@volter/twin-github 2.0.1 → 2.0.2

package/dist/src/github-capabilities.js

@@ -2723,6 +2723,120 @@ export const GITHUB_CAPABILITIES = [
         const after = await handleGithubRequest({ method: 'GET', path: `/user/emails`, root });
         return del.response.status === 204 && isArr(after.body) && after.body.length === 1;
     })),
+    done('github.users.sign_up', 'users', 'Users: a person signs up (username, email, password) and signs in; a username or address another account holds, or a password GitHub\'s rule refuses, is refused', 'api', 'common', () => withRoot(async (root) => {
+        const signUp = async (body) => (await applyGithubWrite({ method: 'POST', path: '/_twin/users', body: JSON.stringify(body), root })).response;
+        const made = await signUp({ login: 'sam-friends', email: 'sam@friends.test', password: 'correct-horse-1' });
+        if (!(made.status === 201 && made.body.login === 'sam-friends'))
+            return false;
+        for (const refused of [
+            { login: 'Sam-Friends', email: 'other@friends.test', password: 'correct-horse-1' }, // the username, any case
+            { login: 'octocat', email: 'o@friends.test', password: 'correct-horse-1' }, // the World's user
+            { login: 'ada', email: 'SAM@friends.test', password: 'correct-horse-1' }, // the address, any case
+            { login: 'ada', email: 'ada@friends.test', password: 'short1' }, // under 8
+            { login: 'ada', email: 'ada@friends.test', password: 'NOLOWERCASE123' }, // 8 to 14 without a lowercase letter
+            { login: 'ada', email: 'not-an-address', password: 'correct-horse-1' },
+            { login: '-ada', email: 'ada@friends.test', password: 'correct-horse-1' },
+        ])
+            if ((await signUp(refused)).status !== 422)
+                return false;
+        if ((await signUp({ login: 'ada', email: 'ada@friends.test', password: 'fifteen chars ok' })).status !== 201)
+            return false;
+        // a username the World already knows is taken, whatever named it: a token holder, a repository's owner or collaborator
+        await mintToken(root, 'grace');
+        await applyGithubWrite({ method: 'POST', path: '/user/repos', body: JSON.stringify({ name: 'shared' }), root });
+        await applyGithubWrite({ method: 'PUT', path: '/repos/octocat/shared/collaborators/rui', body: '{}', root });
+        for (const login of ['Grace', 'rui'])
+            if ((await signUp({ login, email: `${login}@friends.test`, password: 'correct-horse-1' })).status !== 422)
+                return false;
+        // two sign-ups racing for one address: one account is made, the other refused, and the address is the made one's
+        const raced = await Promise.all([signUp({ login: 'kim', email: 'shared@friends.test', password: 'correct-horse-1' }), signUp({ login: 'lee', email: 'shared@friends.test', password: 'correct-horse-1' })]);
+        const winner = raced.find((r) => r.status === 201)?.body;
+        if (raced.filter((r) => r.status === 201).length !== 1 || raced.filter((r) => r.status === 422).length !== 1)
+            return false;
+        const holders = twinResources('github', root).filter((r) => r.type === 'user_email' && r.email === 'shared@friends.test' && r.deleted !== true);
+        if (!(holders.length === 1 && holders[0].login === winner?.login))
+            return false;
+        // the password signs its person in; a wrong one does not
+        const form = (login, password) => githubSessionFlow({ root, now: () => '2026-01-01T00:00:00.000Z' })(new Request('https://github.com/session', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ login, password, return_to: '/' }).toString() }));
+        const wrong = await form('sam-friends', 'wrong-horse-1');
+        const right = await form('sam-friends', 'correct-horse-1');
+        return wrong?.status === 200 && right?.status === 302 && (right.headers.getSetCookie() ?? []).some((c) => c.startsWith('dotcom_user=sam-friends;'));
+    })),
+    done('github.users.oauth_person', 'users', 'Users: the token an OAuth app gets from the person who signed in and consented answers that person\'s account: GET /user their login, name and avatar, GET /user/emails their own addresses; the World\'s shared token stays octocat\'s', 'api', 'common', () => withRoot(async (root) => {
+        const at = '2026-01-01T00:00:00.000Z';
+        // octocat's own address, from before anyone signed up
+        await applyGithubWrite({ method: 'POST', path: '/user/emails', body: JSON.stringify({ emails: ['octocat@github.test'] }), root });
+        await applyGithubWrite({ method: 'PATCH', path: '/user', body: JSON.stringify({ name: 'The Octocat' }), root });
+        const tokenFor = async (login, email) => {
+            await applyGithubWrite({ method: 'POST', path: '/_twin/users', body: JSON.stringify({ login, email, password: 'correct-horse-1' }), root });
+            const signed = await githubSessionFlow({ root, now: () => at })(new Request('https://github.com/session', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ login, password: 'correct-horse-1', return_to: '/' }).toString() }));
+            const cookie = (signed?.headers.getSetCookie() ?? []).map((c) => c.split(';')[0]).join('; ');
+            const consent = { client_id: 'librechat', redirect_uri: 'http://chat.local/oauth/github/callback', scope: 'user:email', state: login };
+            if ((await applyGithubWrite({ method: 'POST', path: '/login/oauth/authorize', body: JSON.stringify({ ...consent, authorize: '1' }), root, cookie })).response.status !== 302)
+                return '';
+            const code = String(twinResources('github', root).find((r) => r.type === 'oauth_code' && r.login === login)?.code ?? '');
+            const ex = await applyGithubWrite({ method: 'POST', path: '/login/oauth/access_token', body: JSON.stringify({ client_id: 'librechat', code }), root });
+            return new URLSearchParams(String(ex.response.body)).get('access_token') ?? '';
+        };
+        const sam = await tokenFor('sam-friends', 'sam@friends.test');
+        const ada = await tokenFor('ada', 'ada@friends.test');
+        if (!sam || !ada)
+            return false;
+        const user = async (token) => (await handleGithubRequest({ method: 'GET', path: '/user', root, ...(token ? { token } : {}) })).body;
+        const emails = async (token) => (await handleGithubRequest({ method: 'GET', path: '/user/emails', root, ...(token ? { token } : {}) })).body;
+        // before he names himself, GitHub has no name for him
+        const before = await user(sam);
+        if (!(before.login === 'sam-friends' && before.name === null && before.avatar_url === `https://avatars.githubusercontent.com/u/${before.id}?v=4`))
+            return false;
+        if ((await applyGithubWrite({ method: 'PATCH', path: '/user', body: JSON.stringify({ name: 'Sam Friends' }), root, token: sam })).response.status !== 200)
+            return false;
+        const [s, a, o] = [await user(sam), await user(ada), await user()];
+        if (!(s.login === 'sam-friends' && s.name === 'Sam Friends' && a.login === 'ada' && a.name === null && o.login === 'octocat' && o.name === 'The Octocat'))
+            return false;
+        if ((await handleGithubRequest({ method: 'GET', path: '/users/sam-friends', root })).body.name !== 'Sam Friends')
+            return false;
+        // a login in another case is the same account, as it is spelled
+        const upper = (await handleGithubRequest({ method: 'GET', path: '/users/SAM-FRIENDS', root })).body;
+        if (!(upper.login === 'sam-friends' && upper.id === s.id && upper.name === 'Sam Friends'))
+            return false;
+        // his public email is one of his own verified addresses, never another's
+        const pub = (email, token) => applyGithubWrite({ method: 'PATCH', path: '/user', body: JSON.stringify({ email }), root, token });
+        if ((await pub('ada@friends.test', sam)).response.status !== 422 || (await pub('nobody@friends.test', sam)).response.status !== 422)
+            return false;
+        if (!((await pub('sam@friends.test', sam)).response.status === 200 && (await user(sam)).email === 'sam@friends.test'))
+            return false;
+        // his primary address is not removed while it is primary
+        if ((await applyGithubWrite({ method: 'DELETE', path: '/user/emails', body: JSON.stringify({ emails: ['sam@friends.test'] }), root, token: sam })).response.status !== 422)
+            return false;
+        const [se, oe] = [await emails(sam), await emails()];
+        if (!(se.length === 1 && se[0].email === 'sam@friends.test' && se[0].primary && se[0].verified))
+            return false;
+        if (!(oe.length === 1 && oe[0].email === 'octocat@github.test'))
+            return false;
+        // an address is one account's: Ada cannot add Sam's, and removing it as Ada leaves it his
+        if ((await applyGithubWrite({ method: 'POST', path: '/user/emails', body: JSON.stringify({ emails: ['sam@friends.test'] }), root, token: ada })).response.status !== 422)
+            return false;
+        await applyGithubWrite({ method: 'DELETE', path: '/user/emails', body: JSON.stringify({ emails: ['sam@friends.test'] }), root, token: ada });
+        if ((await emails(sam)).length !== 1)
+            return false;
+        await applyGithubWrite({ method: 'POST', path: '/user/emails', body: JSON.stringify({ emails: ['sam2@friends.test'] }), root, token: sam });
+        // Sam removes his second address; Ada adds it afresh, and it is hers alone (not primary: her first address is)
+        await applyGithubWrite({ method: 'DELETE', path: '/user/emails', body: JSON.stringify({ emails: ['sam2@friends.test'] }), root, token: sam });
+        await applyGithubWrite({ method: 'POST', path: '/user/emails', body: JSON.stringify({ emails: ['sam2@friends.test'] }), root, token: ada });
+        const [se2, ae2] = [await emails(sam), await emails(ada)];
+        if (!(se2.length === 1 && ae2.length === 2 && ae2.some((e) => e.email === 'sam2@friends.test' && !e.primary) && ae2.some((e) => e.email === 'ada@friends.test' && e.primary)))
+            return false;
+        // an app's installation token has no profile or addresses to change
+        const app = await ciToken(root, HISTORY_REPO);
+        const byApp = [
+            await applyGithubWrite({ method: 'PATCH', path: '/user', body: JSON.stringify({ name: 'bot' }), root, token: app }),
+            await applyGithubWrite({ method: 'POST', path: '/user/emails', body: JSON.stringify({ emails: ['bot@friends.test'] }), root, token: app }),
+            await applyGithubWrite({ method: 'DELETE', path: '/user/emails', body: JSON.stringify({ emails: ['octocat@github.test'] }), root, token: app }),
+        ];
+        return byApp.every((r) => r.response.status === 403 && r.response.body.message === 'Resource not accessible by integration') && (await emails()).length === 1;
+    })),
+    todo('github.users.own_keys', 'users', 'Users: each account its own SSH and GPG keys (today one list, whoever asks)', 'api', 'niche'),
+    todo('github.users.own_blocks', 'users', 'Users: each account its own blocked users (today one list, whoever asks)', 'api', 'niche'),
     done('github.user.keys', 'users', 'User: SSH + GPG keys CRUD', 'api', 'niche', () => withRoot(async (root) => {
         // SSH: missing key 422s; create → 201; get/list; delete → 404. GPG: armored key required.
         if ((await applyGithubWrite({ method: 'POST', path: `/user/keys`, body: JSON.stringify({ title: 'x' }), root })).response.status !== 422)

package/dist/src/github-events.js

@@ -1,7 +1,7 @@
 // Native repository hooks and delivery history live in the World's existing state.
 // Callback HTTP is the caller's webhook sink, never a credentialed GitHub API call.
 import { createHash, createHmac } from 'node:crypto';
-import { applyTwinWrite, applyTwinWriteAtomic, ownFields, twinResources, worldNow } from '@volter/world-core';
+import { applyTwinWrite, applyTwinWriteAtomic, ownFields, twinResources, worldNow, deliveryTraceHeaders } from '@volter/world-core';
 import { GITHUB_WORLD_USER, githubApps, githubState, handleGithubRequest, toGithubWebhook } from "./github-twin.js";
 import { appDestination, appFetch } from '@volter/world-core/app-route';
 import { worldEgressRefusal } from '@volter/world-core/network-policy';
@@ -15,7 +15,7 @@ const httpDelivery = async (url, _event, _payload, headers, body) => {
     const refusal = appDestination(url) ? null : worldEgressRefusal(url);
     if (refusal !== null)
         throw new Error(refusal);
-    const response = await appFetch(url, { method: 'POST', headers, body, redirect: 'manual', signal: AbortSignal.timeout(10_000) });
+    const response = await appFetch(url, { method: 'POST', headers: { ...headers, ...deliveryTraceHeaders() }, body, redirect: 'manual', signal: AbortSignal.timeout(10_000) });
     return { status: response.status, headers: Object.fromEntries(response.headers), body: await response.text() };
 };
 async function nativeObject(path, root) {

package/dist/src/github-mirror-ui.js

@@ -8,11 +8,11 @@
 // real GitHub client speaks, so the mirror renders a twin or a real account unchanged,
 // pointed at any origin by configuration. The client is the shared world UI-mirror design.
 import { readFile } from 'node:fs/promises';
-import { bundleClient, fileResponse } from '@volter/world-core';
+import { bundleClient, fileResponse, filePathOf } from '@volter/world-core';
 import { serveHttp } from '@volter/world-core';
 import { createGithubTwinFetch } from "./github-server.js";
-const CLIENT_ENTRY = () => new URL('../client/github-mirror.tsx', import.meta.url).pathname; // lazy: workerd rejects top-level relative URL from import.meta.url (bundled via pack index)
-const CLIENT_CSS = () => new URL('../client/github-mirror.css', import.meta.url).pathname; // lazy: workerd rejects top-level relative URL from import.meta.url (bundled via pack index)
+const CLIENT_ENTRY = () => filePathOf(new URL('../client/github-mirror.tsx', import.meta.url)); // lazy: workerd rejects top-level relative URL from import.meta.url (bundled via pack index)
+const CLIENT_CSS = () => filePathOf(new URL('../client/github-mirror.css', import.meta.url)); // lazy: workerd rejects top-level relative URL from import.meta.url (bundled via pack index)
 const APP_SHELL = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <base href="/"><title>GitHub UI mirror (twin)</title><link rel="stylesheet" href="assets/styles.css"></head>

package/dist/src/github-server.js

@@ -6,7 +6,7 @@
 // FIRST — its routes (/:owner/:repo/info/refs, git-upload-pack, git-receive-pack) are
 // binary pkt-line streams over the kernel's git library (github-git-http.ts); a push is
 // announced as an API commit's is (semantics/shared.ts announce).
-import { bindSemantics, compileSurface, coreFor, createDerivedFetch, crossCutting, matchOperation, semanticsContext, serveHttp, vendorError } from '@volter/world-core';
+import { bindSemantics, compileSurface, coreFor, createDerivedFetch, crossCutting, derivedRequestScopes, matchOperation, semanticsContext, serveHttp, vendorError } from '@volter/world-core';
 import surface from './generated/surface.gen.json' with { type: 'json' };
 import { manifest, spanning } from "./manifest.js";
 import { githubSemantics } from "./semantics/index.js";
@@ -14,7 +14,7 @@ import { githubGraphql } from "./semantics/graphql.js";
 import { createGraphqlWire } from "./graphql-wire.js";
 import { githubState, handleGithubDoor, revokedToken } from "./github-twin.js";
 import { announce } from "./semantics/shared.js";
-import { answerVendorErrors, RefusedWriteError } from '@volter/world-core';
+import { answerVendorErrors, isReadOnlyRequest, RefusedWriteError } from '@volter/world-core';
 import { worldNow, statefulTwinManifest } from '@volter/world-core';
 import { createHash } from 'node:crypto';
 import { githubOAuthFlow } from "./screens/oauth.js";
@@ -99,7 +99,8 @@ export function createGithubTwinFetch(options) {
                 query: url.searchParams,
                 ...(request.method === 'POST' ? { body: new Uint8Array(await request.arrayBuffer()) } : {}),
                 ...(options.root !== undefined ? { root: options.root } : {}),
-                readOnly,
+                // a read-only request pushes nothing: git refuses it as it refuses a push to a read-only twin
+                readOnly: readOnly || isReadOnlyRequest(request),
                 contentEncoding: request.headers.get('content-encoding') ?? '',
                 gitProtocol: request.headers.get('git-protocol') ?? '',
                 occurredAt,
@@ -210,8 +211,9 @@ export function createGithubTwinFetch(options) {
     // dated by the host's clock contradicts the World's time) and an x-github-request-id in GitHub's colon-separated hex
     // form, derived from the instant, the request and a counter so the same request twice gets two ids.
     let answered = 0;
-    // which part serves each spec operation (the derived dispatch's owners), for the pack's report
-    return Object.assign(async (request) => {
+    // which part serves each spec operation (the derived dispatch's owners), for the pack's report; a read-only request
+    // (x-volter-read-only) writes nothing — a GraphQL mutation or a git push included — answered with GitHub's read-only error
+    return derivedRequestScopes(manifest, Object.assign(async (request) => {
         const token = (request.headers.get('authorization') ?? '').replace(/^(?:bearer|token)\s+/i, '').trim() || undefined;
         const res = revokedToken(token, options.root) ? vendorError(manifest, { status: 401, message: 'Bad credentials' }) : await vended(request);
         const at = now();
@@ -222,7 +224,7 @@ export function createGithubTwinFetch(options) {
             headers.set('x-github-request-id', `${h.slice(0, 4)}:${h.slice(4, 9)}:${h.slice(9, 15)}:${h.slice(15, 21)}:${h.slice(21, 29)}`);
         }
         return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
-    }, { owners: inner.owners });
+    }, { owners: inner.owners }));
 }
 /** The GraphQL wire's requests, as the handler interface names them. */
 const GRAPHQL_OPERATION = { id: 'graphql', method: 'POST', path: '/graphql', class: 'action' };

package/dist/src/github-twin.d.ts

@@ -756,6 +756,7 @@ export type GithubUserEmail = {
     primary: boolean;
     verified: boolean;
     visibility: string | null;
+    login: string;
 };
 export type GithubUserSshKey = {
     id: number;
@@ -1075,6 +1076,7 @@ export type GithubState = {
     userGpgKeys: GithubUserGpgKey[];
     blockedUsers: Set<string>;
     userProfile: Partial<GithubUser>;
+    userProfiles: Record<string, Partial<GithubUser>>;
     projects: GithubProject[];
     projectFields: GithubProjectField[];
     projectItems: GithubProjectItem[];
@@ -1274,6 +1276,12 @@ export declare function toGithubEnvironment(e: GithubEnvironment): Record<string
 export declare function toGithubDeployKey(k: GithubDeployKey): Record<string, unknown>;
 export declare function toGithubAutolink(a: GithubAutolink): Record<string, unknown>;
 export declare function toGithubRuleset(r: GithubRuleset): Record<string, unknown>;
+/** An account as GET /user and GET /users/:login answer it: the login's deterministic account, under the profile its
+ *  person edited (PATCH /user). Nothing is invented for a person who has not filled it in: GitHub's `name` is null until
+ *  they set it. */
+export declare function accountOf(state: GithubState, login: string): GithubUser;
+/** The addresses an account holds, primary first (GET /user/emails). */
+export declare function emailsOf(state: GithubState, login: string): GithubUserEmail[];
 export declare function toGithubUserEmail(e: GithubUserEmail): Record<string, unknown>;
 export declare function toGithubUserSshKey(k: GithubUserSshKey): Record<string, unknown>;
 export declare function toGithubUserGpgKey(k: GithubUserGpgKey): Record<string, unknown>;
@@ -1373,6 +1381,13 @@ export declare function registerGithubApp(body: Record<string, any>, occurredAt:
     response: GithubResponse;
     app?: GithubAppRegistration;
 }>;
+/** Every account login the World already knows, lowercased → as it was first written: the World's user, whoever holds a
+ *  token or a password or an address or a profile, owns, collaborates on or is invited to a repository, is an organization
+ *  or one of its members. A tombstoned row still names an account that existed. Sign-up refuses these; a request naming one in another
+ *  case answers the account as it is spelled. */
+export declare function accountLoginsOf(resources: readonly Record<string, unknown>[]): Map<string, string>;
+/** A login as the account it names is spelled (GitHub's logins are case-insensitive); a login no account holds as asked. */
+export declare function canonicalLogin(login: string, root?: string): string;
 /** The twin's own doors under /_twin/: what stands in for an act GitHub does in its web UI or its runners, which have
  *  no API. A request to any other path is not a door's (undefined). */
 export declare function handleGithubDoor(request: Request, scope: {

package/dist/src/github-twin.js

@@ -285,6 +285,8 @@ export function githubState(root) {
             for (const row of value)
                 Object.freeze(row);
     Object.freeze(state.userProfile);
+    for (const p of Object.values(state.userProfiles))
+        Object.freeze(p);
     memos.set(root ?? '', { stamp, state });
     return state;
 }
@@ -420,7 +422,8 @@ function foldGithubState(root) {
     const userGpgKeysById = new Map();
     const deletedUserGpgKeys = new Set();
     const blockedByLogin = new Map();
-    const userProfile = {};
+    // each account's profile as it edited it (PATCH /user), by lowercased login; octocat's is also `userProfile`
+    const userProfiles = {};
     // Projects v2: projects / fields / items / views — LOCAL constructs keyed by subject id.
     const projectsById = new Map();
     const deletedProjects = new Set();
@@ -1293,15 +1296,19 @@ function foldGithubState(root) {
                 rules: Array.isArray(f.rules) ? f.rules : [] });
         }
         else if (a.subject.type === 'user_email') {
+            // a removed address is gone; added again (by its account or another) it starts afresh
             if (f.deleted === true) {
                 deletedUserEmails.add(a.subject.id);
+                userEmailsByAddr.delete(a.subject.id);
                 continue;
             }
+            deletedUserEmails.delete(a.subject.id);
             const prev = userEmailsByAddr.get(a.subject.id);
             userEmailsByAddr.set(a.subject.id, {
                 email: String(f.email ?? prev?.email ?? ''), primary: f.primary !== undefined ? Boolean(f.primary) : (prev?.primary ?? false),
                 verified: f.verified !== undefined ? Boolean(f.verified) : (prev?.verified ?? true),
                 visibility: f.visibility !== undefined ? f.visibility : (prev?.visibility ?? null),
+                login: typeof f.login === 'string' ? f.login : (prev?.login ?? GITHUB_WORLD_USER),
             });
         }
         else if (a.subject.type === 'user_ssh_key') {
@@ -1333,10 +1340,13 @@ function foldGithubState(root) {
             blockedByLogin.set(String(f.login ?? a.subject.id.replace(/^block:/, '')), f.deleted !== true);
         }
         else if (a.subject.type === 'user_profile') {
-            // PATCH /user — overlay the authenticated user's editable profile fields.
+            // PATCH /user — overlay the authenticated user's editable profile fields, on that user's own profile (a row
+            // without a login is from before profiles were per account: the World's user's).
+            const owner = (typeof f.login === 'string' ? f.login : a.subject.id === 'user_profile:octocat' ? GITHUB_WORLD_USER : a.subject.id.replace(/^user_profile:/, '')).toLowerCase();
+            const profile = userProfiles[owner] ?? (userProfiles[owner] = {});
             for (const k of ['name', 'bio', 'company', 'blog', 'location', 'email']) {
                 if (f[k] !== undefined)
-                    userProfile[k] = f[k];
+                    profile[k] = f[k];
             }
         }
         else if (a.subject.type === 'project_field' || a.subject.type === 'project_item' || a.subject.type === 'project_view') {
@@ -1868,7 +1878,8 @@ function foldGithubState(root) {
         userSshKeys,
         userGpgKeys,
         blockedUsers: new Set([...blockedByLogin.entries()].filter(([, on]) => on).map(([k]) => k)),
-        userProfile,
+        userProfile: userProfiles[GITHUB_WORLD_USER] ?? {},
+        userProfiles,
         projects,
         projectFields,
         projectItems,
@@ -3381,6 +3392,16 @@ export function toGithubRuleset(r) {
     };
 }
 // ── User niche serializers: emails / SSH keys / GPG keys ─────────────────────────────────
+/** An account as GET /user and GET /users/:login answer it: the login's deterministic account, under the profile its
+ *  person edited (PATCH /user). Nothing is invented for a person who has not filled it in: GitHub's `name` is null until
+ *  they set it. */
+export function accountOf(state, login) {
+    return { ...seedUser(login), ...(state.userProfiles[login.toLowerCase()] ?? {}), login };
+}
+/** The addresses an account holds, primary first (GET /user/emails). */
+export function emailsOf(state, login) {
+    return state.userEmails.filter((e) => e.login.toLowerCase() === login.toLowerCase());
+}
 export function toGithubUserEmail(e) {
     return { email: e.email, primary: e.primary, verified: e.verified, visibility: e.visibility };
 }
@@ -3873,6 +3894,83 @@ export async function registerGithubApp(body, occurredAt, root) {
     await applyTwinWrite(SERVICE, { operation: 'app_registration.create', subjectType: 'app_registration', subjectId: `app:${slug}`, fields, occurredAt, actor: { kind: 'agent' } }, req.root);
     return { response: { status: 201, body: toGithubApp(fields, 0, githubState(req.root)) }, app: fields };
 }
+/** Every account login the World already knows, lowercased → as it was first written: the World's user, whoever holds a
+ *  token or a password or an address or a profile, owns, collaborates on or is invited to a repository, is an organization
+ *  or one of its members. A tombstoned row still names an account that existed. Sign-up refuses these; a request naming one in another
+ *  case answers the account as it is spelled. */
+export function accountLoginsOf(resources) {
+    const out = new Map([[GITHUB_WORLD_USER, GITHUB_WORLD_USER]]);
+    const add = (v) => { if (typeof v === 'string' && v && !out.has(v.toLowerCase()))
+        out.set(v.toLowerCase(), v); };
+    for (const r of resources) {
+        switch (r.type) {
+            case 'user_credential':
+            case 'user_email':
+            case 'user_profile':
+            case 'user_two_factor':
+            case 'oauth_grant':
+            case 'collaborator':
+            case 'outside_collaborator':
+            case 'org_membership':
+            case 'team_membership':
+            case 'organization':
+                add(r.login);
+                break;
+            case 'repository':
+                add(r.owner);
+                break;
+            // GitHub invites only an account that exists
+            case 'repo_invitation':
+                add(r.invitee);
+                break;
+        }
+    }
+    return out;
+}
+/** A login as the account it names is spelled (GitHub's logins are case-insensitive); a login no account holds as asked. */
+export function canonicalLogin(login, root) {
+    const store = getActiveWorldStore();
+    const memos = accountMemos.get(store) ?? accountMemos.set(store, new Map()).get(store);
+    const stamp = treeStamp(SERVICE, root);
+    let held = memos.get(root ?? '');
+    if (!held || held.stamp !== stamp) {
+        held = { stamp, logins: accountLoginsOf(twinResources(SERVICE, root)) };
+        memos.set(root ?? '', held);
+    }
+    return held.logins.get(login.toLowerCase()) ?? login;
+}
+const accountMemos = new WeakMap();
+/** A person signs up (POST /_twin/users, standing in for github.com/signup): the account's password and its primary
+ *  address, decided against the tree in one step so two sign-ups cannot take the same username or address. */
+async function signUp(body, occurredAt, root) {
+    const login = typeof body.login === 'string' ? body.login : '';
+    const email = typeof body.email === 'string' ? body.email.trim() : '';
+    const password = typeof body.password === 'string' ? body.password : '';
+    const invalid = (resource, field, code, message) => ({ response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource, field, code, ...(message ? { message } : {}) }] } } });
+    if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(login) || /--|-$/.test(login))
+        return invalid('User', 'login', 'invalid');
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
+        return invalid('User', 'email', 'invalid');
+    if (!(password.length >= 15 || (password.length >= 8 && /[0-9]/.test(password) && /[a-z]/.test(password))))
+        return invalid('User', 'password', 'invalid', 'Password is too short or needs a number and a lowercase letter');
+    const lower = login.toLowerCase();
+    // The account is made by its address: the one write that claims both the username (the row names it, so every later
+    // sign-up sees it taken) and the address, decided against the tree it lands on, so of two sign-ups racing for either
+    // only one is made. Its password follows.
+    const { value: taken } = await applyTwinWriteAtomic(SERVICE, (resources) => {
+        if (accountLoginsOf(resources).has(lower))
+            return { kind: 'skip', value: 'login' };
+        if (resources.some((r) => r.deleted !== true && r.type === 'user_email' && String(r.email).toLowerCase() === email.toLowerCase()))
+            return { kind: 'skip', value: 'email' };
+        return { kind: 'write', value: undefined, write: { operation: 'user_email.upsert', subjectType: 'user_email', subjectId: `useremail:${email}`, fields: { email, primary: true, verified: true, visibility: 'private', login }, occurredAt, actor: { kind: 'human', id: login } } };
+    }, root);
+    if (taken === 'login')
+        return invalid('User', 'login', 'already_exists', 'Username is not available');
+    if (taken === 'email')
+        return invalid('User', 'email', 'already_exists', 'Email is invalid or already taken');
+    await applyTwinWrite(SERVICE, { operation: 'user_credential.set', subjectType: 'user_credential', subjectId: `credential:${lower}`, fields: { login, hash: passwordHash(login, password), set_at: occurredAt }, occurredAt, actor: { kind: 'human', id: login } }, root);
+    return { response: { status: 201, body: { login, email } } };
+}
 /** The twin's own doors under /_twin/: what stands in for an act GitHub does in its web UI or its runners, which have
  *  no API. A request to any other path is not a door's (undefined). */
 export async function handleGithubDoor(request, scope) {
@@ -3911,10 +4009,20 @@ export async function handleGithubDoor(request, scope) {
         //   webhook_secret?}. It is installed through its page, github.com/apps/{slug}/installations/new (src/screens/app-installation.tsx).
         if (seg[1] === 'apps' && !seg[2])
             return registerGithubApp(body, occurredAt, req.root);
+        // POST /_twin/users → {login, email, password}: GitHub's sign-up (github.com/signup; GitHub has no API to create an
+        //   account). As the page does, it takes a username, an email address and a password, and refuses a username or an
+        //   address another account holds and a password GitHub's rule refuses ("at least 15 characters OR at least 8
+        //   characters including a number and a lowercase letter", docs.github.com/authentication/keeping-your-account-and-
+        //   data-secure/creating-a-strong-password). The account's address is its primary one, verified (GitHub creates the
+        //   account only once the launch code it mails there is entered; that step is not modelled) and private, so
+        //   GET /user/emails lists it and GET /user's public `email` stays null. The person signs in at github.com/login;
+        //   their name and the rest of their profile are theirs to set (PATCH /user), empty until they do.
+        if (seg[1] === 'users' && !seg[2])
+            return signUp(body, occurredAt, req.root);
         // POST /_twin/users/:login/tokens → a personal access token for that user (GitHub mints these in its settings UI,
         //   which has no API). Requests carrying it are that user's: writes are attributed to them and GET /user names them.
         if (seg[1] === 'users' && seg[2] && seg[3] === 'tokens' && !seg[4]) {
-            const login = decodeURIComponent(seg[2]);
+            const login = canonicalLogin(decodeURIComponent(seg[2]), req.root);
             if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(login))
                 return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'User', field: 'login', code: 'invalid' }] } } };
             const token = `ghp_${createHash('sha256').update(`pat:${login}:${nextSeq('pat', req.root)}`).digest('hex').slice(0, 36)}`;
@@ -3923,10 +4031,10 @@ export async function handleGithubDoor(request, scope) {
             return { response: { status: 201, body: { token, login, scopes } } };
         }
         // POST /_twin/users/:login/password → {password}: the password the World gives a person, with which they sign in at
-        //   github.com/login (src/screens/session.tsx). GitHub's sign-up and password pages are not modelled; the World keeps
-        //   the password's hash, never the password.
+        //   github.com/login (src/screens/session.tsx). It stands in for GitHub's password page (sign-up is POST /_twin/users
+        //   above); the World keeps the password's hash, never the password.
         if (seg[1] === 'users' && seg[2] && seg[3] === 'password' && !seg[4]) {
-            const login = decodeURIComponent(seg[2]);
+            const login = canonicalLogin(decodeURIComponent(seg[2]), req.root);
             const password = typeof body.password === 'string' ? body.password : '';
             if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(login) || password.length < 8)
                 return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'User', field: password.length < 8 ? 'password' : 'login', code: 'invalid' }] } } };

package/dist/src/screens/session.js

@@ -14,8 +14,9 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // (docs.github.com/authentication/securing-your-account-with-two-factor-authentication-2fa/about-mandatory-two-factor-
 // authentication) is the person's to turn on in the World; the twin does not enrol anyone.
 //
-// Where GitHub's documentation stops and the twin decides: a person's password is what the World gave them
-// (`POST /_twin/users/:login/password`; GitHub's sign-up and password pages are not modelled), an account is named by
+// Where GitHub's documentation stops and the twin decides: a person's password is the one they signed up with
+// (`POST /_twin/users`, standing in for github.com/signup) or the World gave them (`POST /_twin/users/:login/password`;
+// GitHub's password page is not modelled), an account is named by
 // its login (not its email), a refused sign-in shows the form again with GitHub's message (answered 200), a code is
 // taken for the current 30-second step or the one before (RFC 6238's one step of drift) and never twice, a pending
 // two-factor sign-in does not expire, and a session does not end: no person of a World signs out yet, and signing out is built when one does.

package/dist/src/semantics/graphql.js

@@ -275,7 +275,12 @@ export function githubGraphql() {
     };
     return {
         resolvers: {
-            'Query.viewer': (_s, _args, c) => ({ __typename: 'User', login: 'octocat', name: state(c).userProfile.name ?? 'The Octocat' }),
+            // the token's own account; the World's shared token is octocat's, named The Octocat until its profile says otherwise
+            'Query.viewer': (_s, _args, c) => {
+                const login = gh(ctxOf(c)).caller ?? GITHUB_WORLD_USER;
+                const name = state(c).userProfiles[login.toLowerCase()]?.name;
+                return { __typename: 'User', login, name: name ?? (login === GITHUB_WORLD_USER ? 'The Octocat' : null) };
+            },
             'Query.node': queryNode,
             'Query.repository': (_s, args, c) => {
                 const repo = `${String(args.owner)}/${String(args.name)}`;
@@ -420,7 +425,7 @@ export function githubGraphql() {
                 const login = String(args.login ?? '');
                 const st = state(c);
                 const known = login === GITHUB_WORLD_USER || st.oauthGrants.some((g) => g.login === login) || st.orgMembers.some((m) => m.login === login) || st.collaborators.some((x) => x.login === login) || st.repos.some((r) => r.owner === login);
-                return known ? { __typename: 'User', login, name: null, id: `U_${login}` } : fail(`Could not resolve to a User with the login of '${login}'.`, 'NOT_FOUND');
+                return known ? { __typename: 'User', login, name: st.userProfiles[login.toLowerCase()]?.name ?? null, id: `U_${login}` } : fail(`Could not resolve to a User with the login of '${login}'.`, 'NOT_FOUND');
             },
             'Query.organization': (_s, args, c) => {
                 const org = state(c).orgs.find((o) => o.login === String(args.login ?? ''));

package/dist/src/semantics/shared.js

@@ -146,6 +146,6 @@ export const writer = (ctx) => (w) => put(ctx, w);
  *  the noreply address GitHub gives an account that keeps its email private. */
 export function identityOf(g) {
     const login = g.caller ?? 'octocat';
-    const profile = login === 'octocat' ? g.state().userProfile : undefined;
+    const profile = g.state().userProfiles[login.toLowerCase()];
     return { name: String(profile?.name ?? login), email: `${twinUserId(login)}+${login}@users.noreply.github.com` };
 }