@volter/world-core 3.0.38 → 3.0.40

package/dist/src/vendor-call.js

@@ -3,12 +3,21 @@
 // Google's token endpoint — and in a World that other vendor is the World's twin of it. The call is addressed as the
 // vendor's own URL and reaches that twin by the same host rules the injector routes an application by (vendor-hosts.cjs),
 // carrying the World's twins key; a vendor the World runs no twin of is refused, never reached: a twin makes no direct
-// vendor call (simulated execution is deterministic and stays inside the World). This is the one network a handler has;
-// importing this module does nothing.
+// vendor call (simulated execution is deterministic and stays inside the World). A twin this process answers itself (a
+// journey walk's companions, `setInProcessTwins`) is reached first, in process; the instance's twins otherwise. This is
+// the one network a handler has; importing this module does nothing.
 import { twinOrigins, VENDOR_HOSTS } from '../vendor-hosts.cjs';
 /** A call to a vendor the World runs no twin of. */
 export class VendorUnreachableError extends Error {
-    constructor(message) { super(message); this.name = 'VendorUnreachableError'; }
+    constructor(message, options) { super(message, options); this.name = 'VendorUnreachableError'; }
+}
+let inProcessTwins = {};
+/** The twins this process answers itself, by routing key (a key of VENDOR_HOSTS: a journey walk's companions, over the
+ *  walk's own World), consulted before the instance's; returns those set before, which the caller puts back. */
+export function setInProcessTwins(twins) {
+    const previous = inProcessTwins;
+    inProcessTwins = twins;
+    return previous;
 }
 /** The World's twins by vendor: the instance's env (every twin's URL, whenever this process started) over this
  *  process's own. */
@@ -25,17 +34,52 @@ async function worldTwins() {
     }
     return { ...twinOrigins(env), ...twinOrigins(instanceEnv) };
 }
-/** `url`, a vendor's own address, answered by the World's twin of that vendor. */
-export async function vendorFetch(url, init = {}) {
-    const target = new URL(String(url));
+/** One URL answered only by a World-held application or vendor twin: the fetch's application stand-in first (its answer
+ *  is the application's; `'unreachable'` leaves no application to reach, the World's twins still reachable). */
+async function worldResponse(target, init, standIn) {
+    const scripted = await standIn?.(target.toString(), init);
+    if (scripted !== undefined && scripted !== 'unreachable') {
+        // A source may answer its headers then lose its body transport. Preserve that failure until the caller reads.
+        const body = scripted.bodyError === undefined ? scripted.body : new ReadableStream({
+            start(controller) { controller.error(new TypeError(scripted.bodyError)); },
+        });
+        return new Response([204, 205, 304].includes(scripted.status) || init.method === 'HEAD' ? null : body, { status: scripted.status, headers: scripted.headers });
+    }
+    const local = Object.keys(VENDOR_HOSTS).find(v => inProcessTwins[v] !== undefined && VENDOR_HOSTS[v](target.hostname, target.pathname));
+    if (local !== undefined) {
+        const headers = new Headers(init.headers);
+        headers.set('x-volter-twin-original-host', target.host);
+        return inProcessTwins[local](new Request(target, { ...init, headers, redirect: 'manual' }));
+    }
     const twins = await worldTwins();
     const vendor = Object.keys(VENDOR_HOSTS).find((v) => twins[v] !== undefined && VENDOR_HOSTS[v](target.hostname, target.pathname));
-    if (vendor === undefined)
-        throw new VendorUnreachableError(`${target.host}${target.pathname}: this World runs no twin of it, and a twin calls only the World's twins`);
-    const headers = new Headers(init.headers);
-    headers.set('x-volter-twin-original-host', target.host);
-    const key = process.env.VOLTER_TWINS_KEY;
-    if (key && !headers.has('x-twins-key'))
-        headers.set('x-twins-key', key);
-    return fetch(`${twins[vendor].replace(/\/$/, '')}${target.pathname}${target.search}`, { ...init, headers });
+    if (vendor !== undefined) {
+        const headers = new Headers(init.headers);
+        headers.set('x-volter-twin-original-host', target.host);
+        const key = process.env.VOLTER_TWINS_KEY;
+        if (key && !headers.has('x-twins-key'))
+            headers.set('x-twins-key', key);
+        return fetch(`${twins[vendor].replace(/\/$/, '')}${target.pathname}${target.search}`, { ...init, headers, redirect: 'manual' });
+    }
+    const { appDestination, appFetch } = await import('../app-route.cjs');
+    if (scripted !== 'unreachable' && appDestination(target))
+        return appFetch(target, { ...init, redirect: 'manual' });
+    throw new VendorUnreachableError(`${target.host}${target.pathname}: this World holds no application or vendor twin at this URL`);
+}
+/** A vendor URL (or the World's application), including redirects, always answered inside the World; `standIn` is the
+ *  calling fetch's application stand-in (PackFetchOptions.application), consulted at every hop. */
+export async function vendorFetch(url, init = {}, standIn) {
+    const { followRedirects } = await import('../app-route.cjs');
+    try {
+        return await followRedirects(url, init, async (target, request) => {
+            if (!['http:', 'https:'].includes(target.protocol))
+                throw new VendorUnreachableError(`A twin cannot fetch ${target.protocol} URLs`);
+            return worldResponse(target, request, standIn);
+        }, ['x-twins-key', 'x-volter-twin-original-host']);
+    }
+    catch (error) {
+        if (error instanceof VendorUnreachableError)
+            throw error;
+        throw new VendorUnreachableError(error instanceof Error ? error.message : String(error), { cause: error });
+    }
 }

package/dist/test-fixtures/attestation.SOURCE.md

@@ -0,0 +1 @@
+Synthetic test attestation created on 2026-10-01 by the World Fulcio DER issuer and Rekor canonical DSSE entry helpers. Fresh local Ed25519 keys are used; private keys are not retained. The leaf is valid for ten minutes from 2026-01-06T14:00Z; the signed log witness authenticates that signing time. No vendor records or credentials are present.

package/dist/test-fixtures/attestation.json

@@ -0,0 +1,50 @@
+{
+  "bundle": {
+    "mediaType": "application/vnd.dev.sigstore.bundle+json;version=0.1",
+    "dsseEnvelope": {
+      "payloadType": "application/vnd.in-toto+json",
+      "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS9maXh0dXJlQDEuMC4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6IjZhNzkzMjU0ZjQ0YjMwODY1MDUxZTZjNWQ0ZjRiYmFlMzI3OTc0MzIwZjdhYzYwZjg0ZDEzMWY0N2I3YjQ1MGJlOGRhMmRkNGQ4YzkyNThkNWVjMWJiOWNjNDliY2QzZDlkY2NiNTIyNmY0YjM4ODkyNzQyNWZjODVkNjU0MWRlIn19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6e319",
+      "signatures": [
+        {
+          "keyid": "",
+          "sig": "7nKq9VXFF3a1J7rj4tFMbM6UhafUKaXXtV5yhkubs8U/SocLU7m0E0cgxdr8ixMZbwYExsX1d46kncIZ1wCjBQ=="
+        }
+      ]
+    },
+    "verificationMaterial": {
+      "x509CertificateChain": {
+        "certificates": [
+          {
+            "rawBytes": "MIIDTTCCAv+gAwIBAgIQBUiE8XK0h+xFHqyfZxbTXjAFBgMrZXAwKjEVMBMGA1UECgwMc2lnc3RvcmUuZGV2MREwDwYDVQQDDAhzaWdzdG9yZTAeFw0yNjAxMDYxNDAwMDBaFw0yNjAxMDYxNDEwMDBaMAAwKjAFBgMrZXADIQC4nHlTkS1xW0AQsB+d05CE0PzyBGyWvNGEP+EJHrgYY6OCAmMwggJfMA4GA1UdDwEB/wQEAwIAgDATBgNVHSUEDDAKBggrBgEFBQcDAzBhBgNVHREBAf8EVzBVhlNodHRwczovL2dpdGh1Yi5jb20vZml4dHVyZS9yZXBvc2l0b3J5Ly5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvaGVhZHMvbWFpbjAQBgorBgEEAYO/MAEIBAIMADBjBgorBgEEAYO/MAEJBFUMU2h0dHBzOi8vZ2l0aHViLmNvbS9maXh0dXJlL3JlcG9zaXRvcnkvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy9oZWFkcy9tYWluMBAGCisGAQQBg78wAQoEAgwAMBAGCisGAQQBg78wAQsEAgwAMCMGCisGAQQBg78wAQwEFQwTaHR0cHM6Ly9naXRodWIuY29tLzAQBgorBgEEAYO/MAENBAIMADAQBgorBgEEAYO/MAEOBAIMADAQBgorBgEEAYO/MAEPBAIMADAjBgorBgEEAYO/MAEQBBUME2h0dHBzOi8vZ2l0aHViLmNvbS8wEAYKKwYBBAGDvzABEQQCDAAwIwYKKwYBBAGDvzABEgQVDBNodHRwczovL2dpdGh1Yi5jb20vMBAGCisGAQQBg78wARMEAgwAMBAGCisGAQQBg78wARQEAgwAMDsGCisGAQQBg78wARUELQwraHR0cHM6Ly9naXRodWIuY29tLy9hY3Rpb25zL3J1bnMvL2F0dGVtcHRzLzAQBgorBgEEAYO/MAEWBAIMADAQBgorBgEEAYO/MAEYBAIMADAFBgMrZXADQQAwr/lCtMpb0F+w6OzzNVHwjnQtMxTO1WN7W1J3NeIPC8mWcWASE8c41uXJflOk3cXWpV3dFRqZ2c9cjBJszjkI"
+          }
+        ]
+      },
+      "tlogEntries": [
+        {
+          "logIndex": "0",
+          "logId": {
+            "keyId": "dF/sfCyHqi/AtAHN6MyKhdQjWjwmAUydfFFJIBxj/xU="
+          },
+          "kindVersion": {
+            "kind": "dsse",
+            "version": "0.0.1"
+          },
+          "integratedTime": "1767708000",
+          "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNjEyNGVlZjYyMmQ0MDgwYTVhM2Q2NGMxNWU0NWZjODk3NTBmNzJiYWNmYjEwN2MzMTY5MzY5YTI2OGZhNGIzZSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjdhOTgyY2I1ZjczMTc5NDhiM2FlZmFlMDljYjNiYzMzNDdkMDFiNTFlNDdjMDJhZTE2ZTk1NjhiODkxMGVlNTEifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiN25LcTlWWEZGM2ExSjdyajR0Rk1iTTZVaGFmVUthWFh0VjV5aGt1YnM4VS9Tb2NMVTdtMEUwY2d4ZHI4aXhNWmJ3WUV4c1gxZDQ2a25jSVoxd0NqQlE9PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUlVWRU5EUVhZclowRjNTVUpCWjBsUlFsVnBSVGhZU3pCb0szaEdTSEY1WmxwNFlsUllha0ZHUW1kTmNscFlRWGRMYWtWV1RVSk5SMEV4VlVVS1EyZDNUV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5Va1YzUkhkWlJGWlJVVVJFUVdoNllWZGtlbVJIT1hsYVZFRmxSbmN3ZVU1cVFYaE5SRmw0VGtSQmR3cE5SRUpoUm5jd2VVNXFRWGhOUkZsNFRrUkZkMDFFUW1GTlFVRjNTMnBCUmtKblRYSmFXRUZFU1ZGRE5HNUliRlJyVXpGNFZ6QkJVWE5DSzJRd05VTkZDakJRZW5sQ1IzbFhkazVIUlZBclJVcEljbWRaV1RaUFEwRnRUWGRuWjBwbVRVRTBSMEV4VldSRWQwVkNMM2RSUlVGM1NVRm5SRUZVUW1kT1ZraFRWVVVLUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UW1oQ1owNVdTRkpGUWtGbU9FVldla0pXYUd4T2IyUklVbmRqZW05MlRESmtjR1JIYURGWmFUVnFZakl3ZGdwYWJXdzBaRWhXZVZwVE9YbGFXRUoyWXpKc01HSXpTalZNZVRWdVlWaFNiMlJYU1haa01qbDVZVEphYzJJelpIcE1NMHBzWWtkV2FHTXlWWFZsVnpGekNsRklTbXhhYmsxMllVZFdhRnBJVFhaaVYwWndZbXBCVVVKbmIzSkNaMFZGUVZsUEwwMUJSVWxDUVVsTlFVUkNha0puYjNKQ1owVkZRVmxQTDAxQlJVb0tRa1pWVFZVeWFEQmtTRUo2VDJrNGRsb3liREJoU0ZacFRHMU9kbUpUT1cxaFdHZ3daRmhLYkV3elNteGpSemw2WVZoU2RtTnVhM1pNYldSd1pFZG9NUXBaYVRrellqTktjbHB0ZUhaa00wMTJZMjFXYzFwWFJucGFVelUxWWxkNFFXTnRWbTFqZVRsdldsZEdhMk41T1hSWlYyeDFUVUpCUjBOcGMwZEJVVkZDQ21jM09IZEJVVzlGUVdkM1FVMUNRVWREYVhOSFFWRlJRbWMzT0hkQlVYTkZRV2QzUVUxRFRVZERhWE5IUVZGUlFtYzNPSGRCVVhkRlJsRjNWR0ZJVWpBS1kwaE5Oa3g1T1c1aFdGSnZaRmRKZFZreU9YUk1la0ZSUW1kdmNrSm5SVVZCV1U4dlRVRkZUa0pCU1UxQlJFRlJRbWR2Y2tKblJVVkJXVTh2VFVGRlR3cENRVWxOUVVSQlVVSm5iM0pDWjBWRlFWbFBMMDFCUlZCQ1FVbE5RVVJCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVkZDUWxWTlJUSm9NR1JJUW5wUGFUaDJDbG95YkRCaFNGWnBURzFPZG1KVE9IZEZRVmxMUzNkWlFrSkJSMFIyZWtGQ1JWRlJRMFJCUVhkSmQxbExTM2RaUWtKQlIwUjJla0ZDUldkUlZrUkNUbThLWkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJUVUpCUjBOcGMwZEJVVkZDWnpjNGQwRlNUVVZCWjNkQlRVSkJSME5wYzBkQlVWRkNaemM0ZHdwQlVsRkZRV2QzUVUxRWMwZERhWE5IUVZGUlFtYzNPSGRCVWxWRlRGRjNjbUZJVWpCalNFMDJUSGs1Ym1GWVVtOWtWMGwxV1RJNWRFeDVPV2haTTFKd0NtSXlOWHBNTTBveFltNU5ka3d5UmpCa1IxWjBZMGhTZWt4NlFWRkNaMjl5UW1kRlJVRlpUeTlOUVVWWFFrRkpUVUZFUVZGQ1oyOXlRbWRGUlVGWlR5OEtUVUZGV1VKQlNVMUJSRUZHUW1kTmNscFlRVVJSVVVGM2NpOXNRM1JOY0dJd1JpdDNOazk2ZWs1V1NIZHFibEYwVFhoVVR6RlhUamRYTVVvelRtVkpVQXBET0cxWFkxZEJVMFU0WXpReGRWaEtabXhQYXpOaldGZHdWak5rUmxKeFdqSmpPV05xUWtwemVtcHJTUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In1dfX0=",
+          "inclusionPromise": {
+            "signedEntryTimestamp": "ak9H7xUyGle+Y9ffFmG7fcJhmuebWzMA20XrRdW8iCoauQr05gHY7SKB/Ol3Eim/PkWbeXEVh6OE8zBFhmjcDA=="
+          }
+        }
+      ]
+    }
+  },
+  "trust": {
+    "certificates": [
+      "-----BEGIN CERTIFICATE-----\nMIIBezCCAS2gAwIBAgIUaz/8CSoFR9V9lm1MgOxfV29zAfQwBQYDK2VwMCoxFTAT\nBgNVBAoMDHNpZ3N0b3JlLmRldjERMA8GA1UEAwwIc2lnc3RvcmUwIBcNMjAwMTAx\nMDAwMDAwWhgPMjEyMDAxMDEwMDAwMDBaMCoxFTATBgNVBAoMDHNpZ3N0b3JlLmRl\ndjERMA8GA1UEAwwIc2lnc3RvcmUwKjAFBgMrZXADIQDE41ebQe3wxijT90pJKpcI\ncMLr3RWwHjbTcE0wFY8MZ6NjMGEwHQYDVR0OBBYEFCCwTCsZsoFzvP8pW8nIipgg\n1APNMB8GA1UdIwQYMBaAFCCwTCsZsoFzvP8pW8nIipgg1APNMA8GA1UdEwEB/wQF\nMAMBAf8wDgYDVR0PAQH/BAQDAgAGMAUGAytlcANBAG5I7Hn72nt51DGymOMMFimq\n7UQ/RqT8zGPUcRC36HTxmW0p5GS62VbT/X9B+Hl/k+xAOMXfD1OdE0zt4N+V3AY=\n-----END CERTIFICATE-----\n"
+    ],
+    "logKeys": [
+      "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA6ndE8AARgTs3biA59jhDL22PH2EgZqWnk4I5vugGtl8=\n-----END PUBLIC KEY-----\n"
+    ]
+  },
+  "otherLogKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAE8WDvbqLEaI2gSsDadEZGTtJz1L1qvL8hqLgXFR0qpg=\n-----END PUBLIC KEY-----\n"
+}