@volter/twin-standard 1.0.149 → 1.0.151

package/dist/src/clients/resend.js

@@ -58,4 +58,42 @@ export const cases = [
             return answer.data === null && answer.error?.statusCode === 422 && answer.error?.name === 'missing_required_field' ? [] : [`missing sender returned ${JSON.stringify(answer)}`];
         },
     },
+    {
+        id: 'unverified-domain-validation-error',
+        asks: 'a send from a domain the team never verified comes back as the SDK error validation_error (403), with no data',
+        source: `${ERRORS} "To send emails to other recipients, please verify a domain at resend.com/domains, and change the \`from\` address to an email using this domain."`,
+        async run(c) {
+            const resend = client(c);
+            const sent = await resend.emails.send({ from: 'Someone <someone@never-verified.example>', to: ['client@example.org'], subject: 'Not from a verified domain', text: 'Refused.' });
+            const failures = [];
+            if (sent.data !== null)
+                failures.push(`the send answered data ${JSON.stringify(sent.data)}`);
+            const error = sent.error;
+            if (error?.name !== 'validation_error')
+                failures.push(`the error is ${JSON.stringify(error)}, not validation_error`);
+            else if (error.statusCode !== 403)
+                failures.push(`the validation_error's status is ${String(error.statusCode)}, not 403`);
+            return failures;
+        },
+    },
+    {
+        id: 'scheduled-send-waits',
+        asks: "a send scheduled for later (the SDK's scheduledAt, sent as scheduled_at) waits: it reads back scheduled, at its time",
+        source: `${SEND} "Schedule email to be sent later."`,
+        async run(c) {
+            const resend = client(c);
+            const at = '2030-01-01T08:00:00.000Z';
+            const sent = await resend.emails.send({ from: 'Acme <onboarding@resend.dev>', to: ['owner@world.test'], subject: 'Later', text: 'In good time.', scheduledAt: at });
+            if (sent.error || !sent.data?.id)
+                return [`the send answered ${JSON.stringify(sent).slice(0, 200)}`];
+            const read = await resend.emails.get(sent.data.id);
+            const email = read.data;
+            const failures = [];
+            if (email?.last_event !== 'scheduled')
+                failures.push(`the scheduled email's last_event is ${String(email?.last_event)}`);
+            if (email?.scheduled_at === undefined || email.scheduled_at === null || Date.parse(email.scheduled_at) !== Date.parse(at))
+                failures.push(`it reads back scheduled_at ${String(email?.scheduled_at)}`);
+            return failures;
+        },
+    },
 ];

package/dist/src/clients/run.js

@@ -27,7 +27,7 @@ require('@volter/world-core/pack-facts').extendPackFacts([job.packFacts]);
 const facts = JSON.parse(readFileSync(job.packFacts, 'utf8')).packs[job.vendor];
 const keys = [...new Set((facts.hosts ?? []).map((rule) => rule.key ?? job.vendor))];
 require('@volter/world-core/inject').install(Object.fromEntries(keys.map((key) => [key, `http://127.0.0.1:${proxy}`])));
-const context = clientContext(proxy, job.host, job.env, job.scenarioPath);
+const context = clientContext(proxy, job.host, job.env, job.scenarioPath, job.raw ? job.port : undefined);
 for (const c of cases) {
     const failures = await Promise.race([
         c.run(context).catch((e) => [`the case threw: ${e.message}`]),

package/dist/src/clients/sentry.js

@@ -28,7 +28,6 @@ async function sdkOf(name) {
 const pins = [
     ['rallly', '@sentry/node', '10.38.0'],
     ['twenty', 'sentry-node-twenty', '10.73.0'],
-    ['postiz', 'sentry-node-postiz', '10.56.0'],
     ['cal-api', 'sentry-node-cal', '9.46.0'],
     ['cal-web', 'sentry-node-cal-web', '10.33.0'],
 ];
@@ -76,7 +75,7 @@ export const cases = pins.map(([application, name, version]) => ({
         return failures;
     },
 }));
-for (const [name, version] of [['@sentry/browser', '10.38.0'], ['sentry-browser-twenty', '10.59.0'], ['sentry-browser-postiz', '10.56.0']])
+for (const [name, version] of [['@sentry/browser', '10.38.0'], ['sentry-browser-twenty', '10.59.0']])
     cases.push({
         id: 'browser-' + version + '-dsn-query-auth-and-session-envelope',
         asks: 'the browser fetch transport uses DSN query authentication and flushes event and session envelopes',
@@ -142,27 +141,3 @@ cases.push({
         return drained && attempts === 2 && dropped.includes('ratelimit_backoff') ? [] : ['transport retried 503, failed to drain, or sent a rate-limited event'];
     },
 });
-cases.push({
-    id: 'postiz-feedback-attribution',
-    asks: 'captureFeedback preserves the widget message, explicit name/email, associated event and scoped user',
-    source: 'https://unpkg.com/@sentry/core@10.56.0/build/esm/feedback.js "associated_event_id: associatedEventId"',
-    async run(c) {
-        const sdk = await sdkOf('sentry-browser-postiz');
-        const client = new sdk.BrowserClient({ dsn: c.env.SENTRY_DSN, integrations: [], stackParser: sdk.defaultStackParser,
-            transport: (options) => sdk.createTransport(options, async (request) => {
-                const answer = await c.fetch(options.url, { method: 'POST', body: request.body });
-                return { statusCode: answer.status, headers: {} };
-            }) });
-        let id = '';
-        sdk.withScope((scope) => {
-            scope.setClient(client);
-            scope.setUser({ id: 'feedback-author' });
-            id = sdk.captureFeedback({ message: 'The scheduling button is hard to find', name: 'Priya', email: 'priya@harbourline.test', associatedEventId: '00000000000000000000000000000002' }, {}, scope);
-        });
-        const drained = await client.flush(10_000);
-        const event = await read(c, id, await token(c));
-        await client.close(10_000);
-        const feedback = event.contexts?.feedback;
-        return drained && event.type === 'feedback' && event.user?.id === 'feedback-author' && feedback?.name === 'Priya' && feedback?.contact_email === 'priya@harbourline.test' && feedback?.associated_event_id === '00000000000000000000000000000002' ? [] : ['feedback attribution or associated event was lost'];
-    },
-});

package/dist/src/clients/smtp.d.ts

@@ -0,0 +1,2 @@
+import type { ClientCase } from './harness.js';
+export declare const cases: ClientCase[];

package/dist/src/clients/smtp.js

@@ -0,0 +1,54 @@
+const RFC5321 = 'https://www.rfc-editor.org/rfc/rfc5321';
+async function transport(c) {
+    const nodemailer = (await import('nodemailer')).default;
+    return nodemailer.createTransport({
+        host: c.host, port: 25, secure: false, ignoreTLS: true,
+        getSocket: (_options, callback) => callback(null, { connection: c.connect() }),
+    });
+}
+export const cases = [
+    {
+        id: 'verify-greets',
+        asks: "nodemailer's verify opens the session, greets with EHLO and quits: the relay answers it as an SMTP server",
+        source: `${RFC5321} "These commands are used to identify the SMTP client to the SMTP server."`,
+        async run(c) {
+            const t = await transport(c);
+            try {
+                return (await t.verify()) === true ? [] : ['verify resolved without true'];
+            }
+            catch (error) {
+                return [`verify failed: ${String(error).slice(0, 200)}`];
+            }
+            finally {
+                t.close();
+            }
+        },
+    },
+    {
+        id: 'transaction-to-two-recipients',
+        asks: 'a message with text and HTML to two recipients runs MAIL, a RCPT for each, then DATA: both accepted, none rejected, the data answered 250',
+        source: `${RFC5321} "Once started, a mail transaction consists of a transaction beginning command, one or more RCPT commands, and a DATA command, in that order."`,
+        async run(c) {
+            const t = await transport(c);
+            try {
+                const info = await t.sendMail({ from: 'Polls <polls@case.example>', to: ['an@case.example', 'bo@case.example'], subject: 'Pick a date', text: 'Please pick a date.', html: '<p>Please pick a date.</p>' });
+                const failures = [];
+                if (JSON.stringify([...info.accepted].sort()) !== JSON.stringify(['an@case.example', 'bo@case.example']))
+                    failures.push(`accepted ${JSON.stringify(info.accepted)}`);
+                if (info.rejected.length)
+                    failures.push(`rejected ${JSON.stringify(info.rejected)}`);
+                if (!info.response.startsWith('250'))
+                    failures.push(`the data was answered ${info.response}`);
+                if (!info.messageId)
+                    failures.push('no message id');
+                return failures;
+            }
+            catch (error) {
+                return [`the send failed: ${String(error).slice(0, 200)}`];
+            }
+            finally {
+                t.close();
+            }
+        },
+    },
+];

package/dist/src/clients/stripe.js

@@ -1,4 +1,4 @@
-// Stripe's own client (stripe-node), driving the stripe pack as its applications do (Cal.com, Dub, Postiz, Rallly and
+// Stripe's own client (stripe-node), driving the stripe pack as its applications do (Cal.com, Dub, Rallly and
 // Twenty call it): an endpoint registered through the API and the event Stripe sends it verified by constructEvent, as an
 // application's webhook handler verifies it; a customer list read page by page by the client's auto-pagination; a retry
 // sent with its idempotency key; the error a missing object raises; and the customer portal a billing page opens.

package/dist/src/clients/volteridentity.js

@@ -1,9 +1,10 @@
 // @volter/identity 0.4.1, as Volter Harness uses it; discovery and token verification are also the APIs Open Autonomy
-// uses in 0.1.0. These cases are owned by conformance and are not run during pack authoring.
+// uses in 0.1.0. These cases are owned by conformance and are not run during pack authoring. They import nothing of the
+// kernel: the runner is Node's own type stripping, which the kernel's parameter properties do not pass.
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { digest } from '@volter/world-core';
+import { createHash } from 'node:crypto';
 import { resolveIdentity, verifyIdentityToken, tokenFor, readSharedSignIn, SHARED_CLIENTS } from '@volter/identity';
 const INDEX = 'https://unpkg.com/@volter/identity@0.4.1/dist/index.js';
 const SHARED = 'https://unpkg.com/@volter/identity@0.4.1/dist/shared.js';
@@ -34,7 +35,7 @@ async function setup(c, name, shared = false) {
         await send(c, `/admin/clients/${registered.client_id}/resources`, { resource: 'https://teams.sdk.example' }, operator);
     }
     const verifier = 'official-sdk-case-verifier-with-enough-entropy-for-s256';
-    const query = new URLSearchParams({ client_id: registered.client_id, redirect_uri: callback, response_type: 'code', scope: 'openid profile email offline_access', code_challenge: digest('sha256', verifier, 'base64url'), code_challenge_method: 'S256' });
+    const query = new URLSearchParams({ client_id: registered.client_id, redirect_uri: callback, response_type: 'code', scope: 'openid profile email offline_access', code_challenge: createHash('sha256').update(verifier).digest('base64url'), code_challenge_method: 'S256' });
     const authorized = await send(c, `/api/auth/oauth2/authorize?${query}`, undefined, { cookie });
     const code = new URL(authorized.headers.get('location')).searchParams.get('code');
     const form = new URLSearchParams({ client_id: registered.client_id, redirect_uri: callback, grant_type: 'authorization_code', code, code_verifier: verifier, ...(registered.client_secret ? { client_secret: registered.client_secret } : {}) });

package/dist/src/clients/x.d.ts

@@ -0,0 +1,2 @@
+import type { ClientCase } from './harness.js';
+export declare const cases: ClientCase[];

package/dist/src/clients/x.js

@@ -0,0 +1,64 @@
+const CREATE = 'https://docs.x.com/x-api/posts/create-post';
+const ME = 'https://docs.x.com/x-api/users/get-my-user';
+const README = 'https://www.npmjs.com/package/twitter-api-v2/v/1.29.1';
+/** An account named `username` and an access token for it with `scopes`; the client on that token. */
+async function signedIn(c, username, scopes, token = `case-${username}-token`) {
+    const door = async (path, body) => {
+        const answer = await c.fetch(`https://${c.host}${path}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+        if (answer.status >= 300)
+            throw new Error(`${path} answered ${answer.status}`);
+        return (await answer.json()).data;
+    };
+    const account = await door('/_twin/accounts', { username, name: 'Case Account' });
+    await door('/_twin/tokens', { token, account_id: account.id, scopes });
+    const { TwitterApi } = await import('twitter-api-v2');
+    return { client: new TwitterApi(token, { httpAgent: c.agent }), account };
+}
+export const cases = [
+    {
+        id: 'post-and-read-back',
+        asks: "a post made through the SDK answers its id and text, and reads back by id with that text, its author the signed-in account",
+        source: `${CREATE} "Create Posts"`,
+        async run(c) {
+            const { client, account } = await signedIn(c, 'case_poster', ['tweet.read', 'tweet.write', 'users.read']);
+            const made = await client.v2.tweet('Shipping the case today');
+            const failures = [];
+            if (!made.data?.id || made.data.text !== 'Shipping the case today')
+                failures.push(`tweet answered ${JSON.stringify(made)}`);
+            const read = await client.v2.singleTweet(made.data.id, { 'tweet.fields': ['author_id'] });
+            if (read.data?.text !== 'Shipping the case today')
+                failures.push(`the post reads back text ${JSON.stringify(read.data?.text)}`);
+            if (read.data?.author_id !== account.id)
+                failures.push(`the post reads back author ${String(read.data?.author_id)}, not ${account.id}`);
+            return failures;
+        },
+    },
+    {
+        id: 'me-is-the-signed-in-account',
+        asks: "v2.me answers the account the token was issued to, by its id and username (an app's account check after sign-in)",
+        source: `${ME} "Get Users Me"`,
+        async run(c) {
+            const { client, account } = await signedIn(c, 'case_me', ['tweet.read', 'users.read']);
+            const me = await client.v2.me();
+            return me.data?.id === account.id && me.data.username === 'case_me' ? [] : [`me answered ${JSON.stringify(me)}`];
+        },
+    },
+    {
+        id: 'unknown-token-api-response-error',
+        asks: 'a token X never issued is refused, and the client throws its ApiResponseError carrying the 401',
+        source: `${README} "Typed errors, meaningful error messages, error enumerations for both v1.1 and v2"`,
+        async run(c) {
+            const { TwitterApi, ApiResponseError } = await import('twitter-api-v2');
+            const client = new TwitterApi('case-never-issued-token', { httpAgent: c.agent });
+            try {
+                await client.v2.me();
+                return ['the never-issued token was accepted'];
+            }
+            catch (error) {
+                if (!(error instanceof ApiResponseError))
+                    return [`the refusal is not an ApiResponseError: ${String(error).slice(0, 160)}`];
+                return error.code === 401 ? [] : [`the refusal's code is ${error.code}, not 401`];
+            }
+        },
+    },
+];

package/dist/src/conformance.d.ts

@@ -30,5 +30,8 @@ export declare function decisionTableProblems(unit: string, byUnit: Record<strin
     building?: boolean;
 }): string[];
 /** Every check over the pack at `dir`, in order. */
-export declare function conformance(dir: string): Promise<ConformanceResult[]>;
+/** `onCheck` hears each check's id as it starts, so a caller can show where a long run stands. */
+export declare function conformance(dir: string, options?: {
+    onCheck?: (id: string) => void;
+}): Promise<ConformanceResult[]>;
 export {};

package/dist/src/conformance.js

@@ -356,6 +356,190 @@ async function standalone(pack) {
     }
     return out;
 }
+/** The request an application's first call of an operation sends when it knows nothing yet: every path parameter, every
+ *  required query parameter and every header the operation is routed by holding a placeholder, its discriminator's
+ *  values, and an empty body in the operation's encoding. What it measures is the twin's answer to a call it did not
+ *  script: a refusal in the vendor's form, or a result in the vendor's shape, and never a crash, a hang or a row. */
+function sweepRequest(op, basePath, host, credential) {
+    const fill = (name, type) => (type === 'integer' || type === 'number' ? '1' : type === 'boolean' ? 'true' : `conformance-${name.toLowerCase().replace(/[^a-z0-9]+/g, '-')}`);
+    const path = `${op.basePath ?? basePath}${op.path}`.replace(/\{([^}+]+)\+?\}/g, (_m, name) => fill(name));
+    const url = new URL(`https://${host}${path}`);
+    for (const q of op.query ?? [])
+        if (q.required)
+            url.searchParams.set(q.name, fill(q.name, q.type));
+    for (const [name, value] of Object.entries(op.discriminator ?? {}))
+        url.searchParams.set(name, value ?? fill(name));
+    const headers = new Headers(credential);
+    for (const [name, value] of Object.entries(op.headers ?? {}))
+        headers.set(name, value ?? fill(name));
+    const method = op.method.toUpperCase();
+    let body;
+    if (op.bodyEncoding === 'form') {
+        headers.set('content-type', 'application/x-www-form-urlencoded');
+        body = '';
+    }
+    else if (op.bodyEncoding === 'xml') {
+        headers.set('content-type', 'application/xml');
+        body = '';
+    }
+    else if (op.bodyEncoding === 'json' || op.bodyEncoding === 'multipart') {
+        headers.set('content-type', 'application/json');
+        body = '{}';
+    }
+    return new Request(url, { method, headers, ...(body !== undefined && !['GET', 'HEAD'].includes(method) ? { body } : {}) });
+}
+/** Every operation the pack serves, called over HTTP as an application calls it, against its server.ts served as a World
+ *  runs it: once plainly and once with a scenario loaded (an empty one, as a World that scripts nothing loads it). Each
+ *  answers within 10 s, never with a 500 the spec does not declare, never with a field of the twin's own (`_`
+ *  bookkeeping, the kernel's `updatedAt`) and, answered successfully, in the shape the spec gives the operation; and every
+ *  refresh list a fresh account can read (one with no parameter in its path) answers it successfully, so a World rooted
+ *  at this twin reads its resources back. Escaped before: the scenario hang (a served pack given a scenario answered
+ *  nothing), leaked kernel fields in answers no life step read, and refresh scopes on operations the pack answered with
+ *  the gap. The life walks what a customer does; this calls what the pack declares it serves. */
+async function surfaceSwept(pack, scratch) {
+    const out = [];
+    const descriptor = (await manifestOf(pack)).descriptor;
+    const fetchOf = (await import(__rewriteRelativeImportExtension(join(pack, 'src', 'fetch.ts'))))[fetchName(pack)];
+    const root = fetchOf?.();
+    const byUnit = root?.ownersByUnit?.() ?? { '': root?.owners?.() ?? {} };
+    const { shapeChecker } = await import("./walk/shape.js");
+    const { leaked } = await import("./walk/behavior-journey.js");
+    const shape = await shapeChecker(pack);
+    const units = [];
+    const vendorFields = new Set();
+    for (const unit of unitsIn(pack).filter(hasOwnSurface)) {
+        const surface = readJson(join(unit, 'src', 'generated', 'surface.gen.json'));
+        for (const r of surface?.resources ?? [])
+            for (const f of r.fields)
+                vendorFields.add(f.name);
+        // a line protocol and a command table ride in no path of their own: the life's line steps and the examples read them
+        if (!surface?.operations || ['command-reply', 'command-table'].includes(String(surface.format)))
+            continue;
+        const m = (await manifestOf(unit));
+        const host = m.hosts?.find((h) => h.host)?.host ?? descriptor?.hosts?.find((h) => h.host)?.host;
+        if (!host) {
+            out.push(`${nameOf(pack, unit)}: no host is named (its manifest's hosts or the descriptor's) for an application to call it at`);
+            continue;
+        }
+        const owners = byUnit[unit === pack ? '' : basename(unit)] ?? {};
+        const refreshLists = Object.entries(m.resources ?? {}).flatMap(([resource, decl]) => (decl.refresh?.list ? [{ resource, id: decl.refresh.list }] : []));
+        units.push({ name: nameOf(pack, unit), host, basePath: surface.basePath ?? '', ops: surface.operations.filter((o) => owners[o.id] !== undefined && owners[o.id] !== 'gap'), refreshLists, ...(m.auth ? { auth: m.auth } : {}) });
+    }
+    if (!units.length)
+        return { failures: out, note: 'no unit serves an operation on a path of its own' };
+    const tally = { calls: 0, ok: 0, refused: 0 };
+    const env = globalThis.process.env;
+    const scenarioPath = join(scratch, 'surface-scenario.json');
+    writeFileSync(scenarioPath, '{"handlers":[]}');
+    for (const mode of ['plain', 'scenario']) {
+        const before = env.VOLTER_WORLD_BOOT_ID;
+        env.VOLTER_WORLD_BOOT_ID = 'conformance';
+        let server;
+        try {
+            server = await serve(pack, { root: join(scratch, `surface-${mode}`), ...(mode === 'scenario' ? { scenarioPath } : {}) });
+        }
+        finally {
+            if (before === undefined)
+                delete env.VOLTER_WORLD_BOOT_ID;
+            else
+                env.VOLTER_WORLD_BOOT_ID = before;
+        }
+        const http = servedHttpFetch(server.inspectPort ?? server.port);
+        const send = async (request) => {
+            await server.managedDatabaseUrl?.();
+            const abort = new AbortController();
+            try {
+                return await within(10_000, http(request, { signal: abort.signal }));
+            }
+            catch (error) {
+                return error;
+            }
+            finally {
+                abort.abort();
+            }
+        };
+        try {
+            // the account an application holds: the key the credential door issues, sent as the vendor reads its credential
+            let issued;
+            if (descriptor?.credentialDoor) {
+                const door = descriptor.credentialDoor;
+                const answer = await send(new Request(`https://${descriptor.hosts?.find((h) => h.host)?.host ?? units[0].host}${door.path}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(door.body) }));
+                const fields = answer instanceof Response ? (await answer.json().catch(() => ({}))) : {};
+                issued = Object.values(door.fill).map((f) => fields[f]).find((v) => typeof v === 'string');
+            }
+            const said = mode === 'scenario' ? ' with a scenario loaded' : '';
+            for (const u of units) {
+                // a unit whose manifest declares no `auth` checks its key in its own front: the key goes as most vendors read
+                // one, a bearer token, and a refusal of it is no finding of the refresh below
+                const auth = u.auth ?? { header: 'authorization', scheme: 'Bearer' };
+                const credential = issued ? { [auth.header]: auth.scheme ? `${auth.scheme} ${issued}` : issued } : {};
+                const answered = new Map();
+                for (const op of u.ops) {
+                    const request = sweepRequest(op, u.basePath, u.host, credential);
+                    const where = `${u.name}: ${op.id} (${request.method} ${new URL(request.url).pathname})`;
+                    const res = await send(request);
+                    if (res === 'timeout') {
+                        out.push(`${where} answered nothing in 10 s${said}`);
+                        continue;
+                    }
+                    if (res instanceof Error) {
+                        out.push(`${where}: the connection failed${said} (${res.message})`);
+                        continue;
+                    }
+                    answered.set(op.id, res.status);
+                    if (mode === 'plain') {
+                        tally.calls++;
+                        if (res.status < 300)
+                            tally.ok++;
+                        else
+                            tally.refused++;
+                    }
+                    const text = await res.text();
+                    if (res.status === 500 && !op.responseMedia?.['500'] && !op.responseMedia?.['5XX']) {
+                        out.push(`${where} answered 500${said}, which the spec does not declare: ${text.slice(0, 160)}`);
+                        continue;
+                    }
+                    if (mode === 'scenario')
+                        continue;
+                    const type = res.headers.get('content-type') ?? '';
+                    let body;
+                    if (/json/.test(type)) {
+                        try {
+                            body = JSON.parse(text);
+                        }
+                        catch {
+                            body = undefined;
+                        }
+                    }
+                    for (const key of leaked(body, vendorFields, '', !op.answers || res.status >= 300))
+                        out.push(`${where} answers the twin's own field ${key}`);
+                    if (res.status >= 200 && res.status < 300 && shape) {
+                        const hit = shape.operationOf(request.method, request.url, Object.fromEntries(request.headers));
+                        if (hit)
+                            for (const detail of shape.failures(hit.op, body, type, request.headers.get('accept') ?? undefined, res.status, { method: request.method, responseText: text }))
+                                out.push(`${where}: ${detail}`);
+                    }
+                }
+                if (mode === 'plain')
+                    for (const r of u.refreshLists) {
+                        const op = u.ops.find((o) => o.id === r.id);
+                        if (!op || op.path.includes('{') || (op.basePath ?? '').includes('{'))
+                            continue;
+                        const status = answered.get(r.id);
+                        if (status !== undefined && (status === 401 || status === 403) && (!u.auth || !issued))
+                            continue;
+                        if (status !== undefined && (status < 200 || status >= 300))
+                            out.push(`${u.name}: ${r.resource}'s refresh lists by ${r.id}, which answered a fresh account ${status}: a World rooted at this twin reads nothing back`);
+                    }
+            }
+        }
+        finally {
+            await server.stop();
+        }
+    }
+    // one defect repeated over a surface reads as one: the first 40 findings, and how many more
+    return { failures: out.length > 40 ? [...out.slice(0, 40), `… ${out.length - 40} more`] : out, note: `${tally.calls} served operations called, twice each: ${tally.ok} answered successfully, ${tally.refused} refused, unscripted` };
+}
 /** A line protocol's connection over TCP, in the walk's stream shape. A line drew its replies when bytes arrived and then
  *  50 ms passed with no more (a multi-line reply arrives in pieces), or when 500 ms passed with none (a line that draws no
  *  reply: a message's body before its end); 10 s bounds a server that keeps writing. The windows are timing, not protocol:
@@ -429,7 +613,9 @@ async function lifeServed(pack) {
             socket: (url, headers) => new WebSocket(`ws://127.0.0.1:${port}${url}`, { headers }),
             // a line connection opened as an application's client opens it: TCP to the protocol listener (the primary port)
             stream: lineConnection(server.port),
-            stop: () => server.stop(),
+            // bounded: Bun's server.stop(true) never settles once a WebSocket peer has closed under it (discord's life, Bun
+            // 1.3.11: the walk ended and the stop spun at full CPU for 45 minutes), so the check waits 5 s and goes on
+            stop: async () => { await within(5000, Promise.resolve(server.stop())); },
         };
     };
     const world = inMemoryWorld(`conform-${basename(pack)}`);
@@ -465,7 +651,9 @@ async function clientCases(pack, scratch) {
     const descriptor = (await manifestOf(pack)).descriptor;
     // the first host that names one: a descriptor may lead with a suffix (a region's hosts under one domain), which no
     // request addresses; the case's client reaches whatever host its issued credentials name
-    const host = descriptor?.hosts?.find((h) => h.host)?.host;
+    // a raw protocol's pack (hostsNone: SMTP, whose relay is whatever host the operator names) is reached by its TCP
+    // connection alone; its client names a stand-in host the connection never resolves
+    const host = descriptor?.hosts?.find((h) => h.host)?.host ?? (descriptor?.hostsNone ? 'relay.world.test' : undefined);
     if (!host)
         return { failures: ['the descriptor names no host for its client to address'] };
     const scenarioPath = join(scratch, 'client-scenario.json');
@@ -488,13 +676,31 @@ async function clientCases(pack, scratch) {
         const issued = {};
         const door = descriptor?.credentialDoor;
         if (door) {
-            const answer = (await (await fetch(`http://127.0.0.1:${server.port}${door.path}`, { method: 'POST', headers: { host, 'content-type': 'application/json' }, body: JSON.stringify(door.body) })).json().catch(() => ({})));
+            // a door that answers nothing is the pack's failure, never conform's hang (a pack served with a scenario that answered
+            // nothing once held this request open for good)
+            const abort = new AbortController();
+            const asked = await within(10_000, fetch(`http://127.0.0.1:${server.port}${door.path}`, { method: 'POST', headers: { host, 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: abort.signal }).then((r) => r.json().catch(() => ({}))));
+            abort.abort();
+            if (asked === 'timeout')
+                return { failures: [`the credential door (POST ${door.path}) answered nothing in 10 s, served with a scenario loaded`] };
+            const answer = asked;
             for (const [name, field] of Object.entries(door.fill))
                 if (answer[field] !== undefined)
                     issued[name] = String(answer[field]);
         }
         const job = join(scratch, 'client-job.json');
-        writeFileSync(job, JSON.stringify({ vendor, port: server.port, host, env: issued, scenarioPath, packFacts: join(pack, 'generated', 'pack-facts.json') }));
+        // a release carries its facts (generated/pack-facts.json, `twin-standard facts`); a source checkout does not, so its
+        // facts are compiled here, as that command compiles them, for the client the case runs
+        let packFacts = join(pack, 'generated', 'pack-facts.json');
+        if (!existsSync(packFacts)) {
+            const { compilePackFacts, renderPackFacts } = await import("./pack-facts.js");
+            const compiled = await compilePackFacts([{ vendor, dir: pack }]);
+            if (compiled.undeclared.length)
+                throw new Error('Pack descriptor is missing');
+            packFacts = join(scratch, 'pack-facts.json');
+            writeFileSync(packFacts, renderPackFacts(compiled));
+        }
+        writeFileSync(job, JSON.stringify({ vendor, port: server.port, host, env: issued, scenarioPath, packFacts, ...(descriptor?.hostsNone ? { raw: true } : {}) }));
         // Node, as an application runs its SDK (asynchronous: this process serves the pack meanwhile)
         const out = await new Promise((resolve) => {
             const child = spawn('node', ['--experimental-strip-types', '--no-warnings', join(clients, `run${extension}`), job], { stdio: ['ignore', 'pipe', 'pipe'] });
@@ -514,8 +720,46 @@ async function clientCases(pack, scratch) {
         await server.stop();
     }
 }
+/** The gate over every unit of the pack: the form section of the grade, which holds the rules an author's code keeps
+ *  (p3-rules.ts: ids from ctx.mint, the twin's URL from ctx.publicBase, the kernel's crypto, bytes in ctx.blobs, secrets
+ *  drawn from ctx.secret) and the pack layout, handler, kernel and manifest contracts. A contributor's conform is the
+ *  whole of what a machine decides of the pack, as the catalog's admission reads it. */
+async function formOf(pack) {
+    const { p3Gate } = await import("./gate.js");
+    return (await p3Gate(unitsIn(pack))).flatMap((r) => r.failures.map((f) => `${nameOf(pack, r.unit)}: ${f}`));
+}
+/** The pack's records hold what a reviewer reads them for: each demand row cites the application's line it was read at
+ *  (`<path>:<line>`, or `<package>@<version>:<path>:<line>` for a call a dependency makes), the spec's record names a
+ *  vendored file that is there, the life names the session that wrote it (what makes a judge's verdict independent),
+ *  and the package says what it serves in a README. Rules every builder brief carried by hand, decided here. */
+function records(pack) {
+    const out = [];
+    if (!existsSync(join(pack, 'README.md')))
+        out.push('README.md is missing: the package says what it serves, for whom, its doors and what it leaves out');
+    const life = readJson(join(pack, 'journeys', 'customer-life.json'));
+    if (life && (typeof life.author !== 'string' || !life.author.trim()))
+        out.push('journeys/customer-life.json names no author (the session that wrote it), so no verdict on it can be shown independent');
+    for (const unit of unitsIn(pack)) {
+        const name = nameOf(pack, unit);
+        const journeys = hasJourneySource(unit) ? join(unit, 'journeys') : join(unit, '..', 'journeys');
+        const demand = unit === pack || hasJourneySource(unit) ? readJson(join(journeys, 'demand.json')) : undefined;
+        for (const app of demand?.applications ?? [])
+            for (const row of app.backend ?? []) {
+                if (typeof row.evidence !== 'string' || !/:\d+/.test(row.evidence))
+                    out.push(`${name}: ${app.name ?? 'an application'}'s call of ${row.operation ?? '(no operation)'} cites no line it was read at (evidence "<path>:<line>")`);
+            }
+        if (!hasOwnSurface(unit))
+            continue;
+        const source = existsSync(join(unit, 'spec', 'SOURCE.md')) ? readFileSync(join(unit, 'spec', 'SOURCE.md'), 'utf8') : '';
+        const file = /\*\*File:\*\*[^`\n]*`([^`]+)`/.exec(source)?.[1];
+        if (file && !existsSync(join(unit, 'spec', file)))
+            out.push(`${name}: spec/SOURCE.md names ${file} as the vendored spec, and spec/ holds no such file`);
+    }
+    return out;
+}
 /** Every check over the pack at `dir`, in order. */
-export async function conformance(dir) {
+/** `onCheck` hears each check's id as it starts, so a caller can show where a long run stands. */
+export async function conformance(dir, options = {}) {
     const pack = resolve(dir);
     if (!existsSync(join(pack, 'package.json')))
         throw new Error(`${dir} is no pack (no package.json): conformance takes a pack's directory`);
@@ -525,8 +769,10 @@ export async function conformance(dir) {
     const here = process.cwd();
     process.chdir(scratch);
     const run = async (id, asks, check) => {
+        options.onCheck?.(id);
         try {
-            return { id, asks, failures: await check() };
+            const r = await check();
+            return Array.isArray(r) ? { id, asks, failures: r } : { id, asks, failures: r.failures, note: r.note };
         }
         catch (error) {
             return { id, asks, failures: [`the check could not run: ${error.message.split('\n')[0]}`] };
@@ -541,6 +787,7 @@ export async function conformance(dir) {
             await run('registered', 'a vendor-backed unit, lane or not, reaches the registered pack\'s state system', () => registered(pack, runtime)),
             await run('allowance', 'a rate budget above the fallback rests on the vendor\'s documented allowance, cited in its manifest', () => allowance(pack, runtime)),
             await (async () => {
+                options.onCheck?.('client');
                 const asks = "driven by the vendor's own client (its official SDK), served as a World runs it, the vendor's documented behaviour holds";
                 try {
                     const r = await clientCases(pack, scratch);
@@ -552,6 +799,9 @@ export async function conformance(dir) {
             })(),
             await run('life', 'the life walked over HTTP against the pack served as a World runs it, with its scenario: every check held', () => lifeServed(pack)),
             await run('standalone', 'served by its server.ts as a World runs it, the pack answers HTTP and the boot probe, and each declared socket upgrades', () => standalone(pack)),
+            await run('surface', 'every served operation called over HTTP as an application calls it, plainly and with a scenario loaded: answered within 10 s, no undeclared 500, no field of the twin\'s own, a success in the spec\'s shape, and every refresh list a fresh account reads answering', () => surfaceSwept(pack, scratch)),
+            await run('records', 'each demand row cites the line it was read at, the spec\'s record names a vendored file that is there, the life names its author, the package has its README', () => records(pack)),
+            await run('form', 'every unit passes the form section of the grade (the gate): the layout, the handler and kernel contracts, the manifest as data, the rules an author\'s code holds', () => formOf(pack)),
         ];
     }
     finally {

package/dist/src/consumer.js

@@ -201,7 +201,11 @@ export async function runConsumerWorkflow(packDir, options) {
                 throw new Error('Resume changed recorded application state before readback');
             await run('retained-readback', ['run', '--', ...recipe.retention.readback]);
             const after = JSON.parse(await run('log-after-readback', ['log', '--json']));
-            if (JSON.stringify(before) !== JSON.stringify(after))
+            // the readback adds no write of the application's: what it adds may only be the vendor's own moves (a key's
+            // last-used time, recorded by the vendor as a request uses it: actor `system`, ctx.asVendor), never an API call's
+            const added = after.filter((entry) => !before.some((prior) => prior.id === entry.id));
+            const kept = before.every((prior) => after.some((entry) => JSON.stringify(entry) === JSON.stringify(prior)));
+            if (!kept || added.some((entry) => entry.actor?.kind !== 'system'))
                 throw new Error('Retained readback added mutations; it must only inspect existing state');
             retainedReadback = true;
         }

package/dist/src/create-pack.d.ts

@@ -39,4 +39,9 @@ export declare function initFiles(vendor: string): Record<string, string>;
  *  surface of its own under `<lane>/src`, keeping the vendor's one store and sharing its `src/semantics/shared.ts`, and the
  *  pack's server routing each lane's host to it. */
 export declare function laneInitFiles(vendor: string, lanes: string[]): Record<string, string>;
+/** A unit's fixed files as the manifest and the spec make them now (architecture, "Creating a pack"): a lane's fetch, and
+ *  a pack's fetch, index, server and cli. A pack with a wire of its own (`src/stream.ts`, SMTP's and Redis's byte-stream
+ *  door) writes its server and cli itself: they carry its listener beside the fetch, so they are not fixed. `--index`
+ *  writes these and the grade's `fixed-reproducible` compares them byte for byte. */
+export declare function fixedFiles(dir: string): Promise<Record<string, string>>;
 export declare function createPack(args: string[]): Promise<void>;