@volter/twin-xidentity 0.1.0 → 0.1.2

package/dist/src/xidentity-store.d.ts

@@ -1,6 +1,6 @@
 import { type TwinResource } from '@volter/world-core';
 export declare const SERVICE = "xidentity";
-export declare const RESOURCE_TYPES: readonly ["oauth_client", "account", "session", "auth_request", "authorization_code", "access_token", "refresh_token", "grant", "rate_window"];
+export declare const RESOURCE_TYPES: readonly ["oauth_client", "account", "session", "auth_request", "authorization_code", "access_token", "refresh_token", "grant", "rate_window", "oauth1_app", "oauth1_request_token", "oauth1_token", "oauth1_grant"];
 export type ResourceType = (typeof RESOURCE_TYPES)[number];
 export type Row = TwinResource & Record<string, any>;
 export declare function readAll(root: string | undefined): Row[];
@@ -30,6 +30,9 @@ export declare const mintAuthorizationCode: (root: string | undefined, at: numbe
 export declare const mintAccessToken: (root: string | undefined, at: number, subject: string) => string;
 /** An X OAuth 2.0 refresh token (`…:rt:1`). `subject` is the credential exchanged for it. */
 export declare const mintRefreshToken: (root: string | undefined, at: number, subject: string) => string;
+/** FNV-1a over the seed, widened by re-hashing with a round counter until `n` hex chars exist
+ *  (the resend exemplar's `stableHex`). Pure: no clock, no entropy, no host state. */
+export declare function stableHex(seed: string, n: number): string;
 /**
  * Twin-internal handle for an authorize screen in flight (never leaves the twin's own pages) —
  * `ar_` + 32 hex, the shape `randomUUID()` gave it, now a pure function of (request, stored state).

package/dist/src/xidentity-store.js

@@ -39,6 +39,13 @@ export const RESOURCE_TYPES = [
     'refresh_token',
     'grant',
     'rate_window',
+    // OAuth 1.0a (xidentity-oauth1.ts): an App registered through the twin door, a request token
+    // in flight between the three legs, an issued access token, and the (app, user) grant that lets
+    // GET oauth/authenticate skip a screen already approved.
+    'oauth1_app',
+    'oauth1_request_token',
+    'oauth1_token',
+    'oauth1_grant',
 ];
 export function readAll(root) {
     return projectResources(SERVICE, root);
@@ -132,7 +139,7 @@ export const mintRefreshToken = (root, at, subject) => b64url(`${stableHex(crede
 // ── the authorize screen's handle: DETERMINISTIC, because it is SERVED (R9) ─────────────────────
 /** FNV-1a over the seed, widened by re-hashing with a round counter until `n` hex chars exist
  *  (the resend exemplar's `stableHex`). Pure: no clock, no entropy, no host state. */
-function stableHex(seed, n) {
+export function stableHex(seed, n) {
     let out = '';
     for (let round = 0; out.length < n; round += 1) {
         let h = 0x811c9dc5;

package/dist/src/xidentity-twin.js

@@ -47,6 +47,7 @@ import { applyTwinWriteAtomic } from '@volter/world-core';
 import { consentPageHtml, errorPageHtml, xIdentityConsentState } from "./xidentity-consent-ui.js";
 import { formatScopeParam, parseScopeParam } from "./xidentity-scopes.js";
 import { normalizeChallengeMethod, pkceVerifies } from "./xidentity-pkce.js";
+import { OAUTH1_ENDPOINTS, OAUTH1_WRITE_PATHS, routeOAuth1, scopesOfAccessLevel, verifyUserContext } from "./xidentity-oauth1.js";
 import { authRequestIdFor, ensureSeed, mintAccessToken, mintAuthorizationCode, mintClientId, mintRefreshToken, nextRev, nextRevIn, readAll, readOne, readType, RESOURCE_TYPES as STORE_RESOURCE_TYPES, sessionAccount, redirectUriAllowed, write, writeAtomic, } from "./xidentity-store.js";
 export { RESOURCE_TYPES } from "./xidentity-store.js";
 /** X's real hosts. The authorize screen lives on the site host; the API on api.x.com. The legacy
@@ -613,8 +614,11 @@ function enumMessage(param, bad, allowed) {
 async function usersMe(req, query) {
     const root = req.root;
     const header = req.headers?.authorization ?? '';
-    const bearer = /^bearer\s+(.+)$/i.exec(header)?.[1]?.trim();
-    if (!bearer)
+    // Two schemes, as the OpenAPI's security for this operation lists them: an OAuth 2.0 user bearer
+    // (OAuth2UserToken) or OAuth 1.0a User Context (UserToken), verified in xidentity-oauth1.ts.
+    const oauth1 = /^oauth\s/i.test(header);
+    const bearer = oauth1 ? undefined : /^bearer\s+(.+)$/i.exec(header)?.[1]?.trim();
+    if (!bearer && !oauth1)
         return unauthorizedProblem();
     // Parameter validation happens BEFORE rate accounting: a 400 is not a spent request.
     // EXTRAPOLATION on the ordering (`xidentity.rate.what_counts`, todo).
@@ -632,17 +636,31 @@ async function usersMe(req, query) {
     // hydrates a post yet, so it validates nothing and shapes nothing —
     // `xidentity.users_me.expansion_hydration` (todo) owns the honest gap.
     const evaluate = (resources, spend) => {
-        const tokenRow = resources.find((row) => row.type === 'access_token' && row.id === bearer);
-        if (!tokenRow || tokenRow.revoked === true
-            || (typeof tokenRow.expiresAt === 'number' && nowSeconds(req.occurredAt) >= tokenRow.expiresAt)) {
-            return { response: unauthorizedProblem() };
+        let sub;
+        let held;
+        if (oauth1) {
+            // A signed request with an access token this pack issued and has not revoked; anything else
+            // (unknown consumer, bad signature, revoked token) is the same about:blank 401 a bad bearer gets.
+            const who = verifyUserContext(req, resources);
+            if (!who)
+                return { response: unauthorizedProblem() };
+            sub = String(who.token.userId);
+            held = scopesOfAccessLevel(who.token.accessLevel);
+        }
+        else {
+            const tokenRow = resources.find((row) => row.type === 'access_token' && row.id === bearer);
+            if (!tokenRow || tokenRow.revoked === true
+                || (typeof tokenRow.expiresAt === 'number' && nowSeconds(req.occurredAt) >= tokenRow.expiresAt)) {
+                return { response: unauthorizedProblem() };
+            }
+            sub = String(tokenRow.sub);
+            held = parseScopeParam(String(tokenRow.scope));
         }
-        const held = parseScopeParam(String(tokenRow.scope));
         const missing = USERS_ME_REQUIRED_SCOPES.filter((scope) => !held.includes(scope));
         if (missing.length > 0) {
             return { response: forbiddenProblem(`The access token does not carry the scope(s) required by this endpoint: ${missing.join(', ')}.`) };
         }
-        const account = resources.find((row) => row.type === 'account' && row.id === String(tokenRow.sub));
+        const account = resources.find((row) => row.type === 'account' && row.id === sub);
         if (!account)
             return { response: unauthorizedProblem() };
         const now = nowSeconds(req.occurredAt);
@@ -700,6 +718,7 @@ export function xIdentityTwinSnapshot() {
             'POST /2/oauth2/token',
             'POST /2/oauth2/revoke',
             'GET /2/users/me',
+            ...OAUTH1_ENDPOINTS,
         ],
         resourceTypes: STORE_RESOURCE_TYPES,
         grantTypes: ['authorization_code', 'refresh_token'],
@@ -826,7 +845,8 @@ async function routeXIdentityTwinRequest(req) {
     // D3: a read-only twin cannot mint credentials or settle consent. GET /2/users/me stays served
     // (a read), with rate accounting suspended. The refusal is an OAuth error body, so a client sees
     // a protocol error rather than an HTML surprise.
-    const writes = path.startsWith('/_twin/') || path === '/2/oauth2/token' || path === '/2/oauth2/revoke';
+    const writes = path.startsWith('/_twin/') || path === '/2/oauth2/token' || path === '/2/oauth2/revoke' || OAUTH1_WRITE_PATHS.has(path)
+        || (method === 'POST' && path === '/oauth/authorize');
     if (req.readOnly && writes) {
         return oauthError('temporarily_unavailable', 'this twin was started read-only; omit readOnly to accept writes', 405);
     }
@@ -834,6 +854,9 @@ async function routeXIdentityTwinRequest(req) {
     // a world with clients, personas and a signed-in session — exactly what a browser at x.com has.
     if (!req.readOnly)
         await ensureSeed({ root: req.root, ...(req.occurredAt ? { occurredAt: req.occurredAt } : {}), ...((req.callbackOrigin ?? req.origin) ? { origin: req.callbackOrigin ?? req.origin } : {}) });
+    const oauth1 = await routeOAuth1(req, method, path);
+    if (oauth1)
+        return oauth1;
     const control = await twinControl(req, path, form);
     if (control)
         return control;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-xidentity",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Local X (Twitter) identity twin — the real x.com authorize screen, the full OAuth 2.0 authorization-code + PKCE round trip (token, refresh, revoke), and GET /2/users/me with X's real field/expansion/problem envelopes, so an unmodified X client completes sign-in-with-X against it. Built on @volter/world-core.",
   "keywords": [
     "twin",
@@ -56,17 +56,18 @@
     "react-dom": "^19.2.7"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.0"
+    "@volter/world-core": "2.0.2"
   },
   "devDependencies": {
-    "@volter/world-core": "2.0.0",
+    "@volter/world-core": "2.0.2",
     "@volter/world-tooling": "0.1.0",
     "@xdevplatform/xdk": "^0.6.6",
     "@types/bun": "^1.2.20",
     "@types/node": "^24.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "typescript": "^5.9.0"
+    "typescript": "^5.9.0",
+    "twitter-api-v2": "^1.29.1"
   },
   "engines": {
     "node": ">=22.3"

package/src/index.ts

@@ -84,6 +84,21 @@ export {
   xIdentityConsentState,
 } from './xidentity-consent-ui.ts';
 export type { ConsentAccount, ConsentScopeRow, ConsentView, ErrorPageProps } from './xidentity-consent-ui.ts';
+export {
+  OAUTH1_ENDPOINTS,
+  oauth1AppOf,
+  oauth1Params,
+  parseOAuthHeader,
+  pct,
+  scopesOfAccessLevel,
+  signatureMatches,
+  signedBaseUrl,
+  signedRequestOf,
+  verifyUserContext,
+  WORLD_APP_ENV,
+  worldOAuth1App,
+} from './xidentity-oauth1.ts';
+export type { OAuth1App, OAuth1Principal, SignedRequest } from './xidentity-oauth1.ts';
 
 // Registry descriptor: the pack self-describes so tooling can discover it.
 import type { TwinPack } from '@volter/world-core';
@@ -100,13 +115,18 @@ import { XIDENTITY_RATE_BUDGET as RATE_BUDGET } from './xidentity-budget.ts';
 const XIDENTITY_CONSENT_PATHS = '^/i/oauth2/authorize/?$|^/_twin/';
 
 /**
- * The api.x.com / api.twitter.com paths THIS pack serves: the OAuth 2.0 token + revoke endpoints
- * and the authenticated-user read. api.x.com is the ENTIRE X API v2 host — posts, DMs, spaces — and
+ * The api.x.com / api.twitter.com paths THIS pack serves: the OAuth 2.0 token + revoke endpoints,
+ * the authenticated-user read, and OAuth 1.0a's three legs (request_token, the authorize and
+ * authenticate screens — served on api.x.com itself, where X serves them — and access_token) plus
+ * 1.1/oauth/invalidate_token, and the page assets that screen loads from the host it is on
+ * (`/_twin/assets/consent.{js,css}`; the `x` pack's `/_twin/` claim leaves exactly these two out, so
+ * the claims stay disjoint). The screen's Authorize app form posts to `POST oauth/authorize`, which
+ * the same rule already covers. api.x.com is the ENTIRE X API v2 host — posts, DMs, spaces — and
  * this pack models the identity slice only, so nothing else is claimed: an unmodelled X call must
- * refuse loudly rather than land in a twin that cannot serve it. Transcribed unchanged from
- * inject.cjs's former `isXIdentityApiPath` predicate.
+ * refuse loudly rather than land in a twin that cannot serve it. First transcribed from
+ * inject.cjs's former `isXIdentityApiPath` predicate; the asset paths were added 2026-09-28.
  */
-const XIDENTITY_API_PATHS = '^/2/(?:oauth2/(?:token|revoke)|users/me)/?$';
+const XIDENTITY_API_PATHS = '^/2/(?:oauth2/(?:token|revoke)|users/me)/?$|^/oauth/(?:request_token|authorize|authenticate|access_token)/?$|^/1\\.1/oauth/invalidate_token(?:\\.json)?/?$|^/_twin/assets/consent\\.(?:js|css)$';
 
 export const pack: TwinPack = {
   // STILL PROTOCOL 1, and the reason is the gate rather than the pack (ROADMAP.md,
@@ -124,15 +144,17 @@ export const pack: TwinPack = {
   transport: 'rest',
   archetype: 'crud',
   bin: 'world-xidentity',
-  resources: ['oauth_client', 'account', 'session', 'auth_request', 'authorization_code', 'access_token', 'refresh_token', 'grant', 'rate_window'],
+  resources: ['oauth_client', 'account', 'session', 'auth_request', 'authorization_code', 'access_token', 'refresh_token', 'grant', 'rate_window', 'oauth1_app', 'oauth1_request_token', 'oauth1_token', 'oauth1_grant'],
   specSource:
     'api.x.com/2/openapi.json (X API v2 OpenAPI 2.167: /2/users/me, the Problem family, the '
     + '24-scope OAuth2UserToken catalog) + docs.x.com OAuth 2.0 authorization-code/user-access-token '
     + 'guides + the official SDK sources (@xdevplatform/xdk, twitter-api-typescript-sdk), all '
-    + 'fetched 2026-08-21',
+    + 'fetched 2026-08-21; OAuth 1.0a from docs.x.com authentication/api-reference, obtaining-user-access-tokens, '
+    + 'creating-a-signature and developer-apps, fetched 2026-09-27',
   description:
     'X (Twitter) identity twin — the real x.com authorize screen, the full OAuth 2.0 '
-    + 'authorization-code + PKCE round trip (token, refresh, revoke), and GET /2/users/me with '
+    + 'authorization-code + PKCE round trip (token, refresh, revoke), the OAuth 1.0a three-legged flow '
+    + '(request_token, the authorize/authenticate screen, access_token, invalidate_token), and GET /2/users/me with '
     + "X's real field/expansion/problem envelopes. Non-OIDC, exactly as the vendor is.",
   // Adoption + interception, moved off the central maps unchanged (descriptor-first back-migration, adding-a-twin.md §3,
   // 2026-08-31).

package/src/xidentity-capabilities.ts

@@ -47,7 +47,7 @@ import { renderToStaticMarkup } from 'react-dom/server';
 import { checkCapabilities, uiDataCoupled, verifyBoundary, type CapabilityReport, type CapabilitySpec } from '@volter/world-tooling';
 import { ConsentPage, ErrorPage, type ConsentView } from '../client/xidentity-consent.tsx';
 import { CONSENT_CLIENT_JS, xIdentityConsentState } from './xidentity-consent-ui.ts';
-import { checkXIdentityConformance } from './xidentity-conformance.ts';
+import { checkXIdentityConformance, oauth1Fixtures, oauth1Header, OAUTH1_PROBE_APP, OAUTH1_PROBE_CALLBACK } from './xidentity-conformance.ts';
 import { XIdentityBudgetError, XIDENTITY_BUDGET_BURST_CEILING } from './xidentity-budget.ts';
 import {
   liveXIdentityExecute,
@@ -117,6 +117,15 @@ const qp = (r: XResponse, key: string) => {
 const form = (params: Record<string, string>) => new URLSearchParams(params).toString();
 const decoded = (token: unknown) => Buffer.from(String(token ?? ''), 'base64url').toString('utf8');
 
+// ── OAuth 1.0a helpers: the probe App and its independent signer live in xidentity-conformance.ts ──
+const FORM_H = { 'content-type': 'application/x-www-form-urlencoded' };
+/** Register the probe App through the twin door (X's developer console has no API). */
+const oauth1App = (h: H) => h({ m: 'POST', p: '/_twin/oauth1_apps', b: JSON.stringify({ consumer_key: OAUTH1_PROBE_APP.key, consumer_secret: OAUTH1_PROBE_APP.secret, name: 'Probe App', callback_urls: [OAUTH1_PROBE_CALLBACK] }) });
+/** The conformance fixtures' call shape over this verify's handler. */
+const oauthCall = (h: H) => (m: string, p: string, b?: string, headers?: Record<string, string>) => h({ m, p, ...(b === undefined ? {} : { b }), ...(headers ? { h: headers } : {}) });
+/** The legacy v1.1 error code of a refusal. */
+const v1Code = (r: XResponse): number | undefined => (r.body as Body)?.errors?.[0]?.code;
+
 /** Build an authorize URL from parameters, so a verify can vary exactly one of them. `undefined`
  *  REMOVES a base parameter. */
 function authUrl(params: Record<string, string | undefined> = {}): string {
@@ -581,6 +590,11 @@ export const XIDENTITY_CAPABILITIES: CapabilitySpec[] = [
         && d['verified'] === true
         && d['verified_type'] === 'blue';
     })),
+  // The x pack answers user.fields=profile_image_url with X's default avatar for an account seeded
+  // without a photo (every X account has one); this pack omits it, because a PARTIALLY-pulled persona
+  // cannot tell "no photo" from "not pulled" (renderUser). Serving the default for a seeded persona
+  // needs that distinction recorded on the row — until then the two packs answer differently (§9).
+  todo('xidentity.users_me.default_profile_image', 'users_me', "user.fields=profile_image_url for a persona seeded without a photo: X's default avatar URL (abs.twimg.com default_profile_normal.png), as the x pack serves it, rather than omission", 'api', 'common'),
   done('xidentity.users_me.public_metrics', 'users_me', 'user.fields=public_metrics returns the metrics object with the vendor\'s six counters', 'api', 'common', () =>
     withRoot(async (h) => {
       const { tokens } = await fullFlow(h);
@@ -646,7 +660,18 @@ export const XIDENTITY_CAPABILITIES: CapabilitySpec[] = [
   todo('xidentity.users_me.invalid_request_envelope_pin', 'users_me', 'PIN the live invalid-parameter body against the OpenAPI\'s singular InvalidRequestProblem (the twin serves the reported errors[] wire shape)', 'api', 'common'),
   todo('xidentity.users_me.confirmed_email_scope_behavior', 'users_me', 'PIN what the live endpoint does when confirmed_email is requested WITHOUT users.email (the twin withholds the field; a 403 is the other candidate)', 'api', 'niche'),
   todo('xidentity.users_me.app_only_forbidden', 'users_me', 'Model the 403 Unsupported Authentication envelope an app-only bearer gets on this user-context endpoint', 'api', 'common'),
-  todo('xidentity.users_me.oauth1_user_context', 'users_me', 'Model OAuth 1.0a User Context as the alternate auth the OpenAPI lists for this operation', 'api', 'niche'),
+  done('xidentity.users_me.oauth1_user_context', 'users_me', 'GET /2/users/me honours OAuth 1.0a User Context, the alternate scheme the OpenAPI lists: a signed request answers the token\'s user, a wrong secret or unknown token is the 401', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const at = await oauth1Fixtures(oauthCall(h)).accessToken();
+      const sign = (t: { key: string; secret: string }, q = '') => oauth1Header('GET', `${DEMO_ORIGIN}/2/users/me${q}`, OAUTH1_PROBE_APP, t);
+      const r = await h({ m: 'GET', p: '/2/users/me?user.fields=username,verified', h: { authorization: sign(at, '?user.fields=username,verified') } });
+      // the query is signed: the same header over a different query does not verify
+      const unsignedQuery = await h({ m: 'GET', p: '/2/users/me?user.fields=location', h: { authorization: sign(at, '?user.fields=username,verified') } });
+      const unknown = await h({ m: 'GET', p: '/2/users/me', h: { authorization: sign({ key: `${ADA.id}-NotIssued`, secret: at.secret }) } });
+      return r.status === 200 && body(r).data.id === ADA.id && body(r).data.username === ADA.username && body(r).data.verified === ADA.verified
+        && unsignedQuery.status === 401 && unknown.status === 401;
+    })),
   todo('xidentity.users_me.partial_errors', 'users_me', 'Model the errors[] array alongside data (per-field Problem entries on a 200, per GetUsersMeResponse)', 'api', 'niche'),
 
   // ═══ rate envelope ════════════════════════════════════════════════════════════════════════
@@ -730,13 +755,15 @@ export const XIDENTITY_CAPABILITIES: CapabilitySpec[] = [
   todo('xidentity.scopes.users_email_wording', 'scopes', 'PIN the consent screen\'s live wording for users.email (the label is twin prose; the scope itself is announcement-grounded)', 'ui', 'niche'),
 
   // ═══ read-only twin ═══════════════════════════════════════════════════════════════════════
-  done('xidentity.readonly.writes_refused', 'readonly', 'A read-only twin refuses every credential-minting leg (405, protocol-shaped error body) — D3', 'api', 'common', () =>
+  done('xidentity.readonly.writes_refused', 'readonly', 'A read-only twin refuses every credential-minting leg and the OAuth 1.0a screen\'s decision (405, protocol-shaped error body) — D3', 'api', 'common', () =>
     withRoot(async (h) => {
       await fullFlow(h); // seed a world first, through the ordinary write path
       const ro = (s: Step) => handleXIdentityTwinRequest({ method: s.m, path: s.p, ...(s.b !== undefined ? { body: s.b } : {}), root: h.root, origin: DEMO_ORIGIN, occurredAt: AT, readOnly: true });
       const tok = await ro({ m: 'POST', p: '/2/oauth2/token', b: form({ grant_type: 'authorization_code', code: 'x', client_id: DEFAULT_CLIENT_ID, redirect_uri: REDIRECT, code_verifier: VERIFIER }) });
       const rev = await ro({ m: 'POST', p: '/2/oauth2/revoke', b: form({ token: 'x', client_id: DEFAULT_CLIENT_ID }) });
-      return tok.status === 405 && body(tok)['error'] === 'temporarily_unavailable' && rev.status === 405;
+      // the OAuth 1.0a screen's decision settles consent: a write, though its path is also the GET screen's
+      const decide = await ro({ m: 'POST', p: '/oauth/authorize', b: form({ auth_request: 'x', decision: 'allow' }) });
+      return tok.status === 405 && body(tok)['error'] === 'temporarily_unavailable' && rev.status === 405 && decide.status === 405;
     })),
   done('xidentity.readonly.reads_served', 'readonly', 'A read-only twin still serves GET /2/users/me over existing state (rate accounting suspended, headers intact)', 'api', 'niche', () =>
     withRoot(async (h) => {
@@ -748,7 +775,7 @@ export const XIDENTITY_CAPABILITIES: CapabilitySpec[] = [
   // ═══ conformance (the endpoint census with teeth) ═════════════════════════════════════════
   done('xidentity.conformance.census', 'conformance', 'The conformance check passes: one real probe per claimed endpoint, the ROUTER_SURFACE census, the live round trip, and a reachability witness per resource type', 'api', 'core', async () => {
     const report = await checkXIdentityConformance();
-    return report.ok && report.endpointsProbed === 4 && report.resourceTypesChecked === 9;
+    return report.ok && report.endpointsProbed === 11 && report.resourceTypesChecked === 13;
   }),
 
   // ═══ the authorize SCREEN (the vendor's own UI — data-coupled, per ADDING_A_TWIN.md §6) ═══
@@ -1002,9 +1029,228 @@ export const XIDENTITY_CAPABILITIES: CapabilitySpec[] = [
   // ═══ adjacent X auth surface the identity twin does not model yet (honest denominator) ═════
   todo('xidentity.app_only.bearer_token', 'app_only', 'Model the app-only bearer flow (POST /oauth2/token, grant_type=client_credentials, the v1.1 path)', 'api', 'common'),
   todo('xidentity.app_only.invalidate_token', 'app_only', 'Model POST /oauth2/invalidate_token for app-only bearers', 'api', 'niche'),
-  todo('xidentity.oauth1.request_token', 'oauth1', 'Model OAuth 1.0a step 1: POST /oauth/request_token', 'api', 'niche'),
-  todo('xidentity.oauth1.authorize', 'oauth1', 'Model OAuth 1.0a step 2: GET /oauth/authorize (the legacy consent screen)', 'api', 'niche'),
-  todo('xidentity.oauth1.access_token', 'oauth1', 'Model OAuth 1.0a step 3: POST /oauth/access_token', 'api', 'niche'),
+
+  // ═══ OAuth 1.0a (xidentity-oauth1.ts; docs.x.com api-reference + obtaining-user-access-tokens) ══
+  done('xidentity.oauth1.request_token', 'oauth1', 'POST oauth/request_token signed by a registered App answers oauth_token, oauth_token_secret and oauth_callback_confirmed=true, and the token opens that App\'s screen', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const r = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: OAUTH1_PROBE_CALLBACK }) } });
+      const got = new URLSearchParams(String(r.body));
+      const token = got.get('oauth_token') ?? '';
+      const screen = await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(token)}` });
+      return r.status === 200 && got.get('oauth_callback_confirmed') === 'true' && /^[A-Za-z0-9]{27}$/.test(token)
+        && (got.get('oauth_token_secret') ?? '').length > 0 && html(screen).includes('>Probe App<');
+    })),
+  done('xidentity.oauth1.authorize', 'oauth1', 'GET oauth/authorize shows X\'s screen naming the App and the signed-in account; Authorize app sends the person to the callback with exactly oauth_token and oauth_verifier', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const fx = oauth1Fixtures(oauthCall(h));
+      const t = await fx.requestToken();
+      const screen = await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(t.key)}` });
+      const handle = AUTH_REQUEST_RE.exec(html(screen))?.[1] ?? '';
+      const d = await h({ m: 'POST', p: '/oauth/authorize', b: form({ auth_request: handle, decision: 'allow' }), h: FORM_H });
+      const back = new URL(loc(d) || 'http://invalid.test/');
+      return screen.status === 200 && html(screen).includes('<strong class="app-name">Probe App</strong> wants to access your X account')
+        && html(screen).includes(`@${ADA.username}`) && html(screen).includes('action="http://localhost:3000/oauth/authorize"')
+        && d.status === 302 && `${back.origin}${back.pathname}` === OAUTH1_PROBE_CALLBACK
+        && back.searchParams.get('oauth_token') === t.key && /^[A-Za-z0-9]{32}$/.test(back.searchParams.get('oauth_verifier') ?? '')
+        && [...back.searchParams.keys()].length === 2;
+    })),
+  // api.x.com is shared with the `x` pack, which claims that host's `/_twin/*` and comes first in
+  // the World's first-match routing. A decision door there reached the x pack in a World (the
+  // Postiz walk, 2026-09-28: "Authorize app" answered the x pack's JSON 400 and X never connected),
+  // while every in-process test posted straight to this twin's port. So the verify asks the
+  // World's own router which pack the screen's form lands on, for both API hosts, and then drives it.
+  done('xidentity.oauth1.authorize_form_routes_here', 'oauth1', 'Authorize app posts to POST oauth/authorize on the host that served the screen, as X\'s own screen does, and the screen\'s stylesheet and script load from that host — paths a World routes to this pack on api.x.com and api.twitter.com, not to the x pack beside it', 'ui', 'common', () =>
+    withRoot(async (h) => {
+      // the injector's own first-match table (compiled from pack-facts.json), untyped CommonJS
+      const { createRequire } = await import('node:module');
+      const { VENDOR_HOSTS } = createRequire(import.meta.url)('@volter/world-core/vendor-hosts') as { VENDOR_HOSTS: Record<string, (host: string, path?: string) => boolean> };
+      const routedTo = (host: string, path: string) => Object.keys(VENDOR_HOSTS).find((k) => VENDOR_HOSTS[k]!(host, path));
+      await oauth1App(h);
+      const t = await oauth1Fixtures(oauthCall(h)).requestToken();
+      const screen = await h({ m: 'GET', p: `/oauth/authenticate?oauth_token=${encodeURIComponent(t.key)}` });
+      const action = /<form [^>]*method="POST"[^>]*action="([^"]+)"|<form [^>]*action="([^"]+)"[^>]*method="POST"/.exec(html(screen));
+      const actionPath = new URL(action?.[1] ?? action?.[2] ?? 'http://invalid.test/nowhere').pathname;
+      const d = await h({ m: 'POST', p: actionPath, b: form({ auth_request: t.key, decision: 'allow' }), h: FORM_H });
+      // …and the page's own stylesheet and script, loaded from the same host (else it renders unstyled)
+      const assets = [...html(screen).matchAll(/(?:href|src)="([^"]+\/_twin\/assets\/[^"]+)"/g)].map((m) => new URL(m[1]!).pathname);
+      const { createXIdentityTwinFetch } = await import('./xidentity-server.ts');
+      const fetchTwin = createXIdentityTwinFetch({ root: h.root });
+      const served = await Promise.all(assets.map((p) => fetchTwin(new Request(`https://api.x.com${p}`))));
+      return actionPath === '/oauth/authorize' && routedTo('api.x.com', actionPath) === 'xidentity' && routedTo('api.twitter.com', actionPath) === 'xidentity'
+        && assets.length === 2 && assets.every((p) => routedTo('api.x.com', p) === 'xidentity' && routedTo('api.twitter.com', p) === 'xidentity')
+        && served.every((r) => r.status === 200)
+        // the x pack keeps the rest of the host's control prefix
+        && routedTo('api.x.com', '/_twin/accounts') === 'x'
+        && d.status === 302 && qp(d, 'oauth_token') === t.key && (qp(d, 'oauth_verifier') ?? '').length === 32;
+    })),
+  done('xidentity.oauth1.authorize_read_access', 'oauth1', 'x_auth_access_type=read narrows a Read-and-write App: the screen lists only what reading allows', 'ui', 'niche', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const read = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK, x_auth_access_type: 'read' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: OAUTH1_PROBE_CALLBACK, x_auth_access_type: 'read' }) } });
+      const token = new URLSearchParams(String(read.body)).get('oauth_token') ?? '';
+      const screen = html(await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(token)}` }));
+      const write = html(await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent((await oauth1Fixtures(oauthCall(h)).requestToken()).key)}` }));
+      return screen.includes('Accounts you follow, mute, and block.') && !screen.includes('Post and delete Posts for you')
+        && write.includes('Post and delete Posts for you');
+    })),
+  done('xidentity.oauth1.authenticate_skips_approved', 'oauth1', 'GET oauth/authenticate (Sign in with X) redirects without a screen once the person has approved the App, and shows it the first time or with force_login=true', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const fx = oauth1Fixtures(oauthCall(h));
+      const first = await h({ m: 'GET', p: `/oauth/authenticate?oauth_token=${encodeURIComponent((await fx.requestToken()).key)}` });
+      await fx.approved();
+      const again = await h({ m: 'GET', p: `/oauth/authenticate?oauth_token=${encodeURIComponent((await fx.requestToken()).key)}` });
+      const forced = await h({ m: 'GET', p: `/oauth/authenticate?oauth_token=${encodeURIComponent((await fx.requestToken()).key)}&force_login=true` });
+      const back = new URL(loc(again) || 'http://invalid.test/');
+      return first.status === 200 && html(first).includes('Authorize app') && again.status === 302
+        && `${back.origin}${back.pathname}` === OAUTH1_PROBE_CALLBACK && (back.searchParams.get('oauth_verifier') ?? '').length === 32
+        && forced.status === 200 && html(forced).includes('Authorize app');
+    })),
+  done('xidentity.oauth1.cancel_denied', 'oauth1', 'Cancel sends the person back with denied=<request token>, and that token can no longer be exchanged', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const t = await oauth1Fixtures(oauthCall(h)).requestToken();
+      await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(t.key)}` });
+      const d = await h({ m: 'POST', p: '/oauth/authorize', b: form({ auth_request: t.key, decision: 'deny' }), h: FORM_H });
+      const x = await h({ m: 'POST', p: '/oauth/access_token', b: form({ oauth_verifier: 'x' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/access_token`, OAUTH1_PROBE_APP, t, { oauth_verifier: 'x' }) } });
+      return d.status === 302 && qp(d, 'denied') === t.key && qp(d, 'oauth_verifier') === null && x.status === 401 && v1Code(x) === 89;
+    })),
+  done('xidentity.oauth1.oob_pin', 'oauth1', 'oauth_callback=oob (PIN-based): approval shows the verifier as a 7-digit PIN, which access_token accepts', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const r = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: 'oob' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: 'oob' }) } });
+      const t = { key: new URLSearchParams(String(r.body)).get('oauth_token') ?? '', secret: new URLSearchParams(String(r.body)).get('oauth_token_secret') ?? '' };
+      await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(t.key)}` });
+      const d = await h({ m: 'POST', p: '/oauth/authorize', b: form({ auth_request: t.key, decision: 'allow' }), h: FORM_H });
+      const pin = /<code class="oauth-pin">([^<]+)<\/code>/.exec(html(d))?.[1] ?? '';
+      const x = await h({ m: 'POST', p: '/oauth/access_token', b: form({ oauth_verifier: pin }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/access_token`, OAUTH1_PROBE_APP, t, { oauth_verifier: pin }) } });
+      return d.status === 200 && /^\d{7}$/.test(pin) && x.status === 200 && new URLSearchParams(String(x.body)).get('user_id') === ADA.id;
+    })),
+  done('xidentity.oauth1.access_token', 'oauth1', 'POST oauth/access_token trades an approved request token + verifier for `<user id>-<token>`, its secret, user_id and screen_name — once', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const t = await oauth1Fixtures(oauthCall(h)).approved();
+      // twitter-api-v2's shape (Postiz's login): oauth_token in the header AND the body, signed once
+      const exchange = (verifier: string) => h({ m: 'POST', p: '/oauth/access_token', b: form({ oauth_token: t.key, oauth_verifier: verifier }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/access_token`, OAUTH1_PROBE_APP, t, { oauth_verifier: verifier }) } });
+      const wrong = await exchange('not-the-verifier');
+      const r = await exchange(t.verifier);
+      const got = new URLSearchParams(String(r.body));
+      const replay = await exchange(t.verifier);
+      return wrong.status === 401 && r.status === 200 && new RegExp(`^${ADA.id}-[A-Za-z0-9]{40}$`).test(got.get('oauth_token') ?? '')
+        && (got.get('oauth_token_secret') ?? '').length === 40 && got.get('user_id') === ADA.id && got.get('screen_name') === ADA.username
+        && replay.status === 401 && v1Code(replay) === 89;
+    })),
+  done('xidentity.oauth1.reauthorize_same_token', 'oauth1', 'A person who approves the same App again gets the access token they already hold (X\'s tokens "do not expire"); a revoked one is replaced', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const fx = oauth1Fixtures(oauthCall(h));
+      const a = await fx.accessToken();
+      const b = await fx.accessToken();
+      await h({ m: 'POST', p: '/1.1/oauth/invalidate_token', h: { authorization: oauth1Header('POST', `${DEMO_ORIGIN}/1.1/oauth/invalidate_token`, OAUTH1_PROBE_APP, a) } });
+      const c = await fx.accessToken();
+      return a.key !== '' && a.key === b.key && a.secret === b.secret && c.key !== a.key && c.key !== '';
+    })),
+  done('xidentity.oauth1.unknown_consumer_refused', 'oauth1', 'A consumer key X does not hold is 401 with code 32 "Could not authenticate you." and issues nothing', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const r = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, { key: 'UnknownConsumer', secret: OAUTH1_PROBE_APP.secret }, null, { oauth_callback: OAUTH1_PROBE_CALLBACK }) } });
+      const none = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK }), h: FORM_H });
+      return r.status === 401 && v1Code(r) === 32 && body(r).errors[0].message === 'Could not authenticate you.'
+        && none.status === 400 && v1Code(none) === 215;
+    })),
+  done('xidentity.oauth1.bad_signature_refused', 'oauth1', 'A signature made with the wrong consumer secret, the wrong token secret, or over different parameters is refused at every leg and at /2/users/me', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const wrongApp = { key: OAUTH1_PROBE_APP.key, secret: 'wrong-consumer-secret' };
+      const leg1 = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: OAUTH1_PROBE_CALLBACK }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, wrongApp, null, { oauth_callback: OAUTH1_PROBE_CALLBACK }) } });
+      // the body says one callback, the signature covered another
+      const tampered = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: 'https://evil.local/cb' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: OAUTH1_PROBE_CALLBACK }) } });
+      const fx = oauth1Fixtures(oauthCall(h));
+      const t = await fx.approved();
+      const leg3 = await h({ m: 'POST', p: '/oauth/access_token', b: form({ oauth_verifier: t.verifier }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/access_token`, OAUTH1_PROBE_APP, { key: t.key, secret: 'wrong' }, { oauth_verifier: t.verifier }) } });
+      const at = await fx.accessToken();
+      const me = (secret: string, url = `${DEMO_ORIGIN}/2/users/me`) => h({ m: 'GET', p: '/2/users/me', h: { authorization: oauth1Header('GET', url, OAUTH1_PROBE_APP, { key: at.key, secret }) } });
+      const good = await me(at.secret);
+      const badToken = await me('wrong');
+      const otherUrl = await me(at.secret, `${DEMO_ORIGIN}/2/users/me/other`);
+      // a query realm is an ordinary parameter (only the header's is unsigned), and a repeated key is refused
+      const signedPlain = oauth1Header('GET', `${DEMO_ORIGIN}/2/users/me?user.fields=username`, OAUTH1_PROBE_APP, at);
+      const realmInjected = await h({ m: 'GET', p: '/2/users/me?user.fields=username&realm=injected', h: { authorization: signedPlain } });
+      // even signed over it: X accepts no duplicate keys
+      const dup = '/2/users/me?user.fields=username&user.fields=username';
+      const repeated = await h({ m: 'GET', p: dup, h: { authorization: oauth1Header('GET', `${DEMO_ORIGIN}${dup}`, OAUTH1_PROBE_APP, at) } });
+      const plain = await h({ m: 'GET', p: '/2/users/me?user.fields=username', h: { authorization: signedPlain } });
+      return leg1.status === 401 && v1Code(leg1) === 32 && tampered.status === 401 && v1Code(tampered) === 32
+        && leg3.status === 401 && v1Code(leg3) === 32 && good.status === 200 && plain.status === 200
+        && badToken.status === 401 && body(badToken).type === 'about:blank' && otherUrl.status === 401
+        && realmInjected.status === 401 && repeated.status === 401;
+    })),
+  done('xidentity.oauth1.callback_not_approved', 'oauth1', 'A callback the App\'s settings do not list is refused with code 415 "Callback URL not approved for this client application."', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const cb = 'https://probe-app.local/x/callback/';
+      const r = await h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: cb }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, OAUTH1_PROBE_APP, null, { oauth_callback: cb }) } });
+      return r.status === 403 && v1Code(r) === 415 && body(r).errors[0].message === 'Callback URL not approved for this client application.';
+    })),
+  done('xidentity.oauth1.invalid_request_token_page', 'oauth1', 'An authorize link whose request token X does not hold (unknown or already used) shows the invalid-token page, not a screen', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const fx = oauth1Fixtures(oauthCall(h));
+      const t = await fx.approved();
+      const used = await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(t.key)}` });
+      const unknown = await h({ m: 'GET', p: '/oauth/authorize?oauth_token=NotARequestToken' });
+      return used.status === 400 && html(used).includes('The request token for this page is invalid') && !html(used).includes('Authorize app')
+        && unknown.status === 400 && html(unknown).includes('The request token for this page is invalid');
+    })),
+  done('xidentity.oauth1.invalidate_token', 'oauth1', 'POST 1.1/oauth/invalidate_token answers {"access_token": …} and the token is then refused (401) at /2/users/me and again at invalidate (code 89)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await oauth1App(h);
+      const at = await oauth1Fixtures(oauthCall(h)).accessToken();
+      const inv = () => h({ m: 'POST', p: '/1.1/oauth/invalidate_token', h: { authorization: oauth1Header('POST', `${DEMO_ORIGIN}/1.1/oauth/invalidate_token`, OAUTH1_PROBE_APP, at) } });
+      const before = await h({ m: 'GET', p: '/2/users/me', h: { authorization: oauth1Header('GET', `${DEMO_ORIGIN}/2/users/me`, OAUTH1_PROBE_APP, at) } });
+      const r = await inv();
+      const after = await h({ m: 'GET', p: '/2/users/me', h: { authorization: oauth1Header('GET', `${DEMO_ORIGIN}/2/users/me`, OAUTH1_PROBE_APP, at) } });
+      const again = await inv();
+      return before.status === 200 && r.status === 200 && body(r).access_token === at.key && after.status === 401 && again.status === 401 && v1Code(again) === 89;
+    })),
+  done('xidentity.oauth1.world_app', 'oauth1', 'The World\'s own App (X_API_KEY / X_API_SECRET the World sets) signs request_token and is named on the screen for the World; the same values from the caller\'s shell alone are no App', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const names = ['X_API_KEY', 'X_API_SECRET', 'VOLTER_WORLD_ENV_NAMES', 'VOLTER_WORLD_NAME'];
+      const saved = Object.fromEntries(names.map((n) => [n, process.env[n]]));
+      const app = { key: 'WorldConsumerKey000000001', secret: 'WorldConsumerSecret0000000000000000000000000001' };
+      const ask = () => h({ m: 'POST', p: '/oauth/request_token', b: form({ oauth_callback: 'https://postiz.local/integrations/social/x' }), h: { ...FORM_H, authorization: oauth1Header('POST', `${DEMO_ORIGIN}/oauth/request_token`, app, null, { oauth_callback: 'https://postiz.local/integrations/social/x' }) } });
+      try {
+        Object.assign(process.env, { X_API_KEY: app.key, X_API_SECRET: app.secret, VOLTER_WORLD_NAME: 'acme' });
+        delete process.env.VOLTER_WORLD_ENV_NAMES;
+        const shellOnly = await ask();
+        if (shellOnly.status !== 401 || v1Code(shellOnly) !== 32) return false;
+        process.env.VOLTER_WORLD_ENV_NAMES = JSON.stringify(['X_API_KEY', 'X_API_SECRET']);
+        const r = await ask();
+        const token = new URLSearchParams(String(r.body)).get('oauth_token') ?? '';
+        const screen = html(await h({ m: 'GET', p: `/oauth/authorize?oauth_token=${encodeURIComponent(token)}` }));
+        return r.status === 200 && screen.includes('<strong class="app-name">acme</strong>');
+      } finally {
+        for (const [n, v] of Object.entries(saved)) { if (v === undefined) delete process.env[n]; else process.env[n] = v; }
+      }
+    })),
+  todo('xidentity.oauth1.sign_in_with_x_setting', 'oauth1', 'The App\'s "Use Sign in with X" setting, which oauth/authenticate\'s skip depends on (the twin treats every App as having it on)', 'api', 'niche'),
+  todo('xidentity.oauth1.reauthorize_token_reuse_pin', 'oauth1', 'PIN that re-authorizing an App returns the access token it already holds (the twin reads it from the docs\' "do not expire" and invalidate_token sentences)', 'api', 'niche'),
+  todo('xidentity.oauth1.timestamp_window', 'oauth1', 'Refuse an oauth_timestamp outside X\'s window (code 135) — needs the app\'s clock and the World\'s to be one', 'api', 'niche'),
+  todo('xidentity.oauth1.nonce_replay', 'oauth1', 'Refuse a repeated oauth_nonce within the timestamp window', 'api', 'niche'),
+  todo('xidentity.oauth1.request_token_ttl', 'oauth1', 'Expire an unused request token (X\'s lifetime is undocumented)', 'api', 'niche'),
+  todo('xidentity.oauth1.login_screen', 'oauth1', 'force_login / screen_name: the x.com login step before the screen (the twin authenticates nobody; the session is the seeded persona)', 'ui', 'niche'),
+  todo('xidentity.oauth1.dm_access_level', 'oauth1', 'The "Read, write, and Direct Messages" App permission and x_auth_access_type\'s interaction with it', 'api', 'niche'),
+  todo('xidentity.oauth1.consent_wording', 'oauth1', 'PIN the OAuth 1.0a screen\'s live lines and the PIN page (the twin shows the widely-screenshotted wording)', 'ui', 'niche'),
+  todo('xidentity.oauth1.callback_refusal_status', 'oauth1', 'PIN the HTTP status of the 415 callback refusal (the docs show the body; the twin answers 403)', 'api', 'niche'),
+  todo('xidentity.oauth1.request_token_error_wording', 'oauth1', 'PIN the live answer to a request_token without oauth_callback (the twin answers 400 code 215)', 'api', 'niche'),
+  todo('xidentity.oauth1.access_token_error_wording', 'oauth1', 'PIN the live answers at access_token for a wrong verifier (the twin answers the widely-reported plain-text 401)', 'api', 'niche'),
+  todo('xidentity.oauth1.access_type_unknown_value', 'oauth1', 'PIN what X does with an x_auth_access_type other than read/write (the twin ignores it)', 'api', 'niche'),
+  todo('xidentity.oauth1.invalid_token_page', 'oauth1', 'PIN the live page and status for an unknown or used request token (the twin serves the "Whoa there!" wording at 400)', 'ui', 'niche'),
+  todo('xidentity.oauth1.denied_callback', 'oauth1', 'PIN the live callback for Cancel (the twin sends denied=<request token>, as widely reported)', 'api', 'niche'),
+  todo('xidentity.oauth1.response_content_type', 'oauth1', 'PIN the content type X serves the form-encoded leg bodies with (the twin serves text/html)', 'api', 'niche'),
+  todo('xidentity.oauth1.verify_credentials', 'oauth1', 'GET 1.1/account/verify_credentials, the identity read the OAuth 1.0a guide names (v1.1 is not modelled)', 'api', 'niche'),
 ];
 
 export function xidentityCapabilities(): Promise<CapabilityReport> {