refactor: one component name, each namespace adding only the prefix it needs

[y1o1]

auth-auth-provider was a symptom. The cause is that one string was doing three jobs — directory, npm package, container image — so a prefix that is correct in one namespace is wrong in another. Naming the image explicitly (#7) hid that. This fixes it.

The rule

A name carries exactly the disambiguation its namespace does not already provide:

component   provider | policy-verifier
directory   packages/create-${c}    inside the auth repo — "auth" is already
                                    given by where the file is
npm         create-auth-${c}        scope is provin-line, not auth
image       auth-${c}               org is provin-line, not auth

So the publish matrix carries the component again and every identifier derives from it.

What moves

	before	after
dir	packages/create-auth-provider	packages/create-provider
dir	packages/auth-provider-did	packages/provider-did
dir	packages/auth-provider-dplaax-module	packages/provider-dplaax-module
npm	@provin-line/create-policy-verifier	@provin-line/create-auth-policy-verifier
npm	@provin-line/policy-verifier-dplaax-module	@provin-line/auth-policy-verifier-dplaax-module

This deliberately breaks the directory↔package-name mirror. pnpm resolves by the name in package.json, and the alternative was keeping a prefix that says "auth" to a reader who is already inside the auth repository.

All six packages are unpublished on npm, which is the only reason this is a refactor and not a breaking change.

The same conflation was live in the generators — and there it broke things

const TRANSITIVE_PROVIN_PACKAGE_DIRS = ["auth-provider-did", ...]
`@provin-line/${dir}`                   // used as an npm name
`path:/packages/${dir}`                 // and as a directory

One list, two meanings. After the rename it would have emitted a git spec pointing at packages/auth-provider-did — a path that no longer exists, so a generated scaffold would have failed to install rather than merely read oddly.

Now { name, dir } pairs, with a comment saying why they are separate. The generator test caught this; that is the test earning its place.

Also corrected while in here

• the verifier's bin and its Usage: line still said create-policy-verifier
• two assertions escaped the slash — @provin-line\/create-policy-verifier — so a literal search could not see them
• one expected array needed reordering: the rename moved auth-policy-verifier-dplaax-module ahead of did-dplaax in a sorted list

The lockfile is nine lines, and that took two attempts

resolution/integrity changes: zero.

Getting there meant reverting two accidents:

1. pnpm install --lockfile-only re-resolved dependencies unrelated to any rename (picomatch and tinyglobby swapped out, among others) — 488 lines
2. make instances then wrote the generated instances' own dependencies into the root lockfile, because pnpm counts them as workspace projects — 413 lines

The committed lockfile is the base one with importer keys and link: targets substituted, validated with --frozen-lockfile so nothing was re-resolved to make it pass.

Verification

frozen-lockfile install ✓   build ✓   typecheck ✓
484 package tests + integration ✓
make instances ✓            make smoke ✓

Plus the CI assertion reproduced locally — a fresh generation is byte-identical to instances/ — and confirmation that the generated overrides key on @provin-line/auth-provider-did while pointing at /packages/provider-did.

Not yet verified

The published images are currently the ones #7's per-entry image: produced. The derived form should yield the same names, but publish-images has not been dispatched against this change, so that is unproven until it runs.

🤖 Generated with Claude Code