@volter/world-runtime 3.0.38 → 3.0.40

package/dist/known-external-services.json

@@ -19,11 +19,11 @@
     },
     "@daily-co/daily-js": {
       "disposition": "demanded",
-      "reason": "vendor daily (daily.co), its call client (the call machine from c.daily.co, signalling on gs.daily.co, WebRTC media): the daily pack serves Daily's REST API and a room's page, not the call, so the call client is a coverage gap (§9 of twin-daily, 2026-09-28)"
+      "reason": "vendor daily (daily.co), its call client (the call machine from c.daily.co, signalling on gs.daily.co, WebRTC media): the Daily REST spec does not describe call-client media or signalling, so this SDK remains an uncovered wire"
     },
     "@daily-co/daily-react": {
       "disposition": "demanded",
-      "reason": "vendor daily (daily.co), React hooks over its call client (@daily-co/daily-js): the daily pack serves Daily's REST API and a room's page, not the call, so the call client is a coverage gap (§9 of twin-daily, 2026-09-28)"
+      "reason": "vendor daily (daily.co), React hooks over its call client (@daily-co/daily-js): the Daily REST spec does not describe call-client media or signalling, so this SDK remains an uncovered wire"
     },
     "@azure/communication-email": {
       "disposition": "demanded",
@@ -193,10 +193,6 @@
       "disposition": "demanded",
       "reason": "vendor matrix, pack demanded by census 2026-08-31 (×1)"
     },
-    "node-telegram-bot-api": {
-      "disposition": "demanded",
-      "reason": "vendor telegram, pack demanded by census 2026-08-31 (×2); already curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES"
-    },
     "npm-registry@npm.jsr.io": {
       "disposition": "acknowledged",
       "reason": "acknowledged: registry destination — the npm-registry twin deliberately owns npmjs + GitHub only (census 2026-08-31, ×2)"
@@ -217,10 +213,6 @@
       "disposition": "demanded",
       "reason": "vendor shopify, well-known service client with no twin pack (curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES)"
     },
-    "telegraf": {
-      "disposition": "demanded",
-      "reason": "vendor telegram, pack demanded by census 2026-08-31 (×1); already curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES"
-    },
     "twenty-client-sdk": {
       "disposition": "demanded",
       "reason": "vendor twenty, pack demanded by census 2026-08-31 (×1)"
@@ -925,6 +917,7 @@
     }
   },
   "notExternal": {
+    "@chat-adapter/state-memory": "Chat SDK local in-memory state adapter, no external connection: @chat-adapter/state-memory 4.39.0 dist/index.js stores subscriptions in Set and locks, cache and queues in Map; https://chat-sdk.dev/adapters/official/memory",
     "@agentclientprotocol/sdk": "Agent Client Protocol library, not a vendor",
     "@ai-sdk/devtools": "local dev-tools UI for the AI SDK",
     "@ai-sdk/langchain": "LangChain interop adapter, not a service",

package/dist/src/actions-runner-cli.js

@@ -7,9 +7,9 @@ import { hasFlag, optionValue } from '@volter/world-core/args';
 import { mkdirSync } from 'node:fs';
 import { runQueued } from "./actions-runner.js";
 const args = process.argv.slice(2);
-const github = optionValue(args, '--github') ?? process.env.GITHUB_API_URL;
-const token = optionValue(args, '--token') ?? process.env.GITHUB_TOKEN;
-const work = optionValue(args, '--work') ?? '.volter/actions-runner';
+const github = optionValue(args, '--github') || process.env.GITHUB_API_URL;
+const token = optionValue(args, '--token') || process.env.GITHUB_TOKEN;
+const work = optionValue(args, '--work', '.volter/actions-runner');
 if (!github || !token) {
     process.stderr.write('usage: volter-world-actions-runner --github <url> --token <token> [--work <dir>] [--once]\n');
     process.exit(2);

package/dist/src/actions-runner.js

@@ -7,6 +7,7 @@
 //
 // What it does not do (named, so a workflow that needs them fails plainly): matrices beyond their first combination,
 // services and containers, composite and JavaScript actions from the marketplace, reusable workflows, concurrency groups.
+import { errorMessage } from "./error-message.js";
 import { spawn } from 'node:child_process';
 import { appendFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -256,7 +257,7 @@ export async function runOnce(opts, repo, run) {
         }
     }
     catch (error) {
-        log(`run ${repo}#${id}: ${error.message}`);
+        log(`run ${repo}#${id}: ${errorMessage(error)}`);
         conclusion = 'failure';
     }
     finally {

package/dist/src/app-url.js

@@ -19,6 +19,7 @@
 // once, at the caller's request, and stores what it saw. The record lives in the instance dir, so
 // a re-`up` (which wipes the dir) or `down --purge` clears it: a recorded URL never outlives the
 // instance it described.
+import { errorMessage } from "./error-message.js";
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { withFileLock } from '@volter/world-core/runtime';
 import { join } from 'node:path';
@@ -208,7 +209,7 @@ export function addAppHosts(name, hosts, options = {}) {
 function listeningTcpPorts(pid) {
     const result = spawnSync('lsof', ['-a', '-p', String(pid), '-iTCP', '-sTCP:LISTEN', '-P', '-n', '-Fn'], { windowsHide: true, encoding: 'utf8' });
     if (result.error) {
-        throw new Error(`volter-world app-url: \`lsof\` is unavailable (${result.error.message}) — pass the port, or --set the URL directly`);
+        throw new Error(`volter-world app-url: \`lsof\` is unavailable (${errorMessage(result.error)}) — pass the port, or --set the URL directly`);
     }
     const ports = new Set();
     for (const line of (result.stdout ?? '').split('\n')) {

package/dist/src/backings.d.ts

@@ -3,6 +3,7 @@ export type ServerBackingFacts = {
     serverBacking: {
         command: string;
     };
+    maxRequestBodySize?: number;
     adoption: {
         sdks: string[];
         pypi: string[];
@@ -16,8 +17,11 @@ export type ServerBackingFacts = {
     };
 };
 /**
+ * MongoDB is declared infrastructure, not an API service in this table: its native server uses
+ * mongodb-backing.ts through the same managed lifecycle as Postgres (pglite-backing.ts).
+ *
  * A vendor whose open-source server a World runs as its service instead of a twin (architecture, "A vendor's own
- * server as a backing"): the media plane no pack can hold as data. The service is the vendor's own binary on an 'auto'
+ * server as a backing"): the wire or media plane no pack can hold as data. The service is the vendor's own binary on an 'auto'
  * port, loopback only; the application's key and secret are the ones the server is started with, so its SDK signs
  * what the server verifies. What the server does not do on its own (LiveKit's egress, a separate service) the
  * service's note names.
@@ -27,3 +31,8 @@ export declare const VENDOR_SERVER_BACKINGS: Record<string, {
     env: Record<string, string>;
     facts: ServerBackingFacts;
 }>;
+/** Declare a backing's application-owned env stems as service bindings; omitted stems use the vendor's defaults. */
+export declare function serverBackingService(vendor: string, declaration?: {
+    envStems?: readonly string[];
+    service?: WorldServiceConfig;
+}): WorldServiceConfig;

package/dist/src/backings.js

@@ -1,6 +1,10 @@
+import { fileURLToPath } from 'node:url';
 /**
+ * MongoDB is declared infrastructure, not an API service in this table: its native server uses
+ * mongodb-backing.ts through the same managed lifecycle as Postgres (pglite-backing.ts).
+ *
  * A vendor whose open-source server a World runs as its service instead of a twin (architecture, "A vendor's own
- * server as a backing"): the media plane no pack can hold as data. The service is the vendor's own binary on an 'auto'
+ * server as a backing"): the wire or media plane no pack can hold as data. The service is the vendor's own binary on an 'auto'
  * port, loopback only; the application's key and secret are the ones the server is started with, so its SDK signs
  * what the server verifies. What the server does not do on its own (LiveKit's egress, a separate service) the
  * service's note names.
@@ -10,6 +14,31 @@ export const VENDOR_SERVER_BACKINGS = (() => {
     // livekit-server wants a secret of at least 32 characters
     const secret = 'twin-livekit-secret-for-the-worlds-own-server';
     return {
+        temporal: {
+            service: {
+                '//': 'Temporal CLI development server on PATH, loopback only, SQLite in World state. No cluster, Cloud, TLS, World clock or branching; reset clears workflow history. See cookbook/temporal-backing.',
+                id: 'temporal', type: 'process', command: 'node',
+                args: [fileURLToPath(new URL('./temporal-backing.mjs', import.meta.url))],
+                port: 'auto', portArg: false, controlPlane: true, branchState: 'unsupported',
+                // Existing service readiness budgets, no new timeout. Native dev-server checkout took 0.84 s
+                // on 6e0123e + backing error handling changes with Node 23.9.0; SDK consumer only in this World, host not isolated.
+                // Reproduce: cookbook/temporal-backing/README.md, timed checkout and reset commands.
+                ready: { command: 'node', args: [fileURLToPath(new URL('./temporal-backing.mjs', import.meta.url)), '--health'] },
+                injectEnvTemplates: {
+                    TEMPORAL_ADDRESS: '${host}:${port}', TEMPORAL_NAMESPACE: 'default', TEMPORAL_TLS: 'false', TEMPORAL_API_KEY: '',
+                },
+            },
+            env: { TEMPORAL_NAMESPACE: 'default', TEMPORAL_TLS: 'false', TEMPORAL_API_KEY: '' },
+            facts: {
+                serverBacking: { command: 'temporal' },
+                adoption: { sdks: ['@temporalio/client', '@temporalio/worker', '@temporalio/workflow', 'nestjs-temporal-core'],
+                    pypi: ['temporalio'], envStems: ['TEMPORAL'] },
+                hostsNone: 'The World runs the vendor development server at its declared loopback gRPC endpoint.',
+                endpointEnv: { name: 'TEMPORAL_ADDRESS', templates: {
+                        TEMPORAL_ADDRESS: '${host}:${port}', TEMPORAL_NAMESPACE: 'default', TEMPORAL_TLS: 'false', TEMPORAL_API_KEY: '',
+                    }, note: 'The local development server creates default; no TLS or Cloud API key.' },
+            },
+        },
         livekit: {
             service: {
                 '//': 'LiveKit\'s own server (livekit-server, Apache-2.0; `brew install livekit` or LiveKit\'s install script puts it '
@@ -18,11 +47,11 @@ export const VENDOR_SERVER_BACKINGS = (() => {
                     + `"webhook: {api_key: ${key}, urls: [<the app's webhook URL>]}" to args.`,
                 id: 'livekit',
                 type: 'twin',
-                command: 'livekit-server',
-                // media on the loopback address over UDP from LiveKit's default range; ICE over TCP off (its fixed 7881 would
-                // collide with a second server)
-                args: ['--bind', '127.0.0.1', '--node-ip', '127.0.0.1', '--keys', `${key}: ${secret}`, '--rtc.tcp_port', '0'],
+                command: 'node',
+                // The wrapper supplies a local TURN relay using UDP at the allocated HTTP port.
+                args: [fileURLToPath(new URL('./livekit-backing.mjs', import.meta.url)), '--keys', `${key}: ${secret}`],
                 port: 'auto',
+                portArg: false,
                 rootArg: false,
                 controlPlane: true,
                 ready: { httpUrl: '${url}/' },
@@ -34,12 +63,42 @@ export const VENDOR_SERVER_BACKINGS = (() => {
             },
             env: { LIVEKIT_API_KEY: key, LIVEKIT_API_SECRET: secret },
             facts: {
-                // Current consumers: RH2's package.json and server SDK imports; LiveKit's server is the backing, not a pack.
+                // LiveKit's client and server SDKs use its own server as the backing.
                 serverBacking: { command: 'livekit-server' },
-                adoption: { sdks: ['livekit-client', 'livekit-server-sdk', '@livekit/rtc-node'], pypi: ['livekit', 'livekit-agents', 'livekit-api'], envStems: ['LIVEKIT'] },
+                adoption: { sdks: ['livekit-client', 'livekit-server-sdk', '@livekit/rtc-node', '@livekit/react-native',
+                        '@livekit/react-native-expo-plugin', '@livekit/react-native-webrtc'],
+                    pypi: ['livekit', 'livekit-agents', 'livekit-api'], envStems: ['LIVEKIT'] },
                 hostsNone: 'The World runs the vendor server on its declared endpoint; SDKs read LIVEKIT_URL.',
                 endpointEnv: { name: 'LIVEKIT_URL', templates: { LIVEKIT_URL: 'ws://${host}:${port}', LIVEKIT_API_KEY: key, LIVEKIT_API_SECRET: secret }, note: 'Credentials and URL are the same ones the World starts its LiveKit server with.' },
             },
         },
     };
 })();
+/** Declare a backing's application-owned env stems as service bindings; omitted stems use the vendor's defaults. */
+export function serverBackingService(vendor, declaration = {}) {
+    const backing = VENDOR_SERVER_BACKINGS[vendor];
+    // Native infrastructure supplies its already-declared lifecycle rather than an API service from the table.
+    const service = declaration.service ?? backing?.service;
+    if (!service)
+        throw new Error(`No server backing declared for ${vendor}`);
+    const base = backing?.facts.adoption.envStems[0] ?? vendor.toUpperCase();
+    const stems = declaration.envStems ?? backing?.facts.adoption.envStems ?? [base];
+    if (!stems.length || stems.some((stem) => !/^[A-Z][A-Z0-9_]*$/.test(stem)))
+        throw new Error('Server backing env stems must be nonempty uppercase env names');
+    const unique = [...new Set(stems)];
+    const bindingName = (name, stem) => {
+        if (!name.startsWith(`${base}_`))
+            throw new Error(`Server backing ${vendor} binding ${name} has no vendor stem`);
+        return `${stem}${name.slice(base.length)}`;
+    };
+    const injectEnvTemplates = Object.fromEntries(unique.flatMap((stem) => Object.entries(service.injectEnvTemplates ?? {}).map(([name, value]) => [bindingName(name, stem), value])));
+    const external = service.external === undefined ? undefined : {
+        ...service.external,
+        ...(service.external.discover === undefined ? {} : { discover: unique.flatMap((stem) => service.external.discover.map((mapping) => {
+                const as = bindingName(mapping.as, stem);
+                // The producer keeps its own keys; only the application binding gets the declared stem.
+                return { ...mapping, as };
+            })) }),
+    };
+    return { ...service, ...(external ? { external } : { injectEnvTemplates }) };
+}

package/dist/src/branch.js

@@ -3,16 +3,18 @@
 // `branch <world> <name>` boots a new world from the base's config and forks every twin's mirror
 // into it (core's `forkTwin`: a POINTER to the base at its current position — the base's whole
 // history, its own entries included, is the branch's parent; nothing is copied). A managed database (containerless
-// Postgres) keeps no history, so it is the one thing copied: the stopped base's data, as of now. Two branches of one
+// Postgres and MongoDB) keeps no history, so it is the one thing copied: the stopped base's data, as of now. Two branches of one
 // base running at once share the database port its definition names; run one at a time (the SDK does). `checkout <name>`
 // brings a stopped world back up from its own instance record, state intact.
+import { runInfrastructure } from "./infra.js";
 import { cpSync, existsSync, readdirSync, readFileSync, rmSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { captureHistory, historyAtInstant, forkTwin, stateGeneration, withHistoryLocks, worldPaths, worldStateRoot } from '@volter/world-core/runtime';
 import { inheritWorldBrowsers, materializeBrowserFiles } from "./browsers.js";
-import { downWorld, saveWorldInstance, statusWorld, upWorld } from "./runtime.js";
-import { parseInfraDefinition, pgliteDown, pgliteUp } from "./pglite-backing.js";
+import { externalServiceEnv, downWorld, recordedWorldNetwork, saveWorldInstance, readWorldBootRecord, upWorld } from "./runtime.js";
+import { loadWorldConfig } from "./configs.js";
+import { containerlessDataDirectory, parseInfraDefinition, pgliteDown, pgliteUp } from "./pglite-backing.js";
 import { redisTwinCli, redisTwinDown, redisTwinUp } from "./redis-backing.js";
 function stateServices(controlRoot) {
     const stateRoot = worldStateRoot(controlRoot);
@@ -23,7 +25,12 @@ function stateServices(controlRoot) {
 /** A new world over the base's mirrors. */
 export async function branchWorld(base, name, options = {}) {
     const root = resolve(options.root ?? process.cwd());
-    const from = statusWorld(base, root);
+    const from = readWorldBootRecord(base, root);
+    const { config } = loadWorldConfig(existsSync(from.configPath) ? from.configPath : from.config, root);
+    const unsupported = [...new Set([...config.services, ...Object.values(from.services)]
+            .filter((service) => service.branchState === 'unsupported').map((service) => service.id))];
+    if (unsupported.length)
+        throw new Error(`volter-world branch: services do not support carrying state to a branch: ${unsupported.join(', ')}; retain the original World or reset it explicitly`);
     if (name === base)
         throw new Error(`volter-world branch: the branch needs a name other than the base's ("${base}")`);
     const envFile = options.envFile ?? join(dirname(from.envFile), `${name}.world.env`);
@@ -48,42 +55,9 @@ export async function branchWorld(base, name, options = {}) {
         throw new Error(`volter-world branch: ${base} has a managed database, which keeps no history to branch from at an instant or position; branch from its current state`);
     }
     refuseLiveDatabases(from, databases);
-    // a branch that fails to boot (a twin whose mounted version breaks the config's pin) leaves no half-made branch behind:
-    // its record without a fork would check out later as an empty World
-    const existed = (() => { try {
-        statusWorld(name, root);
-        return true;
-    }
-    catch {
-        return false;
-    } })();
-    const began = Date.now();
-    let instance;
-    try {
-        instance = await upWorld(existsSync(from.configPath) ? from.configPath : from.config, { name, root, mode: from.mode, envFile, forceEnvOutput: options.forceEnvOutput });
-    }
-    catch (error) {
-        // only a record made during this call is ours to remove, and it is removed by its own createdAt, as the fork's
-        // cleanup below does: a concurrent `branch` of the same name that recorded first keeps its World
-        let recorded = null;
-        if (!existed) {
-            try {
-                const made = statusWorld(name, root).createdAt;
-                if (Date.parse(made) >= began)
-                    recorded = made;
-            }
-            catch { /* the boot recorded nothing */ }
-        }
-        if (recorded) {
-            try {
-                await downWorld(name, root, { purge: true, expectedCreatedAt: recorded });
-            }
-            catch (cleanup) {
-                throw new Error(`${error instanceof Error ? error.message : String(error)} (and the half-made branch ${name} could not be removed: ${cleanup instanceof Error ? cleanup.message : String(cleanup)})`);
-            }
-        }
-        throw error;
-    }
+    // up owns rollback. If boot throws, retain its diagnostics: a name/time lookup cannot prove
+    // that a partial record belongs to this invocation, especially under a frozen World clock.
+    const instance = await upWorld(existsSync(from.configPath) ? from.configPath : from.config, { name, root, mode: from.mode, owner: from.lifecycle?.owner ?? from.resources?.owner, networkCeiling: recordedWorldNetwork(from), envFile, forceEnvOutput: options.forceEnvOutput });
     const forked = {};
     try {
         // the branch's origin is its base's, or none: never one a stopped World of the same name left
@@ -105,23 +79,34 @@ export async function branchWorld(base, name, options = {}) {
         await branchManagedDatabases(from, instance, databases);
     }
     catch (error) {
-        await downWorld(name, root, { purge: true, expectedCreatedAt: instance.createdAt });
+        try {
+            await downWorld(name, root, { purge: true, expectedInstance: instance.instance });
+        }
+        catch (cleanup) {
+            throw new AggregateError([error, cleanup], 'Copied database startup and branch cleanup failed');
+        }
         throw error;
     }
     return { instance, forked };
 }
-/** The base's containerless managed databases: each PGlite `pglite-<kind>-data` and the MongoDB twin's
- *  `twin-mongodb-data` (pglite-backing.ts), and the redis twin's `redis-twin` tree (redis-backing.ts). A stopped World's
+/** The base's containerless managed databases: each PGlite `pglite-<kind>-data`, MongoDB's
+ *  `mongod-mongodb-data` (pglite-backing.ts), the redis twin's `redis-twin` tree (redis-backing.ts), and native PostgreSQL. A stopped World's
  *  hosts leave no pid file; a docker-backed World keeps its data under the container's volume, which a branch does not
  *  carry. */
 function managedDatabases(from) {
     const data = from.dirs.data;
     if (!existsSync(data))
         return [];
-    return readdirSync(data).filter((n) => /^pglite-[a-z0-9_-]+-data$/.test(n) || n === 'twin-mongodb-data' || n === 'redis-twin');
+    const known = (name) => /^pglite-[a-z0-9_-]+-data$/.test(name) || name === 'mongod-mongodb-data' || name === 'native-postgres-data';
+    if (readdirSync(data).some(name => name.endsWith('-data') && !known(name) && !from.services[name])) {
+        throw new Error('volter-world branch: unrecognised storage; retain the original World');
+    }
+    return readdirSync(data).filter((n) => /^pglite-[a-z0-9_-]+-data$/.test(n) || n === 'mongod-mongodb-data' || n === 'redis-twin' || n === 'native-postgres-data');
 }
 /** The pid files of the hosts serving one managed database directory. */
 function hostPidFiles(data, db) {
+    if (db === 'native-postgres-data')
+        return [join(data, 'native-postgres.owner.json')];
     if (db === 'redis-twin')
         return readdirSync(data).filter((n) => /^redis-twin-\d+\.pid$/.test(n)).map((n) => join(data, n));
     return [join(data, `${db.slice(0, -'-data'.length)}.pid`)];
@@ -131,7 +116,8 @@ function hostPidFiles(data, db) {
 function refuseLiveDatabases(from, dbs) {
     for (const db of dbs) {
         for (const pidFile of hostPidFiles(from.dirs.data, db)) {
-            const pid = existsSync(pidFile) ? Number(readFileSync(pidFile, 'utf8').trim()) : NaN;
+            const recorded = existsSync(pidFile) ? readFileSync(pidFile, 'utf8').trim() : '';
+            const pid = db === 'native-postgres-data' && recorded ? JSON.parse(recorded).pid : Number(recorded);
             let live = false;
             if (Number.isInteger(pid) && pid > 0) {
                 try {
@@ -147,18 +133,65 @@ function refuseLiveDatabases(from, dbs) {
         }
     }
 }
+/** Compare actual cold-storage formats, not the edited config's requested backing. */
+function requireMatchingBackings(source, child) {
+    const kinds = {
+        postgres: ['native-postgres-data', 'pglite-postgres-data'],
+        mongodb: ['mongod-mongodb-data'],
+    };
+    for (const [kind, formats] of Object.entries(kinds)) {
+        const from = source.filter(directory => formats.includes(directory));
+        if (!from.length)
+            continue;
+        const to = child.filter(directory => formats.includes(directory));
+        if (from.length !== 1 || to.length !== 1 || from[0] !== to[0]) {
+            throw new Error(`volter-world branch: ${kind} source backing ${from.join(', ')} differs from child backing ${to.join(', ') || 'none'}; refusing to copy database bytes`);
+        }
+    }
+    for (const directory of source) {
+        if (!child.includes(directory))
+            throw new Error(`volter-world branch: source backing ${directory} differs from child backing ${child.join(', ') || 'none'}; refusing to copy database bytes`);
+    }
+}
 /** The branch's managed databases as the base holds them: the branch's own, just booted empty by `up`, are stopped,
  *  replaced by a copy of the base's data, and started again, so a branch of a migrated and seeded World serves that
  *  data, as its twins serve the base's history. */
 async function branchManagedDatabases(from, instance, dbs) {
     if (!dbs.length)
         return;
+    requireMatchingBackings(dbs, managedDatabases(instance));
     const definition = join(dirname(instance.configPath), 'world.infrastructure.yml');
     if (!existsSync(definition))
-        return;
+        throw new Error('volter-world branch: source has managed database bytes but child has no infrastructure definition; refusing to copy');
     const services = parseInfraDefinition(readFileSync(definition, 'utf8'));
     const redis = services.filter((s) => s.kind === 'redis');
-    const hosted = services.filter((s) => s.kind !== 'redis');
+    const hosted = services.filter((service) => {
+        const directory = containerlessDataDirectory(service.kind);
+        if (directory === undefined || !dbs.includes(directory))
+            return false;
+        if (!existsSync(join(instance.dirs.data, directory))) {
+            throw new Error(`volter-world branch: ${service.kind}'s copied state belongs to a different backing than the branch booted; refusing to replace its database`);
+        }
+        return true;
+    });
+    const config = loadWorldConfig(instance.configPath, instance.root).config;
+    const infrastructure = config.services.find((service) => service.type === 'external' && (service.external?.up[0] === 'volter-world-infra' || service.id === 'infrastructure'));
+    if (!infrastructure)
+        throw new Error(`volter-world branch: ${instance.name}'s managed databases have no declared infrastructure service`);
+    const launch = { env: externalServiceEnv(infrastructure, instance.dirs, instance.env, config.stripEnv) };
+    if (dbs.includes('native-postgres-data')) {
+        const io = { out: (text) => process.stdout.write(text), err: (text) => process.stderr.write(text) };
+        if (await runInfrastructure('down', launch.env, io) !== 0)
+            throw new Error('managed native database branch could not stop its new backing');
+        for (const db of dbs) {
+            const to = join(instance.dirs.data, db);
+            rmSync(to, { recursive: true, force: true });
+            cpSync(join(from.dirs.data, db), to, { recursive: true });
+        }
+        if (await runInfrastructure('up', launch.env, io) !== 0)
+            throw new Error('managed native database branch could not resume its copied backing');
+        return;
+    }
     const redisCli = dbs.includes('redis-twin') && redis.length ? redisTwinCli([dirname(fileURLToPath(import.meta.url)), dirname(instance.configPath)]) : undefined;
     await pgliteDown(hosted, instance.dirs.data);
     if (redisCli)
@@ -170,14 +203,14 @@ async function branchManagedDatabases(from, instance, dbs) {
         rmSync(to, { recursive: true, force: true });
         cpSync(join(from.dirs.data, db), to, { recursive: true });
     }
-    if (dbs.some((db) => db !== 'redis-twin'))
-        await pgliteUp(hosted, instance.dirs.data);
+    if (hosted.length)
+        await pgliteUp(hosted, instance.dirs.data, launch);
     if (redisCli)
-        await redisTwinUp(redis, instance.dirs.data, redisCli);
+        await redisTwinUp(redis, instance.dirs.data, redisCli, launch);
 }
 /** A stopped world back up, from its own record. */
 export async function checkoutWorld(name, options = {}) {
     const root = resolve(options.root ?? process.cwd());
-    const was = statusWorld(name, root);
-    return upWorld(existsSync(was.configPath) ? was.configPath : was.config, { name, root, mode: was.mode, envFile: was.envFile, keepState: true });
+    const was = readWorldBootRecord(name, root);
+    return upWorld(existsSync(was.configPath) ? was.configPath : was.config, { name, root, mode: was.mode, owner: was.lifecycle?.owner ?? was.resources?.owner, envFile: was.envFile, keepState: true });
 }

package/dist/src/browser-routes.cjs

@@ -0,0 +1,59 @@
+// Bind an existing browser page to a World-attached HTTP transport. A namespace gives the World its own page and cookie
+// paths on that page's origin; vendor URLs remain the wire targets. Published external JavaScript is never rewritten.
+exports.installWorldBrowserRoutes = async function (router, transport, { namespace, origin, onExchange, context = false } = {}) {
+  if (namespace && (!/^\/[A-Za-z0-9._~/-]+$/.test(namespace) || !origin)) throw new Error('A World page needs a path namespace and its browser origin');
+  const base = namespace?.replace(/\/$/, '');
+  const forward = async route => {
+    try {
+      const request = route.request();
+      if (context && namespace) {
+        let documentUrl;
+        try { documentUrl = request.frame().page().url(); } catch {}
+        const ownPath = `${origin}${base}/`;
+        if (!request.url().startsWith(ownPath) && !documentUrl?.startsWith(ownPath)) return route.fallback();
+      }
+      let url = new URL(request.url()), method = request.method(), response;
+      let prefix;
+      if (namespace && url.origin === origin && url.pathname.startsWith(base + '/')) {
+        const rest = url.pathname.slice(base.length + 1), at = rest.indexOf('/');
+        const host = at < 0 ? rest : rest.slice(0, at);
+        prefix = `${base}/${host}`;
+        url = new URL(`https://${host}${at < 0 ? '/' : rest.slice(at)}${url.search}`);
+      }
+      if (namespace && !prefix) prefix = `${base}/${url.host}`;
+      // Complete wire headers stay opaque: the abbreviated request header view omits authentication headers.
+      const headers = await request.allHeaders();
+      if (prefix) headers['x-forwarded-prefix'] = prefix;
+      const visited = new Set();
+      for (;;) {
+        if (visited.has(url.href)) throw new Error('World browser redirect loop');
+        visited.add(url.href);
+        response = await route.fetch({ url: transport + '/?url=' + encodeURIComponent(url.href), method, headers, maxRedirects: 0, timeout: 1000 });
+        const status = response.status(), location = response.headers().location;
+        onExchange?.({ method, path: url.pathname, status });
+        if (![301, 302, 303, 307, 308].includes(status) || !location) break;
+        const next = new URL(location, url);
+        // Chrome owns the application's HTTP loopback callback.
+        if (next.protocol !== 'https:') break;
+        if (next.origin !== url.origin) {
+          for (const name of Object.keys(headers)) if (/^(authorization|cookie|proxy-authorization|x-volter-twin-|x-forwarded-prefix)/i.test(name)) delete headers[name];
+        }
+        if (status === 303 || ([301, 302].includes(status) && method === 'POST')) method = 'GET';
+        url = next;
+      }
+      if (namespace && /text\/html/i.test(response.headers()['content-type'] ?? '')) {
+        // Input values are protocol data (OAuth redirect_uri, state and code). Keep them byte-for-byte. Links and inline
+        // scripts name browser destinations, mapped to this World's page; external script bytes remain as published.
+        const body = (await response.text()).split(/(<input\b[^>]*>)/gi).map(part => /^<input\b/i.test(part) ? part : part.replace(/https:\/\/([A-Za-z0-9.-]+(?::\d+)?)(?=[/\s"'&<]|$)/g, (_, host) => `${origin}${base}/${host}`)).join('');
+        const outHeaders = { ...response.headers() };
+        delete outHeaders['content-length'];
+        await route.fulfill({ response, headers: outHeaders, body });
+      } else await route.fulfill({ response });
+    } catch (error) {
+      onExchange?.({ error: error.message });
+      await route.abort('blockedbyclient').catch(() => {});
+    }
+  };
+  await router.route('https://**/*', forward);
+  return { message: 'World routing installed on auth tab', namespace: base ?? null, dispose: () => router.unroute('https://**/*', forward) };
+};

package/dist/src/ca-trust.js

@@ -1,3 +1,4 @@
+import { errorMessage } from "./error-message.js";
 import { createHash, randomUUID, X509Certificate } from 'node:crypto';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
 import { dirname, join } from 'node:path';
@@ -22,7 +23,7 @@ export function sessionTrustEnv(caCertPath, inputs = process.env) {
             return pem;
         }
         catch (error) {
-            throw new CaTrustError(`Cannot read configured CA file ${path}: ${String(error)}`);
+            throw new CaTrustError(`Cannot read configured CA file ${path}: ${errorMessage(error)}`);
         }
     };
     const session = read(caCertPath);
@@ -47,9 +48,9 @@ export function sessionTrustEnv(caCertPath, inputs = process.env) {
                 rmSync(temporary, { force: true });
             }
             catch (cleanupError) {
-                throw new CaTrustError(`Cannot materialize session trust bundle: ${String(error)}; cleanup: ${String(cleanupError)}`);
+                throw new CaTrustError(`Cannot materialize session trust bundle: ${errorMessage(error)}; cleanup: ${errorMessage(cleanupError)}`);
             }
-            throw new CaTrustError(`Cannot materialize session trust bundle: ${String(error)}`);
+            throw new CaTrustError(`Cannot materialize session trust bundle: ${errorMessage(error)}`);
         }
         return path;
     };

package/dist/src/changeset.js

@@ -1,3 +1,4 @@
+import { errorMessage } from "./error-message.js";
 import { worldChangesetRules } from "./configs.js";
 import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, getActiveWorldStore, withHistoryLocks, worldPaths } from '@volter/world-core/runtime';
 // `volter-world mark` / `diff` / `changeset` — the WORLD-side verbs over the changeset
@@ -41,7 +42,7 @@ function requireWorld(name, root) {
         return statusWorld(name, root);
     }
     catch (error) {
-        if (!/World instance not found/.test(String(error.message)))
+        if (!/World instance not found/.test(String(errorMessage(error))))
             throw error;
         const known = listWorlds(root).map((world) => world.name);
         throw new Error(`World "${name}" not found in ${root}${known.length ? ` (known worlds: ${known.join(', ')})` : ' (no worlds here)'} — start it with \`volter world up\` in the app's folder (the operator's own: \`volter-world up <config> --env-out <path> --name ${name}\`)`);
@@ -482,7 +483,7 @@ export async function pushWorldChangeset(name, options) {
             res = { ok: true, status: 200 };
         }
         catch (error) {
-            body = { error: error instanceof Error ? error.message : String(error) };
+            body = { error: errorMessage(error) };
             res = { ok: false, status: 409 };
         }
     }
@@ -547,7 +548,7 @@ export async function pushWorldChangeset(name, options) {
     // the remote's record of who pushed it and who owns it, kept on this copy too (outside the hash)
     const changeset = { ...withApplication(located.changeset, application), ...(body.owner && !located.changeset.owner ? { owner: body.owner } : {}), ...(body.pushedBy ? { pushedBy: body.pushedBy } : {}) };
     writeChangesetFile(located.path, changeset);
-    const unsent = namedFailure ? `records the landed entries name did not reach the origin (${namedFailure instanceof Error ? namedFailure.message : String(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
+    const unsent = namedFailure ? `records the landed entries name did not reach the origin (${errorMessage(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
     return { ...(unsent ? { unsent } : {}), application, changeset, world: located.world, path: located.path, remote: { url, namespace } };
 }
 /** `volter-world changeset rebase <name>`: the merge onto the authoring world's moved mirror. */