@volter/world-runtime 3.0.166 → 3.0.167

package/src/mongodb-command.ts

@@ -0,0 +1,238 @@
+// MongoDB's questions as the runtime asks them (architecture, "A negative MongoDB availability question"): one command
+// on one loopback connection, framed by the kernel's MongoDB client (`@volter/world-core/mongodb`, mongoClient) with
+// the BSON codec below, never through MongoDB's driver. The driver's first load sat on every MongoDB-served World's
+// readiness path, after the server's port accepted and before its first answer. A question is the command the driver
+// sent for it; the answer is the serving process's own (mongod's, or the twin pack's where a twin serves the kind).
+//
+// The kernel frames and reads nothing inside a document (architecture, "the MongoDB wire"): the codec is its user's,
+// here the runtime's own, for the few commands it asks and every type an answer may hold.
+// source: https://bsonspec.org/spec.html "element ::= ... | signed_byte(5) e_name binary | ... | signed_byte(8) e_name "\x00" | signed_byte(8) e_name "\x01""
+import { connect } from 'node:net';
+import { MongoMsgFlag, mongoClient, type MongoCodec, type MongoDocument } from '@volter/world-core/mongodb';
+
+export type { MongoDocument };
+
+/** A command the server answered and refused (`ok` not 1), with its own code, as the driver's server error carries it. */
+export class MongoCommandError extends Error {
+  constructor(readonly code: number | undefined, readonly codeName: string | undefined, message: string) {
+    super(message);
+    this.name = 'MongoCommandError';
+  }
+}
+
+/** MongoDB's own maxMessageSizeBytes. */
+const MAX_MESSAGE = 48_000_000;
+/** The required flag bits (0-15) an answer may carry: checksumPresent alone; moreToCome is an exhaust answer, never
+ *  asked for here. */
+const KNOWN_REQUIRED_FLAGS = MongoMsgFlag.CHECKSUM_PRESENT;
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+
+function cstring(name: string): Buffer {
+  if (name.includes('\0')) throw new Error(`BSON key ${JSON.stringify(name)} holds a NUL`);
+  return Buffer.from(`${name}\0`, 'utf8');
+}
+
+function element(name: string, value: unknown): Buffer[] {
+  const key = cstring(name);
+  if (typeof value === 'number') {
+    if (Number.isInteger(value) && !Object.is(value, -0) && value >= -0x80000000 && value <= 0x7fffffff) {
+      const int = Buffer.alloc(4); int.writeInt32LE(value);
+      return [Buffer.of(0x10), key, int];
+    }
+    const double = Buffer.alloc(8); double.writeDoubleLE(value);
+    return [Buffer.of(0x01), key, double];
+  }
+  if (typeof value === 'bigint') {
+    const long = Buffer.alloc(8); long.writeBigInt64LE(value);
+    return [Buffer.of(0x12), key, long];
+  }
+  if (typeof value === 'string') {
+    const text = Buffer.from(value, 'utf8');
+    const length = Buffer.alloc(4); length.writeInt32LE(text.length + 1);
+    return [Buffer.of(0x02), key, length, text, Buffer.of(0)];
+  }
+  if (typeof value === 'boolean') return [Buffer.of(0x08), key, Buffer.of(value ? 1 : 0)];
+  if (value === null) return [Buffer.of(0x0a), key];
+  // A hole or an undefined element is null, as the driver writes one: an array's indices stay dense.
+  if (Array.isArray(value)) return [Buffer.of(0x04), key, encodeBson(Object.fromEntries(Array.from(value, (item, index) => [String(index), item === undefined ? null : item])))];
+  if (typeof value === 'object' && Object.getPrototypeOf(value) === Object.prototype) return [Buffer.of(0x03), key, encodeBson(value as MongoDocument)];
+  throw new Error(`BSON here carries no value of ${name}'s kind`);
+}
+
+/** A document as BSON: the values the runtime's own commands hold (numbers, bigints, strings, booleans, null,
+ *  documents and arrays). An undefined value is left out, as the driver leaves it; -0 is a double, as it is to BSON. */
+export function encodeBson(document: MongoDocument): Buffer {
+  const body = Buffer.concat(Object.entries(document).filter(([, value]) => value !== undefined).flatMap(([name, value]) => element(name, value)));
+  const size = Buffer.alloc(4); size.writeInt32LE(body.length + 5);
+  return Buffer.concat([size, body, Buffer.of(0)]);
+}
+
+/** A BSON document read whole from `bytes` at `start`. Every BSON type is read, so an answer's fields the runtime does
+ *  not use are still walked; a length out of bounds, a boolean other than 0 or 1, text that is not UTF-8, or a document
+ *  that does not end where its length says is refused. An int64 is a number where it is a safe integer, as the driver
+ *  promotes it, and a bigint where it is not. */
+export function decodeBson(bytes: Buffer, start = 0, array = false): MongoDocument | unknown[] {
+  if (start + 5 > bytes.length) throw new Error('truncated BSON document');
+  const size = bytes.readInt32LE(start);
+  const end = start + size;
+  if (size < 5 || end > bytes.length || bytes[end - 1] !== 0) throw new Error('BSON document length out of bounds');
+  const fields: MongoDocument = {};
+  const items: unknown[] = [];
+  let at = start + 4;
+  const need = (count: number): void => { if (count < 0 || at + count > end - 1) throw new Error('truncated BSON value'); };
+  const length = (minimum: number): number => {
+    need(4);
+    const value = bytes.readInt32LE(at);
+    if (value < minimum) throw new Error('BSON length out of bounds');
+    return value;
+  };
+  const text = (from: number, to: number): string => utf8.decode(bytes.subarray(from, to));
+  const cstr = (): string => {
+    const stop = bytes.indexOf(0, at);
+    if (stop < 0 || stop >= end - 1) throw new Error('unterminated BSON cstring');
+    const value = text(at, stop);
+    at = stop + 1;
+    return value;
+  };
+  const str = (): string => {
+    const count = length(1);
+    need(4 + count);
+    if (bytes[at + 4 + count - 1] !== 0) throw new Error('unterminated BSON string');
+    const value = text(at + 4, at + 4 + count - 1);
+    at += 4 + count;
+    return value;
+  };
+  while (at < end - 1) {
+    const type = bytes[at++]!;
+    const name = cstr();
+    let value: unknown;
+    switch (type) {
+      case 0x01: need(8); value = bytes.readDoubleLE(at); at += 8; break;
+      case 0x02: case 0x0d: case 0x0e: value = str(); break;
+      case 0x03: case 0x04: {
+        const count = length(5);
+        need(count);
+        value = decodeBson(bytes, at, type === 0x04);
+        at += count;
+        break;
+      }
+      case 0x05: {
+        const count = length(0);
+        need(5 + count);
+        value = new Uint8Array(bytes.subarray(at + 5, at + 5 + count));
+        at += 5 + count;
+        break;
+      }
+      case 0x06: value = undefined; break;
+      case 0x07: need(12); value = bytes.toString('hex', at, at + 12); at += 12; break;
+      case 0x08: {
+        need(1);
+        const byte = bytes[at]!;
+        if (byte > 1) throw new Error(`BSON boolean byte ${byte} is neither 0 nor 1`);
+        value = byte === 1; at += 1;
+        break;
+      }
+      case 0x09: need(8); value = new Date(Number(bytes.readBigInt64LE(at))); at += 8; break;
+      case 0x0a: value = null; break;
+      case 0x0b: { const pattern = cstr(); value = { $regex: pattern, $options: cstr() }; break; }
+      case 0x0c: { const ref = str(); need(12); value = { $ref: ref, $id: bytes.toString('hex', at, at + 12) }; at += 12; break; }
+      case 0x0f: {
+        const from = at;
+        const count = length(14);
+        need(count);
+        at += 4;
+        const code = str();
+        const scope = length(5);
+        need(scope);
+        value = { $code: code, $scope: decodeBson(bytes, at) };
+        at += scope;
+        if (at !== from + count) throw new Error('BSON code-with-scope length out of bounds');
+        break;
+      }
+      case 0x10: need(4); value = bytes.readInt32LE(at); at += 4; break;
+      case 0x11: need(8); value = bytes.readBigUInt64LE(at); at += 8; break;
+      case 0x12: {
+        need(8);
+        const long = bytes.readBigInt64LE(at);
+        at += 8;
+        value = long >= BigInt(Number.MIN_SAFE_INTEGER) && long <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(long) : long;
+        break;
+      }
+      case 0x13: need(16); value = new Uint8Array(bytes.subarray(at, at + 16)); at += 16; break;
+      case 0x7f: value = { $maxKey: 1 }; break;
+      case 0xff: value = { $minKey: 1 }; break;
+      default: throw new Error(`unknown BSON type 0x${type.toString(16)} at ${JSON.stringify(name)}`);
+    }
+    if (array) items.push(value);
+    else Object.defineProperty(fields, name, { value, enumerable: true, writable: true, configurable: true });
+  }
+  if (at !== end - 1) throw new Error('BSON document does not end where its length says');
+  return array ? items : fields;
+}
+
+/** The runtime's codec for the kernel's MongoDB client. */
+const codec: MongoCodec = {
+  serialize: (document) => encodeBson(document),
+  deserialize: (bytes) => decodeBson(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)) as MongoDocument,
+};
+
+/** One message sent on one loopback connection, and the one message answered to it, read whole to its length.
+ *  An answer with a required flag bit the runtime does not know (moreToCome among them) is refused. */
+function loopbackExchange(port: number, timeoutMs: number, asked: string, signal?: AbortSignal): (message: Uint8Array) => Promise<Uint8Array> {
+  return (message) => new Promise((resolve, reject) => {
+    if (signal?.aborted) { reject(signal.reason instanceof Error ? signal.reason : new Error(`MongoDB question ${asked} aborted`)); return; }
+    if (!(timeoutMs > 0)) { reject(new Error(`MongoDB question ${asked} has no budget left`)); return; }
+    const socket = connect({ host: '127.0.0.1', port });
+    // The answer's chunks, joined once it is whole (not again at each chunk), and its declared length, read once from
+    // its first four bytes however they arrived.
+    const chunks: Buffer[] = [];
+    let receivedBytes = 0;
+    let length: number | undefined;
+    let settled = false;
+    const onAbort = (): void => finish(signal!.reason instanceof Error ? signal!.reason : new Error(`MongoDB question ${asked} aborted`));
+    const timer = setTimeout(() => finish(new Error(`MongoDB did not answer ${asked} within ${timeoutMs} ms`)), timeoutMs);
+    function finish(error: unknown, answer?: Uint8Array): void {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener('abort', onAbort);
+      socket.destroy();
+      if (error !== undefined) reject(error); else resolve(answer!);
+    }
+    signal?.addEventListener('abort', onAbort, { once: true });
+    socket.setNoDelay(true);
+    socket.once('connect', () => { socket.write(message); });
+    socket.on('data', (chunk: Buffer) => {
+      chunks.push(chunk);
+      receivedBytes += chunk.length;
+      if (length === undefined) {
+        if (receivedBytes < 4) return;
+        const head: Buffer = chunks[0]!.length >= 4 ? chunks[0]! : Buffer.concat(chunks, receivedBytes);
+        length = head.readInt32LE(0);
+        if (length < 21 || length > MAX_MESSAGE) { finish(new Error(`MongoDB's answer to ${asked} has length ${length}, out of bounds`)); return; }
+      }
+      if (receivedBytes < length) return;
+      const received: Buffer = Buffer.concat(chunks, receivedBytes);
+      const answer = received.subarray(0, length);
+      const required = answer.readUInt32LE(16) & 0xffff;
+      if (required & ~KNOWN_REQUIRED_FLAGS) { finish(new Error(`MongoDB answered ${asked} with required flag bits ${required}`)); return; }
+      finish(undefined, answer);
+    });
+    socket.once('error', (error) => finish(error));
+    socket.once('close', () => finish(new Error(`MongoDB closed the connection before answering ${asked}`)));
+  });
+}
+
+/** One admin command on one loopback connection, answered through the kernel's client: refused where the server says
+ *  it is not ok, where its answer cannot be read (the client checks its request, opcode and length; a document
+ *  sequence in it is joined as the field it names, as the client joins one), where the connection ends or refuses
+ *  first, where `timeoutMs` passes, or where `signal` aborts. */
+export async function mongodbCommand(port: number, command: MongoDocument, timeoutMs: number, signal?: AbortSignal): Promise<MongoDocument> {
+  const asked = Object.keys(command)[0] ?? 'a command';
+  const answer = await mongoClient(loopbackExchange(port, timeoutMs, asked, signal), codec).command('admin', command);
+  if (Number(answer.ok) !== 1) {
+    throw new MongoCommandError(typeof answer.code === 'number' ? answer.code : undefined, typeof answer.codeName === 'string' ? answer.codeName : undefined,
+      typeof answer.errmsg === 'string' ? answer.errmsg : `MongoDB refused ${asked}`);
+  }
+  return answer;
+}

package/src/pglite-host.mjs

@@ -687,8 +687,8 @@ const asBuffer = (m) => Buffer.from(m.buffer, m.byteOffset, m.byteLength);
 
 /** Prepared statements' protocol names each connection gives, kept apart where they would collide.
  *  Every connection shares the one backend session, and a client names its statements per connection: Prisma's engine
- *  starts each process at `s0`, so a second process's first Parse met "prepared statement "s0" already exists" (Postiz
- *  walk postiz-2: sign-up, and the post workflow's first read, which left no timer to publish the post). A name no other
+ *  starts each process at `s0`, so a second process's first Parse met "prepared statement "s0" already exists" (an
+ *  application's sign-up, and its workflow's first read in a second process). A name no other
  *  live connection holds goes to the backend as the client gave it, so SQL on it works as on Postgres; one another
  *  live connection holds goes as a short name of the host's own (`volter_s<N>`), and the connection's own simple-Query
  *  DEALLOCATE or EXECUTE of it is rewritten to match (sqlNames). Names are compared on their first 63 bytes, as Postgres compares them

package/src/placeholder.ts

@@ -5,16 +5,22 @@
 // `diff` reads empty, nothing is pending. `reset` is a pull from the placeholder again — down
 // with purge, up, seed — so a world returns to its defaults at any time; local work you want to
 // keep is a fork, taken before.
+import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
 import { claimEnvOutput } from './env-output.ts';
+import { withCurrentCredentialDoor } from './credential-door.ts';
+import { packFacts } from './pack-facts.ts';
 import { materializeRoots } from './root.ts';
 import { loadWorldConfig } from './configs.ts';
-import { WorldDoors, servedName } from './served-world.ts';
-import { existsSync, readdirSync } from 'node:fs';
+import { TOKEN_HEADER, TWINS_KEY_HEADER, WorldDoors, servedName } from './served-world.ts';
+import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { serveHttp, beginPlaceholderPull, endPlaceholderPull, listEvents, PLACEHOLDER_REMOTE, stateDirName, worldStateRoot } from '@volter/world-core/runtime';
-import { downWorld, runWithWorldEnv, saveWorldInstance, statusWorld, upWorld } from './runtime.ts';
-import type { WorldInstance } from './schema.ts';
+import { downWorld, runWithWorldEnv, saveWorldInstance, statusWorld, upWorld, withoutVaultSignIn } from './runtime.ts';
+import { ISSUE_ENV_PREFIX, type WorldInstance } from './schema.ts';
+import type { WorldManifest } from './attach.ts';
 
 export type SeedWorldOptions = { root?: string; entry?: string; cwd?: string; /** Reset writes a new live environment output; never an input file. */ envFile?: string };
 export type SeedWorldOutcome = { world: string; entry: string; exitCode: number; observed: Record<string, number> };
@@ -46,6 +52,17 @@ function rootedTwins(instance: WorldInstance, root: string): string[] {
   return config.services.filter((s) => (s as { root?: unknown }).root).map((s) => s.id);
 }
 
+/** The command that runs a seed entry: the runtime that is running, Bun, or Node with its TypeScript type stripping
+ *  (`--experimental-strip-types`, accepted from Node 22.6 and on by default since 23.6). Never `bun` by name: the
+ *  published runtime supports Node alone, and the tab's engine has no Bun. */
+function seedRunner(entry: string): string[] {
+  if (typeof Bun === 'undefined' && /\.[cm]?ts$/.test(entry)) {
+    const [major, minor] = process.versions.node.split('.').map(Number) as [number, number];
+    if (major < 22 || (major === 22 && minor < 6)) throw new Error(`${entry} is TypeScript: seeding it under Node needs Node 22.6 or newer (type stripping), or Bun; this is Node ${process.versions.node}`);
+  }
+  return typeof Bun !== 'undefined' ? ['bun', entry] : [process.execPath, '--experimental-strip-types', '--no-warnings', entry];
+}
+
 /** Pull from the placeholder: every twin's window open around the seed entry (a twin with a root excepted). */
 export async function seedWorld(name: string, options: SeedWorldOptions = {}): Promise<SeedWorldOutcome> {
   const root = resolve(options.root ?? process.cwd());
@@ -70,15 +87,7 @@ export async function seedWorld(name: string, options: SeedWorldOptions = {}): P
       return path === `/-/${served}/browsers` || path.startsWith(`/-/${served}/browsers/`)
         ? doors.handle(request) : Response.json({ error: 'the seed loader serves browser state only' }, { status: 404 });
     } });
-    // The runtime that is running runs the seed: Bun, or Node with its TypeScript type stripping
-    // (`--experimental-strip-types`, accepted from Node 22.6 and on by default since 23.6). Never
-    // `bun` by name: the published runtime supports Node alone, and the tab's engine has no Bun.
-    if (typeof Bun === 'undefined' && /\.[cm]?ts$/.test(entry)) {
-      const [major, minor] = process.versions.node.split('.').map(Number) as [number, number];
-      if (major < 22 || (major === 22 && minor < 6)) throw new Error(`${entry} is TypeScript: seeding it under Node needs Node 22.6 or newer (type stripping), or Bun; this is Node ${process.versions.node}`);
-    }
-    const runner = typeof Bun !== 'undefined' ? ['bun', entry] : [process.execPath, '--experimental-strip-types', '--no-warnings', entry];
-    exitCode = await runWithWorldEnv(name, runner, root, { cwd: options.cwd ?? dirname(entry), env: { VOLTER_SEED_SKIP: [...rooted].sort().join(','), VOLTER_WORLD_BROWSER_DOOR: `${doorServer.url.origin}/-/${served}/browsers`, VOLTER_WORLD_BROWSER_TOKEN: token } });
+    exitCode = await runWithWorldEnv(name, seedRunner(entry), root, { cwd: options.cwd ?? dirname(entry), env: { VOLTER_SEED_SKIP: [...rooted].sort().join(','), VOLTER_WORLD_BROWSER_DOOR: `${doorServer.url.origin}/-/${served}/browsers`, VOLTER_WORLD_BROWSER_TOKEN: token } });
   } finally {
     await doorServer?.stop();
     for (const service of services) endPlaceholderPull(service, join(instance.dirs.data, service));
@@ -115,3 +124,71 @@ export async function resetWorld(name: string, options: SeedWorldOptions = {}):
     return { ...seeded, instance };
   } finally { rooted(); }
 }
+
+export type SeedServedOutcome = { world: string; entry: string; exitCode: number; /** the names its twins issued the seed, by twin */ issued: Record<string, string[]>; /** the mark taken once the seed ran, and how many of the seed's changes it made part of the World's start */ mark: { id?: string; passed: number } | null };
+
+/** Set up a served World an app's World was linked to, as `up` sets up a fresh local one (docs/contributing/
+ *  architecture.md, "A World's changes count from its latest mark" and "The way in is the app's folder"): the app's
+ *  seed entry runs against the served World's own twins, attached as `volter-world attach <url>` attaches a command
+ *  (its manifest, each twin bridged with the World's key, the injector), with the credentials each twin issues at its
+ *  credential door there (a twin takes only the credentials it issued) and the config's plain values; then the World
+ *  is marked, so what the seed made is where its changes count from, not a change of its own. A seed that fails leaves
+ *  the World unmarked, holding what the seed wrote before it stopped. */
+export async function seedServedWorld(base: string, token: string, options: { root?: string; config: string; entry?: string; cwd?: string }): Promise<SeedServedOutcome> {
+  const root = resolve(options.root ?? process.cwd());
+  const at = base.replace(/\/+$/, '');
+  const entry = resolve(options.entry ?? join(dirname(resolve(root, options.config)), 'seed.ts'));
+  if (!existsSync(entry)) throw new Error(`No seed entry at ${entry}`);
+  const { fetchRemoteManifest, remoteAttachEnv } = await import('./serve.ts');
+  const manifest: WorldManifest = await fetchRemoteManifest(at, { token });
+  const { config } = loadWorldConfig(options.config, root);
+  // each twin of the app's World, by the vendor the served World names it: its door asked there, its names filled
+  const issued: Record<string, string[]> = {};
+  const env: Record<string, string> = {};
+  for (const [name, value] of Object.entries(config.env ?? {})) if (value !== '' && !value.startsWith('$')) env[name] = value;
+  for (const service of config.services) {
+    if ((service.type ?? 'twin') !== 'twin') continue;
+    const vendor = /^@volter\/twin-(.+)$/.exec(service.package ?? '')?.[1] ?? service.id;
+    const place = manifest.vendors[vendor];
+    const names = Object.entries(config.env ?? {}).filter(([, value]) => value === `${ISSUE_ENV_PREFIX}${service.id}`).map(([name]) => name);
+    if (!place || names.length === 0) continue;
+    const door = withCurrentCredentialDoor(service, packFacts()[vendor]?.credentialDoor).issues;
+    if (!door) throw new Error(`${vendor}: the app's World issues ${names.join(', ')} from it, and its pack names no credential door`);
+    const res = await fetch(`${place.replace(/\/+$/, '')}${door.path}`, { method: 'POST', headers: { [TWINS_KEY_HEADER]: token, 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(30_000) });
+    if (!res.ok) throw new Error(`${vendor}'s credential door at ${at} answered ${res.status}: ${(await res.text().catch(() => '')).replace(/\s+/g, ' ').slice(0, 300)}`);
+    const answer = (await res.json()) as Record<string, unknown>;
+    for (const name of names) {
+      const field = door.fill[name] ?? '';
+      // a credential the door hands as a file is kept beside a World on its own machine, never by the command
+      if (field.startsWith('file:') || field.startsWith('directory:')) continue;
+      const v = answer[field];
+      if (typeof v === 'string' && v) { env[name] = v; (issued[vendor] ??= []).push(name); }
+    }
+  }
+  let caFile: string | undefined;
+  if (manifest.ca !== null) { caFile = join(mkdtempSync(join(tmpdir(), 'volter-seed-')), 'ca.pem'); writeFileSync(caFile, manifest.ca); }
+  const required = createRequire(import.meta.url);
+  const { bridgeTwins } = required('@volter/world-core/http-bridge') as { bridgeTwins: (manifest: WorldManifest, key: string, ca?: string) => Promise<Array<{ close: () => void }>> };
+  const listeners = await bridgeTwins(manifest, manifest.env.VOLTER_TWINS_KEY ?? token, manifest.ca ?? undefined);
+  let exitCode = 1;
+  try {
+    const attached = remoteAttachEnv(manifest, { injectPath: required.resolve('@volter/world-core/inject'), worldRef: at, ...(caFile === undefined ? {} : { caFile }) });
+    // the served World's twins are seeded as any of its twins: none of a new World's has a root
+    const commandEnv = withoutVaultSignIn({ ...process.env, ...attached, ...env, VOLTER_WORLD: at, VOLTER_SEED_SKIP: '', VOLTER_TWIN_INJECT_QUIET: process.env.VOLTER_TWIN_INJECT_QUIET ?? '1' });
+    const command = seedRunner(entry);
+    exitCode = await new Promise<number>((done) => {
+      const child = spawn(command[0]!, command.slice(1), { windowsHide: true, cwd: resolve(options.cwd ?? root), env: commandEnv, stdio: 'inherit' });
+      child.once('error', () => done(1));
+      child.once('exit', (code, signal) => done(code ?? (signal ? 1 : 0)));
+    });
+  } finally {
+    for (const listener of listeners) listener.close();
+    if (caFile) rmSync(dirname(caFile), { recursive: true, force: true });
+  }
+  if (exitCode !== 0) return { world: manifest.name, entry, exitCode, issued, mark: null };
+  const doors = new URL(at);
+  const marked = await fetch(`${doors.origin}/-/${doors.pathname.replace(/^\/+|\/+$/g, '')}/marks`, { method: 'POST', headers: { [TOKEN_HEADER]: token, 'content-type': 'application/json' }, body: JSON.stringify({ note: `seeded from ${entry.slice(root.length + 1) || entry}` }) });
+  const body = (await marked.json().catch(() => ({}))) as { mark?: { id?: string }; passed?: number; error?: string };
+  if (!marked.ok) throw new Error(`${at} was seeded, and refused its mark (${marked.status}): ${body.error ?? 'no answer'}`);
+  return { world: manifest.name, entry, exitCode, issued, mark: { ...(body.mark?.id ? { id: body.mark.id } : {}), passed: body.passed ?? 0 } };
+}

package/src/process-signal.d.mts

@@ -7,3 +7,5 @@ export function signalOwnedProcess(identity: SpawnIdentity | undefined, signal:
 export function signalChild(child: ChildProcess, signal: NodeJS.Signals, group?: boolean, by?: string): boolean;
 export function signalHeldChild(child: ChildProcess, signal: NodeJS.Signals, group?: boolean, birth?: Promise<SpawnIdentity | undefined>): Promise<boolean>;
 export function childIdentity(child: ChildProcess): Promise<SpawnIdentity | undefined>;
+export const WINDOWS_BIRTH_LOOKUP_MS: number;
+export function windowsStartScript(pids: number[]): string;

package/src/process-signal.mjs

@@ -27,7 +27,12 @@ function saySignal(pid, toGroup, signal, by, result) {
 // running, CPU load 30%), Node v24.18.0, parent e8d4b55f plus this change: `await processBirth(process.pid)`
 // from this module, timed with performance.now() around the await, took 237-319 ms over 10
 // sequential runs, at most 298 ms with 4 awaited at once and at most 424 ms with 8.
-const BIRTH_LOOKUP_MS = 1000;
+// Windows reads a birth by starting Windows PowerShell, whose own start is most of the probe. Measured 2026-10-27 on
+// the same machine (Node v24.22.0, twin-world 86381aaf with this World's 22 services booting, a livestream running):
+// world.probe events in videogame-ai's World boot log answered in 252-805 ms, and one probe ran past 1000 ms and
+// failed that boot ("Service birth capture failed"). Command: grep world.probe in the World's `up` output.
+// Windows keeps 5000 ms; elsewhere the original 1000 ms ceiling stands.
+const BIRTH_LOOKUP_MS = process.platform === 'win32' ? 5000 : 1000;
 /** The command that prints a pid's birth, and how its output reads. Windows has no `ps` and no /proc: its birth is the
  *  process's creation time (GetProcessTimes, a FILETIME of 100 ns ticks in UTC, so neither the caller's zone nor its
  *  locale changes it), read through .NET by the Windows PowerShell every Windows 10 and 11 install ships. */
@@ -159,10 +164,43 @@ function saySignalFailure(error, target, signal, child) {
     process.stderr.write(`[signal] ${error.code} kill(${target}, ${signal}) exitCode=${child?.exitCode} signalCode=${child?.signalCode} group: ${rows.trim() || 'no rows'}\n`);
   } catch { /* the failure itself is still thrown by the caller */ }
 }
+/** Windows has no process groups. A service's "group" there is the process tree under its leader (the service
+ *  recorder): TERM ends the leader's descendants, the service and everything it started (wrangler's workerd, a
+ *  postmaster's backends, a `docker run`), so the recorder sees its service end, records it and exits on its own;
+ *  KILL ends the whole tree, leader included. Signalling the leader alone (TerminateProcess) left the service and its
+ *  children running, holding their ports and files, and the next `up` and a reset's removal failed on them. taskkill
+ *  /T follows the parent links Windows keeps; /F because a windowless process has no window to answer a close. A
+ *  child listed under the leader is admitted only when it was created after the leader, so a reused parent pid never
+ *  reaches an older process. */
+const WINDOWS_TREE_MS = 5000;
+function windowsTool(name) { return join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', name); }
+function windowsChildren(pid) {
+  const script = `$p=Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}';if($p){Get-CimInstance Win32_Process -Filter 'ParentProcessId=${pid}'|Where-Object{$_.CreationDate -ge $p.CreationDate}|ForEach-Object{$_.ProcessId}}`;
+  const result = spawnSync(windowsTool('WindowsPowerShell\\v1.0\\powershell.exe'), ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script],
+    { windowsHide: true, encoding: 'utf8', timeout: WINDOWS_TREE_MS, killSignal: 'SIGKILL' });
+  if (result.status !== 0) throw Object.assign(new Error(`Windows process tree of ${pid} unreadable (exit ${result.status ?? result.signal ?? result.error?.code})`), { code: 'ETREE' });
+  return result.stdout.split(/\s+/).filter(line => /^\d+$/.test(line)).map(Number).filter(child => child !== pid);
+}
+function signalWindowsTree(pid, signal) {
+  if (signal === 0) return process.kill(pid, 0);
+  const targets = signal === 'SIGKILL' ? [pid] : windowsChildren(pid);
+  if (!targets.length) return process.kill(pid, signal);
+  for (const target of targets) {
+    const result = spawnSync(windowsTool('taskkill.exe'), ['/PID', String(target), '/T', '/F'],
+      { windowsHide: true, encoding: 'utf8', timeout: WINDOWS_TREE_MS, killSignal: 'SIGKILL' });
+    // 128: no such process, already gone. Anything else is said and the leader is still asked below.
+    if (result.status !== 0 && result.status !== 128) process.stderr.write(`[signal] taskkill /PID ${target} /T /F exited ${result.status ?? result.signal ?? result.error?.code}: ${(result.stderr ?? '').trim()}\n`);
+  }
+  return true;
+}
 /** Stored or retained numbers use birth verification before every delivery. */
 export async function signalOwnedProcess(identity, signal, group = false, by = undefined) {
   const asker = askedBy(by);
   await verifySpawnIdentity(identity);
+  if (group && process.platform === 'win32') {
+    try { const delivered = signalWindowsTree(identity.pid, signal); saySignal(identity.pid, true, signal, asker, 'delivered'); return delivered; }
+    catch (error) { saySignal(identity.pid, true, signal, asker, error.code ?? 'failed'); if (error.code === 'ESRCH' || nothingLeftToSignal(identity.pid)) return false; throw error; }
+  }
   const target = group && process.platform !== 'win32' ? -identity.pid : identity.pid;
   try { const delivered = process.kill(target, signal); saySignal(identity.pid, target < 0, signal, asker, 'delivered'); return delivered; }
   catch (error) {
@@ -175,7 +213,11 @@ export async function signalOwnedProcess(identity, signal, group = false, by = u
 export function signalChild(child, signal, group = false, by = undefined) {
   if (!child.pid || child.exitCode !== null || child.signalCode !== null) return false;
   const asker = askedBy(by);
-  if (!group || process.platform === 'win32') { const delivered = child.kill(signal); saySignal(child.pid, false, signal, asker, delivered ? 'delivered' : 'not delivered'); return delivered; }
+  if (group && process.platform === 'win32') {
+    try { const delivered = signalWindowsTree(child.pid, signal); saySignal(child.pid, true, signal, asker, 'delivered'); return delivered; }
+    catch (error) { saySignal(child.pid, true, signal, asker, error.code ?? 'failed'); if (error.code === 'ESRCH' || nothingLeftToSignal(child.pid)) return false; throw error; }
+  }
+  if (!group) { const delivered = child.kill(signal); saySignal(child.pid, false, signal, asker, delivered ? 'delivered' : 'not delivered'); return delivered; }
   try { process.kill(child.pid, 0); }
   catch (error) { if (error.code === 'ESRCH' || nothingLeftToSignal(child.pid)) return false; saySignalFailure(error, child.pid, 0, child); throw error; }
   try { const delivered = process.kill(-child.pid, signal); saySignal(child.pid, true, signal, asker, 'delivered'); return delivered; }

package/src/project-inspect.ts

@@ -659,7 +659,7 @@ export function projectConnections(input = process.cwd(), attributedEnv = new Se
  * This is the third vendor signal beside dependencies and env names: hand-written REST clients
  * often declare no SDK, and an unconventional credential name can hide the same vendor from the
  * env heuristic. Only direct `fetch("https://...")`, `window.fetch`, and `globalThis.fetch` calls
- * count. Dynamic destinations remain intentionally unclaimed; guessing from arbitrary URL strings
+ * count, with their literal argument or a literal the same file binds to the name they pass. Dynamic destinations remain intentionally unclaimed; guessing from arbitrary URL strings
  * would turn docs, links, and webhook examples into false external-service dependencies. */
 /** A migration tool an application carries, by its evidence in the repository (architecture, World wiring). */
 export interface ProjectMigrationTool {
@@ -704,9 +704,16 @@ export function projectFetchUrls(input = process.cwd()): ProjectFetchUrl[] {
   const seen = new Set<string>();
   // A leading identifier/dot would make this a custom method (`client.fetch`), not platform fetch.
   const literalFetch = /(?<![\w$.])(?:(?:globalThis|window)\.)?fetch\s*\(\s*(['"`])(https?:\/\/[^'"`\s]+)\1/g;
+  // A literal bound to a name in the same file and passed to fetch by that name (`const url = \`https://…\`;
+  // fetch(url)`, as Dub's and Rallly's Google Fonts calls are) is the same destination; the demand scan traces it too.
+  const boundLiteral = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(['"`])(https?:\/\/[^'"`\s]+)\2/g;
   for (const path of projectSourceFiles(root)) {
     const text = readFileSync(path, 'utf8');
-    for (const match of text.matchAll(literalFetch)) {
+    const bound = [...text.matchAll(boundLiteral)].filter(m => m.index !== undefined && isCodeAt(text, m.index));
+    const viaName = bound.flatMap(m => [...text.matchAll(new RegExp(`(?<![\\w$.])(?:(?:globalThis|window)\\.)?fetch\\s*\\(\\s*${m[1]!.replace(/\$/g, '\\$')}\\s*[,)]`, 'g'))]
+      .filter(call => call.index !== undefined && call.index > m.index! && isCodeAt(text, call.index))
+      .map(call => Object.assign([call[0], '', m[3]!] as unknown as RegExpExecArray, { index: call.index })));
+    for (const match of [...text.matchAll(literalFetch), ...viaName]) {
       if (match.index === undefined || !isCodeAt(text, match.index)) continue;
       const url = match[2]!;
       try { new URL(url); } catch { continue; }

package/src/redirect-proxy.ts

@@ -39,6 +39,7 @@ import { readFileSync } from 'node:fs';
 import { loadInject } from './inject-map.ts';
 import { packFacts } from './pack-facts.ts';
 import { sessionTrustEnv, type CaTrustInputs } from './ca-trust.ts';
+import { forwardableHeaders } from './forwardable-headers.ts';
 
 /**
  * The body served when a host was MITM'd but no twin serves the PATH.
@@ -235,20 +236,6 @@ export function twinUnreachableMessage(vendor: string, origin: string, err: Erro
   return `twin "${vendor}" at ${origin} is unreachable${world ? ` in World "${world}"` : ''}: ${errorMessage(err)}${cause?.code ? ` (${cause.code})` : cause?.message ? ` (${errorMessage(cause)})` : ''}; check \`volter-world doctor${world ? ` ${world}` : ''}\`\n`;
 }
 
-/** The headers of one connection, not of the request (RFC 9110 §7.6.1), with `expect`: the hop that received them
- *  answered them (Node's server sends the 100 Continue itself). Node's fetch refuses `transfer-encoding`,
- *  `keep-alive`, `upgrade`, `expect` and a `connection` other than close/keep-alive outright, so a `git push` whose
- *  pack came chunked (larger than `http.postBuffer`) failed `fetch failed (UND_ERR_INVALID_ARG)`; the body streams
- *  on and fetch frames it afresh. */
-const HOP_BY_HOP = ['connection', 'keep-alive', 'proxy-connection', 'transfer-encoding', 'te', 'trailer', 'upgrade', 'expect'];
-const TOKEN = /^[!#$%&'*+.^_`|~0-9a-z-]+$/i;
-function forwardableHeaders(incoming: Headers): Headers {
-  const headers = new Headers(incoming);
-  for (const listed of (incoming.get('connection') ?? '').split(',')) { const name = listed.trim(); if (TOKEN.test(name)) headers.delete(name); }
-  for (const h of HOP_BY_HOP) headers.delete(h);
-  return headers;
-}
-
 /** Start the ambient redirect proxy. Returns a handle with the listen port + the env to export.
  * - Plain `http://` proxied requests to a vendor host → forwarded to the twin.
  * - `CONNECT host:443` to a vendor host → MITM-terminated with a session-signed leaf, decrypted, and
@@ -376,7 +363,9 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
     const hostServer = await serveHttp({
       hostname: '127.0.0.1',
       port: 0,
-      tls: { key: leaf.key, cert: leaf.cert },
+      // the leaf, then the session CA that signed it: a client given no CA file can still pin this World's CA by its key
+      // (Chrome's --ignore-certificate-errors-spki-list, the manifest's `browser`), which it matches in the chain served
+      tls: { key: leaf.key, cert: `${leaf.cert.trimEnd()}\n${readFileSync(ca.caCert, 'utf8')}` },
       // Carry a twin's declared transport cap through TLS termination; public grants add no cap.
       maxRequestBodySize: (packFacts()[proxyTargetFor(vendorHost, currentEnv())?.vendor ?? ''] as { maxRequestBodySize?: number } | undefined)?.maxRequestBodySize,
       // A twin can think before its first byte (a git pack built from a cold cache took 19-28 s); Bun's 10 s idle

package/src/reflect.ts

@@ -36,6 +36,7 @@ import { connect as netConnect, createServer as createNetServer, type Server as
 import { join } from 'node:path';
 import { activeVendorMap, ensureCa, leafCertFor, noTwinMessage, proxyTargetFor, twinUnreachableMessage } from './redirect-proxy.ts';
 import { instanceDir } from './runtime.ts';
+import { forwardableHeaders } from './forwardable-headers.ts';
 
 // ---------------------------------------------------------------------------
 // Routes — attachment-scoped, file-backed, re-read live by the resolver.
@@ -160,9 +161,8 @@ export async function startReflectFront(options: ReflectFrontOptions): Promise<R
         let origin: URL;
         try { origin = new URL(target.origin); } catch { return new Response('bad twin origin', { status: 502 }); }
 
-        const headers = new Headers(req.headers);
+        const headers = forwardableHeaders(req.headers);
         headers.delete('x-volter-world-browser');
-        headers.delete('proxy-connection');
         headers.delete('accept-encoding');
         // the consumer spoke TLS to the front; a twin that answers with an absolute URL (Slack's Socket Mode link)
         // gives the scheme the consumer can reach again, as a vendor behind a TLS-terminating edge does