@volter/twin-standard 1.0.158 → 1.0.159

package/dist/src/conformance.js

@@ -6,7 +6,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { hasOwnSurface } from "./lanes.js";
+import { hasOwnSurface, unitsIn } from "./lanes.js";
 // CONFORMANCE — the deterministic half of the Protocol 3 standard that executes the pack: the contract it serves, run the
 // way an application calls it, and every rule a pack's author follows that a machine can decide (docs/contributing/
 // architecture.md, "Conformance"). One command, the same for a contributor, the catalog's admission and its regular
@@ -19,24 +19,50 @@ import { hasOwnSurface } from "./lanes.js";
 // judges (the life's plausibility) is the proof section's. Each check names the defect it was written against: one
 // that escaped review once fails here when reintroduced.
 import { spawn, spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { connect } from 'node:net';
 import { tmpdir } from 'node:os';
 import { basename, dirname, extname, join, matchesGlob, relative, resolve, sep } from 'node:path';
 // A path relative to another with '/' between its parts on every platform (Windows' relative() joins with '\').
 const rel = (from, to) => relative(from, to).split(sep).join('/');
+import { hostRules } from '@volter/world-core/host-routing';
+import { twinEnvStem } from '@volter/world-core/vendor-hosts';
 import { citations, sourceHeld } from "./check-sources.js";
 import { fileURLToPath } from 'node:url';
-import { servedHttpFetch } from "./clients/harness.js";
+import { parseEnv } from 'node:util';
+import { openWebSocket, readHttpResponse, servedHttpFetch, worldProxy } from "./clients/harness.js";
 import { servePack as serve } from "./walk/serve-pack.js";
+import { walkPackDirectory } from "./walk/pack-directory.js";
+import { formBody, sigv4Headers } from "./walk/journey-kit.js";
+import { consumerClientProof, consumerRecipe, runConsumerCommand } from "./consumer.js";
+import { declaredResponseStatuses } from "./spec-documents.js";
 const pascal = (s) => s.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((w) => w[0].toUpperCase() + w.slice(1)).join('');
 const readJson = (p) => (existsSync(p) ? JSON.parse(readFileSync(p, 'utf8')) : undefined);
-/** The pack's units: the pack and each lane in it (a directory with its own src/manifest.ts and no package.json). */
-function unitsIn(pack) {
-    return [pack, ...readdirSync(pack).sort().map((n) => join(pack, n)).filter((d) => !existsSync(join(d, 'package.json')) && existsSync(join(d, 'src', 'manifest.ts')))];
+/** Exercise the door's declared organization and deployment, as the World renderer does. */
+function credentialDoorBody(door) {
+    return JSON.stringify({ ...door.body, ...(door.account ? { [door.account.field]: 'default' } : {}), ...(door.deployment ? { [door.deployment.field]: 'conformance' } : {}) });
 }
 const nameOf = (pack, unit) => rel(resolve(pack, '..'), unit);
+/** A credential door's native successful object and nonempty string outputs, through the served HTTP owner. */
+async function credentialFields(server, door, host) {
+    await server.managedDatabaseUrl?.();
+    const port = server.inspectPort ?? server.port;
+    const answer = await readHttpResponse(servedHttpFetch(port), new Request(`http://${host ?? `127.0.0.1:${port}`}${door.path}`, {
+        method: 'POST', headers: { 'content-type': 'application/json', 'x-volter-world-activity': 'provisioning' }, body: credentialDoorBody(door),
+    }));
+    if (answer.bodyError)
+        throw new Error(`credential door ${door.path}: ${answer.bodyError.message}`);
+    if (answer.status < 200 || answer.status >= 300)
+        throw new Error(`credential door ${door.path} answered ${answer.status}`);
+    const { decodeResponse } = await import("./walk/shape.js");
+    const values = decodeResponse(answer.text, undefined);
+    if (!values || typeof values !== 'object' || Array.isArray(values))
+        throw new Error(`credential door ${door.path} supplies no JSON object`);
+    const fields = values;
+    const outputs = Object.fromEntries(Object.entries(door.fill).flatMap(([name, field]) => typeof fields[field] === 'string' && fields[field] ? [[name, fields[field]]] : []));
+    return { values: fields, outputs };
+}
 /** The files conformance reads from a unit: its manifest, its spec's record, its vendor's life and its decision table
  *  (a lane's journeys are its own `journeys/` or else its vendor's). A release publishes each (published()), and a
  *  pack's standing counts it in the form only when every unit holds them (twin-world's scripts/pack-standing.ts, by
@@ -308,7 +334,6 @@ async function allowance(pack, runtime) {
     }
     return out;
 }
-const within = (ms, p) => Promise.race([p, new Promise((r) => setTimeout(() => r('timeout'), ms))]);
 /** Served by its server.ts as a World runs it (its boot id set), the pack answers HTTP and the boot probe, and every socket
  *  its manifests declare takes an upgrade. Escaped twice: serveHttp never took the upgrade a pack's fetch carries, then
  *  read it off the boot probe's wrapper of the fetch, so OpenAI Realtime's /v1/realtime answered 404, first everywhere
@@ -320,35 +345,33 @@ async function standalone(pack) {
         for (const s of (await manifestOf(unit)).sockets ?? [])
             sockets.push({ unit: nameOf(pack, unit), path: s.path, ...(s.host ? { host: s.host } : {}) });
     // served the way a World runs it: the boot id set, so the seam wraps the fetch with the World's boot probe
-    const env = globalThis.process.env;
-    const before = env.VOLTER_WORLD_BOOT_ID;
-    env.VOLTER_WORLD_BOOT_ID = 'conformance';
-    let server;
-    try {
-        server = await serve(pack, {});
-    }
-    finally {
-        if (before === undefined)
-            delete env.VOLTER_WORLD_BOOT_ID;
-        else
-            env.VOLTER_WORLD_BOOT_ID = before;
-    }
+    const server = await serve(pack, {});
     try {
-        const http = await within(5000, fetch(`http://127.0.0.1:${(server.inspectPort ?? server.port)}/`).then((r) => r.status, (e) => e.message));
-        if (http === 'timeout' || typeof http === 'string')
-            out.push(`served as a World runs it, it answers no HTTP request (${http})`);
-        const boot = await within(5000, fetch(`http://127.0.0.1:${(server.inspectPort ?? server.port)}/__volter/world-boot`).then((r) => r.json(), () => ({})));
-        if (boot === 'timeout' || boot.boot !== 'conformance')
+        const http = servedHttpFetch(server.inspectPort ?? server.port);
+        const probe = (path) => readHttpResponse(http, new Request(`http://127.0.0.1:${server.inspectPort ?? server.port}${path}`, { signal: AbortSignal.timeout(5000) }));
+        try {
+            const answer = await probe('/');
+            if (answer.bodyError)
+                out.push(`served as a World runs it, its HTTP response failed (${answer.bodyError.message})`);
+        }
+        catch (error) {
+            out.push(`served as a World runs it, it answers no HTTP request (${String(error)})`);
+        }
+        try {
+            const boot = await probe('/__volter/world-boot');
+            if (boot.bodyError || JSON.parse(boot.text).boot !== 'conformance')
+                throw new Error('missing boot identity');
+        }
+        catch {
             out.push("served as a World runs it, it does not answer the World's boot probe (/__volter/world-boot)");
+        }
         for (const s of sockets) {
-            const upgraded = await new Promise((done) => {
-                const ws = new WebSocket(`ws://127.0.0.1:${server.port}${s.path}`, { headers: s.host ? { host: s.host } : {} });
-                const timer = setTimeout(() => { ws.close(); done('no upgrade in 5 s'); }, 5000);
-                ws.onopen = () => { clearTimeout(timer); ws.close(); done(undefined); };
-                ws.onerror = () => { clearTimeout(timer); done('the upgrade was refused'); };
-            });
+            const ws = new WebSocket(`ws://127.0.0.1:${server.port}${s.path}`, { headers: s.host ? { host: s.host } : {} });
+            const upgraded = await openWebSocket(ws);
             if (upgraded)
-                out.push(`${s.unit}: the socket at ${s.host ?? ''}${s.path}: ${upgraded}`);
+                ws.close();
+            else
+                out.push(`${s.unit}: the socket at ${s.host ?? ''}${s.path}: no upgrade in 5 s or the upgrade was refused`);
         }
     }
     finally {
@@ -382,163 +405,392 @@ function sweepRequest(op, basePath, host, credential) {
         headers.set('content-type', 'application/xml');
         body = '';
     }
-    else if (op.bodyEncoding === 'json' || op.bodyEncoding === 'multipart') {
+    else if (op.bodyEncoding === 'json') {
         headers.set('content-type', 'application/json');
         body = '{}';
     }
+    else if (op.bodyEncoding === 'multipart') {
+        const formed = formBody({ parts: [] }, {});
+        headers.set('content-type', formed.contentType);
+        body = formed.bytes;
+    }
     return new Request(url, { method, headers, ...(body !== undefined && !['GET', 'HEAD'].includes(method) ? { body } : {}) });
 }
+/** Obtain authorization through the existing customer recipe, with any declared issuer on the same World as the API. */
+async function consumerAuthorization(pack, scratch, root, server, descriptor, outputs, claimsAuthorization, consumer) {
+    const vendor = (await manifestOf(pack)).vendor ?? basename(pack);
+    const issuer = descriptor.credentialIssuer;
+    const companion = issuer ? walkPackDirectory(dirname(pack), issuer, pack) : undefined;
+    if (issuer && !companion)
+        throw new Error(`${vendor}: its declared credential issuer ${issuer} is not installed`);
+    const issuerDoor = companion ? (await manifestOf(companion)).descriptor?.credentialDoor : undefined;
+    if (companion && !issuerDoor)
+        throw new Error(`${issuer}: its declared credential door is missing`);
+    const recipe = consumerRecipe(vendor, pack);
+    if (!consumer)
+        throw new Error(`${vendor}: native authorization requires its prepared installed customer application`);
+    mkdirSync(scratch, { recursive: true });
+    const appDir = consumer.appDir;
+    for (const [path, contents] of Object.entries(recipe.files))
+        if (path !== 'package.json' && path !== '.gitignore' && readFileSync(join(appDir, path), 'utf8') !== contents)
+            throw new Error(`${vendor}: its prepared customer file ${path} differs from its native first-use recipe`);
+    const proxies = [];
+    let servedIssuer;
+    let granted;
+    const { forwardableHeaders } = await import('@volter/world-runtime');
+    try {
+        const env = { ...outputs };
+        if (companion && issuerDoor) {
+            servedIssuer = await serve(companion, { root });
+            Object.assign(env, (await credentialFields(servedIssuer, issuerDoor)).outputs);
+        }
+        const credentialNames = new Set([...Object.keys(descriptor.credentialDoor?.fill ?? {}), ...Object.keys(issuerDoor?.fill ?? {})]);
+        for (const name of Object.keys(parseEnv(recipe.files['.env.example'])))
+            if (credentialNames.has(name) && !env[name])
+                throw new Error(`${vendor}: its native credential doors supplied no ${name}`);
+        const selectedProxy = await worldProxy(server.inspectPort ?? server.port, (request, response) => {
+            const url = new URL(request.url);
+            if (response.status >= 200 && response.status < 300 && !url.pathname.startsWith('/_twin/') && claimsAuthorization(url.hostname, url.pathname)) {
+                const headers = forwardableHeaders(request.headers);
+                for (const name of [...headers.keys()])
+                    if (/^(host|forwarded|x-forwarded-.*|x-volter-.*|x-twins-key|proxy-.*|via|content-.*|digest)$/i.test(name))
+                        headers.delete(name);
+                granted = { headers: Object.fromEntries(headers), url };
+            }
+        });
+        proxies.push(selectedProxy);
+        const selected = [{ vendor, dir: pack, port: selectedProxy.port }];
+        if (issuer && companion && servedIssuer) {
+            const issuerProxy = await worldProxy(servedIssuer.inspectPort ?? servedIssuer.port);
+            proxies.push(issuerProxy);
+            selected.push({ vendor: issuer, dir: companion, port: issuerProxy.port });
+        }
+        const { compilePackFacts, renderPackFacts } = await import("./pack-facts.js");
+        const facts = await compilePackFacts(selected.map(({ vendor, dir }) => ({ vendor, dir })));
+        if (facts.undeclared.length)
+            throw new Error('Customer authorization requires declared pack descriptors');
+        const packFacts = join(scratch, 'pack-facts.json');
+        writeFileSync(packFacts, renderPackFacts(facts));
+        const instance = join(scratch, 'instance.json');
+        writeFileSync(instance, JSON.stringify({ packFacts: [packFacts] }));
+        const routes = Object.fromEntries(selected.flatMap(({ vendor, port }) => (facts.packs[vendor]?.hosts ?? []).map((rule) => [rule.key ?? vendor, `http://127.0.0.1:${port}`])));
+        const endpoints = Object.fromEntries(Object.entries(routes).map(([key, url]) => [`${twinEnvStem(key)}_TWIN_URL`, url]));
+        const require = createRequire(join(pack, 'package.json'));
+        const inject = require.resolve('@volter/world-core/inject');
+        const result = await runConsumerCommand(recipe.run, appDir, {
+            ...process.env, ...endpoints, ...env, VOLTER_WORLD_INSTANCE: instance,
+            TWIN_INJECT: Object.entries(routes).map(([name, url]) => `${name}=${url}`).join(','),
+            NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --require ${JSON.stringify(inject)}`.trim(),
+            VOLTER_TWIN_STRICT_EGRESS: '1',
+        }, AbortSignal.timeout(10_000));
+        if (result.exitCode !== 0)
+            throw new Error(`${vendor}: its native first-use command exited ${result.exitCode}`);
+        if (!granted)
+            throw new Error(`${vendor}: its native first-use command made no successful authorized request to the selected API`);
+        return granted;
+    }
+    finally {
+        const cleanup = await Promise.allSettled([...proxies.map((proxy) => proxy.stop()), ...(servedIssuer ? [Promise.resolve().then(() => servedIssuer.stop())] : [])]);
+        const failed = cleanup.find((result) => result.status === 'rejected');
+        if (failed?.status === 'rejected')
+            throw failed.reason;
+    }
+}
 /** Every operation the pack serves, called over HTTP as an application calls it, against its server.ts served as a World
  *  runs it: once plainly and once with a scenario loaded (an empty one, as a World that scripts nothing loads it). Each
  *  answers within 10 s, never with a 500 the spec does not declare, never with a field of the twin's own (`_`
  *  bookkeeping, the kernel's `updatedAt`) and, answered successfully, in the shape the spec gives the operation; and every
- *  refresh list a fresh account can read (one with no parameter in its path) answers it successfully, so a World rooted
- *  at this twin reads its resources back. Escaped before: the scenario hang (a served pack given a scenario answered
+ *  refresh list a fresh account can read (one with no parameter in its path) succeeds or remains unread under the
+ *  native 403 contract while another read succeeds, or matches the pack's own removal at the World clock.
+ *  Escaped before: the scenario hang (a served pack given a scenario answered
  *  nothing), leaked kernel fields in answers no life step read, and refresh scopes on operations the pack answered with
  *  the gap. The life walks what a customer does; this calls what the pack declares it serves. */
-async function surfaceSwept(pack, scratch) {
+async function surfaceSwept(pack, scratch, runtime, consumer) {
     const out = [];
     const descriptor = (await manifestOf(pack)).descriptor;
     const fetchOf = (await import(__rewriteRelativeImportExtension(join(pack, 'src', 'fetch.ts'))))[fetchName(pack)];
     const root = fetchOf?.();
     const byUnit = root?.ownersByUnit?.() ?? { '': root?.owners?.() ?? {} };
-    const { shapeChecker } = await import("./walk/shape.js");
-    const { leaked } = await import("./walk/behavior-journey.js");
+    const { decodeResponse, responseProblems, shapeChecker, vendorFieldsOf } = await import("./walk/shape.js");
     const shape = await shapeChecker(pack);
     const units = [];
-    const vendorFields = new Set();
+    const vendorFields = await vendorFieldsOf(pack);
     for (const unit of unitsIn(pack).filter(hasOwnSurface)) {
         const surface = readJson(join(unit, 'src', 'generated', 'surface.gen.json'));
-        for (const r of surface?.resources ?? [])
-            for (const f of r.fields)
-                vendorFields.add(f.name);
+        const m = (await manifestOf(unit));
         // a line protocol and a command table ride in no path of their own: the life's line steps and the examples read them
         if (!surface?.operations || ['command-reply', 'command-table'].includes(String(surface.format)))
             continue;
-        const m = (await manifestOf(unit));
-        const host = m.hosts?.find((h) => h.host)?.host ?? descriptor?.hosts?.find((h) => h.host)?.host;
-        if (!host) {
-            out.push(`${nameOf(pack, unit)}: no host is named (its manifest's hosts or the descriptor's) for an application to call it at`);
+        const hosts = m.hosts ?? m.descriptor?.hosts ?? descriptor?.hosts ?? [];
+        if (!hosts.length) {
+            out.push(`${nameOf(pack, unit)}: no host is claimed (its manifest's hosts or the descriptor's) for an application to call it at`);
             continue;
         }
         const owners = byUnit[unit === pack ? '' : basename(unit)] ?? {};
         const refreshLists = Object.entries(m.resources ?? {}).flatMap(([resource, decl]) => (decl.refresh?.list ? [{ resource, id: decl.refresh.list }] : []));
-        units.push({ name: nameOf(pack, unit), host, basePath: surface.basePath ?? '', ops: surface.operations.filter((o) => owners[o.id] !== undefined && owners[o.id] !== 'gap'), refreshLists, ...(m.auth ? { auth: m.auth } : {}) });
+        const refreshReads = Object.values(m.resources ?? {}).flatMap((decl) => [decl.refresh?.list, decl.refresh?.get, decl.refresh?.detail].filter((id) => !!id));
+        const declaredAuth = m.descriptor?.auth ?? descriptor?.auth;
+        const strategy = declaredAuth?.in === 'lanes' ? declaredAuth.lanes[unit === pack ? '' : basename(unit)] : declaredAuth;
+        const shared = join(unit, 'src/semantics/shared.ts');
+        const removedAt = existsSync(shared) ? (await import(__rewriteRelativeImportExtension(shared))).removedAt : undefined;
+        units.push({ name: nameOf(pack, unit), lane: unit === pack ? '' : basename(unit), hosts, basePath: surface.basePath ?? '', manifest: m, ops: surface.operations.filter((o) => owners[o.id] !== undefined && owners[o.id] !== 'gap'), responseStatuses: declaredResponseStatuses(join(unit, 'spec')), refreshLists, refreshReads, ...(m.auth ? { auth: m.auth } : {}), ...(strategy ? { strategy } : {}), ...(typeof removedAt === 'function' ? { removedAt } : {}) });
     }
     if (!units.length)
         return { failures: out, note: 'no unit serves an operation on a path of its own' };
-    const tally = { calls: 0, ok: 0, refused: 0 };
-    const env = globalThis.process.env;
+    const tally = { calls: 0, ok: 0, refused: 0, unread: 0, removed: 0 };
+    const replayedHeaders = new Set();
     const scenarioPath = join(scratch, 'surface-scenario.json');
     writeFileSync(scenarioPath, '{"handlers":[]}');
     for (const mode of ['plain', 'scenario']) {
-        const before = env.VOLTER_WORLD_BOOT_ID;
-        env.VOLTER_WORLD_BOOT_ID = 'conformance';
-        let server;
-        try {
-            server = await serve(pack, { root: join(scratch, `surface-${mode}`), ...(mode === 'scenario' ? { scenarioPath } : {}) });
-        }
-        finally {
-            if (before === undefined)
-                delete env.VOLTER_WORLD_BOOT_ID;
-            else
-                env.VOLTER_WORLD_BOOT_ID = before;
-        }
+        const root = join(scratch, `surface-${mode}`);
+        const server = await serve(pack, { root, ...(mode === 'scenario' ? { scenarioPath } : {}) });
         const http = servedHttpFetch(server.inspectPort ?? server.port);
         const send = async (request) => {
             await server.managedDatabaseUrl?.();
-            const abort = new AbortController();
             try {
-                return await within(10_000, http(request, { signal: abort.signal }));
+                return await readHttpResponse(http, request);
             }
             catch (error) {
-                return error;
-            }
-            finally {
-                abort.abort();
+                return error instanceof Error ? error : new Error(String(error));
             }
         };
         try {
+            const said = mode === 'scenario' ? ' with a scenario loaded' : '';
             // the account an application holds: the key the credential door issues, sent as the vendor reads its credential
             let issued;
+            let nativeHeaders;
+            let recipeAuthorized = false;
+            let nativeUrl;
+            const outputs = {};
             if (descriptor?.credentialDoor) {
                 const door = descriptor.credentialDoor;
-                const answer = await send(new Request(`https://${descriptor.hosts?.find((h) => h.host)?.host ?? units[0].host}${door.path}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(door.body) }));
-                const fields = answer instanceof Response ? (await answer.json().catch(() => ({}))) : {};
-                issued = Object.values(door.fill).map((f) => fields[f]).find((v) => typeof v === 'string');
+                const fields = await credentialFields(server, door);
+                const values = fields.values;
+                Object.assign(outputs, fields.outputs);
+                issued = Object.values(door.fill).map((f) => values[f]).find((v) => typeof v === 'string' && v.length > 0);
+                if (typeof values.authorization === 'string' && values.authorization) {
+                    nativeHeaders = { authorization: values.authorization };
+                    if (typeof values.url === 'string') {
+                        try {
+                            nativeUrl = new URL(values.url);
+                        }
+                        catch {
+                            out.push(`${nameOf(pack, pack)}: credential door supplies an invalid native url`);
+                            continue;
+                        }
+                        if (nativeUrl.protocol !== 'https:' || nativeUrl.username || nativeUrl.password) {
+                            out.push(`${nameOf(pack, pack)}: credential door supplies a native url without a vendor HTTPS origin`);
+                            continue;
+                        }
+                    }
+                }
+            }
+            const headerUnits = units.filter((unit) => !unit.strategy);
+            const ambiguousHeaderCredential = !nativeHeaders && new Set(Object.values(outputs)).size > 1 && headerUnits.length > 0
+                && Object.keys(parseEnv(consumerRecipe((await manifestOf(pack)).vendor ?? basename(pack), pack).files['.env.example'])).some((name) => outputs[name]);
+            if (descriptor && (descriptor.credentialIssuer || ambiguousHeaderCredential)) {
+                const headerClaims = headerUnits.map((unit) => hostRules(unit.hosts));
+                const otherClaims = units.filter((unit) => unit.strategy).map((unit) => hostRules(unit.hosts));
+                const claimsAuthorization = descriptor.credentialIssuer ? hostRules(descriptor.hosts ?? []).takes
+                    : (host, path) => headerClaims.some((claims) => claims.takes(host, path)) && !otherClaims.some((claims) => claims.takes(host, path));
+                const granted = await consumerAuthorization(pack, join(scratch, `authorization-${mode}`), root, server, descriptor, outputs, claimsAuthorization, consumer);
+                nativeHeaders = granted.headers;
+                recipeAuthorized = true;
+                for (const name of Object.keys(nativeHeaders))
+                    replayedHeaders.add(name);
+                nativeUrl = granted.url;
+                issued = undefined;
+            }
+            const endpoints = Object.values(outputs).flatMap((value) => {
+                try {
+                    const url = new URL(value);
+                    return url.protocol === 'https:' && !url.username && !url.password ? [url] : [];
+                }
+                catch {
+                    return [];
+                }
+            });
+            const claimsNativeUrl = (u) => {
+                return nativeUrl !== undefined && hostRules(u.hosts).takes(nativeUrl.hostname, nativeUrl.pathname);
+            };
+            if (nativeUrl && !units.some(claimsNativeUrl)) {
+                out.push(`${units.map((u) => u.name).join(', ')}: credential door native url ${nativeUrl.origin} matches no selected unit's declared host rules${said}`);
+                continue;
+            }
+            const hostCandidates = (u) => {
+                const claims = hostRules(u.hosts);
+                const remote = u.manifest.remoteHost;
+                const remoteHost = remote?.template.replace(/\{([^}]+)\}/g, (_match, name) => Object.values(remote.values?.[name] ?? {})[0] ?? 'conformance');
+                if (remoteHost && !claims.names(new URL(`https://${remoteHost}`).hostname))
+                    throw new Error(`${u.name}: its remote host ${remoteHost} matches none of its declared host rules`);
+                return [...new Set([
+                        ...(nativeUrl && claimsNativeUrl(u) ? [nativeUrl.host] : []),
+                        ...endpoints.map((url) => url.host),
+                        ...(remoteHost ? [remoteHost] : []),
+                        ...u.hosts.flatMap((rule) => 'host' in rule && rule.exclude !== true ? [rule.host] : []),
+                    ])];
+            };
+            const answers = new Map(units.map((u) => [u, new Map()]));
+            const removed = new Set();
+            const callOperation = async (u, op, request) => {
+                const now = Date.parse(runtime.worldNow());
+                const signing = u.strategy?.in === 'signature' && u.strategy.algorithm === 'aws-sigv4' ? u.strategy : undefined;
+                if (signing) {
+                    const keyPart = (suffix) => {
+                        const values = [...new Set(Object.entries(outputs).filter(([name]) => name === suffix || name.endsWith(`_${suffix}`)).map(([, value]) => value))];
+                        return values.length === 1 && values[0] ? values[0] : undefined;
+                    };
+                    const accessKeyId = keyPart('ACCESS_KEY_ID');
+                    const secretAccessKey = keyPart('SECRET_ACCESS_KEY');
+                    if (!accessKeyId || !secretAccessKey) {
+                        out.push(`${u.name}: its SigV4 credential door supplies no unambiguous access-key-id and secret-access-key pair${said}`);
+                        return undefined;
+                    }
+                    const url = new URL(request.url);
+                    const headers = Object.fromEntries(request.headers);
+                    const body = request.body === null ? undefined : await request.clone().text();
+                    const scope = typeof signing.scope === 'function' ? signing.scope({ method: request.method, path: url.pathname + url.search, host: url.host, headers, ...(body === undefined ? {} : { body }) }) : signing.scope;
+                    const signed = sigv4Headers({ accessKeyId, secretAccessKey, ...scope }, {}, request.method, request.url, headers, body, now);
+                    request = new Request(request, { headers: { ...headers, ...signed } });
+                }
+                const where = `${u.name}: ${op?.id ?? 'GraphQL refresh'} (${request.method} ${new URL(request.url).pathname})`;
+                const graphqlBody = request.method === 'POST' && u.manifest.graphql?.paths.includes(new URL(request.url).pathname)
+                    ? await request.clone().json().catch(() => undefined) : undefined;
+                const res = await send(request);
+                if (res instanceof Error) {
+                    out.push(`${where}: the connection failed${said} (${res.message})`);
+                    return undefined;
+                }
+                if (op)
+                    answers.get(u).set(op.id, res.status);
+                if (mode === 'plain') {
+                    tally.calls++;
+                    if (res.status < 300)
+                        tally.ok++;
+                    else
+                        tally.refused++;
+                }
+                if (res.bodyError) {
+                    out.push(`${where}: response body failed${said} (${res.bodyError.message})`);
+                    return undefined;
+                }
+                const text = res.text;
+                const response = { status: res.status, headers: res.headers, body: text, bodyBytes: res.bodyBytes };
+                const removal = op ? u.removedAt?.(op.id, Math.floor(now / 1000)) : undefined;
+                if (removal) {
+                    const expected = runtime.vendorError(u.manifest, removal);
+                    if (res.status === expected.status && text === await expected.text())
+                        removed.add(`${u.name}:${op.id}`);
+                    else
+                        out.push(`${where} does not match its declared native removal at ${new Date(now).toISOString()}${said}: expected ${removal.status} and its exact native body, received ${res.status}: ${text.slice(0, 160)}`);
+                }
+                const statuses = op ? u.responseStatuses.get(op.id) : undefined;
+                if (res.status === 500 && !statuses?.has('500') && !statuses?.has('5XX') && !statuses?.has('default'))
+                    out.push(`${where} answered 500${said}, which the spec does not declare: ${text.slice(0, 160)}`);
+                const type = res.headers['content-type'];
+                const judged = responseProblems(shape, vendorFields, { method: request.method, path: request.url, requestHeaders: Object.fromEntries(request.headers), graphqlBody,
+                    status: res.status, mediaType: type, body: decodeResponse(text, type), text });
+                for (const key of judged.leaks)
+                    out.push(`${where} answers the twin's own field ${key}${said}`);
+                for (const detail of judged.shape)
+                    out.push(`${where}: ${detail}${said}`);
+                return response;
+            };
+            const refreshed = new Set();
+            const nativeRefreshOwnsReads = recipeAuthorized && nativeHeaders !== undefined && units.some((unit) => unit.refreshReads.length > 0);
+            if (nativeRefreshOwnsReads) {
+                const vendor = (await manifestOf(pack)).vendor ?? basename(pack);
+                const refresh = runtime.getPack(vendor)?.stateSystem?.refresh;
+                if (!refresh)
+                    throw new Error(`${vendor}: its registered native refresh adapter is missing`);
+                try {
+                    await refresh(async (call) => {
+                        const u = units.find((unit) => unit.lane === (call.lane ?? ''));
+                        if (!u)
+                            throw new Error(`${vendor}: its native refresh names no selected unit`);
+                        const url = hostCandidates(u).map((host) => new URL(call.path, `https://${host}`)).find((candidate) => hostRules(u.hosts).takes(candidate.hostname, candidate.pathname));
+                        if (!url)
+                            throw new Error(`${u.name}: its native refresh request matches no declared host`);
+                        const headers = { ...call.headers, ...(claimsNativeUrl(u) ? nativeHeaders : {}) };
+                        const request = new Request(url, { method: call.method, headers, ...(call.body === undefined ? {} : { body: call.body }) });
+                        const operation = shape?.operationOf(call.method, url.href, Object.fromEntries(request.headers));
+                        const op = (operation?.lane ?? '') === u.lane ? u.ops.find((candidate) => candidate.id === operation?.op.id) : undefined;
+                        const graphql = call.method.toUpperCase() === 'POST' && u.manifest.graphql?.paths.includes(url.pathname);
+                        if (!op && !graphql)
+                            throw new Error(`${u.name}: its native refresh matches no served operation or declared GraphQL endpoint`);
+                        if (op)
+                            refreshed.add(`${u.name}:${op.id}`);
+                        const response = await callOperation(u, op, request);
+                        if (!response)
+                            throw new Error(`${u.name}: its native refresh request failed`);
+                        return response;
+                    }, { root });
+                }
+                catch (error) {
+                    const detail = error instanceof Error ? error.message : String(error);
+                    const secrets = Object.values(nativeHeaders).flatMap((value) => [value, value.split(/\s+/).slice(1).join(' ')]).filter(Boolean);
+                    out.push(`${vendor}: its native refresh adapter failed${said}: ${secrets.reduce((message, secret) => message.replaceAll(secret, '[redacted]'), detail)}`);
+                }
             }
-            const said = mode === 'scenario' ? ' with a scenario loaded' : '';
             for (const u of units) {
-                // a unit whose manifest declares no `auth` checks its key in its own front: the key goes as most vendors read
-                // one, a bearer token, and a refusal of it is no finding of the refresh below
+                // A front that checks its own key receives the door's token as a bearer.
                 const auth = u.auth ?? { header: 'authorization', scheme: 'Bearer' };
-                const credential = issued ? { [auth.header]: auth.scheme ? `${auth.scheme} ${issued}` : issued } : {};
-                const answered = new Map();
+                const native = nativeHeaders !== undefined && (!nativeUrl || claimsNativeUrl(u));
+                const credential = native ? nativeHeaders : issued ? { [auth.header]: auth.scheme ? `${auth.scheme} ${issued}` : issued } : {};
+                const signing = u.strategy?.in === 'signature' && u.strategy.algorithm === 'aws-sigv4' ? u.strategy : undefined;
+                if (!signing && u.auth && !native && !issued) {
+                    out.push(`${u.name}: its credential door supplies no nonempty credential for ${auth.header}${said}`);
+                    continue;
+                }
+                const claims = hostRules(u.hosts);
+                let hosts;
+                try {
+                    hosts = hostCandidates(u);
+                }
+                catch (error) {
+                    out.push(`${error.message}${said}`);
+                    continue;
+                }
                 for (const op of u.ops) {
-                    const request = sweepRequest(op, u.basePath, u.host, credential);
-                    const where = `${u.name}: ${op.id} (${request.method} ${new URL(request.url).pathname})`;
-                    const res = await send(request);
-                    if (res === 'timeout') {
-                        out.push(`${where} answered nothing in 10 s${said}`);
-                        continue;
-                    }
-                    if (res instanceof Error) {
-                        out.push(`${where}: the connection failed${said} (${res.message})`);
-                        continue;
-                    }
-                    answered.set(op.id, res.status);
-                    if (mode === 'plain') {
-                        tally.calls++;
-                        if (res.status < 300)
-                            tally.ok++;
-                        else
-                            tally.refused++;
-                    }
-                    const text = await res.text();
-                    if (res.status === 500 && !op.responseMedia?.['500'] && !op.responseMedia?.['5XX']) {
-                        out.push(`${where} answered 500${said}, which the spec does not declare: ${text.slice(0, 160)}`);
+                    if (refreshed.has(`${u.name}:${op.id}`))
                         continue;
-                    }
-                    if (mode === 'scenario')
+                    const request = hosts.map((host) => sweepRequest(op, u.basePath, host, signing ? {} : credential)).find((candidate) => {
+                        const url = new URL(candidate.url);
+                        return claims.takes(url.hostname, url.pathname);
+                    });
+                    if (!request) {
+                        out.push(`${u.name}: ${op.id} has no concrete declared host or issued HTTPS endpoint matching its host rules${said}`);
                         continue;
-                    const type = res.headers.get('content-type') ?? '';
-                    let body;
-                    if (/json/.test(type)) {
-                        try {
-                            body = JSON.parse(text);
-                        }
-                        catch {
-                            body = undefined;
-                        }
-                    }
-                    for (const key of leaked(body, vendorFields, '', !op.answers || res.status >= 300))
-                        out.push(`${where} answers the twin's own field ${key}`);
-                    if (res.status >= 200 && res.status < 300 && shape) {
-                        const hit = shape.operationOf(request.method, request.url, Object.fromEntries(request.headers));
-                        if (hit)
-                            for (const detail of shape.failures(hit.op, body, type, request.headers.get('accept') ?? undefined, res.status, { method: request.method, responseText: text }))
-                                out.push(`${where}: ${detail}`);
                     }
+                    await callOperation(u, op, request);
                 }
-                if (mode === 'plain')
+            }
+            const readSomething = units.some((u) => u.refreshReads.some((id) => { const status = answers.get(u)?.get(id); return status !== undefined && status >= 200 && status < 300; }));
+            if (mode === 'plain' && !nativeRefreshOwnsReads)
+                for (const u of units)
                     for (const r of u.refreshLists) {
                         const op = u.ops.find((o) => o.id === r.id);
                         if (!op || op.path.includes('{') || (op.basePath ?? '').includes('{'))
                             continue;
-                        const status = answered.get(r.id);
-                        if (status !== undefined && (status === 401 || status === 403) && (!u.auth || !issued))
+                        const status = answers.get(u)?.get(r.id);
+                        if (removed.has(`${u.name}:${r.id}`)) {
+                            tally.removed++;
+                            continue;
+                        }
+                        if (status === 403 && readSomething) {
+                            tally.unread++;
                             continue;
+                        }
                         if (status !== undefined && (status < 200 || status >= 300))
                             out.push(`${u.name}: ${r.resource}'s refresh lists by ${r.id}, which answered a fresh account ${status}: a World rooted at this twin reads nothing back`);
                     }
-            }
         }
         finally {
             await server.stop();
         }
     }
     // one defect repeated over a surface reads as one: the first 40 findings, and how many more
-    return { failures: out.length > 40 ? [...out.slice(0, 40), `… ${out.length - 40} more`] : out, note: `${tally.calls} served operations called, twice each: ${tally.ok} answered successfully, ${tally.refused} refused, unscripted` };
+    return { failures: out.length > 40 ? [...out.slice(0, 40), `… ${out.length - 40} more`] : out, note: `${tally.calls} served operations called, twice each: ${tally.ok} answered successfully, ${tally.refused} refused, unscripted; ${tally.unread} refresh resources unread (403), ${tally.removed} match declared native removals${replayedHeaders.size ? `; replayed application headers (values redacted): ${[...replayedHeaders].sort().join(', ')}` : ''}` };
 }
 /** A line protocol's connection over TCP, in the walk's stream shape. A line drew its replies when bytes arrived and then
  *  50 ms passed with no more (a multi-line reply arrives in pieces), or when 500 ms passed with none (a line that draws no
@@ -580,42 +832,22 @@ async function lifeServed(pack) {
         return ['journeys/customer-life.json is missing'];
     const { inMemoryWorld, usePacks, walk } = await import("./walk/behavior-journey.js");
     usePacks(dirname(pack), { dependenciesFrom: pack });
-    const env = globalThis.process.env;
     const served = async (root, options) => {
-        const before = env.VOLTER_WORLD_BOOT_ID;
-        env.VOLTER_WORLD_BOOT_ID = 'conformance';
-        let server;
-        try {
-            server = await serve(pack, { root, ...options });
-        }
-        finally {
-            if (before === undefined)
-                delete env.VOLTER_WORLD_BOOT_ID;
-            else
-                env.VOLTER_WORLD_BOOT_ID = before;
-        }
+        const server = await serve(pack, { root, ...options });
         const port = server.inspectPort ?? server.port;
         const http = servedHttpFetch(port);
         return {
             // the vendor's URL as the application called it, sent to the served pack: its host carried in the Host header
-            fetch: Object.assign(async (request) => {
-                await server.managedDatabaseUrl?.();
-                const abort = new AbortController();
-                try {
-                    const answer = await within(10_000, http(request, { signal: abort.signal }));
-                    return answer === 'timeout' ? new Response(`no answer in 10 s from the served pack (${request.method} ${new URL(request.url).pathname})`, { status: 599 }) : answer;
-                }
-                finally {
-                    abort.abort();
-                }
-            }, server.managedDatabaseUrl ? { managedDatabaseUrl: server.managedDatabaseUrl } : {}),
+            fetch: Object.assign(http, {
+                managedDatabaseUrl: server.managedDatabaseUrl,
+                managedDatabaseClock: server.managedDatabaseClock,
+                managedDatabaseConnection: server.managedDatabaseConnection,
+            }),
             // a socket opened as an application opens it: a WebSocket to the served port, the vendor's host in its Host header
             socket: (url, headers) => new WebSocket(`ws://127.0.0.1:${port}${url}`, { headers }),
             // TCP to the native wire: a separate listener beside HTTP, or the primary protocol port.
             stream: lineConnection(server.wirePort ?? server.port),
-            // bounded: Bun's server.stop(true) never settles once a WebSocket peer has closed under it (discord's life, Bun
-            // 1.3.11: the walk ended and the stop spun at full CPU for 45 minutes), so the check waits 5 s and goes on
-            stop: async () => { await within(5000, Promise.resolve(server.stop())); },
+            stop: () => server.stop(),
         };
     };
     const world = inMemoryWorld(`conform-${basename(pack)}`);
@@ -630,63 +862,39 @@ async function lifeServed(pack) {
 }
 /** The pack driven by the vendor's own client (clients/<vendor>.ts): served as a World runs it, its credentials issued
  *  by its credential door, the cases run in Node as an application runs the vendor's SDK (clients/run.ts), each the
- *  vendor's documented behaviour. A vendor whose descriptor names npm clients and has no cases fails it, unless the
- *  descriptor's clientCasesNone says why none is owed. */
-async function clientCases(pack, scratch) {
+ *  vendor's documented behaviour. Without a built-in module, the current installed workflow can supply that proof;
+ *  otherwise a vendor naming npm clients needs cases or clientCasesNone saying why none is owed. */
+async function clientCases(pack, scratch, consumer) {
     const vendor = (await manifestOf(pack)).vendor ?? basename(pack);
     const clients = join(dirname(fileURLToPath(import.meta.url)), 'clients');
     const extension = extname(fileURLToPath(import.meta.url));
     if (!existsSync(join(clients, `${vendor}${extension}`))) {
-        // a vendor whose descriptor names npm clients (adoption.sdks) is held to them: no case is no proof the SDK works,
-        // unless the descriptor says why none is owed (clientCasesNone: no official SDK, or none the demand's applications
-        // use); one an application calls with no SDK of the vendor's (a raw HTTP catalog) has no client to drive
         const descriptor = (await manifestOf(pack)).descriptor;
         const sdks = descriptor?.adoption?.sdks ?? [];
         if (descriptor?.clientCasesNone)
             return { failures: [], note: `${vendor} owes no client case: ${descriptor.clientCasesNone}` };
-        return sdks.length
-            ? { failures: [`${vendor} names npm clients (${sdks.join(', ')}) and has no client cases: add packages/twin-standard/src/clients/${vendor}.ts, the SDK driving the pack as an application does, or the descriptor's clientCasesNone saying why none is owed`] }
-            : { failures: [], note: `${vendor} declares no SDK of its own` };
+        if (!sdks.length)
+            return { failures: [], note: `${vendor} declares no SDK of its own` };
+        const proof = consumerClientProof(pack, vendor, sdks, consumer);
+        return { ...proof, failures: proof.failures.map((failure) => `${vendor} names npm clients (${sdks.join(', ')}) and has no built-in client cases: ${failure}`) };
     }
     const descriptor = (await manifestOf(pack)).descriptor;
     // the first host that names one: a descriptor may lead with a suffix (a region's hosts under one domain), which no
     // request addresses; the case's client reaches whatever host its issued credentials name
     // a raw protocol's pack (hostsNone: SMTP, whose relay is whatever host the operator names) is reached by its TCP
     // connection alone; its client names a stand-in host the connection never resolves
-    const host = descriptor?.hosts?.find((h) => h.host)?.host ?? (descriptor?.hostsNone ? 'relay.world.test' : undefined);
+    const host = descriptor?.hosts?.flatMap((h) => 'host' in h && h.exclude !== true ? [h.host] : [])[0] ?? (descriptor?.hostsNone ? 'relay.world.test' : undefined);
     if (!host)
         return { failures: ['the descriptor names no host for its client to address'] };
     const scenarioPath = join(scratch, 'client-scenario.json');
     writeFileSync(scenarioPath, '{"handlers":[]}');
-    const env = globalThis.process.env;
-    const before = env.VOLTER_WORLD_BOOT_ID;
-    env.VOLTER_WORLD_BOOT_ID = 'conformance';
-    let server;
-    try {
-        server = await serve(pack, { root: join(scratch, 'client-world'), scenarioPath });
-    }
-    finally {
-        if (before === undefined)
-            delete env.VOLTER_WORLD_BOOT_ID;
-        else
-            env.VOLTER_WORLD_BOOT_ID = before;
-    }
+    const server = await serve(pack, { root: join(scratch, 'client-world'), scenarioPath });
     try {
         // the World's credentials: what the pack's credential door issues, by the variable a World sets each in
         const issued = {};
         const door = descriptor?.credentialDoor;
         if (door) {
-            // a door that answers nothing is the pack's failure, never conform's hang (a pack served with a scenario that answered
-            // nothing once held this request open for good)
-            const abort = new AbortController();
-            const asked = await within(10_000, fetch(`http://127.0.0.1:${server.port}${door.path}`, { method: 'POST', headers: { host, 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: abort.signal }).then((r) => r.json().catch(() => ({}))));
-            abort.abort();
-            if (asked === 'timeout')
-                return { failures: [`the credential door (POST ${door.path}) answered nothing in 10 s, served with a scenario loaded`] };
-            const answer = asked;
-            for (const [name, field] of Object.entries(door.fill))
-                if (answer[field] !== undefined)
-                    issued[name] = String(answer[field]);
+            Object.assign(issued, (await credentialFields(server, door, host)).outputs);
         }
         const job = join(scratch, 'client-job.json');
         // a release carries its facts (generated/pack-facts.json, `twin-standard facts`); a source checkout does not, so its
@@ -790,7 +998,7 @@ export async function conformance(dir, options = {}) {
                 options.onCheck?.('client');
                 const asks = "driven by the vendor's own client (its official SDK), served as a World runs it, the vendor's documented behaviour holds";
                 try {
-                    const r = await clientCases(pack, scratch);
+                    const r = await clientCases(pack, scratch, options.consumer);
                     return { id: 'client', asks, failures: r.failures, ...(r.note ? { note: r.note } : {}) };
                 }
                 catch (error) {
@@ -799,7 +1007,7 @@ export async function conformance(dir, options = {}) {
             })(),
             await run('life', 'the life walked over HTTP against the pack served as a World runs it, with its scenario: every check held', () => lifeServed(pack)),
             await run('standalone', 'served by its server.ts as a World runs it, the pack answers HTTP and the boot probe, and each declared socket upgrades', () => standalone(pack)),
-            await run('surface', 'every served operation called over HTTP as an application calls it, plainly and with a scenario loaded: answered within 10 s, no undeclared 500, no field of the twin\'s own, a success in the spec\'s shape, and every refresh list a fresh account reads answering', () => surfaceSwept(pack, scratch)),
+            await run('surface', 'every served operation called over HTTP as an application calls it, plainly and with a scenario loaded: answered within 10 s, no undeclared 500, no field of the twin\'s own, a success in the spec\'s shape, and every refresh list answering, remaining unread under the native 403 contract, or matching its declared removal at the World clock', () => surfaceSwept(pack, scratch, runtime, options.consumer)),
             await run('records', 'each demand row cites the line it was read at, the spec\'s record names a vendored file that is there, the life names its author, the package has its README', () => records(pack)),
             await run('form', 'every unit passes the form section of the grade (the gate): the layout, the handler and kernel contracts, the manifest as data, the rules an author\'s code holds', () => formOf(pack)),
         ];