@volter/world-runtime 3.0.138 → 3.0.139

package/dist/src/changeset.d.ts

@@ -115,6 +115,8 @@ export type PushWorldOptions = WorldRootOptions & {
     /** the remote's twins url and namespace; default to the world's recorded origin */
     to?: string;
     namespace?: string;
+    /** Only the tracked origin may advance this branch's origin cursor or receive its landed receipts. */
+    trackOrigin?: boolean;
     /** the namespace key (a push is a write; the read key is refused) */
     key: string;
     force?: boolean;

package/dist/src/changeset.js

@@ -26,7 +26,7 @@ import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, g
 import { tmpdir } from 'node:os';
 import { join, relative, resolve } from 'node:path';
 import { approveChangeset, rebaseChangeset, buildChangeset, captureMarker, changesetHashMatches, changesetReadiness, diffLedgers, normalizeChangeset, replayChangeset, runChangesetVerifiers, stateDirName, withApplication, withVerification, worldBootMarker, assertSafeChangesetName, assertMarkerBelongsTo, CHANGESET_KIND, MARKER_KIND, WORLD_BOOT_MARKER_ID, } from '@volter/world-core/runtime';
-import { instanceDir, listWorlds, statusWorld } from "./runtime.js";
+import { instanceDir, isWorldOrigin, listWorlds, statusWorld } from "./runtime.js";
 import { fetchFromOrigin } from "./origin.js";
 import { fetchReady, isPathRemote, landChangeset, landReceipts, localWorld, TOKEN_HEADER } from "./served-world.js";
 import { loadWorldChecks } from "./root.js";
@@ -391,19 +391,42 @@ export async function pushWorldChangeset(name, options) {
     const namespace = options.namespace ?? instance.origin?.namespace;
     if (!url || !namespace)
         throw new Error(`World "${located.world}" has no origin to push to — \`volter remote add origin <url> --token <token>\` names one`);
+    const trackOrigin = options.trackOrigin !== false && isWorldOrigin(instance, { url, namespace }, root);
     // over http to a served world's push door, or straight into a world at a path (git's file transport)
     let res;
     let body;
     const expect = {};
     for (const a of located.changeset.actions) {
         const meta = readBranchMeta(a.stateService ?? a.service, join(instance.dirs.data, a.service));
-        const pointer = meta?.origin ?? meta?.parent;
-        if (meta?.origin?.incomplete)
+        const pointer = trackOrigin ? meta?.origin ?? meta?.parent : undefined;
+        if (trackOrigin && meta?.origin?.incomplete)
             throw new Error('The branch cuts through its tracked origin; pull and rebase before pushing');
         const view = isPathRemote(url) ? pointer?.view : pointer?.remoteView;
         if (pointer && view)
             expect[a.service] = { view, position: pointer.position };
     }
+    if (!trackOrigin) {
+        // A named destination has no origin cursor here. Read its head without installing it as
+        // origin, and bind this delivery to that head so a concurrent destination move is refused.
+        for (const a of located.changeset.actions) {
+            if (expect[a.service])
+                continue;
+            if (isPathRemote(url)) {
+                const target = localWorld(url);
+                const head = captureHistory(a.stateService ?? a.service, join(target.instance.dirs.data, a.service));
+                expect[a.service] = { view: head.view, position: head.position };
+            }
+            else {
+                const answer = await fetchReady(`${url}/-/${namespace}/checkpoint/${encodeURIComponent(a.service)}`, { headers: { [TOKEN_HEADER]: options.key } });
+                if (!answer.ok)
+                    throw new Error(`Cannot read destination head for ${a.service}: ${answer.status}`);
+                const head = await answer.json();
+                if (typeof head.view !== 'string' || !Number.isSafeInteger(head.position))
+                    throw new Error(`Destination did not return a history head for ${a.service}`);
+                expect[a.service] = { view: head.view, position: head.position };
+            }
+        }
+    }
     // THE RESOURCE PAYLOADS the entries name (uploaded media, file bytes), in two phases. Content-addressed
     // blobs (a key segment that IS a sha256) never change, so they go before the entries: a refused push
     // leaves only bytes nothing names yet. Records kept by name (an upload's status, a media record) are the
@@ -468,7 +491,7 @@ export async function pushWorldChangeset(name, options) {
                     continue;
                 const put = await fetch(at, { method: 'PUT', headers: { [TOKEN_HEADER]: options.key, 'content-type': 'application/octet-stream' }, body: new Blob([bytes]) });
                 if (!put.ok)
-                    throw new Error(`push: the origin refused ${twin}'s ${key} (${put.status} ${(await put.text()).slice(0, 200)})`);
+                    throw new Error(`push: the destination refused ${twin}'s ${key} (${put.status} ${(await put.text()).slice(0, 200)})`);
             }
         }
     };
@@ -496,7 +519,7 @@ export async function pushWorldChangeset(name, options) {
     const at = new Date().toISOString();
     if (!res.ok || !body.receipts) {
         const refusal = body.refusal ?? [body.error ?? `the remote answered ${res.status}`];
-        const application = { at, contentHash: located.changeset.contentHash, outcome: 'refused', refusal, receipts: [], compensation: [] };
+        const application = { at, contentHash: located.changeset.contentHash, destination: { url, namespace }, outcome: 'refused', refusal, receipts: [], compensation: [] };
         writeChangesetFile(located.path, withApplication(located.changeset, application));
         return { application, changeset: withApplication(located.changeset, application), world: located.world, path: located.path, remote: { url, namespace } };
     }
@@ -515,7 +538,7 @@ export async function pushWorldChangeset(name, options) {
     }
     // origin advanced by what landed (and what it performed): the cursor moves with it, so the next
     // fetch and the next push start from where origin now stands
-    if (body.snapshots && instance.origin) {
+    if (trackOrigin && body.snapshots && instance.origin) {
         const twins = Object.keys(body.snapshots);
         const fetched = await fetchFromOrigin(located.world, { root, url, namespace, key: options.key, services: twins, views: body.snapshots });
         for (const twin of twins) {
@@ -537,6 +560,8 @@ export async function pushWorldChangeset(name, options) {
     for (const r of body.receipts)
         byTwin.set(r.twin, [...(byTwin.get(r.twin) ?? []), r]);
     for (const [twin, receipts] of byTwin) {
+        if (!trackOrigin)
+            continue;
         const entry = located.changeset.actions.find((e) => e.service === twin);
         const state = entry?.stateService ?? twin;
         landReceipts(join(instance.dirs.data, twin), state, receipts, at);
@@ -544,11 +569,11 @@ export async function pushWorldChangeset(name, options) {
     const statusOf = (s) => (s === 'deployed' ? 'confirmed' : s === 'landed' ? 'replayed' : s === 'refused' || s === 'failed' ? 'failed' : 'skipped');
     const receipts = body.receipts.map((r) => ({ actionId: r.actionId, service: r.twin, stateService: located.changeset.actions.find((e) => e.service === r.twin)?.stateService ?? r.twin, status: statusOf(r.status), ...(r.externalId ? { externalId: r.externalId } : {}), ...(r.reason ? { error: r.reason } : {}) }));
     const outcome = receipts.every((r) => r.status !== 'failed') ? 'applied' : receipts.some((r) => r.status === 'confirmed') ? 'partial' : 'refused';
-    const application = { at, contentHash: located.changeset.contentHash, outcome, receipts, compensation: [], ...(outcome === 'refused' ? { refusal: receipts.filter((r) => r.error).map((r) => r.error) } : {}) };
+    const application = { at, contentHash: located.changeset.contentHash, destination: { url, namespace }, outcome, receipts, compensation: [], ...(outcome === 'refused' ? { refusal: receipts.filter((r) => r.error).map((r) => r.error) } : {}) };
     // the remote's record of who pushed it and who owns it, kept on this copy too (outside the hash)
     const changeset = { ...withApplication(located.changeset, application), ...(body.owner && !located.changeset.owner ? { owner: body.owner } : {}), ...(body.pushedBy ? { pushedBy: body.pushedBy } : {}) };
     writeChangesetFile(located.path, changeset);
-    const unsent = namedFailure ? `records the landed entries name did not reach the origin (${errorMessage(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
+    const unsent = namedFailure ? `records the landed entries name did not reach the destination (${errorMessage(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
     return { ...(unsent ? { unsent } : {}), application, changeset, world: located.world, path: located.path, remote: { url, namespace } };
 }
 /** `volter-world changeset rebase <name>`: the merge onto the authoring world's moved mirror. */

package/dist/src/covers.js

@@ -747,7 +747,9 @@ export function coverWorld(world, repoPath, options = {}) {
     const uninterceptable = [];
     const excluded = [];
     for (const [vendor, sources] of [...detected.entries()].sort(([a], [b]) => a.localeCompare(b))) {
-        const selected = inventory.selection === undefined || (uses.get(vendor) ?? []).some((use) => worldSelectionIncludes(inventory.selection, vendor, use.usage));
+        const managedWire = [...inventory.connections.values()].find(binding => binding.protocol === vendor);
+        const explicitlyExcluded = inventory.selection?.exclude.some(s => s.vendor === vendor && (s.usage === undefined || s.usage === 'application'));
+        const selected = (!explicitlyExcluded && managedWire !== undefined) || inventory.selection === undefined || (uses.get(vendor) ?? []).some((use) => worldSelectionIncludes(inventory.selection, vendor, use.usage));
         if (!selected) {
             excluded.push(vendor);
             rows.push({ vendor, detectedVia: sources, twinInWorld: null, status: 'excluded' });
@@ -763,7 +765,7 @@ export function coverWorld(world, repoPath, options = {}) {
             ? [...inventory.connections.values()].find(binding => binding.protocol === managed.scheme)
             : undefined;
         const match = matchId === undefined
-            ? managedBinding ? { label: managedBinding.label, interceptable: true } : null
+            ? managedBinding || managedWire ? { label: (managedBinding ?? managedWire).label, interceptable: true } : null
             : inventory.ids.get(matchId);
         let status = match === null ? 'missing' : match.interceptable ? 'covered' : 'uninterceptable';
         let ackRefused;
@@ -846,7 +848,11 @@ export function coverWorld(world, repoPath, options = {}) {
         const connectionNames = [vendor, ...(requirement.protocol ? [requirement.protocol] : [])];
         const selectorMatches = (selector) => (selector.usage === undefined || selector.usage === 'application') &&
             (selector.vendor === undefined || connectionNames.includes(selector.vendor));
+        const ownedBinding = requirement.env === undefined ? undefined : inventory.connections.get(requirement.env);
+        // A declared managed wire is in the World even when --twins selected only SaaS names.
+        // Keep an explicit exclusion authoritative; otherwise describe the actual owned connection.
         const connectionSelected = inventory.selection === undefined ||
+            (ownedBinding !== undefined && !inventory.selection.exclude.some(selectorMatches)) ||
             (inventory.selection.include.some(selectorMatches) && !inventory.selection.exclude.some(selectorMatches));
         if (!connectionSelected) {
             excluded.push(vendor);

package/dist/src/runtime.d.ts

@@ -92,6 +92,12 @@ export declare function admittedEnv(strip: string[] | undefined, env?: NodeJS.Pr
 /** The names a twin of this World was to issue and did not (its door failed): kept out of every command's env, so a
  *  caller's own value (a real key in their shell) never stands in for the credential the World meant to issue. */
 export declare const UNISSUED_ENV = "VOLTER_WORLD_UNISSUED";
+/** Whether a delivery names the branch's tracked origin. Config owns the root World's
+ *  remote; a local branch keeps its own recorded parent instead of adopting that config. */
+export declare function isWorldOrigin(instance: WorldInstance, destination: {
+    url: string;
+    namespace: string;
+}, root: string): boolean;
 export declare function saveWorldInstance(instance: WorldInstance): void;
 /** The environment an external service and its replacement infrastructure hosts run in. Shared with branching,
  *  so both use the boot's admission, service overrides, lifecycle context and control-plane egress rules. */

package/dist/src/runtime.js

@@ -930,6 +930,15 @@ function namesOrigin(remote, origin, worldRoot) {
         return false;
     }
 }
+/** Whether a delivery names the branch's tracked origin. Config owns the root World's
+ *  remote; a local branch keeps its own recorded parent instead of adopting that config. */
+export function isWorldOrigin(instance, destination, root) {
+    const sameRecorded = instance.origin?.url.replace(/\/+$/, '') === destination.url.replace(/\/+$/, '') && instance.origin?.namespace === destination.namespace;
+    if (instance.name !== instance.config)
+        return sameRecorded;
+    const configured = loadWorldConfig(instance.configPath, root).config.remotes?.origin;
+    return configured ? namesOrigin(configured, destination, root) : sameRecorded;
+}
 export function saveWorldInstance(instance) {
     writeTextAtomic(instanceFile(instance.root, instance.name), `${JSON.stringify(instance, null, 2)}\n`);
 }
@@ -1637,7 +1646,7 @@ async function issueCredentials(service, started, env, pending, unissued, contro
             beginPlaceholderPull(service.id, controlRoot);
         let answer;
         try {
-            const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
+            const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json', 'x-volter-world-activity': 'provisioning' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
             if (!res.ok)
                 throw new Error(`answered ${res.status}`);
             answer = (await res.json());

package/dist/src/served-world.d.ts

@@ -119,6 +119,7 @@ export type WorldLayout = {
     envFile?: string;
     env?: Record<string, string>;
     services: Record<string, {
+        type?: string;
         url?: string;
         protocol?: unknown;
         resolvedPackage?: string;

package/dist/src/served-world.js

@@ -46,7 +46,9 @@ import { fetchFromOrigin } from "./origin.js";
 import { CONSOLE_BASE, consoleRedirect, serveConsoleApart } from "./console-apart.js";
 import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from "./configs.js";
 import { adaptersFor, credentialPath, credentialPayloadFrom, deployTwin, deployWorld, loadWorldChecks, twinSigningSecret, materializeRoots, refreshPosture, refreshTwin, rootForControlRoot, rewrapTwinCredentials, sealTwinCredential, sealedCredentialInfo, bindLegacyCredentials, setTwinRoot, spanMs } from "./root.js";
-import { clockFile, downWorld, listWorlds, statusWorld, upWorld } from "./runtime.js";
+import { describeActionFields } from '@volter/world-core/runtime';
+import { worldLedgers } from "./changeset.js";
+import { clockFile, downWorld, isWorldOrigin, listWorlds, readWorldBootRecord, statusWorld, upWorld } from "./runtime.js";
 import { assertChangesetRules } from "./schema.js";
 export const TOKEN_HEADER = 'x-volter-token';
 /** The header the injector carries a hosted World's token in (inject.cjs, VOLTER_TWINS_KEY). */
@@ -244,7 +246,10 @@ export async function mountWorld(name, opts = {}) {
             // refuse as "already served"), and no twins it started; twins another owner runs were never ours to stop
             let booted = null;
             try {
-                booted = await upWorld(configRef, { name, root: worldRoot, keepState: true });
+                // A view resumes the same app, including the output it owns. Switching to the operator's
+                // default output would strand the app output without an ownership record on the next up.
+                const retained = listWorlds(worldRoot).some(w => w.name === name) ? readWorldBootRecord(name, worldRoot) : null;
+                booted = await upWorld(configRef, { name, root: worldRoot, keepState: true, ...(retained ? { envFile: retained.envFile } : {}) });
                 // a root set in the config while the world was stopped reaches the twins' state now, where the deploy reads it
                 materializeRoots(loadWorldConfig(configRef, worldRoot).config, booted.dirs.data, worldRoot);
                 // credentials sealed before bindings are bound to where they go before any request is let in (instance unset,
@@ -1378,17 +1383,26 @@ export class WorldDoors {
         if (known !== undefined && Date.now() - known.at < 60_000)
             return known.screens;
         let screens = [];
+        let resources = {};
         const twin = this.host.twinFetch(vendor);
         try {
             const answer = twin ? await twin(new Request('http://world.local/twin', { headers: { [READ_ONLY_HEADER]: '1' } })) : null;
-            const listed = answer?.ok ? (await answer.json()).screens : undefined;
+            const manifest = answer?.ok ? await answer.json() : null;
+            const listed = manifest?.screens;
+            const described = manifest?.resources;
+            if (described && typeof described === 'object' && !Array.isArray(described)) {
+                for (const [type, metadata] of Object.entries(described)) {
+                    if (metadata && Array.isArray(metadata.relations))
+                        resources[type] = { relations: metadata.relations.filter(r => r && typeof r.field === 'string' && typeof r.to === 'string') };
+                }
+            }
             if (Array.isArray(listed))
                 screens = listed.filter((x) => typeof x?.id === 'string' && typeof x?.path === 'string').map(({ id, path, host }) => ({ id, path, ...(typeof host === 'string' ? { host } : {}) }));
         }
         catch {
             screens = [];
         }
-        this.workspaces.set(vendor, { screens, at: Date.now() });
+        this.workspaces.set(vendor, { screens, resources, at: Date.now() });
         return screens;
     }
     /** Whether a twin enforces a read-scope request itself (its manifest names `requestScopes: ['read']`):
@@ -1968,7 +1982,7 @@ export class WorldDoors {
             const delta = diffWorld(this.name, { root: this.worldRoot });
             // what another World pushed here is in its changeset already: never this World's uncut changes
             const received = new Set(listWorldChangesets({ root: this.worldRoot, world: this.name }).filter((l) => l.changeset.pushedBy).flatMap((l) => l.changeset.actions.map((a) => a.action.id)));
-            return Response.json({ world: this.served, base: { id: delta.base.id, at: delta.base.createdAt ?? null }, changes: delta.actions.filter((a) => !received.has(a.action.id)).map((a) => ({ twin: a.service, entry: a.action })) });
+            return Response.json({ world: this.served, base: { id: delta.base.id, at: delta.base.createdAt ?? null }, changes: delta.actions.filter((a) => !received.has(a.action.id)).map((a) => ({ twin: a.service, entry: a.action, fields: delta.fieldChanges?.[JSON.stringify([a.service, a.stateService, a.action.id])] })) });
         }
         if (kind === 'log' && name && request.method === 'GET') {
             const state = this.stateOf(name);
@@ -2001,16 +2015,18 @@ export class WorldDoors {
             return Response.json({ twin: name, state, view: cut.view, position: cut.position, tree: readTree(state, controlRoot, { view: cut.view }) });
         }
         if (kind === 'changesets' && request.method === 'GET') {
+            const instance = statusWorld(this.name, this.worldRoot);
+            const originApplied = (c) => Boolean(c.applied && c.applied.outcome !== 'refused' && (!c.applied.destination || isWorldOrigin(instance, c.applied.destination, this.worldRoot)));
             // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
             if (name) {
                 const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name });
-                return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0], readiness: changesetReadiness(l.changeset, worldChangesetRules(this.worldRoot)) });
+                return Response.json({ ...l.changeset, originApplied: originApplied(l.changeset), fieldChanges: describeActionFields(worldLedgers(this.name, this.worldRoot), l.changeset.actions), currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0], readiness: changesetReadiness(l.changeset, worldChangesetRules(this.worldRoot)) });
             }
             const all = listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset);
             const deployed = this.deployedOf(all);
             const rules = worldChangesetRules(this.worldRoot);
             // readiness under this World's rules, as deploy reads it: the console says what the kernel decides
-            return Response.json({ changesets: all.map((c, i) => ({ ...c, currentHash: changesetContentHash(c), deployed: deployed[i], readiness: changesetReadiness(c, rules) })) });
+            return Response.json({ changesets: all.map((c, i) => ({ ...c, originApplied: originApplied(c), fieldChanges: describeActionFields(worldLedgers(this.name, this.worldRoot), c.actions), currentHash: changesetContentHash(c), deployed: deployed[i], readiness: changesetReadiness(c, rules) })) });
         }
         if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
             const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
@@ -2151,7 +2167,8 @@ export class WorldDoors {
             }
             if (name === 'push' && request.method === 'POST') {
                 return Response.json(await this.serialized('push', async () => {
-                    const queue = listWorldChangesets({ root: this.worldRoot, world: this.name }).filter((l) => l.changeset.applied === null || l.changeset.applied.outcome === 'refused').sort((a, b) => a.changeset.createdAt.localeCompare(b.changeset.createdAt));
+                    const instance = statusWorld(this.name, this.worldRoot);
+                    const queue = listWorldChangesets({ root: this.worldRoot, world: this.name }).filter((l) => { const a = l.changeset.applied; return !a || a.outcome === 'refused' || (a.destination && !isWorldOrigin(instance, a.destination, this.worldRoot)); }).sort((a, b) => a.changeset.createdAt.localeCompare(b.changeset.createdAt));
                     const pushed = [];
                     for (const l of queue) {
                         const outcome = await pushWorldChangeset(l.changeset.name, { root: this.worldRoot, world: this.name, key: key() });
@@ -2283,7 +2300,9 @@ export class WorldDoors {
             // every twin of the world as a consumer sees it — the status door mapped over the world; what a
             // console renders first, and what a holder of a world token (never the admin's) can ask
             const twins = [];
-            for (const vendor of Object.keys(this.up().services)) {
+            for (const [vendor, service] of Object.entries(this.up().services)) {
+                if (service.type !== undefined && service.type !== 'twin')
+                    continue;
                 const res = await this.handle(new Request(`${url.origin}/-/${this.served}/twins/${vendor}/status`, { headers: request.headers }));
                 if (res.ok)
                     twins.push(await res.json());
@@ -2364,7 +2383,7 @@ export class WorldDoors {
                 const origin = readBranchMeta(state, this.controlRoot(name))?.origin;
                 const identity = { mounted: mounted?.resolvedPackage ? { package: mounted.resolvedPackage, version: mounted.resolvedVersion ?? null } : null, pinned: mounted?.pinnedSource ?? null };
                 const dataOrigin = origin ? { kind: 'shared-history', url: origin.at } : refresh ? { kind: 'vendor-refresh', url: root?.url ?? null } : { kind: 'unrecorded', url: null };
-                return Response.json({ twin: name, state, identity, dataOrigin, execution: { rootConnected: Boolean(root), deploy: root?.deploy ?? null }, protocol: mounted?.protocol ?? null, screens: await this.screensOf(name), root: root ?? null, credential: sealedCredentialInfo(this.worldRoot, name), refresh, position: wholeLog(state, this.controlRoot(name)).length, lastReceipt: last?.receipt ?? null });
+                return Response.json({ twin: name, state, identity, dataOrigin, execution: { rootConnected: Boolean(root), deploy: root?.deploy ?? null }, protocol: mounted?.protocol ?? null, screens: await this.screensOf(name), resources: this.workspaces.get(name)?.resources ?? {}, root: root ?? null, credential: sealedCredentialInfo(this.worldRoot, name), refresh, position: wholeLog(state, this.controlRoot(name)).length, lastReceipt: last?.receipt ?? null });
             }
             if (verb === 'refresh' && request.method === 'POST') {
                 const root = rootForControlRoot(this.controlRoot(name), name);
@@ -2800,7 +2819,9 @@ export class WorldDoors {
     /** THE MAP: every twin and what it holds, by resource type, and the workspaces it shows. */
     async map() {
         const twins = [];
-        for (const vendor of Object.keys(this.up().services)) {
+        for (const [vendor, service] of Object.entries(this.up().services)) {
+            if (service.type !== undefined && service.type !== 'twin')
+                continue;
             const state = this.stateOf(vendor);
             const controlRoot = this.controlRoot(vendor);
             const counts = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.138",
+  "version": "3.0.139",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -70,14 +70,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.138",
-    "@volter/world-console": "3.0.133"
+    "@volter/world-core": "3.0.139",
+    "@volter/world-console": "3.0.134"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.138",
+    "@volter/world-core": "3.0.139",
     "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",

package/src/changeset.ts

@@ -47,7 +47,7 @@ import {
   WORLD_BOOT_MARKER_ID,
 } from '@volter/world-core/runtime';
 import type { ApplyReceipt, Receipt, ChangesetApplication, RebaseReport, RebaseTarget, Changeset, ChangesetApproval, ChangesetReadiness, ChangesetVerification, ChangesetVerifier, LedgerDelta, LedgerRef, ReplayReport, ReplayTarget, WorldMarker } from '@volter/world-core/runtime';
-import { instanceDir, listWorlds, saveWorldInstance, statusWorld } from './runtime.ts';
+import { instanceDir, isWorldOrigin, listWorlds, saveWorldInstance, statusWorld } from './runtime.ts';
 import { fetchFromOrigin } from './origin.ts';
 import type { WorldInstance } from './schema.ts';
 import { fetchReady, isPathRemote, landChangeset, landReceipts, localWorld, TOKEN_HEADER } from './served-world.ts';
@@ -467,6 +467,8 @@ export type PushWorldOptions = WorldRootOptions & {
   /** the remote's twins url and namespace; default to the world's recorded origin */
   to?: string;
   namespace?: string;
+  /** Only the tracked origin may advance this branch's origin cursor or receive its landed receipts. */
+  trackOrigin?: boolean;
   /** the namespace key (a push is a write; the read key is refused) */
   key: string;
   force?: boolean;
@@ -484,16 +486,35 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   const url = (options.to ?? instance.origin?.url)?.replace(/\/+$/, '');
   const namespace = options.namespace ?? instance.origin?.namespace;
   if (!url || !namespace) throw new Error(`World "${located.world}" has no origin to push to — \`volter remote add origin <url> --token <token>\` names one`);
+  const trackOrigin = options.trackOrigin !== false && isWorldOrigin(instance, { url, namespace }, root);
   // over http to a served world's push door, or straight into a world at a path (git's file transport)
   let res: { ok: boolean; status: number }; let body: { receipts?: Array<{ actionId: string; twin: string } & Receipt>; error?: string; refusal?: string[]; position?: Record<string, number>; snapshots?: Record<string, HistoryReference>; /** whom the remote records as its owner and as who pushed it */ owner?: string; pushedBy?: string };
   const expect: Record<string, HistoryReference> = {};
   for (const a of located.changeset.actions) {
     const meta = readBranchMeta(a.stateService ?? a.service, join(instance.dirs.data, a.service));
-    const pointer = meta?.origin ?? meta?.parent;
-    if (meta?.origin?.incomplete) throw new Error('The branch cuts through its tracked origin; pull and rebase before pushing');
+    const pointer = trackOrigin ? meta?.origin ?? meta?.parent : undefined;
+    if (trackOrigin && meta?.origin?.incomplete) throw new Error('The branch cuts through its tracked origin; pull and rebase before pushing');
     const view = isPathRemote(url) ? pointer?.view : pointer?.remoteView;
     if (pointer && view) expect[a.service] = { view, position: pointer.position };
   }
+  if (!trackOrigin) {
+    // A named destination has no origin cursor here. Read its head without installing it as
+    // origin, and bind this delivery to that head so a concurrent destination move is refused.
+    for (const a of located.changeset.actions) {
+      if (expect[a.service]) continue;
+      if (isPathRemote(url)) {
+        const target = localWorld(url);
+        const head = captureHistory(a.stateService ?? a.service, join(target.instance.dirs.data, a.service));
+        expect[a.service] = { view: head.view, position: head.position };
+      } else {
+        const answer = await fetchReady(`${url}/-/${namespace}/checkpoint/${encodeURIComponent(a.service)}`, { headers: { [TOKEN_HEADER]: options.key } });
+        if (!answer.ok) throw new Error(`Cannot read destination head for ${a.service}: ${answer.status}`);
+        const head = await answer.json() as HistoryReference;
+        if (typeof head.view !== 'string' || !Number.isSafeInteger(head.position)) throw new Error(`Destination did not return a history head for ${a.service}`);
+        expect[a.service] = { view: head.view, position: head.position };
+      }
+    }
+  }
   // THE RESOURCE PAYLOADS the entries name (uploaded media, file bytes), in two phases. Content-addressed
   // blobs (a key segment that IS a sha256) never change, so they go before the entries: a refused push
   // leaves only bytes nothing names yet. Records kept by name (an upload's status, a media record) are the
@@ -546,7 +567,7 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
         const bytes = await blobs.get(path);
         if (!bytes) continue;
         const put = await fetch(at, { method: 'PUT', headers: { [TOKEN_HEADER]: options.key, 'content-type': 'application/octet-stream' }, body: new Blob([bytes as Uint8Array<ArrayBuffer>]) });
-        if (!put.ok) throw new Error(`push: the origin refused ${twin}'s ${key} (${put.status} ${(await put.text()).slice(0, 200)})`);
+        if (!put.ok) throw new Error(`push: the destination refused ${twin}'s ${key} (${put.status} ${(await put.text()).slice(0, 200)})`);
       }
     }
   };
@@ -563,7 +584,7 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   const at = new Date().toISOString();
   if (!res.ok || !body.receipts) {
     const refusal = body.refusal ?? [body.error ?? `the remote answered ${res.status}`];
-    const application: ChangesetApplication = { at, contentHash: located.changeset.contentHash, outcome: 'refused', refusal, receipts: [], compensation: [] };
+    const application: ChangesetApplication = { at, contentHash: located.changeset.contentHash, destination: { url, namespace }, outcome: 'refused', refusal, receipts: [], compensation: [] };
     writeChangesetFile(located.path, withApplication(located.changeset, application));
     return { application, changeset: withApplication(located.changeset, application), world: located.world, path: located.path, remote: { url, namespace } };
   }
@@ -576,7 +597,7 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   }
   // origin advanced by what landed (and what it performed): the cursor moves with it, so the next
   // fetch and the next push start from where origin now stands
-  if (body.snapshots && instance.origin) {
+  if (trackOrigin && body.snapshots && instance.origin) {
     const twins = Object.keys(body.snapshots);
     const fetched = await fetchFromOrigin(located.world, { root, url, namespace, key: options.key, services: twins, views: body.snapshots });
     for (const twin of twins) {
@@ -593,6 +614,7 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   const byTwin = new Map<string, Array<{ actionId: string } & Receipt>>();
   for (const r of body.receipts) byTwin.set(r.twin, [...(byTwin.get(r.twin) ?? []), r]);
   for (const [twin, receipts] of byTwin) {
+    if (!trackOrigin) continue;
     const entry = located.changeset.actions.find((e) => e.service === twin);
     const state = entry?.stateService ?? twin;
     landReceipts(join(instance.dirs.data, twin), state, receipts, at);
@@ -600,11 +622,11 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   const statusOf = (s: Receipt['status']): ApplyReceipt['status'] => (s === 'deployed' ? 'confirmed' : s === 'landed' ? 'replayed' : s === 'refused' || s === 'failed' ? 'failed' : 'skipped');
   const receipts: ApplyReceipt[] = body.receipts.map((r) => ({ actionId: r.actionId, service: r.twin, stateService: located.changeset.actions.find((e) => e.service === r.twin)?.stateService ?? r.twin, status: statusOf(r.status), ...(r.externalId ? { externalId: r.externalId } : {}), ...(r.reason ? { error: r.reason } : {}) }));
   const outcome: ChangesetApplication['outcome'] = receipts.every((r) => r.status !== 'failed') ? 'applied' : receipts.some((r) => r.status === 'confirmed') ? 'partial' : 'refused';
-  const application: ChangesetApplication = { at, contentHash: located.changeset.contentHash, outcome, receipts, compensation: [], ...(outcome === 'refused' ? { refusal: receipts.filter((r) => r.error).map((r) => r.error!) } : {}) };
+  const application: ChangesetApplication = { at, contentHash: located.changeset.contentHash, destination: { url, namespace }, outcome, receipts, compensation: [], ...(outcome === 'refused' ? { refusal: receipts.filter((r) => r.error).map((r) => r.error!) } : {}) };
   // the remote's record of who pushed it and who owns it, kept on this copy too (outside the hash)
   const changeset = { ...withApplication(located.changeset, application), ...(body.owner && !located.changeset.owner ? { owner: body.owner } : {}), ...(body.pushedBy ? { pushedBy: body.pushedBy } : {}) };
   writeChangesetFile(located.path, changeset);
-  const unsent = namedFailure ? `records the landed entries name did not reach the origin (${errorMessage(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
+  const unsent = namedFailure ? `records the landed entries name did not reach the destination (${errorMessage(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
   return { ...(unsent ? { unsent } : {}), application, changeset, world: located.world, path: located.path, remote: { url, namespace } };
 }
 

package/src/covers.ts

@@ -881,7 +881,9 @@ export function coverWorld(world: string, repoPath: string, options: CoverageOpt
   const uninterceptable: string[] = [];
   const excluded: string[] = [];
   for (const [vendor, sources] of [...detected.entries()].sort(([a], [b]) => a.localeCompare(b))) {
-    const selected = inventory.selection === undefined || (uses.get(vendor) ?? []).some((use) => worldSelectionIncludes(inventory.selection!, vendor, use.usage));
+    const managedWire = [...inventory.connections.values()].find(binding => binding.protocol === vendor);
+    const explicitlyExcluded = inventory.selection?.exclude.some(s => s.vendor === vendor && (s.usage === undefined || s.usage === 'application'));
+    const selected = (!explicitlyExcluded && managedWire !== undefined) || inventory.selection === undefined || (uses.get(vendor) ?? []).some((use) => worldSelectionIncludes(inventory.selection!, vendor, use.usage));
     if (!selected) {
       excluded.push(vendor);
       rows.push({ vendor, detectedVia: sources, twinInWorld: null, status: 'excluded' });
@@ -897,7 +899,7 @@ export function coverWorld(world: string, repoPath: string, options: CoverageOpt
       ? [...inventory.connections.values()].find(binding => binding.protocol === managed.scheme)
       : undefined;
     const match = matchId === undefined
-      ? managedBinding ? { label: managedBinding.label, interceptable: true } : null
+      ? managedBinding || managedWire ? { label: (managedBinding ?? managedWire)!.label, interceptable: true } : null
       : inventory.ids.get(matchId)!;
     let status: CoverageStatus = match === null ? 'missing' : match.interceptable ? 'covered' : 'uninterceptable';
     let ackRefused: string | undefined;
@@ -977,7 +979,11 @@ export function coverWorld(world: string, repoPath: string, options: CoverageOpt
     const selectorMatches = (selector: WorldSelection['include'][number]) =>
       (selector.usage === undefined || selector.usage === 'application') &&
       (selector.vendor === undefined || connectionNames.includes(selector.vendor));
+    const ownedBinding = requirement.env === undefined ? undefined : inventory.connections.get(requirement.env);
+    // A declared managed wire is in the World even when --twins selected only SaaS names.
+    // Keep an explicit exclusion authoritative; otherwise describe the actual owned connection.
     const connectionSelected = inventory.selection === undefined ||
+      (ownedBinding !== undefined && !inventory.selection.exclude.some(selectorMatches)) ||
       (inventory.selection.include.some(selectorMatches) && !inventory.selection.exclude.some(selectorMatches));
     if (!connectionSelected) {
       excluded.push(vendor);

package/src/runtime.ts

@@ -927,6 +927,15 @@ function namesOrigin(remote: string | undefined, origin: { url: string; namespac
   } catch { return false; }
 }
 
+/** Whether a delivery names the branch's tracked origin. Config owns the root World's
+ *  remote; a local branch keeps its own recorded parent instead of adopting that config. */
+export function isWorldOrigin(instance: WorldInstance, destination: { url: string; namespace: string }, root: string): boolean {
+  const sameRecorded = instance.origin?.url.replace(/\/+$/, '') === destination.url.replace(/\/+$/, '') && instance.origin?.namespace === destination.namespace;
+  if (instance.name !== instance.config) return sameRecorded;
+  const configured = loadWorldConfig(instance.configPath, root).config.remotes?.origin;
+  return configured ? namesOrigin(configured, destination, root) : sameRecorded;
+}
+
 export function saveWorldInstance(instance: WorldInstance): void {
   writeTextAtomic(instanceFile(instance.root, instance.name), `${JSON.stringify(instance, null, 2)}\n`);
 }
@@ -1603,7 +1612,7 @@ async function issueCredentials(service: WorldServiceConfig, started: WorldServi
     if (!enclosingSeed) beginPlaceholderPull(service.id, controlRoot);
     let answer: Record<string, unknown>;
     try {
-      const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
+      const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json', 'x-volter-world-activity': 'provisioning' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
       if (!res.ok) throw new Error(`answered ${res.status}`);
       answer = (await res.json()) as Record<string, unknown>;
     } finally {

package/src/served-world.ts

@@ -49,7 +49,9 @@ import { fetchFromOrigin } from './origin.ts';
 import { CONSOLE_BASE, consoleRedirect, serveConsoleApart, type ConsoleMount } from './console-apart.ts';
 import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from './configs.ts';
 import { adaptersFor, credentialPath, credentialPayloadFrom, deployTwin, deployWorld, loadWorldChecks, twinSigningSecret, materializeRoots, refreshPosture, refreshTwin, rootForControlRoot, rewrapTwinCredentials, sealTwinCredential, sealedCredentialInfo, bindLegacyCredentials, setTwinRoot, spanMs } from './root.ts';
-import { clockFile, downWorld, listWorlds, statusWorld, upWorld } from './runtime.ts';
+import { describeActionFields } from '@volter/world-core/runtime';
+import { worldLedgers } from './changeset.ts';
+import { clockFile, downWorld, isWorldOrigin, listWorlds, readWorldBootRecord, statusWorld, upWorld } from './runtime.ts';
 import { assertChangesetRules, type WorldChangesetRules, type WorldInstance } from './schema.ts';
 
 export const TOKEN_HEADER = 'x-volter-token';
@@ -252,7 +254,10 @@ export async function mountWorld(name: string, opts: { /** the platforms whose p
       // refuse as "already served"), and no twins it started; twins another owner runs were never ours to stop
       let booted: WorldInstance | null = null;
       try {
-        booted = await upWorld(configRef, { name, root: worldRoot, keepState: true });
+        // A view resumes the same app, including the output it owns. Switching to the operator's
+        // default output would strand the app output without an ownership record on the next up.
+        const retained = listWorlds(worldRoot).some(w => w.name === name) ? readWorldBootRecord(name, worldRoot) : null;
+        booted = await upWorld(configRef, { name, root: worldRoot, keepState: true, ...(retained ? { envFile: retained.envFile } : {}) });
         // a root set in the config while the world was stopped reaches the twins' state now, where the deploy reads it
         materializeRoots(loadWorldConfig(configRef, worldRoot).config, booted.dirs.data, worldRoot);
         // credentials sealed before bindings are bound to where they go before any request is let in (instance unset,
@@ -351,7 +356,7 @@ function streamEnv(id: string, protocol: string): Record<string, string> {
 
 /** What the doors need of a world: where each twin's state lives and which twins it has. A booted
  *  local instance is one; a hosted World describes itself. */
-export type WorldLayout = { dirs: { data: string }; envFile?: string; env?: Record<string, string>; services: Record<string, { url?: string; protocol?: unknown; resolvedPackage?: string; resolvedVersion?: string; pinnedSource?: { package?: string; version?: string } }> };
+export type WorldLayout = { dirs: { data: string }; envFile?: string; env?: Record<string, string>; services: Record<string, { /** Runtime receipts identify non-twin services; older hosts supply a twins-only layout. */ type?: string; url?: string; protocol?: unknown; resolvedPackage?: string; resolvedVersion?: string; pinnedSource?: { package?: string; version?: string } }> };
 /** The host a world's doors run in: its layout, and how a request reaches a twin's wire — a local
  *  host forwards to the twin's own port, a hosted World calls the pack in-process. */
 export type DoorHost = {
@@ -1217,18 +1222,26 @@ export class WorldDoors {
 
   /** A twin's workspaces as its discovery door lists them (`GET /twin`'s `screens`: each built workspace screen's id and
    *  path), which a person is shown at `/<served>/<vendor><path>`. Asked again after a minute, as `enforcesRead` is. */
-  private readonly workspaces = new Map<string, { screens: Array<{ id: string; path: string; host?: string }>; at: number }>();
+  private readonly workspaces = new Map<string, { screens: Array<{ id: string; path: string; host?: string }>; resources: Record<string, { relations: Array<{ field: string; to: string }> }>; at: number }>();
   private async screensOf(vendor: string): Promise<Array<{ id: string; path: string; host?: string }>> {
     const known = this.workspaces.get(vendor);
     if (known !== undefined && Date.now() - known.at < 60_000) return known.screens;
     let screens: Array<{ id: string; path: string; host?: string }> = [];
+    let resources: Record<string, { relations: Array<{ field: string; to: string }> }> = {};
     const twin = this.host.twinFetch(vendor);
     try {
       const answer = twin ? await twin(new Request('http://world.local/twin', { headers: { [READ_ONLY_HEADER]: '1' } })) : null;
-      const listed = answer?.ok ? ((await answer.json()) as { screens?: unknown }).screens : undefined;
+      const manifest = answer?.ok ? await answer.json() as { screens?: unknown; resources?: typeof resources } : null;
+      const listed = manifest?.screens;
+      const described = manifest?.resources;
+      if (described && typeof described === 'object' && !Array.isArray(described)) {
+        for (const [type, metadata] of Object.entries(described)) {
+          if (metadata && Array.isArray(metadata.relations)) resources[type] = { relations: metadata.relations.filter(r => r && typeof r.field === 'string' && typeof r.to === 'string') };
+        }
+      }
       if (Array.isArray(listed)) screens = listed.filter((x): x is { id: string; path: string; host?: string } => typeof x?.id === 'string' && typeof x?.path === 'string').map(({ id, path, host }) => ({ id, path, ...(typeof host === 'string' ? { host } : {}) }));
     } catch { screens = []; }
-    this.workspaces.set(vendor, { screens, at: Date.now() });
+    this.workspaces.set(vendor, { screens, resources, at: Date.now() });
     return screens;
   }
 
@@ -1670,7 +1683,7 @@ export class WorldDoors {
       const delta = diffWorld(this.name, { root: this.worldRoot });
       // what another World pushed here is in its changeset already: never this World's uncut changes
       const received = new Set(listWorldChangesets({ root: this.worldRoot, world: this.name }).filter((l) => l.changeset.pushedBy).flatMap((l) => l.changeset.actions.map((a) => a.action.id)));
-      return Response.json({ world: this.served, base: { id: delta.base.id, at: delta.base.createdAt ?? null }, changes: delta.actions.filter((a) => !received.has(a.action.id)).map((a) => ({ twin: a.service, entry: a.action })) });
+      return Response.json({ world: this.served, base: { id: delta.base.id, at: delta.base.createdAt ?? null }, changes: delta.actions.filter((a) => !received.has(a.action.id)).map((a) => ({ twin: a.service, entry: a.action, fields: delta.fieldChanges?.[JSON.stringify([a.service, a.stateService, a.action.id])] })) });
     }
 
     if (kind === 'log' && name && request.method === 'GET') {
@@ -1699,13 +1712,16 @@ export class WorldDoors {
       return Response.json({ twin: name, state, view: cut.view, position: cut.position, tree: readTree(state, controlRoot, { view: cut.view }) });
     }
     if (kind === 'changesets' && request.method === 'GET') {
+      const instance = statusWorld(this.name, this.worldRoot);
+      const originApplied = (c: Changeset): boolean => Boolean(c.applied && c.applied.outcome !== 'refused' && (!c.applied.destination || isWorldOrigin(instance, c.applied.destination, this.worldRoot)));
+
       // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
-      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0], readiness: changesetReadiness(l.changeset, worldChangesetRules(this.worldRoot)) }); }
+      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json({ ...l.changeset, originApplied: originApplied(l.changeset), fieldChanges: describeActionFields(worldLedgers(this.name, this.worldRoot), l.changeset.actions), currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0], readiness: changesetReadiness(l.changeset, worldChangesetRules(this.worldRoot)) }); }
       const all = listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset);
       const deployed = this.deployedOf(all);
       const rules = worldChangesetRules(this.worldRoot);
       // readiness under this World's rules, as deploy reads it: the console says what the kernel decides
-      return Response.json({ changesets: all.map((c, i) => ({ ...c, currentHash: changesetContentHash(c), deployed: deployed[i], readiness: changesetReadiness(c, rules) })) });
+      return Response.json({ changesets: all.map((c, i) => ({ ...c, originApplied: originApplied(c), fieldChanges: describeActionFields(worldLedgers(this.name, this.worldRoot), c.actions), currentHash: changesetContentHash(c), deployed: deployed[i], readiness: changesetReadiness(c, rules) })) });
     }
     if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
       const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
@@ -1815,7 +1831,8 @@ export class WorldDoors {
       }
       if (name === 'push' && request.method === 'POST') {
         return Response.json(await this.serialized('push', async () => {
-          const queue = listWorldChangesets({ root: this.worldRoot, world: this.name }).filter((l) => l.changeset.applied === null || l.changeset.applied.outcome === 'refused').sort((a, b) => a.changeset.createdAt.localeCompare(b.changeset.createdAt));
+          const instance = statusWorld(this.name, this.worldRoot);
+          const queue = listWorldChangesets({ root: this.worldRoot, world: this.name }).filter((l) => { const a = l.changeset.applied; return !a || a.outcome === 'refused' || (a.destination && !isWorldOrigin(instance, a.destination, this.worldRoot)); }).sort((a, b) => a.changeset.createdAt.localeCompare(b.changeset.createdAt));
           const pushed = [];
           for (const l of queue) {
             const outcome = await pushWorldChangeset(l.changeset.name, { root: this.worldRoot, world: this.name, key: key() });
@@ -1916,7 +1933,8 @@ export class WorldDoors {
       // every twin of the world as a consumer sees it — the status door mapped over the world; what a
       // console renders first, and what a holder of a world token (never the admin's) can ask
       const twins: unknown[] = [];
-      for (const vendor of Object.keys(this.up().services)) {
+      for (const [vendor, service] of Object.entries(this.up().services)) {
+        if (service.type !== undefined && service.type !== 'twin') continue;
         const res = await this.handle(new Request(`${url.origin}/-/${this.served}/twins/${vendor}/status`, { headers: request.headers }));
         if (res.ok) twins.push(await res.json());
       }
@@ -1974,7 +1992,7 @@ export class WorldDoors {
         const origin = readBranchMeta(state, this.controlRoot(name))?.origin;
         const identity = { mounted: mounted?.resolvedPackage ? { package: mounted.resolvedPackage, version: mounted.resolvedVersion ?? null } : null, pinned: mounted?.pinnedSource ?? null };
         const dataOrigin = origin ? { kind: 'shared-history', url: origin.at } : refresh ? { kind: 'vendor-refresh', url: root?.url ?? null } : { kind: 'unrecorded', url: null };
-        return Response.json({ twin: name, state, identity, dataOrigin, execution: { rootConnected: Boolean(root), deploy: root?.deploy ?? null }, protocol: mounted?.protocol ?? null, screens: await this.screensOf(name), root: root ?? null, credential: sealedCredentialInfo(this.worldRoot, name), refresh, position: wholeLog(state, this.controlRoot(name)).length, lastReceipt: last?.receipt ?? null });
+        return Response.json({ twin: name, state, identity, dataOrigin, execution: { rootConnected: Boolean(root), deploy: root?.deploy ?? null }, protocol: mounted?.protocol ?? null, screens: await this.screensOf(name), resources: this.workspaces.get(name)?.resources ?? {}, root: root ?? null, credential: sealedCredentialInfo(this.worldRoot, name), refresh, position: wholeLog(state, this.controlRoot(name)).length, lastReceipt: last?.receipt ?? null });
       }
       if (verb === 'refresh' && request.method === 'POST') {
         const root = rootForControlRoot(this.controlRoot(name), name);
@@ -2323,7 +2341,8 @@ export class WorldDoors {
   /** THE MAP: every twin and what it holds, by resource type, and the workspaces it shows. */
   private async map(): Promise<unknown> {
     const twins: unknown[] = [];
-    for (const vendor of Object.keys(this.up().services)) {
+    for (const [vendor, service] of Object.entries(this.up().services)) {
+      if (service.type !== undefined && service.type !== 'twin') continue;
       const state = this.stateOf(vendor); const controlRoot = this.controlRoot(vendor);
       const counts = new Map<string, number>();
       // what the World holds as the vendor's own resources: the twin's bookkeeping (a `_` type, as a screens sign-in's token)