capsite/toybox: vats have ids, not names; ingress by mount

createVat (POST / on the admin socket) makes a vat with newUniqueId and
returns its id, which addresses it only there. A vat is reachable only
where it is mounted: ?mount=<labels> on each start, as ?egress= is
granted; absent means none.

The ingress reads a request's labels from its query string, plus a
Toybox-Labels header for secret ones (a URL ends up in logs and
Referers). It routes to the vat whose mount labels the request carries,
every one: stricter than Flower's no-conflict match, since an ingress
client holds no constrained handle and a label it omits must not match.
Registration keeps Flower's rule, so a mount must conflict with every
other and no request can carry two. The app keeps the whole path and
sees its connection labels in Toybox-Connection-Labels.

A vat from before ids lives at idFromName(name). PUT /by-name/<name>
reaches it on the admin socket; it stays unreachable from outside until
mounted.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/supervisor.js

@@ -1,7 +1,7 @@
-/** @file toybox supervisor: one Vat per name; its app runs as a facet on installed code. */
+/** @file toybox supervisor: vats with code installed at runtime, each app a facet; ingress by mount, egress by grant. */
 import { DurableObject, WorkerEntrypoint } from "cloudflare:workers";
 import { newWebSocketRpcSession } from "capnweb";
-import { mergeLabels, urlLabels } from "./labels.js";
+import { carries, conflict, mergeLabels, urlLabels } from "./labels.js";
 
 /**
  * A stored grant: labels as JSON, or (before labels) a bare `host[:port]`.
@@ -17,7 +17,8 @@ const grantLabels = (stored) => {
 const hex = (buf) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
 
 /**
- * Holds the vat's installed code and egress grant; the app facet holds the app's state.
+ * One vat, by DO id: holds its installed code and egress grant; the app
+ * facet holds the app's state. Its mount, if any, is in the {@link Directory}.
  *
  * Code is stored by hash so the facet can be rebuilt after hibernation or a
  * restart. The app's global `fetch` throws; a granted host arrives as
@@ -128,24 +129,143 @@ export class Egress extends WorkerEntrypoint {
 	}
 }
 
-const vatOf = (env, url) => env.VATS.getByName(new URL(url).pathname.split("/")[1]);
+/**
+ * Mounts: which vat serves which label set. One instance, by name.
+ *
+ * Registration follows Flower: a mount must conflict with every other, so
+ * no request can carry two mounts' labels. Lookup is stricter than
+ * Flower's: the request must carry all of a mount's labels.
+ */
+export class Directory extends DurableObject {
+	constructor(ctx, env) {
+		super(ctx, env);
+		ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS mount (vat TEXT PRIMARY KEY, labels TEXT)");
+	}
 
-/** The http socket: `/<vat>/...` goes to that vat's app. */
-export class Public extends WorkerEntrypoint {
-	fetch(request) {
-		return vatOf(this.env, request.url).fetch(request);
+	#mounts() {
+		return this.ctx.storage.sql
+			.exec("SELECT vat, labels FROM mount")
+			.toArray()
+			.map(({ vat, labels }) => ({ vat, labels: JSON.parse(labels) }));
+	}
+
+	/**
+	 * Mount `vat` at `labels`, replacing its mount; `null` unmounts it.
+	 *
+	 * @param {string} vat a Vat's DO id, hex
+	 * @param {Record<string, string> | null} labels
+	 */
+	mount(vat, labels) {
+		if (labels) {
+			const overlap = this.#mounts().find((m) => m.vat !== vat && !conflict(m.labels, labels));
+			if (overlap) throw new Error("mount overlaps another: add a label whose value tells them apart");
+			this.ctx.storage.sql.exec("INSERT OR REPLACE INTO mount VALUES (?, ?)", vat, JSON.stringify(labels));
+		} else {
+			this.ctx.storage.sql.exec("DELETE FROM mount WHERE vat = ?", vat);
+		}
+	}
+
+	/**
+	 * The mount whose labels `request` carries, if any.
+	 *
+	 * @param {Record<string, string>} request
+	 */
+	lookup(request) {
+		return this.#mounts().find((m) => carries(m.labels, request)) ?? null;
 	}
 }
 
 /**
- * The admin socket: `PUT /<vat>` with an ES module body installs and starts
- * it; `?egress=<labels as JSON>` grants it egress within those labels.
+ * A request's labels: its query parameters, plus a `Toybox-Labels` header
+ * (JSON) for labels too secret for a URL, which ends up in logs and
+ * `Referer`s. A webkey page keeps such a secret in its fragment and sends
+ * it in the header.
+ *
+ * @param {Request} request
+ */
+const requestLabels = (request) => {
+	const query = {};
+	for (const [k, v] of new URL(request.url).searchParams) {
+		if (k in query) throw new Error(`label ${k} given twice`);
+		query[k] = v;
+	}
+	const header = request.headers.get("Toybox-Labels");
+	return mergeLabels(query, header ? JSON.parse(header) : {});
+};
+
+/**
+ * The http socket: the ingress. A request reaches the vat mounted at labels
+ * it carries, which sees the mount's and the request's labels together in
+ * a `Toybox-Connection-Labels` header (JSON), as a Flower server gets its
+ * connection labels.
+ */
+export class Public extends WorkerEntrypoint {
+	async fetch(request) {
+		let labels;
+		try {
+			labels = requestLabels(request);
+		} catch (e) {
+			return new Response(`bad labels: ${e.message}\n`, { status: 400 });
+		}
+		const mount = await this.env.DIRECTORY.getByName("directory").lookup(labels);
+		if (!mount) return new Response("nothing mounted here\n", { status: 404 });
+		const forwarded = new Request(request);
+		forwarded.headers.set("Toybox-Connection-Labels", JSON.stringify(mergeLabels(mount.labels, labels)));
+		const resp = await this.env.VATS.get(this.env.VATS.idFromString(mount.vat)).fetch(forwarded);
+		if (resp.webSocket) return resp;
+		const sealed = new Response(resp.body, resp);
+		sealed.headers.set("Referrer-Policy", "no-referrer");
+		return sealed;
+	}
+}
+
+/**
+ * Grants in a query parameter, as JSON labels; absent means none.
+ *
+ * @param {URL} url
+ * @param {string} name
+ */
+const grantParam = (url, name) => {
+	const v = url.searchParams.get(name);
+	return v ? JSON.parse(v) : null;
+};
+
+/**
+ * The admin socket: `createVat` and its `adminNode`, over HTTP.
+ *
+ * - `POST /` with an ES module body creates a vat and starts it; the reply
+ *   is `{"vat": <id>, "hash": <code hash>}`, and the id addresses it here.
+ * - `PUT /<id>` with a body upgrades it; its storage carries over.
+ * - `PUT /by-name/<name>` does the same for a vat from before ids, when
+ *   vats were named.
+ *
+ * Every start states the vat's grants, absent meaning none:
+ * `?egress=<labels>` (see {@link Egress}) and `?mount=<labels>` (ingress:
+ * see {@link Public}).
  */
 export class Admin extends WorkerEntrypoint {
 	async fetch(request) {
-		if (request.method !== "PUT") return new Response("PUT code to /<vat>\n", { status: 405 });
-		const egress = new URL(request.url).searchParams.get("egress");
-		return new Response((await vatOf(this.env, request.url).start(await request.text(), egress)) + "\n");
+		const url = new URL(request.url);
+		const [, first, second] = url.pathname.split("/");
+		let id;
+		if (request.method === "POST" && !first) id = this.env.VATS.newUniqueId();
+		else if (request.method === "PUT" && first === "by-name" && second) id = this.env.VATS.idFromName(second);
+		else if (request.method === "PUT" && first && !second) {
+			try {
+				id = this.env.VATS.idFromString(first);
+			} catch {
+				return new Response("no such vat\n", { status: 404 });
+			}
+		} else return new Response("POST / or PUT /<id> or PUT /by-name/<name>, with code\n", { status: 405 });
+		const vat = id.toString();
+		try {
+			await this.env.DIRECTORY.getByName("directory").mount(vat, grantParam(url, "mount"));
+		} catch (e) {
+			return new Response(`${e.message}\n`, { status: 409 });
+		}
+		const egress = url.searchParams.get("egress");
+		const hash = await this.env.VATS.get(id).start(await request.text(), egress);
+		return Response.json({ vat, hash });
 	}
 }