@volter/world-runtime 3.0.165 → 3.0.167

package/dist/src/redirect-proxy.js

@@ -39,6 +39,7 @@ import { readFileSync } from 'node:fs';
 import { loadInject } from "./inject-map.js";
 import { packFacts } from "./pack-facts.js";
 import { sessionTrustEnv } from "./ca-trust.js";
+import { forwardableHeaders } from "./forwardable-headers.js";
 /**
  * The body served when a host was MITM'd but no twin serves the PATH.
  *
@@ -198,24 +199,6 @@ export function twinUnreachableMessage(vendor, origin, err, world) {
     const cause = err.cause;
     return `twin "${vendor}" at ${origin} is unreachable${world ? ` in World "${world}"` : ''}: ${errorMessage(err)}${cause?.code ? ` (${cause.code})` : cause?.message ? ` (${errorMessage(cause)})` : ''}; check \`volter-world doctor${world ? ` ${world}` : ''}\`\n`;
 }
-/** The headers of one connection, not of the request (RFC 9110 §7.6.1), with `expect`: the hop that received them
- *  answered them (Node's server sends the 100 Continue itself). Node's fetch refuses `transfer-encoding`,
- *  `keep-alive`, `upgrade`, `expect` and a `connection` other than close/keep-alive outright, so a `git push` whose
- *  pack came chunked (larger than `http.postBuffer`) failed `fetch failed (UND_ERR_INVALID_ARG)`; the body streams
- *  on and fetch frames it afresh. */
-const HOP_BY_HOP = ['connection', 'keep-alive', 'proxy-connection', 'transfer-encoding', 'te', 'trailer', 'upgrade', 'expect'];
-const TOKEN = /^[!#$%&'*+.^_`|~0-9a-z-]+$/i;
-function forwardableHeaders(incoming) {
-    const headers = new Headers(incoming);
-    for (const listed of (incoming.get('connection') ?? '').split(',')) {
-        const name = listed.trim();
-        if (TOKEN.test(name))
-            headers.delete(name);
-    }
-    for (const h of HOP_BY_HOP)
-        headers.delete(h);
-    return headers;
-}
 /** Start the ambient redirect proxy. Returns a handle with the listen port + the env to export.
  * - Plain `http://` proxied requests to a vendor host → forwarded to the twin.
  * - `CONNECT host:443` to a vendor host → MITM-terminated with a session-signed leaf, decrypted, and
@@ -372,7 +355,9 @@ export async function startRedirectProxy(options) {
         const hostServer = await serveHttp({
             hostname: '127.0.0.1',
             port: 0,
-            tls: { key: leaf.key, cert: leaf.cert },
+            // the leaf, then the session CA that signed it: a client given no CA file can still pin this World's CA by its key
+            // (Chrome's --ignore-certificate-errors-spki-list, the manifest's `browser`), which it matches in the chain served
+            tls: { key: leaf.key, cert: `${leaf.cert.trimEnd()}\n${readFileSync(ca.caCert, 'utf8')}` },
             // Carry a twin's declared transport cap through TLS termination; public grants add no cap.
             maxRequestBodySize: packFacts()[proxyTargetFor(vendorHost, currentEnv())?.vendor ?? '']?.maxRequestBodySize,
             // A twin can think before its first byte (a git pack built from a cold cache took 19-28 s); Bun's 10 s idle

package/dist/src/reflect.js

@@ -36,6 +36,7 @@ import { connect as netConnect, createServer as createNetServer } from 'node:net
 import { join } from 'node:path';
 import { activeVendorMap, ensureCa, leafCertFor, noTwinMessage, proxyTargetFor, twinUnreachableMessage } from "./redirect-proxy.js";
 import { instanceDir } from "./runtime.js";
+import { forwardableHeaders } from "./forwardable-headers.js";
 // ---------------------------------------------------------------------------
 // Routes — attachment-scoped, file-backed, re-read live by the resolver.
 // ---------------------------------------------------------------------------
@@ -139,9 +140,8 @@ export async function startReflectFront(options) {
                 catch {
                     return new Response('bad twin origin', { status: 502 });
                 }
-                const headers = new Headers(req.headers);
+                const headers = forwardableHeaders(req.headers);
                 headers.delete('x-volter-world-browser');
-                headers.delete('proxy-connection');
                 headers.delete('accept-encoding');
                 // the consumer spoke TLS to the front; a twin that answers with an absolute URL (Slack's Socket Mode link)
                 // gives the scheme the consumer can reach again, as a vendor behind a TLS-terminating edge does

package/dist/src/runtime.d.ts

@@ -88,7 +88,7 @@ export declare function withoutVaultSignIn<T extends Record<string, string | und
 export declare function recordedWorldNetwork(instance: WorldInstance): WorldNetwork | undefined;
 /** A stopped receipt checks byte consistency before fields are read; it is not authentication. */
 export declare function readWorldBootRecord(name: string, root: string): WorldInstance;
-export declare function admittedEnv(strip: string[] | undefined, env?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function admittedEnv(strip: string[] | undefined, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): Record<string, string>;
 /** The names a twin of this World was to issue and did not (its door failed): kept out of every command's env, so a
  *  caller's own value (a real key in their shell) never stands in for the credential the World meant to issue. */
 export declare const UNISSUED_ENV = "VOLTER_WORLD_UNISSUED";
@@ -116,6 +116,10 @@ export declare function managedDatabaseFor(vendor: string, configPath: string |
     arg: string;
     url: string;
 } | undefined;
+/** Capture the validated boot's values before an owned executor applies its own environment layers. */
+export declare function worldRequiredCredentialGate(instance: WorldInstance): (env: NodeJS.ProcessEnv, boundary: string) => void;
+/** These transports do not carry required ownership/value authority; refuse instead of exporting an optional-only rendering. */
+export declare function refuseRequiredCredentialTransport(instance: WorldInstance, transport: string, code?: 'WORLD_MACHINE_CAPABILITY_GAP'): void;
 export declare function upWorld(configId: string, options?: UpWorldOptions, abort?: AbortSignal): Promise<WorldInstance>;
 /** The same bounded, identity-checked retirement used by World down, for provider-owned groups.
  * No caller may release a durable receipt when inspection or signal delivery is uncertain. */