@volter/twin-standard 1.0.34 → 1.0.36

package/dist/src/clients/sentry.js

@@ -13,9 +13,10 @@ import { existsSync } from 'node:fs';
 import { request as httpsRequest } from 'node:https';
 import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
+import { standardPackageFile } from "../package-file.js";
 // The pins live in ../../client-sdks with their own lockfile, installed here on first use: some carry advisories with no
 // fix in the line an application pins, so the repository's install (and a release, .github/release-scan.mjs) never does.
-const SDKS = new URL('../../client-sdks/', import.meta.url);
+const SDKS = standardPackageFile('client-sdks/');
 async function sdkOf(name) {
     if (!existsSync(new URL('node_modules/', SDKS))) {
         const install = spawnSync('bun', ['install', '--frozen-lockfile', '--ignore-scripts'], { cwd: SDKS, stdio: 'inherit' });

package/dist/src/create-pack.js

@@ -33,6 +33,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { parseExactJson, exactInteger } from '@volter/world-core/exact-json';
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, relative, resolve } from 'node:path';
+import { standardPackageFile } from "./package-file.js";
 import { gunzipSync } from 'node:zlib';
 import { parse as parseYaml } from 'yaml';
 import { coreFor } from '@volter/world-core';
@@ -476,7 +477,7 @@ export async function createPack(args) {
         // the package's licence, the platform's (Apache-2.0), as every published pack carries it
         const licence = join(dir, 'LICENSE');
         if (!existsSync(licence)) {
-            writeFileSync(licence, readFileSync(new URL('../LICENSE', import.meta.url)));
+            writeFileSync(licence, readFileSync(standardPackageFile('LICENSE')));
             console.log('create-pack: wrote LICENSE');
         }
         // the handler map each fetch imports, empty until the families are written (--index again then)
@@ -526,7 +527,10 @@ export async function createPack(args) {
         console.log(`create-pack: wrote ${join(dir, 'src', 'fetch.ts')}`);
         // a pack's own index (a lane's is the vendor's to name): the descriptor with what the kernel derives from the surface
         if (existsSync(join(dir, 'package.json'))) {
-            const vendor = parseExactJson(readFileSync(join(dir, 'package.json'), 'utf8')).name.replace(/^@volter\/twin-/, '');
+            const { manifest } = await import(__rewriteRelativeImportExtension(join(dir, 'src', 'manifest.ts')));
+            const vendor = manifest?.vendor;
+            if (!vendor || !/^[a-z][a-z0-9-]*$/.test(vendor))
+                throw new Error('Pack manifest must declare its vendor identity independently of the npm package name');
             writeFileSync(join(dir, 'src', 'index.ts'), packIndexFile(dir, vendor));
             console.log(`create-pack: wrote ${join(dir, 'src', 'index.ts')}`);
             // what the grade's typecheck compiles: a pack made before init wrote it gets it here

package/dist/src/package-file.d.ts

@@ -0,0 +1,2 @@
+/** Package-owned data beside src/, or beside dist/ when the released entrypoints are compiled. */
+export declare function standardPackageFile(name: 'package.json' | 'LICENSE' | 'client-sdks/'): URL;

package/dist/src/package-file.js

@@ -0,0 +1,11 @@
+import { existsSync, readFileSync } from 'node:fs';
+/** Package-owned data beside src/, or beside dist/ when the released entrypoints are compiled. */
+export function standardPackageFile(name) {
+    for (const parent of ['../', '../../']) {
+        const root = new URL(parent, import.meta.url);
+        const manifest = new URL('package.json', root);
+        if (existsSync(manifest) && JSON.parse(readFileSync(manifest, 'utf8')).name === '@volter/twin-standard')
+            return new URL(name, root);
+    }
+    throw new Error('Cannot locate the twin-standard package manifest');
+}

package/dist/src/published.d.ts

@@ -6,7 +6,7 @@ export type PublishedGate = {
         failures: string[];
     }>;
 };
-/** The vendor a package twins: its name without its scope and the `twin-` prefix (`@volter/twin-supabase` is supabase). */
+/** Conventional-name fallback for artifacts predating generated identity facts; not an independent package identity. */
 export declare const vendorOfPackage: (name: string) => string;
 /** The conformance of `spec` as the registry serves it: the published tarball with its own dependencies installed,
  *  served and read against the kernel (kernelDir). */

package/dist/src/published.js

@@ -8,7 +8,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { conformance } from "./conformance.js";
 import { p3Gate } from "./gate.js";
-/** The vendor a package twins: its name without its scope and the `twin-` prefix (`@volter/twin-supabase` is supabase). */
+/** Conventional-name fallback for artifacts predating generated identity facts; not an independent package identity. */
 export const vendorOfPackage = (name) => name.replace(/^@[^/]+\//, '').replace(/^twin-/, '');
 /** `spec` (`<name>@<version>`) as the registry serves it, unpacked under its vendor's name in a scratch directory, handed
  *  to `use`; throws when it cannot be fetched or unpacked. */
@@ -23,7 +23,15 @@ async function withPublished(spec, opts, use) {
         if (untar.status !== 0)
             throw new Error(`${spec}: the tarball does not unpack (${String(untar.stderr).trim()})`);
         const name = JSON.parse(readFileSync(join(tmp, 'package', 'package.json'), 'utf8')).name;
-        const dir = join(tmp, vendorOfPackage(name));
+        const factsFile = join(tmp, 'package', 'generated', 'pack-facts.json');
+        const facts = existsSync(factsFile) ? JSON.parse(readFileSync(factsFile, 'utf8')) : undefined;
+        const vendors = Object.keys(facts?.packs ?? {});
+        if (facts && vendors.length !== 1)
+            throw new Error(`${spec}: generated facts must identify one vendor`);
+        const vendor = facts ? vendors[0] : vendorOfPackage(name);
+        if (!/^[a-z][a-z0-9-]*$/.test(vendor))
+            throw new Error(`${spec}: invalid vendor identity`);
+        const dir = join(tmp, vendor);
         renameSync(join(tmp, 'package'), dir);
         return await use(dir, tmp);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-standard",
-  "version": "1.0.34",
+  "version": "1.0.36",
   "description": "The Protocol 3 standard for Volter twin packs: the criteria a pack is graded by, the grader, the gate a pack repository and the twin catalog run on every change and submission, and the spec derivation the grade checks against. Pin a version: every place a pack is judged judges by that standard.",
   "keywords": [
     "twin",
@@ -19,6 +19,8 @@
     "src",
     "README.md",
     "LICENSE",
+    "client-sdks/package.json",
+    "client-sdks/bun.lock",
     "!**/*.test.ts",
     "dist"
   ],
@@ -27,6 +29,9 @@
     "url": "git+https://github.com/volter-ai/twin-world.git",
     "directory": "packages/twin-standard"
   },
+  "assessmentClientSdks": [
+    "client-sdks"
+  ],
   "homepage": "https://github.com/volter-ai/twin-world/tree/main/packages/twin-standard#readme",
   "type": "module",
   "exports": {
@@ -70,7 +75,7 @@
     "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.42",
+    "@volter/world-core": "3.0.44",
     "@volter/world-runtime": "*",
     "playwright": "^1.63.0"
   },

package/src/cli.ts

@@ -19,6 +19,7 @@ import { relative, resolve } from 'node:path';
 import { unitsOf, p3Gate } from './gate.ts';
 import { grade, STANDARDS } from './grade.ts';
 import { withCheckoutFiles } from './protocol-3.ts';
+import { standardPackageFile } from './package-file.ts';
 import { gatePublished } from './published.ts';
 
 const [command, ...args] = process.argv.slice(2);
@@ -28,7 +29,7 @@ const usage = (): never => {
 };
 
 if (command === '--version') {
-  const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { version: string };
+  const pkg = JSON.parse(readFileSync(standardPackageFile('package.json'), 'utf8')) as { version: string };
   console.log(`@volter/twin-standard ${pkg.version} · ${STANDARDS.map((s) => `${s.id}@${s.version}`).join(' ')}`);
 } else if (command === 'gate') {
   const [repoArg, ...only] = args;

package/src/clients/sentry.ts

@@ -6,10 +6,11 @@ import { request as httpsRequest } from 'node:https';
 import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
 import type { ClientCase, ClientContext } from './harness.ts';
+import { standardPackageFile } from '../package-file.ts';
 
 // The pins live in ../../client-sdks with their own lockfile, installed here on first use: some carry advisories with no
 // fix in the line an application pins, so the repository's install (and a release, .github/release-scan.mjs) never does.
-const SDKS = new URL('../../client-sdks/', import.meta.url);
+const SDKS = standardPackageFile('client-sdks/');
 async function sdkOf(name: string): Promise<any> {
   if (!existsSync(new URL('node_modules/', SDKS))) {
     const install = spawnSync('bun', ['install', '--frozen-lockfile', '--ignore-scripts'], { cwd: SDKS, stdio: 'inherit' });

package/src/create-pack.ts

@@ -25,6 +25,7 @@
 import { parseExactJson, exactInteger } from '@volter/world-core/exact-json';
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, relative, resolve } from 'node:path';
+import { standardPackageFile } from './package-file.ts';
 import { gunzipSync } from 'node:zlib';
 import { parse as parseYaml } from 'yaml';
 import { coreFor, type DerivedManifest, type DerivedOperation } from '@volter/world-core';
@@ -457,7 +458,7 @@ export async function createPack(args: string[]): Promise<void> {
     }
     // the package's licence, the platform's (Apache-2.0), as every published pack carries it
     const licence = join(dir, 'LICENSE');
-    if (!existsSync(licence)) { writeFileSync(licence, readFileSync(new URL('../LICENSE', import.meta.url))); console.log('create-pack: wrote LICENSE'); }
+    if (!existsSync(licence)) { writeFileSync(licence, readFileSync(standardPackageFile('LICENSE'))); console.log('create-pack: wrote LICENSE'); }
     // the handler map each fetch imports, empty until the families are written (--index again then)
     for (const at of lanesArg.length ? [...lanesArg.map((l) => join(dir, l)), dir] : [dir]) {
       if (at === dir && lanesArg.length) { const f = join(dir, 'src', 'fetch.ts'); if (!existsSync(f)) { writeFileSync(f, packFetchFile(dir, fetchName(dir))); console.log('create-pack: wrote src/fetch.ts'); } continue; }
@@ -488,7 +489,9 @@ export async function createPack(args: string[]): Promise<void> {
     console.log(`create-pack: wrote ${join(dir, 'src', 'fetch.ts')}`);
     // a pack's own index (a lane's is the vendor's to name): the descriptor with what the kernel derives from the surface
     if (existsSync(join(dir, 'package.json'))) {
-      const vendor = (parseExactJson(readFileSync(join(dir, 'package.json'), 'utf8')) as { name: string }).name.replace(/^@volter\/twin-/, '');
+      const { manifest } = await import(join(dir, 'src', 'manifest.ts')) as { manifest?: { vendor?: string } };
+      const vendor = manifest?.vendor;
+      if (!vendor || !/^[a-z][a-z0-9-]*$/.test(vendor)) throw new Error('Pack manifest must declare its vendor identity independently of the npm package name');
       writeFileSync(join(dir, 'src', 'index.ts'), packIndexFile(dir, vendor));
       console.log(`create-pack: wrote ${join(dir, 'src', 'index.ts')}`);
       // what the grade's typecheck compiles: a pack made before init wrote it gets it here

package/src/package-file.ts

@@ -0,0 +1,11 @@
+import { existsSync, readFileSync } from 'node:fs';
+
+/** Package-owned data beside src/, or beside dist/ when the released entrypoints are compiled. */
+export function standardPackageFile(name: 'package.json' | 'LICENSE' | 'client-sdks/'): URL {
+  for (const parent of ['../', '../../']) {
+    const root = new URL(parent, import.meta.url);
+    const manifest = new URL('package.json', root);
+    if (existsSync(manifest) && JSON.parse(readFileSync(manifest, 'utf8')).name === '@volter/twin-standard') return new URL(name, root);
+  }
+  throw new Error('Cannot locate the twin-standard package manifest');
+}

package/src/published.ts

@@ -11,7 +11,7 @@ import { p3Gate } from './gate.ts';
 
 export type PublishedGate = { spec: string; failures: Array<{ unit: string; failures: string[] }> };
 
-/** The vendor a package twins: its name without its scope and the `twin-` prefix (`@volter/twin-supabase` is supabase). */
+/** Conventional-name fallback for artifacts predating generated identity facts; not an independent package identity. */
 export const vendorOfPackage = (name: string): string => name.replace(/^@[^/]+\//, '').replace(/^twin-/, '');
 
 /** `spec` (`<name>@<version>`) as the registry serves it, unpacked under its vendor's name in a scratch directory, handed
@@ -25,7 +25,13 @@ async function withPublished<T>(spec: string, opts: { registry?: string }, use:
     const untar = spawnSync('tar', ['-xzf', join(tmp, tarball), '-C', tmp], { encoding: 'utf8' });
     if (untar.status !== 0) throw new Error(`${spec}: the tarball does not unpack (${String(untar.stderr).trim()})`);
     const name = (JSON.parse(readFileSync(join(tmp, 'package', 'package.json'), 'utf8')) as { name: string }).name;
-    const dir = join(tmp, vendorOfPackage(name));
+    const factsFile = join(tmp, 'package', 'generated', 'pack-facts.json');
+    const facts = existsSync(factsFile) ? JSON.parse(readFileSync(factsFile, 'utf8')) as { packs?: Record<string, unknown> } : undefined;
+    const vendors = Object.keys(facts?.packs ?? {});
+    if (facts && vendors.length !== 1) throw new Error(`${spec}: generated facts must identify one vendor`);
+    const vendor = facts ? vendors[0]! : vendorOfPackage(name);
+    if (!/^[a-z][a-z0-9-]*$/.test(vendor)) throw new Error(`${spec}: invalid vendor identity`);
+    const dir = join(tmp, vendor);
     renameSync(join(tmp, 'package'), dir);
     return await use(dir, tmp);
   } finally {