@savvy-web/silk 3.7.10 → 3.7.11

package/changesets-changelog.cjs

@@ -2335,7 +2335,7 @@ var GlobSet = class GlobSet extends effect.Schema.Class("GlobSet")(effect.Schema
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/BunExtension.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/BunExtension.js
 /**
 * Extension data specific to bun lockfiles, attached to `Lockfile.extension`
 * when the format is `"bun"`.
@@ -2356,7 +2356,7 @@ var BunExtension = class extends effect.Schema.Class("BunExtension")({
 	trustedDependencies: effect.Schema.optionalKey(effect.Schema.Array(effect.Schema.String))
 }) {};
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.10.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/CatalogResolver.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.11.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/CatalogResolver.js
 /**
 * Contract for resolving pnpm `catalog:` dependency specifiers to concrete
 * version ranges.
@@ -2402,7 +2402,7 @@ var CatalogResolver = class CatalogResolver extends effect.Context.Service()("@e
 	static noop = effect.Layer.succeed(CatalogResolver, { rangeOf: () => effect.Effect.succeed(effect.Option.none()) });
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.10.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/WorkspaceResolver.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.11.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/WorkspaceResolver.js
 /**
 * Raised when a `catalog:` or `workspace:` specifier cannot be resolved
 * because the resolution mechanism itself failed — not for an ordinary
@@ -2463,7 +2463,7 @@ var WorkspaceResolver = class WorkspaceResolver extends effect.Context.Service()
 	static noop = effect.Layer.succeed(WorkspaceResolver, { versionOf: () => effect.Effect.succeed(effect.Option.none()) });
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.10.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/CatalogAssemblyError.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.11.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/CatalogAssemblyError.js
 /**
 * Raised when a workspace's catalogs cannot be assembled — a `pnpm-workspace.yaml`
 * that is unreadable or not valid YAML, a root `package.json` `workspaces` field
@@ -2507,7 +2507,7 @@ var CatalogAssemblyError = class extends effect.Schema.TaggedError()("CatalogAss
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.10.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/DependencySection.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.11.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/DependencySection.js
 /**
 * The short dependency kind: which dependency map an entry came from, named the
 * way consumers branch on it.
@@ -2647,13 +2647,13 @@ const advance$1 = (s) => {
 		return ch;
 	}
 };
-const isDigit$2 = (ch) => ch >= "0" && ch <= "9";
+const isDigit$3 = (ch) => ch >= "0" && ch <= "9";
 const isLetter = (ch) => ch >= "a" && ch <= "z" || ch >= "A" && ch <= "Z";
-const isIdentChar = (ch) => isDigit$2(ch) || isLetter(ch) || ch === "-";
+const isIdentChar = (ch) => isDigit$3(ch) || isLetter(ch) || ch === "-";
 const atEnd$1 = (s) => s.pos >= s.len;
 const peekDigit = (s) => {
 	const ch = peek$1(s);
-	return ch !== void 0 && isDigit$2(ch);
+	return ch !== void 0 && isDigit$3(ch);
 };
 const peekIdentChar = (s) => {
 	const ch = peek$1(s);
@@ -2662,7 +2662,7 @@ const peekIdentChar = (s) => {
 const parseNumericIdentifier = (s) => {
 	const start = s.pos;
 	const first = peek$1(s);
-	if (first === void 0 || !isDigit$2(first)) return fail(s);
+	if (first === void 0 || !isDigit$3(first)) return fail(s);
 	let digits = "";
 	while (peekDigit(s)) digits += advance$1(s);
 	if (digits.length > 1 && digits[0] === "0") {
@@ -2684,7 +2684,7 @@ const parsePrereleaseIdentifier = (s) => {
 	if (first === void 0 || !isIdentChar(first)) return fail(s);
 	while (peekIdentChar(s)) {
 		const ch = advance$1(s) ?? "";
-		if (!isDigit$2(ch)) hasNonDigit = true;
+		if (!isDigit$3(ch)) hasNonDigit = true;
 		token += ch;
 	}
 	if (token.length === 0) return fail(s);
@@ -4122,7 +4122,7 @@ const isComparatorSetSubset = (sub, sup) => {
 	return true;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.10.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/DependencySpecifier.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.11.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/DependencySpecifier.js
 /**
 * Indicates that a string could not be parsed as a valid dependency specifier.
 *
@@ -4329,7 +4329,7 @@ const DependencySpecifier = Object.assign(brandedSpecifier, {
 	FromString: fromString
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.10.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/IntegrityHash.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.11.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/IntegrityHash.js
 const SRI_RE = /^(sha1|sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2}$/;
 const COREPACK_RE = /^(sha1|sha224|sha256|sha384|sha512)\.[0-9a-f]+$/;
 const YARN_RE = /^[0-9]+(c[0-9]+)?\/[0-9a-f]+$/;
@@ -4381,12 +4381,109 @@ const IntegrityHash = Object.assign(brandedIntegrity, {
 	algorithmOf,
 	decode: decode$2
 });
+const corepackRestricted = brandedIntegrity.pipe(effect.Schema.check(effect.Schema.makeFilter((value) => isCorepack(value) ? void 0 : "Expected a corepack (<algo>.<hex>) integrity hash")));
+const BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const decodeBase64 = (value) => {
+	const firstPad = value.indexOf("=");
+	const body = firstPad === -1 ? value : value.slice(0, firstPad);
+	const padding = firstPad === -1 ? "" : value.slice(firstPad);
+	if (padding !== "" && padding !== "=" && padding !== "==") return void 0;
+	const remainder = body.length % 4;
+	if (body.length === 0 || remainder === 1) return void 0;
+	if (padding.length > 0 && padding.length !== (4 - remainder) % 4) return void 0;
+	let buffer = 0;
+	let bits = 0;
+	const bytes = [];
+	for (const char of body) {
+		const sextet = BASE64_ALPHABET.indexOf(char);
+		if (sextet < 0) return void 0;
+		buffer = buffer << 6 | sextet;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			bytes.push(buffer >>> bits & 255);
+		}
+	}
+	if ((buffer & (1 << bits) - 1) !== 0) return void 0;
+	return bytes;
+};
+const encodeBase64 = (bytes) => {
+	let out = "";
+	for (let index = 0; index < bytes.length; index += 3) {
+		const b0 = bytes[index] ?? 0;
+		const b1 = bytes[index + 1];
+		const b2 = bytes[index + 2];
+		const buffer = b0 << 16 | (b1 ?? 0) << 8 | (b2 ?? 0);
+		out += BASE64_ALPHABET.charAt(buffer >>> 18 & 63);
+		out += BASE64_ALPHABET.charAt(buffer >>> 12 & 63);
+		out += b1 === void 0 ? "=" : BASE64_ALPHABET.charAt(buffer >>> 6 & 63);
+		out += b2 === void 0 ? "=" : BASE64_ALPHABET.charAt(buffer & 63);
+	}
+	return out;
+};
+const hexOfBytes = (bytes) => bytes.map((byte) => byte.toString(16).padStart(2, "0")).join("");
+const bytesOfHex = (hex) => {
+	const bytes = [];
+	for (let index = 0; index < hex.length; index += 2) bytes.push(Number.parseInt(hex.slice(index, index + 2), 16));
+	return bytes;
+};
+const SHA512_SRI_PREFIX = "sha512-";
+const SHA512_COREPACK_PREFIX = "sha512.";
+const SHA512_DIGEST_BYTES = 64;
+const COREPACK_SHA512_RE = /^sha512\.[0-9a-f]{128}$/;
+const unwrapJsonQuotes = (value) => value.length >= 2 && value.startsWith("\"") && value.endsWith("\"") ? value.slice(1, -1) : value;
+const corepackOfSri = (input) => {
+	const value = unwrapJsonQuotes(input);
+	if (!value.startsWith(SHA512_SRI_PREFIX)) return void 0;
+	const bytes = decodeBase64(value.slice(7));
+	if (bytes === void 0 || bytes.length !== SHA512_DIGEST_BYTES) return void 0;
+	return `${SHA512_COREPACK_PREFIX}${hexOfBytes(bytes)}`;
+};
+const sriOfCorepack = (value) => COREPACK_SHA512_RE.test(value) ? `${SHA512_SRI_PREFIX}${encodeBase64(bytesOfHex(value.slice(7)))}` : void 0;
+const corepackFromSri = effect.Schema.String.pipe(effect.Schema.decodeTo(corepackRestricted, effect.SchemaTransformation.transformOrFail({
+	decode: (input) => {
+		const corepack = corepackOfSri(input);
+		return corepack === void 0 ? effect.Effect.fail(new effect.SchemaIssue.InvalidValue({ message: `Expected an SRI sha512-<base64> integrity hash carrying a 64-byte digest, got "${input}"` }, input)) : effect.Effect.succeed(corepack);
+	},
+	encode: (value) => {
+		const sri = sriOfCorepack(value);
+		return sri === void 0 ? effect.Effect.fail(new effect.SchemaIssue.InvalidValue({ message: `Expected a corepack sha512.<128-hex-digit> integrity hash, got "${value}"` }, value)) : effect.Effect.succeed(sri);
+	}
+})));
+/**
+* Indicates that a string could not be converted from npm's SRI form to the
+* corepack integrity form.
+*
+* Raised by {@link (CorepackIntegrityHash:variable)}'s `fromSri`. The offending
+* string is preserved on `input`. Only a canonical `sha512-<base64>` value
+* carrying a 64-byte digest converts — corepack pins accept nothing weaker
+* than sha512, so a sha256/sha1 SRI hash, malformed base64, a wrong-length
+* digest and an already-corepack-form input all raise this error.
+*
+* @public
+*/
+var InvalidSriIntegrityHashError = class extends effect.Schema.TaggedError()("InvalidSriIntegrityHashError", { 
+/** The raw input string that failed conversion. */
+input: effect.Schema.String }) {
+	get message() {
+		return `Invalid SRI integrity hash "${this.input}": expected a sha512-<base64> value carrying a 64-byte digest (corepack accepts only sha512)`;
+	}
+};
+const fromSri = (input) => effect.Schema.decodeUnknownEffect(corepackFromSri)(input).pipe(effect.Effect.mapError(() => new InvalidSriIntegrityHashError({ input })));
 /**
 * {@link (IntegrityHash:variable)} narrowed to the corepack `<algo>.<hex>` form
 * — `sha512.deadbeef`, and corepack's own sha224 default pins
 * (`sha224.877304e3…`). An SRI (`sha512-<base64>`) or yarn (`10c0/<hex>`)
 * hash, both valid `IntegrityHash` values, fails this schema.
 *
+* The schema value also carries the SRI bridge: the `FromSri` codec decodes
+* npm's `sha512-<base64>` form (what `NpmRegistry.version()` returns, with one
+* layer of JSON quotes tolerated) into the corepack form, and `fromSri` is its
+* `Effect` convenience, failing with a typed
+* {@link InvalidSriIntegrityHashError}. The conversion is deliberately one-way
+* and sha512-only — corepack pins accept nothing weaker, so a sha256/sha1 SRI
+* hash fails typed rather than minting a pin corepack would reject.
+*
 * @remarks
 * The corepack pin tail (`<name>@<version>+<integrity>`) is the one place the
 * kit meets this form, and two schemas name it: `PackageManagerPin.integrity`
@@ -4432,7 +4529,10 @@ const IntegrityHash = Object.assign(brandedIntegrity, {
 *
 * @public
 */
-const CorepackIntegrityHash = brandedIntegrity.pipe(effect.Schema.check(effect.Schema.makeFilter((value) => isCorepack(value) ? void 0 : "Expected a corepack (<algo>.<hex>) integrity hash")));
+const CorepackIntegrityHash = Object.assign(corepackRestricted, {
+	FromSri: corepackFromSri,
+	fromSri
+});
 effect.Schema.Literals([
 	"npm",
 	"pnpm",
@@ -5299,7 +5399,7 @@ var Run = class {
 	static REDACTED = "***";
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.10.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/ReleaseAgeGate.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.11.0_@effected+semver@0.5.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/npm/ReleaseAgeGate.js
 const MS_PER_MINUTE = 6e4;
 /**
 * A source's partial contribution to a {@link ReleaseAgeGate}: the effective
@@ -5469,7 +5569,7 @@ var ReleaseAgeGate = class ReleaseAgeGate extends effect.Schema.Class("ReleaseAg
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/ImporterDependency.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/ImporterDependency.js
 /**
 * One declared dependency of one workspace importer, as the lockfile records it.
 *
@@ -5507,7 +5607,7 @@ var ImporterDependency = class extends effect.Schema.Class("ImporterDependency")
 	depType: DependencyField
 }) {};
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/LockfileImporter.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/LockfileImporter.js
 /**
 * One workspace importer's declared dependencies, as the lockfile records them.
 *
@@ -5531,7 +5631,7 @@ var LockfileImporter = class extends effect.Schema.Class("LockfileImporter")({
 	dependencies: effect.Schema.Array(ImporterDependency)
 }) {};
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/ResolvedPackage.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/ResolvedPackage.js
 const EMPTY_DEPENDENCIES = {};
 /**
 * A package resolved from a lockfile.
@@ -5566,7 +5666,7 @@ var ResolvedPackage = class extends effect.Schema.Class("ResolvedPackage")({
 	dependencies: effect.Schema.Record(effect.Schema.String, effect.Schema.String).pipe(effect.Schema.withDecodingDefaultKey(effect.Effect.succeed(EMPTY_DEPENDENCIES)), effect.Schema.withConstructorDefault(effect.Effect.succeed(EMPTY_DEPENDENCIES)))
 }) {};
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/WorkspaceDependency.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/WorkspaceDependency.js
 /**
 * A directed dependency edge between two workspace packages as recorded in
 * the lockfile.
@@ -5588,7 +5688,7 @@ var WorkspaceDependency = class extends effect.Schema.Class("WorkspaceDependency
 	constraint: effect.Schema.String
 }) {};
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/PnpmExtension.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/PnpmExtension.js
 /**
 * Extension data specific to pnpm lockfiles, attached to `Lockfile.extension`
 * when the format is `"pnpm"`.
@@ -5613,7 +5713,7 @@ var PnpmExtension = class extends effect.Schema.Class("PnpmExtension")({
 	}))
 }) {};
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/LockfileFormat.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/LockfileFormat.js
 /**
 * The lockfile formats this package parses: bun's `bun.lock` (JSONC), npm's
 * `package-lock.json` (v2/v3 JSON), pnpm's `pnpm-lock.yaml` and yarn Berry's
@@ -5651,7 +5751,7 @@ const FILENAMES = {
 */
 const filenameFor = (format) => FILENAMES[format][0];
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/internal/shared.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/shared.js
 /**
 * The four dependency sections of a manifest, in a stable order — the shared
 * dependency-sections table (v3's `DEP_SECTIONS`). Each entry is both the
@@ -5987,7 +6087,7 @@ function evaluateNode(node, depth) {
 //#region ../../node_modules/.pnpm/@effected+jsonc@0.7.0_effect@4.0.0-rc.109/node_modules/@effected/jsonc/internal/scanner.js
 const isWhitespace = (ch) => ch === 32 || ch === 9 || ch === 11 || ch === 12 || ch === 160 || ch === 65279;
 const isLineBreak$1 = (ch) => ch === 10 || ch === 13 || ch === 8232 || ch === 8233;
-const isDigit$1 = (ch) => ch >= 48 && ch <= 57;
+const isDigit$2 = (ch) => ch >= 48 && ch <= 57;
 /**
 * Create a stateful {@link Scanner} for the given JSONC string.
 *
@@ -6085,31 +6185,31 @@ const createScanner$2 = (text, ignoreTrivia = false) => {
 		if (text.charCodeAt(pos) === 45) pos++;
 		if (text.charCodeAt(pos) === 48) pos++;
 		else {
-			if (!isDigit$1(text.charCodeAt(pos))) {
+			if (!isDigit$2(text.charCodeAt(pos))) {
 				tokenError = "UnexpectedEndOfNumber";
 				return text.substring(start, pos);
 			}
 			pos++;
-			while (pos < len && isDigit$1(text.charCodeAt(pos))) pos++;
+			while (pos < len && isDigit$2(text.charCodeAt(pos))) pos++;
 		}
 		if (pos < len && text.charCodeAt(pos) === 46) {
 			pos++;
-			if (!isDigit$1(text.charCodeAt(pos))) {
+			if (!isDigit$2(text.charCodeAt(pos))) {
 				tokenError = "UnexpectedEndOfNumber";
 				return text.substring(start, pos);
 			}
 			pos++;
-			while (pos < len && isDigit$1(text.charCodeAt(pos))) pos++;
+			while (pos < len && isDigit$2(text.charCodeAt(pos))) pos++;
 		}
 		if (pos < len && (text.charCodeAt(pos) === 69 || text.charCodeAt(pos) === 101)) {
 			pos++;
 			if (pos < len && (text.charCodeAt(pos) === 43 || text.charCodeAt(pos) === 45)) pos++;
-			if (!isDigit$1(text.charCodeAt(pos))) {
+			if (!isDigit$2(text.charCodeAt(pos))) {
 				tokenError = "UnexpectedEndOfNumber";
 				return text.substring(start, pos);
 			}
 			pos++;
-			while (pos < len && isDigit$1(text.charCodeAt(pos))) pos++;
+			while (pos < len && isDigit$2(text.charCodeAt(pos))) pos++;
 		}
 		return text.substring(start, pos);
 	};
@@ -6215,7 +6315,7 @@ const createScanner$2 = (text, ignoreTrivia = false) => {
 				return token;
 			}
 			case 45:
-				if (pos + 1 < len && isDigit$1(text.charCodeAt(pos + 1))) {
+				if (pos + 1 < len && isDigit$2(text.charCodeAt(pos + 1))) {
 					tokenValue = scanNumber();
 					token = "Number";
 					return token;
@@ -6226,7 +6326,7 @@ const createScanner$2 = (text, ignoreTrivia = false) => {
 				tokenError = "InvalidSymbol";
 				return token;
 			default:
-				if (isDigit$1(ch)) {
+				if (isDigit$2(ch)) {
 					tokenValue = scanNumber();
 					token = "Number";
 					return token;
@@ -7580,7 +7680,7 @@ var JsoncModifier = class {
 	});
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/internal/bun.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/bun.js
 const DepRecord$2 = effect.Schema.optionalKey(effect.Schema.Record(effect.Schema.String, effect.Schema.String));
 const BunWorkspaceEntry = effect.Schema.Struct({
 	name: effect.Schema.optionalKey(effect.Schema.String),
@@ -7673,7 +7773,7 @@ const toFields$3 = (raw) => effect.Effect.gen(function* () {
 	};
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/internal/npm.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/npm.js
 const DepRecord$1 = effect.Schema.optionalKey(effect.Schema.Record(effect.Schema.String, effect.Schema.String));
 const NpmPackageEntry = effect.Schema.Struct({
 	name: effect.Schema.optionalKey(effect.Schema.String),
@@ -15450,7 +15550,7 @@ function deepEqualValues(a, b) {
 	return false;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/internal/documents.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/documents.js
 /**
 * An empty YAML document composes to `null` (`Yaml.parseAll("")` is `[null]`,
 * and the trailing document of an env-only `pnpm-lock.yaml` is `null` too).
@@ -15520,7 +15620,7 @@ const selectSoleDocument = (content) => effect.Effect.gen(function* () {
 	};
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/internal/pnpm.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/pnpm.js
 const PnpmImporterDeps = effect.Schema.optionalKey(effect.Schema.Record(effect.Schema.String, effect.Schema.Struct({
 	specifier: effect.Schema.String,
 	version: effect.Schema.String
@@ -15645,7 +15745,7 @@ const toFields$1 = (raw) => effect.Effect.gen(function* () {
 	};
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/internal/yarn.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/yarn.js
 const YarnLockfileRaw = effect.Schema.Record(effect.Schema.String, effect.Schema.Unknown);
 const DepRecord = effect.Schema.optionalKey(effect.Schema.Record(effect.Schema.String, effect.Schema.String));
 const YarnEntry = effect.Schema.Struct({
@@ -15768,7 +15868,7 @@ const cleanYarnDeps = (deps) => {
 	return Object.fromEntries(Object.entries(deps).map(([name, value]) => [name, value.startsWith("npm:") ? value.slice(4) : value]));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/Lockfile.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/Lockfile.js
 const EMPTY_IMPORTERS = [];
 /**
 * Failure of `Lockfile.parse`: the given content is not a valid lockfile of
@@ -16012,7 +16112,7 @@ var Lockfile = class Lockfile extends effect.Schema.Class("Lockfile")({
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.10_ff0fb68daff5c4399291b91de5fa8e66/node_modules/@effected/lockfiles/LockfileIntegrity.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/LockfileIntegrity.js
 /**
 * The minimal manifest shape {@link LockfileIntegrity.compare} checks a
 * lockfile against: a package name plus the four optional dependency maps.
@@ -16128,7 +16228,7 @@ var LockfileIntegrity = class LockfileIntegrity extends effect.Schema.Class("Loc
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/Dependency.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/Dependency.js
 /**
 * A resolved dependency entry pairing a package name with its version
 * specifier and the `kind` of map it came from (`@effected/npm`'s
@@ -16192,7 +16292,7 @@ var Dependency = class extends effect.Schema.Class("Dependency")({
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/DevEngines.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/DevEngines.js
 /**
 * A single `devEngines` constraint with a name and optional `version` / `onFail`.
 *
@@ -16230,7 +16330,7 @@ const DevEnginesSchema = effect.Schema.Struct({
 	libc: effect.Schema.optionalKey(DevEngineOrArray)
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+spdx@0.3.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/internal/licenseIds.js
+//#region ../../node_modules/.pnpm/@effected+spdx@0.4.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/internal/licenseIds.js
 /** @internal */
 const ACTIVE_LICENSE_IDS = [
 	"0BSD",
@@ -16963,7 +17063,7 @@ const LICENSE_IDS = new Set(ACTIVE_LICENSE_IDS);
 /** @internal */
 const DEPRECATED_LICENSE_IDS = new Set(DEPRECATED_LICENSE_ID_LIST);
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+spdx@0.3.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/License.js
+//#region ../../node_modules/.pnpm/@effected+spdx@0.4.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/License.js
 /**
 * Indicates that a string is not a valid SPDX expression fragment: an
 * unrecognized license or exception identifier, or a malformed
@@ -17132,7 +17232,7 @@ var License = class License extends effect.Schema.Class("License")({
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+spdx@0.3.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/internal/exceptions.js
+//#region ../../node_modules/.pnpm/@effected+spdx@0.4.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/internal/exceptions.js
 /** @internal */
 const ACTIVE_EXCEPTION_IDS = [
 	"389-exception",
@@ -17209,7 +17309,7 @@ const EXCEPTION_IDS = new Set(ACTIVE_EXCEPTION_IDS);
 /** @internal */
 const DEPRECATED_EXCEPTION_IDS = new Set(DEPRECATED_EXCEPTION_ID_LIST);
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+spdx@0.3.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/LicenseException.js
+//#region ../../node_modules/.pnpm/@effected+spdx@0.4.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/LicenseException.js
 /**
 * A validated SPDX license-exception identifier: an Effect `Schema.Class` whose
 * `id` is a member of the SPDX exception list. The class doubles as its own
@@ -17329,7 +17429,7 @@ var LicenseException = class LicenseException extends effect.Schema.Class("Licen
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+spdx@0.3.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/internal/parser.js
+//#region ../../node_modules/.pnpm/@effected+spdx@0.4.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/internal/parser.js
 const TOKEN_OPEN_PAREN = 0;
 const TOKEN_CLOSE_PAREN = 1;
 const TOKEN_PLUS = 2;
@@ -17502,6 +17602,7 @@ function parse$2(input) {
 		const head = peek();
 		if (head === void 0 || head.type !== TOKEN_ID) return void 0;
 		const value = head.value;
+		let license;
 		if (value.startsWith(DOCUMENT_REF_PREFIX)) {
 			pos++;
 			if (peek()?.type !== TOKEN_COLON) return void 0;
@@ -17511,27 +17612,32 @@ function parse$2(input) {
 			const full = `${value}:${refToken.value}`;
 			if (!License.isLicenseRef(full)) return void 0;
 			pos++;
-			return {
+			license = {
 				kind: "licenseRef",
 				documentRef: value.slice(12),
 				ref: refToken.value.slice(11)
 			};
-		}
-		if (value.startsWith(LICENSE_REF_PREFIX)) {
+		} else if (value.startsWith(LICENSE_REF_PREFIX)) {
 			if (!License.isLicenseRef(value)) return void 0;
 			pos++;
-			return {
+			license = {
 				kind: "licenseRef",
 				documentRef: void 0,
 				ref: value.slice(11)
 			};
-		}
-		if (!License.isKnownId(value)) return void 0;
-		pos++;
-		let plus = false;
-		if (peek()?.type === TOKEN_PLUS) {
+		} else {
+			if (!License.isKnownId(value)) return void 0;
 			pos++;
-			plus = true;
+			let plus = false;
+			if (peek()?.type === TOKEN_PLUS) {
+				pos++;
+				plus = true;
+			}
+			license = {
+				kind: "license",
+				id: value,
+				plus
+			};
 		}
 		if (peek()?.type === TOKEN_WITH) {
 			pos++;
@@ -17540,25 +17646,18 @@ function parse$2(input) {
 			pos++;
 			return {
 				kind: "with",
-				license: {
-					id: value,
-					plus
-				},
+				license,
 				exception: exceptionToken.value
 			};
 		}
-		return {
-			kind: "license",
-			id: value,
-			plus
-		};
+		return license;
 	}
 	const node = parseOr();
 	if (node === void 0 || pos !== tokens.length) return void 0;
 	return node;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+spdx@0.3.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/SpdxExpression.js
+//#region ../../node_modules/.pnpm/@effected+spdx@0.4.0_effect@4.0.0-rc.109/node_modules/@effected/spdx/SpdxExpression.js
 /**
 * Serialize a tagged SPDX AST node — a class instance OR its encoded POJO — to
 * the canonical, fully-parenthesized SPDX string. This is the single source of
@@ -17615,15 +17714,16 @@ var LicenseRefNode = class extends effect.Schema.TaggedClass()("LicenseRef", {
 	}
 };
 /**
-* A `license WITH exception` node. Per the SPDX order of precedence, `WITH`
-* binds only to a simple license (never a reference or a compound expression),
-* so `license` is always a {@link LicenseNode}.
+* A `license WITH exception` node. Per the SPDX grammar, `WITH` binds to a
+* simple expression — a license identifier (optionally `+`) or a
+* `LicenseRef`/`DocumentRef` reference — never a compound expression, so
+* `license` is a {@link LicenseNode} or a {@link LicenseRefNode}.
 *
 * @public
 */
 var WithExceptionNode = class extends effect.Schema.TaggedClass()("WithException", {
-	/** The license the exception applies to, which may itself carry the `+` marker. */
-	license: LicenseNode,
+	/** The license the exception applies to: a simple license (which may carry the `+` marker) or a `LicenseRef` reference. */
+	license: effect.Schema.Union([LicenseNode, LicenseRefNode]),
 	/** The SPDX exception short identifier, e.g. `"Bison-exception-2.2"`. */
 	exception: effect.Schema.String
 }) {
@@ -17673,21 +17773,21 @@ const SpdxExpressionUnion = effect.Schema.Union([
 	AndNode,
 	OrNode
 ]);
+function materializeSimple(raw) {
+	return raw.kind === "license" ? LicenseNode.make({
+		id: raw.id,
+		plus: raw.plus
+	}) : LicenseRefNode.make(raw.documentRef !== void 0 ? {
+		documentRef: raw.documentRef,
+		ref: raw.ref
+	} : { ref: raw.ref });
+}
 function materialize$1(raw) {
 	switch (raw.kind) {
-		case "license": return LicenseNode.make({
-			id: raw.id,
-			plus: raw.plus
-		});
-		case "licenseRef": return LicenseRefNode.make(raw.documentRef !== void 0 ? {
-			documentRef: raw.documentRef,
-			ref: raw.ref
-		} : { ref: raw.ref });
+		case "license":
+		case "licenseRef": return materializeSimple(raw);
 		case "with": return WithExceptionNode.make({
-			license: LicenseNode.make({
-				id: raw.license.id,
-				plus: raw.license.plus
-			}),
+			license: materializeSimple(raw.license),
 			exception: raw.exception
 		});
 		case "and": return AndNode.make({
@@ -17747,7 +17847,7 @@ effect.Schema.String.pipe(effect.Schema.decodeTo(SpdxExpressionUnion, effect.Sch
 	encode: (expression) => effect.Effect.succeed(serialize$1(expression))
 })));
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/License.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/License.js
 /**
 * Indicates that a string is not a valid SPDX license identifier or expression.
 *
@@ -17782,7 +17882,7 @@ const isValidSpdx = (value) => {
 */
 const SpdxLicense = effect.Schema.String.pipe(effect.Schema.check(effect.Schema.makeFilter((value) => isValidSpdx(value) ? void 0 : "Expected a valid SPDX license expression")), effect.Schema.brand("SpdxLicense"));
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/PackageManager.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/PackageManager.js
 const PACKAGE_MANAGER_NAME_RE = /^[a-z]+$/;
 const invalid$1 = (input, message) => effect.Effect.fail(new effect.SchemaIssue.InvalidValue({ message }, input));
 /**
@@ -17893,7 +17993,7 @@ var PackageManager = class PackageManager extends effect.Schema.Class("PackageMa
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/PackageName.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/PackageName.js
 /**
 * Indicates that a string could not be used as a valid npm package name.
 *
@@ -17951,7 +18051,7 @@ const PackageName = Object.assign(effect.Schema.Union([ScopedPackageName, Unscop
 	isScoped
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/Person.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/Person.js
 const parsePersonString = (input) => {
 	const emailMatch = input.match(/<([^>]+)>/);
 	const urlMatch = input.match(/\(([^)]+)\)/);
@@ -18097,7 +18197,7 @@ var Person = class Person extends effect.Schema.Class("Person")({
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/Repository.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/Repository.js
 /** The shorthand hosts npm resolves without a scheme. */
 const SHORTHAND_HOSTS = /* @__PURE__ */ new Map([
 	["github", "https://github.com"],
@@ -18272,7 +18372,7 @@ var Bugs = class Bugs extends effect.Schema.Class("Bugs")({
 	})));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/internal/format.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/internal/format.js
 const KEY_INDEX = new Map([
 	"$schema",
 	"name",
@@ -18507,7 +18607,7 @@ const renderJson = (raw, options) => {
 	return options.newline ? `${json}\n` : json;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/internal/wire.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/internal/wire.js
 const RawJson = effect.Schema.Record(effect.Schema.String, effect.Schema.Unknown);
 /**
 * Build the open-JSON ↔ class wire codec for a `Schema.Class` carrying a
@@ -18538,7 +18638,7 @@ const makeWire = (Class) => {
 	})));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.10.0_effect@4.0.0-rc.109/node_modules/@effected/package-json/Package.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.10.2_effect@4.0.0-rc.109/node_modules/@effected/package-json/Package.js
 const toHashMap = effect.SchemaTransformation.transform({
 	decode: (record) => effect.HashMap.fromIterable(Object.entries(record)),
 	encode: (map) => Object.fromEntries(effect.HashMap.toEntries(map))
@@ -18825,7 +18925,7 @@ var Package = class Package extends effect.Schema.Class("Package")({
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspacePackage.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspacePackage.js
 const EMPTY$1 = Object.freeze(Object.create(null));
 const EMPTY_MANIFEST = Object.freeze(Object.create(null));
 /**
@@ -19423,7 +19523,7 @@ var Walker$1 = class {
 	static findRoot = findRoot$1;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceRoot.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceRoot.js
 /**
 * The marker filenames {@link WorkspaceRoot} probes for, in priority order.
 *
@@ -19610,7 +19710,7 @@ var WorkspaceRoot = class WorkspaceRoot extends effect.Context.Service()("@effec
 	static layerTest = (root) => effect.Layer.effect(WorkspaceRoot, WorkspaceRoot.makeTest(root)).pipe(effect.Layer.provide(effect.Path.layer));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/limits.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/limits.js
 /**
 * Hard ceiling on directories the enumerator will visit for one pattern set.
 * Guards the pathological case a depth cap alone does not: a wide, shallow
@@ -19628,7 +19728,7 @@ const MAX_ENUMERATION_ENTRIES = 1e5;
 */
 const PRUNED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/traverse.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/traverse.js
 /** Directory names never descended into. */
 const isPruned = (entry) => PRUNED_DIRECTORIES.has(entry);
 /** Join root-relative POSIX segments; `""` is the root itself. */
@@ -19718,7 +19818,7 @@ var Traversal = class {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/enumerate.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/enumerate.js
 /** Strip a trailing slash from `GlobPattern.enumerationPrefix` to get a relative directory. */
 const baseOf = (pattern) => pattern.enumerationPrefix.replace(/\/$/, "");
 /**
@@ -19788,7 +19888,7 @@ const enumerate = (root, globs, options) => effect.Effect.gen(function* () {
 	return results;
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/patterns.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/patterns.js
 const stringsOf = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : void 0;
 /** The `packages:` list of a `pnpm-workspace.yaml` document. Total on a parsed document. */
 const pnpmPatternsOf = (document) => {
@@ -19845,7 +19945,7 @@ const readPatterns = (root) => effect.Effect.gen(function* () {
 	return manifestPatternsOf(manifest);
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceDiscovery.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceDiscovery.js
 /**
 * Raised when a workspace member's `package.json` cannot be read, parsed, or
 * used — it is missing, malformed, or lacks a `name` or `version`.
@@ -20301,7 +20401,7 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends effect.Context.Service
 };
 const isStringRecord$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((entry) => typeof entry === "string");
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/DependencyGraph.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/DependencyGraph.js
 /**
 * Raised when the workspace dependency graph cannot be topologically ordered
 * because it contains a cycle.
@@ -23997,7 +24097,7 @@ var Git = class Git extends effect.Context.Service()("@effected/git/Git") {
 	static layerTest = (overrides = {}) => effect.Layer.succeed(Git, Git.makeTest(overrides));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/ChangeDetector.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/ChangeDetector.js
 /**
 * Which git refs to compare, and whether to fold in the working tree.
 *
@@ -24253,7 +24353,7 @@ function resolveFromCatalog(catalogs, wantedDependency) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/catalogs.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/catalogs.js
 /** Project a pnpm-workspace manifest's `catalog` / `catalogs` fields into a `Catalogs` map. */
 const inlineCatalogs = (manifest) => {
 	if (manifest.catalog === void 0 && manifest.catalogs === void 0) return {};
@@ -24317,7 +24417,7 @@ const rangeOf = (catalogs, dependency, specifier) => {
 	});
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/ConfigDependencyHooks.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/ConfigDependencyHooks.js
 /** Whether `value` is a non-null, non-array object. */
 const isObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
@@ -24731,7 +24831,7 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends effect.Context.S
 	}));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/PackageManagerName.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/PackageManagerName.js
 /**
 * The four package managers this package understands.
 *
@@ -25106,7 +25206,7 @@ var PackageManagerDetector = class PackageManagerDetector extends effect.Context
 	static layerTest = (overrides = {}) => effect.Layer.succeed(PackageManagerDetector, PackageManagerDetector.makeTest(overrides));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/LockfileReader.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/LockfileReader.js
 /**
 * Raised when the workspace's lockfile cannot be read off disk.
 *
@@ -25286,7 +25386,7 @@ var LockfileReader = class LockfileReader extends effect.Context.Service()("@eff
 	static layerTest = (overrides = {}) => effect.Layer.succeed(LockfileReader, LockfileReader.makeTest(overrides));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/Publishability.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/Publishability.js
 /** The public npm registry, used when `publishConfig.registry` says nothing. */
 const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 /**
@@ -25445,7 +25545,7 @@ var PublishabilityDetector = class extends effect.Context.Service()("@effected/w
 	static layerNone = effect.Layer.succeed(this, this.none);
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/importerVersions.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/importerVersions.js
 /**
 * Strip pnpm's peer-disambiguation suffix from a recorded importer version.
 *
@@ -25531,7 +25631,7 @@ const unanimousVersionOf = (index, dependency) => {
 	return agreed;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceCatalogs.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceCatalogs.js
 /**
 * An immutable, fully-normalized catalog collection — the one catalog
 * resolution semantic in the package.
@@ -26058,7 +26158,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends effect.Context.Service()
 	}));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceStateSnapshot.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceStateSnapshot.js
 const EMPTY = Object.freeze(Object.create(null));
 const DependencyMap = effect.Schema.Record(effect.Schema.String, effect.Schema.String).pipe(effect.Schema.withDecodingDefaultKey(effect.Effect.succeed(EMPTY)), effect.Schema.withConstructorDefault(effect.Effect.succeed(EMPTY)));
 /**
@@ -26281,7 +26381,7 @@ var WorkspaceStateSnapshot = class extends effect.Schema.Class("WorkspaceStateSn
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceSnapshots.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceSnapshots.js
 /** Whether `value` is a non-null, non-array object. */
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Whether every value in a record is a string — a usable dependency map. */
@@ -26558,7 +26658,7 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends effect.Context.Service
 	static layerTest = (overrides = {}) => effect.Layer.succeed(WorkspaceSnapshots, WorkspaceSnapshots.makeTest(overrides));
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.0_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/Workspaces.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/Workspaces.js
 const compose = (options, catalogsFactory) => {
 	const roots = WorkspaceRoot.layer;
 	const detector = PackageManagerDetector.layer;
@@ -49575,68 +49675,453 @@ function parseCommitMessage(message) {
 	return { description: message };
 }
 //#endregion
-//#region ../silk-effects/dist/dev/pkg/changesets/utils/issue-refs.js
+//#region ../../node_modules/.pnpm/@effected+github-references@0.1.0_effect@4.0.0-rc.109/node_modules/@effected/github-references/IssueReferences.js
 /**
-* Matches "closes #123" or "close: #456, #789" patterns (case-insensitive).
+* GitHub's closing-keyword issue-reference grammar, as pure functions.
 *
-* Capture group `[1]` contains the comma-separated issue number list.
+* @remarks
+* GitHub links an issue to a pull request when the PR's description carries
+* `<keyword> #<number>` for one of nine documented keywords. Consumers speak
+* that grammar in two distinct dialects, and this module models exactly those
+* two — no service, no layer, nothing but strings in and values out:
+*
+* - **Inline-in-prose** ({@link harvestIssueReferences}): a reference may appear anywhere in
+*   running text — `"fixes #12 and closes #13"` — with mandatory whitespace
+*   and **no colon**, because that is the spelling GitHub itself scans PR
+*   bodies for. This is the dialect a release pipeline harvests from commit
+*   subjects and PR descriptions.
+* - **Bare-line** ({@link parseBareLineReference}): the whole line, after trimming, *is*
+*   the reference — `"Closes: #12"` — with an **optional colon**, because a
+*   generated references region writes one reference per line and a colon
+*   reads better there. GitHub does not require the colon; the region format
+*   allows it, so the parser must too. The dialects differ because their
+*   producers do: prose is written by humans for GitHub's scanner, the region
+*   is written by tooling for humans.
+*
+* Deliberately out of scope this round: cross-repo references
+* (`owner/repo#N`) and full-URL references
+* (`https://github.com/owner/repo/issues/N`). Both are real GitHub spellings;
+* neither dialect's consumers emit them yet, and guessing at their shape here
+* would freeze an API nobody has driven.
+*/
+/**
+* The nine closing keywords GitHub documents, lowercased.
 *
-* @internal
+* @public
 */
-const CLOSES_ISSUE_PATTERN = /closes?:?\s*#?(\d+(?:, *#?\d+)*)/i;
+const CLOSING_KEYWORDS = [
+	"close",
+	"closes",
+	"closed",
+	"fix",
+	"fixes",
+	"fixed",
+	"resolve",
+	"resolves",
+	"resolved"
+];
+/**
+* Both patterns derive from {@link CLOSING_KEYWORDS} so the constant and the
+* grammar cannot drift. Alternation order is safe: the regex engine backtracks
+* through alternatives, so `close` matching inside `closes` fails at the
+* mandatory `#`-introducer and retries the longer keyword.
+*/
+const KEYWORDS = CLOSING_KEYWORDS.join("|");
+new RegExp(`\\b(${KEYWORDS})\\s+#(\\d+)`, "gi");
+new RegExp(`^(${KEYWORDS}):?[ \\t]+#(\\d+)$`, "i");
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+github-references@0.1.0_effect@4.0.0-rc.109/node_modules/@effected/github-references/ClosingList.js
 /**
-* Matches "fixes #123" or "fix: #456, #789" patterns (case-insensitive).
+* The closing-list dialect: one whole line naming several issues at once.
 *
-* Capture group `[1]` contains the comma-separated issue number list.
+* @remarks
+* The third dialect, alongside the two in `IssueReferences`: after trimming,
+* the **entire** line must be `<keyword>[:] <list>` — keyword
+* case-insensitive (lowercased to canonical form in the result), colon
+* optional, and the list one or more `#<digits>` items separated by `,`,
+* `and`, or the Oxford `, and`. Whitespace inside the line is `[ \t]` only,
+* so an embedded newline cannot smuggle two lines past a parser whose
+* contract is one — the same posture as the bare-line pattern. Any trailing
+* content after the list rejects the line; duplicates are preserved in order,
+* because whether `#1, #1` means one issue or two is the caller's business.
+*
+* Two keyword sets play here. {@link parseClosingList} accepts only the nine
+* closing keywords and yields a {@link ClosingList}; {@link parseReferenceList}
+* additionally accepts the non-closing {@link REFERENCE_KEYWORDS} (`ref`,
+* `refs`, `references`) and reports which set matched via
+* {@link ReferenceList}'s `closing` flag.
+*
+* An item whose digits exceed `Number.MAX_SAFE_INTEGER` rejects the **whole
+* line**, where `harvestIssueReferences` merely skips the one match. The
+* asymmetry is deliberate: a harvest drops one reference out of running
+* prose, but a list line is a single claim about a set of issues, and
+* returning the parseable subset would misrepresent the line as claiming
+* less than it does.
+*
+* Complexity posture: parsing is a single left-to-right character scan —
+* this module contains **no regular expressions at all** — so worst-case
+* time is linear in the line length by construction. There is no
+* backtracking engine to feed, no polynomial blow-up for a scanner to flag,
+* and therefore no input truncation.
+*
+* Beyond the whole-line parsers, {@link harvestReferenceLists} generalizes
+* the same list grammar to the inline-in-prose posture — several lists on
+* one line of running text — and {@link parseClosingLists} /
+* {@link parseReferenceLists} apply the whole-line parsers per line of a
+* multi-line text. All of them ride the same character scan; the no-regex
+* promise above covers every export here.
+*/
+/**
+* The non-closing reference keywords the list dialect accepts, lowercased.
 *
-* @internal
+* @remarks
+* GitHub does not act on these — they associate without closing — but a
+* references region writes them, so the parser must read them.
+*
+* @public
 */
-const FIXES_ISSUE_PATTERN = /fix(?:es)?:?\s*#?(\d+(?:, *#?\d+)*)/i;
+const REFERENCE_KEYWORDS = [
+	"ref",
+	"refs",
+	"references"
+];
+/**
+* Both keyword tables ARE the exported constants — membership sets built from
+* them once — so the constants and the grammar cannot drift.
+*/
+const ALL_KEYWORDS = /* @__PURE__ */ new Set([...CLOSING_KEYWORDS, ...REFERENCE_KEYWORDS]);
+/** Membership test for reporting `closing`, widened once so no call casts. */
+const CLOSING_SET = new Set(CLOSING_KEYWORDS);
+const HASH = 35;
+const COLON = 58;
+const COMMA = 44;
+/** `[ \t]` — the only whitespace the dialect admits, per the module remarks. */
+const isSpaceTab = (code) => code === 32 || code === 9;
+const isDigit$1 = (code) => code >= 48 && code <= 57;
+const isAsciiLetter = (code) => code >= 65 && code <= 90 || code >= 97 && code <= 122;
+/** The index after the run of `[ \t]` starting at `from` (possibly `from` itself). */
+const skipSpaceTab = (line, from) => {
+	let index = from;
+	while (index < line.length && isSpaceTab(line.charCodeAt(index))) index += 1;
+	return index;
+};
 /**
-* Matches "refs #123" or "ref: #456, #789" patterns (case-insensitive).
+* One list item at exactly `from`: `#<digits>` and the index one past it.
+* Digits exceeding `Number.MAX_SAFE_INTEGER` report `"unsafe"` rather than a
+* silently rounded issue number, still carrying the index one past the digit
+* run so a caller can skip the item's extent; the whole-line parsers reject
+* on it and {@link harvestReferenceLists} abandons the entire candidate —
+* see the module remarks for why a list never yields a partial reading.
+* Anything that is not `#<digits>` at all is `undefined`.
+*/
+const readItem = (line, from) => {
+	if (line.charCodeAt(from) !== HASH) return void 0;
+	const start = from + 1;
+	let index = start;
+	while (index < line.length && isDigit$1(line.charCodeAt(index))) index += 1;
+	if (index === start) return void 0;
+	const value = Number(line.slice(start, index));
+	return Number.isSafeInteger(value) ? {
+		kind: "item",
+		value,
+		next: index
+	} : {
+		kind: "unsafe",
+		next: index
+	};
+};
+/**
+* One separator at exactly `from`: a comma with optional surrounding `[ \t]`
+* and an optional Oxford `and` (consumed only when its own trailing `[ \t]+`
+* is present), or a bare `and` requiring `[ \t]+` on both sides. `and` is
+* lowercase-only — the keyword head is case-insensitive, the separator is
+* not. Returns the index where the next item must start, or `undefined` when
+* no separator is present.
+*/
+const scanSeparator = (line, from) => {
+	const afterLeading = skipSpaceTab(line, from);
+	if (line.charCodeAt(afterLeading) === COMMA) {
+		const afterComma = skipSpaceTab(line, afterLeading + 1);
+		if (line.startsWith("and", afterComma)) {
+			const afterAnd = skipSpaceTab(line, afterComma + 3);
+			if (afterAnd > afterComma + 3) return afterAnd;
+		}
+		return afterComma;
+	}
+	if (afterLeading > from && line.startsWith("and", afterLeading)) {
+		const afterAnd = skipSpaceTab(line, afterLeading + 3);
+		if (afterAnd > afterLeading + 3) return afterAnd;
+	}
+};
+/**
+* The scan walk: item, then separator, then item, until the cursor stands
+* exactly at the end of the string. Anything else — a malformed item, an
+* unknown separator, trailing content, an unsafe issue number — is
+* `undefined`, and the caller rejects the whole line.
+*/
+const parseItems = (line, from) => {
+	const issueNumbers = [];
+	let cursor = from;
+	for (;;) {
+		const item = readItem(line, cursor);
+		if (item === void 0 || item.kind === "unsafe") return void 0;
+		issueNumbers.push(item.value);
+		cursor = item.next;
+		if (cursor === line.length) return issueNumbers;
+		const next = scanSeparator(line, cursor);
+		if (next === void 0) return void 0;
+		cursor = next;
+	}
+};
+/**
+* The list a whole line carries under either keyword set, or `Option.none()`.
 *
-* Capture group `[1]` contains the comma-separated issue number list.
+* @remarks
+* Accepts the nine closing keywords plus {@link REFERENCE_KEYWORDS}, and
+* reports which set matched in the result's `closing` flag. Grammar,
+* whole-line posture and the whole-line rejection of unsafe issue numbers
+* are in the module remarks.
 *
-* @internal
+* @public
 */
-const REFS_ISSUE_PATTERN = /refs?:?\s*#?(\d+(?:, *#?\d+)*)/i;
+const parseReferenceList = (line) => {
+	const trimmed = line.trim();
+	let letters = 0;
+	while (letters < trimmed.length && isAsciiLetter(trimmed.charCodeAt(letters))) letters += 1;
+	if (letters === 0) return effect.Option.none();
+	const keyword = trimmed.slice(0, letters).toLowerCase();
+	if (!ALL_KEYWORDS.has(keyword)) return effect.Option.none();
+	let cursor = letters;
+	if (trimmed.charCodeAt(cursor) === COLON) cursor += 1;
+	const afterWhitespace = skipSpaceTab(trimmed, cursor);
+	if (afterWhitespace === cursor) return effect.Option.none();
+	const issueNumbers = parseItems(trimmed, afterWhitespace);
+	if (issueNumbers === void 0) return effect.Option.none();
+	return effect.Option.some({
+		keyword,
+		closing: CLOSING_SET.has(keyword),
+		issueNumbers
+	});
+};
 /**
-* Pattern for splitting comma-separated issue numbers.
+* Every reference list a text carries, line by line, across both postures.
 *
-* @internal
+* @remarks
+* The trailer/prose interleave consumers otherwise hand-roll: each line is
+* tried as a whole-line reference list first ({@link parseReferenceList} —
+* colon-tolerant, per the line dialect), and only a line that is not one is
+* harvested inline ({@link harvestReferenceLists} — no colon, per the inline
+* dialect). The preference means a colon-less trailer line contributes its
+* list exactly once, never once per posture.
+*
+* Results carry no offsets, deliberately: this is the line-granular
+* composition, and a consumer that needs spans uses
+* {@link harvestReferenceLists} directly. Duplicates are preserved, in
+* document order.
+*
+* @public
 */
-const ISSUE_NUMBER_SPLIT_PATTERN = /, */;
+const collectReferenceLists = (text) => {
+	const lists = [];
+	for (const line of text.split("\n")) {
+		const whole = parseReferenceList(line);
+		if (effect.Option.isSome(whole)) {
+			lists.push(whole.value);
+			continue;
+		}
+		for (const harvested of harvestReferenceLists(line)) lists.push({
+			keyword: harvested.keyword,
+			closing: harvested.closing,
+			issueNumbers: harvested.issueNumbers
+		});
+	}
+	return lists;
+};
+/** `[A-Za-z0-9_]` — the word-boundary alphabet the inline dialects use. */
+const isWordChar = (code) => isAsciiLetter(code) || isDigit$1(code) || code === 95;
+/**
+* The full JavaScript `\s` set, spelled as a predicate so the module keeps
+* its no-regex promise: ASCII whitespace, NEL-adjacent controls, and the
+* Unicode space separators. Only the keyword→first-item gap of
+* {@link harvestReferenceLists} admits this set — everything inside a list
+* stays `[ \t]`, per the module remarks.
+*/
+const isAnyWhitespace = (code) => code === 32 || code >= 9 && code <= 13 || code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288 || code === 65279;
+/**
+* Every reference list found inline in `text`, in document order.
+*
+* @remarks
+* The inline-in-prose posture generalized to lists:
+* `Closes #123, Fixes #456` in one line of a commit body yields two
+* single-item lists, where
+* `harvestIssueReferences` reads only the first reference of each and the
+* whole-line parsers read neither. The grammar per candidate:
+*
+* - The keyword is case-insensitive, drawn from either keyword set,
+*   lowercased to canonical form in the result, with `closing` reported by
+*   set membership. Word boundaries hold on both sides: the characters
+*   immediately before and after the keyword's letter run must not be
+*   `[A-Za-z0-9_]`, so `recloses #1` and `1closes #1` do not match.
+* - **No colon** — exactly like `harvestIssueReferences`, the colon spelling
+*   belongs to the line dialects ({@link parseReferenceList} and the
+*   bare-line parser), so `closes: #1` inline yields nothing.
+* - The keyword→first-item gap is any run of whitespace **including
+*   newlines**, mirroring the inline dialect's `\s+`.
+* - List continuation uses the `,` / `and` / Oxford separators with `[ \t]`
+*   whitespace only, so a list cannot continue past a newline — a later
+*   line makes its own claims.
+* - Items are `#<digits>`; duplicates are preserved in order.
+*
+* A list ends at its last valid item: in `closes #1 and fixes #2` the
+* ` and ` before `fixes` fails as a separator because what follows is not
+* `#`, so the text yields `closes: [1]` then `fixes: [2]`. An item past
+* `Number.MAX_SAFE_INTEGER` anywhere in a candidate skips the **entire**
+* candidate — never a partial list, for the same reason
+* {@link parseReferenceList} rejects the whole line — and scanning resumes
+* after the candidate's scanned extent.
+*
+* Like everything in this module, the harvest is a single left-to-right
+* character scan with no regular expressions, so time stays linear in the
+* text length and no input is truncated.
+*
+* @public
+*/
+const harvestReferenceLists = (text) => {
+	const lists = [];
+	let index = 0;
+	while (index < text.length) {
+		if (!isAsciiLetter(text.charCodeAt(index))) {
+			index += 1;
+			continue;
+		}
+		const runStart = index;
+		let runEnd = index + 1;
+		while (runEnd < text.length && isAsciiLetter(text.charCodeAt(runEnd))) runEnd += 1;
+		if (runStart > 0 && isWordChar(text.charCodeAt(runStart - 1)) || runEnd < text.length && isWordChar(text.charCodeAt(runEnd))) {
+			index = runEnd;
+			continue;
+		}
+		const keyword = text.slice(runStart, runEnd).toLowerCase();
+		if (!ALL_KEYWORDS.has(keyword)) {
+			index = runEnd;
+			continue;
+		}
+		let cursor = runEnd;
+		while (cursor < text.length && isAnyWhitespace(text.charCodeAt(cursor))) cursor += 1;
+		const first = cursor === runEnd ? void 0 : readItem(text, cursor);
+		if (first === void 0) {
+			index = runEnd;
+			continue;
+		}
+		if (first.kind === "unsafe") {
+			index = first.next;
+			continue;
+		}
+		const issueNumbers = [first.value];
+		let end = first.next;
+		let unsafeNext;
+		for (;;) {
+			const next = scanSeparator(text, end);
+			if (next === void 0) break;
+			const item = readItem(text, next);
+			if (item === void 0) break;
+			if (item.kind === "unsafe") {
+				unsafeNext = item.next;
+				break;
+			}
+			issueNumbers.push(item.value);
+			end = item.next;
+		}
+		if (unsafeNext !== void 0) {
+			index = unsafeNext;
+			continue;
+		}
+		lists.push({
+			keyword,
+			closing: CLOSING_SET.has(keyword),
+			issueNumbers,
+			start: runStart,
+			end
+		});
+		index = end;
+	}
+	return lists;
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+github-references@0.1.0_effect@4.0.0-rc.109/node_modules/@effected/github-references/KeywordFamily.js
+/**
+* The projection table IS the totality proof: `Record` over the union of
+* both keyword types makes a keyword added to either constant without an
+* entry here fail to compile.
+*/
+const FAMILIES = {
+	close: "close",
+	closes: "close",
+	closed: "close",
+	fix: "fix",
+	fixes: "fix",
+	fixed: "fix",
+	resolve: "resolve",
+	resolves: "resolve",
+	resolved: "resolve",
+	ref: "ref",
+	refs: "ref",
+	references: "ref"
+};
 /**
-* Extract issue numbers from a regex match against a commit message.
+* The family a keyword belongs to.
 *
 * @remarks
-* Truncates the input to 10,000 characters before matching to prevent
-* ReDoS on adversarial input. Strips `#` prefixes from matched numbers.
+* Total over both keyword sets by construction — see the module remarks for
+* why an explicit record beats a `startsWith` heuristic. `close`, `closes`
+* and `closed` map to `"close"`; the `fix` and `resolve` conjugations
+* likewise; `ref`, `refs` and `references` map to `"ref"`. The evidence for
+* the projection is downstream: categorized harvesters key maps by family,
+* and each was hand-rolling this collapse.
 *
-* @param pattern - The regex pattern to match (must have a capture group for issue numbers)
-* @param message - The commit message body to search
-* @returns Array of issue number strings (without `#` prefix)
+* @public
+*/
+const keywordFamily = (keyword) => FAMILIES[keyword];
+//#endregion
+//#region ../silk-effects/dist/dev/pkg/changesets/utils/issue-refs.js
+/**
+* The output category each keyword family lands in.
+*
+* @remarks
+* The `resolve` family reads as `closes` since closing is what those keywords
+* do; the record is total over `KeywordFamily`, so a family the kit adds
+* without a category here is a type error, never a silent drop.
 *
 * @internal
 */
-function extractIssueNumbers(pattern, message) {
-	const safeMessage = message.slice(0, 1e4);
-	const match = pattern.exec(safeMessage);
-	if (!match?.[1]) return [];
-	return match[1].split(ISSUE_NUMBER_SPLIT_PATTERN).map((num) => num.replace("#", "").trim());
+const CATEGORY_BY_FAMILY = {
+	close: "closes",
+	fix: "fixes",
+	ref: "refs",
+	resolve: "closes"
+};
+/** @internal */
+function categoryOf(list) {
+	return CATEGORY_BY_FAMILY[keywordFamily(list.keyword)];
 }
 /**
 * Parse a commit message for GitHub issue references.
 *
-* Recognizes `Closes`, `Fixes`, and `Refs` keywords with various formats:
-* - `Closes #123`
-* - `Fixes: #456, #789`
-* - `Refs #101`
+* Recognizes GitHub's closing keywords plus `Ref`/`Refs`/`References` in
+* both list dialects:
+* - whole-line trailers — `Closes #123`, `Fixes: #456, #789`, `Refs #101`;
+* - inline in prose — `This closes #12 in passing`, or several lists on one
+*   line: `Closes #123, Fixes #456`.
 *
 * @remarks
-* Each keyword category is matched independently, so a single commit
-* message can contain references in all three categories. Keywords are
-* case-insensitive and accept both singular and plural forms.
+* References accumulate in message order: two `Closes` lists contribute to
+* the same category. Keywords are case-insensitive and the `#` is mandatory.
+* The colon spelling is line-dialect-only; `collectReferenceLists` owns the
+* per-line composition (whole-line trailer parse first, inline harvest
+* otherwise), guaranteeing a trailer line is never double-counted. Malformed
+* candidates are simply skipped. The kit preserves duplicates by contract;
+* each category dedupes them here (first occurrence wins), mirroring the
+* PR-body path, so a repeated reference renders one changelog link.
 *
 * @param commitMessage - The commit message body to parse
 * @returns Categorized issue references with numbers as strings (no `#` prefix)
@@ -49645,20 +50130,23 @@ function extractIssueNumbers(pattern, message) {
 * ```typescript
 * import { parseIssueReferences } from "../utils/issue-refs.js";
 *
-* const refs = parseIssueReferences("feat: add API\n\nCloses #42\nFixes: #17, #23");
+* const refs = parseIssueReferences("feat: add API\n\nCloses #42, Fixes #17");
 * // refs.closes === ["42"]
-* // refs.fixes === ["17", "23"]
+* // refs.fixes === ["17"]
 * // refs.refs === []
 * ```
 *
 * @internal
 */
 function parseIssueReferences(commitMessage) {
-	return {
-		closes: extractIssueNumbers(CLOSES_ISSUE_PATTERN, commitMessage),
-		fixes: extractIssueNumbers(FIXES_ISSUE_PATTERN, commitMessage),
-		refs: extractIssueNumbers(REFS_ISSUE_PATTERN, commitMessage)
+	const references = {
+		closes: [],
+		fixes: [],
+		refs: []
 	};
+	for (const list of collectReferenceLists(commitMessage)) references[categoryOf(list)].push(...list.issueNumbers.map(String));
+	for (const category of Object.keys(references)) references[category] = [...new Set(references[category])];
+	return references;
 }
 //#endregion
 //#region ../silk-effects/dist/dev/pkg/changesets/utils/logger.js