@volter/twin-standard 1.0.34 → 1.0.35

package/dist/src/create-pack.js

@@ -526,7 +526,10 @@ export async function createPack(args) {
         console.log(`create-pack: wrote ${join(dir, 'src', 'fetch.ts')}`);
         // a pack's own index (a lane's is the vendor's to name): the descriptor with what the kernel derives from the surface
         if (existsSync(join(dir, 'package.json'))) {
-            const vendor = parseExactJson(readFileSync(join(dir, 'package.json'), 'utf8')).name.replace(/^@volter\/twin-/, '');
+            const { manifest } = await import(__rewriteRelativeImportExtension(join(dir, 'src', 'manifest.ts')));
+            const vendor = manifest?.vendor;
+            if (!vendor || !/^[a-z][a-z0-9-]*$/.test(vendor))
+                throw new Error('Pack manifest must declare its vendor identity independently of the npm package name');
             writeFileSync(join(dir, 'src', 'index.ts'), packIndexFile(dir, vendor));
             console.log(`create-pack: wrote ${join(dir, 'src', 'index.ts')}`);
             // what the grade's typecheck compiles: a pack made before init wrote it gets it here

package/dist/src/published.d.ts

@@ -6,7 +6,7 @@ export type PublishedGate = {
         failures: string[];
     }>;
 };
-/** The vendor a package twins: its name without its scope and the `twin-` prefix (`@volter/twin-supabase` is supabase). */
+/** Conventional-name fallback for artifacts predating generated identity facts; not an independent package identity. */
 export declare const vendorOfPackage: (name: string) => string;
 /** The conformance of `spec` as the registry serves it: the published tarball with its own dependencies installed,
  *  served and read against the kernel (kernelDir). */

package/dist/src/published.js

@@ -8,7 +8,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { conformance } from "./conformance.js";
 import { p3Gate } from "./gate.js";
-/** The vendor a package twins: its name without its scope and the `twin-` prefix (`@volter/twin-supabase` is supabase). */
+/** Conventional-name fallback for artifacts predating generated identity facts; not an independent package identity. */
 export const vendorOfPackage = (name) => name.replace(/^@[^/]+\//, '').replace(/^twin-/, '');
 /** `spec` (`<name>@<version>`) as the registry serves it, unpacked under its vendor's name in a scratch directory, handed
  *  to `use`; throws when it cannot be fetched or unpacked. */
@@ -23,7 +23,15 @@ async function withPublished(spec, opts, use) {
         if (untar.status !== 0)
             throw new Error(`${spec}: the tarball does not unpack (${String(untar.stderr).trim()})`);
         const name = JSON.parse(readFileSync(join(tmp, 'package', 'package.json'), 'utf8')).name;
-        const dir = join(tmp, vendorOfPackage(name));
+        const factsFile = join(tmp, 'package', 'generated', 'pack-facts.json');
+        const facts = existsSync(factsFile) ? JSON.parse(readFileSync(factsFile, 'utf8')) : undefined;
+        const vendors = Object.keys(facts?.packs ?? {});
+        if (facts && vendors.length !== 1)
+            throw new Error(`${spec}: generated facts must identify one vendor`);
+        const vendor = facts ? vendors[0] : vendorOfPackage(name);
+        if (!/^[a-z][a-z0-9-]*$/.test(vendor))
+            throw new Error(`${spec}: invalid vendor identity`);
+        const dir = join(tmp, vendor);
         renameSync(join(tmp, 'package'), dir);
         return await use(dir, tmp);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-standard",
-  "version": "1.0.34",
+  "version": "1.0.35",
   "description": "The Protocol 3 standard for Volter twin packs: the criteria a pack is graded by, the grader, the gate a pack repository and the twin catalog run on every change and submission, and the spec derivation the grade checks against. Pin a version: every place a pack is judged judges by that standard.",
   "keywords": [
     "twin",
@@ -70,7 +70,7 @@
     "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.42",
+    "@volter/world-core": "3.0.43",
     "@volter/world-runtime": "*",
     "playwright": "^1.63.0"
   },

package/src/create-pack.ts

@@ -488,7 +488,9 @@ export async function createPack(args: string[]): Promise<void> {
     console.log(`create-pack: wrote ${join(dir, 'src', 'fetch.ts')}`);
     // a pack's own index (a lane's is the vendor's to name): the descriptor with what the kernel derives from the surface
     if (existsSync(join(dir, 'package.json'))) {
-      const vendor = (parseExactJson(readFileSync(join(dir, 'package.json'), 'utf8')) as { name: string }).name.replace(/^@volter\/twin-/, '');
+      const { manifest } = await import(join(dir, 'src', 'manifest.ts')) as { manifest?: { vendor?: string } };
+      const vendor = manifest?.vendor;
+      if (!vendor || !/^[a-z][a-z0-9-]*$/.test(vendor)) throw new Error('Pack manifest must declare its vendor identity independently of the npm package name');
       writeFileSync(join(dir, 'src', 'index.ts'), packIndexFile(dir, vendor));
       console.log(`create-pack: wrote ${join(dir, 'src', 'index.ts')}`);
       // what the grade's typecheck compiles: a pack made before init wrote it gets it here

package/src/published.ts

@@ -11,7 +11,7 @@ import { p3Gate } from './gate.ts';
 
 export type PublishedGate = { spec: string; failures: Array<{ unit: string; failures: string[] }> };
 
-/** The vendor a package twins: its name without its scope and the `twin-` prefix (`@volter/twin-supabase` is supabase). */
+/** Conventional-name fallback for artifacts predating generated identity facts; not an independent package identity. */
 export const vendorOfPackage = (name: string): string => name.replace(/^@[^/]+\//, '').replace(/^twin-/, '');
 
 /** `spec` (`<name>@<version>`) as the registry serves it, unpacked under its vendor's name in a scratch directory, handed
@@ -25,7 +25,13 @@ async function withPublished<T>(spec: string, opts: { registry?: string }, use:
     const untar = spawnSync('tar', ['-xzf', join(tmp, tarball), '-C', tmp], { encoding: 'utf8' });
     if (untar.status !== 0) throw new Error(`${spec}: the tarball does not unpack (${String(untar.stderr).trim()})`);
     const name = (JSON.parse(readFileSync(join(tmp, 'package', 'package.json'), 'utf8')) as { name: string }).name;
-    const dir = join(tmp, vendorOfPackage(name));
+    const factsFile = join(tmp, 'package', 'generated', 'pack-facts.json');
+    const facts = existsSync(factsFile) ? JSON.parse(readFileSync(factsFile, 'utf8')) as { packs?: Record<string, unknown> } : undefined;
+    const vendors = Object.keys(facts?.packs ?? {});
+    if (facts && vendors.length !== 1) throw new Error(`${spec}: generated facts must identify one vendor`);
+    const vendor = facts ? vendors[0]! : vendorOfPackage(name);
+    if (!/^[a-z][a-z0-9-]*$/.test(vendor)) throw new Error(`${spec}: invalid vendor identity`);
+    const dir = join(tmp, vendor);
     renameSync(join(tmp, 'package'), dir);
     return await use(dir, tmp);
   } finally {