@volter/world-runtime 2.0.27 → 2.0.28

package/dist/src/root.d.ts

@@ -12,6 +12,7 @@ export declare function sealTwinCredential(worldRoot: string, vendor: string, pa
 export declare function sealedCredentialInfo(worldRoot: string, vendor: string): {
     placedAt: string;
     fingerprint: string;
+    sealedBy: 'vault' | 'key';
 } | null;
 /** The signing secret sealed beside the credential (`{ headers, signingSecret }`), for ingest; null when none. */
 export declare function twinSigningSecret(worldRoot: string, vendor: string): Promise<string | null>;

package/dist/src/root.js

@@ -11,7 +11,7 @@ import { packEntry } from "./catalog.js";
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, relative, resolve } from 'node:path';
-import { authStrategyFor, getActiveWorldStore, getPack, sealingKey, buildRemoteExecute, clearRoot, openSealedCredential, readRoot, registerStateSystem, sealCredential, stateDirName, stateSystemFor, validateRemoteOrigin, writeRoot, } from '@volter/world-core';
+import { authStrategyFor, currentSealer, openSealedAt, getActiveWorldStore, getPack, buildRemoteExecute, clearRoot, readRoot, registerStateSystem, stateDirName, stateSystemFor, validateRemoteOrigin, writeRoot, } from '@volter/world-core';
 import { loadWorldConfig, writeWorldConfig } from "./configs.js";
 import { changesetReadiness, collectObservations, foldObservations, loadChecks, openRootCredential, performEntries, rootCustody, protocolStanding } from '@volter/world-core';
 import { findWorldChangeset, listWorldChangesets } from "./changeset.js";
@@ -31,7 +31,7 @@ export function credentialPath(worldRoot, vendor) {
     return join(resolve(worldRoot), stateDirName(), 'credentials', `${vendor}.json`);
 }
 export async function sealTwinCredential(worldRoot, vendor, payload, at = new Date().toISOString()) {
-    const sealed = await sealCredential(sealingKey(), payload, at, vendor);
+    const sealed = await currentSealer().seal(payload, at, vendor);
     getActiveWorldStore().write(credentialPath(worldRoot, vendor), `${JSON.stringify(sealed, null, 2)}\n`, { secret: true });
     return { placedAt: sealed.placedAt, fingerprint: sealed.fingerprint };
 }
@@ -40,14 +40,14 @@ export function sealedCredentialInfo(worldRoot, vendor) {
     if (text === null)
         return null;
     const sealed = JSON.parse(text);
-    return { placedAt: sealed.placedAt, fingerprint: sealed.fingerprint };
+    // what wraps it: a vault's transit key (v: 2) or a key the host holds (v: 1), so an operator sees what still needs one
+    return { placedAt: sealed.placedAt, fingerprint: sealed.fingerprint, sealedBy: sealed.v === 2 ? 'vault' : 'key' };
 }
 /** The signing secret sealed beside the credential (`{ headers, signingSecret }`), for ingest; null when none. */
 export async function twinSigningSecret(worldRoot, vendor) {
-    const text = getActiveWorldStore().read(credentialPath(worldRoot, vendor));
-    if (text === null)
+    const payload = await openSealedAt(credentialPath(worldRoot, vendor), vendor);
+    if (payload === null)
         return null;
-    const payload = await openSealedCredential(sealingKey(), JSON.parse(text), vendor);
     return typeof payload.signingSecret === 'string' && payload.signingSecret.length >= 8 ? payload.signingSecret : null;
 }
 // ── where a root's credential comes from (company decision 0033) ────────────────────────────

package/dist/src/served-world.js

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { blobDigest, getActiveBlobStore, loadCheck, mirrorShellUnder, openSealedCredential, readTwinRequestJournal, sealingKey, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
+import { blobDigest, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -912,10 +912,9 @@ export class WorldDoors {
      *  token removed and the sealed credential's headers replacing any of the same name. The vendor's
      *  answer (status, headers, body) is streamed back as it arrives. */
     async forward(request, url, rest, name, origin) {
-        const sealed = getActiveWorldStore().read(credentialPath(this.worldRoot, name));
-        if (sealed === null)
+        const credential = await openSealedAt(credentialPath(this.worldRoot, name), name);
+        if (credential === null)
             return Response.json({ error: `the ${name} link has no credential sealed` }, { status: 409 });
-        const credential = await openSealedCredential(sealingKey(), JSON.parse(sealed), name);
         const base = validateRemoteOrigin(origin);
         const target = new URL(`${base.origin}/${rest}${url.search}`);
         if (target.origin !== base.origin)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.27",
+  "version": "2.0.28",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -67,14 +67,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.15",
+    "@volter/world-core": "2.0.16",
     "@volter/world-console": "2.0.10"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "2.0.2",
-    "@volter/world-core": "2.0.15",
+    "@volter/world-core": "2.0.16",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0"
   },
@@ -84,6 +84,6 @@
     }
   },
   "optionalDependencies": {
-    "@volter/twin-mongodb": "0.1.15"
+    "@volter/twin-mongodb": "0.1.16"
   }
 }

package/src/root.ts

@@ -12,7 +12,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import {
-  NO_SECRETS_CHECK, authStrategyFor, getActiveWorldStore, getPack, sealingKey, buildRemoteExecute, clearRoot, observeAppends, openSealedCredential, readRoot, registerStateSystem, sealCredential, stateDirName, stateSystemFor, type Check, type CredentialPayload, type PerformAction, type PushReport, type RemoteExecute, type RootConfig, type SealedCredential, type TwinAction, validateRemoteOrigin, writeRoot,
+  NO_SECRETS_CHECK, authStrategyFor, currentSealer, openSealedAt, getActiveWorldStore, getPack, buildRemoteExecute, clearRoot, observeAppends, readRoot, registerStateSystem, stateDirName, stateSystemFor, type Check, type CredentialPayload, type PerformAction, type PushReport, type RemoteExecute, type RootConfig, type SealedCredential, type TwinAction, validateRemoteOrigin, writeRoot,
 } from '@volter/world-core';
 import { loadWorldConfig, writeWorldConfig } from './configs.ts';
 import { changesetReadiness, collectObservations, type Observation, foldObservations, loadChecks, openRootCredential, performEntries, rootCustody, protocolStanding, userKek, type DeployReport, type ObserveReport } from '@volter/world-core';
@@ -38,21 +38,21 @@ export function credentialPath(worldRoot: string, vendor: string): string {
   return join(resolve(worldRoot), stateDirName(), 'credentials', `${vendor}.json`);
 }
 export async function sealTwinCredential(worldRoot: string, vendor: string, payload: CredentialPayload, at: string = new Date().toISOString()): Promise<{ placedAt: string; fingerprint: string }> {
-  const sealed = await sealCredential(sealingKey(), payload, at, vendor);
+  const sealed = await currentSealer().seal(payload, at, vendor);
   getActiveWorldStore().write(credentialPath(worldRoot, vendor), `${JSON.stringify(sealed, null, 2)}\n`, { secret: true });
   return { placedAt: sealed.placedAt, fingerprint: sealed.fingerprint };
 }
-export function sealedCredentialInfo(worldRoot: string, vendor: string): { placedAt: string; fingerprint: string } | null {
+export function sealedCredentialInfo(worldRoot: string, vendor: string): { placedAt: string; fingerprint: string; sealedBy: 'vault' | 'key' } | null {
   const text = getActiveWorldStore().read(credentialPath(worldRoot, vendor));
   if (text === null) return null;
   const sealed = JSON.parse(text) as SealedCredential;
-  return { placedAt: sealed.placedAt, fingerprint: sealed.fingerprint };
+  // what wraps it: a vault's transit key (v: 2) or a key the host holds (v: 1), so an operator sees what still needs one
+  return { placedAt: sealed.placedAt, fingerprint: sealed.fingerprint, sealedBy: sealed.v === 2 ? 'vault' : 'key' };
 }
 /** The signing secret sealed beside the credential (`{ headers, signingSecret }`), for ingest; null when none. */
 export async function twinSigningSecret(worldRoot: string, vendor: string): Promise<string | null> {
-  const text = getActiveWorldStore().read(credentialPath(worldRoot, vendor));
-  if (text === null) return null;
-  const payload = await openSealedCredential(sealingKey(), JSON.parse(text) as SealedCredential, vendor);
+  const payload = await openSealedAt(credentialPath(worldRoot, vendor), vendor);
+  if (payload === null) return null;
   return typeof payload.signingSecret === 'string' && payload.signingSecret.length >= 8 ? payload.signingSecret : null;
 }
 

package/src/served-world.ts

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
-import { blobDigest, getActiveBlobStore, loadCheck, mirrorShellUnder, openSealedCredential, readTwinRequestJournal, sealingKey, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
+import { blobDigest, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from './init.ts';
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type TrustedIssuer, type WorldCredentials } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -817,9 +817,8 @@ export class WorldDoors {
    *  token removed and the sealed credential's headers replacing any of the same name. The vendor's
    *  answer (status, headers, body) is streamed back as it arrives. */
   private async forward(request: Request, url: URL, rest: string, name: string, origin: string): Promise<Response> {
-    const sealed = getActiveWorldStore().read(credentialPath(this.worldRoot, name));
-    if (sealed === null) return Response.json({ error: `the ${name} link has no credential sealed` }, { status: 409 });
-    const credential = await openSealedCredential(sealingKey(), JSON.parse(sealed) as SealedCredential, name);
+    const credential = await openSealedAt(credentialPath(this.worldRoot, name), name);
+    if (credential === null) return Response.json({ error: `the ${name} link has no credential sealed` }, { status: 409 });
     const base = validateRemoteOrigin(origin);
     const target = new URL(`${base.origin}/${rest}${url.search}`);
     if (target.origin !== base.origin) return Response.json({ error: 'the path left the link origin' }, { status: 400 });