@volter/world-host 3.0.5 → 3.0.7

package/dist/src/twins-host.js

@@ -17,7 +17,7 @@
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { assertStateRemovable, serveHttp, stateDirName, withAncestryLock, withStateRemoval } from '@volter/world-core/runtime';
 import { dirname, join, resolve } from 'node:path';
-import { assertWorldStateRemovable, resolveCatalog, CONSOLE_BASE, consoleRedirect, initWorld, LocalBranches, loadWorldConfig, localWorldOrigin, mountWorld, pathOfWorld, worldOriginLabel, serveConsoleApart, worldDoorUnderConsole, TOKEN_HEADER, worldOfHost } from '@volter/world-runtime';
+import { assertWorldStateRemovable, resolveCatalog, CONSOLE_BASE, consoleRedirect, initWorld, LocalBranches, loadWorldConfig, localWorldOrigin, mountWorld, pathOfWorld, worldOriginLabel, serveConsoleApart, siteOfHost, worldDoorUnderConsole, TOKEN_HEADER, worldOfHost } from '@volter/world-runtime';
 import { issuerKeys, trustableIssuer } from '@volter/world-access';
 export { CONSOLE_BASE };
 const NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
@@ -274,6 +274,11 @@ export async function createWorldHost(options) {
             const at = new URL(request.url);
             const path = at.pathname;
             // a World's own origin serves that World (and the ping and the console) and no other, nor the admin doors
+            // a site the World's twins answer, under the World's local origin (`<hostname>.<world>--<org>.localhost`): only on
+            // this machine's loopback origins, where the World's own page needs no token either
+            const site = origins && !originBase ? siteOfHost(at.hostname, byServed.keys()) : undefined;
+            if (site)
+                return byServed.get(site.world).site(request, site.site);
             const own = origins ? worldOfHost(at.hostname, byServed.keys(), originBase) : undefined;
             if (own === null)
                 return json({ error: `no world at ${at.host}` }, 404);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-host",
-  "version": "3.0.5",
+  "version": "3.0.7",
   "description": "The hosted remote: worlds under one URL, each holding the canonical history of a real vendor account and its sealed credential — what a local world clones from and pushes to.",
   "keywords": [
     "twin",
@@ -27,11 +27,11 @@
   },
   "dependencies": {
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.5",
-    "@volter/world-runtime": "3.0.5"
+    "@volter/world-core": "3.0.7",
+    "@volter/world-runtime": "3.0.7"
   },
   "peerDependencies": {
-    "@volter/world-console": "3.0.1"
+    "@volter/world-console": "3.0.2"
   },
   "peerDependenciesMeta": {
     "@volter/world-console": {
@@ -39,7 +39,7 @@
     }
   },
   "devDependencies": {
-    "@volter/world-console": "3.0.1"
+    "@volter/world-console": "3.0.2"
   },
   "exports": {
     ".": {

package/src/twins-host.ts

@@ -17,7 +17,7 @@
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { assertStateRemovable, serveHttp, stateDirName, withAncestryLock, withStateRemoval } from '@volter/world-core/runtime';
 import { dirname, join, resolve } from 'node:path';
-import { assertWorldStateRemovable, resolveCatalog, CONSOLE_BASE, consoleRedirect, initWorld, LocalBranches, loadWorldConfig, localWorldOrigin, mountWorld, pathOfWorld, worldOriginLabel, serveConsoleApart, worldDoorUnderConsole, TOKEN_HEADER, worldOfHost, type ConsoleMount, type MountedWorld } from '@volter/world-runtime';
+import { assertWorldStateRemovable, resolveCatalog, CONSOLE_BASE, consoleRedirect, initWorld, LocalBranches, loadWorldConfig, localWorldOrigin, mountWorld, pathOfWorld, worldOriginLabel, serveConsoleApart, siteOfHost, worldDoorUnderConsole, TOKEN_HEADER, worldOfHost, type ConsoleMount, type MountedWorld } from '@volter/world-runtime';
 
 import { issuerKeys, trustableIssuer, type TrustedIssuer } from '@volter/world-access';
 
@@ -239,6 +239,10 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
     async fetch(request) {
       const at = new URL(request.url); const path = at.pathname;
       // a World's own origin serves that World (and the ping and the console) and no other, nor the admin doors
+      // a site the World's twins answer, under the World's local origin (`<hostname>.<world>--<org>.localhost`): only on
+      // this machine's loopback origins, where the World's own page needs no token either
+      const site = origins && !originBase ? siteOfHost(at.hostname, byServed.keys()) : undefined;
+      if (site) return byServed.get(site.world)!.site(request, site.site);
       const own = origins ? worldOfHost(at.hostname, byServed.keys(), originBase) : undefined;
       if (own === null) return json({ error: `no world at ${at.host}` }, 404);
       if (own && !pathOfWorld(path, own, CONSOLE_BASE)) return json({ error: `this origin serves ${own} only` }, 404);