@volter/world-core 2.0.3 → 2.0.5

package/dist/src/derived-core.js

@@ -614,7 +614,10 @@ async function contextFor(m, call, scope) {
     // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
     if (body && typeof body === 'object' && !Array.isArray(body))
         body = adoptedInCall(m.service, body, root);
-    const params = await boundaryParams(m, call, root);
+    // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
+    // still find it unread, whichever of them reads it first
+    const pristine = call.request.clone();
+    const params = await boundaryParams(m, { ...call, request: call.request.clone() }, root);
     const paths = expandPaths(m, params);
     return {
         call,
@@ -677,7 +680,7 @@ async function contextFor(m, call, scope) {
         sse: (events) => sse(m, events, call.operation.id),
         expand: (resource, body) => (paths.length ? expand(m, resource, body, paths, root) : body),
         at: (when) => contextFor(m, { ...call, request: new Request(call.request.url) }, { ...scope, clock: () => when }),
-        core: async () => { const out = await serveCore(m, call, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
+        core: async () => { const out = await serveCore(m, { ...call, request: pristine.clone() }, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
         own: (row) => ownFields(row),
     };
 }

package/dist/src/head.js

@@ -206,17 +206,28 @@ export async function performEntries(opts) {
     queues.set(key, run.catch(() => undefined));
     return run;
 }
-async function performNow(opts) {
-    const { service, root } = opts;
+/** The root a perform runs against: the sealed one, or — when the caller brings its own executor (a library holding
+ *  the person's token in its own process) — the twin's root.json with no credential sealed at all. */
+function performRoot(service, root, callerExecute) {
     const head = headOf(service, root);
-    if (head.kind !== 'real')
+    if (head.kind === 'real')
+        return { sealed: head.root, vendor: vendorOf(head.root) };
+    const unsealed = callerExecute ? readRoot(service, root) : null;
+    if (!unsealed)
         throw new Error(`the ${service} twin has no root — nothing to perform against`);
-    const vendor = vendorOf(head.root);
+    return { sealed: null, vendor: service };
+}
+async function performNow(opts) {
+    const { service, root } = opts;
+    const bound = performRoot(service, root, opts.execute !== undefined);
+    const vendor = bound.vendor;
     const adapters = opts.adapters ?? stateSystemFor(vendor) ?? stateSystemFor(service);
     if (!adapters?.perform)
         throw new Error(`the ${vendor} twin has no perform adapter — a protocol 2 pack names one in its descriptor and registers itself (registerPack)`);
-    const execute = opts.execute ?? buildRemoteExecute(validateRemoteOrigin(head.root.url, { allowInsecureLoopback: true }), await openRootCredential(head.root, vendor), authStrategyFor(vendor), getPack(vendor)?.hosts, { custody: rootCustody(head.root, vendor) });
-    const checks = opts.checks ?? (await loadChecks(worldRootOf(head.root)));
+    // the caller's executor, or the one built over the sealed credential; an unsealed root has no other
+    const execute = opts.execute ?? buildRemoteExecute(validateRemoteOrigin(bound.sealed.url, { allowInsecureLoopback: true }), await openRootCredential(bound.sealed, vendor), authStrategyFor(vendor), getPack(vendor)?.hosts, { custody: rootCustody(bound.sealed, vendor) });
+    // an unsealed root's World is where its state resolves (the root given, PROJECT_ROOT, or the working directory)
+    const checks = opts.checks ?? (await loadChecks(bound.sealed ? worldRootOf(bound.sealed) : worldPaths(service, root).root));
     const deployable = deployableEntries(service, root);
     const entries = opts.actionIds === undefined ? deployable : opts.actionIds.map((id) => deployable.find((a) => a.id === id)).filter((a) => a !== undefined);
     const report = { pushed: 0, deployed: [], skipped: [], replayed: [] };
@@ -244,7 +255,7 @@ async function performNow(opts) {
             // a declared reference to an adopted id is resolved before the pack sees the entry: the vendor is
             // asked about #7, never the local #3 (docs/contributing/architecture.md#alias-aware-lookup-at-the-request-boundary)
             const fields = resolveReferences(service, action.subject.type, action.fields ?? {}, aliasesFrom(parentEntries(service, root)));
-            const outcome = await adapters.perform(execute, fields === action.fields ? action : { ...action, fields }, performContext(service, root, rootCredentialFingerprint(head.root)));
+            const outcome = await adapters.perform(execute, fields === action.fields ? action : { ...action, fields }, performContext(service, root, bound.sealed ? rootCredentialFingerprint(bound.sealed) : undefined));
             // the vendor's answer, when the adapter returned one as fields, is what the landed copy holds
             const answered = outcome.data !== null && typeof outcome.data === 'object' && !Array.isArray(outcome.data) ? outcome.data : {};
             confirmAction({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",

package/src/derived-core.ts

@@ -851,7 +851,10 @@ async function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScop
   try { body = text ? JSON.parse(text) : undefined; } catch { body = text; }
   // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
   if (body && typeof body === 'object' && !Array.isArray(body)) body = adoptedInCall(m.service, body as Record<string, unknown>, root);
-  const params = await boundaryParams(m, call, root);
+  // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
+  // still find it unread, whichever of them reads it first
+  const pristine = call.request.clone();
+  const params = await boundaryParams(m, { ...call, request: call.request.clone() }, root);
   const paths = expandPaths(m, params);
   return {
     call,
@@ -913,7 +916,7 @@ async function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScop
     sse: (events) => sse(m, events, call.operation.id),
     expand: (resource, body) => (paths.length ? expand(m, resource, body, paths, root) : body),
     at: (when) => contextFor(m, { ...call, request: new Request(call.request.url) }, { ...scope, clock: () => when }),
-    core: async () => { const out = await serveCore(m, call, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
+    core: async () => { const out = await serveCore(m, { ...call, request: pristine.clone() }, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
     own: (row) => ownFields(row as unknown as TwinResource),
   };
 }

package/src/head.ts

@@ -229,15 +229,26 @@ export async function performEntries(opts: {
   return run;
 }
 
+/** The root a perform runs against: the sealed one, or — when the caller brings its own executor (a library holding
+ *  the person's token in its own process) — the twin's root.json with no credential sealed at all. */
+function performRoot(service: string, root: string | undefined, callerExecute: boolean): { sealed: BoundRoot | null; vendor: string } {
+  const head = headOf(service, root);
+  if (head.kind === 'real') return { sealed: head.root, vendor: vendorOf(head.root) };
+  const unsealed = callerExecute ? readRoot(service, root) : null;
+  if (!unsealed) throw new Error(`the ${service} twin has no root — nothing to perform against`);
+  return { sealed: null, vendor: service };
+}
+
 async function performNow(opts: Parameters<typeof performEntries>[0]): Promise<DeployReport> {
   const { service, root } = opts;
-  const head = headOf(service, root);
-  if (head.kind !== 'real') throw new Error(`the ${service} twin has no root — nothing to perform against`);
-  const vendor = vendorOf(head.root);
+  const bound = performRoot(service, root, opts.execute !== undefined);
+  const vendor = bound.vendor;
   const adapters = opts.adapters ?? stateSystemFor(vendor) ?? stateSystemFor(service);
   if (!adapters?.perform) throw new Error(`the ${vendor} twin has no perform adapter — a protocol 2 pack names one in its descriptor and registers itself (registerPack)`);
-  const execute = opts.execute ?? buildRemoteExecute(validateRemoteOrigin(head.root.url, { allowInsecureLoopback: true }), await openRootCredential(head.root, vendor), authStrategyFor(vendor), getPack(vendor)?.hosts, { custody: rootCustody(head.root, vendor) });
-  const checks = opts.checks ?? (await loadChecks(worldRootOf(head.root)));
+  // the caller's executor, or the one built over the sealed credential; an unsealed root has no other
+  const execute = opts.execute ?? buildRemoteExecute(validateRemoteOrigin(bound.sealed!.url, { allowInsecureLoopback: true }), await openRootCredential(bound.sealed!, vendor), authStrategyFor(vendor), getPack(vendor)?.hosts, { custody: rootCustody(bound.sealed!, vendor) });
+  // an unsealed root's World is where its state resolves (the root given, PROJECT_ROOT, or the working directory)
+  const checks = opts.checks ?? (await loadChecks(bound.sealed ? worldRootOf(bound.sealed) : worldPaths(service, root).root));
   const deployable = deployableEntries(service, root);
   const entries = opts.actionIds === undefined ? deployable : opts.actionIds.map((id) => deployable.find((a) => a.id === id)).filter((a): a is TwinAction => a !== undefined);
   const report: DeployReport = { pushed: 0, deployed: [], skipped: [], replayed: [] };
@@ -260,7 +271,7 @@ async function performNow(opts: Parameters<typeof performEntries>[0]): Promise<D
       // a declared reference to an adopted id is resolved before the pack sees the entry: the vendor is
       // asked about #7, never the local #3 (docs/contributing/architecture.md#alias-aware-lookup-at-the-request-boundary)
       const fields = resolveReferences(service, action.subject.type, action.fields ?? {}, aliasesFrom(parentEntries(service, root)));
-      const outcome = await adapters.perform(execute, fields === action.fields ? action : { ...action, fields }, performContext(service, root, rootCredentialFingerprint(head.root)));
+      const outcome = await adapters.perform(execute, fields === action.fields ? action : { ...action, fields }, performContext(service, root, bound.sealed ? rootCredentialFingerprint(bound.sealed) : undefined));
       // the vendor's answer, when the adapter returned one as fields, is what the landed copy holds
       const answered = outcome.data !== null && typeof outcome.data === 'object' && !Array.isArray(outcome.data) ? (outcome.data as Record<string, unknown>) : {};
       confirmAction({