@volter/world-core 3.0.161 → 3.0.163

package/dist/src/derived-core.js

@@ -1,3 +1,5 @@
+import { storageTenant } from "./request-scope.js";
+import { isWorldAccountName } from "./world-account-name.js";
 import { parseExactJson, compareExactNumbers, exactInteger, isExactIntegerValue } from "./exact-json.js";
 // THE DERIVED CORE — what a derived pack does for an operation it declares no handler for
 // (docs/contributing/architecture.md, "Protocol 3"). The generated surface says what the
@@ -35,6 +37,7 @@ import { vendorFetch } from "./vendor-call.js";
 import { packReferences } from "./references.js";
 import { twinPublicBase, withRequestScopes } from "./twin-fetch.js";
 import { inVendorMove, isReadOnlyRequest, runAsVendorMove, writesRefused } from "./request-scope.js";
+import { getPack } from "./packRegistry.js";
 import { bodyTextOf, checkJsonBody, takeParsedBody } from "./derived.js";
 /** What a move to `to` stores in the field: a boolean field's value is a boolean, and a derived field's
  *  value is written by the move's effects (a state name is not a timestamp), so it stores nothing itself. */
@@ -235,7 +238,13 @@ function notFound(manifest, object, id, param) {
     return vendorError(manifest, { status: nf.status, message: String(fill(message, { object, id })), ...(code ? { code } : {}), ...(nf.kind ? { kind: nf.kind } : {}), ...(param ? { param } : {}) });
 }
 // ── the tree ─────────────────────────────────────────────────────────────────────────────────
-export const storedType = (m, resource) => m.resources[resource]?.storedAs ?? resource;
+const TENANT_TYPE = '::account:';
+const accountScope = (m) => m.tenant?.storage === 'namespaced' ? storageTenant(m.service) : undefined;
+const scopeLabel = (m, label) => { const account = accountScope(m); return account && account !== 'default' ? `account:${account}:${label}` : label; };
+export const storedType = (m, resource) => {
+    const base = m.resources[resource]?.storedAs ?? resource, account = accountScope(m);
+    return account && account !== 'default' && !m.resources[resource]?.shared ? `${base}${TENANT_TYPE}${encodeURIComponent(account)}` : base;
+};
 // A service's resources by type, folded once per World state (the tree's stamp; any write moves it), not on every read:
 // a read of one resource type projected the service's whole tree, so a pack whose tree also holds many subjects of
 // other types (PlanetScale's SQL rows beside its management records) paid for all of them on each read. A read gets its
@@ -254,9 +263,15 @@ export function resourcesOfType(service, type, root) {
     if (held && delta) {
         // the index keeps the tree's order: a subject updated where it stands stays there, one new to the tree (or made
         // again after a delete) goes to the end in the order the tree holds it
-        for (const k of [...delta.removed, ...delta.appended])
-            held.byType.get(k.slice(0, k.indexOf(':')))?.delete(k);
+        for (const k of [...delta.removed, ...delta.appended]) {
+            const type = held.typeByKey.get(k);
+            if (type !== undefined)
+                held.byType.get(type)?.delete(k);
+            held.typeByKey.delete(k);
+        }
         const byKey = new Map(delta.changed.map((r) => [`${r.type}:${r.id}`, r]));
+        for (const [k, r] of byKey)
+            held.typeByKey.set(k, r.type);
         for (const [k, r] of byKey)
             if (!delta.appended.includes(k))
                 (held.byType.get(r.type) ?? held.byType.set(r.type, new Map()).get(r.type)).set(k, r);
@@ -273,7 +288,7 @@ export function resourcesOfType(service, type, root) {
             const byType = new Map();
             for (const r of twinResources(service, root))
                 (byType.get(r.type) ?? byType.set(r.type, new Map()).get(r.type)).set(`${r.type}:${r.id}`, r);
-            held = { stamp, byType };
+            held = { stamp, byType, typeByKey: new Map([...byType].flatMap(([type, rows]) => [...rows.keys()].map(key => [key, type]))) };
             indexes.set(key, held);
         }
     }
@@ -282,7 +297,9 @@ export function resourcesOfType(service, type, root) {
 function stored(m, resource, root, opts = {}) {
     const type = storedType(m, resource);
     const when = Object.entries(m.resources[resource]?.readableWhen ?? {});
-    return resourcesOfType(m.service, type, root).filter((r) => (opts.withDeleted || r.deleted !== true) && when.every(([k, v]) => r[k] === v));
+    const rows = m.tenant?.storage === 'namespaced' && accountScope(m) === undefined && !m.resources[resource]?.shared
+        ? twinResources(m.service, root).filter(row => row.type === type || row.type.startsWith(`${type}${TENANT_TYPE}`)) : resourcesOfType(m.service, type, root);
+    return rows.filter((r) => (opts.withDeleted || r.deleted !== true) && when.every(([k, v]) => r[k] === v));
 }
 /** The subject an item operation names: the manifest's key over the path parameters, or the last one. */
 function subjectOf(m, resource, call) {
@@ -317,7 +334,7 @@ function missingParent(m, resource, call, root, tenant) {
     const id = parentValue(parent, call.params);
     const where = Object.entries(parent.where ?? {}).map(([field, template]) => [field, String(fill(template, call.params))]);
     const found = (r) => (where.length ? where.every(([field, v]) => String(parentField(r, field)) === v) : r.id === id)
-        && (!m.tenant || m.resources[parent.resource]?.shared || r[m.tenant.field] === tenant);
+        && (!m.tenant || m.tenant.storage === 'namespaced' || m.resources[parent.resource]?.shared || r[m.tenant.field] === tenant);
     return id !== undefined && stored(m, parent.resource, root, { withDeleted: parent.allowDeleted === true }).some(found) ? undefined : notFound(m, parent.resource, String(id), parent.param ?? parent.params?.at(-1));
 }
 /** The vendor's view of a stored subject: its own fields, bookkeeping (`_`) left out. */
@@ -430,14 +447,84 @@ function worldSeed(service, root, at) {
     if (pending)
         return pending;
     const made = (async () => {
-        const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
-        // the World's own bookkeeping, made on first use whatever the request: a read-only one lands it too (a vendor's move)
-        await runAsVendorMove(() => applyTwinWrite(service, { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } }, root));
+        // The action lock also joins first asks from several renderers/processes to the same seed.
+        const { value } = await runAsVendorMove(() => applyTwinWriteAtomic(service, snapshot => {
+            const existing = snapshot.find(row => row.type === SEED && row.id === 'seed');
+            if (typeof existing?.value === 'string')
+                return { kind: 'skip', value: existing.value };
+            const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
+            return { kind: 'write', value, write: { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } } };
+        }, root));
         return value;
     })().finally(() => seeding.delete(key));
     seeding.set(key, made);
     return made;
 }
+/** World-owned generated values use the same private seed and log as pack secrets. */
+export async function worldSecret(service, root, label, at = new Date().toISOString()) {
+    return hmac(await worldSeed(service, root, at), label, 'base64url');
+}
+/** The same retained account primitive for pack doors and private native twin fronts. */
+export async function worldAccount(service, root, id = 'default', at = worldNow(), provisioning = false) {
+    if (!isWorldAccountName(id))
+        throw new Error('Credential account must be a name of at most 128 letters, digits, dots, underscores or hyphens');
+    await applyTwinWriteAtomic(service, (snapshot) => {
+        const held = snapshot.find(row => row.type === '_world_account' && row.id === id);
+        return held ? { kind: 'skip', value: id } : { kind: 'write', value: id, write: { operation: 'world_account.create', subjectType: '_world_account', subjectId: id, fields: { name: id }, ...(provisioning ? { input: { activity: 'provisioning' } } : {}), occurredAt: at, actor: { kind: 'system' } } };
+    }, root);
+    return id;
+}
+function nativeAccountLink(row, field) {
+    if (!row || row.deleted === true)
+        return undefined;
+    const fields = ownFields(row);
+    const value = field === undefined ? fields : fields[field];
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const link = value;
+    return typeof link.resource === 'string' && typeof link.id === 'string' ? { resource: link.resource, id: link.id } : undefined;
+}
+const sameAccountLink = (a, b) => a?.resource === b?.resource && a?.id === b?.id;
+/** Native creation and reconstruction run outside the action lock; only the retained link is compared and written. */
+async function retainNativeAccountLink(service, root, at, call, type, id, field, resource, make, read) {
+    for (;;) {
+        const before = nativeAccountLink(resourcesOfType(service, type, root).find((row) => row.id === id), field);
+        const held = before && await read(before);
+        if (held !== undefined)
+            return held;
+        const made = { resource, id: await make() };
+        if (await read(made) === undefined)
+            throw new Error(`Credential ${type}/${id}: native ${resource}/${made.id} is unavailable after creation`);
+        const { value } = await applyTwinWriteAtomic(service, (snapshot) => {
+            const current = nativeAccountLink(snapshot.find((row) => row.type === type && row.id === id), field);
+            if (!sameAccountLink(current, before))
+                return { kind: 'skip', value: current };
+            return {
+                kind: 'write', value: made,
+                write: {
+                    operation: `${type.slice(1)}.link`, subjectType: type, subjectId: id,
+                    fields: field === undefined ? made : { name: id, [field]: made },
+                    ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' },
+                },
+            };
+        }, root);
+        const linked = value && await read(value);
+        if (linked !== undefined)
+            return linked;
+    }
+}
+function vendorName(label, rule, { suffixed = false, identity = label } = {}) {
+    const allowed = new RegExp(rule.allowed.source, rule.allowed.flags.replace(/[gy]/g, ''));
+    const separator = rule.separator ?? '-';
+    if ([...separator].length !== 1 || !allowed.test(separator))
+        throw new Error('Credential name separator must be one allowed character');
+    const first = rule.first && new RegExp(rule.first.source, rule.first.flags.replace(/[gy]/g, ''));
+    let name = [...(rule.lower ? label.toLowerCase() : label)].map((letter) => allowed.test(letter) ? letter : separator).join('');
+    name = name.replace(new RegExp(`${escapeRe(separator)}+`, 'g'), separator);
+    if (first && !first.test(name[0] ?? ''))
+        name = `w${separator}${name}`;
+    return name !== label || name.length > rule.max || suffixed ? `${name.slice(0, Math.max(0, rule.max - 9))}${separator}${sha256(identity).slice(0, 8)}` : name;
+}
 /** A World's signing key for a label (ctx.signingKey): made once from the platform's random source, then read; the
  *  making is one per service store and label in the process, as the seed's is. */
 const SIGNING_KEY = '_world_signing_key';
@@ -472,6 +559,13 @@ function worldSigningKey(service, root, at, label, alg) {
     keying.set(key, made);
     return made;
 }
+/** Vendor ids remain unique across its accounts, including public links that carry an id instead of a key. */
+function mintRows(m, resource, root, snapshot) {
+    const base = m.resources[resource]?.storedAs ?? resource;
+    if (m.tenant?.storage === 'namespaced')
+        return (snapshot ?? twinResources(m.service, root)).filter(row => row.type === base || row.type.startsWith(`${base}${TENANT_TYPE}`));
+    return snapshot ? snapshot.filter(row => row.type === base) : resourcesOfType(m.service, base, root);
+}
 function mintId(m, resource, root, at, snapshot) {
     if (!m.resources[resource])
         throw new Error(`mint: ${resource} is not a resource ${m.vendor}'s manifest declares`);
@@ -495,7 +589,7 @@ function mintId(m, resource, root, at, snapshot) {
         const width = Number(digits[1]);
         if (!Number.isInteger(width) || width < 1 || width > 77)
             throw new Error('mint: decimal width must be between 1 and 77');
-        const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+        const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
         const floor = 10n ** BigInt(width - 1);
         for (let n = held.size + 1;; n++) {
             const id = String(floor + BigInt('0x' + sha256(`${m.service}:${resource}:${n}`)) % (9n * floor));
@@ -518,7 +612,7 @@ function mintId(m, resource, root, at, snapshot) {
     const pattern = new RegExp(`^${escapeRe(String(fill(head, { prefix })))}(\\d+)${escapeRe(String(fill(tail, { prefix })))}$`);
     let max = 0n;
     // the one type, from the index that follows writes (a scan of the whole World per create grew with it)
-    for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root))) {
+    for (const r of mintRows(m, resource, root, snapshot)) {
         const hit = pattern.exec(r.id);
         if (hit && BigInt(hit[1]) > max)
             max = BigInt(hit[1]);
@@ -533,13 +627,13 @@ function mintId(m, resource, root, at, snapshot) {
  *  and its attachment) must not meet. */
 const lastSnowflake = new Map();
 function mintSnowflake(m, epoch, root, at, snapshot) {
-    const ms = BigInt(Date.parse(at ?? '') || 0);
+    const ms = BigInt(Date.parse(at) || 0);
     const base = ms > epoch ? (ms - epoch) << 22n : 0n;
     let max = -1n;
     for (const [name, decl] of Object.entries(m.resources)) {
         if (!/^\{snowflake:\d+\}$/.test(decl.ids ?? m.ids.template))
             continue;
-        for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, name)) : resourcesOfType(m.service, storedType(m, name), root)))
+        for (const r of mintRows(m, name, root, snapshot))
             if (/^\d+$/.test(r.id)) {
                 const v = BigInt(r.id);
                 if (v > max)
@@ -555,9 +649,9 @@ function mintSnowflake(m, epoch, root, at, snapshot) {
 }
 /** The next KSUID for a resource (Clerk's and Svix's ids, `ksuidFrom`): the World's instant, then the type's mint
  *  count, so a frozen clock still lists them as made; past any the World already holds. */
-function mintKsuid(m, resource, at, root, prefix = '', snapshot, width = 27) {
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
-    const seconds = Math.floor((Date.parse(at ?? '') || 0) / 1000);
+function mintKsuid(m, resource, at, root, prefix, snapshot, width) {
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
+    const seconds = Math.floor((Date.parse(at) || 0) / 1000);
     for (let n = held.size + 1;; n++) {
         const id = `${prefix}${ksuidFrom(seconds, n, `${m.service}:${resource}:${n}`, width)}`;
         if (!held.has(id))
@@ -566,8 +660,8 @@ function mintKsuid(m, resource, at, root, prefix = '', snapshot, width = 27) {
 }
 /** The next id of `count` lowercase letters for a resource, derived from the resource and the count before it, past
  *  any the World already holds. */
-function mintLetters(m, resource, count, root, prefix = '', snapshot) {
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+function mintLetters(m, resource, count, root, prefix, snapshot) {
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
         const id = `${prefix}${lettersFrom(`${m.service}:${resource}:${n}`, count)}`;
         if (!held.has(id))
@@ -576,8 +670,8 @@ function mintLetters(m, resource, count, root, prefix = '', snapshot) {
 }
 /** The next hex id for a resource: N hex digits derived from the resource and the count before it, past any the World
  *  already holds (a Cloudflare id, 32). */
-function mintHex(m, resource, count, root, prefix = '', snapshot) {
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+function mintHex(m, resource, count, root, prefix, snapshot) {
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
         const id = `${prefix}${sha256(`${m.service}:${resource}:${n}`).slice(0, count)}`;
         if (!held.has(id))
@@ -587,8 +681,7 @@ function mintHex(m, resource, count, root, prefix = '', snapshot) {
 /** The next UUID for a resource: a version-4-shaped UUID derived from the resource and the count before it, past any
  *  the World already holds. */
 function mintUuid(m, resource, root, snapshot) {
-    const type = storedType(m, resource);
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === type) : resourcesOfType(m.service, type, root)).map((r) => r.id));
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
         const id = uuidFrom(`${m.service}:${resource}:${n}`);
         if (!held.has(id))
@@ -849,14 +942,15 @@ async function finishWrite(m, call, resource, row, result, operation, params, ro
     const request = requestOfCall.get(call) ?? call.request;
     const context = () => contextFor(m, { ...call, request: request.clone() }, { ...(scopeOfCall.get(call) ?? {}), ...(root !== undefined ? { root } : {}), clock: () => occurredAt });
     if (m.onWrite)
-        await m.onWrite({ operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone(), context });
+        await m.onWrite({ operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone(), context });
     if (m.events) {
-        const events = m.events;
-        const write = { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() };
+        const endpoint = (kind) => ({ ...kind, storedAs: storedType(m, kind.storedAs), ...(kind.joins ? { joins: Object.fromEntries(Object.entries(kind.joins).map(([name, join]) => [name, { ...join, storedAs: storedType(m, join.storedAs) }])) } : {}) });
+        const events = { ...m.events, ...(m.events.store ? { store: storedType(m, m.events.store) } : {}), endpoints: 'storedAs' in m.events.endpoints ? endpoint(m.events.endpoints) : m.events.endpoints.map(endpoint) };
+        const write = { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() };
         await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values(await context(), write, type) : undefined);
     }
     if (m.sockets?.length)
-        socketWrite(m.service, root, { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() });
+        socketWrite(m.service, root, { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() });
     // a read held until the World writes (held-reads.ts) hears it
     heldReadsWrite(m.service, root, storedType(m, resource));
     // the subject's id as it stands after the write: the vendor's, when a live head minted one
@@ -1018,8 +1112,8 @@ function adoptedPath(m, call, root) {
 /** A call's fields with each declared reference that names an adopted subject by its local id moved to the adopted
  *  id. A call (a handler's operation) need not say which subject type it writes, so every reference the pack declares
  *  is tried: a field is rewritten only when its value is a local id the alias map holds for the reference's target. */
-function adoptedInCall(service, fields, root) {
-    const refs = packReferences(service);
+function adoptedInCall(m, fields, root) {
+    const service = m.service, refs = packReferences(service);
     if (refs.length === 0)
         return fields;
     const aliases = aliasesNow(service, root);
@@ -1028,14 +1122,14 @@ function adoptedInCall(service, fields, root) {
     let out = fields;
     for (const ref of refs) {
         const local = ref.key(out);
-        const adopted = local === undefined ? undefined : aliases.get(`${ref.to}:${local}`);
+        const adopted = local === undefined ? undefined : aliases.get(`${storedType(m, ref.to)}:${local}`);
         if (adopted !== undefined && adopted !== local)
             out = { ...out, ...ref.adopt(out, adopted) };
     }
     return out;
 }
 async function boundaryParams(m, call, root) {
-    return adoptedInCall(m.service, await readParams(m, call.request, call.operation), root);
+    return adoptedInCall(m, await readParams(m, call.request, call.operation), root);
 }
 /** The refusal a subject's fields would draw from its resource's `unique` rules: another live subject (not `except`)
  *  already holds every field of a rule, each field given. */
@@ -1237,7 +1331,7 @@ export async function serveCore(m, call, scope = {}) {
     const parent = parentOfCall(decl, call);
     const parentId = parent ? parentValue(parent, call.params) : undefined;
     // the caller's tenant, when the vendor has tenancy and the resource is not shared by every tenant
-    const tenantField = m.tenant && !decl.shared ? m.tenant.field : undefined;
+    const tenantField = m.tenant?.storage !== 'namespaced' && m.tenant && !decl.shared ? m.tenant.field : undefined;
     const tenant = tenantField && scope.tenant ? await scope.tenant(await contextFor(m, { ...call, request: call.request.clone() }, scope)) : undefined;
     if (tenantField && tenant === undefined)
         return { unmodeled: `the caller names no tenant (semantics/tenant.ts) for ${resource}` };
@@ -1433,7 +1527,7 @@ export async function contextFor(m, call, scope) {
     sentOf.set(call, { ...sentRequest(m, asAsked, parts ? Object.fromEntries(parts.filter((p) => p.filename === null).map((p) => [p.name, new TextDecoder().decode(p.body)])) : raw ?? body), ...(parts ? { parts } : {}), ...(raw ? { type: call.request.headers.get('content-type') ?? undefined } : {}) });
     // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
     if (body && typeof body === 'object' && !Array.isArray(body))
-        body = adoptedInCall(m.service, body, root);
+        body = adoptedInCall(m, body, root);
     // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
     // still find it unread, whichever of them reads it first
     const pristine = call.request.clone();
@@ -1447,12 +1541,25 @@ export async function contextFor(m, call, scope) {
     });
     const paths = expandPaths(m, params);
     const stateChecks = new Map();
+    const credentialDoor = m.descriptor?.credentialDoor ?? getPack(m.vendor)?.credentialDoor;
+    const credentialFields = body && typeof body === 'object' && !Array.isArray(body) ? body : {};
     const rawResources = new WeakMap();
     const rawRow = (resource, row) => {
         const name = m.resources[resource] ? resource : Object.keys(m.resources).find((name) => storedType(m, name) === row.type);
+        if (m.tenant?.storage === 'namespaced') {
+            const [base, encoded] = row.type.split(TENANT_TYPE);
+            const owner = m.resources[name ?? resource]?.shared && row[m.tenant.field] !== undefined ? row[m.tenant.field] : encoded ? decodeURIComponent(encoded) : 'default';
+            row = copyResource(row);
+            row.type = base;
+            row[m.tenant.field] = owner;
+        }
         rawResources.set(row, name ?? resource);
         return row;
     };
+    const liveNativeRow = (link) => {
+        const row = context.row(link.resource, link.id);
+        return row && row.deleted !== true ? row : undefined;
+    };
     const context = {
         call,
         params,
@@ -1468,7 +1575,7 @@ export async function contextFor(m, call, scope) {
         git: (name) => {
             if (!/^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$/.test(name) || name.split('/').some((seg) => seg === '.' || seg === '..'))
                 throw new Error(`semantics: ${name} is not a git repository name`);
-            const plane = `${worldPaths(m.service, root).dir}/git`;
+            const plane = `${worldPaths(m.service, root).dir}/git${accountScope(m) && accountScope(m) !== 'default' ? `/accounts/${encodeURIComponent(accountScope(m))}` : ''}`;
             return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/repos/${name}`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
         },
         mail: (route, mail, headers) => sendMail(route, mail, headers),
@@ -1508,17 +1615,50 @@ export async function contextFor(m, call, scope) {
             return value;
         },
         occurredAt: at,
-        secret: async (label) => hmac(await worldSeed(m.service, root, at), label, 'base64url'),
+        secret: async (label) => hmac(await worldSeed(m.service, root, at), scopeLabel(m, label), 'base64url'),
+        account: async (field = credentialDoor?.account?.field ?? 'account') => {
+            return worldAccount(m.service, root, credentialFields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+        },
+        organization: async () => {
+            const id = await context.account();
+            const row = projectOwnerResources('_world', root, { type: '_world_organization', id }).find((row) => row.type === '_world_organization' && row.id === id && row.deleted !== true);
+            return row ? { id, label: row.label, members: [...row.members] } : { id, label: id, members: ['owner@world.test'] };
+        },
+        deployment: () => {
+            const id = credentialFields[credentialDoor?.deployment?.field ?? 'deployment'] ?? '';
+            if (id !== '' && !isWorldAccountName(id))
+                throw new Error('Credential deployment must be a name of at most 128 letters, digits, dots, underscores or hyphens');
+            return id;
+        },
+        vendorName,
+        tenant: async (resource, make) => {
+            const id = await context.account();
+            return retainNativeAccountLink(m.service, root, at, call, '_world_account', id, 'tenant', resource, async () => make(await context.organization()), async (link) => liveNativeRow(link));
+        },
+        deploymentObject: async (kind, resource, make) => {
+            const organization = await context.account(), deployment = context.deployment();
+            return retainNativeAccountLink(m.service, root, at, call, '_world_deployment_object', `${organization}/${deployment}/${kind}`, undefined, resource, () => make(deployment), async (link) => liveNativeRow(link));
+        },
+        accountKey: async (purpose, resource, key) => {
+            const organization = await context.account(), deployment = context.deployment();
+            return retainNativeAccountLink(m.service, root, at, call, '_world_account_key', `${organization}/${deployment}/${purpose}`, undefined, resource, () => key.make(), async (link) => {
+                const row = liveNativeRow(link);
+                if (!row)
+                    return undefined;
+                const secret = await key.read(row);
+                return secret === undefined ? undefined : { id: link.id, secret };
+            });
+        },
         record: async (type, fields, id, operation) => {
             if (!type.startsWith('_'))
                 throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
             // a bookkeeping subject a resource counts (`counts` naming it: sentry's issue users) keeps that count as any
             // child does, the parent it left recounted too
-            const keeps = counted(m, type);
+            const keeps = counted(m, type), physicalType = storedType(m, type);
             if (id !== undefined) {
                 const before = operation ? stateBeforeWrite(m, type, id, root) : undefined;
-                const prior = keeps ? resourcesOfType(m.service, type, root).find((r) => r.id === id) : undefined;
-                const { resource: row, result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: id, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } }, root);
+                const prior = keeps ? resourcesOfType(m.service, physicalType, root).find((r) => r.id === id) : undefined;
+                const { resource: row, result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: physicalType, subjectId: id, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } }, root);
                 if (operation)
                     observeStateWrite(m, result, before, root, stateChecks);
                 if (keeps)
@@ -1531,7 +1671,7 @@ export async function contextFor(m, call, scope) {
                     const prefix = `${type.slice(1)}_`;
                     let max = 0n;
                     for (const r of resources) {
-                        if (r.type !== type)
+                        if (r.type !== physicalType)
                             continue;
                         const digits = r.id.startsWith(prefix) ? r.id.slice(prefix.length) : '';
                         if (/^\d+$/.test(digits) && BigInt(digits) > max)
@@ -1539,21 +1679,21 @@ export async function contextFor(m, call, scope) {
                     }
                     return `${prefix}${max + 1n}`;
                 })();
-                return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } } };
-            }, root, () => resourcesOfType(m.service, type, root));
+                return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: physicalType, subjectId: subject, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } } };
+            }, root, () => resourcesOfType(m.service, physicalType, root));
             if (operation && result)
                 observeStateWrite(m, result, undefined, root, stateChecks);
-            const made = keeps && value !== undefined ? resourcesOfType(m.service, type, root).find((r) => r.id === value) : undefined;
+            const made = keeps && value !== undefined ? resourcesOfType(m.service, physicalType, root).find((r) => r.id === value) : undefined;
             if (made)
                 await keepCounts(m, call, type, made, params, root, at);
             return value;
         },
         get machines() {
             const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool');
-            return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies, { images: enrolled?.images }), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
+            return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
         },
-        signingKey: (label, alg) => worldSigningKey(m.service, root, at, label, alg ?? 'RS256'),
-        heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, label, alg ?? 'RS256'),
+        signingKey: (label, alg) => worldSigningKey(m.service, root, at, scopeLabel(m, label), alg ?? 'RS256'),
+        heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, scopeLabel(m, label), alg ?? 'RS256'),
         create: (resource, fields, operation) => atomicWrite(m, call, resource, (snapshot) => {
             const id = mintId(m, resource, root, at, snapshot);
             return { id, fields: typeof fields === 'function' ? fields(id) : fields };
@@ -1566,9 +1706,14 @@ export async function contextFor(m, call, scope) {
                 throw new Error('createUnique requires declared unique keys');
             let existing;
             const row = await atomicWrite(m, call, resource, (snapshot) => {
-                const id = mintId(m, resource, root, at, snapshot);
+                const id = options?.id ?? mintId(m, resource, root, at, snapshot);
                 const selected = typeof fields === 'function' ? fields(id) : fields;
-                const hit = snapshot.find((r) => r.type === storedType(m, resource) && r.deleted !== true && rules.some((rule) => rule.fields.every((f) => selected[f] !== undefined && view(m, resource, r)[f] === selected[f])));
+                const hit = snapshot.find((r) => {
+                    if (r.type !== storedType(m, resource) || r.deleted === true)
+                        return false;
+                    const fields = { [m.resources[resource]?.idAs ?? 'id']: r.id, ...ownFields(r) };
+                    return rules.some((rule) => rule.fields.every((field) => selected[field] !== undefined && fields[field] === selected[field]));
+                });
                 if (hit) {
                     existing = view(m, resource, hit);
                     return undefined;
@@ -1608,11 +1753,21 @@ export async function contextFor(m, call, scope) {
         },
         writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at, stateChecks),
         resolve: (resource, id) => resolveSubjectId(m.service, storedType(m, resource), id, root),
-        storedType: (resource) => storedType(m, resource),
+        storedType: (resource) => m.resources[resource]?.storedAs ?? resource,
         ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
         row: (resource, id, opts) => { const row = stored(m, resource, root, opts).find((r) => r.id === id); return row ? rawRow(resource, row) : undefined; },
         rowsRaw: (resource, opts) => stored(m, resource, root, opts).map((row) => rawRow(resource, row)),
-        tree: () => twinResources(m.service, root),
+        tree: () => {
+            const rows = twinResources(m.service, root);
+            if (m.tenant?.storage !== 'namespaced')
+                return rows;
+            const account = accountScope(m);
+            return rows.filter(row => {
+                const [base, encoded] = row.type.split(TENANT_TYPE);
+                const name = Object.keys(m.resources).find(name => (m.resources[name]?.storedAs ?? name) === base) ?? base;
+                return account === undefined || m.resources[name]?.shared || (encoded ? decodeURIComponent(encoded) : 'default') === account;
+            }).map(row => rawRow(row.type.split(TENANT_TYPE)[0], row));
+        },
         history: (resource, id) => subjectHistory(m.service, { type: storedType(m, resource), id }, root).map((e) => ({ ...(e.operation ? { operation: e.operation } : {}), ...(e.fields ? { fields: e.fields } : {}), ...(e.occurredAt ? { occurredAt: e.occurredAt } : {}) })),
         raw: (body, init = {}) => new Response(body, { status: init.status ?? 200, headers: init.headers ?? {} }),
         atomically: async (decide) => {
@@ -1667,17 +1822,17 @@ export async function contextFor(m, call, scope) {
         engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request) }),
         redis: (commands, options) => execRedisRun(commands, {
             root, occurredAt: at, service: m.service, readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), dialect: options.dialect,
-            ...(options.database === undefined ? {} : { database: options.database }),
+            ...(accountScope(m) && accountScope(m) !== 'default' ? { database: scopeLabel(m, options.database ?? 'default') } : options.database === undefined ? {} : { database: options.database }),
             ...(options.transaction === undefined ? {} : { transaction: options.transaction }),
         }),
-        live: liveAccess({ rows: (type) => resourcesOfType(m.service, type, root), blob: (key) => readResourceBlob(m.service, key, root) }, call.request),
+        live: liveAccess({ rows: (type) => stored(m, type, root).map(row => rawRow(type, row)), blob: (key) => readResourceBlob(m.service, scopeLabel(m, key), root) }, call.request),
         blobs: {
-            put: (key, bytes) => writeResourceBlob(m.service, key, bytes, root),
-            putStream: (key, body, accept) => writeResourceBlobStream(m.service, key, body, accept, root),
-            get: (key) => readResourceBlob(m.service, key, root),
-            remove: (key) => removeResourceBlob(m.service, key, root),
-            size: (key) => resourceBlobSize(m.service, key, root),
-            range: (key, start, endInclusive) => readResourceBlobRange(m.service, key, start, endInclusive, root),
+            put: (key, bytes) => writeResourceBlob(m.service, scopeLabel(m, key), bytes, root),
+            putStream: (key, body, accept) => writeResourceBlobStream(m.service, scopeLabel(m, key), body, accept, root),
+            get: (key) => readResourceBlob(m.service, scopeLabel(m, key), root),
+            remove: (key) => removeResourceBlob(m.service, scopeLabel(m, key), root),
+            size: (key) => resourceBlobSize(m.service, scopeLabel(m, key), root),
+            range: (key, start, endInclusive) => readResourceBlobRange(m.service, scopeLabel(m, key), start, endInclusive, root),
         },
         merge: (resource, prior, next) => mergeField(m.resources[resource]?.update, prior, next),
         conflict: (resource, fields, except) => {
@@ -1719,10 +1874,12 @@ const BATCH_REFUSED_READS = ['get', 'rows', 'tree', 'history', 'find', 'list', '
 /** The members that write, or wait on writes, or answer as another context: each lands the staged writes first. */
 const BATCH_LANDING_MEMBERS = ['create', 'createUnique', 'change', 'accumulate', 'writeDetailed', 'record', 'atomically', 'remove', 'issue', 'at', 'over', 'core', 'awaitWrite', 'awaitCondition',
     // a World's seed and signing keys are written when first asked (worldSeed, worldSigningKey, as a vendor's move)
-    'secret', 'signingKey'];
+    'secret', 'signingKey', 'account', 'organization', 'tenant', 'deploymentObject', 'accountKey'];
 /** `ctx.batch` over a context whose writes may be grouped (see `batchable`). */
 function bindBatch(m, call, context, params, root, at, rawRow) {
     let staged;
+    // A callback's native object must land before the helper writes its retained link.
+    let nativeAccountWrites = 0;
     // each staged subject as it will stand, by `type:id`, in the order first written
     const subjects = new Map();
     const land = async () => {
@@ -1738,7 +1895,19 @@ function bindBatch(m, call, context, params, root, at, rawRow) {
         const plain = ctx[name];
         if (typeof plain !== 'function')
             continue;
-        ctx[name] = async (...args) => { await land(); return plain(...args); };
+        ctx[name] = async (...args) => {
+            await land();
+            const native = name === 'tenant' || name === 'deploymentObject' || name === 'accountKey';
+            if (native)
+                nativeAccountWrites++;
+            try {
+                return await plain(...args);
+            }
+            finally {
+                if (native)
+                    nativeAccountWrites--;
+            }
+        };
     }
     for (const name of BATCH_REFUSED_READS) {
         const plain = ctx[name];
@@ -1753,7 +1922,7 @@ function bindBatch(m, call, context, params, root, at, rawRow) {
     const plainWrite = context.write, plainRow = context.row, plainRowsRaw = context.rowsRaw;
     context.write = async (resource, id, fields, operation) => {
         // a vendor's own move (ctx.asVendor) is the clock's write, recorded as the system's: it lands alone, in its place
-        if (!staged || inVendorMove()) {
+        if (!staged || nativeAccountWrites > 0 || inVendorMove()) {
             await land();
             return plainWrite(resource, id, fields, operation);
         }
@@ -2005,7 +2174,7 @@ export function authRefusal(m, request, root) {
     const held = m.auth.held;
     if (held && !held.standing?.includes(key)) {
         const hash = sha256(key);
-        const holds = resourcesOfType(m.service, held.storedAs, root).some((r) => r.deleted !== true && r[held.hashField] === hash && (held.unless === undefined || r[held.unless] !== true));
+        const holds = stored(m, held.storedAs, root).some((r) => r.deleted !== true && r[held.hashField] === hash && (held.unless === undefined || r[held.unless] !== true));
         if (!holds)
             return vendorError(errorManifest, invalid);
     }
@@ -2101,7 +2270,7 @@ export function crossCutting(m, opts = {}) {
         const url = new URL(request.url);
         const signature = hashFieldValue({ path: url.pathname + url.search, body: await bodyTextOf(request.clone()) });
         const id = `idem_${hex(key)}`;
-        const prior = twinResources(m.service, opts.root).find((r) => r.type === m.idempotency.storedAs && r.id === id);
+        const prior = twinResources(m.service, opts.root).find((r) => r.type === storedType(m, m.idempotency.storedAs) && r.id === id);
         if (prior) {
             if (m.idempotency.conflict && prior.requestHash !== undefined && prior.requestHash !== signature)
                 return vendorError(m, m.idempotency.conflict);
@@ -2117,7 +2286,7 @@ export function crossCutting(m, opts = {}) {
             return response;
         const contentType = response.headers.get('content-type') ?? 'application/json';
         const text = await response.clone().text();
-        await applyTwinWrite(m.service, { operation: 'idempotency.record', subjectType: m.idempotency.storedAs, subjectId: id, fields: { response: { status: response.status, text, contentType }, requestHash: signature }, occurredAt: (opts.clock ?? worldNow)(), actor: { kind: 'system' } }, opts.root);
+        await applyTwinWrite(m.service, { operation: 'idempotency.record', subjectType: storedType(m, m.idempotency.storedAs), subjectId: id, fields: { response: { status: response.status, text, contentType }, requestHash: signature }, occurredAt: (opts.clock ?? worldNow)(), actor: { kind: 'system' } }, opts.root);
         return response;
     }
 }

package/dist/src/index.d.ts

@@ -47,8 +47,8 @@ export { siteLabel, siteUrlOf, twinSiteUrl, twinVendorUrl } from './twin-fetch.j
 export { statefulTwinManifest, twinManifest } from './scenario.js';
 export { assetContentType, packAsset } from './pack-assets.js';
 export { bytesResponse, contentTypeOf, fileResponse } from './file-response.js';
-export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtVerify, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from './signing.js';
-export type { HandlerCrypto, Jwk, Jwks, JwtVerdict, SigningKey } from './signing.js';
+export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtSignClaims, jwtVerify, jwtVerifySignature, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from './signing.js';
+export type { HandlerCrypto, Jwk, Jwks, JwtDecodeOptions, JwtSignatureOptions, JwtVerdict, JwtVerificationKey, SigningKey } from './signing.js';
 export { blobDigest } from './blob-store.js';
 export { gunzip, gzip } from './bytes.js';
 export { ownFields } from './log.js';
@@ -81,3 +81,5 @@ export { readHostPort } from './host-port.js';
 export { assertBrowserName, browserOrigin, validateBrowserState, validateBrowserStorageState, validateBrowserContext, browserAcceptLanguage, cookieMatchesHost, type BrowserCookie, type BrowserState, type BrowserStorageState, type BrowserContext, type BrowserIndexedDB } from './browser-state.js';
 export * as managedOriginalInputs from './managed-original-inputs.js';
 export * as managedGoPrograms from './managed-go-programs.js';
+export { worldSecret, worldAccount } from './derived-core.js';
+export { isWorldAccountName } from './world-account-name.js';

package/dist/src/index.js

@@ -37,7 +37,7 @@ export { statefulTwinManifest, twinManifest } from "./scenario.js";
 export { assetContentType, packAsset } from "./pack-assets.js";
 export { bytesResponse, contentTypeOf, fileResponse } from "./file-response.js";
 // ── the kernel's deterministic helpers ─────────────────────────────────────────────────────────
-export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtVerify, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from "./signing.js";
+export { certificateOf, digest, digestBytes, equalSecrets, oauth1BaseString, oauth1Encode, oauth1Header, oauth1Signature, hmac, jwks, jwtDecode, jwtSign, jwtSignClaims, jwtVerify, jwtVerifySignature, keyId, lettersFrom, base62From, md5, publicKeyOf, sha256, signWith, SIGNING_ALGORITHMS, uuidFrom, verifyWith } from "./signing.js";
 export { blobDigest } from "./blob-store.js";
 // compressed bytes a wire carries (a SARIF upload), over web streams
 export { gunzip, gzip } from "./bytes.js";
@@ -73,3 +73,5 @@ export { readHostPort } from "./host-port.js";
 export { assertBrowserName, browserOrigin, validateBrowserState, validateBrowserStorageState, validateBrowserContext, browserAcceptLanguage, cookieMatchesHost } from "./browser-state.js";
 export * as managedOriginalInputs from "./managed-original-inputs.js";
 export * as managedGoPrograms from "./managed-go-programs.js";
+export { worldSecret, worldAccount } from "./derived-core.js";
+export { isWorldAccountName } from "./world-account-name.js";