@volter/twin-catalog 0.2.27 → 0.2.29

package/lib/browse.d.mts

@@ -7,6 +7,19 @@ export type Coverage = {
 };
 export type Replay = { equal: boolean; runs: number; firstSha256: string; secondSha256: string };
 export type Measurements = {
+  consumer: null | {
+    measured: boolean;
+    passed: boolean;
+    scope: string | null;
+    fixture: string | null;
+    sdkDependencies: Record<string, string> | null;
+    tools: Record<string, string> | null;
+    clock: Record<string, unknown> | null;
+    retainedReadback: boolean | null;
+    retentionNotApplicable: string | null;
+    teardownVerified: boolean | null;
+    failures: string[] | null;
+  };
   scope: string | null;
   surface: { total: number; served: number; gap: number } | null;
   operationCoverage: Coverage | null;

package/lib/browse.mjs

@@ -130,6 +130,16 @@ export function browse(root, { vendor, package: packageName, integrity = null }
                     operationCoverage: quick?.operationCoverage ?? null, servedOperations: quick?.servedOperations ?? null,
                     steps: quick?.steps ?? null, answered: quick?.answered ?? null, failures: quick?.failures ?? null,
                     replay: quick?.replay ?? null, conformance: bound.report.conformance ?? null,
+                    consumer: bound.report.consumer ? {
+                      measured: bound.report.consumer.measured === true, passed: bound.report.consumer.passed === true,
+                      scope: bound.report.consumer.scope ?? null, fixture: bound.report.consumer.fixture ?? null,
+                      sdkDependencies: bound.envelope.prepared?.consumerFixture?.dependencies ?? null,
+                      tools: bound.report.consumer.tools ?? null, clock: bound.report.consumer.clock ?? null,
+                      retainedReadback: bound.report.consumer.retainedReadback ?? null,
+                      retentionNotApplicable: bound.report.consumer.retentionNotApplicable ?? null,
+                      teardownVerified: bound.report.consumer.teardownVerified ?? null,
+                      failures: bound.report.consumer.failures ?? null,
+                    } : null,
                     browser: browser?.measured === true ? browser : null,
                     codeCoverage: quick?.codeCoverage ?? null, stateTransitionCoverage: quick?.stateTransitionCoverage ?? null,
                     domCoverage: browser?.domCoverage ?? null, comparison: bound.report.comparison ?? null } : null };

package/lib/runner.mjs

@@ -25,7 +25,8 @@ export function withContainer(root, input, output, execute, { spawn = spawnSync
   let volume = false;
   try {
     const tools = input.policy.tools;
-    run(['build', '--iidfile', imageFile, '--build-arg', `NODE_IMAGE=${input.policy.nodeImage}`, '--build-arg', `BUN_VERSION=${input.policy.bun}`, '--build-arg', `STANDARD_VERSION=${tools['@volter/twin-standard']}`, '--build-arg', `CORE_VERSION=${tools['@volter/world-core']}`, '--build-arg', `RUNTIME_VERSION=${tools['@volter/world-runtime']}`, '--build-arg', `PLAYWRIGHT_VERSION=${tools.playwright}`, '-f', join(root, 'runner/Dockerfile'), root]);
+    requireThat(tools['@volter/world'], 'policy must pin the product CLI for installed customer workflows');
+    run(['build', '--iidfile', imageFile, '--build-arg', `NODE_IMAGE=${input.policy.nodeImage}`, '--build-arg', `BUN_VERSION=${input.policy.bun}`, '--build-arg', `STANDARD_VERSION=${tools['@volter/twin-standard']}`, '--build-arg', `CORE_VERSION=${tools['@volter/world-core']}`, '--build-arg', `RUNTIME_VERSION=${tools['@volter/world-runtime']}`, '--build-arg', `CLI_VERSION=${tools['@volter/world']}`, '--build-arg', `PLAYWRIGHT_VERSION=${tools.playwright}`, '-f', join(root, 'runner/Dockerfile'), root]);
     const image = readFileSync(imageFile, 'utf8').trim();
     requireThat(/^sha256:[a-f0-9]{64}$/.test(image), 'container image has no immutable identity');
     run(['volume', 'create', '--label', `twin-catalog.owner=${id}`, '--label', `twin-catalog.run=${runOwner}`, id]); volume = true;
@@ -56,12 +57,15 @@ export function evaluate(root, input, output, options = {}) {
       const lock = run([...common, '--network', 'none', image, '-e', 'process.stdout.write(require("fs").readFileSync("/work/package-lock.json","utf8"))']).stdout;
       requireThat(digest(lock) === prepared.dependencyLockSha256, 'dependency lock identity changed');
       write(`${output}.lock.json`, JSON.parse(lock));
+      const consumerLock = run([...common, '--network', 'none', image, '-e', 'process.stdout.write(require("fs").readFileSync("/work/customer-app/package-lock.json","utf8"))']).stdout;
+      requireThat(digest(consumerLock) === prepared.consumerDependencyLockSha256, 'customer SDK lock identity changed');
+      write(`${output}.consumer-lock.json`, JSON.parse(consumerLock));
       phase = 'offline-assessment';
       const result = run([...common, '--network', 'none', '--entrypoint', 'bun', image, '/opt/catalog/node_modules/@volter/world-runtime/src/cli.ts', 'run', '/work/world.json', '--root', '/work', '--env-out', '/work/world.env', '--owner', owner, '--', 'bun', '/opt/catalog/runner/evaluate.mjs'], true);
       const reportRead = run([...common, '--network', 'none', image, '-e', 'process.stdout.write(require("fs").readFileSync("/work/report.json","utf8"))'], true);
       const report = reportRead.status === 0 ? JSON.parse(reportRead.stdout) : null;
       requireThat(!report || (report.schemaVersion === 1 && report.package === input.submission.package && report.version === input.submission.version && report.integrity === input.submission.integrity), 'evaluator returned a mismatched report');
-      const envelope = { schemaVersion: 1, inputSha256: digest(input), input, image, prepared, dependencyLock: JSON.parse(lock), status: result.status === 0 && report?.ready === true ? 'ready' : 'changes-needed', report, evaluatedAt: new Date().toISOString() };
+      const envelope = { schemaVersion: 1, inputSha256: digest(input), input, image, prepared, dependencyLock: JSON.parse(lock), consumerDependencyLock: JSON.parse(consumerLock), status: result.status === 0 && report?.ready === true ? 'ready' : 'changes-needed', report, evaluatedAt: new Date().toISOString() };
       write(output, envelope);
       return envelope;
     }, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-catalog",
-  "version": "0.2.27",
+  "version": "0.2.29",
   "description": "The moderated twin distribution: approved versions and submission tooling for independent publishers.",
   "type": "module",
   "bin": {
@@ -38,7 +38,7 @@
     "evidence"
   ],
   "catalog": {
-    "sourceCommit": "c27c7eb3ddb06ebc3dd9f28005e5912d9611f4c8",
-    "digest": "444d6dddb05c1a2a6bb3a145d485325213664f442d4eaf61154942d2e918db0d"
+    "sourceCommit": "251b4771b7e0f8f262041cc47f436d8b4f785537",
+    "digest": "3195c901d6068ef7be8e9e23676b9b6ec58fb4e50c2d5604bbea390fefec9fdb"
   }
 }

package/policy.json

@@ -2,10 +2,11 @@
   "schemaVersion": 1,
   "registry": "https://registry.npmjs.org",
   "tools": {
-    "@volter/world-core": "3.0.98",
-    "@volter/world-runtime": "3.0.98",
-    "@volter/twin-standard": "1.0.90",
-    "playwright": "1.63.0"
+    "@volter/world-core": "3.0.100",
+    "@volter/world-runtime": "3.0.100",
+    "@volter/twin-standard": "1.0.92",
+    "playwright": "1.63.0",
+    "@volter/world": "3.0.100"
   },
   "bun": "1.4.2",
   "nodeImage": "node:24-bookworm-slim",

package/runner/Dockerfile

@@ -4,13 +4,18 @@ ARG BUN_VERSION=1.3.11
 ARG STANDARD_VERSION=1.0.37
 ARG CORE_VERSION=3.0.45
 ARG RUNTIME_VERSION=3.0.45
+ARG CLI_VERSION
 ARG PLAYWRIGHT_VERSION=1.63.0
 ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright
-RUN apt-get update && apt-get install -y --no-install-recommends git openssl ca-certificates libfaketime && rm -rf /var/lib/apt/lists/*
+# Install native PostgreSQL tools without a distribution-owned cluster; each World owns its own data and lifetime.
+# https://manpages.debian.org/bookworm/postgresql-common/pg_createcluster.1.en.html#DEFAULT_VALUES
+RUN mkdir -p /etc/postgresql-common && printf 'create_main_cluster = false\n' > /etc/postgresql-common/createcluster.conf \
+    && apt-get update && apt-get install -y --no-install-recommends git openssl ca-certificates libfaketime postgresql-15 && rm -rf /var/lib/apt/lists/*
+ENV VOLTER_WORLD_POSTGRES_BIN=/usr/lib/postgresql/15/bin
 WORKDIR /opt/catalog
 RUN npm install --ignore-scripts --no-audit --no-fund --save-exact \
     @oven/bun-linux-x64@${BUN_VERSION} @volter/twin-standard@${STANDARD_VERSION} \
-    @volter/world-core@${CORE_VERSION} @volter/world-runtime@${RUNTIME_VERSION} tar@7.5.7 semver@7.8.5 sigstore@4.1.1 playwright@${PLAYWRIGHT_VERSION}
+    @volter/world-core@${CORE_VERSION} @volter/world-runtime@${RUNTIME_VERSION} @volter/world@${CLI_VERSION} tar@7.5.7 semver@7.8.5 sigstore@4.1.1 playwright@${PLAYWRIGHT_VERSION}
 ENV PATH="/opt/catalog/node_modules/@oven/bun-linux-x64/bin:/opt/catalog/node_modules/.bin:${PATH}"
 RUN ./node_modules/.bin/playwright install --with-deps chromium
 COPY lib /opt/catalog/lib

package/runner/evaluate.mjs

@@ -7,9 +7,10 @@ requireThat(Boolean(process.env.VOLTER_WORLD), 'evaluation must run inside a Wor
 const { submission: s } = read('/input/input.json');
 const requireFromPack = createRequire('/work/package.json');
 const { assessPack } = await import(requireFromPack.resolve('@volter/twin-standard'));
-const assessment = await assessPack(join('/work/packs', s.vendor), { browser: true });
+const prepared = read('/work/prepared.json');
+const assessment = await assessPack(join('/work/packs', s.vendor), { browser: true, consumer: prepared.consumer });
 requireThat(assessment.package === s.package && assessment.version === s.version && assessment.vendor === s.vendor, 'assessment returned a different artifact identity');
-const report = { ...assessment, integrity: s.integrity, prepared: read('/work/prepared.json') };
+const report = { ...assessment, integrity: s.integrity, prepared };
 report.comparison = compareReports(report, existsSync('/input/baseline.json') ? read('/input/baseline.json') : null);
 write('/work/report.json', report);
 process.exit(report.ready ? 0 : 1);

package/runner/prepare.mjs

@@ -81,6 +81,18 @@ const provenance = await verifiedProvenance(await response.json(), source, bytes
 // Keep a vendor-named package directory for the standard's public directory API; preserve the installed artifact.
 mkdirSync('/work/packs', { recursive: true });
 cpSync(join('/work/node_modules', s.package), join('/work/packs', s.vendor), { recursive: true });
+const { prepareConsumerApp } = await import(evaluatorRequire.resolve('@volter/twin-standard'));
+const appDir = '/work/customer-app';
+const consumerFixture = prepareConsumerApp(join('/work/packs', s.vendor), appDir);
+const appInstall = spawnSync('npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--registry', policy.registry], { cwd: appDir, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+requireThat(appInstall.status === 0, `customer SDK preparation failed: ${appInstall.stderr}`);
+const consumerLock = read(join(appDir, 'package-lock.json'));
+for (const [path, entry] of Object.entries(consumerLock.packages ?? {})) {
+  if (!path) continue;
+  requireThat(!entry.link && entry.resolved && entry.integrity, `${path}: customer dependency is not a locked registry artifact`);
+  registryURL(entry.resolved, policy.registry);
+}
+const consumer = { appDir, cli: '/work/node_modules/.bin/volter', artifactIntegrity: s.integrity };
 // Retain listing facts from these exact bytes, never the registry's moving latest metadata.
 const packageMetadata = {
   description: typeof pack.description === 'string' ? pack.description : null,
@@ -90,5 +102,5 @@ const packageMetadata = {
   repositoryDirectory: typeof pack.repository === 'object' ? pack.repository.directory ?? null : null,
   bugs: typeof pack.bugs === 'string' ? pack.bugs : pack.bugs?.url ?? null,
 };
-write('/work/prepared.json', { schemaVersion: 1, submission: s, integrity: s.integrity, provenance, packageMetadata, dependencyLockSha256: digest(readFileSync('/work/package-lock.json', 'utf8')), clientSdkLocks, clientDependencyChoices, tools: policy.tools });
+write('/work/prepared.json', { schemaVersion: 1, submission: s, integrity: s.integrity, provenance, packageMetadata, dependencyLockSha256: digest(readFileSync('/work/package-lock.json', 'utf8')), clientSdkLocks, clientDependencyChoices, tools: policy.tools, consumer, consumerFixture, consumerDependencyLockSha256: digest(readFileSync(join(appDir, 'package-lock.json'), 'utf8')) });
 write('/work/world.json', { id: 'catalog-assessment', network: { egress: [] }, services: [] });

package/vendors/clerk.json

@@ -0,0 +1,20 @@
+{
+  "vendor": "clerk",
+  "packages": [
+    {
+      "name": "@volter/twin-clerk",
+      "source": "twin-packs-open",
+      "versions": [
+        {
+          "version": "1.0.2",
+          "status": "live",
+          "integrity": "sha512-3HZEt5czGpF/wEWcoDk+1/2Ln6J4Tg00kqFbgWTJ6VP8th5myZ1c9x2QowBmFcSdmdp0U00HMMxD7VJ4ucSkxw==",
+          "submission": "fa756dfc21662a70679a660dd88fcb2b4f8bad30f408f1134cd87b0668289fc6",
+          "commit": "c7c9a81cfb79e7410ddf7b26a51c2359647cd1a8",
+          "at": "2026-10-07T01:03:20Z",
+          "by": "moderated-merge"
+        }
+      ]
+    }
+  ]
+}