@volter/world-core 2.0.0 → 2.0.1

package/dist/src/storage.d.ts

@@ -7,8 +7,29 @@ import type { AppendEventResult, GenericWorldState, WorldPaths, WorldReducer, Wo
  */
 export declare function stateDirName(): string;
 export declare function worldStateRoot(root?: string): string;
-export declare function observeWorldPaths(observer: (service: string, root: string | undefined) => void): void;
+/** Install the observer; the one it replaces is returned (a test puts it back). */
+export declare function observeWorldPaths(observer: ((service: string, root: string | undefined) => void) | undefined): ((service: string, root: string | undefined) => void) | undefined;
+/** Run `fn` without its worldPaths calls reaching the identity observer. */
+export declare function withoutIdentityClaim<T>(fn: () => T): T;
 export declare function worldPaths(service: string, root?: string): WorldPaths;
+/**
+ * THE WORLD'S DATA DIRECTORY, as the World runtime hands it to every service it starts. Each twin of a World runs on
+ * its own root, `<data>/<service id>` (world-runtime's startService and startColocatedServices), so one twin's
+ * `.volter/world/<service>` is not another's; `ownerStoreRoots` finds a store across them.
+ */
+export declare const WORLD_DATA_ENV = "VOLTER_WORLD_DATA";
+/**
+ * The roots that hold the store of `owner` (ANOTHER pack's, read by contract: architecture A3), for a twin on `root`:
+ *   - `[root]` when `root` itself holds that store (both packs on one root: `volter world serve`, a test, a pack serving
+ *     several services on its root, as aws does);
+ *   - else, when `root` is one of a World's service roots (a directory directly under the World's data directory), every
+ *     other service root there that holds it (usually one; two when the World runs the owning pack twice);
+ *   - else `[]`: nothing is issued yet, or the twin runs outside a World.
+ * Only a declared cross-pack read resolves through here (`projectOwnerResources`); a pack's reads of its OWN store never
+ * leave its root, so a fresh twin never reads a sibling that happens to run the same pack. Not memoized: it is a few
+ * stats per service root, and a store that appears after the first read (the owner's first write) must be found.
+ */
+export declare function ownerStoreRoots(owner: string, root?: string): string[];
 /** Read + parse a whole-file JSON sidecar, citing the path on a parse failure (mirrors
  *  readJsonl's `${path}:...` error shape). Callers own existence semantics — this parses a
  *  file that is expected to exist; guard with existsSync first when absence is allowed. */

package/dist/src/storage.js

@@ -40,12 +40,29 @@ function assertServiceName(service) {
  * Nothing else may use this: it is a one-slot observability hook, never a control seam.
  */
 let worldPathsObserver;
+/** Install the observer; the one it replaces is returned (a test puts it back). */
 export function observeWorldPaths(observer) {
+    const previous = worldPathsObserver;
     worldPathsObserver = observer;
+    return previous;
+}
+/** While > 0, a read of ANOTHER pack's store is in progress (`projectOwnerResources`): that is not the request's twin
+ *  saying who it is, so it claims no journal identity. */
+let identityQuiet = 0;
+/** Run `fn` without its worldPaths calls reaching the identity observer. */
+export function withoutIdentityClaim(fn) {
+    identityQuiet++;
+    try {
+        return fn();
+    }
+    finally {
+        identityQuiet--;
+    }
 }
 export function worldPaths(service, root) {
     const safeService = assertServiceName(service);
-    worldPathsObserver?.(safeService, root);
+    if (identityQuiet === 0)
+        worldPathsObserver?.(safeService, root);
     const resolvedRoot = projectRoot(root);
     const dir = join(worldStateRoot(root), safeService);
     return {
@@ -60,6 +77,43 @@ export function worldPaths(service, root) {
         eventQueue: join(dir, 'event-queue.jsonl'),
     };
 }
+/**
+ * THE WORLD'S DATA DIRECTORY, as the World runtime hands it to every service it starts. Each twin of a World runs on
+ * its own root, `<data>/<service id>` (world-runtime's startService and startColocatedServices), so one twin's
+ * `.volter/world/<service>` is not another's; `ownerStoreRoots` finds a store across them.
+ */
+export const WORLD_DATA_ENV = 'VOLTER_WORLD_DATA';
+/** Does `root` hold `service`'s store: its log or its branch record (what a write or a fork leaves; a read leaves
+ *  neither)? The paths are built without worldPaths, so a probe claims no journal identity. */
+function holdsStore(service, root) {
+    const dir = join(worldStateRoot(root), service);
+    const store = getActiveWorldStore();
+    return ['events.jsonl', 'actions.jsonl', 'branch.json'].some((file) => store.exists(join(dir, file)));
+}
+/**
+ * The roots that hold the store of `owner` (ANOTHER pack's, read by contract: architecture A3), for a twin on `root`:
+ *   - `[root]` when `root` itself holds that store (both packs on one root: `volter world serve`, a test, a pack serving
+ *     several services on its root, as aws does);
+ *   - else, when `root` is one of a World's service roots (a directory directly under the World's data directory), every
+ *     other service root there that holds it (usually one; two when the World runs the owning pack twice);
+ *   - else `[]`: nothing is issued yet, or the twin runs outside a World.
+ * Only a declared cross-pack read resolves through here (`projectOwnerResources`); a pack's reads of its OWN store never
+ * leave its root, so a fresh twin never reads a sibling that happens to run the same pack. Not memoized: it is a few
+ * stats per service root, and a store that appears after the first read (the owner's first write) must be found.
+ */
+export function ownerStoreRoots(owner, root) {
+    const safeOwner = assertServiceName(owner);
+    const own = projectRoot(root);
+    if (holdsStore(safeOwner, own))
+        return [own];
+    const data = typeof process === 'undefined' ? undefined : process.env[WORLD_DATA_ENV];
+    if (!data || dirname(own) !== resolve(data))
+        return [];
+    return getActiveWorldStore().list(dirname(own))
+        .map((name) => join(dirname(own), name))
+        .filter((candidate) => candidate !== own && holdsStore(safeOwner, candidate))
+        .sort();
+}
 function readJsonl(path) {
     const rows = [];
     for (const [index, line] of getActiveWorldStore().readLines(path).entries()) {

package/dist/src/world-clock.d.ts

@@ -1,4 +1,4 @@
 export declare const WORLD_CLOCK_ENV = "TWIN_WORLD_CLOCK_FILE";
-/** The world's "now": the frozen instant in the clock file when one is configured and
- *  parseable; real wall-clock time otherwise. */
+/** The world's "now": the clock file's time when one is configured (its frozen instant, or a running clock's time
+ *  now); real wall-clock time otherwise. */
 export declare function worldNow(): string;

package/dist/src/world-clock.js

@@ -6,27 +6,28 @@
 // is the operator door (set / advance / show). No file, or no env → real wall-clock time,
 // exactly the pre-clock behavior; a world only has scripted time when its operator says so.
 //
-// File format: a single ISO-8601 line (a FROZEN instant). Every read returns exactly that
-// instant — deterministic by construction. Advancing time is an explicit operator act, never
-// a background drift.
-// Read through the ACTIVE WorldStore, not node:fs: the clock file is world state, and a
-// hydrated serverless namespace must carry its frozen instant with it (runtime contract R11–R14
-// — a MemoryWorldStore world that read the clock off the host filesystem would silently
-// serve the HOST's time, the exact two-services-disagreeing-about-now defect below).
+// File format (world-clock.cjs, the one home of it, shared with the injector that gives an application process the
+// same time): a FROZEN instant, one ISO-8601 line, every read returning exactly that instant; or a RUNNING clock,
+// `<instant> from <wall instant>`, the World's time at a moment of the machine's, running on at the machine's pace (a
+// World serving an application). Moving time is an explicit operator act either way, never a background drift.
 import { getActiveWorldStore } from "./world-store.js";
+import clockForm from '../world-clock.cjs';
 export const WORLD_CLOCK_ENV = 'TWIN_WORLD_CLOCK_FILE';
-/** The world's "now": the frozen instant in the clock file when one is configured and
- *  parseable; real wall-clock time otherwise. */
+/** The machine's own time: the real Date.now even where the injector gives the process the World's time (inject.cjs
+ *  leaves the original under this symbol), so a running clock's offset is applied once. */
+const machineNow = () => {
+    const real = globalThis[Symbol.for('volter.machineDateNow')];
+    return typeof real === 'function' ? real() : Date.now();
+};
+/** The world's "now": the clock file's time when one is configured (its frozen instant, or a running clock's time
+ *  now); real wall-clock time otherwise. */
 export function worldNow() {
     const file = process.env[WORLD_CLOCK_ENV];
     if (file && getActiveWorldStore().exists(file)) {
-        const raw = (getActiveWorldStore().read(file) ?? '').trim();
-        const parsed = Date.parse(raw);
-        if (!Number.isNaN(parsed))
-            return new Date(parsed).toISOString();
-        // A configured-but-corrupt clock is a WORLD defect — fail loudly, never silently drift
-        // back to wall-clock (two services disagreeing about now breaks the world).
-        throw new Error(`world clock: ${file} does not contain a parseable ISO-8601 instant (got ${JSON.stringify(raw.slice(0, 40))})`);
+        // A configured-but-corrupt clock is a WORLD defect — parseClock fails loudly, never silently drifting back to
+        // wall-clock (two services disagreeing about now breaks the world).
+        const clock = clockForm.parseClock(getActiveWorldStore().read(file) ?? '');
+        return new Date(clockForm.clockNowMs(clock, machineNow())).toISOString();
     }
-    return new Date().toISOString();
+    return new Date(machineNow()).toISOString();
 }

package/dist/vendor-hosts.cjs

@@ -22,7 +22,7 @@
 //
 // THE SHARED-HOST RULE (Cal.com incident, 2026-08): a shared-host predicate must claim ONLY the
 // paths its twin actually serves — never "the rest of the host". Claiming the remainder is how
-// every `@googleapis/calendar` call (37 methods, all defaulting to www.googleapis.com) was routed
+// every `@googleapis/calendar` call (all of its methods default to www.googleapis.com) was routed
 // into the googleauth/gemini twin and answered with a plausible Google-shaped 404: a mis-route
 // that fails OPEN and PLAUSIBLE, strictly worse than a coverage gap. An UNCLAIMED path on a
 // claimed host is refused LOUDLY instead (see unclaimedTwinnedHostPathMessage below): the error
@@ -32,7 +32,7 @@
  * Exactly the routes gemini-twin.ts §googleauth models: `POST /token` (the oauth2.googleapis.com
  * path, also answered on the legacy host) and `POST /oauth2/v4/token` (the legacy
  * www.googleapis.com token path older google-auth-library versions default to). NOTHING else:
- * /calendar/v3/*, /drive/v3/*, … are other Google products with no twin in this repo, and
+ * /calendar/v3/* (the googlecalendar pack's), /drive/v3/*, … are other Google products, and
  * claiming them would mis-route those SDKs into an auth twin that answers with vendor-shaped
  * 404s (the Cal.com incident).
  */

package/dist/world-clock.cjs

@@ -0,0 +1,40 @@
+'use strict';
+// THE WORLD CLOCK'S FORM — the one home of how a clock file reads (dependency-free, side-effect free), shared by the
+// twins' worldNow() (src/world-clock.ts, reading through the active WorldStore) and the injector, which gives an
+// application process the same time (inject.cjs, WORLD TIME).
+//
+// A clock file holds one line in one of two forms:
+//   · FROZEN:  `<ISO-8601 instant>` — every read answers exactly that instant (scripted time: lives, seeds, a story);
+//   · RUNNING: `<ISO-8601 instant> from <ISO-8601 wall instant>` — the World's time was <instant> when the machine's was
+//     <wall instant>, and runs on at the machine's pace from there: a World serving an application moves time this way
+//     (`volter-world clock <world> shift <N s|m|h|d>`), since a frozen instant would stop the application's time.
+// No file: the machine's time.
+
+/** The clock a file's text states, or throws on text that states neither form. */
+function parseClock(raw) {
+  const text = String(raw ?? '').trim();
+  const m = /^(\S+)\s+from\s+(\S+)$/.exec(text);
+  if (m) {
+    const at = Date.parse(m[1]);
+    const since = Date.parse(m[2]);
+    if (!Number.isNaN(at) && !Number.isNaN(since)) return { kind: 'running', at, since };
+  } else {
+    const at = Date.parse(text);
+    if (!Number.isNaN(at)) return { kind: 'frozen', at };
+  }
+  throw new Error(`world clock: expected an ISO-8601 instant, or "<instant> from <instant>", got ${JSON.stringify(text.slice(0, 60))}`);
+}
+
+/** The World's time in ms for a parsed clock, at the machine's time `wallMs`. */
+function clockNowMs(clock, wallMs) {
+  return clock.kind === 'running' ? clock.at + (wallMs - clock.since) : clock.at;
+}
+
+/** A clock's text: frozen at `atMs`, or running from `atMs` as of the machine's `sinceMs`. */
+function formatClock(clock) {
+  return clock.kind === 'running'
+    ? `${new Date(clock.at).toISOString()} from ${new Date(clock.since).toISOString()}`
+    : new Date(clock.at).toISOString();
+}
+
+module.exports = { parseClock, clockNowMs, formatClock };

package/dist/world-clock.d.cts

@@ -0,0 +1,4 @@
+export type WorldClock = { kind: 'frozen'; at: number } | { kind: 'running'; at: number; since: number };
+export function parseClock(raw: string | null | undefined): WorldClock;
+export function clockNowMs(clock: WorldClock, wallMs: number): number;
+export function formatClock(clock: WorldClock): string;

package/generated/pack-facts.json

@@ -714,6 +714,9 @@
       "hosts": [
         {
           "host": "api.cohere.com"
+        },
+        {
+          "host": "api.cohere.ai"
         }
       ],
       "archetype": "generative",
@@ -728,7 +731,7 @@
         "embed_job",
         "token"
       ],
-      "endpointEnvNone": "neither official SDK reads a base-URL env var: cohere-ai@8.1.0 takes the override as the `baseUrl`/`environment` CONSTRUCTOR option and reads only CO_API_KEY from the environment (auth/BearerAuthProvider.js), and @ai-sdk/cohere@4.0.35 takes `options.baseURL` and reads only COHERE_API_KEY. Interception is host-based on api.cohere.com; inventing a COHERE_BASE_URL nothing reads would make `covers` claim a world it does not cover.",
+      "endpointEnvNone": "neither official SDK reads a base-URL env var: cohere-ai@8.1.0 takes the override as the `baseUrl`/`environment` CONSTRUCTOR option and reads only CO_API_KEY from the environment (auth/BearerAuthProvider.js), and @ai-sdk/cohere@4.0.35 takes `options.baseURL` and reads only COHERE_API_KEY. Interception is host-based on api.cohere.com and api.cohere.ai; inventing a COHERE_BASE_URL nothing reads would make `covers` claim a world it does not cover.",
       "serveExport": "createCohereTwinServer"
     },
     "currencyapi": {
@@ -963,6 +966,10 @@
           "host": "discord.com",
           "pathPattern": "^/api/"
         },
+        {
+          "host": "discord.com",
+          "pathPattern": "^/(oauth2/authorize|login)/?$"
+        },
         {
           "host": "gateway.discord.gg"
         },
@@ -1399,6 +1406,10 @@
           "host": "github.com",
           "pathPattern": "^/login/oauth/(authorize|access_token)$"
         },
+        {
+          "host": "github.com",
+          "pathPattern": "^/(login|session|sessions/two-factor(/app)?)$"
+        },
         {
           "host": "github.com",
           "pathPattern": "^/apps/[^/]+/installations/new$"
@@ -1470,6 +1481,37 @@
       "endpointEnvNone": "no Google Ads client exposes an HTTP base-URL override: google-ads-api builds the host into the request literally, google-ads-python's `endpoint` is a gRPC host:port for its transport channel, and Dub hardcodes the host in a raw fetch. Interception is host-based.",
       "serveExport": "createGoogleAdsTwinServer"
     },
+    "googlecalendar": {
+      "adoption": {
+        "sdks": [
+          "@googleapis/calendar"
+        ],
+        "pypi": [],
+        "envStems": [
+          "GOOGLECALENDAR"
+        ]
+      },
+      "hosts": [
+        {
+          "host": "www.googleapis.com",
+          "pathPattern": "^/(batch/)?calendar/v3(/|$)"
+        }
+      ],
+      "archetype": "crud",
+      "protocol": {
+        "declared": "2",
+        "major": 2,
+        "standing": "current"
+      },
+      "transport": "rest",
+      "resources": [
+        "Calendar",
+        "CalendarListEntry",
+        "Event"
+      ],
+      "endpointEnvNone": "@googleapis/calendar and googleapis read no base-URL variable: the root URL is the Discovery document's `https://www.googleapis.com/` unless the caller passes `rootUrl` (Inbox Zero reads its own GOOGLE_BASE_URL for that); interception is the host rule above.",
+      "serveExport": "createGooglecalendarTwinServer"
+    },
     "googlemaps": {
       "adoption": {
         "pypi": [
@@ -2148,6 +2190,27 @@
       ],
       "serveExport": "createMixpanelTwinServer"
     },
+    "mongodb": {
+      "adoption": {
+        "pypi": [],
+        "sdks": []
+      },
+      "hostsNone": "RAW-PROTOCOL pack — there is no host to map. MongoDB clients speak the wire protocol over a raw TCP socket to whatever host the connection string names, which the injector (http/fetch patching) cannot see; a World reaches this twin through the connection string itself (MONGO_URI and its kin), which World-managed infrastructure injects.",
+      "archetype": "crud",
+      "protocol": {
+        "declared": "2",
+        "major": 2,
+        "standing": "current"
+      },
+      "transport": "raw-tcp",
+      "resources": [
+        "collection",
+        "index",
+        "document"
+      ],
+      "endpointEnvNone": "no vendor base-URL variable: the application reads its own connection-string variable (MONGO_URI, MONGODB_URL, DATABASE_URL, …), and World-managed infrastructure (`volter-world init` → `volter-world-infra`) injects that variable pointing at this twin's listener.",
+      "serveExport": "createMongodbTwinServer"
+    },
     "moonshot": {
       "adoption": {
         "pypi": [],
@@ -2816,6 +2879,26 @@
       "endpointEnvNone": "reddit clients take no base-URL environment variable (snoowrap and PRAW build https://oauth.reddit.com and https://www.reddit.com URLs from constants or explicit constructor options), so a World reaches them through the hosts above; inventing a REDDIT_BASE_URL the app never reads would report coverage the app does not have.",
       "serveExport": "createRedditTwinServer"
     },
+    "redis": {
+      "adoption": {},
+      "hostsNone": "RAW-PROTOCOL pack — there is no host to map. Redis's protocol runs over a TCP socket the injector (which patches http/fetch) never sees, and a Redis has no vendor hostname: it is wherever the app's REDIS_URL points. The World points it here: init classifies REDIS_URL as managed infrastructure and the managed redis service is this twin.",
+      "archetype": "crud",
+      "protocol": {
+        "major": 1,
+        "standing": "deprecated"
+      },
+      "transport": "raw-tcp",
+      "resources": [
+        "key",
+        "field",
+        "member",
+        "scored",
+        "entry",
+        "script"
+      ],
+      "endpointEnvNone": "Redis clients read no base-URL env of their own: the app passes its REDIS_URL (or host/port) to ioredis or node-redis itself, and init emits that REDIS_URL for the managed redis service (world-runtime/src/init.ts), not as a twin endpoint env.",
+      "serveExport": "createRedisTwinServer"
+    },
     "replicate": {
       "adoption": {
         "pypi": [
@@ -3358,11 +3441,11 @@
         },
         {
           "host": "connect.stripe.com",
-          "pathPattern": "^/setup/"
+          "pathPattern": "^/setup/|^/oauth/(authorize|token|deauthorize)/?$"
         },
         {
           "host": "dashboard.stripe.com",
-          "pathPattern": "^/settings/public/?$"
+          "pathPattern": "^/settings/public/?$|^/(test/)?settings/connect(/onboarding-options/oauth)?/?$"
         },
         {
           "host": "verify.stripe.com",
@@ -3561,6 +3644,38 @@
       "endpointEnvNone": "the @tavily/core SDK exposes no base-URL env var — it reads only TAVILY_API_KEY/TAVILY_HTTP(S)_PROXY/TAVILY_ORG_ID/TAVILY_PROJECT from process.env; base-URL override is the constructor option apiBaseURL (dist/index.mjs post()/get(): `apiBaseURL || BASE_URL`), so interception is the hosts entry above.",
       "serveExport": "createTavilyTwinServer"
     },
+    "temporal": {
+      "adoption": {
+        "sdks": [
+          "@temporalio/client",
+          "@temporalio/worker",
+          "@temporalio/workflow",
+          "@temporalio/activity"
+        ],
+        "scopes": [
+          "@temporalio/"
+        ],
+        "pypi": [
+          "temporalio"
+        ],
+        "envStems": [
+          "TEMPORAL"
+        ]
+      },
+      "hostsNone": "RAW-PROTOCOL pack — there is no host to map. The Temporal SDKs dial the frontend address they are configured with (Connection.connect / NativeConnection.connect `address`, conventionally TEMPORAL_ADDRESS) over gRPC, which the http/fetch injector never sees. Interception is the app-read address: the World injects TEMPORAL_ADDRESS=<host>:<port> at this twin (APP_READ_ENDPOINT_ENV in world-runtime/src/init.ts).",
+      "archetype": "engine-control",
+      "protocol": {
+        "declared": "2",
+        "major": 2,
+        "standing": "current"
+      },
+      "transport": "raw-tcp",
+      "resources": [
+        "workflow-execution",
+        "namespace"
+      ],
+      "serveExport": "createTemporalTwinServer"
+    },
     "tiktok": {
       "adoption": {
         "sdks": [],
@@ -4154,11 +4269,11 @@
       "hosts": [
         {
           "host": "api.x.com",
-          "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/"
+          "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/(?!assets/consent\\.(?:js|css)$)"
         },
         {
           "host": "api.twitter.com",
-          "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/"
+          "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/(?!assets/consent\\.(?:js|css)$)"
         }
       ],
       "archetype": "crud",
@@ -4241,11 +4356,11 @@
         },
         {
           "host": "api.x.com",
-          "pathPattern": "^/2/(?:oauth2/(?:token|revoke)|users/me)/?$"
+          "pathPattern": "^/2/(?:oauth2/(?:token|revoke)|users/me)/?$|^/oauth/(?:request_token|authorize|authenticate|access_token)/?$|^/1\\.1/oauth/invalidate_token(?:\\.json)?/?$|^/_twin/assets/consent\\.(?:js|css)$"
         },
         {
           "host": "api.twitter.com",
-          "pathPattern": "^/2/(?:oauth2/(?:token|revoke)|users/me)/?$"
+          "pathPattern": "^/2/(?:oauth2/(?:token|revoke)|users/me)/?$|^/oauth/(?:request_token|authorize|authenticate|access_token)/?$|^/1\\.1/oauth/invalidate_token(?:\\.json)?/?$|^/_twin/assets/consent\\.(?:js|css)$"
         }
       ],
       "archetype": "crud",
@@ -4263,7 +4378,11 @@
         "access_token",
         "refresh_token",
         "grant",
-        "rate_window"
+        "rate_window",
+        "oauth1_app",
+        "oauth1_request_token",
+        "oauth1_token",
+        "oauth1_grant"
       ],
       "serveExport": "createXIdentityTwinServer"
     },

package/inject.cjs

@@ -678,7 +678,7 @@ function fakeClientRequest(origin, method, fullPath, headers, callback) {
 
 // --- unclaimed path on a twinned shared host: refuse LOUDLY, never mis-route -----------------
 // The Cal.com incident class: a host two vendors share (www.googleapis.com) is twinned, the
-// request's PATH belongs to neither twin (`/calendar/v3/*` — Google Calendar has no pack), and
+// request's PATH belongs to neither twin (`/drive/v3/*` — Google Drive has no pack; `/calendar/v3/*` was the case until the googlecalendar pack), and
 // the old catch-all matcher answered it from the WRONG pack with a vendor-shaped 404: fails open
 // AND plausible. The operator declared this host virtualized, so the traffic must not leak to the
 // real vendor either. The only honest outcome is a refusal that NAMES the situation.
@@ -1092,6 +1092,51 @@ function restore() {
 
 module.exports = { install, restore, readMap, resolveTwin, twinUrlVendor, twinnedHostVendors, unclaimedTwinnedHostPathMessage, appForwardHeaders, VENDOR_HOSTS };
 
+// WORLD TIME: an application process keeps the World's time, as its twins do (worldNow(), world-clock.ts). A World's
+// clock (TWIN_WORLD_CLOCK_FILE, one of world-clock.cjs's two forms) is read at most once a second, so a clock moved
+// while the application runs applies within a second; with no clock set, the process keeps the machine's time.
+// `Date` is the machine's own, wrapped so its `now()` and argument-less construction read the World's time; every other use
+// (a parsed date, `Date.UTC`, arithmetic, timers, `performance.now()`) is unchanged. The machine's own `Date.now` is
+// left under a global symbol, so the kernel's worldNow() applies a running clock's offset once in a process like this.
+// Without this, time moved in a World reaches its twins and not its application: a token the twins sign by the
+// World's time is refused by the application's (dub-stress findings row 107).
+function installWorldTime() {
+  const file = process.env.TWIN_WORLD_CLOCK_FILE;
+  if (!file || globalThis[Symbol.for('volter.machineDateNow')]) return;
+  const fs = require('fs');
+  const { parseClock, clockNowMs } = require('./world-clock.cjs');
+  const MachineDate = Date;
+  const machineNow = MachineDate.now.bind(MachineDate);
+  let held = { checkedAt: -Infinity, mtimeMs: -1, clock: null };
+  const clock = () => {
+    const wall = machineNow();
+    if (wall - held.checkedAt < 1000) return held.clock;
+    held.checkedAt = wall;
+    try {
+      const mtimeMs = fs.statSync(file).mtimeMs;
+      if (mtimeMs !== held.mtimeMs) held = { checkedAt: wall, mtimeMs, clock: parseClock(fs.readFileSync(file, 'utf8')) };
+    } catch (error) {
+      // no clock: the machine's time; a clock caught mid-write keeps the last one read until the next look
+      if (error && error.code === 'ENOENT') held = { checkedAt: wall, mtimeMs: -1, clock: null };
+    }
+    return held.clock;
+  };
+  const worldMs = () => { const c = clock(); return c ? clockNowMs(c, machineNow()) : machineNow(); };
+  // the machine's own Date, wrapped rather than subclassed, so identity holds everywhere: dates Node makes itself
+  // (a file's mtime, structuredClone, a worker's message) are `instanceof Date`, `d.constructor === Date` stays true,
+  // and Date.prototype is the machine's; only now() and argument-less construction read the World's time
+  const WorldDate = new Proxy(MachineDate, {
+    construct: (target, args, newTarget) => Reflect.construct(target, args.length ? args : [worldMs()], newTarget === WorldDate ? target : newTarget),
+    // called as a function, Date() answers the current time's string, as the machine's does
+    apply: () => new MachineDate(worldMs()).toString(),
+  });
+  Object.defineProperty(globalThis, Symbol.for('volter.machineDateNow'), { value: machineNow, enumerable: false });
+  MachineDate.now = worldMs;
+  Object.defineProperty(MachineDate.prototype, 'constructor', { value: WorldDate, writable: true, configurable: true, enumerable: false });
+  globalThis.Date = WorldDate;
+}
+
 // Auto-install as a preload (`--require`); strict refusal also applies without twin URLs.
 install();
+installWorldTime();
 installPrismaAdapterShim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",
@@ -29,6 +29,8 @@
     "network-policy.d.cts",
     "app-route.cjs",
     "vendor-hosts.cjs",
+    "world-clock.cjs",
+    "world-clock.d.cts",
     "app-route.d.cts",
     "generated",
     "src",
@@ -73,10 +75,18 @@
       "default": "./app-route.cjs"
     },
     "./vendor-hosts": "./vendor-hosts.cjs",
+    "./world-clock": {
+      "types": "./world-clock.d.cts",
+      "default": "./world-clock.cjs"
+    },
     "./generated/pack-facts.json": "./generated/pack-facts.json",
     "./lifecycle": {
       "types": "./dist/src/lifecycle.d.ts",
       "default": "./dist/src/lifecycle.js"
+    },
+    "./redis": {
+      "types": "./dist/src/redis/index.d.ts",
+      "default": "./dist/src/redis/index.js"
     }
   },
   "scripts": {

package/src/actions.ts

@@ -17,9 +17,9 @@ import { randomUUID } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { canonicalJson, hashFieldValue, subjectKey } from './hash.ts';
 import type { SubjectFields } from './hash.ts';
-import { appendDurable, eventsLockPath, projectionLockPath, twinLog, withFileLock, worldPaths } from './storage.ts';
+import { appendDurable, eventsLockPath, ownerStoreRoots, projectionLockPath, twinLog, withFileLock, withoutIdentityClaim, worldPaths } from './storage.ts';
 import { landAsPlaceholder, placeholderPullActive } from './placeholder-remote.ts';
-import { aliasesFrom, dropCheckpoint, landedCopy, landedIds, parentEntries, readTree, type Receipt } from './log.ts';
+import { aliasesFrom, dropCheckpoint, landedCopy, landedIds, parentEntries, readTree, treeStamp, type Receipt } from './log.ts';
 import { WorldServiceEventSchema } from './schemas.ts';
 import { getActiveWorldStore } from './world-store.ts';
 import type { WorldServiceEvent } from './types.ts';
@@ -439,6 +439,57 @@ export function projectResources(service: string, root?: string, opts: { until?:
   return readTree(service, root, opts);
 }
 
+/** A read of another pack's store that cannot choose: the subject it looks for (or, with none named, the store itself)
+ *  is held by more than one service of the World. A reader answers it as the vendor answers a credential it cannot
+ *  resolve; it is never a server error. */
+export class OwnerStoreAmbiguousError extends Error {
+  constructor(owner: string, roots: string[], subject?: { type: string; id: string }) {
+    super(`${subject ? `${subject.type} ${subject.id} of ` : ''}${owner}'s store is held by more than one service of this World (${roots.join(', ')}); a cross-pack read cannot choose between them`);
+    this.name = 'OwnerStoreAmbiguousError';
+  }
+}
+
+/** One owner store as a cross-pack reader sees it: its rows (frozen, shared by every read until the store changes) and
+ *  an index by `type:id`. Memoized per (owner, root) on the store's `treeStamp`, so a reader resolving a token on every
+ *  request folds and copies the owner's tree only when the owner has written since. */
+type OwnerIndex = { stamp: string; rows: readonly TwinResource[]; byKey: Map<string, TwinResource> };
+const ownerIndexes = new Map<string, OwnerIndex>();
+function ownerIndex(owner: string, root: string): OwnerIndex {
+  const key = `${owner}\0${root}`;
+  const stamp = treeStamp(owner, root);
+  const held = ownerIndexes.get(key);
+  if (held && held.stamp === stamp) return held;
+  const rows = readTree(owner, root).map((r) => Object.freeze(r));
+  const index: OwnerIndex = { stamp, rows: Object.freeze(rows), byKey: new Map(rows.map((r) => [`${r.type}:${r.id}`, r])) };
+  ownerIndexes.set(key, index);
+  return index;
+}
+
+/**
+ * ANOTHER pack's rows, read by contract (architecture A3: one vendor's store split across two packs, xidentity's tokens
+ * read by x, googleoauth's by googlecalendar; scripts/architecture.test.ts holds the declared reader-owner pairs): the
+ * owner's tree, from wherever the World keeps the owner's store (`ownerStoreRoots`). Read only: the rows are frozen and
+ * shared. It claims no journal identity (the twin answering is the reader).
+ *
+ * With `subject`, the store that holds that subject (the token a request presents): `[]` when none does, and
+ * `OwnerStoreAmbiguousError` only when more than one does, so a second service running the owning pack never breaks a
+ * lookup of what only one of them issued. Without it, the one store there is, and `OwnerStoreAmbiguousError` when the
+ * World holds two.
+ */
+export function projectOwnerResources(owner: string, root?: string, subject?: { type: string; id: string }): readonly TwinResource[] {
+  return withoutIdentityClaim(() => {
+    const roots = ownerStoreRoots(owner, root);
+    if (!subject) {
+      if (roots.length > 1) throw new OwnerStoreAmbiguousError(owner, roots);
+      return roots[0] ? ownerIndex(owner, roots[0]).rows : [];
+    }
+    const key = `${subject.type}:${subject.id}`;
+    const holding = roots.filter((r) => ownerIndex(owner, r).byKey.has(key));
+    if (holding.length > 1) throw new OwnerStoreAmbiguousError(owner, holding, subject);
+    return holding[0] ? ownerIndex(owner, holding[0]).rows : [];
+  });
+}
+
 /** The local → vendor id aliases the landed copies carry: a read by the id a caller was handed before
  *  its write was performed resolves to the row the vendor now owns. */
 export function subjectAliases(service: string, root?: string): Map<string, string> {

package/src/index.ts

@@ -111,6 +111,9 @@ export {
   withFileLock,
   worldPaths,
   worldStateRoot,
+  // Where another pack's store is in a World (architecture A3), and the variable the runtime names its data directory in.
+  ownerStoreRoots,
+  WORLD_DATA_ENV,
 } from './storage.ts';
 export type {
   AppendEventResult,
@@ -190,6 +193,8 @@ export {
   isTwinBookkeeping,
   pendingTransactionCommits,
   projectResources,
+  projectOwnerResources,
+  OwnerStoreAmbiguousError,
   revertAction,
   TwinActionPreconditionError, subjectAliases, resolveSubjectId, runWithCorrelationId, currentCorrelationId } from './actions.ts';
 export type {