUnique requires declared unique keys');
       let existing: Record<string, unknown> | undefined;
       const row = await atomicWrite(m, call, resource, (snapshot) => {
-        const id = mintId(m, resource, root, at, snapshot);
+        const id = options?.id ?? mintId(m, resource, root, at, snapshot);
         const selected = typeof fields === 'function' ? fields(id) : fields;
         const hit = snapshot.find((r) => r.type === storedType(m, resource) && r.deleted !== true && rules.some((rule) => rule.fields.every((f) => selected[f] !== undefined && view(m, resource, r)[f] === selected[f])));
         if (hit) { existing = view(m, resource, hit); return undefined; }
@@ -2255,7 +2308,16 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
     row: (resource, id, opts) => { const row = stored(m, resource, root, opts).find((r) => r.id === id); return row ? rawRow(resource, row) : undefined; },
     rowsRaw: (resource, opts) => stored(m, resource, root, opts).map((row) => rawRow(resource, row)),
-    tree: () => twinResources(m.service, root) as Array<Record<string, unknown>>,
+    tree: () => {
+      const rows = twinResources(m.service, root);
+      if (m.tenant?.storage !== 'namespaced') return rows as Array<Record<string, unknown>>;
+      const account = accountScope(m);
+      return rows.filter(row => {
+        const [base, encoded] = row.type.split(TENANT_TYPE);
+        const name = Object.keys(m.resources).find(name => (m.resources[name]?.storedAs ?? name) === base) ?? base!;
+        return account === undefined || m.resources[name]?.shared || (encoded ? decodeURIComponent(encoded) : 'default') === account;
+      }).map(row => rawRow(row.type.split(TENANT_TYPE)[0]!, row));
+    },
     history: (resource, id) => subjectHistory(m.service, { type: storedType(m, resource), id }, root).map((e) => ({ ...(e.operation ? { operation: e.operation } : {}), ...(e.fields ? { fields: e.fields as Record<string, unknown> } : {}), ...(e.occurredAt ? { occurredAt: e.occurredAt } : {}) })),
     raw: (body, init = {}) => new Response(body, { status: init.status ?? 200, headers: init.headers ?? {} }),
     atomically: async (decide) => {
@@ -2309,17 +2371,17 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request) }),
     redis: (commands, options) => execRedisRun(commands, {
       root, occurredAt: at, service: m.service, readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), dialect: options.dialect,
-      ...(options.database === undefined ? {} : { database: options.database }),
+      ...(accountScope(m) && accountScope(m) !== 'default' ? { database: scopeLabel(m, options.database ?? 'default') } : options.database === undefined ? {} : { database: options.database }),
       ...(options.transaction === undefined ? {} : { transaction: options.transaction }),
     }),
-    live: liveAccess({ rows: (type) => resourcesOfType(m.service, type, root) as unknown as Array<Record<string, unknown>>, blob: (key) => readResourceBlob(m.service, key, root) }, call.request),
+    live: liveAccess({ rows: (type) => stored(m, type, root).map(row => rawRow(type, row)), blob: (key) => readResourceBlob(m.service, scopeLabel(m, key), root) }, call.request),
     blobs: {
-      put: (key, bytes) => writeResourceBlob(m.service, key, bytes, root),
-      putStream: (key, body, accept) => writeResourceBlobStream(m.service, key, body, accept, root),
-      get: (key) => readResourceBlob(m.service, key, root),
-      remove: (key) => removeResourceBlob(m.service, key, root),
-      size: (key) => resourceBlobSize(m.service, key, root),
-      range: (key, start, endInclusive) => readResourceBlobRange(m.service, key, start, endInclusive, root),
+      put: (key, bytes) => writeResourceBlob(m.service, scopeLabel(m, key), bytes, root),
+      putStream: (key, body, accept) => writeResourceBlobStream(m.service, scopeLabel(m, key), body, accept, root),
+      get: (key) => readResourceBlob(m.service, scopeLabel(m, key), root),
+      remove: (key) => removeResourceBlob(m.service, scopeLabel(m, key), root),
+      size: (key) => resourceBlobSize(m.service, scopeLabel(m, key), root),
+      range: (key, start, endInclusive) => readResourceBlobRange(m.service, scopeLabel(m, key), start, endInclusive, root),
     },
     merge: (resource, prior, next) => mergeField(m.resources[resource]?.update, prior, next),
     conflict: (resource, fields, except) => {
@@ -2614,7 +2676,7 @@ export function authRefusal(m: DerivedManifest, request: Request, root?: string)
   const held = m.auth.held;
   if (held && !held.standing?.includes(key)) {
     const hash = sha256(key);
-    const holds = resourcesOfType(m.service, held.storedAs, root).some((r) => r.deleted !== true && (r as Record<string, unknown>)[held.hashField] === hash && (held.unless === undefined || (r as Record<string, unknown>)[held.unless] !== true));
+    const holds = stored(m, held.storedAs, root).some((r) => r.deleted !== true && (r as Record<string, unknown>)[held.hashField] === hash && (held.unless === undefined || (r as Record<string, unknown>)[held.unless] !== true));
     if (!holds) return vendorError(errorManifest, invalid);
   }
   return undefined;
@@ -2691,7 +2753,7 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
     const url = new URL(request.url);
     const signature = hashFieldValue({ path: url.pathname + url.search, body: await bodyTextOf(request.clone()) });
     const id = `idem_${hex(key)}`;
-    const prior = twinResources(m.service, opts.root).find((r) => r.type === m.idempotency!.storedAs && r.id === id) as Record<string, unknown> | undefined;
+    const prior = twinResources(m.service, opts.root).find((r) => r.type === storedType(m, m.idempotency!.storedAs) && r.id === id) as Record<string, unknown> | undefined;
     if (prior) {
       if (m.idempotency.conflict && prior.requestHash !== undefined && prior.requestHash !== signature) return vendorError(m, m.idempotency.conflict);
       const answer = prior.response as { status: number; body?: unknown; text?: string; contentType?: string };
@@ -2704,7 +2766,7 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
     if (m.idempotency.onlySuccess && (response.status < 200 || response.status >= 300)) return response;
     const contentType = response.headers.get('content-type') ?? 'application/json';
     const text = await response.clone().text();
-    await applyTwinWrite(m.service, { operation: 'idempotency.record', subjectType: m.idempotency.storedAs, subjectId: id, fields: { response: { status: response.status, text, contentType }, requestHash: signature }, occurredAt: (opts.clock ?? worldNow)(), actor: { kind: 'system' } }, opts.root);
+    await applyTwinWrite(m.service, { operation: 'idempotency.record', subjectType: storedType(m, m.idempotency.storedAs), subjectId: id, fields: { response: { status: response.status, text, contentType }, requestHash: signature }, occurredAt: (opts.clock ?? worldNow)(), actor: { kind: 'system' } }, opts.root);
     return response;
   }
 }

package/src/index.ts

@@ -63,8 +63,8 @@ export { assetContentType, packAsset } from './pack-assets.ts';
 export { bytesResponse, contentTypeOf, fileResponse } from './file-response.ts';
 
 // ── the kernel's deterministic helpers ─────────────────────────────────────────────────────────
-export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtVerify, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from './signing.ts';
-export type { HandlerCrypto, Jwk, Jwks, JwtVerdict, SigningKey } from './signing.ts';
+export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtSignClaims, jwtVerify, jwtVerifySignature, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from './signing.ts';
+export type { HandlerCrypto, Jwk, Jwks, JwtDecodeOptions, JwtSignatureOptions, JwtVerdict, JwtVerificationKey, SigningKey } from './signing.ts';
 export { blobDigest } from './blob-store.ts';
 // compressed bytes a wire carries (a SARIF upload), over web streams
 export { gunzip, gzip } from './bytes.ts';
@@ -109,3 +109,6 @@ export { assertBrowserName, browserOrigin, validateBrowserState, validateBrowser
 
 export * as managedOriginalInputs from './managed-original-inputs.ts';
 export * as managedGoPrograms from './managed-go-programs.ts';
+
+export { worldSecret, worldAccount } from './derived-core.ts';
+export { isWorldAccountName } from './world-account-name.ts';

package/src/live/rtmp.ts

@@ -204,6 +204,9 @@ export function rtmpSession(sink: TwinStreamSink, publisher: RtmpPublisher, log:
   const media = async (hand: () => void | Promise<void>): Promise<void> => {
     try { await hand(); } catch (error) {
       if (!(error instanceof RtmpRefusal)) throw error;
+      // said in the World's log too, not only to the publisher: an ended broadcast is otherwise unreadable afterwards
+      // (the stream key is the publish name, so it is never logged)
+      log(`a publish to ${app || 'its app'} was refused and ended: ${error.message}`);
       status(publishStream, 'error', error.code, error.message);
       await stop();
       close();

package/src/machines.ts

@@ -3,14 +3,12 @@
 // `POST /_twin/machine-pool`, recorded in the pack's own tree; a handler reaches it as `ctx.machines`. `docker` runs
 // each machine as a local container with its internal ports published on loopback; `none` runs nothing; `fake`
 // records what it was asked (capability verification). Nothing here runs at module scope, and `node:child_process`
-// is reached only when a compute pool is asked to act. The light pool delegates to the host's Substrate adapter.
+// is reached only when a compute pool is asked to act.
 import { refuseReadOnlyWrite } from './request-scope.ts';
 import { nodeBuiltin } from './serve-http.ts';
 import { refuseRequiredMachineTransport } from '../required-credential-transport.cjs';
 
 export type MachineSpec = { name: string; image: string; env?: Record<string, string>; ports?: number[]; command?: string[]; checks?: Array<{ port: number; type: 'http' | 'tcp'; path?: string }>; resetOnStop?: boolean; mounts?: Array<{ name: string; path: string }>; signal?: AbortSignal; startTimeoutMs?: number };
-export type GuestImage = { context: string; dockerfile?: string; runtime?: 'node' | 'bun' | 'python' | 'deno'; command?: string[]; cwd?: string; env?: Record<string, string>; prepared?: boolean };
-export type LightPoolOptions = { images?: Record<string, GuestImage> };
 export type MachineRun = { ports: Array<{ internal: number; host: number; url?: string }> };
 export type MachineStatus = { state: 'started' | 'paused' | 'stopped' | 'exited' | 'failed'; exitCode?: number; reason?: string };
 export type MachineFileStat = { type: 'file' | 'directory'; size: number; mode: number; mtime: string };
@@ -27,7 +25,7 @@ export type MachineProcess = { pid: number; events: AsyncIterable<{ stdout?: str
 export type ExecSpec = { args: string[]; env?: Record<string, string>; cwd?: string };
 export type MachineHttpReply = { port: number; method: string; path: string; requestText?: string; status: number; headers?: Record<string, string>; body?: string };
 export type MachinePool = {
-  readonly kind: 'docker' | 'none' | 'fake' | 'light';
+  readonly kind: 'docker' | 'none' | 'fake';
   /** Optional capability admission, before vendor resource creation; starts no process. */
   admitRun?(spec: MachineSpec): Promise<void>;
   /** runs the image; a failure (no container runtime, an image that will not start) rejects with the runtime's message */
@@ -51,33 +49,7 @@ export function isMachineCapabilityGap(error: unknown): boolean {
   return typeof error === 'object' && error !== null && 'code' in error && error.code === 'WORLD_MACHINE_CAPABILITY_GAP';
 }
 export const MACHINE_POOL = '_machine_pool';
-export const POOL_KINDS = ['docker', 'none', 'fake', 'light'] as const;
-
-/** The host owns provider bootstrapping. Browser/kernel imports stay inert, and a missing
- * host provider refuses rather than falling back to metadata-only success. */
-function lightPool(world: string, root: string | undefined, options: LightPoolOptions): MachinePool {
-  let ready: Promise<MachinePool> | undefined;
-  const load = (): Promise<MachinePool> => ready ??= (async () => {
-    const entry = typeof process === 'undefined' ? undefined : process.env.VOLTER_WORLD_GUEST_RUNNER;
-    if (!entry) throw new Error('light guest runner is unavailable: run this twin inside a World');
-    const provider = await import(entry);
-    return provider.createLightGuestPool({ world, root, ...options }) as MachinePool;
-  })();
-  return {
-    kind: 'light',
-    admitRun: async (spec) => { await (await load()).admitRun?.(spec); },
-    run: async (spec) => (await load()).run(spec),
-    exec: async (name, spec) => (await load()).exec(name, spec),
-    request: async (name, port, request) => (await load()).request(name, port, request),
-    status: async (name) => (await load()).status(name),
-    ports: async (name) => (await load()).ports(name),
-    files: async (name) => (await load()).files(name),
-    pause: async (name) => (await load()).pause(name),
-    resume: async (name) => (await load()).resume(name),
-    stop: async (name) => (await load()).stop(name),
-    remove: async (name) => (await load()).remove(name),
-  };
-}
+export const POOL_KINDS = ['docker', 'none', 'fake'] as const;
 
 /** A container's name for a machine: the World's prefix, the World's own mark (a machine id repeats across Worlds and
  *  branches, which mint alike), then the vendor's machine name made safe for docker. */
@@ -100,8 +72,8 @@ function dockerPool(world: string): MachinePool {
       const state = JSON.parse(await docker(['inspect', '--format', '{{json .State}}', containerName(world, name)]));
       return state.Running ? { state: 'started' } : { state: 'exited', exitCode: state.ExitCode, ...(state.Error ? { reason: state.Error } : {}) };
     },
-    async ports() { throw new Error('port discovery requires the light guest backing'); },
-    async files() { throw new Error('file access requires the light guest backing'); },
+    async ports() { throw new Error('port discovery is unavailable'); },
+    async files() { throw new Error('file access is unavailable'); },
     async run(spec) {
       refuseRequiredMachineTransport(process.env, 'Docker machine application transport');
       const name = containerName(world, spec.name);
@@ -187,8 +159,8 @@ function dockerPool(world: string): MachinePool {
 }
 
 /** The pool of a kind, for a World (`world`: the mark its containers carry). */
-export function machinePool(kind: MachinePool['kind'], world = 'world', httpReplies: readonly MachineHttpReply[] = [], light: LightPoolOptions = {}, root?: string): MachinePool {
-  if (kind === 'light') return lightPool(world, root, light);
+export function machinePool(kind: MachinePool['kind'], world = 'world', httpReplies: readonly MachineHttpReply[] = []): MachinePool {
+  if (!POOL_KINDS.includes(kind)) throw new Error(`kind must be one of ${POOL_KINDS.join(', ')}`);
   if (kind === 'docker') return dockerPool(world);
   if (kind === 'fake') {
     const asked: NonNullable<MachinePool['asked']> = [];
@@ -237,14 +209,14 @@ export function machinePool(kind: MachinePool['kind'], world = 'world', httpRepl
 
 /** A vendor's pool in a World, one per World and kind for the life of the process (a fake pool keeps what it was asked). */
 const pools = new Map<string, MachinePool>();
-export function poolFor(service: string, root: string | undefined, kind: MachinePool['kind'], httpReplies: readonly MachineHttpReply[] = [], light: LightPoolOptions = {}): MachinePool {
-  const key = `${service}\0${root ?? ''}\0${kind}${kind === 'light' ? JSON.stringify(light) : ''}`;
+export function poolFor(service: string, root: string | undefined, kind: MachinePool['kind'], httpReplies: readonly MachineHttpReply[] = []): MachinePool {
+  const key = `${service}\0${root ?? ''}\0${kind}`;
   let pool = pools.get(key);
   if (!pool) {
     // the World's mark: a short digest of the vendor and the World's tree, so two Worlds' machines never share a name
     let h = 0;
     for (const ch of `${service}:${root ?? ''}`) h = (Math.imul(h, 31) + ch.charCodeAt(0)) >>> 0;
-    pool = machinePool(kind, h.toString(16).padStart(8, '0'), httpReplies, light, root);
+    pool = machinePool(kind, h.toString(16).padStart(8, '0'), httpReplies);
     pools.set(key, pool);
   }
   return pool;