@volter/twin-xidentity 0.1.0

package/dist/client/xidentity-consent.css

@@ -0,0 +1,204 @@
+/* X authorize screen — the twin's rendering of x.com's OAuth consent page. Dark, single-column,
+   pill buttons: the visual grammar of the real page, sized for the journey filmstrip review. */
+
+:root {
+  color-scheme: dark;
+  --x-bg: #000000;
+  --x-card: #000000;
+  --x-text: #e7e9ea;
+  --x-muted: #71767b;
+  --x-border: #2f3336;
+  --x-primary: #eff3f4;
+  --x-primary-text: #0f1419;
+  --x-danger: #f4212e;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  background: var(--x-bg);
+  color: var(--x-text);
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+  display: flex;
+  justify-content: center;
+  padding: 32px 16px;
+}
+
+.card {
+  width: 100%;
+  max-width: 600px;
+  background: var(--x-card);
+  border: 1px solid var(--x-border);
+  border-radius: 16px;
+  padding: 32px 32px 24px;
+}
+
+.x-header {
+  display: flex;
+  justify-content: center;
+  margin-bottom: 16px;
+}
+
+.x-mark {
+  font-size: 32px;
+  line-height: 1;
+  color: var(--x-text);
+}
+
+.signed-in {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  border: 1px solid var(--x-border);
+  border-radius: 9999px;
+  padding: 8px 16px;
+  margin: 0 auto 20px;
+  width: fit-content;
+}
+
+.avatar {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 40px;
+  height: 40px;
+  border-radius: 50%;
+  background: #1d9bf0;
+  color: #fff;
+  font-weight: 700;
+  font-size: 18px;
+}
+
+.account-text {
+  display: flex;
+  flex-direction: column;
+}
+
+.account-name {
+  font-weight: 700;
+  font-size: 15px;
+}
+
+.account-username {
+  color: var(--x-muted);
+  font-size: 14px;
+}
+
+.title {
+  font-size: 23px;
+  font-weight: 800;
+  text-align: center;
+  margin: 0 0 24px;
+}
+
+.app-name {
+  font-weight: 800;
+}
+
+.scope-section {
+  margin-bottom: 20px;
+}
+
+.scope-heading {
+  font-size: 17px;
+  font-weight: 700;
+  margin: 0 0 8px;
+}
+
+.scope-list {
+  list-style: disc;
+  margin: 0;
+  padding-left: 24px;
+}
+
+.scope-row {
+  font-size: 15px;
+  color: var(--x-text);
+  margin-bottom: 6px;
+}
+
+.scope-tag {
+  margin-left: 8px;
+  font-size: 12px;
+  border: 1px solid var(--x-border);
+  border-radius: 4px;
+  padding: 1px 6px;
+  color: var(--x-muted);
+}
+
+.scope-tag-unknown {
+  color: var(--x-danger);
+  border-color: var(--x-danger);
+}
+
+.consent-form {
+  margin-top: 24px;
+}
+
+.actions {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.btn {
+  border-radius: 9999px;
+  font-size: 17px;
+  font-weight: 700;
+  padding: 12px 24px;
+  cursor: pointer;
+  border: 1px solid var(--x-border);
+  background: transparent;
+  color: var(--x-text);
+}
+
+.btn-primary {
+  background: var(--x-primary);
+  color: var(--x-primary-text);
+  border-color: var(--x-primary);
+}
+
+.btn-primary:hover {
+  background: #d7dbdc;
+}
+
+.btn-secondary:hover {
+  background: #16181c;
+}
+
+.legal {
+  margin-top: 20px;
+  color: var(--x-muted);
+  font-size: 13px;
+  line-height: 1.5;
+}
+
+.redirect-host {
+  color: var(--x-text);
+}
+
+.card-error .title {
+  margin-bottom: 12px;
+}
+
+.error-detail {
+  font-size: 15px;
+  text-align: center;
+  color: var(--x-text);
+}
+
+.error-code {
+  text-align: center;
+  color: var(--x-muted);
+  font-size: 14px;
+}
+
+.error-request {
+  text-align: center;
+  color: var(--x-muted);
+  font-size: 13px;
+  word-break: break-all;
+}

package/dist/client/xidentity-consent.d.ts

@@ -0,0 +1,53 @@
+export type ConsentAccount = {
+    id: string;
+    username: string;
+    name: string;
+    profileImageUrl: string;
+};
+export type ConsentScopeRow = {
+    scope: string;
+    label: string;
+    group: 'view' | 'do' | 'session';
+    known: boolean;
+};
+export type ConsentApp = {
+    clientId: string;
+    name: string;
+};
+export type ConsentView = {
+    requestId: string;
+    /** Where the twin is reachable — the form action posts back here. */
+    origin: string;
+    app: ConsentApp;
+    /** The x.com session this browser is signed in as — the account that will consent. */
+    account: ConsentAccount;
+    scopes: ConsentScopeRow[];
+    /** Host of the validated redirect_uri, shown in the "you'll be redirected to" notice. */
+    redirectHost: string;
+};
+/** The authorize screen — X's consent page for the app named by the pending auth request. */
+export declare function ConsentPage({ view }: {
+    view: ConsentView;
+}): import("react").JSX.Element;
+export type ErrorPageProps = {
+    status: number;
+    /** The OAuth error code the failure classifies as (e.g. `invalid_request`). */
+    code: string;
+    detail: string;
+    /** The offending parameter, echoed for the developer. */
+    requestParam?: string;
+};
+/**
+ * The authorize-endpoint error PAGE — what a browser sees when the twin cannot trust the
+ * redirect_uri (unknown client, unregistered callback) and therefore must not bounce the error
+ * back to it. X's live page for this case renders a terse "Something went wrong" card; its exact
+ * DOM was not captured, so this page states the failure plainly and machine-readably rather than
+ * imitating unverified vendor prose (`xidentity.authorize.error_page_fidelity`, todo).
+ */
+export declare function ErrorPage({ status, code, detail, requestParam }: ErrorPageProps): import("react").JSX.Element;
+/**
+ * The bundled browser entry. The screen is fully functional server-side; the bundle only marks the
+ * document as enhanced (a hook for future affordances) without re-rendering server markup, so the
+ * no-JavaScript path and the enhanced path agree by construction.
+ */
+export declare function hydrateConsentControls(): void;

package/dist/client/xidentity-consent.js

@@ -0,0 +1,57 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// X's AUTHORIZE SCREEN, as React — the vendor's own product UI, not a dashboard mirror.
+//
+// These components are the ONE renderer for the screen: the twin server-renders them with
+// `renderToStaticMarkup` to answer `GET /i/oauth2/authorize`, the capability verifies render the
+// SAME exported components over the SAME projection, and the Playwright journey drives the HTML
+// they emit. There is no second implementation to drift from.
+//
+// PROGRESSIVE ENHANCEMENT, DELIBERATELY: the decision is a plain `<form>` POST with two submit
+// buttons — X's real page is exactly two choices, "Authorize app" and "Cancel", with no per-scope
+// checkboxes — so no JavaScript is required to complete an OAuth round trip against this twin
+// (headless browsers, `curl`, and redirect-following libraries all work).
+//
+// LAYOUT PROVENANCE: the section headings ("Things App can view…" / "…do…"), the two buttons and
+// the redirect notice reproduce X's authorize page as widely screenshotted; the exact live DOM was
+// not captured from a vendor artefact, so visual fidelity is certified by the journey filmstrip
+// review, not asserted as a pin.
+import { StrictMode } from 'react';
+import { createRoot } from 'react-dom/client';
+/** The X mark, drawn rather than fetched — a twin never reaches out to a vendor CDN. */
+function XMark() {
+    return (_jsx("span", { className: "x-mark", "aria-hidden": "true", children: "\uD835\uDD4F" }));
+}
+function ScopeSection({ heading, rows }) {
+    if (rows.length === 0)
+        return null;
+    return (_jsxs("section", { className: "scope-section", children: [_jsx("h2", { className: "scope-heading", children: heading }), _jsx("ul", { className: "scope-list", children: rows.map((row) => (_jsxs("li", { className: "scope-row", children: [_jsx("span", { className: "scope-text", children: row.label }), row.known ? null : _jsx("span", { className: "scope-tag scope-tag-unknown", children: "not in the twin's scope catalog" })] }, row.scope))) })] }));
+}
+/** The authorize screen — X's consent page for the app named by the pending auth request. */
+export function ConsentPage({ view }) {
+    const appName = view.app.name;
+    return (_jsxs("div", { className: "card", children: [_jsx("header", { className: "x-header", children: _jsx(XMark, {}) }), _jsx("div", { className: "signed-in", children: _jsxs("span", { className: "account-text", children: [_jsx("span", { className: "account-name", children: view.account.name || view.account.username || view.account.id }), view.account.username ? _jsxs("span", { className: "account-username", children: ["@", view.account.username] }) : null] }) }), _jsxs("h1", { className: "title", children: [_jsx("strong", { className: "app-name", children: appName }), " wants to access your X account"] }), _jsx(ScopeSection, { heading: `Things ${appName} can view`, rows: view.scopes.filter((s) => s.group === 'view') }), _jsx(ScopeSection, { heading: `Things ${appName} can do`, rows: view.scopes.filter((s) => s.group === 'do') }), _jsx(ScopeSection, { heading: "Until you revoke access", rows: view.scopes.filter((s) => s.group === 'session') }), _jsxs("form", { method: "POST", action: `${view.origin}/_twin/consent`, className: "consent-form", children: [_jsx("input", { type: "hidden", name: "auth_request", value: view.requestId }), _jsxs("div", { className: "actions", children: [_jsx("button", { className: "btn btn-primary", type: "submit", name: "decision", value: "allow", children: "Authorize app" }), _jsx("button", { className: "btn btn-secondary", type: "submit", name: "decision", value: "deny", children: "Cancel" })] })] }), _jsxs("p", { className: "legal", children: ["You'll be redirected to ", _jsx("strong", { className: "redirect-host", children: view.redirectHost }), ". You can revoke access to any app at any time from the Apps and sessions section of your X settings."] })] }));
+}
+/**
+ * The authorize-endpoint error PAGE — what a browser sees when the twin cannot trust the
+ * redirect_uri (unknown client, unregistered callback) and therefore must not bounce the error
+ * back to it. X's live page for this case renders a terse "Something went wrong" card; its exact
+ * DOM was not captured, so this page states the failure plainly and machine-readably rather than
+ * imitating unverified vendor prose (`xidentity.authorize.error_page_fidelity`, todo).
+ */
+export function ErrorPage({ status, code, detail, requestParam }) {
+    return (_jsxs("div", { className: "card card-error", children: [_jsx("header", { className: "x-header", children: _jsx(XMark, {}) }), _jsx("h1", { className: "title", children: "Something went wrong" }), _jsxs("p", { className: "error-detail", children: ["You weren't able to give access to the App. ", detail] }), _jsxs("p", { className: "error-code", children: ["Error ", status, ": ", code] }), requestParam ? _jsxs("p", { className: "error-request", children: ["Request details: ", requestParam] }) : null] }));
+}
+/**
+ * The bundled browser entry. The screen is fully functional server-side; the bundle only marks the
+ * document as enhanced (a hook for future affordances) without re-rendering server markup, so the
+ * no-JavaScript path and the enhanced path agree by construction.
+ */
+export function hydrateConsentControls() {
+    const slot = document.getElementById('consent-enhanced');
+    if (!slot)
+        return;
+    createRoot(slot).render(_jsx(StrictMode, { children: null }));
+    document.documentElement.dataset['twinEnhanced'] = 'true';
+}
+if (typeof document !== 'undefined')
+    hydrateConsentControls();

package/dist/client/xidentity-consent.tsx

@@ -0,0 +1,162 @@
+// X's AUTHORIZE SCREEN, as React — the vendor's own product UI, not a dashboard mirror.
+//
+// These components are the ONE renderer for the screen: the twin server-renders them with
+// `renderToStaticMarkup` to answer `GET /i/oauth2/authorize`, the capability verifies render the
+// SAME exported components over the SAME projection, and the Playwright journey drives the HTML
+// they emit. There is no second implementation to drift from.
+//
+// PROGRESSIVE ENHANCEMENT, DELIBERATELY: the decision is a plain `<form>` POST with two submit
+// buttons — X's real page is exactly two choices, "Authorize app" and "Cancel", with no per-scope
+// checkboxes — so no JavaScript is required to complete an OAuth round trip against this twin
+// (headless browsers, `curl`, and redirect-following libraries all work).
+//
+// LAYOUT PROVENANCE: the section headings ("Things App can view…" / "…do…"), the two buttons and
+// the redirect notice reproduce X's authorize page as widely screenshotted; the exact live DOM was
+// not captured from a vendor artefact, so visual fidelity is certified by the journey filmstrip
+// review, not asserted as a pin.
+import { StrictMode } from 'react';
+import { createRoot } from 'react-dom/client';
+
+export type ConsentAccount = {
+  id: string;
+  username: string;
+  name: string;
+  profileImageUrl: string;
+};
+
+export type ConsentScopeRow = {
+  scope: string;
+  label: string;
+  group: 'view' | 'do' | 'session';
+  known: boolean;
+};
+
+export type ConsentApp = {
+  clientId: string;
+  name: string;
+};
+
+export type ConsentView = {
+  requestId: string;
+  /** Where the twin is reachable — the form action posts back here. */
+  origin: string;
+  app: ConsentApp;
+  /** The x.com session this browser is signed in as — the account that will consent. */
+  account: ConsentAccount;
+  scopes: ConsentScopeRow[];
+  /** Host of the validated redirect_uri, shown in the "you'll be redirected to" notice. */
+  redirectHost: string;
+};
+
+/** The X mark, drawn rather than fetched — a twin never reaches out to a vendor CDN. */
+function XMark() {
+  return (
+    <span className="x-mark" aria-hidden="true">
+      𝕏
+    </span>
+  );
+}
+
+function ScopeSection({ heading, rows }: { heading: string; rows: ConsentScopeRow[] }) {
+  if (rows.length === 0) return null;
+  return (
+    <section className="scope-section">
+      <h2 className="scope-heading">{heading}</h2>
+      <ul className="scope-list">
+        {rows.map((row) => (
+          <li key={row.scope} className="scope-row">
+            <span className="scope-text">{row.label}</span>
+            {row.known ? null : <span className="scope-tag scope-tag-unknown">not in the twin&apos;s scope catalog</span>}
+          </li>
+        ))}
+      </ul>
+    </section>
+  );
+}
+
+/** The authorize screen — X's consent page for the app named by the pending auth request. */
+export function ConsentPage({ view }: { view: ConsentView }) {
+  const appName = view.app.name;
+  return (
+    <div className="card">
+      <header className="x-header">
+        <XMark />
+      </header>
+      <div className="signed-in">
+        <span className="account-text">
+          {/* A partially-pulled persona may lack a display name or handle; the fallback shows the
+              REAL id rather than an empty pill or a bare "@" (never an invented placeholder). */}
+          <span className="account-name">{view.account.name || view.account.username || view.account.id}</span>
+          {view.account.username ? <span className="account-username">@{view.account.username}</span> : null}
+        </span>
+      </div>
+      <h1 className="title">
+        <strong className="app-name">{appName}</strong> wants to access your X account
+      </h1>
+      <ScopeSection heading={`Things ${appName} can view`} rows={view.scopes.filter((s) => s.group === 'view')} />
+      <ScopeSection heading={`Things ${appName} can do`} rows={view.scopes.filter((s) => s.group === 'do')} />
+      <ScopeSection heading="Until you revoke access" rows={view.scopes.filter((s) => s.group === 'session')} />
+      <form method="POST" action={`${view.origin}/_twin/consent`} className="consent-form">
+        <input type="hidden" name="auth_request" value={view.requestId} />
+        <div className="actions">
+          <button className="btn btn-primary" type="submit" name="decision" value="allow">
+            Authorize app
+          </button>
+          <button className="btn btn-secondary" type="submit" name="decision" value="deny">
+            Cancel
+          </button>
+        </div>
+      </form>
+      <p className="legal">
+        You&apos;ll be redirected to <strong className="redirect-host">{view.redirectHost}</strong>. You can revoke
+        access to any app at any time from the Apps and sessions section of your X settings.
+      </p>
+    </div>
+  );
+}
+
+export type ErrorPageProps = {
+  status: number;
+  /** The OAuth error code the failure classifies as (e.g. `invalid_request`). */
+  code: string;
+  detail: string;
+  /** The offending parameter, echoed for the developer. */
+  requestParam?: string;
+};
+
+/**
+ * The authorize-endpoint error PAGE — what a browser sees when the twin cannot trust the
+ * redirect_uri (unknown client, unregistered callback) and therefore must not bounce the error
+ * back to it. X's live page for this case renders a terse "Something went wrong" card; its exact
+ * DOM was not captured, so this page states the failure plainly and machine-readably rather than
+ * imitating unverified vendor prose (`xidentity.authorize.error_page_fidelity`, todo).
+ */
+export function ErrorPage({ status, code, detail, requestParam }: ErrorPageProps) {
+  return (
+    <div className="card card-error">
+      <header className="x-header">
+        <XMark />
+      </header>
+      <h1 className="title">Something went wrong</h1>
+      <p className="error-detail">You weren&apos;t able to give access to the App. {detail}</p>
+      <p className="error-code">
+        Error {status}: {code}
+      </p>
+      {requestParam ? <p className="error-request">Request details: {requestParam}</p> : null}
+    </div>
+  );
+}
+
+/**
+ * The bundled browser entry. The screen is fully functional server-side; the bundle only marks the
+ * document as enhanced (a hook for future affordances) without re-rendering server markup, so the
+ * no-JavaScript path and the enhanced path agree by construction.
+ */
+export function hydrateConsentControls(): void {
+  const slot = document.getElementById('consent-enhanced');
+  if (!slot) return;
+  createRoot(slot).render(<StrictMode>{null}</StrictMode>);
+  document.documentElement.dataset['twinEnhanced'] = 'true';
+}
+
+if (typeof document !== 'undefined') hydrateConsentControls();

package/dist/src/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/src/cli.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { keepProcessAlive } from '@volter/world-core/lifecycle';
+// world-xidentity CLI: serve the X identity twin, or run conformance.
+//
+// `serve` and `mirror` start the SAME server, because the authorize screen is served by the twin
+// at the vendor's own path — there is no second renderer to start. `mirror` additionally prints a
+// ready-to-open authorization URL, which is the thing an operator actually wants when they ask to
+// "see the UI".
+import { hasFlag, optionValue } from '@volter/world-core/args';
+import { createXIdentityTwinServer } from "./xidentity-server.js";
+import { pkceS256 } from "./xidentity-pkce.js";
+import { DEFAULT_CLIENT_ID, defaultRedirectUris } from "./xidentity-store.js";
+const [cmd, ...rest] = process.argv.slice(2);
+const port = Number(optionValue(rest, '--port', '0')) || undefined;
+const root = optionValue(rest, '--root') || undefined;
+const readOnly = hasFlag(rest, '--read-only'); // a twin accepts writes unless started read-only
+if (cmd === 'serve' || cmd === 'mirror') {
+    const s = await createXIdentityTwinServer({ readOnly, ...(root ? { root } : {}), ...(port ? { port } : {}) });
+    const origin = `http://127.0.0.1:${s.port}`;
+    process.stdout.write(`xidentity twin (X OAuth 2.0 + /2/users/me)${readOnly ? ' [read-only]' : ''} at ${origin}\n`);
+    if (cmd === 'mirror') {
+        const url = new URL(`${origin}/i/oauth2/authorize`);
+        url.searchParams.set('response_type', 'code');
+        url.searchParams.set('client_id', DEFAULT_CLIENT_ID);
+        url.searchParams.set('redirect_uri', defaultRedirectUris(origin)[0]);
+        url.searchParams.set('scope', 'tweet.read users.read offline.access');
+        url.searchParams.set('state', 'twin-demo-state');
+        url.searchParams.set('code_challenge', pkceS256('twin-demo-verifier'));
+        url.searchParams.set('code_challenge_method', 'S256');
+        process.stdout.write(`authorize screen: ${url.toString()}\n`);
+    }
+    await keepProcessAlive();
+}
+else if (cmd === 'conformance') {
+    // dev-only; lazy so the bin runs without @volter/world-tooling in the runtime graph
+    const { checkXIdentityConformance } = await import("./xidentity-conformance.js");
+    const report = await checkXIdentityConformance({ ...(root ? { root } : {}) });
+    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    if (!report.ok)
+        process.exitCode = 1;
+}
+else {
+    process.stdout.write('Usage: world-xidentity serve|mirror|conformance [--port N] [--root DIR] [--read-only]\n');
+}

package/dist/src/index.d.ts

@@ -0,0 +1,15 @@
+export { ACCESS_TOKEN_TTL_SECONDS, API_ORIGIN, AUTH_CODE_TTL_SECONDS, AUTHORIZE_ORIGIN, handleXIdentityTwinRequest, LEGACY_API_ORIGIN, LEGACY_AUTHORIZE_ORIGIN, RATE_WINDOW_SECONDS, RESOURCE_TYPES, USER_EXPANSIONS, USER_FIELDS, USERS_ME_RATE_LIMIT, USERS_ME_REQUIRED_SCOPES, xIdentityTwinSnapshot, } from './xidentity-twin.js';
+export type { XIdentityRequest, XIdentityResponse, XResponse } from './xidentity-twin.js';
+export { createXIdentityConsentServer, createXIdentityTwinFetch, createXIdentityTwinServer, type XIdentityTwinFetchOptions } from './xidentity-server.js';
+export { DEFAULT_ACCOUNTS, DEFAULT_CLIENT_ID, DEFAULT_CLIENT_SECRET, DEFAULT_PUBLIC_CLIENT_ID, defaultRedirectUris, redirectUriAllowed, sessionAccount, } from './xidentity-store.js';
+export { normalizeChallengeMethod, pkceS256, pkceVerifies } from './xidentity-pkce.js';
+export { describeScope, describeScopes, formatScopeParam, KNOWN_SCOPES, parseScopeParam, SCOPE_CATALOG, sortScopesForConsent, } from './xidentity-scopes.js';
+export type { ScopeInfo } from './xidentity-scopes.js';
+export { liveXIdentityExecute, mapUsersMeAccount, PULL_USER_FIELDS, pullXIdentity, pushPendingXIdentityActions, syncXIdentityFromReal, } from './xidentity-connector.js';
+export type { LiveXIdentityOptions, XIdentityExecute } from './xidentity-connector.js';
+export { XIDENTITY_BUDGET_CEILING, XIDENTITY_BUDGET_MAX_RETRY_AFTER_S, XIDENTITY_BUDGET_WINDOW_MS, XIDENTITY_CALL_WEIGHTS, XIDENTITY_RATE_BUDGET, XIdentityBudget, XIdentityBudgetError, xIdentityBudgetPath, xIdentityCallWeight, } from './xidentity-budget.js';
+export type { XIdentityBudgetErrorKind, XIdentityBudgetOptions, XIdentityBudgetReservation, XIdentityBudgetSnapshot, } from './xidentity-budget.js';
+export { consentPageHtml, CONSENT_SCRIPT_PATH, CONSENT_STYLE_PATH, errorPageHtml, xIdentityConsentState, } from './xidentity-consent-ui.js';
+export type { ConsentAccount, ConsentScopeRow, ConsentView, ErrorPageProps } from './xidentity-consent-ui.js';
+import type { TwinPack } from '@volter/world-core';
+export declare const pack: TwinPack;

package/dist/src/index.js

@@ -0,0 +1,105 @@
+// @volter/twin-xidentity — the X (Twitter) identity twin (one vendor, one package), built on the
+// shared @volter/world-core kernel.
+//
+// A BROWSER-FACING protocol pack (the googleoauth class): it serves X's own authorize screen as
+// HTML at x.com's real path, completes the full OAuth 2.0 authorization-code + PKCE round trip
+// (consent → 302 with code+state → redemption at the token endpoint → refresh → revoke), and
+// answers GET /2/users/me with X's real field/expansion/problem envelopes. Deliberately NON-OIDC,
+// exactly as the vendor is: opaque tokens, no id_token, no JWKS — identity comes from the API.
+// Conformance tooling lives in @volter/world-tooling (a dev dependency) — not shipped here.
+export { ACCESS_TOKEN_TTL_SECONDS, API_ORIGIN, AUTH_CODE_TTL_SECONDS, AUTHORIZE_ORIGIN, handleXIdentityTwinRequest, LEGACY_API_ORIGIN, LEGACY_AUTHORIZE_ORIGIN, RATE_WINDOW_SECONDS, RESOURCE_TYPES, USER_EXPANSIONS, USER_FIELDS, USERS_ME_RATE_LIMIT, USERS_ME_REQUIRED_SCOPES, xIdentityTwinSnapshot, } from "./xidentity-twin.js";
+export { createXIdentityConsentServer, createXIdentityTwinFetch, createXIdentityTwinServer } from "./xidentity-server.js";
+export { DEFAULT_ACCOUNTS, DEFAULT_CLIENT_ID, DEFAULT_CLIENT_SECRET, DEFAULT_PUBLIC_CLIENT_ID, defaultRedirectUris, redirectUriAllowed, sessionAccount, } from "./xidentity-store.js";
+export { normalizeChallengeMethod, pkceS256, pkceVerifies } from "./xidentity-pkce.js";
+export { describeScope, describeScopes, formatScopeParam, KNOWN_SCOPES, parseScopeParam, SCOPE_CATALOG, sortScopesForConsent, } from "./xidentity-scopes.js";
+export { liveXIdentityExecute, mapUsersMeAccount, PULL_USER_FIELDS, pullXIdentity, pushPendingXIdentityActions, syncXIdentityFromReal, } from "./xidentity-connector.js";
+// The client-side rate budget — the fail-closed backstop `liveXIdentityExecute` routes every live
+// request through. The MECHANISM is the kernel's shared, vendor-agnostic `RateBudget`; what lives
+// here is this vendor's DECLARATION (window/ceiling/per-endpoint weights) plus the vendor-bound
+// bindings. Exported so an operator can inspect spend (`snapshot`) and so a caller can catch
+// `XIdentityBudgetError` by type; there is deliberately no export that disables the guard.
+export { XIDENTITY_BUDGET_CEILING, XIDENTITY_BUDGET_MAX_RETRY_AFTER_S, XIDENTITY_BUDGET_WINDOW_MS, XIDENTITY_CALL_WEIGHTS, XIDENTITY_RATE_BUDGET, XIdentityBudget, XIdentityBudgetError, xIdentityBudgetPath, xIdentityCallWeight, } from "./xidentity-budget.js";
+export { consentPageHtml, CONSENT_SCRIPT_PATH, CONSENT_STYLE_PATH, errorPageHtml, xIdentityConsentState, } from "./xidentity-consent-ui.js";
+import { XIDENTITY_RATE_BUDGET as RATE_BUDGET } from "./xidentity-budget.js";
+/**
+ * The x.com / twitter.com paths THIS pack serves — the consent leg — as a RegExp SOURCE for the
+ * descriptor's `hosts` path rule. x.com is NOT an API host: it is the whole X web property (the
+ * timeline, settings, everything). Claiming the host outright would be the Cal.com mis-route
+ * incident with the largest possible blast radius, so this claims EXACTLY the authorize path plus
+ * the twin-only prefix. ANCHORED, the googleoauth lesson: an unanchored claim swallows
+ * `/i/oauth2/authorize2` and friends. Transcribed unchanged from inject.cjs's former
+ * `isXIdentityConsentPath` predicate.
+ */
+const XIDENTITY_CONSENT_PATHS = '^/i/oauth2/authorize/?$|^/_twin/';
+/**
+ * The api.x.com / api.twitter.com paths THIS pack serves: the OAuth 2.0 token + revoke endpoints
+ * and the authenticated-user read. api.x.com is the ENTIRE X API v2 host — posts, DMs, spaces — and
+ * this pack models the identity slice only, so nothing else is claimed: an unmodelled X call must
+ * refuse loudly rather than land in a twin that cannot serve it. Transcribed unchanged from
+ * inject.cjs's former `isXIdentityApiPath` predicate.
+ */
+const XIDENTITY_API_PATHS = '^/2/(?:oauth2/(?:token|revoke)|users/me)/?$';
+export const pack = {
+    // STILL PROTOCOL 1, and the reason is the gate rather than the pack (ROADMAP.md,
+    // shape-parity-refusals: a refusal the harness cannot express). Everything else is ready: the connector
+    // is on the v2 kernel and `performXIdentityAction` / `syncXIdentityFromRemote` are written and
+    // exported below. What blocks the declaration is that `GET /2/users/me` needs an access token
+    // that only a completed OAuth flow mints, so the refresh REFUSES at the twin's own wire — which
+    // is correct (never fold an empty account over observed state) and which the parity harness
+    // turns into a crash rather than a reported diff.
+    vendor: 'xidentity',
+    // The SAME object xidentity-budget.ts declares at module load — one source of truth, so
+    // registering the pack and importing the connector can never arm two different ceilings.
+    rateBudget: RATE_BUDGET,
+    transport: 'rest',
+    archetype: 'crud',
+    bin: 'world-xidentity',
+    resources: ['oauth_client', 'account', 'session', 'auth_request', 'authorization_code', 'access_token', 'refresh_token', 'grant', 'rate_window'],
+    specSource: 'api.x.com/2/openapi.json (X API v2 OpenAPI 2.167: /2/users/me, the Problem family, the '
+        + '24-scope OAuth2UserToken catalog) + docs.x.com OAuth 2.0 authorization-code/user-access-token '
+        + 'guides + the official SDK sources (@xdevplatform/xdk, twitter-api-typescript-sdk), all '
+        + 'fetched 2026-08-21',
+    description: 'X (Twitter) identity twin — the real x.com authorize screen, the full OAuth 2.0 '
+        + 'authorization-code + PKCE round trip (token, refresh, revoke), and GET /2/users/me with '
+        + "X's real field/expansion/problem envelopes. Non-OIDC, exactly as the vendor is.",
+    // Adoption + interception, moved off the central maps unchanged (descriptor-first back-migration, adding-a-twin.md §3,
+    // 2026-08-31).
+    //
+    // BOTH official clients — the current XDK and the legacy (archived but still installed) SDK —
+    // plus X's own npm scope, where the current official XDK lives and any future first-party
+    // sibling will. `twitter-api-v2` is deliberately NOT claimed here: it is a third-party library
+    // spanning the whole X API and belongs to the POSTING pack (`x`), which models the surface it is
+    // installed for.
+    //
+    // The X_* / TWITTER_* stems stay on THIS pack now that a second X pack exists, deliberately:
+    // X_CLIENT_ID / X_CLIENT_SECRET and TWITTER_CLIENT_ID / TWITTER_BEARER_TOKEN name the OAuth APP
+    // credentials, which is this pack's surface. NB the single-letter `X` stem fires on ANY
+    // X_<credential-suffix> shape the BROAD suffix list admits (X_KEY, X_TOKEN, X_API_URL, …), not
+    // only the strict _CLIENT_ID/_CLIENT_SECRET pair — accepted deliberately: a var actually named
+    // bare `X_*` with a credential suffix is overwhelmingly the vendor, and a false hit surfaces as
+    // a visible coverage row rather than a silent drop.
+    adoption: {
+        // No Python distribution of its own: X's official SDKs are TypeScript, and the one community
+        // Python client of this API - `tweepy` - is claimed by the `x` pack (one name, one pack), whose
+        // posting surface is what tweepy is overwhelmingly used for.
+        pypi: [],
+        sdks: ['@xdevplatform/xdk', 'twitter-api-sdk'],
+        scopes: ['@xdevplatform/'],
+        envStems: ['X', 'TWITTER'],
+    },
+    // TWO host families — x.com/api.x.com plus the twitter.com pair X's LEGACY official SDK still
+    // targets — every one path-scoped, because x.com is the entire X web property and api.x.com the
+    // entire X API v2 host, of which this pack models the identity slice only. With no pathname each
+    // host is still claimed so the ambient proxy MITMs it; the post-decrypt resolve then routes the
+    // identity paths here and refuses the rest loudly (unclaimedTwinnedHostPathMessage) — the
+    // Cal.com mis-route lesson.
+    hosts: [
+        { host: 'x.com', pathPattern: XIDENTITY_CONSENT_PATHS },
+        { host: 'twitter.com', pathPattern: XIDENTITY_CONSENT_PATHS },
+        { host: 'api.x.com', pathPattern: XIDENTITY_API_PATHS },
+        { host: 'api.twitter.com', pathPattern: XIDENTITY_API_PATHS },
+    ],
+    // A browser is REDIRECTED to x.com/i/oauth2/authorize — the loader host is the consent host and
+    // the prefix is the OAuth path root.
+    browserRouting: { apiPathPrefix: '/i/oauth2/', loaderHost: 'https://x.com' },
+};