fix(cli): classify pnpm sibling workspace links as workspace packages [RED-1312] [ship]

packages/cli/src/services/embedded-packages/__tests__/lockfile-packages.spec.ts

@@ -677,6 +677,37 @@ packages: {}
       { name: '@acme/outside', kind: 'unfetchable' },
     ])
   })
+
+  it('resolves link targets against the importer directory', () => {
+    const { excluded } = parsePnpmLockfilePackages(`
+lockfileVersion: '9.0'
+importers:
+  .: {}
+  packages/e2e:
+    dependencies:
+      '@acme/design-system':
+        specifier: workspace:*
+        version: link:../design-system
+      '@acme/outside':
+        specifier: file:../../../elsewhere
+        version: link:../../../elsewhere
+  packages/design-system: {}
+packages: {}
+`)
+    expect(excluded).toEqual([
+      {
+        name: '@acme/design-system',
+        reason: `'@acme/design-system' is a workspace package, which cannot be embedded as a registry tarball`,
+        kind: 'workspace',
+      },
+      {
+        name: '@acme/outside',
+        reason: `'@acme/outside' is a local directory link outside the workspace, which cannot be embedded`
+          + ` as a registry tarball`,
+        kind: 'unfetchable',
+      },
+    ])
+  })
 })
 
 describe('parseNpmLockfilePackages() links', () => {

packages/cli/src/services/embedded-packages/lockfile-packages.ts

@@ -231,16 +231,21 @@ export function parsePnpmLockfilePackages (content: string): LockfilePackages {
   const importers = data?.importers
   if (typeof importers === 'object' && importers !== null) {
     const linkedNames = new Set<string>()
-    for (const importer of Object.values<any>(importers)) {
+    for (const [importerPath, importer] of Object.entries<any>(importers)) {
       for (const group of ['dependencies', 'devDependencies', 'optionalDependencies']) {
         for (const [name, dep] of Object.entries<any>(importer?.[group] ?? {})) {
           const version = typeof dep === 'string' ? dep : dep?.version
           if (typeof version === 'string' && version.startsWith('link:') && !linkedNames.has(name)) {
             linkedNames.add(name)
             // Same distinction as npm's `link: true` entries: a link whose
             // target escapes the workspace is not part of the project the
-            // bundle carries.
-            const target = version.slice('link:'.length)
+            // bundle carries. pnpm writes the target relative to the
+            // importer's directory, so a sibling member's link
+            // (`link:../design-system` from `packages/e2e`) stays inside.
+            const linkTarget = version.slice('link:'.length)
+            const target = path.isAbsolute(linkTarget)
+              ? linkTarget
+              : path.posix.join(importerPath, linkTarget)
             const escapesWorkspace = linkTargetEscapesWorkspace(target)
             result.excluded.push({
               name,