@savvy-web/silk 2.2.0 → 2.2.2

package/changesets-changelog.js

@@ -295,6 +295,33 @@ const ChangesetConfigReaderLive = Layer.effect(ChangesetConfigReader, Effect.gen
 	return { read };
 }));
 
+//#endregion
+//#region ../silk-effects/dist/dev/pkg/errors/PublishTargetBindingError.js
+/**
+* Raised when publishability detection selects a directory that the package's
+* `dist/prod/targets.json` binding does not describe.
+*
+* @remarks
+* The bundler's prod build writes `targets.json` naming every byte-group
+* directory it produced. Once that binding exists it is authoritative: the only
+* directories whose bytes may be published are the ones it lists. A detector
+* that returns anything else — most often `publishConfig.directory` pointing at
+* a **dev** build, because silk mode was misdetected — is about to pack an
+* unresolved workspace manifest and ship it to a registry.
+*
+* That is the `yaml-effect@0.7.1` failure: detection picked `dist/dev/pkg`, the
+* dev manifest still carried `catalog:` specifiers, and the published package
+* was uninstallable (`EUNSUPPORTEDPROTOCOL`).
+*
+* @since 3.1.0
+* @public
+*/
+var PublishTargetBindingError = class extends Data.TaggedError("PublishTargetBindingError") {
+	get message() {
+		return `Package ${this.pkg} resolved publish directory "${this.directory}", which is not one of the directories bound by dist/prod/targets.json (${this.boundDirectories.join(", ")}). This means publishability detection did not select the prod build output — refusing to publish before packing an unresolved manifest.`;
+	}
+};
+
 //#endregion
 //#region ../silk-effects/dist/dev/pkg/services/ChangesetConfig.js
 /**
@@ -372,7 +399,7 @@ const ChangesetConfigLive = Layer.effect(ChangesetConfig, Effect.gen(function* (
 }));
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogAssemblyError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogAssemblyError.js
 /**
 * Base constant for {@link CatalogAssemblyError}.
 *
@@ -400,7 +427,7 @@ var CatalogAssemblyError = class extends CatalogAssemblyErrorBase {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogResolutionError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogResolutionError.js
 /**
 * Base constant for {@link CatalogResolutionError}.
 *
@@ -427,7 +454,7 @@ var CatalogResolutionError = class extends CatalogResolutionErrorBase {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/GitReadError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/GitReadError.js
 /**
 * Base constant for {@link GitReadError}.
 *
@@ -453,7 +480,7 @@ var GitReadError = class extends GitReadErrorBase {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/PackageNotFoundError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/PackageNotFoundError.js
 /**
 * Base constant for {@link PackageNotFoundError}.
 *
@@ -505,7 +532,7 @@ var PackageNotFoundError = class extends PackageNotFoundErrorBase {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceDiscoveryError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceDiscoveryError.js
 /**
 * Base constant for {@link WorkspaceDiscoveryError}.
 *
@@ -557,7 +584,7 @@ var WorkspaceDiscoveryError = class extends WorkspaceDiscoveryErrorBase {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceRootNotFoundError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceRootNotFoundError.js
 /**
 * Base constant for {@link WorkspaceRootNotFoundError}.
 *
@@ -608,7 +635,7 @@ var WorkspaceRootNotFoundError = class extends WorkspaceRootNotFoundErrorBase {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceDiscovery.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceDiscovery.js
 /**
 * Service for discovering workspace packages in a monorepo.
 *
@@ -659,7 +686,7 @@ var WorkspaceRootNotFoundError = class extends WorkspaceRootNotFoundErrorBase {
 var WorkspaceDiscovery = class extends Context.Tag("@spencerbeggs/workspaces-effect/WorkspaceDiscovery")() {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceRoot.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceRoot.js
 /**
 * Service for finding the workspace root directory.
 *
@@ -6402,7 +6429,7 @@ function parse$3(text, options) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/workspace-manifest.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/workspace-manifest.js
 /**
 * Parse a pnpm-workspace.yaml text into its catalog/config-dependency/packages
 * slice. Pure with respect to the filesystem.
@@ -6478,7 +6505,7 @@ function checkDefaultCatalogIsDefinedOnce(manifest) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/assemble.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/assemble.js
 /** Merge catalog sources; later sources win per dependency within a catalog. */
 function mergeCatalogs(...sources) {
 	const result = {};
@@ -6563,7 +6590,7 @@ function resolveFromCatalog(catalogs, wantedDependency) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/resolve.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/resolve.js
 const DEP_FIELDS = [
 	"dependencies",
 	"devDependencies",
@@ -6634,7 +6661,7 @@ function resolveManifest(catalogs, workspaceVersions, manifest) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/CatalogSet.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/CatalogSet.js
 /**
 * An immutable, fully-normalized catalog collection with the one
 * resolution semantic shared by live and point-in-time resolution.
@@ -6725,7 +6752,7 @@ var CatalogSet = class CatalogSet extends Schema.Class("CatalogSet")({ entries:
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/worktree-catalogs.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/worktree-catalogs.js
 /**
 * The ONE code path that reads the working tree's catalog sources
 * (`pnpm-workspace.yaml` + `pnpm-lock.yaml`). Consumed by
@@ -8281,7 +8308,7 @@ minimatch.escape = escape;
 minimatch.unescape = unescape;
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/core.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/core.js
 /**
 * Schema for supported package manager identifiers.
 *
@@ -9904,7 +9931,7 @@ function modifyImpl(text, path, value, formattingOptions) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/WorkspaceStateSnapshot.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/WorkspaceStateSnapshot.js
 const DepRecord = Schema.optionalWith(Schema.Record({
 	key: Schema.String,
 	value: Schema.String
@@ -9974,7 +10001,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PointInTimeWorkspace.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PointInTimeWorkspace.js
 /**
 * Service for reading a monorepo's workspace state at a specific moment: any
 * git ref (via `git show`/`git ls-tree`, without checking the ref out) or the
@@ -10002,7 +10029,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 var PointInTimeWorkspace = class extends Context.Tag("@spencerbeggs/workspaces-effect/PointInTimeWorkspace")() {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/discovery/glob-core.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/discovery/glob-core.js
 const normalize$2 = (pattern) => pattern.replace(/\/\*\*$/, "/*");
 const toRegex = (glob) => new RegExp(`^${glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")}$`);
 /**
@@ -10046,7 +10073,7 @@ const compileWorkspaceGlobs = (patterns) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/git.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/git.js
 /**
 * Stderr shapes that mean "the path is not present at this ref" rather than
 * "the git command failed."
@@ -10139,7 +10166,7 @@ const makeGitReader = (executor, options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PointInTimeWorkspaceLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PointInTimeWorkspaceLive.js
 /**
 * Live layer for the {@link PointInTimeWorkspace} service.
 *
@@ -10261,6 +10288,7 @@ const PointInTimeWorkspaceLive = Layer.effect(PointInTimeWorkspace, Effect.gen(f
 	}).pipe(Effect.withSpan("PointInTimeWorkspace.at", { attributes: { ref } }));
 	const worktree = (options) => Effect.gen(function* () {
 		const root = yield* resolveRoot(options?.cwd);
+		yield* discovery.refresh();
 		return new WorkspaceStateSnapshot({
 			packages: (yield* discovery.listPackages(root)).map((p) => new PackageStateSnapshot({
 				name: p.name,
@@ -10281,7 +10309,7 @@ const PointInTimeWorkspaceLive = Layer.effect(PointInTimeWorkspace, Effect.gen(f
 }));
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/publish.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/publish.js
 /**
 * Schema for package publish targets.
 *
@@ -10325,7 +10353,7 @@ var PublishTarget = class extends Schema.Class("PublishTarget")({
 }) {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PublishabilityDetector.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PublishabilityDetector.js
 /**
 * Service for detecting whether a workspace package is publishable and
 * identifying its publish targets (npm, GitHub Packages, etc.).
@@ -10388,7 +10416,7 @@ var PublishTarget = class extends Schema.Class("PublishTarget")({
 var PublishabilityDetector = class extends Context.Tag("@spencerbeggs/workspaces-effect/PublishabilityDetector")() {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PublishabilityDetectorLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PublishabilityDetectorLive.js
 /**
 * Default live implementation of the {@link PublishabilityDetector} service.
 *
@@ -10461,7 +10489,7 @@ const PublishabilityDetectorLive = Layer.succeed(PublishabilityDetector, { detec
 }).pipe(Effect.withSpan("PublishabilityDetector.detect", { attributes: { "workspace.package": pkg.name } })) });
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceDiscoveryLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceDiscoveryLive.js
 /**
 * Live implementation of the {@link WorkspaceDiscovery} service.
 *
@@ -10749,7 +10777,7 @@ const WorkspaceDiscoveryLive = Layer.effect(WorkspaceDiscovery, Effect.gen(funct
 }));
 
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceRootLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceRootLive.js
 /**
 * Live implementation of the {@link WorkspaceRoot} service.
 *
@@ -10970,6 +10998,17 @@ var SilkPublishability = class {
 	* Resolve a package's publish targets via {@link SilkPublishability}, then drop any
 	* whose built `directory` package.json is `private: true`. Returned targets keep the
 	* detector's original (possibly package-relative) `directory`.
+	*
+	* @remarks
+	* When the prod build has written `dist/prod/targets.json`, that binding is
+	* authoritative: every surviving target's directory must be one of the group
+	* directories it names. A directory outside the binding means detection did
+	* not select the prod output — the `yaml-effect@0.7.1` shape, where a dev
+	* manifest carrying `catalog:` specifiers was packed and published. Rather
+	* than ship those bytes, fail with {@link PublishTargetBindingError}.
+	*
+	* Before the prod build runs there is no binding, and the detector's
+	* placeholder directories are left alone.
 	*/
 	static resolveTargets(pkg, root) {
 		return Effect.gen(function* () {
@@ -10981,6 +11020,18 @@ var SilkPublishability = class {
 				const dir = isAbsolute(t.directory) ? t.directory : join(pkg.path, t.directory);
 				if (!(yield* isTargetPrivate(fs, dir))) kept.push(t);
 			}
+			const binding = yield* readTargetsBinding(fs, pkg.path);
+			if (binding === null) return kept;
+			const boundDirectories = binding.groups.map((g) => normalizeDir(g.dir));
+			const bound = new Set(boundDirectories);
+			for (const t of kept) {
+				const relativeDir = normalizeDir(isAbsolute(t.directory) ? relative(pkg.path, t.directory) : t.directory);
+				if (!bound.has(relativeDir)) return yield* Effect.fail(new PublishTargetBindingError({
+					pkg: pkg.name,
+					directory: relativeDir,
+					boundDirectories
+				}));
+			}
 			return kept;
 		});
 	}
@@ -11007,6 +11058,26 @@ var SilkPublishability = class {
 		});
 	}
 };
+/**
+* Reduce a directory to a comparable package-relative POSIX path: backslashes to
+* forward slashes, no `./` prefix, no trailing slash. `""` (the package root)
+* normalizes to `.`, matching how a root-directory target is recorded.
+*
+* @remarks
+* Trailing slashes are trimmed with an index scan rather than `/\/+$/`. That
+* regex is unanchored at the start, so the engine retries the match from every
+* position and degrades to O(n²) on a path of many slashes (CodeQL
+* `js/polynomial-redos`). `dir` reaches here from `dist/prod/targets.json`, which
+* the bundler writes but a consumer repo could hand-edit.
+*/
+const normalizeDir = (dir) => {
+	const slashed = dir.replaceAll("\\", "/");
+	const withoutPrefix = slashed.startsWith("./") ? slashed.slice(2) : slashed;
+	let end = withoutPrefix.length;
+	while (end > 0 && withoutPrefix[end - 1] === "/") end -= 1;
+	const normalized = withoutPrefix.slice(0, end);
+	return normalized === "" ? "." : normalized;
+};
 /** True when a built target directory's package.json is `private: true`. Missing/unreadable/malformed → false. */
 const isTargetPrivate = (fs, targetDir) => fs.readFileString(join(targetDir, "package.json")).pipe(Effect.flatMap((content) => Effect.try({
 	try: () => JSON.parse(content).private === true,
@@ -39747,6 +39818,7 @@ function makeShape$1(pit, inspector, discovery, detector, config, fs) {
 	const plan = (options) => Effect.gen(function* () {
 		const resolvedCwd = resolve(options.cwd);
 		const changesetDir = join(resolvedCwd, ".changeset");
+		yield* discovery.refresh();
 		let fromRef = options.from;
 		if (!fromRef) {
 			let baseBranch = options.base;

package/changesets-markdownlint.cjs

@@ -287,6 +287,32 @@ const ChangesetConfigReaderLive = effect.Layer.effect(ChangesetConfigReader, eff
 	return { read };
 }));
 //#endregion
+//#region ../silk-effects/dist/dev/pkg/errors/PublishTargetBindingError.js
+/**
+* Raised when publishability detection selects a directory that the package's
+* `dist/prod/targets.json` binding does not describe.
+*
+* @remarks
+* The bundler's prod build writes `targets.json` naming every byte-group
+* directory it produced. Once that binding exists it is authoritative: the only
+* directories whose bytes may be published are the ones it lists. A detector
+* that returns anything else — most often `publishConfig.directory` pointing at
+* a **dev** build, because silk mode was misdetected — is about to pack an
+* unresolved workspace manifest and ship it to a registry.
+*
+* That is the `yaml-effect@0.7.1` failure: detection picked `dist/dev/pkg`, the
+* dev manifest still carried `catalog:` specifiers, and the published package
+* was uninstallable (`EUNSUPPORTEDPROTOCOL`).
+*
+* @since 3.1.0
+* @public
+*/
+var PublishTargetBindingError = class extends effect.Data.TaggedError("PublishTargetBindingError") {
+	get message() {
+		return `Package ${this.pkg} resolved publish directory "${this.directory}", which is not one of the directories bound by dist/prod/targets.json (${this.boundDirectories.join(", ")}). This means publishability detection did not select the prod build output — refusing to publish before packing an unresolved manifest.`;
+	}
+};
+//#endregion
 //#region ../silk-effects/dist/dev/pkg/services/ChangesetConfig.js
 /**
 * Accessor service over a workspace root's `.changeset/config.json`.
@@ -362,7 +388,7 @@ const ChangesetConfigLive = effect.Layer.effect(ChangesetConfig, effect.Effect.g
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogAssemblyError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogAssemblyError.js
 /**
 * Base constant for {@link CatalogAssemblyError}.
 *
@@ -389,7 +415,7 @@ var CatalogAssemblyError = class extends CatalogAssemblyErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogResolutionError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/CatalogResolutionError.js
 /**
 * Base constant for {@link CatalogResolutionError}.
 *
@@ -415,7 +441,7 @@ var CatalogResolutionError = class extends CatalogResolutionErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/GitReadError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/GitReadError.js
 /**
 * Base constant for {@link GitReadError}.
 *
@@ -440,7 +466,7 @@ var GitReadError = class extends GitReadErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/PackageNotFoundError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/PackageNotFoundError.js
 /**
 * Base constant for {@link PackageNotFoundError}.
 *
@@ -491,7 +517,7 @@ var PackageNotFoundError = class extends PackageNotFoundErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceDiscoveryError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceDiscoveryError.js
 /**
 * Base constant for {@link WorkspaceDiscoveryError}.
 *
@@ -542,7 +568,7 @@ var WorkspaceDiscoveryError = class extends WorkspaceDiscoveryErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceRootNotFoundError.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/errors/WorkspaceRootNotFoundError.js
 /**
 * Base constant for {@link WorkspaceRootNotFoundError}.
 *
@@ -592,7 +618,7 @@ var WorkspaceRootNotFoundError = class extends WorkspaceRootNotFoundErrorBase {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceDiscovery.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceDiscovery.js
 /**
 * Service for discovering workspace packages in a monorepo.
 *
@@ -642,7 +668,7 @@ var WorkspaceRootNotFoundError = class extends WorkspaceRootNotFoundErrorBase {
 */
 var WorkspaceDiscovery = class extends effect.Context.Tag("@spencerbeggs/workspaces-effect/WorkspaceDiscovery")() {};
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceRoot.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/WorkspaceRoot.js
 /**
 * Service for finding the workspace root directory.
 *
@@ -6328,7 +6354,7 @@ function parse$3(text, options) {
 	}));
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/workspace-manifest.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/workspace-manifest.js
 /**
 * Parse a pnpm-workspace.yaml text into its catalog/config-dependency/packages
 * slice. Pure with respect to the filesystem.
@@ -6396,7 +6422,7 @@ function checkDefaultCatalogIsDefinedOnce(manifest) {
 	if (manifest.catalog != null && manifest.catalogs?.default != null) throw new PnpmError("INVALID_CATALOGS_CONFIGURATION", "The 'default' catalog was defined multiple times. Use the 'catalog' field or 'catalogs.default', but not both.");
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/assemble.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/assemble.js
 /** Merge catalog sources; later sources win per dependency within a catalog. */
 function mergeCatalogs(...sources) {
 	const result = {};
@@ -6477,7 +6503,7 @@ function resolveFromCatalog(catalogs, wantedDependency) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/resolve.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/catalog/resolve.js
 const DEP_FIELDS = [
 	"dependencies",
 	"devDependencies",
@@ -6547,7 +6573,7 @@ function resolveManifest(catalogs, workspaceVersions, manifest) {
 	return out;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/CatalogSet.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/CatalogSet.js
 /**
 * An immutable, fully-normalized catalog collection with the one
 * resolution semantic shared by live and point-in-time resolution.
@@ -6637,7 +6663,7 @@ var CatalogSet = class CatalogSet extends effect.Schema.Class("CatalogSet")({ en
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/worktree-catalogs.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/worktree-catalogs.js
 /**
 * The ONE code path that reads the working tree's catalog sources
 * (`pnpm-workspace.yaml` + `pnpm-lock.yaml`). Consumed by
@@ -8182,7 +8208,7 @@ minimatch.Minimatch = Minimatch;
 minimatch.escape = escape;
 minimatch.unescape = unescape;
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/core.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/core.js
 /**
 * Schema for supported package manager identifiers.
 *
@@ -9723,7 +9749,7 @@ function modifyImpl(text, path, value, formattingOptions) {
 	return [];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/WorkspaceStateSnapshot.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/WorkspaceStateSnapshot.js
 const DepRecord = effect.Schema.optionalWith(effect.Schema.Record({
 	key: effect.Schema.String,
 	value: effect.Schema.String
@@ -9792,7 +9818,7 @@ var WorkspaceStateSnapshot = class extends effect.Schema.Class("WorkspaceStateSn
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PointInTimeWorkspace.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PointInTimeWorkspace.js
 /**
 * Service for reading a monorepo's workspace state at a specific moment: any
 * git ref (via `git show`/`git ls-tree`, without checking the ref out) or the
@@ -9819,7 +9845,7 @@ var WorkspaceStateSnapshot = class extends effect.Schema.Class("WorkspaceStateSn
 */
 var PointInTimeWorkspace = class extends effect.Context.Tag("@spencerbeggs/workspaces-effect/PointInTimeWorkspace")() {};
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/discovery/glob-core.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/discovery/glob-core.js
 const normalize$1 = (pattern) => pattern.replace(/\/\*\*$/, "/*");
 const toRegex = (glob) => new RegExp(`^${glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")}$`);
 /**
@@ -9862,7 +9888,7 @@ const compileWorkspaceGlobs = (patterns) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/git.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/point-in-time/git.js
 /**
 * Stderr shapes that mean "the path is not present at this ref" rather than
 * "the git command failed."
@@ -9954,7 +9980,7 @@ const makeGitReader = (executor, options) => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PointInTimeWorkspaceLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PointInTimeWorkspaceLive.js
 /**
 * Live layer for the {@link PointInTimeWorkspace} service.
 *
@@ -10076,6 +10102,7 @@ const PointInTimeWorkspaceLive = effect.Layer.effect(PointInTimeWorkspace, effec
 	}).pipe(effect.Effect.withSpan("PointInTimeWorkspace.at", { attributes: { ref } }));
 	const worktree = (options) => effect.Effect.gen(function* () {
 		const root = yield* resolveRoot(options?.cwd);
+		yield* discovery.refresh();
 		return new WorkspaceStateSnapshot({
 			packages: (yield* discovery.listPackages(root)).map((p) => new PackageStateSnapshot({
 				name: p.name,
@@ -10095,7 +10122,7 @@ const PointInTimeWorkspaceLive = effect.Layer.effect(PointInTimeWorkspace, effec
 	});
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/publish.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/schemas/publish.js
 /**
 * Schema for package publish targets.
 *
@@ -10138,7 +10165,7 @@ var PublishTarget = class extends effect.Schema.Class("PublishTarget")({
 	provenance: effect.Schema.optionalWith(effect.Schema.Boolean, { default: () => false })
 }) {};
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PublishabilityDetector.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/services/PublishabilityDetector.js
 /**
 * Service for detecting whether a workspace package is publishable and
 * identifying its publish targets (npm, GitHub Packages, etc.).
@@ -10200,7 +10227,7 @@ var PublishTarget = class extends effect.Schema.Class("PublishTarget")({
 */
 var PublishabilityDetector = class extends effect.Context.Tag("@spencerbeggs/workspaces-effect/PublishabilityDetector")() {};
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PublishabilityDetectorLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/PublishabilityDetectorLive.js
 /**
 * Default live implementation of the {@link PublishabilityDetector} service.
 *
@@ -10272,7 +10299,7 @@ const PublishabilityDetectorLive = effect.Layer.succeed(PublishabilityDetector,
 	return targets;
 }).pipe(effect.Effect.withSpan("PublishabilityDetector.detect", { attributes: { "workspace.package": pkg.name } })) });
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceDiscoveryLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceDiscoveryLive.js
 /**
 * Live implementation of the {@link WorkspaceDiscovery} service.
 *
@@ -10559,7 +10586,7 @@ const WorkspaceDiscoveryLive = effect.Layer.effect(WorkspaceDiscovery, effect.Ef
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/workspaces-effect@2.0.2_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceRootLive.js
+//#region ../../node_modules/.pnpm/workspaces-effect@2.0.3_@effect+platform@0.96.2_effect@3.21.4__effect@3.21.4/node_modules/workspaces-effect/layers/WorkspaceRootLive.js
 /**
 * Live implementation of the {@link WorkspaceRoot} service.
 *
@@ -10779,6 +10806,17 @@ var SilkPublishability = class {
 	* Resolve a package's publish targets via {@link SilkPublishability}, then drop any
 	* whose built `directory` package.json is `private: true`. Returned targets keep the
 	* detector's original (possibly package-relative) `directory`.
+	*
+	* @remarks
+	* When the prod build has written `dist/prod/targets.json`, that binding is
+	* authoritative: every surviving target's directory must be one of the group
+	* directories it names. A directory outside the binding means detection did
+	* not select the prod output — the `yaml-effect@0.7.1` shape, where a dev
+	* manifest carrying `catalog:` specifiers was packed and published. Rather
+	* than ship those bytes, fail with {@link PublishTargetBindingError}.
+	*
+	* Before the prod build runs there is no binding, and the detector's
+	* placeholder directories are left alone.
 	*/
 	static resolveTargets(pkg, root) {
 		return effect.Effect.gen(function* () {
@@ -10790,6 +10828,18 @@ var SilkPublishability = class {
 				const dir = (0, node_path.isAbsolute)(t.directory) ? t.directory : (0, node_path.join)(pkg.path, t.directory);
 				if (!(yield* isTargetPrivate(fs, dir))) kept.push(t);
 			}
+			const binding = yield* readTargetsBinding(fs, pkg.path);
+			if (binding === null) return kept;
+			const boundDirectories = binding.groups.map((g) => normalizeDir(g.dir));
+			const bound = new Set(boundDirectories);
+			for (const t of kept) {
+				const relativeDir = normalizeDir((0, node_path.isAbsolute)(t.directory) ? (0, node_path.relative)(pkg.path, t.directory) : t.directory);
+				if (!bound.has(relativeDir)) return yield* effect.Effect.fail(new PublishTargetBindingError({
+					pkg: pkg.name,
+					directory: relativeDir,
+					boundDirectories
+				}));
+			}
 			return kept;
 		});
 	}
@@ -10816,6 +10866,26 @@ var SilkPublishability = class {
 		});
 	}
 };
+/**
+* Reduce a directory to a comparable package-relative POSIX path: backslashes to
+* forward slashes, no `./` prefix, no trailing slash. `""` (the package root)
+* normalizes to `.`, matching how a root-directory target is recorded.
+*
+* @remarks
+* Trailing slashes are trimmed with an index scan rather than `/\/+$/`. That
+* regex is unanchored at the start, so the engine retries the match from every
+* position and degrades to O(n²) on a path of many slashes (CodeQL
+* `js/polynomial-redos`). `dir` reaches here from `dist/prod/targets.json`, which
+* the bundler writes but a consumer repo could hand-edit.
+*/
+const normalizeDir = (dir) => {
+	const slashed = dir.replaceAll("\\", "/");
+	const withoutPrefix = slashed.startsWith("./") ? slashed.slice(2) : slashed;
+	let end = withoutPrefix.length;
+	while (end > 0 && withoutPrefix[end - 1] === "/") end -= 1;
+	const normalized = withoutPrefix.slice(0, end);
+	return normalized === "" ? "." : normalized;
+};
 /** True when a built target directory's package.json is `private: true`. Missing/unreadable/malformed → false. */
 const isTargetPrivate = (fs, targetDir) => fs.readFileString((0, node_path.join)(targetDir, "package.json")).pipe(effect.Effect.flatMap((content) => effect.Effect.try({
 	try: () => JSON.parse(content).private === true,
@@ -39302,6 +39372,7 @@ function makeShape$1(pit, inspector, discovery, detector, config, fs) {
 	const plan = (options) => effect.Effect.gen(function* () {
 		const resolvedCwd = (0, node_path.resolve)(options.cwd);
 		const changesetDir = (0, node_path.join)(resolvedCwd, ".changeset");
+		yield* discovery.refresh();
 		let fromRef = options.from;
 		if (!fromRef) {
 			let baseBranch = options.base;