@volter/world-runtime 3.0.30 → 3.0.32

package/dist/src/served-world.js

@@ -1,4 +1,4 @@
-import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant, historyDigest, historyEntries, readHistoryView, worldPaths } from '@volter/world-core/runtime';
+import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant, historyDigest, historyEntries, readHistoryView, worldPaths } from '@volter/world-core/runtime';
 // A SERVED WORLD (docs/reference/http-api.md#a-served-world): `volter world serve` puts a world at
 // `http://<host>:<port>/<org>/<world>/`. Each twin's vendor API is under its vendor id — the
 // addressed grammar RH2 depends on — and the world's own doors are under `/-/<org>/<world>/`:
@@ -13,7 +13,6 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 //   POST deploy[/<name>]             perform landed entries against each root, by policy
 //   GET/PUT twins/<vendor>/root      the vendor's real account behind the twin (PUT null clears)
 //   PUT  twins/<vendor>/credential   seal the credential; GET answers only that one is sealed
-//   GET twins/<vendor>/people, POST twins/<vendor>/session   a browser views the vendor as a World's person
 //   POST twins/<vendor>/refresh      observe the root now
 // and what a person looks into it through (docs/contributing/architecture.md, "Viewing a World"):
 //   GET  map | timeline | diff       every twin and what it holds; the logs merged newest first; the changes since the base
@@ -31,10 +30,12 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, siteLabel, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin } from '@volter/world-core/runtime';
-import { BROWSER_SESSION_HEADER, BROWSER_SESSION_PATH, stripBrowserSessionPermit, withBrowserSessionPermit } from '@volter/world-core/runtime';
+import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin } from '@volter/world-core/runtime';
+import { resolveTwinHost } from '@volter/world-core/host-routing';
+import { assertBrowserName, validateBrowserState, cookieMatchesHost } from '@volter/world-core';
+import { worldBrowser, worldBrowsers, putWorldBrowser, deleteWorldBrowser, materializeBrowserFiles, browserLoad, putBrowserLoad, browserLoadId } from "./browsers.js";
 import { APP_READ_ENDPOINT_ENV } from "./init.js";
-import { packFacts } from "./pack-facts.js";
+import { packFacts, packHostRules } from "./pack-facts.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
@@ -49,6 +50,17 @@ import { assertChangesetRules } from "./schema.js";
 export const TOKEN_HEADER = 'x-volter-token';
 /** The header the injector carries a hosted World's token in (inject.cjs, VOLTER_TWINS_KEY). */
 export const TWINS_KEY_HEADER = 'x-twins-key';
+// Browser input policy; these caps bound accepted input, independently of infrastructure limits.
+const BROWSER_COUNT_LIMIT = 32;
+const BROWSER_STATE_BYTES_LIMIT = 1024 * 1024;
+/** This fact belongs to the World router, never to a caller. */
+function withoutBrowserHeader(request) {
+    if (!request.headers.has('x-volter-world-browser'))
+        return request;
+    const headers = new Headers(request.headers);
+    headers.delete('x-volter-world-browser');
+    return new Request(request, { headers });
+}
 class Booting extends Error {
     constructor() { super('the world is still booting'); }
 }
@@ -95,7 +107,7 @@ export function sessionsFile(worldRoot) { return join(worldRoot, stateDirName(),
 export function keysFile(worldRoot) { return join(worldRoot, stateDirName(), 'keys.json'); }
 /** Where a World keeps its boards as its people arranged them (what each hides or includes, and its frames' places): `.volter/board.json`. */
 export function boardFile(worldRoot) { return join(worldRoot, stateDirName(), 'board.json'); }
-const BOARD_KEY = /^[a-z0-9-]+:[^\s]{1,300}$/;
+const BOARD_KEY = /^(?:[a-z0-9-]+|~browser:[a-z0-9-]+:[a-z0-9-]+):[^\s]{1,300}$/;
 /** The largest board document a World keeps. */
 const BOARD_BYTES = 256 * 1024;
 /** A board document from a request, or the reason it is refused: every field of its type, nothing else. */
@@ -134,7 +146,7 @@ function boardsOf(body) {
             for (const [k, v] of Object.entries(sections)) {
                 const r = v;
                 // a section is a pack's group (`<vendor>:section:<id>`) or one people drew (`user:<id>`), on the board's plane
-                if (!BOARD_KEY.test(k) || !(/^user:[a-z0-9]{1,32}$/.test(k) || /^[a-z0-9-]+:section:/.test(k)) || !r || typeof r !== 'object' || Object.keys(r).some((f) => !['x', 'y', 'w', 'h', 'name', 'gone'].includes(f))
+                if (!BOARD_KEY.test(k) || !(/^user:[a-z0-9]{1,32}$/.test(k) || /^(?:[a-z0-9-]+|~browser:[a-z0-9-]+:[a-z0-9-]+):section:/.test(k)) || !r || typeof r !== 'object' || Object.keys(r).some((f) => !['x', 'y', 'w', 'h', 'name', 'gone'].includes(f))
                     || !['x', 'y'].every((f) => typeof r[f] === 'number' && Math.abs(r[f]) <= 1e7) || !['w', 'h'].every((f) => typeof r[f] === 'number' && r[f] >= 0 && r[f] <= 1e6)
                     || (r.gone !== true && (r.w < 100 || r.h < 100))
                     || (r.name !== undefined && (typeof r.name !== 'string' || !r.name.trim() || r.name.length > 80)) || (r.gone !== undefined && r.gone !== true))
@@ -486,7 +498,7 @@ export class WorldDoors {
         return pass ? `${at}/-/${this.served}/pages/open#${new URLSearchParams({ pass, land }).toString()}` : null;
     }
     /** A one-time pass (a minute long) for the content plane or a hosted site; null when its asker holds fifty unused. */
-    mintPagesPass(scope, grant, viewAs) {
+    mintPagesPass(scope, grant) {
         const now = Date.now();
         for (const [k, v] of this.pagePasses)
             if (v.until <= now)
@@ -496,7 +508,7 @@ export class WorldDoors {
         if ([...this.pagePasses.values()].filter((v) => askerOf(v) === asker).length >= 50 || this.pagePasses.size >= 5000)
             return null;
         const pass = mintToken('pass_');
-        this.pagePasses.set(pass, { ...grant, scope, until: now + 60_000, ...(viewAs ? { viewAs } : {}) });
+        this.pagePasses.set(pass, { ...grant, scope, until: now + 60_000 });
         return pass;
     }
     /** The hostname a hosted site address names (`{site}` template: `<label>--<world>--<org>.<suffix>`) among those this
@@ -504,35 +516,50 @@ export class WorldDoors {
     /** Whether an address has a hosted site's shape here (`<label>--<world>--<org>.<suffix>`), claimed or not. */
     siteShaped(url) {
         const template = this.host.sitesTemplate?.() ?? null;
-        if (!template || !template.includes('{site}'))
+        if (!template)
+            return false;
+        const flat = template.includes('{site}');
+        if (!flat && !template.includes('{host}'))
+            return false;
+        const after = new URL(template.replace(flat ? '{site}' : '{host}', 'x')).host.slice(1);
+        if (!url.host.endsWith(after) || url.host.length <= after.length)
             return false;
-        const after = new URL(template.replace('{site}', 'x')).host.slice(1);
-        return url.host.endsWith(after) && url.host.length > after.length;
+        const label = url.host.slice(0, -after.length);
+        return flat || (!label.includes('.') && label.includes('--'));
     }
     async hostedSiteOf(url) {
         if (!this.siteShaped(url))
             return null;
-        const template = this.host.sitesTemplate?.() ?? null;
-        if (!template || !template.includes('{site}'))
-            return null;
-        const after = new URL(template.replace('{site}', 'x')).host.slice(1);
-        if (!url.host.endsWith(after) || url.host.length <= after.length)
+        const template = this.host.sitesTemplate();
+        const claimed = await this.claimedHosts(url.origin);
+        for (const { hosts } of claimed)
+            for (const site of hosts) {
+                const at = siteUrlOf(template, site);
+                if (at && new URL(at).host === url.host)
+                    return { site };
+            }
+        const browsers = worldBrowsers(this.up().dirs.data);
+        if (!browsers.length)
             return null;
-        const label = url.host.slice(0, -after.length);
-        for (const { hosts } of await this.claimedHosts(url.origin))
-            for (const h of hosts)
-                if (siteLabel(h) === label)
-                    return h.toLowerCase();
+        const sites = await this.browserSites(url.origin, claimed);
+        for (const browser of browsers) {
+            for (const { hosts } of sites)
+                for (const site of hosts) {
+                    const at = siteUrlOf(template, site, browser.name);
+                    if (at && new URL(at).host === url.host)
+                        return { site, browser: browser.name };
+                }
+        }
         return null;
     }
     pagesCookie(url) { return url.protocol === 'https:' ? '__Host-volter_pages' : 'volter_pages'; }
-    pageSession(request, url, site) {
+    pageSession(request, url, site, browser) {
         const id = new RegExp(`(?:^|;\\s*)${this.pagesCookie(url)}=([^;]+)`).exec(request.headers.get('cookie') ?? '')?.[1];
         const held = id && Object.hasOwn(this.pagesSessions(), id) ? this.pagesSessions()[id] : undefined;
         if (!id || !held || held.until <= Date.now() || !this.pagesParentLive(held))
             return null;
         // a session opens only where its pass was for: the content plane, or that one hosted site
-        if ((held.site ?? null) !== (site ?? null))
+        if ((held.site ?? null) !== (site ?? null) || held.browser !== browser)
             return null;
         const { until: _until, ...grant } = held;
         return { id, ...grant };
@@ -545,18 +572,16 @@ export class WorldDoors {
             return;
         out.delete('set-cookie');
         for (const c of cookies) {
-            if (/^\s*(?:__Host-)?volter_(?:world|pages)=/i.test(c))
+            if (/^\s*(?:__Host-)?volter_(?:world|pages|browser)=/i.test(c))
                 continue;
             out.append('set-cookie', `${c.replace(/;\s*(?:samesite=[^;]*|secure|partitioned|domain=[^;]*)\s*(?=;|$)/gi, '')}; SameSite=None; Secure; Partitioned`);
         }
     }
     /** What the content plane answers: its opening page and session, and the twins' pages; no door of the World. */
-    async pagesPlane(request, url, /** a hosted site served here, not the content plane */ site) {
+    async pagesPlane(request, url, /** a hosted site served here, not the content plane */ site, browser) {
         const doors = `/-/${this.served}/pages/`;
-        const viewPath = url.pathname.startsWith(`/${this.served}/`) ? url.pathname.slice(`/${this.served}/`.length).split('/') : [];
-        const viewVendor = viewPath.length === 4 && viewPath[1] === '_twin' && viewPath[2] === 'view-as' && Object.hasOwn(this.up().services, viewPath[0]) ? viewPath[0] : null;
-        const door = viewVendor ? viewPath[3] : url.pathname.startsWith(doors) ? url.pathname.slice(doors.length) : null;
-        const opening = viewVendor ? `/${this.served}/${viewVendor}/_twin/view-as/` : doors;
+        const door = url.pathname.startsWith(doors) ? url.pathname.slice(doors.length) : null;
+        const opening = doors;
         const own = this.host.browserOrigin?.() ?? null;
         if (door === 'open' && request.method === 'GET') {
             // framed by this World's console, or its parent's (a comparison frames its branch's pages); the pages it opens are
@@ -571,8 +596,6 @@ export class WorldDoors {
   history.replaceState(null, '', location.pathname);
   const pass = carried.get('pass') || '';
   const land = carried.get('land') || '';
-  const viewAs = carried.get('viewAs') === '1';
-  const tell = (data) => { if (viewAs && parent !== window) parent.postMessage({ type: 'volter-view-as', pass, ...data }, ${JSON.stringify(own)}); };
   // resolved as the browser will (encoded dots too), on this origin and under this World
   let to = null;
   // a hosted site lands anywhere on it; the content plane only under this World
@@ -583,11 +606,9 @@ export class WorldDoors {
     .then(async (r) => {
       const opened = await r.json();
       if (!r.ok) throw new Error(opened.error || 'This World did not open.');
-      if (opened.viewAs) { tell({ viewed: opened.viewAs }); location.replace(opened.viewAs.land); }
-      else if (viewAs) throw new Error('This pass did not sign in to the vendor.');
-      else location.replace(to);
+      location.replace(to);
     })
-    .catch((e) => { document.body.textContent = e.message || 'This World did not answer.'; tell({ error: document.body.textContent }); });
+    .catch((e) => { document.body.textContent = e.message || 'This World did not answer.'; });
 })();
 `;
             return new Response(script, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' } });
@@ -599,21 +620,11 @@ export class WorldDoors {
             this.pagePasses.delete(pass);
             if (request.headers.get('sec-fetch-site') !== 'same-origin')
                 return Response.json({ error: 'the content plane opens its session from its own page' }, { status: 403 });
-            if (!given || given.until <= Date.now() || !this.pagesParentLive(given) || (given.site ?? null) !== (site ?? null))
+            if (!given || given.until <= Date.now() || !this.pagesParentLive(given) || (given.site ?? null) !== (site ?? null) || given.browser !== browser)
                 return Response.json({ error: 'that pass is used or expired: open the page again from the World' }, { status: 401 });
-            const { until: _until, viewAs, ...grant } = given;
-            if (viewAs) {
-                const held = this.pageSession(request, url);
-                if (!held)
-                    return Response.json({ error: 'Open a vendor page from this World first, then choose View as again.' }, { status: 403 });
-                if (viewVendor !== viewAs.vendor || !given.session || held.scope !== 'write' || held.session !== given.session)
-                    return Response.json({ error: 'View as belongs to the browser session that asked for it' }, { status: 403 });
-                return this.vendorSession(request, viewAs, given.until);
-            }
-            if (viewVendor)
-                return Response.json({ error: 'this door takes only a View as pass' }, { status: 403 });
+            const { until: _until, ...grant } = given;
             // one content session per asker at a scope and framer: a board's frames opening together share it
-            const same = (x) => x.scope === grant.scope && x.session === grant.session && x.asker === grant.asker && x.framer === grant.framer && x.who === grant.who && x.site === grant.site;
+            const same = (x) => x.scope === grant.scope && x.session === grant.session && x.asker === grant.asker && x.framer === grant.framer && x.who === grant.who && x.site === grant.site && x.browser === grant.browser;
             const now = Date.now();
             const found = Object.entries(this.pagesSessions()).find(([, x]) => x.until > now && same(x))?.[0];
             const id = found ?? mintToken('pgs_');
@@ -625,22 +636,28 @@ export class WorldDoors {
         }
         // A HOSTED SITE: read with a session its World's own origin gave it a pass for (sites/go), never without
         if (site) {
-            const held = this.pageSession(request, url, site);
-            const back = own ? `${own}/-/${this.served}/sites/go?${new URLSearchParams({ host: site, land: `${url.pathname}${url.search}` }).toString()}` : null;
+            const held = this.pageSession(request, url, site, browser);
+            const back = own && !browser ? `${own}/-/${this.served}/sites/go?${new URLSearchParams({ host: site, land: `${url.pathname}${url.search}` }).toString()}` : null;
             if (!held) {
-                if (request.method === 'GET' && (request.headers.get('accept') ?? '').includes('text/html') && back) {
+                if (request.method === 'GET' && (request.headers.get('accept') ?? '').includes('text/html') && (browser || back)) {
                     const shown = site.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
-                    return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p><b>${shown}</b> is a site in the World ${this.served}, shown to its people.</p><p><a href="${back.replace(/&/g, '&amp;')}">Open it from the World</a></p></body>`, { status: 401, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
+                    const opening = browser ? "Open this site from the World's board." : `<a href="${back.replace(/&/g, '&amp;')}">Open it from the World</a>`;
+                    return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p><b>${shown}</b> is a site in the World ${this.served}, shown to its people.</p><p>${opening}</p></body>`, { status: 401, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
                 }
-                return Response.json({ error: `${site} is shown to ${this.served}'s people: open it from the World` }, { status: 401 });
+                return Response.json({ error: `${site} is shown to ${this.served}'s people: open it from the World${browser ? "'s board" : ''}` }, { status: 401 });
             }
             // read by the site's own pages, or a person's navigation to it: never by another page of the same domain (the
             // session's partition is the domain's, which every World's pages share)
             const fetchSite = request.headers.get('sec-fetch-site');
             const navigation = ['document', 'iframe'].includes(request.headers.get('sec-fetch-dest') ?? '');
-            if (fetchSite !== 'same-origin' && !(navigation && ['none', 'same-site'].includes(fetchSite ?? '')))
+            if (fetchSite !== 'same-origin' && !((!browser || request.method === 'GET' || request.method === 'HEAD') && navigation && ['none', 'same-site'].includes(fetchSite ?? '')))
                 return Response.json({ error: `${site} is read by its own pages` }, { status: 403 });
-            const answer = await this.site(request, site);
+            if (browser) {
+                const loading = this.loadBrowser(request, url, site, browser);
+                if (loading)
+                    return loading;
+            }
+            const answer = await this.site(request, site, browser, held);
             const out = new Headers(answer.headers);
             out.append('content-security-policy', `frame-ancestors 'self'${held.framer ? ` ${held.framer}` : ''}`);
             this.keepCookiesHere(answer, out);
@@ -665,76 +682,6 @@ export class WorldDoors {
         }
         return Response.json({ error: `this origin shows ${this.served}'s pages only` }, { status: 404 });
     }
-    /** A landing resolved as a browser resolves it, within this vendor's place only. */
-    vendorLanding(vendor, land) {
-        if (typeof land !== 'string' || !land.startsWith('/') || land.startsWith('//') || /[\\\s]/.test(land))
-            return null;
-        try {
-            const url = new URL(land, 'https://world.local');
-            const path = decodeURIComponent(url.pathname);
-            const base = `/${this.served}/${vendor}/`;
-            if (url.origin !== 'https://world.local' || !url.pathname.startsWith(base) || !path.startsWith(base)
-                || path.includes('\\') || path.split('/').some((p) => p === '.' || p === '..' || p.includes('%')))
-                return null;
-            return url.pathname + url.search + url.hash;
-        }
-        catch {
-            return null;
-        }
-    }
-    /** The pack's declared browser session, never inferred from its vendor or a sign-in page. */
-    async browserSessionOf(vendor) {
-        const twin = this.host.twinFetch(vendor);
-        if (!twin || !this.host.pagesOrigin?.())
-            return null;
-        try {
-            const answer = await twin(new Request('http://world.local/twin', { headers: { [READ_ONLY_HEADER]: '1' } }));
-            const manifest = answer.ok ? await answer.json() : null;
-            if (!manifest?.drawsScreens)
-                return null;
-            const session = manifest?.browserSession;
-            if (!session || typeof session !== 'object')
-                return null;
-            const { cookie, scope } = session;
-            if (typeof cookie !== 'string' || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(cookie)
-                || /^(?:__Host-|(?:__Secure-)?volter_(?:world|pages)$)/i.test(cookie) || (scope !== undefined && typeof scope !== 'string'))
-                return null;
-            return { cookie, ...(typeof scope === 'string' ? { scope } : {}) };
-        }
-        catch {
-            return null;
-        }
-    }
-    vendorPeople(vendor) {
-        return readTree(this.stateOf(vendor), this.controlRoot(vendor))
-            .filter((p) => p.type === '_person' && p.deleted !== true && typeof p.email === 'string')
-            .map((p) => ({ id: p.id, email: String(p.email), label: String(p.email) }));
-    }
-    /** The twin receives its own cookie and changes the session in its own process, over a host-only permit. */
-    async vendorSession(request, pass, until) {
-        const twin = this.host.twinFetch(pass.vendor);
-        if (!twin || !await this.browserSessionOf(pass.vendor) || !this.vendorLanding(pass.vendor, pass.land))
-            return Response.json({ error: 'that vendor session is unavailable' }, { status: 404 });
-        const person = pass.person === null ? null : this.vendorPeople(pass.vendor).find((p) => p.id === pass.person);
-        if (person === undefined)
-            return Response.json({ error: 'that person is no longer in the World' }, { status: 404 });
-        const url = new URL(request.url);
-        const headers = new Headers({ [TWIN_PREFIX_HEADER]: `/${this.served}/${pass.vendor}`, 'x-forwarded-host': url.host, 'x-forwarded-proto': url.protocol.slice(0, -1) });
-        headers.set(CALLER_HEADER, callerForHeader(pass.asker));
-        headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
-        const cookies = (request.headers.get('cookie') ?? '').split(/;\s*/).filter((c) => c && !/^(?:__Host-)?volter_(?:world|pages)=/.test(c));
-        if (cookies.length)
-            headers.set('cookie', cookies.join('; '));
-        const answer = await withBrowserSessionPermit(this.stateOf(pass.vendor), this.controlRoot(pass.vendor), { person: pass.person, land: pass.land, until }, async (permit) => {
-            headers.set(BROWSER_SESSION_HEADER, permit);
-            return twin(new Request(`${url.origin}${BROWSER_SESSION_PATH}`, { method: 'POST', headers, redirect: 'manual' }));
-        });
-        if (answer.status !== 303)
-            return answer;
-        const out = new Headers({ 'cache-control': 'no-store' });
-        this.keepCookiesHere(answer, out);
-        return Response.json({ viewAs: { vendor: pass.vendor, person: pass.person, label: person?.email ?? 'Signed out', land: pass.land } }, { headers: out });
-    }
     /** BROWSER SESSIONS: the session cookie carries an opaque id, never a token, so a leaked cookie is one session and
      *  not the World's write token; rotating the tokens ends every session. Kept in the World's store, so a restart
      *  keeps them; each lasts 30 days from its opening. */
@@ -1140,6 +1087,78 @@ export class WorldDoors {
         }
         return out;
     }
+    /** Browser sites include the pack's exact declared hosts, beside the dynamically claimed sites. */
+    async browserSites(origin, listed) {
+        const dynamic = listed ?? await this.claimedHosts(origin);
+        return Object.keys(this.up().services).map(vendor => ({ vendor, hosts: [...new Set([
+                    ...(dynamic.find(d => d.vendor === vendor)?.hosts ?? []),
+                    ...(packFacts()[vendor]?.hosts ?? []).flatMap(rule => typeof rule.host === 'string' && !rule.exclude ? [rule.host] : []),
+                ])] }));
+    }
+    async browserRoutes(origin) {
+        const listed = await this.claimedHosts(origin);
+        const facts = packFacts();
+        const map = Object.fromEntries(Object.keys(this.up().services).map(vendor => [vendor, vendor]));
+        const claimed = {};
+        // The proxy's static rule order is in the shared table; dynamic order is the same facts order.
+        for (const vendor of Object.keys(facts))
+            if (this.up().services[vendor]) {
+                map[vendor] = vendor;
+                for (const rule of facts[vendor]?.hosts ?? [])
+                    if (rule.key)
+                        map[rule.key] = vendor;
+                if (facts[vendor]?.hostsClaimed)
+                    claimed[vendor] = new Set(listed.find(row => row.vendor === vendor)?.hosts ?? []);
+            }
+        return { sites: await this.browserSites(origin, listed), rules: packHostRules(), map, claimed };
+    }
+    loadBrowser(request, url, site, name) {
+        const browser = worldBrowser(this.up().dirs.data, name);
+        if (!browser)
+            return Response.json({ error: `no browser ${name}` }, { status: 404 });
+        const marker = url.protocol === 'https:' ? '__Host-volter_browser' : 'volter_browser';
+        const id = new RegExp(`(?:^|;\\s*)${marker}=([^;]+)`).exec(request.headers.get('cookie') ?? '')?.[1];
+        const loadId = browserLoadId(browser.version, site);
+        const current = browserLoad(this.up().dirs.data, loadId);
+        const previous = browserLoad(this.up().dirs.data, id);
+        const carried = [current, previous].filter(load => load?.name === name && load.site === site);
+        if (id === loadId && current?.name === name && current.site === site && current.version === browser.version)
+            return null;
+        if (request.method !== 'GET' || !['document', 'iframe'].includes(request.headers.get('sec-fetch-dest') ?? ''))
+            return null;
+        const cookies = browser.state.cookies.filter(c => cookieMatchesHost(c, site));
+        const storage = browser.state.origins.find(o => new URL(o.origin).hostname === site)?.localStorage ?? [];
+        const headers = new Headers({ 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' });
+        const protectedCookie = (key) => /^(?:__Host-)?volter_(?:world|pages|browser)$/.test(key);
+        const expired = new Map();
+        for (const c of [...carried.flatMap(load => load.cookies), ...cookies])
+            expired.set(JSON.stringify([c.name, c.path]), { name: c.name, path: c.path });
+        for (const part of (request.headers.get('cookie') ?? '').split(/;\s*/)) {
+            const key = part.split('=')[0];
+            if (/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(key))
+                expired.set(JSON.stringify([key, '/']), { name: key, path: '/' });
+        }
+        for (const c of expired.values()) {
+            if (protectedCookie(c.name))
+                continue;
+            for (const partition of ['', '; Partitioned'])
+                headers.append('set-cookie', `${c.name}=; Path=${c.path}; Max-Age=0; Secure; SameSite=None${partition}`);
+        }
+        for (const c of cookies) {
+            if (/^(?:__Host-)?volter_(?:world|pages|browser)$/.test(c.name))
+                continue;
+            if (c.expires !== -1 && c.expires <= Date.parse(worldNow()) / 1000)
+                continue;
+            headers.append('set-cookie', `${c.name}=${c.value}; Path=${c.path}${c.expires === -1 ? '' : `; Expires=${new Date(c.expires * 1000).toUTCString()}`}${c.httpOnly ? '; HttpOnly' : ''}; Secure; SameSite=None; Partitioned`);
+        }
+        putBrowserLoad(this.up().dirs.data, loadId, { name, site, version: browser.version, cookies: cookies.filter(c => !protectedCookie(c.name)).map(c => ({ name: c.name, path: c.path })) });
+        headers.append('set-cookie', `${marker}=${loadId}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned`);
+        const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.replace(location.href);`;
+        const hash = createHash('sha256').update(script).digest('base64');
+        const framer = this.pageSession(request, url, site, name)?.framer;
+        headers.set('content-security-policy', `default-src 'none'; script-src 'sha256-${hash}'; base-uri 'none'; frame-ancestors 'self'${framer ? ` ${framer}` : ''}`);
+        return new Response(`<!doctype html><meta charset="utf-8"><title>Loading browser</title><script>${script}</script>`, { headers });
+    }
     /** What a twin asks an application (`ctx.ask`) that this World can answer truthfully, where no process routes it (a
      *  hosted World's isolate): a GET or HEAD of a URL whose hostname one of this World's twins answers (its hostsClaimed
      *  door: a Cloudflare twin's Worker route or custom domain) is that twin's answer, read as a browser reads the site
@@ -1170,24 +1189,59 @@ export class WorldDoors {
     /** A hostname one of this World's twins answers (its hostsClaimed door lists it), read as a browser reads it there:
      *  the request goes to that twin with the hostname as its original host, as the injector routes it inside the World.
      *  Reads only: the site is the twin's state as the World holds it, never a way to write it. */
-    async site(request, host) {
-        request = stripBrowserSessionPermit(request);
-        if (request.method !== 'GET' && request.method !== 'HEAD')
+    async site(request, host, browser, grant) {
+        request = withoutBrowserHeader(request);
+        if (!browser && request.method !== 'GET' && request.method !== 'HEAD')
             return Response.json({ error: 'a site in a World is read: GET and HEAD' }, { status: 405 });
+        if (browser && !grant)
+            return Response.json({ error: "open this browser site from the World's board" }, { status: 401 });
         const url = new URL(request.url);
-        for (const { vendor, hosts } of await this.claimedHosts(url.origin)) {
-            const twin = this.host.twinFetch(vendor);
-            if (!twin || !hosts.includes(host))
-                continue;
-            const headers = new Headers();
+        const routes = browser ? await this.browserRoutes(url.origin) : null;
+        let vendor;
+        if (routes)
+            vendor = resolveTwinHost(routes.rules, host, routes.map, url.pathname, routes.claimed)?.origin;
+        else
+            for (const row of await this.claimedHosts(url.origin)) {
+                if (!this.host.twinFetch(row.vendor) || !row.hosts.includes(host))
+                    continue;
+                vendor = row.vendor;
+                break;
+            }
+        const twin = vendor ? this.host.twinFetch(vendor) : undefined;
+        if (vendor && twin) {
+            const reads = request.method === 'GET' || request.method === 'HEAD';
+            const enforced = browser && grant?.scope === 'read' && await this.enforcesRead(vendor, twin, url.origin);
+            if (browser && grant?.scope === 'read' && !reads && !enforced)
+                return Response.json({ error: 'the read token opens only reads' }, { status: 403 });
+            const headers = browser ? new Headers(request.headers) : new Headers();
+            for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER])
+                headers.delete(key);
             for (const name of ['accept', 'accept-language', 'if-none-match', 'range', 'user-agent']) {
                 const v = request.headers.get(name);
                 if (v !== null)
                     headers.set(name, v);
             }
+            if (browser) {
+                const cookies = (request.headers.get('cookie') ?? '').split(/;\s*/).filter(c => !/^(?:__Host-)?volter_(?:world|pages|browser)=/.test(c));
+                if (cookies.length)
+                    headers.set('cookie', cookies.join('; '));
+                headers.set('x-volter-world-browser', browser);
+                const template = this.host.sitesTemplate?.();
+                if (template)
+                    headers.set(TWIN_SITES_HEADER, template);
+                headers.set('x-forwarded-host', url.host);
+                headers.set('x-forwarded-proto', url.protocol.slice(0, -1));
+            }
             headers.set('x-volter-twin-original-host', host);
-            headers.set(READ_ONLY_HEADER, '1');
-            const answer = await twin(new Request(`${url.origin}${url.pathname}${url.search}`, { method: request.method, headers, redirect: 'manual' }));
+            if (!browser || enforced)
+                headers.set(READ_ONLY_HEADER, '1');
+            if (browser) {
+                if (grant?.who)
+                    headers.set(CALLER_HEADER, callerForHeader(grant.who));
+                headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
+            }
+            const body = reads ? undefined : await request.arrayBuffer();
+            const answer = await twin(new Request(`${url.origin}${url.pathname}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
             // a redirect the site answers names its own hostname: in the World it stays under the World's origin
             const out = new Headers(answer.headers);
             const location = out.get('location');
@@ -1196,6 +1250,12 @@ export class WorldDoors {
                     const to = new URL(location, `https://${host}`);
                     if (to.hostname === host)
                         out.set('location', `${to.pathname}${to.search}${to.hash}`);
+                    else if (browser && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed) && routes.sites.some(row => row.hosts.includes(to.hostname))) {
+                        const at = this.host.sitesTemplate?.();
+                        const next = at ? siteUrlOf(at, to.hostname, browser) : null;
+                        if (next)
+                            out.set('location', `${next}${to.pathname}${to.search}${to.hash}`);
+                    }
                 }
                 catch { /* left as answered */ }
             }
@@ -1209,7 +1269,7 @@ export class WorldDoors {
         return Response.json({ error: `no twin of ${this.served} answers ${host}` }, { status: 404 });
     }
     async handle(request) {
-        request = stripBrowserSessionPermit(request);
+        request = withoutBrowserHeader(request);
         try {
             if (!this.host.ready() && !new URL(request.url).pathname.startsWith('/-/ping'))
                 return Response.json({ error: 'booting', world: this.served }, { status: 503, headers: { 'retry-after': '1' } });
@@ -1221,7 +1281,7 @@ export class WorldDoors {
                 return await this.pagesPlane(request, url);
             const hostedSite = await this.hostedSiteOf(url);
             if (hostedSite)
-                return await this.pagesPlane(request, url, hostedSite);
+                return await this.pagesPlane(request, url, hostedSite.site, hostedSite.browser);
             if (this.siteShaped(url))
                 return Response.json({ error: `no site of ${this.served} at ${url.host}` }, { status: 404 });
             if (url.pathname.startsWith(`/-/${this.served}/`))
@@ -1275,7 +1335,7 @@ export class WorldDoors {
             const answer = twin ? await twin(new Request('http://world.local/twin', { headers: { [READ_ONLY_HEADER]: '1' } })) : null;
             const listed = answer?.ok ? (await answer.json()).screens : undefined;
             if (Array.isArray(listed))
-                screens = listed.filter((x) => typeof x?.id === 'string' && typeof x?.path === 'string').map(({ id, path }) => ({ id, path }));
+                screens = listed.filter((x) => typeof x?.id === 'string' && typeof x?.path === 'string').map(({ id, path, host }) => ({ id, path, ...(typeof host === 'string' ? { host } : {}) }));
         }
         catch {
             screens = [];
@@ -1307,6 +1367,7 @@ export class WorldDoors {
     }
     /** The vendor wire: `/<org>/<world>/<vendor>/<rest>` → the twin's own URL. */
     async wire(request, url, rest) {
+        request = withoutBrowserHeader(request);
         const [vendor, ...tail] = rest.split('/');
         const { scope, via } = this.credential(request);
         const manifestAsk = request.method === 'GET' && tail.join('/').replace(/\/+$/, '') === 'twin';
@@ -1361,7 +1422,6 @@ export class WorldDoors {
         // the request's trace: the caller's trace-id goes on (or a new one), under a parent-id the World mints, which the
         // request's log entries carry, so each entry is joined to its caller by an id no caller chose
         headers.delete(CALLER_HEADER);
-        headers.delete(BROWSER_SESSION_HEADER);
         // the address a request was signed for (a CLI's loopback bridge says it, @volter/world-core/http-bridge) is a
         // credential holder's word: a browser's session cannot name another, so a signature is checked on the path it reached
         if (via === 'session') {
@@ -1415,10 +1475,10 @@ export class WorldDoors {
         // above): caches keep them apart
         out.append('vary', 'Sec-Fetch-Dest');
         const setCookies = answer.headers.getSetCookie();
-        if (setCookies.some((c) => /^\s*(?:__Host-)?volter_(?:world|pages)=/i.test(c))) {
+        if (setCookies.some((c) => /^\s*(?:__Host-)?volter_(?:world|pages|browser)=/i.test(c))) {
             out.delete('set-cookie');
             for (const c of setCookies)
-                if (!/^\s*(?:__Host-)?volter_(?:world|pages)=/i.test(c))
+                if (!/^\s*(?:__Host-)?volter_(?:world|pages|browser)=/i.test(c))
                     out.append('set-cookie', c);
         }
         return new Response(answer.body, { status: answer.status, headers: out });
@@ -1437,7 +1497,7 @@ export class WorldDoors {
         // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
         // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
         const caller = new Headers(request.headers);
-        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, CALLER_HEADER, BROWSER_SESSION_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
+        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, CALLER_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
             caller.delete(h);
         // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
         const authorization = caller.get('authorization');
@@ -1600,21 +1660,39 @@ export class WorldDoors {
         if (kind === 'sites' && name === 'go' && request.method === 'GET') {
             const fetchSite = request.headers.get('sec-fetch-site');
             const dest = request.headers.get('sec-fetch-dest');
+            const browser = url.searchParams.get('browser') ?? undefined;
+            if (browser && fetchSite !== 'same-origin' && fetchSite !== 'none')
+                return Response.json({ error: 'a browser site opens only from its World or a typed address (Sec-Fetch-Site: same-origin or none)' }, { status: 403 });
             // a person's navigation (from here, from the site's own page linking back, or typed in), or a frame of this World's
             // own console (its board, its comparison)
-            const navigated = dest === 'document' && ['same-origin', 'same-site', 'none'].includes(fetchSite ?? '');
-            const framed = dest === 'iframe' && fetchSite === 'same-origin';
+            const navigated = (request.method === 'GET' || request.method === 'HEAD') && dest === 'document' && ['same-origin', 'same-site', 'none'].includes(fetchSite ?? '');
+            const framed = fetchSite === 'same-origin' && dest === 'iframe';
             if (via === 'session' && !navigated && !framed)
                 return Response.json({ error: "a hosted site opens on a person's navigation" }, { status: 403 });
             const template = this.host.sitesTemplate?.() ?? null;
             const hostname = (url.searchParams.get('host') ?? '').toLowerCase();
-            const claimed = (await this.claimedHosts(url.origin)).some(({ hosts }) => hosts.some((h) => h.toLowerCase() === hostname));
-            const at = template && claimed ? siteUrlOf(template, hostname) : null;
+            if (browser) {
+                try {
+                    assertBrowserName(browser);
+                }
+                catch (error) {
+                    return Response.json({ error: error.message }, { status: 400 });
+                }
+                if (!worldBrowser(this.up().dirs.data, browser))
+                    return Response.json({ error: `no browser ${browser}` }, { status: 404 });
+            }
+            const claimed = (await (browser ? this.browserSites(url.origin) : this.claimedHosts(url.origin))).some(({ hosts }) => hosts.some((h) => h.toLowerCase() === hostname));
+            const at = template && claimed ? siteUrlOf(template, hostname, browser) : null;
+            if (browser && at && (await this.claimedHosts(url.origin)).some(row => row.hosts.some(site => {
+                const claimedAt = siteUrlOf(template, site);
+                return claimedAt && new URL(claimedAt).host === new URL(at).host;
+            })))
+                return Response.json({ error: `browser ${browser}'s address for ${hostname} is owned by a claimed site` }, { status: 404 });
             if (!at)
                 return Response.json({ error: `${hostname || 'that host'} is no site of ${this.served} shown here` }, { status: 404 });
             const asked = this.credential(request);
             const land = url.searchParams.get('land') ?? '/';
-            const passed = this.mintPagesPass('read', { site: hostname, ...(asked.session ? { session: asked.session } : {}), ...(asked.who ? { who: asked.who } : {}), ...(this.host.browserOrigin?.() ? { framer: this.host.browserOrigin() } : {}) });
+            const passed = this.mintPagesPass(browser ? scope : 'read', { site: hostname, ...(browser ? { browser } : {}), ...(asked.session ? { session: asked.session } : {}), ...(asked.who ? { who: asked.who } : {}), ...(this.host.browserOrigin?.() ? { framer: this.host.browserOrigin() } : {}) });
             if (!passed)
                 return Response.json({ error: 'too many sites opened at once: try again in a minute' }, { status: 429 });
             return new Response(null, { status: 303, headers: { location: `${at}/-/${this.served}/pages/open#${new URLSearchParams({ pass: passed, land: land.startsWith('/') ? land : '/' }).toString()}`, 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
@@ -1633,6 +1711,122 @@ export class WorldDoors {
             return this.keysDoor(request, name, scope, via, this.credential(request).session);
         if (scope === 'read' && request.method !== 'GET')
             return Response.json({ error: 'the read token opens only reads' }, { status: 403 });
+        if (kind === 'browsers') {
+            if (parts.length > 2)
+                return Response.json({ error: 'no such browser door' }, { status: 404 });
+            const headers = { 'cache-control': 'no-store' };
+            if (!name)
+                return request.method === 'GET'
+                    ? Response.json({ browsers: worldBrowsers(this.up().dirs.data).map(b => b.name) }, { headers })
+                    : Response.json({ error: 'list browsers with GET' }, { status: 405 });
+            try {
+                assertBrowserName(name);
+            }
+            catch (error) {
+                return Response.json({ error: error.message }, { status: 400 });
+            }
+            return this.serialized('browsers', async () => {
+                const data = this.host.reload().dirs.data;
+                if (request.method === 'GET') {
+                    const b = worldBrowser(data, name);
+                    return b ? Response.json(b.state, { headers }) : Response.json({ error: `no browser ${name}` }, { status: 404 });
+                }
+                if (request.method === 'DELETE') {
+                    if (!worldBrowser(data, name))
+                        return Response.json({ error: `no browser ${name}` }, { status: 404 });
+                    deleteWorldBrowser(data, name);
+                    if (this.up().envFile)
+                        materializeBrowserFiles(data, this.worldRoot, this.name, loadWorldConfig(this.configRef, this.worldRoot).config.id);
+                    return new Response(null, { status: 204, headers });
+                }
+                if (request.method === 'PUT') {
+                    if (!/^application\/json\b/i.test(request.headers.get('content-type') ?? ''))
+                        return Response.json({ error: 'browser state is application/json' }, { status: 415 });
+                    if (!worldBrowser(data, name) && worldBrowsers(data).length >= BROWSER_COUNT_LIMIT)
+                        return Response.json({ error: `a World holds at most ${BROWSER_COUNT_LIMIT} browsers; delete one before adding another` }, { status: 409 });
+                    const oversized = () => Response.json({ error: `browser state PUT body is limited to ${BROWSER_STATE_BYTES_LIMIT} bytes (1 MiB)` }, { status: 413 });
+                    const length = request.headers.get('content-length');
+                    if (length && /^\d+$/.test(length) && Number(length) > BROWSER_STATE_BYTES_LIMIT)
+                        return oversized();
+                    let state;
+                    try {
+                        const reader = request.body?.getReader();
+                        const chunks = [];
+                        let bytes = 0;
+                        if (reader) {
+                            try {
+                                for (;;) {
+                                    const chunk = await reader.read();
+                                    if (chunk.done)
+                                        break;
+                                    bytes += chunk.value.byteLength;
+                                    if (bytes > BROWSER_STATE_BYTES_LIMIT) {
+                                        await reader.cancel().catch(() => { });
+                                        return oversized();
+                                    }
+                                    chunks.push(chunk.value);
+                                }
+                            }
+                            finally {
+                                reader.releaseLock();
+                            }
+                        }
+                        const body = new Uint8Array(bytes);
+                        let offset = 0;
+                        for (const chunk of chunks) {
+                            body.set(chunk, offset);
+                            offset += chunk.byteLength;
+                        }
+                        state = validateBrowserState(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(body)));
+                    }
+                    catch (error) {
+                        return Response.json({ error: error.message }, { status: 400 });
+                    }
+                    const template = this.host.sitesTemplate?.();
+                    if (template) {
+                        const sites = await this.browserSites(url.origin);
+                        const claimed = await this.claimedHosts(url.origin);
+                        const addresses = new Map();
+                        for (const { hosts } of claimed)
+                            for (const site of hosts) {
+                                const at = siteUrlOf(template, site);
+                                if (at)
+                                    addresses.set(new URL(at).host, `claimed site ${site}`);
+                            }
+                        for (const other of worldBrowsers(data))
+                            if (other.name !== name)
+                                for (const { hosts } of sites)
+                                    for (const site of hosts) {
+                                        const at = siteUrlOf(template, site, other.name);
+                                        if (at)
+                                            addresses.set(new URL(at).host, `browser ${other.name}, site ${site}`);
+                                    }
+                        let fits = false;
+                        for (const { hosts } of sites)
+                            for (const site of hosts) {
+                                const at = siteUrlOf(template, site, name);
+                                if (!at)
+                                    continue;
+                                fits = true;
+                                const host = new URL(at).host;
+                                const identity = `browser ${name}, site ${site}`;
+                                if (addresses.has(host) && addresses.get(host) !== identity)
+                                    return Response.json({ error: `${identity} collides with ${addresses.get(host)} at ${host}` }, { status: 400 });
+                                addresses.set(host, identity);
+                            }
+                        if (!fits)
+                            return Response.json({ error: sites.some(row => row.hosts.length)
+                                    ? `no site of this World fits browser ${name} (DNS labels are at most 63 characters)`
+                                    : `this World has no declared or claimed exact-host site for browser ${name}` }, { status: 400 });
+                    }
+                    putWorldBrowser(data, name, state);
+                    if (this.up().envFile)
+                        materializeBrowserFiles(data, this.worldRoot, this.name, loadWorldConfig(this.configRef, this.worldRoot).config.id);
+                    return Response.json(state, { headers });
+                }
+                return Response.json({ error: 'browser state takes GET, PUT or DELETE' }, { status: 405 });
+            });
+        }
         if (kind === 'clock')
             return await this.clockDoor(request, name);
         if (kind === 'branches')
@@ -2049,33 +2243,6 @@ export class WorldDoors {
             return Response.json({ world: this.served, twins });
         }
         if (kind === 'twins' && name) {
-            if (parts.length === 3 && (verb === 'people' || verb === 'session')) {
-                const session = Object.hasOwn(this.up().services, name) ? await this.browserSessionOf(name) : null;
-                if (verb === 'people' && request.method === 'GET')
-                    return Response.json({ viewAs: session !== null, people: session ? this.vendorPeople(name).map(({ id, label }) => ({ id, label })) : [] }, { headers: { 'cache-control': 'no-store' } });
-                if (verb === 'session' && request.method === 'POST') {
-                    if (!session)
-                        return Response.json({ error: `${name} needs a declared browser session, a drawn screen and a content plane for View as` }, { status: 409 });
-                    if (via !== 'session' || presentedSecrets(request.headers, { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }).length || crossSite || site !== 'same-origin')
-                        return Response.json({ error: 'View as is opened from this World’s own page' }, { status: 403 });
-                    const body = await request.json().catch(() => null);
-                    const land = this.vendorLanding(name, body?.land);
-                    if (!body || (body.person !== null && typeof body.person !== 'string') || !land)
-                        return Response.json({ error: 'a session names a person (or null) and a path within that vendor' }, { status: 400 });
-                    if (body.person !== null && !this.vendorPeople(name).some((p) => p.id === body.person))
-                        return Response.json({ error: 'no such person in this World' }, { status: 404 });
-                    const at = this.host.pagesOrigin?.();
-                    if (!at)
-                        return Response.json({ error: 'View as needs this World’s content plane' }, { status: 409 });
-                    const asked = this.credential(request);
-                    if (!asked.session)
-                        return Response.json({ error: 'View as needs this World’s browser session' }, { status: 403 });
-                    const pass = this.mintPagesPass('write', { session: asked.session, ...(asked.who ? { who: asked.who } : {}), ...(this.host.browserOrigin?.() ? { framer: this.host.browserOrigin() } : {}) }, { vendor: name, person: body.person, land, asker: this.callerOf(request) });
-                    if (!pass)
-                        return Response.json({ error: 'too many pages opened at once: try again in a minute' }, { status: 429 });
-                    return Response.json({ url: `${at}/${this.served}/${name}/_twin/view-as/open#${new URLSearchParams({ pass, land, viewAs: '1' }).toString()}` }, { headers: { 'cache-control': 'no-store' } });
-                }
-            }
             if (verb === 'root' && request.method === 'GET')
                 return Response.json({ twin: name, root: rootForControlRoot(this.controlRoot(name), name) ?? null, credential: sealedCredentialInfo(this.worldRoot, name) });
             if (verb === 'root' && request.method === 'PUT') {
@@ -2415,7 +2582,11 @@ export class WorldDoors {
         const key = url.searchParams.get('frame') ?? '';
         if (!key)
             return Response.json({ error: 'board/changes?frame=<vendor>:<frame id>' }, { status: 400 });
-        const found = (await this.boardFrames(url, fork)).frames.find(({ frame }) => `${frame.vendor}:${frame.id}` === key);
+        const { frames } = await this.boardFrames(url, fork);
+        const first = worldBrowsers(this.up().dirs.data)[0]?.name;
+        const keyOf = (frame) => boardFrameKey({ vendor: frame.vendor, id: frame.id, ...(typeof frame.browser === 'string' ? { browser: frame.browser } : {}) });
+        const found = frames.find(({ frame }) => keyOf(frame) === key)
+            ?? frames.find(({ frame }) => frame.browser === first && `${frame.vendor}:${frame.id}` === key);
         if (!found)
             return Response.json({ error: `no frame ${key} on ${this.served}'s board` }, { status: 404 });
         const acts = new Map();
@@ -2434,20 +2605,30 @@ export class WorldDoors {
     }
     /** Every twin's frames, where each opens here, and each with the changes not yet cut that are its own. */
     async boardFrames(url, fork = false) {
-        const claimed = new Map((await this.claimedHosts(url.origin)).map(({ vendor, hosts }) => [vendor, new Set(hosts)]));
+        const listedHosts = await this.claimedHosts(url.origin);
+        const claimed = new Map(listedHosts.map(({ vendor, hosts }) => [vendor, new Set(hosts)]));
         const sitesAt = this.host.sitesTemplate?.() ?? null;
+        const browsers = worldBrowsers(this.up().dirs.data).map(b => b.name);
+        if (!browsers.length)
+            browsers.push(undefined);
+        const browserHosts = browsers[0] ? new Map((await this.browserSites(url.origin, listedHosts)).map(({ vendor, hosts }) => [vendor, new Set(hosts)])) : claimed;
         // a site private to the World's people (a `{site}` template: a hosted World) opens through this World's own origin,
         // which hands its address a one-time read pass (sites/go); one on this machine opens at its address
-        const siteAt = (hostname, rest) => {
+        const siteAt = (hostname, rest, browser) => {
             if (!sitesAt)
                 return null;
-            const direct = siteUrlOf(sitesAt, hostname);
+            const direct = siteUrlOf(sitesAt, hostname, browser);
             if (!direct)
                 return null;
-            if (sitesAt.includes('{host}'))
+            if (browser && [...claimed.values()].some(hosts => [...hosts].some(site => {
+                const claimedAt = siteUrlOf(sitesAt, site);
+                return claimedAt && new URL(claimedAt).host === new URL(direct).host;
+            })))
+                return null;
+            if (!browser && sitesAt.includes('{host}'))
                 return `${direct}${rest}`;
             const own = this.host.browserOrigin?.() ?? null;
-            return own ? `${own}/-/${this.served}/sites/go?${new URLSearchParams({ host: hostname, land: rest }).toString()}` : null;
+            return own ? `${own}/-/${this.served}/sites/go?${new URLSearchParams({ host: hostname, ...(browser ? { browser } : {}), land: rest }).toString()}` : null;
         };
         // inherited history is the parent log: the branch's own ledger starts at its fork, even after a cut
         const delta = diffWorld(this.name, { root: this.worldRoot, ...(fork ? { base: 'world-boot' } : {}) });
@@ -2466,21 +2647,52 @@ export class WorldDoors {
             }
             // a pack that lays out no board yet keeps its vendor's home on it (its root workspace, else its first unparameterized
             // one), whose changes are all of the vendor's
-            if (!listed.length) {
+            const fallback = !listed.length;
+            let homeHost;
+            if (fallback) {
                 const screens = await this.screensOf(vendor);
                 const home = screens.find((w) => w.path.replace(/\/+$/, '') === '') ?? screens.find((w) => !/[{<]/.test(w.path));
+                homeHost = home?.host;
                 if (home)
-                    frames.push({ frame: { vendor, id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, at: { screen: home.path.startsWith('/') ? home.path : `/${home.path}` } }, mine: changes.filter((c) => c.service === vendor) });
+                    listed = [{ id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, covers: [], drawn: true }];
             }
             for (const f of listed) {
+                const covered = new Set(f.covers.map(c => `${c.type}:${c.id}`));
+                const mine = changes.filter(x => x.service === vendor && (fallback || covered.has(`${x.action.subject.type}:${x.action.subject.id}`)));
+                const add = (at, browser, unseen) => {
+                    frames.push({ frame: { vendor, ...(browser ? { browser } : {}), id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(f.parent ? { parent: f.parent } : {}), ...(f.ours ? { ours: true } : {}), ...(unseen ? { unseen } : {}) }, mine });
+                };
+                let plain = false;
+                const openedBrowsers = [];
+                for (const browser of browsers) {
+                    if (!browser) {
+                        plain = true;
+                        continue;
+                    }
+                    let opened = null;
+                    try {
+                        const u = new URL(f.url, homeHost ? `https://${homeHost}` : undefined);
+                        if (browserHosts.get(vendor)?.has(u.hostname.toLowerCase()))
+                            opened = siteAt(u.hostname.toLowerCase(), `${u.pathname}${u.search}`, browser);
+                    }
+                    catch { /* this page has no site address */ }
+                    if (opened)
+                        openedBrowsers.push({ browser, at: opened });
+                    else
+                        plain = true;
+                }
+                for (const opened of openedBrowsers)
+                    add({ site: opened.at }, opened.browser);
+                if (!plain)
+                    continue;
                 let at = null;
-                // why a frame opens nowhere: its twin draws no page for it yet, or this host routes no sites
                 let unseen;
                 try {
                     const u = new URL(f.url);
                     if (claimed.get(vendor)?.has(u.hostname.toLowerCase())) {
                         const opened = siteAt(u.hostname.toLowerCase(), `${u.pathname}${u.search}`);
-                        at = opened ? { site: opened } : null;
+                        if (opened)
+                            at = { site: opened };
                     }
                     else if (f.drawn)
                         at = { screen: `${u.pathname}${u.search}` };
@@ -2488,13 +2700,18 @@ export class WorldDoors {
                         unseen = claimed.get(vendor)?.has(u.hostname.toLowerCase()) ? 'sites-not-routed' : 'not-drawn';
                 }
                 catch {
-                    at = null;
-                    unseen = 'not-drawn';
+                    if (fallback)
+                        at = { screen: f.url.startsWith('/') ? f.url : `/${f.url}` };
+                    else
+                        unseen = 'not-drawn';
                 }
-                const covered = new Set(f.covers.map((c) => `${c.type}:${c.id}`));
-                frames.push({ frame: { vendor, id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(f.parent ? { parent: f.parent } : {}), ...(f.ours ? { ours: true } : {}), ...(unseen ? { unseen } : {}) }, mine: changes.filter((x) => x.service === vendor && covered.has(`${x.action.subject.type}:${x.action.subject.id}`)) });
+                if (fallback)
+                    at = { screen: f.url.startsWith('/') ? f.url : `/${f.url}` };
+                add(at, undefined, unseen);
             }
         }
+        if (browsers[0])
+            frames.sort((a, b) => String(a.frame.browser ?? '').localeCompare(String(b.frame.browser ?? '')));
         return { delta, frames };
     }
     /** The boards as the World keeps them, and the version a save names: the default board when none was ever kept. */