@volter/world-host 3.0.8 → 3.0.10

package/dist/src/twins-host.js

@@ -113,6 +113,8 @@ export async function createWorldHost(options) {
     const browserOrigin = !origins ? undefined : originBase
         ? (served) => { const label = worldOriginLabel(served); return label ? `${advertised?.protocol ?? 'https:'}//${label}.${originBase}${advertised?.port ? `:${advertised.port}` : ''}` : null; }
         : (served) => (port ? localWorldOrigin(served, port) : null);
+    // sites are routed only at this machine's loopback origins (the front's siteOfHost)
+    const sitesOrigin = origins && !originBase ? (served) => (port ? localWorldOrigin(served, port) : null) : undefined;
     // one key reader per trusted platform, shared by every World here (each caches its platform's key set)
     // https only, or http on this machine: keys read over plain http elsewhere could be swapped, and a swapped key forges passes
     const passIssuers = (options.trust ?? []).map((origin) => {
@@ -126,7 +128,7 @@ export async function createWorldHost(options) {
     const branches = new LocalBranches({ dir, origin: () => loopback, worlds: byServed, mount: (root) => mount({ name: '', root }), ...(options.announce ? { announce: options.announce } : {}) });
     const mount = async (w) => {
         const config = loadWorldConfig(join(w.root, '.volter', 'world.json'), w.root).config;
-        return mountWorld(config.id, { root: w.root, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(passIssuers.length ? { passIssuers } : {}) });
+        return mountWorld(config.id, { root: w.root, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(sitesOrigin ? { sitesOrigin } : {}), ...(passIssuers.length ? { passIssuers } : {}) });
     };
     for (const w of found)
         byServed.set(w.name, await mount(w));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-host",
-  "version": "3.0.8",
+  "version": "3.0.10",
   "description": "The hosted remote: worlds under one URL, each holding the canonical history of a real vendor account and its sealed credential — what a local world clones from and pushes to.",
   "keywords": [
     "twin",
@@ -27,11 +27,11 @@
   },
   "dependencies": {
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.8",
-    "@volter/world-runtime": "3.0.8"
+    "@volter/world-core": "3.0.10",
+    "@volter/world-runtime": "3.0.10"
   },
   "peerDependencies": {
-    "@volter/world-console": "3.0.3"
+    "@volter/world-console": "3.0.5"
   },
   "peerDependenciesMeta": {
     "@volter/world-console": {
@@ -39,7 +39,7 @@
     }
   },
   "devDependencies": {
-    "@volter/world-console": "3.0.3"
+    "@volter/world-console": "3.0.5"
   },
   "exports": {
     ".": {

package/src/twins-host.ts

@@ -122,6 +122,8 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
   const browserOrigin = !origins ? undefined : originBase
     ? (served: string) => { const label = worldOriginLabel(served); return label ? `${advertised?.protocol ?? 'https:'}//${label}.${originBase}${advertised?.port ? `:${advertised.port}` : ''}` : null; }
     : (served: string) => (port ? localWorldOrigin(served, port) : null);
+  // sites are routed only at this machine's loopback origins (the front's siteOfHost)
+  const sitesOrigin = origins && !originBase ? (served: string) => (port ? localWorldOrigin(served, port) : null) : undefined;
   // one key reader per trusted platform, shared by every World here (each caches its platform's key set)
   // https only, or http on this machine: keys read over plain http elsewhere could be swapped, and a swapped key forges passes
   const passIssuers: TrustedIssuer[] = (options.trust ?? []).map((origin) => {
@@ -134,7 +136,7 @@ export async function createWorldHost(options: WorldHostOptions): Promise<WorldH
   const branches: LocalBranches = new LocalBranches({ dir, origin: () => loopback, worlds: byServed, mount: (root) => mount({ name: '', root }), ...(options.announce ? { announce: options.announce } : {}) });
   const mount = async (w: { name: string; root: string }): Promise<MountedWorld> => {
     const config = loadWorldConfig(join(w.root, '.volter', 'world.json'), w.root).config;
-    return mountWorld(config.id, { root: w.root, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(passIssuers.length ? { passIssuers } : {}) });
+    return mountWorld(config.id, { root: w.root, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(sitesOrigin ? { sitesOrigin } : {}), ...(passIssuers.length ? { passIssuers } : {}) });
   };
   for (const w of found) byServed.set(w.name, await mount(w));
   const host = options.host ?? '127.0.0.1';