@volter/world-runtime 3.0.117 → 3.0.119

package/dist/src/attach.d.ts

@@ -1,3 +1,4 @@
+import { type WorldNetwork } from '@volter/world-core/network-policy';
 export declare const WORLD_REF_FILE = ".volter-world";
 export type WorldRefSource = 'explicit' | 'env' | 'file';
 export interface ResolvedWorldRef {
@@ -24,6 +25,8 @@ export declare function resolveWorldRef(explicit: string | undefined, options?:
 /** The manifest (docs/guides/route-a-cli-through-the-world.md): what a world publishes to its attachers. */
 export interface WorldManifest {
     name: string;
+    /** Declared network grants; attachers intersect these with their caller's ceiling. */
+    network?: WorldNetwork;
     /** vendor host → twin endpoint, exactly the map the injector/proxy redirect */
     vendors: Record<string, string>;
     /** session CA (PEM) when the world has one, else null */

package/dist/src/attach.js

@@ -10,6 +10,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { activeVendorMap } from "./redirect-proxy.js";
 import { statusWorld } from "./runtime.js";
+import { worldNetworkPolicyFromEnv } from '@volter/world-core/network-policy';
 export const WORLD_REF_FILE = '.volter-world';
 /** A world reference is remote when it is a URL; every other ref is a local world name. */
 export function isRemoteWorldRef(ref) {
@@ -53,7 +54,7 @@ export function resolveWorldRef(explicit, options = {}) {
 // Internal runtime vars are plumbing, not suggested credentials. CA-trust
 // bundle vars are local renderings of `ca` (they hold machine-local paths), so
 // a manifest never carries them — an attacher re-renders trust from `ca`.
-const MANIFEST_ENV_EXCLUDED = /^(volter_world_|node_options$|twin_inject$|no_proxy$|https?_proxy$|node_extra_ca_certs$|ssl_cert_file$|(aws|curl|requests)_ca_bundle$)/i;
+const MANIFEST_ENV_EXCLUDED = /^(volter_world(?:_|$)|node_options$|twin_inject$|no_proxy$|https?_proxy$|node_extra_ca_certs$|ssl_cert_file$|(aws|curl|requests)_ca_bundle$)/i;
 /** Derive the manifest from a world's generated env map (the local rendering).
  * Pure — the CA is inlined only when its file is readable. */
 export function deriveWorldManifest(name, worldEnv) {
@@ -78,7 +79,9 @@ export function deriveWorldManifest(name, worldEnv) {
             continue; // rendered as `vendors`, not credentials
         env[key] = value;
     }
-    return { name, vendors, ca, proxy: worldEnv.VOLTER_WORLD_PROXY ?? null, env };
+    const policy = worldNetworkPolicyFromEnv(worldEnv);
+    const network = policy === undefined ? undefined : (({ version, world, ...permission }) => permission)(policy);
+    return { name, vendors, ca, proxy: worldEnv.VOLTER_WORLD_PROXY ?? null, env, ...(network === undefined ? {} : { network }) };
 }
 /** The manifest of a local world instance (name resolved against `root` like every other verb). */
 export function worldManifest(name, root = process.cwd()) {

package/dist/src/cli-commands.js

@@ -940,7 +940,7 @@ export async function main() {
             const { bridgeTwins } = createRequire(import.meta.url)('@volter/world-core/http-bridge');
             await bridgeTwins(manifest, manifest.env.VOLTER_TWINS_KEY ?? attachToken ?? '', manifest.ca ?? undefined);
             const injectPath = createRequire(import.meta.url).resolve('@volter/world-core/inject');
-            const env = remoteAttachEnv(manifest, { injectPath, ...(caFile === undefined ? {} : { caFile }) });
+            const env = remoteAttachEnv(manifest, { injectPath, worldRef: resolved.ref, ...(caFile === undefined ? {} : { caFile }) });
             // the world's byte-stream doors, bridged to loopback listeners here, beside a command in any language
             const { bridgeStreams, drainStreams } = createRequire(import.meta.url)('@volter/world-core/stream-bridge');
             const bridged = manifest.streams ? await bridgeStreams(manifest.streams, manifest.env.VOLTER_TWINS_KEY ?? attachToken ?? '') : { env: {} };

package/dist/src/serve.d.ts

@@ -27,4 +27,6 @@ export declare function fetchRemoteManifest(ref: string, options?: {
 export declare function remoteAttachEnv(manifest: WorldManifest, options: {
     caFile?: string;
     injectPath: string;
+    worldRef?: string;
+    callerEnv?: Readonly<Record<string, string | undefined>>;
 }): Record<string, string>;

package/dist/src/serve.js

@@ -9,6 +9,7 @@ import { timingSafeEqual } from 'node:crypto';
 import { createServer as createHttpServer } from 'node:http';
 import { deriveWorldManifest } from "./attach.js";
 import { statusWorld } from "./runtime.js";
+import { worldAttachmentNetworkEnv, worldStrictEgress } from '@volter/world-core/network-policy';
 export const MANIFEST_PATH = '/.well-known/volter-world';
 /** The manifest a REMOTE attacher sees: every vendor behind the one advertised
  * door. The serving side keeps routing against its own loopback env. */
@@ -71,7 +72,9 @@ export async function fetchRemoteManifest(ref, options = {}) {
 /** The env a remote env-attachment exports: vendor twin URLs (the advertised
  * door), suggested fake credentials, CA trust, and the injector preload. */
 export function remoteAttachEnv(manifest, options) {
-    const env = { ...manifest.env };
+    const env = { ...manifest.env,
+        ...worldAttachmentNetworkEnv(options.worldRef ?? manifest.name, manifest.network, options.callerEnv ?? process.env, worldStrictEgress(manifest.env)),
+    };
     for (const [vendor, origin] of Object.entries(manifest.vendors)) {
         env[`${vendor.toUpperCase()}_TWIN_URL`] = origin;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.117",
+  "version": "3.0.119",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -70,14 +70,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.117",
-    "@volter/world-console": "3.0.112"
+    "@volter/world-core": "3.0.119",
+    "@volter/world-console": "3.0.114"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.117",
+    "@volter/world-core": "3.0.119",
     "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",

package/src/attach.ts

@@ -10,6 +10,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { activeVendorMap } from './redirect-proxy.ts';
 import { statusWorld } from './runtime.ts';
+import { worldNetworkPolicyFromEnv, type WorldNetwork } from '@volter/world-core/network-policy';
 
 export const WORLD_REF_FILE = '.volter-world';
 
@@ -67,6 +68,8 @@ export function resolveWorldRef(
 /** The manifest (docs/guides/route-a-cli-through-the-world.md): what a world publishes to its attachers. */
 export interface WorldManifest {
   name: string;
+  /** Declared network grants; attachers intersect these with their caller's ceiling. */
+  network?: WorldNetwork;
   /** vendor host → twin endpoint, exactly the map the injector/proxy redirect */
   vendors: Record<string, string>;
   /** session CA (PEM) when the world has one, else null */
@@ -85,7 +88,7 @@ export interface WorldManifest {
 // bundle vars are local renderings of `ca` (they hold machine-local paths), so
 // a manifest never carries them — an attacher re-renders trust from `ca`.
 const MANIFEST_ENV_EXCLUDED =
-  /^(volter_world_|node_options$|twin_inject$|no_proxy$|https?_proxy$|node_extra_ca_certs$|ssl_cert_file$|(aws|curl|requests)_ca_bundle$)/i;
+  /^(volter_world(?:_|$)|node_options$|twin_inject$|no_proxy$|https?_proxy$|node_extra_ca_certs$|ssl_cert_file$|(aws|curl|requests)_ca_bundle$)/i;
 
 /** Derive the manifest from a world's generated env map (the local rendering).
  * Pure — the CA is inlined only when its file is readable. */
@@ -107,7 +110,9 @@ export function deriveWorldManifest(name: string, worldEnv: Record<string, strin
     if (/_TWIN_URL$/.test(key)) continue; // rendered as `vendors`, not credentials
     env[key] = value;
   }
-  return { name, vendors, ca, proxy: worldEnv.VOLTER_WORLD_PROXY ?? null, env };
+  const policy = worldNetworkPolicyFromEnv(worldEnv);
+  const network = policy === undefined ? undefined : (({ version, world, ...permission }) => permission)(policy);
+  return { name, vendors, ca, proxy: worldEnv.VOLTER_WORLD_PROXY ?? null, env, ...(network === undefined ? {} : { network }) };
 }
 
 /** The manifest of a local world instance (name resolved against `root` like every other verb). */

package/src/cli-commands.ts

@@ -818,7 +818,7 @@ export async function main(): Promise<void> {
       const { bridgeTwins } = createRequire(import.meta.url)('@volter/world-core/http-bridge') as { bridgeTwins: (manifest: WorldManifest, key: string, ca?: string) => Promise<unknown[]> };
       await bridgeTwins(manifest, manifest.env.VOLTER_TWINS_KEY ?? attachToken ?? '', manifest.ca ?? undefined);
       const injectPath = createRequire(import.meta.url).resolve('@volter/world-core/inject');
-      const env = remoteAttachEnv(manifest, { injectPath, ...(caFile === undefined ? {} : { caFile }) });
+      const env = remoteAttachEnv(manifest, { injectPath, worldRef: resolved.ref, ...(caFile === undefined ? {} : { caFile }) });
       // the world's byte-stream doors, bridged to loopback listeners here, beside a command in any language
       const { bridgeStreams, drainStreams } = createRequire(import.meta.url)('@volter/world-core/stream-bridge') as { bridgeStreams: (streams: WorldManifest['streams'], token: string) => Promise<{ env: Record<string, string> }>; drainStreams: (ms?: number) => Promise<void> };
       const bridged = manifest.streams ? await bridgeStreams(manifest.streams, manifest.env.VOLTER_TWINS_KEY ?? attachToken ?? '') : { env: {} };

package/src/serve.ts

@@ -9,6 +9,7 @@ import { timingSafeEqual } from 'node:crypto';
 import { createServer as createHttpServer, type Server as HttpServer } from 'node:http';
 import { deriveWorldManifest, type WorldManifest } from './attach.ts';
 import { statusWorld } from './runtime.ts';
+import { worldAttachmentNetworkEnv, worldStrictEgress } from '@volter/world-core/network-policy';
 
 export const MANIFEST_PATH = '/.well-known/volter-world';
 
@@ -90,9 +91,11 @@ export async function fetchRemoteManifest(ref: string, options: { token?: string
  * door), suggested fake credentials, CA trust, and the injector preload. */
 export function remoteAttachEnv(
   manifest: WorldManifest,
-  options: { caFile?: string; injectPath: string },
+  options: { caFile?: string; injectPath: string; worldRef?: string; callerEnv?: Readonly<Record<string, string | undefined>> },
 ): Record<string, string> {
-  const env: Record<string, string> = { ...manifest.env };
+  const env: Record<string, string> = { ...manifest.env,
+    ...worldAttachmentNetworkEnv(options.worldRef ?? manifest.name, manifest.network, options.callerEnv ?? process.env, worldStrictEgress(manifest.env)),
+  };
   for (const [vendor, origin] of Object.entries(manifest.vendors)) {
     env[`${vendor.toUpperCase()}_TWIN_URL`] = origin;
   }