@volter/twin-upstash 0.1.1 → 0.1.3

package/dist/src/upstash-server.js

@@ -13,7 +13,7 @@
 // the SERVER is one line of `Bun.serve` around it. This is a CUSTOM fetch, not the kernel adapter
 // (`createTwinFetchFromHandler`): replies carry ONLY the handler's own headers (the REST envelope
 // declares its own content type; a 405 carries none at all), and the clock is an injectable seam.
-import { serveHttp } from '@volter/world-core';
+import { isReadOnlyRequest, serveHttp, withRequestScopes } from '@volter/world-core';
 import { handleUpstashRedisTwinRequest } from "./upstash-twin.js";
 import { upstashRedisOwners } from "./upstash-store.js";
 import { API_HOST, CONSOLE_HOST, createUpstashApiLaneFetch } from "../api/src/fetch.js";
@@ -26,12 +26,16 @@ const QSTASH_HOST = /^qstash(-[a-z0-9-]+)?\.upstash\.io$/;
 const QSTASH_PATH = /^\/(v2\/|_twin\/(deliveries|destinations)(\/|$))/;
 /** The pack's fetch, with `owners()`: per id of Redis's command table, the command core (`handler`) or the gap. */
 export function createUpstashRedisTwinFetch(options = {}) {
-    const readOnly = options.readOnly ?? false;
     const now = options.now ?? (() => worldNow());
     // api.upstash.com's Developer API and console.upstash.com's pages are the pack's `api` lane (../api/src/fetch.ts)
+    // the lanes' own read-only twin; a read-only REQUEST is refused by the kernel's scope around them (withRequestScopes)
+    const readOnly = options.readOnly ?? false;
     const api = createUpstashApiLaneFetch({ ...(options.root !== undefined ? { root: options.root } : {}), readOnly, clock: now });
     const qstash = options.qstash ?? createQstashLaneFetch({ ...(options.root !== undefined ? { root: options.root } : {}), readOnly, clock: now });
-    const fetch = async function upstashRedisTwinFetch(request) {
+    // a read-only request (x-volter-read-only) is a request to a read-only twin: a command that writes
+    // (by GET too: Upstash runs any command from the path) is refused, and the kernel refuses any that slip
+    const fetch = withRequestScopes(async function upstashRedisTwinFetch(request) {
+        const readOnly = (options.readOnly ?? false) || isReadOnlyRequest(request);
         const url = new URL(request.url);
         // the vendor host a redirected request names in x-volter-twin-original-host (the injector's fetch path, a hosted
         // World), else its Host, else its URL's (vercel-server.ts's precedent): the lane's two hosts go to the lane
@@ -64,7 +68,7 @@ export function createUpstashRedisTwinFetch(options = {}) {
         if (out === null)
             return new Response(null, { status, headers: { ...(outHeaders ?? {}) } });
         return new Response(JSON.stringify(out), { status, headers: { ...(outHeaders ?? {}) } });
-    };
+    }, { refuse: () => Response.json({ error: 'NOPERM this request is read-only' }, { status: 403 }) });
     return Object.assign(fetch, { owners: upstashRedisOwners });
 }
 /** `GET /twin`, the discovery manifest. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-upstash",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Local Upstash Redis (REST API) twin: a real stateful Redis command core (strings/counters/TTL/hashes/sets/sorted-sets/keyspace) served over Upstash's per-database REST protocol — single-command POST /, path-style GET /get/key, POST /pipeline, POST /multi-exec, Bearer-token auth, the {result}/{error} envelope, Upstash-Encoding: base64 — plus an EVAL/EVALSHA Lua-subset interpreter that runs @upstash/ratelimit's real fixed-window/sliding-window/token-bucket scripts. Built on @volter/world-core.",
   "author": "Volter (https://github.com/volter-ai)",
   "license": "Apache-2.0",
@@ -37,17 +37,17 @@
     "postpack": "node ../../../scripts/publish/prepare-publish.mjs postpack"
   },
   "dependencies": {
-    "@volter/world-ui": "0.1.1",
+    "@volter/world-ui": "0.1.3",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.1"
+    "@volter/world-core": "2.0.3"
   },
   "devDependencies": {
     "@types/bun": "^1.2.20",
     "@types/node": "^24.0.0",
-    "@volter/world-core": "2.0.1",
+    "@volter/world-core": "2.0.3",
     "@volter/world-tooling": "0.1.0",
     "@upstash/redis": "1.35.7",
     "@upstash/ratelimit": "2.0.8",

package/src/upstash-server.ts

@@ -13,7 +13,7 @@
 // the SERVER is one line of `Bun.serve` around it. This is a CUSTOM fetch, not the kernel adapter
 // (`createTwinFetchFromHandler`): replies carry ONLY the handler's own headers (the REST envelope
 // declares its own content type; a 405 carries none at all), and the clock is an injectable seam.
-import { serveHttp } from '@volter/world-core';
+import { isReadOnlyRequest, serveHttp, withRequestScopes } from '@volter/world-core';
 import { handleUpstashRedisTwinRequest } from './upstash-twin.ts';
 import { upstashRedisOwners } from './upstash-store.ts';
 import { API_HOST, CONSOLE_HOST, createUpstashApiLaneFetch } from '../api/src/fetch.ts';
@@ -50,12 +50,16 @@ const QSTASH_PATH = /^\/(v2\/|_twin\/(deliveries|destinations)(\/|$))/;
 
 /** The pack's fetch, with `owners()`: per id of Redis's command table, the command core (`handler`) or the gap. */
 export function createUpstashRedisTwinFetch(options: UpstashRedisTwinFetchOptions = {}): ((request: Request) => Promise<Response>) & { owners: typeof upstashRedisOwners } {
-  const readOnly = options.readOnly ?? false;
   const now = options.now ?? (() => worldNow());
   // api.upstash.com's Developer API and console.upstash.com's pages are the pack's `api` lane (../api/src/fetch.ts)
+  // the lanes' own read-only twin; a read-only REQUEST is refused by the kernel's scope around them (withRequestScopes)
+  const readOnly = options.readOnly ?? false;
   const api = createUpstashApiLaneFetch({ ...(options.root !== undefined ? { root: options.root } : {}), readOnly, clock: now });
   const qstash = options.qstash ?? createQstashLaneFetch({ ...(options.root !== undefined ? { root: options.root } : {}), readOnly, clock: now });
-  const fetch = async function upstashRedisTwinFetch(request: Request): Promise<Response> {
+  // a read-only request (x-volter-read-only) is a request to a read-only twin: a command that writes
+  // (by GET too: Upstash runs any command from the path) is refused, and the kernel refuses any that slip
+  const fetch = withRequestScopes(async function upstashRedisTwinFetch(request: Request): Promise<Response> {
+    const readOnly = (options.readOnly ?? false) || isReadOnlyRequest(request);
     const url = new URL(request.url);
     // the vendor host a redirected request names in x-volter-twin-original-host (the injector's fetch path, a hosted
     // World), else its Host, else its URL's (vercel-server.ts's precedent): the lane's two hosts go to the lane
@@ -84,7 +88,7 @@ export function createUpstashRedisTwinFetch(options: UpstashRedisTwinFetchOption
     // the real service answers those with zero bytes and, for 405, no content-type either.
     if (out === null) return new Response(null, { status, headers: { ...(outHeaders ?? {}) } });
     return new Response(JSON.stringify(out), { status, headers: { ...(outHeaders ?? {}) } });
-  };
+  }, { refuse: () => Response.json({ error: 'NOPERM this request is read-only' }, { status: 403 }) });
   return Object.assign(fetch, { owners: upstashRedisOwners });
 }