@volter/world-core 3.0.162 → 3.0.164

package/dist/src/managed-database.d.ts

@@ -76,9 +76,11 @@ export declare function managedDatabase(url: string, options?: {
  *  walk/journey-kit.ts), its statements sent as its client sends them: a text alone as one simple Query (a migration
  *  file, a `BEGIN`), a text with values as one extended-protocol statement, the values bind parameters. A transaction it
  *  opens stays open across its statements until it ends it, as on the application's own connection. Each statement's
- *  answer is its results in Postgres's text format, untyped. */
+ *  answer is its results in Postgres's text format, with native column type OIDs retained beside the values. */
 export type DatabaseSession = {
-    query(text: string, values?: ReadonlyArray<string | null>): Promise<StatementResult[]>;
+    query(text: string, values?: ReadonlyArray<string | null>): Promise<Array<StatementResult & {
+        fieldTypes: number[];
+    }>>;
     end(): Promise<void>;
 };
 /** The World's Postgres at `url` as one connection held until `end()`. */

package/dist/src/managed-database.js

@@ -255,6 +255,7 @@ export async function databaseSession(url) {
                 const answer = (await client.query({ text, ...(values === undefined ? {} : { values }), rowMode: 'array', types: raw }));
                 return (Array.isArray(answer) ? answer : [answer]).map((r) => ({
                     fields: (r.fields ?? []).map((f) => f.name),
+                    fieldTypes: (r.fields ?? []).map((f) => f.dataTypeID),
                     rows: r.rows ?? [],
                     command: [r.command ?? '', r.command === 'INSERT' ? '0' : '', r.rowCount ?? ''].filter((part) => part !== '').join(' '),
                 }));

package/dist/src/media-header.d.ts

@@ -0,0 +1,34 @@
+type ImageType = 'image/png' | 'image/gif' | 'image/jpeg' | 'image/webp';
+type Dimensions = {
+    width: number;
+    height: number;
+};
+type ImageHeader = Dimensions & {
+    jpeg?: {
+        frameEnd: number;
+        nonMarkerBytes: boolean;
+        standaloneMarkers: boolean;
+        fillBytes: boolean;
+        shortSegments: boolean;
+    };
+};
+/** Dimensions in a caller-declared image format, or undefined for an incomplete header. */
+export declare function imageDimensions(bytes: Uint8Array, type: ImageType): ImageHeader | undefined;
+/** An image's signature and dimensions, without deciding whether a vendor accepts that format or size. */
+export declare function readImageHeader(bytes: Uint8Array): (ImageHeader & {
+    type: ImageType;
+}) | undefined;
+/** ISO BMFF's bounded top-level boxes and movie headers, with raw duration and 16.16 track dimensions. */
+export declare function readMp4Header(bytes: Uint8Array): {
+    fileType: boolean;
+    hasMediaData: boolean;
+    movies: Array<{
+        headers: Array<{
+            timescale: number;
+            duration: number;
+            payloadSize: number;
+        }>;
+        tracks: Dimensions[];
+    }>;
+};
+export {};

package/dist/src/media-header.js

@@ -0,0 +1,129 @@
+const tag = (bytes, at) => String.fromCharCode(...bytes.subarray(at, at + 4));
+/** Dimensions in a caller-declared image format, or undefined for an incomplete header. */
+export function imageDimensions(bytes, type) {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    if (type === 'image/png')
+        return bytes.length >= 24 ? { width: view.getUint32(16), height: view.getUint32(20) } : undefined;
+    if (type === 'image/gif')
+        return bytes.length >= 10 ? { width: view.getUint16(6, true), height: view.getUint16(8, true) } : undefined;
+    if (type === 'image/webp') {
+        if (bytes.length < 30)
+            return undefined;
+        const chunk = tag(bytes, 12);
+        if (chunk === 'VP8 ')
+            return { width: view.getUint16(26, true) & 0x3fff, height: view.getUint16(28, true) & 0x3fff };
+        if (chunk === 'VP8L') {
+            const bits = view.getUint32(21, true);
+            return { width: 1 + (bits & 0x3fff), height: 1 + ((bits >>> 14) & 0x3fff) };
+        }
+        if (chunk === 'VP8X') {
+            const u24 = (at) => bytes[at] | (bytes[at + 1] << 8) | (bytes[at + 2] << 16);
+            return { width: 1 + u24(24), height: 1 + u24(27) };
+        }
+        return undefined;
+    }
+    let at = 2;
+    const jpeg = { frameEnd: 0, nonMarkerBytes: false, standaloneMarkers: false, fillBytes: false, shortSegments: false };
+    while (at + 4 <= bytes.length) {
+        if (bytes[at] !== 0xff) {
+            jpeg.nonMarkerBytes = true;
+            at += 1;
+            continue;
+        }
+        const marker = bytes[at + 1];
+        if (marker === 0xff) {
+            jpeg.fillBytes = true;
+            at += 1;
+            continue;
+        }
+        if (marker === 0xd8 || marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7)) {
+            jpeg.standaloneMarkers = true;
+            at += 2;
+            continue;
+        }
+        const length = view.getUint16(at + 2);
+        if (length < 2)
+            jpeg.shortSegments = true;
+        if (marker >= 0xc0 && marker <= 0xcf && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+            return at + 9 <= bytes.length ? { width: view.getUint16(at + 7), height: view.getUint16(at + 5), jpeg: { ...jpeg, frameEnd: at + 9 } } : undefined;
+        }
+        if (marker === 0xda)
+            return undefined;
+        at += 2 + length;
+    }
+    return undefined;
+}
+/** An image's signature and dimensions, without deciding whether a vendor accepts that format or size. */
+export function readImageHeader(bytes) {
+    let type;
+    if (bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4e && bytes[3] === 0x47)
+        type = 'image/png';
+    else if (tag(bytes, 0).startsWith('GIF'))
+        type = 'image/gif';
+    else if (bytes[0] === 0xff && bytes[1] === 0xd8)
+        type = 'image/jpeg';
+    else if (tag(bytes, 0) === 'RIFF' && tag(bytes, 8) === 'WEBP')
+        type = 'image/webp';
+    else
+        return undefined;
+    const dimensions = imageDimensions(bytes, type);
+    return dimensions ? { type, ...dimensions } : undefined;
+}
+/** ISO BMFF's bounded top-level boxes and movie headers, with raw duration and 16.16 track dimensions. */
+export function readMp4Header(bytes) {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    function* boxes(from, to) {
+        let at = from;
+        while (at + 8 <= to) {
+            let size = view.getUint32(at);
+            const type = tag(bytes, at + 4);
+            let header = 8;
+            if (size === 1) {
+                if (at + 16 > to)
+                    return;
+                size = Number(view.getBigUint64(at + 8));
+                header = 16;
+            }
+            if (size === 0)
+                size = to - at;
+            if (!Number.isSafeInteger(size) || size < header || size > to - at)
+                return;
+            yield { type, start: at + header, end: at + size };
+            at += size;
+        }
+    }
+    const result = { fileType: bytes.length >= 8 && tag(bytes, 4) === 'ftyp', hasMediaData: false, movies: [] };
+    for (const box of boxes(0, bytes.length)) {
+        if (box.type === 'mdat' && box.end > box.start)
+            result.hasMediaData = true;
+        if (box.type !== 'moov')
+            continue;
+        const movie = { headers: [], tracks: [] };
+        result.movies.push(movie);
+        for (const child of boxes(box.start, box.end)) {
+            const { type, start, end } = child;
+            if (type === 'mvhd' && start < end) {
+                const version = bytes[start];
+                const payloadSize = end - start;
+                if (version === 0 && payloadSize >= 20)
+                    movie.headers.push({ timescale: view.getUint32(start + 12), duration: view.getUint32(start + 16), payloadSize });
+                if (version === 1 && payloadSize >= 32)
+                    movie.headers.push({ timescale: view.getUint32(start + 20), duration: Number(view.getBigUint64(start + 24)), payloadSize });
+            }
+            if (type !== 'trak')
+                continue;
+            for (const track of boxes(start, end)) {
+                if (track.type !== 'tkhd' || track.start >= track.end)
+                    continue;
+                const version = bytes[track.start];
+                const at = version === 1 ? track.start + 88 : version === 0 ? track.start + 76 : track.end;
+                if (at + 8 > track.end)
+                    continue;
+                const width = view.getUint32(at) / 65536;
+                const height = view.getUint32(at + 4) / 65536;
+                movie.tracks.push({ width, height });
+            }
+        }
+    }
+    return result;
+}

package/dist/src/pack-fetch.d.ts

@@ -1,5 +1,5 @@
-import { type DerivedManifest, type Handler, type HandlerContext, type ScreenDecl, type VendorManifest } from './derived-core.js';
-import { type DerivedFetch, type DerivedSurface, type BoardFrame } from './derived.js';
+import { type DerivedManifest, type Handler, type HandlerContext, type LanesDecl, type ScreenDecl, type VendorManifest } from './derived-core.js';
+import { compileSurface, type DerivedFetch, type DerivedSurface, type BoardFrame } from './derived.js';
 import { type PackScenarioAdapter } from './scenario.js';
 import type { ApplicationStandIn } from './events.js';
 import { type SocketEngine } from './sockets.js';
@@ -83,13 +83,34 @@ export type PackFetchOptions = {
     clock?: () => string;
     database?: string;
     scenarioPath?: string;
-    /** the application a walk stands in for (a life's `application` answers): this fetch's `ctx.ask` is answered by it */
+    /** the application a walk stands in for: this fetch's requests and declared events are answered by it */
     application?: ApplicationStandIn;
 };
+/** The host a request is for: the vendor host the World's injector names, else its own. */
+export declare const hostOf: (request: Request) => string;
 /** Where a workspace asked `?show=<type>:<id>` opens the record (architecture, "Workspace"): the built workspace page
  *  that shows that type, its parameter the id; else the one that lists the type; else the workspace's home (its root
  *  page). Every other parameter a page's path names is the asking page's, and a page that cannot be filled is passed
  *  over. Undefined when nothing is asked; the path (with no `show`) otherwise. */
 export declare function shownRecord(url: URL, workspaces: ReadonlyArray<ScreenDecl>, params: Record<string, string>): string | undefined;
+/** A declared World door, matched by the same normalized path for serving and response ownership. */
+export declare function worldDoorMatcher<Door extends {
+    method: string;
+    path: string;
+}>(doors: ReadonlyArray<Door>): (method: string, path: string) => {
+    door: Door;
+    params: Record<string, string>;
+} | undefined;
+/** A request with its path's repeated slashes merged, as a front that merges them routes it (the manifest's
+ *  `mergeSlashes`); one with none is itself. */
+export declare function slashesMerged(request: Request): Request;
+/** The selected unit's request transformation, shared by serving and response judgment. */
+export declare function unitRequestRouter(m: Pick<DerivedManifest, 'pathPrefix' | 'basePathAlias' | 'pathFromHost' | 'hostParams' | 'headerParams'>, surface: DerivedSurface, routes: ReturnType<typeof compileSurface>): (request: Request) => Request;
+/** A pack's HTTP surface, as the kernel serves it from the pack's parts. */
 export declare function createPackFetch(parts: PackParts, options?: PackFetchOptions): DerivedFetch;
+/** The lane selected by the vendor gateway, shared by serving and response judgment. */
+export declare function laneSelector(decl: LanesDecl, lanes: Record<string, {
+    manifest: LanePart['manifest'];
+    fetch: Pick<LanePart['fetch'], 'serves' | 'contentHosts'>;
+}>, rootServes?: (method: string, path: string) => boolean): (request: Request) => string | undefined;
 export declare function createVendorFetch(manifest: VendorManifest, lanes: Record<string, LanePart>): DerivedFetch;

package/dist/src/pack-fetch.js

@@ -71,7 +71,7 @@ function hostMatcher(pattern) {
     };
 }
 /** The host a request is for: the vendor host the World's injector names, else its own. */
-const hostOf = (request) => readHostPort(request.headers.get('x-volter-twin-original-host') ?? request.headers.get('host') ?? new URL(request.url).host)?.host ?? '';
+export const hostOf = (request) => readHostPort(request.headers.get('x-volter-twin-original-host') ?? request.headers.get('host') ?? new URL(request.url).host)?.host ?? '';
 /** Where a workspace asked `?show=<type>:<id>` opens the record (architecture, "Workspace"): the built workspace page
  *  that shows that type, its parameter the id; else the one that lists the type; else the workspace's home (its root
  *  page). Every other parameter a page's path names is the asking page's, and a page that cannot be filled is passed
@@ -152,12 +152,26 @@ async function encoded(m, request, res) {
     const buffered = new ReadableStream({ start(controller) { controller.enqueue(body); controller.close(); } });
     return new Response(buffered, { status: res.status, statusText: res.statusText, headers });
 }
-/** A pack's HTTP surface, as the kernel serves it from the pack's parts. */
 /** A door's path as it is served and listed: under `/_twin/`, whether the manifest writes the prefix or not. */
 const doorPath = (path) => (path.startsWith('/_twin/') ? path : `/_twin${path.startsWith('/') ? '' : '/'}${path}`);
+/** A declared World door, matched by the same normalized path for serving and response ownership. */
+export function worldDoorMatcher(doors) {
+    const routes = doors.map((door) => ({ door, method: door.method.toUpperCase(), matches: pathMatcher(doorPath(door.path), false) }));
+    return (method, path) => {
+        const at = path.replace(/\/+$/, '') || '/';
+        for (const route of routes) {
+            if (route.method !== method.toUpperCase())
+                continue;
+            const hit = route.matches(at);
+            if (hit)
+                return { door: route.door, params: hit.params };
+        }
+        return undefined;
+    };
+}
 /** A request with its path's repeated slashes merged, as a front that merges them routes it (the manifest's
  *  `mergeSlashes`); one with none is itself. */
-function slashesMerged(request) {
+export function slashesMerged(request) {
     const url = new URL(request.url);
     const merged = url.pathname.replace(/\/{2,}/g, '/');
     if (merged === url.pathname)
@@ -165,6 +179,63 @@ function slashesMerged(request) {
     url.pathname = merged;
     return new Request(url, request);
 }
+/** The selected unit's request transformation, shared by serving and response judgment. */
+export function unitRequestRouter(m, surface, routes) {
+    const prefix = m.pathPrefix ? new RegExp(`^(?:${m.pathPrefix})(?=/)`) : undefined;
+    const base = surface.basePath ?? '';
+    const baseAlias = m.basePathAlias && base ? new RegExp(`^(?:${m.basePathAlias})(?=/)`) : undefined;
+    const hostPath = m.pathFromHost ? new RegExp(m.pathFromHost, 'i') : undefined;
+    const hostParams = m.hostParams ? new RegExp(m.hostParams, 'i') : undefined;
+    // each operation's spanning parameters, keyed by the operation and the parameter as the route compiles them (a whole
+    // segment's label whose name the surface or the manifest declares spanning), so one operation's spanning name never
+    // keeps another's slashes, nor a label that only part of a segment holds
+    const spanningNames = new Set(surface.spanning ?? []);
+    const spanningOf = new Set(surface.operations.flatMap((op) => ((op.basePath ?? base) + op.path).split('/').flatMap((seg) => {
+        const label = /^\{([^}]+)\}$/.exec(seg)?.[1];
+        return label !== undefined && spanningNames.has(label) ? [`${op.id}\u0000${label}`] : [];
+    })));
+    /** A path as the vendor routes it: the manifest's path prefix taken off, the spec's base in an alias's place, a host's
+     *  path label (pathFromHost) put in front. */
+    const rewritten = (pathname, host) => {
+        let path = pathname;
+        if (prefix)
+            path = path.replace(prefix, '') || '/';
+        // a base the vendor serves as its own: the spec's base in its place (a path already under the spec's base stays)
+        if (baseAlias && !(path === base || path.startsWith(`${base}/`)))
+            path = path.replace(baseAlias, base);
+        const label = hostPath?.exec(host)?.[1];
+        if (label)
+            path = `/${label}${path === '/' ? '' : path}`;
+        return path;
+    };
+    /** The request as its vendor routes it: duplicate slashes collapsed, unless the rewritten path matches an operation
+     *  through one of that operation's spanning parameters (the surface's and the manifest's), whose value keeps its
+     *  slashes; then rewritten. */
+    return (request) => {
+        const url = new URL(request.url);
+        const host = hostOf(request);
+        const kept = rewritten(url.pathname, host);
+        const matched = matchOperation(routes, request.method, kept);
+        const spanning = matched !== undefined && Object.keys(matched.params).some((name) => spanningOf.has(`${matched.operation.id}\u0000${name}`));
+        const source = spanning ? url.pathname : url.pathname.replace(/\/{2,}/g, '/');
+        // a prefix's named groups (Jira's `/ex/jira/(?<cloudId>[^/]+)`) and the host's (E2B's envd at
+        // `49983-(?<sandboxID>…).e2b.app`) join the operation's parameters
+        const groups = { ...(prefix?.exec(source)?.groups ?? {}), ...(hostParams?.exec(host)?.groups ?? {}), ...Object.fromEntries(Object.entries(m.headerParams ?? {}).flatMap(([param, header]) => { const value = request.headers.get(header); return value === null ? [] : [[param, value]]; })) };
+        const path = spanning ? kept : rewritten(source, host);
+        if (path === url.pathname && !Object.keys(groups).length)
+            return request;
+        // the path the client sent, which a signature over the request (SigV4's canonical URI) covers
+        const headers = new Headers(request.headers);
+        // the path as first sent: a front before this (an attach bridge) may have named the one its client signed
+        if (!headers.has(ORIGINAL_PATH_HEADER))
+            headers.set(ORIGINAL_PATH_HEADER, url.pathname);
+        if (Object.keys(groups).length)
+            headers.set(PREFIX_PARAMS_HEADER, JSON.stringify(groups));
+        url.pathname = path;
+        return new Request(url, { method: request.method, headers, body: request.body, signal: request.signal, ...(request.body ? { duplex: 'half' } : {}) });
+    };
+}
+/** A pack's HTTP surface, as the kernel serves it from the pack's parts. */
 export function createPackFetch(parts, options = {}) {
     const m = parts.manifest;
     const scope = {
@@ -267,12 +338,10 @@ export function createPackFetch(parts, options = {}) {
             return Response.json(decision.result.body, { status: decision.result.status, headers: decision.result.headers ?? {} });
         return api(withHeaders(request, new Headers([...request.headers, [SCENARIO_DECISION_HEADER, scenarioDecisionHeader(decision)]])));
     };
-    const doors = (m.doors ?? []).map((d) => {
-        const answer = parts.doors?.[d.id];
-        if (!answer)
+    for (const d of m.doors ?? [])
+        if (!parts.doors?.[d.id])
             throw new Error(`${m.vendor}: the manifest declares the door ${d.id}, and semantics/doors.ts exports no ${d.id}`);
-        return { decl: d, path: pathMatcher(doorPath(d.path), false), answer };
-    });
+    const door = worldDoorMatcher(m.doors ?? []);
     const screens = (m.screens ?? []).filter((s) => s.status === 'done' && parts.screens?.[s.id]).map((s) => {
         const hosts = [s.host, ...(s.hosts ?? [])].map(hostMatcher);
         return { decl: s, host: (h) => hosts.map((match) => match(h)).find(Boolean), path: pathMatcher(s.path, true), answer: parts.screens[s.id] };
@@ -304,59 +373,7 @@ export function createPackFetch(parts, options = {}) {
             await runAsVendorMove(async () => parts.clock(await open(new Request(request.url, m.tenant ? { headers: request.headers } : {}), 'clock', 'POST', '/_twin/clock', {})));
     };
     const refusedReadOnly = () => vendorError(m, m.readOnly);
-    const prefix = m.pathPrefix ? new RegExp(`^(?:${m.pathPrefix})(?=/)`) : undefined;
-    const base = surface.basePath ?? '';
-    const baseAlias = m.basePathAlias && base ? new RegExp(`^(?:${m.basePathAlias})(?=/)`) : undefined;
-    const hostPath = m.pathFromHost ? new RegExp(m.pathFromHost, 'i') : undefined;
-    const hostParams = m.hostParams ? new RegExp(m.hostParams, 'i') : undefined;
-    // each operation's spanning parameters, keyed by the operation and the parameter as the route compiles them (a whole
-    // segment's label whose name the surface or the manifest declares spanning), so one operation's spanning name never
-    // keeps another's slashes, nor a label that only part of a segment holds
-    const spanningNames = new Set(surface.spanning ?? []);
-    const spanningOf = new Set(surface.operations.flatMap((op) => ((op.basePath ?? base) + op.path).split('/').flatMap((seg) => {
-        const label = /^\{([^}]+)\}$/.exec(seg)?.[1];
-        return label !== undefined && spanningNames.has(label) ? [`${op.id}\u0000${label}`] : [];
-    })));
-    /** A path as the vendor routes it: the manifest's path prefix taken off, the spec's base in an alias's place, a host's
-     *  path label (pathFromHost) put in front. */
-    const rewritten = (pathname, host) => {
-        let path = pathname;
-        if (prefix)
-            path = path.replace(prefix, '') || '/';
-        // a base the vendor serves as its own: the spec's base in its place (a path already under the spec's base stays)
-        if (baseAlias && !(path === base || path.startsWith(`${base}/`)))
-            path = path.replace(baseAlias, base);
-        const label = hostPath?.exec(host)?.[1];
-        if (label)
-            path = `/${label}${path === '/' ? '' : path}`;
-        return path;
-    };
-    /** The request as its vendor routes it: duplicate slashes collapsed, unless the rewritten path matches an operation
-     *  through one of that operation's spanning parameters (the surface's and the manifest's), whose value keeps its
-     *  slashes; then rewritten. */
-    const routed = (request) => {
-        const url = new URL(request.url);
-        const host = hostOf(request);
-        const kept = rewritten(url.pathname, host);
-        const matched = matchOperation(routes, request.method, kept);
-        const spanning = matched !== undefined && Object.keys(matched.params).some((name) => spanningOf.has(`${matched.operation.id}\u0000${name}`));
-        const source = spanning ? url.pathname : url.pathname.replace(/\/{2,}/g, '/');
-        // a prefix's named groups (Jira's `/ex/jira/(?<cloudId>[^/]+)`) and the host's (E2B's envd at
-        // `49983-(?<sandboxID>…).e2b.app`) join the operation's parameters
-        const groups = { ...(prefix?.exec(source)?.groups ?? {}), ...(hostParams?.exec(host)?.groups ?? {}), ...Object.fromEntries(Object.entries(m.headerParams ?? {}).flatMap(([param, header]) => { const value = request.headers.get(header); return value === null ? [] : [[param, value]]; })) };
-        const path = spanning ? kept : rewritten(source, host);
-        if (path === url.pathname && !Object.keys(groups).length)
-            return request;
-        // the path the client sent, which a signature over the request (SigV4's canonical URI) covers
-        const headers = new Headers(request.headers);
-        // the path as first sent: a front before this (an attach bridge) may have named the one its client signed
-        if (!headers.has(ORIGINAL_PATH_HEADER))
-            headers.set(ORIGINAL_PATH_HEADER, url.pathname);
-        if (Object.keys(groups).length)
-            headers.set(PREFIX_PARAMS_HEADER, JSON.stringify(groups));
-        url.pathname = path;
-        return new Request(url, { method: request.method, headers, body: request.body, signal: request.signal, ...(request.body ? { duplex: 'half' } : {}) });
-    };
+    const routed = unitRequestRouter(m, surface, routes);
     const rootServes = (method, path) => Boolean(matchOperation(routes, method, path));
     const lane = m.lanes ? laneRouter(m.vendor, m.lanes, parts.lanes ?? {}, rootServes) : undefined;
     // Inspect lane-owned World doors directly, without routing them back through the vendor gateway.
@@ -455,7 +472,7 @@ export function createPackFetch(parts, options = {}) {
         if (own)
             return own;
         // Root World doors belong to the pack at every routed host, including a lane's host.
-        const rootDoor = doors.some((d) => d.decl.method.toUpperCase() === arrived.method && d.path(asked));
+        const rootDoor = door(arrived.method, asked);
         const toLane = discovery || rootDoor ? undefined : lane?.(arrived);
         if (toLane)
             return toLane(arrived);
@@ -531,15 +548,12 @@ export function createPackFetch(parts, options = {}) {
                     resetFakePool(m.service, options.root);
                 return Response.json({ kind }, { status: 201 });
             }
-            for (const d of doors) {
-                if (d.decl.method.toUpperCase() !== request.method)
-                    continue;
-                const hit = d.path(path);
-                if (!hit)
-                    continue;
+            const hit = door(request.method, path);
+            if (hit) {
                 if (readOnly && request.method !== 'GET')
                     return refusedReadOnly();
-                return d.answer(await open(request, d.decl.id, d.decl.method, d.decl.path, hit.params));
+                const d = hit.door;
+                return parts.doors[d.id](await open(request, d.id, d.method, d.path, hit.params));
             }
             return gapAnswer(m, request);
         }
@@ -720,31 +734,16 @@ export function createPackFetch(parts, options = {}) {
     const owners = () => flatOwners(ownersByUnit());
     return derivedRequestScopes(m, Object.assign(served, { owners, ownersByUnit, serves, advanceClock: async (request) => runWithStorageTenant(m.service, await selectedAccount(request), () => advanceClock(request)), workspaces, boards: Boolean(parts.board), maxRequestBodySize: m.descriptor?.maxRequestBodySize, draws: drawsUrl, contentHosts, ...(upgrade ? { upgrade } : {}), ...(ingest ? { ingest } : {}) }), options.readOnly);
 }
-/** The vendor's gateway over its lanes: the lane a request goes to (a door to the lane that declares it, then the first
- *  route whose conditions all hold, then the default), behind the gateway's CORS; undefined when none takes it. */
-function laneRouter(vendor, decl, lanes, rootServes = () => false) {
-    const served = (name) => {
-        const part = lanes[name];
-        if (!part)
-            throw new Error(`${vendor}: the manifest routes to the lane ${name}, and the vendor's fetch is given no ${name}`);
-        // the lane is named on the request, so a write it makes records which lane's API made it (LANE_HEADER)
-        const named = (request) => {
-            const headers = new Headers(request.headers);
-            headers.set(LANE_HEADER, name);
-            return part.fetch(withHeaders(request, headers));
-        };
-        return decl.cors ? withCors(decl.cors, named) : named;
-    };
-    const doors = Object.entries(lanes).flatMap(([name, part]) => (part.manifest.doors ?? []).map((d) => ({
-        name, method: d.method.toUpperCase(), matches: pathMatcher(d.path.startsWith('/_twin/') ? d.path : `/_twin/${d.path.replace(/^\//, '')}`, false),
-    })));
+/** The lane selected by the vendor gateway, shared by serving and response judgment. */
+export function laneSelector(decl, lanes, rootServes = () => false) {
+    const door = worldDoorMatcher(Object.entries(lanes).flatMap(([name, part]) => (part.manifest.doors ?? []).map((d) => ({ ...d, name }))));
     const laneRoutes = decl.routes.map((r) => {
         const at = r.path?.replace(/\/+$/, '');
         const host = r.host !== undefined ? new RegExp(r.host, 'i') : undefined;
         const except = (r.exceptHosts ?? []).map((h) => h.toLowerCase());
         const own = lanes[r.lane]?.fetch.serves;
         return {
-            lane: served(r.lane),
+            lane: r.lane,
             holds: (request, path, name) => (at === undefined || path === at || path.startsWith(`${at}/`))
                 && (host === undefined || host.test(name))
                 && (r.header === undefined || (request.headers.get(r.header.name) ?? '').startsWith(r.header.prefix) !== (r.header.absent === true))
@@ -752,7 +751,6 @@ function laneRouter(vendor, decl, lanes, rootServes = () => false) {
                 && !(r.unlessOnlyRoot && rootServes(request.method, path) && !(own?.(request.method, path) ?? false)),
         };
     });
-    const fallback = decl.default !== undefined ? served(decl.default) : undefined;
     return (request) => {
         // `<base>/@<host>/<path>` at a World's place, for a host a lane's built content screen names, goes to that lane, before
         // any lane is picked by the request's host or path: its own fetch answers it by its content route, under the vendor's
@@ -760,15 +758,37 @@ function laneRouter(vendor, decl, lanes, rootServes = () => false) {
         const address = request.headers.has(TWIN_PREFIX_HEADER) ? contentAddressOf(new URL(request.url).pathname) : undefined;
         const content = address && Object.keys(lanes).find((l) => lanes[l].fetch.contentHosts?.includes(address.host));
         if (content)
-            return served(content);
+            return content;
         const path = new URL(request.url).pathname.replace(/\/{2,}/g, '/');
         if (path.startsWith('/_twin/')) {
-            const door = doors.find((d) => d.method === request.method && d.matches(path));
-            if (door)
-                return served(door.name);
+            const hit = door(request.method, path);
+            if (hit)
+                return hit.door.name;
         }
         const name = hostOf(request);
-        return laneRoutes.find((r) => r.holds(request, path, name))?.lane ?? fallback;
+        return laneRoutes.find((r) => r.holds(request, path, name))?.lane ?? decl.default;
+    };
+}
+/** The vendor's gateway over its lanes: the lane a request goes to (a door to the lane that declares it, then the first
+ *  route whose conditions all hold, then the default), behind the gateway's CORS; undefined when none takes it. */
+function laneRouter(vendor, decl, lanes, rootServes = () => false) {
+    const served = (name) => {
+        const part = lanes[name];
+        if (!part)
+            throw new Error(`${vendor}: the manifest routes to the lane ${name}, and the vendor's fetch is given no ${name}`);
+        // the lane is named on the request, so a write it makes records which lane's API made it (LANE_HEADER)
+        const named = (request) => {
+            const headers = new Headers(request.headers);
+            headers.set(LANE_HEADER, name);
+            return part.fetch(withHeaders(request, headers));
+        };
+        return decl.cors ? withCors(decl.cors, named) : named;
+    };
+    const selected = laneSelector(decl, lanes, rootServes);
+    const handlers = new Map([...new Set([...decl.routes.map((route) => route.lane), ...(decl.default === undefined ? [] : [decl.default]), ...Object.keys(lanes)])].map((name) => [name, served(name)]));
+    return (request) => {
+        const name = selected(request);
+        return name === undefined ? undefined : handlers.get(name);
     };
 }
 /** A vendor whose every API is a lane (Cloudflare's API v4 and R2, AWS's services), served from its manifest: the

package/dist/src/packRegistry.d.ts

@@ -204,6 +204,18 @@ export type TwinPack = {
         fill: Record<string, string>;
         account?: {
             field: string;
+        } & ({
+            tenancy?: never;
+            source?: never;
+        } | {
+            tenancy: string;
+            source: string;
+        });
+        deployment?: {
+            field: string;
+            object: string;
+            source: string;
+            organizationOutputs?: string[];
         };
     };
     /** Another pack of this vendor issues the API's credentials; architecture, descriptor World wiring. */

package/dist/src/request-body.d.ts

@@ -1,8 +1,7 @@
-/** Compressed-request output only: Node's plain requests remain uncapped; Bun retains its own plain-body limit.
- * The default is Bun's existing largest plain body (128 MiB), so both runtimes decode the same.
+/** The shared HTTP transport and compressed-request output retain Bun's 128 MiB plain-body default.
  * Source: bun-types/serve.d.ts, ServeOptions.maxRequestBodySize (@default 1024 * 1024 * 128),
  * https://github.com/oven-sh/bun/blob/main/packages/bun-types/serve.d.ts .
- * A pack's descriptor.maxRequestBodySize overrides decoded output as it does Bun's plain-body limit. */
+ * A pack's descriptor.maxRequestBodySize overrides both the transport and decoded-output limits. */
 export declare const DEFAULT_MAX_DECODED_REQUEST_BODY_SIZE: number;
 export declare class RequestBodyTooLargeError extends Error {
     constructor();

package/dist/src/request-body.js

@@ -1,8 +1,7 @@
-/** Compressed-request output only: Node's plain requests remain uncapped; Bun retains its own plain-body limit.
- * The default is Bun's existing largest plain body (128 MiB), so both runtimes decode the same.
+/** The shared HTTP transport and compressed-request output retain Bun's 128 MiB plain-body default.
  * Source: bun-types/serve.d.ts, ServeOptions.maxRequestBodySize (@default 1024 * 1024 * 128),
  * https://github.com/oven-sh/bun/blob/main/packages/bun-types/serve.d.ts .
- * A pack's descriptor.maxRequestBodySize overrides decoded output as it does Bun's plain-body limit. */
+ * A pack's descriptor.maxRequestBodySize overrides both the transport and decoded-output limits. */
 export const DEFAULT_MAX_DECODED_REQUEST_BODY_SIZE = 128 * 1024 * 1024;
 export class RequestBodyTooLargeError extends Error {
     constructor() { super('Payload Too Large'); this.name = 'RequestBodyTooLargeError'; }

package/dist/src/runtime.d.ts

@@ -7,11 +7,12 @@ export { ORIGINAL_PATH_HEADER } from './sigv4.js';
 export { createTwinFetchFromHandler, placedCookies, TWIN_PREFIX_HEADER, TWIN_REQUEST_SCOPES, TWIN_SITES_HEADER, TWIN_SITE_HEADER, siteLabel, siteUrlOf, twinPublicBase, twinSiteUrl, twinVendorUrl, withRequestScopes } from './twin-fetch.js';
 export { isReadOnlyRequest, READ_ONLY_REQUEST_HEADER, ReadOnlyRequestError, runAsReadOnlyRequest, runAsVendorMove, writesRefused } from './request-scope.js';
 export { compileSurface, createDerivedFetch, matchOperation, observeDerivedDispatch } from './derived.js';
+export { hostOf, laneSelector, slashesMerged, unitRequestRouter, worldDoorMatcher } from './pack-fetch.js';
 export { currentTraceparent, deliveryTraceHeaders, newTraceparent, parseTraceparent, runWithRequestTrace, runWithTraceparent, TRACEPARENT_HEADER, traceparentForDelivery, validTraceparent } from './trace-context.js';
 export type { Traceparent } from './trace-context.js';
 export type { DerivedCall, DerivedCoreOutcome, DerivedDispatch, DerivedFetch, DerivedFetchOptions, DerivedHandler, DerivedOperation, DerivedOwner, DerivedSurface, BoardFrame } from './derived.js';
 export { authRefusal, bindSemantics, coreFor, crossCutting, flagOf, derivedRequestScopes, observeTransitions, resourcesOfType as twinResourcesOfType, semanticsContext, stateOf, transitionFor, parseBracketForm, readParams, render as renderDerived, serveCore, sse, vendorError } from './derived-core.js';
-export { deliverEvents, fillEnvelope, setDeliveryObserver, signEvent, signEventAll, verifyEvent } from './events.js';
+export { deliverEvents, fillEnvelope, setDeliveryObserver, settleEventDeliveries, signEvent, signEventAll, verifyEvent } from './events.js';
 export { equalSecrets, hmac, jwks, jwtDecode, jwtSign, jwtSignClaims, jwtVerify, jwtVerifySignature, keyId, lettersFrom, md5, sha256, SIGNING_ALGORITHMS, uuidFrom } from './signing.js';
 export type { HandlerCrypto, Jwk, Jwks, JwtDecodeOptions, JwtSignatureOptions, JwtVerdict, JwtVerificationKey, SigningKey } from './signing.js';
 export type { EventDelivery, EventRender, EventScheme, EventsDecl, EventTransport, EventWrite } from './events.js';

package/dist/src/runtime.js

@@ -15,9 +15,10 @@ export { ORIGINAL_PATH_HEADER } from "./sigv4.js";
 export { createTwinFetchFromHandler, placedCookies, TWIN_PREFIX_HEADER, TWIN_REQUEST_SCOPES, TWIN_SITES_HEADER, TWIN_SITE_HEADER, siteLabel, siteUrlOf, twinPublicBase, twinSiteUrl, twinVendorUrl, withRequestScopes } from "./twin-fetch.js";
 export { isReadOnlyRequest, READ_ONLY_REQUEST_HEADER, ReadOnlyRequestError, runAsReadOnlyRequest, runAsVendorMove, writesRefused } from "./request-scope.js";
 export { compileSurface, createDerivedFetch, matchOperation, observeDerivedDispatch } from "./derived.js";
+export { hostOf, laneSelector, slashesMerged, unitRequestRouter, worldDoorMatcher } from "./pack-fetch.js";
 export { currentTraceparent, deliveryTraceHeaders, newTraceparent, parseTraceparent, runWithRequestTrace, runWithTraceparent, TRACEPARENT_HEADER, traceparentForDelivery, validTraceparent } from "./trace-context.js";
 export { authRefusal, bindSemantics, coreFor, crossCutting, flagOf, derivedRequestScopes, observeTransitions, resourcesOfType as twinResourcesOfType, semanticsContext, stateOf, transitionFor, parseBracketForm, readParams, render as renderDerived, serveCore, sse, vendorError } from "./derived-core.js";
-export { deliverEvents, fillEnvelope, setDeliveryObserver, signEvent, signEventAll, verifyEvent } from "./events.js";
+export { deliverEvents, fillEnvelope, setDeliveryObserver, settleEventDeliveries, signEvent, signEventAll, verifyEvent } from "./events.js";
 export { equalSecrets, hmac, jwks, jwtDecode, jwtSign, jwtSignClaims, jwtVerify, jwtVerifySignature, keyId, lettersFrom, md5, sha256, SIGNING_ALGORITHMS, uuidFrom } from "./signing.js";
 export { emitTwinEvent, eventSubscriptionMatches, listEmittable, runEmitCli } from "./emit.js";
 // The vendor-agnostic CLIENT-SIDE RATE BUDGET — the fail-closed backstop a pack's guarded client

package/dist/src/serve-http.d.ts

@@ -29,7 +29,7 @@ export type ServeHttpOptions = {
     fetch: HttpHandler;
     /** seconds a connection may idle (Bun honors it; Node's keep-alive timeout is set from it) */
     idleTimeout?: number;
-    /** Explicit transport limit in bytes; absent, Bun retains its 128 MiB default. */
+    /** Explicit transport limit in bytes; absent, 128 MiB on both runtimes. */
     maxRequestBodySize?: number;
     /** what a thrown handler answers with; absent, a 500 carrying the error (as Bun.serve) */
     error?: (error: Error) => Response | Promise<Response>;