@savvy-web/silk 2.2.0 → 2.2.1

package/changesets-changelog.js

@@ -295,6 +295,33 @@ const ChangesetConfigReaderLive = Layer.effect(ChangesetConfigReader, Effect.gen
 	return { read };
 }));
 
+//#endregion
+//#region ../silk-effects/dist/dev/pkg/errors/PublishTargetBindingError.js
+/**
+* Raised when publishability detection selects a directory that the package's
+* `dist/prod/targets.json` binding does not describe.
+*
+* @remarks
+* The bundler's prod build writes `targets.json` naming every byte-group
+* directory it produced. Once that binding exists it is authoritative: the only
+* directories whose bytes may be published are the ones it lists. A detector
+* that returns anything else — most often `publishConfig.directory` pointing at
+* a **dev** build, because silk mode was misdetected — is about to pack an
+* unresolved workspace manifest and ship it to a registry.
+*
+* That is the `yaml-effect@0.7.1` failure: detection picked `dist/dev/pkg`, the
+* dev manifest still carried `catalog:` specifiers, and the published package
+* was uninstallable (`EUNSUPPORTEDPROTOCOL`).
+*
+* @since 3.1.0
+* @public
+*/
+var PublishTargetBindingError = class extends Data.TaggedError("PublishTargetBindingError") {
+	get message() {
+		return `Package ${this.pkg} resolved publish directory "${this.directory}", which is not one of the directories bound by dist/prod/targets.json (${this.boundDirectories.join(", ")}). This means publishability detection did not select the prod build output — refusing to publish before packing an unresolved manifest.`;
+	}
+};
+
 //#endregion
 //#region ../silk-effects/dist/dev/pkg/services/ChangesetConfig.js
 /**
@@ -10970,6 +10997,17 @@ var SilkPublishability = class {
 	* Resolve a package's publish targets via {@link SilkPublishability}, then drop any
 	* whose built `directory` package.json is `private: true`. Returned targets keep the
 	* detector's original (possibly package-relative) `directory`.
+	*
+	* @remarks
+	* When the prod build has written `dist/prod/targets.json`, that binding is
+	* authoritative: every surviving target's directory must be one of the group
+	* directories it names. A directory outside the binding means detection did
+	* not select the prod output — the `yaml-effect@0.7.1` shape, where a dev
+	* manifest carrying `catalog:` specifiers was packed and published. Rather
+	* than ship those bytes, fail with {@link PublishTargetBindingError}.
+	*
+	* Before the prod build runs there is no binding, and the detector's
+	* placeholder directories are left alone.
 	*/
 	static resolveTargets(pkg, root) {
 		return Effect.gen(function* () {
@@ -10981,6 +11019,18 @@ var SilkPublishability = class {
 				const dir = isAbsolute(t.directory) ? t.directory : join(pkg.path, t.directory);
 				if (!(yield* isTargetPrivate(fs, dir))) kept.push(t);
 			}
+			const binding = yield* readTargetsBinding(fs, pkg.path);
+			if (binding === null) return kept;
+			const boundDirectories = binding.groups.map((g) => normalizeDir(g.dir));
+			const bound = new Set(boundDirectories);
+			for (const t of kept) {
+				const relativeDir = normalizeDir(isAbsolute(t.directory) ? relative(pkg.path, t.directory) : t.directory);
+				if (!bound.has(relativeDir)) return yield* Effect.fail(new PublishTargetBindingError({
+					pkg: pkg.name,
+					directory: relativeDir,
+					boundDirectories
+				}));
+			}
 			return kept;
 		});
 	}
@@ -11007,6 +11057,26 @@ var SilkPublishability = class {
 		});
 	}
 };
+/**
+* Reduce a directory to a comparable package-relative POSIX path: backslashes to
+* forward slashes, no `./` prefix, no trailing slash. `""` (the package root)
+* normalizes to `.`, matching how a root-directory target is recorded.
+*
+* @remarks
+* Trailing slashes are trimmed with an index scan rather than `/\/+$/`. That
+* regex is unanchored at the start, so the engine retries the match from every
+* position and degrades to O(n²) on a path of many slashes (CodeQL
+* `js/polynomial-redos`). `dir` reaches here from `dist/prod/targets.json`, which
+* the bundler writes but a consumer repo could hand-edit.
+*/
+const normalizeDir = (dir) => {
+	const slashed = dir.replaceAll("\\", "/");
+	const withoutPrefix = slashed.startsWith("./") ? slashed.slice(2) : slashed;
+	let end = withoutPrefix.length;
+	while (end > 0 && withoutPrefix[end - 1] === "/") end -= 1;
+	const normalized = withoutPrefix.slice(0, end);
+	return normalized === "" ? "." : normalized;
+};
 /** True when a built target directory's package.json is `private: true`. Missing/unreadable/malformed → false. */
 const isTargetPrivate = (fs, targetDir) => fs.readFileString(join(targetDir, "package.json")).pipe(Effect.flatMap((content) => Effect.try({
 	try: () => JSON.parse(content).private === true,

package/changesets-markdownlint.cjs

@@ -287,6 +287,32 @@ const ChangesetConfigReaderLive = effect.Layer.effect(ChangesetConfigReader, eff
 	return { read };
 }));
 //#endregion
+//#region ../silk-effects/dist/dev/pkg/errors/PublishTargetBindingError.js
+/**
+* Raised when publishability detection selects a directory that the package's
+* `dist/prod/targets.json` binding does not describe.
+*
+* @remarks
+* The bundler's prod build writes `targets.json` naming every byte-group
+* directory it produced. Once that binding exists it is authoritative: the only
+* directories whose bytes may be published are the ones it lists. A detector
+* that returns anything else — most often `publishConfig.directory` pointing at
+* a **dev** build, because silk mode was misdetected — is about to pack an
+* unresolved workspace manifest and ship it to a registry.
+*
+* That is the `yaml-effect@0.7.1` failure: detection picked `dist/dev/pkg`, the
+* dev manifest still carried `catalog:` specifiers, and the published package
+* was uninstallable (`EUNSUPPORTEDPROTOCOL`).
+*
+* @since 3.1.0
+* @public
+*/
+var PublishTargetBindingError = class extends effect.Data.TaggedError("PublishTargetBindingError") {
+	get message() {
+		return `Package ${this.pkg} resolved publish directory "${this.directory}", which is not one of the directories bound by dist/prod/targets.json (${this.boundDirectories.join(", ")}). This means publishability detection did not select the prod build output — refusing to publish before packing an unresolved manifest.`;
+	}
+};
+//#endregion
 //#region ../silk-effects/dist/dev/pkg/services/ChangesetConfig.js
 /**
 * Accessor service over a workspace root's `.changeset/config.json`.
@@ -10779,6 +10805,17 @@ var SilkPublishability = class {
 	* Resolve a package's publish targets via {@link SilkPublishability}, then drop any
 	* whose built `directory` package.json is `private: true`. Returned targets keep the
 	* detector's original (possibly package-relative) `directory`.
+	*
+	* @remarks
+	* When the prod build has written `dist/prod/targets.json`, that binding is
+	* authoritative: every surviving target's directory must be one of the group
+	* directories it names. A directory outside the binding means detection did
+	* not select the prod output — the `yaml-effect@0.7.1` shape, where a dev
+	* manifest carrying `catalog:` specifiers was packed and published. Rather
+	* than ship those bytes, fail with {@link PublishTargetBindingError}.
+	*
+	* Before the prod build runs there is no binding, and the detector's
+	* placeholder directories are left alone.
 	*/
 	static resolveTargets(pkg, root) {
 		return effect.Effect.gen(function* () {
@@ -10790,6 +10827,18 @@ var SilkPublishability = class {
 				const dir = (0, node_path.isAbsolute)(t.directory) ? t.directory : (0, node_path.join)(pkg.path, t.directory);
 				if (!(yield* isTargetPrivate(fs, dir))) kept.push(t);
 			}
+			const binding = yield* readTargetsBinding(fs, pkg.path);
+			if (binding === null) return kept;
+			const boundDirectories = binding.groups.map((g) => normalizeDir(g.dir));
+			const bound = new Set(boundDirectories);
+			for (const t of kept) {
+				const relativeDir = normalizeDir((0, node_path.isAbsolute)(t.directory) ? (0, node_path.relative)(pkg.path, t.directory) : t.directory);
+				if (!bound.has(relativeDir)) return yield* effect.Effect.fail(new PublishTargetBindingError({
+					pkg: pkg.name,
+					directory: relativeDir,
+					boundDirectories
+				}));
+			}
 			return kept;
 		});
 	}
@@ -10816,6 +10865,26 @@ var SilkPublishability = class {
 		});
 	}
 };
+/**
+* Reduce a directory to a comparable package-relative POSIX path: backslashes to
+* forward slashes, no `./` prefix, no trailing slash. `""` (the package root)
+* normalizes to `.`, matching how a root-directory target is recorded.
+*
+* @remarks
+* Trailing slashes are trimmed with an index scan rather than `/\/+$/`. That
+* regex is unanchored at the start, so the engine retries the match from every
+* position and degrades to O(n²) on a path of many slashes (CodeQL
+* `js/polynomial-redos`). `dir` reaches here from `dist/prod/targets.json`, which
+* the bundler writes but a consumer repo could hand-edit.
+*/
+const normalizeDir = (dir) => {
+	const slashed = dir.replaceAll("\\", "/");
+	const withoutPrefix = slashed.startsWith("./") ? slashed.slice(2) : slashed;
+	let end = withoutPrefix.length;
+	while (end > 0 && withoutPrefix[end - 1] === "/") end -= 1;
+	const normalized = withoutPrefix.slice(0, end);
+	return normalized === "" ? "." : normalized;
+};
 /** True when a built target directory's package.json is `private: true`. Missing/unreadable/malformed → false. */
 const isTargetPrivate = (fs, targetDir) => fs.readFileString((0, node_path.join)(targetDir, "package.json")).pipe(effect.Effect.flatMap((content) => effect.Effect.try({
 	try: () => JSON.parse(content).private === true,