@volter/twin-catalog 0.2.29 → 0.2.31
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/catalog.json +1 -1
- package/package.json +2 -2
- package/policy.json +4 -4
- package/runner/prepare.mjs +10 -3
package/catalog.json
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@volter/twin-catalog",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.31",
|
|
4
4
|
"description": "The moderated twin distribution: approved versions and submission tooling for independent publishers.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
"evidence"
|
|
39
39
|
],
|
|
40
40
|
"catalog": {
|
|
41
|
-
"sourceCommit": "
|
|
41
|
+
"sourceCommit": "77dcff41838da44336f6025808295100caa53d14",
|
|
42
42
|
"digest": "3195c901d6068ef7be8e9e23676b9b6ec58fb4e50c2d5604bbea390fefec9fdb"
|
|
43
43
|
}
|
|
44
44
|
}
|
package/policy.json
CHANGED
|
@@ -2,11 +2,11 @@
|
|
|
2
2
|
"schemaVersion": 1,
|
|
3
3
|
"registry": "https://registry.npmjs.org",
|
|
4
4
|
"tools": {
|
|
5
|
-
"@volter/world-core": "3.0.
|
|
6
|
-
"@volter/world-runtime": "3.0.
|
|
7
|
-
"@volter/twin-standard": "1.0.
|
|
5
|
+
"@volter/world-core": "3.0.105",
|
|
6
|
+
"@volter/world-runtime": "3.0.105",
|
|
7
|
+
"@volter/twin-standard": "1.0.97",
|
|
8
8
|
"playwright": "1.63.0",
|
|
9
|
-
"@volter/world": "3.0.
|
|
9
|
+
"@volter/world": "3.0.105"
|
|
10
10
|
},
|
|
11
11
|
"bun": "1.4.2",
|
|
12
12
|
"nodeImage": "node:24-bookworm-slim",
|
package/runner/prepare.mjs
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
// No credentials enter this container. This phase downloads data; scripts are disabled.
|
|
2
|
-
import { readFileSync, writeFileSync, mkdirSync, cpSync } from 'node:fs';
|
|
3
|
-
import { join } from 'node:path';
|
|
2
|
+
import { readFileSync, writeFileSync, mkdirSync, cpSync, realpathSync } from 'node:fs';
|
|
3
|
+
import { join, relative } from 'node:path';
|
|
4
4
|
import { spawnSync } from 'node:child_process';
|
|
5
5
|
import { createRequire } from 'node:module';
|
|
6
6
|
import { x } from 'tar';
|
|
@@ -92,7 +92,14 @@ for (const [path, entry] of Object.entries(consumerLock.packages ?? {})) {
|
|
|
92
92
|
requireThat(!entry.link && entry.resolved && entry.integrity, `${path}: customer dependency is not a locked registry artifact`);
|
|
93
93
|
registryURL(entry.resolved, policy.registry);
|
|
94
94
|
}
|
|
95
|
-
|
|
95
|
+
// Other dependencies can own the flattened volter shortcut; use the exact product's declared entry.
|
|
96
|
+
const productRoot = '/work/node_modules/@volter/world';
|
|
97
|
+
const product = read(join(productRoot, 'package.json'));
|
|
98
|
+
requireThat(product.name === '@volter/world' && product.version === policy.tools['@volter/world'], 'customer CLI differs from the product pin');
|
|
99
|
+
requireThat(typeof product.bin?.volter === 'string', 'product has no declared volter entry');
|
|
100
|
+
const cli = realpathSync(join(productRoot, product.bin.volter));
|
|
101
|
+
requireThat(!relative(realpathSync(productRoot), cli).startsWith('..'), 'CLI entry is outside the installed product');
|
|
102
|
+
const consumer = { appDir, cli, artifactIntegrity: s.integrity };
|
|
96
103
|
// Retain listing facts from these exact bytes, never the registry's moving latest metadata.
|
|
97
104
|
const packageMetadata = {
|
|
98
105
|
description: typeof pack.description === 'string' ? pack.description : null,
|