@volter/world-runtime 3.0.28 → 3.0.30

package/dist/src/redirect-proxy.js

@@ -1,4 +1,4 @@
-import { serveHttp } from '@volter/world-core/runtime';
+import { BROWSER_SESSION_HEADER, serveHttp } from '@volter/world-core/runtime';
 import { worldNetworkPolicyFromEnv, allowsWorldNetworkEgress } from '@volter/world-core/network-policy';
 import { websocketRelay } from "./websocket-relay.js";
 // The ambient TLS redirect proxy — the substance of "any CLI, zero config" (WORLD_ACTIVATE.md §"How
@@ -350,7 +350,7 @@ export async function startRedirectProxy(options) {
                 }
                 const origin = new URL(twin.origin);
                 const headers = new Headers(req.headers);
-                for (const h of ['proxy-connection', 'accept-encoding', 'connection'])
+                for (const h of [BROWSER_SESSION_HEADER, 'proxy-connection', 'accept-encoding', 'connection'])
                     headers.delete(h);
                 // the application is not a twin: it gets no World key, keeps its Host and hears it was reached over TLS
                 if (twin.vendor === 'app') {
@@ -479,6 +479,7 @@ export async function startRedirectProxy(options) {
                 outHeaders['x-volter-twin-original-host'] = headers.host ?? origin.host;
                 outHeaders.host = origin.host;
             }
+            delete outHeaders[BROWSER_SESSION_HEADER];
             delete outHeaders['proxy-connection'];
             delete outHeaders['accept-encoding'];
             upstream.write(`${method} ${path} ${version}\r\n`);

package/dist/src/reflect.js

@@ -1,3 +1,4 @@
+import { BROWSER_SESSION_HEADER } from '@volter/world-core/runtime';
 import { serveHttp } from '@volter/world-core/runtime';
 import { websocketRelay } from "./websocket-relay.js";
 import { sessionTrustEnv } from "./ca-trust.js";
@@ -139,6 +140,7 @@ export async function startReflectFront(options) {
                     return new Response('bad twin origin', { status: 502 });
                 }
                 const headers = new Headers(req.headers);
+                headers.delete(BROWSER_SESSION_HEADER);
                 headers.delete('proxy-connection');
                 headers.delete('accept-encoding');
                 // the consumer spoke TLS to the front; a twin that answers with an absolute URL (Slack's Socket Mode link)

package/dist/src/served-world.d.ts

@@ -67,10 +67,6 @@ export type MountedWorld = {
     boot: (url: string) => Promise<void>;
     stop: () => Promise<void>;
 };
-/** A browser session a World keeps: its scope, when it ends, and the person a pass named, when one did. */
-/** What a content-plane pass, and the session it opens, carry: its scope; the control session that asked (the content
- *  session ends with it; none when the World's token asked); the person; the console that frames it; and whether it
- *  is this machine's own page (attributed to the machine). */
 type PagesGrant = {
     scope: 'read' | 'write';
     session?: string;
@@ -266,6 +262,13 @@ export declare class WorldDoors {
     private keepCookiesHere;
     /** What the content plane answers: its opening page and session, and the twins' pages; no door of the World. */
     private pagesPlane;
+    /** A landing resolved as a browser resolves it, within this vendor's place only. */
+    private vendorLanding;
+    /** The pack's declared browser session, never inferred from its vendor or a sign-in page. */
+    private browserSessionOf;
+    private vendorPeople;
+    /** The twin receives its own cookie and changes the session in its own process, over a host-only permit. */
+    private vendorSession;
     /** BROWSER SESSIONS: the session cookie carries an opaque id, never a token, so a leaked cookie is one session and
      *  not the World's write token; rotating the tokens ends every session. Kept in the World's store, so a restart
      *  keeps them; each lasts 30 days from its opening. */

package/dist/src/served-world.js

@@ -13,6 +13,7 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 //   POST deploy[/<name>]             perform landed entries against each root, by policy
 //   GET/PUT twins/<vendor>/root      the vendor's real account behind the twin (PUT null clears)
 //   PUT  twins/<vendor>/credential   seal the credential; GET answers only that one is sealed
+//   GET twins/<vendor>/people, POST twins/<vendor>/session   a browser views the vendor as a World's person
 //   POST twins/<vendor>/refresh      observe the root now
 // and what a person looks into it through (docs/contributing/architecture.md, "Viewing a World"):
 //   GET  map | timeline | diff       every twin and what it holds; the logs merged newest first; the changes since the base
@@ -31,6 +32,7 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
 import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, siteLabel, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin } from '@volter/world-core/runtime';
+import { BROWSER_SESSION_HEADER, BROWSER_SESSION_PATH, stripBrowserSessionPermit, withBrowserSessionPermit } from '@volter/world-core/runtime';
 import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { packFacts } from "./pack-facts.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
@@ -471,7 +473,9 @@ export class WorldDoors {
     }
     /** Whether what gave a content session its pass still stands: the control session that asked (ended, signed out, or
      *  its shared link revoked, the content session ends with it), or this World's token (rotated, every one ends). */
-    pagesParentLive(grant) { return grant.session === undefined || this.issued().session(grant.session) !== null; }
+    pagesParentLive(grant) {
+        return grant.session === undefined || this.issued().session(grant.session) !== null;
+    }
     /** The address that opens this World's content plane for a minute's one-time pass and lands on `land` (a path of this
      *  World); null where the World has no content plane, or the asker holds fifty passes not yet used. */
     pagesPass(scope, land, grant = {}) {
@@ -482,7 +486,7 @@ export class WorldDoors {
         return pass ? `${at}/-/${this.served}/pages/open#${new URLSearchParams({ pass, land }).toString()}` : null;
     }
     /** A one-time pass (a minute long) for the content plane or a hosted site; null when its asker holds fifty unused. */
-    mintPagesPass(scope, grant) {
+    mintPagesPass(scope, grant, viewAs) {
         const now = Date.now();
         for (const [k, v] of this.pagePasses)
             if (v.until <= now)
@@ -492,7 +496,7 @@ export class WorldDoors {
         if ([...this.pagePasses.values()].filter((v) => askerOf(v) === asker).length >= 50 || this.pagePasses.size >= 5000)
             return null;
         const pass = mintToken('pass_');
-        this.pagePasses.set(pass, { ...grant, scope, until: now + 60_000 });
+        this.pagePasses.set(pass, { ...grant, scope, until: now + 60_000, ...(viewAs ? { viewAs } : {}) });
         return pass;
     }
     /** The hostname a hosted site address names (`{site}` template: `<label>--<world>--<org>.<suffix>`) among those this
@@ -549,13 +553,16 @@ export class WorldDoors {
     /** What the content plane answers: its opening page and session, and the twins' pages; no door of the World. */
     async pagesPlane(request, url, /** a hosted site served here, not the content plane */ site) {
         const doors = `/-/${this.served}/pages/`;
-        const door = url.pathname.startsWith(doors) ? url.pathname.slice(doors.length) : null;
+        const viewPath = url.pathname.startsWith(`/${this.served}/`) ? url.pathname.slice(`/${this.served}/`.length).split('/') : [];
+        const viewVendor = viewPath.length === 4 && viewPath[1] === '_twin' && viewPath[2] === 'view-as' && Object.hasOwn(this.up().services, viewPath[0]) ? viewPath[0] : null;
+        const door = viewVendor ? viewPath[3] : url.pathname.startsWith(doors) ? url.pathname.slice(doors.length) : null;
+        const opening = viewVendor ? `/${this.served}/${viewVendor}/_twin/view-as/` : doors;
         const own = this.host.browserOrigin?.() ?? null;
         if (door === 'open' && request.method === 'GET') {
             // framed by this World's console, or its parent's (a comparison frames its branch's pages); the pages it opens are
             // framed only by the console that asked
             const consoles = [own, this.parentOrigin()].filter((x) => Boolean(x)).join(' ') || "'none'";
-            return new Response(`<!doctype html><meta charset="utf-8"><title>${this.served}</title><body data-world="${this.served}"${site ? ' data-site="1"' : ''}><script src="${doors}open.js"></script></body>`, { headers: { 'content-type': 'text/html; charset=utf-8', 'content-security-policy': `default-src 'none'; script-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors ${consoles}`, 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
+            return new Response(`<!doctype html><meta charset="utf-8"><title>${this.served}</title><body data-world="${this.served}" data-session="${opening}session"${site ? ' data-site="1"' : ''}><script src="${opening}open.js"></script></body>`, { headers: { 'content-type': 'text/html; charset=utf-8', 'content-security-policy': `default-src 'none'; script-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors ${consoles}`, 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
         }
         if (door === 'open.js' && request.method === 'GET') {
             const script = `(() => {
@@ -564,29 +571,47 @@ export class WorldDoors {
   history.replaceState(null, '', location.pathname);
   const pass = carried.get('pass') || '';
   const land = carried.get('land') || '';
+  const viewAs = carried.get('viewAs') === '1';
+  const tell = (data) => { if (viewAs && parent !== window) parent.postMessage({ type: 'volter-view-as', pass, ...data }, ${JSON.stringify(own)}); };
   // resolved as the browser will (encoded dots too), on this origin and under this World
   let to = null;
   // a hosted site lands anywhere on it; the content plane only under this World
   const anywhere = document.body.dataset.site === '1';
   try { const u = new URL(land, location.origin); if (land.startsWith('/') && !/[\\\\\\s]/.test(land) && u.origin === location.origin && (anywhere || u.pathname.startsWith('/' + world + '/'))) to = u.pathname + u.search; } catch {}
   if (!pass || !to) { document.body.textContent = 'Nothing to open.'; return; }
-  fetch('/-/' + world + '/pages/session', { method: 'POST', headers: { 'x-volter-pages-pass': pass } })
-    .then((r) => { if (r.ok) location.replace(to); else document.body.textContent = 'This World did not open.'; })
-    .catch(() => { document.body.textContent = 'This World did not answer.'; });
+  fetch(document.body.dataset.session, { method: 'POST', headers: { 'x-volter-pages-pass': pass } })
+    .then(async (r) => {
+      const opened = await r.json();
+      if (!r.ok) throw new Error(opened.error || 'This World did not open.');
+      if (opened.viewAs) { tell({ viewed: opened.viewAs }); location.replace(opened.viewAs.land); }
+      else if (viewAs) throw new Error('This pass did not sign in to the vendor.');
+      else location.replace(to);
+    })
+    .catch((e) => { document.body.textContent = e.message || 'This World did not answer.'; tell({ error: document.body.textContent }); });
 })();
 `;
             return new Response(script, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' } });
         }
         if (door === 'session' && request.method === 'POST') {
             // only this plane's own opening page asks (a browser sets the header; a page elsewhere cannot)
-            if (request.headers.get('sec-fetch-site') !== 'same-origin')
-                return Response.json({ error: 'the content plane opens its session from its own page' }, { status: 403 });
             const pass = request.headers.get('x-volter-pages-pass') ?? '';
             const given = this.pagePasses.get(pass);
             this.pagePasses.delete(pass);
+            if (request.headers.get('sec-fetch-site') !== 'same-origin')
+                return Response.json({ error: 'the content plane opens its session from its own page' }, { status: 403 });
             if (!given || given.until <= Date.now() || !this.pagesParentLive(given) || (given.site ?? null) !== (site ?? null))
                 return Response.json({ error: 'that pass is used or expired: open the page again from the World' }, { status: 401 });
-            const { until: _until, ...grant } = given;
+            const { until: _until, viewAs, ...grant } = given;
+            if (viewAs) {
+                const held = this.pageSession(request, url);
+                if (!held)
+                    return Response.json({ error: 'Open a vendor page from this World first, then choose View as again.' }, { status: 403 });
+                if (viewVendor !== viewAs.vendor || !given.session || held.scope !== 'write' || held.session !== given.session)
+                    return Response.json({ error: 'View as belongs to the browser session that asked for it' }, { status: 403 });
+                return this.vendorSession(request, viewAs, given.until);
+            }
+            if (viewVendor)
+                return Response.json({ error: 'this door takes only a View as pass' }, { status: 403 });
             // one content session per asker at a scope and framer: a board's frames opening together share it
             const same = (x) => x.scope === grant.scope && x.session === grant.session && x.asker === grant.asker && x.framer === grant.framer && x.who === grant.who && x.site === grant.site;
             const now = Date.now();
@@ -594,7 +619,9 @@ export class WorldDoors {
             const id = found ?? mintToken('pgs_');
             // twelve hours from its last opening while the session that asked stands; an hour where that cannot be known
             this.keepPagesSessions({ ...this.pagesSessions(), [id]: { ...grant, until: now + (grant.session !== undefined || grant.asker === undefined ? 12 : 1) * 3_600_000 } });
-            return Response.json({ world: this.served, scope: grant.scope }, { headers: { 'set-cookie': `${this.pagesCookie(url)}=${id}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned` } });
+            const headers = new Headers({ 'cache-control': 'no-store' });
+            headers.append('set-cookie', `${this.pagesCookie(url)}=${id}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned`);
+            return Response.json({ world: this.served, scope: grant.scope }, { headers });
         }
         // A HOSTED SITE: read with a session its World's own origin gave it a pass for (sites/go), never without
         if (site) {
@@ -638,6 +665,76 @@ export class WorldDoors {
         }
         return Response.json({ error: `this origin shows ${this.served}'s pages only` }, { status: 404 });
     }
+    /** A landing resolved as a browser resolves it, within this vendor's place only. */
+    vendorLanding(vendor, land) {
+        if (typeof land !== 'string' || !land.startsWith('/') || land.startsWith('//') || /[\\\s]/.test(land))
+            return null;
+        try {
+            const url = new URL(land, 'https://world.local');
+            const path = decodeURIComponent(url.pathname);
+            const base = `/${this.served}/${vendor}/`;
+            if (url.origin !== 'https://world.local' || !url.pathname.startsWith(base) || !path.startsWith(base)
+                || path.includes('\\') || path.split('/').some((p) => p === '.' || p === '..' || p.includes('%')))
+                return null;
+            return url.pathname + url.search + url.hash;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The pack's declared browser session, never inferred from its vendor or a sign-in page. */
+    async browserSessionOf(vendor) {
+        const twin = this.host.twinFetch(vendor);
+        if (!twin || !this.host.pagesOrigin?.())
+            return null;
+        try {
+            const answer = await twin(new Request('http://world.local/twin', { headers: { [READ_ONLY_HEADER]: '1' } }));
+            const manifest = answer.ok ? await answer.json() : null;
+            if (!manifest?.drawsScreens)
+                return null;
+            const session = manifest?.browserSession;
+            if (!session || typeof session !== 'object')
+                return null;
+            const { cookie, scope } = session;
+            if (typeof cookie !== 'string' || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(cookie)
+                || /^(?:__Host-|(?:__Secure-)?volter_(?:world|pages)$)/i.test(cookie) || (scope !== undefined && typeof scope !== 'string'))
+                return null;
+            return { cookie, ...(typeof scope === 'string' ? { scope } : {}) };
+        }
+        catch {
+            return null;
+        }
+    }
+    vendorPeople(vendor) {
+        return readTree(this.stateOf(vendor), this.controlRoot(vendor))
+            .filter((p) => p.type === '_person' && p.deleted !== true && typeof p.email === 'string')
+            .map((p) => ({ id: p.id, email: String(p.email), label: String(p.email) }));
+    }
+    /** The twin receives its own cookie and changes the session in its own process, over a host-only permit. */
+    async vendorSession(request, pass, until) {
+        const twin = this.host.twinFetch(pass.vendor);
+        if (!twin || !await this.browserSessionOf(pass.vendor) || !this.vendorLanding(pass.vendor, pass.land))
+            return Response.json({ error: 'that vendor session is unavailable' }, { status: 404 });
+        const person = pass.person === null ? null : this.vendorPeople(pass.vendor).find((p) => p.id === pass.person);
+        if (person === undefined)
+            return Response.json({ error: 'that person is no longer in the World' }, { status: 404 });
+        const url = new URL(request.url);
+        const headers = new Headers({ [TWIN_PREFIX_HEADER]: `/${this.served}/${pass.vendor}`, 'x-forwarded-host': url.host, 'x-forwarded-proto': url.protocol.slice(0, -1) });
+        headers.set(CALLER_HEADER, callerForHeader(pass.asker));
+        headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
+        const cookies = (request.headers.get('cookie') ?? '').split(/;\s*/).filter((c) => c && !/^(?:__Host-)?volter_(?:world|pages)=/.test(c));
+        if (cookies.length)
+            headers.set('cookie', cookies.join('; '));
+        const answer = await withBrowserSessionPermit(this.stateOf(pass.vendor), this.controlRoot(pass.vendor), { person: pass.person, land: pass.land, until }, async (permit) => {
+            headers.set(BROWSER_SESSION_HEADER, permit);
+            return twin(new Request(`${url.origin}${BROWSER_SESSION_PATH}`, { method: 'POST', headers, redirect: 'manual' }));
+        });
+        if (answer.status !== 303)
+            return answer;
+        const out = new Headers({ 'cache-control': 'no-store' });
+        this.keepCookiesHere(answer, out);
+        return Response.json({ viewAs: { vendor: pass.vendor, person: pass.person, label: person?.email ?? 'Signed out', land: pass.land } }, { headers: out });
+    }
     /** BROWSER SESSIONS: the session cookie carries an opaque id, never a token, so a leaked cookie is one session and
      *  not the World's write token; rotating the tokens ends every session. Kept in the World's store, so a restart
      *  keeps them; each lasts 30 days from its opening. */
@@ -1074,6 +1171,7 @@ export class WorldDoors {
      *  the request goes to that twin with the hostname as its original host, as the injector routes it inside the World.
      *  Reads only: the site is the twin's state as the World holds it, never a way to write it. */
     async site(request, host) {
+        request = stripBrowserSessionPermit(request);
         if (request.method !== 'GET' && request.method !== 'HEAD')
             return Response.json({ error: 'a site in a World is read: GET and HEAD' }, { status: 405 });
         const url = new URL(request.url);
@@ -1111,6 +1209,7 @@ export class WorldDoors {
         return Response.json({ error: `no twin of ${this.served} answers ${host}` }, { status: 404 });
     }
     async handle(request) {
+        request = stripBrowserSessionPermit(request);
         try {
             if (!this.host.ready() && !new URL(request.url).pathname.startsWith('/-/ping'))
                 return Response.json({ error: 'booting', world: this.served }, { status: 503, headers: { 'retry-after': '1' } });
@@ -1262,6 +1361,7 @@ export class WorldDoors {
         // the request's trace: the caller's trace-id goes on (or a new one), under a parent-id the World mints, which the
         // request's log entries carry, so each entry is joined to its caller by an id no caller chose
         headers.delete(CALLER_HEADER);
+        headers.delete(BROWSER_SESSION_HEADER);
         // the address a request was signed for (a CLI's loopback bridge says it, @volter/world-core/http-bridge) is a
         // credential holder's word: a browser's session cannot name another, so a signature is checked on the path it reached
         if (via === 'session') {
@@ -1337,7 +1437,7 @@ export class WorldDoors {
         // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
         // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
         const caller = new Headers(request.headers);
-        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, CALLER_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
+        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, CALLER_HEADER, BROWSER_SESSION_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
             caller.delete(h);
         // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
         const authorization = caller.get('authorization');
@@ -1949,6 +2049,33 @@ export class WorldDoors {
             return Response.json({ world: this.served, twins });
         }
         if (kind === 'twins' && name) {
+            if (parts.length === 3 && (verb === 'people' || verb === 'session')) {
+                const session = Object.hasOwn(this.up().services, name) ? await this.browserSessionOf(name) : null;
+                if (verb === 'people' && request.method === 'GET')
+                    return Response.json({ viewAs: session !== null, people: session ? this.vendorPeople(name).map(({ id, label }) => ({ id, label })) : [] }, { headers: { 'cache-control': 'no-store' } });
+                if (verb === 'session' && request.method === 'POST') {
+                    if (!session)
+                        return Response.json({ error: `${name} needs a declared browser session, a drawn screen and a content plane for View as` }, { status: 409 });
+                    if (via !== 'session' || presentedSecrets(request.headers, { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }).length || crossSite || site !== 'same-origin')
+                        return Response.json({ error: 'View as is opened from this World’s own page' }, { status: 403 });
+                    const body = await request.json().catch(() => null);
+                    const land = this.vendorLanding(name, body?.land);
+                    if (!body || (body.person !== null && typeof body.person !== 'string') || !land)
+                        return Response.json({ error: 'a session names a person (or null) and a path within that vendor' }, { status: 400 });
+                    if (body.person !== null && !this.vendorPeople(name).some((p) => p.id === body.person))
+                        return Response.json({ error: 'no such person in this World' }, { status: 404 });
+                    const at = this.host.pagesOrigin?.();
+                    if (!at)
+                        return Response.json({ error: 'View as needs this World’s content plane' }, { status: 409 });
+                    const asked = this.credential(request);
+                    if (!asked.session)
+                        return Response.json({ error: 'View as needs this World’s browser session' }, { status: 403 });
+                    const pass = this.mintPagesPass('write', { session: asked.session, ...(asked.who ? { who: asked.who } : {}), ...(this.host.browserOrigin?.() ? { framer: this.host.browserOrigin() } : {}) }, { vendor: name, person: body.person, land, asker: this.callerOf(request) });
+                    if (!pass)
+                        return Response.json({ error: 'too many pages opened at once: try again in a minute' }, { status: 429 });
+                    return Response.json({ url: `${at}/${this.served}/${name}/_twin/view-as/open#${new URLSearchParams({ pass, land, viewAs: '1' }).toString()}` }, { headers: { 'cache-control': 'no-store' } });
+                }
+            }
             if (verb === 'root' && request.method === 'GET')
                 return Response.json({ twin: name, root: rootForControlRoot(this.controlRoot(name), name) ?? null, credential: sealedCredentialInfo(this.worldRoot, name) });
             if (verb === 'root' && request.method === 'PUT') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.28",
+  "version": "3.0.30",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -68,14 +68,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.28",
-    "@volter/world-console": "3.0.23"
+    "@volter/world-core": "3.0.30",
+    "@volter/world-console": "3.0.25"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.28",
+    "@volter/world-core": "3.0.30",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",
     "yaml": "2.9.0"

package/src/redirect-proxy.ts

@@ -1,4 +1,4 @@
-import { serveHttp, type HttpServer } from '@volter/world-core/runtime';
+import { BROWSER_SESSION_HEADER, serveHttp, type HttpServer } from '@volter/world-core/runtime';
 import { worldNetworkPolicyFromEnv, allowsWorldNetworkEgress } from '@volter/world-core/network-policy';
 import { websocketRelay } from './websocket-relay.ts';
 // The ambient TLS redirect proxy — the substance of "any CLI, zero config" (WORLD_ACTIVATE.md §"How
@@ -376,7 +376,7 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
         const origin = new URL(twin.origin);
 
         const headers = new Headers(req.headers);
-        for (const h of ['proxy-connection', 'accept-encoding', 'connection']) headers.delete(h);
+        for (const h of [BROWSER_SESSION_HEADER, 'proxy-connection', 'accept-encoding', 'connection']) headers.delete(h);
         // the application is not a twin: it gets no World key, keeps its Host and hears it was reached over TLS
         if (twin.vendor === 'app') {
           headers.delete('x-twins-key');
@@ -509,6 +509,7 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
         outHeaders['x-volter-twin-original-host'] = headers.host ?? origin.host;
         outHeaders.host = origin.host;
       }
+      delete outHeaders[BROWSER_SESSION_HEADER];
       delete outHeaders['proxy-connection'];
       delete outHeaders['accept-encoding'];
       upstream.write(`${method} ${path} ${version}\r\n`);

package/src/reflect.ts

@@ -1,3 +1,4 @@
+import { BROWSER_SESSION_HEADER } from '@volter/world-core/runtime';
 import { serveHttp, type HttpServer } from '@volter/world-core/runtime';
 import { websocketRelay } from './websocket-relay.ts';
 import { sessionTrustEnv } from './ca-trust.ts';
@@ -160,6 +161,7 @@ export async function startReflectFront(options: ReflectFrontOptions): Promise<R
         try { origin = new URL(target.origin); } catch { return new Response('bad twin origin', { status: 502 }); }
 
         const headers = new Headers(req.headers);
+        headers.delete(BROWSER_SESSION_HEADER);
         headers.delete('proxy-connection');
         headers.delete('accept-encoding');
         // the consumer spoke TLS to the front; a twin that answers with an absolute URL (Slack's Socket Mode link)

package/src/served-world.ts

@@ -13,6 +13,7 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 //   POST deploy[/<name>]             perform landed entries against each root, by policy
 //   GET/PUT twins/<vendor>/root      the vendor's real account behind the twin (PUT null clears)
 //   PUT  twins/<vendor>/credential   seal the credential; GET answers only that one is sealed
+//   GET twins/<vendor>/people, POST twins/<vendor>/session   a browser views the vendor as a World's person
 //   POST twins/<vendor>/refresh      observe the root now
 // and what a person looks into it through (docs/contributing/architecture.md, "Viewing a World"):
 //   GET  map | timeline | diff       every twin and what it holds; the logs merged newest first; the changes since the base
@@ -31,6 +32,7 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
 import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, type TwinRequestJournalCursor, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, siteLabel, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink, type BoardFrame } from '@volter/world-core/runtime';
+import { BROWSER_SESSION_HEADER, BROWSER_SESSION_PATH, stripBrowserSessionPermit, withBrowserSessionPermit, type DerivedManifest } from '@volter/world-core/runtime';
 import { APP_READ_ENDPOINT_ENV } from './init.ts';
 import { packFacts } from './pack-facts.ts';
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type TrustedIssuer, type WorldCredentials } from '@volter/world-access';
@@ -168,6 +170,7 @@ export type MountedWorld = { name: string; served: string; root: string; readonl
 /** What a content-plane pass, and the session it opens, carry: its scope; the control session that asked (the content
  *  session ends with it; none when the World's token asked); the person; the console that frames it; and whether it
  *  is this machine's own page (attributed to the machine). */
+type VendorSessionPass = { vendor: string; person: string | null; land: string; asker: string };
 type PagesGrant = { scope: 'read' | 'write'; session?: string; who?: string; framer?: string; local?: true; /** the hosted site it
  *  opens (a hostname this World's twins answer), not the content plane */ site?: string; /** a parent World's session that asked
  *  for a branch's page, as an opaque mark: the branch keeps one content session per asker and caps passes by it, but
@@ -450,7 +453,7 @@ export class WorldDoors {
    *  token: it uses the twins at its scope and nothing else. One per session that gave it a pass (every frame of a board
    *  shares it), kept in the World's store, ended with that session; framed only by the console that asked. */
   private onPages(url: URL): boolean { const at = this.host.pagesOrigin?.() ?? null; return at !== null && url.host === new URL(at).host; }
-  private readonly pagePasses = new Map<string, PagesGrant & { until: number }>();
+  private readonly pagePasses = new Map<string, PagesGrant & { until: number; viewAs?: VendorSessionPass }>();
   private pagesPath(): string { return join(this.worldRoot, stateDirName(), 'pages-sessions.json'); }
   private pagesHeld: Record<string, PagesGrant & { until: number }> | null = null;
   private pagesSessions(): Record<string, PagesGrant & { until: number }> {
@@ -477,7 +480,9 @@ export class WorldDoors {
   }
   /** Whether what gave a content session its pass still stands: the control session that asked (ended, signed out, or
    *  its shared link revoked, the content session ends with it), or this World's token (rotated, every one ends). */
-  private pagesParentLive(grant: PagesGrant): boolean { return grant.session === undefined || this.issued().session(grant.session) !== null; }
+  private pagesParentLive(grant: PagesGrant): boolean {
+    return grant.session === undefined || this.issued().session(grant.session) !== null;
+  }
   /** The address that opens this World's content plane for a minute's one-time pass and lands on `land` (a path of this
    *  World); null where the World has no content plane, or the asker holds fifty passes not yet used. */
   pagesPass(scope: 'read' | 'write', land: string, grant: Omit<PagesGrant, 'scope'> = {}): string | null {
@@ -487,14 +492,14 @@ export class WorldDoors {
     return pass ? `${at}/-/${this.served}/pages/open#${new URLSearchParams({ pass, land }).toString()}` : null;
   }
   /** A one-time pass (a minute long) for the content plane or a hosted site; null when its asker holds fifty unused. */
-  private mintPagesPass(scope: 'read' | 'write', grant: Omit<PagesGrant, 'scope'>): string | null {
+  private mintPagesPass(scope: 'read' | 'write', grant: Omit<PagesGrant, 'scope'>, viewAs?: VendorSessionPass): string | null {
     const now = Date.now();
     for (const [k, v] of this.pagePasses) if (v.until <= now) this.pagePasses.delete(k);
     const askerOf = (g: Omit<PagesGrant, 'scope'>): string => g.session ?? g.asker ?? g.framer ?? 'token';
     const asker = askerOf(grant);
     if ([...this.pagePasses.values()].filter((v) => askerOf(v) === asker).length >= 50 || this.pagePasses.size >= 5000) return null;
     const pass = mintToken('pass_');
-    this.pagePasses.set(pass, { ...grant, scope, until: now + 60_000 });
+    this.pagePasses.set(pass, { ...grant, scope, until: now + 60_000, ...(viewAs ? { viewAs } : {}) });
     return pass;
   }
   /** The hostname a hosted site address names (`{site}` template: `<label>--<world>--<org>.<suffix>`) among those this
@@ -540,13 +545,16 @@ export class WorldDoors {
   /** What the content plane answers: its opening page and session, and the twins' pages; no door of the World. */
   private async pagesPlane(request: Request, url: URL, /** a hosted site served here, not the content plane */ site?: string): Promise<Response> {
     const doors = `/-/${this.served}/pages/`;
-    const door = url.pathname.startsWith(doors) ? url.pathname.slice(doors.length) : null;
+    const viewPath = url.pathname.startsWith(`/${this.served}/`) ? url.pathname.slice(`/${this.served}/`.length).split('/') : [];
+    const viewVendor = viewPath.length === 4 && viewPath[1] === '_twin' && viewPath[2] === 'view-as' && Object.hasOwn(this.up().services, viewPath[0]!) ? viewPath[0]! : null;
+    const door = viewVendor ? viewPath[3] : url.pathname.startsWith(doors) ? url.pathname.slice(doors.length) : null;
+    const opening = viewVendor ? `/${this.served}/${viewVendor}/_twin/view-as/` : doors;
     const own = this.host.browserOrigin?.() ?? null;
     if (door === 'open' && request.method === 'GET') {
       // framed by this World's console, or its parent's (a comparison frames its branch's pages); the pages it opens are
       // framed only by the console that asked
       const consoles = [own, this.parentOrigin()].filter((x): x is string => Boolean(x)).join(' ') || "'none'";
-      return new Response(`<!doctype html><meta charset="utf-8"><title>${this.served}</title><body data-world="${this.served}"${site ? ' data-site="1"' : ''}><script src="${doors}open.js"></script></body>`,
+      return new Response(`<!doctype html><meta charset="utf-8"><title>${this.served}</title><body data-world="${this.served}" data-session="${opening}session"${site ? ' data-site="1"' : ''}><script src="${opening}open.js"></script></body>`,
         { headers: { 'content-type': 'text/html; charset=utf-8', 'content-security-policy': `default-src 'none'; script-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors ${consoles}`, 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
     }
     if (door === 'open.js' && request.method === 'GET') {
@@ -556,27 +564,42 @@ export class WorldDoors {
   history.replaceState(null, '', location.pathname);
   const pass = carried.get('pass') || '';
   const land = carried.get('land') || '';
+  const viewAs = carried.get('viewAs') === '1';
+  const tell = (data) => { if (viewAs && parent !== window) parent.postMessage({ type: 'volter-view-as', pass, ...data }, ${JSON.stringify(own)}); };
   // resolved as the browser will (encoded dots too), on this origin and under this World
   let to = null;
   // a hosted site lands anywhere on it; the content plane only under this World
   const anywhere = document.body.dataset.site === '1';
   try { const u = new URL(land, location.origin); if (land.startsWith('/') && !/[\\\\\\s]/.test(land) && u.origin === location.origin && (anywhere || u.pathname.startsWith('/' + world + '/'))) to = u.pathname + u.search; } catch {}
   if (!pass || !to) { document.body.textContent = 'Nothing to open.'; return; }
-  fetch('/-/' + world + '/pages/session', { method: 'POST', headers: { 'x-volter-pages-pass': pass } })
-    .then((r) => { if (r.ok) location.replace(to); else document.body.textContent = 'This World did not open.'; })
-    .catch(() => { document.body.textContent = 'This World did not answer.'; });
+  fetch(document.body.dataset.session, { method: 'POST', headers: { 'x-volter-pages-pass': pass } })
+    .then(async (r) => {
+      const opened = await r.json();
+      if (!r.ok) throw new Error(opened.error || 'This World did not open.');
+      if (opened.viewAs) { tell({ viewed: opened.viewAs }); location.replace(opened.viewAs.land); }
+      else if (viewAs) throw new Error('This pass did not sign in to the vendor.');
+      else location.replace(to);
+    })
+    .catch((e) => { document.body.textContent = e.message || 'This World did not answer.'; tell({ error: document.body.textContent }); });
 })();
 `;
       return new Response(script, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' } });
     }
     if (door === 'session' && request.method === 'POST') {
       // only this plane's own opening page asks (a browser sets the header; a page elsewhere cannot)
-      if (request.headers.get('sec-fetch-site') !== 'same-origin') return Response.json({ error: 'the content plane opens its session from its own page' }, { status: 403 });
       const pass = request.headers.get('x-volter-pages-pass') ?? '';
       const given = this.pagePasses.get(pass);
       this.pagePasses.delete(pass);
+      if (request.headers.get('sec-fetch-site') !== 'same-origin') return Response.json({ error: 'the content plane opens its session from its own page' }, { status: 403 });
       if (!given || given.until <= Date.now() || !this.pagesParentLive(given) || (given.site ?? null) !== (site ?? null)) return Response.json({ error: 'that pass is used or expired: open the page again from the World' }, { status: 401 });
-      const { until: _until, ...grant } = given;
+      const { until: _until, viewAs, ...grant } = given;
+      if (viewAs) {
+        const held = this.pageSession(request, url);
+        if (!held) return Response.json({ error: 'Open a vendor page from this World first, then choose View as again.' }, { status: 403 });
+        if (viewVendor !== viewAs.vendor || !given.session || held.scope !== 'write' || held.session !== given.session) return Response.json({ error: 'View as belongs to the browser session that asked for it' }, { status: 403 });
+        return this.vendorSession(request, viewAs, given.until);
+      }
+      if (viewVendor) return Response.json({ error: 'this door takes only a View as pass' }, { status: 403 });
       // one content session per asker at a scope and framer: a board's frames opening together share it
       const same = (x: PagesGrant): boolean => x.scope === grant.scope && x.session === grant.session && x.asker === grant.asker && x.framer === grant.framer && x.who === grant.who && x.site === grant.site;
       const now = Date.now();
@@ -584,7 +607,9 @@ export class WorldDoors {
       const id = found ?? mintToken('pgs_');
       // twelve hours from its last opening while the session that asked stands; an hour where that cannot be known
       this.keepPagesSessions({ ...this.pagesSessions(), [id]: { ...grant, until: now + (grant.session !== undefined || grant.asker === undefined ? 12 : 1) * 3_600_000 } });
-      return Response.json({ world: this.served, scope: grant.scope }, { headers: { 'set-cookie': `${this.pagesCookie(url)}=${id}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned` } });
+      const headers = new Headers({ 'cache-control': 'no-store' });
+      headers.append('set-cookie', `${this.pagesCookie(url)}=${id}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned`);
+      return Response.json({ world: this.served, scope: grant.scope }, { headers });
     }
     // A HOSTED SITE: read with a session its World's own origin gave it a pass for (sites/go), never without
     if (site) {
@@ -627,6 +652,61 @@ export class WorldDoors {
     return Response.json({ error: `this origin shows ${this.served}'s pages only` }, { status: 404 });
   }
 
+  /** A landing resolved as a browser resolves it, within this vendor's place only. */
+  private vendorLanding(vendor: string, land: unknown): string | null {
+    if (typeof land !== 'string' || !land.startsWith('/') || land.startsWith('//') || /[\\\s]/.test(land)) return null;
+    try {
+      const url = new URL(land, 'https://world.local');
+      const path = decodeURIComponent(url.pathname);
+      const base = `/${this.served}/${vendor}/`;
+      if (url.origin !== 'https://world.local' || !url.pathname.startsWith(base) || !path.startsWith(base)
+        || path.includes('\\') || path.split('/').some((p) => p === '.' || p === '..' || p.includes('%'))) return null;
+      return url.pathname + url.search + url.hash;
+    } catch { return null; }
+  }
+  /** The pack's declared browser session, never inferred from its vendor or a sign-in page. */
+  private async browserSessionOf(vendor: string): Promise<NonNullable<DerivedManifest['browserSession']> | null> {
+    const twin = this.host.twinFetch(vendor);
+    if (!twin || !this.host.pagesOrigin?.()) return null;
+    try {
+      const answer = await twin(new Request('http://world.local/twin', { headers: { [READ_ONLY_HEADER]: '1' } }));
+      const manifest = answer.ok ? await answer.json() as { browserSession?: unknown; drawsScreens?: boolean } : null;
+      if (!manifest?.drawsScreens) return null;
+      const session = manifest?.browserSession;
+      if (!session || typeof session !== 'object') return null;
+      const { cookie, scope } = session as { cookie?: unknown; scope?: unknown };
+      if (typeof cookie !== 'string' || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(cookie)
+        || /^(?:__Host-|(?:__Secure-)?volter_(?:world|pages)$)/i.test(cookie) || (scope !== undefined && typeof scope !== 'string')) return null;
+      return { cookie, ...(typeof scope === 'string' ? { scope } : {}) };
+    } catch { return null; }
+  }
+  private vendorPeople(vendor: string): Array<{ id: string; label: string; email: string }> {
+    return readTree(this.stateOf(vendor), this.controlRoot(vendor))
+      .filter((p) => p.type === '_person' && p.deleted !== true && typeof p.email === 'string')
+      .map((p) => ({ id: p.id, email: String(p.email), label: String(p.email) }));
+  }
+  /** The twin receives its own cookie and changes the session in its own process, over a host-only permit. */
+  private async vendorSession(request: Request, pass: VendorSessionPass, until: number): Promise<Response> {
+    const twin = this.host.twinFetch(pass.vendor);
+    if (!twin || !await this.browserSessionOf(pass.vendor) || !this.vendorLanding(pass.vendor, pass.land)) return Response.json({ error: 'that vendor session is unavailable' }, { status: 404 });
+    const person = pass.person === null ? null : this.vendorPeople(pass.vendor).find((p) => p.id === pass.person);
+    if (person === undefined) return Response.json({ error: 'that person is no longer in the World' }, { status: 404 });
+    const url = new URL(request.url);
+    const headers = new Headers({ [TWIN_PREFIX_HEADER]: `/${this.served}/${pass.vendor}`, 'x-forwarded-host': url.host, 'x-forwarded-proto': url.protocol.slice(0, -1) });
+    headers.set(CALLER_HEADER, callerForHeader(pass.asker));
+    headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
+    const cookies = (request.headers.get('cookie') ?? '').split(/;\s*/).filter((c) => c && !/^(?:__Host-)?volter_(?:world|pages)=/.test(c));
+    if (cookies.length) headers.set('cookie', cookies.join('; '));
+    const answer = await withBrowserSessionPermit(this.stateOf(pass.vendor), this.controlRoot(pass.vendor), { person: pass.person, land: pass.land, until }, async (permit) => {
+      headers.set(BROWSER_SESSION_HEADER, permit);
+      return twin(new Request(`${url.origin}${BROWSER_SESSION_PATH}`, { method: 'POST', headers, redirect: 'manual' }));
+    });
+    if (answer.status !== 303) return answer;
+    const out = new Headers({ 'cache-control': 'no-store' });
+    this.keepCookiesHere(answer, out);
+    return Response.json({ viewAs: { vendor: pass.vendor, person: pass.person, label: person?.email ?? 'Signed out', land: pass.land } }, { headers: out });
+  }
+
   /** BROWSER SESSIONS: the session cookie carries an opaque id, never a token, so a leaked cookie is one session and
    *  not the World's write token; rotating the tokens ends every session. Kept in the World's store, so a restart
    *  keeps them; each lasts 30 days from its opening. */
@@ -971,6 +1051,7 @@ export class WorldDoors {
    *  the request goes to that twin with the hostname as its original host, as the injector routes it inside the World.
    *  Reads only: the site is the twin's state as the World holds it, never a way to write it. */
   async site(request: Request, host: string): Promise<Response> {
+    request = stripBrowserSessionPermit(request);
     if (request.method !== 'GET' && request.method !== 'HEAD') return Response.json({ error: 'a site in a World is read: GET and HEAD' }, { status: 405 });
     const url = new URL(request.url);
     for (const { vendor, hosts } of await this.claimedHosts(url.origin)) {
@@ -996,6 +1077,7 @@ export class WorldDoors {
   }
 
   async handle(request: Request): Promise<Response> {
+    request = stripBrowserSessionPermit(request);
     try {
       if (!this.host.ready() && !new URL(request.url).pathname.startsWith('/-/ping')) return Response.json({ error: 'booting', world: this.served }, { status: 503, headers: { 'retry-after': '1' } });
       const url = new URL(request.url);
@@ -1123,6 +1205,7 @@ export class WorldDoors {
     // the request's trace: the caller's trace-id goes on (or a new one), under a parent-id the World mints, which the
     // request's log entries carry, so each entry is joined to its caller by an id no caller chose
     headers.delete(CALLER_HEADER);
+    headers.delete(BROWSER_SESSION_HEADER);
     // the address a request was signed for (a CLI's loopback bridge says it, @volter/world-core/http-bridge) is a
     // credential holder's word: a browser's session cannot name another, so a signature is checked on the path it reached
     if (via === 'session') { headers.delete(ORIGINAL_PATH_HEADER); headers.delete('x-volter-twin-original-host'); }
@@ -1182,7 +1265,7 @@ export class WorldDoors {
     // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
     // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
     const caller = new Headers(request.headers);
-    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, CALLER_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) caller.delete(h);
+    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, CALLER_HEADER, BROWSER_SESSION_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) caller.delete(h);
     // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
     const authorization = caller.get('authorization');
     const offered = authorization ? presentedSecrets(new Headers({ authorization }), { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }) : [];
@@ -1657,6 +1740,26 @@ export class WorldDoors {
       return Response.json({ world: this.served, twins });
     }
     if (kind === 'twins' && name) {
+      if (parts.length === 3 && (verb === 'people' || verb === 'session')) {
+        const session = Object.hasOwn(this.up().services, name) ? await this.browserSessionOf(name) : null;
+        if (verb === 'people' && request.method === 'GET') return Response.json({ viewAs: session !== null, people: session ? this.vendorPeople(name).map(({ id, label }) => ({ id, label })) : [] }, { headers: { 'cache-control': 'no-store' } });
+        if (verb === 'session' && request.method === 'POST') {
+          if (!session) return Response.json({ error: `${name} needs a declared browser session, a drawn screen and a content plane for View as` }, { status: 409 });
+          if (via !== 'session' || presentedSecrets(request.headers, { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }).length || crossSite || site !== 'same-origin') return Response.json({ error: 'View as is opened from this World’s own page' }, { status: 403 });
+          const body = await request.json().catch(() => null) as { person?: unknown; land?: unknown } | null;
+          const land = this.vendorLanding(name, body?.land);
+          if (!body || (body.person !== null && typeof body.person !== 'string') || !land) return Response.json({ error: 'a session names a person (or null) and a path within that vendor' }, { status: 400 });
+          if (body.person !== null && !this.vendorPeople(name).some((p) => p.id === body.person)) return Response.json({ error: 'no such person in this World' }, { status: 404 });
+          const at = this.host.pagesOrigin?.();
+          if (!at) return Response.json({ error: 'View as needs this World’s content plane' }, { status: 409 });
+          const asked = this.credential(request);
+          if (!asked.session) return Response.json({ error: 'View as needs this World’s browser session' }, { status: 403 });
+          const pass = this.mintPagesPass('write', { session: asked.session, ...(asked.who ? { who: asked.who } : {}), ...(this.host.browserOrigin?.() ? { framer: this.host.browserOrigin!()! } : {}) }, { vendor: name, person: body.person, land, asker: this.callerOf(request)! });
+          if (!pass) return Response.json({ error: 'too many pages opened at once: try again in a minute' }, { status: 429 });
+          return Response.json({ url: `${at}/${this.served}/${name}/_twin/view-as/open#${new URLSearchParams({ pass, land, viewAs: '1' }).toString()}` }, { headers: { 'cache-control': 'no-store' } });
+        }
+      }
+
       if (verb === 'root' && request.method === 'GET') return Response.json({ twin: name, root: rootForControlRoot(this.controlRoot(name), name) ?? null, credential: sealedCredentialInfo(this.worldRoot, name) });
       if (verb === 'root' && request.method === 'PUT') {
         const body = (await request.json()) as RootConfig | null;