fix: restore generated/ paths, mkdir guard, gitignore DEPENDENCIES.json

Re-apply generated/ output paths for gen-deps.cjs and publish.yml,
add mkdir -p guards for fresh clones, and gitignore both
generated/DEPENDENCIES.md and generated/DEPENDENCIES.json.

Author: github-actions[bot]

.github/workflows/publish.yml

@@ -264,7 +264,7 @@ jobs:
 
       - name: Generate DEPENDENCIES.json
         if: github.event_name != 'push'
-        run: npm ls --json --all --omit=dev > DEPENDENCIES.json 2>/dev/null || true
+        run: mkdir -p generated && npm ls --json --all --omit=dev > generated/DEPENDENCIES.json 2>/dev/null || true
 
       - name: Push version bump via PR
         if: github.event_name != 'push'
@@ -276,10 +276,10 @@ jobs:
           BRANCH="release/v${VERSION}"
 
           # Check if there are version bump changes to push
-          if git diff --quiet HEAD -- package.json package-lock.json CHANGELOG.md DEPENDENCIES.json; then
+          if git diff --quiet HEAD -- package.json package-lock.json CHANGELOG.md generated/DEPENDENCIES.json; then
             echo "No version bump commit to push — skipping PR"
           else
-            git add package.json package-lock.json CHANGELOG.md DEPENDENCIES.json
+            git add package.json package-lock.json CHANGELOG.md generated/DEPENDENCIES.json
             git commit -m "chore: release v${VERSION}"
             git push origin "HEAD:refs/heads/${BRANCH}"
             gh pr create \

.gitignore

@@ -6,5 +6,7 @@ coverage/
 grammars/*.wasm
 .claude/session-edits.log
 .claude/codegraph-checked.log
+generated/DEPENDENCIES.md
+generated/DEPENDENCIES.json
 artifacts/
 pkg/

scripts/gen-deps.cjs

@@ -1,18 +1,19 @@
 const { execSync } = require('child_process');
 const fs = require('fs');
+const path = require('path');
+
+const outFile = path.join('generated', 'DEPENDENCIES.md');
+fs.mkdirSync(path.dirname(outFile), { recursive: true });
 
 try {
   const tree = execSync('npm ls --all --omit=dev', { encoding: 'utf8' });
-  fs.writeFileSync(
-    'DEPENDENCIES.md',
-    '# Dependencies\n\n```\n' + tree + '```\n',
-  );
+  fs.writeFileSync(outFile, '# Dependencies\n\n```\n' + tree + '```\n');
 } catch (err) {
   // npm ls exits non-zero on ELSPROBLEMS (version mismatches in optional deps).
   // If stdout still has content, write it; otherwise skip silently.
   if (err.stdout) {
     fs.writeFileSync(
-      'DEPENDENCIES.md',
+      outFile,
       '# Dependencies\n\n```\n' + err.stdout + '```\n',
     );
   } else {