@volter/twin-xidentity 0.1.0 → 0.1.2

package/dist/client/xidentity-consent.d.ts

@@ -22,13 +22,29 @@ export type ConsentView = {
     /** The x.com session this browser is signed in as — the account that will consent. */
     account: ConsentAccount;
     scopes: ConsentScopeRow[];
-    /** Host of the validated redirect_uri, shown in the "you'll be redirected to" notice. */
+    /** Host of the validated redirect_uri, shown in the "you'll be redirected to" notice. Empty for
+     *  an OAuth 1.0a out-of-band (PIN) request, which redirects nowhere. */
     redirectHost: string;
+    /** Where the decision posts, under `origin`: `/_twin/consent` for an OAuth 2.0 authorize screen,
+     *  `/oauth/authorize` for an OAuth 1.0a one, as X's own screen posts (the request token is the handle). */
+    decisionPath?: string;
 };
 /** The authorize screen — X's consent page for the app named by the pending auth request. */
 export declare function ConsentPage({ view }: {
     view: ConsentView;
 }): import("react").JSX.Element;
+export type PinPageProps = {
+    appName: string;
+    /** The oauth_verifier, shown as the PIN the person types into the app (out-of-band flow). */
+    pin: string;
+};
+/**
+ * The OAuth 1.0a out-of-band ending: an app that registered `oauth_callback=oob` gets no redirect,
+ * so X shows the verifier as a PIN for the person to type into the app (docs.x.com PIN-based
+ * authorization). The layout follows the classic screen as widely screenshotted; its live DOM was
+ * not captured (`xidentity.oauth1.consent_wording`, todo).
+ */
+export declare function PinPage({ appName, pin }: PinPageProps): import("react").JSX.Element;
 export type ErrorPageProps = {
     status: number;
     /** The OAuth error code the failure classifies as (e.g. `invalid_request`). */

package/dist/client/xidentity-consent.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 // X's AUTHORIZE SCREEN, as React — the vendor's own product UI, not a dashboard mirror.
 //
 // These components are the ONE renderer for the screen: the twin server-renders them with
@@ -29,7 +29,16 @@ function ScopeSection({ heading, rows }) {
 /** The authorize screen — X's consent page for the app named by the pending auth request. */
 export function ConsentPage({ view }) {
     const appName = view.app.name;
-    return (_jsxs("div", { className: "card", children: [_jsx("header", { className: "x-header", children: _jsx(XMark, {}) }), _jsx("div", { className: "signed-in", children: _jsxs("span", { className: "account-text", children: [_jsx("span", { className: "account-name", children: view.account.name || view.account.username || view.account.id }), view.account.username ? _jsxs("span", { className: "account-username", children: ["@", view.account.username] }) : null] }) }), _jsxs("h1", { className: "title", children: [_jsx("strong", { className: "app-name", children: appName }), " wants to access your X account"] }), _jsx(ScopeSection, { heading: `Things ${appName} can view`, rows: view.scopes.filter((s) => s.group === 'view') }), _jsx(ScopeSection, { heading: `Things ${appName} can do`, rows: view.scopes.filter((s) => s.group === 'do') }), _jsx(ScopeSection, { heading: "Until you revoke access", rows: view.scopes.filter((s) => s.group === 'session') }), _jsxs("form", { method: "POST", action: `${view.origin}/_twin/consent`, className: "consent-form", children: [_jsx("input", { type: "hidden", name: "auth_request", value: view.requestId }), _jsxs("div", { className: "actions", children: [_jsx("button", { className: "btn btn-primary", type: "submit", name: "decision", value: "allow", children: "Authorize app" }), _jsx("button", { className: "btn btn-secondary", type: "submit", name: "decision", value: "deny", children: "Cancel" })] })] }), _jsxs("p", { className: "legal", children: ["You'll be redirected to ", _jsx("strong", { className: "redirect-host", children: view.redirectHost }), ". You can revoke access to any app at any time from the Apps and sessions section of your X settings."] })] }));
+    return (_jsxs("div", { className: "card", children: [_jsx("header", { className: "x-header", children: _jsx(XMark, {}) }), _jsx("div", { className: "signed-in", children: _jsxs("span", { className: "account-text", children: [_jsx("span", { className: "account-name", children: view.account.name || view.account.username || view.account.id }), view.account.username ? _jsxs("span", { className: "account-username", children: ["@", view.account.username] }) : null] }) }), _jsxs("h1", { className: "title", children: [_jsx("strong", { className: "app-name", children: appName }), " wants to access your X account"] }), _jsx(ScopeSection, { heading: `Things ${appName} can view`, rows: view.scopes.filter((s) => s.group === 'view') }), _jsx(ScopeSection, { heading: `Things ${appName} can do`, rows: view.scopes.filter((s) => s.group === 'do') }), _jsx(ScopeSection, { heading: "Until you revoke access", rows: view.scopes.filter((s) => s.group === 'session') }), _jsxs("form", { method: "POST", action: `${view.origin}${view.decisionPath ?? '/_twin/consent'}`, className: "consent-form", children: [_jsx("input", { type: "hidden", name: "auth_request", value: view.requestId }), _jsxs("div", { className: "actions", children: [_jsx("button", { className: "btn btn-primary", type: "submit", name: "decision", value: "allow", children: "Authorize app" }), _jsx("button", { className: "btn btn-secondary", type: "submit", name: "decision", value: "deny", children: "Cancel" })] })] }), _jsxs("p", { className: "legal", children: [view.redirectHost ? (_jsxs(_Fragment, { children: ["You'll be redirected to ", _jsx("strong", { className: "redirect-host", children: view.redirectHost }), ".", ' '] })) : null, "You can revoke access to any app at any time from the Apps and sessions section of your X settings."] })] }));
+}
+/**
+ * The OAuth 1.0a out-of-band ending: an app that registered `oauth_callback=oob` gets no redirect,
+ * so X shows the verifier as a PIN for the person to type into the app (docs.x.com PIN-based
+ * authorization). The layout follows the classic screen as widely screenshotted; its live DOM was
+ * not captured (`xidentity.oauth1.consent_wording`, todo).
+ */
+export function PinPage({ appName, pin }) {
+    return (_jsxs("div", { className: "card", children: [_jsx("header", { className: "x-header", children: _jsx(XMark, {}) }), _jsxs("h1", { className: "title", children: ["You've granted access to ", _jsx("strong", { className: "app-name", children: appName }), "!"] }), _jsxs("p", { className: "legal", children: ["Next, return to ", appName, " and enter this PIN to complete the authorization process:"] }), _jsx("p", { className: "title", children: _jsx("code", { className: "oauth-pin", children: pin }) })] }));
 }
 /**
  * The authorize-endpoint error PAGE — what a browser sees when the twin cannot trust the

package/dist/client/xidentity-consent.tsx

@@ -44,8 +44,12 @@ export type ConsentView = {
   /** The x.com session this browser is signed in as — the account that will consent. */
   account: ConsentAccount;
   scopes: ConsentScopeRow[];
-  /** Host of the validated redirect_uri, shown in the "you'll be redirected to" notice. */
+  /** Host of the validated redirect_uri, shown in the "you'll be redirected to" notice. Empty for
+   *  an OAuth 1.0a out-of-band (PIN) request, which redirects nowhere. */
   redirectHost: string;
+  /** Where the decision posts, under `origin`: `/_twin/consent` for an OAuth 2.0 authorize screen,
+   *  `/oauth/authorize` for an OAuth 1.0a one, as X's own screen posts (the request token is the handle). */
+  decisionPath?: string;
 };
 
 /** The X mark, drawn rather than fetched — a twin never reaches out to a vendor CDN. */
@@ -96,7 +100,7 @@ export function ConsentPage({ view }: { view: ConsentView }) {
       <ScopeSection heading={`Things ${appName} can view`} rows={view.scopes.filter((s) => s.group === 'view')} />
       <ScopeSection heading={`Things ${appName} can do`} rows={view.scopes.filter((s) => s.group === 'do')} />
       <ScopeSection heading="Until you revoke access" rows={view.scopes.filter((s) => s.group === 'session')} />
-      <form method="POST" action={`${view.origin}/_twin/consent`} className="consent-form">
+      <form method="POST" action={`${view.origin}${view.decisionPath ?? '/_twin/consent'}`} className="consent-form">
         <input type="hidden" name="auth_request" value={view.requestId} />
         <div className="actions">
           <button className="btn btn-primary" type="submit" name="decision" value="allow">
@@ -108,8 +112,41 @@ export function ConsentPage({ view }: { view: ConsentView }) {
         </div>
       </form>
       <p className="legal">
-        You&apos;ll be redirected to <strong className="redirect-host">{view.redirectHost}</strong>. You can revoke
-        access to any app at any time from the Apps and sessions section of your X settings.
+        {view.redirectHost ? (
+          <>
+            You&apos;ll be redirected to <strong className="redirect-host">{view.redirectHost}</strong>.{' '}
+          </>
+        ) : null}
+        You can revoke access to any app at any time from the Apps and sessions section of your X settings.
+      </p>
+    </div>
+  );
+}
+
+export type PinPageProps = {
+  appName: string;
+  /** The oauth_verifier, shown as the PIN the person types into the app (out-of-band flow). */
+  pin: string;
+};
+
+/**
+ * The OAuth 1.0a out-of-band ending: an app that registered `oauth_callback=oob` gets no redirect,
+ * so X shows the verifier as a PIN for the person to type into the app (docs.x.com PIN-based
+ * authorization). The layout follows the classic screen as widely screenshotted; its live DOM was
+ * not captured (`xidentity.oauth1.consent_wording`, todo).
+ */
+export function PinPage({ appName, pin }: PinPageProps) {
+  return (
+    <div className="card">
+      <header className="x-header">
+        <XMark />
+      </header>
+      <h1 className="title">
+        You&apos;ve granted access to <strong className="app-name">{appName}</strong>!
+      </h1>
+      <p className="legal">Next, return to {appName} and enter this PIN to complete the authorization process:</p>
+      <p className="title">
+        <code className="oauth-pin">{pin}</code>
       </p>
     </div>
   );

package/dist/src/index.d.ts

@@ -11,5 +11,7 @@ export { XIDENTITY_BUDGET_CEILING, XIDENTITY_BUDGET_MAX_RETRY_AFTER_S, XIDENTITY
 export type { XIdentityBudgetErrorKind, XIdentityBudgetOptions, XIdentityBudgetReservation, XIdentityBudgetSnapshot, } from './xidentity-budget.js';
 export { consentPageHtml, CONSENT_SCRIPT_PATH, CONSENT_STYLE_PATH, errorPageHtml, xIdentityConsentState, } from './xidentity-consent-ui.js';
 export type { ConsentAccount, ConsentScopeRow, ConsentView, ErrorPageProps } from './xidentity-consent-ui.js';
+export { OAUTH1_ENDPOINTS, oauth1AppOf, oauth1Params, parseOAuthHeader, pct, scopesOfAccessLevel, signatureMatches, signedBaseUrl, signedRequestOf, verifyUserContext, WORLD_APP_ENV, worldOAuth1App, } from './xidentity-oauth1.js';
+export type { OAuth1App, OAuth1Principal, SignedRequest } from './xidentity-oauth1.js';
 import type { TwinPack } from '@volter/world-core';
 export declare const pack: TwinPack;

package/dist/src/index.js

@@ -20,6 +20,7 @@ export { liveXIdentityExecute, mapUsersMeAccount, PULL_USER_FIELDS, pullXIdentit
 // `XIdentityBudgetError` by type; there is deliberately no export that disables the guard.
 export { XIDENTITY_BUDGET_CEILING, XIDENTITY_BUDGET_MAX_RETRY_AFTER_S, XIDENTITY_BUDGET_WINDOW_MS, XIDENTITY_CALL_WEIGHTS, XIDENTITY_RATE_BUDGET, XIdentityBudget, XIdentityBudgetError, xIdentityBudgetPath, xIdentityCallWeight, } from "./xidentity-budget.js";
 export { consentPageHtml, CONSENT_SCRIPT_PATH, CONSENT_STYLE_PATH, errorPageHtml, xIdentityConsentState, } from "./xidentity-consent-ui.js";
+export { OAUTH1_ENDPOINTS, oauth1AppOf, oauth1Params, parseOAuthHeader, pct, scopesOfAccessLevel, signatureMatches, signedBaseUrl, signedRequestOf, verifyUserContext, WORLD_APP_ENV, worldOAuth1App, } from "./xidentity-oauth1.js";
 import { XIDENTITY_RATE_BUDGET as RATE_BUDGET } from "./xidentity-budget.js";
 /**
  * The x.com / twitter.com paths THIS pack serves — the consent leg — as a RegExp SOURCE for the
@@ -32,13 +33,18 @@ import { XIDENTITY_RATE_BUDGET as RATE_BUDGET } from "./xidentity-budget.js";
  */
 const XIDENTITY_CONSENT_PATHS = '^/i/oauth2/authorize/?$|^/_twin/';
 /**
- * The api.x.com / api.twitter.com paths THIS pack serves: the OAuth 2.0 token + revoke endpoints
- * and the authenticated-user read. api.x.com is the ENTIRE X API v2 host — posts, DMs, spaces — and
+ * The api.x.com / api.twitter.com paths THIS pack serves: the OAuth 2.0 token + revoke endpoints,
+ * the authenticated-user read, and OAuth 1.0a's three legs (request_token, the authorize and
+ * authenticate screens — served on api.x.com itself, where X serves them — and access_token) plus
+ * 1.1/oauth/invalidate_token, and the page assets that screen loads from the host it is on
+ * (`/_twin/assets/consent.{js,css}`; the `x` pack's `/_twin/` claim leaves exactly these two out, so
+ * the claims stay disjoint). The screen's Authorize app form posts to `POST oauth/authorize`, which
+ * the same rule already covers. api.x.com is the ENTIRE X API v2 host — posts, DMs, spaces — and
  * this pack models the identity slice only, so nothing else is claimed: an unmodelled X call must
- * refuse loudly rather than land in a twin that cannot serve it. Transcribed unchanged from
- * inject.cjs's former `isXIdentityApiPath` predicate.
+ * refuse loudly rather than land in a twin that cannot serve it. First transcribed from
+ * inject.cjs's former `isXIdentityApiPath` predicate; the asset paths were added 2026-09-28.
  */
-const XIDENTITY_API_PATHS = '^/2/(?:oauth2/(?:token|revoke)|users/me)/?$';
+const XIDENTITY_API_PATHS = '^/2/(?:oauth2/(?:token|revoke)|users/me)/?$|^/oauth/(?:request_token|authorize|authenticate|access_token)/?$|^/1\\.1/oauth/invalidate_token(?:\\.json)?/?$|^/_twin/assets/consent\\.(?:js|css)$';
 export const pack = {
     // STILL PROTOCOL 1, and the reason is the gate rather than the pack (ROADMAP.md,
     // shape-parity-refusals: a refusal the harness cannot express). Everything else is ready: the connector
@@ -54,13 +60,15 @@ export const pack = {
     transport: 'rest',
     archetype: 'crud',
     bin: 'world-xidentity',
-    resources: ['oauth_client', 'account', 'session', 'auth_request', 'authorization_code', 'access_token', 'refresh_token', 'grant', 'rate_window'],
+    resources: ['oauth_client', 'account', 'session', 'auth_request', 'authorization_code', 'access_token', 'refresh_token', 'grant', 'rate_window', 'oauth1_app', 'oauth1_request_token', 'oauth1_token', 'oauth1_grant'],
     specSource: 'api.x.com/2/openapi.json (X API v2 OpenAPI 2.167: /2/users/me, the Problem family, the '
         + '24-scope OAuth2UserToken catalog) + docs.x.com OAuth 2.0 authorization-code/user-access-token '
         + 'guides + the official SDK sources (@xdevplatform/xdk, twitter-api-typescript-sdk), all '
-        + 'fetched 2026-08-21',
+        + 'fetched 2026-08-21; OAuth 1.0a from docs.x.com authentication/api-reference, obtaining-user-access-tokens, '
+        + 'creating-a-signature and developer-apps, fetched 2026-09-27',
     description: 'X (Twitter) identity twin — the real x.com authorize screen, the full OAuth 2.0 '
-        + 'authorization-code + PKCE round trip (token, refresh, revoke), and GET /2/users/me with '
+        + 'authorization-code + PKCE round trip (token, refresh, revoke), the OAuth 1.0a three-legged flow '
+        + '(request_token, the authorize/authenticate screen, access_token, invalidate_token), and GET /2/users/me with '
         + "X's real field/expansion/problem envelopes. Non-OIDC, exactly as the vendor is.",
     // Adoption + interception, moved off the central maps unchanged (descriptor-first back-migration, adding-a-twin.md §3,
     // 2026-08-31).

package/dist/src/xidentity-capabilities.js

@@ -47,7 +47,7 @@ import { renderToStaticMarkup } from 'react-dom/server';
 import { checkCapabilities, uiDataCoupled, verifyBoundary } from '@volter/world-tooling';
 import { ConsentPage, ErrorPage } from "../client/xidentity-consent.js";
 import { CONSENT_CLIENT_JS, xIdentityConsentState } from "./xidentity-consent-ui.js";
-import { checkXIdentityConformance } from "./xidentity-conformance.js";
+import { checkXIdentityConformance, oauth1Fixtures, oauth1Header, OAUTH1_PROBE_APP, OAUTH1_PROBE_CALLBACK } from "./xidentity-conformance.js";
 import { XIdentityBudgetError, XIDENTITY_BUDGET_BURST_CEILING } from "./xidentity-budget.js";
 import { liveXIdentityExecute, mapUsersMeAccount, pullXIdentity, pushPendingXIdentityActions, syncXIdentityFromReal, } from "./xidentity-connector.js";
 import { pkceS256 } from "./xidentity-pkce.js";
@@ -99,6 +99,14 @@ const qp = (r, key) => {
 };
 const form = (params) => new URLSearchParams(params).toString();
 const decoded = (token) => Buffer.from(String(token ?? ''), 'base64url').toString('utf8');
+// ── OAuth 1.0a helpers: the probe App and its independent signer live in xidentity-conformance.ts ──
+const FORM_H = { 'content-type': 'application/x-www-form-urlencoded' };
+/** Register the probe App through the twin door (X's developer console has no API). */
+const oauth1App = (h) => h({ m: 'POST', p: '/_twin/oauth1_apps', b: JSON.stringify({ consumer_key: OAUTH1_PROBE_APP.key, consumer_secret: OAUTH1_PROBE_APP.secret, name: 'Probe App', callback_urls: [OAUTH1_PROBE_CALLBACK] }) });
+/** The conformance fixtures' call shape over this verify's handler. */
+const oauthCall = (h) => (m, p, b, headers) => h({ m, p, ...(b === undefined ? {} : { b }), ...(headers ? { h: headers } : {}) });
+/** The legacy v1.1 error code of a refusal. */
+const v1Code = (r) => r.body?.errors?.[0]?.code;
 /** Build an authorize URL from parameters, so a verify can vary exactly one of them. `undefined`
  *  REMOVES a base parameter. */
 function authUrl(params = {}) {
@@ -500,6 +508,11 @@ export const XIDENTITY_CAPABILITIES = [
             && d['verified'] === true
             && d['verified_type'] === 'blue';
     })),
+    // The x pack answers user.fields=profile_image_url with X's default avatar for an account seeded
+    // without a photo (every X account has one); this pack omits it, because a PARTIALLY-pulled persona
+    // cannot tell "no photo" from "not pulled" (renderUser). Serving the default for a seeded persona
+    // needs that distinction recorded on the row — until then the two packs answer differently (§9).
+    todo('xidentity.users_me.default_profile_image', 'users_me', "user.fields=profile_image_url for a persona seeded without a photo: X's default avatar URL (abs.twimg.com default_profile_normal.png), as the x pack serves it, rather than omission", 'api', 'common'),
     done('xidentity.users_me.public_metrics', 'users_me', 'user.fields=public_metrics returns the metrics object with the vendor\'s six counters', 'api', 'common', () => withRoot(async (h) => {
         const { tokens } = await fullFlow(h);
         const r = await h({ m: 'GET', p: '/2/users/me?user.fields=public_metrics', h: { authorization: `Bearer ${tokens['access_token']}` } });
@@ -560,7 +573,17 @@ export const XIDENTITY_CAPABILITIES = [
     todo('xidentity.users_me.invalid_request_envelope_pin', 'users_me', 'PIN the live invalid-parameter body against the OpenAPI\'s singular InvalidRequestProblem (the twin serves the reported errors[] wire shape)', 'api', 'common'),
     todo('xidentity.users_me.confirmed_email_scope_behavior', 'users_me', 'PIN what the live endpoint does when confirmed_email is requested WITHOUT users.email (the twin withholds the field; a 403 is the other candidate)', 'api', 'niche'),
     todo('xidentity.users_me.app_only_forbidden', 'users_me', 'Model the 403 Unsupported Authentication envelope an app-only bearer gets on this user-context endpoint', 'api', 'common'),
-    todo('xidentity.users_me.oauth1_user_context', 'users_me', 'Model OAuth 1.0a User Context as the alternate auth the OpenAPI lists for this operation', 'api', 'niche'),
+    done('xidentity.users_me.oauth1_user_context', 'users_me', 'GET /2/users/me honours OAuth 1.0a User Context, the alternate scheme the OpenAPI lists: a signed request answers the token\'s user, a wrong secret or unknown token is the 401', 'api', 'common', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const at = await oauth1Fixtures(oauthCall(h)).accessToken();
+        const sign = (t, q = '') => oauth1Header('GET', `${DEMO_ORIGIN}/2/users/me${q}`, OAUTH1_PROBE_APP, t);
+        const r = await h({ m: 'GET', p: '/2/users/me?user.fields=username,verified', h: { authorization: sign(at, '?user.fields=username,verified') } });
+        // the query is signed: the same header over a different query does not verify
+        const unsignedQuery = await h({ m: 'GET', p: '/2/users/me?user.fields=location', h: { authorization: sign(at, '?user.fields=username,verified') } });
+        const unknown = await h({ m: 'GET', p: '/2/users/me', h: { authorization: sign({ key: `${ADA.id}-NotIssued`, secret: at.secret }) } });
+        return r.status === 200 && body(r).data.id === ADA.id && body(r).data.username === ADA.username && body(r).data.verified === ADA.verified
+            && unsignedQuery.status === 401 && unknown.status === 401;
+    })),
     todo('xidentity.users_me.partial_errors', 'users_me', 'Model the errors[] array alongside data (per-field Problem entries on a 200, per GetUsersMeResponse)', 'api', 'niche'),
     // ═══ rate envelope ════════════════════════════════════════════════════════════════════════
     done('xidentity.rate.headers', 'rate', 'Every /2/users/me response carries x-rate-limit-limit/remaining/reset (docs.x.com fundamentals): limit 75, remaining decrements per call, reset a unix timestamp', 'api', 'core', () => withRoot(async (h) => {
@@ -633,12 +656,14 @@ export const XIDENTITY_CAPABILITIES = [
     todo('xidentity.scopes.unknown_scope_live', 'scopes', 'PIN what the live authorize endpoint does with an unknown scope value (the twin renders it flagged on the screen rather than inventing a rejection)', 'api', 'niche'),
     todo('xidentity.scopes.users_email_wording', 'scopes', 'PIN the consent screen\'s live wording for users.email (the label is twin prose; the scope itself is announcement-grounded)', 'ui', 'niche'),
     // ═══ read-only twin ═══════════════════════════════════════════════════════════════════════
-    done('xidentity.readonly.writes_refused', 'readonly', 'A read-only twin refuses every credential-minting leg (405, protocol-shaped error body) — D3', 'api', 'common', () => withRoot(async (h) => {
+    done('xidentity.readonly.writes_refused', 'readonly', 'A read-only twin refuses every credential-minting leg and the OAuth 1.0a screen\'s decision (405, protocol-shaped error body) — D3', 'api', 'common', () => withRoot(async (h) => {
         await fullFlow(h); // seed a world first, through the ordinary write path
         const ro = (s) => handleXIdentityTwinRequest({ method: s.m, path: s.p, ...(s.b !== undefined ? { body: s.b } : {}), root: h.root, origin: DEMO_ORIGIN, occurredAt: AT, readOnly: true });
         const tok = await ro({ m: 'POST', p: '/2/oauth2/token', b: form({ grant_type: 'authorization_code', code: 'x', client_id: DEFAULT_CLIENT_ID, redirect_uri: REDIRECT, code_verifier: VERIFIER }) });
         const rev = await ro({ m: 'POST', p: '/2/oauth2/revoke', b: form({ token: 'x', client_id: DEFAULT_CLIENT_ID }) });
-        return tok.status === 405 && body(tok)['error'] === 'temporarily_unavailable' && rev.status === 405;
+        // the OAuth 1.0a screen's decision settles consent: a write, though its path is also the GET screen's
+        const decide = await ro({ m: 'POST', p: '/oauth/authorize', b: form({ auth_request: 'x', decision: 'allow' }) });
+        return tok.status === 405 && body(tok)['error'] === 'temporarily_unavailable' && rev.status === 405 && decide.status === 405;
     })),
     done('xidentity.readonly.reads_served', 'readonly', 'A read-only twin still serves GET /2/users/me over existing state (rate accounting suspended, headers intact)', 'api', 'niche', () => withRoot(async (h) => {
         const { tokens } = await fullFlow(h);
@@ -648,7 +673,7 @@ export const XIDENTITY_CAPABILITIES = [
     // ═══ conformance (the endpoint census with teeth) ═════════════════════════════════════════
     done('xidentity.conformance.census', 'conformance', 'The conformance check passes: one real probe per claimed endpoint, the ROUTER_SURFACE census, the live round trip, and a reachability witness per resource type', 'api', 'core', async () => {
         const report = await checkXIdentityConformance();
-        return report.ok && report.endpointsProbed === 4 && report.resourceTypesChecked === 9;
+        return report.ok && report.endpointsProbed === 11 && report.resourceTypesChecked === 13;
     }),
     // ═══ the authorize SCREEN (the vendor's own UI — data-coupled, per ADDING_A_TWIN.md §6) ═══
     done('xidentity.ui.authorize_screen', 'ui', 'The authorize screen names the REGISTERED app and the SIGNED-IN account from the projection (data-coupled: a seeded client + persona appear on screen)', 'ui', 'core', uiDataCoupled({
@@ -896,9 +921,219 @@ export const XIDENTITY_CAPABILITIES = [
     // ═══ adjacent X auth surface the identity twin does not model yet (honest denominator) ═════
     todo('xidentity.app_only.bearer_token', 'app_only', 'Model the app-only bearer flow (POST /oauth2/token, grant_type=client_credentials, the v1.1 path)', 'api', 'common'),
     todo('xidentity.app_only.invalidate_token', 'app_only', 'Model POST /oauth2/invalidate_token for app-only bearers', 'api', 'niche'),
-    todo('xidentity.oauth1.request_token', 'oauth1', 'Model OAuth 1.0a step 1: POST /oauth/request_token', 'api', 'niche'),
-    todo('xidentity.oauth1.authorize', 'oauth1', 'Model OAuth 1.0a step 2: GET /oauth/authorize (the legacy consent screen)', 'api', 'niche'),
-    todo('xidentity.oauth1.access_token', 'oauth1', 'Model OAuth 1.0a step 3: POST /oauth/access_token', 'api', 'niche'),
+    // ═══ OAuth 1.0a (xidentity-oauth1.ts; docs.x.com api-reference + obtaining-user-access-tokens) ══
+    done('xidentity.oauth1.request_token', 'oauth1', 'POST oauth/request_token signed by a registered App answers oauth_token, oauth_token_secret and oauth_callback_confirmed=true, and the token opens that App\'s screen', 'api', 'common', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const r = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: OAUTH1_PROBE_CALLBACK }) } });
+        const got = new URLSearchParams(String(r.body));
+        const token = got.get('oauth_token') ?? '';
+        const screen = await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(token)}` });
+        return r.status === 200 && got.get('oauth_callback_confirmed') === 'true' && /^[A-Za-z0-9]{27}$/.test(token)
+            && (got.get('oauth_token_secret') ?? '').length > 0 && html(screen).includes('>Probe App<');
+    })),
+    done('xidentity.oauth1.authorize', 'oauth1', 'GET oauth/authorize shows X\'s screen naming the App and the signed-in account; Authorize app sends the person to the callback with exactly oauth_token and oauth_verifier', 'api', 'common', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const fx = oauth1Fixtures(oauthCall(h));
+        const t = await fx.requestToken();
+        const screen = await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(t.key)}` });
+        const handle = AUTH_REQUEST_RE.exec(html(screen))?.[1] ?? '';
+        const d = await h({ m: 'POST', p: '/oauth/authorize', b: form({ auth_request: handle, decision: 'allow' }), h: FORM_H });
+        const back = new URL(loc(d) || 'http://invalid.test/');
+        return screen.status === 200 && html(screen).includes('<strong class="app-name">Probe App</strong> wants to access your X account')
+            && html(screen).includes(`@${ADA.username}`) && html(screen).includes('action="http://localhost:3000/oauth/authorize"')
+            && d.status === 302 && `${back.origin}${back.pathname}` === OAUTH1_PROBE_CALLBACK
+            && back.searchParams.get('oauth_token') === t.key && /^[A-Za-z0-9]{32}$/.test(back.searchParams.get('oauth_verifier') ?? '')
+            && [...back.searchParams.keys()].length === 2;
+    })),
+    // api.x.com is shared with the `x` pack, which claims that host's `/_twin/*` and comes first in
+    // the World's first-match routing. A decision door there reached the x pack in a World (the
+    // Postiz walk, 2026-09-28: "Authorize app" answered the x pack's JSON 400 and X never connected),
+    // while every in-process test posted straight to this twin's port. So the verify asks the
+    // World's own router which pack the screen's form lands on, for both API hosts, and then drives it.
+    done('xidentity.oauth1.authorize_form_routes_here', 'oauth1', 'Authorize app posts to POST oauth/authorize on the host that served the screen, as X\'s own screen does, and the screen\'s stylesheet and script load from that host — paths a World routes to this pack on api.x.com and api.twitter.com, not to the x pack beside it', 'ui', 'common', () => withRoot(async (h) => {
+        // the injector's own first-match table (compiled from pack-facts.json), untyped CommonJS
+        const { createRequire } = await import('node:module');
+        const { VENDOR_HOSTS } = createRequire(import.meta.url)('@volter/world-core/vendor-hosts');
+        const routedTo = (host, path) => Object.keys(VENDOR_HOSTS).find((k) => VENDOR_HOSTS[k](host, path));
+        await oauth1App(h);
+        const t = await oauth1Fixtures(oauthCall(h)).requestToken();
+        const screen = await h({ m: 'GET', p: `/oauth/authenticate?oauth_token=${encodeURIComponent(t.key)}` });
+        const action = /<form [^>]*method="POST"[^>]*action="([^"]+)"|<form [^>]*action="([^"]+)"[^>]*method="POST"/.exec(html(screen));
+        const actionPath = new URL(action?.[1] ?? action?.[2] ?? 'http://invalid.test/nowhere').pathname;
+        const d = await h({ m: 'POST', p: actionPath, b: form({ auth_request: t.key, decision: 'allow' }), h: FORM_H });
+        // …and the page's own stylesheet and script, loaded from the same host (else it renders unstyled)
+        const assets = [...html(screen).matchAll(/(?:href|src)="([^"]+\/_twin\/assets\/[^"]+)"/g)].map((m) => new URL(m[1]).pathname);
+        const { createXIdentityTwinFetch } = await import("./xidentity-server.js");
+        const fetchTwin = createXIdentityTwinFetch({ root: h.root });
+        const served = await Promise.all(assets.map((p) => fetchTwin(new Request(`https://api.x.com${p}`))));
+        return actionPath === '/oauth/authorize' && routedTo('api.x.com', actionPath) === 'xidentity' && routedTo('api.twitter.com', actionPath) === 'xidentity'
+            && assets.length === 2 && assets.every((p) => routedTo('api.x.com', p) === 'xidentity' && routedTo('api.twitter.com', p) === 'xidentity')
+            && served.every((r) => r.status === 200)
+            // the x pack keeps the rest of the host's control prefix
+            && routedTo('api.x.com', '/_twin/accounts') === 'x'
+            && d.status === 302 && qp(d, 'oauth_token') === t.key && (qp(d, 'oauth_verifier') ?? '').length === 32;
+    })),
+    done('xidentity.oauth1.authorize_read_access', 'oauth1', 'x_auth_access_type=read narrows a Read-and-write App: the screen lists only what reading allows', 'ui', 'niche', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const read = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK, x_auth_access_type: 'read' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: OAUTH1_PROBE_CALLBACK, x_auth_access_type: 'read' }) } });
+        const token = new URLSearchParams(String(read.body)).get('oauth_token') ?? '';
+        const screen = html(await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(token)}` }));
+        const write = html(await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent((await oauth1Fixtures(oauthCall(h)).requestToken()).key)}` }));
+        return screen.includes('Accounts you follow, mute, and block.') && !screen.includes('Post and delete Posts for you')
+            && write.includes('Post and delete Posts for you');
+    })),
+    done('xidentity.oauth1.authenticate_skips_approved', 'oauth1', 'GET oauth/authenticate (Sign in with X) redirects without a screen once the person has approved the App, and shows it the first time or with force_login=true', 'api', 'common', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const fx = oauth1Fixtures(oauthCall(h));
+        const first = await h({ m: 'GET', p: `/oauth/authenticate?oauth_token=${encodeURIComponent((await fx.requestToken()).key)}` });
+        await fx.approved();
+        const again = await h({ m: 'GET', p: `/oauth/authenticate?oauth_token=${encodeURIComponent((await fx.requestToken()).key)}` });
+        const forced = await h({ m: 'GET', p: `/oauth/authenticate?oauth_token=${encodeURIComponent((await fx.requestToken()).key)}&force_login=true` });
+        const back = new URL(loc(again) || 'http://invalid.test/');
+        return first.status === 200 && html(first).includes('Authorize app') && again.status === 302
+            && `${back.origin}${back.pathname}` === OAUTH1_PROBE_CALLBACK && (back.searchParams.get('oauth_verifier') ?? '').length === 32
+            && forced.status === 200 && html(forced).includes('Authorize app');
+    })),
+    done('xidentity.oauth1.cancel_denied', 'oauth1', 'Cancel sends the person back with denied=<request token>, and that token can no longer be exchanged', 'api', 'common', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const t = await oauth1Fixtures(oauthCall(h)).requestToken();
+        await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(t.key)}` });
+        const d = await h({ m: 'POST', p: '/oauth/authorize', b: form({ auth_request: t.key, decision: 'deny' }), h: FORM_H });
+        const x = await h({ m: 'POST', p: '/oauth/access_token', b: form({ oauth_verifier: 'x' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/access_token`, OAUTH1_PROBE_APP, t, { oauth_verifier: 'x' }) } });
+        return d.status === 302 && qp(d, 'denied') === t.key && qp(d, 'oauth_verifier') === null && x.status === 401 && v1Code(x) === 89;
+    })),
+    done('xidentity.oauth1.oob_pin', 'oauth1', 'oauth_callback=oob (PIN-based): approval shows the verifier as a 7-digit PIN, which access_token accepts', 'api', 'niche', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const r = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: 'oob' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: 'oob' }) } });
+        const t = { key: new URLSearchParams(String(r.body)).get('oauth_token') ?? '', secret: new URLSearchParams(String(r.body)).get('oauth_token_secret') ?? '' };
+        await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(t.key)}` });
+        const d = await h({ m: 'POST', p: '/oauth/authorize', b: form({ auth_request: t.key, decision: 'allow' }), h: FORM_H });
+        const pin = /<code class="oauth-pin">([^<]+)<\/code>/.exec(html(d))?.[1] ?? '';
+        const x = await h({ m: 'POST', p: '/oauth/access_token', b: form({ oauth_verifier: pin }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/access_token`, OAUTH1_PROBE_APP, t, { oauth_verifier: pin }) } });
+        return d.status === 200 && /^\d{7}$/.test(pin) && x.status === 200 && new URLSearchParams(String(x.body)).get('user_id') === ADA.id;
+    })),
+    done('xidentity.oauth1.access_token', 'oauth1', 'POST oauth/access_token trades an approved request token + verifier for `<user id>-<token>`, its secret, user_id and screen_name — once', 'api', 'common', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const t = await oauth1Fixtures(oauthCall(h)).approved();
+        // twitter-api-v2's shape (Postiz's login): oauth_token in the header AND the body, signed once
+        const exchange = (verifier) => h({ m: 'POST', p: '/oauth/access_token', b: form({ oauth_token: t.key, oauth_verifier: verifier }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/access_token`, OAUTH1_PROBE_APP, t, { oauth_verifier: verifier }) } });
+        const wrong = await exchange('not-the-verifier');
+        const r = await exchange(t.verifier);
+        const got = new URLSearchParams(String(r.body));
+        const replay = await exchange(t.verifier);
+        return wrong.status === 401 && r.status === 200 && new RegExp(`^${ADA.id}-[A-Za-z0-9]{40}$`).test(got.get('oauth_token') ?? '')
+            && (got.get('oauth_token_secret') ?? '').length === 40 && got.get('user_id') === ADA.id && got.get('screen_name') === ADA.username
+            && replay.status === 401 && v1Code(replay) === 89;
+    })),
+    done('xidentity.oauth1.reauthorize_same_token', 'oauth1', 'A person who approves the same App again gets the access token they already hold (X\'s tokens "do not expire"); a revoked one is replaced', 'api', 'niche', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const fx = oauth1Fixtures(oauthCall(h));
+        const a = await fx.accessToken();
+        const b = await fx.accessToken();
+        await h({ m: 'POST', p: '/1.1/oauth/invalidate_token', h: { authorization: oauth1Header('POST', `${DEMO_ORIGIN}/1.1/oauth/invalidate_token`, OAUTH1_PROBE_APP, a) } });
+        const c = await fx.accessToken();
+        return a.key !== '' && a.key === b.key && a.secret === b.secret && c.key !== a.key && c.key !== '';
+    })),
+    done('xidentity.oauth1.unknown_consumer_refused', 'oauth1', 'A consumer key X does not hold is 401 with code 32 "Could not authenticate you." and issues nothing', 'api', 'core', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const r = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, { key: 'UnknownConsumer', secret: OAUTH1_PROBE_APP.secret }, null, { oauth_callback: OAUTH1_PROBE_CALLBACK }) } });
+        const none = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK }), h: FORM_H });
+        return r.status === 401 && v1Code(r) === 32 && body(r).errors[0].message === 'Could not authenticate you.'
+            && none.status === 400 && v1Code(none) === 215;
+    })),
+    done('xidentity.oauth1.bad_signature_refused', 'oauth1', 'A signature made with the wrong consumer secret, the wrong token secret, or over different parameters is refused at every leg and at /2/users/me', 'api', 'core', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const wrongApp = { key: OAUTH1_PROBE_APP.key, secret: 'wrong-consumer-secret' };
+        const leg1 = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, wrongApp, null, { oauth_callback: OAUTH1_PROBE_CALLBACK }) } });
+        // the body says one callback, the signature covered another
+        const tampered = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: 'https://evil.local/cb' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: OAUTH1_PROBE_CALLBACK }) } });
+        const fx = oauth1Fixtures(oauthCall(h));
+        const t = await fx.approved();
+        const leg3 = await h({ m: 'POST', p: '/oauth/access_token', b: form({ oauth_verifier: t.verifier }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/access_token`, OAUTH1_PROBE_APP, { key: t.key, secret: 'wrong' }, { oauth_verifier: t.verifier }) } });
+        const at = await fx.accessToken();
+        const me = (secret, url = `${DEMO_ORIGIN}/2/users/me`) => h({ m: 'GET', p: '/2/users/me', h: { authorization: oauth1Header('GET', url, OAUTH1_PROBE_APP, { key: at.key, secret }) } });
+        const good = await me(at.secret);
+        const badToken = await me('wrong');
+        const otherUrl = await me(at.secret, `${DEMO_ORIGIN}/2/users/me/other`);
+        // a query realm is an ordinary parameter (only the header's is unsigned), and a repeated key is refused
+        const signedPlain = oauth1Header('GET', `${DEMO_ORIGIN}/2/users/me?user.fields=username`, OAUTH1_PROBE_APP, at);
+        const realmInjected = await h({ m: 'GET', p: '/2/users/me?user.fields=username&realm=injected', h: { authorization: signedPlain } });
+        // even signed over it: X accepts no duplicate keys
+        const dup = '/2/users/me?user.fields=username&user.fields=username';
+        const repeated = await h({ m: 'GET', p: dup, h: { authorization: oauth1Header('GET', `${DEMO_ORIGIN}${dup}`, OAUTH1_PROBE_APP, at) } });
+        const plain = await h({ m: 'GET', p: '/2/users/me?user.fields=username', h: { authorization: signedPlain } });
+        return leg1.status === 401 && v1Code(leg1) === 32 && tampered.status === 401 && v1Code(tampered) === 32
+            && leg3.status === 401 && v1Code(leg3) === 32 && good.status === 200 && plain.status === 200
+            && badToken.status === 401 && body(badToken).type === 'about:blank' && otherUrl.status === 401
+            && realmInjected.status === 401 && repeated.status === 401;
+    })),
+    done('xidentity.oauth1.callback_not_approved', 'oauth1', 'A callback the App\'s settings do not list is refused with code 415 "Callback URL not approved for this client application."', 'api', 'common', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const cb = 'https://probe-app.local/x/callback/';
+        const r = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: cb }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: cb }) } });
+        return r.status === 403 && v1Code(r) === 415 && body(r).errors[0].message === 'Callback URL not approved for this client application.';
+    })),
+    done('xidentity.oauth1.invalid_request_token_page', 'oauth1', 'An authorize link whose request token X does not hold (unknown or already used) shows the invalid-token page, not a screen', 'api', 'niche', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const fx = oauth1Fixtures(oauthCall(h));
+        const t = await fx.approved();
+        const used = await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(t.key)}` });
+        const unknown = await h({ m: 'GET', p: '/oauth/authorize?oauth_token=NotARequestToken' });
+        return used.status === 400 && html(used).includes('The request token for this page is invalid') && !html(used).includes('Authorize app')
+            && unknown.status === 400 && html(unknown).includes('The request token for this page is invalid');
+    })),
+    done('xidentity.oauth1.invalidate_token', 'oauth1', 'POST 1.1/oauth/invalidate_token answers {"access_token": …} and the token is then refused (401) at /2/users/me and again at invalidate (code 89)', 'api', 'niche', () => withRoot(async (h) => {
+        await oauth1App(h);
+        const at = await oauth1Fixtures(oauthCall(h)).accessToken();
+        const inv = () => h({ m: 'POST', p: '/1.1/oauth/invalidate_token', h: { authorization: oauth1Header('POST', `${DEMO_ORIGIN}/1.1/oauth/invalidate_token`, OAUTH1_PROBE_APP, at) } });
+        const before = await h({ m: 'GET', p: '/2/users/me', h: { authorization: oauth1Header('GET', `${DEMO_ORIGIN}/2/users/me`, OAUTH1_PROBE_APP, at) } });
+        const r = await inv();
+        const after = await h({ m: 'GET', p: '/2/users/me', h: { authorization: oauth1Header('GET', `${DEMO_ORIGIN}/2/users/me`, OAUTH1_PROBE_APP, at) } });
+        const again = await inv();
+        return before.status === 200 && r.status === 200 && body(r).access_token === at.key && after.status === 401 && again.status === 401 && v1Code(again) === 89;
+    })),
+    done('xidentity.oauth1.world_app', 'oauth1', 'The World\'s own App (X_API_KEY / X_API_SECRET the World sets) signs request_token and is named on the screen for the World; the same values from the caller\'s shell alone are no App', 'api', 'common', () => withRoot(async (h) => {
+        const names = ['X_API_KEY', 'X_API_SECRET', 'VOLTER_WORLD_ENV_NAMES', 'VOLTER_WORLD_NAME'];
+        const saved = Object.fromEntries(names.map((n) => [n, process.env[n]]));
+        const app = { key: 'WorldConsumerKey000000001', secret: 'WorldConsumerSecret0000000000000000000000000001' };
+        const ask = () => h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: 'https://postiz.local/integrations/social/x' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, app, null, { oauth_callback: 'https://postiz.local/integrations/social/x' }) } });
+        try {
+            Object.assign(process.env, { X_API_KEY: app.key, X_API_SECRET: app.secret, VOLTER_WORLD_NAME: 'acme' });
+            delete process.env.VOLTER_WORLD_ENV_NAMES;
+            const shellOnly = await ask();
+            if (shellOnly.status !== 401 || v1Code(shellOnly) !== 32)
+                return false;
+            process.env.VOLTER_WORLD_ENV_NAMES = JSON.stringify(['X_API_KEY', 'X_API_SECRET']);
+            const r = await ask();
+            const token = new URLSearchParams(String(r.body)).get('oauth_token') ?? '';
+            const screen = html(await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(token)}` }));
+            return r.status === 200 && screen.includes('<strong class="app-name">acme</strong>');
+        }
+        finally {
+            for (const [n, v] of Object.entries(saved)) {
+                if (v === undefined)
+                    delete process.env[n];
+                else
+                    process.env[n] = v;
+            }
+        }
+    })),
+    todo('xidentity.oauth1.sign_in_with_x_setting', 'oauth1', 'The App\'s "Use Sign in with X" setting, which oauth/authenticate\'s skip depends on (the twin treats every App as having it on)', 'api', 'niche'),
+    todo('xidentity.oauth1.reauthorize_token_reuse_pin', 'oauth1', 'PIN that re-authorizing an App returns the access token it already holds (the twin reads it from the docs\' "do not expire" and invalidate_token sentences)', 'api', 'niche'),
+    todo('xidentity.oauth1.timestamp_window', 'oauth1', 'Refuse an oauth_timestamp outside X\'s window (code 135) — needs the app\'s clock and the World\'s to be one', 'api', 'niche'),
+    todo('xidentity.oauth1.nonce_replay', 'oauth1', 'Refuse a repeated oauth_nonce within the timestamp window', 'api', 'niche'),
+    todo('xidentity.oauth1.request_token_ttl', 'oauth1', 'Expire an unused request token (X\'s lifetime is undocumented)', 'api', 'niche'),
+    todo('xidentity.oauth1.login_screen', 'oauth1', 'force_login / screen_name: the x.com login step before the screen (the twin authenticates nobody; the session is the seeded persona)', 'ui', 'niche'),
+    todo('xidentity.oauth1.dm_access_level', 'oauth1', 'The "Read, write, and Direct Messages" App permission and x_auth_access_type\'s interaction with it', 'api', 'niche'),
+    todo('xidentity.oauth1.consent_wording', 'oauth1', 'PIN the OAuth 1.0a screen\'s live lines and the PIN page (the twin shows the widely-screenshotted wording)', 'ui', 'niche'),
+    todo('xidentity.oauth1.callback_refusal_status', 'oauth1', 'PIN the HTTP status of the 415 callback refusal (the docs show the body; the twin answers 403)', 'api', 'niche'),
+    todo('xidentity.oauth1.request_token_error_wording', 'oauth1', 'PIN the live answer to a request_token without oauth_callback (the twin answers 400 code 215)', 'api', 'niche'),
+    todo('xidentity.oauth1.access_token_error_wording', 'oauth1', 'PIN the live answers at access_token for a wrong verifier (the twin answers the widely-reported plain-text 401)', 'api', 'niche'),
+    todo('xidentity.oauth1.access_type_unknown_value', 'oauth1', 'PIN what X does with an x_auth_access_type other than read/write (the twin ignores it)', 'api', 'niche'),
+    todo('xidentity.oauth1.invalid_token_page', 'oauth1', 'PIN the live page and status for an unknown or used request token (the twin serves the "Whoa there!" wording at 400)', 'ui', 'niche'),
+    todo('xidentity.oauth1.denied_callback', 'oauth1', 'PIN the live callback for Cancel (the twin sends denied=<request token>, as widely reported)', 'api', 'niche'),
+    todo('xidentity.oauth1.response_content_type', 'oauth1', 'PIN the content type X serves the form-encoded leg bodies with (the twin serves text/html)', 'api', 'niche'),
+    todo('xidentity.oauth1.verify_credentials', 'oauth1', 'GET 1.1/account/verify_credentials, the identity read the OAuth 1.0a guide names (v1.1 is not modelled)', 'api', 'niche'),
 ];
 export function xidentityCapabilities() {
     return checkCapabilities('xidentity', XIDENTITY_CAPABILITIES);

package/dist/src/xidentity-conformance.d.ts

@@ -1,3 +1,4 @@
+import { type XResponse } from './xidentity-twin.js';
 export type XIdentityConformanceReport = {
     ok: boolean;
     endpointsChecked: number;
@@ -5,6 +6,46 @@ export type XIdentityConformanceReport = {
     resourceTypesChecked: number;
     violations: string[];
 };
+/** The Authorization header for `method url` with these extra signed params (query + form body). */
+export declare function oauth1Header(method: string, url: string, consumer: {
+    key: string;
+    secret: string;
+}, token: {
+    key: string;
+    secret: string;
+} | null, signed?: Record<string, string>): string;
+/** The App the OAuth 1.0a probes run under, registered through the twin door. */
+export declare const OAUTH1_PROBE_APP: {
+    key: string;
+    secret: string;
+};
+export declare const OAUTH1_PROBE_CALLBACK = "https://probe-app.local/x/callback";
+type Call = (method: string, path: string, body?: string, headers?: Record<string, string>) => Promise<XResponse>;
+export type OAuth1Fixtures = {
+    /** A fresh request token (and its secret) from step 1. */
+    requestToken(): Promise<{
+        key: string;
+        secret: string;
+    }>;
+    /** A fresh request token whose screen the person has open (the decision is still to make). */
+    presented(): Promise<{
+        key: string;
+        secret: string;
+    }>;
+    /** A request token taken through the screen and approved: its verifier. */
+    approved(): Promise<{
+        key: string;
+        secret: string;
+        verifier: string;
+    }>;
+    /** A usable access token for the signed-in persona. */
+    accessToken(): Promise<{
+        key: string;
+        secret: string;
+    }>;
+};
+export declare function oauth1Fixtures(call: Call): OAuth1Fixtures;
 export declare function checkXIdentityConformance(opts?: {
     root?: string;
 }): Promise<XIdentityConformanceReport>;
+export {};