@volter/world-core 3.0.161 → 3.0.162

package/dist/src/derived-core.js

@@ -1,3 +1,5 @@
+import { storageTenant } from "./request-scope.js";
+import { isWorldAccountName } from "./world-account-name.js";
 import { parseExactJson, compareExactNumbers, exactInteger, isExactIntegerValue } from "./exact-json.js";
 // THE DERIVED CORE — what a derived pack does for an operation it declares no handler for
 // (docs/contributing/architecture.md, "Protocol 3"). The generated surface says what the
@@ -235,7 +237,13 @@ function notFound(manifest, object, id, param) {
     return vendorError(manifest, { status: nf.status, message: String(fill(message, { object, id })), ...(code ? { code } : {}), ...(nf.kind ? { kind: nf.kind } : {}), ...(param ? { param } : {}) });
 }
 // ── the tree ─────────────────────────────────────────────────────────────────────────────────
-export const storedType = (m, resource) => m.resources[resource]?.storedAs ?? resource;
+const TENANT_TYPE = '::account:';
+const accountScope = (m) => m.tenant?.storage === 'namespaced' ? storageTenant(m.service) : undefined;
+const scopeLabel = (m, label) => { const account = accountScope(m); return account && account !== 'default' ? `account:${account}:${label}` : label; };
+export const storedType = (m, resource) => {
+    const base = m.resources[resource]?.storedAs ?? resource, account = accountScope(m);
+    return account && account !== 'default' && !m.resources[resource]?.shared ? `${base}${TENANT_TYPE}${encodeURIComponent(account)}` : base;
+};
 // A service's resources by type, folded once per World state (the tree's stamp; any write moves it), not on every read:
 // a read of one resource type projected the service's whole tree, so a pack whose tree also holds many subjects of
 // other types (PlanetScale's SQL rows beside its management records) paid for all of them on each read. A read gets its
@@ -254,9 +262,15 @@ export function resourcesOfType(service, type, root) {
     if (held && delta) {
         // the index keeps the tree's order: a subject updated where it stands stays there, one new to the tree (or made
         // again after a delete) goes to the end in the order the tree holds it
-        for (const k of [...delta.removed, ...delta.appended])
-            held.byType.get(k.slice(0, k.indexOf(':')))?.delete(k);
+        for (const k of [...delta.removed, ...delta.appended]) {
+            const type = held.typeByKey.get(k);
+            if (type !== undefined)
+                held.byType.get(type)?.delete(k);
+            held.typeByKey.delete(k);
+        }
         const byKey = new Map(delta.changed.map((r) => [`${r.type}:${r.id}`, r]));
+        for (const [k, r] of byKey)
+            held.typeByKey.set(k, r.type);
         for (const [k, r] of byKey)
             if (!delta.appended.includes(k))
                 (held.byType.get(r.type) ?? held.byType.set(r.type, new Map()).get(r.type)).set(k, r);
@@ -273,7 +287,7 @@ export function resourcesOfType(service, type, root) {
             const byType = new Map();
             for (const r of twinResources(service, root))
                 (byType.get(r.type) ?? byType.set(r.type, new Map()).get(r.type)).set(`${r.type}:${r.id}`, r);
-            held = { stamp, byType };
+            held = { stamp, byType, typeByKey: new Map([...byType].flatMap(([type, rows]) => [...rows.keys()].map(key => [key, type]))) };
             indexes.set(key, held);
         }
     }
@@ -282,7 +296,9 @@ export function resourcesOfType(service, type, root) {
 function stored(m, resource, root, opts = {}) {
     const type = storedType(m, resource);
     const when = Object.entries(m.resources[resource]?.readableWhen ?? {});
-    return resourcesOfType(m.service, type, root).filter((r) => (opts.withDeleted || r.deleted !== true) && when.every(([k, v]) => r[k] === v));
+    const rows = m.tenant?.storage === 'namespaced' && accountScope(m) === undefined && !m.resources[resource]?.shared
+        ? twinResources(m.service, root).filter(row => row.type === type || row.type.startsWith(`${type}${TENANT_TYPE}`)) : resourcesOfType(m.service, type, root);
+    return rows.filter((r) => (opts.withDeleted || r.deleted !== true) && when.every(([k, v]) => r[k] === v));
 }
 /** The subject an item operation names: the manifest's key over the path parameters, or the last one. */
 function subjectOf(m, resource, call) {
@@ -317,7 +333,7 @@ function missingParent(m, resource, call, root, tenant) {
     const id = parentValue(parent, call.params);
     const where = Object.entries(parent.where ?? {}).map(([field, template]) => [field, String(fill(template, call.params))]);
     const found = (r) => (where.length ? where.every(([field, v]) => String(parentField(r, field)) === v) : r.id === id)
-        && (!m.tenant || m.resources[parent.resource]?.shared || r[m.tenant.field] === tenant);
+        && (!m.tenant || m.tenant.storage === 'namespaced' || m.resources[parent.resource]?.shared || r[m.tenant.field] === tenant);
     return id !== undefined && stored(m, parent.resource, root, { withDeleted: parent.allowDeleted === true }).some(found) ? undefined : notFound(m, parent.resource, String(id), parent.param ?? parent.params?.at(-1));
 }
 /** The vendor's view of a stored subject: its own fields, bookkeeping (`_`) left out. */
@@ -430,14 +446,33 @@ function worldSeed(service, root, at) {
     if (pending)
         return pending;
     const made = (async () => {
-        const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
-        // the World's own bookkeeping, made on first use whatever the request: a read-only one lands it too (a vendor's move)
-        await runAsVendorMove(() => applyTwinWrite(service, { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } }, root));
+        // The action lock also joins first asks from several renderers/processes to the same seed.
+        const { value } = await runAsVendorMove(() => applyTwinWriteAtomic(service, snapshot => {
+            const existing = snapshot.find(row => row.type === SEED && row.id === 'seed');
+            if (typeof existing?.value === 'string')
+                return { kind: 'skip', value: existing.value };
+            const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
+            return { kind: 'write', value, write: { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } } };
+        }, root));
         return value;
     })().finally(() => seeding.delete(key));
     seeding.set(key, made);
     return made;
 }
+/** World-owned generated values use the same private seed and log as pack secrets. */
+export async function worldSecret(service, root, label, at = new Date().toISOString()) {
+    return hmac(await worldSeed(service, root, at), label, 'base64url');
+}
+/** The same retained account primitive for pack doors and private native twin fronts. */
+export async function worldAccount(service, root, id = 'default', at = worldNow(), provisioning = false) {
+    if (!isWorldAccountName(id))
+        throw new Error('Credential account must be a name of at most 128 letters, digits, dots, underscores or hyphens');
+    await applyTwinWriteAtomic(service, (snapshot) => {
+        const held = snapshot.find(row => row.type === '_world_account' && row.id === id);
+        return held ? { kind: 'skip', value: id } : { kind: 'write', value: id, write: { operation: 'world_account.create', subjectType: '_world_account', subjectId: id, fields: { name: id }, ...(provisioning ? { input: { activity: 'provisioning' } } : {}), occurredAt: at, actor: { kind: 'system' } } };
+    }, root);
+    return id;
+}
 /** A World's signing key for a label (ctx.signingKey): made once from the platform's random source, then read; the
  *  making is one per service store and label in the process, as the seed's is. */
 const SIGNING_KEY = '_world_signing_key';
@@ -472,6 +507,13 @@ function worldSigningKey(service, root, at, label, alg) {
     keying.set(key, made);
     return made;
 }
+/** Vendor ids remain unique across its accounts, including public links that carry an id instead of a key. */
+function mintRows(m, resource, root, snapshot) {
+    const base = m.resources[resource]?.storedAs ?? resource;
+    if (m.tenant?.storage === 'namespaced')
+        return (snapshot ?? twinResources(m.service, root)).filter(row => row.type === base || row.type.startsWith(`${base}${TENANT_TYPE}`));
+    return snapshot ? snapshot.filter(row => row.type === base) : resourcesOfType(m.service, base, root);
+}
 function mintId(m, resource, root, at, snapshot) {
     if (!m.resources[resource])
         throw new Error(`mint: ${resource} is not a resource ${m.vendor}'s manifest declares`);
@@ -495,7 +537,7 @@ function mintId(m, resource, root, at, snapshot) {
         const width = Number(digits[1]);
         if (!Number.isInteger(width) || width < 1 || width > 77)
             throw new Error('mint: decimal width must be between 1 and 77');
-        const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+        const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
         const floor = 10n ** BigInt(width - 1);
         for (let n = held.size + 1;; n++) {
             const id = String(floor + BigInt('0x' + sha256(`${m.service}:${resource}:${n}`)) % (9n * floor));
@@ -518,7 +560,7 @@ function mintId(m, resource, root, at, snapshot) {
     const pattern = new RegExp(`^${escapeRe(String(fill(head, { prefix })))}(\\d+)${escapeRe(String(fill(tail, { prefix })))}$`);
     let max = 0n;
     // the one type, from the index that follows writes (a scan of the whole World per create grew with it)
-    for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root))) {
+    for (const r of mintRows(m, resource, root, snapshot)) {
         const hit = pattern.exec(r.id);
         if (hit && BigInt(hit[1]) > max)
             max = BigInt(hit[1]);
@@ -533,13 +575,13 @@ function mintId(m, resource, root, at, snapshot) {
  *  and its attachment) must not meet. */
 const lastSnowflake = new Map();
 function mintSnowflake(m, epoch, root, at, snapshot) {
-    const ms = BigInt(Date.parse(at ?? '') || 0);
+    const ms = BigInt(Date.parse(at) || 0);
     const base = ms > epoch ? (ms - epoch) << 22n : 0n;
     let max = -1n;
     for (const [name, decl] of Object.entries(m.resources)) {
         if (!/^\{snowflake:\d+\}$/.test(decl.ids ?? m.ids.template))
             continue;
-        for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, name)) : resourcesOfType(m.service, storedType(m, name), root)))
+        for (const r of mintRows(m, name, root, snapshot))
             if (/^\d+$/.test(r.id)) {
                 const v = BigInt(r.id);
                 if (v > max)
@@ -555,9 +597,9 @@ function mintSnowflake(m, epoch, root, at, snapshot) {
 }
 /** The next KSUID for a resource (Clerk's and Svix's ids, `ksuidFrom`): the World's instant, then the type's mint
  *  count, so a frozen clock still lists them as made; past any the World already holds. */
-function mintKsuid(m, resource, at, root, prefix = '', snapshot, width = 27) {
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
-    const seconds = Math.floor((Date.parse(at ?? '') || 0) / 1000);
+function mintKsuid(m, resource, at, root, prefix, snapshot, width) {
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
+    const seconds = Math.floor((Date.parse(at) || 0) / 1000);
     for (let n = held.size + 1;; n++) {
         const id = `${prefix}${ksuidFrom(seconds, n, `${m.service}:${resource}:${n}`, width)}`;
         if (!held.has(id))
@@ -566,8 +608,8 @@ function mintKsuid(m, resource, at, root, prefix = '', snapshot, width = 27) {
 }
 /** The next id of `count` lowercase letters for a resource, derived from the resource and the count before it, past
  *  any the World already holds. */
-function mintLetters(m, resource, count, root, prefix = '', snapshot) {
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+function mintLetters(m, resource, count, root, prefix, snapshot) {
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
         const id = `${prefix}${lettersFrom(`${m.service}:${resource}:${n}`, count)}`;
         if (!held.has(id))
@@ -576,8 +618,8 @@ function mintLetters(m, resource, count, root, prefix = '', snapshot) {
 }
 /** The next hex id for a resource: N hex digits derived from the resource and the count before it, past any the World
  *  already holds (a Cloudflare id, 32). */
-function mintHex(m, resource, count, root, prefix = '', snapshot) {
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+function mintHex(m, resource, count, root, prefix, snapshot) {
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
         const id = `${prefix}${sha256(`${m.service}:${resource}:${n}`).slice(0, count)}`;
         if (!held.has(id))
@@ -587,8 +629,7 @@ function mintHex(m, resource, count, root, prefix = '', snapshot) {
 /** The next UUID for a resource: a version-4-shaped UUID derived from the resource and the count before it, past any
  *  the World already holds. */
 function mintUuid(m, resource, root, snapshot) {
-    const type = storedType(m, resource);
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === type) : resourcesOfType(m.service, type, root)).map((r) => r.id));
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
         const id = uuidFrom(`${m.service}:${resource}:${n}`);
         if (!held.has(id))
@@ -849,14 +890,15 @@ async function finishWrite(m, call, resource, row, result, operation, params, ro
     const request = requestOfCall.get(call) ?? call.request;
     const context = () => contextFor(m, { ...call, request: request.clone() }, { ...(scopeOfCall.get(call) ?? {}), ...(root !== undefined ? { root } : {}), clock: () => occurredAt });
     if (m.onWrite)
-        await m.onWrite({ operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone(), context });
+        await m.onWrite({ operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone(), context });
     if (m.events) {
-        const events = m.events;
-        const write = { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() };
+        const endpoint = (kind) => ({ ...kind, storedAs: storedType(m, kind.storedAs), ...(kind.joins ? { joins: Object.fromEntries(Object.entries(kind.joins).map(([name, join]) => [name, { ...join, storedAs: storedType(m, join.storedAs) }])) } : {}) });
+        const events = { ...m.events, ...(m.events.store ? { store: storedType(m, m.events.store) } : {}), endpoints: 'storedAs' in m.events.endpoints ? endpoint(m.events.endpoints) : m.events.endpoints.map(endpoint) };
+        const write = { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() };
         await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values(await context(), write, type) : undefined);
     }
     if (m.sockets?.length)
-        socketWrite(m.service, root, { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() });
+        socketWrite(m.service, root, { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() });
     // a read held until the World writes (held-reads.ts) hears it
     heldReadsWrite(m.service, root, storedType(m, resource));
     // the subject's id as it stands after the write: the vendor's, when a live head minted one
@@ -1018,8 +1060,8 @@ function adoptedPath(m, call, root) {
 /** A call's fields with each declared reference that names an adopted subject by its local id moved to the adopted
  *  id. A call (a handler's operation) need not say which subject type it writes, so every reference the pack declares
  *  is tried: a field is rewritten only when its value is a local id the alias map holds for the reference's target. */
-function adoptedInCall(service, fields, root) {
-    const refs = packReferences(service);
+function adoptedInCall(m, fields, root) {
+    const service = m.service, refs = packReferences(service);
     if (refs.length === 0)
         return fields;
     const aliases = aliasesNow(service, root);
@@ -1028,14 +1070,14 @@ function adoptedInCall(service, fields, root) {
     let out = fields;
     for (const ref of refs) {
         const local = ref.key(out);
-        const adopted = local === undefined ? undefined : aliases.get(`${ref.to}:${local}`);
+        const adopted = local === undefined ? undefined : aliases.get(`${storedType(m, ref.to)}:${local}`);
         if (adopted !== undefined && adopted !== local)
             out = { ...out, ...ref.adopt(out, adopted) };
     }
     return out;
 }
 async function boundaryParams(m, call, root) {
-    return adoptedInCall(m.service, await readParams(m, call.request, call.operation), root);
+    return adoptedInCall(m, await readParams(m, call.request, call.operation), root);
 }
 /** The refusal a subject's fields would draw from its resource's `unique` rules: another live subject (not `except`)
  *  already holds every field of a rule, each field given. */
@@ -1237,7 +1279,7 @@ export async function serveCore(m, call, scope = {}) {
     const parent = parentOfCall(decl, call);
     const parentId = parent ? parentValue(parent, call.params) : undefined;
     // the caller's tenant, when the vendor has tenancy and the resource is not shared by every tenant
-    const tenantField = m.tenant && !decl.shared ? m.tenant.field : undefined;
+    const tenantField = m.tenant?.storage !== 'namespaced' && m.tenant && !decl.shared ? m.tenant.field : undefined;
     const tenant = tenantField && scope.tenant ? await scope.tenant(await contextFor(m, { ...call, request: call.request.clone() }, scope)) : undefined;
     if (tenantField && tenant === undefined)
         return { unmodeled: `the caller names no tenant (semantics/tenant.ts) for ${resource}` };
@@ -1433,7 +1475,7 @@ export async function contextFor(m, call, scope) {
     sentOf.set(call, { ...sentRequest(m, asAsked, parts ? Object.fromEntries(parts.filter((p) => p.filename === null).map((p) => [p.name, new TextDecoder().decode(p.body)])) : raw ?? body), ...(parts ? { parts } : {}), ...(raw ? { type: call.request.headers.get('content-type') ?? undefined } : {}) });
     // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
     if (body && typeof body === 'object' && !Array.isArray(body))
-        body = adoptedInCall(m.service, body, root);
+        body = adoptedInCall(m, body, root);
     // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
     // still find it unread, whichever of them reads it first
     const pristine = call.request.clone();
@@ -1450,6 +1492,13 @@ export async function contextFor(m, call, scope) {
     const rawResources = new WeakMap();
     const rawRow = (resource, row) => {
         const name = m.resources[resource] ? resource : Object.keys(m.resources).find((name) => storedType(m, name) === row.type);
+        if (m.tenant?.storage === 'namespaced') {
+            const [base, encoded] = row.type.split(TENANT_TYPE);
+            const owner = m.resources[name ?? resource]?.shared && row[m.tenant.field] !== undefined ? row[m.tenant.field] : encoded ? decodeURIComponent(encoded) : 'default';
+            row = copyResource(row);
+            row.type = base;
+            row[m.tenant.field] = owner;
+        }
         rawResources.set(row, name ?? resource);
         return row;
     };
@@ -1468,7 +1517,7 @@ export async function contextFor(m, call, scope) {
         git: (name) => {
             if (!/^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$/.test(name) || name.split('/').some((seg) => seg === '.' || seg === '..'))
                 throw new Error(`semantics: ${name} is not a git repository name`);
-            const plane = `${worldPaths(m.service, root).dir}/git`;
+            const plane = `${worldPaths(m.service, root).dir}/git${accountScope(m) && accountScope(m) !== 'default' ? `/accounts/${encodeURIComponent(accountScope(m))}` : ''}`;
             return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/repos/${name}`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
         },
         mail: (route, mail, headers) => sendMail(route, mail, headers),
@@ -1508,17 +1557,21 @@ export async function contextFor(m, call, scope) {
             return value;
         },
         occurredAt: at,
-        secret: async (label) => hmac(await worldSeed(m.service, root, at), label, 'base64url'),
+        secret: async (label) => hmac(await worldSeed(m.service, root, at), scopeLabel(m, label), 'base64url'),
+        account: async (field = 'account') => {
+            const fields = body && typeof body === 'object' && !Array.isArray(body) ? body : {};
+            return worldAccount(m.service, root, fields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+        },
         record: async (type, fields, id, operation) => {
             if (!type.startsWith('_'))
                 throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
             // a bookkeeping subject a resource counts (`counts` naming it: sentry's issue users) keeps that count as any
             // child does, the parent it left recounted too
-            const keeps = counted(m, type);
+            const keeps = counted(m, type), physicalType = storedType(m, type);
             if (id !== undefined) {
                 const before = operation ? stateBeforeWrite(m, type, id, root) : undefined;
-                const prior = keeps ? resourcesOfType(m.service, type, root).find((r) => r.id === id) : undefined;
-                const { resource: row, result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: id, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } }, root);
+                const prior = keeps ? resourcesOfType(m.service, physicalType, root).find((r) => r.id === id) : undefined;
+                const { resource: row, result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: physicalType, subjectId: id, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } }, root);
                 if (operation)
                     observeStateWrite(m, result, before, root, stateChecks);
                 if (keeps)
@@ -1531,7 +1584,7 @@ export async function contextFor(m, call, scope) {
                     const prefix = `${type.slice(1)}_`;
                     let max = 0n;
                     for (const r of resources) {
-                        if (r.type !== type)
+                        if (r.type !== physicalType)
                             continue;
                         const digits = r.id.startsWith(prefix) ? r.id.slice(prefix.length) : '';
                         if (/^\d+$/.test(digits) && BigInt(digits) > max)
@@ -1539,21 +1592,21 @@ export async function contextFor(m, call, scope) {
                     }
                     return `${prefix}${max + 1n}`;
                 })();
-                return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } } };
-            }, root, () => resourcesOfType(m.service, type, root));
+                return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: physicalType, subjectId: subject, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } } };
+            }, root, () => resourcesOfType(m.service, physicalType, root));
             if (operation && result)
                 observeStateWrite(m, result, undefined, root, stateChecks);
-            const made = keeps && value !== undefined ? resourcesOfType(m.service, type, root).find((r) => r.id === value) : undefined;
+            const made = keeps && value !== undefined ? resourcesOfType(m.service, physicalType, root).find((r) => r.id === value) : undefined;
             if (made)
                 await keepCounts(m, call, type, made, params, root, at);
             return value;
         },
         get machines() {
             const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool');
-            return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies, { images: enrolled?.images }), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
+            return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
         },
-        signingKey: (label, alg) => worldSigningKey(m.service, root, at, label, alg ?? 'RS256'),
-        heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, label, alg ?? 'RS256'),
+        signingKey: (label, alg) => worldSigningKey(m.service, root, at, scopeLabel(m, label), alg ?? 'RS256'),
+        heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, scopeLabel(m, label), alg ?? 'RS256'),
         create: (resource, fields, operation) => atomicWrite(m, call, resource, (snapshot) => {
             const id = mintId(m, resource, root, at, snapshot);
             return { id, fields: typeof fields === 'function' ? fields(id) : fields };
@@ -1566,7 +1619,7 @@ export async function contextFor(m, call, scope) {
                 throw new Error('createUnique requires declared unique keys');
             let existing;
             const row = await atomicWrite(m, call, resource, (snapshot) => {
-                const id = mintId(m, resource, root, at, snapshot);
+                const id = options?.id ?? mintId(m, resource, root, at, snapshot);
                 const selected = typeof fields === 'function' ? fields(id) : fields;
                 const hit = snapshot.find((r) => r.type === storedType(m, resource) && r.deleted !== true && rules.some((rule) => rule.fields.every((f) => selected[f] !== undefined && view(m, resource, r)[f] === selected[f])));
                 if (hit) {
@@ -1612,7 +1665,17 @@ export async function contextFor(m, call, scope) {
         ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
         row: (resource, id, opts) => { const row = stored(m, resource, root, opts).find((r) => r.id === id); return row ? rawRow(resource, row) : undefined; },
         rowsRaw: (resource, opts) => stored(m, resource, root, opts).map((row) => rawRow(resource, row)),
-        tree: () => twinResources(m.service, root),
+        tree: () => {
+            const rows = twinResources(m.service, root);
+            if (m.tenant?.storage !== 'namespaced')
+                return rows;
+            const account = accountScope(m);
+            return rows.filter(row => {
+                const [base, encoded] = row.type.split(TENANT_TYPE);
+                const name = Object.keys(m.resources).find(name => (m.resources[name]?.storedAs ?? name) === base) ?? base;
+                return account === undefined || m.resources[name]?.shared || (encoded ? decodeURIComponent(encoded) : 'default') === account;
+            }).map(row => rawRow(row.type.split(TENANT_TYPE)[0], row));
+        },
         history: (resource, id) => subjectHistory(m.service, { type: storedType(m, resource), id }, root).map((e) => ({ ...(e.operation ? { operation: e.operation } : {}), ...(e.fields ? { fields: e.fields } : {}), ...(e.occurredAt ? { occurredAt: e.occurredAt } : {}) })),
         raw: (body, init = {}) => new Response(body, { status: init.status ?? 200, headers: init.headers ?? {} }),
         atomically: async (decide) => {
@@ -1667,17 +1730,17 @@ export async function contextFor(m, call, scope) {
         engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request) }),
         redis: (commands, options) => execRedisRun(commands, {
             root, occurredAt: at, service: m.service, readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), dialect: options.dialect,
-            ...(options.database === undefined ? {} : { database: options.database }),
+            ...(accountScope(m) && accountScope(m) !== 'default' ? { database: scopeLabel(m, options.database ?? 'default') } : options.database === undefined ? {} : { database: options.database }),
             ...(options.transaction === undefined ? {} : { transaction: options.transaction }),
         }),
-        live: liveAccess({ rows: (type) => resourcesOfType(m.service, type, root), blob: (key) => readResourceBlob(m.service, key, root) }, call.request),
+        live: liveAccess({ rows: (type) => stored(m, type, root).map(row => rawRow(type, row)), blob: (key) => readResourceBlob(m.service, scopeLabel(m, key), root) }, call.request),
         blobs: {
-            put: (key, bytes) => writeResourceBlob(m.service, key, bytes, root),
-            putStream: (key, body, accept) => writeResourceBlobStream(m.service, key, body, accept, root),
-            get: (key) => readResourceBlob(m.service, key, root),
-            remove: (key) => removeResourceBlob(m.service, key, root),
-            size: (key) => resourceBlobSize(m.service, key, root),
-            range: (key, start, endInclusive) => readResourceBlobRange(m.service, key, start, endInclusive, root),
+            put: (key, bytes) => writeResourceBlob(m.service, scopeLabel(m, key), bytes, root),
+            putStream: (key, body, accept) => writeResourceBlobStream(m.service, scopeLabel(m, key), body, accept, root),
+            get: (key) => readResourceBlob(m.service, scopeLabel(m, key), root),
+            remove: (key) => removeResourceBlob(m.service, scopeLabel(m, key), root),
+            size: (key) => resourceBlobSize(m.service, scopeLabel(m, key), root),
+            range: (key, start, endInclusive) => readResourceBlobRange(m.service, scopeLabel(m, key), start, endInclusive, root),
         },
         merge: (resource, prior, next) => mergeField(m.resources[resource]?.update, prior, next),
         conflict: (resource, fields, except) => {
@@ -2005,7 +2068,7 @@ export function authRefusal(m, request, root) {
     const held = m.auth.held;
     if (held && !held.standing?.includes(key)) {
         const hash = sha256(key);
-        const holds = resourcesOfType(m.service, held.storedAs, root).some((r) => r.deleted !== true && r[held.hashField] === hash && (held.unless === undefined || r[held.unless] !== true));
+        const holds = stored(m, held.storedAs, root).some((r) => r.deleted !== true && r[held.hashField] === hash && (held.unless === undefined || r[held.unless] !== true));
         if (!holds)
             return vendorError(errorManifest, invalid);
     }
@@ -2101,7 +2164,7 @@ export function crossCutting(m, opts = {}) {
         const url = new URL(request.url);
         const signature = hashFieldValue({ path: url.pathname + url.search, body: await bodyTextOf(request.clone()) });
         const id = `idem_${hex(key)}`;
-        const prior = twinResources(m.service, opts.root).find((r) => r.type === m.idempotency.storedAs && r.id === id);
+        const prior = twinResources(m.service, opts.root).find((r) => r.type === storedType(m, m.idempotency.storedAs) && r.id === id);
         if (prior) {
             if (m.idempotency.conflict && prior.requestHash !== undefined && prior.requestHash !== signature)
                 return vendorError(m, m.idempotency.conflict);
@@ -2117,7 +2180,7 @@ export function crossCutting(m, opts = {}) {
             return response;
         const contentType = response.headers.get('content-type') ?? 'application/json';
         const text = await response.clone().text();
-        await applyTwinWrite(m.service, { operation: 'idempotency.record', subjectType: m.idempotency.storedAs, subjectId: id, fields: { response: { status: response.status, text, contentType }, requestHash: signature }, occurredAt: (opts.clock ?? worldNow)(), actor: { kind: 'system' } }, opts.root);
+        await applyTwinWrite(m.service, { operation: 'idempotency.record', subjectType: storedType(m, m.idempotency.storedAs), subjectId: id, fields: { response: { status: response.status, text, contentType }, requestHash: signature }, occurredAt: (opts.clock ?? worldNow)(), actor: { kind: 'system' } }, opts.root);
         return response;
     }
 }

package/dist/src/index.d.ts

@@ -47,8 +47,8 @@ export { siteLabel, siteUrlOf, twinSiteUrl, twinVendorUrl } from './twin-fetch.j
 export { statefulTwinManifest, twinManifest } from './scenario.js';
 export { assetContentType, packAsset } from './pack-assets.js';
 export { bytesResponse, contentTypeOf, fileResponse } from './file-response.js';
-export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtVerify, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from './signing.js';
-export type { HandlerCrypto, Jwk, Jwks, JwtVerdict, SigningKey } from './signing.js';
+export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtSignClaims, jwtVerify, jwtVerifySignature, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from './signing.js';
+export type { HandlerCrypto, Jwk, Jwks, JwtDecodeOptions, JwtSignatureOptions, JwtVerdict, JwtVerificationKey, SigningKey } from './signing.js';
 export { blobDigest } from './blob-store.js';
 export { gunzip, gzip } from './bytes.js';
 export { ownFields } from './log.js';
@@ -81,3 +81,5 @@ export { readHostPort } from './host-port.js';
 export { assertBrowserName, browserOrigin, validateBrowserState, validateBrowserStorageState, validateBrowserContext, browserAcceptLanguage, cookieMatchesHost, type BrowserCookie, type BrowserState, type BrowserStorageState, type BrowserContext, type BrowserIndexedDB } from './browser-state.js';
 export * as managedOriginalInputs from './managed-original-inputs.js';
 export * as managedGoPrograms from './managed-go-programs.js';
+export { worldSecret, worldAccount } from './derived-core.js';
+export { isWorldAccountName } from './world-account-name.js';

package/dist/src/index.js

@@ -37,7 +37,7 @@ export { statefulTwinManifest, twinManifest } from "./scenario.js";
 export { assetContentType, packAsset } from "./pack-assets.js";
 export { bytesResponse, contentTypeOf, fileResponse } from "./file-response.js";
 // ── the kernel's deterministic helpers ─────────────────────────────────────────────────────────
-export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtVerify, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from "./signing.js";
+export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtSignClaims, jwtVerify, jwtVerifySignature, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from "./signing.js";
 export { blobDigest } from "./blob-store.js";
 // compressed bytes a wire carries (a SARIF upload), over web streams
 export { gunzip, gzip } from "./bytes.js";
@@ -73,3 +73,5 @@ export { readHostPort } from "./host-port.js";
 export { assertBrowserName, browserOrigin, validateBrowserState, validateBrowserStorageState, validateBrowserContext, browserAcceptLanguage, cookieMatchesHost } from "./browser-state.js";
 export * as managedOriginalInputs from "./managed-original-inputs.js";
 export * as managedGoPrograms from "./managed-go-programs.js";
+export { worldSecret, worldAccount } from "./derived-core.js";
+export { isWorldAccountName } from "./world-account-name.js";

package/dist/src/machines.d.ts

@@ -17,18 +17,6 @@ export type MachineSpec = {
     signal?: AbortSignal;
     startTimeoutMs?: number;
 };
-export type GuestImage = {
-    context: string;
-    dockerfile?: string;
-    runtime?: 'node' | 'bun' | 'python' | 'deno';
-    command?: string[];
-    cwd?: string;
-    env?: Record<string, string>;
-    prepared?: boolean;
-};
-export type LightPoolOptions = {
-    images?: Record<string, GuestImage>;
-};
 export type MachineRun = {
     ports: Array<{
         internal: number;
@@ -85,7 +73,7 @@ export type MachineHttpReply = {
     body?: string;
 };
 export type MachinePool = {
-    readonly kind: 'docker' | 'none' | 'fake' | 'light';
+    readonly kind: 'docker' | 'none' | 'fake';
     /** Optional capability admission, before vendor resource creation; starts no process. */
     admitRun?(spec: MachineSpec): Promise<void>;
     /** runs the image; a failure (no container runtime, an image that will not start) rejects with the runtime's message */
@@ -115,10 +103,10 @@ export type MachinePool = {
 /** A declared compute capability gap, distinct from a failed admitted guest. */
 export declare function isMachineCapabilityGap(error: unknown): boolean;
 export declare const MACHINE_POOL = "_machine_pool";
-export declare const POOL_KINDS: readonly ["docker", "none", "fake", "light"];
+export declare const POOL_KINDS: readonly ["docker", "none", "fake"];
 /** The pool of a kind, for a World (`world`: the mark its containers carry). */
-export declare function machinePool(kind: MachinePool['kind'], world?: string, httpReplies?: readonly MachineHttpReply[], light?: LightPoolOptions, root?: string): MachinePool;
-export declare function poolFor(service: string, root: string | undefined, kind: MachinePool['kind'], httpReplies?: readonly MachineHttpReply[], light?: LightPoolOptions): MachinePool;
+export declare function machinePool(kind: MachinePool['kind'], world?: string, httpReplies?: readonly MachineHttpReply[]): MachinePool;
+export declare function poolFor(service: string, root: string | undefined, kind: MachinePool['kind'], httpReplies?: readonly MachineHttpReply[]): MachinePool;
 /** Re-enrolling a verification pool starts a fresh fake execution record. */
 export declare function resetFakePool(service: string, root: string | undefined): void;
 /** Every machine mutation shares the tree's refusal seam. HTTP/RPC reads must be explicitly

package/dist/src/machines.js

@@ -1,17 +1,9 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
 // The World's machine pool (architecture, "Other wires: … machines"): what runs a vendor's customer's image when the
 // vendor is one that runs images (Fly's Machines). It is a platform provider enrolled through the kernel's door
 // `POST /_twin/machine-pool`, recorded in the pack's own tree; a handler reaches it as `ctx.machines`. `docker` runs
 // each machine as a local container with its internal ports published on loopback; `none` runs nothing; `fake`
 // records what it was asked (capability verification). Nothing here runs at module scope, and `node:child_process`
-// is reached only when a compute pool is asked to act. The light pool delegates to the host's Substrate adapter.
+// is reached only when a compute pool is asked to act.
 import { refuseReadOnlyWrite } from "./request-scope.js";
 import { nodeBuiltin } from "./serve-http.js";
 import { refuseRequiredMachineTransport } from '../required-credential-transport.cjs';
@@ -20,33 +12,7 @@ export function isMachineCapabilityGap(error) {
     return typeof error === 'object' && error !== null && 'code' in error && error.code === 'WORLD_MACHINE_CAPABILITY_GAP';
 }
 export const MACHINE_POOL = '_machine_pool';
-export const POOL_KINDS = ['docker', 'none', 'fake', 'light'];
-/** The host owns provider bootstrapping. Browser/kernel imports stay inert, and a missing
- * host provider refuses rather than falling back to metadata-only success. */
-function lightPool(world, root, options) {
-    let ready;
-    const load = () => ready ??= (async () => {
-        const entry = typeof process === 'undefined' ? undefined : process.env.VOLTER_WORLD_GUEST_RUNNER;
-        if (!entry)
-            throw new Error('light guest runner is unavailable: run this twin inside a World');
-        const provider = await import(__rewriteRelativeImportExtension(entry));
-        return provider.createLightGuestPool({ world, root, ...options });
-    })();
-    return {
-        kind: 'light',
-        admitRun: async (spec) => { await (await load()).admitRun?.(spec); },
-        run: async (spec) => (await load()).run(spec),
-        exec: async (name, spec) => (await load()).exec(name, spec),
-        request: async (name, port, request) => (await load()).request(name, port, request),
-        status: async (name) => (await load()).status(name),
-        ports: async (name) => (await load()).ports(name),
-        files: async (name) => (await load()).files(name),
-        pause: async (name) => (await load()).pause(name),
-        resume: async (name) => (await load()).resume(name),
-        stop: async (name) => (await load()).stop(name),
-        remove: async (name) => (await load()).remove(name),
-    };
-}
+export const POOL_KINDS = ['docker', 'none', 'fake'];
 /** A container's name for a machine: the World's prefix, the World's own mark (a machine id repeats across Worlds and
  *  branches, which mint alike), then the vendor's machine name made safe for docker. */
 const containerName = (world, name) => `volter-world-machine-${world}-${name.replace(/[^A-Za-z0-9_.-]/g, '-')}`;
@@ -66,8 +32,8 @@ function dockerPool(world) {
             const state = JSON.parse(await docker(['inspect', '--format', '{{json .State}}', containerName(world, name)]));
             return state.Running ? { state: 'started' } : { state: 'exited', exitCode: state.ExitCode, ...(state.Error ? { reason: state.Error } : {}) };
         },
-        async ports() { throw new Error('port discovery requires the light guest backing'); },
-        async files() { throw new Error('file access requires the light guest backing'); },
+        async ports() { throw new Error('port discovery is unavailable'); },
+        async files() { throw new Error('file access is unavailable'); },
         async run(spec) {
             refuseRequiredMachineTransport(process.env, 'Docker machine application transport');
             const name = containerName(world, spec.name);
@@ -175,9 +141,9 @@ function dockerPool(world) {
     };
 }
 /** The pool of a kind, for a World (`world`: the mark its containers carry). */
-export function machinePool(kind, world = 'world', httpReplies = [], light = {}, root) {
-    if (kind === 'light')
-        return lightPool(world, root, light);
+export function machinePool(kind, world = 'world', httpReplies = []) {
+    if (!POOL_KINDS.includes(kind))
+        throw new Error(`kind must be one of ${POOL_KINDS.join(', ')}`);
     if (kind === 'docker')
         return dockerPool(world);
     if (kind === 'fake') {
@@ -231,15 +197,15 @@ export function machinePool(kind, world = 'world', httpReplies = [], light = {},
 }
 /** A vendor's pool in a World, one per World and kind for the life of the process (a fake pool keeps what it was asked). */
 const pools = new Map();
-export function poolFor(service, root, kind, httpReplies = [], light = {}) {
-    const key = `${service}\0${root ?? ''}\0${kind}${kind === 'light' ? JSON.stringify(light) : ''}`;
+export function poolFor(service, root, kind, httpReplies = []) {
+    const key = `${service}\0${root ?? ''}\0${kind}`;
     let pool = pools.get(key);
     if (!pool) {
         // the World's mark: a short digest of the vendor and the World's tree, so two Worlds' machines never share a name
         let h = 0;
         for (const ch of `${service}:${root ?? ''}`)
             h = (Math.imul(h, 31) + ch.charCodeAt(0)) >>> 0;
-        pool = machinePool(kind, h.toString(16).padStart(8, '0'), httpReplies, light, root);
+        pool = machinePool(kind, h.toString(16).padStart(8, '0'), httpReplies);
         pools.set(key, pool);
     }
     return pool;