Reserve @taffyjs scope for published packages

[hyfdev]

Summary

• reserve the @taffyjs npm scope for packages that are intended to be published separately
• change the build-only Wasm napi-rs staging package from @taffyjs/binding-wasm32-wasip1 to unscoped taffyjs-binding-wasm32-wasip1
• update the exact generated-loader transformation, package-content assertions, and durable package records

Why

The Wasm target package exists only as a build staging input and is never published. It should not use the organization scope. Public packages and native platform optional dependencies remain scoped because they are separately distributed npm artifacts.

Impact

Public @taffyjs/node and @taffyjs/wasm names, native platform package names, and consumer imports are unchanged. Only the internal generated Wasm target identity changes.

The Wasm design record previously had a whole-file vouch. Because this change updates covered wording, the stamp was removed rather than being carried forward without explicit re-vouching.

Validation

• vp fmt --check
• vp lint --deny-warnings
• vp run check
• vp run check:wasm
• vp run tests-taffy-wasm#check:package
• verified the real napi-rs staging output references only taffyjs-binding-wasm32-wasip1
• independent adversarial review, with the stale-vouch finding fixed and targeted follow-up passing

[Copilot]

Pull request overview

This pull request tightens npm package naming hygiene by reserving the @taffyjs/* scope for artifacts that are intended to be published independently, and renames the build-only wasm32-wasip1 napi-rs staging package to an unscoped name. This aligns internal build staging identities with the repository’s intended distribution boundaries without changing public consumer imports.

Changes:

• Switched the wasm32-wasip1 staging package reference from @taffyjs/binding-wasm32-wasip1 to taffyjs-binding-wasm32-wasip1 in the wasm runtime-file generation pipeline.
• Updated the @taffyjs/wasm package’s napi-rs packageName to taffyjs-binding and strengthened package-content assertions to ensure no binding-wasm dependency leakage.
• Recorded the new “scope reserved for published packages” decision in PCR tooling records and updated wasm package documentation accordingly (including removal of a now-stale whole-file vouch stamp).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/taffy-wasm/generate-inline-wasm-runtime-files.ts	Updates the exact-loader transformation inputs and forbidden-string guards to reflect the unscoped wasm32-wasip1 staging package name.
tests/taffyjs-wasm/tests/package-contents.ts	Adjusts package-content assertions to validate the updated napi packageName and ensure no binding-wasm dependencies are present.
packages/taffyjs-wasm/package.json	Changes napi-rs packageName to taffyjs-binding to drive unscoped build-only target package naming.
.agents/docs/tooling-decisions.md	Adds a new tooling decision explicitly reserving @taffyjs scope for separately published packages.
.agents/docs/taffyjs-wasm-package.md	Updates the wasm package design record to reference the unscoped staging package name and removes the stale whole-file vouch stamp.
.agents/docs/README.md	Updates the PCR map descriptions to reflect current vouch status and the expanded tooling decisions scope.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.