@volter/world-runtime 3.0.32 → 3.0.34

package/dist/src/served-world.js

@@ -30,7 +30,7 @@ import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, h
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin } from '@volter/world-core/runtime';
+import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, TWIN_SITE_HEADER, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin } from '@volter/world-core/runtime';
 import { resolveTwinHost } from '@volter/world-core/host-routing';
 import { assertBrowserName, validateBrowserState, cookieMatchesHost } from '@volter/world-core';
 import { worldBrowser, worldBrowsers, putWorldBrowser, deleteWorldBrowser, materializeBrowserFiles, browserLoad, putBrowserLoad, browserLoadId } from "./browsers.js";
@@ -1095,8 +1095,8 @@ export class WorldDoors {
                     ...(packFacts()[vendor]?.hosts ?? []).flatMap(rule => typeof rule.host === 'string' && !rule.exclude ? [rule.host] : []),
                 ])] }));
     }
-    async browserRoutes(origin) {
-        const listed = await this.claimedHosts(origin);
+    async browserRoutes(origin, hosts) {
+        const listed = hosts ?? await this.claimedHosts(origin);
         const facts = packFacts();
         const map = Object.fromEntries(Object.keys(this.up().services).map(vendor => [vendor, vendor]));
         const claimed = {};
@@ -1196,17 +1196,32 @@ export class WorldDoors {
         if (browser && !grant)
             return Response.json({ error: "open this browser site from the World's board" }, { status: 401 });
         const url = new URL(request.url);
-        const routes = browser ? await this.browserRoutes(url.origin) : null;
+        const pageHost = host;
+        // This prefix belongs only to a hosted site's session, never to a bare twin or the content plane.
+        const resource = grant && this.siteShaped(url) && url.pathname.startsWith('/_host/');
+        const listed = await this.claimedHosts(url.origin);
+        const routes = browser || resource ? await this.browserRoutes(url.origin, listed) : null;
+        let path = url.pathname;
         let vendor;
-        if (routes)
-            vendor = resolveTwinHost(routes.rules, host, routes.map, url.pathname, routes.claimed)?.origin;
+        if (browser && routes)
+            vendor = resolveTwinHost(routes.rules, host, routes.map, resource ? '/' : path, routes.claimed)?.origin;
         else
-            for (const row of await this.claimedHosts(url.origin)) {
+            for (const row of listed) {
                 if (!this.host.twinFetch(row.vendor) || !row.hosts.includes(host))
                     continue;
                 vendor = row.vendor;
                 break;
             }
+        if (resource && routes) {
+            const target = /^\/_host\/([a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(\/.*)?$/.exec(path);
+            const targetHost = target?.[1];
+            const targetPath = target?.[2] ?? '/';
+            const targetVendor = targetHost ? resolveTwinHost(routes.rules, targetHost, routes.map, targetPath, routes.claimed)?.origin : undefined;
+            if (!vendor || targetVendor !== vendor)
+                return Response.json({ error: 'this site serves only its own vendor hosts' }, { status: 404 });
+            host = targetHost;
+            path = targetPath;
+        }
         const twin = vendor ? this.host.twinFetch(vendor) : undefined;
         if (vendor && twin) {
             const reads = request.method === 'GET' || request.method === 'HEAD';
@@ -1214,7 +1229,7 @@ export class WorldDoors {
             if (browser && grant?.scope === 'read' && !reads && !enforced)
                 return Response.json({ error: 'the read token opens only reads' }, { status: 403 });
             const headers = browser ? new Headers(request.headers) : new Headers();
-            for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER])
+            for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, TWIN_SITE_HEADER])
                 headers.delete(key);
             for (const name of ['accept', 'accept-language', 'if-none-match', 'range', 'user-agent']) {
                 const v = request.headers.get(name);
@@ -1226,9 +1241,12 @@ export class WorldDoors {
                 if (cookies.length)
                     headers.set('cookie', cookies.join('; '));
                 headers.set('x-volter-world-browser', browser);
+            }
+            if (grant && this.siteShaped(url)) {
                 const template = this.host.sitesTemplate?.();
                 if (template)
                     headers.set(TWIN_SITES_HEADER, template);
+                headers.set(TWIN_SITE_HEADER, pageHost);
                 headers.set('x-forwarded-host', url.host);
                 headers.set('x-forwarded-proto', url.protocol.slice(0, -1));
             }
@@ -1241,14 +1259,17 @@ export class WorldDoors {
                 headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
             }
             const body = reads ? undefined : await request.arrayBuffer();
-            const answer = await twin(new Request(`${url.origin}${url.pathname}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
+            const answer = await twin(new Request(`${url.origin}${path}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
             // a redirect the site answers names its own hostname: in the World it stays under the World's origin
             const out = new Headers(answer.headers);
             const location = out.get('location');
             if (location) {
                 try {
-                    const to = new URL(location, `https://${host}`);
-                    if (to.hostname === host)
+                    const to = new URL(location, `https://${host}${path}${url.search}`);
+                    const sameVendor = resource && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed)?.origin === vendor;
+                    if (sameVendor)
+                        out.set('location', `${to.hostname === pageHost ? '' : `/_host/${to.hostname}`}${to.pathname}${to.search}${to.hash}`);
+                    else if (to.hostname === host)
                         out.set('location', `${to.pathname}${to.search}${to.hash}`);
                     else if (browser && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed) && routes.sites.some(row => row.hosts.includes(to.hostname))) {
                         const at = this.host.sitesTemplate?.();
@@ -2656,11 +2677,30 @@ export class WorldDoors {
                 if (home)
                     listed = [{ id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, covers: [], drawn: true }];
             }
+            const entries = wholeLog(this.stateOf(vendor), this.controlRoot(vendor));
+            // One index per vendor, rather than scanning its history for every page on every board read.
+            const positions = new Map();
+            let vendorPosition = 0;
+            for (let i = 0; i < entries.length; i++) {
+                const entry = entries[i];
+                if (entry.subject.type.startsWith('_'))
+                    continue;
+                vendorPosition = i + 1;
+                positions.set(`${entry.subject.type}:${entry.subject.id}`, vendorPosition);
+                if (entry.aliasOf)
+                    positions.set(`${entry.subject.type}:${entry.aliasOf}`, vendorPosition);
+            }
             for (const f of listed) {
                 const covered = new Set(f.covers.map(c => `${c.type}:${c.id}`));
                 const mine = changes.filter(x => x.service === vendor && (fallback || covered.has(`${x.action.subject.type}:${x.action.subject.id}`)));
+                // A page's revision includes already-cut writes and landed receipts, independent of the board's filter.
+                // Another page's writes never move it. A fallback home covers the vendor's public writes, as its change count does.
+                let position = fallback ? vendorPosition : 0;
+                if (!fallback)
+                    for (const key of covered)
+                        position = Math.max(position, positions.get(key) ?? 0);
                 const add = (at, browser, unseen) => {
-                    frames.push({ frame: { vendor, ...(browser ? { browser } : {}), id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(f.parent ? { parent: f.parent } : {}), ...(f.ours ? { ours: true } : {}), ...(unseen ? { unseen } : {}) }, mine });
+                    frames.push({ frame: { vendor, ...(browser ? { browser } : {}), id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, position, at, ...(f.parent ? { parent: f.parent } : {}), ...(f.ours ? { ours: true } : {}), ...(unseen ? { unseen } : {}) }, mine });
                 };
                 let plain = false;
                 const openedBrowsers = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.32",
+  "version": "3.0.34",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -68,14 +68,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.32",
-    "@volter/world-console": "3.0.27"
+    "@volter/world-core": "3.0.34",
+    "@volter/world-console": "3.0.29"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.32",
+    "@volter/world-core": "3.0.34",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",
     "yaml": "2.9.0"

package/src/served-world.ts

@@ -30,7 +30,7 @@ import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, h
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
-import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, type TwinRequestJournalCursor, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, siteLabel, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink, type BoardFrame } from '@volter/world-core/runtime';
+import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, type TwinRequestJournalCursor, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, TWIN_SITE_HEADER, siteLabel, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink, type BoardFrame } from '@volter/world-core/runtime';
 import { resolveTwinHost, type HostPredicate } from '@volter/world-core/host-routing';
 import { assertBrowserName, validateBrowserState, cookieMatchesHost } from '@volter/world-core';
 import { worldBrowser, worldBrowsers, putWorldBrowser, deleteWorldBrowser, materializeBrowserFiles, browserLoad, putBrowserLoad, browserLoadId } from './browsers.ts';
@@ -997,8 +997,8 @@ export class WorldDoors {
     ])] }));
   }
 
-  private async browserRoutes(origin: string): Promise<{ sites: Array<{ vendor: string; hosts: string[] }>; rules: Record<string, HostPredicate>; map: Record<string, string>; claimed: Record<string, Set<string>> }> {
-    const listed = await this.claimedHosts(origin);
+  private async browserRoutes(origin: string, hosts?: Array<{ vendor: string; hosts: string[] }>): Promise<{ sites: Array<{ vendor: string; hosts: string[] }>; rules: Record<string, HostPredicate>; map: Record<string, string>; claimed: Record<string, Set<string>> }> {
+    const listed = hosts ?? await this.claimedHosts(origin);
     const facts = packFacts();
     const map: Record<string, string> = Object.fromEntries(Object.keys(this.up().services).map(vendor => [vendor, vendor]));
     const claimed: Record<string, Set<string>> = {};
@@ -1078,28 +1078,45 @@ export class WorldDoors {
     if (!browser && request.method !== 'GET' && request.method !== 'HEAD') return Response.json({ error: 'a site in a World is read: GET and HEAD' }, { status: 405 });
     if (browser && !grant) return Response.json({ error: "open this browser site from the World's board" }, { status: 401 });
     const url = new URL(request.url);
-    const routes = browser ? await this.browserRoutes(url.origin) : null;
+    const pageHost = host;
+    // This prefix belongs only to a hosted site's session, never to a bare twin or the content plane.
+    const resource = grant && this.siteShaped(url) && url.pathname.startsWith('/_host/');
+    const listed = await this.claimedHosts(url.origin);
+    const routes = browser || resource ? await this.browserRoutes(url.origin, listed) : null;
+    let path = url.pathname;
     let vendor: string | undefined;
-    if (routes) vendor = resolveTwinHost(routes.rules, host, routes.map, url.pathname, routes.claimed)?.origin;
-    else for (const row of await this.claimedHosts(url.origin)) {
+    if (browser && routes) vendor = resolveTwinHost(routes.rules, host, routes.map, resource ? '/' : path, routes.claimed)?.origin;
+    else for (const row of listed) {
       if (!this.host.twinFetch(row.vendor) || !row.hosts.includes(host)) continue;
       vendor = row.vendor;
       break;
     }
+    if (resource && routes) {
+      const target = /^\/_host\/([a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(\/.*)?$/.exec(path);
+      const targetHost = target?.[1];
+      const targetPath = target?.[2] ?? '/';
+      const targetVendor = targetHost ? resolveTwinHost(routes.rules, targetHost, routes.map, targetPath, routes.claimed)?.origin : undefined;
+      if (!vendor || targetVendor !== vendor) return Response.json({ error: 'this site serves only its own vendor hosts' }, { status: 404 });
+      host = targetHost!;
+      path = targetPath;
+    }
     const twin = vendor ? this.host.twinFetch(vendor) : undefined;
     if (vendor && twin) {
       const reads = request.method === 'GET' || request.method === 'HEAD';
       const enforced = browser && grant?.scope === 'read' && await this.enforcesRead(vendor, twin, url.origin);
       if (browser && grant?.scope === 'read' && !reads && !enforced) return Response.json({ error: 'the read token opens only reads' }, { status: 403 });
       const headers = browser ? new Headers(request.headers) : new Headers();
-      for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER]) headers.delete(key);
+      for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, TWIN_SITE_HEADER]) headers.delete(key);
       for (const name of ['accept', 'accept-language', 'if-none-match', 'range', 'user-agent']) { const v = request.headers.get(name); if (v !== null) headers.set(name, v); }
       if (browser) {
         const cookies = (request.headers.get('cookie') ?? '').split(/;\s*/).filter(c => !/^(?:__Host-)?volter_(?:world|pages|browser)=/.test(c));
         if (cookies.length) headers.set('cookie', cookies.join('; '));
         headers.set('x-volter-world-browser', browser);
+      }
+      if (grant && this.siteShaped(url)) {
         const template = this.host.sitesTemplate?.();
         if (template) headers.set(TWIN_SITES_HEADER, template);
+        headers.set(TWIN_SITE_HEADER, pageHost);
         headers.set('x-forwarded-host', url.host);
         headers.set('x-forwarded-proto', url.protocol.slice(0, -1));
       }
@@ -1110,11 +1127,17 @@ export class WorldDoors {
         headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
       }
       const body = reads ? undefined : await request.arrayBuffer();
-      const answer = await twin(new Request(`${url.origin}${url.pathname}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
+      const answer = await twin(new Request(`${url.origin}${path}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
       // a redirect the site answers names its own hostname: in the World it stays under the World's origin
       const out = new Headers(answer.headers);
       const location = out.get('location');
-      if (location) { try { const to = new URL(location, `https://${host}`); if (to.hostname === host) out.set('location', `${to.pathname}${to.search}${to.hash}`); else if (browser && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed) && routes.sites.some(row => row.hosts.includes(to.hostname))) { const at = this.host.sitesTemplate?.(); const next = at ? siteUrlOf(at, to.hostname, browser) : null; if (next) out.set('location', `${next}${to.pathname}${to.search}${to.hash}`); } } catch { /* left as answered */ } }
+      if (location) { try {
+        const to = new URL(location, `https://${host}${path}${url.search}`);
+        const sameVendor = resource && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed)?.origin === vendor;
+        if (sameVendor) out.set('location', `${to.hostname === pageHost ? '' : `/_host/${to.hostname}`}${to.pathname}${to.search}${to.hash}`);
+        else if (to.hostname === host) out.set('location', `${to.pathname}${to.search}${to.hash}`);
+        else if (browser && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed) && routes.sites.some(row => row.hosts.includes(to.hostname))) { const at = this.host.sitesTemplate?.(); const next = at ? siteUrlOf(at, to.hostname, browser) : null; if (next) out.set('location', `${next}${to.pathname}${to.search}${to.hash}`); }
+      } catch { /* left as answered */ } }
       return new Response(request.method === 'HEAD' ? null : answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
     }
     // a person's browser is told in words (often the site is not there yet, or was not in a copy of the World as it was)
@@ -2212,11 +2235,26 @@ export class WorldDoors {
         homeHost = home?.host;
         if (home) listed = [{ id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, covers: [], drawn: true }];
       }
+      const entries = wholeLog(this.stateOf(vendor), this.controlRoot(vendor));
+      // One index per vendor, rather than scanning its history for every page on every board read.
+      const positions = new Map<string, number>();
+      let vendorPosition = 0;
+      for (let i = 0; i < entries.length; i++) {
+        const entry = entries[i]!;
+        if (entry.subject.type.startsWith('_')) continue;
+        vendorPosition = i + 1;
+        positions.set(`${entry.subject.type}:${entry.subject.id}`, vendorPosition);
+        if (entry.aliasOf) positions.set(`${entry.subject.type}:${entry.aliasOf}`, vendorPosition);
+      }
       for (const f of listed) {
         const covered = new Set(f.covers.map(c => `${c.type}:${c.id}`));
         const mine = changes.filter(x => x.service === vendor && (fallback || covered.has(`${x.action.subject.type}:${x.action.subject.id}`)));
+        // A page's revision includes already-cut writes and landed receipts, independent of the board's filter.
+        // Another page's writes never move it. A fallback home covers the vendor's public writes, as its change count does.
+        let position = fallback ? vendorPosition : 0;
+        if (!fallback) for (const key of covered) position = Math.max(position, positions.get(key) ?? 0);
         const add = (at: { site: string } | { screen: string } | null, browser?: string, unseen?: string): void => {
-          frames.push({ frame: { vendor, ...(browser ? { browser } : {}), id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(f.parent ? { parent: f.parent } : {}), ...(f.ours ? { ours: true } : {}), ...(unseen ? { unseen } : {}) }, mine });
+          frames.push({ frame: { vendor, ...(browser ? { browser } : {}), id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, position, at, ...(f.parent ? { parent: f.parent } : {}), ...(f.ours ? { ours: true } : {}), ...(unseen ? { unseen } : {}) }, mine });
         };
         let plain = false;
         const openedBrowsers: Array<{ browser: string; at: string }> = [];