@savvy-web/silk 1.0.0 → 1.1.1

package/changesets-changelog.cjs

@@ -74158,6 +74158,26 @@ const DEFAULT_REGISTRIES = {
 	github: "https://npm.pkg.github.com"
 };
 /**
+* Whether a registry endpoint participates in npm-style SLSA provenance.
+*
+* @remarks
+* The npm public registry and GitHub Packages both accept provenance attestations through the
+* Sigstore/OIDC trusted-publishing flow, so a {@link PublishTarget} bound to either is marked
+* `provenance: true` by default — this is what gates the release action's attestation step. JSR
+* and custom registries do not participate and resolve to `false`. Matching is endpoint-based
+* (not target-key based) so a custom key pointed at one of these registries still opts in.
+*/
+const provenanceForRegistry = (registry) => {
+	const normalized = /^[a-z]+:\/\//i.test(registry) ? registry : `https://${registry}`;
+	let hostname;
+	try {
+		hostname = new URL(normalized).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return hostname === "registry.npmjs.org" || hostname === "npm.pkg.github.com";
+};
+/**
 * Silk publishability rules over `workspaces-effect`'s {@link PublishTarget}.
 *
 * @remarks
@@ -74199,28 +74219,41 @@ var SilkPublishability = class {
 					name: t.name,
 					registry: t.registry,
 					directory: dirByGroup.get(t.group) ?? `dist/prod/${t.group}/pkg`,
-					access
+					access,
+					provenance: provenanceForRegistry(t.registry)
 				}));
 			}
-			return Object.keys(targets).map((id) => new PublishTarget({
+			return Object.entries(targets).map(([id, target]) => {
+				const registry = typeof target === "object" && target !== null && typeof target.registry === "string" ? target.registry : DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT;
+				return new PublishTarget({
+					name: pkgName,
+					registry,
+					directory: `dist/prod/${id}/pkg`,
+					access,
+					provenance: provenanceForRegistry(registry)
+				});
+			});
+		}
+		if (pc && (pc.access === "public" || pc.access === "restricted")) {
+			const registry = pc.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
 				name: pkgName,
-				registry: DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT,
-				directory: `dist/prod/${id}/pkg`,
-				access
-			}));
+				registry,
+				directory: pc.directory ?? ".",
+				access: pc.access,
+				provenance: provenanceForRegistry(registry)
+			})];
+		}
+		if (raw.private !== true) {
+			const registry = pc?.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
+				name: pkgName,
+				registry,
+				directory: pc?.directory ?? ".",
+				access: pc?.access ?? "public",
+				provenance: provenanceForRegistry(registry)
+			})];
 		}
-		if (pc && (pc.access === "public" || pc.access === "restricted")) return [new PublishTarget({
-			name: pkgName,
-			registry: pc.registry ?? NPM_DEFAULT,
-			directory: pc.directory ?? ".",
-			access: pc.access
-		})];
-		if (raw.private !== true) return [new PublishTarget({
-			name: pkgName,
-			registry: pc?.registry ?? NPM_DEFAULT,
-			directory: pc?.directory ?? ".",
-			access: pc?.access ?? "public"
-		})];
 		return [];
 	}
 	/**
@@ -77211,10 +77244,12 @@ function readRawPackageJson(fs, pkgDir) {
 /**
 * Build resolved scopes from the discovered workspace packages, keeping only
 * those that are a release surface (declare publishConfig that yields at least
-* one publish target). Used when `.changeset/config.json` declares no explicit
-* `packages` record. The changeset `ignore` list is intentionally NOT consulted
-* here — an ignored package still declares publishConfig and remains a valid
-* changeset target.
+* one publish target). Used both when `.changeset/config.json` declares no
+* explicit `packages` record AND to augment an explicit record with the
+* remaining workspace packages it does not list (so the record annotates the
+* listed packages without shrinking the release surface). The changeset
+* `ignore` list is intentionally NOT consulted here — an ignored package still
+* declares publishConfig and remains a valid changeset target.
 */
 function buildFallbackScopes(fs, workspaces) {
 	return effect.Effect.forEach(workspaces, (ws) => effect.Effect.gen(function* () {
@@ -77328,19 +77363,24 @@ function makeShape$2(reader, discovery, fs) {
 		}));
 		const hasExplicitPackages = Object.keys(decodedOptions.packages ?? {}).length > 0;
 		let scopes;
-		if (hasExplicitPackages) try {
-			scopes = buildResolvedScopes({
-				options: decodedOptions,
-				workspaces,
-				projectDir,
-				configPath
-			});
-			checkConflicts(scopes, workspaces, projectDir, configPath);
-		} catch (e) {
-			if (e instanceof ConfigurationError) return yield* effect.Effect.fail(e);
-			throw e;
-		}
-		else scopes = yield* buildFallbackScopes(fs, workspaces);
+		if (hasExplicitPackages) {
+			let explicitScopes;
+			try {
+				explicitScopes = buildResolvedScopes({
+					options: decodedOptions,
+					workspaces,
+					projectDir,
+					configPath
+				});
+				checkConflicts(explicitScopes, workspaces, projectDir, configPath);
+			} catch (e) {
+				if (e instanceof ConfigurationError) return yield* effect.Effect.fail(e);
+				throw e;
+			}
+			const explicitNames = new Set(explicitScopes.map((s) => s.name));
+			const discoveredScopes = yield* buildFallbackScopes(fs, workspaces.filter((w) => !explicitNames.has(w.name)));
+			scopes = [...explicitScopes, ...discoveredScopes];
+		} else scopes = yield* buildFallbackScopes(fs, workspaces);
 		const inspected = {
 			configPath,
 			projectDir,

package/changesets-markdownlint.cjs

@@ -74162,6 +74162,26 @@ const DEFAULT_REGISTRIES = {
 	github: "https://npm.pkg.github.com"
 };
 /**
+* Whether a registry endpoint participates in npm-style SLSA provenance.
+*
+* @remarks
+* The npm public registry and GitHub Packages both accept provenance attestations through the
+* Sigstore/OIDC trusted-publishing flow, so a {@link PublishTarget} bound to either is marked
+* `provenance: true` by default — this is what gates the release action's attestation step. JSR
+* and custom registries do not participate and resolve to `false`. Matching is endpoint-based
+* (not target-key based) so a custom key pointed at one of these registries still opts in.
+*/
+const provenanceForRegistry = (registry) => {
+	const normalized = /^[a-z]+:\/\//i.test(registry) ? registry : `https://${registry}`;
+	let hostname;
+	try {
+		hostname = new URL(normalized).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return hostname === "registry.npmjs.org" || hostname === "npm.pkg.github.com";
+};
+/**
 * Silk publishability rules over `workspaces-effect`'s {@link PublishTarget}.
 *
 * @remarks
@@ -74203,28 +74223,41 @@ var SilkPublishability = class {
 					name: t.name,
 					registry: t.registry,
 					directory: dirByGroup.get(t.group) ?? `dist/prod/${t.group}/pkg`,
-					access
+					access,
+					provenance: provenanceForRegistry(t.registry)
 				}));
 			}
-			return Object.keys(targets).map((id) => new PublishTarget({
+			return Object.entries(targets).map(([id, target]) => {
+				const registry = typeof target === "object" && target !== null && typeof target.registry === "string" ? target.registry : DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT;
+				return new PublishTarget({
+					name: pkgName,
+					registry,
+					directory: `dist/prod/${id}/pkg`,
+					access,
+					provenance: provenanceForRegistry(registry)
+				});
+			});
+		}
+		if (pc && (pc.access === "public" || pc.access === "restricted")) {
+			const registry = pc.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
 				name: pkgName,
-				registry: DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT,
-				directory: `dist/prod/${id}/pkg`,
-				access
-			}));
+				registry,
+				directory: pc.directory ?? ".",
+				access: pc.access,
+				provenance: provenanceForRegistry(registry)
+			})];
+		}
+		if (raw.private !== true) {
+			const registry = pc?.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
+				name: pkgName,
+				registry,
+				directory: pc?.directory ?? ".",
+				access: pc?.access ?? "public",
+				provenance: provenanceForRegistry(registry)
+			})];
 		}
-		if (pc && (pc.access === "public" || pc.access === "restricted")) return [new PublishTarget({
-			name: pkgName,
-			registry: pc.registry ?? NPM_DEFAULT,
-			directory: pc.directory ?? ".",
-			access: pc.access
-		})];
-		if (raw.private !== true) return [new PublishTarget({
-			name: pkgName,
-			registry: pc?.registry ?? NPM_DEFAULT,
-			directory: pc?.directory ?? ".",
-			access: pc?.access ?? "public"
-		})];
 		return [];
 	}
 	/**
@@ -77215,10 +77248,12 @@ function readRawPackageJson(fs, pkgDir) {
 /**
 * Build resolved scopes from the discovered workspace packages, keeping only
 * those that are a release surface (declare publishConfig that yields at least
-* one publish target). Used when `.changeset/config.json` declares no explicit
-* `packages` record. The changeset `ignore` list is intentionally NOT consulted
-* here — an ignored package still declares publishConfig and remains a valid
-* changeset target.
+* one publish target). Used both when `.changeset/config.json` declares no
+* explicit `packages` record AND to augment an explicit record with the
+* remaining workspace packages it does not list (so the record annotates the
+* listed packages without shrinking the release surface). The changeset
+* `ignore` list is intentionally NOT consulted here — an ignored package still
+* declares publishConfig and remains a valid changeset target.
 */
 function buildFallbackScopes(fs, workspaces) {
 	return effect.Effect.forEach(workspaces, (ws) => effect.Effect.gen(function* () {
@@ -77332,19 +77367,24 @@ function makeShape$2(reader, discovery, fs) {
 		}));
 		const hasExplicitPackages = Object.keys(decodedOptions.packages ?? {}).length > 0;
 		let scopes;
-		if (hasExplicitPackages) try {
-			scopes = buildResolvedScopes({
-				options: decodedOptions,
-				workspaces,
-				projectDir,
-				configPath
-			});
-			checkConflicts(scopes, workspaces, projectDir, configPath);
-		} catch (e) {
-			if (e instanceof ConfigurationError) return yield* effect.Effect.fail(e);
-			throw e;
-		}
-		else scopes = yield* buildFallbackScopes(fs, workspaces);
+		if (hasExplicitPackages) {
+			let explicitScopes;
+			try {
+				explicitScopes = buildResolvedScopes({
+					options: decodedOptions,
+					workspaces,
+					projectDir,
+					configPath
+				});
+				checkConflicts(explicitScopes, workspaces, projectDir, configPath);
+			} catch (e) {
+				if (e instanceof ConfigurationError) return yield* effect.Effect.fail(e);
+				throw e;
+			}
+			const explicitNames = new Set(explicitScopes.map((s) => s.name));
+			const discoveredScopes = yield* buildFallbackScopes(fs, workspaces.filter((w) => !explicitNames.has(w.name)));
+			scopes = [...explicitScopes, ...discoveredScopes];
+		} else scopes = yield* buildFallbackScopes(fs, workspaces);
 		const inspected = {
 			configPath,
 			projectDir,

package/lint.d.ts

@@ -88,7 +88,9 @@ declare const MARKDOWNLINT_CONFIG: {
   readonly MD024: {
     readonly siblings_only: true;
   };
-  readonly MD025: true;
+  readonly MD025: {
+    readonly front_matter_title: "";
+  };
   readonly MD026: true;
   readonly MD027: true;
   readonly MD028: true;
@@ -141,7 +143,7 @@ declare const MARKDOWNLINT_TEMPLATE: {
   readonly fix: true;
   readonly gitignore: true;
   readonly noBanner: true;
-  readonly ignores: readonly ["**/node_modules", "**/.cache", "**/coverage", "**/.coverage", "**/dist", "**/CHANGELOG.md", "**/.claude/plans", "**/docs/superpowers"];
+  readonly ignores: readonly ["**/node_modules", "**/.cache", "**/coverage", "**/.coverage", "**/dist", "**/CHANGELOG.md", "**/.claude/plans", "**/docs/superpowers", "**/__test__/**/fixtures/**", "**/__fixtures__/**"];
   readonly customRules: readonly ["@savvy-web/silk/changesets/markdownlint"];
   readonly config: {
     readonly default: true;
@@ -171,7 +173,9 @@ declare const MARKDOWNLINT_TEMPLATE: {
     readonly MD024: {
       readonly siblings_only: true;
     };
-    readonly MD025: true;
+    readonly MD025: {
+      readonly front_matter_title: "";
+    };
     readonly MD026: true;
     readonly MD027: true;
     readonly MD028: true;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@savvy-web/silk",
-	"version": "1.0.0",
+	"version": "1.1.1",
 	"private": false,
 	"description": "The single Silk Suite dev-tooling package — changeset, commitlint, lint, and biome conventions",
 	"homepage": "https://github.com/savvy-web/systems/tree/main/packages/silk",
@@ -60,11 +60,13 @@
 			"import": "./lint.js"
 		},
 		"./biome": "./public/biome/silk.jsonc",
+		"./tsconfig/node/root.json": "./public/tsconfig/node/root.json",
+		"./tsconfig/rspress/website.json": "./public/tsconfig/rspress/website.json",
 		"./package.json": "./package.json"
 	},
 	"dependencies": {
 		"@effect/platform": "^0.96.1",
-		"@savvy-web/silk-effects": "1.1.0",
+		"@savvy-web/silk-effects": "1.3.0",
 		"effect": "^3.21.3",
 		"semver": "^7.8.4"
 	},
@@ -73,8 +75,8 @@
 		"@changesets/cli": "^2.31.0",
 		"@commitlint/cli": "^21.0.1",
 		"@commitlint/config-conventional": "^21.0.2",
-		"@savvy-web/cli": "1.0.0",
-		"@savvy-web/mcp": "1.0.0",
+		"@savvy-web/cli": "1.1.1",
+		"@savvy-web/mcp": "1.1.1",
 		"@types/node": "^25.9.0",
 		"@typescript/native-preview": "^7.0.0-dev.20260513.1",
 		"commitizen": "^4.3.0",

package/packages/silk-effects/dist/dev/pkg/changesets/services/config-inspector.cjs

@@ -248,10 +248,12 @@ function readRawPackageJson(fs, pkgDir) {
 /**
 * Build resolved scopes from the discovered workspace packages, keeping only
 * those that are a release surface (declare publishConfig that yields at least
-* one publish target). Used when `.changeset/config.json` declares no explicit
-* `packages` record. The changeset `ignore` list is intentionally NOT consulted
-* here — an ignored package still declares publishConfig and remains a valid
-* changeset target.
+* one publish target). Used both when `.changeset/config.json` declares no
+* explicit `packages` record AND to augment an explicit record with the
+* remaining workspace packages it does not list (so the record annotates the
+* listed packages without shrinking the release surface). The changeset
+* `ignore` list is intentionally NOT consulted here — an ignored package still
+* declares publishConfig and remains a valid changeset target.
 */
 function buildFallbackScopes(fs, workspaces) {
 	return effect.Effect.forEach(workspaces, (ws) => effect.Effect.gen(function* () {
@@ -365,19 +367,24 @@ function makeShape(reader, discovery, fs) {
 		}));
 		const hasExplicitPackages = Object.keys(decodedOptions.packages ?? {}).length > 0;
 		let scopes;
-		if (hasExplicitPackages) try {
-			scopes = buildResolvedScopes({
-				options: decodedOptions,
-				workspaces,
-				projectDir,
-				configPath
-			});
-			checkConflicts(scopes, workspaces, projectDir, configPath);
-		} catch (e) {
-			if (e instanceof require_errors.ConfigurationError) return yield* effect.Effect.fail(e);
-			throw e;
-		}
-		else scopes = yield* buildFallbackScopes(fs, workspaces);
+		if (hasExplicitPackages) {
+			let explicitScopes;
+			try {
+				explicitScopes = buildResolvedScopes({
+					options: decodedOptions,
+					workspaces,
+					projectDir,
+					configPath
+				});
+				checkConflicts(explicitScopes, workspaces, projectDir, configPath);
+			} catch (e) {
+				if (e instanceof require_errors.ConfigurationError) return yield* effect.Effect.fail(e);
+				throw e;
+			}
+			const explicitNames = new Set(explicitScopes.map((s) => s.name));
+			const discoveredScopes = yield* buildFallbackScopes(fs, workspaces.filter((w) => !explicitNames.has(w.name)));
+			scopes = [...explicitScopes, ...discoveredScopes];
+		} else scopes = yield* buildFallbackScopes(fs, workspaces);
 		const inspected = {
 			configPath,
 			projectDir,

package/packages/silk-effects/dist/dev/pkg/changesets/services/config-inspector.js

@@ -248,10 +248,12 @@ function readRawPackageJson(fs, pkgDir) {
 /**
 * Build resolved scopes from the discovered workspace packages, keeping only
 * those that are a release surface (declare publishConfig that yields at least
-* one publish target). Used when `.changeset/config.json` declares no explicit
-* `packages` record. The changeset `ignore` list is intentionally NOT consulted
-* here — an ignored package still declares publishConfig and remains a valid
-* changeset target.
+* one publish target). Used both when `.changeset/config.json` declares no
+* explicit `packages` record AND to augment an explicit record with the
+* remaining workspace packages it does not list (so the record annotates the
+* listed packages without shrinking the release surface). The changeset
+* `ignore` list is intentionally NOT consulted here — an ignored package still
+* declares publishConfig and remains a valid changeset target.
 */
 function buildFallbackScopes(fs, workspaces) {
 	return Effect.forEach(workspaces, (ws) => Effect.gen(function* () {
@@ -365,19 +367,24 @@ function makeShape(reader, discovery, fs) {
 		}));
 		const hasExplicitPackages = Object.keys(decodedOptions.packages ?? {}).length > 0;
 		let scopes;
-		if (hasExplicitPackages) try {
-			scopes = buildResolvedScopes({
-				options: decodedOptions,
-				workspaces,
-				projectDir,
-				configPath
-			});
-			checkConflicts(scopes, workspaces, projectDir, configPath);
-		} catch (e) {
-			if (e instanceof ConfigurationError) return yield* Effect.fail(e);
-			throw e;
-		}
-		else scopes = yield* buildFallbackScopes(fs, workspaces);
+		if (hasExplicitPackages) {
+			let explicitScopes;
+			try {
+				explicitScopes = buildResolvedScopes({
+					options: decodedOptions,
+					workspaces,
+					projectDir,
+					configPath
+				});
+				checkConflicts(explicitScopes, workspaces, projectDir, configPath);
+			} catch (e) {
+				if (e instanceof ConfigurationError) return yield* Effect.fail(e);
+				throw e;
+			}
+			const explicitNames = new Set(explicitScopes.map((s) => s.name));
+			const discoveredScopes = yield* buildFallbackScopes(fs, workspaces.filter((w) => !explicitNames.has(w.name)));
+			scopes = [...explicitScopes, ...discoveredScopes];
+		} else scopes = yield* buildFallbackScopes(fs, workspaces);
 		const inspected = {
 			configPath,
 			projectDir,

package/packages/silk-effects/dist/dev/pkg/services/SilkPublishability.cjs

@@ -16,6 +16,26 @@ const DEFAULT_REGISTRIES = {
 	github: "https://npm.pkg.github.com"
 };
 /**
+* Whether a registry endpoint participates in npm-style SLSA provenance.
+*
+* @remarks
+* The npm public registry and GitHub Packages both accept provenance attestations through the
+* Sigstore/OIDC trusted-publishing flow, so a {@link PublishTarget} bound to either is marked
+* `provenance: true` by default — this is what gates the release action's attestation step. JSR
+* and custom registries do not participate and resolve to `false`. Matching is endpoint-based
+* (not target-key based) so a custom key pointed at one of these registries still opts in.
+*/
+const provenanceForRegistry = (registry) => {
+	const normalized = /^[a-z]+:\/\//i.test(registry) ? registry : `https://${registry}`;
+	let hostname;
+	try {
+		hostname = new URL(normalized).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return hostname === "registry.npmjs.org" || hostname === "npm.pkg.github.com";
+};
+/**
 * Silk publishability rules over `workspaces-effect`'s {@link PublishTarget}.
 *
 * @remarks
@@ -57,28 +77,41 @@ var SilkPublishability = class {
 					name: t.name,
 					registry: t.registry,
 					directory: dirByGroup.get(t.group) ?? `dist/prod/${t.group}/pkg`,
-					access
+					access,
+					provenance: provenanceForRegistry(t.registry)
 				}));
 			}
-			return Object.keys(targets).map((id) => new require_index.PublishTarget({
+			return Object.entries(targets).map(([id, target]) => {
+				const registry = typeof target === "object" && target !== null && typeof target.registry === "string" ? target.registry : DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT;
+				return new require_index.PublishTarget({
+					name: pkgName,
+					registry,
+					directory: `dist/prod/${id}/pkg`,
+					access,
+					provenance: provenanceForRegistry(registry)
+				});
+			});
+		}
+		if (pc && (pc.access === "public" || pc.access === "restricted")) {
+			const registry = pc.registry ?? NPM_DEFAULT;
+			return [new require_index.PublishTarget({
+				name: pkgName,
+				registry,
+				directory: pc.directory ?? ".",
+				access: pc.access,
+				provenance: provenanceForRegistry(registry)
+			})];
+		}
+		if (raw.private !== true) {
+			const registry = pc?.registry ?? NPM_DEFAULT;
+			return [new require_index.PublishTarget({
 				name: pkgName,
-				registry: DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT,
-				directory: `dist/prod/${id}/pkg`,
-				access
-			}));
+				registry,
+				directory: pc?.directory ?? ".",
+				access: pc?.access ?? "public",
+				provenance: provenanceForRegistry(registry)
+			})];
 		}
-		if (pc && (pc.access === "public" || pc.access === "restricted")) return [new require_index.PublishTarget({
-			name: pkgName,
-			registry: pc.registry ?? NPM_DEFAULT,
-			directory: pc.directory ?? ".",
-			access: pc.access
-		})];
-		if (raw.private !== true) return [new require_index.PublishTarget({
-			name: pkgName,
-			registry: pc?.registry ?? NPM_DEFAULT,
-			directory: pc?.directory ?? ".",
-			access: pc?.access ?? "public"
-		})];
 		return [];
 	}
 	/**

package/packages/silk-effects/dist/dev/pkg/services/SilkPublishability.js

@@ -16,6 +16,26 @@ const DEFAULT_REGISTRIES = {
 	github: "https://npm.pkg.github.com"
 };
 /**
+* Whether a registry endpoint participates in npm-style SLSA provenance.
+*
+* @remarks
+* The npm public registry and GitHub Packages both accept provenance attestations through the
+* Sigstore/OIDC trusted-publishing flow, so a {@link PublishTarget} bound to either is marked
+* `provenance: true` by default — this is what gates the release action's attestation step. JSR
+* and custom registries do not participate and resolve to `false`. Matching is endpoint-based
+* (not target-key based) so a custom key pointed at one of these registries still opts in.
+*/
+const provenanceForRegistry = (registry) => {
+	const normalized = /^[a-z]+:\/\//i.test(registry) ? registry : `https://${registry}`;
+	let hostname;
+	try {
+		hostname = new URL(normalized).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return hostname === "registry.npmjs.org" || hostname === "npm.pkg.github.com";
+};
+/**
 * Silk publishability rules over `workspaces-effect`'s {@link PublishTarget}.
 *
 * @remarks
@@ -57,28 +77,41 @@ var SilkPublishability = class {
 					name: t.name,
 					registry: t.registry,
 					directory: dirByGroup.get(t.group) ?? `dist/prod/${t.group}/pkg`,
-					access
+					access,
+					provenance: provenanceForRegistry(t.registry)
 				}));
 			}
-			return Object.keys(targets).map((id) => new PublishTarget({
+			return Object.entries(targets).map(([id, target]) => {
+				const registry = typeof target === "object" && target !== null && typeof target.registry === "string" ? target.registry : DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT;
+				return new PublishTarget({
+					name: pkgName,
+					registry,
+					directory: `dist/prod/${id}/pkg`,
+					access,
+					provenance: provenanceForRegistry(registry)
+				});
+			});
+		}
+		if (pc && (pc.access === "public" || pc.access === "restricted")) {
+			const registry = pc.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
+				name: pkgName,
+				registry,
+				directory: pc.directory ?? ".",
+				access: pc.access,
+				provenance: provenanceForRegistry(registry)
+			})];
+		}
+		if (raw.private !== true) {
+			const registry = pc?.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
 				name: pkgName,
-				registry: DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT,
-				directory: `dist/prod/${id}/pkg`,
-				access
-			}));
+				registry,
+				directory: pc?.directory ?? ".",
+				access: pc?.access ?? "public",
+				provenance: provenanceForRegistry(registry)
+			})];
 		}
-		if (pc && (pc.access === "public" || pc.access === "restricted")) return [new PublishTarget({
-			name: pkgName,
-			registry: pc.registry ?? NPM_DEFAULT,
-			directory: pc.directory ?? ".",
-			access: pc.access
-		})];
-		if (raw.private !== true) return [new PublishTarget({
-			name: pkgName,
-			registry: pc?.registry ?? NPM_DEFAULT,
-			directory: pc?.directory ?? ".",
-			access: pc?.access ?? "public"
-		})];
 		return [];
 	}
 	/**

package/public/biome/silk.jsonc

@@ -107,7 +107,7 @@
 					}
 				}
 			},
-			"includes": ["**/turbo.json", "**/tsconfig.json", "**/tsconfig.*.json"]
+			"includes": ["**/turbo.json", "**/tsconfig.json", "**/tsconfig.*.json", "**/public/tsconfig/**/*.json"]
 		},
 		{
 			"includes": ["**/*.test.ts"],
@@ -138,7 +138,8 @@
 			"!**/.vitest",
 			"!**/.coverage",
 			"!coverage",
-			"!**/__test__/fixtures",
+			"!.claude/worktrees",
+			"!**/__test__/**/fixtures",
 			"!**/__test__/snapshots",
 			"!**/__test__/**/fixtures",
 			"!**/__test__/**/snapshots",

package/public/tsconfig/node/root.json

@@ -0,0 +1,35 @@
+{
+	"$schema": "https://json.schemastore.org/tsconfig",
+	"compilerOptions": {
+		"composite": true,
+		"declaration": true,
+		"module": "nodenext",
+		"outDir": "dist",
+		"resolveJsonModule": true,
+		"strict": true,
+		"strictNullChecks": true,
+		"target": "es2025",
+		"types": ["node"]
+	},
+	"exclude": ["${configDir}/node_modules", "${configDir}/dist/**/*"],
+	"include": [
+		"${configDir}/types/*.ts",
+		"${configDir}/package.json",
+		"${configDir}/*.ts",
+		"${configDir}/*.cts",
+		"${configDir}/*.mts",
+		"${configDir}/src/**/*.ts",
+		"${configDir}/src/**/*.tsx",
+		"${configDir}/src/**/*.cts",
+		"${configDir}/src/**/*.mts",
+		"${configDir}/lib/**/*.ts",
+		"${configDir}/lib/**/*.tsx",
+		"${configDir}/lib/**/*.cts",
+		"${configDir}/lib/**/*.mts",
+		"${configDir}/__test__/**/*.ts",
+		"${configDir}/__test__/**/*.tsx",
+		"${configDir}/__test__/**/*.cts",
+		"${configDir}/__test__/**/*.mts",
+		"${configDir}/public/**/*.json"
+	]
+}

package/public/tsconfig/rspress/website.json

@@ -0,0 +1,28 @@
+{
+	"$schema": "https://json.schemastore.org/tsconfig.json",
+	"compilerOptions": {
+		"allowImportingTsExtensions": true,
+		"isolatedModules": true,
+		"jsx": "react-jsx",
+		"lib": ["dom", "es2023"],
+		"module": "esnext",
+		"moduleDetection": "force",
+		"moduleResolution": "bundler",
+		"noEmit": true,
+		"noUncheckedSideEffectImports": true,
+		"noUnusedLocals": true,
+		"noUnusedParameters": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"strict": true,
+		"target": "es2023",
+		"types": ["node", "react", "react-dom"],
+		"useDefineForClassFields": true,
+		"verbatimModuleSyntax": true
+	},
+	"exclude": ["${configDir}/node_modules", "${configDir}/dist", "${configDir}/.rspress"],
+	"include": ["${configDir}/docs", "${configDir}/theme", "${configDir}/rspress.config.ts", "${configDir}/types/*.d.ts"],
+	"mdx": {
+		"checkMdx": true
+	}
+}