@savvy-web/silk 1.1.0 → 1.1.2

package/changesets-changelog.cjs

@@ -74158,6 +74158,26 @@ const DEFAULT_REGISTRIES = {
 	github: "https://npm.pkg.github.com"
 };
 /**
+* Whether a registry endpoint participates in npm-style SLSA provenance.
+*
+* @remarks
+* The npm public registry and GitHub Packages both accept provenance attestations through the
+* Sigstore/OIDC trusted-publishing flow, so a {@link PublishTarget} bound to either is marked
+* `provenance: true` by default — this is what gates the release action's attestation step. JSR
+* and custom registries do not participate and resolve to `false`. Matching is endpoint-based
+* (not target-key based) so a custom key pointed at one of these registries still opts in.
+*/
+const provenanceForRegistry = (registry) => {
+	const normalized = /^[a-z]+:\/\//i.test(registry) ? registry : `https://${registry}`;
+	let hostname;
+	try {
+		hostname = new URL(normalized).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return hostname === "registry.npmjs.org" || hostname === "npm.pkg.github.com";
+};
+/**
 * Silk publishability rules over `workspaces-effect`'s {@link PublishTarget}.
 *
 * @remarks
@@ -74199,28 +74219,41 @@ var SilkPublishability = class {
 					name: t.name,
 					registry: t.registry,
 					directory: dirByGroup.get(t.group) ?? `dist/prod/${t.group}/pkg`,
-					access
+					access,
+					provenance: provenanceForRegistry(t.registry)
 				}));
 			}
-			return Object.keys(targets).map((id) => new PublishTarget({
+			return Object.entries(targets).map(([id, target]) => {
+				const registry = typeof target === "object" && target !== null && typeof target.registry === "string" ? target.registry : DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT;
+				return new PublishTarget({
+					name: pkgName,
+					registry,
+					directory: `dist/prod/${id}/pkg`,
+					access,
+					provenance: provenanceForRegistry(registry)
+				});
+			});
+		}
+		if (pc && (pc.access === "public" || pc.access === "restricted")) {
+			const registry = pc.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
 				name: pkgName,
-				registry: DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT,
-				directory: `dist/prod/${id}/pkg`,
-				access
-			}));
+				registry,
+				directory: pc.directory ?? ".",
+				access: pc.access,
+				provenance: provenanceForRegistry(registry)
+			})];
+		}
+		if (raw.private !== true) {
+			const registry = pc?.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
+				name: pkgName,
+				registry,
+				directory: pc?.directory ?? ".",
+				access: pc?.access ?? "public",
+				provenance: provenanceForRegistry(registry)
+			})];
 		}
-		if (pc && (pc.access === "public" || pc.access === "restricted")) return [new PublishTarget({
-			name: pkgName,
-			registry: pc.registry ?? NPM_DEFAULT,
-			directory: pc.directory ?? ".",
-			access: pc.access
-		})];
-		if (raw.private !== true) return [new PublishTarget({
-			name: pkgName,
-			registry: pc?.registry ?? NPM_DEFAULT,
-			directory: pc?.directory ?? ".",
-			access: pc?.access ?? "public"
-		})];
 		return [];
 	}
 	/**

package/changesets-markdownlint.cjs

@@ -74162,6 +74162,26 @@ const DEFAULT_REGISTRIES = {
 	github: "https://npm.pkg.github.com"
 };
 /**
+* Whether a registry endpoint participates in npm-style SLSA provenance.
+*
+* @remarks
+* The npm public registry and GitHub Packages both accept provenance attestations through the
+* Sigstore/OIDC trusted-publishing flow, so a {@link PublishTarget} bound to either is marked
+* `provenance: true` by default — this is what gates the release action's attestation step. JSR
+* and custom registries do not participate and resolve to `false`. Matching is endpoint-based
+* (not target-key based) so a custom key pointed at one of these registries still opts in.
+*/
+const provenanceForRegistry = (registry) => {
+	const normalized = /^[a-z]+:\/\//i.test(registry) ? registry : `https://${registry}`;
+	let hostname;
+	try {
+		hostname = new URL(normalized).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return hostname === "registry.npmjs.org" || hostname === "npm.pkg.github.com";
+};
+/**
 * Silk publishability rules over `workspaces-effect`'s {@link PublishTarget}.
 *
 * @remarks
@@ -74203,28 +74223,41 @@ var SilkPublishability = class {
 					name: t.name,
 					registry: t.registry,
 					directory: dirByGroup.get(t.group) ?? `dist/prod/${t.group}/pkg`,
-					access
+					access,
+					provenance: provenanceForRegistry(t.registry)
 				}));
 			}
-			return Object.keys(targets).map((id) => new PublishTarget({
+			return Object.entries(targets).map(([id, target]) => {
+				const registry = typeof target === "object" && target !== null && typeof target.registry === "string" ? target.registry : DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT;
+				return new PublishTarget({
+					name: pkgName,
+					registry,
+					directory: `dist/prod/${id}/pkg`,
+					access,
+					provenance: provenanceForRegistry(registry)
+				});
+			});
+		}
+		if (pc && (pc.access === "public" || pc.access === "restricted")) {
+			const registry = pc.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
 				name: pkgName,
-				registry: DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT,
-				directory: `dist/prod/${id}/pkg`,
-				access
-			}));
+				registry,
+				directory: pc.directory ?? ".",
+				access: pc.access,
+				provenance: provenanceForRegistry(registry)
+			})];
+		}
+		if (raw.private !== true) {
+			const registry = pc?.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
+				name: pkgName,
+				registry,
+				directory: pc?.directory ?? ".",
+				access: pc?.access ?? "public",
+				provenance: provenanceForRegistry(registry)
+			})];
 		}
-		if (pc && (pc.access === "public" || pc.access === "restricted")) return [new PublishTarget({
-			name: pkgName,
-			registry: pc.registry ?? NPM_DEFAULT,
-			directory: pc.directory ?? ".",
-			access: pc.access
-		})];
-		if (raw.private !== true) return [new PublishTarget({
-			name: pkgName,
-			registry: pc?.registry ?? NPM_DEFAULT,
-			directory: pc?.directory ?? ".",
-			access: pc?.access ?? "public"
-		})];
 		return [];
 	}
 	/**

package/lint.d.ts

@@ -143,7 +143,7 @@ declare const MARKDOWNLINT_TEMPLATE: {
   readonly fix: true;
   readonly gitignore: true;
   readonly noBanner: true;
-  readonly ignores: readonly ["**/node_modules", "**/.cache", "**/coverage", "**/.coverage", "**/dist", "**/CHANGELOG.md", "**/.claude/plans", "**/docs/superpowers", "**/__test__/**/fixtures/**", "**/__fixtures__/**"];
+  readonly ignores: readonly ["**/.git", "**/node_modules", "**/.cache", "**/coverage", "**/.coverage", "**/dist", "**/CHANGELOG.md", "**/.claude/plans", "**/docs/superpowers", "**/__test__/**/fixtures/**", "**/__fixtures__/**"];
   readonly customRules: readonly ["@savvy-web/silk/changesets/markdownlint"];
   readonly config: {
     readonly default: true;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@savvy-web/silk",
-	"version": "1.1.0",
+	"version": "1.1.2",
 	"private": false,
 	"description": "The single Silk Suite dev-tooling package — changeset, commitlint, lint, and biome conventions",
 	"homepage": "https://github.com/savvy-web/systems/tree/main/packages/silk",
@@ -66,7 +66,7 @@
 	},
 	"dependencies": {
 		"@effect/platform": "^0.96.1",
-		"@savvy-web/silk-effects": "1.2.0",
+		"@savvy-web/silk-effects": "1.3.1",
 		"effect": "^3.21.3",
 		"semver": "^7.8.4"
 	},
@@ -75,8 +75,8 @@
 		"@changesets/cli": "^2.31.0",
 		"@commitlint/cli": "^21.0.1",
 		"@commitlint/config-conventional": "^21.0.2",
-		"@savvy-web/cli": "1.1.0",
-		"@savvy-web/mcp": "1.1.0",
+		"@savvy-web/cli": "1.1.2",
+		"@savvy-web/mcp": "1.1.2",
 		"@types/node": "^25.9.0",
 		"@typescript/native-preview": "^7.0.0-dev.20260513.1",
 		"commitizen": "^4.3.0",

package/packages/silk-effects/dist/dev/pkg/services/SilkPublishability.cjs

@@ -16,6 +16,26 @@ const DEFAULT_REGISTRIES = {
 	github: "https://npm.pkg.github.com"
 };
 /**
+* Whether a registry endpoint participates in npm-style SLSA provenance.
+*
+* @remarks
+* The npm public registry and GitHub Packages both accept provenance attestations through the
+* Sigstore/OIDC trusted-publishing flow, so a {@link PublishTarget} bound to either is marked
+* `provenance: true` by default — this is what gates the release action's attestation step. JSR
+* and custom registries do not participate and resolve to `false`. Matching is endpoint-based
+* (not target-key based) so a custom key pointed at one of these registries still opts in.
+*/
+const provenanceForRegistry = (registry) => {
+	const normalized = /^[a-z]+:\/\//i.test(registry) ? registry : `https://${registry}`;
+	let hostname;
+	try {
+		hostname = new URL(normalized).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return hostname === "registry.npmjs.org" || hostname === "npm.pkg.github.com";
+};
+/**
 * Silk publishability rules over `workspaces-effect`'s {@link PublishTarget}.
 *
 * @remarks
@@ -57,28 +77,41 @@ var SilkPublishability = class {
 					name: t.name,
 					registry: t.registry,
 					directory: dirByGroup.get(t.group) ?? `dist/prod/${t.group}/pkg`,
-					access
+					access,
+					provenance: provenanceForRegistry(t.registry)
 				}));
 			}
-			return Object.keys(targets).map((id) => new require_index.PublishTarget({
+			return Object.entries(targets).map(([id, target]) => {
+				const registry = typeof target === "object" && target !== null && typeof target.registry === "string" ? target.registry : DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT;
+				return new require_index.PublishTarget({
+					name: pkgName,
+					registry,
+					directory: `dist/prod/${id}/pkg`,
+					access,
+					provenance: provenanceForRegistry(registry)
+				});
+			});
+		}
+		if (pc && (pc.access === "public" || pc.access === "restricted")) {
+			const registry = pc.registry ?? NPM_DEFAULT;
+			return [new require_index.PublishTarget({
+				name: pkgName,
+				registry,
+				directory: pc.directory ?? ".",
+				access: pc.access,
+				provenance: provenanceForRegistry(registry)
+			})];
+		}
+		if (raw.private !== true) {
+			const registry = pc?.registry ?? NPM_DEFAULT;
+			return [new require_index.PublishTarget({
 				name: pkgName,
-				registry: DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT,
-				directory: `dist/prod/${id}/pkg`,
-				access
-			}));
+				registry,
+				directory: pc?.directory ?? ".",
+				access: pc?.access ?? "public",
+				provenance: provenanceForRegistry(registry)
+			})];
 		}
-		if (pc && (pc.access === "public" || pc.access === "restricted")) return [new require_index.PublishTarget({
-			name: pkgName,
-			registry: pc.registry ?? NPM_DEFAULT,
-			directory: pc.directory ?? ".",
-			access: pc.access
-		})];
-		if (raw.private !== true) return [new require_index.PublishTarget({
-			name: pkgName,
-			registry: pc?.registry ?? NPM_DEFAULT,
-			directory: pc?.directory ?? ".",
-			access: pc?.access ?? "public"
-		})];
 		return [];
 	}
 	/**

package/packages/silk-effects/dist/dev/pkg/services/SilkPublishability.js

@@ -16,6 +16,26 @@ const DEFAULT_REGISTRIES = {
 	github: "https://npm.pkg.github.com"
 };
 /**
+* Whether a registry endpoint participates in npm-style SLSA provenance.
+*
+* @remarks
+* The npm public registry and GitHub Packages both accept provenance attestations through the
+* Sigstore/OIDC trusted-publishing flow, so a {@link PublishTarget} bound to either is marked
+* `provenance: true` by default — this is what gates the release action's attestation step. JSR
+* and custom registries do not participate and resolve to `false`. Matching is endpoint-based
+* (not target-key based) so a custom key pointed at one of these registries still opts in.
+*/
+const provenanceForRegistry = (registry) => {
+	const normalized = /^[a-z]+:\/\//i.test(registry) ? registry : `https://${registry}`;
+	let hostname;
+	try {
+		hostname = new URL(normalized).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return hostname === "registry.npmjs.org" || hostname === "npm.pkg.github.com";
+};
+/**
 * Silk publishability rules over `workspaces-effect`'s {@link PublishTarget}.
 *
 * @remarks
@@ -57,28 +77,41 @@ var SilkPublishability = class {
 					name: t.name,
 					registry: t.registry,
 					directory: dirByGroup.get(t.group) ?? `dist/prod/${t.group}/pkg`,
-					access
+					access,
+					provenance: provenanceForRegistry(t.registry)
 				}));
 			}
-			return Object.keys(targets).map((id) => new PublishTarget({
+			return Object.entries(targets).map(([id, target]) => {
+				const registry = typeof target === "object" && target !== null && typeof target.registry === "string" ? target.registry : DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT;
+				return new PublishTarget({
+					name: pkgName,
+					registry,
+					directory: `dist/prod/${id}/pkg`,
+					access,
+					provenance: provenanceForRegistry(registry)
+				});
+			});
+		}
+		if (pc && (pc.access === "public" || pc.access === "restricted")) {
+			const registry = pc.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
+				name: pkgName,
+				registry,
+				directory: pc.directory ?? ".",
+				access: pc.access,
+				provenance: provenanceForRegistry(registry)
+			})];
+		}
+		if (raw.private !== true) {
+			const registry = pc?.registry ?? NPM_DEFAULT;
+			return [new PublishTarget({
 				name: pkgName,
-				registry: DEFAULT_REGISTRIES[id] ?? pc?.registry ?? NPM_DEFAULT,
-				directory: `dist/prod/${id}/pkg`,
-				access
-			}));
+				registry,
+				directory: pc?.directory ?? ".",
+				access: pc?.access ?? "public",
+				provenance: provenanceForRegistry(registry)
+			})];
 		}
-		if (pc && (pc.access === "public" || pc.access === "restricted")) return [new PublishTarget({
-			name: pkgName,
-			registry: pc.registry ?? NPM_DEFAULT,
-			directory: pc.directory ?? ".",
-			access: pc.access
-		})];
-		if (raw.private !== true) return [new PublishTarget({
-			name: pkgName,
-			registry: pc?.registry ?? NPM_DEFAULT,
-			directory: pc?.directory ?? ".",
-			access: pc?.access ?? "public"
-		})];
 		return [];
 	}
 	/**