@savvy-web/silk 2.2.0 → 2.2.1

package/changesets-markdownlint.js

@@ -295,6 +295,33 @@ const ChangesetConfigReaderLive = Layer.effect(ChangesetConfigReader, Effect.gen
 	return { read };
 }));
 
+//#endregion
+//#region ../silk-effects/dist/dev/pkg/errors/PublishTargetBindingError.js
+/**
+* Raised when publishability detection selects a directory that the package's
+* `dist/prod/targets.json` binding does not describe.
+*
+* @remarks
+* The bundler's prod build writes `targets.json` naming every byte-group
+* directory it produced. Once that binding exists it is authoritative: the only
+* directories whose bytes may be published are the ones it lists. A detector
+* that returns anything else — most often `publishConfig.directory` pointing at
+* a **dev** build, because silk mode was misdetected — is about to pack an
+* unresolved workspace manifest and ship it to a registry.
+*
+* That is the `yaml-effect@0.7.1` failure: detection picked `dist/dev/pkg`, the
+* dev manifest still carried `catalog:` specifiers, and the published package
+* was uninstallable (`EUNSUPPORTEDPROTOCOL`).
+*
+* @since 3.1.0
+* @public
+*/
+var PublishTargetBindingError = class extends Data.TaggedError("PublishTargetBindingError") {
+	get message() {
+		return `Package ${this.pkg} resolved publish directory "${this.directory}", which is not one of the directories bound by dist/prod/targets.json (${this.boundDirectories.join(", ")}). This means publishability detection did not select the prod build output — refusing to publish before packing an unresolved manifest.`;
+	}
+};
+
 //#endregion
 //#region ../silk-effects/dist/dev/pkg/services/ChangesetConfig.js
 /**
@@ -10970,6 +10997,17 @@ var SilkPublishability = class {
 	* Resolve a package's publish targets via {@link SilkPublishability}, then drop any
 	* whose built `directory` package.json is `private: true`. Returned targets keep the
 	* detector's original (possibly package-relative) `directory`.
+	*
+	* @remarks
+	* When the prod build has written `dist/prod/targets.json`, that binding is
+	* authoritative: every surviving target's directory must be one of the group
+	* directories it names. A directory outside the binding means detection did
+	* not select the prod output — the `yaml-effect@0.7.1` shape, where a dev
+	* manifest carrying `catalog:` specifiers was packed and published. Rather
+	* than ship those bytes, fail with {@link PublishTargetBindingError}.
+	*
+	* Before the prod build runs there is no binding, and the detector's
+	* placeholder directories are left alone.
 	*/
 	static resolveTargets(pkg, root) {
 		return Effect.gen(function* () {
@@ -10981,6 +11019,18 @@ var SilkPublishability = class {
 				const dir = isAbsolute(t.directory) ? t.directory : join(pkg.path, t.directory);
 				if (!(yield* isTargetPrivate(fs, dir))) kept.push(t);
 			}
+			const binding = yield* readTargetsBinding(fs, pkg.path);
+			if (binding === null) return kept;
+			const boundDirectories = binding.groups.map((g) => normalizeDir(g.dir));
+			const bound = new Set(boundDirectories);
+			for (const t of kept) {
+				const relativeDir = normalizeDir(isAbsolute(t.directory) ? relative(pkg.path, t.directory) : t.directory);
+				if (!bound.has(relativeDir)) return yield* Effect.fail(new PublishTargetBindingError({
+					pkg: pkg.name,
+					directory: relativeDir,
+					boundDirectories
+				}));
+			}
 			return kept;
 		});
 	}
@@ -11007,6 +11057,26 @@ var SilkPublishability = class {
 		});
 	}
 };
+/**
+* Reduce a directory to a comparable package-relative POSIX path: backslashes to
+* forward slashes, no `./` prefix, no trailing slash. `""` (the package root)
+* normalizes to `.`, matching how a root-directory target is recorded.
+*
+* @remarks
+* Trailing slashes are trimmed with an index scan rather than `/\/+$/`. That
+* regex is unanchored at the start, so the engine retries the match from every
+* position and degrades to O(n²) on a path of many slashes (CodeQL
+* `js/polynomial-redos`). `dir` reaches here from `dist/prod/targets.json`, which
+* the bundler writes but a consumer repo could hand-edit.
+*/
+const normalizeDir = (dir) => {
+	const slashed = dir.replaceAll("\\", "/");
+	const withoutPrefix = slashed.startsWith("./") ? slashed.slice(2) : slashed;
+	let end = withoutPrefix.length;
+	while (end > 0 && withoutPrefix[end - 1] === "/") end -= 1;
+	const normalized = withoutPrefix.slice(0, end);
+	return normalized === "" ? "." : normalized;
+};
 /** True when a built target directory's package.json is `private: true`. Missing/unreadable/malformed → false. */
 const isTargetPrivate = (fs, targetDir) => fs.readFileString(join(targetDir, "package.json")).pipe(Effect.flatMap((content) => Effect.try({
 	try: () => JSON.parse(content).private === true,

package/changesets-remark.d.ts

@@ -1,5 +1,4 @@
 import { Changesets } from "@savvy-web/silk-effects";
-
 //#region src/changesets/remark.d.ts
 declare const AggregateDependencyTablesPlugin: typeof Changesets.AggregateDependencyTablesPlugin;
 declare const ContributorFootnotesPlugin: typeof Changesets.ContributorFootnotesPlugin;

package/changesets.d.ts

@@ -1,5 +1,4 @@
 import { Changesets } from "@savvy-web/silk-effects";
-
 //#region src/changesets/index.d.ts
 type LintMessage = Changesets.LintMessage;
 declare const Categories: typeof Changesets.Categories;

package/commitlint-formatter.d.ts

@@ -1,5 +1,4 @@
 import { Commitlint } from "@savvy-web/silk-effects";
-
 //#region src/commitlint/formatter.d.ts
 type FormatterResult = Commitlint.FormatterResult;
 type LintOutcome = Commitlint.LintOutcome;

package/commitlint-prompt.d.ts

@@ -1,5 +1,4 @@
 import { Commitlint } from "@savvy-web/silk-effects";
-
 //#region src/commitlint/prompt.d.ts
 type CommitType = Commitlint.CommitType;
 type PromptConfigOptions = Commitlint.PromptConfigOptions;

package/commitlint-static.d.ts

@@ -1,5 +1,4 @@
 import { Commitlint } from "@savvy-web/silk-effects";
-
 //#region src/commitlint/static.d.ts
 type CommitType = Commitlint.CommitType;
 type CommitTypeDefinition = Commitlint.CommitTypeDefinition;

package/commitlint.d.ts

@@ -1,5 +1,4 @@
 import { Commitlint } from "@savvy-web/silk-effects";
-
 //#region src/commitlint/index.d.ts
 type CommitType = Commitlint.CommitType;
 type ReleaseFormat = Commitlint.ReleaseFormat;

package/lint.d.ts

@@ -1,5 +1,4 @@
 import { ConfigDiscovery, ConfigDiscoveryLive, ConfigLocation, Lint } from "@savvy-web/silk-effects";
-
 //#region src/lint/index.d.ts
 declare const Handler: typeof Lint.Handler;
 type Handler = typeof Lint.Handler;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@savvy-web/silk",
-	"version": "2.2.0",
+	"version": "2.2.1",
 	"private": false,
 	"description": "The single Silk Suite dev-tooling package — changeset, commitlint, lint, and biome conventions",
 	"homepage": "https://github.com/savvy-web/systems/tree/main/packages/silk",
@@ -67,9 +67,9 @@
 	"dependencies": {
 		"@effect/platform": "^0.96.2",
 		"@savvy-web/changelog": "0.1.1",
-		"@savvy-web/cli": "1.5.3",
-		"@savvy-web/mcp": "1.7.0",
-		"@savvy-web/silk-effects": "3.1.0",
+		"@savvy-web/cli": "1.5.4",
+		"@savvy-web/mcp": "1.7.1",
+		"@savvy-web/silk-effects": "3.2.0",
 		"effect": "^3.21.4",
 		"semver": "^7.8.5"
 	},