@volter/world-runtime 3.0.10 → 3.0.12

package/dist/src/cli-commands.js

@@ -920,11 +920,15 @@ export async function main() {
                 caFile = join(mkdtempSync(join(tmpdir(), 'volter-attach-')), 'ca.pem');
                 writeFileSync(caFile, manifest.ca);
             }
+            // the World's twins, each a loopback listener here that adds its key, so a command with its own HTTP stack reaches
+            // them as it would a local World's (the manifest pointed at the listeners before its env is made)
+            const { bridgeTwins } = createRequire(import.meta.url)('@volter/world-core/http-bridge');
+            await bridgeTwins(manifest, manifest.env.VOLTER_TWINS_KEY ?? attachToken ?? '', manifest.ca ?? undefined);
             const injectPath = createRequire(import.meta.url).resolve('@volter/world-core/inject');
             const env = remoteAttachEnv(manifest, { injectPath, ...(caFile === undefined ? {} : { caFile }) });
             // the world's byte-stream doors, bridged to loopback listeners here, beside a command in any language
             const { bridgeStreams, drainStreams } = createRequire(import.meta.url)('@volter/world-core/stream-bridge');
-            const bridged = manifest.streams ? await bridgeStreams(manifest.streams, attachToken ?? manifest.env.VOLTER_TWINS_KEY ?? '') : { env: {} };
+            const bridged = manifest.streams ? await bridgeStreams(manifest.streams, manifest.env.VOLTER_TWINS_KEY ?? attachToken ?? '') : { env: {} };
             // VOLTER_WORLD names the World to the injector: a request addressed to its paths carries its key
             const commandEnv = withoutVaultSignIn({ ...process.env, ...env, ...bridged.env, VOLTER_WORLD: resolved.ref });
             commandEnv.VOLTER_TWIN_INJECT_QUIET = head.includes('--verbose') ? '0' : commandEnv.VOLTER_TWIN_INJECT_QUIET ?? '1';

package/dist/src/served-world.d.ts

@@ -358,9 +358,15 @@ export declare class WorldDoors {
     private newestEntry;
     /** THE BOARD: every twin's frames as its pack lays them out (`GET /twin/board`), each where this World shows it (a
      *  hostname a twin answers as a site at its own origin, a vendor page under the twin's place, or nowhere: a frame no
-     *  screen draws yet) and the changes not yet cut on the records it covers, counted by the request that made them; and
-     *  the boards as this World's people arranged them. */
+     *  screen draws yet) and the changes not yet cut on the records it covers, counted by the request that made them, with
+     *  when the first was made; and the boards as this World's people arranged them. A frame's changes themselves are read
+     *  one frame at a time (`board/changes`). */
     private board;
+    /** One frame's changes not yet cut, newest first: each the writes one request made, as words read them (the operation,
+     *  the record, its few naming fields), the frame named `<vendor>:<frame id>`. */
+    private boardChanges;
+    /** Every twin's frames, where each opens here, and each with the changes not yet cut that are its own. */
+    private boardFrames;
     /** The boards as the World keeps them, and the version a save names: the default board when none was ever kept. */
     private savedBoards;
     /** THE MAP: every twin and what it holds, by resource type, and the workspaces it shows. */

package/dist/src/served-world.js

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, validateRemoteOrigin } from '@volter/world-core/runtime';
+import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, ORIGINAL_PATH_HEADER, validateRemoteOrigin } from '@volter/world-core/runtime';
 import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { packFacts } from "./pack-facts.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
@@ -95,14 +95,16 @@ const BOARD_BYTES = 256 * 1024;
 /** A board document from a request, or the reason it is refused: every field of its type, nothing else. */
 /** A kept board document's version: its bytes' digest, or `none` before one is kept. */
 const boardVersion = (text) => (text === null ? 'none' : createHash('sha256').update(text).digest('hex').slice(0, 16));
+/** A change's act: the request that made it (its writes share one correlation id), else the write itself. */
+const actOf = (c) => (typeof c.action.correlationId === 'string' ? c.action.correlationId : c.action.id);
 function boardsOf(body) {
     const list = body?.boards;
     if (!Array.isArray(list) || list.length < 1 || list.length > 50)
         return 'boards: a list of 1-50 boards';
     const ids = new Set();
     for (const b of list) {
-        if (!b || typeof b !== 'object' || Object.keys(b).some((k) => !['id', 'name', 'include', 'hidden', 'placed'].includes(k)))
-            return 'a board has only id, name, include, hidden and placed';
+        if (!b || typeof b !== 'object' || Object.keys(b).some((k) => !['id', 'name', 'include', 'hidden', 'placed', 'sections'].includes(k)))
+            return 'a board has only id, name, include, hidden, placed and sections';
         if (typeof b.id !== 'string' || !/^[a-z0-9-]{1,64}$/.test(b.id) || ids.has(b.id))
             return 'a board id is unique, a-z 0-9 -';
         ids.add(b.id);
@@ -119,6 +121,20 @@ function boardsOf(body) {
                 if (!BOARD_KEY.test(k) || !v || typeof v !== 'object' || Object.keys(v).join() !== 'x,y' || !Object.values(v).every((n) => typeof n === 'number' && Number.isFinite(n)))
                     return 'placed: { x, y } by frame name';
         }
+        if (b.sections !== undefined) {
+            const sections = b.sections;
+            if (!sections || typeof sections !== 'object' || Array.isArray(sections) || Object.keys(sections).length > 500)
+                return 'sections: a section name to its region';
+            for (const [k, v] of Object.entries(sections)) {
+                const r = v;
+                // a section is a pack's group (`<vendor>:section:<id>`) or one people drew (`user:<id>`), on the board's plane
+                if (!BOARD_KEY.test(k) || !(/^user:[a-z0-9]{1,32}$/.test(k) || /^[a-z0-9-]+:section:/.test(k)) || !r || typeof r !== 'object' || Object.keys(r).some((f) => !['x', 'y', 'w', 'h', 'name', 'gone'].includes(f))
+                    || !['x', 'y'].every((f) => typeof r[f] === 'number' && Math.abs(r[f]) <= 1e7) || !['w', 'h'].every((f) => typeof r[f] === 'number' && r[f] >= 0 && r[f] <= 1e6)
+                    || (r.gone !== true && (r.w < 100 || r.h < 100))
+                    || (r.name !== undefined && (typeof r.name !== 'string' || !r.name.trim() || r.name.length > 80)) || (r.gone !== undefined && r.gone !== true))
+                    return 'sections: { x, y, w, h, name?, gone? } by section name';
+            }
+        }
     }
     if (list[0].include !== undefined)
         return 'the first board is everything: it includes no list';
@@ -833,6 +849,11 @@ export class WorldDoors {
             }
             return new Response(request.method === 'HEAD' ? null : answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
         }
+        // a person's browser is told in words (often the site is not there yet, or was not in a copy of the World as it was)
+        if ((request.headers.get('accept') ?? '').includes('text/html')) {
+            const shown = host.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+            return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p>Nothing is served at <b>${shown}</b> in this World.</p></body>`, { status: 404, headers: { 'content-type': 'text/html; charset=utf-8' } });
+        }
         return Response.json({ error: `no twin of ${this.served} answers ${host}` }, { status: 404 });
     }
     async handle(request) {
@@ -961,6 +982,12 @@ export class WorldDoors {
         // the request's trace: the caller's trace-id goes on (or a new one), under a parent-id the World mints, which the
         // request's log entries carry, so each entry is joined to its caller by an id no caller chose
         headers.delete(CALLER_HEADER);
+        // the address a request was signed for (a CLI's loopback bridge says it, @volter/world-core/http-bridge) is a
+        // credential holder's word: a browser's session cannot name another, so a signature is checked on the path it reached
+        if (via === 'session') {
+            headers.delete(ORIGINAL_PATH_HEADER);
+            headers.delete('x-volter-twin-original-host');
+        }
         const who = this.callerOf(request);
         if (who)
             headers.set(CALLER_HEADER, callerForHeader(who));
@@ -1123,6 +1150,35 @@ export class WorldDoors {
         // ending a browser's session needs no token: it only clears the caller's own cookie, which never
         // reaches these /-/ paths, so a page holding just the session could not otherwise sign out
         const sessionPath = path.replace(/\/+$/, '');
+        // THE HAND-OFF: a page of no UI that opens this World's session from the token in its fragment, then goes to the page
+        // of this World it names (`land`): how a page elsewhere links to this World's own pages (the console's comparison
+        // opening a vendor's page in a copy of the World, read only). The token never reaches the server in a URL; its script
+        // is a file of this origin, so the page keeps a strict policy. It is never framed: a session opened in another
+        // site's frame is not this World's own page's
+        if (sessionPath === 'session/hand-off' && request.method === 'GET') {
+            return new Response(`<!doctype html><meta charset="utf-8"><title>${this.served}</title><body data-world="${this.served}"><script src="/-/${this.served}/session/hand-off.js"></script></body>`, { headers: { 'content-type': 'text/html; charset=utf-8', 'content-security-policy': "default-src 'none'; script-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'", 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
+        }
+        if (sessionPath === 'session/hand-off.js' && request.method === 'GET') {
+            const script = `(() => {
+  const world = document.body.dataset.world;
+  const carried = new URLSearchParams(location.hash.slice(1));
+  history.replaceState(null, '', location.pathname);
+  const token = carried.get('token') || '';
+  const land = carried.get('land') || '';
+  // resolved as the browser will (encoded dots too), on this origin and under this World
+  let to = null;
+  try { const u = new URL(land, location.origin); if (land.startsWith('/') && !/[\\\\\\s]/.test(land) && u.origin === location.origin && u.pathname.startsWith('/' + world + '/')) to = u.pathname + u.search; } catch {}
+  const open = () => fetch('/-/' + world + '/session', { method: 'POST', headers: { 'x-volter-token': token } });
+  if (!token || !to) { document.body.textContent = 'Nothing to open.'; return; }
+  // a session this browser already holds here is kept: a page elsewhere cannot replace, downgrade or fix it
+  fetch('/-/' + world + '/session')
+    .then((held) => (held.ok ? held : open()))
+    .then((r) => { if (r.ok) location.replace(to); else document.body.textContent = 'This World did not open.'; })
+    .catch(() => { document.body.textContent = 'This World did not answer.'; });
+})();
+`;
+            return new Response(script, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' } });
+        }
         // a person signing in from a page (the console's form, posted to this origin): the token in the
         // form body, the session set here, then on to a page of this World
         // a form or beacon from another site never opens or ends a session here (the console, on this host's
@@ -1221,6 +1277,8 @@ export class WorldDoors {
             return Response.json(await this.map());
         if (kind === 'board' && !name && request.method === 'GET')
             return Response.json(await this.board(url));
+        if (kind === 'board' && name === 'changes' && !verb && request.method === 'GET')
+            return await this.boardChanges(url);
         if (kind === 'board' && !name && request.method === 'PUT') {
             if (!/^application\/json\b/i.test(request.headers.get('content-type') ?? ''))
                 return Response.json({ error: 'the board is sent as application/json' }, { status: 415 });
@@ -1878,9 +1936,39 @@ export class WorldDoors {
     }
     /** THE BOARD: every twin's frames as its pack lays them out (`GET /twin/board`), each where this World shows it (a
      *  hostname a twin answers as a site at its own origin, a vendor page under the twin's place, or nowhere: a frame no
-     *  screen draws yet) and the changes not yet cut on the records it covers, counted by the request that made them; and
-     *  the boards as this World's people arranged them. */
+     *  screen draws yet) and the changes not yet cut on the records it covers, counted by the request that made them, with
+     *  when the first was made; and the boards as this World's people arranged them. A frame's changes themselves are read
+     *  one frame at a time (`board/changes`). */
     async board(url) {
+        const { frames, delta } = await this.boardFrames(url);
+        // the changes are counted from the World's base: what was last cut or received, and when
+        return { world: this.served, base: { id: delta.base.id, at: delta.base.createdAt ?? null }, frames: frames.map(({ frame, mine }) => ({ ...frame, changes: new Set(mine.map(actOf)).size, since: mine.map((c) => c.action.occurredAt).sort()[0] ?? null })), ...this.savedBoards() };
+    }
+    /** One frame's changes not yet cut, newest first: each the writes one request made, as words read them (the operation,
+     *  the record, its few naming fields), the frame named `<vendor>:<frame id>`. */
+    async boardChanges(url) {
+        const key = url.searchParams.get('frame') ?? '';
+        if (!key)
+            return Response.json({ error: 'board/changes?frame=<vendor>:<frame id>' }, { status: 400 });
+        const found = (await this.boardFrames(url)).frames.find(({ frame }) => `${frame.vendor}:${frame.id}` === key);
+        if (!found)
+            return Response.json({ error: `no frame ${key} on ${this.served}'s board` }, { status: 404 });
+        const acts = new Map();
+        for (const c of found.mine) {
+            const act = acts.get(actOf(c)) ?? { at: c.action.occurredAt, writes: 0, entries: [] };
+            if (c.action.occurredAt > act.at)
+                act.at = c.action.occurredAt;
+            act.writes += 1;
+            const named = Object.fromEntries(['title', 'name', 'hostname', 'email', 'text', 'subject', 'summary', 'description'].flatMap((k) => { const v = c.action.fields?.[k]; return typeof v === 'string' ? [[k, v.slice(0, 120)]] : []; }));
+            if (act.entries.length < 50)
+                act.entries.push({ op: c.action.op, ...(c.action.operation ? { operation: c.action.operation } : {}), subject: c.action.subject, fields: named });
+            acts.set(actOf(c), act);
+        }
+        const all = [...acts.values()].sort((a, b) => b.at.localeCompare(a.at));
+        return Response.json({ frame: key, total: all.length, since: found.mine.map((c) => c.action.occurredAt).sort()[0] ?? null, acts: all.slice(0, 100) });
+    }
+    /** Every twin's frames, where each opens here, and each with the changes not yet cut that are its own. */
+    async boardFrames(url) {
         const claimed = new Map((await this.claimedHosts(url.origin)).map(({ vendor, hosts }) => [vendor, new Set(hosts)]));
         const routed = this.host.sitesOrigin?.() ?? null;
         const sites = routed ? new URL(routed) : null;
@@ -1898,12 +1986,13 @@ export class WorldDoors {
             catch {
                 listed = [];
             }
-            // a pack that lays out no board yet keeps its vendor's home on it: its root workspace, else its first unparameterized one
+            // a pack that lays out no board yet keeps its vendor's home on it (its root workspace, else its first unparameterized
+            // one), whose changes are all of the vendor's
             if (!listed.length) {
                 const screens = await this.screensOf(vendor);
                 const home = screens.find((w) => w.path.replace(/\/+$/, '') === '') ?? screens.find((w) => !/[{<]/.test(w.path));
                 if (home)
-                    frames.push({ vendor, id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, at: { screen: home.path.startsWith('/') ? home.path : `/${home.path}` }, changes: changes.filter((c) => c.service === vendor).length ? new Set(changes.filter((c) => c.service === vendor).map((c) => (typeof c.action.correlationId === 'string' ? c.action.correlationId : undefined) ?? c.action.id)).size : 0 });
+                    frames.push({ frame: { vendor, id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, at: { screen: home.path.startsWith('/') ? home.path : `/${home.path}` } }, mine: changes.filter((c) => c.service === vendor) });
             }
             for (const f of listed) {
                 let at = null;
@@ -1923,12 +2012,10 @@ export class WorldDoors {
                     unseen = 'not-drawn';
                 }
                 const covered = new Set(f.covers.map((c) => `${c.type}:${c.id}`));
-                // one change per request that made it: a deploy's script, versions and assets are one act, its domain another
-                const acts = new Set(changes.filter((c) => c.service === vendor && covered.has(`${c.action.subject.type}:${c.action.subject.id}`)).map((c) => (typeof c.action.correlationId === 'string' ? c.action.correlationId : undefined) ?? c.action.id));
-                frames.push({ vendor, id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(unseen ? { unseen } : {}), changes: acts.size });
+                frames.push({ frame: { vendor, id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(unseen ? { unseen } : {}) }, mine: changes.filter((x) => x.service === vendor && covered.has(`${x.action.subject.type}:${x.action.subject.id}`)) });
             }
         }
-        return { world: this.served, frames, ...this.savedBoards() };
+        return { delta, frames };
     }
     /** The boards as the World keeps them, and the version a save names: the default board when none was ever kept. */
     savedBoards() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.10",
+  "version": "3.0.12",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -68,14 +68,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.10",
-    "@volter/world-console": "3.0.5"
+    "@volter/world-core": "3.0.12",
+    "@volter/world-console": "3.0.7"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.10",
+    "@volter/world-core": "3.0.12",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",
     "yaml": "2.9.0"

package/src/cli-commands.ts

@@ -802,11 +802,15 @@ export async function main(): Promise<void> {
         caFile = join(mkdtempSync(join(tmpdir(), 'volter-attach-')), 'ca.pem');
         writeFileSync(caFile, manifest.ca);
       }
+      // the World's twins, each a loopback listener here that adds its key, so a command with its own HTTP stack reaches
+      // them as it would a local World's (the manifest pointed at the listeners before its env is made)
+      const { bridgeTwins } = createRequire(import.meta.url)('@volter/world-core/http-bridge') as { bridgeTwins: (manifest: WorldManifest, key: string, ca?: string) => Promise<unknown[]> };
+      await bridgeTwins(manifest, manifest.env.VOLTER_TWINS_KEY ?? attachToken ?? '', manifest.ca ?? undefined);
       const injectPath = createRequire(import.meta.url).resolve('@volter/world-core/inject');
       const env = remoteAttachEnv(manifest, { injectPath, ...(caFile === undefined ? {} : { caFile }) });
       // the world's byte-stream doors, bridged to loopback listeners here, beside a command in any language
       const { bridgeStreams, drainStreams } = createRequire(import.meta.url)('@volter/world-core/stream-bridge') as { bridgeStreams: (streams: WorldManifest['streams'], token: string) => Promise<{ env: Record<string, string> }>; drainStreams: (ms?: number) => Promise<void> };
-      const bridged = manifest.streams ? await bridgeStreams(manifest.streams, attachToken ?? manifest.env.VOLTER_TWINS_KEY ?? '') : { env: {} };
+      const bridged = manifest.streams ? await bridgeStreams(manifest.streams, manifest.env.VOLTER_TWINS_KEY ?? attachToken ?? '') : { env: {} };
       // VOLTER_WORLD names the World to the injector: a request addressed to its paths carries its key
       const commandEnv: Record<string, string | undefined> = withoutVaultSignIn({ ...process.env, ...env, ...bridged.env, VOLTER_WORLD: resolved.ref });
       commandEnv.VOLTER_TWIN_INJECT_QUIET = head.includes('--verbose') ? '0' : commandEnv.VOLTER_TWIN_INJECT_QUIET ?? '1';

package/src/served-world.ts

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
-import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, type TwinRequestJournalCursor, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink, type BoardFrame } from '@volter/world-core/runtime';
+import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, type TwinRequestJournalCursor, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, ORIGINAL_PATH_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink, type BoardFrame } from '@volter/world-core/runtime';
 import { APP_READ_ENDPOINT_ENV } from './init.ts';
 import { packFacts } from './pack-facts.ts';
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type TrustedIssuer, type WorldCredentials } from '@volter/world-access';
@@ -84,19 +84,21 @@ export function keysFile(worldRoot: string): string { return join(worldRoot, sta
 export function boardFile(worldRoot: string): string { return join(worldRoot, stateDirName(), 'board.json'); }
 /** A board as the World keeps it: a frame or a section is named `<vendor>:<frame id>` or `<vendor>:section:<section id>`.
  *  The first board is everything the packs lay out; another holds what it includes, a section with its frames to come. */
-type SavedBoard = { id: string; name: string; include?: string[]; hidden?: string[]; placed?: Record<string, { x: number; y: number }> };
+type SavedBoard = { id: string; name: string; include?: string[]; hidden?: string[]; placed?: Record<string, { x: number; y: number }>; /** each section's region and name, by a pack's group or `user:<id>`; a pack's group removed is `gone` */ sections?: Record<string, { x: number; y: number; w: number; h: number; name?: string; gone?: true }> };
 const BOARD_KEY = /^[a-z0-9-]+:[^\s]{1,300}$/;
 /** The largest board document a World keeps. */
 const BOARD_BYTES = 256 * 1024;
 /** A board document from a request, or the reason it is refused: every field of its type, nothing else. */
 /** A kept board document's version: its bytes' digest, or `none` before one is kept. */
 const boardVersion = (text: string | null): string => (text === null ? 'none' : createHash('sha256').update(text).digest('hex').slice(0, 16));
+/** A change's act: the request that made it (its writes share one correlation id), else the write itself. */
+const actOf = (c: { action: { id: string; correlationId?: unknown } }): string => (typeof c.action.correlationId === 'string' ? c.action.correlationId : c.action.id);
 function boardsOf(body: unknown): SavedBoard[] | string {
   const list = (body as { boards?: unknown } | null)?.boards;
   if (!Array.isArray(list) || list.length < 1 || list.length > 50) return 'boards: a list of 1-50 boards';
   const ids = new Set<string>();
   for (const b of list as Array<Record<string, unknown>>) {
-    if (!b || typeof b !== 'object' || Object.keys(b).some((k) => !['id', 'name', 'include', 'hidden', 'placed'].includes(k))) return 'a board has only id, name, include, hidden and placed';
+    if (!b || typeof b !== 'object' || Object.keys(b).some((k) => !['id', 'name', 'include', 'hidden', 'placed', 'sections'].includes(k))) return 'a board has only id, name, include, hidden, placed and sections';
     if (typeof b.id !== 'string' || !/^[a-z0-9-]{1,64}$/.test(b.id) || ids.has(b.id)) return 'a board id is unique, a-z 0-9 -';
     ids.add(b.id);
     if (typeof b.name !== 'string' || !b.name.trim() || b.name.length > 80) return 'a board name is 1-80 characters';
@@ -106,6 +108,18 @@ function boardsOf(body: unknown): SavedBoard[] | string {
       if (!placed || typeof placed !== 'object' || Array.isArray(placed) || Object.keys(placed).length > 2000) return 'placed: a frame name to its place';
       for (const [k, v] of Object.entries(placed)) if (!BOARD_KEY.test(k) || !v || typeof v !== 'object' || Object.keys(v).join() !== 'x,y' || !Object.values(v).every((n) => typeof n === 'number' && Number.isFinite(n))) return 'placed: { x, y } by frame name';
     }
+    if (b.sections !== undefined) {
+      const sections = b.sections as Record<string, unknown>;
+      if (!sections || typeof sections !== 'object' || Array.isArray(sections) || Object.keys(sections).length > 500) return 'sections: a section name to its region';
+      for (const [k, v] of Object.entries(sections)) {
+        const r = v as Record<string, unknown> | null;
+        // a section is a pack's group (`<vendor>:section:<id>`) or one people drew (`user:<id>`), on the board's plane
+        if (!BOARD_KEY.test(k) || !(/^user:[a-z0-9]{1,32}$/.test(k) || /^[a-z0-9-]+:section:/.test(k)) || !r || typeof r !== 'object' || Object.keys(r).some((f) => !['x', 'y', 'w', 'h', 'name', 'gone'].includes(f))
+          || !['x', 'y'].every((f) => typeof r[f] === 'number' && Math.abs(r[f] as number) <= 1e7) || !['w', 'h'].every((f) => typeof r[f] === 'number' && (r[f] as number) >= 0 && (r[f] as number) <= 1e6)
+          || (r.gone !== true && ((r.w as number) < 100 || (r.h as number) < 100))
+          || (r.name !== undefined && (typeof r.name !== 'string' || !r.name.trim() || r.name.length > 80)) || (r.gone !== undefined && r.gone !== true)) return 'sections: { x, y, w, h, name?, gone? } by section name';
+      }
+    }
   }
   if ((list[0] as SavedBoard).include !== undefined) return 'the first board is everything: it includes no list';
   return list as SavedBoard[];
@@ -740,6 +754,11 @@ export class WorldDoors {
       if (location) { try { const to = new URL(location, `https://${host}`); if (to.hostname === host) out.set('location', `${to.pathname}${to.search}${to.hash}`); } catch { /* left as answered */ } }
       return new Response(request.method === 'HEAD' ? null : answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
     }
+    // a person's browser is told in words (often the site is not there yet, or was not in a copy of the World as it was)
+    if ((request.headers.get('accept') ?? '').includes('text/html')) {
+      const shown = host.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+      return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p>Nothing is served at <b>${shown}</b> in this World.</p></body>`, { status: 404, headers: { 'content-type': 'text/html; charset=utf-8' } });
+    }
     return Response.json({ error: `no twin of ${this.served} answers ${host}` }, { status: 404 });
   }
 
@@ -850,6 +869,9 @@ export class WorldDoors {
     // the request's trace: the caller's trace-id goes on (or a new one), under a parent-id the World mints, which the
     // request's log entries carry, so each entry is joined to its caller by an id no caller chose
     headers.delete(CALLER_HEADER);
+    // the address a request was signed for (a CLI's loopback bridge says it, @volter/world-core/http-bridge) is a
+    // credential holder's word: a browser's session cannot name another, so a signature is checked on the path it reached
+    if (via === 'session') { headers.delete(ORIGINAL_PATH_HEADER); headers.delete('x-volter-twin-original-host'); }
     const who = this.callerOf(request); if (who) headers.set(CALLER_HEADER, callerForHeader(who));
     headers.set('traceparent', traceparentForDelivery(headers.get('traceparent')) ?? newTraceparent());
     // at a twin that enforces the read scope, every request of the read token is marked read-only (a GET
@@ -978,6 +1000,36 @@ export class WorldDoors {
     // ending a browser's session needs no token: it only clears the caller's own cookie, which never
     // reaches these /-/ paths, so a page holding just the session could not otherwise sign out
     const sessionPath = path.replace(/\/+$/, '');
+    // THE HAND-OFF: a page of no UI that opens this World's session from the token in its fragment, then goes to the page
+    // of this World it names (`land`): how a page elsewhere links to this World's own pages (the console's comparison
+    // opening a vendor's page in a copy of the World, read only). The token never reaches the server in a URL; its script
+    // is a file of this origin, so the page keeps a strict policy. It is never framed: a session opened in another
+    // site's frame is not this World's own page's
+    if (sessionPath === 'session/hand-off' && request.method === 'GET') {
+      return new Response(`<!doctype html><meta charset="utf-8"><title>${this.served}</title><body data-world="${this.served}"><script src="/-/${this.served}/session/hand-off.js"></script></body>`,
+        { headers: { 'content-type': 'text/html; charset=utf-8', 'content-security-policy': "default-src 'none'; script-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'", 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
+    }
+    if (sessionPath === 'session/hand-off.js' && request.method === 'GET') {
+      const script = `(() => {
+  const world = document.body.dataset.world;
+  const carried = new URLSearchParams(location.hash.slice(1));
+  history.replaceState(null, '', location.pathname);
+  const token = carried.get('token') || '';
+  const land = carried.get('land') || '';
+  // resolved as the browser will (encoded dots too), on this origin and under this World
+  let to = null;
+  try { const u = new URL(land, location.origin); if (land.startsWith('/') && !/[\\\\\\s]/.test(land) && u.origin === location.origin && u.pathname.startsWith('/' + world + '/')) to = u.pathname + u.search; } catch {}
+  const open = () => fetch('/-/' + world + '/session', { method: 'POST', headers: { 'x-volter-token': token } });
+  if (!token || !to) { document.body.textContent = 'Nothing to open.'; return; }
+  // a session this browser already holds here is kept: a page elsewhere cannot replace, downgrade or fix it
+  fetch('/-/' + world + '/session')
+    .then((held) => (held.ok ? held : open()))
+    .then((r) => { if (r.ok) location.replace(to); else document.body.textContent = 'This World did not open.'; })
+    .catch(() => { document.body.textContent = 'This World did not answer.'; });
+})();
+`;
+      return new Response(script, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' } });
+    }
     // a person signing in from a page (the console's form, posted to this origin): the token in the
     // form body, the session set here, then on to a page of this World
     // a form or beacon from another site never opens or ends a session here (the console, on this host's
@@ -1052,6 +1104,7 @@ export class WorldDoors {
     }
     if (kind === 'map' && !name && request.method === 'GET') return Response.json(await this.map());
     if (kind === 'board' && !name && request.method === 'GET') return Response.json(await this.board(url));
+    if (kind === 'board' && name === 'changes' && !verb && request.method === 'GET') return await this.boardChanges(url);
     if (kind === 'board' && !name && request.method === 'PUT') {
       if (!/^application\/json\b/i.test(request.headers.get('content-type') ?? '')) return Response.json({ error: 'the board is sent as application/json' }, { status: 415 });
       if (Number(request.headers.get('content-length') ?? '0') > BOARD_BYTES) return Response.json({ error: `the board is at most ${BOARD_BYTES} bytes` }, { status: 413 });
@@ -1565,16 +1618,42 @@ export class WorldDoors {
 
   /** THE BOARD: every twin's frames as its pack lays them out (`GET /twin/board`), each where this World shows it (a
    *  hostname a twin answers as a site at its own origin, a vendor page under the twin's place, or nowhere: a frame no
-   *  screen draws yet) and the changes not yet cut on the records it covers, counted by the request that made them; and
-   *  the boards as this World's people arranged them. */
+   *  screen draws yet) and the changes not yet cut on the records it covers, counted by the request that made them, with
+   *  when the first was made; and the boards as this World's people arranged them. A frame's changes themselves are read
+   *  one frame at a time (`board/changes`). */
   private async board(url: URL): Promise<unknown> {
+    const { frames, delta } = await this.boardFrames(url);
+    // the changes are counted from the World's base: what was last cut or received, and when
+    return { world: this.served, base: { id: delta.base.id, at: delta.base.createdAt ?? null }, frames: frames.map(({ frame, mine }) => ({ ...frame, changes: new Set(mine.map(actOf)).size, since: mine.map((c) => c.action.occurredAt).sort()[0] ?? null })), ...this.savedBoards() };
+  }
+  /** One frame's changes not yet cut, newest first: each the writes one request made, as words read them (the operation,
+   *  the record, its few naming fields), the frame named `<vendor>:<frame id>`. */
+  private async boardChanges(url: URL): Promise<Response> {
+    const key = url.searchParams.get('frame') ?? '';
+    if (!key) return Response.json({ error: 'board/changes?frame=<vendor>:<frame id>' }, { status: 400 });
+    const found = (await this.boardFrames(url)).frames.find(({ frame }) => `${frame.vendor}:${frame.id}` === key);
+    if (!found) return Response.json({ error: `no frame ${key} on ${this.served}'s board` }, { status: 404 });
+    const acts = new Map<string, { at: string; writes: number; entries: Array<{ op: string; operation?: string; subject: { type: string; id: string }; fields: Record<string, string> }> }>();
+    for (const c of found.mine) {
+      const act = acts.get(actOf(c)) ?? { at: c.action.occurredAt, writes: 0, entries: [] };
+      if (c.action.occurredAt > act.at) act.at = c.action.occurredAt;
+      act.writes += 1;
+      const named = Object.fromEntries(['title', 'name', 'hostname', 'email', 'text', 'subject', 'summary', 'description'].flatMap((k) => { const v = (c.action.fields as Record<string, unknown> | undefined)?.[k]; return typeof v === 'string' ? [[k, v.slice(0, 120)]] : []; }));
+      if (act.entries.length < 50) act.entries.push({ op: c.action.op, ...(c.action.operation ? { operation: c.action.operation } : {}), subject: c.action.subject, fields: named });
+      acts.set(actOf(c), act);
+    }
+    const all = [...acts.values()].sort((a, b) => b.at.localeCompare(a.at));
+    return Response.json({ frame: key, total: all.length, since: found.mine.map((c) => c.action.occurredAt).sort()[0] ?? null, acts: all.slice(0, 100) });
+  }
+  /** Every twin's frames, where each opens here, and each with the changes not yet cut that are its own. */
+  private async boardFrames(url: URL): Promise<{ delta: ReturnType<typeof diffWorld>; frames: Array<{ frame: Record<string, unknown> & { vendor: string; id: string }; mine: Array<ReturnType<typeof diffWorld>['actions'][number]> }> }> {
     const claimed = new Map((await this.claimedHosts(url.origin)).map(({ vendor, hosts }) => [vendor, new Set(hosts)]));
     const routed = this.host.sitesOrigin?.() ?? null;
     const sites = routed ? new URL(routed) : null;
     const delta = diffWorld(this.name, { root: this.worldRoot });
     const received = new Set(listWorldChangesets({ root: this.worldRoot, world: this.name }).filter((l) => l.changeset.pushedBy).flatMap((l) => l.changeset.actions.map((a) => a.action.id)));
     const changes = delta.actions.filter((a) => !received.has(a.action.id));
-    const frames: unknown[] = [];
+    const frames: Array<{ frame: Record<string, unknown> & { vendor: string; id: string }; mine: typeof changes }> = [];
     for (const vendor of Object.keys(this.up().services)) {
       const twin = this.host.twinFetch(vendor);
       let listed: BoardFrame[] = [];
@@ -1582,11 +1661,12 @@ export class WorldDoors {
         const answer = twin ? await twin(new Request('http://world.local/twin/board', { headers: { [READ_ONLY_HEADER]: '1' } })) : null;
         listed = answer?.ok ? (((await answer.json()) as { frames?: BoardFrame[] }).frames ?? []) : [];
       } catch { listed = []; }
-      // a pack that lays out no board yet keeps its vendor's home on it: its root workspace, else its first unparameterized one
+      // a pack that lays out no board yet keeps its vendor's home on it (its root workspace, else its first unparameterized
+      // one), whose changes are all of the vendor's
       if (!listed.length) {
         const screens = await this.screensOf(vendor);
         const home = screens.find((w) => w.path.replace(/\/+$/, '') === '') ?? screens.find((w) => !/[{<]/.test(w.path));
-        if (home) frames.push({ vendor, id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, at: { screen: home.path.startsWith('/') ? home.path : `/${home.path}` }, changes: changes.filter((c) => c.service === vendor).length ? new Set(changes.filter((c) => c.service === vendor).map((c) => (typeof c.action.correlationId === 'string' ? c.action.correlationId : undefined) ?? c.action.id)).size : 0 });
+        if (home) frames.push({ frame: { vendor, id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, at: { screen: home.path.startsWith('/') ? home.path : `/${home.path}` } }, mine: changes.filter((c) => c.service === vendor) });
       }
       for (const f of listed) {
         let at: { site: string } | { screen: string } | null = null;
@@ -1599,12 +1679,10 @@ export class WorldDoors {
           if (!at) unseen = claimed.get(vendor)?.has(u.hostname.toLowerCase()) ? 'sites-not-routed' : 'not-drawn';
         } catch { at = null; unseen = 'not-drawn'; }
         const covered = new Set(f.covers.map((c) => `${c.type}:${c.id}`));
-        // one change per request that made it: a deploy's script, versions and assets are one act, its domain another
-        const acts = new Set(changes.filter((c) => c.service === vendor && covered.has(`${c.action.subject.type}:${c.action.subject.id}`)).map((c) => (typeof c.action.correlationId === 'string' ? c.action.correlationId : undefined) ?? c.action.id));
-        frames.push({ vendor, id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(unseen ? { unseen } : {}), changes: acts.size });
+        frames.push({ frame: { vendor, id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(unseen ? { unseen } : {}) }, mine: changes.filter((x) => x.service === vendor && covered.has(`${x.action.subject.type}:${x.action.subject.id}`)) });
       }
     }
-    return { world: this.served, frames, ...this.savedBoards() };
+    return { delta, frames };
   }
   /** The boards as the World keeps them, and the version a save names: the default board when none was ever kept. */
   private savedBoards(): { boards: SavedBoard[]; version: string } {