@volter/twin-catalog 0.2.2 → 0.2.4

package/lib/browse.d.mts

@@ -45,6 +45,19 @@ export type Release = {
   assessedAt?: string;
 };
 export type CatalogRelease = Release & {
+  packageMetadata: null | {
+    description: string | null;
+    license: string;
+    engines: Record<string, string>;
+    peerDependencies: Record<string, string>;
+    repositoryDirectory: string | null;
+    bugs: string | null;
+    sourceCommit: string | null;
+    readmeUrl: string | null;
+    licenseUrl: string | null;
+    packageUrl: string;
+    issuesUrl: string | null;
+  };
   revoked: { reason: string } | null;
   selectable: boolean;
   default: boolean;

package/lib/browse.mjs

@@ -6,6 +6,25 @@ import { digest, loadIndex, read, requireThat, selection, stable, submissionId,
 const textOrder = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 const releaseKey = (v) => `${v.package}@${v.version}`;
 
+function packageDetails(bound, source, packageName, version) {
+  const metadata = bound?.report.prepared?.packageMetadata;
+  if (!metadata) return null;
+  const commit = bound.report.prepared?.provenance?.sourceCommit;
+  const directory = metadata.repositoryDirectory ?? '';
+  const parts = typeof directory === 'string' ? directory.split('/').filter(Boolean) : null;
+  const validDirectory = parts && parts.every((part) => part !== '.' && part !== '..' && !part.includes('\\'));
+  const sourceRoot = /^[a-f0-9]{40}$/.test(commit ?? '') && validDirectory
+    ? `https://github.com/${source.repository}/blob/${commit}/${parts.length ? parts.map(encodeURIComponent).join('/') + '/' : ''}`
+    : null;
+  let issuesUrl = null;
+  try { const url = new URL(metadata.bugs); if (url.protocol === 'https:') issuesUrl = url.href; } catch { /* No usable issue URL was supplied. */ }
+  return { ...metadata, sourceCommit: commit ?? null,
+    readmeUrl: sourceRoot ? `${sourceRoot}README.md` : null,
+    licenseUrl: sourceRoot ? `${sourceRoot}LICENSE` : null,
+    packageUrl: `https://www.npmjs.com/package/${packageName}/v/${encodeURIComponent(version)}`,
+    issuesUrl };
+}
+
 function repositoryOf(pkg) {
   const value = typeof pkg.repository === 'string' ? pkg.repository : pkg.repository?.url;
   const match = /^git\+https:\/\/github\.com\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(value ?? '') ??
@@ -99,7 +118,8 @@ export function browse(root, { vendor, package: packageName, integrity = null }
                 const revoked = index.revocations.find((r) => r.package === p.name && r.version === v.version);
                 const selectable = v.status === 'live' && !v.version.includes('-') && !revoked;
                 const quick = bound?.report.quick, browser = bound?.report.browser;
-                return { ...v, revoked: revoked ? { reason: revoked.reason } : null, selectable: Boolean(selectable),
+                return { ...v, packageMetadata: packageDetails(bound, source, p.name, v.version),
+                  revoked: revoked ? { reason: revoked.reason } : null, selectable: Boolean(selectable),
                   default: choice?.p.name === p.name && choice.v.version === v.version,
                   assessment: { recorded: record.assessed, available: Boolean(bound), evidence: record.evidence,
                     input: bound ? { repository: bound.envelope.input.repository, pullRequest: bound.envelope.input.pullRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-catalog",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "The moderated twin distribution: approved versions and submission tooling for independent publishers.",
   "type": "module",
   "bin": {
@@ -38,7 +38,7 @@
     "evidence"
   ],
   "catalog": {
-    "sourceCommit": "646cb5db50f24248f177e1fab1ccdeb681e7005b",
-    "digest": "1c1ad9dfb2fd6cba0923988b3a1f17c6da892efc3a5ec36f230a91c88a437ff6"
+    "sourceCommit": "d295a1e52d80b36146cac13cfccc403139d8d947",
+    "digest": "1c9e35135ce16a67c8c5ba817277ac2e11869b8a1234206aee5674eb8851a134"
   }
 }

package/policy.json

@@ -2,9 +2,9 @@
   "schemaVersion": 1,
   "registry": "https://registry.npmjs.org",
   "tools": {
-    "@volter/world-core": "3.0.59",
-    "@volter/world-runtime": "3.0.59",
-    "@volter/twin-standard": "1.0.51",
+    "@volter/world-core": "3.0.68",
+    "@volter/world-runtime": "3.0.68",
+    "@volter/twin-standard": "1.0.60",
     "playwright": "1.63.0"
   },
   "bun": "1.3.11",

package/runner/prepare.mjs

@@ -77,5 +77,14 @@ const provenance = await verifiedProvenance(await response.json(), source, bytes
 // Keep a vendor-named package directory for the standard's public directory API; preserve the installed artifact.
 mkdirSync('/work/packs', { recursive: true });
 cpSync(join('/work/node_modules', s.package), join('/work/packs', s.vendor), { recursive: true });
-write('/work/prepared.json', { schemaVersion: 1, submission: s, integrity: s.integrity, provenance, dependencyLockSha256: digest(readFileSync('/work/package-lock.json', 'utf8')), clientSdkLocks, tools: policy.tools });
+// Retain listing facts from these exact bytes, never the registry's moving latest metadata.
+const packageMetadata = {
+  description: typeof pack.description === 'string' ? pack.description : null,
+  license: pack.license,
+  engines: pack.engines ?? {},
+  peerDependencies: pack.peerDependencies ?? {},
+  repositoryDirectory: typeof pack.repository === 'object' ? pack.repository.directory ?? null : null,
+  bugs: typeof pack.bugs === 'string' ? pack.bugs : pack.bugs?.url ?? null,
+};
+write('/work/prepared.json', { schemaVersion: 1, submission: s, integrity: s.integrity, provenance, packageMetadata, dependencyLockSha256: digest(readFileSync('/work/package-lock.json', 'utf8')), clientSdkLocks, tools: policy.tools });
 write('/work/world.json', { id: 'catalog-assessment', network: { egress: [] }, services: [] });

package/vendors/tavily.json

@@ -0,0 +1,20 @@
+{
+  "vendor": "tavily",
+  "packages": [
+    {
+      "name": "@volter/twin-tavily",
+      "source": "twin-packs-open",
+      "versions": [
+        {
+          "version": "1.0.1",
+          "status": "live",
+          "integrity": "sha512-ABLgHRXQAk3LjrdP5bWBXhS4WW+w5/KyuL9UrPREgJc+nhE/Sd8bR+EZha0qaFFzaQIHqfuo9yPlxA/O3fMqlQ==",
+          "submission": "100cf4069352dee18bcb1f8ef9198c637ce1842d42f66477a6a62702c24f9f13",
+          "commit": "373e9ad779cd1eb68fb9f093d669a3f061d4e01d",
+          "at": "2026-10-06T01:19:08Z",
+          "by": "moderated-merge"
+        }
+      ]
+    }
+  ]
+}