@volter/world-runtime 3.0.156 → 3.0.157

package/dist/src/changeset.js

@@ -1,6 +1,6 @@
 import { errorMessage } from "./error-message.js";
 import { worldChangesetRules } from "./configs.js";
-import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, getActiveWorldStore, withHistoryLocks, worldPaths } from '@volter/world-core/runtime';
+import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, getActiveWorldStore, resourceBlobFile, resourceBlobKey, withHistoryLocks, worldPaths } from '@volter/world-core/runtime';
 // `volter-world mark` / `diff` / `changeset` — the WORLD-side verbs over the changeset
 // primitive (docs/concepts/the-model.md v0). Thin, exactly like `covers` and `tail` are thin: all
 // the state logic (markers, deltas, content hashing, replay) lives in @volter/world-core's
@@ -24,7 +24,7 @@ import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, g
 // Read-only over the twins' data at rest, like `tail` — except `replay`, which is the one verb
 // here that WRITES, and it writes only through the control plane's kernel write path.
 import { tmpdir } from 'node:os';
-import { join, relative, resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { approveChangeset, rebaseChangeset, buildChangeset, captureMarker, changesetHashMatches, changesetReadiness, diffLedgers, normalizeChangeset, replayChangeset, runChangesetVerifiers, stateDirName, withApplication, withVerification, worldBootMarker, assertSafeChangesetName, assertMarkerBelongsTo, CHANGESET_KIND, MARKER_KIND, WORLD_BOOT_MARKER_ID, } from '@volter/world-core/runtime';
 import { instanceDir, isWorldOrigin, listWorlds, statusWorld } from "./runtime.js";
 import { fetchFromOrigin } from "./origin.js";
@@ -436,7 +436,7 @@ export async function pushWorldChangeset(name, options) {
     const twins = [...new Map(located.changeset.actions.map((a) => [a.service, a.stateService ?? a.service])).entries()];
     const ownBlobs = async (twin, state) => {
         const dir = worldPaths(state, join(instance.dirs.data, twin)).resources;
-        return (await blobs.list(dir)).map((path) => ({ key: relative(dir, path).split('\\').join('/'), path }));
+        return (await blobs.list(dir)).map((path) => ({ key: resourceBlobKey(dir, path), path }));
     };
     // content-addressed means a segment of the key IS the digest of the bytes it holds: such bytes never
     // change. A name built on a digest of something else (a record keyed by a hash of an action id, a
@@ -465,12 +465,12 @@ export async function pushWorldChangeset(name, options) {
                 for (const { key, path } of await ownBlobs(twin, state)) {
                     if (!(await wanted(key, path)))
                         continue;
-                    const held = await blobs.get(join(there, key));
+                    const held = await blobs.get(resourceBlobFile(there, key));
                     if (held !== null && blobDigest(held) === (await digestOf(path)))
                         continue;
                     const bytes = await blobs.get(path);
                     if (bytes)
-                        await blobs.put(join(there, key), bytes);
+                        await blobs.put(resourceBlobFile(there, key), bytes);
                 }
             }
             return;

package/dist/src/served-world.d.ts

@@ -419,6 +419,11 @@ export declare class WorldDoors {
     private enforcesRead;
     /** The vendor wire: `/<org>/<world>/<vendor>/<rest>` → the twin's own URL. */
     private wire;
+    /** A page's links to sites this World serves (the hostnames its twins claim, a Worker's custom domain among them),
+     *  rewritten to where the World shows each (siteUrlOf), so a person who follows one stays in the World. The page's own
+     *  vendor's hosts (`own`) are its own to place, and a site the World does not hold keeps its real address. Null
+     *  when there is nothing to do: not HTML, compressed, or no site served. */
+    private inWorldLinks;
     private linksPath;
     /** The World's links: name → the vendor origin it forwards to. */
     links(): Record<string, {

package/dist/src/served-world.js

@@ -46,7 +46,7 @@ import { fetchFromOrigin } from "./origin.js";
 import { CONSOLE_BASE, consoleRedirect, serveConsoleApart } from "./console-apart.js";
 import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from "./configs.js";
 import { adaptersFor, credentialPath, credentialPayloadFrom, deployTwin, deployWorld, loadWorldChecks, twinSigningSecret, materializeRoots, refreshPosture, refreshTwin, rootForControlRoot, rewrapTwinCredentials, sealTwinCredential, sealedCredentialInfo, bindLegacyCredentials, setTwinRoot, spanMs } from "./root.js";
-import { describeActionFields } from '@volter/world-core/runtime';
+import { describeActionFields, resourceBlobFile } from '@volter/world-core/runtime';
 import { worldLedgers } from "./changeset.js";
 import { clockFile, downWorld, instanceDir, isWorldOrigin, listWorlds, readWorldBootRecord, statusWorld, upWorld } from "./runtime.js";
 import { assertChangesetRules } from "./schema.js";
@@ -1305,12 +1305,21 @@ export class WorldDoors {
                 }
                 catch { /* left as answered */ }
             }
+            // A page a site answers links another site the World serves by its hostname (www.videogame.ai's link to
+            // cyclotron.videogame.ai): it opens where the World shows that site, as a browser redirect does above.
+            const at = request.method !== 'HEAD' ? this.host.sitesTemplate?.() : undefined;
+            const linked = at ? await this.inWorldLinks(answer, out, url.origin, at, undefined, browser) : null;
+            if (linked)
+                return linked;
             return new Response(request.method === 'HEAD' ? null : answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
         }
         // a person's browser is told in words (often the site is not there yet, or was not in a copy of the World as it was)
         if ((request.headers.get('accept') ?? '').includes('text/html')) {
             const shown = host.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
-            return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p>Nothing is served at <b>${shown}</b> in this World.</p></body>`, { status: 404, headers: { 'content-type': 'text/html; charset=utf-8' } });
+            // A link here from a page in the World (a post's URL) names a site the World does not hold: the person may open
+            // the real one, by a click of their own (an answered redirect would make the World's origin an open redirect).
+            const real = `https://${host}${path}${url.search}`.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+            return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p>Nothing is served at <b>${shown}</b> in this World.</p><p><a href="${real}" rel="noopener noreferrer">Open ${shown} outside the World</a></p></body>`, { status: 404, headers: { 'content-type': 'text/html; charset=utf-8' } });
         }
         return Response.json({ error: `no twin of ${this.served} answers ${host}` }, { status: 404 });
     }
@@ -1566,8 +1575,32 @@ export class WorldDoors {
                 if (!/^\s*(?:__Host-)?volter_(?:world|pages|browser)=/i.test(c))
                     out.append('set-cookie', c);
         }
+        // a twin's page links a site this World serves (a post's URL, a Worker's custom domain) by its hostname: the
+        // person who follows it stays in the World
+        if (sitesAt && request.method === 'GET' && answer.status < 300) {
+            const linked = await this.inWorldLinks(answer, out, url.origin, sitesAt, vendor);
+            if (linked)
+                return linked;
+        }
         return new Response(answer.body, { status: answer.status, headers: out });
     }
+    /** A page's links to sites this World serves (the hostnames its twins claim, a Worker's custom domain among them),
+     *  rewritten to where the World shows each (siteUrlOf), so a person who follows one stays in the World. The page's own
+     *  vendor's hosts (`own`) are its own to place, and a site the World does not hold keeps its real address. Null
+     *  when there is nothing to do: not HTML, compressed, or no site served. */
+    async inWorldLinks(answer, out, origin, template, own, browser) {
+        if (!answer.body || !(out.get('content-type') ?? '').includes('text/html') || out.has('content-encoding'))
+            return null;
+        const served = new Set((await this.claimedHosts(origin)).filter(row => row.vendor !== own).flatMap(row => row.hosts.map(h => h.toLowerCase())));
+        if (served.size === 0)
+            return null;
+        const html = (await answer.text()).replace(/(href|action)="https?:\/\/([A-Za-z0-9.-]+)(?::\d+)?((?:[/?#][^"]*)?)"/g, (match, attr, to, rest) => {
+            const next = served.has(to.toLowerCase()) ? siteUrlOf(template, to.toLowerCase(), browser) : null;
+            return next ? `${attr}="${next}${rest || '/'}"` : match;
+        });
+        out.delete('content-length');
+        return new Response(html, { status: answer.status, statusText: answer.statusText, headers: out });
+    }
     linksPath() { return join(this.worldRoot, stateDirName(), 'links.json'); }
     /** The World's links: name → the vendor origin it forwards to. */
     links() {
@@ -2266,7 +2299,7 @@ export class WorldDoors {
                 return Response.json({ error: 'a digest in a blob key is lowercase hex' }, { status: 400 });
             if (!this.up().services[name])
                 return Response.json({ error: `no twin "${name}" in ${this.served}` }, { status: 404 });
-            const path = join(worldPaths(this.stateOf(name), this.controlRoot(name)).resources, key);
+            const path = resourceBlobFile(worldPaths(this.stateOf(name), this.controlRoot(name)).resources, key);
             const store = getActiveBlobStore();
             // HEAD names the blob's own digest, so a push can tell the same key holding other bytes from the same blob
             if (request.method === 'HEAD') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.156",
+  "version": "3.0.157",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -70,14 +70,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.148",
+    "@volter/world-core": "3.0.149",
     "@volter/world-console": "3.0.149"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.148",
+    "@volter/world-core": "3.0.149",
     "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",

package/src/changeset.ts

@@ -1,6 +1,6 @@
 import { errorMessage } from './error-message.ts';
 import { worldChangesetRules } from './configs.ts';
-import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, getActiveWorldStore, originHead, withHistoryLocks, worldPaths, type HistoryReference } from '@volter/world-core/runtime';
+import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, getActiveWorldStore, originHead, resourceBlobFile, resourceBlobKey, withHistoryLocks, worldPaths, type HistoryReference } from '@volter/world-core/runtime';
 // `volter-world mark` / `diff` / `changeset` — the WORLD-side verbs over the changeset
 // primitive (docs/concepts/the-model.md v0). Thin, exactly like `covers` and `tail` are thin: all
 // the state logic (markers, deltas, content hashing, replay) lives in @volter/world-core's
@@ -24,7 +24,7 @@ import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, g
 // Read-only over the twins' data at rest, like `tail` — except `replay`, which is the one verb
 // here that WRITES, and it writes only through the control plane's kernel write path.
 import { tmpdir } from 'node:os';
-import { join, relative, resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import {
   approveChangeset,
   rebaseChangeset,
@@ -524,7 +524,7 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   const twins = [...new Map(located.changeset.actions.map((a) => [a.service, a.stateService ?? a.service])).entries()];
   const ownBlobs = async (twin: string, state: string): Promise<Array<{ key: string; path: string }>> => {
     const dir = worldPaths(state, join(instance.dirs.data, twin)).resources;
-    return (await blobs.list(dir)).map((path) => ({ key: relative(dir, path).split('\\').join('/'), path }));
+    return (await blobs.list(dir)).map((path) => ({ key: resourceBlobKey(dir, path), path }));
   };
   // content-addressed means a segment of the key IS the digest of the bytes it holds: such bytes never
   // change. A name built on a digest of something else (a record keyed by a hash of an action id, a
@@ -548,10 +548,10 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
         const there = worldPaths(state, join(target.instance.dirs.data, twin)).resources;
         for (const { key, path } of await ownBlobs(twin, state)) {
           if (!(await wanted(key, path))) continue;
-          const held = await blobs.get(join(there, key));
+          const held = await blobs.get(resourceBlobFile(there, key));
           if (held !== null && blobDigest(held) === (await digestOf(path))) continue;
           const bytes = await blobs.get(path);
-          if (bytes) await blobs.put(join(there, key), bytes);
+          if (bytes) await blobs.put(resourceBlobFile(there, key), bytes);
         }
       }
       return;

package/src/served-world.ts

@@ -49,7 +49,7 @@ import { fetchFromOrigin } from './origin.ts';
 import { CONSOLE_BASE, consoleRedirect, serveConsoleApart, type ConsoleMount } from './console-apart.ts';
 import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from './configs.ts';
 import { adaptersFor, credentialPath, credentialPayloadFrom, deployTwin, deployWorld, loadWorldChecks, twinSigningSecret, materializeRoots, refreshPosture, refreshTwin, rootForControlRoot, rewrapTwinCredentials, sealTwinCredential, sealedCredentialInfo, bindLegacyCredentials, setTwinRoot, spanMs } from './root.ts';
-import { describeActionFields } from '@volter/world-core/runtime';
+import { describeActionFields, resourceBlobFile } from '@volter/world-core/runtime';
 import { worldLedgers } from './changeset.ts';
 import { clockFile, downWorld, instanceDir, isWorldOrigin, listWorlds, readWorldBootRecord, statusWorld, upWorld } from './runtime.ts';
 import { assertChangesetRules, type WorldChangesetRules, type WorldInstance } from './schema.ts';
@@ -1155,12 +1155,20 @@ export class WorldDoors {
         else if (to.hostname === host) out.set('location', `${to.pathname}${to.search}${to.hash}`);
         else if (browser && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed) && routes.sites.some(row => row.hosts.includes(to.hostname))) { const at = this.host.sitesTemplate?.(); const next = at ? siteUrlOf(at, to.hostname, browser) : null; if (next) out.set('location', `${next}${to.pathname}${to.search}${to.hash}`); }
       } catch { /* left as answered */ } }
+      // A page a site answers links another site the World serves by its hostname (www.videogame.ai's link to
+      // cyclotron.videogame.ai): it opens where the World shows that site, as a browser redirect does above.
+      const at = request.method !== 'HEAD' ? this.host.sitesTemplate?.() : undefined;
+      const linked = at ? await this.inWorldLinks(answer, out, url.origin, at, undefined, browser) : null;
+      if (linked) return linked;
       return new Response(request.method === 'HEAD' ? null : answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
     }
     // a person's browser is told in words (often the site is not there yet, or was not in a copy of the World as it was)
     if ((request.headers.get('accept') ?? '').includes('text/html')) {
       const shown = host.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
-      return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p>Nothing is served at <b>${shown}</b> in this World.</p></body>`, { status: 404, headers: { 'content-type': 'text/html; charset=utf-8' } });
+      // A link here from a page in the World (a post's URL) names a site the World does not hold: the person may open
+      // the real one, by a click of their own (an answered redirect would make the World's origin an open redirect).
+      const real = `https://${host}${path}${url.search}`.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+      return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p>Nothing is served at <b>${shown}</b> in this World.</p><p><a href="${real}" rel="noopener noreferrer">Open ${shown} outside the World</a></p></body>`, { status: 404, headers: { 'content-type': 'text/html; charset=utf-8' } });
     }
     return Response.json({ error: `no twin of ${this.served} answers ${host}` }, { status: 404 });
   }
@@ -1369,9 +1377,31 @@ export class WorldDoors {
       out.delete('set-cookie');
       for (const c of setCookies) if (!/^\s*(?:__Host-)?volter_(?:world|pages|browser)=/i.test(c)) out.append('set-cookie', c);
     }
+    // a twin's page links a site this World serves (a post's URL, a Worker's custom domain) by its hostname: the
+    // person who follows it stays in the World
+    if (sitesAt && request.method === 'GET' && answer.status < 300) {
+      const linked = await this.inWorldLinks(answer, out, url.origin, sitesAt, vendor);
+      if (linked) return linked;
+    }
     return new Response(answer.body, { status: answer.status, headers: out });
   }
 
+  /** A page's links to sites this World serves (the hostnames its twins claim, a Worker's custom domain among them),
+   *  rewritten to where the World shows each (siteUrlOf), so a person who follows one stays in the World. The page's own
+   *  vendor's hosts (`own`) are its own to place, and a site the World does not hold keeps its real address. Null
+   *  when there is nothing to do: not HTML, compressed, or no site served. */
+  private async inWorldLinks(answer: Response, out: Headers, origin: string, template: string, own: string | undefined, browser?: string): Promise<Response | null> {
+    if (!answer.body || !(out.get('content-type') ?? '').includes('text/html') || out.has('content-encoding')) return null;
+    const served = new Set((await this.claimedHosts(origin)).filter(row => row.vendor !== own).flatMap(row => row.hosts.map(h => h.toLowerCase())));
+    if (served.size === 0) return null;
+    const html = (await answer.text()).replace(/(href|action)="https?:\/\/([A-Za-z0-9.-]+)(?::\d+)?((?:[/?#][^"]*)?)"/g, (match, attr: string, to: string, rest: string) => {
+      const next = served.has(to.toLowerCase()) ? siteUrlOf(template, to.toLowerCase(), browser) : null;
+      return next ? `${attr}="${next}${rest || '/'}"` : match;
+    });
+    out.delete('content-length');
+    return new Response(html, { status: answer.status, statusText: answer.statusText, headers: out });
+  }
+
   private linksPath(): string { return join(this.worldRoot, stateDirName(), 'links.json'); }
   /** The World's links: name → the vendor origin it forwards to. */
   links(): Record<string, { origin: string }> {
@@ -1906,7 +1936,7 @@ export class WorldDoors {
       // a digest-shaped segment is lowercase, so a case-insensitive filesystem can't take unchecked bytes for it
       if (key.split('/').some((seg) => /^[0-9a-fA-F]{64}$/.test(seg) && seg !== seg.toLowerCase())) return Response.json({ error: 'a digest in a blob key is lowercase hex' }, { status: 400 });
       if (!this.up().services[name]) return Response.json({ error: `no twin "${name}" in ${this.served}` }, { status: 404 });
-      const path = join(worldPaths(this.stateOf(name), this.controlRoot(name)).resources, key);
+      const path = resourceBlobFile(worldPaths(this.stateOf(name), this.controlRoot(name)).resources, key);
       const store = getActiveBlobStore();
       // HEAD names the blob's own digest, so a push can tell the same key holding other bytes from the same blob
       if (request.method === 'HEAD') {