@volter/world-runtime 3.0.123 → 3.0.125

package/dist/src/configs.js

@@ -32,7 +32,7 @@ const LEGACY_TOP_LEVEL = new Set(['id', 'description', 'bare', 'remotes', 'resou
 const LEGACY_SERVICE = new Set(['id', 'type', 'package', 'command', 'args', 'cwd', 'port', 'portReason', 'env', 'controlPlane', 'branchState', 'injectEnv', 'injectEnvTemplates', 'root', 'rootArg', 'portArg', 'cliRedirect', 'ready', 'preload', 'external', 'colocate', 'version']);
 const LEGACY_NESTED = {
     bare: new Set(['name']), resources: new Set(['memoryMiB', 'writableStorageMiB']), catalog: new Set(['sha', 'protocol']),
-    root: new Set(['url', 'deploy', 'refresh', 'scope']), refresh: new Set(['every', 'webhook']),
+    root: new Set(['url', 'deploy', 'refresh', 'scope']), refresh: new Set(['every', 'webhook', 'atMost']),
     external: new Set(['up', 'status', 'down', 'discover', 'readyWhen']), discover: new Set(['as', 'source', 'jsonPath', 'pattern']),
     ready: new Set(['command', 'args', 'httpUrl', 'timeoutMs', 'intervalMs']), colocate: new Set(['module', 'export', 'scenarioPath']),
     share: new Set(['provider', 'command', 'args', 'ephemeral', 'services']), shareService: new Set(['id', 'verifyPath']),

package/dist/src/root.js

@@ -13,7 +13,7 @@ import { packEntry } from "./catalog.js";
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, relative, resolve } from 'node:path';
-import { authStrategyFor, currentSealer, destinationOf, sealsThroughVault, openSealedAt, getActiveWorldStore, getPack, buildRemoteExecute, clearRoot, readRoot, registerStateSystem, stateDirName, stateSystemFor, validateRemoteOrigin, writeRoot, } from '@volter/world-core/runtime';
+import { authStrategyFor, currentSealer, destinationOf, sealsThroughVault, openSealedAt, getActiveWorldStore, getPack, buildRemoteExecute, clearRoot, readRoot, registerPack, registerStateSystem, stateDirName, stateSystemFor, validateRemoteOrigin, writeRoot, } from '@volter/world-core/runtime';
 import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from "./configs.js";
 import { changesetReadiness, collectObservations, foldObservations, loadChecks, openRootCredential, performEntries, rootCustody, vendorPackageDir } from '@volter/world-core/runtime';
 import { findWorldChangeset, listWorldChangesets } from "./changeset.js";
@@ -427,7 +427,14 @@ async function packModule(vendor, from) {
     if (registered)
         return { pack: registered };
     const entry = packEntryPath(vendor, from);
-    return entry ? await importModule(entry) : null;
+    if (!entry)
+        return null;
+    const mod = await importModule(entry);
+    // An app-local pack may import its own installed kernel copy. Arm the exported descriptor in this runtime's
+    // kernel too, so its executor sees the pack's budget, hosts and references rather than the fallback.
+    if (mod.pack)
+        registerPack(mod.pack);
+    return mod;
 }
 /** The pack's directory: installed beside the World, in its pack repository, or in the pack repository beside this
  *  platform checkout. */

package/dist/src/runtime.js

@@ -28,7 +28,7 @@ import { isEnvironmentName } from "./schema.js";
 import { infraConnections, parseInfraDefinition } from "./pglite-backing.js";
 import { describeServiceEnd, readServiceEnd } from "./service-exit.js";
 import { Socket } from 'node:net';
-import { getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
+import { beginPlaceholderPull, endPlaceholderPull, placeholderPullActive, getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
 import { loadWorldConfig } from "./configs.js";
 import { createWorldNetworkPolicy, parseWorldNetworkPolicy, normalizeWorldNetwork, intersectWorldNetwork, WORLD_NETWORK_POLICY_ENV } from '@volter/world-core/network-policy';
 import { overlayPackFactsFile, resolveServicePackage } from "./catalog.js";
@@ -1613,7 +1613,7 @@ const ISSUE_TIMEOUT_MS = 15_000;
 /** A twin's issued credential (its `issues`, copied from its pack's credentialDoor by init): once it is up, the door is
  *  asked for one and each pending name of that service is set to it. A twin that answers no credential, or has no
  *  door, leaves the names unset and says so, rather than handing the application a fixture the twin would refuse. */
-async function issueCredentials(service, started, env, pending, unissued) {
+async function issueCredentials(service, started, env, pending, unissued, controlRoot) {
     const direct = new Set([...pending].filter(([, id]) => id === `${service.id}@direct`).map(([name]) => name));
     const wanted = [...pending].filter(([name, id]) => id === service.id || direct.has(name)).map(([name]) => name);
     if (wanted.length === 0)
@@ -1631,10 +1631,21 @@ async function issueCredentials(service, started, env, pending, unissued) {
             throw new Error('its service names no credential door');
         if (!started.url)
             throw new Error('it has no URL to ask');
-        const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
-        if (!res.ok)
-            throw new Error(`answered ${res.status}`);
-        const answer = (await res.json());
+        // A boot's identity is existing account state, not an application write to deploy.
+        const enclosingSeed = placeholderPullActive(service.id, controlRoot);
+        if (!enclosingSeed)
+            beginPlaceholderPull(service.id, controlRoot);
+        let answer;
+        try {
+            const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
+            if (!res.ok)
+                throw new Error(`answered ${res.status}`);
+            answer = (await res.json());
+        }
+        finally {
+            if (!enclosingSeed)
+                endPlaceholderPull(service.id, controlRoot);
+        }
         for (const name of wanted) {
             const spec = door.fill[name] ?? '';
             if (spec.startsWith('directory:') || spec.startsWith('file:')) {
@@ -2277,7 +2288,7 @@ export async function upWorld(configId, options = {}, abort) {
                     for (const started of host.services) {
                         const declared = colocated.find((s) => s.id === started.id);
                         if (declared)
-                            await issueCredentials(declared, started, env, issuing, unissued);
+                            await issueCredentials(declared, started, env, issuing, unissued, ownedPath(data, started.id));
                     }
                     writeProxyEnv(root, name, env);
                     if (colocated.length)
@@ -2347,7 +2358,7 @@ export async function upWorld(configId, options = {}, abort) {
                 recordService(started);
                 recordPidsSoFar();
                 Object.assign(env, started.env);
-                await issueCredentials(service, started, env, issuing, unissued);
+                await issueCredentials(service, started, env, issuing, unissued, ownedPath(data, started.id));
                 writeProxyEnv(root, name, env);
                 boot.progress(`${service.id}: started, its environment merged`);
             }

package/dist/src/schema.d.ts

@@ -230,6 +230,7 @@ export type WorldServiceConfig = {
         refresh?: {
             every?: string;
             webhook?: boolean;
+            atMost?: string;
         };
         scope?: string;
     };

package/dist/src/schema.js

@@ -245,11 +245,13 @@ function assertLegacyWorldConfig(value, path) {
             if (r.refresh !== undefined) {
                 if (!record(r.refresh))
                     throw new Error(`Service "${service.id}" root.refresh must be an object in ${path}`);
-                assertKeys(r.refresh, ['every', 'webhook'], `Service "${service.id}" root.refresh`, path);
+                assertKeys(r.refresh, ['every', 'webhook', 'atMost'], `Service "${service.id}" root.refresh`, path);
                 if (r.refresh.every !== undefined && typeof r.refresh.every !== 'string')
                     throw new Error(`Service "${service.id}" root.refresh.every must be a string in ${path}`);
                 if (r.refresh.webhook !== undefined && typeof r.refresh.webhook !== 'boolean')
                     throw new Error(`Service "${service.id}" root.refresh.webhook must be a boolean in ${path}`);
+                if (r.refresh.atMost !== undefined && typeof r.refresh.atMost !== 'string')
+                    throw new Error(`Service "${service.id}" root.refresh.atMost must be a string in ${path}`);
             }
             if (r.deploy === undefined)
                 service.root.deploy = 'gated';

package/dist/src/served-world.d.ts

@@ -117,6 +117,7 @@ export type WorldLayout = {
         data: string;
     };
     envFile?: string;
+    env?: Record<string, string>;
     services: Record<string, {
         url?: string;
         protocol?: unknown;

package/dist/src/served-world.js

@@ -1,5 +1,5 @@
 import { errorMessage } from "./error-message.js";
-import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant, historyDigest, historyEntries, readHistoryView, worldPaths } from '@volter/world-core/runtime';
+import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant, historyDigest, historyEntries, readHistoryView, worldPaths, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
 // A SERVED WORLD (docs/reference/http-api.md#a-served-world): `volter world serve` puts a world at
 // `http://<host>:<port>/<org>/<world>/`. Each twin's vendor API is under its vendor id — the
 // addressed grammar RH2 depends on — and the world's own doors are under `/-/<org>/<world>/`:
@@ -1350,7 +1350,15 @@ export class WorldDoors {
                         ...Object.entries(templates).filter(([, t]) => !/\$\{(?:host|port)\}/.test(t)).map(([n, t]) => [n, t.replaceAll('${url}', vendors[v])]),
                     ];
                 }));
-                return Response.json({ name: this.served, vendors, ca: null, proxy: null, env: { ...endpoints, VOLTER_TWINS_KEY: presented }, ...(Object.keys(streams).length ? { streams } : {}) });
+                const runningEnv = this.up().env ?? {};
+                const declaredNames = JSON.parse(runningEnv[WORLD_ENV_NAMES_ENV] ?? '[]');
+                const ownedNames = new Set(Array.isArray(declaredNames) ? declaredNames.filter((name) => typeof name === 'string') : []);
+                const services = loadWorldConfig(this.configRef, this.worldRoot).config.services;
+                const credentials = Object.fromEntries(Object.keys(vendors).flatMap((vendor) => {
+                    const door = services.find((service) => service.id === vendor)?.issues ?? packFacts()[vendor]?.credentialDoor;
+                    return Object.entries(door?.fill ?? {}).flatMap(([name, field]) => !field.startsWith('file:') && ownedNames.has(name) && runningEnv[name] ? [[name, runningEnv[name]]] : []);
+                }));
+                return Response.json({ name: this.served, vendors, ca: null, proxy: null, env: { ...credentials, ...endpoints, VOLTER_TWINS_KEY: presented }, ...(Object.keys(streams).length ? { streams } : {}) });
             }
             if (url.pathname.startsWith(prefix)) {
                 const rest = url.pathname.slice(prefix.length);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.123",
+  "version": "3.0.125",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -70,14 +70,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.123",
-    "@volter/world-console": "3.0.118"
+    "@volter/world-core": "3.0.125",
+    "@volter/world-console": "3.0.120"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.123",
+    "@volter/world-core": "3.0.125",
     "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",

package/src/configs.ts

@@ -36,7 +36,7 @@ const LEGACY_TOP_LEVEL = new Set(['id', 'description', 'bare', 'remotes', 'resou
 const LEGACY_SERVICE = new Set(['id', 'type', 'package', 'command', 'args', 'cwd', 'port', 'portReason', 'env', 'controlPlane', 'branchState', 'injectEnv', 'injectEnvTemplates', 'root', 'rootArg', 'portArg', 'cliRedirect', 'ready', 'preload', 'external', 'colocate', 'version']);
 const LEGACY_NESTED = {
   bare: new Set(['name']), resources: new Set(['memoryMiB', 'writableStorageMiB']), catalog: new Set(['sha', 'protocol']),
-  root: new Set(['url', 'deploy', 'refresh', 'scope']), refresh: new Set(['every', 'webhook']),
+  root: new Set(['url', 'deploy', 'refresh', 'scope']), refresh: new Set(['every', 'webhook', 'atMost']),
   external: new Set(['up', 'status', 'down', 'discover', 'readyWhen']), discover: new Set(['as', 'source', 'jsonPath', 'pattern']),
   ready: new Set(['command', 'args', 'httpUrl', 'timeoutMs', 'intervalMs']), colocate: new Set(['module', 'export', 'scenarioPath']),
   share: new Set(['provider', 'command', 'args', 'ephemeral', 'services']), shareService: new Set(['id', 'verifyPath']),

package/src/root.ts

@@ -14,7 +14,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, relative, resolve } from 'node:path';
 import {
-  NO_SECRETS_CHECK, authStrategyFor, currentSealer, destinationOf, sealsThroughVault, openSealedAt, getActiveWorldStore, getPack, buildRemoteExecute, clearRoot, observeAppends, readRoot, registerStateSystem, stateDirName, stateSystemFor, type Check, type CredentialPayload, type PerformAction, type RemoteExecute, type RootConfig, type SealedCredential, type TwinAction, validateRemoteOrigin, writeRoot,
+  NO_SECRETS_CHECK, authStrategyFor, currentSealer, destinationOf, sealsThroughVault, openSealedAt, getActiveWorldStore, getPack, buildRemoteExecute, clearRoot, observeAppends, readRoot, registerPack, registerStateSystem, stateDirName, stateSystemFor, type Check, type CredentialPayload, type PerformAction, type RemoteExecute, type RootConfig, type SealedCredential, type TwinAction, type TwinPack, validateRemoteOrigin, writeRoot,
 } from '@volter/world-core/runtime';
 import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from './configs.ts';
 import { changesetReadiness, collectObservations, type Observation, foldObservations, loadChecks, openRootCredential, performEntries, rootCustody, protocolStanding, userKek, vendorPackageDir, type DeployReport, type ObserveReport } from '@volter/world-core/runtime';
@@ -356,7 +356,12 @@ async function packModule(vendor: string, from: string): Promise<Record<string,
   const registered = getPack(vendor);
   if (registered) return { pack: registered };
   const entry = packEntryPath(vendor, from);
-  return entry ? await importModule(entry) : null;
+  if (!entry) return null;
+  const mod = await importModule(entry);
+  // An app-local pack may import its own installed kernel copy. Arm the exported descriptor in this runtime's
+  // kernel too, so its executor sees the pack's budget, hosts and references rather than the fallback.
+  if (mod.pack) registerPack(mod.pack as TwinPack);
+  return mod;
 }
 /** The pack's directory: installed beside the World, in its pack repository, or in the pack repository beside this
  *  platform checkout. */

package/src/runtime.ts

@@ -30,7 +30,7 @@ import { isEnvironmentName } from './schema.ts';
 import { infraConnections, parseInfraDefinition } from './pglite-backing.ts';
 import { describeServiceEnd, readServiceEnd } from './service-exit.ts';
 import { Socket } from 'node:net';
-import { getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
+import { beginPlaceholderPull, endPlaceholderPull, placeholderPullActive, getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
 import { loadWorldConfig } from './configs.ts';
 import { createWorldNetworkPolicy, parseWorldNetworkPolicy, normalizeWorldNetwork, intersectWorldNetwork, type WorldNetwork, WORLD_NETWORK_POLICY_ENV } from '@volter/world-core/network-policy';
 import { overlayPackFactsFile, resolveServicePackage } from './catalog.ts';
@@ -1587,7 +1587,7 @@ const ISSUE_TIMEOUT_MS = 15_000;
 /** A twin's issued credential (its `issues`, copied from its pack's credentialDoor by init): once it is up, the door is
  *  asked for one and each pending name of that service is set to it. A twin that answers no credential, or has no
  *  door, leaves the names unset and says so, rather than handing the application a fixture the twin would refuse. */
-async function issueCredentials(service: WorldServiceConfig, started: WorldServiceInstance, env: Record<string, string>, pending: Map<string, string>, unissued: Set<string>): Promise<void> {
+async function issueCredentials(service: WorldServiceConfig, started: WorldServiceInstance, env: Record<string, string>, pending: Map<string, string>, unissued: Set<string>, controlRoot: string): Promise<void> {
   const direct = new Set([...pending].filter(([, id]) => id === `${service.id}@direct`).map(([name]) => name));
   const wanted = [...pending].filter(([name, id]) => id === service.id || direct.has(name)).map(([name]) => name);
   if (wanted.length === 0) return;
@@ -1598,9 +1598,17 @@ async function issueCredentials(service: WorldServiceConfig, started: WorldServi
   try {
     if (!door) throw new Error('its service names no credential door');
     if (!started.url) throw new Error('it has no URL to ask');
-    const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
-    if (!res.ok) throw new Error(`answered ${res.status}`);
-    const answer = (await res.json()) as Record<string, unknown>;
+    // A boot's identity is existing account state, not an application write to deploy.
+    const enclosingSeed = placeholderPullActive(service.id, controlRoot);
+    if (!enclosingSeed) beginPlaceholderPull(service.id, controlRoot);
+    let answer: Record<string, unknown>;
+    try {
+      const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
+      if (!res.ok) throw new Error(`answered ${res.status}`);
+      answer = (await res.json()) as Record<string, unknown>;
+    } finally {
+      if (!enclosingSeed) endPlaceholderPull(service.id, controlRoot);
+    }
     for (const name of wanted) {
       const spec = door.fill[name] ?? '';
       if (spec.startsWith('directory:') || spec.startsWith('file:')) {
@@ -2158,7 +2166,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
           if (colocated.length) boot.progress('co-located host ready: receipt read, every port admitted as its own');
           for (const started of host.services) {
             const declared = colocated.find((s) => s.id === started.id);
-            if (declared) await issueCredentials(declared, started, env, issuing, unissued);
+            if (declared) await issueCredentials(declared, started, env, issuing, unissued, ownedPath(data, started.id));
           }
           writeProxyEnv(root, name, env);
           if (colocated.length) boot.progress('co-located twins: credentials issued, proxy environment written');
@@ -2219,7 +2227,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
         recordService(started);
         recordPidsSoFar();
         Object.assign(env, started.env);
-        await issueCredentials(service, started, env, issuing, unissued);
+        await issueCredentials(service, started, env, issuing, unissued, ownedPath(data, started.id));
         writeProxyEnv(root, name, env);
         boot.progress(`${service.id}: started, its environment merged`);
       }

package/src/schema.ts

@@ -204,7 +204,7 @@ export type WorldServiceConfig = {
   /** THE ROOT (contract "The model"): the vendor's real account behind this twin on a shared world —
    *  its API (or the one resource the account is), the deploy policy, how it is refreshed. Key-free;
    *  the credential is sealed under `.volter/credentials/`. Written by `volter twin <vendor> root`. */
-  root?: { url: string; deploy: 'auto' | 'gated' | 'hold'; refresh?: { every?: string; webhook?: boolean }; scope?: string };
+  root?: { url: string; deploy: 'auto' | 'gated' | 'hold'; refresh?: { every?: string; webhook?: boolean; atMost?: string }; scope?: string };
   rootArg?: string | false;
   portArg?: string | false;
   /**
@@ -635,9 +635,10 @@ function assertLegacyWorldConfig(value: unknown, path: string): WorldConfig {
       if ((r as { scope?: unknown }).scope !== undefined && typeof (r as { scope?: unknown }).scope !== 'string') throw new Error(`Service "${service.id}" root.scope must be a string in ${path}`);
       if (r.refresh !== undefined) {
         if (!record(r.refresh)) throw new Error(`Service "${service.id}" root.refresh must be an object in ${path}`);
-        assertKeys(r.refresh, ['every', 'webhook'], `Service "${service.id}" root.refresh`, path);
+        assertKeys(r.refresh, ['every', 'webhook', 'atMost'], `Service "${service.id}" root.refresh`, path);
         if (r.refresh.every !== undefined && typeof r.refresh.every !== 'string') throw new Error(`Service "${service.id}" root.refresh.every must be a string in ${path}`);
         if (r.refresh.webhook !== undefined && typeof r.refresh.webhook !== 'boolean') throw new Error(`Service "${service.id}" root.refresh.webhook must be a boolean in ${path}`);
+        if (r.refresh.atMost !== undefined && typeof r.refresh.atMost !== 'string') throw new Error(`Service "${service.id}" root.refresh.atMost must be a string in ${path}`);
       }
       if (r.deploy === undefined) (service.root as { deploy: string }).deploy = 'gated';
     }

package/src/served-world.ts

@@ -1,5 +1,5 @@
 import { errorMessage } from './error-message.ts';
-import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant, historyDigest, historyEntries, historyLength, readHistoryView, worldPaths, type HistoryReference } from '@volter/world-core/runtime';
+import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant, historyDigest, historyEntries, historyLength, readHistoryView, worldPaths, WORLD_ENV_NAMES_ENV, type HistoryReference } from '@volter/world-core/runtime';
 // A SERVED WORLD (docs/reference/http-api.md#a-served-world): `volter world serve` puts a world at
 // `http://<host>:<port>/<org>/<world>/`. Each twin's vendor API is under its vendor id — the
 // addressed grammar RH2 depends on — and the world's own doors are under `/-/<org>/<world>/`:
@@ -351,7 +351,7 @@ function streamEnv(id: string, protocol: string): Record<string, string> {
 
 /** What the doors need of a world: where each twin's state lives and which twins it has. A booted
  *  local instance is one; a hosted World describes itself. */
-export type WorldLayout = { dirs: { data: string }; envFile?: string; services: Record<string, { url?: string; protocol?: unknown; resolvedPackage?: string; resolvedVersion?: string; pinnedSource?: { package?: string; version?: string } }> };
+export type WorldLayout = { dirs: { data: string }; envFile?: string; env?: Record<string, string>; services: Record<string, { url?: string; protocol?: unknown; resolvedPackage?: string; resolvedVersion?: string; pinnedSource?: { package?: string; version?: string } }> };
 /** The host a world's doors run in: its layout, and how a request reaches a twin's wire — a local
  *  host forwards to the twin's own port, a hosted World calls the pack in-process. */
 export type DoorHost = {
@@ -1194,7 +1194,16 @@ export class WorldDoors {
             ...Object.entries(templates).filter(([, t]) => !/\$\{(?:host|port)\}/.test(t)).map(([n, t]) => [n, t.replaceAll('${url}', vendors[v]!)]),
           ];
         }));
-        return Response.json({ name: this.served, vendors, ca: null, proxy: null, env: { ...endpoints, VOLTER_TWINS_KEY: presented }, ...(Object.keys(streams).length ? { streams } : {}) });
+        const runningEnv = this.up().env ?? {};
+        const declaredNames: unknown = JSON.parse(runningEnv[WORLD_ENV_NAMES_ENV] ?? '[]');
+        const ownedNames = new Set(Array.isArray(declaredNames) ? declaredNames.filter((name): name is string => typeof name === 'string') : []);
+        const services = loadWorldConfig(this.configRef, this.worldRoot).config.services;
+        const credentials = Object.fromEntries(Object.keys(vendors).flatMap((vendor) => {
+          const door = services.find((service) => service.id === vendor)?.issues ?? packFacts()[vendor]?.credentialDoor;
+          return Object.entries(door?.fill ?? {}).flatMap(([name, field]) =>
+            !field.startsWith('file:') && ownedNames.has(name) && runningEnv[name] ? [[name, runningEnv[name]]] : []);
+        }));
+        return Response.json({ name: this.served, vendors, ca: null, proxy: null, env: { ...credentials, ...endpoints, VOLTER_TWINS_KEY: presented }, ...(Object.keys(streams).length ? { streams } : {}) });
       }
       if (url.pathname.startsWith(prefix)) {
         const rest = url.pathname.slice(prefix.length);