fix: publish storage package root entrypoints

[kang-heewon]

Fixes #578.

Summary

@croco/storage-core, @croco/storage-cloudinary, and @croco/storage-r2 now publish package-root entrypoints that point directly at shipped dist files. The package manifest normalizer also treats these storage packages as direct-dist entrypoint packages, so future root drift back to src fails manifest validation.

변경 사항

• Align storage package root main, module, types, exports, and publishConfig.exports on the same dist entrypoints.
• Add storage package direct-dist entrypoint policy to package manifest normalization.
• Add normalizer regressions for writing the storage policy and rejecting src root drift.
• Add patch changesets for the three storage packages.

Verification

• pnpm exec vitest run scripts/tests/normalize-packages.spec.ts --reporter verbose - passed, 9 tests.
• pnpm package-manifests:check - passed, 97 checked / 2 private skipped.
• pnpm build - passed, 99 tasks.
• pnpm package-entrypoints:smoke - passed, 96 public packages; storage-core, storage-cloudinary, and storage-r2 resolved through CJS, ESM, and TypeScript consumers.
• Dry pack check for @croco/storage-core, @croco/storage-cloudinary, and @croco/storage-r2 - passed; each tarball root manifest points main/module/types/exports at dist, includes dist/index.{js,mjs,d.ts}, and excludes src/index.ts.
• pnpm check - passed.
• pnpm test - passed, 197 tasks.
• pnpm typecheck - passed, 196 tasks.
• git diff --check origin/trunk...HEAD - passed.
• Pre-push hook passed: existing changeset found, full cached test, and full cached typecheck passed.

Self-review

• Correctness/regression: PASS. Issue [storage packages] Published manifests point package roots at src while only dist is shipped #578 acceptance is covered by direct package manifest changes, normalizer tests that reject src root entrypoints for the storage packages, manifest normalization, dry-pack tarball inspection, and package-entrypoint smoke coverage.
• API/security/compatibility/release: PASS. The public package contract now matches shipped dist artifacts for CJS, ESM, and types; no dependencies, lockfile entries, secrets, or environment assumptions changed; patch changesets cover the three publishable packages.
• Maintainability/minimality: PASS. The diff is scoped to the three storage manifests, shared manifest contract helper, normalizer policy, focused regression tests, and release metadata.

Risk

Low. Package-root imports now require built dist artifacts, which matches the published package shape and the repo's Turbo build/test/typecheck dependency graph.

[coderabbitai]

Warning

Review limit reached

@kang-heewon, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 53 minutes and 6 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c62cc152-4aad-42a9-9dc7-7b18d9c788a3

📥 Commits

Reviewing files that changed from the base of the PR and between 38727f9 and 26bbfac.

📒 Files selected for processing (7)

• .changeset/storage-package-entrypoints.md
• packages/storage-cloudinary/package.json
• packages/storage-core/package.json
• packages/storage-r2/package.json
• scripts/normalize-packages.mjs
• scripts/package-manifest-contracts.mjs
• scripts/tests/normalize-packages.spec.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-578-storage-package-entrypoints

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}