@volter/world-runtime 2.0.31 → 2.0.32

package/dist/src/cli.js

@@ -111,10 +111,10 @@ function printHelp() {
                                                   # merged, occurredAt-ordered feed of the twins' action ledgers — one
                                                   # \`HH:MM:SS.mmm <service> <operation> <subjectId>\` line per action;
                                                   # follows until Ctrl-C (--no-follow: dump and exit; --json: raw JSONL;
-                                                  # --requests: also merge the opt-in request journals — reads/404s,
+                                                  # --requests: also merge the request journals — reads/404s,
                                                   # plus WHICH credential arrived in WHICH header/query param, named +
-                                                  # fingerprinted, never the value — written by twins under
-                                                  # VOLTER_TWIN_REQUEST_JOURNAL=1)
+                                                  # fingerprinted, never the value — kept by every twin and link
+                                                  # unless VOLTER_TWIN_REQUEST_JOURNAL=0)
   volter-world seed <world> [--entry <file>] [--cwd <dir>] [--json] [--root <repo>]
                                                   # pull from the placeholder remote: the seed entry runs with every twin's
                                                   # window open, so the defaults land as observed state (diff empty, nothing pending)

package/dist/src/served-world.d.ts

@@ -314,10 +314,11 @@ export declare class WorldDoors {
         origin: string;
     }>;
     private link;
-    /** Forward to the link's origin: the path under the link, the caller's headers with the World's
-     *  token removed and the sealed credential's headers replacing any of the same name. The vendor's
+    /** Forward to the link's origin: the path under the link, the caller's headers with every World
+     *  credential removed and the sealed credential's headers replacing any of the same name. The vendor's
      *  answer (status, headers, body) is streamed back as it arrives. */
     private forward;
+    private forwardSealed;
     /** The instant of the twin's last completed refresh (its marker's `observedAt`), when it has a root. */
     private observedAt;
     /** The world's own doors under `/-/<org>/<world>/`. */

package/dist/src/served-world.js

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
+import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, journalTwinRequest, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -278,7 +278,8 @@ export async function serveWorld(name, opts = {}) {
     // doors answer 503.
     let consoleOrigin = null;
     // a pushed blob (a release video) is one PUT: bodies up to 1 GiB, past a vendor's own media limits
-    const server = await serveHttp({ hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024, fetch: (request) => consoleRedirect(request, consoleOrigin) ?? mounted.handle(request) });
+    // a front for the whole World: its twins and links keep their own journals (architecture: a multiplexing front journals nothing)
+    const server = await serveHttp({ hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024, twinRequestJournal: false, fetch: (request) => consoleRedirect(request, consoleOrigin) ?? mounted.handle(request) });
     const url = `http://${host}:${server.port}`;
     try {
         await mounted.boot(url);
@@ -850,7 +851,7 @@ export class WorldDoors {
             return foreign;
         const reads = request.method === 'GET' || request.method === 'HEAD';
         // A LINK: a path of this World that forwards to the vendor itself with the credential sealed beside
-        // the World (the World holds the key; its callers hold the World's token). Stateless, no log.
+        // the World (the World holds the key; its callers hold the World's token). Journaled as a twin's request is.
         // a person's browser opening a page at the twin's place (a navigation, or the frame the console shows it in)
         const page = request.method === 'GET' && ['document', 'iframe'].includes(request.headers.get('sec-fetch-dest') ?? '');
         const link = this.link(vendor);
@@ -934,10 +935,34 @@ export class WorldDoors {
         return held === null ? {} : JSON.parse(held);
     }
     link(name) { return this.links()[name] ?? null; }
-    /** Forward to the link's origin: the path under the link, the caller's headers with the World's
-     *  token removed and the sealed credential's headers replacing any of the same name. The vendor's
+    /** Forward to the link's origin: the path under the link, the caller's headers with every World
+     *  credential removed and the sealed credential's headers replacing any of the same name. The vendor's
      *  answer (status, headers, body) is streamed back as it arrives. */
     async forward(request, url, rest, name, origin) {
+        // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
+        // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
+        const caller = new Headers(request.headers);
+        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
+            caller.delete(h);
+        // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
+        const authorization = caller.get('authorization');
+        const offered = authorization ? presentedSecrets(new Headers({ authorization }), { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }) : [];
+        if (offered.some((p) => p.startsWith('tok_')) || (offered.length && grantOf(offered, null, this.issued())))
+            caller.delete('authorization');
+        // an opened seal keeps the audit a twin keeps: the same line in the same journal under the link's
+        // name, with the credential shape of what the caller sent on
+        const startedAt = Date.now();
+        let status = 500;
+        try {
+            const answer = await this.forwardSealed(request, caller, url, rest, name, origin);
+            status = answer.status;
+            return answer;
+        }
+        finally {
+            journalTwinRequest(name, { method: request.method, path: `/${rest}`, status, ms: Date.now() - startedAt, credentials: twinRequestCredentials(caller, url) }, this.controlRoot(name));
+        }
+    }
+    async forwardSealed(request, caller, url, rest, name, origin) {
         const base = validateRemoteOrigin(origin);
         // opened for this link's origin only: a credential sealed for another destination, or for none, refuses
         let credential;
@@ -952,9 +977,7 @@ export class WorldDoors {
         const target = new URL(`${base.origin}/${rest}${url.search}`);
         if (target.origin !== base.origin)
             return Response.json({ error: 'the path left the link origin' }, { status: 400 });
-        const headers = new Headers(request.headers);
-        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
-            headers.delete(h);
+        const headers = new Headers(caller);
         for (const [k, v] of Object.entries(credential.headers))
             headers.set(k, v);
         const body = request.method === 'GET' || request.method === 'HEAD' ? undefined : await request.arrayBuffer();
@@ -1300,11 +1323,11 @@ export class WorldDoors {
         }
         if (kind === 'requests' && !name && request.method === 'GET') {
             // the world's request report (layer 8: Supabase's API report): the kernel's request journal per twin, summed over a period —
-            // requests by twin and status class, the response time's p50/p95, the top routes
+            // requests by twin (and by link, journaled the same way) and status class, the response time's p50/p95, the top routes
             const sinceMs = Number(url.searchParams.get('hours') ?? '24') * 3_600_000;
             const since = Date.now() - sinceMs;
             const twins = [];
-            for (const vendor of Object.keys(this.up().services)) {
+            for (const vendor of [...new Set([...Object.keys(this.up().services), ...Object.keys(this.links())])]) {
                 const entries = readTwinRequestJournal(vendor, this.controlRoot(vendor)).filter((e) => !e.at || Date.parse(e.at) >= since);
                 const byStatus = {};
                 const routes = new Map();

package/dist/src/tail.d.ts

@@ -6,9 +6,9 @@ export type TailWorldOptions = {
     follow?: boolean;
     /** Raw JSONL passthrough with the world service id injected as `service` (default: human lines). */
     json?: boolean;
-    /** Also merge each service's opt-in REQUEST journal into the feed (`requests.jsonl`, written
-     * by twins running under VOLTER_TWIN_REQUEST_JOURNAL=1 — shape-only `{at, method, path,
-     * status}` rows; control-plane/src/serve.ts). Reads are otherwise invisible here: an
+    /** Also merge each service's REQUEST journal into the feed (`requests.jsonl`, kept by every
+     * twin and link unless VOLTER_TWIN_REQUEST_JOURNAL=0 — shape-only `{at, method, path,
+     * status}` rows; world-core/src/serve.ts). Reads are otherwise invisible here: an
      * empty-catalog GET that 404s leaves no trace in an actions-only tail. */
     requests?: boolean;
     /** Poll interval while following (ledger appends are cross-process, so this polls rather than

package/dist/src/tail.js

@@ -6,7 +6,7 @@
 // this just watches what the twins already record. A ledger dir may not exist until a service
 // records its first action, so discovery re-runs on every poll and a missing ledger is a
 // notice, never an error.
-import { closeSync, existsSync, openSync, readSync, readdirSync, statSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readFileSync, readSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { stateDirName } from '@volter/world-core';
 import { statusWorld } from "./runtime.js";
@@ -22,6 +22,15 @@ function serviceLedgers(dataDir, service, file = 'actions.jsonl') {
         .map((entry) => join(stateRoot, entry.name, file))
         .sort();
 }
+/** The World's links by name (`<root>/<state-dir>/links.json`, served-world.ts). */
+function linkNames(root) {
+    try {
+        return Object.keys(JSON.parse(readFileSync(join(root, stateDirName(), 'links.json'), 'utf8')));
+    }
+    catch {
+        return [];
+    }
+}
 /** Read the complete lines appended to `path` since the recorded offset, advancing the offset
  * only past the last newline — a half-written trailing line stays unconsumed until the writer
  * finishes it, so a poll can never emit a torn row. */
@@ -105,9 +114,11 @@ function sleep(ms, signal) {
 export async function tailWorldActions(name, options = {}) {
     const root = options.root ?? process.cwd();
     const instance = statusWorld(name, root);
-    const known = Object.keys(instance.services);
+    // a link (an opened seal) journals its requests as a twin does, under its own name
+    const links = linkNames(root);
+    const known = [...new Set([...Object.keys(instance.services), ...links])];
     for (const service of options.services ?? []) {
-        if (!instance.services[service]) {
+        if (!known.includes(service)) {
             throw new Error(`World ${name} has no service "${service}"; it has: ${known.join(', ')}`);
         }
     }
@@ -143,6 +154,8 @@ export async function tailWorldActions(name, options = {}) {
     };
     emit(collect());
     for (const service of services) {
+        if (links.includes(service) && !instance.services[service])
+            continue; // a link records requests, never actions
         if (serviceLedgers(instance.dirs.data, service).length === 0) {
             notice(`World ${name}: service "${service}" has no action ledger yet${follow
                 ? ' — watching; drive the app (or a vendor SDK) through the world to record actions'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.31",
+  "version": "2.0.32",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -67,14 +67,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.18",
-    "@volter/world-console": "2.0.10"
+    "@volter/world-core": "2.0.19",
+    "@volter/world-console": "2.0.11"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "2.0.2",
-    "@volter/world-core": "2.0.18",
+    "@volter/world-core": "2.0.19",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0"
   },
@@ -84,6 +84,6 @@
     }
   },
   "optionalDependencies": {
-    "@volter/twin-mongodb": "0.1.18"
+    "@volter/twin-mongodb": "0.1.19"
   }
 }

package/src/cli.ts

@@ -112,10 +112,10 @@ function printHelp(): void {
                                                   # merged, occurredAt-ordered feed of the twins' action ledgers — one
                                                   # \`HH:MM:SS.mmm <service> <operation> <subjectId>\` line per action;
                                                   # follows until Ctrl-C (--no-follow: dump and exit; --json: raw JSONL;
-                                                  # --requests: also merge the opt-in request journals — reads/404s,
+                                                  # --requests: also merge the request journals — reads/404s,
                                                   # plus WHICH credential arrived in WHICH header/query param, named +
-                                                  # fingerprinted, never the value — written by twins under
-                                                  # VOLTER_TWIN_REQUEST_JOURNAL=1)
+                                                  # fingerprinted, never the value — kept by every twin and link
+                                                  # unless VOLTER_TWIN_REQUEST_JOURNAL=0)
   volter-world seed <world> [--entry <file>] [--cwd <dir>] [--json] [--root <repo>]
                                                   # pull from the placeholder remote: the seed entry runs with every twin's
                                                   # window open, so the defaults land as observed state (diff empty, nothing pending)

package/src/served-world.ts

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
-import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
+import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, journalTwinRequest, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from './init.ts';
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type TrustedIssuer, type WorldCredentials } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -252,7 +252,8 @@ export async function serveWorld(name: string, opts: { root?: string; port?: num
   // doors answer 503.
   let consoleOrigin: string | null = null;
   // a pushed blob (a release video) is one PUT: bodies up to 1 GiB, past a vendor's own media limits
-  const server = await serveHttp({ hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024, fetch: (request) => consoleRedirect(request, consoleOrigin) ?? mounted.handle(request) });
+  // a front for the whole World: its twins and links keep their own journals (architecture: a multiplexing front journals nothing)
+  const server = await serveHttp({ hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024, twinRequestJournal: false, fetch: (request) => consoleRedirect(request, consoleOrigin) ?? mounted.handle(request) });
   const url = `http://${host}:${server.port}`;
   try { await mounted.boot(url); } catch (error) { await server.stop(true); throw error; }
   // the console, when it is installed beside the World, on an origin of its own (console-apart.ts)
@@ -765,7 +766,7 @@ export class WorldDoors {
     if (foreign) return foreign;
     const reads = request.method === 'GET' || request.method === 'HEAD';
     // A LINK: a path of this World that forwards to the vendor itself with the credential sealed beside
-    // the World (the World holds the key; its callers hold the World's token). Stateless, no log.
+    // the World (the World holds the key; its callers hold the World's token). Journaled as a twin's request is.
     // a person's browser opening a page at the twin's place (a navigation, or the frame the console shows it in)
     const page = request.method === 'GET' && ['document', 'iframe'].includes(request.headers.get('sec-fetch-dest') ?? '');
     const link = this.link(vendor!);
@@ -835,10 +836,31 @@ export class WorldDoors {
   }
   private link(name: string): { origin: string } | null { return this.links()[name] ?? null; }
 
-  /** Forward to the link's origin: the path under the link, the caller's headers with the World's
-   *  token removed and the sealed credential's headers replacing any of the same name. The vendor's
+  /** Forward to the link's origin: the path under the link, the caller's headers with every World
+   *  credential removed and the sealed credential's headers replacing any of the same name. The vendor's
    *  answer (status, headers, body) is streamed back as it arrives. */
   private async forward(request: Request, url: URL, rest: string, name: string, origin: string): Promise<Response> {
+    // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
+    // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
+    const caller = new Headers(request.headers);
+    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) caller.delete(h);
+    // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
+    const authorization = caller.get('authorization');
+    const offered = authorization ? presentedSecrets(new Headers({ authorization }), { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }) : [];
+    if (offered.some((p) => p.startsWith('tok_')) || (offered.length && grantOf(offered, null, this.issued()))) caller.delete('authorization');
+    // an opened seal keeps the audit a twin keeps: the same line in the same journal under the link's
+    // name, with the credential shape of what the caller sent on
+    const startedAt = Date.now(); let status = 500;
+    try {
+      const answer = await this.forwardSealed(request, caller, url, rest, name, origin);
+      status = answer.status;
+      return answer;
+    } finally {
+      journalTwinRequest(name, { method: request.method, path: `/${rest}`, status, ms: Date.now() - startedAt, credentials: twinRequestCredentials(caller, url) }, this.controlRoot(name));
+    }
+  }
+
+  private async forwardSealed(request: Request, caller: Headers, url: URL, rest: string, name: string, origin: string): Promise<Response> {
     const base = validateRemoteOrigin(origin);
     // opened for this link's origin only: a credential sealed for another destination, or for none, refuses
     let credential: Awaited<ReturnType<typeof openSealedAt>>;
@@ -846,8 +868,7 @@ export class WorldDoors {
     if (credential === null) return Response.json({ error: `the ${name} link has no credential sealed` }, { status: 409 });
     const target = new URL(`${base.origin}/${rest}${url.search}`);
     if (target.origin !== base.origin) return Response.json({ error: 'the path left the link origin' }, { status: 400 });
-    const headers = new Headers(request.headers);
-    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) headers.delete(h);
+    const headers = new Headers(caller);
     for (const [k, v] of Object.entries(credential.headers)) headers.set(k, v);
     const body = request.method === 'GET' || request.method === 'HEAD' ? undefined : await request.arrayBuffer();
     const controller = new AbortController();
@@ -1120,10 +1141,10 @@ export class WorldDoors {
     }
     if (kind === 'requests' && !name && request.method === 'GET') {
       // the world's request report (layer 8: Supabase's API report): the kernel's request journal per twin, summed over a period —
-      // requests by twin and status class, the response time's p50/p95, the top routes
+      // requests by twin (and by link, journaled the same way) and status class, the response time's p50/p95, the top routes
       const sinceMs = Number(url.searchParams.get('hours') ?? '24') * 3_600_000; const since = Date.now() - sinceMs;
       const twins: Array<{ twin: string; requests: number; byStatus: Record<string, number>; p50Ms: number | null; p95Ms: number | null; topRoutes: Array<{ route: string; requests: number }> }> = [];
-      for (const vendor of Object.keys(this.up().services)) {
+      for (const vendor of [...new Set([...Object.keys(this.up().services), ...Object.keys(this.links())])]) {
         const entries = readTwinRequestJournal(vendor, this.controlRoot(vendor)).filter((e) => !e.at || Date.parse(e.at) >= since);
         const byStatus: Record<string, number> = {}; const routes = new Map<string, number>(); const times: number[] = [];
         for (const e of entries) { const cls = `${String(e.status)[0]}xx`; byStatus[cls] = (byStatus[cls] ?? 0) + 1; const route = `${e.method} ${e.path.replace(/\/[0-9]+(?=\/|$)/g, '/{id}')}`; routes.set(route, (routes.get(route) ?? 0) + 1); if (typeof e.ms === 'number') times.push(e.ms); }

package/src/tail.ts

@@ -6,7 +6,7 @@
 // this just watches what the twins already record. A ledger dir may not exist until a service
 // records its first action, so discovery re-runs on every poll and a missing ledger is a
 // notice, never an error.
-import { closeSync, existsSync, openSync, readSync, readdirSync, statSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readFileSync, readSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { stateDirName } from '@volter/world-core';
 import { statusWorld } from './runtime.ts';
@@ -40,9 +40,9 @@ export type TailWorldOptions = {
   follow?: boolean;
   /** Raw JSONL passthrough with the world service id injected as `service` (default: human lines). */
   json?: boolean;
-  /** Also merge each service's opt-in REQUEST journal into the feed (`requests.jsonl`, written
-   * by twins running under VOLTER_TWIN_REQUEST_JOURNAL=1 — shape-only `{at, method, path,
-   * status}` rows; control-plane/src/serve.ts). Reads are otherwise invisible here: an
+  /** Also merge each service's REQUEST journal into the feed (`requests.jsonl`, kept by every
+   * twin and link unless VOLTER_TWIN_REQUEST_JOURNAL=0 — shape-only `{at, method, path,
+   * status}` rows; world-core/src/serve.ts). Reads are otherwise invisible here: an
    * empty-catalog GET that 404s leaves no trace in an actions-only tail. */
   requests?: boolean;
   /** Poll interval while following (ledger appends are cross-process, so this polls rather than
@@ -68,6 +68,11 @@ function serviceLedgers(dataDir: string, service: string, file: 'actions.jsonl'
     .sort();
 }
 
+/** The World's links by name (`<root>/<state-dir>/links.json`, served-world.ts). */
+function linkNames(root: string): string[] {
+  try { return Object.keys(JSON.parse(readFileSync(join(root, stateDirName(), 'links.json'), 'utf8')) as Record<string, unknown>); } catch { return []; }
+}
+
 /** Read the complete lines appended to `path` since the recorded offset, advancing the offset
  * only past the last newline — a half-written trailing line stays unconsumed until the writer
  * finishes it, so a poll can never emit a torn row. */
@@ -150,9 +155,11 @@ function sleep(ms: number, signal?: AbortSignal): Promise<void> {
 export async function tailWorldActions(name: string, options: TailWorldOptions = {}): Promise<void> {
   const root = options.root ?? process.cwd();
   const instance = statusWorld(name, root);
-  const known = Object.keys(instance.services);
+  // a link (an opened seal) journals its requests as a twin does, under its own name
+  const links = linkNames(root);
+  const known = [...new Set([...Object.keys(instance.services), ...links])];
   for (const service of options.services ?? []) {
-    if (!instance.services[service]) {
+    if (!known.includes(service)) {
       throw new Error(`World ${name} has no service "${service}"; it has: ${known.join(', ')}`);
     }
   }
@@ -189,6 +196,7 @@ export async function tailWorldActions(name: string, options: TailWorldOptions =
 
   emit(collect());
   for (const service of services) {
+    if (links.includes(service) && !instance.services[service]) continue; // a link records requests, never actions
     if (serviceLedgers(instance.dirs.data, service).length === 0) {
       notice(`World ${name}: service "${service}" has no action ledger yet${follow
         ? ' — watching; drive the app (or a vendor SDK) through the world to record actions'