From 6785c2565d952f482b70a7ada20e8968bcd40e4d Mon Sep 17 00:00:00 2001 From: ScriptedAlchemy Date: Sat, 5 Sep 2026 01:10:37 +0000 Subject: [PATCH] docs: count prebuilt payload imports as AB7014 dependency evidence --- website/docs/en/guide/distribution/validation.mdx | 5 +++-- website/docs/zh/guide/distribution/validation.mdx | 3 ++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/website/docs/en/guide/distribution/validation.mdx b/website/docs/en/guide/distribution/validation.mdx index e58e9293e..e000711e0 100644 --- a/website/docs/en/guide/distribution/validation.mdx +++ b/website/docs/en/guide/distribution/validation.mdx @@ -198,8 +198,9 @@ entry is therefore only for what the packed files demonstrably need from outside — a package a packed module still imports because the author kept it external through the [`tools` hatch](../../reference/configuration.mdx#tools) (possible in the package build's `dist` output, which `AB6005` does not walk; a host-pack module with that import fails the build), one a -consumer-side install script runs, one whose `bin` a packed file executes, or one a packed -declaration file references — and `AB7014` reports a declared dependency with none of that +prebuilt payload module imports (prebuilt files are opaque to `AB6005` but are scanned for +`AB7014`), one a consumer-side install script runs, one whose `bin` a packed file executes, or one +a packed declaration file references — and `AB7014` reports a declared dependency with none of that evidence, while `AB7015` reports one a consumer's npm cannot install. | Code | Meaning | diff --git a/website/docs/zh/guide/distribution/validation.mdx b/website/docs/zh/guide/distribution/validation.mdx index 80b53463a..312e6beb1 100644 --- a/website/docs/zh/guide/distribution/validation.mdx +++ b/website/docs/zh/guide/distribution/validation.mdx @@ -173,7 +173,8 @@ CLI、MCP 入口、钩子包装层以及包构建的 JavaScript bundle——都 从产物之外加载的只有内建模块。因此，`dependencies` 条目只留给打包后的文件有据可证地需要从已编译 bundle 之外 获取的内容——打包后的模块因作者通过 [`tools` 逃生舱](../../reference/configuration.mdx#tools)将其保持外部化 而仍然导入的包（这在包构建的 `dist` 输出中是可能的，因为 `AB6005` 不会遍历它；带有这种导入的宿主包模块则会 -让构建失败），消费者侧安装脚本运行的包，打包后的文件执行其 `bin` 的包，或打包后的声明文件引用的包—— +让构建失败），预构建 payload 模块导入的包（预构建文件对 `AB6005` 不透明，但会被 `AB7014` 扫描），消费者侧 +安装脚本运行的包，打包后的文件执行其 `bin` 的包，或打包后的声明文件引用的包—— `AB7014` 会报告不具备上述任何一种证据的已声明依赖，而 `AB7015` 会报告消费者的 npm 无法安装的依赖。 | 代码 | 含义 |