@volter/world-core 3.0.19 → 3.0.21

package/dist/generated/pack-facts.json

@@ -1137,6 +1137,48 @@
       },
       "serveExport": "createGroqTwinServer"
     },
+    "hackernews": {
+      "adoption": {
+        "sdks": [],
+        "envStems": [
+          "HN",
+          "HACKERNEWS"
+        ]
+      },
+      "hosts": [
+        {
+          "host": "hacker-news.firebaseio.com"
+        },
+        {
+          "host": "news.ycombinator.com"
+        }
+      ],
+      "archetype": "crud",
+      "protocol": {
+        "declared": "3",
+        "major": 3,
+        "standing": "current"
+      },
+      "transport": "rest",
+      "resources": [
+        "item",
+        "user",
+        "_vote",
+        "_person",
+        "_web_session",
+        "_web_session_issue"
+      ],
+      "endpointEnvNone": "Hacker News publishes no SDK: clients fetch https://hacker-news.firebaseio.com/v0 directly and people use news.ycombinator.com in a browser, both reached by host",
+      "credentialDoor": {
+        "path": "/_twin/app-credentials",
+        "body": {},
+        "fill": {
+          "HN_USERNAME": "acct",
+          "HN_PASSWORD": "pw"
+        }
+      },
+      "serveExport": "createHackernewsTwinServer"
+    },
     "hubspot": {
       "adoption": {
         "sdks": [
@@ -1844,6 +1886,88 @@
       },
       "serveExport": "createPosthogTwinServer"
     },
+    "reddit": {
+      "adoption": {
+        "sdks": [
+          "snoowrap"
+        ],
+        "pypi": [
+          "praw",
+          "asyncpraw"
+        ],
+        "envStems": [
+          "REDDIT"
+        ]
+      },
+      "hosts": [
+        {
+          "host": "oauth.reddit.com"
+        },
+        {
+          "host": "www.reddit.com"
+        },
+        {
+          "host": "reddit.com"
+        },
+        {
+          "host": "reddit-uploaded-media.s3-accelerate.amazonaws.com"
+        },
+        {
+          "host": "reddit-uploaded-video.s3-accelerate.amazonaws.com"
+        },
+        {
+          "host": "v.redd.it"
+        },
+        {
+          "host": "i.redd.it"
+        },
+        {
+          "host": "preview.redd.it"
+        },
+        {
+          "host": "external-preview.redd.it"
+        },
+        {
+          "host": "b.thumbs.redditmedia.com"
+        }
+      ],
+      "archetype": "crud",
+      "protocol": {
+        "declared": "3",
+        "major": 3,
+        "standing": "current"
+      },
+      "transport": "rest",
+      "resourcesUnreachable": {},
+      "resources": [
+        "account",
+        "subreddit",
+        "link",
+        "comment",
+        "asset",
+        "app",
+        "_access_token",
+        "_token_issue",
+        "_client_secret",
+        "_rate_window",
+        "_vote",
+        "_membership",
+        "_person",
+        "_web_session",
+        "_web_session_issue"
+      ],
+      "endpointEnvNone": "Reddit's clients name oauth.reddit.com and www.reddit.com themselves (the campaign's sender writes them as constants); the World's injector routes those hosts, and no client of the demand reads a base-URL variable",
+      "credentialDoor": {
+        "path": "/_twin/app-credentials",
+        "body": {
+          "username": "volter"
+        },
+        "fill": {
+          "REDDIT_ACCESS_TOKEN": "access_token"
+        }
+      },
+      "serveExport": "createRedditTwinServer"
+    },
     "resend": {
       "adoption": {
         "pypi": [
@@ -2817,27 +2941,27 @@
         },
         {
           "host": "x.com",
-          "pathPattern": "^/i/oauth2/authorize/?$|^/_twin/|^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/i/oauth2/authorize/?$|^/_twin/|^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "twitter.com",
-          "pathPattern": "^/i/oauth2/authorize/?$|^/_twin/|^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/i/oauth2/authorize/?$|^/_twin/|^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "www.x.com",
-          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "www.twitter.com",
-          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "mobile.twitter.com",
-          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "mobile.x.com",
-          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "pbs.twimg.com",
@@ -2863,7 +2987,6 @@
         "oauth_client",
         "oauth1_app",
         "account",
-        "session",
         "auth_request",
         "post",
         "rate_limit",
@@ -2873,6 +2996,7 @@
         "repost",
         "bookmark",
         "_impressions",
+        "_card",
         "_grant",
         "_oauth1_grant",
         "_rate_window",

package/dist/inject.cjs

@@ -21,7 +21,13 @@
 // (stripe-node → https; @octokit → fetch; @slack/web-api & jira.js → axios →
 // http/https; @linear/sdk → fetch), so no per-SDK shim is needed.
 //
-// A client can still open its own sockets (npm `undici`'s Agent, which
+// Attached to a World (VOLTER_WORLD), a request a bundled undici (wrangler's) sends to the
+// World's own paths through undici's shared global dispatcher carries the World's key too:
+// Object.defineProperty is watched for that global, and the dispatcher set there is stood
+// in for by a view whose dispatch keys a hop whose origin and path are the World's
+// (keyedView, below), sent with maxRedirections 0 so no follower below it takes the key on.
+//
+// A client can still open its own sockets (npm `undici`'s own Agent, which
 // @turbopuffer/turbopuffer uses under Node, honours neither patch nor HTTPS_PROXY).
 // `net.connect`/`tls.connect` are the seam every Node client ends at, so they carry
 // the backstop: a connect to a twinned vendor host went around the rewrite and is
@@ -435,6 +441,74 @@ function withWorldKey(args) {
   return out;
 }
 
+// A client that bundles its own undici (wrangler) calls neither the global `fetch` nor http(s), so its requests to the
+// World's own paths would arrive without the key. Every undici copy, Node's own included, keeps its dispatcher on one
+// shared global (`Symbol.for('undici.globalDispatcher.<n>')`), set with Object.defineProperty when that copy loads. A
+// dispatcher defined there is stood in for by a view of it whose `dispatch` adds the key to one hop, only when that
+// hop's origin is the World's and its path one of the World's own, compared as strings (a path is never resolved as a
+// URL, so `//other-host/…` names no other origin); the dispatcher itself is never changed, and restore() puts it back.
+const UNDICI_DISPATCHERS = [Symbol.for('undici.globalDispatcher.1'), Symbol.for('undici.globalDispatcher.2')];
+const KEYED_VIEWS = new WeakMap(); // view -> the dispatcher it stands in for
+function keyedUndiciHeaders(headers, key) {
+  if (headers == null) return { 'x-twins-key': key };
+  if (Array.isArray(headers)) {
+    const flat = headers.length === 0 || !Array.isArray(headers[0]);
+    const names = flat ? headers.filter((_, i) => i % 2 === 0) : headers.map((h) => h[0]);
+    if (names.some((n) => String(n).toLowerCase() === 'x-twins-key')) return headers;
+    return flat ? [...headers, 'x-twins-key', key] : [...headers, ['x-twins-key', key]];
+  }
+  const entries = typeof headers[Symbol.iterator] === 'function' ? [...headers] : Object.entries(headers);
+  if (entries.some(([n]) => String(n).toLowerCase() === 'x-twins-key')) return headers;
+  return Object.assign(Object.fromEntries(entries), { 'x-twins-key': key });
+}
+/** A dispatch hop is the World's: its origin is the World's own and its path, as written, under the World's paths. */
+function hopToWorld(opts) {
+  const base = worldBase();
+  if (!base || !base.path || !opts || opts.origin == null) return false;
+  let origin;
+  try { origin = new URL(String(opts.origin)).origin; } catch { return false; }
+  const at = String(opts.path == null ? '/' : opts.path);
+  return origin === base.origin && (at.startsWith(`${base.path}/`) || at.startsWith(`/-${base.path}/`));
+}
+function keyedView(dispatcher) {
+  if (!dispatcher || typeof dispatcher.dispatch !== 'function' || KEYED_VIEWS.has(dispatcher)) return dispatcher;
+  const view = new Proxy(dispatcher, {
+    get(target, name) {
+      if (name === 'dispatch') {
+        return function keyedDispatch(opts, handler) {
+          const key = ORIGINAL_DEFINE_PROPERTY ? twinsKey() : null;
+          // a hop the caller asked undici to follow is not keyed; a keyed hop is sent with maxRedirections 0, so no
+          // redirect follower below this view (a composed interceptor, a RetryAgent or proxy agent around one, undici
+          // 6's option or interceptors) carries its headers to the next origin: the redirect comes back to the caller
+          const keyed = key && !(opts && Number(opts.maxRedirections) > 0) && hopToWorld(opts);
+          return target.dispatch(keyed ? Object.assign({}, opts, { headers: keyedUndiciHeaders(opts.headers, key), maxRedirections: 0 }) : opts, handler);
+        };
+      }
+      const value = Reflect.get(target, name, target);
+      return typeof value === 'function' ? value.bind(target) : value;
+    },
+  });
+  KEYED_VIEWS.set(view, dispatcher);
+  return view;
+}
+let ORIGINAL_DEFINE_PROPERTY = null;
+function keyUndiciDispatches() {
+  if (ORIGINAL_DEFINE_PROPERTY || !worldBase() || Object.defineProperty.name === 'keyingDefineProperty') return;
+  const define = ORIGINAL_DEFINE_PROPERTY = Object.defineProperty;
+  Object.defineProperty = function keyingDefineProperty(target, name, descriptor) {
+    if (ORIGINAL_DEFINE_PROPERTY && target === globalThis && UNDICI_DISPATCHERS.includes(name) && descriptor && 'value' in descriptor) descriptor = Object.assign({}, descriptor, { value: keyedView(descriptor.value) });
+    return define(target, name, descriptor);
+  };
+  for (const name of UNDICI_DISPATCHERS) if (globalThis[name]) globalThis[name] = keyedView(globalThis[name]);
+}
+function unkeyUndiciDispatches() {
+  if (!ORIGINAL_DEFINE_PROPERTY) return;
+  // only what this put in place is put back: a wrapper installed over it since stays
+  if (Object.defineProperty.name === 'keyingDefineProperty') Object.defineProperty = ORIGINAL_DEFINE_PROPERTY;
+  ORIGINAL_DEFINE_PROPERTY = null;
+  for (const name of UNDICI_DISPATCHERS) if (KEYED_VIEWS.has(globalThis[name])) globalThis[name] = KEYED_VIEWS.get(globalThis[name]);
+}
+
 // S4 review F3: undici's default redirect-follow forwards CUSTOM headers across origins — a
 // twin (or the World) answering 30x to an external URL would carry x-twins-key to a REAL host. A
 // keyed fetch follows redirects itself: a hop that is a twin or the World re-enters the patched
@@ -979,6 +1053,7 @@ function install(mapOverride) {
   tls.connect = patchedConnect(ORIGINALS.tlsConnect, true);
   dns.lookup = patchedLookup(ORIGINALS.dnsLookup);
   dns.promises.lookup = patchedPromisesLookup(ORIGINALS.dnsPromisesLookup);
+  keyUndiciDispatches();
   // gRPC (architecture, "Other wires": gRPC): an HTTP/2 session to a host a twin serves (grpc-js on google-gax: TLS to
   // webrisk.googleapis.com) connects to that twin's origin in plain text, where the kernel's HTTP/2 server answers it;
   // the client carries on unchanged. Any other authority is the real one's.
@@ -1139,6 +1214,7 @@ function restore() {
   dns.lookup = ORIGINALS.dnsLookup;
   dns.promises.lookup = ORIGINALS.dnsPromisesLookup;
   http2.connect = ORIGINALS.http2Connect;
+  unkeyUndiciDispatches();
   installed = false;
   MAP = {};
 }

package/generated/pack-facts.json

@@ -1137,6 +1137,48 @@
       },
       "serveExport": "createGroqTwinServer"
     },
+    "hackernews": {
+      "adoption": {
+        "sdks": [],
+        "envStems": [
+          "HN",
+          "HACKERNEWS"
+        ]
+      },
+      "hosts": [
+        {
+          "host": "hacker-news.firebaseio.com"
+        },
+        {
+          "host": "news.ycombinator.com"
+        }
+      ],
+      "archetype": "crud",
+      "protocol": {
+        "declared": "3",
+        "major": 3,
+        "standing": "current"
+      },
+      "transport": "rest",
+      "resources": [
+        "item",
+        "user",
+        "_vote",
+        "_person",
+        "_web_session",
+        "_web_session_issue"
+      ],
+      "endpointEnvNone": "Hacker News publishes no SDK: clients fetch https://hacker-news.firebaseio.com/v0 directly and people use news.ycombinator.com in a browser, both reached by host",
+      "credentialDoor": {
+        "path": "/_twin/app-credentials",
+        "body": {},
+        "fill": {
+          "HN_USERNAME": "acct",
+          "HN_PASSWORD": "pw"
+        }
+      },
+      "serveExport": "createHackernewsTwinServer"
+    },
     "hubspot": {
       "adoption": {
         "sdks": [
@@ -1844,6 +1886,88 @@
       },
       "serveExport": "createPosthogTwinServer"
     },
+    "reddit": {
+      "adoption": {
+        "sdks": [
+          "snoowrap"
+        ],
+        "pypi": [
+          "praw",
+          "asyncpraw"
+        ],
+        "envStems": [
+          "REDDIT"
+        ]
+      },
+      "hosts": [
+        {
+          "host": "oauth.reddit.com"
+        },
+        {
+          "host": "www.reddit.com"
+        },
+        {
+          "host": "reddit.com"
+        },
+        {
+          "host": "reddit-uploaded-media.s3-accelerate.amazonaws.com"
+        },
+        {
+          "host": "reddit-uploaded-video.s3-accelerate.amazonaws.com"
+        },
+        {
+          "host": "v.redd.it"
+        },
+        {
+          "host": "i.redd.it"
+        },
+        {
+          "host": "preview.redd.it"
+        },
+        {
+          "host": "external-preview.redd.it"
+        },
+        {
+          "host": "b.thumbs.redditmedia.com"
+        }
+      ],
+      "archetype": "crud",
+      "protocol": {
+        "declared": "3",
+        "major": 3,
+        "standing": "current"
+      },
+      "transport": "rest",
+      "resourcesUnreachable": {},
+      "resources": [
+        "account",
+        "subreddit",
+        "link",
+        "comment",
+        "asset",
+        "app",
+        "_access_token",
+        "_token_issue",
+        "_client_secret",
+        "_rate_window",
+        "_vote",
+        "_membership",
+        "_person",
+        "_web_session",
+        "_web_session_issue"
+      ],
+      "endpointEnvNone": "Reddit's clients name oauth.reddit.com and www.reddit.com themselves (the campaign's sender writes them as constants); the World's injector routes those hosts, and no client of the demand reads a base-URL variable",
+      "credentialDoor": {
+        "path": "/_twin/app-credentials",
+        "body": {
+          "username": "volter"
+        },
+        "fill": {
+          "REDDIT_ACCESS_TOKEN": "access_token"
+        }
+      },
+      "serveExport": "createRedditTwinServer"
+    },
     "resend": {
       "adoption": {
         "pypi": [
@@ -2817,27 +2941,27 @@
         },
         {
           "host": "x.com",
-          "pathPattern": "^/i/oauth2/authorize/?$|^/_twin/|^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/i/oauth2/authorize/?$|^/_twin/|^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "twitter.com",
-          "pathPattern": "^/i/oauth2/authorize/?$|^/_twin/|^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/i/oauth2/authorize/?$|^/_twin/|^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "www.x.com",
-          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "www.twitter.com",
-          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "mobile.twitter.com",
-          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "mobile.x.com",
-          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$"
+          "pathPattern": "^/(?!_twin/)[A-Za-z0-9_]{1,15}/status/[0-9]{1,19}/?$|^/(?!(?:i|en|home|explore|notifications|messages|settings|search|compose|login|logout|signup|tos|privacy|about|account|intent|share|hashtag|lists|bookmarks|jobs|download|grok|premium|communities|creators|twin|_twin)/?$)[A-Za-z0-9_]{1,15}/?$|^/home/?$|^/i/flow/login/?$|^/$"
         },
         {
           "host": "pbs.twimg.com",
@@ -2863,7 +2987,6 @@
         "oauth_client",
         "oauth1_app",
         "account",
-        "session",
         "auth_request",
         "post",
         "rate_limit",
@@ -2873,6 +2996,7 @@
         "repost",
         "bookmark",
         "_impressions",
+        "_card",
         "_grant",
         "_oauth1_grant",
         "_rate_window",

package/inject.cjs

@@ -21,7 +21,13 @@
 // (stripe-node → https; @octokit → fetch; @slack/web-api & jira.js → axios →
 // http/https; @linear/sdk → fetch), so no per-SDK shim is needed.
 //
-// A client can still open its own sockets (npm `undici`'s Agent, which
+// Attached to a World (VOLTER_WORLD), a request a bundled undici (wrangler's) sends to the
+// World's own paths through undici's shared global dispatcher carries the World's key too:
+// Object.defineProperty is watched for that global, and the dispatcher set there is stood
+// in for by a view whose dispatch keys a hop whose origin and path are the World's
+// (keyedView, below), sent with maxRedirections 0 so no follower below it takes the key on.
+//
+// A client can still open its own sockets (npm `undici`'s own Agent, which
 // @turbopuffer/turbopuffer uses under Node, honours neither patch nor HTTPS_PROXY).
 // `net.connect`/`tls.connect` are the seam every Node client ends at, so they carry
 // the backstop: a connect to a twinned vendor host went around the rewrite and is
@@ -435,6 +441,74 @@ function withWorldKey(args) {
   return out;
 }
 
+// A client that bundles its own undici (wrangler) calls neither the global `fetch` nor http(s), so its requests to the
+// World's own paths would arrive without the key. Every undici copy, Node's own included, keeps its dispatcher on one
+// shared global (`Symbol.for('undici.globalDispatcher.<n>')`), set with Object.defineProperty when that copy loads. A
+// dispatcher defined there is stood in for by a view of it whose `dispatch` adds the key to one hop, only when that
+// hop's origin is the World's and its path one of the World's own, compared as strings (a path is never resolved as a
+// URL, so `//other-host/…` names no other origin); the dispatcher itself is never changed, and restore() puts it back.
+const UNDICI_DISPATCHERS = [Symbol.for('undici.globalDispatcher.1'), Symbol.for('undici.globalDispatcher.2')];
+const KEYED_VIEWS = new WeakMap(); // view -> the dispatcher it stands in for
+function keyedUndiciHeaders(headers, key) {
+  if (headers == null) return { 'x-twins-key': key };
+  if (Array.isArray(headers)) {
+    const flat = headers.length === 0 || !Array.isArray(headers[0]);
+    const names = flat ? headers.filter((_, i) => i % 2 === 0) : headers.map((h) => h[0]);
+    if (names.some((n) => String(n).toLowerCase() === 'x-twins-key')) return headers;
+    return flat ? [...headers, 'x-twins-key', key] : [...headers, ['x-twins-key', key]];
+  }
+  const entries = typeof headers[Symbol.iterator] === 'function' ? [...headers] : Object.entries(headers);
+  if (entries.some(([n]) => String(n).toLowerCase() === 'x-twins-key')) return headers;
+  return Object.assign(Object.fromEntries(entries), { 'x-twins-key': key });
+}
+/** A dispatch hop is the World's: its origin is the World's own and its path, as written, under the World's paths. */
+function hopToWorld(opts) {
+  const base = worldBase();
+  if (!base || !base.path || !opts || opts.origin == null) return false;
+  let origin;
+  try { origin = new URL(String(opts.origin)).origin; } catch { return false; }
+  const at = String(opts.path == null ? '/' : opts.path);
+  return origin === base.origin && (at.startsWith(`${base.path}/`) || at.startsWith(`/-${base.path}/`));
+}
+function keyedView(dispatcher) {
+  if (!dispatcher || typeof dispatcher.dispatch !== 'function' || KEYED_VIEWS.has(dispatcher)) return dispatcher;
+  const view = new Proxy(dispatcher, {
+    get(target, name) {
+      if (name === 'dispatch') {
+        return function keyedDispatch(opts, handler) {
+          const key = ORIGINAL_DEFINE_PROPERTY ? twinsKey() : null;
+          // a hop the caller asked undici to follow is not keyed; a keyed hop is sent with maxRedirections 0, so no
+          // redirect follower below this view (a composed interceptor, a RetryAgent or proxy agent around one, undici
+          // 6's option or interceptors) carries its headers to the next origin: the redirect comes back to the caller
+          const keyed = key && !(opts && Number(opts.maxRedirections) > 0) && hopToWorld(opts);
+          return target.dispatch(keyed ? Object.assign({}, opts, { headers: keyedUndiciHeaders(opts.headers, key), maxRedirections: 0 }) : opts, handler);
+        };
+      }
+      const value = Reflect.get(target, name, target);
+      return typeof value === 'function' ? value.bind(target) : value;
+    },
+  });
+  KEYED_VIEWS.set(view, dispatcher);
+  return view;
+}
+let ORIGINAL_DEFINE_PROPERTY = null;
+function keyUndiciDispatches() {
+  if (ORIGINAL_DEFINE_PROPERTY || !worldBase() || Object.defineProperty.name === 'keyingDefineProperty') return;
+  const define = ORIGINAL_DEFINE_PROPERTY = Object.defineProperty;
+  Object.defineProperty = function keyingDefineProperty(target, name, descriptor) {
+    if (ORIGINAL_DEFINE_PROPERTY && target === globalThis && UNDICI_DISPATCHERS.includes(name) && descriptor && 'value' in descriptor) descriptor = Object.assign({}, descriptor, { value: keyedView(descriptor.value) });
+    return define(target, name, descriptor);
+  };
+  for (const name of UNDICI_DISPATCHERS) if (globalThis[name]) globalThis[name] = keyedView(globalThis[name]);
+}
+function unkeyUndiciDispatches() {
+  if (!ORIGINAL_DEFINE_PROPERTY) return;
+  // only what this put in place is put back: a wrapper installed over it since stays
+  if (Object.defineProperty.name === 'keyingDefineProperty') Object.defineProperty = ORIGINAL_DEFINE_PROPERTY;
+  ORIGINAL_DEFINE_PROPERTY = null;
+  for (const name of UNDICI_DISPATCHERS) if (KEYED_VIEWS.has(globalThis[name])) globalThis[name] = KEYED_VIEWS.get(globalThis[name]);
+}
+
 // S4 review F3: undici's default redirect-follow forwards CUSTOM headers across origins — a
 // twin (or the World) answering 30x to an external URL would carry x-twins-key to a REAL host. A
 // keyed fetch follows redirects itself: a hop that is a twin or the World re-enters the patched
@@ -979,6 +1053,7 @@ function install(mapOverride) {
   tls.connect = patchedConnect(ORIGINALS.tlsConnect, true);
   dns.lookup = patchedLookup(ORIGINALS.dnsLookup);
   dns.promises.lookup = patchedPromisesLookup(ORIGINALS.dnsPromisesLookup);
+  keyUndiciDispatches();
   // gRPC (architecture, "Other wires": gRPC): an HTTP/2 session to a host a twin serves (grpc-js on google-gax: TLS to
   // webrisk.googleapis.com) connects to that twin's origin in plain text, where the kernel's HTTP/2 server answers it;
   // the client carries on unchanged. Any other authority is the real one's.
@@ -1139,6 +1214,7 @@ function restore() {
   dns.lookup = ORIGINALS.dnsLookup;
   dns.promises.lookup = ORIGINALS.dnsPromisesLookup;
   http2.connect = ORIGINALS.http2Connect;
+  unkeyUndiciDispatches();
   installed = false;
   MAP = {};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "3.0.19",
+  "version": "3.0.21",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",