@volter/twin-catalog 0.2.21 → 0.2.22

package/catalog.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceCommit": "9ddd392f308b6117596141fe62ff9e593c97b574",
+  "sourceCommit": "613d5262e9af9c28c79ae7622a9f6ef3c5067007",
   "digest": "6eb6ed3d49a71b4696b3de94ded50876b71e186f6ba5fdf670041364d8a853fe",
   "versions": [
     {

package/docs/process.md

@@ -156,6 +156,8 @@ artifact digest is independently recomputed. Private-source publication without
 
 Resend client conformance uses its official Node SDK at the demanded application's exact 6.6.0 pin: a single send and readback, a batch and individual readbacks, and the documented missing-required-field refusal. Mail remains synthetic. Passing these cases establishes those operations, not live delivery or complete SDK coverage.
 
+The released standard owns the development SDK versions used by its client cases. Candidate development dependencies supply additional clients but cannot override an evaluator-owned version. Preparation retains `clientDependencyChoices` for differing requested ranges and the resolved dependency lock. These cases measure the selected evaluator client; they do not establish compatibility with every SDK range in the candidate manifest.
+
 The versioned `@volter/twin-standard` owns the checks and machine-readable assessment API. The catalog invokes it;
 it does not implement another Protocol 3 grader or journey engine. Evaluation occurs inside a task-owned World.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-catalog",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "description": "The moderated twin distribution: approved versions and submission tooling for independent publishers.",
   "type": "module",
   "bin": {
@@ -38,7 +38,7 @@
     "evidence"
   ],
   "catalog": {
-    "sourceCommit": "9ddd392f308b6117596141fe62ff9e593c97b574",
+    "sourceCommit": "613d5262e9af9c28c79ae7622a9f6ef3c5067007",
     "digest": "6eb6ed3d49a71b4696b3de94ded50876b71e186f6ba5fdf670041364d8a853fe"
   }
 }

package/runner/prepare.mjs

@@ -35,7 +35,14 @@ for (const group of ['dependencies', 'optionalDependencies', 'peerDependencies',
 // The standard's client cases and the pack's declared SDK examples need their pinned development clients too.
 // This installs data only; candidate scripts never execute in the networked preparation phase.
 const standardManifest = read('/opt/catalog/node_modules/@volter/twin-standard/package.json');
-const dependencies = { ...standardManifest.devDependencies, ...pack.devDependencies, ...policy.tools, [s.package]: s.version };
+// Evaluator client cases run against the released standard's clients. The candidate's development manifest
+// supplies additional clients; it cannot replace one used by that evaluator. Retain collisions as conditions,
+// rather than claiming these cases measured the candidate's different SDK range.
+const clientDependencyChoices = Object.entries(pack.devDependencies ?? {}).flatMap(([name, candidate]) => {
+  const evaluator = standardManifest.devDependencies?.[name];
+  return evaluator && evaluator !== candidate ? [{ name, candidate, evaluator, selected: evaluator }] : [];
+});
+const dependencies = { ...pack.devDependencies, ...standardManifest.devDependencies, ...policy.tools, [s.package]: s.version };
 requireThat(!Object.hasOwn(policy.tools, s.package), 'submission collides with evaluator tooling');
 write('/work/package.json', { name: 'catalog-assessment', private: true, dependencies });
 await installationMetadata(s, policy.registry);
@@ -83,5 +90,5 @@ const packageMetadata = {
   repositoryDirectory: typeof pack.repository === 'object' ? pack.repository.directory ?? null : null,
   bugs: typeof pack.bugs === 'string' ? pack.bugs : pack.bugs?.url ?? null,
 };
-write('/work/prepared.json', { schemaVersion: 1, submission: s, integrity: s.integrity, provenance, packageMetadata, dependencyLockSha256: digest(readFileSync('/work/package-lock.json', 'utf8')), clientSdkLocks, tools: policy.tools });
+write('/work/prepared.json', { schemaVersion: 1, submission: s, integrity: s.integrity, provenance, packageMetadata, dependencyLockSha256: digest(readFileSync('/work/package-lock.json', 'utf8')), clientSdkLocks, clientDependencyChoices, tools: policy.tools });
 write('/work/world.json', { id: 'catalog-assessment', network: { egress: [] }, services: [] });