build(release): publish the dsh family publicly

Every release member now declares publishConfig.access: public, so the scope no
longer mixes levels: the 221 packages/*/* and apps/* manifests join the vendored
framework and the native packages.

check-workspace-constraints drops the per-sequence expectation and holds every
release member to public, which is what stops a member from drifting back.

Access is a property of the package, not of a version: the dsh packages already
published as restricted become world-readable at their next publication.
This commit is contained in:
imccyu
2026-08-13 18:05:10 +08:00
parent f26a6f6cff
commit 8c1e8d9890
222 changed files with 223 additions and 224 deletions

View File

@@ -251,12 +251,11 @@ function checkWorkspace({ dir, manifest }: WorkspaceManifest): string[] {
// public. A mixed scope is why no publish path passes `--access` — one flag
// cannot serve both, so each packed manifest decides
// ([rationale](../.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.md)).
const expectedAccess = dir.startsWith('vendor/') ? 'public' : 'restricted'
if (manifest.private === true) {
errors.push(`${label}: release member must not set "private": true`)
}
if (manifest.publishConfig?.access !== expectedAccess) {
errors.push(`${label}: release member must set publishConfig.access to "${expectedAccess}"`)
if (manifest.publishConfig?.access !== 'public') {
errors.push(`${label}: release member must set publishConfig.access to "public"`)
}
if (manifest.repository?.type !== 'git'
|| manifest.repository.url !== publishedRepositoryUrl