@volter/world 2.0.32 → 2.0.33

package/dist/src/world.js

@@ -5,12 +5,12 @@
 import { rebaseChangeset, worldBootMarker, listActions, isTwinBookkeeping, pushablePendingActions, pendingActions, applyTwinWrite, twinResources } from '@volter/world-core';
 import { spawnSync } from 'node:child_process';
 import clockForm from '@volter/world-core/world-clock';
-import { activateScript, approveWorldChangeset, branchWorld, clockFile, checkoutWorld, createWorldChangeset, diffWorld, downWorld, fetchFromOrigin, findWorldChangeset, initWorld, listWorldChangesets, listWorldMarks, listWorlds, markWorld, pushWorldChangeset, rebaseWorldChangeset, replayWorldChangeset, resetWorld, runWithWorldEnv, seedWorld, shellWorld, statusWorld, statusWorldChangeset, upWorld, verifyWorldChangeset, worldLedgers, worldOrigin, deployWorld, loadWorldConfig, writeWorldConfig, readServeRecord, refreshTwin, serveWorld, serveWorldView, findInstalledPackage, rootForControlRoot, sealTwinCredential, sealedCredentialInfo, setTwinRoot, credentialPayloadFrom, rootCredentialInput, withoutVaultSignIn, materializeRoots } from '@volter/world-runtime';
+import { activateScript, approveWorldChangeset, branchWorld, clockFile, checkoutWorld, createWorldChangeset, diffWorld, downWorld, fetchFromOrigin, findWorldChangeset, initWorld, listWorldChangesets, listWorldMarks, listWorlds, markWorld, pushWorldChangeset, rebaseWorldChangeset, replayWorldChangeset, resetWorld, runWithWorldEnv, seedWorld, shellWorld, statusWorld, statusWorldChangeset, upWorld, verifyWorldChangeset, worldLedgers, worldOrigin, bindLegacyCredentials, deployWorld, loadWorldConfig, writeWorldConfig, readServeRecord, refreshTwin, serveWorld, serveWorldView, findInstalledPackage, rootForControlRoot, sealTwinCredential, sealedCredentialInfo, setTwinRoot, credentialPayloadFrom, rootCredentialInput, withoutVaultSignIn, materializeRoots } from '@volter/world-runtime';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { requireToken, storeToken } from "./credentials.js";
 import { currentBranch, findWorldRoot, mainBranch, requireWorldRoot, setCurrentBranch, worldConfigRelative, worldEnvPath, worldSeedPath } from "./locate.js";
-import { parentEntries, rebaseBranch } from '@volter/world-core';
+import { destinationOf, parentEntries, rebaseBranch } from '@volter/world-core';
 /** One change as `log` shows it: the write, and the receipt the vendor answered with once pushed. */
 /** A twin's branch log as the world reads it: the twin's name, the state service it records under, its control root. */
 /** `30d`, `12h`, `5m`, `90s` in ms. */
@@ -501,12 +501,25 @@ export class World {
         }
     }
     /** Seal the vendor's credential beside the world (a bare token, or a JSON payload). Never readable back. */
-    sealTwinCredential(vendor, input) { return sealTwinCredential(this.root, vendor, credentialPayloadFrom(input, vendor)); }
+    sealTwinCredential(vendor, input) {
+        // sealed for the one destination it serves, the twin's root: with none set there is nowhere it may go
+        const url = loadWorldConfig(this.configRef(), this.root).config.services.find((s) => s.id === vendor)?.root?.url;
+        if (!url)
+            return Promise.reject(new Error(`the ${vendor} twin has no root: \`volter twin ${vendor} root <url>\` sets where its credential goes, then seal it`));
+        return sealTwinCredential(this.root, vendor, credentialPayloadFrom(input, vendor), undefined, destinationOf(url));
+    }
     /** A root's credential when none is piped in: the signed-in vault, else the repo's `.env` (decision 0033). */
     rootCredentialInput(vendor) { return rootCredentialInput(this.root, vendor); }
     /** Refresh one twin from its root now. */
     async refreshTwin(vendor, opts = {}) {
         const { controlRoot, root } = this.rootOf(vendor);
+        // a credential sealed before bindings is bound to this root first: the person at this machine set both
+        // credentials sealed before bindings are bound first, each to its twin's root in world.json (the person at this
+        // machine set both); the inventory is the World's own, so it takes every twin's root, not just this one's
+        const roots = () => Object.fromEntries(loadWorldConfig(this.configRef(), this.root).config.services.filter((s) => s.id && s.root?.url).map((s) => [s.id, s.root.url]));
+        const legacy = await bindLegacyCredentials(this.root, roots);
+        if (!legacy.ready)
+            throw new Error('the credentials beside this World could not be inventoried');
         return refreshTwin({ worldRoot: this.root, vendor, controlRoot, root, ...(opts.force ? { force: true } : {}) });
     }
     rootOf(vendor) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world",
-  "version": "2.0.32",
+  "version": "2.0.33",
   "description": "Run your app against a world of twins. `World` and `Repo` — one method per verb: init, up, run, log, diff, reset, branch, checkout, clone, fetch, changeset, push — and the `volter` command, one client of them.",
   "keywords": [
     "volter",
@@ -30,8 +30,8 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
-    "@volter/world-core": "2.0.17",
-    "@volter/world-runtime": "2.0.30",
+    "@volter/world-core": "2.0.18",
+    "@volter/world-runtime": "2.0.31",
     "zod": "^4.6.5"
   },
   "peerDependencies": {

package/src/world.ts

@@ -8,14 +8,14 @@ import clockForm from '@volter/world-core/world-clock';
 import {
   activateScript, approveWorldChangeset, branchWorld, clockFile, checkoutWorld, createWorldChangeset, diffWorld, downWorld, fetchFromOrigin, findWorldChangeset, initWorld, listWorldChangesets, listWorldMarks, listWorlds, markWorld, pushWorldChangeset, rebaseWorldChangeset, replayWorldChangeset, resetWorld, runWithWorldEnv, seedWorld, shellWorld,
   statusWorld, statusWorldChangeset, upWorld, verifyWorldChangeset, worldLedgers, worldOrigin,
-  deployWorld, loadWorldConfig, writeWorldConfig, readServeRecord, refreshTwin, serveWorld, serveWorldView, findInstalledPackage, type ServedWorld, type ViewConsole, type WorldView, rootForControlRoot, sealTwinCredential, sealedCredentialInfo, setTwinRoot, credentialPayloadFrom, rootCredentialInput, withoutVaultSignIn,
+  bindLegacyCredentials, deployWorld, loadWorldConfig, writeWorldConfig, readServeRecord, refreshTwin, serveWorld, serveWorldView, findInstalledPackage, type ServedWorld, type ViewConsole, type WorldView, rootForControlRoot, sealTwinCredential, sealedCredentialInfo, setTwinRoot, credentialPayloadFrom, rootCredentialInput, withoutVaultSignIn,
   type DeployTwinOutcome, type MaterializedRoot,
   type ChangesetLocation, type InitOptions, type InitResult, type WorldInstance, materializeRoots } from '@volter/world-runtime';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { requireToken, storeToken } from './credentials.ts';
 import { currentBranch, findWorldRoot, mainBranch, requireWorldRoot, setCurrentBranch, worldConfigRelative, worldEnvPath, worldSeedPath } from './locate.ts';
-import { parentEntries, rebaseBranch, type Receipt, type RootConfig } from '@volter/world-core';
+import { destinationOf, parentEntries, rebaseBranch, type Receipt, type RootConfig } from '@volter/world-core';
 
 export type WorldRef = { name?: string; root?: string };
 export type WorldMode = 'local' | 'share' | 'sealed';
@@ -460,12 +460,23 @@ export class World {
     if (inst?.running) { materializeRoots(loadWorldConfig(this.configRef(), this.root).config, inst.dirs.data, this.root); }
   }
   /** Seal the vendor's credential beside the world (a bare token, or a JSON payload). Never readable back. */
-  sealTwinCredential(vendor: string, input: string): Promise<{ placedAt: string; fingerprint: string }> { return sealTwinCredential(this.root, vendor, credentialPayloadFrom(input, vendor)); }
+  sealTwinCredential(vendor: string, input: string): Promise<{ placedAt: string; fingerprint: string }> {
+    // sealed for the one destination it serves, the twin's root: with none set there is nowhere it may go
+    const url = (loadWorldConfig(this.configRef(), this.root).config.services as Array<{ id?: string; root?: { url?: string } }>).find((s) => s.id === vendor)?.root?.url;
+    if (!url) return Promise.reject(new Error(`the ${vendor} twin has no root: \`volter twin ${vendor} root <url>\` sets where its credential goes, then seal it`));
+    return sealTwinCredential(this.root, vendor, credentialPayloadFrom(input, vendor), undefined, destinationOf(url));
+  }
   /** A root's credential when none is piped in: the signed-in vault, else the repo's `.env` (decision 0033). */
   rootCredentialInput(vendor: string): ReturnType<typeof rootCredentialInput> { return rootCredentialInput(this.root, vendor); }
   /** Refresh one twin from its root now. */
   async refreshTwin(vendor: string, opts: { force?: boolean } = {}): Promise<{ refreshed: boolean; reason?: string; report?: { observed: number; appended: number; unchanged: number; removed: number } }> {
     const { controlRoot, root } = this.rootOf(vendor);
+    // a credential sealed before bindings is bound to this root first: the person at this machine set both
+    // credentials sealed before bindings are bound first, each to its twin's root in world.json (the person at this
+    // machine set both); the inventory is the World's own, so it takes every twin's root, not just this one's
+    const roots = () => Object.fromEntries((loadWorldConfig(this.configRef(), this.root).config.services as Array<{ id?: string; root?: { url?: string } }>).filter((s) => s.id && s.root?.url).map((s) => [s.id!, s.root!.url!]));
+    const legacy = await bindLegacyCredentials(this.root, roots);
+    if (!legacy.ready) throw new Error('the credentials beside this World could not be inventoried');
     return refreshTwin({ worldRoot: this.root, vendor, controlRoot, root, ...(opts.force ? { force: true } : {}) });
   }
   private rootOf(vendor: string): { controlRoot: string; root: MaterializedRoot } {