+ proj: whitelist the published source files in seven libs - #243
Merged
Conversation
`.agents/skills/zui-standards/references/library.md:29` mandates `"files": ["./src/**/*"]` on every lib. Seven declared none, so a pack of those packages shipped whatever sat in the lib directory alongside the sources consumers import. Measured on `@zui/avatar`: 29 files before, 15 after — the change drops `dev.ts`, `docs/`, `tsconfig.json` and 140 kB of `assets/*.png` demo images, none of which `src/` references. `@zui/icons` is worth a note. Its `public/` directory holds the ZenIcon font binaries that `src/style/icons-core.css:5` loads, and `./src/**/*` excludes them. That is not a regression: `scripts/build/publish.ts` publishes a single aggregate package built from `dist/zui`, not the individual workspace packages, and `scripts/build/config.ts:425-428` copies each lib's `public/` into the build from the working tree regardless of `files`. Verified — the built CSS still resolves `url(./icons/zenicon.woff)` against an emitted font file. Three libs still lack the field: `avatar-group`, `label` and `panel` are covered by the CSS-only optimization branch.
The previous commit's `"files": ["./src/**/*"]` excludes `lib/icons/public/`,
which holds the ZenIcon binaries that `src/style/icons-core.css:3-7` loads via
`@font-face` as `@/public/zenicon.{eot,woff,ttf,svg}`. It also excluded
`public/fontawesome-license.md`, which should ship on its own merits.
This governs no publish today — `scripts/build/publish.ts` ships a single
aggregate package from `dist/zui`, and `scripts/build/config.ts:425-428` copies
each lib's `public/` from the working tree regardless of `files`. But the
manifest is the wrong place to leave a trap that only springs if per-lib
publishing is ever turned on, and it looked more correct than it was.
`npm pack --dry-run` on this lib now lists 11 files: the manifest, README, the
four src files, and the five files under `public/`. `dev.ts`, `docs/` and the
IcoMoon sources in `assets/` stay excluded — `src/` references none of them.
`@zui/icons` is the only lib affected. A scan of every lib carrying a `files`
whitelist finds it is the only one whose `src/` references a path outside
`src/`; the `public/` and `assets/` directories in `dashboard`, `sortable`,
`avatar` and `modal` hold demo and vendor files that nothing in `src/` loads.
catouse
marked this pull request as ready for review
August 31, 2026 02:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.agents/skills/zui-standards/references/library.md:29mandates"files": ["./src/**/*"]on every lib. Without it, a pack ships whatever sits in the libdirectory —
dev.ts,docs/, stray local files — alongside the sources consumers import.Seven libs had no
filesfield:avatar,form,icons,input-control,input-group,upload,upload-imgs. With #240's three, that closes the gap.Commits
@zui/iconsfonts — that whitelist was too narrow for one lib.The icons fix
./src/**/*excludeslib/icons/public/, which holds the ZenIcon binaries thatsrc/style/icons-core.css:3-7loads via@font-faceas@/public/zenicon.{eot,woff,ttf,svg}— referenced through the lib-root alias, which is why a search for relative
../publicpaths does not find it. It also excluded
public/fontawesome-license.md, which shouldship on its own merits.
This governs no publish today:
scripts/build/publish.tsships a single aggregatepackage built from
dist/zui, so the individual workspace packages are never published,and
scripts/build/config.ts:425-428copies each lib'spublic/from the working treeregardless of
files. But the manifest is the wrong place to leave a trap that onlysprings if per-lib publishing is ever turned on — especially one that looks more correct
than it is.
@zui/iconsis the only lib affected. A scan of every lib carrying afileswhitelistfinds it is the only one whose
src/references a path outsidesrc/; thepublic/andassets/directories indashboard,sortable,avatarandmodalhold demo andvendor files that nothing in
src/loads.Verification
for unchanged key order and unchanged values for every key but
files. The first commitis exactly 21 insertions, 0 deletions.
npm pack --dry-runon@zui/avatar: 29 files → 15,dropping
dev.ts,docs/,tsconfig.jsonand 140 kB ofassets/*.png.README.mdstays — npm always includes it and
filescannot exclude it.@zui/iconsnow packs 11 files: the manifest, README, four src files and the five underpublic/.dev.ts,docs/and the IcoMoon sources inassets/stay excluded.pnpm checkgreen; fullpnpm buildgreen, 870 modules, every lib still resolving.Placement
The plan called for the field "after
devDependencies, beforezui". There is no suchconvention in this repo — key order varies widely, and the dominant shape among libs that
already have the field is
keywords → files → exports → dependencies → devDependencies → zui. The rule actually applied is the one stable one: insert immediately before"zui".Two of the seven (
avatar,form) also carry nokeywordsfield. That is #246's scope,untouched here; the two PRs overlap on five manifests but edit different regions and merge
cleanly.