@volter/world-core 3.0.20 → 3.0.21

package/dist/inject.cjs

@@ -21,7 +21,13 @@
 // (stripe-node → https; @octokit → fetch; @slack/web-api & jira.js → axios →
 // http/https; @linear/sdk → fetch), so no per-SDK shim is needed.
 //
-// A client can still open its own sockets (npm `undici`'s Agent, which
+// Attached to a World (VOLTER_WORLD), a request a bundled undici (wrangler's) sends to the
+// World's own paths through undici's shared global dispatcher carries the World's key too:
+// Object.defineProperty is watched for that global, and the dispatcher set there is stood
+// in for by a view whose dispatch keys a hop whose origin and path are the World's
+// (keyedView, below), sent with maxRedirections 0 so no follower below it takes the key on.
+//
+// A client can still open its own sockets (npm `undici`'s own Agent, which
 // @turbopuffer/turbopuffer uses under Node, honours neither patch nor HTTPS_PROXY).
 // `net.connect`/`tls.connect` are the seam every Node client ends at, so they carry
 // the backstop: a connect to a twinned vendor host went around the rewrite and is
@@ -435,6 +441,74 @@ function withWorldKey(args) {
   return out;
 }
 
+// A client that bundles its own undici (wrangler) calls neither the global `fetch` nor http(s), so its requests to the
+// World's own paths would arrive without the key. Every undici copy, Node's own included, keeps its dispatcher on one
+// shared global (`Symbol.for('undici.globalDispatcher.<n>')`), set with Object.defineProperty when that copy loads. A
+// dispatcher defined there is stood in for by a view of it whose `dispatch` adds the key to one hop, only when that
+// hop's origin is the World's and its path one of the World's own, compared as strings (a path is never resolved as a
+// URL, so `//other-host/…` names no other origin); the dispatcher itself is never changed, and restore() puts it back.
+const UNDICI_DISPATCHERS = [Symbol.for('undici.globalDispatcher.1'), Symbol.for('undici.globalDispatcher.2')];
+const KEYED_VIEWS = new WeakMap(); // view -> the dispatcher it stands in for
+function keyedUndiciHeaders(headers, key) {
+  if (headers == null) return { 'x-twins-key': key };
+  if (Array.isArray(headers)) {
+    const flat = headers.length === 0 || !Array.isArray(headers[0]);
+    const names = flat ? headers.filter((_, i) => i % 2 === 0) : headers.map((h) => h[0]);
+    if (names.some((n) => String(n).toLowerCase() === 'x-twins-key')) return headers;
+    return flat ? [...headers, 'x-twins-key', key] : [...headers, ['x-twins-key', key]];
+  }
+  const entries = typeof headers[Symbol.iterator] === 'function' ? [...headers] : Object.entries(headers);
+  if (entries.some(([n]) => String(n).toLowerCase() === 'x-twins-key')) return headers;
+  return Object.assign(Object.fromEntries(entries), { 'x-twins-key': key });
+}
+/** A dispatch hop is the World's: its origin is the World's own and its path, as written, under the World's paths. */
+function hopToWorld(opts) {
+  const base = worldBase();
+  if (!base || !base.path || !opts || opts.origin == null) return false;
+  let origin;
+  try { origin = new URL(String(opts.origin)).origin; } catch { return false; }
+  const at = String(opts.path == null ? '/' : opts.path);
+  return origin === base.origin && (at.startsWith(`${base.path}/`) || at.startsWith(`/-${base.path}/`));
+}
+function keyedView(dispatcher) {
+  if (!dispatcher || typeof dispatcher.dispatch !== 'function' || KEYED_VIEWS.has(dispatcher)) return dispatcher;
+  const view = new Proxy(dispatcher, {
+    get(target, name) {
+      if (name === 'dispatch') {
+        return function keyedDispatch(opts, handler) {
+          const key = ORIGINAL_DEFINE_PROPERTY ? twinsKey() : null;
+          // a hop the caller asked undici to follow is not keyed; a keyed hop is sent with maxRedirections 0, so no
+          // redirect follower below this view (a composed interceptor, a RetryAgent or proxy agent around one, undici
+          // 6's option or interceptors) carries its headers to the next origin: the redirect comes back to the caller
+          const keyed = key && !(opts && Number(opts.maxRedirections) > 0) && hopToWorld(opts);
+          return target.dispatch(keyed ? Object.assign({}, opts, { headers: keyedUndiciHeaders(opts.headers, key), maxRedirections: 0 }) : opts, handler);
+        };
+      }
+      const value = Reflect.get(target, name, target);
+      return typeof value === 'function' ? value.bind(target) : value;
+    },
+  });
+  KEYED_VIEWS.set(view, dispatcher);
+  return view;
+}
+let ORIGINAL_DEFINE_PROPERTY = null;
+function keyUndiciDispatches() {
+  if (ORIGINAL_DEFINE_PROPERTY || !worldBase() || Object.defineProperty.name === 'keyingDefineProperty') return;
+  const define = ORIGINAL_DEFINE_PROPERTY = Object.defineProperty;
+  Object.defineProperty = function keyingDefineProperty(target, name, descriptor) {
+    if (ORIGINAL_DEFINE_PROPERTY && target === globalThis && UNDICI_DISPATCHERS.includes(name) && descriptor && 'value' in descriptor) descriptor = Object.assign({}, descriptor, { value: keyedView(descriptor.value) });
+    return define(target, name, descriptor);
+  };
+  for (const name of UNDICI_DISPATCHERS) if (globalThis[name]) globalThis[name] = keyedView(globalThis[name]);
+}
+function unkeyUndiciDispatches() {
+  if (!ORIGINAL_DEFINE_PROPERTY) return;
+  // only what this put in place is put back: a wrapper installed over it since stays
+  if (Object.defineProperty.name === 'keyingDefineProperty') Object.defineProperty = ORIGINAL_DEFINE_PROPERTY;
+  ORIGINAL_DEFINE_PROPERTY = null;
+  for (const name of UNDICI_DISPATCHERS) if (KEYED_VIEWS.has(globalThis[name])) globalThis[name] = KEYED_VIEWS.get(globalThis[name]);
+}
+
 // S4 review F3: undici's default redirect-follow forwards CUSTOM headers across origins — a
 // twin (or the World) answering 30x to an external URL would carry x-twins-key to a REAL host. A
 // keyed fetch follows redirects itself: a hop that is a twin or the World re-enters the patched
@@ -979,6 +1053,7 @@ function install(mapOverride) {
   tls.connect = patchedConnect(ORIGINALS.tlsConnect, true);
   dns.lookup = patchedLookup(ORIGINALS.dnsLookup);
   dns.promises.lookup = patchedPromisesLookup(ORIGINALS.dnsPromisesLookup);
+  keyUndiciDispatches();
   // gRPC (architecture, "Other wires": gRPC): an HTTP/2 session to a host a twin serves (grpc-js on google-gax: TLS to
   // webrisk.googleapis.com) connects to that twin's origin in plain text, where the kernel's HTTP/2 server answers it;
   // the client carries on unchanged. Any other authority is the real one's.
@@ -1139,6 +1214,7 @@ function restore() {
   dns.lookup = ORIGINALS.dnsLookup;
   dns.promises.lookup = ORIGINALS.dnsPromisesLookup;
   http2.connect = ORIGINALS.http2Connect;
+  unkeyUndiciDispatches();
   installed = false;
   MAP = {};
 }

package/inject.cjs

@@ -21,7 +21,13 @@
 // (stripe-node → https; @octokit → fetch; @slack/web-api & jira.js → axios →
 // http/https; @linear/sdk → fetch), so no per-SDK shim is needed.
 //
-// A client can still open its own sockets (npm `undici`'s Agent, which
+// Attached to a World (VOLTER_WORLD), a request a bundled undici (wrangler's) sends to the
+// World's own paths through undici's shared global dispatcher carries the World's key too:
+// Object.defineProperty is watched for that global, and the dispatcher set there is stood
+// in for by a view whose dispatch keys a hop whose origin and path are the World's
+// (keyedView, below), sent with maxRedirections 0 so no follower below it takes the key on.
+//
+// A client can still open its own sockets (npm `undici`'s own Agent, which
 // @turbopuffer/turbopuffer uses under Node, honours neither patch nor HTTPS_PROXY).
 // `net.connect`/`tls.connect` are the seam every Node client ends at, so they carry
 // the backstop: a connect to a twinned vendor host went around the rewrite and is
@@ -435,6 +441,74 @@ function withWorldKey(args) {
   return out;
 }
 
+// A client that bundles its own undici (wrangler) calls neither the global `fetch` nor http(s), so its requests to the
+// World's own paths would arrive without the key. Every undici copy, Node's own included, keeps its dispatcher on one
+// shared global (`Symbol.for('undici.globalDispatcher.<n>')`), set with Object.defineProperty when that copy loads. A
+// dispatcher defined there is stood in for by a view of it whose `dispatch` adds the key to one hop, only when that
+// hop's origin is the World's and its path one of the World's own, compared as strings (a path is never resolved as a
+// URL, so `//other-host/…` names no other origin); the dispatcher itself is never changed, and restore() puts it back.
+const UNDICI_DISPATCHERS = [Symbol.for('undici.globalDispatcher.1'), Symbol.for('undici.globalDispatcher.2')];
+const KEYED_VIEWS = new WeakMap(); // view -> the dispatcher it stands in for
+function keyedUndiciHeaders(headers, key) {
+  if (headers == null) return { 'x-twins-key': key };
+  if (Array.isArray(headers)) {
+    const flat = headers.length === 0 || !Array.isArray(headers[0]);
+    const names = flat ? headers.filter((_, i) => i % 2 === 0) : headers.map((h) => h[0]);
+    if (names.some((n) => String(n).toLowerCase() === 'x-twins-key')) return headers;
+    return flat ? [...headers, 'x-twins-key', key] : [...headers, ['x-twins-key', key]];
+  }
+  const entries = typeof headers[Symbol.iterator] === 'function' ? [...headers] : Object.entries(headers);
+  if (entries.some(([n]) => String(n).toLowerCase() === 'x-twins-key')) return headers;
+  return Object.assign(Object.fromEntries(entries), { 'x-twins-key': key });
+}
+/** A dispatch hop is the World's: its origin is the World's own and its path, as written, under the World's paths. */
+function hopToWorld(opts) {
+  const base = worldBase();
+  if (!base || !base.path || !opts || opts.origin == null) return false;
+  let origin;
+  try { origin = new URL(String(opts.origin)).origin; } catch { return false; }
+  const at = String(opts.path == null ? '/' : opts.path);
+  return origin === base.origin && (at.startsWith(`${base.path}/`) || at.startsWith(`/-${base.path}/`));
+}
+function keyedView(dispatcher) {
+  if (!dispatcher || typeof dispatcher.dispatch !== 'function' || KEYED_VIEWS.has(dispatcher)) return dispatcher;
+  const view = new Proxy(dispatcher, {
+    get(target, name) {
+      if (name === 'dispatch') {
+        return function keyedDispatch(opts, handler) {
+          const key = ORIGINAL_DEFINE_PROPERTY ? twinsKey() : null;
+          // a hop the caller asked undici to follow is not keyed; a keyed hop is sent with maxRedirections 0, so no
+          // redirect follower below this view (a composed interceptor, a RetryAgent or proxy agent around one, undici
+          // 6's option or interceptors) carries its headers to the next origin: the redirect comes back to the caller
+          const keyed = key && !(opts && Number(opts.maxRedirections) > 0) && hopToWorld(opts);
+          return target.dispatch(keyed ? Object.assign({}, opts, { headers: keyedUndiciHeaders(opts.headers, key), maxRedirections: 0 }) : opts, handler);
+        };
+      }
+      const value = Reflect.get(target, name, target);
+      return typeof value === 'function' ? value.bind(target) : value;
+    },
+  });
+  KEYED_VIEWS.set(view, dispatcher);
+  return view;
+}
+let ORIGINAL_DEFINE_PROPERTY = null;
+function keyUndiciDispatches() {
+  if (ORIGINAL_DEFINE_PROPERTY || !worldBase() || Object.defineProperty.name === 'keyingDefineProperty') return;
+  const define = ORIGINAL_DEFINE_PROPERTY = Object.defineProperty;
+  Object.defineProperty = function keyingDefineProperty(target, name, descriptor) {
+    if (ORIGINAL_DEFINE_PROPERTY && target === globalThis && UNDICI_DISPATCHERS.includes(name) && descriptor && 'value' in descriptor) descriptor = Object.assign({}, descriptor, { value: keyedView(descriptor.value) });
+    return define(target, name, descriptor);
+  };
+  for (const name of UNDICI_DISPATCHERS) if (globalThis[name]) globalThis[name] = keyedView(globalThis[name]);
+}
+function unkeyUndiciDispatches() {
+  if (!ORIGINAL_DEFINE_PROPERTY) return;
+  // only what this put in place is put back: a wrapper installed over it since stays
+  if (Object.defineProperty.name === 'keyingDefineProperty') Object.defineProperty = ORIGINAL_DEFINE_PROPERTY;
+  ORIGINAL_DEFINE_PROPERTY = null;
+  for (const name of UNDICI_DISPATCHERS) if (KEYED_VIEWS.has(globalThis[name])) globalThis[name] = KEYED_VIEWS.get(globalThis[name]);
+}
+
 // S4 review F3: undici's default redirect-follow forwards CUSTOM headers across origins — a
 // twin (or the World) answering 30x to an external URL would carry x-twins-key to a REAL host. A
 // keyed fetch follows redirects itself: a hop that is a twin or the World re-enters the patched
@@ -979,6 +1053,7 @@ function install(mapOverride) {
   tls.connect = patchedConnect(ORIGINALS.tlsConnect, true);
   dns.lookup = patchedLookup(ORIGINALS.dnsLookup);
   dns.promises.lookup = patchedPromisesLookup(ORIGINALS.dnsPromisesLookup);
+  keyUndiciDispatches();
   // gRPC (architecture, "Other wires": gRPC): an HTTP/2 session to a host a twin serves (grpc-js on google-gax: TLS to
   // webrisk.googleapis.com) connects to that twin's origin in plain text, where the kernel's HTTP/2 server answers it;
   // the client carries on unchanged. Any other authority is the real one's.
@@ -1139,6 +1214,7 @@ function restore() {
   dns.lookup = ORIGINALS.dnsLookup;
   dns.promises.lookup = ORIGINALS.dnsPromisesLookup;
   http2.connect = ORIGINALS.http2Connect;
+  unkeyUndiciDispatches();
   installed = false;
   MAP = {};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "3.0.20",
+  "version": "3.0.21",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",