@volter/twin-catalog 0.2.30 → 0.2.32

package/catalog.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceCommit": "0053b5936eec781b314e51a78486e05d39523ee1",
+  "sourceCommit": "8139c5d489b73762bf5ba34d4cf37235eb30bb46",
   "digest": "3195c901d6068ef7be8e9e23676b9b6ec58fb4e50c2d5604bbea390fefec9fdb",
   "versions": [
     {

package/docs/contributing.md

@@ -16,7 +16,10 @@ bunx --bun twin-standard create stripe --init stripe --package @example/payments
 The generated files contain explicit fill markers. Author the vendored spec and its provenance, demand, manifest,
 stored resource states, decision table, handlers and customer journey in the standard's required order. Start the
 outline from the vendor quickstart and pinned SDK's ordinary default requests, app environment and issued identity.
-Walk that customer entry while building; reducing its requested fields to match the twin does not establish compatibility. The package
+Write the executable customer entry as `journeys/first-use.json` at this outline stage, before implementing
+resource semantics; its format is below. Walk it through `runConsumerWorkflow` while building, using a new
+prepared app for each walk. Fix the pack or shared mechanism when an ordinary SDK call fails; keep the SDK
+request unchanged. Source coverage reports describe source journeys and do not establish installed readiness. The package
 README describes its vendor surface, refusals and limits. Declare your own public GitHub repository and license in
 package.json. Complete source requirements before derivation:
 
@@ -34,9 +37,9 @@ consumers while retaining the TypeScript source the pinned standard reads. Use T
 bin at their compiled entrypoints. A `files` list includes `src`, `dist`, `generated`, `spec`, `journeys`, README and
 LICENSE. A build and `npm pack --dry-run` must show those paths; no platform-specific prepack script is required.
 
-## Assess before submitting
+## Customer entry and release qualification
 
-Package the customer entry in `journeys/first-use.json`. It has `schemaVersion: 1`, the upstream `source`, an
+Author the customer entry with the outline, then package it in `journeys/first-use.json`. It has `schemaVersion: 1`, the upstream `source`, an
 `about` describing its scope, and a `files` map of relative paths to text. Include `package.json` with exact registry
 SDK dependencies, `.env.example` with the names the app reads, and its unchanged client script with result
 assertions. `run` is an argument array such as `["node", "workflow.mjs"]`. For stored workflows,
@@ -54,8 +57,9 @@ twin-standard prepare-consumer <installed pack dir> --app <new app dir> --cli <a
 npm install --prefix <new app dir> --ignore-scripts --no-audit --no-fund
 ```
 
-This preparation writes fixture files only; SDK dependency installation precedes offline execution. The product
-CLI must resolve the installed candidate through that app's parent dependency directory. For the final assessment,
+This preparation writes fixture files only; SDK dependency installation precedes offline execution. Select `--cli` from the installed `@volter/world` package's declared `bin.volter`, rather than the shared
+`node_modules/.bin/volter`: another package may claim that shortcut. The runner invokes compiled JavaScript
+through Node and records the actual entrypoint, command and Node version. The product CLI must resolve the installed candidate through that app's parent dependency directory. For the final assessment,
 run the released standard through a World:
 
 Create `assessment.world.config.json`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-catalog",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "description": "The moderated twin distribution: approved versions and submission tooling for independent publishers.",
   "type": "module",
   "bin": {
@@ -38,7 +38,7 @@
     "evidence"
   ],
   "catalog": {
-    "sourceCommit": "0053b5936eec781b314e51a78486e05d39523ee1",
+    "sourceCommit": "8139c5d489b73762bf5ba34d4cf37235eb30bb46",
     "digest": "3195c901d6068ef7be8e9e23676b9b6ec58fb4e50c2d5604bbea390fefec9fdb"
   }
 }

package/policy.json

@@ -2,11 +2,11 @@
   "schemaVersion": 1,
   "registry": "https://registry.npmjs.org",
   "tools": {
-    "@volter/world-core": "3.0.105",
-    "@volter/world-runtime": "3.0.105",
-    "@volter/twin-standard": "1.0.97",
+    "@volter/world-core": "3.0.108",
+    "@volter/world-runtime": "3.0.108",
+    "@volter/twin-standard": "1.0.100",
     "playwright": "1.63.0",
-    "@volter/world": "3.0.105"
+    "@volter/world": "3.0.108"
   },
   "bun": "1.4.2",
   "nodeImage": "node:24-bookworm-slim",

package/runner/prepare.mjs

@@ -1,6 +1,6 @@
 // No credentials enter this container. This phase downloads data; scripts are disabled.
-import { readFileSync, writeFileSync, mkdirSync, cpSync } from 'node:fs';
-import { join } from 'node:path';
+import { readFileSync, writeFileSync, mkdirSync, cpSync, realpathSync } from 'node:fs';
+import { join, relative } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { x } from 'tar';
@@ -92,7 +92,14 @@ for (const [path, entry] of Object.entries(consumerLock.packages ?? {})) {
   requireThat(!entry.link && entry.resolved && entry.integrity, `${path}: customer dependency is not a locked registry artifact`);
   registryURL(entry.resolved, policy.registry);
 }
-const consumer = { appDir, cli: '/work/node_modules/.bin/volter', artifactIntegrity: s.integrity };
+// Other dependencies can own the flattened volter shortcut; use the exact product's declared entry.
+const productRoot = '/work/node_modules/@volter/world';
+const product = read(join(productRoot, 'package.json'));
+requireThat(product.name === '@volter/world' && product.version === policy.tools['@volter/world'], 'customer CLI differs from the product pin');
+requireThat(typeof product.bin?.volter === 'string', 'product has no declared volter entry');
+const cli = realpathSync(join(productRoot, product.bin.volter));
+requireThat(!relative(realpathSync(productRoot), cli).startsWith('..'), 'CLI entry is outside the installed product');
+const consumer = { appDir, cli, artifactIntegrity: s.integrity };
 // Retain listing facts from these exact bytes, never the registry's moving latest metadata.
 const packageMetadata = {
   description: typeof pack.description === 'string' ? pack.description : null,