@volter/world-runtime 3.0.33 → 3.0.35

package/dist/src/served-world.js

@@ -30,7 +30,7 @@ import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, h
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin } from '@volter/world-core/runtime';
+import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, TWIN_SITE_HEADER, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin } from '@volter/world-core/runtime';
 import { resolveTwinHost } from '@volter/world-core/host-routing';
 import { assertBrowserName, validateBrowserState, cookieMatchesHost } from '@volter/world-core';
 import { worldBrowser, worldBrowsers, putWorldBrowser, deleteWorldBrowser, materializeBrowserFiles, browserLoad, putBrowserLoad, browserLoadId } from "./browsers.js";
@@ -659,6 +659,9 @@ export class WorldDoors {
             }
             const answer = await this.site(request, site, browser, held);
             const out = new Headers(answer.headers);
+            // A document belongs to this live page session and browser state, not an earlier opening of its URL.
+            if (out.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase() === 'text/html')
+                out.set('cache-control', 'private, no-store');
             out.append('content-security-policy', `frame-ancestors 'self'${held.framer ? ` ${held.framer}` : ''}`);
             this.keepCookiesHere(answer, out);
             return new Response(answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
@@ -1095,8 +1098,8 @@ export class WorldDoors {
                     ...(packFacts()[vendor]?.hosts ?? []).flatMap(rule => typeof rule.host === 'string' && !rule.exclude ? [rule.host] : []),
                 ])] }));
     }
-    async browserRoutes(origin) {
-        const listed = await this.claimedHosts(origin);
+    async browserRoutes(origin, hosts) {
+        const listed = hosts ?? await this.claimedHosts(origin);
         const facts = packFacts();
         const map = Object.fromEntries(Object.keys(this.up().services).map(vendor => [vendor, vendor]));
         const claimed = {};
@@ -1153,7 +1156,7 @@ export class WorldDoors {
         }
         putBrowserLoad(this.up().dirs.data, loadId, { name, site, version: browser.version, cookies: cookies.filter(c => !protectedCookie(c.name)).map(c => ({ name: c.name, path: c.path })) });
         headers.append('set-cookie', `${marker}=${loadId}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned`);
-        const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.replace(location.href);`;
+        const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.reload();`;
         const hash = createHash('sha256').update(script).digest('base64');
         const framer = this.pageSession(request, url, site, name)?.framer;
         headers.set('content-security-policy', `default-src 'none'; script-src 'sha256-${hash}'; base-uri 'none'; frame-ancestors 'self'${framer ? ` ${framer}` : ''}`);
@@ -1196,17 +1199,32 @@ export class WorldDoors {
         if (browser && !grant)
             return Response.json({ error: "open this browser site from the World's board" }, { status: 401 });
         const url = new URL(request.url);
-        const routes = browser ? await this.browserRoutes(url.origin) : null;
+        const pageHost = host;
+        // This prefix belongs only to a hosted site's session, never to a bare twin or the content plane.
+        const resource = grant && this.siteShaped(url) && url.pathname.startsWith('/_host/');
+        const listed = await this.claimedHosts(url.origin);
+        const routes = browser || resource ? await this.browserRoutes(url.origin, listed) : null;
+        let path = url.pathname;
         let vendor;
-        if (routes)
-            vendor = resolveTwinHost(routes.rules, host, routes.map, url.pathname, routes.claimed)?.origin;
+        if (browser && routes)
+            vendor = resolveTwinHost(routes.rules, host, routes.map, resource ? '/' : path, routes.claimed)?.origin;
         else
-            for (const row of await this.claimedHosts(url.origin)) {
+            for (const row of listed) {
                 if (!this.host.twinFetch(row.vendor) || !row.hosts.includes(host))
                     continue;
                 vendor = row.vendor;
                 break;
             }
+        if (resource && routes) {
+            const target = /^\/_host\/([a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(\/.*)?$/.exec(path);
+            const targetHost = target?.[1];
+            const targetPath = target?.[2] ?? '/';
+            const targetVendor = targetHost ? resolveTwinHost(routes.rules, targetHost, routes.map, targetPath, routes.claimed)?.origin : undefined;
+            if (!vendor || targetVendor !== vendor)
+                return Response.json({ error: 'this site serves only its own vendor hosts' }, { status: 404 });
+            host = targetHost;
+            path = targetPath;
+        }
         const twin = vendor ? this.host.twinFetch(vendor) : undefined;
         if (vendor && twin) {
             const reads = request.method === 'GET' || request.method === 'HEAD';
@@ -1214,7 +1232,7 @@ export class WorldDoors {
             if (browser && grant?.scope === 'read' && !reads && !enforced)
                 return Response.json({ error: 'the read token opens only reads' }, { status: 403 });
             const headers = browser ? new Headers(request.headers) : new Headers();
-            for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER])
+            for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, TWIN_SITE_HEADER])
                 headers.delete(key);
             for (const name of ['accept', 'accept-language', 'if-none-match', 'range', 'user-agent']) {
                 const v = request.headers.get(name);
@@ -1226,9 +1244,12 @@ export class WorldDoors {
                 if (cookies.length)
                     headers.set('cookie', cookies.join('; '));
                 headers.set('x-volter-world-browser', browser);
+            }
+            if (grant && this.siteShaped(url)) {
                 const template = this.host.sitesTemplate?.();
                 if (template)
                     headers.set(TWIN_SITES_HEADER, template);
+                headers.set(TWIN_SITE_HEADER, pageHost);
                 headers.set('x-forwarded-host', url.host);
                 headers.set('x-forwarded-proto', url.protocol.slice(0, -1));
             }
@@ -1241,14 +1262,17 @@ export class WorldDoors {
                 headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
             }
             const body = reads ? undefined : await request.arrayBuffer();
-            const answer = await twin(new Request(`${url.origin}${url.pathname}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
+            const answer = await twin(new Request(`${url.origin}${path}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
             // a redirect the site answers names its own hostname: in the World it stays under the World's origin
             const out = new Headers(answer.headers);
             const location = out.get('location');
             if (location) {
                 try {
-                    const to = new URL(location, `https://${host}`);
-                    if (to.hostname === host)
+                    const to = new URL(location, `https://${host}${path}${url.search}`);
+                    const sameVendor = resource && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed)?.origin === vendor;
+                    if (sameVendor)
+                        out.set('location', `${to.hostname === pageHost ? '' : `/_host/${to.hostname}`}${to.pathname}${to.search}${to.hash}`);
+                    else if (to.hostname === host)
                         out.set('location', `${to.pathname}${to.search}${to.hash}`);
                     else if (browser && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed) && routes.sites.some(row => row.hosts.includes(to.hostname))) {
                         const at = this.host.sitesTemplate?.();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.33",
+  "version": "3.0.35",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -68,14 +68,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.33",
-    "@volter/world-console": "3.0.28"
+    "@volter/world-core": "3.0.35",
+    "@volter/world-console": "3.0.30"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.33",
+    "@volter/world-core": "3.0.35",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",
     "yaml": "2.9.0"

package/src/served-world.ts

@@ -30,7 +30,7 @@ import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, h
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
-import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, type TwinRequestJournalCursor, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, siteLabel, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink, type BoardFrame } from '@volter/world-core/runtime';
+import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, type TwinRequestJournalCursor, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, TWIN_SITE_HEADER, siteLabel, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink, type BoardFrame } from '@volter/world-core/runtime';
 import { resolveTwinHost, type HostPredicate } from '@volter/world-core/host-routing';
 import { assertBrowserName, validateBrowserState, cookieMatchesHost } from '@volter/world-core';
 import { worldBrowser, worldBrowsers, putWorldBrowser, deleteWorldBrowser, materializeBrowserFiles, browserLoad, putBrowserLoad, browserLoadId } from './browsers.ts';
@@ -645,6 +645,8 @@ export class WorldDoors {
       }
       const answer = await this.site(request, site, browser, held);
       const out = new Headers(answer.headers);
+      // A document belongs to this live page session and browser state, not an earlier opening of its URL.
+      if (out.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase() === 'text/html') out.set('cache-control', 'private, no-store');
       out.append('content-security-policy', `frame-ancestors 'self'${held.framer ? ` ${held.framer}` : ''}`);
       this.keepCookiesHere(answer, out);
       return new Response(answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
@@ -997,8 +999,8 @@ export class WorldDoors {
     ])] }));
   }
 
-  private async browserRoutes(origin: string): Promise<{ sites: Array<{ vendor: string; hosts: string[] }>; rules: Record<string, HostPredicate>; map: Record<string, string>; claimed: Record<string, Set<string>> }> {
-    const listed = await this.claimedHosts(origin);
+  private async browserRoutes(origin: string, hosts?: Array<{ vendor: string; hosts: string[] }>): Promise<{ sites: Array<{ vendor: string; hosts: string[] }>; rules: Record<string, HostPredicate>; map: Record<string, string>; claimed: Record<string, Set<string>> }> {
+    const listed = hosts ?? await this.claimedHosts(origin);
     const facts = packFacts();
     const map: Record<string, string> = Object.fromEntries(Object.keys(this.up().services).map(vendor => [vendor, vendor]));
     const claimed: Record<string, Set<string>> = {};
@@ -1043,7 +1045,7 @@ export class WorldDoors {
     }
     putBrowserLoad(this.up().dirs.data, loadId, { name, site, version: browser.version, cookies: cookies.filter(c => !protectedCookie(c.name)).map(c => ({ name: c.name, path: c.path })) });
     headers.append('set-cookie', `${marker}=${loadId}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned`);
-    const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.replace(location.href);`;
+    const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.reload();`;
     const hash = createHash('sha256').update(script).digest('base64');
     const framer = this.pageSession(request, url, site, name)?.framer;
     headers.set('content-security-policy', `default-src 'none'; script-src 'sha256-${hash}'; base-uri 'none'; frame-ancestors 'self'${framer ? ` ${framer}` : ''}`);
@@ -1078,28 +1080,45 @@ export class WorldDoors {
     if (!browser && request.method !== 'GET' && request.method !== 'HEAD') return Response.json({ error: 'a site in a World is read: GET and HEAD' }, { status: 405 });
     if (browser && !grant) return Response.json({ error: "open this browser site from the World's board" }, { status: 401 });
     const url = new URL(request.url);
-    const routes = browser ? await this.browserRoutes(url.origin) : null;
+    const pageHost = host;
+    // This prefix belongs only to a hosted site's session, never to a bare twin or the content plane.
+    const resource = grant && this.siteShaped(url) && url.pathname.startsWith('/_host/');
+    const listed = await this.claimedHosts(url.origin);
+    const routes = browser || resource ? await this.browserRoutes(url.origin, listed) : null;
+    let path = url.pathname;
     let vendor: string | undefined;
-    if (routes) vendor = resolveTwinHost(routes.rules, host, routes.map, url.pathname, routes.claimed)?.origin;
-    else for (const row of await this.claimedHosts(url.origin)) {
+    if (browser && routes) vendor = resolveTwinHost(routes.rules, host, routes.map, resource ? '/' : path, routes.claimed)?.origin;
+    else for (const row of listed) {
       if (!this.host.twinFetch(row.vendor) || !row.hosts.includes(host)) continue;
       vendor = row.vendor;
       break;
     }
+    if (resource && routes) {
+      const target = /^\/_host\/([a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(\/.*)?$/.exec(path);
+      const targetHost = target?.[1];
+      const targetPath = target?.[2] ?? '/';
+      const targetVendor = targetHost ? resolveTwinHost(routes.rules, targetHost, routes.map, targetPath, routes.claimed)?.origin : undefined;
+      if (!vendor || targetVendor !== vendor) return Response.json({ error: 'this site serves only its own vendor hosts' }, { status: 404 });
+      host = targetHost!;
+      path = targetPath;
+    }
     const twin = vendor ? this.host.twinFetch(vendor) : undefined;
     if (vendor && twin) {
       const reads = request.method === 'GET' || request.method === 'HEAD';
       const enforced = browser && grant?.scope === 'read' && await this.enforcesRead(vendor, twin, url.origin);
       if (browser && grant?.scope === 'read' && !reads && !enforced) return Response.json({ error: 'the read token opens only reads' }, { status: 403 });
       const headers = browser ? new Headers(request.headers) : new Headers();
-      for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER]) headers.delete(key);
+      for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, TWIN_SITE_HEADER]) headers.delete(key);
       for (const name of ['accept', 'accept-language', 'if-none-match', 'range', 'user-agent']) { const v = request.headers.get(name); if (v !== null) headers.set(name, v); }
       if (browser) {
         const cookies = (request.headers.get('cookie') ?? '').split(/;\s*/).filter(c => !/^(?:__Host-)?volter_(?:world|pages|browser)=/.test(c));
         if (cookies.length) headers.set('cookie', cookies.join('; '));
         headers.set('x-volter-world-browser', browser);
+      }
+      if (grant && this.siteShaped(url)) {
         const template = this.host.sitesTemplate?.();
         if (template) headers.set(TWIN_SITES_HEADER, template);
+        headers.set(TWIN_SITE_HEADER, pageHost);
         headers.set('x-forwarded-host', url.host);
         headers.set('x-forwarded-proto', url.protocol.slice(0, -1));
       }
@@ -1110,11 +1129,17 @@ export class WorldDoors {
         headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
       }
       const body = reads ? undefined : await request.arrayBuffer();
-      const answer = await twin(new Request(`${url.origin}${url.pathname}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
+      const answer = await twin(new Request(`${url.origin}${path}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
       // a redirect the site answers names its own hostname: in the World it stays under the World's origin
       const out = new Headers(answer.headers);
       const location = out.get('location');
-      if (location) { try { const to = new URL(location, `https://${host}`); if (to.hostname === host) out.set('location', `${to.pathname}${to.search}${to.hash}`); else if (browser && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed) && routes.sites.some(row => row.hosts.includes(to.hostname))) { const at = this.host.sitesTemplate?.(); const next = at ? siteUrlOf(at, to.hostname, browser) : null; if (next) out.set('location', `${next}${to.pathname}${to.search}${to.hash}`); } } catch { /* left as answered */ } }
+      if (location) { try {
+        const to = new URL(location, `https://${host}${path}${url.search}`);
+        const sameVendor = resource && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed)?.origin === vendor;
+        if (sameVendor) out.set('location', `${to.hostname === pageHost ? '' : `/_host/${to.hostname}`}${to.pathname}${to.search}${to.hash}`);
+        else if (to.hostname === host) out.set('location', `${to.pathname}${to.search}${to.hash}`);
+        else if (browser && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed) && routes.sites.some(row => row.hosts.includes(to.hostname))) { const at = this.host.sitesTemplate?.(); const next = at ? siteUrlOf(at, to.hostname, browser) : null; if (next) out.set('location', `${next}${to.pathname}${to.search}${to.hash}`); }
+      } catch { /* left as answered */ } }
       return new Response(request.method === 'HEAD' ? null : answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
     }
     // a person's browser is told in words (often the site is not there yet, or was not in a copy of the World as it was)