@volter/world-core 2.0.8 → 2.0.9

package/dist/src/rateBudget.d.ts

@@ -301,6 +301,11 @@ export declare class RateBudget {
      */
     private now;
     private lockPath;
+    /** The store the ledger persists through where there is no filesystem of this machine's to hold it: a hosted World's
+     *  (its SQL store, one instance serializing its requests). Null on the filesystem, where the ledger is the file below,
+     *  locked across processes as it always was. A hosted World's ledger is its own: two hosted Worlds sealed with one
+     *  credential each keep an allowance, where a machine's Worlds share one per credential. */
+    private store;
     /** Acquire the exclusive lock, run `fn`, always release. Bounded wait, dead locks broken. */
     private withLock;
     /** Remove a lock whose owner is provably gone. Never removes one that might still be live. */

package/dist/src/rateBudget.js

@@ -72,6 +72,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { volterHome } from "./volter-home.js";
 import { dirname, join } from 'node:path';
 import { worldPaths } from "./storage.js";
+import { FsWorldStore, getActiveWorldStore } from "./world-store.js";
 // ── bounds the kernel enforces on ANY declaration ───────────────────────────────────────────
 /** Shortest window a declaration may claim. A sub-second window is a counter reset, not a budget. */
 export const MIN_RATE_BUDGET_WINDOW_MS = 1_000;
@@ -538,8 +539,19 @@ export class RateBudget {
     }
     // ── locking + durable IO ──────────────────────────────────────────────────────────────────
     lockPath() { return `${this.path}.lock`; }
+    /** The store the ledger persists through where there is no filesystem of this machine's to hold it: a hosted World's
+     *  (its SQL store, one instance serializing its requests). Null on the filesystem, where the ledger is the file below,
+     *  locked across processes as it always was. A hosted World's ledger is its own: two hosted Worlds sealed with one
+     *  credential each keep an allowance, where a machine's Worlds share one per credential. */
+    store() {
+        const active = getActiveWorldStore();
+        return active instanceof FsWorldStore ? null : active;
+    }
     /** Acquire the exclusive lock, run `fn`, always release. Bounded wait, dead locks broken. */
     withLock(fn) {
+        const held = this.store();
+        if (held)
+            return held.withLock(this.lockPath(), fn);
         const lock = this.lockPath();
         mkdirSync(dirname(this.path), { recursive: true });
         let fd;
@@ -613,11 +625,12 @@ export class RateBudget {
      * window instead of needing a human to delete a file.
      */
     load(now) {
-        if (!existsSync(this.path))
+        const held = this.store();
+        if (held ? !held.exists(this.path) : !existsSync(this.path))
             return { v: 1, cooldownUntil: 0, entries: [] };
         let raw;
         try {
-            raw = readFileSync(this.path, 'utf8');
+            raw = held ? (held.read(this.path) ?? '') : readFileSync(this.path, 'utf8');
         }
         catch (e) {
             throw this.quarantine(now, `unreadable (${e.message})`);
@@ -668,6 +681,16 @@ export class RateBudget {
     }
     /** Atomic replace: write a temp file, then rename over the target. No partial ledger is visible. */
     save(ledger) {
+        const held = this.store();
+        if (held) {
+            try {
+                held.writeAtomic(this.path, `${JSON.stringify(ledger)}\n`);
+            }
+            catch (e) {
+                throw new RateBudgetError('ledger-unwritable', this.vendor, `${this.vendor} budget: cannot persist ${this.path} (${e.message}) — refusing rather than tracking nothing`, this.windowMs);
+            }
+            return;
+        }
         const tmp = `${this.path}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
         try {
             mkdirSync(dirname(this.path), { recursive: true });

package/dist/src/twin-fetch.js

@@ -22,8 +22,17 @@ export const TWIN_PREFIX_HEADER = 'x-forwarded-prefix';
  *  callback) from this, never from the bare origin, so the URL works behind a served World. */
 export function twinPublicBase(request) {
     const prefix = request.headers.get(TWIN_PREFIX_HEADER);
-    if (!prefix || !/^\/[A-Za-z0-9._~\/-]*$/.test(prefix))
-        return new URL(request.url).origin;
+    if (!prefix || !/^\/[A-Za-z0-9._~\/-]*$/.test(prefix)) {
+        // a twin reached at its vendor's host through the World's proxy, which ends the caller's TLS and forwards the
+        // request in the clear: the scheme the caller used is the one its links carry (a page's form posting to
+        // http://accounts.google.com from an https page is one a browser warns about), the host the request's own
+        // A twin reached at its own listener (a loopback or an address: the injector's route, a direct client) is that
+        // listener, whatever scheme a caller's forwarded headers claim
+        const proto = request.headers.get('x-forwarded-proto');
+        const own = new URL(request.url);
+        const listener = own.hostname === 'localhost' || own.hostname.endsWith('.localhost') || /^[\d.]+$/.test(own.hostname) || own.hostname.startsWith('[');
+        return !listener && (proto === 'https' || proto === 'http') ? `${proto}://${own.host}` : own.origin;
+    }
     // the host that mounted the twin says where it is reached: a local World forwards to the twin's
     // own port, so the request's own origin is not the public one
     const host = request.headers.get('x-forwarded-host');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "2.0.8",
+  "version": "2.0.9",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",

package/src/rateBudget.ts

@@ -72,6 +72,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { volterHome } from './volter-home.ts';
 import { dirname, join } from 'node:path';
 import { worldPaths } from './storage.ts';
+import { FsWorldStore, getActiveWorldStore, type WorldStore } from './world-store.ts';
 
 // ── bounds the kernel enforces on ANY declaration ───────────────────────────────────────────
 
@@ -706,8 +707,19 @@ export class RateBudget {
 
   private lockPath(): string { return `${this.path}.lock`; }
 
+  /** The store the ledger persists through where there is no filesystem of this machine's to hold it: a hosted World's
+   *  (its SQL store, one instance serializing its requests). Null on the filesystem, where the ledger is the file below,
+   *  locked across processes as it always was. A hosted World's ledger is its own: two hosted Worlds sealed with one
+   *  credential each keep an allowance, where a machine's Worlds share one per credential. */
+  private store(): WorldStore | null {
+    const active = getActiveWorldStore();
+    return active instanceof FsWorldStore ? null : active;
+  }
+
   /** Acquire the exclusive lock, run `fn`, always release. Bounded wait, dead locks broken. */
   private withLock<T>(fn: () => T): T {
+    const held = this.store();
+    if (held) return held.withLock(this.lockPath(), fn);
     const lock = this.lockPath();
     mkdirSync(dirname(this.path), { recursive: true });
     let fd: number | undefined;
@@ -764,10 +776,11 @@ export class RateBudget {
    * window instead of needing a human to delete a file.
    */
   private load(now: number): Ledger {
-    if (!existsSync(this.path)) return { v: 1, cooldownUntil: 0, entries: [] };
+    const held = this.store();
+    if (held ? !held.exists(this.path) : !existsSync(this.path)) return { v: 1, cooldownUntil: 0, entries: [] };
     let raw: string;
     try {
-      raw = readFileSync(this.path, 'utf8');
+      raw = held ? (held.read(this.path) ?? '') : readFileSync(this.path, 'utf8');
     } catch (e) {
       throw this.quarantine(now, `unreadable (${(e as Error).message})`);
     }
@@ -819,6 +832,13 @@ export class RateBudget {
 
   /** Atomic replace: write a temp file, then rename over the target. No partial ledger is visible. */
   private save(ledger: Ledger): void {
+    const held = this.store();
+    if (held) {
+      try { held.writeAtomic(this.path, `${JSON.stringify(ledger)}\n`); } catch (e) {
+        throw new RateBudgetError('ledger-unwritable', this.vendor, `${this.vendor} budget: cannot persist ${this.path} (${(e as Error).message}) — refusing rather than tracking nothing`, this.windowMs);
+      }
+      return;
+    }
     const tmp = `${this.path}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
     try {
       mkdirSync(dirname(this.path), { recursive: true });

package/src/twin-fetch.ts

@@ -24,7 +24,17 @@ export const TWIN_PREFIX_HEADER = 'x-forwarded-prefix';
  *  callback) from this, never from the bare origin, so the URL works behind a served World. */
 export function twinPublicBase(request: Request): string {
   const prefix = request.headers.get(TWIN_PREFIX_HEADER);
-  if (!prefix || !/^\/[A-Za-z0-9._~\/-]*$/.test(prefix)) return new URL(request.url).origin;
+  if (!prefix || !/^\/[A-Za-z0-9._~\/-]*$/.test(prefix)) {
+    // a twin reached at its vendor's host through the World's proxy, which ends the caller's TLS and forwards the
+    // request in the clear: the scheme the caller used is the one its links carry (a page's form posting to
+    // http://accounts.google.com from an https page is one a browser warns about), the host the request's own
+    // A twin reached at its own listener (a loopback or an address: the injector's route, a direct client) is that
+    // listener, whatever scheme a caller's forwarded headers claim
+    const proto = request.headers.get('x-forwarded-proto');
+    const own = new URL(request.url);
+    const listener = own.hostname === 'localhost' || own.hostname.endsWith('.localhost') || /^[\d.]+$/.test(own.hostname) || own.hostname.startsWith('[');
+    return !listener && (proto === 'https' || proto === 'http') ? `${proto}://${own.host}` : own.origin;
+  }
   // the host that mounted the twin says where it is reached: a local World forwards to the twin's
   // own port, so the request's own origin is not the public one
   const host = request.headers.get('x-forwarded-host');