@volter/world-core 3.0.162 → 3.0.164

package/dist/src/serve-http.js

@@ -1,13 +1,14 @@
 // The HTTP server seam of the kernel (docs/contributing/architecture.md#the-serve-seam): a fetch handler on
 // a port, in the shape every `Bun.serve` call already has, so the serve path meets the runtime in
-// ONE place. Bun-backed where Bun is the runtime; `node:http`-backed otherwise, the request rebuilt
-// as a standard Request and the handler's Response written back. Async, because binding a port is
+// ONE place. Ordinary HTTP uses `node:http`; requested WebSockets retain Bun's native backend.
+// The request is rebuilt as a standard Request and the handler's Response written back. Async, because binding a port is
 // asynchronous on Node — Bun's synchronous bind is the special case.
 //
 // Nothing here runs at module scope (the served-handler registry is made on first use), and `node:http` is reached through `process.getBuiltinModule`
 // rather than a static import: this module rides into browser client bundles through the kernel's
 // entrypoint, where a static `node:` import is the 2026-09-06 class of break.
 import { worldBootAnswer } from "./world-boot.js";
+import { DEFAULT_MAX_DECODED_REQUEST_BODY_SIZE, RequestBodyTooLargeError } from "./request-body.js";
 /** One socket library at the host seam, shared by inbound upgrades and authenticated outbound relays. */
 const socketLibrary = () => import('ws');
 export async function connectWebSocket(url, headers, protocols = []) {
@@ -56,7 +57,7 @@ export async function serveHttp(options) {
     const hostname = options.hostname ?? '127.0.0.1';
     const urlHost = options.hostname ?? '127.0.0.1';
     const bun = bunRuntime();
-    if (bun) {
+    if (bun && (options.upgrade !== undefined || 'websocket' in options)) {
         // the global `Bun.serve` — the request journal's wrap of it (serve.ts) applies to packs and to
         // this seam alike, so the seam never decorates twice on Bun
         const upgrade = options.upgrade;
@@ -191,7 +192,8 @@ function builtin(name) {
 }
 async function serveOnNode(options) {
     const http = builtin('node:http');
-    const { Readable } = builtin('node:stream');
+    const { Readable, Transform } = builtin('node:stream');
+    const requestLimit = options.maxRequestBodySize ?? DEFAULT_MAX_DECODED_REQUEST_BODY_SIZE;
     if ('websocket' in options)
         throw new Error('serveHttp: use the portable upgrade callbacks for WebSocket support on Node');
     const protocol = options.tls ? 'https' : 'http';
@@ -230,20 +232,35 @@ async function serveOnNode(options) {
     const activeRequests = new Set();
     const server = factory((req, res) => {
         const controller = new AbortController();
-        active.add(controller);
-        const abort = () => { if (!controller.signal.aborted)
-            controller.abort(); };
+        const socket = req.socket;
+        const hasInputBody = req.headers['transfer-encoding'] !== undefined || Number(req.headers['content-length']) > 0;
+        let incoming;
+        let flushingBodyRefusal = false;
+        const abort = () => {
+            if (!controller.signal.aborted)
+                controller.abort();
+            incoming?.destroy(controller.signal.reason);
+            if (!flushingBodyRefusal) {
+                req.destroy();
+                if (!res.writableFinished)
+                    res.destroy();
+                socket.destroy();
+            }
+        };
+        active.add(abort);
         const onRequestClose = () => { if (!req.complete)
             abort(); };
-        const onResponseClose = () => { if (!res.writableFinished)
-            abort(); };
+        const onResponseClose = () => { if (!res.writableFinished) {
+            flushingBodyRefusal = false;
+            abort();
+        } };
         const onSocketClose = () => { if (!res.writableFinished)
             abort(); };
         req.on('aborted', abort);
         req.on('close', onRequestClose);
         req.on('error', abort);
-        req.socket.on('close', onSocketClose);
-        req.socket.on('error', abort);
+        socket.on('close', onSocketClose);
+        socket.on('error', abort);
         res.on('close', onResponseClose);
         res.on('error', abort);
         const disconnected = () => controller.signal.aborted || res.destroyed;
@@ -279,8 +296,38 @@ async function serveOnNode(options) {
                 closed();
         });
         let request;
+        let bodyTooLarge = false;
+        const rejectBody = () => {
+            if (bodyTooLarge)
+                return;
+            bodyTooLarge = true;
+            const error = new RequestBodyTooLargeError();
+            if (incoming)
+                req.unpipe(incoming);
+            req.pause();
+            if (!res.headersSent && !res.destroyed) {
+                for (const name of res.getHeaderNames())
+                    res.removeHeader(name);
+                flushingBodyRefusal = true;
+                res.writeHead(413, { 'connection': 'close', 'content-type': 'text/plain', 'content-length': Buffer.byteLength(error.message) });
+                res.once('finish', () => { flushingBodyRefusal = false; req.destroy(); });
+                res.end(error.message);
+            }
+            else if (!res.destroyed)
+                res.destroy(error);
+            abort();
+        };
+        const inputSettled = new Promise((resolve) => {
+            const settled = () => { req.off('end', settled); req.off('close', settled); resolve(); };
+            req.once('end', settled);
+            req.once('close', settled);
+        });
         const handle = async () => {
             const method = req.method ?? 'GET';
+            if (Number(req.headers['content-length']) > requestLimit) {
+                rejectBody();
+                return;
+            }
             let response;
             try {
                 const headers = new Headers();
@@ -295,9 +342,26 @@ async function serveOnNode(options) {
                 }
                 const url = `${protocol}://${req.headers.host ?? `${options.hostname}:${server.address()?.port ?? 0}`}${req.url ?? '/'}`;
                 const withBody = method !== 'GET' && method !== 'HEAD';
-                const init = { method, headers, signal: controller.signal, ...(withBody ? { body: Readable.toWeb(req), duplex: 'half' } : {}) };
+                let received = 0;
+                incoming = new Transform({ transform(chunk, _encoding, callback) {
+                        received += chunk.byteLength;
+                        if (received > requestLimit) {
+                            rejectBody();
+                            callback(new RequestBodyTooLargeError());
+                        }
+                        else
+                            callback(null, chunk);
+                    } });
+                const inputClosed = () => { if (!req.readableEnded)
+                    abort(); };
+                incoming.on('error', inputClosed);
+                incoming.once('close', inputClosed);
+                const init = { method, headers, signal: controller.signal, ...(withBody ? { body: Readable.toWeb(incoming), duplex: 'half' } : {}) };
                 request = new Request(url, init);
                 activeRequests.add(request);
+                req.pipe(incoming);
+                if (!withBody)
+                    incoming.resume();
                 response = await options.fetch(request);
             }
             catch (error) {
@@ -365,6 +429,7 @@ async function serveOnNode(options) {
                     if (k !== 'set-cookie')
                         res.setHeader(k, v);
                 }
+                res.strictContentLength = response.headers.has('content-length');
                 const cookies = response.headers.getSetCookie?.() ?? [];
                 if (cookies.length)
                     res.setHeader('set-cookie', cookies);
@@ -424,12 +489,23 @@ async function serveOnNode(options) {
                 res.destroy(error instanceof Error ? error : new Error(String(error)));
         }).then(async () => {
             await responseSettled;
-            active.delete(controller);
+            // A runtime may retire its native body forwarding when the response ends.
+            // Close unfinished input after the response flushes; a consumed upload keeps its connection.
+            if (hasInputBody && !incoming?.readableEnded)
+                abort();
+            else
+                incoming?.resume();
+            await inputSettled;
+            if (incoming) {
+                req.unpipe(incoming);
+                incoming.destroy();
+            }
+            active.delete(abort);
             req.off('aborted', abort);
             req.off('close', onRequestClose);
             req.off('error', abort);
-            req.socket.off('close', onSocketClose);
-            req.socket.off('error', abort);
+            socket.off('close', onSocketClose);
+            socket.off('error', abort);
             res.off('close', onResponseClose);
             res.off('error', abort);
         });
@@ -462,8 +538,8 @@ async function serveOnNode(options) {
     return {
         hostname: options.hostname, port, url: new URL(`${protocol}://${options.urlHost}:${port}/`),
         stop: (closeActive = true) => new Promise((resolve) => { if (closeActive) {
-            for (const controller of active)
-                controller.abort();
+            for (const abort of active)
+                abort();
             for (const peer of socketServer?.clients ?? [])
                 peer.terminate();
         } socketServer?.close(); server.close(() => { if (closeActive && active.size)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "3.0.162",
+  "version": "3.0.164",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",

package/src/browser-session.ts

@@ -1,19 +1,31 @@
 // A vendor's browser session: the bookkeeping used by its own sign-in and sign-out pages.
 import type { HandlerContext } from './derived-core.ts';
+import { personOf, type Person } from './people.ts';
 
 type Writer = Pick<HandlerContext, 'record' | 'secret' | 'occurredAt'>;
 
-/** The named cookie, without interpreting any other vendor's cookie. */
-export function browserSessionToken(request: Request, name: string): string | undefined {
+/** The value of the cookie `name` the request carries, as a browser sends it back. */
+export function cookieOf(request: Request, name: string): string | undefined {
   for (const part of (request.headers.get('cookie') ?? '').split(';')) {
     const at = part.indexOf('=');
-    if (at > 0 && part.slice(0, at).trim() === name) {
-      try { return decodeURIComponent(part.slice(at + 1).trim()); } catch { return undefined; }
-    }
+    if (at > 0 && part.slice(0, at).trim() === name) return decodeURIComponent(part.slice(at + 1).trim());
   }
   return undefined;
 }
 
+/** The named session cookie; malformed encodings do not name a session. */
+export function browserSessionToken(request: Request, name: string): string | undefined {
+  try { return cookieOf(request, name); } catch { return undefined; }
+}
+
+/** The person the request's session cookie names, or undefined when nobody is signed in; with `scope`, only a session
+ *  begun in it (a vendor's sandbox dashboard and its production one sign a person in apart). */
+export function signedIn(ctx: HandlerContext, cookie: string, scope?: string): Person | undefined {
+  const token = cookieOf(ctx.call.request, cookie);
+  const session = token ? ctx.rowsRaw('_web_session').find((s) => s.token === token && (scope === undefined || s.scope === scope)) : undefined;
+  return session ? personOf(ctx, String(session.email)) : undefined;
+}
+
 /** A new, independent sign-in, returning the cookie the vendor places on its response. */
 export async function startBrowserSession(ctx: Writer, email: string, cookie: string, scope?: string): Promise<string> {
   const issued = await ctx.record('_web_session_issue', { email, ...(scope !== undefined ? { scope } : {}) });

package/src/derived-core.ts

@@ -11,7 +11,7 @@ import { parseExactJson, compareExactNumbers, exactInteger, isExactIntegerValue
 import { applyTwinWrite, applyTwinWriteAtomic, applyTwinWrites, twinResources, type TwinResource } from './serve.ts';
 import { copyResource, foldLocalWrite, heldSubject, ownFields, parentStamp, subjectHistory, treeChangesSince, treeResources, treeStamp, type Subject } from './log.ts';
 import { performsAtHeadNow } from './head.ts';
-import { getActiveWorldStore } from './world-store.ts';
+import { getActiveWorldStore, type WorldStore } from './world-store.ts';
 import { getActiveBlobStore } from './blob-store.ts';
 import { worldPaths } from './storage.ts';
 import { GitObjectStore } from './git/objects.ts';
@@ -43,7 +43,7 @@ import type { SubjectFields } from './hash.ts';
 import { twinPublicBase, withRequestScopes } from './twin-fetch.ts';
 import { inVendorMove, isReadOnlyRequest, runAsVendorMove, writesRefused } from './request-scope.ts';
 import type { DerivedCall, DerivedCoreOutcome, DerivedHandler, DerivedOperation } from './derived.ts';
-import type { PackDescriptor } from './packRegistry.ts';
+import { getPack, type PackDescriptor } from './packRegistry.ts';
 import type { ScenarioDecision, ScenarioHandler } from './scenario.ts';
 import { bodyTextOf, checkJsonBody, takeParsedBody } from './derived.ts';
 
@@ -937,7 +937,7 @@ export type CoreScope = {
   root?: string; clock?: () => string; database?: string; readOnly?: boolean;
   /** `semantics/tenant.ts`: the tenant the caller acts in (the manifest's `tenant`), or undefined for none */
   tenant?: (ctx: HandlerContext) => string | undefined | Promise<string | undefined>;
-  /** the application a walk stands in for: what the vendor asks it (`ctx.ask`) is answered by it (events.ts) */
+  /** the application a walk stands in for: vendor requests and declared events are answered by it (events.ts) */
   application?: ApplicationStandIn;
 };
 
@@ -996,6 +996,62 @@ export async function worldAccount(service: string, root: string | undefined, id
   return id;
 }
 
+type WorldOrganization = { id: string; label: string; members: string[] };
+type VendorNameRule = { max: number; lower?: boolean; allowed: RegExp; separator?: string; first?: RegExp };
+type NativeAccountLink = { resource: string; id: string };
+
+function nativeAccountLink(row: TwinResource | undefined, field?: string): NativeAccountLink | undefined {
+  if (!row || row.deleted === true) return undefined;
+  const fields = ownFields(row);
+  const value = field === undefined ? fields : fields[field];
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const link = value as Record<string, unknown>;
+  return typeof link.resource === 'string' && typeof link.id === 'string' ? { resource: link.resource, id: link.id } : undefined;
+}
+
+const sameAccountLink = (a: NativeAccountLink | undefined, b: NativeAccountLink | undefined): boolean =>
+  a?.resource === b?.resource && a?.id === b?.id;
+
+/** Native creation and reconstruction run outside the action lock; only the retained link is compared and written. */
+async function retainNativeAccountLink<T>(
+  service: string, root: string | undefined, at: string, call: DerivedCall,
+  type: string, id: string, field: string | undefined, resource: string,
+  make: () => Promise<string>, read: (link: NativeAccountLink) => Promise<T | undefined>,
+): Promise<T> {
+  for (;;) {
+    const before = nativeAccountLink(resourcesOfType(service, type, root).find((row) => row.id === id), field);
+    const held = before && await read(before);
+    if (held !== undefined) return held;
+    const made = { resource, id: await make() };
+    if (await read(made) === undefined) throw new Error(`Credential ${type}/${id}: native ${resource}/${made.id} is unavailable after creation`);
+    const { value } = await applyTwinWriteAtomic(service, (snapshot) => {
+      const current = nativeAccountLink(snapshot.find((row) => row.type === type && row.id === id), field);
+      if (!sameAccountLink(current, before)) return { kind: 'skip', value: current };
+      return {
+        kind: 'write', value: made,
+        write: {
+          operation: `${type.slice(1)}.link`, subjectType: type, subjectId: id,
+          fields: field === undefined ? made : { name: id, [field]: made },
+          ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' },
+        },
+      };
+    }, root);
+    const linked = value && await read(value);
+    if (linked !== undefined) return linked;
+  }
+}
+
+function vendorName(label: string, rule: VendorNameRule, { suffixed = false, identity = label }: { suffixed?: boolean; identity?: string } = {}): string {
+  const allowed = new RegExp(rule.allowed.source, rule.allowed.flags.replace(/[gy]/g, ''));
+  const separator = rule.separator ?? '-';
+  if ([...separator].length !== 1 || !allowed.test(separator)) throw new Error('Credential name separator must be one allowed character');
+  const first = rule.first && new RegExp(rule.first.source, rule.first.flags.replace(/[gy]/g, ''));
+  let name = [...(rule.lower ? label.toLowerCase() : label)].map((letter) => allowed.test(letter) ? letter : separator).join('');
+  name = name.replace(new RegExp(`${escapeRe(separator)}+`, 'g'), separator);
+  if (first && !first.test(name[0] ?? '')) name = `w${separator}${name}`;
+  return name !== label || name.length > rule.max || suffixed ? `${name.slice(0, Math.max(0, rule.max - 9))}${separator}${sha256(identity).slice(0, 8)}` : name;
+}
+
 /** A World's signing key for a label (ctx.signingKey): made once from the platform's random source, then read; the
  *  making is one per service store and label in the process, as the seed's is. */
 const SIGNING_KEY = '_world_signing_key';
@@ -1082,9 +1138,9 @@ function mintId(m: DerivedManifest, resource: string, root: string | undefined,
  *  increment. One space over every snowflake resource of the vendor, as its one generator's: the instant's first, or one
  *  past the greatest the World holds when that is later (a frozen clock, or several ids in one millisecond), so ids
  *  rise with time and never repeat. */
-/** The last snowflake minted per vendor and World in this process: two mints before the first is written (a message
+/** The last snowflake minted per store, vendor and World: two mints before the first is written (a message
  *  and its attachment) must not meet. */
-const lastSnowflake = new Map<string, bigint>();
+const lastSnowflake = new WeakMap<WorldStore, Map<string, bigint>>();
 function mintSnowflake(m: DerivedManifest, epoch: bigint, root: string | undefined, at: string, snapshot?: readonly TwinResource[]): string {
   const ms = BigInt(Date.parse(at) || 0);
   const base = ms > epoch ? (ms - epoch) << 22n : 0n;
@@ -1093,11 +1149,13 @@ function mintSnowflake(m: DerivedManifest, epoch: bigint, root: string | undefin
     if (!/^\{snowflake:\d+\}$/.test(decl.ids ?? m.ids.template)) continue;
     for (const r of mintRows(m, name, root, snapshot)) if (/^\d+$/.test(r.id)) { const v = BigInt(r.id); if (v > max) max = v; }
   }
+  const store = getActiveWorldStore();
+  const reservations = lastSnowflake.get(store) ?? lastSnowflake.set(store, new Map()).get(store)!;
   const key = `${m.service}\0${root ?? ''}`;
-  const last = lastSnowflake.get(key) ?? -1n;
+  const last = reservations.get(key) ?? -1n;
   const floor = max > last ? max : last;
   const id = base > floor ? base : floor + 1n;
-  lastSnowflake.set(key, id);
+  reservations.set(key, id);
   return String(id);
 }
 
@@ -1396,7 +1454,7 @@ async function finishWrite(m: DerivedManifest, call: DerivedCall, resource: stri
     const endpoint = (kind: import('./events.ts').EndpointsDecl): import('./events.ts').EndpointsDecl => ({ ...kind, storedAs: storedType(m, kind.storedAs), ...(kind.joins ? { joins: Object.fromEntries(Object.entries(kind.joins).map(([name, join]) => [name, { ...join, storedAs: storedType(m, join.storedAs) }])) } : {}) });
     const events = { ...m.events, ...(m.events.store ? { store: storedType(m, m.events.store) } : {}), endpoints: 'storedAs' in m.events.endpoints ? endpoint(m.events.endpoints) : m.events.endpoints.map(endpoint) };
     const write = { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() };
-    await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values!(await context(), write, type) : undefined);
+    await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values!(await context(), write, type) : undefined, scopeOfCall.get(call)?.application);
   }
   if (m.sockets?.length) socketWrite(m.service, root, { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() });
   // a read held until the World writes (held-reads.ts) hears it
@@ -1959,6 +2017,18 @@ export type SemanticsContext = {
   secret(label: string): Promise<string>;
   /** Select an account at a pack's credential door. Packs retain their own vendor account/key semantics. */
   account(field?: string): Promise<string>;
+  /** The selected organization's label and people from the World's organization registry. */
+  organization(): Promise<WorldOrganization>;
+  /** The selected deployment, or an empty string for the organization's own level. */
+  deployment(): string;
+  /** A vendor-safe label; retained links keep identity independent of names. */
+  vendorName(label: string, rule: VendorNameRule, options?: { suffixed?: boolean; identity?: string }): string;
+  /** Retain the native customer tenant for the selected organization. */
+  tenant(resource: string, make: (organization: WorldOrganization) => Promise<string>): Promise<Record<string, unknown>>;
+  /** Retain one native resource of this kind for the selected organization and deployment. */
+  deploymentObject(kind: string, resource: string, make: (deployment: string) => Promise<string>): Promise<Record<string, unknown>>;
+  /** Reconstruct a live native key, replacing its link when the vendor's reader refuses it. */
+  accountKey(purpose: string, resource: string, key: { make: () => Promise<string>; read: (row: Record<string, unknown>) => Promise<string | undefined> }): Promise<{ id: string; secret: string }>;
   /** The World's machine pool (machines.ts), as the pack's `machine-pool` door enrolled it; `none` when none was. */
   machines: MachinePool;
   /** A signing key pair for `label` (an issuer's ID tokens, a provider's JWTs, a CA's or a log's key), PEM: RSA 2048
@@ -2105,7 +2175,7 @@ export type HandlerContext = Omit<SemanticsContext, 'now' | 'core' | 'atomically
 };
 /** What a write hook reads: the writing call's context without its ways to write, so a hook that renders an event
  *  cannot write again (and run itself again). */
-export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'at' | 'over'>;
+export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'tenant' | 'deploymentObject' | 'accountKey' | 'at' | 'over'>;
 /** A derived pack's handler: one operation, by its operationId, over the contract's context. */
 export type Handler = (ctx: HandlerContext) => Promise<Response>;
 
@@ -2153,6 +2223,8 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
   });
   const paths = expandPaths(m, params);
   const stateChecks: StateChecks = new Map();
+  const credentialDoor = m.descriptor?.credentialDoor ?? getPack(m.vendor)?.credentialDoor;
+  const credentialFields = body && typeof body === 'object' && !Array.isArray(body) ? body as Record<string, unknown> : {};
   const rawResources = new WeakMap<Record<string, unknown>, string>();
   const rawRow = (resource: string, row: TwinResource): Record<string, unknown> => {
     const name = m.resources[resource] ? resource : Object.keys(m.resources).find((name) => storedType(m, name) === row.type);
@@ -2166,6 +2238,10 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     rawResources.set(row as Record<string, unknown>, name ?? resource);
     return row as Record<string, unknown>;
   };
+  const liveNativeRow = (link: NativeAccountLink): Record<string, unknown> | undefined => {
+    const row = context.row(link.resource, link.id);
+    return row && row.deleted !== true ? row : undefined;
+  };
   const context: SemanticsContext = {
     call,
     params,
@@ -2218,9 +2294,39 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     },
     occurredAt: at,
     secret: async (label) => hmac(await worldSeed(m.service, root, at), scopeLabel(m, label), 'base64url'),
-    account: async (field = 'account') => {
-      const fields = body && typeof body === 'object' && !Array.isArray(body) ? body as Record<string, unknown> : {};
-      return worldAccount(m.service, root, fields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+    account: async (field = credentialDoor?.account?.field ?? 'account') => {
+      return worldAccount(m.service, root, credentialFields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+    },
+    organization: async () => {
+      const id = await context.account();
+      const row = projectOwnerResources('_world', root, { type: '_world_organization', id }).find((row) => row.type === '_world_organization' && row.id === id && row.deleted !== true);
+      return row ? { id, label: row.label as string, members: [...(row.members as string[])] } : { id, label: id, members: ['owner@world.test'] };
+    },
+    deployment: () => {
+      const id = credentialFields[credentialDoor?.deployment?.field ?? 'deployment'] ?? '';
+      if (id !== '' && !isWorldAccountName(id)) throw new Error('Credential deployment must be a name of at most 128 letters, digits, dots, underscores or hyphens');
+      return id;
+    },
+    vendorName,
+    tenant: async (resource, make) => {
+      const id = await context.account();
+      return retainNativeAccountLink(m.service, root, at, call, '_world_account', id, 'tenant', resource,
+        async () => make(await context.organization()), async (link) => liveNativeRow(link));
+    },
+    deploymentObject: async (kind, resource, make) => {
+      const organization = await context.account(), deployment = context.deployment();
+      return retainNativeAccountLink(m.service, root, at, call, '_world_deployment_object', `${organization}/${deployment}/${kind}`, undefined, resource,
+        () => make(deployment), async (link) => liveNativeRow(link));
+    },
+    accountKey: async (purpose, resource, key) => {
+      const organization = await context.account(), deployment = context.deployment();
+      return retainNativeAccountLink(m.service, root, at, call, '_world_account_key', `${organization}/${deployment}/${purpose}`, undefined, resource,
+        () => key.make(), async (link) => {
+          const row = liveNativeRow(link);
+          if (!row) return undefined;
+          const secret = await key.read(row);
+          return secret === undefined ? undefined : { id: link.id, secret };
+        });
     },
     record: async (type, fields, id, operation) => {
       if (!type.startsWith('_')) throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
@@ -2272,7 +2378,11 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
       const row = await atomicWrite(m, call, resource, (snapshot) => {
         const id = options?.id ?? mintId(m, resource, root, at, snapshot);
         const selected = typeof fields === 'function' ? fields(id) : fields;
-        const hit = snapshot.find((r) => r.type === storedType(m, resource) && r.deleted !== true && rules.some((rule) => rule.fields.every((f) => selected[f] !== undefined && view(m, resource, r)[f] === selected[f])));
+        const hit = snapshot.find((r) => {
+          if (r.type !== storedType(m, resource) || r.deleted === true) return false;
+          const fields = { [m.resources[resource]?.idAs ?? 'id']: r.id, ...ownFields(r) };
+          return rules.some((rule) => rule.fields.every((field) => selected[field] !== undefined && fields[field] === selected[field]));
+        });
         if (hit) { existing = view(m, resource, hit); return undefined; }
         return { id, fields: selected };
       }, operation, params, root, at, undefined, stateChecks, options?.input === 'omit');
@@ -2304,7 +2414,7 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     },
     writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at, stateChecks),
     resolve: (resource, id) => resolveSubjectId(m.service, storedType(m, resource), id, root),
-    storedType: (resource) => storedType(m, resource),
+    storedType: (resource) => m.resources[resource]?.storedAs ?? resource,
     ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
     row: (resource, id, opts) => { const row = stored(m, resource, root, opts).find((r) => r.id === id); return row ? rawRow(resource, row) : undefined; },
     rowsRaw: (resource, opts) => stored(m, resource, root, opts).map((row) => rawRow(resource, row)),
@@ -2427,12 +2537,14 @@ const BATCH_REFUSED_READS = ['get', 'rows', 'tree', 'history', 'find', 'list', '
 /** The members that write, or wait on writes, or answer as another context: each lands the staged writes first. */
 const BATCH_LANDING_MEMBERS = ['create', 'createUnique', 'change', 'accumulate', 'writeDetailed', 'record', 'atomically', 'remove', 'issue', 'at', 'over', 'core', 'awaitWrite', 'awaitCondition',
   // a World's seed and signing keys are written when first asked (worldSeed, worldSigningKey, as a vendor's move)
-  'secret', 'signingKey'] as const;
+  'secret', 'signingKey', 'account', 'organization', 'tenant', 'deploymentObject', 'accountKey'] as const;
 
 /** `ctx.batch` over a context whose writes may be grouped (see `batchable`). */
 function bindBatch(m: DerivedManifest, call: DerivedCall, context: SemanticsContext, params: Record<string, unknown>, root: string | undefined, at: string,
   rawRow: (resource: string, row: TwinResource) => Record<string, unknown>): void {
   let staged: StagedWrite[] | undefined;
+  // A callback's native object must land before the helper writes its retained link.
+  let nativeAccountWrites = 0;
   // each staged subject as it will stand, by `type:id`, in the order first written
   const subjects = new Map<string, Subject>();
   const land = async (): Promise<void> => {
@@ -2446,7 +2558,13 @@ function bindBatch(m: DerivedManifest, call: DerivedCall, context: SemanticsCont
   for (const name of BATCH_LANDING_MEMBERS) {
     const plain = ctx[name];
     if (typeof plain !== 'function') continue;
-    ctx[name] = async (...args: unknown[]) => { await land(); return (plain as (...a: unknown[]) => unknown)(...args); };
+    ctx[name] = async (...args: unknown[]) => {
+      await land();
+      const native = name === 'tenant' || name === 'deploymentObject' || name === 'accountKey';
+      if (native) nativeAccountWrites++;
+      try { return await (plain as (...a: unknown[]) => unknown)(...args); }
+      finally { if (native) nativeAccountWrites--; }
+    };
   }
   for (const name of BATCH_REFUSED_READS) {
     const plain = ctx[name];
@@ -2459,7 +2577,7 @@ function bindBatch(m: DerivedManifest, call: DerivedCall, context: SemanticsCont
   const plainWrite = context.write, plainRow = context.row, plainRowsRaw = context.rowsRaw;
   context.write = async (resource, id, fields, operation) => {
     // a vendor's own move (ctx.asVendor) is the clock's write, recorded as the system's: it lands alone, in its place
-    if (!staged || inVendorMove()) { await land(); return plainWrite(resource, id, fields, operation); }
+    if (!staged || nativeAccountWrites > 0 || inVendorMove()) { await land(); return plainWrite(resource, id, fields, operation); }
     const type = storedType(m, resource), key = `${type}:${id}`;
     // the one subject, as the memoized tree holds it (readTreeMap would copy the whole tree on every staged write)
     const subject = foldLocalWrite(subjects.get(key) ?? heldSubject(m.service, type, id, root), type, id, fields as SubjectFields, at);

package/src/derived-real.ts

@@ -583,8 +583,8 @@ function refreshOf(units: Unit[], service: string): NonNullable<StateSystemAdapt
             const sent = asked.length ? `${target}${target.includes('?') ? '&' : '?'}${new URLSearchParams(asked)}` : target;
             const answer = await execute({ method: op.method.toUpperCase(), path: sentTo(m, sent, subject), ...onLane, headers: fixedHeaders(op) });
             // a door's subject the vendor does not show the root (another bot's private chat) stays as the World holds it
-            if (!rooted.has(key) && answer.status >= 400 && answer.status !== 429) continue;
             if (answer.status === 401) throw new Error(`401: the vendor refused the root's credential (${op.method.toUpperCase()} ${path}); nothing folded`);
+            if (!rooted.has(key) && answer.status >= 400 && answer.status !== 429) continue;
             if (answer.status === 403) { unread.push({ type, path, status: 403 }); refused = true; break; }
             if (answer.status === 429) throw new Error(`429: rate limited${answer.headers['retry-after'] ? `, retry after ${answer.headers['retry-after']}s` : ''}`);
             read.push(String(subject.id));
@@ -592,7 +592,15 @@ function refreshOf(units: Unit[], service: string): NonNullable<StateSystemAdapt
             // the vendor's answer for a subject it no longer has: a 404, or the scope's `gone` (Telegram's 400 `chat not found`)
             if (answer.status === 404 || (scope.gone && answer.status === scope.gone.status && refusalWords(m, parse(answer)).includes(scope.gone.says))) continue;
             if (answer.status >= 400 || refusedIn(m, parse(answer))) throw new Error(`${m.vendor}: ${resource} refresh ${op.id} (${op.method.toUpperCase()} ${op.path}): ${answer.status}: ${refusalWords(m, parse(answer))}`);
-            const full = object(op.answers?.key ? at(parse(answer), op.answers.key) : parse(answer)) ?? {};
+            const parsed = parse(answer);
+            let full: Row;
+            if (op.answers?.list) {
+              const items = itemsOf(op, parsed);
+              const matching = items.find((item) => (scopeIdOf(scope, item) ?? storedIdOf(decl, item)) === vendorId);
+              if (!matching && items.length) throw new Error(`${m.vendor}: ${resource} refresh ${op.id} omitted the requested subject; nothing folded`);
+              if (!matching) continue;
+              full = matching;
+            } else full = object(op.answers?.key ? at(parsed, op.answers.key) : parsed) ?? {};
             const local = (m as { worldFields?: Record<string, Record<string, unknown>> }).worldFields?.[resource] ?? {};
             const fields = Object.fromEntries(Object.entries(full).filter(([k]) => !(k in local)));
             if (decl.parent) {