@volter/world-core 3.0.30 → 3.0.32

package/dist/src/derived-core.d.ts

@@ -268,7 +268,6 @@ export type VendorManifest = {
     descriptor: Omit<PackDescriptor, 'vendor'>;
     ingest?: IngestDecl;
     rateBudget?: RateBudgetDeclaration;
-    browserSession?: DerivedManifest['browserSession'];
     /** the vendor has no vendor-backed half (architecture, "The descriptor"): packOf copies it, and derives no state system */
     vendorBacked?: DerivedManifest['vendorBacked'];
 };
@@ -544,11 +543,6 @@ export type DerivedManifest = {
         owner: string;
         resource: string;
     }>;
-    /** The browser session of a World's person, issued with world-ui's kit. Declaring it lets the World offer View as. */
-    browserSession?: {
-        cookie: string;
-        scope?: string;
-    };
     /** the vendor's screens this pack serves or owes (demand decides which exist) */
     screens?: ScreenDecl[];
     /** The discovery door's facts (`GET /twin`): what the twin is of, what it stores, and how it is authenticated. */
@@ -689,8 +683,10 @@ export declare function render(r: TwinResource): Record<string, unknown>;
  *  a caller that pins an instant passes its own). */
 /** One call of a protocol-3 pack's default data (`src/semantics/seed.ts` exports `seed: SeedCall[]`): a request to the
  *  vendor's own operation (or the pack's door), made in order against the twin by the runner `volter-world init` writes
- *  beside the copied data. */
+ *  beside the copied data. An ordinary path is relative to the twin base. A call naming a browser uses the
+ *  vendor's absolute URL and is exported separately as `browserSeed`, after the ordinary `seed` calls. */
 export type SeedCall = {
+    browser?: string;
     method: string;
     path: string;
     body?: unknown;

package/dist/src/derived.d.ts

@@ -125,6 +125,7 @@ export type DerivedFetch = ((request: Request) => Promise<Response>) & {
 export type Workspace = {
     id: string;
     path: string;
+    host?: string;
 };
 /** A page of the World's board (architecture, "The board"): a page there is to see at the vendor, a record's own (an
  *  account's profile, each of its posts, a site and each page it serves), as the vendor's pack lists them from its state

package/dist/src/index.d.ts

@@ -65,3 +65,4 @@ export * as git from './git/index.js';
 export { parseScenarioDocument, scenarioFaultResult, ScenarioEngine, ScenarioError } from './scenario.js';
 export type { PackScenarioAdapter, ScenarioDecision, ScenarioDocument, ScenarioExtractorSpec, ScenarioFault, ScenarioFaultResult, ScenarioFeatures, ScenarioHandler, ScenarioMatcher, ScenarioMissRecord, ScenarioStatus } from './scenario.js';
 export { browserSessionToken, startBrowserSession, endBrowserSession } from './browser-session.js';
+export { assertBrowserName, browserOrigin, validateBrowserState, cookieMatchesHost, type BrowserCookie, type BrowserState, type BrowserIndexedDB } from './browser-state.js';

package/dist/src/index.js

@@ -60,3 +60,4 @@ export * as git from "./git/index.js";
 // ── the scenario grammar (architecture, "Behaviour") ───────────────────────────────────────────
 export { parseScenarioDocument, scenarioFaultResult, ScenarioEngine, ScenarioError } from "./scenario.js";
 export { browserSessionToken, startBrowserSession, endBrowserSession } from "./browser-session.js";
+export { assertBrowserName, browserOrigin, validateBrowserState, cookieMatchesHost } from "./browser-state.js";

package/dist/src/pack-fetch.d.ts

@@ -56,12 +56,9 @@ export type LanePart = {
     fetch: ((request: Request) => Promise<Response>) & {
         serves?: (method: string, path: string) => boolean;
         boards?: boolean;
-        drawsScreens?: boolean;
         draws?: (url: string) => boolean;
         /** the hosts the lane's built content screens name: its vendor's router sends `<base>/@<host>/` there */
         contentHosts?: ReadonlyArray<string>;
-        /** A vendor's browser session applies to its lanes without a lane importing its parent's manifest. */
-        sessionDeclaration?: (session: NonNullable<DerivedManifest['browserSession']>) => void;
     };
     manifest: {
         doors?: ReadonlyArray<{

package/dist/src/pack-fetch.js

@@ -5,8 +5,6 @@
 // `screens/<id>.tsx`), and the API (the derived dispatch over the generated surface, the handlers and the core). Every
 // one of them is answered over the contract's context, which the kernel opens: a pack opens none, reads the tree and
 // writes it only through one.
-import { startBrowserSession, endBrowserSession } from "./browser-session.js";
-import { BROWSER_SESSION_PATH, takeBrowserSessionPermit } from "./browser-session-permit.js";
 import { ORIGINAL_PATH_HEADER } from "./sigv4.js";
 import { placedCookies, TWIN_PREFIX_HEADER } from "./twin-fetch.js";
 import { PREFIX_PARAMS_HEADER } from "./derived.js";
@@ -21,7 +19,7 @@ import { deferPerform, performRequestGroup, RefusedWriteError, VendorWriteError
 import { withCors } from "./cors.js";
 import { contentAddressOf } from "./content-route.js";
 import { getPack } from "./packRegistry.js";
-import { hostRules } from '../vendor-hosts.cjs';
+import { hostRules } from '../host-routing.cjs';
 import { socketUpgrade } from "./sockets.js";
 import { MACHINE_POOL, POOL_KINDS } from "./machines.js";
 import { applyTwinWrite } from "./serve.js";
@@ -112,7 +110,6 @@ async function encoded(m, request, res) {
 /** A pack's HTTP surface, as the kernel serves it from the pack's parts. */
 export function createPackFetch(parts, options = {}) {
     const m = parts.manifest;
-    let browserSession = m.browserSession;
     const scope = {
         ...(options.root !== undefined ? { root: options.root } : {}),
         ...(options.clock ? { clock: options.clock } : {}),
@@ -223,7 +220,7 @@ export function createPackFetch(parts, options = {}) {
     });
     // the workspaces a person can be shown (Viewing a World): each built workspace screen's id and path, the pack's own
     // and its lanes'
-    const workspaces = () => [...(m.screens ?? []).filter((s) => s.kind === 'workspace' && s.status === 'done' && parts.screens?.[s.id]).map((s) => ({ id: s.id, path: s.path })), ...lanesWorkspaces(parts.lanes ?? {})];
+    const workspaces = () => [...(m.screens ?? []).filter((s) => s.kind === 'workspace' && s.status === 'done' && parts.screens?.[s.id]).map((s) => ({ id: s.id, path: s.path, host: s.host })), ...lanesWorkspaces(parts.lanes ?? {})];
     /** Whether a built screen a person views (a workspace or a flow, never content an API client reads) draws a url: its host
      *  one the screen names, its path the screen's or under it (a root screen draws its root alone). */
     // by what the pack declares built (a screen drawn by another's handler, as X's profile is by its web pages, is built)
@@ -231,7 +228,6 @@ export function createPackFetch(parts, options = {}) {
         const hosts = [s.host, ...(s.hosts ?? [])].map(hostMatcher);
         return { root: s.path.replace(/\/+$/, '') === '', host: (h) => hosts.some((match) => match(h)), path: pathMatcher(s.path, true) };
     });
-    const drawsScreens = viewed.length > 0 || Object.values(parts.lanes ?? {}).some((l) => l.fetch.drawsScreens);
     const drawsUrl = (at) => {
         try {
             const u = new URL(at);
@@ -381,7 +377,7 @@ export function createPackFetch(parts, options = {}) {
         if (request.method === 'GET' && path === '/twin' && m.discovery) {
             const d = m.discovery;
             // the workspaces a person can be shown (Viewing a World): each built workspace screen's id and path
-            const shown = { drawsScreens, ...(workspaces().length ? { screens: workspaces() } : {}), ...(browserSession ? { browserSession } : {}) };
+            const shown = workspaces().length ? { screens: workspaces() } : {};
             // a model vendor's: its state, and what its scenario scripts, with the scenario's live counts
             if (parts.scenario && d.behavior) {
                 return Response.json({ ...shown, ...twinManifest({
@@ -399,20 +395,6 @@ export function createPackFetch(parts, options = {}) {
         // header would make a payout time makes the caller's), but a tenant's, when the vendor keeps tenants apart
         if (parts.clock)
             await runAsVendorMove(async () => parts.clock(await open(new Request(request.url, m.tenant ? { headers: request.headers } : {}), 'clock', 'POST', '/_twin/clock', {})));
-        if (path === BROWSER_SESSION_PATH && browserSession) {
-            if (request.method !== 'POST' || readOnly)
-                return Response.json({ error: 'a browser session needs a permitted write' }, { status: 403 });
-            const choice = takeBrowserSessionPermit(request, m.service, options.root);
-            if (!choice)
-                return Response.json({ error: 'only the World can change this browser session' }, { status: 403 });
-            const ctx = await open(request, 'browser-session', 'POST', BROWSER_SESSION_PATH, {});
-            const person = choice.person === null ? null : ctx.rowsRaw('_person').find((p) => p.id === choice.person && typeof p.email === 'string');
-            if (person === undefined)
-                return Response.json({ error: 'that person is no longer in the World' }, { status: 404 });
-            const cleared = await endBrowserSession(ctx, browserSession.cookie);
-            const cookie = person ? await startBrowserSession(ctx, String(person.email), browserSession.cookie, browserSession.scope) : cleared;
-            return new Response(null, { status: 303, headers: { location: choice.land, 'set-cookie': cookie } });
-        }
         if (path.startsWith('/_twin/')) {
             // the World's machine pool, enrolled by the kernel for a vendor that runs images (machines.ts)
             if (m.machines && path === '/_twin/machine-pool' && request.method === 'POST') {
@@ -531,7 +513,7 @@ export function createPackFetch(parts, options = {}) {
     async (asked) => engineOf()?.serve(asked)) : undefined;
     // what serves each operation: the pack's own, and each lane's
     const owners = () => ({ ...api.owners(), ...lanesOwners(parts.lanes ?? {}) });
-    return derivedRequestScopes(m, Object.assign(served, { sessionDeclaration: (session) => { browserSession ??= session; }, owners, serves, workspaces, boards: Boolean(parts.board), drawsScreens, draws: drawsUrl, contentHosts, ...(upgrade ? { upgrade } : {}) }));
+    return derivedRequestScopes(m, Object.assign(served, { owners, serves, workspaces, boards: Boolean(parts.board), draws: drawsUrl, contentHosts, ...(upgrade ? { upgrade } : {}) }));
 }
 /** The vendor's gateway over its lanes: the lane a request goes to (a door to the lane that declares it, then the first
  *  route whose conditions all hold, then the default), behind the gateway's CORS; undefined when none takes it. */
@@ -591,9 +573,6 @@ const lanesOwners = (lanes) => Object.assign({}, ...Object.values(lanes).map((l)
 /** The workspaces a vendor's lanes draw, as one list. */
 const lanesWorkspaces = (lanes) => Object.values(lanes).flatMap((l) => l.fetch.workspaces?.() ?? []);
 export function createVendorFetch(manifest, lanes) {
-    if (manifest.browserSession)
-        for (const part of Object.values(lanes))
-            part.fetch.sessionDeclaration?.(manifest.browserSession);
     const lane = laneRouter(manifest.vendor, manifest.lanes, lanes);
     return Object.assign(async (request) => {
         const path = new URL(request.url).pathname.replace(/\/+$/, '') || '/';
@@ -616,7 +595,7 @@ export function createVendorFetch(manifest, lanes) {
         if (request.method === 'GET' && path === '/twin' && manifest.discovery) {
             // the vendor's screens are its lanes' (a dashboard drawn by one lane is the vendor's)
             const screens = lanesWorkspaces(lanes);
-            return Response.json({ ...statefulTwinManifest({ vendor: manifest.vendor, ...manifest.discovery }), drawsScreens: Object.values(lanes).some((l) => l.fetch.drawsScreens), ...(manifest.browserSession ? { browserSession: manifest.browserSession } : {}), ...(screens.length ? { screens } : {}) });
+            return Response.json({ ...statefulTwinManifest({ vendor: manifest.vendor, ...manifest.discovery }), ...(screens.length ? { screens } : {}) });
         }
         const to = lane(request);
         return to ? to(request) : Response.json({ error: `${manifest.vendor}: no lane serves ${request.method} ${path}` }, { status: 404 });