@volter/world 2.0.28 → 2.0.29

package/dist/src/cli.js

@@ -15,6 +15,7 @@ import { forgetPlatform, forgetToken, platformOrigin, storePlatform, storeToken,
 import { parseOriginUrl, World } from "./world.js";
 import { waitForServeShutdown } from "./serve-shutdown.js";
 import { startUpdateCheck } from "./update-notice.js";
+import { withoutVaultSignIn } from '@volter/world-runtime';
 /** Open a URL in the person's browser; a machine without one only loses the convenience. */
 function openInBrowser(url) {
     // an http(s) URL only, and on Windows through the URL handler rather than cmd.exe, which would read `"`, `&` or `%VAR%`
@@ -608,9 +609,19 @@ async function twinCommand(args) {
             world.setTwinRoot(vendor, { url, deploy, ...(value(rest, '--scope') ? { scope: value(rest, '--scope') } : {}), ...(Object.keys(refresh).length ? { refresh } : {}) });
         }
         else if (verb === 'credential') {
-            const input = stdinText();
-            if (input.trim() === '')
-                throw new Error(`volter twin ${vendor} credential: read the credential from stdin (printf '<token>' | volter twin ${vendor} credential)`);
+            // what is piped in, else the signed-in vault, else the repo's .env (company decision 0033: no vault required)
+            let input = process.stdin.isTTY ? '' : stdinText();
+            if (input.trim() === '') {
+                if (!world.twin(vendor))
+                    throw new Error(`volter twin ${vendor} credential: this World has no twin "${vendor}"`);
+                const found = await world.rootCredentialInput(vendor);
+                for (const note of found.notes)
+                    process.stderr.write(`${vendor}  ${note}\n`);
+                if (found.input === null)
+                    throw new Error(`volter twin ${vendor} credential: no credential found. Pipe one (printf '<token>' | volter twin ${vendor} credential), sign in to a vault holding kv/vendors/${vendor}, or put it in the repo's .env`);
+                out(`${vendor}  credential from ${found.from}`);
+                input = found.input;
+            }
             await world.sealTwinCredential(vendor, input);
         }
         else if (verb === 'refresh') {
@@ -961,7 +972,8 @@ async function installDetectedTwins(app, install) {
         throw new Error(`install the twins first: ${command}
 then run volter world init again (or volter world init --install does both)`);
     // one command line built from the checked names above: nothing of anyone's input reaches the shell
-    const ran = spawnSync(command, { cwd: app, stdio: 'inherit', shell: true, windowsHide: true });
+    // a dependency's install script is not Volter's: it never sees the person's vault sign-in
+    const ran = spawnSync(command, { cwd: app, stdio: 'inherit', shell: true, windowsHide: true, env: withoutVaultSignIn(process.env) });
     if (ran.status !== 0)
         throw new Error(`${command} failed (exit ${ran.status ?? 'none'})`);
 }

package/dist/src/world.d.ts

@@ -1,5 +1,5 @@
 import { rebaseChangeset, worldBootMarker, type Changeset, type LedgerDelta, type TwinAction, type WorldMarker, type ApplyReceipt, applyTwinWrite, type TwinResource } from '@volter/world-core';
-import { approveWorldChangeset, createWorldChangeset, downWorld, fetchFromOrigin, pushWorldChangeset, rebaseWorldChangeset, replayWorldChangeset, resetWorld, seedWorld, statusWorldChangeset, verifyWorldChangeset, type ServedWorld, type ViewConsole, type WorldView, type DeployTwinOutcome, type ChangesetLocation, type InitOptions, type InitResult, type WorldInstance } from '@volter/world-runtime';
+import { approveWorldChangeset, createWorldChangeset, downWorld, fetchFromOrigin, pushWorldChangeset, rebaseWorldChangeset, replayWorldChangeset, resetWorld, seedWorld, statusWorldChangeset, verifyWorldChangeset, type ServedWorld, type ViewConsole, type WorldView, rootCredentialInput, type DeployTwinOutcome, type ChangesetLocation, type InitOptions, type InitResult, type WorldInstance } from '@volter/world-runtime';
 import { rebaseBranch, type Receipt, type RootConfig } from '@volter/world-core';
 export type WorldRef = {
     name?: string;
@@ -296,6 +296,8 @@ export declare class World {
         placedAt: string;
         fingerprint: string;
     }>;
+    /** A root's credential when none is piped in: the signed-in vault, else the repo's `.env` (decision 0033). */
+    rootCredentialInput(vendor: string): ReturnType<typeof rootCredentialInput>;
     /** Refresh one twin from its root now. */
     refreshTwin(vendor: string, opts?: {
         force?: boolean;

package/dist/src/world.js

@@ -5,7 +5,7 @@
 import { rebaseChangeset, worldBootMarker, listActions, isTwinBookkeeping, pushablePendingActions, pendingActions, applyTwinWrite, twinResources } from '@volter/world-core';
 import { spawnSync } from 'node:child_process';
 import clockForm from '@volter/world-core/world-clock';
-import { activateScript, approveWorldChangeset, branchWorld, clockFile, checkoutWorld, createWorldChangeset, diffWorld, downWorld, fetchFromOrigin, findWorldChangeset, initWorld, listWorldChangesets, listWorldMarks, listWorlds, markWorld, pushWorldChangeset, rebaseWorldChangeset, replayWorldChangeset, resetWorld, runWithWorldEnv, seedWorld, shellWorld, statusWorld, statusWorldChangeset, upWorld, verifyWorldChangeset, worldLedgers, worldOrigin, deployWorld, loadWorldConfig, writeWorldConfig, readServeRecord, refreshTwin, serveWorld, serveWorldView, findInstalledPackage, rootForControlRoot, sealTwinCredential, sealedCredentialInfo, setTwinRoot, credentialPayloadFrom, materializeRoots } from '@volter/world-runtime';
+import { activateScript, approveWorldChangeset, branchWorld, clockFile, checkoutWorld, createWorldChangeset, diffWorld, downWorld, fetchFromOrigin, findWorldChangeset, initWorld, listWorldChangesets, listWorldMarks, listWorlds, markWorld, pushWorldChangeset, rebaseWorldChangeset, replayWorldChangeset, resetWorld, runWithWorldEnv, seedWorld, shellWorld, statusWorld, statusWorldChangeset, upWorld, verifyWorldChangeset, worldLedgers, worldOrigin, deployWorld, loadWorldConfig, writeWorldConfig, readServeRecord, refreshTwin, serveWorld, serveWorldView, findInstalledPackage, rootForControlRoot, sealTwinCredential, sealedCredentialInfo, setTwinRoot, credentialPayloadFrom, rootCredentialInput, withoutVaultSignIn, materializeRoots } from '@volter/world-runtime';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { requireToken, storeToken } from "./credentials.js";
@@ -94,7 +94,7 @@ export class World {
         if (opts.install !== false && !twins.every((t) => findInstalledPackage(dir, `@volter/twin-${t}`))) {
             // the runtime's own installer: bun under Bun, npm under Node — never assumed
             const cmd = typeof Bun !== 'undefined' ? ['bun', 'add', '-d'] : ['npm', 'install', '--save-dev'];
-            const r = spawnSync(cmd[0], [...cmd.slice(1), ...twins.map((t) => `@volter/twin-${t}`)], { windowsHide: true, cwd: dir, stdio: 'inherit' });
+            const r = spawnSync(cmd[0], [...cmd.slice(1), ...twins.map((t) => `@volter/twin-${t}`)], { windowsHide: true, cwd: dir, stdio: 'inherit', env: withoutVaultSignIn(process.env) });
             if (r.status !== 0)
                 throw new Error(`installing the twins failed (${cmd.join(' ')} exited ${r.status})`);
         }
@@ -502,6 +502,8 @@ export class World {
     }
     /** Seal the vendor's credential beside the world (a bare token, or a JSON payload). Never readable back. */
     sealTwinCredential(vendor, input) { return sealTwinCredential(this.root, vendor, credentialPayloadFrom(input, vendor)); }
+    /** A root's credential when none is piped in: the signed-in vault, else the repo's `.env` (decision 0033). */
+    rootCredentialInput(vendor) { return rootCredentialInput(this.root, vendor); }
     /** Refresh one twin from its root now. */
     async refreshTwin(vendor, opts = {}) {
         const { controlRoot, root } = this.rootOf(vendor);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world",
-  "version": "2.0.28",
+  "version": "2.0.29",
   "description": "Run your app against a world of twins. `World` and `Repo` — one method per verb: init, up, run, log, diff, reset, branch, checkout, clone, fetch, changeset, push — and the `volter` command, one client of them.",
   "keywords": [
     "volter",
@@ -31,7 +31,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
     "@volter/world-core": "2.0.15",
-    "@volter/world-runtime": "2.0.26",
+    "@volter/world-runtime": "2.0.27",
     "zod": "^4.6.5"
   },
   "peerDependencies": {

package/src/cli.ts

@@ -17,6 +17,7 @@ import { parseOriginUrl, World } from './world.ts';
 import { waitForServeShutdown } from './serve-shutdown.ts';
 import { startUpdateCheck } from './update-notice.ts';
 import type { ViewConsole } from '@volter/world-runtime';
+import { withoutVaultSignIn } from '@volter/world-runtime';
 
 /** Open a URL in the person's browser; a machine without one only loses the convenience. */
 function openInBrowser(url: string): void {
@@ -440,8 +441,16 @@ async function twinCommand(args: string[]): Promise<void> {
       const refresh = { ...(value(rest, '--refresh') ? { every: value(rest, '--refresh')! } : {}), ...(value(rest, '--at-most') ? { atMost: value(rest, '--at-most')! } : {}) };
       world.setTwinRoot(vendor, { url, deploy, ...(value(rest, '--scope') ? { scope: value(rest, '--scope')! } : {}), ...(Object.keys(refresh).length ? { refresh } : {}) });
     } else if (verb === 'credential') {
-      const input = stdinText();
-      if (input.trim() === '') throw new Error(`volter twin ${vendor} credential: read the credential from stdin (printf '<token>' | volter twin ${vendor} credential)`);
+      // what is piped in, else the signed-in vault, else the repo's .env (company decision 0033: no vault required)
+      let input = process.stdin.isTTY ? '' : stdinText();
+      if (input.trim() === '') {
+        if (!world.twin(vendor)) throw new Error(`volter twin ${vendor} credential: this World has no twin "${vendor}"`);
+        const found = await world.rootCredentialInput(vendor);
+        for (const note of found.notes) process.stderr.write(`${vendor}  ${note}\n`);
+        if (found.input === null) throw new Error(`volter twin ${vendor} credential: no credential found. Pipe one (printf '<token>' | volter twin ${vendor} credential), sign in to a vault holding kv/vendors/${vendor}, or put it in the repo's .env`);
+        out(`${vendor}  credential from ${found.from}`);
+        input = found.input;
+      }
       await world.sealTwinCredential(vendor, input);
     } else if (verb === 'refresh') {
       const r = await world.refreshTwin(vendor, { force: flag(rest, '--force') });
@@ -703,7 +712,8 @@ async function installDetectedTwins(app: string, install: boolean): Promise<void
   if (!yes) throw new Error(`install the twins first: ${command}
 then run volter world init again (or volter world init --install does both)`);
   // one command line built from the checked names above: nothing of anyone's input reaches the shell
-  const ran = spawnSync(command, { cwd: app, stdio: 'inherit', shell: true, windowsHide: true });
+  // a dependency's install script is not Volter's: it never sees the person's vault sign-in
+  const ran = spawnSync(command, { cwd: app, stdio: 'inherit', shell: true, windowsHide: true, env: withoutVaultSignIn(process.env) });
   if (ran.status !== 0) throw new Error(`${command} failed (exit ${ran.status ?? 'none'})`);
 }
 

package/src/world.ts

@@ -8,7 +8,7 @@ import clockForm from '@volter/world-core/world-clock';
 import {
   activateScript, approveWorldChangeset, branchWorld, clockFile, checkoutWorld, createWorldChangeset, diffWorld, downWorld, fetchFromOrigin, findWorldChangeset, initWorld, listWorldChangesets, listWorldMarks, listWorlds, markWorld, pushWorldChangeset, rebaseWorldChangeset, replayWorldChangeset, resetWorld, runWithWorldEnv, seedWorld, shellWorld,
   statusWorld, statusWorldChangeset, upWorld, verifyWorldChangeset, worldLedgers, worldOrigin,
-  deployWorld, loadWorldConfig, writeWorldConfig, readServeRecord, refreshTwin, serveWorld, serveWorldView, findInstalledPackage, type ServedWorld, type ViewConsole, type WorldView, rootForControlRoot, sealTwinCredential, sealedCredentialInfo, setTwinRoot, credentialPayloadFrom,
+  deployWorld, loadWorldConfig, writeWorldConfig, readServeRecord, refreshTwin, serveWorld, serveWorldView, findInstalledPackage, type ServedWorld, type ViewConsole, type WorldView, rootForControlRoot, sealTwinCredential, sealedCredentialInfo, setTwinRoot, credentialPayloadFrom, rootCredentialInput, withoutVaultSignIn,
   type DeployTwinOutcome, type MaterializedRoot,
   type ChangesetLocation, type InitOptions, type InitResult, type WorldInstance, materializeRoots } from '@volter/world-runtime';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
@@ -108,7 +108,7 @@ export class World {
     if (opts.install !== false && !twins.every((t) => findInstalledPackage(dir, `@volter/twin-${t}`))) {
       // the runtime's own installer: bun under Bun, npm under Node — never assumed
       const cmd = typeof Bun !== 'undefined' ? ['bun', 'add', '-d'] : ['npm', 'install', '--save-dev'];
-      const r = spawnSync(cmd[0]!, [...cmd.slice(1), ...twins.map((t) => `@volter/twin-${t}`)], { windowsHide: true, cwd: dir, stdio: 'inherit' });
+      const r = spawnSync(cmd[0]!, [...cmd.slice(1), ...twins.map((t) => `@volter/twin-${t}`)], { windowsHide: true, cwd: dir, stdio: 'inherit', env: withoutVaultSignIn(process.env) });
       if (r.status !== 0) throw new Error(`installing the twins failed (${cmd.join(' ')} exited ${r.status})`);
     }
     const name = served.split('/')[1]!;
@@ -461,6 +461,8 @@ export class World {
   }
   /** Seal the vendor's credential beside the world (a bare token, or a JSON payload). Never readable back. */
   sealTwinCredential(vendor: string, input: string): Promise<{ placedAt: string; fingerprint: string }> { return sealTwinCredential(this.root, vendor, credentialPayloadFrom(input, vendor)); }
+  /** A root's credential when none is piped in: the signed-in vault, else the repo's `.env` (decision 0033). */
+  rootCredentialInput(vendor: string): ReturnType<typeof rootCredentialInput> { return rootCredentialInput(this.root, vendor); }
   /** Refresh one twin from its root now. */
   async refreshTwin(vendor: string, opts: { force?: boolean } = {}): Promise<{ refreshed: boolean; reason?: string; report?: { observed: number; appended: number; unchanged: number; removed: number } }> {
     const { controlRoot, root } = this.rootOf(vendor);