@volter/twin-standard 1.0.149 → 1.0.150

package/dist/src/verdict.js

@@ -7,7 +7,7 @@
 export function attributionName(name) {
     if (name === undefined)
         return undefined;
-    if (/\bcx-|\bt_[0-9a-f]{8}|wt\/|\/root(?:\/|$|[: )])|\b(?:pane|session)[ -:]|[0-9a-f]{8}-[0-9a-f-]{27}|\b[0-9a-f]{16,64}\b/i.test(name))
+    if (/\bcx-|\bt_[0-9a-f]{8}|wt\/|\/root(?:\/|$|[: )])|\b(?:pane|session)[ :-]|[0-9a-f]{8}-[0-9a-f-]{27}|\b[0-9a-f]{16,64}\b/i.test(name))
         throw new Error('attribution must use an author name, not an execution identifier');
     return name;
 }

package/dist/src/walk/behavior-journey.d.ts

@@ -18,6 +18,12 @@ export type Failure = {
     beat: string;
     detail: string;
 };
+/** What a stored row keeps for the twin that no schema of the vendor's spec names, by path, in anything the World shows a
+ *  client: the pack's `_`-prefixed bookkeeping (GitHub's `_links` is the vendor's), and, in what no answer's SHAPE
+ *  reads (an event's delivery, a socket frame), the kernel's own `updatedAt`, which a raw row filtered on `_` alone
+ *  carries (Slack's message events once did). The kernel's `deleted` is not read there: vendors send their own
+ *  (Stripe's deleted customer's `deleted: true`). */
+export declare function leaked(v: unknown, vendorFields: Set<string>, at?: string, unshaped?: boolean): string[];
 /** What a caller that scores a walk observes around each step: the step, its resolved path and body,
  *  and (after) the answer and the failures the step produced. */
 export type StepHooks = {

package/dist/src/walk/behavior-journey.js

@@ -151,7 +151,7 @@ const claims = (keys, url) => {
  *  reads (an event's delivery, a socket frame), the kernel's own `updatedAt`, which a raw row filtered on `_` alone
  *  carries (Slack's message events once did). The kernel's `deleted` is not read there: vendors send their own
  *  (Stripe's deleted customer's `deleted: true`). */
-function leaked(v, vendorFields, at = '', unshaped = false) {
+export function leaked(v, vendorFields, at = '', unshaped = false) {
     if (Array.isArray(v))
         return v.flatMap((x, i) => leaked(x, vendorFields, `${at}[${i}]`, unshaped)).slice(0, 5);
     if (!v || typeof v !== 'object')
@@ -1172,13 +1172,15 @@ export async function walk(journey, root, collect, opts) {
                 let res;
                 if (deferred) {
                     pending.delete(step.await);
-                    try {
-                        res = await deferred.answer;
-                    }
-                    catch (error) {
-                        collect.push({ step: step.name, beat: 'PENDING', detail: String(error) });
+                    const got = await deferred.answer.then((a) => ({ a }), (error) => ({ error }));
+                    // a body the vendor broke off, as the collect expects (`breaks`): its words are the answer
+                    if ('error' in got) {
+                        if (step.breaks === undefined || !String(got.error).includes(step.breaks))
+                            collect.push({ step: step.name, beat: 'PENDING', detail: String(got.error) });
                         continue;
                     }
+                    // over a listener, which ends a broken stream as a short body, the ordinary checks hold the part that arrived
+                    res = got.a;
                 }
                 else
                     res = await send({ ...step, body, headers, ...(formed ? { formed } : {}) }, path);

package/dist/src/walk/journey-kit.d.ts

@@ -10,6 +10,8 @@ export type JourneyStep = {
     defer?: string;
     /** Collect a previously deferred request once, with all ordinary response checks. */
     await?: string;
+    /** A collect whose answer's body breaks off with these words (a stream the vendor ends in an error), not arriving whole. */
+    breaks?: string;
     body?: unknown;
     /** A body of raw bytes (a gzip'd package, an image, an audio file), base64 in the journey and sent decoded: a
      *  string body is sent as UTF-8, which no binary format survives. A step carries `body` or `bodyBase64`, never both. */

package/dist/src/walk/journey-kit.js

@@ -112,8 +112,9 @@ export function expectFailures(expect, body, captured, headers = {}, wireText) {
         if (e.contains !== undefined) {
             const want = fill(e.contains, captured);
             const text = typeof v === 'string' ? v : JSON.stringify(v ?? '');
+            // what it holds instead, its first characters, so a failure says what the twin answered
             if (!text.includes(want))
-                out.push(`${e.path || 'the answer'} does not contain ${JSON.stringify(want)}`);
+                out.push(`${e.path || 'the answer'} does not contain ${JSON.stringify(want)} (it begins ${JSON.stringify(text.replace(/\s+/g, ' ').slice(0, 160))})`);
         }
         // `notContains`: the value does not hold the text (a list that omits what the caller may not see)
         if (e.notContains !== undefined) {
@@ -337,7 +338,10 @@ export function fill(template, captured, graphqlDocument = false) {
     }
     // a doubled brace is the vendor's own template syntax ({{sample.output_text}} in an OpenAI grader), not a capture; a
     // capture's name starts with a letter, so a pattern's count (`[A-Za-z0-9]{40}` in an expectation) is no capture
-    return encoded.replace(/\{\{[^{}]*\}\}|\{([A-Za-z_][A-Za-z0-9_.]*)\}/g, (m, key, offset) => {
+    // `{literal:word}` is `{word}` as the vendor's page prints it (a Redis hash tag, `{queue}`), never a capture
+    return encoded.replace(/\{literal:([^{}]*)\}|\{\{[^{}]*\}\}|\{([A-Za-z_][A-Za-z0-9_.]*)\}/g, (m, literal, key, offset) => {
+        if (literal !== undefined)
+            return `{${literal}}`;
         if (selections.has(offset))
             return m;
         if (key === undefined)

package/dist/src/walk/rendered-scalar.d.ts

@@ -0,0 +1,3 @@
+export declare function renderedScalar(value: unknown, types: unknown[], enumerated: boolean): symbol | undefined;
+export declare function isRenderedScalar(value: unknown): boolean;
+export declare function matchesRenderedScalar(marker: unknown, value: unknown): boolean;

package/dist/src/walk/rendered-scalar.js

@@ -0,0 +1,23 @@
+/** Unfilled scalar type words in schema-rendered examples. Real values and enum words remain literal. */
+const BOOLEAN = Symbol('rendered boolean');
+const INTEGER = Symbol('rendered integer');
+const NUMBER = Symbol('rendered number');
+export function renderedScalar(value, types, enumerated) {
+    if (enumerated || typeof value !== 'string')
+        return undefined;
+    if (value === 'boolean' && types.includes('boolean'))
+        return BOOLEAN;
+    if (value === 'integer' && types.includes('integer'))
+        return INTEGER;
+    if (value === 'number' && types.includes('number'))
+        return NUMBER;
+    return undefined;
+}
+export function isRenderedScalar(value) { return value === BOOLEAN || value === INTEGER || value === NUMBER; }
+export function matchesRenderedScalar(marker, value) {
+    if (marker === BOOLEAN)
+        return typeof value === 'boolean';
+    if (marker === INTEGER)
+        return typeof value === 'bigint' || (typeof value === 'number' && Number.isInteger(value));
+    return marker === NUMBER && typeof value === 'number' && Number.isFinite(value);
+}

package/dist/src/walk/sse-example.js

@@ -1,6 +1,8 @@
 import { parseExactJson } from '@volter/world-core/exact-json';
 /** Match a published SDK-decoded SSE sample to a real HTTP frame; preserve non-SSE answers and mismatches. */
 export function sseExampleAnswer(example, answer, matches) {
+    if (typeof example === 'string' && typeof answer === 'string')
+        return streamSample(example, answer);
     if (typeof answer !== 'string' || !example || typeof example !== 'object')
         return answer;
     const wrapped = 'data' in example;
@@ -30,3 +32,46 @@ export function sseExampleAnswer(example, answer, matches) {
     const candidates = relevant.map((frame) => wrapped ? frame : frame.data);
     return candidates.find(matches) ?? candidates[0] ?? answer;
 }
+/** A stream's frames: each block's `event:` and joined `data:` lines, or a block that is JSON alone (a page printing the
+ *  chunks without their framing); `[DONE]`, an elision (`...`, `....`) and anything else not JSON are no frame. */
+function framesOf(text) {
+    const frames = [];
+    for (const block of text.replace(/\r\n/g, '\n').split(/\n\s*\n/)) {
+        const lines = block.split('\n').map((l) => l.trim()).filter(Boolean);
+        const framed = lines.some((l) => l.startsWith('data:'));
+        const data = framed ? lines.filter((l) => l.startsWith('data:')).map((l) => l.slice(5).trim()).join('\n') : lines.join('\n');
+        if (!data || data === '[DONE]' || /^\.{3,}$/.test(data))
+            continue;
+        const event = lines.find((l) => l.startsWith('event:'))?.slice(6).trim();
+        try {
+            frames.push({ data: parseExactJson(data), ...(event ? { event } : {}) });
+        }
+        catch { /* not a JSON frame */ }
+    }
+    return frames;
+}
+const kindOf = (v) => (v === null ? 'null' : Array.isArray(v) ? 'array' : typeof v);
+/** Whether an answer's frame holds a published frame's keys with the same kinds of value (a null published value admits
+ *  any), its type or object the same. */
+function holds(published, got) {
+    if (!published || typeof published !== 'object' || Array.isArray(published))
+        return kindOf(published) === kindOf(got) || published === null;
+    if (!got || typeof got !== 'object' || Array.isArray(got))
+        return false;
+    const p = published, g = got;
+    for (const key of ['type', 'object'])
+        if (typeof p[key] === 'string' && p[key] !== g[key])
+            return false;
+    return Object.entries(p).every(([k, v]) => k in g && (v === null || kindOf(v) === kindOf(g[k]) || (kindOf(v) === 'object' && holds(v, g[k]))));
+}
+/** A published stream printed as text (a page's sample of a stream, its middle elided): each frame it shows has a frame
+ *  of the answer holding it, the answer then standing for the sample; else the answer, unchanged, which the literal
+ *  comparison reports. */
+function streamSample(example, answer) {
+    const published = framesOf(example);
+    if (published.length < 2)
+        return answer;
+    const frames = framesOf(answer);
+    const held = published.every((p) => frames.some((f) => (!p.event || p.event === f.event) && holds(p.data, f.data)));
+    return held ? example : answer;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-standard",
-  "version": "1.0.149",
+  "version": "1.0.150",
   "description": "The Protocol 3 standard for Volter twin packs: the criteria a pack is graded by, the grader, the gate a pack repository and the twin catalog run on every change and submission, and the spec derivation the grade checks against. Pin a version: every place a pack is judged judges by that standard.",
   "keywords": [
     "twin",
@@ -75,7 +75,7 @@
     "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.156",
+    "@volter/world-core": "3.0.157",
     "@volter/world-runtime": "*",
     "playwright": "^1.63.0"
   },

package/src/assessment.ts

@@ -93,5 +93,6 @@ export async function assessPack(packDir: string, options: AssessmentOptions = {
   try { consumer = options.consumer ? await runConsumerWorkflow(packDir, options.consumer) : { measured: false, passed: false, failures: ['Installed customer workflow was not prepared'] }; }
   catch (error) { consumer = { measured: false, passed: false, failures: [(error as Error).message] }; }
   const ready = gates.length > 0 && gates.every((gate) => !gate.failures.length) && !quick.failures.length && replayEqual && conform !== null && conform.length > 0 && conform.every((result) => !result.failures.length) && consumer.measured && consumer.passed && (!options.browser || !httpOnly || browser.measured === true && (browser.failures as unknown[]).length === 0 && (browser.replay as { equal: boolean }).equal);
-  return { schemaVersion: 1, vendor, package: manifest.name, version: manifest.version, ready, gates: gates.map((gate) => ({ ...gate, unit: gate.unit === packDir ? vendor : `${vendor}/${gate.unit.slice(packDir.length + 1)}` })), quick, browser, conformance: conform, consumer };
+  // the artifact assessed, by the integrity its prepared consumer verified the installed candidate against (consumer.ts)
+  return { schemaVersion: 1, vendor, package: manifest.name, version: manifest.version, ...((consumer as { integrity?: string }).integrity ? { integrity: (consumer as { integrity?: string }).integrity } : {}), ready, gates: gates.map((gate) => ({ ...gate, unit: gate.unit === packDir ? vendor : `${vendor}/${gate.unit.slice(packDir.length + 1)}` })), quick, browser, conformance: conform, consumer };
 }

package/src/cli.ts

@@ -13,6 +13,12 @@
 //                                                                  the pack served and read as an application and the
 //                                                                  catalog meet it (conformance.ts): a checkout, or a
 //                                                                  published version as the catalog admits it; or exit 1
+//   twin-standard walk <vendor> [--write] [--report <file>]        the journey test, from the pack repository's root: the
+//                                                                  life walked on a fresh World (twice, the same), its
+//                                                                  coverage and the published examples (tools/score-pack.ts)
+//   twin-standard examples <vendor> [--sweep]                      the vendor's published examples replayed (tools/vendor-examples.ts)
+//   twin-standard coverage <vendor> [--write | --out <file>]       the code and state logic the walks reach (tools/life-coverage.ts)
+//   twin-standard judge-brief <vendor> --authors <names>           what an independent judge reads and writes (tools/judge-brief.ts)
 //   twin-standard --version                                        the package's version and each standard's
 import { existsSync, readFileSync } from 'node:fs';
 import { relative, resolve } from 'node:path';
@@ -24,7 +30,7 @@ import { gatePublished } from './published.ts';
 
 const [command, ...args] = process.argv.slice(2);
 const usage = (): never => {
-  console.error('usage: twin-standard gate <repo> [units…] | gate-published <name>@<version>… [--registry <url>] | grade <unit>… [--static] [--form] | derive <unit> [--out <dir>] | read-page <url> [--raw] | check-sources <unit> [--recheck] | conform <pack dir> | <name>@<version> [--registry <url>] | create <dir> --init <vendor> --package <@scope/name> | create <unit> --index [--building] | facts <pack dir> [--out <file>] | prepare-consumer <pack dir> --app <new dir> --cli <volter executable> --integrity <sha512> --out <json> [--candidate <tgz>] | walk-consumer <pack dir> --prepared-consumer <json> [--out <file>] | assess <pack dir> --prepared-consumer <json> [--browser] [--out <file>] | --version');
+  console.error('usage: twin-standard gate <repo> [units…] | gate-published <name>@<version>… [--registry <url>] | grade <unit>… [--static] [--form] | derive <unit> [--out <dir>] | read-page <url> [--raw] | check-sources <unit> [--recheck] | conform <pack dir> | <name>@<version> [--registry <url>] | create <dir> --init <vendor> --package <@scope/name> | create <unit> --index [--building] | facts <pack dir> [--out <file>] | prepare-consumer <pack dir> --app <new dir> --cli <volter executable> --integrity <sha512> --out <json> [--candidate <tgz>] | walk-consumer <pack dir> --prepared-consumer <json> [--out <file>] | assess <pack dir> --prepared-consumer <json> [--browser] [--out <file>] | walk <vendor> [--write] [--report <file>] | examples <vendor> [--sweep] | coverage <vendor> [--write | --out <file>] | judge-brief <vendor> --authors <names> | --version');
   process.exit(2);
 };
 
@@ -133,6 +139,13 @@ if (command === '--version') {
   mkdirSync(dirname(out), { recursive: true });
   writeFileSync(out, renderPackFacts(facts));
   console.log(out);
+} else if (command === 'walk' || command === 'examples' || command === 'coverage' || command === 'judge-brief') {
+  // the contributor's journey tools, run from the pack repository's root (tools/packs-root.ts), each a script over
+  // process.argv whose first argument is the vendor
+  if (!args[0] || args[0].startsWith('-')) usage();
+  const tool = { walk: 'score-pack', examples: 'vendor-examples', coverage: 'life-coverage', 'judge-brief': 'judge-brief' }[command];
+  process.argv = [process.argv[0]!, process.argv[1]!, ...args];
+  await import((await import('./tools/packs-root.ts')).toolPath(tool));
 } else if (command === 'derive') {
   if (!args[0]) usage();
   // the derivation is a script over process.argv: it reads the unit from its first argument
@@ -157,7 +170,7 @@ if (command === '--version') {
   const published = target.endsWith('.tgz') || (!existsSync(target) && /^@?[^@]+@[^@]+$/.test(target));
   const results = published
     ? await (await import('./published.ts')).conformPublished(target, at >= 0 ? { registry: args[at + 1]! } : {})
-    : await (await import('./conformance.ts')).conformance(target);
+    : await (await import('./conformance.ts')).conformance(target, { onCheck: (id) => console.error(`  … ${id} (${new Date().toISOString().slice(11, 19)})`) });
   for (const r of results) {
     console.log(`${r.failures.length ? '✗' : '✓'} ${r.id.padEnd(15)} ${r.asks}${r.note ? `  (${r.note})` : ''}`);
     for (const f of r.failures) console.log(`    ${f}`);

package/src/clients/harness.ts

@@ -106,13 +106,15 @@ export function servedHttpFetch(port: number): typeof fetch {
 }
 
 /** The context for a pack reached at `port` of this machine (the World's proxy in front of it). */
-export function clientContext(port: number, host: string, env: Record<string, string>, scenarioPath: string): ClientContext {
+/** `raw`: a raw protocol's served port (SMTP's listener), which a connection reaches directly, as a World passes a raw TCP
+ *  connection through untouched; the proxy speaks HTTP only. */
+export function clientContext(port: number, host: string, env: Record<string, string>, scenarioPath: string, raw?: number): ClientContext {
   const agent = new (class extends HttpsAgent {
     createConnection(): Socket { return connect(port, '127.0.0.1'); }
   })({ keepAlive: false });
   return {
     host, env, fetch: servedHttpFetch(port), agent,
-    connect: () => connect(port, '127.0.0.1'),
+    connect: () => connect(raw ?? port, '127.0.0.1'),
     scenario: (doc) => writeFileSync(scenarioPath, JSON.stringify(doc)),
   };
 }

package/src/clients/jira.ts

@@ -0,0 +1,73 @@
+// jira.js 5.4.0, unmodified (Twin's on-call agent's client: cookbook/on-call-agent/agent.mjs), as that agent constructs
+// it: a Version3Client on the site's URL with Basic authentication by an account's email and API token, its axios
+// requests through the World's routed HTTPS agent. The site, its admin and the token are made at the pack's doors, as a
+// person makes them at Atlassian's sign-up and account console.
+import type { ClientCase, ClientContext } from './harness.ts';
+
+const README = 'https://www.npmjs.com/package/jira.js/v/5.4.0';
+const CREATE = 'https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-issues/#api-rest-api-3-issue-post';
+const ADF = 'https://developer.atlassian.com/cloud/jira/platform/apis/document/structure/';
+
+/** A site named `slug`, its admin, the admin's API token and a project OPS led by them; the client on the site's URL. */
+async function site(c: ClientContext, slug: string, apiToken?: string) {
+  const door = async (path: string, body: unknown) => {
+    const answer = await c.fetch(`https://${c.host}${path}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+    if (answer.status !== 201) throw new Error(`${path} answered ${answer.status}`);
+    return (await answer.json()) as Record<string, string>;
+  };
+  const email = `admin@${slug}.example`;
+  const made = await door('/_twin/sites', { name: slug, admin: { name: 'Admin', email, password: 'sdk-case-2026' } });
+  const token = apiToken ?? (await door('/_twin/api-token', { site: slug, email, password: 'sdk-case-2026' })).apiToken!;
+  const { Version3Client } = await import('jira.js');
+  const jira = new Version3Client({ host: `https://${slug}.atlassian.net`, authentication: { basic: { email, apiToken: token } }, baseRequestConfig: { httpsAgent: c.agent } });
+  return { jira, admin: made.admin! };
+}
+
+export const cases: ClientCase[] = [
+  {
+    id: 'create-issue-string-description',
+    asks: "an issue filed as the on-call agent files it, its description a plain string the client sends as an ADF document, answers its id, key and self, and reads back with that text",
+    source: `${CREATE} "Creates an issue or, where the option to create subtasks is enabled in Jira, a subtask."`,
+    async run(c) {
+      const { jira, admin } = await site(c, 'sdk-file');
+      await jira.projects.createProject({ key: 'OPS', name: 'Operations', projectTypeKey: 'software', leadAccountId: admin });
+      const filed = await jira.issues.createIssue({ fields: { project: { key: 'OPS' }, issuetype: { name: 'Task' }, summary: 'acme/web#1: checkout fails', description: 'SEVERITY: high — checkout fails' } });
+      const failures: string[] = [];
+      if (!/^OPS-\d+$/.test(String(filed.key)) || !filed.id || !String(filed.self).includes(`/rest/api/3/issue/${filed.id}`)) failures.push(`createIssue answered ${JSON.stringify(filed)}`);
+      const read = await jira.issues.getIssue({ issueIdOrKey: String(filed.key), fields: ['summary', 'description'] });
+      const text = JSON.stringify(read.fields.description ?? null);
+      if (read.fields.summary !== 'acme/web#1: checkout fails') failures.push(`the issue reads back summary ${JSON.stringify(read.fields.summary)}`);
+      if (!text.includes('"type":"doc"') || !text.includes('SEVERITY: high — checkout fails')) failures.push(`the description reads back ${text.slice(0, 160)}, not the ADF document of the text sent`);
+      return failures;
+    },
+  },
+  {
+    id: 'adf-document-shape',
+    asks: 'a description read back is an ADF document: type doc, version 1, its paragraph holding the text node',
+    source: `${ADF} "Atlassian Document Format (ADF) represents rich text stored in Atlassian products."`,
+    async run(c) {
+      const { jira, admin } = await site(c, 'sdk-adf');
+      await jira.projects.createProject({ key: 'OPS', name: 'Operations', projectTypeKey: 'software', leadAccountId: admin });
+      const filed = await jira.issues.createIssue({ fields: { project: { key: 'OPS' }, issuetype: { name: 'Task' }, summary: 'shape', description: 'one line' } });
+      const doc = (await jira.issues.getIssue({ issueIdOrKey: String(filed.key), fields: ['description'] })).fields.description as { type?: string; version?: number; content?: Array<{ type?: string; content?: Array<{ type?: string; text?: string }> }> } | undefined;
+      return doc?.type === 'doc' && doc.version === 1 && doc.content?.[0]?.type === 'paragraph' && doc.content[0].content?.[0]?.type === 'text' && doc.content[0].content[0].text === 'one line'
+        ? [] : [`the description is ${JSON.stringify(doc).slice(0, 200)}`];
+    },
+  },
+  {
+    id: 'wrong-token-http-exception',
+    asks: 'a request with an API token the account never made is refused, and the client throws its HttpException carrying the status',
+    source: `${README} "\`HttpException\`: Server responded with an error (includes parsed error details)"`,
+    async run(c) {
+      const { HttpException } = await import('jira.js');
+      const { jira } = await site(c, 'sdk-refused', 'ATATT-not-a-token-this-account-made');
+      try {
+        await jira.projects.searchProjects({ maxResults: 50 });
+        return ['the made-up token was accepted'];
+      } catch (error) {
+        if (!(error instanceof HttpException)) return [`the refusal is not an HttpException: ${String(error).slice(0, 160)}`];
+        return error.status === 401 ? [] : [`the refusal's status is ${error.status}, not 401`];
+      }
+    },
+  },
+];

package/src/clients/polar.ts

@@ -0,0 +1,73 @@
+// Polar's TypeScript SDK, unmodified (@polar-sh/sdk 0.49, Twin's billing app: apps/billing/src/polar.ts), with the
+// Organization Access Token the World's credential door issues. The SDK validates every answer against its own models,
+// so a case that reads one back has held the answer's shape too. It sends through the global fetch, so the World's
+// routed fetch is set before it is made.
+import type { ClientCase, ClientContext } from './harness.ts';
+
+const INGEST = 'https://polar.sh/docs/api-reference/events/ingest';
+const STATE = 'https://polar.sh/docs/api-reference/customers/state-external';
+const PRODUCTS = 'https://polar.sh/docs/api-reference/products/create';
+
+async function client(c: ClientContext) {
+  globalThis.fetch = c.fetch;
+  const { Polar } = await import('@polar-sh/sdk');
+  return new Polar({ accessToken: c.env.POLAR_ACCESS_TOKEN, server: 'production' });
+}
+
+export const cases: ClientCase[] = [
+  {
+    id: 'catalog-bootstrap',
+    asks: "the billing app's boot: a meter made by its filter and aggregation, and a monthly product priced fixed and per metered unit with a trial, each read back by name in the SDK's own models",
+    source: `${PRODUCTS} "plus any number of metered prices"`,
+    async run(c) {
+      const polar = await client(c);
+      const meter = await polar.meters.create({ name: 'case_world_hours', filter: { conjunction: 'and', clauses: [{ property: 'name', operator: 'eq', value: 'world.hour' }] }, aggregation: { func: 'sum', property: 'units' } });
+      const product = await polar.products.create({
+        name: 'Case Team', recurringInterval: 'month', description: 'A case plan',
+        prices: [{ amountType: 'fixed', priceAmount: 4900, priceCurrency: 'usd' }, { amountType: 'metered_unit', unitAmount: '2', meterId: meter.id }],
+        trialInterval: 'day', trialIntervalCount: 14,
+      });
+      const failures: string[] = [];
+      const meters = await polar.meters.list({ limit: 100 });
+      if (!meters.result.items.some((m) => m.id === meter.id && m.name === 'case_world_hours')) failures.push('the made meter is not listed by its name');
+      const products = await polar.products.list({ limit: 100 });
+      const listed = products.result.items.find((p) => p.id === product.id);
+      if (!listed || listed.name !== 'Case Team' || listed.isArchived) failures.push(`the made product lists as ${JSON.stringify(listed && { name: listed.name, isArchived: listed.isArchived })}`);
+      if (product.prices.length !== 2) failures.push(`the product holds ${product.prices.length} prices, not its fixed and metered two`);
+      if (product.trialInterval !== 'day' || product.trialIntervalCount !== 14) failures.push(`the product's trial is ${String(product.trialIntervalCount)} ${String(product.trialInterval)}`);
+      return failures;
+    },
+  },
+  {
+    id: 'unknown-customer-state-not-found',
+    asks: "an organization with no customer reads as the SDK's ResourceNotFound (404), which the billing app takes as Free",
+    source: `${STATE} "Customer not found."`,
+    async run(c) {
+      const polar = await client(c);
+      const { ResourceNotFound } = await import('@polar-sh/sdk/models/errors/resourcenotfound.js');
+      try {
+        await polar.customers.getStateExternal({ externalId: 'org_never_a_customer' });
+        return ['an unknown external id read as a customer'];
+      } catch (error) {
+        return error instanceof ResourceNotFound ? [] : [`the refusal is not ResourceNotFound: ${String(error).slice(0, 160)}`];
+      }
+    },
+  },
+  {
+    id: 'ingest-deduplicates-by-external-id',
+    asks: 'an event sent again with the same external_id (a tick retried after a timeout) is skipped as a duplicate, not counted twice',
+    source: `${INGEST} "Number of duplicate events skipped."`,
+    async run(c) {
+      const polar = await client(c);
+      const customer = await polar.customers.create({ email: 'ops@case-ingest.example', externalId: 'org_case_ingest' });
+      const event = { name: 'world.hour', externalCustomerId: 'org_case_ingest', externalId: 'tick-2026-01-14T10', metadata: { units: 1 } };
+      const first = await polar.events.ingest({ events: [event] });
+      const again = await polar.events.ingest({ events: [event] });
+      const failures: string[] = [];
+      if (first.inserted !== 1 || first.duplicates !== 0) failures.push(`the first send answered ${JSON.stringify(first)}`);
+      if (again.inserted !== 0 || again.duplicates !== 1) failures.push(`the retried send answered ${JSON.stringify(again)}, not one duplicate skipped`);
+      if (!customer.id) failures.push('the customer was made with no id');
+      return failures;
+    },
+  },
+];

package/src/clients/resend.ts

@@ -56,4 +56,36 @@ export const cases: ClientCase[] = [
       return answer.data === null && answer.error?.statusCode === 422 && answer.error?.name === 'missing_required_field' ? [] : [`missing sender returned ${JSON.stringify(answer)}`];
     },
   },
+  {
+    id: 'unverified-domain-validation-error',
+    asks: 'a send from a domain the team never verified comes back as the SDK error validation_error (403), with no data',
+    source: `${ERRORS} "To send emails to other recipients, please verify a domain at resend.com/domains, and change the \`from\` address to an email using this domain."`,
+    async run(c) {
+      const resend = client(c);
+      const sent = await resend.emails.send({ from: 'Someone <someone@never-verified.example>', to: ['client@example.org'], subject: 'Not from a verified domain', text: 'Refused.' });
+      const failures: string[] = [];
+      if (sent.data !== null) failures.push(`the send answered data ${JSON.stringify(sent.data)}`);
+      const error = sent.error as { name?: string; statusCode?: number | null } | null;
+      if (error?.name !== 'validation_error') failures.push(`the error is ${JSON.stringify(error)}, not validation_error`);
+      else if (error.statusCode !== 403) failures.push(`the validation_error's status is ${String(error.statusCode)}, not 403`);
+      return failures;
+    },
+  },
+  {
+    id: 'scheduled-send-waits',
+    asks: "a send scheduled for later (the SDK's scheduledAt, sent as scheduled_at) waits: it reads back scheduled, at its time",
+    source: `${SEND} "Schedule email to be sent later."`,
+    async run(c) {
+      const resend = client(c);
+      const at = '2030-01-01T08:00:00.000Z';
+      const sent = await resend.emails.send({ from: 'Acme <onboarding@resend.dev>', to: ['owner@world.test'], subject: 'Later', text: 'In good time.', scheduledAt: at });
+      if (sent.error || !sent.data?.id) return [`the send answered ${JSON.stringify(sent).slice(0, 200)}`];
+      const read = await resend.emails.get(sent.data.id);
+      const email = read.data as { last_event?: string; scheduled_at?: string | null } | null;
+      const failures: string[] = [];
+      if (email?.last_event !== 'scheduled') failures.push(`the scheduled email's last_event is ${String(email?.last_event)}`);
+      if (email?.scheduled_at === undefined || email.scheduled_at === null || Date.parse(email.scheduled_at) !== Date.parse(at)) failures.push(`it reads back scheduled_at ${String(email?.scheduled_at)}`);
+      return failures;
+    },
+  },
 ];

package/src/clients/run.ts

@@ -7,7 +7,7 @@ import { extname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { clientContext, worldProxy, type ClientCase } from './harness.ts';
 
-const job = JSON.parse(readFileSync(process.argv[2]!, 'utf8')) as { vendor: string; port: number; host: string; env: Record<string, string>; scenarioPath: string; packFacts: string };
+const job = JSON.parse(readFileSync(process.argv[2]!, 'utf8')) as { vendor: string; port: number; host: string; env: Record<string, string>; scenarioPath: string; packFacts: string; raw?: boolean };
 const { cases } = (await import(`./${job.vendor}${extname(fileURLToPath(import.meta.url))}`)) as { cases: ClientCase[] };
 if (!Array.isArray(cases) || cases.length === 0) throw new Error(`${job.vendor} client module declares no cases; there is no SDK execution evidence`);
 // every connection a case makes goes through the World's proxy, as an application's does in a World
@@ -19,7 +19,7 @@ require('@volter/world-core/pack-facts').extendPackFacts([job.packFacts]);
 const facts = JSON.parse(readFileSync(job.packFacts, 'utf8')).packs[job.vendor];
 const keys: string[] = [...new Set<string>((facts.hosts ?? []).map((rule: { key?: string }) => rule.key ?? job.vendor))];
 require('@volter/world-core/inject').install(Object.fromEntries(keys.map((key) => [key, `http://127.0.0.1:${proxy}`])));
-const context = clientContext(proxy, job.host, job.env, job.scenarioPath);
+const context = clientContext(proxy, job.host, job.env, job.scenarioPath, job.raw ? job.port : undefined);
 for (const c of cases) {
   const failures = await Promise.race([
     c.run(context).catch((e: Error) => [`the case threw: ${e.message}`]),

package/src/clients/sentry.ts

@@ -22,7 +22,6 @@ async function sdkOf(name: string): Promise<any> {
 const pins = [
   ['rallly', '@sentry/node', '10.38.0'],
   ['twenty', 'sentry-node-twenty', '10.73.0'],
-  ['postiz', 'sentry-node-postiz', '10.56.0'],
   ['cal-api', 'sentry-node-cal', '9.46.0'],
   ['cal-web', 'sentry-node-cal-web', '10.33.0'],
 ] as const;
@@ -67,7 +66,7 @@ export const cases: ClientCase[] = pins.map(([application, name, version]) => ({
   },
 }));
 
-for (const [name, version] of [['@sentry/browser', '10.38.0'], ['sentry-browser-twenty', '10.59.0'], ['sentry-browser-postiz', '10.56.0']] as const) cases.push({
+for (const [name, version] of [['@sentry/browser', '10.38.0'], ['sentry-browser-twenty', '10.59.0']] as const) cases.push({
   id: 'browser-' + version + '-dsn-query-auth-and-session-envelope',
   asks: 'the browser fetch transport uses DSN query authentication and flushes event and session envelopes',
   source: `https://unpkg.com/@sentry/core@${version}/build/esm/api.js "sentry_key: publicKey"`,
@@ -133,26 +132,3 @@ cases.push({
 });
 
 
-cases.push({
-  id: 'postiz-feedback-attribution',
-  asks: 'captureFeedback preserves the widget message, explicit name/email, associated event and scoped user',
-  source: 'https://unpkg.com/@sentry/core@10.56.0/build/esm/feedback.js "associated_event_id: associatedEventId"',
-  async run(c) {
-    const sdk = await sdkOf('sentry-browser-postiz');
-    const client = new sdk.BrowserClient({ dsn: c.env.SENTRY_DSN, integrations: [], stackParser: sdk.defaultStackParser,
-      transport: (options: any) => sdk.createTransport(options, async (request: { body: string | Uint8Array }) => {
-        const answer = await c.fetch(options.url, { method: 'POST', body: request.body as BodyInit });
-        return { statusCode: answer.status, headers: {} };
-      }) });
-    let id = '';
-    sdk.withScope((scope: any) => {
-      scope.setClient(client); scope.setUser({ id: 'feedback-author' });
-      id = sdk.captureFeedback({ message: 'The scheduling button is hard to find', name: 'Priya', email: 'priya@harbourline.test', associatedEventId: '00000000000000000000000000000002' }, {}, scope);
-    });
-    const drained = await client.flush(10_000);
-    const event = await read(c, id, await token(c));
-    await client.close(10_000);
-    const feedback = event.contexts?.feedback;
-    return drained && event.type === 'feedback' && event.user?.id === 'feedback-author' && feedback?.name === 'Priya' && feedback?.contact_email === 'priya@harbourline.test' && feedback?.associated_event_id === '00000000000000000000000000000002' ? [] : ['feedback attribution or associated event was lost'];
-  },
-});

package/src/clients/smtp.ts

@@ -0,0 +1,49 @@
+// Nodemailer 10, unmodified, as Dub, Rallly, Cal.com, Twenty and LibreChat send their mail: its SMTP transport, plain
+// on the relay's port, given the World's TCP connection through its getSocket hook (SMTP is a raw protocol: the case
+// names a stand-in relay host the connection never resolves). The relay's policy at boot asks no authentication.
+import type { ClientCase, ClientContext } from './harness.ts';
+
+const RFC5321 = 'https://www.rfc-editor.org/rfc/rfc5321';
+
+async function transport(c: ClientContext) {
+  const nodemailer = (await import('nodemailer')).default;
+  return nodemailer.createTransport({
+    host: c.host, port: 25, secure: false, ignoreTLS: true,
+    getSocket: (_options: unknown, callback: (error: Error | null, socket?: { connection: unknown }) => void) => callback(null, { connection: c.connect() }),
+  } as never);
+}
+
+export const cases: ClientCase[] = [
+  {
+    id: 'verify-greets',
+    asks: "nodemailer's verify opens the session, greets with EHLO and quits: the relay answers it as an SMTP server",
+    source: `${RFC5321} "These commands are used to identify the SMTP client to the SMTP server."`,
+    async run(c) {
+      const t = await transport(c);
+      try {
+        return (await t.verify()) === true ? [] : ['verify resolved without true'];
+      } catch (error) {
+        return [`verify failed: ${String(error).slice(0, 200)}`];
+      } finally { t.close(); }
+    },
+  },
+  {
+    id: 'transaction-to-two-recipients',
+    asks: 'a message with text and HTML to two recipients runs MAIL, a RCPT for each, then DATA: both accepted, none rejected, the data answered 250',
+    source: `${RFC5321} "Once started, a mail transaction consists of a transaction beginning command, one or more RCPT commands, and a DATA command, in that order."`,
+    async run(c) {
+      const t = await transport(c);
+      try {
+        const info = await t.sendMail({ from: 'Polls <polls@case.example>', to: ['an@case.example', 'bo@case.example'], subject: 'Pick a date', text: 'Please pick a date.', html: '<p>Please pick a date.</p>' }) as { accepted: string[]; rejected: string[]; response: string; messageId: string };
+        const failures: string[] = [];
+        if (JSON.stringify([...info.accepted].sort()) !== JSON.stringify(['an@case.example', 'bo@case.example'])) failures.push(`accepted ${JSON.stringify(info.accepted)}`);
+        if (info.rejected.length) failures.push(`rejected ${JSON.stringify(info.rejected)}`);
+        if (!info.response.startsWith('250')) failures.push(`the data was answered ${info.response}`);
+        if (!info.messageId) failures.push('no message id');
+        return failures;
+      } catch (error) {
+        return [`the send failed: ${String(error).slice(0, 200)}`];
+      } finally { t.close(); }
+    },
+  },
+];

package/src/clients/stripe.ts

@@ -1,4 +1,4 @@
-// Stripe's own client (stripe-node), driving the stripe pack as its applications do (Cal.com, Dub, Postiz, Rallly and
+// Stripe's own client (stripe-node), driving the stripe pack as its applications do (Cal.com, Dub, Rallly and
 // Twenty call it): an endpoint registered through the API and the event Stripe sends it verified by constructEvent, as an
 // application's webhook handler verifies it; a customer list read page by page by the client's auto-pagination; a retry
 // sent with its idempotency key; the error a missing object raises; and the customer portal a billing page opens.

package/src/clients/volteridentity.ts

@@ -1,9 +1,10 @@
 // @volter/identity 0.4.1, as Volter Harness uses it; discovery and token verification are also the APIs Open Autonomy
-// uses in 0.1.0. These cases are owned by conformance and are not run during pack authoring.
+// uses in 0.1.0. These cases are owned by conformance and are not run during pack authoring. They import nothing of the
+// kernel: the runner is Node's own type stripping, which the kernel's parameter properties do not pass.
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { digest } from '@volter/world-core';
+import { createHash } from 'node:crypto';
 import { resolveIdentity, verifyIdentityToken, tokenFor, readSharedSignIn, SHARED_CLIENTS } from '@volter/identity';
 import type { ClientCase, ClientContext } from './harness.ts';
 
@@ -36,7 +37,7 @@ async function setup(c: ClientContext, name: string, shared = false): Promise<{
     await send(c, `/admin/clients/${registered.client_id}/resources`, { resource: 'https://teams.sdk.example' }, operator);
   }
   const verifier = 'official-sdk-case-verifier-with-enough-entropy-for-s256';
-  const query = new URLSearchParams({ client_id: registered.client_id, redirect_uri: callback, response_type: 'code', scope: 'openid profile email offline_access', code_challenge: digest('sha256', verifier, 'base64url'), code_challenge_method: 'S256' });
+  const query = new URLSearchParams({ client_id: registered.client_id, redirect_uri: callback, response_type: 'code', scope: 'openid profile email offline_access', code_challenge: createHash('sha256').update(verifier).digest('base64url'), code_challenge_method: 'S256' });
   const authorized = await send(c, `/api/auth/oauth2/authorize?${query}`, undefined, { cookie });
   const code = new URL(authorized.headers.get('location')!).searchParams.get('code')!;
   const form = new URLSearchParams({ client_id: registered.client_id, redirect_uri: callback, grant_type: 'authorization_code', code, code_verifier: verifier, ...(registered.client_secret ? { client_secret: registered.client_secret } : {}) });