@volter/world-core 3.0.161 → 3.0.163

package/dist/generated/pack-facts.json

@@ -25,6 +25,9 @@
       "resources": [],
       "endpointEnvNone": "@ai-sdk/gateway calls https://ai-gateway.vercel.sh/v4/ai and an OpenAI client is given https://ai-gateway.vercel.sh/v1 in code; the World claims the host",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -110,6 +113,9 @@
         "note": "the SDKs' base URL (the TypeScript and Python SDKs and Claude Code read ANTHROPIC_BASE_URL)"
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -174,6 +180,9 @@
         "note": "The AWS SDKs read AWS_ENDPOINT_URL as every service's endpoint (https://docs.aws.amazon.com/sdkref/latest/guide/feature-ss-endpoints.html)."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -360,6 +369,9 @@
       "credentialDoor": {
         "path": "/_twin/app-credentials",
         "body": {},
+        "account": {
+          "field": "account"
+        },
         "fill": {
           "CLERK_SECRET_KEY": "secret_key",
           "CLERK_API_KEY": "secret_key",
@@ -782,6 +794,9 @@
         "note": "Python e2b 2.45.0 and the JS SDK read E2B_API_URL; the JS SDK reads E2B_SANDBOX_URL and sends sandbox id/port headers; vendor hosts route through the World proxy"
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/teams",
         "body": {
           "name": "World team"
@@ -1003,6 +1018,9 @@
         "note": "Google GenAI SDK reads this base URL; other callers retain the routed vendor host."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1079,6 +1097,9 @@
         "app"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1213,6 +1234,9 @@
       ],
       "endpointEnvNone": "Google's OAuth libraries read no base-URL variable: the endpoints are the discovery document's, claimed by the host rules.",
       "credentialDoor": {
+        "account": {
+          "field": "world_account"
+        },
         "path": "/_twin/credentials",
         "body": {
           "client_email": "world@world-project.iam.gserviceaccount.com",
@@ -1657,11 +1681,20 @@
       "endpointEnv": {
         "name": "LIVEKIT_URL",
         "templates": {
-          "LIVEKIT_URL": "ws://${host}:${port}",
-          "LIVEKIT_API_KEY": "twin-livekit-key",
-          "LIVEKIT_API_SECRET": "twin-livekit-secret-for-the-worlds-own-server"
+          "LIVEKIT_URL": "ws://${host}:${port}"
         },
-        "note": "Credentials and URL are the same ones the World starts its LiveKit server with."
+        "note": "The native server uses a private key; its twin front accepts only keys issued for retained World accounts."
+      },
+      "credentialDoor": {
+        "path": "/_twin/app-credentials",
+        "body": {},
+        "account": {
+          "field": "account"
+        },
+        "fill": {
+          "LIVEKIT_API_KEY": "api_key",
+          "LIVEKIT_API_SECRET": "api_secret"
+        }
       },
       "sidePorts": [
         {
@@ -1696,6 +1729,9 @@
       "resources": [],
       "endpointEnvNone": "Open Autonomy reads MODEL_GATEWAY_URL and defaults to api-gateway.merge.dev; the World claims the host",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/organizations",
         "body": {},
         "fill": {
@@ -1734,6 +1770,9 @@
       "resources": [],
       "endpointEnvNone": "the SDKs call https://api.mistral.ai/v1 unless given a base URL in code or config; the World claims the host",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1808,6 +1847,9 @@
         "note": "npm and bun read the registry from npm_config_registry (and .npmrc's `registry`)."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1871,6 +1913,9 @@
         "api_key"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -1982,6 +2027,9 @@
         "note": "the twin's own URL; applications reach it at <region>.connect.psdb.cloud, which the injector redirects, with the password the credentialDoor issued."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {
           "organization": "world",
@@ -2306,6 +2354,9 @@
         "received"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -2377,6 +2428,9 @@
       ],
       "endpointEnvNone": "an SDK sends to its DSN's host and sentry-cli to SENTRY_URL (sentry.io by default); the DSN the World issues names the World's ingest host, claimed by the host rules",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -2485,6 +2539,9 @@
         "app"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -2602,6 +2659,9 @@
       "credentialDoor": {
         "path": "/_twin/app-credentials",
         "body": {},
+        "account": {
+          "field": "account"
+        },
         "fill": {
           "STRIPE_SECRET_KEY": "secret_key",
           "STRIPE_API_KEY": "secret_key",
@@ -2675,7 +2735,11 @@
       "managedDatabase": {
         "kind": "postgres",
         "arg": "--database",
-        "note": "the project's database is the World's managed postgres: the database the application's migrations and queries use, whose URL the credential door answers"
+        "user": "world",
+        "database": "world",
+        "clock": "wall",
+        "credentialField": "database_url",
+        "note": "the selected Supabase twin owns its private PostgreSQL data plane; the credential door answers its URL, application migrations own application tables, and SQL uses wall time"
       },
       "serveExport": "createSupabaseTwinServer"
     },
@@ -2886,6 +2950,9 @@
       ],
       "endpointEnvNone": "Tinybird's clients take the API host as configuration (@chronark/zod-bird's baseUrl, tinybird-cli's --host), defaulting to https://api.tinybird.co, which the World routes by host; no SDK reads a base-URL variable of its own",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -3205,6 +3272,9 @@
         "note": "Redis reads its REST URL; QStash and Workflow read QSTASH_URL. Direct SDK transports use the twin endpoint and issued token; other clients also use host routing."
       },
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {
           "owner": "owner@world.test"
@@ -3270,6 +3340,9 @@
       ],
       "endpointEnvNone": "the applications reach api.vercel.com and the Edge Config connection string's host, which the World routes to the twin",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {
           "team": "world",
@@ -3508,6 +3581,9 @@
         "upload"
       ],
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {
@@ -3546,6 +3622,9 @@
       "resources": [],
       "endpointEnvNone": "the SDK calls https://api.x.ai/v1 unless given a base URL in code; the World claims the host",
       "credentialDoor": {
+        "account": {
+          "field": "account"
+        },
         "path": "/_twin/app-credentials",
         "body": {},
         "fill": {

package/dist/inject.cjs

@@ -358,8 +358,8 @@ function strictEgressEnabled() {
 }
 
 // THE WORLD'S DECISION (docs/contributing/architecture.md, "Capability decisions"): every seam below asks
-// capability-decision.cjs and enforces its answer. This process is a host process, whose declaration is the open one; a
-// local light guest, whose HTTP leaves through its guest listener; or a process of an image run, which carries its
+// capability-decision.cjs and enforces its answer. This process is a host process, whose declaration is the open one; or
+// a process of an image run, which carries its
 // image's declaration (VOLTER_WORLD_DECLARATION) and is confined from the host's network. What the World grants is its
 // published policy. The seams supply what they observe: the twin route, the vendors sharing a host, the World's doors.
 function worldGrant() {

package/dist/src/derived-core.d.ts

@@ -15,7 +15,7 @@ import { type MultipartPart } from './multipart.js';
 import type { CorsDecl } from './cors.js';
 import { type TwinAction } from './actions.js';
 import type { DerivedCall, DerivedCoreOutcome, DerivedHandler, DerivedOperation } from './derived.js';
-import type { PackDescriptor } from './packRegistry.js';
+import { type PackDescriptor } from './packRegistry.js';
 import type { ScenarioDecision, ScenarioHandler } from './scenario.js';
 /** How a stored field gets its value when the server assigns it. `now` is the world clock in the
  *  manifest's time format; `id` the subject's id; a `value` is stored as given. */
@@ -783,6 +783,7 @@ export type DerivedManifest = {
      *  read, list, update and delete by it and stamps it on every create, for each resource not `shared`. */
     tenant?: {
         field: string;
+        storage?: 'namespaced';
     };
     /** The vendor's own lanes behind this manifest's API ("Other wires: lanes"), dispatched by the kernel before the
      *  vendor's own doors, clock and API (LanesDecl). */
@@ -916,6 +917,22 @@ export type CoreScope = {
     /** the application a walk stands in for: what the vendor asks it (`ctx.ask`) is answered by it (events.ts) */
     application?: ApplicationStandIn;
 };
+/** World-owned generated values use the same private seed and log as pack secrets. */
+export declare function worldSecret(service: string, root: string, label: string, at?: string): Promise<string>;
+/** The same retained account primitive for pack doors and private native twin fronts. */
+export declare function worldAccount(service: string, root: string | undefined, id?: unknown, at?: string, provisioning?: boolean): Promise<string>;
+type WorldOrganization = {
+    id: string;
+    label: string;
+    members: string[];
+};
+type VendorNameRule = {
+    max: number;
+    lower?: boolean;
+    allowed: RegExp;
+    separator?: string;
+    first?: RegExp;
+};
 /** The lane a vendor's router sent a request to (pack-fetch's laneRouter sets it). */
 export declare const LANE_HEADER = "x-volter-lane";
 /** What a coverage measurement sees of a pack's declared state logic: each move a request made and each refusal a
@@ -1011,6 +1028,29 @@ export type SemanticsContext = {
      *  random, and keeps as bookkeeping no door answers. The same label gives the same secret for the World's whole life,
      *  and no one can compute it from ids the World shows, as they can a value derived from them alone. */
     secret(label: string): Promise<string>;
+    /** Select an account at a pack's credential door. Packs retain their own vendor account/key semantics. */
+    account(field?: string): Promise<string>;
+    /** The selected organization's label and people from the World's organization registry. */
+    organization(): Promise<WorldOrganization>;
+    /** The selected deployment, or an empty string for the organization's own level. */
+    deployment(): string;
+    /** A vendor-safe label; retained links keep identity independent of names. */
+    vendorName(label: string, rule: VendorNameRule, options?: {
+        suffixed?: boolean;
+        identity?: string;
+    }): string;
+    /** Retain the native customer tenant for the selected organization. */
+    tenant(resource: string, make: (organization: WorldOrganization) => Promise<string>): Promise<Record<string, unknown>>;
+    /** Retain one native resource of this kind for the selected organization and deployment. */
+    deploymentObject(kind: string, resource: string, make: (deployment: string) => Promise<string>): Promise<Record<string, unknown>>;
+    /** Reconstruct a live native key, replacing its link when the vendor's reader refuses it. */
+    accountKey(purpose: string, resource: string, key: {
+        make: () => Promise<string>;
+        read: (row: Record<string, unknown>) => Promise<string | undefined>;
+    }): Promise<{
+        id: string;
+        secret: string;
+    }>;
     /** The World's machine pool (machines.ts), as the pack's `machine-pool` door enrolled it; `none` when none was. */
     machines: MachinePool;
     /** A signing key pair for `label` (an issuer's ID tokens, a provider's JWTs, a CA's or a log's key), PEM: RSA 2048
@@ -1031,7 +1071,8 @@ export type SemanticsContext = {
     create(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string): Promise<Record<string, unknown>>;
     /** Create under declared unique keys and the action lock; a collision returns the existing own-field view without a write. */
     createUnique(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string, options?: {
-        input: 'omit';
+        input?: 'omit';
+        id?: string;
     }): Promise<{
         created: boolean;
         row: Record<string, unknown>;
@@ -1211,7 +1252,7 @@ export type HandlerContext = Omit<SemanticsContext, 'now' | 'core' | 'atomically
 };
 /** What a write hook reads: the writing call's context without its ways to write, so a hook that renders an event
  *  cannot write again (and run itself again). */
-export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'at' | 'over'>;
+export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'tenant' | 'deploymentObject' | 'accountKey' | 'at' | 'over'>;
 /** A derived pack's handler: one operation, by its operationId, over the contract's context. */
 export type Handler = (ctx: HandlerContext) => Promise<Response>;
 export declare function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScope): Promise<SemanticsContext>;