@volter/world-core 3.0.160 → 3.0.162

package/dist/generated/pack-facts.json

@@ -25,6 +25,9 @@
       "resources": [],
       "endpointEnvNone": "@ai-sdk/gateway calls https://ai-gateway.vercel.sh/v4/ai and an OpenAI client is given https://ai-gateway.vercel.sh/v1 in code; the World claims the host",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -110,6 +113,9 @@
         "note": "the SDKs' base URL (the TypeScript and Python SDKs and Claude Code read ANTHROPIC_BASE_URL)"
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -174,6 +180,9 @@
         "note": "The AWS SDKs read AWS_ENDPOINT_URL as every service's endpoint (https://docs.aws.amazon.com/sdkref/latest/guide/feature-ss-endpoints.html)."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -360,6 +369,9 @@
       "credentialDoor": {
         "path": "/_twin/app-credentials",
         "body": {},
+        "account": {
+          "field": "account"
+        },
         "fill": {
           "CLERK_SECRET_KEY": "secret_key",
           "CLERK_API_KEY": "secret_key",
@@ -782,6 +794,9 @@
         "note": "Python e2b 2.45.0 and the JS SDK read E2B_API_URL; the JS SDK reads E2B_SANDBOX_URL and sends sandbox id/port headers; vendor hosts route through the World proxy"
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/teams",
         "body": {
           "name": "World team"
@@ -1003,6 +1018,9 @@
         "note": "Google GenAI SDK reads this base URL; other callers retain the routed vendor host."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1079,6 +1097,9 @@
         "app"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1213,6 +1234,9 @@
       ],
       "endpointEnvNone": "Google's OAuth libraries read no base-URL variable: the endpoints are the discovery document's, claimed by the host rules.",
       "credentialDoor": {
+        "account": {
+          "field": "world_account"
+        },
         "path": "/_twin/credentials",
         "body": {
           "client_email": "world@world-project.iam.gserviceaccount.com",
@@ -1657,12 +1681,30 @@
       "endpointEnv": {
         "name": "LIVEKIT_URL",
         "templates": {
-          "LIVEKIT_URL": "ws://${host}:${port}",
-          "LIVEKIT_API_KEY": "twin-livekit-key",
-          "LIVEKIT_API_SECRET": "twin-livekit-secret-for-the-worlds-own-server"
+          "LIVEKIT_URL": "ws://${host}:${port}"
         },
-        "note": "Credentials and URL are the same ones the World starts its LiveKit server with."
-      }
+        "note": "The native server uses a private key; its twin front accepts only keys issued for retained World accounts."
+      },
+      "credentialDoor": {
+        "path": "/_twin/app-credentials",
+        "body": {},
+        "account": {
+          "field": "account"
+        },
+        "fill": {
+          "LIVEKIT_API_KEY": "api_key",
+          "LIVEKIT_API_SECRET": "api_secret"
+        }
+      },
+      "sidePorts": [
+        {
+          "name": "rtc-tcp",
+          "option": "rtcTcpPort",
+          "flag": "--rtc-tcp-port",
+          "scheme": "tcp",
+          "note": "ICE/TCP media advertised on loopback at this port; the vendor binds all interfaces. Forward beside signaling for a browser on another machine."
+        }
+      ]
     },
     "merge": {
       "adoption": {
@@ -1687,6 +1729,9 @@
       "resources": [],
       "endpointEnvNone": "Open Autonomy reads MODEL_GATEWAY_URL and defaults to api-gateway.merge.dev; the World claims the host",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/organizations",
         "body": {},
         "fill": {
@@ -1725,6 +1770,9 @@
       "resources": [],
       "endpointEnvNone": "the SDKs call https://api.mistral.ai/v1 unless given a base URL in code or config; the World claims the host",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1799,6 +1847,9 @@
         "note": "npm and bun read the registry from npm_config_registry (and .npmrc's `registry`)."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1862,6 +1913,9 @@
         "api_key"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1973,6 +2027,9 @@
         "note": "the twin's own URL; applications reach it at <region>.connect.psdb.cloud, which the injector redirects, with the password the credentialDoor issued."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {
           "organization": "world",
@@ -2297,6 +2354,9 @@
         "received"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -2368,6 +2428,9 @@
       ],
       "endpointEnvNone": "an SDK sends to its DSN's host and sentry-cli to SENTRY_URL (sentry.io by default); the DSN the World issues names the World's ingest host, claimed by the host rules",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -2476,6 +2539,9 @@
         "app"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -2593,6 +2659,9 @@
       "credentialDoor": {
         "path": "/_twin/app-credentials",
         "body": {},
+        "account": {
+          "field": "account"
+        },
         "fill": {
           "STRIPE_SECRET_KEY": "secret_key",
           "STRIPE_API_KEY": "secret_key",
@@ -2666,7 +2735,11 @@
       "managedDatabase": {
         "kind": "postgres",
         "arg": "--database",
-        "note": "the project's database is the World's managed postgres: the database the application's migrations and queries use, whose URL the credential door answers"
+        "user": "world",
+        "database": "world",
+        "clock": "wall",
+        "credentialField": "database_url",
+        "note": "the selected Supabase twin owns its private PostgreSQL data plane; the credential door answers its URL, application migrations own application tables, and SQL uses wall time"
       },
       "serveExport": "createSupabaseTwinServer"
     },
@@ -2877,6 +2950,9 @@
       ],
       "endpointEnvNone": "Tinybird's clients take the API host as configuration (@chronark/zod-bird's baseUrl, tinybird-cli's --host), defaulting to https://api.tinybird.co, which the World routes by host; no SDK reads a base-URL variable of its own",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -3045,6 +3121,102 @@
       },
       "serveExport": "createTurbopufferTwinServer"
     },
+    "twitch": {
+      "adoption": {
+        "sdks": [],
+        "envStems": [
+          "TWITCH"
+        ]
+      },
+      "hosts": [
+        {
+          "host": "api.twitch.tv",
+          "pathPattern": "^/helix/|^/_twin/"
+        },
+        {
+          "host": "id.twitch.tv",
+          "pathPattern": "^/oauth2/|^/_twin/"
+        },
+        {
+          "host": "www.twitch.tv",
+          "pathPattern": "^/$|^/login/?$|^/popout/[A-Za-z0-9_]{1,25}/chat/?$|^/[A-Za-z0-9_]{1,25}/?$|^/_twin/"
+        },
+        {
+          "host": "twitch.tv",
+          "pathPattern": "^/$|^/login/?$|^/popout/[A-Za-z0-9_]{1,25}/chat/?$|^/[A-Za-z0-9_]{1,25}/?$|^/_twin/"
+        },
+        {
+          "host": "m.twitch.tv",
+          "pathPattern": "^/$|^/login/?$|^/popout/[A-Za-z0-9_]{1,25}/chat/?$|^/[A-Za-z0-9_]{1,25}/?$|^/_twin/"
+        },
+        {
+          "host": "dashboard.twitch.tv",
+          "pathPattern": "^/u/[A-Za-z0-9_]{1,25}/(?:stream-manager|settings/stream)/?$"
+        },
+        {
+          "host": "player.twitch.tv",
+          "pathPattern": "^/$"
+        },
+        {
+          "host": "irc-ws.chat.twitch.tv"
+        },
+        {
+          "host": "usher.ttvnw.net",
+          "pathPattern": "^/api/channel/hls/"
+        }
+      ],
+      "archetype": "crud",
+      "protocol": {
+        "declared": "3",
+        "major": 3,
+        "standing": "current"
+      },
+      "transport": "rest",
+      "resources": [
+        "user",
+        "channel",
+        "stream",
+        "chat_message",
+        "application",
+        "_token",
+        "_authorization_code",
+        "_client_secret",
+        "_stream_key",
+        "_live",
+        "_live_segment"
+      ],
+      "endpointEnvNone": "Twitch's clients address api.twitch.tv, id.twitch.tv and irc-ws.chat.twitch.tv by their published URLs; no SDK reads a base-URL variable",
+      "credentialDoor": {
+        "path": "/_twin/console",
+        "body": {
+          "login": "worldchannel",
+          "password": "world-password",
+          "email": "worldchannel@example.com",
+          "application": {
+            "name": "World App",
+            "redirect_uris": [
+              "http://localhost:3000"
+            ]
+          }
+        },
+        "fill": {
+          "TWITCH_CLIENT_ID": "client_id",
+          "TWITCH_CLIENT_SECRET": "client_secret",
+          "TWITCH_CHANNEL": "login"
+        }
+      },
+      "sidePorts": [
+        {
+          "name": "ingest",
+          "option": "ingestPort",
+          "flag": "--ingest-port",
+          "scheme": "rtmp",
+          "path": "/app",
+          "note": "Twitch's RTMP ingest (rtmp://<ingest-server>/app/<stream-key>): OBS publishes the channel's broadcast here"
+        }
+      ],
+      "serveExport": "createTwitchTwinServer"
+    },
     "upstash": {
       "adoption": {
         "sdks": [
@@ -3100,6 +3272,9 @@
         "note": "Redis reads its REST URL; QStash and Workflow read QSTASH_URL. Direct SDK transports use the twin endpoint and issued token; other clients also use host routing."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {
           "owner": "owner@world.test"
@@ -3165,6 +3340,9 @@
       ],
       "endpointEnvNone": "the applications reach api.vercel.com and the Edge Config connection string's host, which the World routes to the twin",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {
           "team": "world",
@@ -3403,6 +3581,9 @@
         "upload"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -3441,6 +3622,9 @@
       "resources": [],
       "endpointEnvNone": "the SDK calls https://api.x.ai/v1 unless given a base URL in code; the World claims the host",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {

package/dist/inject.cjs

@@ -358,8 +358,8 @@ function strictEgressEnabled() {
 }
 
 // THE WORLD'S DECISION (docs/contributing/architecture.md, "Capability decisions"): every seam below asks
-// capability-decision.cjs and enforces its answer. This process is a host process, whose declaration is the open one; a
-// local light guest, whose HTTP leaves through its guest listener; or a process of an image run, which carries its
+// capability-decision.cjs and enforces its answer. This process is a host process, whose declaration is the open one; or
+// a process of an image run, which carries its
 // image's declaration (VOLTER_WORLD_DECLARATION) and is confined from the host's network. What the World grants is its
 // published policy. The seams supply what they observe: the twin route, the vendors sharing a host, the World's doors.
 function worldGrant() {

package/dist/src/derived-core.d.ts

@@ -783,6 +783,7 @@ export type DerivedManifest = {
      *  read, list, update and delete by it and stamps it on every create, for each resource not `shared`. */
     tenant?: {
         field: string;
+        storage?: 'namespaced';
     };
     /** The vendor's own lanes behind this manifest's API ("Other wires: lanes"), dispatched by the kernel before the
      *  vendor's own doors, clock and API (LanesDecl). */
@@ -916,6 +917,10 @@ export type CoreScope = {
     /** the application a walk stands in for: what the vendor asks it (`ctx.ask`) is answered by it (events.ts) */
     application?: ApplicationStandIn;
 };
+/** World-owned generated values use the same private seed and log as pack secrets. */
+export declare function worldSecret(service: string, root: string, label: string, at?: string): Promise<string>;
+/** The same retained account primitive for pack doors and private native twin fronts. */
+export declare function worldAccount(service: string, root: string | undefined, id?: unknown, at?: string, provisioning?: boolean): Promise<string>;
 /** The lane a vendor's router sent a request to (pack-fetch's laneRouter sets it). */
 export declare const LANE_HEADER = "x-volter-lane";
 /** What a coverage measurement sees of a pack's declared state logic: each move a request made and each refusal a
@@ -1011,6 +1016,8 @@ export type SemanticsContext = {
      *  random, and keeps as bookkeeping no door answers. The same label gives the same secret for the World's whole life,
      *  and no one can compute it from ids the World shows, as they can a value derived from them alone. */
     secret(label: string): Promise<string>;
+    /** Select an account at a pack's credential door. Packs retain their own vendor account/key semantics. */
+    account(field?: string): Promise<string>;
     /** The World's machine pool (machines.ts), as the pack's `machine-pool` door enrolled it; `none` when none was. */
     machines: MachinePool;
     /** A signing key pair for `label` (an issuer's ID tokens, a provider's JWTs, a CA's or a log's key), PEM: RSA 2048
@@ -1031,7 +1038,8 @@ export type SemanticsContext = {
     create(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string): Promise<Record<string, unknown>>;
     /** Create under declared unique keys and the action lock; a collision returns the existing own-field view without a write. */
     createUnique(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string, options?: {
-        input: 'omit';
+        input?: 'omit';
+        id?: string;
     }): Promise<{
         created: boolean;
         row: Record<string, unknown>;