@effected/workspaces 0.23.0 → 0.24.0

package/ConfigDependencyHooks.js

@@ -1,7 +1,7 @@
 import { normalize } from "./internal/catalogs.js";
-import { Context, Duration, Effect, Layer, Predicate, Result, Schema } from "effect";
+import { lookupPnpmfiles, resolvePnpmfiles } from "./internal/configDependencyResolution.js";
+import { Context, Duration, Effect, Layer, Predicate, Schema } from "effect";
 import { CatalogAssemblyError } from "@effected/npm";
-import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { Run } from "@effected/commands";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
@@ -28,32 +28,6 @@ const NoPeerDependencyRules = Object.freeze({
 });
 /** Internal alias, kept short at the many call sites in this module. */
 const NO_PEER_RULES = NoPeerDependencyRules;
-/** Whether `value` is a non-null, non-array object. */
-const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/**
-* The file URL a Node ESM `ERR_MODULE_NOT_FOUND` reports as unresolvable, or
-* `undefined` when the failure is anything else.
-*
-* @remarks
-* Node sets `err.url` (an own string property) to the offending module's URL.
-* For an absent *entry* module it is that entry's own URL; for a module the entry
-* `import`s that fails to resolve it is the **nested** module's URL. That
-* distinction is exactly what separates "this pnpmfile does not exist" (a
-* legitimate skip, `err.url` equal to the candidate) from "the pnpmfile's own
-* import failed to resolve" (a real error, `err.url` pointing elsewhere) — a
-* discrimination `err.code` alone cannot make, since both raise
-* `ERR_MODULE_NOT_FOUND`. Verified against Node's ESM loader: the entry-absent
-* case yields `err.url === pathToFileURL(candidate).href`; the nested case yields
-* the nested module's URL.
-*/
-const moduleNotFoundUrl = (cause) => isObject(cause) && cause.code === "ERR_MODULE_NOT_FOUND" && typeof cause.url === "string" ? cause.url : void 0;
-/**
-* Whether a config-dependency `name` carries a `..` path segment. A scoped name
-* legitimately contains `/` (`@scope/pkg`), so only a `..` *segment* is rejected —
-* it would traverse out of `.pnpm-config` and feed an attacker-chosen path to the
-* dynamic `import()` below.
-*/
-const hasTraversalSegment = (name) => name.split(/[/\\]/).includes("..");
 /** Turn the seed record into the pnpm hook config, with the default catalog split out under `catalog`. */
 const seedToConfig = (seed, rules) => {
 	const catalogs = {};
@@ -85,10 +59,10 @@ const stringArrayOr = (value, fallback) => Array.isArray(value) && value.every((
 * write wins**, exactly as pnpm's single mutable config object behaves.
 */
 const configOf = (value, fallback) => {
-	if (!isObject(value)) return fallback;
+	if (!Predicate.isObject(value)) return fallback;
 	return {
-		catalog: isObject(value.catalog) ? value.catalog : fallback.catalog,
-		catalogs: isObject(value.catalogs) ? value.catalogs : fallback.catalogs,
+		catalog: Predicate.isObject(value.catalog) ? value.catalog : fallback.catalog,
+		catalogs: Predicate.isObject(value.catalogs) ? value.catalogs : fallback.catalogs,
 		minimumReleaseAge: finiteNumberOr(value.minimumReleaseAge, fallback.minimumReleaseAge),
 		minimumReleaseAgeExclude: stringArrayOr(value.minimumReleaseAgeExclude, fallback.minimumReleaseAgeExclude),
 		peerDependencyRules: peerRulesOr(value.peerDependencyRules, fallback.peerDependencyRules)
@@ -101,9 +75,9 @@ const configOf = (value, fallback) => {
 * Each axis is normalized independently: a hook that rewrites `allowedVersions`
 * and leaves `ignoreMissing` alone must not blank the latter.
 */
-const stringRecordOr = (value, fallback) => isObject(value) && Object.values(value).every((entry) => typeof entry === "string") ? value : fallback;
+const stringRecordOr = (value, fallback) => Predicate.isObject(value) && Object.values(value).every((entry) => typeof entry === "string") ? value : fallback;
 const peerRulesOr = (value, fallback) => {
-	if (!isObject(value)) return fallback;
+	if (!Predicate.isObject(value)) return fallback;
 	const allowed = stringRecordOr(value.allowedVersions, fallback?.allowedVersions);
 	const ignoreMissing = stringArrayOr(value.ignoreMissing, fallback?.ignoreMissing);
 	const allowAny = stringArrayOr(value.allowAny, fallback?.allowAny);
@@ -129,21 +103,96 @@ const releaseAgeOf = (config) => ({
 const configToEntries = (config) => {
 	const raw = { ...config.catalogs };
 	if (Object.keys(config.catalog).length > 0) raw.default = {
-		...isObject(raw.default) ? raw.default : {},
+		...Predicate.isObject(raw.default) ? raw.default : {},
 		...config.catalog
 	};
 	return normalize(raw);
 };
 /** Locate the `updateConfig` hook across the CJS/ESM export shapes a `pnpmfile.cjs` can present. */
 const updateConfigOf = (mod) => {
-	for (const candidate of [mod, isObject(mod) ? mod.default : void 0]) {
-		if (!isObject(candidate)) continue;
+	for (const candidate of [mod, Predicate.isObject(mod) ? mod.default : void 0]) {
+		if (!Predicate.isObject(candidate)) continue;
 		const hooks = candidate.hooks;
-		if (isObject(hooks) && Predicate.isFunction(hooks.updateConfig)) return hooks.updateConfig;
+		if (Predicate.isObject(hooks) && Predicate.isFunction(hooks.updateConfig)) return hooks.updateConfig;
 		if (Predicate.isFunction(candidate.updateConfig)) return candidate.updateConfig;
 	}
 };
 /**
+* The seed pass-through: what every layer returns for an empty
+* `configDependencies`, and — with `replays` — what a replaying layer returns
+* when every resolved dependency ships no pnpmfile.
+*/
+const untouched = (seed, rules, replays = {}) => ({
+	catalogs: seed,
+	releaseAge: {},
+	peerDependencyRules: rules ?? NO_PEER_RULES,
+	replays
+});
+/** The per-name replay record of a resolved set — every resolved dependency, pnpmfile or not. */
+const replaysOf = (pnpmfiles) => {
+	const replays = {};
+	for (const { name, version, source } of pnpmfiles) replays[name] = {
+		version,
+		source
+	};
+	return replays;
+};
+/** Project the final threaded config into the injection, alongside the replay record. */
+const injectionOf = (config, pnpmfiles) => ({
+	catalogs: configToEntries(config),
+	releaseAge: releaseAgeOf(config),
+	peerDependencyRules: peerRulesOf(config),
+	replays: replaysOf(pnpmfiles)
+});
+/**
+* Replay already-resolved pnpmfiles IN PROCESS over the seed, in order — the
+* one implementation {@link ConfigDependencyHooks.layerLive} and
+* {@link ConfigDependencyHooks.layerFrom} share; only how the paths were
+* found differs.
+*
+* @remarks
+* Each file is loaded via a dynamic `import()` of its file URL. Because the
+* caller has already established that the file exists (listed by the
+* ladder's directory read, or by the caller's own word under `layerFrom`),
+* ANY load failure — a syntax error, a throwing top level, an unreadable
+* file, an `ERR_MODULE_NOT_FOUND` for a module the pnpmfile itself imports —
+* is a real error and surfaces typed as a
+* `hooks`-source `CatalogAssemblyError` naming the dependency, never a silent
+* skip. A file exposing no `updateConfig` hook contributes nothing. The hook
+* is called synchronously and its returned data threaded tolerantly
+* (`configOf`); a hook that throws fails typed.
+*/
+const replayInProcess = (pnpmfiles, seed, rules) => Effect.gen(function* () {
+	let config = seedToConfig(seed, rules);
+	for (const { name, path } of pnpmfiles) {
+		if (path === void 0) continue;
+		const url = pathToFileURL(path).href;
+		const loaded = yield* Effect.tryPromise({
+			try: () => import(
+				/* webpackIgnore: true */
+				url
+),
+			catch: (cause) => new CatalogAssemblyError({
+				source: "hooks",
+				path: name,
+				cause
+			})
+		});
+		const updateConfig = updateConfigOf(loaded);
+		if (updateConfig === void 0) continue;
+		const currentConfig = config;
+		config = yield* Effect.try({
+			try: () => configOf(updateConfig(currentConfig), currentConfig),
+			catch: (cause) => new CatalogAssemblyError({
+				source: "hooks",
+				path: name,
+				cause
+			})
+		});
+	}
+	return injectionOf(config, pnpmfiles);
+});
+/**
 * The subprocess replay program {@link ConfigDependencyHooks.layerSubprocess}
 * hands to `node --input-type=module -e`.
 *
@@ -152,13 +201,16 @@ const updateConfigOf = (mod) => {
 * dynamic `import()` into a context module that cannot resolve a runtime path
 * (`Cannot find module 'file:///…'`), so the computed import has to run in a
 * child process whose program text carries **no interpolated runtime value** —
-* the workspace root, the seed and the dependency names all arrive via argv
-* (`process.argv.slice(1)` under `-e`), never spliced into the script.
+* the seed, the rules seed and the resolved `[name, fileUrl]` pairs all
+* arrive via argv (`<seed> <rules> <entries>`, read as `process.argv.slice(1)`
+* under `-e`), never spliced into the script.
 *
-* The script mirrors this module's in-process semantics exactly so the two
-* layers are drop-in interchangeable: `pnpmfile.mjs` before `pnpmfile.cjs`
-* (pnpm 11's loader order), the `ERR_MODULE_NOT_FOUND`-for-the-candidate-itself
-* skip discrimination (`err.url` equality), the same hook-locator shapes, the
+* The PARENT resolves each config dependency to the pnpmfile of its declared
+* version (`internal/configDependencyResolution.ts`) and hands the child only
+* `file:` URLs of existing files, so the child performs no lookup, no path
+* conversion and no skip discrimination: any `import()` failure is a real
+* load failure. The script otherwise mirrors `replayInProcess` exactly so the
+* two layers are drop-in interchangeable: the same hook-locator shapes, the
 * same tolerant threading of returned data (`configOf` / `finiteNumberOr` /
 * `stringArrayOr` clones below), and the same synchronous hook call. Only the
 * *mechanism* failures are reported: the script prints one final line of JSON —
@@ -169,9 +221,7 @@ const updateConfigOf = (mod) => {
 * noise on stdout.
 */
 const REPLAY_SCRIPT = `
-const [root, seedJson, rulesJson, ...names] = process.argv.slice(1);
-const { pathToFileURL } = await import("node:url");
-const { join } = await import("node:path");
+const [seedJson, rulesJson, entriesJson] = process.argv.slice(1);
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const finiteNumberOr = (value, fallback) => (typeof value === "number" && Number.isFinite(value) ? value : fallback);
 const stringArrayOr = (value, fallback) =>
@@ -216,25 +266,13 @@ const replay = async () => {
 		minimumReleaseAgeExclude: undefined,
 		peerDependencyRules: JSON.parse(rulesJson),
 	};
-	for (const name of names) {
+	for (const [name, url] of JSON.parse(entriesJson)) {
 		let loaded;
-		let found = false;
-		for (const filename of ["pnpmfile.mjs", "pnpmfile.cjs"]) {
-			const candidate = pathToFileURL(join(root, "node_modules", ".pnpm-config", name, filename)).href;
-			try {
-				loaded = await import(candidate);
-				found = true;
-				break;
-			} catch (cause) {
-				const url =
-					isObject(cause) && cause.code === "ERR_MODULE_NOT_FOUND" && typeof cause.url === "string"
-						? cause.url
-						: undefined;
-				if (url === candidate) continue;
-				return failure(name, cause);
-			}
+		try {
+			loaded = await import(url);
+		} catch (cause) {
+			return failure(name, cause);
 		}
-		if (!found) continue;
 		let hook;
 		for (const candidate of [loaded, isObject(loaded) ? loaded.default : undefined]) {
 			if (!isObject(candidate)) continue;
@@ -301,12 +339,21 @@ const replayFailureCause = (payload) => {
 * assembly.
 *
 * @remarks
-* A contract-only service: it declares the shape and ships two layers, never a
+* A contract-only service: it declares the shape and ships layers, never a
 * baked-in default. {@link ConfigDependencyHooks.layerNoop} executes no
 * config-dependency code (it returns the seed untouched) and is what the default
 * {@link WorkspaceCatalogs} layer wires; {@link ConfigDependencyHooks.layerLive}
-* dynamically imports each `pnpmfile.cjs` and replays it, and is wired only by the
-* explicit `WorkspaceCatalogs.layerWithConfigDependencies` opt-in.
+* dynamically imports each pnpmfile and replays it, and is wired only by the
+* explicit `WorkspaceCatalogs.layerWithConfigDependencies` opt-in;
+* {@link ConfigDependencyHooks.layerSubprocess} is its bundler-safe twin; and
+* {@link ConfigDependencyHooks.layerFrom} is the hermetic test seam that
+* replays caller-supplied files with no resolution.
+*
+* Every replaying layer replays the pnpmfile of the version each
+* `configDependencies` entry **declares** — `layerLive` and `layerSubprocess`
+* resolve it through `node_modules/.pnpm-config` and then the pnpm store,
+* failing closed when neither holds that version — so a snapshot read at a
+* past ref replays that ref's pinned hook, not today's.
 *
 * @public
 */
@@ -316,83 +363,85 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	* config dependency. The default {@link WorkspaceCatalogs} layer wires this, so
 	* the default catalog path provably executes no config-dependency code.
 	*/
-	static layerNoop = Layer.succeed(ConfigDependencyHooks, { inject: (_root, _configDependencies, seed, rules) => Effect.succeed({
-		catalogs: seed,
-		releaseAge: {},
-		peerDependencyRules: rules ?? NO_PEER_RULES
-	}) });
+	static layerNoop = Layer.succeed(ConfigDependencyHooks, { inject: (_root, _configDependencies, seed, rules) => Effect.succeed(untouched(seed, rules)) });
 	/**
-	* The live layer: dynamically imports each config dependency's `pnpmfile.cjs`
-	* (in process, no subprocess) and replays its `updateConfig` hook over the
-	* seed, in declaration order. A dependency without a `pnpmfile.cjs` contributes
-	* nothing; a dependency whose file fails to load or replay fails typed with a
-	* `hooks`-source `CatalogAssemblyError`, never a silent skip.
+	* The live layer: resolves each config dependency to the pnpmfile of its
+	* **declared** version, dynamically imports it (in process, no subprocess)
+	* and replays its `updateConfig` hook over the seed, in declaration order.
+	* A dependency that ships no pnpmfile contributes nothing; a dependency
+	* whose declared version is installed nowhere, or whose file fails to load
+	* or replay, fails typed with a `hooks`-source `CatalogAssemblyError`, never
+	* a silent skip.
 	*
 	* @remarks
-	* Runtime-coupled by design, not node-exclusive. The `import()` below loads
+	* Resolution is a ladder, fail-closed, with no registry fetch ever:
+	* `<root>/node_modules/.pnpm-config/<name>` when its `package.json`
+	* `version` equals the declared version (the text before the first `+` of
+	* the `configDependencies` value), else the pnpm store's
+	* `links/<name>/<declared>/*\/node_modules/<name>` (the store is located
+	* from `node_modules/.modules.yaml`, the realpath of any `.pnpm-config`
+	* entry, then `$PNPM_HOME` / `$XDG_DATA_HOME` / the platform default), else
+	* a typed error naming the package, the declared version, what is
+	* installed, the stores searched, and the remediation
+	* (`pnpm add --config <name>@<version>` in a throwaway workspace). In the
+	* chosen directory the first of `pnpmfile.mjs`, `pnpmfile.cjs`,
+	* `pnpmfile.js` present in one directory listing is loaded; a listed but
+	* unreadable file fails typed at import time, never as "ships no hook".
+	*
+	* Runtime-coupled by design, not node-exclusive. The `import()` loads
 	* **and executes** a config dependency's pnpmfile in-process — code execution,
-	* not IO, so no `FileSystem` / `Path` service abstracts it. The `node:path` and
-	* `node:url` imports (`join`, `pathToFileURL`) exist only to build the URL that
-	* `import()` consumes; node and bun both implement those builtins and dynamic
-	* import, so this layer runs on either runtime. Only ever wired by
-	* `WorkspaceCatalogs.layerWithConfigDependencies`.
+	* not IO, so no `FileSystem` / `Path` service abstracts it — and the ladder
+	* reads the real disk through `node:fs` for the same reason: the store it
+	* searches is real even when the caller's `FileSystem` is virtual. Only ever
+	* wired by `WorkspaceCatalogs.layerWithConfigDependencies` and the
+	* `Workspaces` composites of the same name.
 	*/
 	static layerLive = Layer.succeed(ConfigDependencyHooks, { inject: (root, configDependencies, seed, rules) => Effect.gen(function* () {
-		const names = Object.keys(configDependencies);
-		if (names.length === 0) return {
-			catalogs: seed,
-			releaseAge: {},
-			peerDependencyRules: rules ?? NO_PEER_RULES
-		};
-		let config = seedToConfig(seed, rules);
-		for (const name of names) {
-			if (hasTraversalSegment(name)) return yield* Effect.fail(new CatalogAssemblyError({
-				source: "hooks",
-				path: name,
-				cause: /* @__PURE__ */ new Error(`config dependency name has a '..' path segment: ${name}`)
-			}));
-			let loaded;
-			let found = false;
-			for (const filename of ["pnpmfile.mjs", "pnpmfile.cjs"]) {
-				const candidatePath = join(root, "node_modules", ".pnpm-config", name, filename);
-				const candidateUrl = pathToFileURL(candidatePath).href;
-				const result = yield* Effect.result(Effect.tryPromise({
-					try: () => import(
-						/* webpackIgnore: true */
-						candidateUrl
-),
-					catch: (cause) => cause
-				}));
-				if (Result.isSuccess(result)) {
-					loaded = result.success;
-					found = true;
-					break;
-				}
-				if (moduleNotFoundUrl(result.failure) === candidateUrl) continue;
-				return yield* Effect.fail(new CatalogAssemblyError({
-					source: "hooks",
-					path: name,
-					cause: result.failure
-				}));
-			}
-			if (!found) continue;
-			const updateConfig = updateConfigOf(loaded);
-			if (updateConfig === void 0) continue;
-			const currentConfig = config;
-			config = yield* Effect.try({
-				try: () => configOf(updateConfig(currentConfig), currentConfig),
-				catch: (cause) => new CatalogAssemblyError({
-					source: "hooks",
-					path: name,
-					cause
-				})
-			});
-		}
-		return {
-			catalogs: configToEntries(config),
-			releaseAge: releaseAgeOf(config),
-			peerDependencyRules: peerRulesOf(config)
-		};
+		if (Object.keys(configDependencies).length === 0) return untouched(seed, rules);
+		const pnpmfiles = yield* resolvePnpmfiles(root, configDependencies);
+		return yield* replayInProcess(pnpmfiles, seed, rules);
+	}) });
+	/**
+	* The hermetic layer: replays caller-supplied pnpmfiles, keyed
+	* `"<name>@<version>"` → absolute path, with **no resolution** — it consults
+	* neither `node_modules/.pnpm-config` nor the pnpm store, and never the
+	* effect `FileSystem` service, so it works unchanged under an
+	* `@effected/memfs` volume.
+	*
+	* @remarks
+	* The test seam for anything that replays hooks: a suite can pin what
+	* `at(ref)` replays for a ref declaring `plugin@1.0.0` versus one declaring
+	* `plugin@2.0.0` by mapping both keys to fixture files, with no store on
+	* disk. The version half of the key is the declared version — the text
+	* before the first `+` of the `configDependencies` value — so a
+	* `<version>+<integrity>` spec and a bare `<version>` spec look up the same
+	* entry.
+	*
+	* Same typed semantics as {@link ConfigDependencyHooks.layerLive} past the
+	* lookup: the same in-process `import()`, the same hook-locator shapes, the
+	* same tolerant threading, the same `hooks`-source attribution. A declared
+	* `(name, version)` with no entry fails closed, the same shape as an
+	* uninstalled version under `layerLive`; an empty `configDependencies`
+	* returns the seed untouched. A `..` segment in a name is refused before
+	* any lookup.
+	*
+	* @param entries - `"<name>@<version>"` → the absolute path of the pnpmfile
+	*   to replay for that declared version.
+	*
+	* @example
+	* ```ts
+	* import { ConfigDependencyHooks } from "@effected/workspaces";
+	*
+	* const hooks = ConfigDependencyHooks.layerFrom({
+	*   "@scope/plugin@1.0.0": "/fixtures/plugin-1/pnpmfile.mjs",
+	*   "@scope/plugin@2.0.0": "/fixtures/plugin-2/pnpmfile.mjs",
+	* });
+	* ```
+	*/
+	static layerFrom = (entries) => Layer.succeed(ConfigDependencyHooks, { inject: (_root, configDependencies, seed, rules) => Effect.gen(function* () {
+		if (Object.keys(configDependencies).length === 0) return untouched(seed, rules);
+		const pnpmfiles = yield* lookupPnpmfiles(entries, configDependencies);
+		return yield* replayInProcess(pnpmfiles, seed, rules);
 	}) });
 	/**
 	* The subprocess layer: replays each config dependency's pnpmfile in a `node`
@@ -407,24 +456,26 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	* consumer, a GitHub Action above all, the in-process replay is unreachable.
 	* This layer keeps every computed load out of the bundle graph: the replay
 	* program is a **static** string constant passed via argv
-	* (`node --input-type=module -e <script> <root> <seed> <...names>`), and the
+	* (`node --input-type=module -e <script> <seed> <rules> <entries>`), and the
 	* child process performs the computed imports where no bundler rewrote them.
 	* A subprocess also keeps config-dependency code out of the consumer's own
 	* process.
 	*
-	* The contract's semantics are unchanged, not the downstream fail-open shape:
-	* an empty `configDependencies` returns the seed without spawning anything; a
-	* `..` path segment in a dependency name fails typed **before** any spawn; a
-	* missing pnpmfile (neither `.mjs` nor `.cjs`) is the one legitimate skip,
-	* discriminated inside the child by `err.url` equality exactly as
-	* `layerLive` discriminates in process; any other load failure — a syntax
-	* error, a throwing top level, an `ERR_MODULE_NOT_FOUND` for a module the
-	* pnpmfile itself imports — and a hook that throws when called are serialized
-	* back per-name and surface typed as a `hooks`-source `CatalogAssemblyError`
-	* naming that dependency. A hook's returned *data* stays tolerantly threaded
-	* (last well-formed write wins), never fatal. Spawn and transport failures —
-	* `node` absent, a non-zero exit without a result payload, unparseable
-	* output — fail typed too, never a defect and never a silent skip.
+	* The declared-version resolution is the PARENT's: the same ladder as
+	* `layerLive` (`.pnpm-config` when it holds the declared version, else the
+	* pnpm store, else a typed fail-closed error) runs here, and the child
+	* receives the resolved `[name, fileUrl]` pairs as one JSON argv
+	* argument. An empty `configDependencies`, or one whose dependencies all
+	* ship no pnpmfile, returns the seed without spawning anything; a `..` path
+	* segment in a dependency name fails typed **before** any spawn; a
+	* load failure in the child — a syntax error, a throwing top level, an
+	* `ERR_MODULE_NOT_FOUND` for a module the pnpmfile itself imports — and a
+	* hook that throws when called are serialized back per-name and surface
+	* typed as a `hooks`-source `CatalogAssemblyError` naming that dependency.
+	* A hook's returned *data* stays tolerantly threaded (last well-formed write
+	* wins), never fatal. Spawn and transport failures — `node` absent, a
+	* non-zero exit without a result payload, unparseable output — fail typed
+	* too, never a defect and never a silent skip.
 	*
 	* Two bounds this layer imposes that `layerLive` cannot: the replay is
 	* given thirty seconds (a pnpmfile that loops or awaits forever fails typed
@@ -448,25 +499,17 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	static layerSubprocess = Layer.effect(ConfigDependencyHooks, Effect.gen(function* () {
 		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 		return { inject: (root, configDependencies, seed, rules) => Effect.gen(function* () {
-			const names = Object.keys(configDependencies);
-			if (names.length === 0) return {
-				catalogs: seed,
-				releaseAge: {},
-				peerDependencyRules: rules ?? NO_PEER_RULES
-			};
-			for (const name of names) if (hasTraversalSegment(name)) return yield* Effect.fail(new CatalogAssemblyError({
-				source: "hooks",
-				path: name,
-				cause: /* @__PURE__ */ new Error(`config dependency name has a '..' path segment: ${name}`)
-			}));
+			if (Object.keys(configDependencies).length === 0) return untouched(seed, rules);
+			const pnpmfiles = yield* resolvePnpmfiles(root, configDependencies);
+			const loadable = pnpmfiles.flatMap(({ name, path }) => path === void 0 ? [] : [[name, pathToFileURL(path).href]]);
+			if (loadable.length === 0) return untouched(seed, rules, replaysOf(pnpmfiles));
 			const command = ChildProcess.make("node", [
 				"--input-type=module",
 				"-e",
 				REPLAY_SCRIPT,
-				root,
 				JSON.stringify(seed),
 				JSON.stringify(rules ?? NO_PEER_RULES),
-				...names
+				JSON.stringify(loadable)
 			]);
 			const payload = yield* Run.jsonLine(command, ReplayPayload, { timeout: REPLAY_TIMEOUT }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner), Effect.catch((cause) => Effect.fail(new CatalogAssemblyError({
 				source: "hooks",
@@ -478,12 +521,7 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 				path: payload.name ?? root,
 				cause: replayFailureCause(payload)
 			}));
-			const config = configOf(payload.config, seedToConfig(seed, rules));
-			return {
-				catalogs: configToEntries(config),
-				releaseAge: releaseAgeOf(config),
-				peerDependencyRules: peerRulesOf(config)
-			};
+			return injectionOf(configOf(payload.config, seedToConfig(seed, rules)), pnpmfiles);
 		}) };
 	}));
 };

package/PeerCheck.js

@@ -1,4 +1,5 @@
 import { indexInstances, rootInstances } from "./internal/roots.js";
+import { peerNameMatcher } from "./internal/peerPatterns.js";
 import { Result, Schema } from "effect";
 import { Range, SemVer } from "@effected/semver";
 
@@ -187,10 +188,12 @@ var PeerCheck = class PeerCheck extends Schema.Class("PeerCheck")({
 	static run(lockfile, options) {
 		const keySupplied = options !== void 0 && "peerDependencyRules" in options;
 		const rules = options?.peerDependencyRules;
-		const axesUnapplied = rules !== void 0 && (rules.ignoreMissing.length > 0 || rules.allowAny.length > 0);
-		const rulesApplied = keySupplied && !axesUnapplied;
-		const allowed = rules?.allowedVersions ?? {};
-		const unverified = rulesApplied ? [] : ["peerRulesNotApplied"];
+		const policy = {
+			allowed: rules?.allowedVersions ?? {},
+			ignoreMissing: peerNameMatcher(rules?.ignoreMissing ?? []),
+			allowAny: peerNameMatcher(rules?.allowAny ?? [])
+		};
+		const unverified = keySupplied ? [] : ["peerRulesNotApplied"];
 		if (!supportsPeerResolution(lockfile.format)) return PeerCheck.make({
 			supported: false,
 			unsatisfied: [],
@@ -208,7 +211,7 @@ var PeerCheck = class PeerCheck extends Schema.Class("PeerCheck")({
 				unresolved.push(importer.path);
 				continue;
 			}
-			collect(importer.path, walksFrom(roots), byId, rows, seen, allowed);
+			collect(importer.path, walksFrom(roots), byId, rows, seen, policy);
 		}
 		if (lockfile.packages.some((pkg) => pkg.unresolvedEdges.length > 0)) unverified.push("unresolvedEdge");
 		return PeerCheck.make({
@@ -244,7 +247,7 @@ const walksFrom = (roots) => roots._tag === "own" ? [{
 *
 * @internal
 */
-const collect = (importerPath, roots, byId, rows, seen, allowed) => {
+const collect = (importerPath, roots, byId, rows, seen, policy) => {
 	const visited = /* @__PURE__ */ new Set();
 	const queue = [...roots];
 	while (queue.length > 0) {
@@ -257,7 +260,7 @@ const collect = (importerPath, roots, byId, rows, seen, allowed) => {
 			const optional = current.instance.peerDependenciesMeta[peer]?.optional === true;
 			const verdict = judge(current.instance, peer, wanted, optional, byId);
 			if (verdict === void 0) continue;
-			if (suppressedByRule(allowed, current.instance.name, peer, verdict.found)) continue;
+			if (suppressedByRule(policy, current.instance.name, peer, verdict.found)) continue;
 			const key = `${importerPath}\u0000${peer}\u0000${current.instance.instanceId}`;
 			if (seen.has(key)) continue;
 			seen.add(key);
@@ -315,27 +318,31 @@ const ruleParentName = (parent) => {
 	return at > 0 ? parent.slice(0, at) : parent;
 };
 /**
-* Whether a rule permits the version that actually resolved for this peer.
+* Whether the effective rules suppress this row, the way pnpm would.
 *
 * @remarks
-* Only `allowedVersions` is consulted. `ignoreMissing` and `allowAny` are
-* carried through the seam **unmeasured and unwired** — an unmeasured
-* suppression is exactly what produced the false positives this work removes,
-* so no code acts on them until someone measures them. Non-empty, they make the
-* whole report `"peerRulesNotApplied"` (see {@link PeerCheck.run}) rather than
-* being ignored here.
+* The three axes partition on `found`, and the partition is the measured
+* no-cross rule (pnpm 12.5.1, `__test__/fixtures/peers/allowany/` and
+* `ignoremissing/`):
 *
-* A rule cannot rescue a peer that resolved to nothing: with no version there
-* is nothing for the rule to permit, and pnpm's own `missing` section is not
-* suppressed by `allowedVersions` either.
+* - **Nothing resolved** (`found === null`): only `ignoreMissing` can hide the
+*   row, by matching the peer name. `allowedVersions` cannot — with no version
+*   there is nothing for a range to permit, and pnpm's `missing` section is not
+*   suppressed by it either — and neither can `allowAny`
+*   (`ignoremissing/peers-check-allowany-react.json` keeps all three rows).
+* - **Something resolved outside the range**: `allowAny` hides it by name, and
+*   `allowedVersions` hides it when a matching key's range covers the found
+*   version. `ignoreMissing` never does
+*   (`allowany/peers-check-ignoremissing-react-redux.json` keeps both rows).
 *
 * @internal
 */
-const suppressedByRule = (allowed, parentName, peer, found) => {
-	if (found === null) return false;
+const suppressedByRule = (policy, parentName, peer, found) => {
+	if (found === null) return policy.ignoreMissing(peer);
+	if (policy.allowAny(peer)) return true;
 	const version = SemVer.parseResult(found);
 	if (Result.isFailure(version)) return false;
-	for (const [key, permitted] of Object.entries(allowed)) {
+	for (const [key, permitted] of Object.entries(policy.allowed)) {
 		const separator = key.indexOf(">");
 		if (separator === 0) continue;
 		if (separator === -1) {