@volter/twin-standard 1.0.37 → 1.0.39

package/dist/src/browser-assessment.js

@@ -73,18 +73,19 @@ export async function chromiumServed(packDir, host) {
         await page.goto(harness);
         await page.clock.setFixedTime(syncClock());
         return {
-            fetch: async (request) => {
+            scheme: 'https',
+            fetch: async (request, options) => {
                 await page.clock.setFixedTime(syncClock());
                 const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
-                const result = await page.evaluate(async ({ url, method, headers, body }) => {
+                const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
                     const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
-                    const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials: 'include' });
+                    const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
                     const data = new Uint8Array(await response.arrayBuffer());
                     let text = '';
                     for (let i = 0; i < data.length; i += 32768)
                         text += String.fromCharCode(...data.subarray(i, i + 32768));
                     return { status: response.status, headers: [...response.headers], body: btoa(text) };
-                }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body });
+                }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
                 if (!result.status)
                     throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
                 return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });

package/dist/src/browser-verification.d.ts

@@ -15,5 +15,6 @@ export declare function verifyBrowserTransport(pack: string): Promise<{
     };
     binaryBytes: number;
     corsEnforced: boolean;
+    credentialModes: boolean;
     domCoverage: null;
 }>;

package/dist/src/browser-verification.js

@@ -9,6 +9,8 @@ import { inMemoryWorld } from "./walk/behavior-journey.js";
 import { chromiumServed } from "./browser-assessment.js";
 const require = createRequire(import.meta.url);
 export async function verifyBrowserTransport(pack) {
+    const started = performance.now();
+    const progress = (phase) => console.log(JSON.stringify({ purpose: 'browser-transport-fixture', phase, elapsedMs: Math.round(performance.now() - started) }));
     assert.ok(process.env.VOLTER_WORLD, 'browser transport verification must run through a World');
     assert.ok(!existsSync(pack), 'browser fixture directory must be new and task-owned');
     mkdirSync(join(pack, 'src'), { recursive: true });
@@ -22,6 +24,8 @@ export async function verifyBrowserTransport(pack) {
       { id: 'head', method: 'head', path: '/head', class: 'get' },
       { id: 'gap', method: 'get', path: '/gap', class: 'get' },
       { id: 'unused', method: 'get', path: '/unused', class: 'get' },
+      { id: 'publicCrossOrigin', method: 'get', path: '/public', class: 'get' },
+      { id: 'credentialedCrossOrigin', method: 'get', path: '/credentialed', class: 'get' },
     ] }, handlers: {
       login: async () => new Response(null, { status: 204, headers: [['set-cookie', 'session=fixture; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=3600'], ['set-cookie', 'second=fixture; Path=/; Secure; SameSite=Strict; Expires=Thu, 01 Jan 2026 01:00:00 GMT']] }),
       identity: async ({ request }) => {
@@ -31,6 +35,8 @@ export async function verifyBrowserTransport(pack) {
       },
       binary: async () => new Response(new Uint8Array(100000).fill(197), { headers: { 'content-type': 'application/octet-stream' } }),
       head: async () => new Response(null, { status: 204 }),
+      publicCrossOrigin: async () => Response.json({ public: true }, { headers: { 'access-control-allow-origin': '*' } }),
+      credentialedCrossOrigin: async () => Response.json({ credentialed: true }, { headers: { 'access-control-allow-origin': 'https://browser-fixture.test', 'access-control-allow-credentials': 'true' } }),
     }, gap: async () => Response.json({ error: 'unsupported' }, { status: 404 }) });
   }
   `);
@@ -42,6 +48,7 @@ export async function verifyBrowserTransport(pack) {
     const replays = [];
     try {
         for (let run = 0; run < 2; run++) {
+            progress(`replay-${run + 1}:start`);
             setClock('2026-01-01T00:00:00.000Z');
             const served = await browser.served(world.root(), {});
             try {
@@ -55,6 +62,7 @@ export async function verifyBrowserTransport(pack) {
                 setClock('2026-01-01T01:00:01.000Z');
                 const expired = await (await fetch('/identity')).json();
                 assert.deepEqual(expired, { authenticated: false, session: false, second: false }, 'native Expires and Max-Age must follow World time');
+                progress(`replay-${run + 1}:cookies`);
                 const binary = new Uint8Array(await (await fetch('/binary')).arrayBuffer());
                 assert.equal(binary.byteLength, 100000);
                 assert.ok(binary.every((byte) => byte === 197));
@@ -63,7 +71,15 @@ export async function verifyBrowserTransport(pack) {
                 assert.equal(await head.text(), '');
                 assert.equal((await fetch('/gap')).status, 404);
                 assert.equal((await fetch('/unknown')).status, 404);
+                progress(`replay-${run + 1}:responses`);
                 await assert.rejects(() => served.fetch(new Request('https://another-origin.test/identity')), /Failed to fetch/);
+                progress(`replay-${run + 1}:cors-denied`);
+                assert.deepEqual(await (await served.fetch(new Request('https://another-origin.test/public'))).json(), { public: true }, 'anonymous cross-origin fetch accepts a wildcard permission');
+                progress(`replay-${run + 1}:anonymous-cors`);
+                await assert.rejects(() => served.fetch(new Request('https://another-origin.test/public'), { credentials: 'include' }), /Failed to fetch/, 'credentialed fetch refuses wildcard permission');
+                progress(`replay-${run + 1}:credentialed-wildcard-denied`);
+                assert.deepEqual(await (await served.fetch(new Request('https://another-origin.test/credentialed'), { credentials: 'include' })).json(), { credentialed: true }, 'credentialed fetch requires matching origin and credential permission');
+                progress(`replay-${run + 1}:complete`);
                 replays.push({ identity, expired, binaryBytes: binary.byteLength, headStatus: head.status, gapStatus: 404 });
             }
             finally {
@@ -71,8 +87,8 @@ export async function verifyBrowserTransport(pack) {
             }
         }
         assert.deepEqual(replays[0], replays[1]);
-        assert.deepEqual([...seen].sort(), ['binary', 'gap', 'head', 'identity', 'login']);
-        return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 6, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, domCoverage: null };
+        assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin']);
+        return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 8, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, domCoverage: null };
     }
     finally {
         unsubscribe();

package/dist/src/walk/behavior-journey.d.ts

@@ -33,7 +33,10 @@ export type ServedTwin = (root: string, options: {
     scenarioPath?: string;
     application?: import('@volter/world-core').PackFetchOptions['application'];
 }) => Promise<{
-    fetch: (request: Request) => Promise<Response>;
+    scheme?: 'http' | 'https';
+    fetch: (request: Request, options?: {
+        credentials?: RequestCredentials;
+    }) => Promise<Response>;
     stop: () => void | Promise<void>;
     socket?: (url: string, headers: Record<string, string>) => WebSocket;
     stream?: TwinStream;

package/dist/src/walk/behavior-journey.js

@@ -239,6 +239,7 @@ export async function walk(journey, root, collect, opts) {
     const twin = served ? served.fetch : factory(root, { ...(scenarioPath ? { scenarioPath } : {}), application });
     const shape = await shapeOf(journey.vendor);
     const host = journey.host ?? 'twin.local';
+    const origin = `${served?.scheme ?? 'http'}://${host}`;
     // what an earlier walk captured, when this one continues it (the branch round-trip sends a life's write again)
     const captured = { ...(opts.captured ?? {}) };
     // a capture's JSON value where it is not text (a number, a boolean, an object such as database-js's `session`)
@@ -268,7 +269,9 @@ export async function walk(journey, root, collect, opts) {
         // a twin that throws answers 500, as a server would: the walk reports the step and goes on to the next
         let res;
         try {
-            res = await (companionOf(path)?.fetch ?? twin)(new Request(/^https?:\/\//.test(path) ? path : `http://${host}${path}`, init));
+            const request = new Request(/^https?:\/\//.test(path) ? path : `${origin}${path}`, init);
+            const companion = companionOf(path);
+            res = companion ? await companion.fetch(request) : served ? await served.fetch(request, { credentials: step.credentials ?? 'same-origin' }) : await twin(request);
         }
         catch (error) {
             res = new Response(`twin threw: ${error instanceof Error ? error.message : String(error)}`, { status: 500 });
@@ -287,7 +290,7 @@ export async function walk(journey, root, collect, opts) {
         // a hosted flow answers with a redirect: its target and query are what a step captures (redirect.code)
         const location = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
         if (location)
-            body = { location, redirect: Object.fromEntries(new URL(location, `http://${host}`).searchParams) };
+            body = { location, redirect: Object.fromEntries(new URL(location, origin).searchParams) };
         // every cookie an answer sets, joined as one header: a sign-in sets several, and a map keeps only the last
         const cookies = res.headers.getSetCookie();
         return { status: res.status, body, text, headers: { ...Object.fromEntries(res.headers), ...(cookies.length ? { 'set-cookie': cookies.join(', ') } : {}) } };
@@ -488,7 +491,7 @@ export async function walk(journey, root, collect, opts) {
         opts.hooks?.before?.(step, where, files);
         let answered = { status: 0, body: undefined };
         try {
-            const base = `http://${host}${where}`;
+            const base = `${origin}${where}`;
             const res = step.git === 'clone'
                 ? await gitClone(twin, base, { ...(step.ref ? { ref: step.ref } : {}) }, headers)
                 : await gitPush(twin, base, { ref: step.ref ?? 'refs/heads/main', ...(files ? { files } : {}), ...(step.message ? { message: step.message } : {}), ...(step.author ? { author: step.author } : {}), ...(step.amend ? { amend: true } : {}), ...(step.delete ? { delete: true } : {}) }, headers);
@@ -887,7 +890,7 @@ export async function walk(journey, root, collect, opts) {
                 // an OAuth 1.0a step is signed as its client signs it, over the URL it sends to, at the World clock's instant
                 if (step.oauth1) {
                     const o = parseExactJson(fill(JSON.stringify(step.oauth1), captured));
-                    const url = /^https?:\/\//.test(path) ? path : `http://${host}${path}`;
+                    const url = /^https?:\/\//.test(path) ? path : `${origin}${path}`;
                     // a form is signed as it is sent: its multipart type, whose parts OAuth 1.0a's base string never carries
                     const sent = formed ? undefined : body === undefined ? undefined : typeof body === 'string' ? body : JSON.stringify(body);
                     const contentType = Object.entries(headers ?? {}).find(([k]) => k.toLowerCase() === 'content-type')?.[1] ?? (formed ? formed.contentType : step.bodyBase64 === undefined ? defaultType(body) : undefined);
@@ -898,7 +901,7 @@ export async function walk(journey, root, collect, opts) {
                     headers = { ...(headers ?? {}), authorization: jwtAuthorization(step.jwt, captured) };
                 // an AWS SDK's request is signed as it sends it, at the World clock's instant
                 if (step.sigv4) {
-                    const url = /^https?:\/\//.test(path) ? path : `http://${host}${path}`;
+                    const url = /^https?:\/\//.test(path) ? path : `${origin}${path}`;
                     // the bytes and the type sent: a form's multipart body and boundary, raw bytes, or the body's text
                     const sent = formed ? formed.bytes : step.bodyBase64 !== undefined ? Uint8Array.from(Buffer.from(step.bodyBase64, 'base64')) : body === undefined ? undefined : typeof body === 'string' ? body : JSON.stringify(body);
                     const instant = clockFile && store.exists(clockFile) ? Date.parse((store.read(clockFile) ?? '').trim()) : Number.NaN;
@@ -950,7 +953,7 @@ export async function walk(journey, root, collect, opts) {
                     collect.push({ step: step.name, beat: 'LANDED', detail: e.message });
                 }
                 if (changesPath)
-                    beforeChange = (await send({ method: 'GET', headers: stepHeaders(step) }, changesPath)).text;
+                    beforeChange = (await send({ method: 'GET', headers: stepHeaders(step), credentials: step.credentials }, changesPath)).text;
             }
             const failuresBefore = collect.length;
             opts.hooks?.before?.(step, path, body);
@@ -1031,7 +1034,7 @@ export async function walk(journey, root, collect, opts) {
                 }
                 // LANDED beat, part two: a write that answered success must have moved something.
                 if (changesPath !== undefined && beforeChange !== undefined) {
-                    const after = await send({ method: 'GET', headers: stepHeaders(step) }, changesPath);
+                    const after = await send({ method: 'GET', headers: stepHeaders(step), credentials: step.credentials }, changesPath);
                     if (after.text === beforeChange) {
                         collect.push({ step: step.name, beat: 'LANDED', detail: `${step.method} ${path} answered ${res.status} and GET ${changesPath} is byte-identical to what it was before — the write reported success and stored nothing` });
                     }
@@ -1051,13 +1054,13 @@ export async function walk(journey, root, collect, opts) {
                         collect.push({ step: step.name, beat: 'ECHO (read back)', detail: e.message });
                         continue;
                     }
-                    const back = await send({ method: 'GET', headers: stepHeaders(step) }, readPath);
+                    const back = await send({ method: 'GET', headers: stepHeaders(step), credentials: step.credentials }, readPath);
                     if (back.status < 200 || back.status >= 300)
                         collect.push({ step: step.name, beat: 'ECHO (read back)', detail: `GET ${readPath} answered ${back.status} right after the create` });
                     else
                         for (const f of echoFailures(body, payload(back.body), except))
                             collect.push({ step: step.name, beat: 'ECHO (read back)', detail: `${f} — reading it back at ${readPath}` });
-                    created.push({ step: step.name, readBack: readPath, sent: body, except, at: step.creates.at });
+                    created.push({ step: step.name, readBack: readPath, sent: body, except, at: step.creates.at, credentials: step.credentials });
                 }
             }
             finally {
@@ -1067,7 +1070,7 @@ export async function walk(journey, root, collect, opts) {
         // PERSISTS — after the whole walk, everything created early must still be there.
         if (opts.beats) {
             for (const c of created) {
-                const back = await send({ method: 'GET' }, c.readBack);
+                const back = await send({ method: 'GET', credentials: c.credentials }, c.readBack);
                 if (back.status < 200 || back.status >= 300) {
                     collect.push({ step: c.step, beat: 'PERSISTS', detail: `GET ${c.readBack} answered ${back.status} at the END of the walk — it was created and did not survive` });
                     continue;
@@ -1118,7 +1121,7 @@ export async function withPinnedWorldDraws(fn) {
     let n = 0;
     globalThis.crypto.getRandomValues = ((array) => {
         const caller = (new Error().stack ?? '').split('\n')[2] ?? '';
-        if (!/world-core\/src\//.test(caller))
+        if (!/world-core[\\/](?:src|dist)[\\/]/.test(caller))
             return real(array);
         if (array) {
             const bytes = new Uint8Array(array.buffer, array.byteOffset, array.byteLength);
@@ -1129,7 +1132,7 @@ export async function withPinnedWorldDraws(fn) {
     });
     globalThis.crypto.subtle.generateKey = ((algorithm, extractable, usages) => {
         const caller = (new Error().stack ?? '').split('\n')[2] ?? '';
-        if (!/world-core\/src\//.test(caller))
+        if (!/world-core[\\/](?:src|dist)[\\/]/.test(caller))
             return generate(algorithm, extractable, usages);
         const shape = JSON.stringify([algorithm, extractable, usages]);
         const draw = keyDraws.get(shape) ?? 0;

package/dist/src/walk/journey-kit.d.ts

@@ -33,6 +33,8 @@ export type JourneyStep = {
      *  one of `body`, `bodyBase64` and `form`. */
     form?: JourneyForm;
     headers?: Record<string, string>;
+    /** Browser Fetch cookie mode; defaults to same-origin. Passed explicitly, independent of server Request getters. */
+    credentials?: 'omit' | 'same-origin' | 'include';
     /** The status this step must answer. Defaults to "any 2xx". */
     status?: number;
     /** Values for later steps: name → a dot path into the answer, `text:<pattern>` for a value read off a page's or mail's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-standard",
-  "version": "1.0.37",
+  "version": "1.0.39",
   "description": "The Protocol 3 standard for Volter twin packs: the criteria a pack is graded by, the grader, the gate a pack repository and the twin catalog run on every change and submission, and the spec derivation the grade checks against. Pin a version: every place a pack is judged judges by that standard.",
   "keywords": [
     "twin",
@@ -75,7 +75,7 @@
     "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.45",
+    "@volter/world-core": "3.0.47",
     "@volter/world-runtime": "*",
     "playwright": "^1.63.0"
   },

package/src/browser-assessment.ts

@@ -48,17 +48,18 @@ export async function chromiumServed(packDir: string, host: string) {
     await page.goto(harness);
     await page.clock.setFixedTime(syncClock());
     return {
-      fetch: async (request: Request) => {
+      scheme: 'https',
+      fetch: async (request: Request, options?: { credentials?: RequestCredentials }) => {
         await page.clock.setFixedTime(syncClock());
         const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
-        const result = await page.evaluate(async ({ url, method, headers, body }) => {
+        const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
           const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
-          const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials: 'include' });
+          const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
           const data = new Uint8Array(await response.arrayBuffer());
           let text = '';
           for (let i = 0; i < data.length; i += 32768) text += String.fromCharCode(...data.subarray(i, i + 32768));
           return { status: response.status, headers: [...response.headers], body: btoa(text) };
-        }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body });
+        }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
         if (!result.status) throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
         return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });
       },

package/src/browser-verification.ts

@@ -9,6 +9,8 @@ import { inMemoryWorld } from './walk/behavior-journey.ts';
 import { chromiumServed } from './browser-assessment.ts';
 const require = createRequire(import.meta.url);
 export async function verifyBrowserTransport(pack: string) {
+  const started = performance.now();
+  const progress = (phase: string) => console.log(JSON.stringify({ purpose: 'browser-transport-fixture', phase, elapsedMs: Math.round(performance.now() - started) }));
   assert.ok(process.env.VOLTER_WORLD, 'browser transport verification must run through a World');
   assert.ok(!existsSync(pack), 'browser fixture directory must be new and task-owned');
 
@@ -23,6 +25,8 @@ export async function verifyBrowserTransport(pack: string) {
       { id: 'head', method: 'head', path: '/head', class: 'get' },
       { id: 'gap', method: 'get', path: '/gap', class: 'get' },
       { id: 'unused', method: 'get', path: '/unused', class: 'get' },
+      { id: 'publicCrossOrigin', method: 'get', path: '/public', class: 'get' },
+      { id: 'credentialedCrossOrigin', method: 'get', path: '/credentialed', class: 'get' },
     ] }, handlers: {
       login: async () => new Response(null, { status: 204, headers: [['set-cookie', 'session=fixture; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=3600'], ['set-cookie', 'second=fixture; Path=/; Secure; SameSite=Strict; Expires=Thu, 01 Jan 2026 01:00:00 GMT']] }),
       identity: async ({ request }) => {
@@ -32,6 +36,8 @@ export async function verifyBrowserTransport(pack: string) {
       },
       binary: async () => new Response(new Uint8Array(100000).fill(197), { headers: { 'content-type': 'application/octet-stream' } }),
       head: async () => new Response(null, { status: 204 }),
+      publicCrossOrigin: async () => Response.json({ public: true }, { headers: { 'access-control-allow-origin': '*' } }),
+      credentialedCrossOrigin: async () => Response.json({ credentialed: true }, { headers: { 'access-control-allow-origin': 'https://browser-fixture.test', 'access-control-allow-credentials': 'true' } }),
     }, gap: async () => Response.json({ error: 'unsupported' }, { status: 404 }) });
   }
   `);
@@ -43,6 +49,7 @@ export async function verifyBrowserTransport(pack: string) {
   const replays = [];
   try {
     for (let run = 0; run < 2; run++) {
+      progress(`replay-${run + 1}:start`);
       setClock('2026-01-01T00:00:00.000Z');
       const served = await browser.served(world.root(), {});
       try {
@@ -56,6 +63,7 @@ export async function verifyBrowserTransport(pack: string) {
         setClock('2026-01-01T01:00:01.000Z');
         const expired = await (await fetch('/identity')).json();
         assert.deepEqual(expired, { authenticated: false, session: false, second: false }, 'native Expires and Max-Age must follow World time');
+        progress(`replay-${run + 1}:cookies`);
         const binary = new Uint8Array(await (await fetch('/binary')).arrayBuffer());
         assert.equal(binary.byteLength, 100000);
         assert.ok(binary.every((byte) => byte === 197));
@@ -63,12 +71,20 @@ export async function verifyBrowserTransport(pack: string) {
         assert.equal(head.status, 204); assert.equal(await head.text(), '');
         assert.equal((await fetch('/gap')).status, 404);
         assert.equal((await fetch('/unknown')).status, 404);
+        progress(`replay-${run + 1}:responses`);
         await assert.rejects(() => served.fetch(new Request('https://another-origin.test/identity')), /Failed to fetch/);
+        progress(`replay-${run + 1}:cors-denied`);
+        assert.deepEqual(await (await served.fetch(new Request('https://another-origin.test/public'))).json(), { public: true }, 'anonymous cross-origin fetch accepts a wildcard permission');
+        progress(`replay-${run + 1}:anonymous-cors`);
+        await assert.rejects(() => served.fetch(new Request('https://another-origin.test/public'), { credentials: 'include' }), /Failed to fetch/, 'credentialed fetch refuses wildcard permission');
+        progress(`replay-${run + 1}:credentialed-wildcard-denied`);
+        assert.deepEqual(await (await served.fetch(new Request('https://another-origin.test/credentialed'), { credentials: 'include' })).json(), { credentialed: true }, 'credentialed fetch requires matching origin and credential permission');
+        progress(`replay-${run + 1}:complete`);
         replays.push({ identity, expired, binaryBytes: binary.byteLength, headStatus: head.status, gapStatus: 404 });
       } finally { await served.stop(); }
     }
     assert.deepEqual(replays[0], replays[1]);
-    assert.deepEqual([...seen].sort(), ['binary', 'gap', 'head', 'identity', 'login']);
-    return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 6, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, domCoverage: null };
+    assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin']);
+    return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 8, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, domCoverage: null };
   } finally { unsubscribe(); try { await browser.stop(); } finally { world.restore(); } }
 }

package/src/walk/behavior-journey.ts

@@ -168,7 +168,7 @@ function takeReplies(c: Connection): LineReply[] {
 /** A pack served for a walk the way a World runs it (its server.ts on a port, the World's root and scenario its options):
  *  the walk's requests go to it over HTTP, the vendor's host in their Host header, instead of to the fetch in process;
  *  its sockets are WebSockets to that port, and a line connection (`stream`) is a TCP connection to its protocol port. */
-export type ServedTwin = (root: string, options: { scenarioPath?: string; application?: import('@volter/world-core').PackFetchOptions['application'] }) => Promise<{ fetch: (request: Request) => Promise<Response>; stop: () => void | Promise<void>; socket?: (url: string, headers: Record<string, string>) => WebSocket; stream?: TwinStream }>;
+export type ServedTwin = (root: string, options: { scenarioPath?: string; application?: import('@volter/world-core').PackFetchOptions['application'] }) => Promise<{ scheme?: 'http' | 'https'; fetch: (request: Request, options?: { credentials?: RequestCredentials }) => Promise<Response>; stop: () => void | Promise<void>; socket?: (url: string, headers: Record<string, string>) => WebSocket; stream?: TwinStream }>;
 
 export async function walk(journey: Journey, root: string, collect: Failure[], opts: { beats: boolean; verbose?: boolean; hooks?: StepHooks; captured?: Captured; served?: ServedTwin }): Promise<Captured> {
   attributionName(journey.author);
@@ -223,6 +223,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
   const twin = served ? served.fetch : factory(root, { ...(scenarioPath ? { scenarioPath } : {}), application });
   const shape = await shapeOf(journey.vendor);
   const host = journey.host ?? 'twin.local';
+  const origin = `${served?.scheme ?? 'http'}://${host}`;
   // what an earlier walk captured, when this one continues it (the branch round-trip sends a life's write again)
   const captured: Captured = { ...(opts.captured ?? {}) };
   // a capture's JSON value where it is not text (a number, a boolean, an object such as database-js's `session`)
@@ -231,9 +232,9 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
     captured[name] = v !== null && typeof v === 'object' ? JSON.stringify(v) : String(v);
     typedValues[name] = v;
   };
-  const created: Array<{ step: string; readBack: string; sent: unknown; except: string[]; at?: string }> = [];
+  const created: Array<{ step: string; readBack: string; sent: unknown; except: string[]; at?: string; credentials?: JourneyStep['credentials'] }> = [];
 
-  const send = async (step: Pick<JourneyStep, 'method' | 'body' | 'bodyBase64' | 'headers' | 'encode'> & { formed?: { contentType: string; bytes: Uint8Array<ArrayBuffer> } }, path: string, signal?: AbortSignal): Promise<Answer> => {
+  const send = async (step: Pick<JourneyStep, 'method' | 'body' | 'bodyBase64' | 'headers' | 'encode' | 'credentials'> & { formed?: { contentType: string; bytes: Uint8Array<ArrayBuffer> } }, path: string, signal?: AbortSignal): Promise<Answer> => {
     // raw bytes carry only the type the step names (a client that sends none, Dub's base64 image upload, sends none); a
     // form its own multipart type and boundary
     const headers = { ...(step.formed ? { 'content-type': step.formed.contentType } : step.bodyBase64 === undefined ? { 'content-type': defaultType(step.body) } : {}), ...(journey.headers ?? {}), ...(step.headers ?? {}) };
@@ -247,7 +248,11 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
     // a step may follow an absolute url an answer gave it (a hosted page's), as the application does
     // a twin that throws answers 500, as a server would: the walk reports the step and goes on to the next
     let res: Response;
-    try { res = await (companionOf(path)?.fetch ?? twin)(new Request(/^https?:\/\//.test(path) ? path : `http://${host}${path}`, init)); }
+    try {
+      const request = new Request(/^https?:\/\//.test(path) ? path : `${origin}${path}`, init);
+      const companion = companionOf(path);
+      res = companion ? await companion.fetch(request) : served ? await served.fetch(request, { credentials: step.credentials ?? 'same-origin' }) : await twin(request);
+    }
     catch (error) { res = new Response(`twin threw: ${error instanceof Error ? error.message : String(error)}`, { status: 500 }); }
     const text = await res.text();
     let body: unknown; try { body = parseExactJson(text); } catch { body = text; }
@@ -255,7 +260,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
     if (typeof body === 'string' && /xml/.test(res.headers.get('content-type') ?? '')) body = xmlMembers(text) ?? text;
     // a hosted flow answers with a redirect: its target and query are what a step captures (redirect.code)
     const location = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
-    if (location) body = { location, redirect: Object.fromEntries(new URL(location, `http://${host}`).searchParams) };
+    if (location) body = { location, redirect: Object.fromEntries(new URL(location, origin).searchParams) };
     // every cookie an answer sets, joined as one header: a sign-in sets several, and a map keeps only the last
     const cookies = res.headers.getSetCookie();
     return { status: res.status, body, text, headers: { ...Object.fromEntries(res.headers), ...(cookies.length ? { 'set-cookie': cookies.join(', ') } : {}) } };
@@ -379,7 +384,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
     opts.hooks?.before?.(step, where, files);
     let answered: { status: number; body: unknown } = { status: 0, body: undefined };
     try {
-      const base = `http://${host}${where}`;
+      const base = `${origin}${where}`;
       const res = step.git === 'clone'
         ? await gitClone(twin as Parameters<typeof gitClone>[0], base, { ...(step.ref ? { ref: step.ref } : {}) }, headers)
         : await gitPush(twin as Parameters<typeof gitPush>[0], base, { ref: step.ref ?? 'refs/heads/main', ...(files ? { files } : {}), ...(step.message ? { message: step.message } : {}), ...(step.author ? { author: step.author } : {}), ...(step.amend ? { amend: true } : {}), ...(step.delete ? { delete: true } : {}) }, headers);
@@ -625,7 +630,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
       // an OAuth 1.0a step is signed as its client signs it, over the URL it sends to, at the World clock's instant
       if (step.oauth1) {
         const o = parseExactJson(fill(JSON.stringify(step.oauth1), captured)) as NonNullable<JourneyStep['oauth1']>;
-        const url = /^https?:\/\//.test(path) ? path : `http://${host}${path}`;
+        const url = /^https?:\/\//.test(path) ? path : `${origin}${path}`;
         // a form is signed as it is sent: its multipart type, whose parts OAuth 1.0a's base string never carries
         const sent = formed ? undefined : body === undefined ? undefined : typeof body === 'string' ? body : JSON.stringify(body);
         const contentType = Object.entries(headers ?? {}).find(([k]) => k.toLowerCase() === 'content-type')?.[1] ?? (formed ? formed.contentType : step.bodyBase64 === undefined ? defaultType(body) : undefined);
@@ -635,7 +640,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
       if (step.jwt) headers = { ...(headers ?? {}), authorization: jwtAuthorization(step.jwt, captured) };
       // an AWS SDK's request is signed as it sends it, at the World clock's instant
       if (step.sigv4) {
-        const url = /^https?:\/\//.test(path) ? path : `http://${host}${path}`;
+        const url = /^https?:\/\//.test(path) ? path : `${origin}${path}`;
         // the bytes and the type sent: a form's multipart body and boundary, raw bytes, or the body's text
         const sent = formed ? formed.bytes : step.bodyBase64 !== undefined ? Uint8Array.from(Buffer.from(step.bodyBase64, 'base64')) : body === undefined ? undefined : typeof body === 'string' ? body : JSON.stringify(body);
         const instant = clockFile && store.exists(clockFile) ? Date.parse((store.read(clockFile) ?? '').trim()) : Number.NaN;
@@ -673,7 +678,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
     let changesPath: string | undefined;
     if (step.changes && opts.beats) {
       try { changesPath = fill(step.changes, captured); } catch (e) { collect.push({ step: step.name, beat: 'LANDED', detail: (e as Error).message }); }
-      if (changesPath) beforeChange = (await send({ method: 'GET', headers: stepHeaders(step) }, changesPath)).text;
+      if (changesPath) beforeChange = (await send({ method: 'GET', headers: stepHeaders(step), credentials: step.credentials }, changesPath)).text;
     }
     const failuresBefore = collect.length;
     opts.hooks?.before?.(step, path, body);
@@ -727,7 +732,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
 
     // LANDED beat, part two: a write that answered success must have moved something.
     if (changesPath !== undefined && beforeChange !== undefined) {
-      const after = await send({ method: 'GET', headers: stepHeaders(step) }, changesPath);
+      const after = await send({ method: 'GET', headers: stepHeaders(step), credentials: step.credentials }, changesPath);
       if (after.text === beforeChange) {
         collect.push({ step: step.name, beat: 'LANDED', detail: `${step.method} ${path} answered ${res.status} and GET ${changesPath} is byte-identical to what it was before — the write reported success and stored nothing` });
       }
@@ -741,10 +746,10 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
       }
       let readPath: string;
       try { readPath = fill(step.creates.readBack, captured); } catch (e) { collect.push({ step: step.name, beat: 'ECHO (read back)', detail: (e as Error).message }); continue; }
-      const back = await send({ method: 'GET', headers: stepHeaders(step) }, readPath);
+      const back = await send({ method: 'GET', headers: stepHeaders(step), credentials: step.credentials }, readPath);
       if (back.status < 200 || back.status >= 300) collect.push({ step: step.name, beat: 'ECHO (read back)', detail: `GET ${readPath} answered ${back.status} right after the create` });
       else for (const f of echoFailures(body, payload(back.body), except)) collect.push({ step: step.name, beat: 'ECHO (read back)', detail: `${f} — reading it back at ${readPath}` });
-      created.push({ step: step.name, readBack: readPath, sent: body, except, at: step.creates.at });
+      created.push({ step: step.name, readBack: readPath, sent: body, except, at: step.creates.at, credentials: step.credentials });
     }
     } finally {
       opts.hooks?.after?.(step, path, answered, collect.slice(failuresBefore));
@@ -754,7 +759,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
   // PERSISTS — after the whole walk, everything created early must still be there.
   if (opts.beats) {
     for (const c of created) {
-      const back = await send({ method: 'GET' }, c.readBack);
+      const back = await send({ method: 'GET', credentials: c.credentials }, c.readBack);
       if (back.status < 200 || back.status >= 300) { collect.push({ step: c.step, beat: 'PERSISTS', detail: `GET ${c.readBack} answered ${back.status} at the END of the walk — it was created and did not survive` }); continue; }
       for (const f of echoFailures(c.sent, c.at ? at(back.body, c.at) : back.body, c.except)) collect.push({ step: c.step, beat: 'PERSISTS', detail: `${f} — at the END of the walk` });
     }
@@ -793,13 +798,13 @@ export async function withPinnedWorldDraws<T>(fn: () => Promise<T>): Promise<T>
   let n = 0;
   globalThis.crypto.getRandomValues = (<A extends ArrayBufferView | null>(array: A): A => {
     const caller = (new Error().stack ?? '').split('\n')[2] ?? '';
-    if (!/world-core\/src\//.test(caller)) return real(array as ArrayBufferView) as A;
+    if (!/world-core[\\/](?:src|dist)[\\/]/.test(caller)) return real(array as ArrayBufferView) as A;
     if (array) { const bytes = new Uint8Array(array.buffer, array.byteOffset, array.byteLength); for (let i = 0; i < bytes.length; i++) bytes[i] = (n++ * 2654435761 + 97) >>> 24 & 0xff; }
     return array;
   }) as typeof globalThis.crypto.getRandomValues;
   globalThis.crypto.subtle.generateKey = ((algorithm: AlgorithmIdentifier, extractable: boolean, usages: KeyUsage[]) => {
     const caller = (new Error().stack ?? '').split('\n')[2] ?? '';
-    if (!/world-core\/src\//.test(caller)) return generate(algorithm as RsaHashedKeyGenParams, extractable, usages);
+    if (!/world-core[\\/](?:src|dist)[\\/]/.test(caller)) return generate(algorithm as RsaHashedKeyGenParams, extractable, usages);
     const shape = JSON.stringify([algorithm, extractable, usages]);
     const draw = keyDraws.get(shape) ?? 0;
     keyDraws.set(shape, draw + 1);

package/src/walk/journey-kit.ts

@@ -72,6 +72,8 @@ export type JourneyStep = {
    *  one of `body`, `bodyBase64` and `form`. */
   form?: JourneyForm;
   headers?: Record<string, string>;
+  /** Browser Fetch cookie mode; defaults to same-origin. Passed explicitly, independent of server Request getters. */
+  credentials?: 'omit' | 'same-origin' | 'include';
   /** The status this step must answer. Defaults to "any 2xx". */
   status?: number;
   /** Values for later steps: name → a dot path into the answer, `text:<pattern>` for a value read off a page's or mail's