@volter/world-runtime 2.0.15 → 2.0.17

package/dist/src/infra-cli.js

@@ -1,185 +1,9 @@
 #!/usr/bin/env node
-// Private implementation for infrastructure emitted by `volter-world init`. World configs invoke
-// this declared service; application agents never operate or diagnose its backing mechanism.
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { infraConnections, parseInfraDefinition } from "./pglite-backing.js";
-const phase = process.argv[2];
-if (phase !== 'up' && phase !== 'status' && phase !== 'down') {
-    process.stderr.write('managed infrastructure: expected up, status, or down\n');
-    process.exit(2);
-}
-const worldConfig = process.env.VOLTER_WORLD_CONFIG;
-const worldData = process.env.VOLTER_WORLD_DATA;
-if (!worldConfig || !worldData) {
-    process.stderr.write('managed infrastructure: missing World lifecycle context\n');
-    process.exit(2);
-}
-const definition = join(dirname(worldConfig), 'world.infrastructure.yml');
-if (!existsSync(definition)) {
-    process.stderr.write('managed infrastructure: declared definition is missing\n');
-    process.exit(2);
-}
-const base = ['compose', '-f', definition];
-const run = (args) => spawnSync('docker', [...base, ...args], { windowsHide: true,
-    encoding: 'utf8',
-    env: { ...process.env, VOLTER_WORLD_DATA: worldData },
-    timeout: 120_000,
+// `volter-world-infra up|status|down`: the World-managed infrastructure's declared lifecycle commands (infra.ts), as
+// a process. World configs invoke this declared service; application agents never operate or diagnose its backing.
+import { runInfrastructure } from "./infra.js";
+const code = await runInfrastructure(process.argv[2] ?? '', process.env, {
+    out: (text) => { process.stdout.write(text); },
+    err: (text) => { process.stderr.write(text); },
 });
-const classify = (raw) => /no space left on device|enospc/iu.test(raw)
-    ? 'insufficient writable storage'
-    : /out of memory|cannot allocate memory|killed/iu.test(raw)
-        ? 'insufficient memory'
-        : /cannot connect|not running|daemon/iu.test(raw)
-            ? 'local execution capacity is unavailable'
-            : 'managed infrastructure operation failed';
-const fail = (result) => {
-    const raw = `${result.stdout ?? ''}\n${result.stderr ?? ''}`.trim();
-    process.stderr.write(`managed infrastructure ${phase} failed: ${classify(raw)}\n`);
-    process.exit(result.status && result.status > 0 ? result.status : 1);
-};
-// ---- backing selection ------------------------------------------------------
-// The declared service contract (up/status/down) is the boundary; WHICH
-// runtime answers it is private and chosen here, per machine, at each phase:
-//   1. VOLTER_WORLD_INFRA_BACKING=docker|pglite — explicit, for tests/operators;
-//   2. a working container runtime — the compose path, byte-identical to before;
-//   3. no container runtime + a definition of postgres and/or mongodb services —
-//      the containerless backing (pglite-backing.ts: PGlite for postgres, the
-//      MongoDB twin for mongodb), announced loudly;
-//   4. otherwise the honest refusal naming what this machine cannot serve.
-function selectBacking() {
-    const forced = process.env.VOLTER_WORLD_INFRA_BACKING;
-    if (forced === 'docker' || forced === 'pglite')
-        return forced;
-    if (forced !== undefined) {
-        process.stderr.write(`managed infrastructure: VOLTER_WORLD_INFRA_BACKING must be docker or pglite (got ${JSON.stringify(forced)})\n`);
-        process.exit(2);
-    }
-    const probe = spawnSync('docker', ['info', '--format', '{{.ServerVersion}}'], { windowsHide: true, encoding: 'utf8', timeout: 10_000 });
-    if (probe.status === 0)
-        return 'docker';
-    // Absence of a container runtime (no binary, no daemon) is a capability
-    // difference: swap backings. A PRESENT runtime failing on resources stays
-    // on the docker path so the real capacity problem is classified and
-    // surfaced — a full disk starves every backing equally.
-    if (probe.error !== undefined)
-        return 'pglite';
-    const reason = classify(`${probe.stdout ?? ''}\n${probe.stderr ?? ''}`);
-    return reason === 'local execution capacity is unavailable' ? 'pglite' : 'docker';
-}
-async function runPglite() {
-    const { unsupportedKinds, pgliteUp, pgliteStatus, pgliteDown } = await import("./pglite-backing.js");
-    const services = parseInfraDefinition(readFileSync(definition, 'utf8')).filter((s) => composed === null || composed.includes(s.kind));
-    if (services.length === 0) {
-        process.stderr.write('managed infrastructure: the declared definition names no services\n');
-        process.exit(1);
-    }
-    const unsupported = unsupportedKinds(services);
-    if (unsupported.length > 0) {
-        process.stderr.write(`managed infrastructure ${phase} failed: local execution capacity is unavailable (no container runtime, and the containerless backing cannot serve: ${unsupported.join(', ')})\n`);
-        process.exit(1);
-    }
-    if (phase === 'up') {
-        process.stdout.write('managed infrastructure backing: containerless (no container runtime)\n');
-        try {
-            await pgliteUp(services, worldData);
-        }
-        catch (error) {
-            process.stderr.write(`managed infrastructure up failed: ${String(error.message ?? error)}\n`);
-            process.exit(1);
-        }
-        process.stdout.write('managed infrastructure ready\n');
-        process.exit(0);
-    }
-    if (phase === 'status') {
-        const status = await pgliteStatus(services, worldData);
-        if (!status.ok) {
-            process.stderr.write(`managed infrastructure status failed: ${status.ready}/${services.length} declared services are ready\n`);
-            process.exit(1);
-        }
-        process.stdout.write(`${JSON.stringify({ ok: true, services: declared.length, connections: infraConnections(declared, process.env) })}\n`);
-        process.exit(0);
-    }
-    await pgliteDown(services, worldData);
-    process.stdout.write('managed infrastructure stopped\n');
-    process.exit(0);
-}
-// ---- redis: the twin, containerless ----------------------------------------
-// A redis service is served by the redis twin (redis-backing.ts) on every machine, container runtime or not,
-// unless the operator forces the container backing; the other services take the backing chosen above. Where the
-// twin is not installed (@volter/twin-redis is not this runtime's dependency), redis goes to that backing too:
-// the container where there is one, else the backing's refusal naming redis.
-const declared = parseInfraDefinition(readFileSync(definition, 'utf8'));
-const { redisTwinCli } = await import("./redis-backing.js");
-const twinCli = redisTwinCli([dirname(fileURLToPath(import.meta.url)), dirname(worldConfig)]);
-const twinned = process.env.VOLTER_WORLD_INFRA_BACKING === 'docker' || twinCli === undefined ? [] : declared.filter((s) => s.kind === 'redis');
-/** The services the backing below answers for: every one, or those the twin does not serve (by compose service name). */
-const composed = twinned.length === 0 ? null : declared.filter((s) => s.kind !== 'redis').map((s) => s.kind);
-if (twinned.length > 0)
-    await runRedisTwin();
-async function runRedisTwin() {
-    const { redisTwinDown, redisTwinStatus, redisTwinUp } = await import("./redis-backing.js");
-    const cli = twinCli;
-    if (phase === 'up') {
-        process.stdout.write('managed infrastructure backing: redis twin (containerless)\n');
-        try {
-            await redisTwinUp(twinned, worldData, cli);
-        }
-        catch (error) {
-            process.stderr.write(`managed infrastructure up failed: ${String(error.message ?? error)}\n`);
-            process.exit(1);
-        }
-    }
-    else if (phase === 'status') {
-        const ready = await redisTwinStatus(twinned, worldData);
-        if (ready !== twinned.length) {
-            process.stderr.write(`managed infrastructure status failed: ${ready}/${declared.length} declared services are ready\n`);
-            process.exit(1);
-        }
-    }
-    else {
-        await redisTwinDown(twinned, worldData);
-    }
-    if (composed.length === 0) {
-        if (phase === 'up')
-            process.stdout.write('managed infrastructure ready\n');
-        else if (phase === 'status')
-            process.stdout.write(`${JSON.stringify({ ok: true, services: declared.length, connections: infraConnections(declared, process.env) })}\n`);
-        else
-            process.stdout.write('managed infrastructure stopped\n');
-        process.exit(0);
-    }
-}
-if (selectBacking() === 'pglite') {
-    await runPglite();
-}
-const only = composed ?? [];
-if (phase === 'up') {
-    const result = run(['up', '-d', '--wait', ...only]);
-    if (result.status !== 0)
-        fail(result);
-    process.stdout.write('managed infrastructure ready\n');
-}
-else if (phase === 'status') {
-    const expected = run(['config', '--services']);
-    if (expected.status !== 0)
-        fail(expected);
-    const running = run(['ps', '--status', 'running', '--services']);
-    if (running.status !== 0)
-        fail(running);
-    const expectedNames = expected.stdout.split(/\s+/u).filter(Boolean).filter((n) => composed === null || composed.includes(n)).sort();
-    const runningNames = running.stdout.split(/\s+/u).filter(Boolean).filter((n) => composed === null || composed.includes(n)).sort();
-    if (expectedNames.length === 0 || expectedNames.join('\0') !== runningNames.join('\0')) {
-        process.stderr.write(`managed infrastructure status failed: ${runningNames.length + twinned.length}/${expectedNames.length + twinned.length} declared services are ready\n`);
-        process.exit(1);
-    }
-    process.stdout.write(`${JSON.stringify({ ok: true, services: expectedNames.length + twinned.length, connections: infraConnections(declared, process.env) })}\n`);
-}
-else {
-    const result = run(['down', '--remove-orphans']);
-    if (result.status !== 0)
-        fail(result);
-    process.stdout.write('managed infrastructure stopped\n');
-}
+process.exit(code);

package/dist/src/infra.d.ts

@@ -0,0 +1,7 @@
+export interface InfrastructureIo {
+    out: (text: string) => void;
+    err: (text: string) => void;
+}
+/** One phase of the World-managed infrastructure. `env` is the infrastructure service's environment, which the
+ *  services this starts run in; `signal` is the boot's abort (the World's own up passes it; the tool has none). */
+export declare function runInfrastructure(phase: string, env: NodeJS.ProcessEnv, io: InfrastructureIo, signal?: AbortSignal): Promise<number>;

package/dist/src/infra.js

@@ -0,0 +1,237 @@
+// Private implementation for infrastructure emitted by `volter-world init`. World configs invoke
+// this declared service; application agents never operate or diagnose its backing mechanism.
+//
+// One phase (up, status, down) per call, answering its exit code, with its output written through `io`. The
+// `volter-world-infra` bin (infra-cli.ts) runs it as a process; the World's own `up` runs the up phase in its own
+// process (runtime.ts, `ownInfrastructureUp`), so the containerless services it starts are children of the process
+// that owns the World's lifetime, as every other service's recorder is, and not of a tool that exits once they
+// serve. A process layer where a child does not outlive its parent (a browser tab's) otherwise ended the PGlite host
+// the moment `volter-world-infra up` returned, and the World's readiness probe never saw it.
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { infraConnections, parseInfraDefinition } from "./pglite-backing.js";
+/** A command run to its end without blocking this process: in the World's own `up` the phase shares the event loop
+ *  with the boot's signal handling, where the tool's spawnSync blocked only the tool. Ended by `timeout` (SIGTERM,
+ *  as spawnSync's timeout) or by the boot's abort. */
+function runCommand(command, args, options) {
+    return new Promise((resolveRan) => {
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        let grace;
+        const child = spawn(command, args, { windowsHide: true, env: options.env, stdio: ['ignore', 'pipe', 'pipe'], ...(options.signal ? { signal: options.signal } : {}) });
+        const settle = (ran) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (grace)
+                clearTimeout(grace);
+            // a grandchild that still holds the pipes does not hold this answer
+            child.stdout?.destroy();
+            child.stderr?.destroy();
+            resolveRan(ran);
+        };
+        // the timeout is a hard limit and answers as spawnSync's did: the command is killed and the result carries an
+        // ETIMEDOUT error (a hung `docker info`, a daemon that never answers, is then no container runtime, as before)
+        const timer = setTimeout(() => {
+            child.kill('SIGTERM');
+            settle({ status: null, stdout, stderr, error: Object.assign(new Error(`spawn ${command} ETIMEDOUT`), { code: 'ETIMEDOUT' }) });
+        }, options.timeout);
+        child.stdout?.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+        child.stderr?.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+        // a spawn that fails (no such binary, an abort) answers as spawnSync did: no status, the error
+        child.on('error', (error) => settle({ status: null, stdout, stderr, error }));
+        // the output is whole at `close`; once the command has exited, a descendant holding its pipes open delays the
+        // answer by at most a moment, never to the timeout
+        child.on('exit', (code) => { grace = setTimeout(() => settle({ status: code, stdout, stderr }), 500); });
+        child.on('close', (code) => settle({ status: code, stdout, stderr }));
+    });
+}
+/** One phase of the World-managed infrastructure. `env` is the infrastructure service's environment, which the
+ *  services this starts run in; `signal` is the boot's abort (the World's own up passes it; the tool has none). */
+export async function runInfrastructure(phase, env, io, signal) {
+    if (phase !== 'up' && phase !== 'status' && phase !== 'down') {
+        io.err('managed infrastructure: expected up, status, or down\n');
+        return 2;
+    }
+    const worldConfig = env.VOLTER_WORLD_CONFIG;
+    const worldData = env.VOLTER_WORLD_DATA;
+    if (!worldConfig || !worldData) {
+        io.err('managed infrastructure: missing World lifecycle context\n');
+        return 2;
+    }
+    const definition = join(dirname(worldConfig), 'world.infrastructure.yml');
+    if (!existsSync(definition)) {
+        io.err('managed infrastructure: declared definition is missing\n');
+        return 2;
+    }
+    const base = ['compose', '-f', definition];
+    const run = async (args) => {
+        const ran = await runCommand('docker', [...base, ...args], { env: { ...env, VOLTER_WORLD_DATA: worldData }, timeout: 120_000, ...(signal ? { signal } : {}) });
+        signal?.throwIfAborted();
+        return ran;
+    };
+    const launch = { env, ...(signal ? { signal } : {}) };
+    const classify = (raw) => /no space left on device|enospc/iu.test(raw)
+        ? 'insufficient writable storage'
+        : /out of memory|cannot allocate memory|killed/iu.test(raw)
+            ? 'insufficient memory'
+            : /cannot connect|not running|daemon/iu.test(raw)
+                ? 'local execution capacity is unavailable'
+                : 'managed infrastructure operation failed';
+    const fail = (result) => {
+        const raw = `${result.stdout ?? ''}\n${result.stderr ?? ''}`.trim();
+        io.err(`managed infrastructure ${phase} failed: ${classify(raw)}\n`);
+        return result.status && result.status > 0 ? result.status : 1;
+    };
+    // ---- backing selection ------------------------------------------------------
+    // The declared service contract (up/status/down) is the boundary; WHICH
+    // runtime answers it is private and chosen here, per machine, at each phase:
+    //   1. VOLTER_WORLD_INFRA_BACKING=docker|pglite — explicit, for tests/operators;
+    //   2. a working container runtime — the compose path, byte-identical to before;
+    //   3. no container runtime + a definition of postgres and/or mongodb services —
+    //      the containerless backing (pglite-backing.ts: PGlite for postgres, the
+    //      MongoDB twin for mongodb), announced loudly;
+    //   4. otherwise the honest refusal naming what this machine cannot serve.
+    async function selectBacking() {
+        const forced = env.VOLTER_WORLD_INFRA_BACKING;
+        if (forced === 'docker' || forced === 'pglite')
+            return forced;
+        if (forced !== undefined) {
+            io.err(`managed infrastructure: VOLTER_WORLD_INFRA_BACKING must be docker or pglite (got ${JSON.stringify(forced)})\n`);
+            return 2;
+        }
+        const probe = await runCommand('docker', ['info', '--format', '{{.ServerVersion}}'], { env, timeout: 10_000, ...(signal ? { signal } : {}) });
+        signal?.throwIfAborted();
+        if (probe.status === 0)
+            return 'docker';
+        // Absence of a container runtime (no binary, no daemon) is a capability
+        // difference: swap backings. A PRESENT runtime failing on resources stays
+        // on the docker path so the real capacity problem is classified and
+        // surfaced — a full disk starves every backing equally.
+        // A shell's "command not found" (127) is the same absence: a process layer that runs commands by name answers
+        // an unknown one so, where spawnSync answered ENOSYS (a browser tab's).
+        if (probe.error !== undefined || probe.status === 127)
+            return 'pglite';
+        const reason = classify(`${probe.stdout ?? ''}\n${probe.stderr ?? ''}`);
+        return reason === 'local execution capacity is unavailable' ? 'pglite' : 'docker';
+    }
+    async function runPglite() {
+        const { unsupportedKinds, pgliteUp, pgliteStatus, pgliteDown } = await import("./pglite-backing.js");
+        const services = parseInfraDefinition(readFileSync(definition, 'utf8')).filter((s) => composed === null || composed.includes(s.kind));
+        if (services.length === 0) {
+            io.err('managed infrastructure: the declared definition names no services\n');
+            return 1;
+        }
+        const unsupported = unsupportedKinds(services);
+        if (unsupported.length > 0) {
+            io.err(`managed infrastructure ${phase} failed: local execution capacity is unavailable (no container runtime, and the containerless backing cannot serve: ${unsupported.join(', ')})\n`);
+            return 1;
+        }
+        if (phase === 'up') {
+            io.out('managed infrastructure backing: containerless (no container runtime)\n');
+            try {
+                await pgliteUp(services, worldData, launch);
+            }
+            catch (error) {
+                io.err(`managed infrastructure up failed: ${String(error.message ?? error)}\n`);
+                return 1;
+            }
+            io.out('managed infrastructure ready\n');
+            return 0;
+        }
+        if (phase === 'status') {
+            const status = await pgliteStatus(services, worldData);
+            if (!status.ok) {
+                io.err(`managed infrastructure status failed: ${status.ready}/${services.length} declared services are ready\n`);
+                return 1;
+            }
+            io.out(`${JSON.stringify({ ok: true, services: declared.length, connections: infraConnections(declared, env) })}\n`);
+            return 0;
+        }
+        await pgliteDown(services, worldData);
+        io.out('managed infrastructure stopped\n');
+        return 0;
+    }
+    // ---- redis: the twin, containerless ----------------------------------------
+    // A redis service is served by the redis twin (redis-backing.ts) on every machine, container runtime or not,
+    // unless the operator forces the container backing; the other services take the backing chosen above. Where the
+    // twin is not installed (@volter/twin-redis is not this runtime's dependency), redis goes to that backing too:
+    // the container where there is one, else the backing's refusal naming redis.
+    const declared = parseInfraDefinition(readFileSync(definition, 'utf8'));
+    const { redisTwinCli } = await import("./redis-backing.js");
+    const twinCli = redisTwinCli([dirname(fileURLToPath(import.meta.url)), dirname(worldConfig)]);
+    const twinned = env.VOLTER_WORLD_INFRA_BACKING === 'docker' || twinCli === undefined ? [] : declared.filter((s) => s.kind === 'redis');
+    /** The services the backing below answers for: every one, or those the twin does not serve (by compose service name). */
+    const composed = twinned.length === 0 ? null : declared.filter((s) => s.kind !== 'redis').map((s) => s.kind);
+    if (twinned.length > 0) {
+        const { redisTwinDown, redisTwinStatus, redisTwinUp } = await import("./redis-backing.js");
+        const cli = twinCli;
+        if (phase === 'up') {
+            io.out('managed infrastructure backing: redis twin (containerless)\n');
+            try {
+                await redisTwinUp(twinned, worldData, cli, launch);
+            }
+            catch (error) {
+                io.err(`managed infrastructure up failed: ${String(error.message ?? error)}\n`);
+                return 1;
+            }
+        }
+        else if (phase === 'status') {
+            const ready = await redisTwinStatus(twinned, worldData);
+            if (ready !== twinned.length) {
+                io.err(`managed infrastructure status failed: ${ready}/${declared.length} declared services are ready\n`);
+                return 1;
+            }
+        }
+        else {
+            await redisTwinDown(twinned, worldData);
+        }
+        if (composed.length === 0) {
+            if (phase === 'up')
+                io.out('managed infrastructure ready\n');
+            else if (phase === 'status')
+                io.out(`${JSON.stringify({ ok: true, services: declared.length, connections: infraConnections(declared, env) })}\n`);
+            else
+                io.out('managed infrastructure stopped\n');
+            return 0;
+        }
+    }
+    const backing = await selectBacking();
+    if (typeof backing === 'number')
+        return backing;
+    if (backing === 'pglite')
+        return runPglite();
+    const only = composed ?? [];
+    if (phase === 'up') {
+        const result = await run(['up', '-d', '--wait', ...only]);
+        if (result.status !== 0)
+            return fail(result);
+        io.out('managed infrastructure ready\n');
+    }
+    else if (phase === 'status') {
+        const expected = await run(['config', '--services']);
+        if (expected.status !== 0)
+            return fail(expected);
+        const running = await run(['ps', '--status', 'running', '--services']);
+        if (running.status !== 0)
+            return fail(running);
+        const expectedNames = expected.stdout.split(/\s+/u).filter(Boolean).filter((n) => composed === null || composed.includes(n)).sort();
+        const runningNames = running.stdout.split(/\s+/u).filter(Boolean).filter((n) => composed === null || composed.includes(n)).sort();
+        if (expectedNames.length === 0 || expectedNames.join('\0') !== runningNames.join('\0')) {
+            io.err(`managed infrastructure status failed: ${runningNames.length + twinned.length}/${expectedNames.length + twinned.length} declared services are ready\n`);
+            return 1;
+        }
+        io.out(`${JSON.stringify({ ok: true, services: expectedNames.length + twinned.length, connections: infraConnections(declared, env) })}\n`);
+    }
+    else {
+        const result = await run(['down', '--remove-orphans']);
+        if (result.status !== 0)
+            return fail(result);
+        io.out('managed infrastructure stopped\n');
+    }
+    return 0;
+}

package/dist/src/pglite-backing.d.ts

@@ -19,9 +19,18 @@ export declare function mongodbTwinCli(worldConfig?: string, froms?: string[]):
  *  stripping, so it runs under Bun (this process's, or the one on PATH) — the repository's toolchain —
  *  and without Bun it is refused by name rather than started to fail. */
 export declare function twinRunner(cli: string, bunOnPath?: () => boolean, underBun?: boolean): string;
+/** How a backing starts its hosts: the environment they run in (the World's service environment, which
+ *  the runtime computes for the infrastructure service: admitted host env, the World's env, the service's own, less
+ *  the control plane's NODE_OPTIONS and proxies), and the boot's abort. The `volter-world-infra` process passes
+ *  nothing and its hosts inherit its own environment, which is that same service environment. The World's `up`,
+ *  running the up phase in its own process, passes it: its own process.env is the operator's, not the service's. */
+export interface HostLaunch {
+    env?: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+}
 /** The kinds this backing cannot serve, or [] when it can serve the world. */
 export declare function unsupportedKinds(services: InfraService[]): string[];
-export declare function pgliteUp(services: InfraService[], dataDir: string): Promise<void>;
+export declare function pgliteUp(services: InfraService[], dataDir: string, launch?: HostLaunch): Promise<void>;
 export declare function pgliteStatus(services: InfraService[], dataDir: string): Promise<{
     ok: boolean;
     ready: number;

package/dist/src/pglite-backing.js

@@ -102,10 +102,11 @@ export function twinRunner(cli, bunOnPath = () => spawnSync('bun', ['--version']
     throw new Error(`a checkout's MongoDB twin runs under bun, which is not on PATH (${cli} is TypeScript that Node cannot run)`);
 }
 /** The argv that serves one service on its declared loopback port, with its bytes in `serviceData`. */
-function hostArgv(service, serviceData) {
+function hostArgv(service, serviceData, env) {
     if (service.kind === 'mongodb') {
-        const cli = mongodbTwinCli(process.env.VOLTER_WORLD_CONFIG);
-        return [twinRunner(cli), cli, 'serve', '--port', String(service.hostPort), '--root', serviceData];
+        const cli = mongodbTwinCli(env.VOLTER_WORLD_CONFIG);
+        // blocking (spawnSync), as it was in the tool: reached only for a checkout's TypeScript cli under Node
+        return [twinRunner(cli, () => spawnSync('bun', ['--version'], { stdio: 'ignore', timeout: 10_000, windowsHide: true, env }).status === 0), cli, 'serve', '--port', String(service.hostPort), '--root', serviceData];
     }
     return ['node', hostScript(), '--port', String(service.hostPort), '--data', serviceData];
 }
@@ -146,7 +147,8 @@ function logSince(log, offset) {
         return '';
     }
 }
-export async function pgliteUp(services, dataDir) {
+export async function pgliteUp(services, dataDir, launch = {}) {
+    const env = launch.env ?? process.env;
     // Every check before any start: a refused up starts nothing, so it never leaves the World half-booted.
     const plan = [];
     for (const service of services) {
@@ -159,7 +161,7 @@ export async function pgliteUp(services, dataDir) {
         if (await listening(service.hostPort)) {
             throw new Error(`${name} cannot serve port ${service.hostPort}: another process is already listening on it`);
         }
-        plan.push({ service, name, serviceData, log, pidFile, argv: hostArgv(service, serviceData) });
+        plan.push({ service, name, serviceData, log, pidFile, argv: hostArgv(service, serviceData, env) });
     }
     const started = [];
     try {
@@ -172,6 +174,7 @@ export async function pgliteUp(services, dataDir) {
             const logFd = openSync(log, 'a');
             const child = spawn(command, args, {
                 windowsHide: true,
+                env,
                 detached: true,
                 stdio: ['ignore', logFd, logFd],
             });
@@ -188,6 +191,8 @@ export async function pgliteUp(services, dataDir) {
                     throw new Error(`${name} exited before serving — see ${log}`);
                 if (Date.now() > deadline)
                     throw new Error(`${name} did not serve port ${service.hostPort} within ${READY_TIMEOUT_MS / 1000}s — see ${log}`);
+                // an aborted boot (Ctrl-C during up) stops waiting; the catch below ends what this up started
+                launch.signal?.throwIfAborted();
                 await sleep(200);
             }
         }

package/dist/src/redis-backing.d.ts

@@ -1,8 +1,8 @@
-import type { InfraService } from './pglite-backing.js';
+import type { HostLaunch, InfraService } from './pglite-backing.js';
 /** The redis twin's cli: installed beside this runtime (its node_modules walk), else beside the World's config. */
 export declare function redisTwinCli(from: string[]): string | undefined;
 /** Where the service's keys live: the World's tree for the `redis` service, under the World's data. */
 export declare const redisTwinRoot: (dataDir: string) => string;
-export declare function redisTwinUp(services: InfraService[], dataDir: string, cli: string): Promise<void>;
+export declare function redisTwinUp(services: InfraService[], dataDir: string, cli: string, launch?: HostLaunch): Promise<void>;
 export declare function redisTwinStatus(services: InfraService[], dataDir: string): Promise<number>;
 export declare function redisTwinDown(services: InfraService[], dataDir: string): Promise<void>;

package/dist/src/redis-backing.js

@@ -48,7 +48,7 @@ function listening(port) {
     });
 }
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-export async function redisTwinUp(services, dataDir, cli) {
+export async function redisTwinUp(services, dataDir, cli, launch = {}) {
     for (const service of services) {
         const pidFile = pidPath(dataDir, service);
         if (existsSync(pidFile) && alive(Number(readFileSync(pidFile, 'utf8').trim())) && await listening(service.hostPort))
@@ -67,6 +67,7 @@ export async function redisTwinUp(services, dataDir, cli) {
         // type transformation, not only stripping (the kernel declares constructor parameter properties)
         const runtime = typeof globalThis.Bun !== 'undefined' || !cli.endsWith('.ts') ? [] : ['--experimental-transform-types', '--no-warnings'];
         const child = spawn(process.execPath, [...runtime, cli, 'serve', '--port', String(service.hostPort), '--root', root], {
+            env: launch.env ?? process.env,
             detached: true,
             stdio: ['ignore', logFd, logFd],
         });
@@ -77,6 +78,7 @@ export async function redisTwinUp(services, dataDir, cli) {
         while (!(await listening(service.hostPort)) || !alive(child.pid)) {
             if (!alive(child.pid))
                 throw new Error(`redis exited before serving — see ${log}`);
+            launch.signal?.throwIfAborted();
             if (Date.now() > deadline)
                 throw new Error(`redis did not serve port ${service.hostPort} within ${READY_TIMEOUT_MS / 1000}s — see ${log}`);
             await sleep(200);

package/dist/src/runtime.js

@@ -12,7 +12,7 @@ import { createRequire } from 'node:module';
 import { isIP } from 'node:net';
 import { allocatePort } from "./tcp-port.js";
 import { constants as osConstants, hostname as osHostname } from 'node:os';
-import { appendFileSync, chmodSync, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, writeFileSync, writeSync, existsSync } from 'node:fs';
+import { accessSync, appendFileSync, chmodSync, closeSync, constants as fsConstants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync, existsSync } from 'node:fs';
 import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import { packFacts } from "./pack-facts.js";
 import { describeServiceEnd, readServiceEnd, serviceOutput } from "./service-exit.js";
@@ -803,6 +803,8 @@ async function runExternalCommand(command, cwd, serviceId, phase, env = process.
  * (instead of buffering through spawnSync's 1MB cap, which a large DB restore would overflow). Returns
  * the combined output so `discover` can read it. Throws with a bounded tail on nonzero exit. */
 async function runExternalUp(command, cwd, serviceId, env, logPath, abort) {
+    if (ownInfrastructureUp(command))
+        return runOwnInfrastructureUp(command, serviceId, env, logPath, abort);
     const [bin, ...args] = ownCommand(command);
     if (!bin)
         throw new Error(`External service "${serviceId}": up command is empty`);
@@ -846,6 +848,40 @@ async function runExternalUp(command, cwd, serviceId, env, logPath, abort) {
     }
     return chunks.join('');
 }
+/** Whether an external `up` is this runtime's own managed-infrastructure tool (`volter-world-infra up`, which `init`
+ *  names), with nothing on PATH answering the name: the phase then runs in this process (infra.ts) instead of in a
+ *  child. The services it starts (the PGlite host, the redis and MongoDB twins) are then children of the process that
+ *  owns the World's lifetime, as every service recorder is, not of a tool that exits once they serve. Where a child
+ *  does not outlive its parent (a browser tab's process layer, measured 2026-09-28: a detached, unref'd listener
+ *  ended with the process that spawned it), the PGlite host ended the moment `volter-world-infra up` returned and
+ *  the readiness probe timed out at "0/1 declared services are ready". status and down still run as the tool.
+ *  The phase gets what the tool's process got: the infrastructure service's environment (`env`, which the hosts it
+ *  starts are spawned with, never this process's own) and the boot's abort; its commands (docker info, compose)
+ *  run without blocking this process's event loop. */
+function ownInfrastructureUp(command) {
+    return command[0] === 'volter-world-infra' && command[1] === 'up' && ownCommand(command)[0] === process.execPath;
+}
+async function runOwnInfrastructureUp(command, serviceId, env, logPath, abort) {
+    writeFileSync(logPath, `$ ${command.join(' ')}\n`, { mode: 0o600 });
+    chmodSync(logPath, 0o600);
+    const out = openPrivateLog(logPath, 'a');
+    const chunks = [];
+    try {
+        abort?.throwIfAborted();
+        const { runInfrastructure } = await import("./infra.js");
+        const write = (text) => { chunks.push(text); writeSync(out, text); };
+        const code = await runInfrastructure(command[1], env, { out: write, err: write }, abort);
+        abort?.throwIfAborted();
+        if (code !== 0) {
+            const detail = chunks.join('').trim().split('\n').slice(-40).join('\n');
+            throw new Error(`External service "${serviceId}": up command exited ${code}\n${detail}`);
+        }
+    }
+    finally {
+        closeSync(out);
+    }
+    return chunks.join('');
+}
 /** Resolve `${url}`/`${host}`/`${port}` in a readiness probe's httpUrl against an owned loopback
  * service's allocated port (process/twin readiness — the port is auto-assigned, so it can't be a
  * literal in the config). Other probe kinds (command/stdoutMatch) are returned unchanged. */
@@ -2236,7 +2272,21 @@ export function ownCommand(command) {
         return command;
     return [process.execPath, siblingScript(import.meta.url, stem), ...args];
 }
+/** A command answers when it names an executable: a path is checked as a file (what `which` does with a path),
+ *  never by spawning `which`. `ownCommand` hands this the running executable's own path (process.execPath), and a
+ *  process layer without synchronous spawn (a browser tab's, where spawnSync is ENOSYS) answered "not found on PATH"
+ *  for the very node running the World: the managed infrastructure never started there. A bare name is still looked
+ *  up on PATH. */
 function onPath(command) {
+    if (command.includes(sep) || command.includes('/')) {
+        try {
+            accessSync(command, fsConstants.X_OK);
+            return statSync(command).isFile();
+        }
+        catch {
+            return false;
+        }
+    }
     return spawnSync('which', [command], { windowsHide: true, stdio: 'ignore', env: process.env }).status === 0;
 }
 function resolveWithPublicDns(hostname) {