@volter/world-core 3.0.31 → 3.0.33

package/dist/src/browser.js

@@ -3,6 +3,67 @@ import { assertBrowserName, browserOrigin, validateBrowserState } from "./browse
 import { nodeBuiltin } from "./serve-http.js";
 import { worldNow } from "./world-clock.js";
 export { cookieMatchesHost } from "./browser-state.js";
+/** Undo the request's path mount before its answer reaches a vendor-addressed client. */
+function vendorResponse(response, vendor, twin, mount) {
+    if (!mount)
+        return response;
+    const pathAtVendor = (path) => path === mount ? '/' : path.startsWith(`${mount}/`) ? path.slice(mount.length) : path;
+    const urlAtVendor = (value) => {
+        if (!value.trim())
+            return value;
+        let at;
+        try {
+            at = new URL(value, twin);
+        }
+        catch {
+            return value;
+        }
+        if (at.origin !== twin.origin && at.origin !== vendor.origin)
+            return value;
+        const path = pathAtVendor(at.pathname);
+        if (path === at.pathname)
+            return value;
+        const tail = `${path}${at.search}${at.hash}`;
+        return /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(value.trim()) ? `${vendor.origin}${tail}` : tail;
+    };
+    const headers = new Headers(response.headers);
+    let changed = false;
+    const cookies = response.headers.getSetCookie();
+    const mapped = cookies.map(cookie => cookie.replace(/(;\s*path\s*=)([^;]*)/gi, (attribute, lead, path) => {
+        const at = pathAtVendor(path.trim());
+        return at === path.trim() ? attribute : `${lead}${at}`;
+    }));
+    if (mapped.some((cookie, i) => cookie !== cookies[i])) {
+        headers.delete('set-cookie');
+        for (const cookie of mapped)
+            headers.append('set-cookie', cookie);
+        changed = true;
+    }
+    for (const name of ['location', 'content-location']) {
+        const value = headers.get(name);
+        if (value === null)
+            continue;
+        const at = urlAtVendor(value);
+        if (at !== value) {
+            headers.set(name, at);
+            changed = true;
+        }
+    }
+    const refresh = headers.get('refresh');
+    if (refresh !== null) {
+        const parts = /^(\s*\d+(?:\.\d+)?\s*[;,]\s*(?:url\s*=\s*)?)(?:"([^"]*)"|'([^']*)'|([^"']*?))(\s*)$/i.exec(refresh);
+        if (parts) {
+            const value = parts[2] ?? parts[3] ?? parts[4];
+            const at = urlAtVendor(value);
+            if (at !== value) {
+                const quote = parts[2] !== undefined ? '"' : parts[3] !== undefined ? "'" : '';
+                headers.set('refresh', `${parts[1]}${quote}${at}${quote}${parts[5]}`);
+                changed = true;
+            }
+        }
+    }
+    return changed ? new Response(response.body, { status: response.status, statusText: response.statusText, headers }) : response;
+}
 /** A seed's named browser. Every state write goes through the World's single HTTP loader. */
 export async function browser(name) {
     assertBrowserName(name);
@@ -91,20 +152,21 @@ export async function browser(name) {
                 if (!target || target.vendor === 'app')
                     throw new Error(`browser ${name}: no twin in this World serves ${url.hostname}${url.pathname}`);
                 const at = new URL(target.origin);
-                at.pathname = `${at.pathname.replace(/\/$/, '')}${url.pathname}`;
+                const mount = at.pathname.replace(/\/+$/, '');
+                at.pathname = `${mount}${url.pathname}`;
                 at.search = url.search;
                 const sent = new Headers(headers);
                 const cookies = jar.header(url, new Date(worldNow()).getTime());
                 if (cookies)
                     sent.set('cookie', cookies);
-                sent.set('host', new URL(target.origin).pathname.replace(/\/$/, '') ? at.host : url.host);
+                sent.set('host', mount ? at.host : url.host);
                 sent.set('x-volter-twin-original-host', url.host);
                 sent.set('x-forwarded-host', url.host);
                 sent.set('x-forwarded-proto', url.protocol.slice(0, -1));
                 if (process.env.VOLTER_TWINS_KEY)
                     sent.set('x-twins-key', process.env.VOLTER_TWINS_KEY);
                 const before = JSON.stringify(snapshot());
-                const response = await fetch(at, { method, headers: sent, body, redirect: 'manual', signal: request.signal });
+                const response = vendorResponse(await fetch(at, { method, headers: sent, body, redirect: 'manual', signal: request.signal }), url, at, mount);
                 for (const cookie of response.headers.getSetCookie())
                     jar.set(cookie, url, new Date(worldNow()).getTime());
                 if (JSON.stringify(snapshot()) !== before)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "3.0.31",
+  "version": "3.0.33",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",

package/src/browser.ts

@@ -11,6 +11,54 @@ export type SeedBrowser = {
   state(): Promise<BrowserState>;
 };
 
+/** Undo the request's path mount before its answer reaches a vendor-addressed client. */
+function vendorResponse(response: Response, vendor: URL, twin: URL, mount: string): Response {
+  if (!mount) return response;
+  const pathAtVendor = (path: string): string => path === mount ? '/' : path.startsWith(`${mount}/`) ? path.slice(mount.length) : path;
+  const urlAtVendor = (value: string): string => {
+    if (!value.trim()) return value;
+    let at: URL;
+    try { at = new URL(value, twin); } catch { return value; }
+    if (at.origin !== twin.origin && at.origin !== vendor.origin) return value;
+    const path = pathAtVendor(at.pathname);
+    if (path === at.pathname) return value;
+    const tail = `${path}${at.search}${at.hash}`;
+    return /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(value.trim()) ? `${vendor.origin}${tail}` : tail;
+  };
+  const headers = new Headers(response.headers);
+  let changed = false;
+  const cookies = response.headers.getSetCookie();
+  const mapped = cookies.map(cookie => cookie.replace(/(;\s*path\s*=)([^;]*)/gi, (attribute, lead: string, path: string) => {
+    const at = pathAtVendor(path.trim());
+    return at === path.trim() ? attribute : `${lead}${at}`;
+  }));
+  if (mapped.some((cookie, i) => cookie !== cookies[i])) {
+    headers.delete('set-cookie');
+    for (const cookie of mapped) headers.append('set-cookie', cookie);
+    changed = true;
+  }
+  for (const name of ['location', 'content-location']) {
+    const value = headers.get(name);
+    if (value === null) continue;
+    const at = urlAtVendor(value);
+    if (at !== value) { headers.set(name, at); changed = true; }
+  }
+  const refresh = headers.get('refresh');
+  if (refresh !== null) {
+    const parts = /^(\s*\d+(?:\.\d+)?\s*[;,]\s*(?:url\s*=\s*)?)(?:"([^"]*)"|'([^']*)'|([^"']*?))(\s*)$/i.exec(refresh);
+    if (parts) {
+      const value = parts[2] ?? parts[3] ?? parts[4]!;
+      const at = urlAtVendor(value);
+      if (at !== value) {
+        const quote = parts[2] !== undefined ? '"' : parts[3] !== undefined ? "'" : '';
+        headers.set('refresh', `${parts[1]}${quote}${at}${quote}${parts[5]}`);
+        changed = true;
+      }
+    }
+  }
+  return changed ? new Response(response.body, { status: response.status, statusText: response.statusText, headers }) : response;
+}
+
 /** A seed's named browser. Every state write goes through the World's single HTTP loader. */
 export async function browser(name: string): Promise<SeedBrowser> {
   assertBrowserName(name);
@@ -83,18 +131,19 @@ export async function browser(name: string): Promise<SeedBrowser> {
         const target = await resolve(url);
         if (!target || target.vendor === 'app') throw new Error(`browser ${name}: no twin in this World serves ${url.hostname}${url.pathname}`);
         const at = new URL(target.origin);
-        at.pathname = `${at.pathname.replace(/\/$/, '')}${url.pathname}`;
+        const mount = at.pathname.replace(/\/+$/, '');
+        at.pathname = `${mount}${url.pathname}`;
         at.search = url.search;
         const sent = new Headers(headers);
         const cookies = jar.header(url, new Date(worldNow()).getTime());
         if (cookies) sent.set('cookie', cookies);
-        sent.set('host', new URL(target.origin).pathname.replace(/\/$/, '') ? at.host : url.host);
+        sent.set('host', mount ? at.host : url.host);
         sent.set('x-volter-twin-original-host', url.host);
         sent.set('x-forwarded-host', url.host);
         sent.set('x-forwarded-proto', url.protocol.slice(0, -1));
         if (process.env.VOLTER_TWINS_KEY) sent.set('x-twins-key', process.env.VOLTER_TWINS_KEY);
         const before = JSON.stringify(snapshot());
-        const response = await fetch(at, { method, headers: sent, body, redirect: 'manual', signal: request.signal });
+        const response = vendorResponse(await fetch(at, { method, headers: sent, body, redirect: 'manual', signal: request.signal }), url, at, mount);
         for (const cookie of response.headers.getSetCookie()) jar.set(cookie, url, new Date(worldNow()).getTime());
         if (JSON.stringify(snapshot()) !== before) await save();
         const location = response.headers.get('location');