@volter/twin-standard 1.0.153 → 1.0.154

package/dist/client-sdks/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+packages:
+  - .
+packageImportMethod: hardlink
+nodeLinker: hoisted
+strictPeerDependencies: false
+autoInstallPeers: false
+allowBuilds:
+  esbuild: true
+  workerd: true

package/dist/src/clients/sentry.js

@@ -19,9 +19,9 @@ import { standardPackageFile } from "../package-file.js";
 const SDKS = standardPackageFile('client-sdks/');
 async function sdkOf(name) {
     if (!existsSync(new URL('node_modules/', SDKS))) {
-        const install = spawnSync('bun', ['install', '--frozen-lockfile', '--ignore-scripts'], { cwd: SDKS, stdio: 'inherit' });
+        const install = spawnSync('pnpm', ['install', '--frozen-lockfile', '--ignore-scripts'], { cwd: SDKS, stdio: 'inherit' });
         if (install.status !== 0)
-            throw new Error('client-sdks: bun install --frozen-lockfile failed');
+            throw new Error('client-sdks: pnpm install --frozen-lockfile failed');
     }
     return await import(__rewriteRelativeImportExtension(pathToFileURL(createRequire(new URL('package.json', SDKS)).resolve(name)).href));
 }

package/dist/src/conformance.js

@@ -219,7 +219,7 @@ async function registered(pack, runtime) {
  *  journeys, read from the file list `npm pack` makes. Escaped once: seven packs published their lanes' src without
  *  their spec, so the catalog's conformance of the tarball never read those lanes. */
 function published(pack) {
-    const run = spawnSync('npm', ['pack', '--dry-run', '--json', '--ignore-scripts'], { cwd: pack, encoding: 'utf8' });
+    const run = spawnSync('npm', ['pack', '--force', '--dry-run', '--json', '--ignore-scripts'], { cwd: pack, encoding: 'utf8' });
     let files;
     try {
         files = new Set((JSON.parse(run.stdout)[0]?.files ?? []).map((f) => f.path));

package/dist/src/consumer.js

@@ -6,6 +6,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:pat
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { standardPackageFile } from "./package-file.js";
+import { dependencyLock } from "./dependency-lock.js";
 function packageIdentity(entry, name) {
     let directory = dirname(realpathSync(entry));
     while (true) {
@@ -81,6 +82,8 @@ export function prepareConsumerApp(packDir, appDir, installation) {
     if (existsSync(appDir))
         throw new Error('Consumer app must be a new directory');
     const app = JSON.parse(recipe.files['package.json']);
+    app.packageManager = 'pnpm@12.15.0';
+    app.devEngines = { packageManager: { name: 'pnpm', version: '12.15.0', onFail: 'error' } };
     if (app.scripts || app.workspaces)
         throw new Error('Consumer fixture supplies direct SDK commands, not install scripts or workspace links');
     for (const [name, version] of Object.entries({ ...app.dependencies, ...app.devDependencies, ...app.optionalDependencies })) {
@@ -102,8 +105,9 @@ export function prepareConsumerApp(packDir, appDir, installation) {
         if (Object.hasOwn(app.dependencies ?? {}, metadata.name))
             throw new Error('Consumer SDK dependencies must not substitute the candidate package');
         app.devDependencies = { ...app.devDependencies, '@volter/world-core': tools['@volter/world-core'], [metadata.name]: installation.artifact ? `file:${installation.artifact}` : metadata.version };
-        files.find(([path]) => path === 'package.json')[1] = JSON.stringify(app, null, 2) + '\n';
     }
+    files.find(([path]) => path === 'package.json')[1] = JSON.stringify(app, null, 2) + '\n';
+    files.push(['pnpm-workspace.yaml', 'packages:\n  - .\npackageImportMethod: hardlink\nnodeLinker: hoisted\nautoInstallPeers: false\nstrictPeerDependencies: false\n']);
     mkdirSync(appDir, { recursive: true });
     for (const [path, content] of files) {
         mkdirSync(dirname(join(appDir, path)), { recursive: true });
@@ -127,11 +131,10 @@ export async function runConsumerWorkflow(packDir, options) {
         if (location.startsWith('..') || isAbsolute(location))
             throw new Error(`${name}: consumer resolves an evaluator or ancestor dependency; install it in the app`);
     }
-    const appLockBytes = readFileSync(join(appRoot, 'package-lock.json'));
-    const appLock = JSON.parse(appLockBytes.toString());
-    if (candidate.version !== metadata.version || appLock.packages?.[`node_modules/${metadata.name}`]?.integrity !== options.artifactIntegrity)
+    const appLock = dependencyLock(appRoot), appLockBytes = appLock.bytes;
+    if (candidate.version !== metadata.version || appLock.entry(metadata.name)?.integrity !== options.artifactIntegrity)
         throw new Error('Consumer app candidate does not match the exact assessed artifact');
-    if (kernel.version !== tools['@volter/world-core'] || appLock.packages?.['node_modules/@volter/world-core']?.version !== kernel.version)
+    if (kernel.version !== tools['@volter/world-core'] || appLock.entry('@volter/world-core')?.version !== kernel.version)
         throw new Error('Consumer app kernel does not match the CLI kernel pin');
     const application = { candidate: { package: metadata.name, version: candidate.version, integrity: options.artifactIntegrity }, kernel: { package: '@volter/world-core', version: kernel.version }, dependencyLockSha256: createHash('sha256').update(appLockBytes).digest('hex'), appLocal: true };
     const facts = JSON.parse(readFileSync(join(packDir, 'generated/pack-facts.json'), 'utf8'));

package/dist/src/dependency-lock.d.ts

@@ -0,0 +1,16 @@
+/** The application's selected direct dependency, including the exact installer's integrity. */
+export declare function dependencyLock(root: string): {
+    bytes: NonSharedBuffer;
+    file: string;
+    entry(name: string): {
+        version: any;
+        integrity: any;
+    } | undefined;
+} | {
+    bytes: NonSharedBuffer;
+    file: string;
+    entry(name: string): {
+        version?: string;
+        integrity?: string;
+    } | undefined;
+};

package/dist/src/dependency-lock.js

@@ -0,0 +1,30 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseAllDocuments } from 'yaml';
+/** The application's selected direct dependency, including the exact installer's integrity. */
+export function dependencyLock(root) {
+    const pnpm = join(root, 'pnpm-lock.yaml');
+    if (existsSync(pnpm)) {
+        const bytes = readFileSync(pnpm);
+        const documents = parseAllDocuments(bytes.toString());
+        for (const doc of documents)
+            if (doc.errors.length)
+                throw doc.errors[0];
+        const lock = documents.map(doc => doc.toJS()).find(doc => doc?.importers?.['.'] && !doc.importers['.'].packageManagerDependencies);
+        if (!lock)
+            throw new Error('No pnpm application importer');
+        return { bytes, file: pnpm, entry(name) {
+                const importer = lock.importers['.'];
+                const selected = importer.dependencies?.[name] ?? importer.devDependencies?.[name] ?? importer.optionalDependencies?.[name];
+                if (!selected)
+                    return undefined;
+                const selectedRef = String(selected.version);
+                const ref = lock.packages?.[`${name}@${selectedRef}`] ? selectedRef : selectedRef.replace(/\(.*$/, '');
+                const pkg = lock.packages?.[`${name}@${ref}`];
+                return { version: pkg?.version ?? ref, integrity: pkg?.resolution?.integrity };
+            } };
+    }
+    const file = join(root, 'package-lock.json'), bytes = readFileSync(file);
+    const lock = JSON.parse(bytes.toString());
+    return { bytes, file, entry(name) { return lock.packages?.[`node_modules/${name}`]; } };
+}

package/dist/src/published.js

@@ -15,7 +15,7 @@ export const vendorOfPackage = (name) => name.replace(/^@[^/]+\//, '').replace(/
 async function withPublished(spec, opts, use) {
     const tmp = mkdtempSync(join(tmpdir(), 'twin-standard-'));
     try {
-        const pack = spawnSync('npm', ['pack', spec, '--pack-destination', tmp, '--silent', ...(opts.registry ? ['--registry', opts.registry] : [])], { encoding: 'utf8' });
+        const pack = spawnSync('npm', ['pack', '--force', spec, '--pack-destination', tmp, '--silent', ...(opts.registry ? ['--registry', opts.registry] : [])], { encoding: 'utf8' });
         const tarball = readdirSync(tmp).find((f) => f.endsWith('.tgz'));
         if (pack.status !== 0 || !tarball)
             throw new Error(`${spec}: the registry gave no tarball (${String(pack.stderr).trim().split('\n').at(-1) ?? ''})`);
@@ -72,7 +72,7 @@ export async function conformPublished(spec, opts = {}) {
         const platform = Object.keys(deps).filter((d) => d.startsWith('@volter/'));
         const others = Object.entries(deps).filter(([d]) => !d.startsWith('@volter/')).map(([d, v]) => `${d}@${v}`);
         if (others.length) {
-            const install = spawnSync('npm', ['install', '--no-save', '--omit=dev', '--omit=peer', '--ignore-scripts', '--no-audit', '--no-fund', '--no-package-lock', ...(opts.registry ? ['--registry', opts.registry] : []), ...others], { cwd: dirname(dir), encoding: 'utf8' });
+            const install = spawnSync('pnpm', ['add', '--prod', '--config.autoInstallPeers=false', '--package-import-method=hardlink', '--config.nodeLinker=hoisted', '--ignore-scripts', ...(opts.registry ? ['--registry', opts.registry] : []), ...others], { cwd: dirname(dir), encoding: 'utf8' });
             if (install.status !== 0)
                 throw new Error(`${spec}: its dependencies do not install (${String(install.stderr).trim().split('\n').at(-1) ?? ''})`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-standard",
-  "version": "1.0.153",
+  "version": "1.0.154",
   "description": "The Protocol 3 standard for Volter twin packs: the criteria a pack is graded by, the grader, the gate a pack repository and the twin catalog run on every change and submission, and the spec derivation the grade checks against. Pin a version: every place a pack is judged judges by that standard.",
   "keywords": [
     "twin",
@@ -20,8 +20,9 @@
     "README.md",
     "LICENSE",
     "client-sdks/package.json",
-    "client-sdks/bun.lock",
+    "client-sdks/pnpm-lock.yaml",
     "!**/*.test.ts",
+    "client-sdks/pnpm-workspace.yaml",
     "dist"
   ],
   "repository": {
@@ -75,7 +76,7 @@
     "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.160",
+    "@volter/world-core": "3.0.161",
     "@volter/world-runtime": "*",
     "playwright": "^1.63.0"
   },
@@ -112,5 +113,13 @@
   },
   "engines": {
     "node": ">=22.6"
+  },
+  "packageManager": "pnpm@12.15.0",
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": "12.15.0",
+      "onFail": "error"
+    }
   }
 }

package/src/clients/sentry.ts

@@ -13,8 +13,8 @@ import { standardPackageFile } from '../package-file.ts';
 const SDKS = standardPackageFile('client-sdks/');
 async function sdkOf(name: string): Promise<any> {
   if (!existsSync(new URL('node_modules/', SDKS))) {
-    const install = spawnSync('bun', ['install', '--frozen-lockfile', '--ignore-scripts'], { cwd: SDKS, stdio: 'inherit' });
-    if (install.status !== 0) throw new Error('client-sdks: bun install --frozen-lockfile failed');
+    const install = spawnSync('pnpm', ['install', '--frozen-lockfile', '--ignore-scripts'], { cwd: SDKS, stdio: 'inherit' });
+    if (install.status !== 0) throw new Error('client-sdks: pnpm install --frozen-lockfile failed');
   }
   return await import(pathToFileURL(createRequire(new URL('package.json', SDKS)).resolve(name)).href);
 }

package/src/conformance.ts

@@ -211,7 +211,7 @@ async function registered(pack: string, runtime: Runtime): Promise<string[]> {
  *  journeys, read from the file list `npm pack` makes. Escaped once: seven packs published their lanes' src without
  *  their spec, so the catalog's conformance of the tarball never read those lanes. */
 function published(pack: string): string[] {
-  const run = spawnSync('npm', ['pack', '--dry-run', '--json', '--ignore-scripts'], { cwd: pack, encoding: 'utf8' });
+  const run = spawnSync('npm', ['pack', '--force', '--dry-run', '--json', '--ignore-scripts'], { cwd: pack, encoding: 'utf8' });
   let files: Set<string>;
   try { files = new Set(((JSON.parse(run.stdout) as Array<{ files: Array<{ path: string }> }>)[0]?.files ?? []).map((f) => f.path)); } catch { return [`npm pack lists no files (${String(run.stderr).trim().split('\n').at(-1) ?? ''})`]; }
   const out: string[] = [];

package/src/consumer.ts

@@ -6,6 +6,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:pat
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { standardPackageFile } from './package-file.ts';
+import { dependencyLock } from './dependency-lock.ts';
 
 export type ConsumerRecipe = {
   schemaVersion: 1;
@@ -79,6 +80,8 @@ export function prepareConsumerApp(packDir: string, appDir: string, installation
   const recipe = consumerRecipe(vendor, packDir);
   if (existsSync(appDir)) throw new Error('Consumer app must be a new directory');
   const app = JSON.parse(recipe.files['package.json']!);
+  app.packageManager = 'pnpm@12.15.0';
+  app.devEngines = { packageManager: { name: 'pnpm', version: '12.15.0', onFail: 'error' } };
   if (app.scripts || app.workspaces) throw new Error('Consumer fixture supplies direct SDK commands, not install scripts or workspace links');
   for (const [name, version] of Object.entries({ ...app.dependencies, ...app.devDependencies, ...app.optionalDependencies })) {
     if (typeof version !== 'string' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) throw new Error(`${name}: customer SDK dependencies require exact registry versions`);
@@ -94,8 +97,9 @@ export function prepareConsumerApp(packDir: string, appDir: string, installation
     if (installation.artifact && (!isAbsolute(installation.artifact) || !statSync(installation.artifact).isFile())) throw new Error('Consumer candidate must be an absolute prepared archive path');
     if (Object.hasOwn(app.dependencies ?? {}, metadata.name)) throw new Error('Consumer SDK dependencies must not substitute the candidate package');
     app.devDependencies = { ...app.devDependencies, '@volter/world-core': tools['@volter/world-core'], [metadata.name]: installation.artifact ? `file:${installation.artifact}` : metadata.version };
-    files.find(([path]) => path === 'package.json')![1] = JSON.stringify(app, null, 2) + '\n';
   }
+  files.find(([path]) => path === 'package.json')![1] = JSON.stringify(app, null, 2) + '\n';
+  files.push(['pnpm-workspace.yaml', 'packages:\n  - .\npackageImportMethod: hardlink\nnodeLinker: hoisted\nautoInstallPeers: false\nstrictPeerDependencies: false\n']);
   mkdirSync(appDir, { recursive: true });
   for (const [path, content] of files) {
     mkdirSync(dirname(join(appDir, path)), { recursive: true });
@@ -117,10 +121,9 @@ export async function runConsumerWorkflow(packDir: string, options: ConsumerOpti
     const location = relative(join(appRoot, 'node_modules'), identity.directory);
     if (location.startsWith('..') || isAbsolute(location)) throw new Error(`${name}: consumer resolves an evaluator or ancestor dependency; install it in the app`);
   }
-  const appLockBytes = readFileSync(join(appRoot, 'package-lock.json'));
-  const appLock = JSON.parse(appLockBytes.toString());
-  if (candidate.version !== metadata.version || appLock.packages?.[`node_modules/${metadata.name}`]?.integrity !== options.artifactIntegrity) throw new Error('Consumer app candidate does not match the exact assessed artifact');
-  if (kernel.version !== tools['@volter/world-core'] || appLock.packages?.['node_modules/@volter/world-core']?.version !== kernel.version) throw new Error('Consumer app kernel does not match the CLI kernel pin');
+  const appLock = dependencyLock(appRoot), appLockBytes = appLock.bytes;
+  if (candidate.version !== metadata.version || appLock.entry(metadata.name)?.integrity !== options.artifactIntegrity) throw new Error('Consumer app candidate does not match the exact assessed artifact');
+  if (kernel.version !== tools['@volter/world-core'] || appLock.entry('@volter/world-core')?.version !== kernel.version) throw new Error('Consumer app kernel does not match the CLI kernel pin');
   const application = { candidate: { package: metadata.name, version: candidate.version, integrity: options.artifactIntegrity }, kernel: { package: '@volter/world-core', version: kernel.version }, dependencyLockSha256: createHash('sha256').update(appLockBytes).digest('hex'), appLocal: true };
   const facts = JSON.parse(readFileSync(join(packDir, 'generated/pack-facts.json'), 'utf8'));
   const vendor = Object.keys(facts.packs ?? {})[0];

package/src/dependency-lock.ts

@@ -0,0 +1,27 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseAllDocuments } from 'yaml';
+
+/** The application's selected direct dependency, including the exact installer's integrity. */
+export function dependencyLock(root: string) {
+  const pnpm = join(root, 'pnpm-lock.yaml');
+  if (existsSync(pnpm)) {
+    const bytes = readFileSync(pnpm);
+    const documents = parseAllDocuments(bytes.toString());
+    for (const doc of documents) if (doc.errors.length) throw doc.errors[0];
+    const lock = documents.map(doc => doc.toJS()).find(doc => doc?.importers?.['.'] && !doc.importers['.'].packageManagerDependencies);
+    if (!lock) throw new Error('No pnpm application importer');
+    return { bytes, file: pnpm, entry(name: string) {
+      const importer = lock.importers['.'];
+      const selected = importer.dependencies?.[name] ?? importer.devDependencies?.[name] ?? importer.optionalDependencies?.[name];
+      if (!selected) return undefined;
+      const selectedRef = String(selected.version);
+      const ref = lock.packages?.[`${name}@${selectedRef}`] ? selectedRef : selectedRef.replace(/\(.*$/, '');
+      const pkg = lock.packages?.[`${name}@${ref}`];
+      return { version: pkg?.version ?? ref, integrity: pkg?.resolution?.integrity };
+    } };
+  }
+  const file = join(root, 'package-lock.json'), bytes = readFileSync(file);
+  const lock = JSON.parse(bytes.toString());
+  return { bytes, file, entry(name: string) { return lock.packages?.[`node_modules/${name}`] as { version?: string; integrity?: string } | undefined; } };
+}

package/src/published.ts

@@ -19,7 +19,7 @@ export const vendorOfPackage = (name: string): string => name.replace(/^@[^/]+\/
 async function withPublished<T>(spec: string, opts: { registry?: string }, use: (dir: string, tmp: string) => Promise<T>): Promise<T> {
   const tmp = mkdtempSync(join(tmpdir(), 'twin-standard-'));
   try {
-    const pack = spawnSync('npm', ['pack', spec, '--pack-destination', tmp, '--silent', ...(opts.registry ? ['--registry', opts.registry] : [])], { encoding: 'utf8' });
+    const pack = spawnSync('npm', ['pack', '--force', spec, '--pack-destination', tmp, '--silent', ...(opts.registry ? ['--registry', opts.registry] : [])], { encoding: 'utf8' });
     const tarball = readdirSync(tmp).find((f) => f.endsWith('.tgz'));
     if (pack.status !== 0 || !tarball) throw new Error(`${spec}: the registry gave no tarball (${String(pack.stderr).trim().split('\n').at(-1) ?? ''})`);
     const untar = spawnSync('tar', ['-xzf', join(tmp, tarball), '-C', tmp], { encoding: 'utf8' });
@@ -66,7 +66,7 @@ export async function conformPublished(spec: string, opts: { registry?: string }
     const platform = Object.keys(deps).filter((d) => d.startsWith('@volter/'));
     const others = Object.entries(deps).filter(([d]) => !d.startsWith('@volter/')).map(([d, v]) => `${d}@${v}`);
     if (others.length) {
-      const install = spawnSync('npm', ['install', '--no-save', '--omit=dev', '--omit=peer', '--ignore-scripts', '--no-audit', '--no-fund', '--no-package-lock', ...(opts.registry ? ['--registry', opts.registry] : []), ...others], { cwd: dirname(dir), encoding: 'utf8' });
+      const install = spawnSync('pnpm', ['add', '--prod', '--config.autoInstallPeers=false', '--package-import-method=hardlink', '--config.nodeLinker=hoisted', '--ignore-scripts', ...(opts.registry ? ['--registry', opts.registry] : []), ...others], { cwd: dirname(dir), encoding: 'utf8' });
       if (install.status !== 0) throw new Error(`${spec}: its dependencies do not install (${String(install.stderr).trim().split('\n').at(-1) ?? ''})`);
     }
     mkdirSync(join(dir, 'node_modules', '@volter'), { recursive: true });