@volter/twin-standard 1.0.62 → 1.0.64

package/dist/src/assessment.js

@@ -109,10 +109,10 @@ export async function assessPack(packDir, options = {}) {
     const httpOnly = life.steps.every((step) => 'method' in step || 'wait' in step);
     if (options.browser && httpOnly) {
         const { chromiumServed } = await import("./browser-assessment.js");
-        const transport = await chromiumServed(packDir, life.host ?? 'twin.local');
+        const transport = await chromiumServed(packDir, life.host ?? 'twin.local', 'http-journey');
         try {
             const a = await replay(transport.served), b = await replay(transport.served);
-            browser = { measured: true, target: 'Chromium fetch, cookie jar and HTTP response behavior; no DOM interaction coverage', version: transport.version, answered: a.trace.length, failures: [...a.failures, ...b.failures], replay: { equal: a.trace.length > 0 && json(a.trace) === json(b.trace), firstSha256: hash(a.trace), secondSha256: hash(b.trace), runs: 2 }, operationCoverage: coverageOf(a), domCoverage: null, clock: transport.clock };
+            browser = { measured: true, target: 'HTTP customer journey replay through Chromium at each request origin; authored HTTP headers and observed wire responses', responseObservation: 'Transport observes status, headers and body, including redirects and Set-Cookie; these are not JavaScript-visible response claims', applicationOriginCorsCoverage: null, cookieJarCoverage: null, version: transport.version, answered: a.trace.length, failures: [...a.failures, ...b.failures], replay: { equal: a.trace.length > 0 && json(a.trace) === json(b.trace), firstSha256: hash(a.trace), secondSha256: hash(b.trace), runs: 2 }, operationCoverage: coverageOf(a), domCoverage: null, clock: transport.clock };
         }
         finally {
             await transport.stop();

package/dist/src/browser-assessment.d.ts

@@ -1,5 +1,5 @@
 import type { ServedTwin } from './walk/behavior-journey.js';
-export declare function chromiumServed(packDir: string, host: string): Promise<{
+export declare function chromiumServed(packDir: string, host: string, mode?: 'browser-fetch' | 'http-journey'): Promise<{
     served: ServedTwin;
     version: string;
     clock: {

package/dist/src/browser-assessment.js

@@ -11,7 +11,7 @@ import { join } from 'node:path';
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { worldNow } from '@volter/world-core/runtime';
-export async function chromiumServed(packDir, host) {
+export async function chromiumServed(packDir, host, mode = 'browser-fetch') {
     const { chromium } = await import('playwright');
     const mod = await import(__rewriteRelativeImportExtension(join(packDir, 'src/index.ts')));
     const factory = Object.entries(mod).find(([name, value]) => /^create\w+Fetch$/.test(name) && !/TwinFetch$/.test(name) && typeof value === 'function')?.[1];
@@ -43,11 +43,12 @@ export async function chromiumServed(packDir, host) {
         syncClock();
         const fetchPack = factory({ root, ...options });
         const context = await browser.newContext({ serviceWorkers: 'block', locale: 'en-US', timezoneId: 'UTC' });
-        const page = await context.newPage();
-        const harness = `https://${host}/__catalog_assessment__`;
+        const pages = [];
+        const pending = new Map();
+        const harnesses = new Set();
         await context.route('**/*', async (route) => {
             const request = route.request();
-            if (request.url() === harness) {
+            if (request.isNavigationRequest() && harnesses.has(request.url())) {
                 await route.fulfill({ status: 200, contentType: 'text/html', body: '<!doctype html><title>Catalog assessment</title>' });
                 return;
             }
@@ -55,8 +56,12 @@ export async function chromiumServed(packDir, host) {
                 await route.abort('blockedbyclient');
                 return;
             }
+            const observation = pending.get(request.frame().page());
             try {
-                const response = await fetchPack(new Request(request.url(), { method: request.method(), headers: await request.allHeaders(), ...(request.postDataBuffer() ? { body: new Uint8Array(request.postDataBuffer()).buffer } : {}) }));
+                if (mode === 'http-journey' && !observation)
+                    throw new Error('HTTP journey request has no authored input');
+                // HTTP transcripts explicitly name actors and headers; strict browser checks use the native wire instead.
+                const response = await fetchPack(new Request(request.url(), { method: request.method(), headers: mode === 'http-journey' ? observation.request.headers : await request.allHeaders(), ...(request.postDataBuffer() ? { body: new Uint8Array(request.postDataBuffer()).buffer } : {}) }));
                 const headers = Object.fromEntries(response.headers);
                 // Playwright otherwise adds CORS permission to cross-origin fulfillments. Absence means denial on the vendor wire.
                 if (!Object.hasOwn(headers, 'access-control-allow-origin'))
@@ -64,31 +69,65 @@ export async function chromiumServed(packDir, host) {
                 const cookies = response.headers.getSetCookie();
                 if (cookies.length)
                     headers['set-cookie'] = cookies.join('\n');
-                await route.fulfill({ status: response.status, headers, body: Buffer.from(await response.arrayBuffer()) });
+                const bytes = Buffer.from(await response.arrayBuffer());
+                if (observation)
+                    observation.response = new Response(request.method() === 'HEAD' || [204, 205, 304].includes(response.status) ? null : bytes, { status: response.status, headers: response.headers });
+                await route.fulfill({ status: response.status, headers, body: bytes });
             }
-            catch {
+            catch (error) {
+                if (observation)
+                    observation.error = error;
                 await route.abort('failed');
             }
         });
-        await page.goto(harness);
-        await page.clock.setFixedTime(syncClock());
+        const acquire = async (origin) => {
+            const available = pages.find((entry) => entry.origin === origin && !entry.busy);
+            if (available) {
+                available.busy = true;
+                return available;
+            }
+            const page = await context.newPage();
+            const entry = { page, origin, busy: true };
+            pages.push(entry);
+            const harness = `${origin}/__catalog_assessment__`;
+            harnesses.add(harness);
+            await page.goto(harness);
+            return entry;
+        };
         return {
             scheme: 'https',
             fetch: async (request, options) => {
-                await page.clock.setFixedTime(syncClock());
-                const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
-                const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
-                    const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
-                    const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
-                    const data = new Uint8Array(await response.arrayBuffer());
-                    let text = '';
-                    for (let i = 0; i < data.length; i += 32768)
-                        text += String.fromCharCode(...data.subarray(i, i + 32768));
-                    return { status: response.status, headers: [...response.headers], body: btoa(text) };
-                }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
-                if (!result.status)
-                    throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
-                return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });
+                const entry = await acquire(mode === 'http-journey' ? new URL(request.url).origin : `https://${host}`);
+                const { page } = entry;
+                const observation = { request };
+                pending.set(page, observation);
+                try {
+                    await page.clock.setFixedTime(syncClock());
+                    const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
+                    const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
+                        const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
+                        const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
+                        const data = new Uint8Array(await response.arrayBuffer());
+                        let text = '';
+                        for (let i = 0; i < data.length; i += 32768)
+                            text += String.fromCharCode(...data.subarray(i, i + 32768));
+                        return { status: response.status, headers: [...response.headers], body: btoa(text) };
+                    }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
+                    if (mode === 'http-journey') {
+                        if (observation.error)
+                            throw observation.error;
+                        if (!observation.response)
+                            throw new Error('Chromium request produced no observed HTTP response');
+                        return observation.response;
+                    }
+                    if (!result.status)
+                        throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
+                    return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });
+                }
+                finally {
+                    pending.delete(page);
+                    entry.busy = false;
+                }
             },
             stop: () => context.close(),
         };

package/dist/src/browser-verification.d.ts

@@ -16,5 +16,12 @@ export declare function verifyBrowserTransport(pack: string): Promise<{
     binaryBytes: number;
     corsEnforced: boolean;
     credentialModes: boolean;
+    httpJourney: {
+        perRequestOrigin: boolean;
+        authoredActorHeaders: boolean;
+        redirectCaptures: boolean;
+        setCookieCaptures: boolean;
+        dispatchExactlyOnce: boolean;
+    };
     domCoverage: null;
 }>;

package/dist/src/browser-verification.js

@@ -26,9 +26,12 @@ export async function verifyBrowserTransport(pack) {
       { id: 'unused', method: 'get', path: '/unused', class: 'get' },
       { id: 'publicCrossOrigin', method: 'get', path: '/public', class: 'get' },
       { id: 'credentialedCrossOrigin', method: 'get', path: '/credentialed', class: 'get' },
+      { id: 'redirect', method: 'post', path: '/redirect', class: 'action' },
     ] }, handlers: {
       login: async () => new Response(null, { status: 204, headers: [['set-cookie', 'session=fixture; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=3600'], ['set-cookie', 'second=fixture; Path=/; Secure; SameSite=Strict; Expires=Thu, 01 Jan 2026 01:00:00 GMT']] }),
       identity: async ({ request }) => {
+        const actor = request.headers.get('cookie')?.match(/actor=([^;]+)/)?.[1];
+        if (actor) return Response.json({ actor, origin: request.headers.get('origin') });
         const session = request.headers.get('cookie')?.includes('session=fixture') || false;
         const second = request.headers.get('cookie')?.includes('second=fixture') || false;
         return Response.json({ authenticated: session && second, session, second });
@@ -37,6 +40,7 @@ export async function verifyBrowserTransport(pack) {
       head: async () => new Response(null, { status: 204 }),
       publicCrossOrigin: async () => Response.json({ public: true }, { headers: { 'access-control-allow-origin': '*' } }),
       credentialedCrossOrigin: async () => Response.json({ credentialed: true }, { headers: { 'access-control-allow-origin': 'https://browser-fixture.test', 'access-control-allow-credentials': 'true' } }),
+      redirect: async () => new Response(null, { status: 302, headers: [['location', 'https://console-fixture.test/identity'], ['set-cookie', 'actor=second; Path=/; Secure; HttpOnly'], ['set-cookie', 'redirect=fixture; Path=/; Secure']] }),
     }, gap: async () => Response.json({ error: 'unsupported' }, { status: 404 }) });
   }
   `);
@@ -46,6 +50,9 @@ export async function verifyBrowserTransport(pack) {
     const seen = new Set();
     const unsubscribe = observeDerivedDispatch(({ operation }) => seen.add(operation.id));
     const replays = [];
+    let redirects = 0;
+    const stopRedirects = observeDerivedDispatch(({ operation }) => { if (operation.id === 'redirect')
+        redirects++; });
     try {
         for (let run = 0; run < 2; run++) {
             progress(`replay-${run + 1}:start`);
@@ -79,6 +86,7 @@ export async function verifyBrowserTransport(pack) {
                 await assert.rejects(() => served.fetch(new Request('https://another-origin.test/public'), { credentials: 'include' }), /Failed to fetch/, 'credentialed fetch refuses wildcard permission');
                 progress(`replay-${run + 1}:credentialed-wildcard-denied`);
                 assert.deepEqual(await (await served.fetch(new Request('https://another-origin.test/credentialed'), { credentials: 'include' })).json(), { credentialed: true }, 'credentialed fetch requires matching origin and credential permission');
+                await assert.rejects(() => fetch('/redirect', 'POST'), /opaque response/, 'strict Fetch must not expose HTTP redirect captures');
                 progress(`replay-${run + 1}:complete`);
                 replays.push({ identity, expired, binaryBytes: binary.byteLength, headStatus: head.status, gapStatus: 404 });
             }
@@ -87,10 +95,42 @@ export async function verifyBrowserTransport(pack) {
             }
         }
         assert.deepEqual(replays[0], replays[1]);
-        assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin']);
-        return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 8, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, domCoverage: null };
+        setClock('2026-01-01T00:00:00.000Z');
+        progress('http-journey:launch');
+        const http = await chromiumServed(pack, 'browser-fixture.test', 'http-journey');
+        progress('http-journey:launched');
+        try {
+            for (let run = 0; run < 2; run++) {
+                progress(`http-journey-${run + 1}:start`);
+                setClock('2026-01-01T00:00:00.000Z');
+                const served = await http.served(world.root(), {});
+                try {
+                    const redirect = await served.fetch(new Request('https://api-fixture.test/redirect', { method: 'POST' }));
+                    progress(`http-journey-${run + 1}:redirect`);
+                    assert.equal(redirect.status, 302);
+                    assert.equal(redirect.headers.get('location'), 'https://console-fixture.test/identity');
+                    assert.equal(redirect.headers.getSetCookie().length, 2, 'HTTP observations retain all Set-Cookie headers');
+                    for (const actor of ['first', 'second', 'first']) {
+                        const response = await served.fetch(new Request('https://console-fixture.test/identity', { headers: { cookie: `actor=${actor}`, origin: 'https://authored-app.test' } }));
+                        assert.deepEqual(await response.json(), { actor, origin: 'https://authored-app.test' }, 'HTTP transcripts retain authored actor and origin headers');
+                    }
+                    assert.equal((await served.fetch(new Request('https://third-fixture.test/unknown'))).status, 404, 'changing hosts does not erase real HTTP gaps');
+                    progress(`http-journey-${run + 1}:complete`);
+                }
+                finally {
+                    await served.stop();
+                }
+            }
+        }
+        finally {
+            await http.stop();
+        }
+        assert.equal(redirects, 4, 'each strict or HTTP redirect request executes exactly once');
+        assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin', 'redirect']);
+        return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 9, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, httpJourney: { perRequestOrigin: true, authoredActorHeaders: true, redirectCaptures: true, setCookieCaptures: true, dispatchExactlyOnce: true }, domCoverage: null };
     }
     finally {
+        stopRedirects();
         unsubscribe();
         try {
             await browser.stop();

package/dist/src/create-pack.d.ts

@@ -26,7 +26,7 @@ export declare function packIndexFile(dir: string, vendor: string): string;
  *  itself: "Other wires"), or, for a unit whose spec is a proto, the gRPC seam over the schema derive-pack generated
  *  (src/generated/proto.gen.json, imported by its literal path). `--init` writes the plain one, `--index` the gRPC one once
  *  the unit's proto is derived. */
-export declare function serverFile(vendor: string, grpc: boolean): string;
+export declare function serverFile(vendor: string, grpc: boolean, wire?: boolean): string;
 /** A pack's tsconfig.json, a fixed file: what the grade's typecheck (soundness) compiles, the pack and its lanes. */
 export declare const TSCONFIG: string;
 /** The fixed files of a new pack, by path, for a vendor: what nobody should write by hand. */

package/dist/src/create-pack.js

@@ -336,10 +336,15 @@ export function packIndexFile(dir, vendor) {
  *  itself: "Other wires"), or, for a unit whose spec is a proto, the gRPC seam over the schema derive-pack generated
  *  (src/generated/proto.gen.json, imported by its literal path). `--init` writes the plain one, `--index` the gRPC one once
  *  the unit's proto is derived. */
-export function serverFile(vendor, grpc) {
+export function serverFile(vendor, grpc, wire = false) {
     const Name = pascal(vendor);
     const head = `// FETCH-FIRST (runtime contract R12b): a fixed file, the kernel's serve seam around the pack's fetch (./fetch.ts).\n`;
     const signature = `export async function create${Name}TwinServer(options: PackFetchOptions & { port?: number } = {}): Promise<{ port: number; stop: () => void }> {\n`;
+    if (grpc && wire) {
+        // a unit with a wire of its own beside its API (./stream.ts: the PlanetScale twin's MySQL protocol) serves it on a side
+        // port, `wirePort`, which the manifest's sidePorts declares
+        return `${head}import { grpc, serveStream, type PackFetchOptions } from '@volter/world-core';\nimport schema from './generated/proto.gen.json' with { type: 'json' };\nimport { create${Name}Fetch } from './fetch.ts';\nimport { create${Name}TwinStream } from './stream.ts';\n\nexport async function create${Name}TwinServer(options: PackFetchOptions & { port?: number; wirePort?: number } = {}): Promise<{ port: number; wirePort: number; stop: () => void }> {\n  const fetch = create${Name}Fetch(options);\n  // the vendor speaks gRPC (its manifest's \`grpc\`): HTTP/2 and HTTP/1 on one port, each rpc through the fetch\n  const server = await grpc.serveGrpc({ ...(options.port ? { port: options.port } : {}), fetch: async (r) => fetch(r), schema: schema as unknown as Parameters<typeof grpc.serveGrpc>[0]['schema'] });\n  // the unit's own wire beside its API, on its side port (the manifest's sidePorts: \`wirePort\`)\n  const wire = await serveStream({ port: options.wirePort ?? 0, stream: create${Name}TwinStream(options) });\n  return { port: server.port, wirePort: wire.port, stop: () => { wire.stop(); server.stop(); } };\n}\n`;
+    }
     if (grpc) {
         return `${head}import { grpc, type PackFetchOptions } from '@volter/world-core';\nimport schema from './generated/proto.gen.json' with { type: 'json' };\nimport { create${Name}Fetch } from './fetch.ts';\n\n${signature}  const fetch = create${Name}Fetch(options);\n  // the vendor speaks gRPC (its manifest's \`grpc\`): HTTP/2 and HTTP/1 on one port, each rpc through the fetch\n  return grpc.serveGrpc({ ...(options.port ? { port: options.port } : {}), fetch: async (r) => fetch(r), schema: schema as unknown as Parameters<typeof grpc.serveGrpc>[0]['schema'] });\n}\n`;
     }
@@ -541,7 +546,7 @@ export async function createPack(args) {
             // a unit whose spec is a proto (derive-pack generated its schema) is served over gRPC: its serve seam in that form,
             // the one form a unit takes after --init (a server.ts of a wire of the pack's own, SMTP's, is never written over)
             if (!lanesOnly && existsSync(join(dir, 'src', 'generated', 'proto.gen.json'))) {
-                writeFileSync(join(dir, 'src', 'server.ts'), serverFile(vendor, true));
+                writeFileSync(join(dir, 'src', 'server.ts'), serverFile(vendor, true, existsSync(join(dir, 'src', 'stream.ts'))));
                 console.log(`create-pack: wrote ${join(dir, 'src', 'server.ts')}`);
             }
         }

package/dist/src/walk/behavior-journey.js

@@ -8,7 +8,7 @@ import { attributionName } from "../verdict.js";
 // score-pack walks the life through it twice, on two fresh roots, and compares what they answer.
 //
 // The caller names the pack repository first (usePacks).
-import { redis } from '@volter/world-core';
+import { mysql, redis } from '@volter/world-core';
 import { gzipSync } from 'node:zlib';
 import { parse, visit } from 'graphql';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
@@ -16,7 +16,7 @@ import { join } from 'node:path';
 import { databaseSession, getActiveWorldStore, MemoryBlobStore, MemoryWorldStore, setActiveBlobStore, setActiveWorldStore, setDeliveryObserver, setInProcessTwins } from '@volter/world-core/runtime';
 import { createHostTable } from '@volter/world-core/host-routing';
 import packFactsDocument from '@volter/world-core/generated/pack-facts.json' with { type: 'json' };
-import { isResp, at, captureAt, echoFailures, expandFills, expectFailures, fill, fillJson, formBody, isGit, isLine, isSql, isSocket, isWait, jwtAuthorization, oauth1Authorization, presignedPath, sigv4Headers, waitMs } from "./journey-kit.js";
+import { isMysql, isResp, at, captureAt, echoFailures, expandFills, expectFailures, fill, fillJson, formBody, isGit, isLine, isSql, isSocket, isWait, jwtAuthorization, oauth1Authorization, presignedPath, sigv4Headers, waitMs } from "./journey-kit.js";
 import { lanesOf, lineShape, shapeChecker } from "./shape.js";
 import { xmlMembers } from "./xml-view.js";
 /** The pack repository the walk finds a vendor's pack in, set by the caller before its first walk. */
@@ -472,6 +472,79 @@ export async function walk(journey, root, collect, opts) {
             opts.hooks?.after?.(step, step.connection, answered, collect.slice(before));
         }
     };
+    // A MySQL step speaks the pack's MySQL wire as an application's driver does (@volter/world-core/mysql's client), on the
+    // same byte-stream adapter the owned TCP listener serves.
+    const mysqlConnections = new Map();
+    const mysqlStep = async (step) => {
+        const before = collect.length;
+        let answered = { status: 0, body: undefined };
+        const link = step.link ?? 'mysql';
+        opts.hooks?.before?.(step, link, step.mysql ?? '(sign in)');
+        try {
+            let body;
+            if (step.signIn) {
+                if (!served?.stream)
+                    streams ??= await vendorStream(packsDir(), journey.vendor);
+                const factory = served?.stream ?? streams?.(root, {});
+                if (!factory)
+                    throw new Error(`no create<Name>TwinStream adapter enrolled for ${journey.vendor}`);
+                let out = [];
+                const conn = factory({ write: (b) => { out.push(...b); }, end: () => { } }, '127.0.0.1');
+                await conn.settled();
+                const greeting = Uint8Array.from(out);
+                out = [];
+                const exchange = async (bytes) => { conn.data(bytes); await conn.settled(); const got = Uint8Array.from(out); out = []; return got; };
+                const signed = await mysql.mysqlSignIn(exchange, greeting, fill(step.signIn.user, captured), fill(step.signIn.password, captured), step.signIn.database ? fill(step.signIn.database, captured) : null);
+                if ('error' in signed)
+                    body = { ...signed.error };
+                else
+                    mysqlConnections.set(link, { exchange, close: () => conn.close() });
+            }
+            if (!body && step.mysql !== undefined) {
+                const c = mysqlConnections.get(link);
+                if (!c)
+                    throw new Error(`no MySQL connection "${link}" is open`);
+                const sql = fill(step.mysql, captured);
+                const result = step.values ? await mysql.mysqlExecute(c.exchange, sql, step.values.map((v) => (v === null ? null : fill(v, captured)))) : await mysql.mysqlQuery(c.exchange, sql);
+                body = 'error' in result ? { ...result.error }
+                    : 'columns' in result ? { columns: result.columns.map((col) => col.name), rows: result.rows.map((row) => Object.fromEntries(result.columns.map((col, i) => [col.name, row[i] ?? null]))) }
+                        : { ...result };
+            }
+            body ??= { signedIn: true };
+            const errno = typeof body.errno === 'number' ? body.errno : undefined;
+            answered = { status: errno ?? 0, body };
+            if (opts.verbose)
+                console.log(`  ${String(errno ?? 'OK').padEnd(4)} ${link.padEnd(6)} ${(step.mysql ?? '(sign in)').slice(0, 70).padEnd(70)} ${step.name}`);
+            if (step.refused !== undefined ? errno !== step.refused : errno !== undefined) {
+                collect.push({ step: step.name, beat: 'STATUS', detail: errno !== undefined ? `MySQL refused it: ${errno} ${String(body.message)}${step.refused ? ` (wanted ${step.refused})` : ''}` : `MySQL completed it, wanted ${step.refused}` });
+                return;
+            }
+            for (const [name, dot] of Object.entries(step.capture ?? {})) {
+                const value = captureAt(body, dot);
+                if (value === undefined || value === null)
+                    collect.push({ step: step.name, beat: 'CAPTURE', detail: `nothing at "${dot}" in the answer to capture as {${name}}` });
+                else
+                    remember(name, value);
+            }
+            try {
+                for (const detail of expectFailures(step.expect ?? [], body, captured))
+                    collect.push({ step: step.name, beat: 'EXPECT', detail });
+            }
+            catch (e) {
+                collect.push({ step: step.name, beat: 'CAPTURE', detail: e.message });
+            }
+            if (step.close) {
+                mysqlConnections.get(link)?.close();
+                mysqlConnections.delete(link);
+            }
+        }
+        catch (e) {
+            collect.push({ step: step.name, beat: 'MYSQL', detail: e.message });
+        }
+        finally {
+            opts.hooks?.after?.(step, link, answered, collect.slice(before));
+        }
+    };
     // A git step is a git client's clone or push on the pack's smart-HTTP plane (packages/twin-standard/src/walk/git-client.ts); its answer is
     // checked as a request's is (status, captures, expectations).
     const gitStep = async (step) => {
@@ -824,6 +897,10 @@ export async function walk(journey, root, collect, opts) {
     try {
         for (const step of journey.steps) {
             stepNow = step.name;
+            if (isMysql(step)) {
+                await mysqlStep(step);
+                continue;
+            }
             if (isResp(step)) {
                 await respStep(step);
                 continue;

package/dist/src/walk/journey-kit.d.ts

@@ -226,7 +226,29 @@ export type Journey = {
     }) => boolean;
     steps: Step[];
 };
-export type Step = JourneyStep | WaitStep | LineStep | GitStep | SocketStep | SqlStep | RespStep;
+export type Step = JourneyStep | WaitStep | LineStep | GitStep | SocketStep | SqlStep | RespStep | MysqlStep;
+/** A step on a MySQL wire (the kernel's @volter/world-core/mysql, a pack's `create<Name>TwinStream`), spoken as an
+ *  application's driver speaks it. `signIn` opens a named connection (`link`, `mysql` by default) with a user and
+ *  password (mysql_native_password); `mysql` sends a statement on it: a text query, or a prepared statement when
+ *  `values` binds its `?` placeholders (binary parameters and rows, as Prisma sends one). Its answer is the rows, each
+ *  its columns by name in MySQL's text format (`rows`, `columns`), or `{ affectedRows, insertId }`, or MySQL's refusal
+ *  `{ errno, sqlstate, message }`, which fails the step unless `refused` names its errno. */
+export type MysqlStep = {
+    name: string;
+    mysql?: string;
+    values?: Array<string | null>;
+    link?: string;
+    signIn?: {
+        user: string;
+        password: string;
+        database?: string;
+    };
+    close?: boolean;
+    refused?: number;
+    capture?: JourneyStep['capture'];
+    expect?: JourneyStep['expect'];
+};
+export declare const isMysql: (step: Step) => step is MysqlStep;
 /** A typed request/reply stream step. `resp` is one command or a pipeline of commands, on a named connection.
  * Captures and expectations see `{ replies, last, error }`; binary arguments use `{ base64 }`.
  * `read` drains pushes or a blocking command's answer without sending bytes. */

package/dist/src/walk/journey-kit.js

@@ -197,6 +197,7 @@ export function expandFills(journey) {
     });
     return steps.some((x, i) => x !== journey.steps[i]) ? { ...journey, steps } : journey;
 }
+export const isMysql = (step) => 'mysql' in step || 'signIn' in step;
 export const isResp = (step) => 'connection' in step;
 export const isLine = (step) => 'on' in step;
 export const isSocket = (step) => 'socket' in step;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-standard",
-  "version": "1.0.62",
+  "version": "1.0.64",
   "description": "The Protocol 3 standard for Volter twin packs: the criteria a pack is graded by, the grader, the gate a pack repository and the twin catalog run on every change and submission, and the spec derivation the grade checks against. Pin a version: every place a pack is judged judges by that standard.",
   "keywords": [
     "twin",
@@ -75,7 +75,7 @@
     "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.70",
+    "@volter/world-core": "3.0.72",
     "@volter/world-runtime": "*",
     "playwright": "^1.63.0"
   },

package/src/assessment.ts

@@ -81,10 +81,10 @@ export async function assessPack(packDir: string, options: AssessmentOptions = {
   const httpOnly = life.steps.every((step) => 'method' in step || 'wait' in step);
   if (options.browser && httpOnly) {
     const { chromiumServed } = await import('./browser-assessment.ts');
-    const transport = await chromiumServed(packDir, life.host ?? 'twin.local');
+    const transport = await chromiumServed(packDir, life.host ?? 'twin.local', 'http-journey');
     try {
       const a = await replay(transport.served), b = await replay(transport.served);
-      browser = { measured: true, target: 'Chromium fetch, cookie jar and HTTP response behavior; no DOM interaction coverage', version: transport.version, answered: a.trace.length, failures: [...a.failures, ...b.failures], replay: { equal: a.trace.length > 0 && json(a.trace) === json(b.trace), firstSha256: hash(a.trace), secondSha256: hash(b.trace), runs: 2 }, operationCoverage: coverageOf(a), domCoverage: null, clock: transport.clock };
+      browser = { measured: true, target: 'HTTP customer journey replay through Chromium at each request origin; authored HTTP headers and observed wire responses', responseObservation: 'Transport observes status, headers and body, including redirects and Set-Cookie; these are not JavaScript-visible response claims', applicationOriginCorsCoverage: null, cookieJarCoverage: null, version: transport.version, answered: a.trace.length, failures: [...a.failures, ...b.failures], replay: { equal: a.trace.length > 0 && json(a.trace) === json(b.trace), firstSha256: hash(a.trace), secondSha256: hash(b.trace), runs: 2 }, operationCoverage: coverageOf(a), domCoverage: null, clock: transport.clock };
     } finally { await transport.stop(); }
   }
   const conform = options.conformance === false ? null : await conformance(packDir);

package/src/browser-assessment.ts

@@ -4,7 +4,7 @@ import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { worldNow } from '@volter/world-core/runtime';
 import type { ServedTwin } from './walk/behavior-journey.ts';
-export async function chromiumServed(packDir: string, host: string) {
+export async function chromiumServed(packDir: string, host: string, mode: 'browser-fetch' | 'http-journey' = 'browser-fetch') {
   const { chromium } = await import('playwright');
   const mod = await import(join(packDir, 'src/index.ts')) as Record<string, unknown>;
   const factory = Object.entries(mod).find(([name, value]) => /^create\w+Fetch$/.test(name) && !/TwinFetch$/.test(name) && typeof value === 'function')?.[1] as ((options: import('@volter/world-core').PackFetchOptions) => (request: Request) => Promise<Response>) | undefined;
@@ -29,39 +29,66 @@ export async function chromiumServed(packDir: string, host: string) {
     syncClock();
     const fetchPack = factory({ root, ...options });
     const context = await browser.newContext({ serviceWorkers: 'block', locale: 'en-US', timezoneId: 'UTC' });
-    const page = await context.newPage();
-    const harness = `https://${host}/__catalog_assessment__`;
+    type Page = Awaited<ReturnType<typeof context.newPage>>;
+    const pages: Array<{ page: Page; origin: string; busy: boolean }> = [];
+    const pending = new Map<Page, { request: Request; response?: Response; error?: unknown }>();
+    const harnesses = new Set<string>();
     await context.route('**/*', async (route) => {
       const request = route.request();
-      if (request.url() === harness) { await route.fulfill({ status: 200, contentType: 'text/html', body: '<!doctype html><title>Catalog assessment</title>' }); return; }
+      if (request.isNavigationRequest() && harnesses.has(request.url())) { await route.fulfill({ status: 200, contentType: 'text/html', body: '<!doctype html><title>Catalog assessment</title>' }); return; }
       if (!['xhr', 'fetch'].includes(request.resourceType())) { await route.abort('blockedbyclient'); return; }
+      const observation = pending.get(request.frame().page());
       try {
-        const response = await fetchPack(new Request(request.url(), { method: request.method(), headers: await request.allHeaders(), ...(request.postDataBuffer() ? { body: new Uint8Array(request.postDataBuffer()!).buffer } : {}) }));
+        if (mode === 'http-journey' && !observation) throw new Error('HTTP journey request has no authored input');
+        // HTTP transcripts explicitly name actors and headers; strict browser checks use the native wire instead.
+        const response = await fetchPack(new Request(request.url(), { method: request.method(), headers: mode === 'http-journey' ? observation!.request.headers : await request.allHeaders(), ...(request.postDataBuffer() ? { body: new Uint8Array(request.postDataBuffer()!).buffer } : {}) }));
         const headers = Object.fromEntries(response.headers);
         // Playwright otherwise adds CORS permission to cross-origin fulfillments. Absence means denial on the vendor wire.
         if (!Object.hasOwn(headers, 'access-control-allow-origin')) headers['access-control-allow-origin'] = '';
         const cookies = response.headers.getSetCookie();
         if (cookies.length) headers['set-cookie'] = cookies.join('\n');
-        await route.fulfill({ status: response.status, headers, body: Buffer.from(await response.arrayBuffer()) });
-      } catch { await route.abort('failed'); }
+        const bytes = Buffer.from(await response.arrayBuffer());
+        if (observation) observation.response = new Response(request.method() === 'HEAD' || [204, 205, 304].includes(response.status) ? null : bytes, { status: response.status, headers: response.headers });
+        await route.fulfill({ status: response.status, headers, body: bytes });
+      } catch (error) { if (observation) observation.error = error; await route.abort('failed'); }
     });
-    await page.goto(harness);
-    await page.clock.setFixedTime(syncClock());
+    const acquire = async (origin: string) => {
+      const available = pages.find((entry) => entry.origin === origin && !entry.busy);
+      if (available) { available.busy = true; return available; }
+      const page = await context.newPage();
+      const entry = { page, origin, busy: true };
+      pages.push(entry);
+      const harness = `${origin}/__catalog_assessment__`;
+      harnesses.add(harness);
+      await page.goto(harness);
+      return entry;
+    };
     return {
       scheme: 'https',
       fetch: async (request: Request, options?: { credentials?: RequestCredentials }) => {
-        await page.clock.setFixedTime(syncClock());
-        const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
-        const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
-          const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
-          const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
-          const data = new Uint8Array(await response.arrayBuffer());
-          let text = '';
-          for (let i = 0; i < data.length; i += 32768) text += String.fromCharCode(...data.subarray(i, i + 32768));
-          return { status: response.status, headers: [...response.headers], body: btoa(text) };
-        }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
-        if (!result.status) throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
-        return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });
+        const entry = await acquire(mode === 'http-journey' ? new URL(request.url).origin : `https://${host}`);
+        const { page } = entry;
+        const observation = { request } as { request: Request; response?: Response; error?: unknown };
+        pending.set(page, observation);
+        try {
+          await page.clock.setFixedTime(syncClock());
+          const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
+          const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
+            const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
+            const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
+            const data = new Uint8Array(await response.arrayBuffer());
+            let text = '';
+            for (let i = 0; i < data.length; i += 32768) text += String.fromCharCode(...data.subarray(i, i + 32768));
+            return { status: response.status, headers: [...response.headers], body: btoa(text) };
+          }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
+          if (mode === 'http-journey') {
+            if (observation.error) throw observation.error;
+            if (!observation.response) throw new Error('Chromium request produced no observed HTTP response');
+            return observation.response;
+          }
+          if (!result.status) throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
+          return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });
+        } finally { pending.delete(page); entry.busy = false; }
       },
       stop: () => context.close(),
     };

package/src/browser-verification.ts

@@ -27,9 +27,12 @@ export async function verifyBrowserTransport(pack: string) {
       { id: 'unused', method: 'get', path: '/unused', class: 'get' },
       { id: 'publicCrossOrigin', method: 'get', path: '/public', class: 'get' },
       { id: 'credentialedCrossOrigin', method: 'get', path: '/credentialed', class: 'get' },
+      { id: 'redirect', method: 'post', path: '/redirect', class: 'action' },
     ] }, handlers: {
       login: async () => new Response(null, { status: 204, headers: [['set-cookie', 'session=fixture; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=3600'], ['set-cookie', 'second=fixture; Path=/; Secure; SameSite=Strict; Expires=Thu, 01 Jan 2026 01:00:00 GMT']] }),
       identity: async ({ request }) => {
+        const actor = request.headers.get('cookie')?.match(/actor=([^;]+)/)?.[1];
+        if (actor) return Response.json({ actor, origin: request.headers.get('origin') });
         const session = request.headers.get('cookie')?.includes('session=fixture') || false;
         const second = request.headers.get('cookie')?.includes('second=fixture') || false;
         return Response.json({ authenticated: session && second, session, second });
@@ -38,6 +41,7 @@ export async function verifyBrowserTransport(pack: string) {
       head: async () => new Response(null, { status: 204 }),
       publicCrossOrigin: async () => Response.json({ public: true }, { headers: { 'access-control-allow-origin': '*' } }),
       credentialedCrossOrigin: async () => Response.json({ credentialed: true }, { headers: { 'access-control-allow-origin': 'https://browser-fixture.test', 'access-control-allow-credentials': 'true' } }),
+      redirect: async () => new Response(null, { status: 302, headers: [['location', 'https://console-fixture.test/identity'], ['set-cookie', 'actor=second; Path=/; Secure; HttpOnly'], ['set-cookie', 'redirect=fixture; Path=/; Secure']] }),
     }, gap: async () => Response.json({ error: 'unsupported' }, { status: 404 }) });
   }
   `);
@@ -47,6 +51,8 @@ export async function verifyBrowserTransport(pack: string) {
   const seen = new Set<string>();
   const unsubscribe = observeDerivedDispatch(({ operation }) => seen.add(operation.id));
   const replays = [];
+  let redirects = 0;
+  const stopRedirects = observeDerivedDispatch(({ operation }) => { if (operation.id === 'redirect') redirects++; });
   try {
     for (let run = 0; run < 2; run++) {
       progress(`replay-${run + 1}:start`);
@@ -79,12 +85,38 @@ export async function verifyBrowserTransport(pack: string) {
         await assert.rejects(() => served.fetch(new Request('https://another-origin.test/public'), { credentials: 'include' }), /Failed to fetch/, 'credentialed fetch refuses wildcard permission');
         progress(`replay-${run + 1}:credentialed-wildcard-denied`);
         assert.deepEqual(await (await served.fetch(new Request('https://another-origin.test/credentialed'), { credentials: 'include' })).json(), { credentialed: true }, 'credentialed fetch requires matching origin and credential permission');
+        await assert.rejects(() => fetch('/redirect', 'POST'), /opaque response/, 'strict Fetch must not expose HTTP redirect captures');
         progress(`replay-${run + 1}:complete`);
         replays.push({ identity, expired, binaryBytes: binary.byteLength, headStatus: head.status, gapStatus: 404 });
       } finally { await served.stop(); }
     }
     assert.deepEqual(replays[0], replays[1]);
-    assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin']);
-    return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 8, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, domCoverage: null };
-  } finally { unsubscribe(); try { await browser.stop(); } finally { world.restore(); } }
+    setClock('2026-01-01T00:00:00.000Z');
+    progress('http-journey:launch');
+    const http = await chromiumServed(pack, 'browser-fixture.test', 'http-journey');
+    progress('http-journey:launched');
+    try {
+      for (let run = 0; run < 2; run++) {
+        progress(`http-journey-${run + 1}:start`);
+        setClock('2026-01-01T00:00:00.000Z');
+        const served = await http.served(world.root(), {});
+        try {
+          const redirect = await served.fetch(new Request('https://api-fixture.test/redirect', { method: 'POST' }));
+          progress(`http-journey-${run + 1}:redirect`);
+          assert.equal(redirect.status, 302);
+          assert.equal(redirect.headers.get('location'), 'https://console-fixture.test/identity');
+          assert.equal(redirect.headers.getSetCookie().length, 2, 'HTTP observations retain all Set-Cookie headers');
+          for (const actor of ['first', 'second', 'first']) {
+            const response = await served.fetch(new Request('https://console-fixture.test/identity', { headers: { cookie: `actor=${actor}`, origin: 'https://authored-app.test' } }));
+            assert.deepEqual(await response.json(), { actor, origin: 'https://authored-app.test' }, 'HTTP transcripts retain authored actor and origin headers');
+          }
+          assert.equal((await served.fetch(new Request('https://third-fixture.test/unknown'))).status, 404, 'changing hosts does not erase real HTTP gaps');
+          progress(`http-journey-${run + 1}:complete`);
+        } finally { await served.stop(); }
+      }
+    } finally { await http.stop(); }
+    assert.equal(redirects, 4, 'each strict or HTTP redirect request executes exactly once');
+    assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin', 'redirect']);
+    return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 9, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, httpJourney: { perRequestOrigin: true, authoredActorHeaders: true, redirectCaptures: true, setCookieCaptures: true, dispatchExactlyOnce: true }, domCoverage: null };
+  } finally { stopRedirects(); unsubscribe(); try { await browser.stop(); } finally { world.restore(); } }
 }

package/src/create-pack.ts

@@ -324,10 +324,15 @@ export function packIndexFile(dir: string, vendor: string): string {
  *  itself: "Other wires"), or, for a unit whose spec is a proto, the gRPC seam over the schema derive-pack generated
  *  (src/generated/proto.gen.json, imported by its literal path). `--init` writes the plain one, `--index` the gRPC one once
  *  the unit's proto is derived. */
-export function serverFile(vendor: string, grpc: boolean): string {
+export function serverFile(vendor: string, grpc: boolean, wire = false): string {
   const Name = pascal(vendor);
   const head = `// FETCH-FIRST (runtime contract R12b): a fixed file, the kernel's serve seam around the pack's fetch (./fetch.ts).\n`;
   const signature = `export async function create${Name}TwinServer(options: PackFetchOptions & { port?: number } = {}): Promise<{ port: number; stop: () => void }> {\n`;
+  if (grpc && wire) {
+    // a unit with a wire of its own beside its API (./stream.ts: the PlanetScale twin's MySQL protocol) serves it on a side
+    // port, `wirePort`, which the manifest's sidePorts declares
+    return `${head}import { grpc, serveStream, type PackFetchOptions } from '@volter/world-core';\nimport schema from './generated/proto.gen.json' with { type: 'json' };\nimport { create${Name}Fetch } from './fetch.ts';\nimport { create${Name}TwinStream } from './stream.ts';\n\nexport async function create${Name}TwinServer(options: PackFetchOptions & { port?: number; wirePort?: number } = {}): Promise<{ port: number; wirePort: number; stop: () => void }> {\n  const fetch = create${Name}Fetch(options);\n  // the vendor speaks gRPC (its manifest's \`grpc\`): HTTP/2 and HTTP/1 on one port, each rpc through the fetch\n  const server = await grpc.serveGrpc({ ...(options.port ? { port: options.port } : {}), fetch: async (r) => fetch(r), schema: schema as unknown as Parameters<typeof grpc.serveGrpc>[0]['schema'] });\n  // the unit's own wire beside its API, on its side port (the manifest's sidePorts: \`wirePort\`)\n  const wire = await serveStream({ port: options.wirePort ?? 0, stream: create${Name}TwinStream(options) });\n  return { port: server.port, wirePort: wire.port, stop: () => { wire.stop(); server.stop(); } };\n}\n`;
+  }
   if (grpc) {
     return `${head}import { grpc, type PackFetchOptions } from '@volter/world-core';\nimport schema from './generated/proto.gen.json' with { type: 'json' };\nimport { create${Name}Fetch } from './fetch.ts';\n\n${signature}  const fetch = create${Name}Fetch(options);\n  // the vendor speaks gRPC (its manifest's \`grpc\`): HTTP/2 and HTTP/1 on one port, each rpc through the fetch\n  return grpc.serveGrpc({ ...(options.port ? { port: options.port } : {}), fetch: async (r) => fetch(r), schema: schema as unknown as Parameters<typeof grpc.serveGrpc>[0]['schema'] });\n}\n`;
   }
@@ -499,7 +504,7 @@ export async function createPack(args: string[]): Promise<void> {
       // a unit whose spec is a proto (derive-pack generated its schema) is served over gRPC: its serve seam in that form,
       // the one form a unit takes after --init (a server.ts of a wire of the pack's own, SMTP's, is never written over)
       if (!lanesOnly && existsSync(join(dir, 'src', 'generated', 'proto.gen.json'))) {
-        writeFileSync(join(dir, 'src', 'server.ts'), serverFile(vendor, true));
+        writeFileSync(join(dir, 'src', 'server.ts'), serverFile(vendor, true, existsSync(join(dir, 'src', 'stream.ts'))));
         console.log(`create-pack: wrote ${join(dir, 'src', 'server.ts')}`);
       }
     }

package/src/walk/behavior-journey.ts

@@ -9,7 +9,7 @@ import { attributionName } from '../verdict.ts';
 //
 // The caller names the pack repository first (usePacks).
 
-import { redis } from '@volter/world-core';
+import { mysql, redis } from '@volter/world-core';
 import { gzipSync } from 'node:zlib';
 import { parse, visit } from 'graphql';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
@@ -17,7 +17,7 @@ import { join } from 'node:path';
 import { databaseSession, type DatabaseSession, getActiveWorldStore, MemoryBlobStore, MemoryWorldStore, setActiveBlobStore, setActiveWorldStore, setDeliveryObserver, setInProcessTwins, type InProcessTwin, type TwinStream, type TwinStreamConnection } from '@volter/world-core/runtime';
 import { createHostTable, type HostFacts } from '@volter/world-core/host-routing';
 import packFactsDocument from '@volter/world-core/generated/pack-facts.json' with { type: 'json' };
-import { type Captured, type GitStep, type Journey, type JourneyStep, type LineStep, type SocketStep, type SqlStep, type RespStep, isResp, at, captureAt, echoFailures, expandFills, expectFailures, fill, fillJson, formBody, isGit, isLine, isSql, isSocket, isWait, jwtAuthorization, oauth1Authorization, presignedPath, sigv4Headers, waitMs } from './journey-kit.ts';
+import { type Captured, type GitStep, type Journey, type JourneyStep, type LineStep, type SocketStep, type SqlStep, type RespStep, type MysqlStep, isMysql, isResp, at, captureAt, echoFailures, expandFills, expectFailures, fill, fillJson, formBody, isGit, isLine, isSql, isSocket, isWait, jwtAuthorization, oauth1Authorization, presignedPath, sigv4Headers, waitMs } from './journey-kit.ts';
 import { lanesOf, lineShape, shapeChecker, type LineConnection, type ShapeChecker } from './shape.ts';
 import { xmlMembers } from './xml-view.ts';
 
@@ -369,6 +369,50 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
     finally { opts.hooks?.after?.(step, step.connection, answered, collect.slice(before)); }
   };
 
+  // A MySQL step speaks the pack's MySQL wire as an application's driver does (@volter/world-core/mysql's client), on the
+  // same byte-stream adapter the owned TCP listener serves.
+  const mysqlConnections = new Map<string, { exchange: mysql.MysqlExchange; close: () => void }>();
+  const mysqlStep = async (step: MysqlStep): Promise<void> => {
+    const before = collect.length; let answered: { status: number; body: unknown } = { status: 0, body: undefined };
+    const link = step.link ?? 'mysql';
+    opts.hooks?.before?.(step as never, link, step.mysql ?? '(sign in)');
+    try {
+      let body: Record<string, unknown> | undefined;
+      if (step.signIn) {
+        if (!served?.stream) streams ??= await vendorStream(packsDir(), journey.vendor);
+        const factory = served?.stream ?? streams?.(root, {}); if (!factory) throw new Error(`no create<Name>TwinStream adapter enrolled for ${journey.vendor}`);
+        let out: number[] = [];
+        const conn = factory({ write: (b) => { out.push(...b); }, end: () => {} }, '127.0.0.1');
+        await conn.settled();
+        const greeting = Uint8Array.from(out); out = [];
+        const exchange: mysql.MysqlExchange = async (bytes) => { conn.data(bytes); await conn.settled(); const got = Uint8Array.from(out); out = []; return got; };
+        const signed = await mysql.mysqlSignIn(exchange, greeting, fill(step.signIn.user, captured), fill(step.signIn.password, captured), step.signIn.database ? fill(step.signIn.database, captured) : null);
+        if ('error' in signed) body = { ...signed.error }; else mysqlConnections.set(link, { exchange, close: () => conn.close() });
+      }
+      if (!body && step.mysql !== undefined) {
+        const c = mysqlConnections.get(link); if (!c) throw new Error(`no MySQL connection "${link}" is open`);
+        const sql = fill(step.mysql, captured);
+        const result = step.values ? await mysql.mysqlExecute(c.exchange, sql, step.values.map((v) => (v === null ? null : fill(v, captured)))) : await mysql.mysqlQuery(c.exchange, sql);
+        body = 'error' in result ? { ...result.error }
+          : 'columns' in result ? { columns: result.columns.map((col) => col.name), rows: result.rows.map((row) => Object.fromEntries(result.columns.map((col, i) => [col.name, row[i] ?? null]))) }
+          : { ...result };
+      }
+      body ??= { signedIn: true };
+      const errno = typeof body.errno === 'number' ? body.errno : undefined;
+      answered = { status: errno ?? 0, body };
+      if (opts.verbose) console.log(`  ${String(errno ?? 'OK').padEnd(4)} ${link.padEnd(6)} ${(step.mysql ?? '(sign in)').slice(0, 70).padEnd(70)} ${step.name}`);
+      if (step.refused !== undefined ? errno !== step.refused : errno !== undefined) {
+        collect.push({ step: step.name, beat: 'STATUS', detail: errno !== undefined ? `MySQL refused it: ${errno} ${String(body.message)}${step.refused ? ` (wanted ${step.refused})` : ''}` : `MySQL completed it, wanted ${step.refused}` });
+        return;
+      }
+      for (const [name, dot] of Object.entries(step.capture ?? {})) { const value = captureAt(body, dot); if (value === undefined || value === null) collect.push({ step: step.name, beat: 'CAPTURE', detail: `nothing at "${dot}" in the answer to capture as {${name}}` }); else remember(name, value); }
+      try { for (const detail of expectFailures(step.expect ?? [], body, captured)) collect.push({ step: step.name, beat: 'EXPECT', detail }); }
+      catch (e) { collect.push({ step: step.name, beat: 'CAPTURE', detail: (e as Error).message }); }
+      if (step.close) { mysqlConnections.get(link)?.close(); mysqlConnections.delete(link); }
+    } catch (e) { collect.push({ step: step.name, beat: 'MYSQL', detail: (e as Error).message }); }
+    finally { opts.hooks?.after?.(step as never, link, answered, collect.slice(before)); }
+  };
+
   // A git step is a git client's clone or push on the pack's smart-HTTP plane (packages/twin-standard/src/walk/git-client.ts); its answer is
   // checked as a request's is (status, captures, expectations).
   const gitStep = async (step: GitStep): Promise<void> => {
@@ -602,6 +646,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
   try {
   for (const step of journey.steps) {
     stepNow = step.name;
+    if (isMysql(step)) { await mysqlStep(step); continue; }
     if (isResp(step)) { await respStep(step); continue; }
     if (isLine(step)) { await speak(step); continue; }
     if (isGit(step)) { await gitStep(step); continue; }

package/src/walk/journey-kit.ts

@@ -327,7 +327,20 @@ export type Journey = {
   steps: Step[];
 };
 
-export type Step = JourneyStep | WaitStep | LineStep | GitStep | SocketStep | SqlStep | RespStep;
+export type Step = JourneyStep | WaitStep | LineStep | GitStep | SocketStep | SqlStep | RespStep | MysqlStep;
+
+/** A step on a MySQL wire (the kernel's @volter/world-core/mysql, a pack's `create<Name>TwinStream`), spoken as an
+ *  application's driver speaks it. `signIn` opens a named connection (`link`, `mysql` by default) with a user and
+ *  password (mysql_native_password); `mysql` sends a statement on it: a text query, or a prepared statement when
+ *  `values` binds its `?` placeholders (binary parameters and rows, as Prisma sends one). Its answer is the rows, each
+ *  its columns by name in MySQL's text format (`rows`, `columns`), or `{ affectedRows, insertId }`, or MySQL's refusal
+ *  `{ errno, sqlstate, message }`, which fails the step unless `refused` names its errno. */
+export type MysqlStep = {
+  name: string; mysql?: string; values?: Array<string | null>; link?: string;
+  signIn?: { user: string; password: string; database?: string }; close?: boolean;
+  refused?: number; capture?: JourneyStep['capture']; expect?: JourneyStep['expect'];
+};
+export const isMysql = (step: Step): step is MysqlStep => 'mysql' in step || 'signIn' in step;
 
 /** A typed request/reply stream step. `resp` is one command or a pipeline of commands, on a named connection.
  * Captures and expectations see `{ replies, last, error }`; binary arguments use `{ base64 }`.