@volter/world-host 2.0.1 → 2.0.2

package/dist/src/cli.js

@@ -1,19 +1,22 @@
 #!/usr/bin/env node
 // volter-host — worlds under one URL (see twins-host.ts).
 //
-//   volter-host serve --dir <worlds> [--host H] [--port P] [--url <origin reached at>] [--console-port C] [--console-url <console origin reached at; same site as --url, or its mirror links are refused>]
+//   volter-host serve --dir <worlds> [--host H] [--port P] [--url <origin reached at>] [--console-port C] [--console-url <console origin reached at; same site as --url, or its mirror links are refused>] [--trust <platform origin>]… [--world-origins <domain>]
 //
 // `<dir>/<org>/<world>/` is a bare world (`volter world init --bare <org>/<world>`). Each world's
 // token is in its own `.volter/token`; each world's serve record names this host's URL. The admin
 // token (`<dir>/.volter-host/admin`) opens the host's own doors — `/-/worlds` — and is printed once.
+// Each `--trust` names a platform whose passes open these Worlds for a person (its keys at /.well-known/jwks.json).
+// `--world-origins <domain>` gives each World an origin of its own under it (`<world>--<org>.<domain>`), for a host reached at --url.
 import { createWorldHost } from "./twins-host.js";
 const cmd = process.argv[2];
 const rest = process.argv.slice(3);
 const value = (flag) => { const i = rest.indexOf(flag); return i >= 0 ? rest[i + 1] : undefined; };
+const values = (flag) => rest.flatMap((a, i) => (a === flag && rest[i + 1] ? [rest[i + 1]] : []));
 if (cmd === 'serve') {
     const dir = value('--dir');
     if (!dir) {
-        process.stderr.write('volter-host serve --dir <worlds> [--host H] [--port P] [--url <origin reached at>] [--console-port C] [--console-url <console origin reached at; same site as --url, or its mirror links are refused>]\n');
+        process.stderr.write('volter-host serve --dir <worlds> [--host H] [--port P] [--url <origin reached at>] [--console-port C] [--console-url <console origin reached at; same site as --url, or its mirror links are refused>] [--trust <platform origin>]… [--world-origins <domain>]\n');
         process.exit(2);
     }
     // the console mounts when it is installed beside the host; a host without it serves the doors alone
@@ -26,7 +29,7 @@ if (cmd === 'serve') {
             return undefined;
         }
     })();
-    const host = await createWorldHost({ dir, ...(value('--host') ? { host: value('--host') } : {}), ...(value('--port') ? { port: Number(value('--port')) } : {}), ...(value('--url') ? { advertise: value('--url') } : {}), ...(value('--console-port') ? { consolePort: Number(value('--console-port')) } : {}), ...(value('--console-url') ? { consoleAdvertise: value('--console-url') } : {}), ...(console ? { console } : {}), announce: (line) => process.stdout.write(`${line}\n`) });
+    const host = await createWorldHost({ dir, ...(value('--host') ? { host: value('--host') } : {}), ...(value('--port') ? { port: Number(value('--port')) } : {}), ...(value('--url') ? { advertise: value('--url') } : {}), ...(value('--console-port') ? { consolePort: Number(value('--console-port')) } : {}), ...(value('--console-url') ? { consoleAdvertise: value('--console-url') } : {}), ...(console ? { console } : {}), ...(rest.includes('--no-origins') ? { origins: false } : {}), ...(values('--trust').length ? { trust: values('--trust') } : {}), ...(value('--world-origins') ? { worldOrigins: value('--world-origins') } : {}), announce: (line) => process.stdout.write(`${line}\n`) });
     process.stdout.write(`host ready  ${host.url}  ${host.worlds.length} world${host.worlds.length === 1 ? '' : 's'}\nadmin token  ${host.adminToken}\n${host.console ? `console      ${host.console}\n` : ''}`);
     const shutdown = async () => { await host.stop(); process.exit(0); };
     process.on('SIGTERM', shutdown);

package/dist/src/twins-host.d.ts

@@ -18,6 +18,16 @@ export type WorldHostOptions = {
      *  0.0.0.0 behind a port map, a host behind a proxy. Every world's `base`, its serve record and the
      *  printed URLs use it; without it the bind address stands (loopback runs). */
     advertise?: string;
+    /** each World a browser steps into at an origin of its own, `<world>--<org>.localhost` (on by default
+     *  on a loopback host that is not advertised under another URL) */
+    origins?: boolean;
+    /** The platforms (their origins) whose passes open this host's Worlds for a person: each publishes its keys at
+     *  `/.well-known/jwks.json` (docs/contributing/architecture.md, "The hosted product"). None, and only tokens do. */
+    trust?: string[];
+    /** A host reached under its own domain (`advertise`): each World at `<world>--<org>.<worldOrigins>` (a wildcard name
+     *  and certificate pointing here), the origin its browser session and a platform's passes live at. Loopback hosts
+     *  have theirs under `localhost` already. */
+    worldOrigins?: string;
 };
 export { CONSOLE_BASE, type ConsoleMount };
 export type WorldHostHandle = {
@@ -36,7 +46,9 @@ export type WorldInventoryRow = {
     org: string;
     world: string;
     name: string;
-    base: string;
+    base: string; /** the World's own origin, where a browser opens it */
+    origin?: string; /** the org that owns it, as the platform that made or claimed it names the org (architecture, "Every World has an owner from its making") */
+    owner?: string;
     token: string;
     readToken: string;
     twins: Array<{

package/dist/src/twins-host.js

@@ -15,11 +15,29 @@
 // Nothing of the vendor lives here — no arms, no keys, no folds: the host is the shell; the kernel
 // serves. The v1 host (namespaces, links, the push flip, the R2 shell) left with v1.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { assertStateRemovable, serveHttp, withAncestryLock, withStateRemoval } from '@volter/world-core';
+import { assertStateRemovable, serveHttp, stateDirName, withAncestryLock, withStateRemoval } from '@volter/world-core';
 import { dirname, join, resolve } from 'node:path';
-import { assertWorldStateRemovable, CONSOLE_BASE, consoleRedirect, initWorld, loadWorldConfig, mountWorld, serveConsoleApart, TOKEN_HEADER } from '@volter/world-runtime';
+import { assertWorldStateRemovable, resolveCatalog, CONSOLE_BASE, consoleRedirect, initWorld, LocalBranches, loadWorldConfig, localWorldOrigin, mountWorld, pathOfWorld, worldOriginLabel, serveConsoleApart, worldDoorUnderConsole, TOKEN_HEADER, worldOfHost } from '@volter/world-runtime';
+import { issuerKeys, trustableIssuer } from '@volter/world-access';
 export { CONSOLE_BASE };
 const NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
+/** Public suffixes of two labels, under which a registrable domain has three (the common ones: a site-level warning, not a PSL). */
+const MULTI_LABEL_SUFFIXES = new Set(['co.uk', 'org.uk', 'ac.uk', 'gov.uk', 'me.uk', 'ltd.uk', 'plc.uk', 'com.au', 'net.au', 'org.au', 'co.nz', 'org.nz', 'co.jp', 'ne.jp', 'or.jp', 'co.in', 'co.za', 'com.br', 'com.cn', 'com.mx', 'com.sg', 'com.tr', 'co.kr', 'com.tw', 'github.io', 'gitlab.io', 'pages.dev', 'workers.dev', 'vercel.app', 'netlify.app', 'herokuapp.com', 'fly.dev', 'onrender.com', 'web.app', 'firebaseapp.com', 'azurewebsites.net', 'cloudfront.net', 'amazonaws.com', 'trycloudflare.com', 'ngrok.app', 'ngrok.io']);
+/** An owner as a platform names an org: its id, letters, digits, `_` and `-`. */
+const OWNER = /^[A-Za-z0-9_-]{1,80}$/;
+/** The owner recorded beside a World (`.volter/owner`), or null. */
+const ownerOf = (root) => { try {
+    const o = readFileSync(join(root, stateDirName(), 'owner'), 'utf8').trim();
+    return OWNER.test(o) ? o : null;
+}
+catch {
+    return null;
+} };
+const recordOwner = (root, owner) => {
+    mkdirSync(join(root, stateDirName()), { recursive: true });
+    writeFileSync(join(root, stateDirName(), 'owner'), `${owner}
+`);
+};
 /** The bare worlds under a directory: `<dir>/<org>/<world>/.volter/world.json`. */
 export function worldsUnder(dir) {
     const out = [];
@@ -59,11 +77,57 @@ export async function createWorldHost(options) {
     if (found.length === 0)
         throw new Error(`no worlds under ${dir} — a world is \`<dir>/<org>/<world>/\` with \`.volter/world.json\` (\`volter world init --bare <org>/<world>\` makes one)`);
     const adminToken = adminTokenFor(dir);
+    const byServed = new Map();
+    let loopback = '';
+    let port = 0;
+    const bound = options.host ?? '127.0.0.1';
+    const originBase = options.worldOrigins?.replace(/^\.+|\.+$/g, '') || undefined;
+    const origins = options.origins ?? (originBase !== undefined || (!options.advertise && (bound === '127.0.0.1' || bound === 'localhost' || bound === '::1')));
+    // off by default (an advertised URL, or a bind a browser cannot reach as *.localhost): say so, since every World
+    // then shares one origin and a browser session there is only path-scoped (an explicit --no-origins is a choice)
+    if (options.origins === undefined && !origins)
+        options.announce?.(`origins  off (${options.advertise ? `advertised at ${options.advertise}` : `bound to ${bound}`}): every World shares one origin, where a browser session is only path-scoped; serve together only Worlds whose pages you trust, or bind loopback without --url for an origin per World`);
+    // under a domain of its own: the advertised URL's scheme and port, each World a label under the domain
+    const advertised = options.advertise ? new URL(options.advertise) : null;
+    const loopbackName = (host) => host === 'localhost' || host.endsWith('.localhost') || host === '127.0.0.1' || host === '[::1]';
+    // a host reached over plain http on a public name: its Worlds' session cookies cannot be `__Host-`, and travel in clear
+    if (advertised?.protocol === 'http:' && !loopbackName(advertised.hostname))
+        throw new Error(`--url ${options.advertise}: a host is reached over https (or http on this machine's loopback)`);
+    // over plain http a World's session cookie cannot be `__Host-`, so sibling Worlds could toss it, and it travels in clear
+    if (originBase !== undefined && advertised?.protocol === 'http:' && !loopbackName(originBase))
+        throw new Error(`--world-origins ${originBase}: Worlds get origins of their own over https (or http on this machine's loopback); --url is ${options.advertise}`);
+    // a World's pages on the same registrable domain as a platform this host trusts are same-site with it: say so (the
+    // platform refuses a same-site page's changes, but a domain of the Worlds' own is the layout that needs no such care)
+    // the registrable domain: the last two labels, three under a public suffix of two (co.uk, com.au, github.io…); when
+    // unsure the check errs toward warning (a longer shared suffix is still compared)
+    const siteOf = (host) => { const labels = host.toLowerCase().split('.'); const two = labels.slice(-2).join('.'); return labels.slice(MULTI_LABEL_SUFFIXES.has(two) ? -3 : -2).join('.'); };
+    if (originBase !== undefined)
+        for (const t of options.trust ?? []) {
+            try {
+                const h = new URL(t).hostname;
+                if (!loopbackName(h) && siteOf(h) === siteOf(originBase))
+                    options.announce?.(`origins  ${originBase} shares a site with the platform ${t}: give the Worlds a registrable domain of their own (as github.com uses githubusercontent.com)`);
+            }
+            catch { /* the trust check below says why */ }
+        }
+    const browserOrigin = !origins ? undefined : originBase
+        ? (served) => { const label = worldOriginLabel(served); return label ? `${advertised?.protocol ?? 'https:'}//${label}.${originBase}${advertised?.port ? `:${advertised.port}` : ''}` : null; }
+        : (served) => (port ? localWorldOrigin(served, port) : null);
+    // one key reader per trusted platform, shared by every World here (each caches its platform's key set)
+    // https only, or http on this machine: keys read over plain http elsewhere could be swapped, and a swapped key forges passes
+    const passIssuers = (options.trust ?? []).map((origin) => {
+        const issuer = trustableIssuer(origin);
+        if (!issuer)
+            throw new Error(`--trust ${origin}: a platform is trusted over https (or http on this machine's loopback)`);
+        return { issuer, keys: issuerKeys(issuer) };
+    });
+    // a World's branches ("as of" views) live beside it under the host's directory, and reach their
+    // parent through this host's own listener
+    const branches = new LocalBranches({ dir, origin: () => loopback, worlds: byServed, mount: (root) => mount({ name: '', root }), ...(options.announce ? { announce: options.announce } : {}) });
     const mount = async (w) => {
         const config = loadWorldConfig(join(w.root, '.volter', 'world.json'), w.root).config;
-        return mountWorld(config.id, { root: w.root });
+        return mountWorld(config.id, { root: w.root, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(passIssuers.length ? { passIssuers } : {}) });
     };
-    const byServed = new Map();
     for (const w of found)
         byServed.set(w.name, await mount(w));
     const host = options.host ?? '127.0.0.1';
@@ -78,7 +142,11 @@ export async function createWorldHost(options) {
             const status = res.ok ? (await res.json()) : {};
             twins.push({ vendor, protocol: status.protocol ?? null, root: status.root ?? null });
         }
-        return { org, world, name: m.served, base: `${url}/${m.served}`, token: m.token, readToken: m.readToken, twins };
+        // `origin`: where a browser steps into this World (its page, its session), when it has an origin of its own
+        // only where this host serves the World's page there (the console): a pass sent anywhere else lands on nothing
+        const origin = options.console ? browserOrigin?.(m.served) ?? null : null;
+        const owner = ownerOf(m.root);
+        return { org, world, name: m.served, base: `${url}/${m.served}`, ...(origin ? { origin } : {}), ...(owner ? { owner } : {}), token: m.token, readToken: m.readToken, twins };
     };
     const checkAncestry = (path) => {
         for (const world of worldsUnder(dir))
@@ -88,7 +156,16 @@ export async function createWorldHost(options) {
     const admin = async (request, path) => {
         if (request.headers.get(TOKEN_HEADER) !== adminToken)
             return json({ error: 'the host\'s doors open to the admin token' }, 401);
-        const m = /^\/-\/worlds(?:\/([^/]+)\/([^/]+)(?:\/(rotate))?)?$/.exec(path);
+        // the twins this host can make a World with: those installed beside its Worlds (a platform's picker offers these)
+        if (path === '/-/vendors' && request.method === 'GET') {
+            let vendors = [];
+            try {
+                vendors = resolveCatalog(dir).vendors();
+            }
+            catch { /* none installed */ }
+            return json({ vendors });
+        }
+        const m = /^\/-\/worlds(?:\/([^/]+)\/([^/]+)(?:\/(rotate|owner))?)?$/.exec(path);
         if (!m)
             return json({ error: `no such door: ${request.method} ${path}` }, 404);
         const [, org, world, verb] = m;
@@ -105,8 +182,10 @@ export async function createWorldHost(options) {
                     body = (await request.json());
                 }
                 catch {
-                    return json({ error: 'provision: { org, world, vendors }' }, 400);
+                    return json({ error: 'provision: { org, world, vendors, owner? }' }, 400);
                 }
+                if (body.owner !== undefined && (typeof body.owner !== 'string' || !OWNER.test(body.owner)))
+                    return json({ error: 'owner: the owning org as its platform names it (letters, digits, _ and -)' }, 400);
                 const vendors = Array.isArray(body.vendors) ? body.vendors.filter((v) => typeof v === 'string' && NAME.test(v)) : [];
                 if (!body.org || !body.world || !NAME.test(body.org) || !NAME.test(body.world) || vendors.length === 0)
                     return json({ error: 'provision: { org, world, vendors: [vendor, …] } — names are letters, digits, . _ -' }, 400);
@@ -120,6 +199,8 @@ export async function createWorldHost(options) {
                     const result = initWorld(body.world, root, { root, vendors, bare: name });
                     if (!result.ok)
                         throw new Error(`init refused: ${JSON.stringify(result.plan)}`);
+                    if (body.owner)
+                        recordOwner(root, body.owner);
                     const mounted = await mount({ name, root });
                     acquired = mounted;
                     await mounted.boot(url);
@@ -150,7 +231,26 @@ export async function createWorldHost(options) {
             return json({ error: `no world ${name} here` }, 404);
         if (verb === 'rotate' && request.method === 'POST')
             return json({ name, ...mounted.rotate() });
+        // a World made before its platform is claimed once: its owner is recorded then, and never silently replaced
+        if (verb === 'owner' && request.method === 'PUT') {
+            let body;
+            try {
+                body = (await request.json());
+            }
+            catch {
+                return json({ error: 'owner: { owner }' }, 400);
+            }
+            if (typeof body.owner !== 'string' || !OWNER.test(body.owner))
+                return json({ error: 'owner: { owner } — the owning org as its platform names it' }, 400);
+            const held = ownerOf(mounted.root);
+            if (held && held !== body.owner)
+                return json({ error: `${name} is owned by ${held}` }, 409);
+            recordOwner(mounted.root, body.owner);
+            return json({ name, owner: body.owner });
+        }
         if (!verb && request.method === 'DELETE') {
+            if (branches.hasBranches(name))
+                return json({ error: `${name} has branches: ${branches.list(name).map((b) => b.name).join(', ')}` }, 409);
             try {
                 withAncestryLock(() => checkAncestry(mounted.root));
                 await mounted.stop();
@@ -171,13 +271,30 @@ export async function createWorldHost(options) {
         // here misattributes requests and can recreate a removed World after its response.
         twinRequestJournal: false,
         async fetch(request) {
-            const path = new URL(request.url).pathname;
-            const moved = consoleRedirect(request, consoleUrl ? consoleUrl.slice(0, -`${CONSOLE_BASE}/`.length) : null);
+            const at = new URL(request.url);
+            const path = at.pathname;
+            // a World's own origin serves that World (and the ping and the console) and no other, nor the admin doors
+            const own = origins ? worldOfHost(at.hostname, byServed.keys(), originBase) : undefined;
+            if (own === null)
+                return json({ error: `no world at ${at.host}` }, 404);
+            if (own && !pathOfWorld(path, own, CONSOLE_BASE))
+                return json({ error: `this origin serves ${own} only` }, 404);
+            // the console's pages of a World live at the World's own origin, beside its session and its mirrors
+            // (the console's home, the list of Worlds, lives at the console's own origin: consoleRedirect below)
+            // a World named console/<world> keeps its doors (/-/console/<world>/…): they are never the console's pages
+            const worldDoor = worldDoorUnderConsole(path, (n) => byServed.has(n), CONSOLE_BASE);
+            if (own && options.console && !worldDoor && (path === CONSOLE_BASE || path.startsWith(`${CONSOLE_BASE}/`))) {
+                const answered = await options.console.handle(request, CONSOLE_BASE, { worlds: at.origin, worldOrigin: true });
+                if (answered)
+                    return answered;
+            }
+            const moved = worldDoor ? null : consoleRedirect(request, consoleUrl ? consoleUrl.slice(0, -`${CONSOLE_BASE}/`.length) : null);
             if (moved)
                 return moved;
+            // on a World's own origin the ping names that World only (a sibling's name is none of its business)
             if (path === '/-/ping')
-                return json({ ok: true, worlds: [...byServed.keys()], ...(consoleUrl ? { console: consoleUrl } : {}) });
-            if (path === '/-/worlds' || path.startsWith('/-/worlds/'))
+                return json({ ok: true, worlds: own ? [own] : [...byServed.keys()], ...(consoleUrl ? { console: consoleUrl } : {}) });
+            if (path === '/-/worlds' || path.startsWith('/-/worlds/') || path === '/-/vendors')
                 return admin(request, path);
             const m = /^\/(?:-\/)?([^/]+)\/([^/]+)/.exec(path);
             const world = m ? byServed.get(`${m[1]}/${m[2]}`) : undefined;
@@ -187,6 +304,8 @@ export async function createWorldHost(options) {
         },
     });
     url = options.advertise ? options.advertise.replace(/\/+$/, '') : `http://${host}:${server.port}`;
+    port = server.port ?? 0;
+    loopback = `http://${host === '0.0.0.0' || host === '::' ? '127.0.0.1' : host}:${server.port}`;
     let apart = null;
     try {
         for (const m of byServed.values()) {
@@ -195,8 +314,7 @@ export async function createWorldHost(options) {
         }
         if (options.console) {
             // the console reaches the doors at this host's own address; the pages it serves name the advertised one
-            const internal = `http://${host === '0.0.0.0' ? '127.0.0.1' : host}:${server.port}`;
-            const serveApart = (port) => serveConsoleApart(options.console, { upstream: internal, worlds: url, hostname: host, port });
+            const serveApart = (port) => serveConsoleApart(options.console, { upstream: loopback, worlds: url, hostname: host, port });
             if (options.consolePort !== undefined)
                 apart = await serveApart(options.consolePort);
             else {
@@ -211,15 +329,17 @@ export async function createWorldHost(options) {
         }
     }
     catch (error) {
+        await apart?.server.stop(true);
         await server.stop(true);
         for (const m of byServed.values())
             await m.stop().catch(() => undefined);
         throw error;
     }
+    await branches.resume();
     return {
         url, port: server.port ?? 0, adminToken, console: consoleUrl,
         get worlds() { return [...byServed.values()].map((m) => ({ name: m.served, base: `${url}/${m.served}` })); },
-        stop: async () => { await apart?.server.stop(true); await server.stop(true); for (const m of byServed.values())
+        stop: async () => { branches.stop(); await apart?.server.stop(true); await server.stop(true); for (const m of byServed.values())
             await m.stop(); },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-host",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "The hosted remote: worlds under one URL, each holding the canonical history of a real vendor account and its sealed credential — what a local world clones from and pushes to.",
   "keywords": [
     "twin",
@@ -26,11 +26,12 @@
     "postpack": "node ../../scripts/publish/prepare-publish.mjs postpack"
   },
   "dependencies": {
-    "@volter/world-core": "2.0.1",
-    "@volter/world-runtime": "2.0.1"
+    "@volter/world-access": "2.0.0",
+    "@volter/world-core": "2.0.2",
+    "@volter/world-runtime": "2.0.2"
   },
   "peerDependencies": {
-    "@volter/world-console": "2.0.1"
+    "@volter/world-console": "2.0.2"
   },
   "peerDependenciesMeta": {
     "@volter/world-console": {
@@ -38,7 +39,7 @@
     }
   },
   "devDependencies": {
-    "@volter/world-console": "2.0.1"
+    "@volter/world-console": "2.0.2"
   },
   "exports": {
     ".": {

package/src/cli.ts

@@ -1,25 +1,28 @@
 #!/usr/bin/env node
 // volter-host — worlds under one URL (see twins-host.ts).
 //
-//   volter-host serve --dir <worlds> [--host H] [--port P] [--url <origin reached at>] [--console-port C] [--console-url <console origin reached at; same site as --url, or its mirror links are refused>]
+//   volter-host serve --dir <worlds> [--host H] [--port P] [--url <origin reached at>] [--console-port C] [--console-url <console origin reached at; same site as --url, or its mirror links are refused>] [--trust <platform origin>]… [--world-origins <domain>]
 //
 // `<dir>/<org>/<world>/` is a bare world (`volter world init --bare <org>/<world>`). Each world's
 // token is in its own `.volter/token`; each world's serve record names this host's URL. The admin
 // token (`<dir>/.volter-host/admin`) opens the host's own doors — `/-/worlds` — and is printed once.
+// Each `--trust` names a platform whose passes open these Worlds for a person (its keys at /.well-known/jwks.json).
+// `--world-origins <domain>` gives each World an origin of its own under it (`<world>--<org>.<domain>`), for a host reached at --url.
 import { createWorldHost, type ConsoleMount } from './twins-host.ts';
 
 const cmd = process.argv[2];
 const rest = process.argv.slice(3);
 const value = (flag: string): string | undefined => { const i = rest.indexOf(flag); return i >= 0 ? rest[i + 1] : undefined; };
+const values = (flag: string): string[] => rest.flatMap((a, i) => (a === flag && rest[i + 1] ? [rest[i + 1]!] : []));
 
 if (cmd === 'serve') {
   const dir = value('--dir');
-  if (!dir) { process.stderr.write('volter-host serve --dir <worlds> [--host H] [--port P] [--url <origin reached at>] [--console-port C] [--console-url <console origin reached at; same site as --url, or its mirror links are refused>]\n'); process.exit(2); }
+  if (!dir) { process.stderr.write('volter-host serve --dir <worlds> [--host H] [--port P] [--url <origin reached at>] [--console-port C] [--console-url <console origin reached at; same site as --url, or its mirror links are refused>] [--trust <platform origin>]… [--world-origins <domain>]\n'); process.exit(2); }
   // the console mounts when it is installed beside the host; a host without it serves the doors alone
   const console = await (async (): Promise<ConsoleMount | undefined> => {
     try { const mod = await import('@volter/world-console') as { createConsole: () => ConsoleMount }; return mod.createConsole(); } catch { return undefined; }
   })();
-  const host = await createWorldHost({ dir, ...(value('--host') ? { host: value('--host')! } : {}), ...(value('--port') ? { port: Number(value('--port')) } : {}), ...(value('--url') ? { advertise: value('--url')! } : {}), ...(value('--console-port') ? { consolePort: Number(value('--console-port')) } : {}), ...(value('--console-url') ? { consoleAdvertise: value('--console-url')! } : {}), ...(console ? { console } : {}), announce: (line) => process.stdout.write(`${line}\n`) });
+  const host = await createWorldHost({ dir, ...(value('--host') ? { host: value('--host')! } : {}), ...(value('--port') ? { port: Number(value('--port')) } : {}), ...(value('--url') ? { advertise: value('--url')! } : {}), ...(value('--console-port') ? { consolePort: Number(value('--console-port')) } : {}), ...(value('--console-url') ? { consoleAdvertise: value('--console-url')! } : {}), ...(console ? { console } : {}), ...(rest.includes('--no-origins') ? { origins: false } : {}), ...(values('--trust').length ? { trust: values('--trust') } : {}), ...(value('--world-origins') ? { worldOrigins: value('--world-origins')! } : {}), announce: (line) => process.stdout.write(`${line}\n`) });
   process.stdout.write(`host ready  ${host.url}  ${host.worlds.length} world${host.worlds.length === 1 ? '' : 's'}\nadmin token  ${host.adminToken}\n${host.console ? `console      ${host.console}\n` : ''}`);
   const shutdown = async () => { await host.stop(); process.exit(0); };
   process.on('SIGTERM', shutdown); process.on('SIGINT', shutdown);

package/src/twins-host.test.ts

@@ -113,6 +113,76 @@ describe("the hosted product's doors", () => {
 });
 
 
+test('World origins on the host\'s own front: each serves its World and the console\'s pages of it, never the admin doors; --no-origins turns them off', async () => {
+  const base = mkdtempSync(join(tmpdir(), 'world-host-front-'));
+  mkdirSync(join(base, 'node_modules', '@volter'), { recursive: true }); symlinkSync(join(PACKS, 'github'), join(base, 'node_modules', '@volter', 'twin-github'), 'junction');
+  for (const name of ['acme/one', 'acme/two', 'console/lab']) {
+    const at = join(base, ...name.split('/')); mkdirSync(at, { recursive: true });
+    const made = spawnSync(process.execPath, [CLI, 'world', 'init', '--bare', name, '--twins', 'github'], { cwd: at, encoding: 'utf8', windowsHide: true });
+    if (made.status !== 0) throw new Error(made.stderr);
+  }
+  // a console mount that says what the host asked of it
+  const asked: Array<{ path: string; opts: unknown }> = [];
+  const console = { handle: async (request: Request, _base: string, opts?: unknown) => { asked.push({ path: new URL(request.url).pathname, opts: opts ?? null }); return new Response('console page', { headers: { 'content-type': 'text/html' } }); } };
+  const front = await createWorldHost({ dir: base, console });
+  try {
+    const port = new URL(front.url).port;
+    const token = readFileSync(join(base, 'acme', 'one', '.volter', 'token'), 'utf8').trim();
+    // an origin reached as a browser reaches it: this listener, the origin's name as Host
+    const at = (host: string, path: string, init: RequestInit = {}) => fetch(`${front.url}${path}`, { ...init, redirect: 'manual', headers: { ...(init.headers as Record<string, string> | undefined), host } });
+    const one = `one--acme.localhost:${port}`;
+    expect((await at(one, '/-/acme/one/clock', { headers: { 'x-volter-token': token } })).status).toBe(200);
+    expect((await at(one, '/-/acme/two/clock', { headers: { 'x-volter-token': token } })).status).toBe(404); // another World's doors
+    expect((await at(one, '/-/worlds', { headers: { 'x-volter-token': front.adminToken } })).status).toBe(404); // the admin doors, never on a World origin
+    expect(((await (await at(one, '/-/ping')).json()) as { worlds: string[] }).worlds).toEqual(['acme/one']); // this World only, not its siblings
+    // the console's pages of a World are served on its own origin, flagged as such; on the shared origin they move to the console's
+    expect(await (await at(one, '/-/console/acme/one')).text()).toBe('console page');
+    expect(asked.at(-1)).toMatchObject({ path: '/-/console/acme/one', opts: { worldOrigin: true } });
+    const shared = await fetch(`${front.url}/-/console/acme/one`, { redirect: 'manual' });
+    expect(shared.status).toBe(302);
+    expect(shared.headers.get('location')).toStartWith(front.console!.replace(/\/-\/console\/$/, ''));
+    // a World whose org is named like the console keeps its doors, on its origin and on the shared one; its console
+    // pages are still the console's
+    const labToken = readFileSync(join(base, 'console', 'lab', '.volter', 'token'), 'utf8').trim();
+    const lab = `lab--console.localhost:${port}`;
+    const labClock = await at(lab, '/-/console/lab/clock', { headers: { 'x-volter-token': labToken } });
+    expect(labClock.status).toBe(200);
+    expect(labClock.headers.get('content-type')).toContain('json');
+    expect((await fetch(`${front.url}/-/console/lab/clock`, { redirect: 'manual', headers: { 'x-volter-token': labToken } })).status).toBe(200);
+    expect(await (await at(lab, '/-/console/console/lab')).text()).toBe('console page');
+  } finally { await front.stop(); }
+  // --no-origins: a World's name as Host is nothing special; the shared origin serves every World by path
+  const off = await createWorldHost({ dir: base, origins: false });
+  try {
+    const token = readFileSync(join(base, 'acme', 'two', '.volter', 'token'), 'utf8').trim();
+    const port = new URL(off.url).port;
+    expect((await fetch(`${off.url}/-/acme/two/clock`, { headers: { host: `one--acme.localhost:${port}`, 'x-volter-token': token } })).status).toBe(200);
+  } finally { await off.stop(); rmSync(base, { recursive: true, force: true }); }
+}, 180_000);
+
+test('a host whose default turns World origins off says so; an explicit choice and the loopback default do not', async () => {
+  const empty = mkdtempSync(join(tmpdir(), 'world-host-origins-'));
+  // one bare World of its own (a host serves at least one), its twin resolved above it as the suite's are
+  mkdirSync(join(empty, 'node_modules', '@volter'), { recursive: true }); symlinkSync(join(PACKS, 'github'), join(empty, 'node_modules', '@volter', 'twin-github'), 'junction');
+  const solo = join(empty, 'acme', 'solo'); mkdirSync(solo, { recursive: true });
+  const made = spawnSync(process.execPath, [CLI, 'world', 'init', '--bare', 'acme/solo', '--twins', 'github'], { cwd: solo, encoding: 'utf8', windowsHide: true });
+  if (made.status !== 0) throw new Error(made.stderr);
+  const said = async (options: Parameters<typeof createWorldHost>[0]): Promise<string[]> => {
+    const lines: string[] = [];
+    const h = await createWorldHost({ ...options, dir: empty, announce: (line) => lines.push(line) });
+    await h.stop();
+    return lines.filter((l) => l.startsWith('origins'));
+  };
+  try {
+    const advertised = await said({ dir: empty, advertise: 'https://worlds.example' });
+    expect(advertised).toHaveLength(1);
+    expect(advertised[0]).toContain('advertised at https://worlds.example');
+    expect(advertised[0]).toContain('path-scoped');
+    expect(await said({ dir: empty, advertise: 'https://worlds.example', origins: false })).toEqual([]);
+    expect(await said({ dir: empty })).toEqual([]);
+  } finally { rmSync(empty, { recursive: true, force: true }); }
+});
+
 test('host deletion refuses a local dependent branch while keeping the parent served', async () => {
   const headers = { 'x-volter-token': host.adminToken, 'content-type': 'application/json' };
   const child = mkdtempSync(join(tmpdir(), 'host-lineage-child-'));

package/src/twins-host.ts

@@ -15,9 +15,11 @@
 // Nothing of the vendor lives here — no arms, no keys, no folds: the host is the shell; the kernel
 // serves. The v1 host (namespaces, links, the push flip, the R2 shell) left with v1.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { assertStateRemovable, serveHttp, withAncestryLock, withStateRemoval } from '@volter/world-core';
+import { assertStateRemovable, serveHttp, stateDirName, withAncestryLock, withStateRemoval } from '@volter/world-core';
 import { dirname, join, resolve } from 'node:path';
-import { assertWorldStateRemovable, CONSOLE_BASE, consoleRedirect, initWorld, loadWorldConfig, mountWorld, serveConsoleApart, TOKEN_HEADER, type ConsoleMount, type MountedWorld } from '@volter/world-runtime';
+import { assertWorldStateRemovable, resolveCatalog, CONSOLE_BASE, consoleRedirect, initWorld, LocalBranches, loadWorldConfig, localWorldOrigin, mountWorld, pathOfWorld, worldOriginLabel, serveConsoleApart, worldDoorUnderConsole, TOKEN_HEADER, worldOfHost, type ConsoleMount, type MountedWorld } from '@volter/world-runtime';
+
+import { issuerKeys, trustableIssuer, type TrustedIssuer } from '@volter/world-access';
 
 export type WorldHostOptions = {
   /** the directory of worlds: `<dir>/<org>/<world>/` is a bare world */
@@ -38,14 +40,33 @@ export type WorldHostOptions = {
    *  0.0.0.0 behind a port map, a host behind a proxy. Every world's `base`, its serve record and the
    *  printed URLs use it; without it the bind address stands (loopback runs). */
   advertise?: string;
+  /** each World a browser steps into at an origin of its own, `<world>--<org>.localhost` (on by default
+   *  on a loopback host that is not advertised under another URL) */
+  origins?: boolean;
+  /** The platforms (their origins) whose passes open this host's Worlds for a person: each publishes its keys at
+   *  `/.well-known/jwks.json` (docs/contributing/architecture.md, "The hosted product"). None, and only tokens do. */
+  trust?: string[];
+  /** A host reached under its own domain (`advertise`): each World at `<world>--<org>.<worldOrigins>` (a wildcard name
+   *  and certificate pointing here), the origin its browser session and a platform's passes live at. Loopback hosts
+   *  have theirs under `localhost` already. */
+  worldOrigins?: string;
 };
 export { CONSOLE_BASE, type ConsoleMount };
 export type WorldHostHandle = { url: string; port: number; adminToken: string; console: string | null; worlds: Array<{ name: string; base: string }>; stop: () => Promise<void> };
 /** One row of the inventory: what the platform records and what the console is handed. */
-export type WorldInventoryRow = { org: string; world: string; name: string; base: string; token: string; readToken: string; twins: Array<{ vendor: string; protocol: unknown; root: unknown }> };
+export type WorldInventoryRow = { org: string; world: string; name: string; base: string; /** the World's own origin, where a browser opens it */ origin?: string; /** the org that owns it, as the platform that made or claimed it names the org (architecture, "Every World has an owner from its making") */ owner?: string; token: string; readToken: string; twins: Array<{ vendor: string; protocol: unknown; root: unknown }> };
 
 const NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
 
+/** Public suffixes of two labels, under which a registrable domain has three (the common ones: a site-level warning, not a PSL). */
+const MULTI_LABEL_SUFFIXES = new Set(['co.uk', 'org.uk', 'ac.uk', 'gov.uk', 'me.uk', 'ltd.uk', 'plc.uk', 'com.au', 'net.au', 'org.au', 'co.nz', 'org.nz', 'co.jp', 'ne.jp', 'or.jp', 'co.in', 'co.za', 'com.br', 'com.cn', 'com.mx', 'com.sg', 'com.tr', 'co.kr', 'com.tw', 'github.io', 'gitlab.io', 'pages.dev', 'workers.dev', 'vercel.app', 'netlify.app', 'herokuapp.com', 'fly.dev', 'onrender.com', 'web.app', 'firebaseapp.com', 'azurewebsites.net', 'cloudfront.net', 'amazonaws.com', 'trycloudflare.com', 'ngrok.app', 'ngrok.io']);
+/** An owner as a platform names an org: its id, letters, digits, `_` and `-`. */
+const OWNER = /^[A-Za-z0-9_-]{1,80}$/;
+/** The owner recorded beside a World (`.volter/owner`), or null. */
+const ownerOf = (root: string): string | null => { try { const o = readFileSync(join(root, stateDirName(), 'owner'), 'utf8').trim(); return OWNER.test(o) ? o : null; } catch { return null; } };
+const recordOwner = (root: string, owner: string): void => { mkdirSync(join(root, stateDirName()), { recursive: true }); writeFileSync(join(root, stateDirName(), 'owner'), `${owner}
+`); };
+
 /** The bare worlds under a directory: `<dir>/<org>/<world>/.volter/world.json`. */
 export function worldsUnder(dir: string): Array<{ name: string; root: string }> {
   const out: Array<{ name: string; root: string }> = [];
@@ -77,11 +98,44 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
   const found = worldsUnder(dir);
   if (found.length === 0) throw new Error(`no worlds under ${dir} — a world is \`<dir>/<org>/<world>/\` with \`.volter/world.json\` (\`volter world init --bare <org>/<world>\` makes one)`);
   const adminToken = adminTokenFor(dir);
+  const byServed = new Map<string, MountedWorld>();
+  let loopback = ''; let port = 0;
+  const bound = options.host ?? '127.0.0.1';
+  const originBase = options.worldOrigins?.replace(/^\.+|\.+$/g, '') || undefined;
+  const origins = options.origins ?? (originBase !== undefined || (!options.advertise && (bound === '127.0.0.1' || bound === 'localhost' || bound === '::1')));
+  // off by default (an advertised URL, or a bind a browser cannot reach as *.localhost): say so, since every World
+  // then shares one origin and a browser session there is only path-scoped (an explicit --no-origins is a choice)
+  if (options.origins === undefined && !origins) options.announce?.(`origins  off (${options.advertise ? `advertised at ${options.advertise}` : `bound to ${bound}`}): every World shares one origin, where a browser session is only path-scoped; serve together only Worlds whose pages you trust, or bind loopback without --url for an origin per World`);
+  // under a domain of its own: the advertised URL's scheme and port, each World a label under the domain
+  const advertised = options.advertise ? new URL(options.advertise) : null;
+  const loopbackName = (host: string): boolean => host === 'localhost' || host.endsWith('.localhost') || host === '127.0.0.1' || host === '[::1]';
+  // a host reached over plain http on a public name: its Worlds' session cookies cannot be `__Host-`, and travel in clear
+  if (advertised?.protocol === 'http:' && !loopbackName(advertised.hostname)) throw new Error(`--url ${options.advertise}: a host is reached over https (or http on this machine's loopback)`);
+  // over plain http a World's session cookie cannot be `__Host-`, so sibling Worlds could toss it, and it travels in clear
+  if (originBase !== undefined && advertised?.protocol === 'http:' && !loopbackName(originBase)) throw new Error(`--world-origins ${originBase}: Worlds get origins of their own over https (or http on this machine's loopback); --url is ${options.advertise}`);
+  // a World's pages on the same registrable domain as a platform this host trusts are same-site with it: say so (the
+  // platform refuses a same-site page's changes, but a domain of the Worlds' own is the layout that needs no such care)
+  // the registrable domain: the last two labels, three under a public suffix of two (co.uk, com.au, github.io…); when
+  // unsure the check errs toward warning (a longer shared suffix is still compared)
+  const siteOf = (host: string): string => { const labels = host.toLowerCase().split('.'); const two = labels.slice(-2).join('.'); return labels.slice(MULTI_LABEL_SUFFIXES.has(two) ? -3 : -2).join('.'); };
+  if (originBase !== undefined) for (const t of options.trust ?? []) { try { const h = new URL(t).hostname; if (!loopbackName(h) && siteOf(h) === siteOf(originBase)) options.announce?.(`origins  ${originBase} shares a site with the platform ${t}: give the Worlds a registrable domain of their own (as github.com uses githubusercontent.com)`); } catch { /* the trust check below says why */ } }
+  const browserOrigin = !origins ? undefined : originBase
+    ? (served: string) => { const label = worldOriginLabel(served); return label ? `${advertised?.protocol ?? 'https:'}//${label}.${originBase}${advertised?.port ? `:${advertised.port}` : ''}` : null; }
+    : (served: string) => (port ? localWorldOrigin(served, port) : null);
+  // one key reader per trusted platform, shared by every World here (each caches its platform's key set)
+  // https only, or http on this machine: keys read over plain http elsewhere could be swapped, and a swapped key forges passes
+  const passIssuers: TrustedIssuer[] = (options.trust ?? []).map((origin) => {
+    const issuer = trustableIssuer(origin);
+    if (!issuer) throw new Error(`--trust ${origin}: a platform is trusted over https (or http on this machine's loopback)`);
+    return { issuer, keys: issuerKeys(issuer) };
+  });
+  // a World's branches ("as of" views) live beside it under the host's directory, and reach their
+  // parent through this host's own listener
+  const branches: LocalBranches = new LocalBranches({ dir, origin: () => loopback, worlds: byServed, mount: (root) => mount({ name: '', root }), ...(options.announce ? { announce: options.announce } : {}) });
   const mount = async (w: { name: string; root: string }): Promise<MountedWorld> => {
     const config = loadWorldConfig(join(w.root, '.volter', 'world.json'), w.root).config;
-    return mountWorld(config.id, { root: w.root });
+    return mountWorld(config.id, { root: w.root, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(passIssuers.length ? { passIssuers } : {}) });
   };
-  const byServed = new Map<string, MountedWorld>();
   for (const w of found) byServed.set(w.name, await mount(w));
   const host = options.host ?? '127.0.0.1';
   let url = '';
@@ -96,7 +150,11 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
       const status = res.ok ? (await res.json()) as { protocol?: unknown; root?: unknown } : {};
       twins.push({ vendor, protocol: status.protocol ?? null, root: status.root ?? null });
     }
-    return { org, world, name: m.served, base: `${url}/${m.served}`, token: m.token, readToken: m.readToken, twins };
+    // `origin`: where a browser steps into this World (its page, its session), when it has an origin of its own
+    // only where this host serves the World's page there (the console): a pass sent anywhere else lands on nothing
+    const origin = options.console ? browserOrigin?.(m.served) ?? null : null;
+    const owner = ownerOf(m.root);
+    return { org, world, name: m.served, base: `${url}/${m.served}`, ...(origin ? { origin } : {}), ...(owner ? { owner } : {}), token: m.token, readToken: m.readToken, twins };
   };
 
   const checkAncestry = (path: string): void => {
@@ -106,14 +164,17 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
 
   const admin = async (request: Request, path: string): Promise<Response> => {
     if (request.headers.get(TOKEN_HEADER) !== adminToken) return json({ error: 'the host\'s doors open to the admin token' }, 401);
-    const m = /^\/-\/worlds(?:\/([^/]+)\/([^/]+)(?:\/(rotate))?)?$/.exec(path);
+    // the twins this host can make a World with: those installed beside its Worlds (a platform's picker offers these)
+    if (path === '/-/vendors' && request.method === 'GET') { let vendors: string[] = []; try { vendors = resolveCatalog(dir).vendors(); } catch { /* none installed */ } return json({ vendors }); }
+    const m = /^\/-\/worlds(?:\/([^/]+)\/([^/]+)(?:\/(rotate|owner))?)?$/.exec(path);
     if (!m) return json({ error: `no such door: ${request.method} ${path}` }, 404);
     const [, org, world, verb] = m;
     if (!org) {
       if (request.method === 'GET') { const rows: WorldInventoryRow[] = []; for (const w of byServed.values()) rows.push(await row(w)); return json({ worlds: rows }); }
       if (request.method === 'POST') {
-        let body: { org?: string; world?: string; vendors?: string[] };
-        try { body = (await request.json()) as typeof body; } catch { return json({ error: 'provision: { org, world, vendors }' }, 400); }
+        let body: { org?: string; world?: string; vendors?: string[]; owner?: string };
+        try { body = (await request.json()) as typeof body; } catch { return json({ error: 'provision: { org, world, vendors, owner? }' }, 400); }
+        if (body.owner !== undefined && (typeof body.owner !== 'string' || !OWNER.test(body.owner))) return json({ error: 'owner: the owning org as its platform names it (letters, digits, _ and -)' }, 400);
         const vendors = Array.isArray(body.vendors) ? body.vendors.filter((v): v is string => typeof v === 'string' && NAME.test(v)) : [];
         if (!body.org || !body.world || !NAME.test(body.org) || !NAME.test(body.world) || vendors.length === 0) return json({ error: 'provision: { org, world, vendors: [vendor, …] } — names are letters, digits, . _ -' }, 400);
         const name = `${body.org}/${body.world}`; const root = join(dir, body.org, body.world);
@@ -123,6 +184,7 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
           mkdirSync(root, { recursive: true });
           const result = initWorld(body.world, root, { root, vendors, bare: name });
           if (!result.ok) throw new Error(`init refused: ${JSON.stringify(result.plan)}`);
+          if (body.owner) recordOwner(root, body.owner);
           const mounted = await mount({ name, root });
           acquired = mounted;
           await mounted.boot(url);
@@ -146,7 +208,17 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
     const name = `${org}/${world}`; const mounted = byServed.get(name);
     if (!mounted) return json({ error: `no world ${name} here` }, 404);
     if (verb === 'rotate' && request.method === 'POST') return json({ name, ...mounted.rotate() });
+    // a World made before its platform is claimed once: its owner is recorded then, and never silently replaced
+    if (verb === 'owner' && request.method === 'PUT') {
+      let body: { owner?: string }; try { body = (await request.json()) as typeof body; } catch { return json({ error: 'owner: { owner }' }, 400); }
+      if (typeof body.owner !== 'string' || !OWNER.test(body.owner)) return json({ error: 'owner: { owner } — the owning org as its platform names it' }, 400);
+      const held = ownerOf(mounted.root);
+      if (held && held !== body.owner) return json({ error: `${name} is owned by ${held}` }, 409);
+      recordOwner(mounted.root, body.owner);
+      return json({ name, owner: body.owner });
+    }
     if (!verb && request.method === 'DELETE') {
+      if (branches.hasBranches(name)) return json({ error: `${name} has branches: ${branches.list(name).map((b) => b.name).join(', ')}` }, 409);
       try {
         withAncestryLock(() => checkAncestry(mounted.root));
         await mounted.stop();
@@ -165,11 +237,24 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
     // here misattributes requests and can recreate a removed World after its response.
     twinRequestJournal: false,
     async fetch(request) {
-      const path = new URL(request.url).pathname;
-      const moved = consoleRedirect(request, consoleUrl ? consoleUrl.slice(0, -`${CONSOLE_BASE}/`.length) : null);
+      const at = new URL(request.url); const path = at.pathname;
+      // a World's own origin serves that World (and the ping and the console) and no other, nor the admin doors
+      const own = origins ? worldOfHost(at.hostname, byServed.keys(), originBase) : undefined;
+      if (own === null) return json({ error: `no world at ${at.host}` }, 404);
+      if (own && !pathOfWorld(path, own, CONSOLE_BASE)) return json({ error: `this origin serves ${own} only` }, 404);
+      // the console's pages of a World live at the World's own origin, beside its session and its mirrors
+      // (the console's home, the list of Worlds, lives at the console's own origin: consoleRedirect below)
+      // a World named console/<world> keeps its doors (/-/console/<world>/…): they are never the console's pages
+      const worldDoor = worldDoorUnderConsole(path, (n) => byServed.has(n), CONSOLE_BASE);
+      if (own && options.console && !worldDoor && (path === CONSOLE_BASE || path.startsWith(`${CONSOLE_BASE}/`))) {
+        const answered = await options.console.handle(request, CONSOLE_BASE, { worlds: at.origin, worldOrigin: true });
+        if (answered) return answered;
+      }
+      const moved = worldDoor ? null : consoleRedirect(request, consoleUrl ? consoleUrl.slice(0, -`${CONSOLE_BASE}/`.length) : null);
       if (moved) return moved;
-      if (path === '/-/ping') return json({ ok: true, worlds: [...byServed.keys()], ...(consoleUrl ? { console: consoleUrl } : {}) });
-      if (path === '/-/worlds' || path.startsWith('/-/worlds/')) return admin(request, path);
+      // on a World's own origin the ping names that World only (a sibling's name is none of its business)
+      if (path === '/-/ping') return json({ ok: true, worlds: own ? [own] : [...byServed.keys()], ...(consoleUrl ? { console: consoleUrl } : {}) });
+      if (path === '/-/worlds' || path.startsWith('/-/worlds/') || path === '/-/vendors') return admin(request, path);
       const m = /^\/(?:-\/)?([^/]+)\/([^/]+)/.exec(path);
       const world = m ? byServed.get(`${m[1]}/${m[2]}`) : undefined;
       if (!world) return json({ error: `no world at ${path}: this host serves ${[...byServed.keys()].join(', ')}` }, 404);
@@ -177,21 +262,23 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
     },
   });
   url = options.advertise ? options.advertise.replace(/\/+$/, '') : `http://${host}:${server.port}`;
+  port = server.port ?? 0;
+  loopback = `http://${host === '0.0.0.0' || host === '::' ? '127.0.0.1' : host}:${server.port}`;
   let apart: Awaited<ReturnType<typeof serveConsoleApart>> | null = null;
   try {
     for (const m of byServed.values()) { await m.boot(url); options.announce?.(`serving  ${m.served}  ${url}/${m.served}`); }
     if (options.console) {
       // the console reaches the doors at this host's own address; the pages it serves name the advertised one
-      const internal = `http://${host === '0.0.0.0' ? '127.0.0.1' : host}:${server.port}`;
-      const serveApart = (port: number) => serveConsoleApart(options.console!, { upstream: internal, worlds: url, hostname: host, port });
+      const serveApart = (port: number) => serveConsoleApart(options.console!, { upstream: loopback, worlds: url, hostname: host, port });
       if (options.consolePort !== undefined) apart = await serveApart(options.consolePort);
       else { try { apart = await serveApart((server.port ?? 0) ? (server.port ?? 0) + 1 : 0); } catch { apart = await serveApart(0); } }
       consoleUrl = `${(options.consoleAdvertise ?? apart.url).replace(/\/+$/, '')}${CONSOLE_BASE}/`;
     }
-  } catch (error) { await server.stop(true); for (const m of byServed.values()) await m.stop().catch(() => undefined); throw error; }
+  } catch (error) { await apart?.server.stop(true); await server.stop(true); for (const m of byServed.values()) await m.stop().catch(() => undefined); throw error; }
+  await branches.resume();
   return {
     url, port: server.port ?? 0, adminToken, console: consoleUrl,
     get worlds() { return [...byServed.values()].map((m) => ({ name: m.served, base: `${url}/${m.served}` })); },
-    stop: async () => { await apart?.server.stop(true); await server.stop(true); for (const m of byServed.values()) await m.stop(); },
+    stop: async () => { branches.stop(); await apart?.server.stop(true); await server.stop(true); for (const m of byServed.values()) await m.stop(); },
   };
 }