@volter/twin-catalog 0.2.6 → 0.2.8

package/lib/browse.d.mts

@@ -19,6 +19,9 @@ export type Measurements = {
   browser: {
     measured: true;
     target: string;
+    responseObservation?: string;
+    applicationOriginCorsCoverage?: unknown | null;
+    cookieJarCoverage?: unknown | null;
     version: string;
     answered?: number;
     failures?: unknown[];

package/lib/registry.mjs

@@ -57,6 +57,26 @@ export function registryURL(value, registry) {
   requireThat(url.origin === new URL(registry).origin && !url.username && !url.password && !url.hash, 'artifact and attestation URLs must remain on the policy registry');
   return url.href;
 }
+/** Artifact bytes can propagate after exact-version metadata. Retry 404 only, never a conflicting artifact. */
+export async function artifactBytes(doc, submission, registry, fetcher = fetch, confirmation = {}) {
+  const { now = Date.now, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), windowMs = 600_000, intervalMs = 15_000 } = confirmation;
+  // Same read-only propagation bound as docs/measurements/registry-confirmation.json.
+  requireThat(Number.isFinite(windowMs) && windowMs > 0 && Number.isFinite(intervalMs) && intervalMs > 0, 'invalid registry confirmation timing');
+  requireThat(doc.dist?.integrity === submission.integrity, 'artifact metadata integrity mismatch');
+  const url = registryURL(doc.dist.tarball, registry), deadline = now() + windowMs;
+  for (;;) {
+    const response = await fetcher(url, { redirect: 'error' });
+    if (response.ok) {
+      const bytes = Buffer.from(await response.arrayBuffer());
+      verifyArtifact(bytes, submission, doc);
+      return bytes;
+    }
+    requireThat(response.status === 404, `tarball: HTTP ${response.status}`);
+    const remaining = deadline - now();
+    requireThat(remaining > 0, 'published tarball is not yet visible; retry confirmation, never upload this version again');
+    await sleep(Math.min(intervalMs, remaining));
+  }
+}
 export const integrityOf = (bytes) => `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
 export function verifyArtifact(bytes, submission, doc) {
   requireThat(doc.dist?.integrity === submission.integrity && integrityOf(bytes) === submission.integrity, 'artifact integrity mismatch');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-catalog",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "The moderated twin distribution: approved versions and submission tooling for independent publishers.",
   "type": "module",
   "bin": {
@@ -38,7 +38,7 @@
     "evidence"
   ],
   "catalog": {
-    "sourceCommit": "0b244a51e879003463f966bdd53ee28a3e6a13ac",
-    "digest": "40d2cedb009e33347073016fc48027327d4594da7d3162abeafc0a298a6f9aeb"
+    "sourceCommit": "c25260a59113213049ec5d482da2c9da77dbccf4",
+    "digest": "59c803c33c856ddc8f6d0d5a90894f8aa5719076a485dd2ae95f638f2e2d7fcd"
   }
 }

package/policy.json

@@ -2,9 +2,9 @@
   "schemaVersion": 1,
   "registry": "https://registry.npmjs.org",
   "tools": {
-    "@volter/world-core": "3.0.69",
-    "@volter/world-runtime": "3.0.69",
-    "@volter/twin-standard": "1.0.61",
+    "@volter/world-core": "3.0.72",
+    "@volter/world-runtime": "3.0.72",
+    "@volter/twin-standard": "1.0.64",
     "playwright": "1.63.0"
   },
   "bun": "1.3.11",

package/runner/prepare.mjs

@@ -7,16 +7,13 @@ import { x } from 'tar';
 import semver from 'semver';
 import { verify as verifyBundle } from 'sigstore';
 import { read, write, requireThat, digest } from '../lib/model.mjs';
-import { metadata, installationMetadata, registryURL, verifyArtifact, verifiedProvenance } from '../lib/registry.mjs';
+import { metadata, installationMetadata, registryURL, artifactBytes, verifiedProvenance } from '../lib/registry.mjs';
 
 const input = read('/input/input.json');
 const { submission: s, source, policy } = input;
 const doc = await metadata(s.package, s.version, policy.registry, fetch, {});
 requireThat(doc.dist?.attestations?.url, 'npm provenance required; this version has no attestation');
-const tarResponse = await fetch(registryURL(doc.dist.tarball, policy.registry), { redirect: 'error' });
-requireThat(tarResponse.ok, `tarball: HTTP ${tarResponse.status}`);
-const bytes = Buffer.from(await tarResponse.arrayBuffer());
-verifyArtifact(bytes, s, doc);
+const bytes = await artifactBytes(doc, s, policy.registry);
 writeFileSync('/work/artifact.tgz', bytes);
 mkdirSync('/work/unpacked', { recursive: true });
 await x({ file: '/work/artifact.tgz', cwd: '/work/unpacked', strict: true, filter: (path, entry) => {

package/vendors/anthropic.json

@@ -0,0 +1,20 @@
+{
+  "vendor": "anthropic",
+  "packages": [
+    {
+      "name": "@volter/twin-anthropic",
+      "source": "twin-packs-open",
+      "versions": [
+        {
+          "version": "1.0.3",
+          "status": "live",
+          "integrity": "sha512-B7n7lnObG0nsmpkb4urtxZVixhmw4Gg1B8Xh13Oj2qj2WUulymAjpJ0sghCTdFUi+RXX/tSY43rDX1AWTJexJQ==",
+          "submission": "2c123aa480c3d787e21218b005870509fe48379ba534df5a2eed8d2db5956596",
+          "commit": "d22a0fed4cf0891f706d99842b7d5b76f9db34f7",
+          "at": "2026-10-06T16:43:29Z",
+          "by": "moderated-merge"
+        }
+      ]
+    }
+  ]
+}