@savvy-web/silk 2.2.0 → 2.2.2

package/changesets-changelog.cjs

@@ -283,6 +283,32 @@ const ChangesetConfigReaderLive = effect.Layer.effect(ChangesetConfigReader, eff
 	return { read };
 }));
 //#endregion
+//#region ../silk-effects/dist/dev/pkg/errors/PublishTargetBindingError.js
+/**
+* Raised when publishability detection selects a directory that the package's
+* `dist/prod/targets.json` binding does not describe.
+*
+* @remarks
+* The bundler's prod build writes `targets.json` naming every byte-group
+* directory it produced. Once that binding exists it is authoritative: the only
+* directories whose bytes may be published are the ones it lists. A detector
+* that returns anything else — most often `publishConfig.directory` pointing at
+* a **dev** build, because silk mode was misdetected — is about to pack an
+* unresolved workspace manifest and ship it to a registry.
+*
+* That is the `yaml-effect@0.7.1` failure: detection picked `dist/dev/pkg`, the
+* dev manifest still carried `catalog:` specifiers, and the published package
+* was uninstallable (`EUNSUPPORTEDPROTOCOL`).
+*
+* @since 3.1.0
+* @public
+*/
+var PublishTargetBindingError = class extends effect.Data.TaggedError("PublishTargetBindingError") {
+	get message() {
+		return `Package ${this.pkg} resolved publish directory "${this.directory}", which is not one of the directories bound by dist/prod/targets.json (${this.boundDirectories.join(", ")}). This means publishability detection did not select the prod build output — refusing to publish before packing an unresolved manifest.`;
+	}
+};
+//#endregion
 //#region ../silk-effects/dist/dev/pkg/services/ChangesetConfig.js
 /**
 * Accessor service over a workspace root's `.changeset/config.json`.
@@ -358,7 +384,7 @@ const ChangesetConfigLive = effect.Layer.effect(ChangesetConfig, effect.Effect.g
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogAssemblyError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogAssemblyError.js
 /**
 * Base constant for {@link CatalogAssemblyError}.
 *
@@ -385,7 +411,7 @@ var CatalogAssemblyError = class extends CatalogAssemblyErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogResolutionError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogResolutionError.js
 /**
 * Base constant for {@link CatalogResolutionError}.
 *
@@ -411,7 +437,7 @@ var CatalogResolutionError = class extends CatalogResolutionErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/GitReadError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/GitReadError.js
 /**
 * Base constant for {@link GitReadError}.
 *
@@ -436,7 +462,7 @@ var GitReadError = class extends GitReadErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/PackageNotFoundError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/PackageNotFoundError.js
 /**
 * Base constant for {@link PackageNotFoundError}.
 *
@@ -487,7 +513,7 @@ var PackageNotFoundError = class extends PackageNotFoundErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceDiscoveryError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceDiscoveryError.js
 /**
 * Base constant for {@link WorkspaceDiscoveryError}.
 *
@@ -538,7 +564,7 @@ var WorkspaceDiscoveryError = class extends WorkspaceDiscoveryErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceRootNotFoundError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceRootNotFoundError.js
 /**
 * Base constant for {@link WorkspaceRootNotFoundError}.
 *
@@ -588,7 +614,7 @@ var WorkspaceRootNotFoundError = class extends WorkspaceRootNotFoundErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceDiscovery.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceDiscovery.js
 /**
 * Service for discovering workspace packages in a monorepo.
 *
@@ -638,7 +664,7 @@ var WorkspaceRootNotFoundError = class extends WorkspaceRootNotFoundErrorBase {
 */
 var WorkspaceDiscovery = class extends effect.Context.Tag("@spencerbeggs/workspaces-effect/WorkspaceDiscovery")() {};
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceRoot.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceRoot.js
 /**
 * Service for finding the workspace root directory.
 *
@@ -6324,7 +6350,7 @@ function parse$3(text, options) {
 	}));
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/workspace-manifest.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/workspace-manifest.js
 /**
 * Parse a pnpm-workspace.yaml text into its catalog/config-dependency/packages
 * slice. Pure with respect to the filesystem.
@@ -6392,7 +6418,7 @@ function checkDefaultCatalogIsDefinedOnce(manifest) {
 	if (manifest.catalog != null && manifest.catalogs?.default != null) throw new PnpmError("INVALID_CATALOGS_CONFIGURATION", "The 'default' catalog was defined multiple times. Use the 'catalog' field or 'catalogs.default', but not both.");
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/assemble.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/assemble.js
 /** Merge catalog sources; later sources win per dependency within a catalog. */
 function mergeCatalogs(...sources) {
 	const result = {};
@@ -6473,7 +6499,7 @@ function resolveFromCatalog(catalogs, wantedDependency) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/resolve.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/resolve.js
 const DEP_FIELDS = [
 	"dependencies",
 	"devDependencies",
@@ -6543,7 +6569,7 @@ function resolveManifest(catalogs, workspaceVersions, manifest) {
 	return out;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/CatalogSet.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/CatalogSet.js
 /**
 * An immutable, fully-normalized catalog collection with the one
 * resolution semantic shared by live and point-in-time resolution.
@@ -6633,7 +6659,7 @@ var CatalogSet = class CatalogSet extends effect.Schema.Class("CatalogSet")({ en
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/worktree-catalogs.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/worktree-catalogs.js
 /**
 * The ONE code path that reads the working tree's catalog sources
 * (`pnpm-workspace.yaml` + `pnpm-lock.yaml`). Consumed by
@@ -8178,7 +8204,7 @@ minimatch.Minimatch = Minimatch;
 minimatch.escape = escape;
 minimatch.unescape = unescape;
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/core.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/core.js
 /**
 * Schema for supported package manager identifiers.
 *
@@ -9719,7 +9745,7 @@ function modifyImpl(text, path, value, formattingOptions) {
 	return [];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/WorkspaceStateSnapshot.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/WorkspaceStateSnapshot.js
 const DepRecord = effect.Schema.optionalWith(effect.Schema.Record({
 	key: effect.Schema.String,
 	value: effect.Schema.String
@@ -9788,7 +9814,7 @@ var WorkspaceStateSnapshot = class extends effect.Schema.Class("WorkspaceStateSn
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PointInTimeWorkspace.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PointInTimeWorkspace.js
 /**
 * Service for reading a monorepo's workspace state at a specific moment: any
 * git ref (via `git show`/`git ls-tree`, without checking the ref out) or the
@@ -9815,7 +9841,7 @@ var WorkspaceStateSnapshot = class extends effect.Schema.Class("WorkspaceStateSn
 */
 var PointInTimeWorkspace = class extends effect.Context.Tag("@spencerbeggs/workspaces-effect/PointInTimeWorkspace")() {};
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/discovery/glob-core.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/discovery/glob-core.js
 const normalize$1 = (pattern) => pattern.replace(/\/\*\*$/, "/*");
 const toRegex = (glob) => new RegExp(`^${glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")}$`);
 /**
@@ -9858,7 +9884,7 @@ const compileWorkspaceGlobs = (patterns) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/git.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/git.js
 /**
 * Stderr shapes that mean "the path is not present at this ref" rather than
 * "the git command failed."
@@ -9950,7 +9976,7 @@ const makeGitReader = (executor, options) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PointInTimeWorkspaceLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PointInTimeWorkspaceLive.js
 /**
 * Live layer for the {@link PointInTimeWorkspace} service.
 *
@@ -10072,6 +10098,7 @@ const PointInTimeWorkspaceLive = effect.Layer.effect(PointInTimeWorkspace, effec
 	}).pipe(effect.Effect.withSpan("PointInTimeWorkspace.at", { attributes: { ref } }));
 	const worktree = (options) => effect.Effect.gen(function* () {
 		const root = yield* resolveRoot(options?.cwd);
+		yield* discovery.refresh();
 		return new WorkspaceStateSnapshot({
 			packages: (yield* discovery.listPackages(root)).map((p) => new PackageStateSnapshot({
 				name: p.name,
@@ -10091,7 +10118,7 @@ const PointInTimeWorkspaceLive = effect.Layer.effect(PointInTimeWorkspace, effec
 	});
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/publish.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/publish.js
 /**
 * Schema for package publish targets.
 *
@@ -10134,7 +10161,7 @@ var PublishTarget = class extends effect.Schema.Class("PublishTarget")({
 	provenance: effect.Schema.optionalWith(effect.Schema.Boolean, { default: () => false })
 }) {};
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PublishabilityDetector.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PublishabilityDetector.js
 /**
 * Service for detecting whether a workspace package is publishable and
 * identifying its publish targets (npm, GitHub Packages, etc.).
@@ -10196,7 +10223,7 @@ var PublishTarget = class extends effect.Schema.Class("PublishTarget")({
 */
 var PublishabilityDetector = class extends effect.Context.Tag("@spencerbeggs/workspaces-effect/PublishabilityDetector")() {};
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PublishabilityDetectorLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PublishabilityDetectorLive.js
 /**
 * Default live implementation of the {@link PublishabilityDetector} service.
 *
@@ -10268,7 +10295,7 @@ const PublishabilityDetectorLive = effect.Layer.succeed(PublishabilityDetector,
 	return targets;
 }).pipe(effect.Effect.withSpan("PublishabilityDetector.detect", { attributes: { "workspace.package": pkg.name } })) });
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceDiscoveryLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceDiscoveryLive.js
 /**
 * Live implementation of the {@link WorkspaceDiscovery} service.
 *
@@ -10555,7 +10582,7 @@ const WorkspaceDiscoveryLive = effect.Layer.effect(WorkspaceDiscovery, effect.Ef
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceRootLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceRootLive.js
 /**
 * Live implementation of the {@link WorkspaceRoot} service.
 *
@@ -10775,6 +10802,17 @@ var SilkPublishability = class {
 	* Resolve a package's publish targets via {@link SilkPublishability}, then drop any
 	* whose built `directory` package.json is `private: true`. Returned targets keep the
 	* detector's original (possibly package-relative) `directory`.
+	*
+	* @remarks
+	* When the prod build has written `dist/prod/targets.json`, that binding is
+	* authoritative: every surviving target's directory must be one of the group
+	* directories it names. A directory outside the binding means detection did
+	* not select the prod output — the `yaml-effect@0.7.1` shape, where a dev
+	* manifest carrying `catalog:` specifiers was packed and published. Rather
+	* than ship those bytes, fail with {@link PublishTargetBindingError}.
+	*
+	* Before the prod build runs there is no binding, and the detector's
+	* placeholder directories are left alone.
 	*/
 	static resolveTargets(pkg, root) {
 		return effect.Effect.gen(function* () {
@@ -10786,6 +10824,18 @@ var SilkPublishability = class {
 				const dir = (0, node_path.isAbsolute)(t.directory) ? t.directory : (0, node_path.join)(pkg.path, t.directory);
 				if (!(yield* isTargetPrivate(fs, dir))) kept.push(t);
 			}
+			const binding = yield* readTargetsBinding(fs, pkg.path);
+			if (binding === null) return kept;
+			const boundDirectories = binding.groups.map((g) => normalizeDir(g.dir));
+			const bound = new Set(boundDirectories);
+			for (const t of kept) {
+				const relativeDir = normalizeDir((0, node_path.isAbsolute)(t.directory) ? (0, node_path.relative)(pkg.path, t.directory) : t.directory);
+				if (!bound.has(relativeDir)) return yield* effect.Effect.fail(new PublishTargetBindingError({
+					pkg: pkg.name,
+					directory: relativeDir,
+					boundDirectories
+				}));
+			}
 			return kept;
 		});
 	}
@@ -10812,6 +10862,26 @@ var SilkPublishability = class {
 		});
 	}
 };
+/**
+* Reduce a directory to a comparable package-relative POSIX path: backslashes to
+* forward slashes, no `./` prefix, no trailing slash. `""` (the package root)
+* normalizes to `.`, matching how a root-directory target is recorded.
+*
+* @remarks
+* Trailing slashes are trimmed with an index scan rather than `/\/+$/`. That
+* regex is unanchored at the start, so the engine retries the match from every
+* position and degrades to O(n²) on a path of many slashes (CodeQL
+* `js/polynomial-redos`). `dir` reaches here from `dist/prod/targets.json`, which
+* the bundler writes but a consumer repo could hand-edit.
+*/
+const normalizeDir = (dir) => {
+	const slashed = dir.replaceAll("\\", "/");
+	const withoutPrefix = slashed.startsWith("./") ? slashed.slice(2) : slashed;
+	let end = withoutPrefix.length;
+	while (end > 0 && withoutPrefix[end - 1] === "/") end -= 1;
+	const normalized = withoutPrefix.slice(0, end);
+	return normalized === "" ? "." : normalized;
+};
 /** True when a built target directory's package.json is `private: true`. Missing/unreadable/malformed → false. */
 const isTargetPrivate = (fs, targetDir) => fs.readFileString((0, node_path.join)(targetDir, "package.json")).pipe(effect.Effect.flatMap((content) => effect.Effect.try({
 	try: () => JSON.parse(content).private === true,
@@ -39298,6 +39368,7 @@ function makeShape$1(pit, inspector, discovery, detector, config, fs) {
 	const plan = (options) => effect.Effect.gen(function* () {
 		const resolvedCwd = (0, node_path.resolve)(options.cwd);
 		const changesetDir = (0, node_path.join)(resolvedCwd, ".changeset");
+		yield* discovery.refresh();
 		let fromRef = options.from;
 		if (!fromRef) {
 			let baseBranch = options.base;