diff --git a/website/docs/en/guide/distribution/validation.mdx b/website/docs/en/guide/distribution/validation.mdx index e000711e0..d910ebeeb 100644 --- a/website/docs/en/guide/distribution/validation.mdx +++ b/website/docs/en/guide/distribution/validation.mdx @@ -198,9 +198,10 @@ entry is therefore only for what the packed files demonstrably need from outside — a package a packed module still imports because the author kept it external through the [`tools` hatch](../../reference/configuration.mdx#tools) (possible in the package build's `dist` output, which `AB6005` does not walk; a host-pack module with that import fails the build), one a -prebuilt payload module imports (prebuilt files are opaque to `AB6005` but are scanned for -`AB7014`), one a consumer-side install script runs, one whose `bin` a packed file executes, or one -a packed declaration file references — and `AB7014` reports a declared dependency with none of that +prebuilt `.js`/`.mjs`/`.cjs` payload module imports (prebuilt files are opaque to `AB6005`, and +`AB7014` scans only those extensions, so an extensionless prebuilt module counts for nothing), one +a consumer-side install script runs, one whose `bin` a packed file executes, or one a packed +declaration file references — and `AB7014` reports a declared dependency with none of that evidence, while `AB7015` reports one a consumer's npm cannot install. | Code | Meaning | diff --git a/website/docs/zh/guide/distribution/validation.mdx b/website/docs/zh/guide/distribution/validation.mdx index 312e6beb1..751e77ce4 100644 --- a/website/docs/zh/guide/distribution/validation.mdx +++ b/website/docs/zh/guide/distribution/validation.mdx @@ -173,7 +173,8 @@ CLI、MCP 入口、钩子包装层以及包构建的 JavaScript bundle——都 从产物之外加载的只有内建模块。因此，`dependencies` 条目只留给打包后的文件有据可证地需要从已编译 bundle 之外 获取的内容——打包后的模块因作者通过 [`tools` 逃生舱](../../reference/configuration.mdx#tools)将其保持外部化 而仍然导入的包（这在包构建的 `dist` 输出中是可能的，因为 `AB6005` 不会遍历它；带有这种导入的宿主包模块则会 -让构建失败），预构建 payload 模块导入的包（预构建文件对 `AB6005` 不透明，但会被 `AB7014` 扫描），消费者侧 +让构建失败），预构建的 `.js`/`.mjs`/`.cjs` payload 模块导入的包（预构建文件对 `AB6005` 不透明，而 +`AB7014` 只扫描这些扩展名，因此无扩展名的预构建模块不算任何证据），消费者侧 安装脚本运行的包，打包后的文件执行其 `bin` 的包，或打包后的声明文件引用的包—— `AB7014` 会报告不具备上述任何一种证据的已声明依赖，而 `AB7015` 会报告消费者的 npm 无法安装的依赖。