@volter/world-core 3.0.162 → 3.0.163

package/dist/src/derived-core.d.ts

@@ -15,7 +15,7 @@ import { type MultipartPart } from './multipart.js';
 import type { CorsDecl } from './cors.js';
 import { type TwinAction } from './actions.js';
 import type { DerivedCall, DerivedCoreOutcome, DerivedHandler, DerivedOperation } from './derived.js';
-import type { PackDescriptor } from './packRegistry.js';
+import { type PackDescriptor } from './packRegistry.js';
 import type { ScenarioDecision, ScenarioHandler } from './scenario.js';
 /** How a stored field gets its value when the server assigns it. `now` is the world clock in the
  *  manifest's time format; `id` the subject's id; a `value` is stored as given. */
@@ -921,6 +921,18 @@ export type CoreScope = {
 export declare function worldSecret(service: string, root: string, label: string, at?: string): Promise<string>;
 /** The same retained account primitive for pack doors and private native twin fronts. */
 export declare function worldAccount(service: string, root: string | undefined, id?: unknown, at?: string, provisioning?: boolean): Promise<string>;
+type WorldOrganization = {
+    id: string;
+    label: string;
+    members: string[];
+};
+type VendorNameRule = {
+    max: number;
+    lower?: boolean;
+    allowed: RegExp;
+    separator?: string;
+    first?: RegExp;
+};
 /** The lane a vendor's router sent a request to (pack-fetch's laneRouter sets it). */
 export declare const LANE_HEADER = "x-volter-lane";
 /** What a coverage measurement sees of a pack's declared state logic: each move a request made and each refusal a
@@ -1018,6 +1030,27 @@ export type SemanticsContext = {
     secret(label: string): Promise<string>;
     /** Select an account at a pack's credential door. Packs retain their own vendor account/key semantics. */
     account(field?: string): Promise<string>;
+    /** The selected organization's label and people from the World's organization registry. */
+    organization(): Promise<WorldOrganization>;
+    /** The selected deployment, or an empty string for the organization's own level. */
+    deployment(): string;
+    /** A vendor-safe label; retained links keep identity independent of names. */
+    vendorName(label: string, rule: VendorNameRule, options?: {
+        suffixed?: boolean;
+        identity?: string;
+    }): string;
+    /** Retain the native customer tenant for the selected organization. */
+    tenant(resource: string, make: (organization: WorldOrganization) => Promise<string>): Promise<Record<string, unknown>>;
+    /** Retain one native resource of this kind for the selected organization and deployment. */
+    deploymentObject(kind: string, resource: string, make: (deployment: string) => Promise<string>): Promise<Record<string, unknown>>;
+    /** Reconstruct a live native key, replacing its link when the vendor's reader refuses it. */
+    accountKey(purpose: string, resource: string, key: {
+        make: () => Promise<string>;
+        read: (row: Record<string, unknown>) => Promise<string | undefined>;
+    }): Promise<{
+        id: string;
+        secret: string;
+    }>;
     /** The World's machine pool (machines.ts), as the pack's `machine-pool` door enrolled it; `none` when none was. */
     machines: MachinePool;
     /** A signing key pair for `label` (an issuer's ID tokens, a provider's JWTs, a CA's or a log's key), PEM: RSA 2048
@@ -1219,7 +1252,7 @@ export type HandlerContext = Omit<SemanticsContext, 'now' | 'core' | 'atomically
 };
 /** What a write hook reads: the writing call's context without its ways to write, so a hook that renders an event
  *  cannot write again (and run itself again). */
-export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'at' | 'over'>;
+export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'tenant' | 'deploymentObject' | 'accountKey' | 'at' | 'over'>;
 /** A derived pack's handler: one operation, by its operationId, over the contract's context. */
 export type Handler = (ctx: HandlerContext) => Promise<Response>;
 export declare function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScope): Promise<SemanticsContext>;

package/dist/src/derived-core.js

@@ -37,6 +37,7 @@ import { vendorFetch } from "./vendor-call.js";
 import { packReferences } from "./references.js";
 import { twinPublicBase, withRequestScopes } from "./twin-fetch.js";
 import { inVendorMove, isReadOnlyRequest, runAsVendorMove, writesRefused } from "./request-scope.js";
+import { getPack } from "./packRegistry.js";
 import { bodyTextOf, checkJsonBody, takeParsedBody } from "./derived.js";
 /** What a move to `to` stores in the field: a boolean field's value is a boolean, and a derived field's
  *  value is written by the move's effects (a state name is not a timestamp), so it stores nothing itself. */
@@ -473,6 +474,57 @@ export async function worldAccount(service, root, id = 'default', at = worldNow(
     }, root);
     return id;
 }
+function nativeAccountLink(row, field) {
+    if (!row || row.deleted === true)
+        return undefined;
+    const fields = ownFields(row);
+    const value = field === undefined ? fields : fields[field];
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const link = value;
+    return typeof link.resource === 'string' && typeof link.id === 'string' ? { resource: link.resource, id: link.id } : undefined;
+}
+const sameAccountLink = (a, b) => a?.resource === b?.resource && a?.id === b?.id;
+/** Native creation and reconstruction run outside the action lock; only the retained link is compared and written. */
+async function retainNativeAccountLink(service, root, at, call, type, id, field, resource, make, read) {
+    for (;;) {
+        const before = nativeAccountLink(resourcesOfType(service, type, root).find((row) => row.id === id), field);
+        const held = before && await read(before);
+        if (held !== undefined)
+            return held;
+        const made = { resource, id: await make() };
+        if (await read(made) === undefined)
+            throw new Error(`Credential ${type}/${id}: native ${resource}/${made.id} is unavailable after creation`);
+        const { value } = await applyTwinWriteAtomic(service, (snapshot) => {
+            const current = nativeAccountLink(snapshot.find((row) => row.type === type && row.id === id), field);
+            if (!sameAccountLink(current, before))
+                return { kind: 'skip', value: current };
+            return {
+                kind: 'write', value: made,
+                write: {
+                    operation: `${type.slice(1)}.link`, subjectType: type, subjectId: id,
+                    fields: field === undefined ? made : { name: id, [field]: made },
+                    ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' },
+                },
+            };
+        }, root);
+        const linked = value && await read(value);
+        if (linked !== undefined)
+            return linked;
+    }
+}
+function vendorName(label, rule, { suffixed = false, identity = label } = {}) {
+    const allowed = new RegExp(rule.allowed.source, rule.allowed.flags.replace(/[gy]/g, ''));
+    const separator = rule.separator ?? '-';
+    if ([...separator].length !== 1 || !allowed.test(separator))
+        throw new Error('Credential name separator must be one allowed character');
+    const first = rule.first && new RegExp(rule.first.source, rule.first.flags.replace(/[gy]/g, ''));
+    let name = [...(rule.lower ? label.toLowerCase() : label)].map((letter) => allowed.test(letter) ? letter : separator).join('');
+    name = name.replace(new RegExp(`${escapeRe(separator)}+`, 'g'), separator);
+    if (first && !first.test(name[0] ?? ''))
+        name = `w${separator}${name}`;
+    return name !== label || name.length > rule.max || suffixed ? `${name.slice(0, Math.max(0, rule.max - 9))}${separator}${sha256(identity).slice(0, 8)}` : name;
+}
 /** A World's signing key for a label (ctx.signingKey): made once from the platform's random source, then read; the
  *  making is one per service store and label in the process, as the seed's is. */
 const SIGNING_KEY = '_world_signing_key';
@@ -1489,6 +1541,8 @@ export async function contextFor(m, call, scope) {
     });
     const paths = expandPaths(m, params);
     const stateChecks = new Map();
+    const credentialDoor = m.descriptor?.credentialDoor ?? getPack(m.vendor)?.credentialDoor;
+    const credentialFields = body && typeof body === 'object' && !Array.isArray(body) ? body : {};
     const rawResources = new WeakMap();
     const rawRow = (resource, row) => {
         const name = m.resources[resource] ? resource : Object.keys(m.resources).find((name) => storedType(m, name) === row.type);
@@ -1502,6 +1556,10 @@ export async function contextFor(m, call, scope) {
         rawResources.set(row, name ?? resource);
         return row;
     };
+    const liveNativeRow = (link) => {
+        const row = context.row(link.resource, link.id);
+        return row && row.deleted !== true ? row : undefined;
+    };
     const context = {
         call,
         params,
@@ -1558,9 +1616,38 @@ export async function contextFor(m, call, scope) {
         },
         occurredAt: at,
         secret: async (label) => hmac(await worldSeed(m.service, root, at), scopeLabel(m, label), 'base64url'),
-        account: async (field = 'account') => {
-            const fields = body && typeof body === 'object' && !Array.isArray(body) ? body : {};
-            return worldAccount(m.service, root, fields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+        account: async (field = credentialDoor?.account?.field ?? 'account') => {
+            return worldAccount(m.service, root, credentialFields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+        },
+        organization: async () => {
+            const id = await context.account();
+            const row = projectOwnerResources('_world', root, { type: '_world_organization', id }).find((row) => row.type === '_world_organization' && row.id === id && row.deleted !== true);
+            return row ? { id, label: row.label, members: [...row.members] } : { id, label: id, members: ['owner@world.test'] };
+        },
+        deployment: () => {
+            const id = credentialFields[credentialDoor?.deployment?.field ?? 'deployment'] ?? '';
+            if (id !== '' && !isWorldAccountName(id))
+                throw new Error('Credential deployment must be a name of at most 128 letters, digits, dots, underscores or hyphens');
+            return id;
+        },
+        vendorName,
+        tenant: async (resource, make) => {
+            const id = await context.account();
+            return retainNativeAccountLink(m.service, root, at, call, '_world_account', id, 'tenant', resource, async () => make(await context.organization()), async (link) => liveNativeRow(link));
+        },
+        deploymentObject: async (kind, resource, make) => {
+            const organization = await context.account(), deployment = context.deployment();
+            return retainNativeAccountLink(m.service, root, at, call, '_world_deployment_object', `${organization}/${deployment}/${kind}`, undefined, resource, () => make(deployment), async (link) => liveNativeRow(link));
+        },
+        accountKey: async (purpose, resource, key) => {
+            const organization = await context.account(), deployment = context.deployment();
+            return retainNativeAccountLink(m.service, root, at, call, '_world_account_key', `${organization}/${deployment}/${purpose}`, undefined, resource, () => key.make(), async (link) => {
+                const row = liveNativeRow(link);
+                if (!row)
+                    return undefined;
+                const secret = await key.read(row);
+                return secret === undefined ? undefined : { id: link.id, secret };
+            });
         },
         record: async (type, fields, id, operation) => {
             if (!type.startsWith('_'))
@@ -1621,7 +1708,12 @@ export async function contextFor(m, call, scope) {
             const row = await atomicWrite(m, call, resource, (snapshot) => {
                 const id = options?.id ?? mintId(m, resource, root, at, snapshot);
                 const selected = typeof fields === 'function' ? fields(id) : fields;
-                const hit = snapshot.find((r) => r.type === storedType(m, resource) && r.deleted !== true && rules.some((rule) => rule.fields.every((f) => selected[f] !== undefined && view(m, resource, r)[f] === selected[f])));
+                const hit = snapshot.find((r) => {
+                    if (r.type !== storedType(m, resource) || r.deleted === true)
+                        return false;
+                    const fields = { [m.resources[resource]?.idAs ?? 'id']: r.id, ...ownFields(r) };
+                    return rules.some((rule) => rule.fields.every((field) => selected[field] !== undefined && fields[field] === selected[field]));
+                });
                 if (hit) {
                     existing = view(m, resource, hit);
                     return undefined;
@@ -1661,7 +1753,7 @@ export async function contextFor(m, call, scope) {
         },
         writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at, stateChecks),
         resolve: (resource, id) => resolveSubjectId(m.service, storedType(m, resource), id, root),
-        storedType: (resource) => storedType(m, resource),
+        storedType: (resource) => m.resources[resource]?.storedAs ?? resource,
         ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
         row: (resource, id, opts) => { const row = stored(m, resource, root, opts).find((r) => r.id === id); return row ? rawRow(resource, row) : undefined; },
         rowsRaw: (resource, opts) => stored(m, resource, root, opts).map((row) => rawRow(resource, row)),
@@ -1782,10 +1874,12 @@ const BATCH_REFUSED_READS = ['get', 'rows', 'tree', 'history', 'find', 'list', '
 /** The members that write, or wait on writes, or answer as another context: each lands the staged writes first. */
 const BATCH_LANDING_MEMBERS = ['create', 'createUnique', 'change', 'accumulate', 'writeDetailed', 'record', 'atomically', 'remove', 'issue', 'at', 'over', 'core', 'awaitWrite', 'awaitCondition',
     // a World's seed and signing keys are written when first asked (worldSeed, worldSigningKey, as a vendor's move)
-    'secret', 'signingKey'];
+    'secret', 'signingKey', 'account', 'organization', 'tenant', 'deploymentObject', 'accountKey'];
 /** `ctx.batch` over a context whose writes may be grouped (see `batchable`). */
 function bindBatch(m, call, context, params, root, at, rawRow) {
     let staged;
+    // A callback's native object must land before the helper writes its retained link.
+    let nativeAccountWrites = 0;
     // each staged subject as it will stand, by `type:id`, in the order first written
     const subjects = new Map();
     const land = async () => {
@@ -1801,7 +1895,19 @@ function bindBatch(m, call, context, params, root, at, rawRow) {
         const plain = ctx[name];
         if (typeof plain !== 'function')
             continue;
-        ctx[name] = async (...args) => { await land(); return plain(...args); };
+        ctx[name] = async (...args) => {
+            await land();
+            const native = name === 'tenant' || name === 'deploymentObject' || name === 'accountKey';
+            if (native)
+                nativeAccountWrites++;
+            try {
+                return await plain(...args);
+            }
+            finally {
+                if (native)
+                    nativeAccountWrites--;
+            }
+        };
     }
     for (const name of BATCH_REFUSED_READS) {
         const plain = ctx[name];
@@ -1816,7 +1922,7 @@ function bindBatch(m, call, context, params, root, at, rawRow) {
     const plainWrite = context.write, plainRow = context.row, plainRowsRaw = context.rowsRaw;
     context.write = async (resource, id, fields, operation) => {
         // a vendor's own move (ctx.asVendor) is the clock's write, recorded as the system's: it lands alone, in its place
-        if (!staged || inVendorMove()) {
+        if (!staged || nativeAccountWrites > 0 || inVendorMove()) {
             await land();
             return plainWrite(resource, id, fields, operation);
         }

package/dist/src/packRegistry.d.ts

@@ -204,6 +204,18 @@ export type TwinPack = {
         fill: Record<string, string>;
         account?: {
             field: string;
+        } & ({
+            tenancy?: never;
+            source?: never;
+        } | {
+            tenancy: string;
+            source: string;
+        });
+        deployment?: {
+            field: string;
+            object: string;
+            source: string;
+            organizationOutputs?: string[];
         };
     };
     /** Another pack of this vendor issues the API's credentials; architecture, descriptor World wiring. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "3.0.162",
+  "version": "3.0.163",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",

package/src/derived-core.ts

@@ -43,7 +43,7 @@ import type { SubjectFields } from './hash.ts';
 import { twinPublicBase, withRequestScopes } from './twin-fetch.ts';
 import { inVendorMove, isReadOnlyRequest, runAsVendorMove, writesRefused } from './request-scope.ts';
 import type { DerivedCall, DerivedCoreOutcome, DerivedHandler, DerivedOperation } from './derived.ts';
-import type { PackDescriptor } from './packRegistry.ts';
+import { getPack, type PackDescriptor } from './packRegistry.ts';
 import type { ScenarioDecision, ScenarioHandler } from './scenario.ts';
 import { bodyTextOf, checkJsonBody, takeParsedBody } from './derived.ts';
 
@@ -996,6 +996,62 @@ export async function worldAccount(service: string, root: string | undefined, id
   return id;
 }
 
+type WorldOrganization = { id: string; label: string; members: string[] };
+type VendorNameRule = { max: number; lower?: boolean; allowed: RegExp; separator?: string; first?: RegExp };
+type NativeAccountLink = { resource: string; id: string };
+
+function nativeAccountLink(row: TwinResource | undefined, field?: string): NativeAccountLink | undefined {
+  if (!row || row.deleted === true) return undefined;
+  const fields = ownFields(row);
+  const value = field === undefined ? fields : fields[field];
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const link = value as Record<string, unknown>;
+  return typeof link.resource === 'string' && typeof link.id === 'string' ? { resource: link.resource, id: link.id } : undefined;
+}
+
+const sameAccountLink = (a: NativeAccountLink | undefined, b: NativeAccountLink | undefined): boolean =>
+  a?.resource === b?.resource && a?.id === b?.id;
+
+/** Native creation and reconstruction run outside the action lock; only the retained link is compared and written. */
+async function retainNativeAccountLink<T>(
+  service: string, root: string | undefined, at: string, call: DerivedCall,
+  type: string, id: string, field: string | undefined, resource: string,
+  make: () => Promise<string>, read: (link: NativeAccountLink) => Promise<T | undefined>,
+): Promise<T> {
+  for (;;) {
+    const before = nativeAccountLink(resourcesOfType(service, type, root).find((row) => row.id === id), field);
+    const held = before && await read(before);
+    if (held !== undefined) return held;
+    const made = { resource, id: await make() };
+    if (await read(made) === undefined) throw new Error(`Credential ${type}/${id}: native ${resource}/${made.id} is unavailable after creation`);
+    const { value } = await applyTwinWriteAtomic(service, (snapshot) => {
+      const current = nativeAccountLink(snapshot.find((row) => row.type === type && row.id === id), field);
+      if (!sameAccountLink(current, before)) return { kind: 'skip', value: current };
+      return {
+        kind: 'write', value: made,
+        write: {
+          operation: `${type.slice(1)}.link`, subjectType: type, subjectId: id,
+          fields: field === undefined ? made : { name: id, [field]: made },
+          ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' },
+        },
+      };
+    }, root);
+    const linked = value && await read(value);
+    if (linked !== undefined) return linked;
+  }
+}
+
+function vendorName(label: string, rule: VendorNameRule, { suffixed = false, identity = label }: { suffixed?: boolean; identity?: string } = {}): string {
+  const allowed = new RegExp(rule.allowed.source, rule.allowed.flags.replace(/[gy]/g, ''));
+  const separator = rule.separator ?? '-';
+  if ([...separator].length !== 1 || !allowed.test(separator)) throw new Error('Credential name separator must be one allowed character');
+  const first = rule.first && new RegExp(rule.first.source, rule.first.flags.replace(/[gy]/g, ''));
+  let name = [...(rule.lower ? label.toLowerCase() : label)].map((letter) => allowed.test(letter) ? letter : separator).join('');
+  name = name.replace(new RegExp(`${escapeRe(separator)}+`, 'g'), separator);
+  if (first && !first.test(name[0] ?? '')) name = `w${separator}${name}`;
+  return name !== label || name.length > rule.max || suffixed ? `${name.slice(0, Math.max(0, rule.max - 9))}${separator}${sha256(identity).slice(0, 8)}` : name;
+}
+
 /** A World's signing key for a label (ctx.signingKey): made once from the platform's random source, then read; the
  *  making is one per service store and label in the process, as the seed's is. */
 const SIGNING_KEY = '_world_signing_key';
@@ -1959,6 +2015,18 @@ export type SemanticsContext = {
   secret(label: string): Promise<string>;
   /** Select an account at a pack's credential door. Packs retain their own vendor account/key semantics. */
   account(field?: string): Promise<string>;
+  /** The selected organization's label and people from the World's organization registry. */
+  organization(): Promise<WorldOrganization>;
+  /** The selected deployment, or an empty string for the organization's own level. */
+  deployment(): string;
+  /** A vendor-safe label; retained links keep identity independent of names. */
+  vendorName(label: string, rule: VendorNameRule, options?: { suffixed?: boolean; identity?: string }): string;
+  /** Retain the native customer tenant for the selected organization. */
+  tenant(resource: string, make: (organization: WorldOrganization) => Promise<string>): Promise<Record<string, unknown>>;
+  /** Retain one native resource of this kind for the selected organization and deployment. */
+  deploymentObject(kind: string, resource: string, make: (deployment: string) => Promise<string>): Promise<Record<string, unknown>>;
+  /** Reconstruct a live native key, replacing its link when the vendor's reader refuses it. */
+  accountKey(purpose: string, resource: string, key: { make: () => Promise<string>; read: (row: Record<string, unknown>) => Promise<string | undefined> }): Promise<{ id: string; secret: string }>;
   /** The World's machine pool (machines.ts), as the pack's `machine-pool` door enrolled it; `none` when none was. */
   machines: MachinePool;
   /** A signing key pair for `label` (an issuer's ID tokens, a provider's JWTs, a CA's or a log's key), PEM: RSA 2048
@@ -2105,7 +2173,7 @@ export type HandlerContext = Omit<SemanticsContext, 'now' | 'core' | 'atomically
 };
 /** What a write hook reads: the writing call's context without its ways to write, so a hook that renders an event
  *  cannot write again (and run itself again). */
-export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'at' | 'over'>;
+export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'tenant' | 'deploymentObject' | 'accountKey' | 'at' | 'over'>;
 /** A derived pack's handler: one operation, by its operationId, over the contract's context. */
 export type Handler = (ctx: HandlerContext) => Promise<Response>;
 
@@ -2153,6 +2221,8 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
   });
   const paths = expandPaths(m, params);
   const stateChecks: StateChecks = new Map();
+  const credentialDoor = m.descriptor?.credentialDoor ?? getPack(m.vendor)?.credentialDoor;
+  const credentialFields = body && typeof body === 'object' && !Array.isArray(body) ? body as Record<string, unknown> : {};
   const rawResources = new WeakMap<Record<string, unknown>, string>();
   const rawRow = (resource: string, row: TwinResource): Record<string, unknown> => {
     const name = m.resources[resource] ? resource : Object.keys(m.resources).find((name) => storedType(m, name) === row.type);
@@ -2166,6 +2236,10 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     rawResources.set(row as Record<string, unknown>, name ?? resource);
     return row as Record<string, unknown>;
   };
+  const liveNativeRow = (link: NativeAccountLink): Record<string, unknown> | undefined => {
+    const row = context.row(link.resource, link.id);
+    return row && row.deleted !== true ? row : undefined;
+  };
   const context: SemanticsContext = {
     call,
     params,
@@ -2218,9 +2292,39 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     },
     occurredAt: at,
     secret: async (label) => hmac(await worldSeed(m.service, root, at), scopeLabel(m, label), 'base64url'),
-    account: async (field = 'account') => {
-      const fields = body && typeof body === 'object' && !Array.isArray(body) ? body as Record<string, unknown> : {};
-      return worldAccount(m.service, root, fields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+    account: async (field = credentialDoor?.account?.field ?? 'account') => {
+      return worldAccount(m.service, root, credentialFields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+    },
+    organization: async () => {
+      const id = await context.account();
+      const row = projectOwnerResources('_world', root, { type: '_world_organization', id }).find((row) => row.type === '_world_organization' && row.id === id && row.deleted !== true);
+      return row ? { id, label: row.label as string, members: [...(row.members as string[])] } : { id, label: id, members: ['owner@world.test'] };
+    },
+    deployment: () => {
+      const id = credentialFields[credentialDoor?.deployment?.field ?? 'deployment'] ?? '';
+      if (id !== '' && !isWorldAccountName(id)) throw new Error('Credential deployment must be a name of at most 128 letters, digits, dots, underscores or hyphens');
+      return id;
+    },
+    vendorName,
+    tenant: async (resource, make) => {
+      const id = await context.account();
+      return retainNativeAccountLink(m.service, root, at, call, '_world_account', id, 'tenant', resource,
+        async () => make(await context.organization()), async (link) => liveNativeRow(link));
+    },
+    deploymentObject: async (kind, resource, make) => {
+      const organization = await context.account(), deployment = context.deployment();
+      return retainNativeAccountLink(m.service, root, at, call, '_world_deployment_object', `${organization}/${deployment}/${kind}`, undefined, resource,
+        () => make(deployment), async (link) => liveNativeRow(link));
+    },
+    accountKey: async (purpose, resource, key) => {
+      const organization = await context.account(), deployment = context.deployment();
+      return retainNativeAccountLink(m.service, root, at, call, '_world_account_key', `${organization}/${deployment}/${purpose}`, undefined, resource,
+        () => key.make(), async (link) => {
+          const row = liveNativeRow(link);
+          if (!row) return undefined;
+          const secret = await key.read(row);
+          return secret === undefined ? undefined : { id: link.id, secret };
+        });
     },
     record: async (type, fields, id, operation) => {
       if (!type.startsWith('_')) throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
@@ -2272,7 +2376,11 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
       const row = await atomicWrite(m, call, resource, (snapshot) => {
         const id = options?.id ?? mintId(m, resource, root, at, snapshot);
         const selected = typeof fields === 'function' ? fields(id) : fields;
-        const hit = snapshot.find((r) => r.type === storedType(m, resource) && r.deleted !== true && rules.some((rule) => rule.fields.every((f) => selected[f] !== undefined && view(m, resource, r)[f] === selected[f])));
+        const hit = snapshot.find((r) => {
+          if (r.type !== storedType(m, resource) || r.deleted === true) return false;
+          const fields = { [m.resources[resource]?.idAs ?? 'id']: r.id, ...ownFields(r) };
+          return rules.some((rule) => rule.fields.every((field) => selected[field] !== undefined && fields[field] === selected[field]));
+        });
         if (hit) { existing = view(m, resource, hit); return undefined; }
         return { id, fields: selected };
       }, operation, params, root, at, undefined, stateChecks, options?.input === 'omit');
@@ -2304,7 +2412,7 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     },
     writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at, stateChecks),
     resolve: (resource, id) => resolveSubjectId(m.service, storedType(m, resource), id, root),
-    storedType: (resource) => storedType(m, resource),
+    storedType: (resource) => m.resources[resource]?.storedAs ?? resource,
     ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
     row: (resource, id, opts) => { const row = stored(m, resource, root, opts).find((r) => r.id === id); return row ? rawRow(resource, row) : undefined; },
     rowsRaw: (resource, opts) => stored(m, resource, root, opts).map((row) => rawRow(resource, row)),
@@ -2427,12 +2535,14 @@ const BATCH_REFUSED_READS = ['get', 'rows', 'tree', 'history', 'find', 'list', '
 /** The members that write, or wait on writes, or answer as another context: each lands the staged writes first. */
 const BATCH_LANDING_MEMBERS = ['create', 'createUnique', 'change', 'accumulate', 'writeDetailed', 'record', 'atomically', 'remove', 'issue', 'at', 'over', 'core', 'awaitWrite', 'awaitCondition',
   // a World's seed and signing keys are written when first asked (worldSeed, worldSigningKey, as a vendor's move)
-  'secret', 'signingKey'] as const;
+  'secret', 'signingKey', 'account', 'organization', 'tenant', 'deploymentObject', 'accountKey'] as const;
 
 /** `ctx.batch` over a context whose writes may be grouped (see `batchable`). */
 function bindBatch(m: DerivedManifest, call: DerivedCall, context: SemanticsContext, params: Record<string, unknown>, root: string | undefined, at: string,
   rawRow: (resource: string, row: TwinResource) => Record<string, unknown>): void {
   let staged: StagedWrite[] | undefined;
+  // A callback's native object must land before the helper writes its retained link.
+  let nativeAccountWrites = 0;
   // each staged subject as it will stand, by `type:id`, in the order first written
   const subjects = new Map<string, Subject>();
   const land = async (): Promise<void> => {
@@ -2446,7 +2556,13 @@ function bindBatch(m: DerivedManifest, call: DerivedCall, context: SemanticsCont
   for (const name of BATCH_LANDING_MEMBERS) {
     const plain = ctx[name];
     if (typeof plain !== 'function') continue;
-    ctx[name] = async (...args: unknown[]) => { await land(); return (plain as (...a: unknown[]) => unknown)(...args); };
+    ctx[name] = async (...args: unknown[]) => {
+      await land();
+      const native = name === 'tenant' || name === 'deploymentObject' || name === 'accountKey';
+      if (native) nativeAccountWrites++;
+      try { return await (plain as (...a: unknown[]) => unknown)(...args); }
+      finally { if (native) nativeAccountWrites--; }
+    };
   }
   for (const name of BATCH_REFUSED_READS) {
     const plain = ctx[name];
@@ -2459,7 +2575,7 @@ function bindBatch(m: DerivedManifest, call: DerivedCall, context: SemanticsCont
   const plainWrite = context.write, plainRow = context.row, plainRowsRaw = context.rowsRaw;
   context.write = async (resource, id, fields, operation) => {
     // a vendor's own move (ctx.asVendor) is the clock's write, recorded as the system's: it lands alone, in its place
-    if (!staged || inVendorMove()) { await land(); return plainWrite(resource, id, fields, operation); }
+    if (!staged || nativeAccountWrites > 0 || inVendorMove()) { await land(); return plainWrite(resource, id, fields, operation); }
     const type = storedType(m, resource), key = `${type}:${id}`;
     // the one subject, as the memoized tree holds it (readTreeMap would copy the whole tree on every staged write)
     const subject = foldLocalWrite(subjects.get(key) ?? heldSubject(m.service, type, id, root), type, id, fields as SubjectFields, at);

package/src/packRegistry.ts

@@ -221,7 +221,13 @@ export type TwinPack = {
    *  answer: `init` writes `$issue:<service>` for each, and `up`, once this twin is running, POSTs the body to the door
    *  and sets each name to its field (`file:<field>` materializes one file; `directory:<field>` a relative-file map). A twin that holds its keys (refusing any it
    *  did not issue) declares one, so a World's applications hold keys it issued rather than fixtures it refuses. */
-  credentialDoor?: { path: string; body: Record<string, unknown>; fill: Record<string, string>; account?: { field: string } };
+  credentialDoor?: {
+    path: string;
+    body: Record<string, unknown>;
+    fill: Record<string, string>;
+    account?: { field: string } & ({ tenancy?: never; source?: never } | { tenancy: string; source: string });
+    deployment?: { field: string; object: string; source: string; organizationOutputs?: string[] };
+  };
   /** Another pack of this vendor issues the API's credentials; architecture, descriptor World wiring. */
   credentialIssuer?: string;
   prismaAdapter?: { adapter: string; export: string; urlEnv: string };