@volter/twin-catalog 0.2.21 → 0.2.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-catalog",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "description": "The moderated twin distribution: approved versions and submission tooling for independent publishers.",
   "type": "module",
   "bin": {
@@ -38,7 +38,7 @@
     "evidence"
   ],
   "catalog": {
-    "sourceCommit": "9ddd392f308b6117596141fe62ff9e593c97b574",
-    "digest": "6eb6ed3d49a71b4696b3de94ded50876b71e186f6ba5fdf670041364d8a853fe"
+    "sourceCommit": "469e90a6e6093cba4bb7d4272efbddddc4f36ddf",
+    "digest": "4b2cd196c82d39e60f2e52fc81cd6123570fa615435404f26d96b5a976dd67ac"
   }
 }

package/runner/prepare.mjs

@@ -35,7 +35,14 @@ for (const group of ['dependencies', 'optionalDependencies', 'peerDependencies',
 // The standard's client cases and the pack's declared SDK examples need their pinned development clients too.
 // This installs data only; candidate scripts never execute in the networked preparation phase.
 const standardManifest = read('/opt/catalog/node_modules/@volter/twin-standard/package.json');
-const dependencies = { ...standardManifest.devDependencies, ...pack.devDependencies, ...policy.tools, [s.package]: s.version };
+// Evaluator client cases run against the released standard's clients. The candidate's development manifest
+// supplies additional clients; it cannot replace one used by that evaluator. Retain collisions as conditions,
+// rather than claiming these cases measured the candidate's different SDK range.
+const clientDependencyChoices = Object.entries(pack.devDependencies ?? {}).flatMap(([name, candidate]) => {
+  const evaluator = standardManifest.devDependencies?.[name];
+  return evaluator && evaluator !== candidate ? [{ name, candidate, evaluator, selected: evaluator }] : [];
+});
+const dependencies = { ...pack.devDependencies, ...standardManifest.devDependencies, ...policy.tools, [s.package]: s.version };
 requireThat(!Object.hasOwn(policy.tools, s.package), 'submission collides with evaluator tooling');
 write('/work/package.json', { name: 'catalog-assessment', private: true, dependencies });
 await installationMetadata(s, policy.registry);
@@ -83,5 +90,5 @@ const packageMetadata = {
   repositoryDirectory: typeof pack.repository === 'object' ? pack.repository.directory ?? null : null,
   bugs: typeof pack.bugs === 'string' ? pack.bugs : pack.bugs?.url ?? null,
 };
-write('/work/prepared.json', { schemaVersion: 1, submission: s, integrity: s.integrity, provenance, packageMetadata, dependencyLockSha256: digest(readFileSync('/work/package-lock.json', 'utf8')), clientSdkLocks, tools: policy.tools });
+write('/work/prepared.json', { schemaVersion: 1, submission: s, integrity: s.integrity, provenance, packageMetadata, dependencyLockSha256: digest(readFileSync('/work/package-lock.json', 'utf8')), clientSdkLocks, clientDependencyChoices, tools: policy.tools });
 write('/work/world.json', { id: 'catalog-assessment', network: { egress: [] }, services: [] });

package/vendors/openai.json

@@ -0,0 +1,20 @@
+{
+  "vendor": "openai",
+  "packages": [
+    {
+      "name": "@volter/twin-openai",
+      "source": "twin-packs-open",
+      "versions": [
+        {
+          "version": "3.0.2",
+          "status": "live",
+          "integrity": "sha512-DbNSre3DPt6mY1VKRX9Tdevl2Gg0l2vi9Jx7FGH23Xl3WEV+tWCyiUMDSDc8uoCBT0p1VUR7xz8svjRDukDORw==",
+          "submission": "6f9f4c4659dc8d86e42363050c0ee444e4f1e05409866bf4ee3b54d12a3c2cc2",
+          "commit": "2064bfcc2bc3ac5db0cfbb215fd83ff931d9cb10",
+          "at": "2026-10-06T23:22:55Z",
+          "by": "moderated-merge"
+        }
+      ]
+    }
+  ]
+}