@volter/twin-standard 1.0.0

package/dist/src/p3-rules.js

@@ -0,0 +1,43 @@
+// The architecture's mechanical rules for a derived pack's own code (docs/contributing/architecture.md, "What an author
+// writes, and how"), checked by the derive over `src/` (generated files aside). Each was broken by copying: the rules the
+// tools did not check spread from one pack to thirty (the P3 drift pass, 2026-09-30). A line may record why it is the
+// exception, in a `// p3: <reason>` comment on it or on the line before, and the check passes it.
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+const RULES = [
+    // ids come from ctx.mint: never a row count made into an id, a number or a label's nonce
+    { rule: 'an id or number from a row count (use ctx.mint)', test: (l) => /\b(rowsRaw|rows|rowsOf)\([^;]*?\)(\s*\.filter\([^;]*?\))?\.length\s*\+\s*1\b/.test(l) || /\b1\s*\+\s*[\w.]*\b(rowsRaw|rows|rowsOf)\([^;]*?\)(\s*\.filter\([^;]*?\))?\.length\b/.test(l) },
+    // the twin's own URL is ctx.publicBase
+    { rule: "the twin's URL from the request (use ctx.publicBase)", test: (l) => /request\.url\)\.origin/.test(l) },
+    // signing, digests and randomness are the kernel's (ctx.crypto, world-core's exports)
+    { rule: 'node:crypto in a pack (use ctx.crypto or the kernel\'s digest)', test: (l) => /from ['"](node:)?crypto['"]|require\(['"](node:)?crypto['"]\)/.test(l) },
+    // a webhook is the manifest's events; ctx.deliver is for a message that is no declared event (a push notification)
+    { rule: 'ctx.deliver where the manifest\'s events belong (or record why)', test: (l) => /ctx\.deliver\(/.test(l) },
+    // an object's bytes are ctx.blobs, never a row's field
+    { rule: "bytes kept in a row (use ctx.blobs)", test: (l) => /ctx\.(write|record)\([^;]*toString\(['"]base64['"]\)/.test(l) || /\b_bytes\s*:/.test(l) },
+    // a secret the vendor issues is drawn from ctx.secret, never computed from ids
+    { rule: 'a secret computed from ids (draw it from ctx.secret)', test: (l) => /(\b(const|let)\s+[a-zA-Z]*(secret|Secret|token|Token|password|Password|hmac|Hmac)\b\s*=|[{,]\s*(secret|token|password|hmac|api_key|client_secret|access_token|refresh_token)\s*:(?!\s*(string|number|unknown)\b))[^;,]*\b(digest|uuidFrom|lettersFrom|sha256)\(/.test(l) && !/secret\(|Secret\(|keyValue\(|tokenValue\(|credential\(/.test(l) },
+];
+const files = (dir) => readdirSync(dir).flatMap((n) => {
+    const p = join(dir, n);
+    if (statSync(p).isDirectory())
+        return n === 'generated' || n === 'node_modules' ? [] : files(p);
+    return /\.(ts|tsx)$/.test(n) && !n.endsWith('.test.ts') ? [p] : [];
+});
+/** Every line of a unit's `src/` that breaks a rule and does not record why. */
+export function p3RuleHits(unit) {
+    const src = join(unit, 'src');
+    const out = [];
+    for (const f of files(src)) {
+        const lines = readFileSync(f, 'utf8').split('\n');
+        lines.forEach((text, i) => {
+            if (/^\s*(\/\/|\*|\/\*)/.test(text))
+                return;
+            const excused = /\/\/ p3: \S/.test(text) || /\/\/ p3: \S/.test(lines[i - 1] ?? '');
+            for (const r of RULES)
+                if (!excused && r.test(text))
+                    out.push({ file: relative(unit, f), line: i + 1, rule: r.rule, text: text.trim().slice(0, 140) });
+        });
+    }
+    return out;
+}

package/dist/src/protocol-3.d.ts

@@ -0,0 +1,5 @@
+import type { Standard } from './types.js';
+export declare const handlerName: (operationId: string) => string;
+/** Named by "The grade" and decided by no tool yet: counted in no grade until a version of this standard checks them. */
+export declare const PLANNED: string[];
+export declare const protocol3: Standard;