@volter/world-core 2.0.2 → 2.0.4

package/dist/generated/pack-facts.json

@@ -506,6 +506,10 @@
         {
           "host": "cdn.bsky.app",
           "pathPattern": "^/img/"
+        },
+        {
+          "host": "bsky.app",
+          "pathPattern": "^/profile/[^/]+/?$|^/profile/[^/]+/post/[A-Za-z0-9._:~-]{1,512}/?$"
         }
       ],
       "archetype": "crud",
@@ -4274,6 +4278,38 @@
         {
           "host": "api.twitter.com",
           "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/(?!assets/consent\\.(?:js|css)$)"
+        },
+        {
+          "host": "x.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "twitter.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "www.x.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "www.twitter.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "mobile.twitter.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "mobile.x.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "pbs.twimg.com",
+          "pathPattern": "^/media/[0-9a-f]{64}\\.(?:jpg|png|gif|webp)$|^/ext_tw_video_thumb/[0-9]{1,19}/pu/img/[0-9a-f]{64}\\.svg$"
+        },
+        {
+          "host": "video.twimg.com",
+          "pathPattern": "^/ext_tw_video/[0-9]{1,19}/pu/vid/avc1/[0-9]+x[0-9]+/[0-9a-f]{64}\\.mp4$"
         }
       ],
       "archetype": "crud",

package/dist/src/derived-core.js

@@ -614,7 +614,10 @@ async function contextFor(m, call, scope) {
     // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
     if (body && typeof body === 'object' && !Array.isArray(body))
         body = adoptedInCall(m.service, body, root);
-    const params = await boundaryParams(m, call, root);
+    // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
+    // still find it unread, whichever of them reads it first
+    const pristine = call.request.clone();
+    const params = await boundaryParams(m, { ...call, request: call.request.clone() }, root);
     const paths = expandPaths(m, params);
     return {
         call,
@@ -677,7 +680,7 @@ async function contextFor(m, call, scope) {
         sse: (events) => sse(m, events, call.operation.id),
         expand: (resource, body) => (paths.length ? expand(m, resource, body, paths, root) : body),
         at: (when) => contextFor(m, { ...call, request: new Request(call.request.url) }, { ...scope, clock: () => when }),
-        core: async () => { const out = await serveCore(m, call, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
+        core: async () => { const out = await serveCore(m, { ...call, request: pristine.clone() }, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
         own: (row) => ownFields(row),
     };
 }

package/dist/vendor-hosts.cjs

@@ -77,13 +77,14 @@ const isGoogleOAuthTokenPath = (p) =>
 // operation must fail LOCALLY, not succeed remotely.
 
 /**
- * The www.googleapis.com paths it serves: the v1 (PEM) and v3 (JWK) cert endpoints, and the v3
- * userinfo alias. NOT `/oauth2/v2/*` — Google publishes no v2 certs endpoint at all, and the v2
- * userinfo alias returns a DIFFERENT field set the pack does not model
- * (`googleoauth.endpoints.userinfo_v2`, todo), so its handler refuses it.
+ * The www.googleapis.com paths it serves: the v1 (PEM) and v3 (JWK) cert endpoints, the v3
+ * userinfo alias, and the OAuth2 API v2's userinfo (`/oauth2/v2/userinfo` and its `/userinfo/v2/me`
+ * alias, a different field set: `googleoauth.endpoints.userinfo_v2`), which `@googleapis/oauth2`
+ * calls (Cal.com's Google Calendar callback). NOT `/oauth2/v2/certs`: Google publishes no v2 certs
+ * endpoint at all.
  */
 const isGoogleOAuthApisPath = (p) =>
-  typeof p === 'string' && /^\/oauth2\/(v1\/certs|v3\/(certs|userinfo))\/?$/.test(p);
+  typeof p === 'string' && /^\/(oauth2\/(v1\/certs|v3\/(certs|userinfo)|v2\/userinfo)|userinfo\/v2\/me)\/?$/.test(p);
 
 // vendor → predicate(hostname, pathname?). A vendor is only active if its twin URL is set.
 // THE HAND TABLE'S ONLY RESIDENTS: keys served by KERNEL packages (browser-assets serves

package/generated/pack-facts.json

@@ -506,6 +506,10 @@
         {
           "host": "cdn.bsky.app",
           "pathPattern": "^/img/"
+        },
+        {
+          "host": "bsky.app",
+          "pathPattern": "^/profile/[^/]+/?$|^/profile/[^/]+/post/[A-Za-z0-9._:~-]{1,512}/?$"
         }
       ],
       "archetype": "crud",
@@ -4274,6 +4278,38 @@
         {
           "host": "api.twitter.com",
           "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/(?!assets/consent\\.(?:js|css)$)"
+        },
+        {
+          "host": "x.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "twitter.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "www.x.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "www.twitter.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "mobile.twitter.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "mobile.x.com",
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+        },
+        {
+          "host": "pbs.twimg.com",
+          "pathPattern": "^/media/[0-9a-f]{64}\\.(?:jpg|png|gif|webp)$|^/ext_tw_video_thumb/[0-9]{1,19}/pu/img/[0-9a-f]{64}\\.svg$"
+        },
+        {
+          "host": "video.twimg.com",
+          "pathPattern": "^/ext_tw_video/[0-9]{1,19}/pu/vid/avc1/[0-9]+x[0-9]+/[0-9a-f]{64}\\.mp4$"
         }
       ],
       "archetype": "crud",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",

package/src/derived-core.ts

@@ -851,7 +851,10 @@ async function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScop
   try { body = text ? JSON.parse(text) : undefined; } catch { body = text; }
   // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
   if (body && typeof body === 'object' && !Array.isArray(body)) body = adoptedInCall(m.service, body as Record<string, unknown>, root);
-  const params = await boundaryParams(m, call, root);
+  // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
+  // still find it unread, whichever of them reads it first
+  const pristine = call.request.clone();
+  const params = await boundaryParams(m, { ...call, request: call.request.clone() }, root);
   const paths = expandPaths(m, params);
   return {
     call,
@@ -913,7 +916,7 @@ async function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScop
     sse: (events) => sse(m, events, call.operation.id),
     expand: (resource, body) => (paths.length ? expand(m, resource, body, paths, root) : body),
     at: (when) => contextFor(m, { ...call, request: new Request(call.request.url) }, { ...scope, clock: () => when }),
-    core: async () => { const out = await serveCore(m, call, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
+    core: async () => { const out = await serveCore(m, { ...call, request: pristine.clone() }, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
     own: (row) => ownFields(row as unknown as TwinResource),
   };
 }

package/vendor-hosts.cjs

@@ -77,13 +77,14 @@ const isGoogleOAuthTokenPath = (p) =>
 // operation must fail LOCALLY, not succeed remotely.
 
 /**
- * The www.googleapis.com paths it serves: the v1 (PEM) and v3 (JWK) cert endpoints, and the v3
- * userinfo alias. NOT `/oauth2/v2/*` — Google publishes no v2 certs endpoint at all, and the v2
- * userinfo alias returns a DIFFERENT field set the pack does not model
- * (`googleoauth.endpoints.userinfo_v2`, todo), so its handler refuses it.
+ * The www.googleapis.com paths it serves: the v1 (PEM) and v3 (JWK) cert endpoints, the v3
+ * userinfo alias, and the OAuth2 API v2's userinfo (`/oauth2/v2/userinfo` and its `/userinfo/v2/me`
+ * alias, a different field set: `googleoauth.endpoints.userinfo_v2`), which `@googleapis/oauth2`
+ * calls (Cal.com's Google Calendar callback). NOT `/oauth2/v2/certs`: Google publishes no v2 certs
+ * endpoint at all.
  */
 const isGoogleOAuthApisPath = (p) =>
-  typeof p === 'string' && /^\/oauth2\/(v1\/certs|v3\/(certs|userinfo))\/?$/.test(p);
+  typeof p === 'string' && /^\/(oauth2\/(v1\/certs|v3\/(certs|userinfo)|v2\/userinfo)|userinfo\/v2\/me)\/?$/.test(p);
 
 // vendor → predicate(hostname, pathname?). A vendor is only active if its twin URL is set.
 // THE HAND TABLE'S ONLY RESIDENTS: keys served by KERNEL packages (browser-assets serves