@effected/workspaces 0.23.0 → 0.24.1

package/WorkspaceCatalogs.js

@@ -1,8 +1,9 @@
 import { WorkspaceRoot } from "./WorkspaceRoot.js";
 import { inlineCatalogs, merge, normalize, rangeOf } from "./internal/catalogs.js";
-import { ConfigDependencyHooks } from "./ConfigDependencyHooks.js";
+import { ConfigDependencyHooks, NoPeerDependencyRules } from "./ConfigDependencyHooks.js";
 import { LockfileReader } from "./LockfileReader.js";
 import { importerVersionsOf } from "./internal/importerVersions.js";
+import { configDependenciesOf, inlinePeerDependencyRules } from "./internal/workspaceYaml.js";
 import { Context, Duration, Effect, Exit, FileSystem, Layer, Option, Path, PlatformError, Schema } from "effect";
 import { CatalogAssemblyError, CatalogResolver, DependencyResolutionError, PartialReleaseAgeGate, ReleaseAgeGate } from "@effected/npm";
 import { Yaml } from "@effected/yaml";
@@ -173,13 +174,6 @@ const catalogBlocksOf = (document) => {
 		catalogs: raw.catalogs
 	};
 };
-/** The `configDependencies` map (name → version+integrity) of a parsed pnpm-workspace document. */
-const configDependenciesOf = (document) => {
-	if (!isObject(document) || !isObject(document.configDependencies)) return {};
-	const out = {};
-	for (const [name, spec] of Object.entries(document.configDependencies)) if (typeof spec === "string") out[name] = spec;
-	return out;
-};
 /**
 * The inline release-age gate contribution of a parsed `pnpm-workspace.yaml`
 * document — pnpm's top-level `minimumReleaseAge` (minutes) and
@@ -211,41 +205,6 @@ const inlineReleaseAge = (document) => {
 		cause
 	})));
 };
-/**
-* The `peerDependencyRules` a `pnpm-workspace.yaml` declares inline — the half
-* `pnpm:export` materializes into the file, as opposed to the half a config
-* dependency injects at replay time.
-*
-* @remarks
-* **Tolerant, unlike the catalog blocks**, and the asymmetry is deliberate: a
-* malformed catalog block must hard-fail because a silently-empty catalog makes
-* every dependency look newly added, whereas a malformed rules block costs only
-* suppression — the failure mode is reporting a peer pnpm would have hidden,
-* which is visible and safe. Failing the whole assembly over it would take the
-* catalogs down with it.
-*
-* Every axis is read independently, so a malformed `ignoreMissing` does not
-* discard a well-formed `allowedVersions`.
-*/
-const EMPTY_PEER_RULES = {
-	allowedVersions: {},
-	ignoreMissing: [],
-	allowAny: []
-};
-const inlinePeerDependencyRules = (document) => {
-	if (!isObject(document) || !isObject(document.peerDependencyRules)) return EMPTY_PEER_RULES;
-	const block = document.peerDependencyRules;
-	const allowedVersions = {};
-	if (isObject(block.allowedVersions)) {
-		for (const [key, value] of Object.entries(block.allowedVersions)) if (typeof value === "string") allowedVersions[key] = value;
-	}
-	const strings = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-	return {
-		allowedVersions,
-		ignoreMissing: strings(block.ignoreMissing),
-		allowAny: strings(block.allowAny)
-	};
-};
 /** A hard-fail catalog-assembly failure naming the malformed part of a `workspaces` field. */
 const malformed = (source, path, detail) => new CatalogAssemblyError({
 	source,
@@ -321,6 +280,23 @@ const validatePnpmWorkspaceCatalogs = (document) => {
 /** A defect naming the unstubbed test-double method — a test-wiring mistake, not a typed failure. */
 const unstubbed = (method) => Effect.die(/* @__PURE__ */ new Error(`WorkspaceCatalogs.makeTest: ${method}() was called but not stubbed — pass a \`${method}\` override.`));
 /**
+* Replay a parsed `pnpm-workspace.yaml` document's `configDependencies`
+* hooks over its inline catalogs, seeded by its inline `peerDependencyRules`
+* — the ONE call into `hooks.inject` that both the live assembler and the
+* at-ref reader (`WorkspaceSnapshots`) make, so the two sides of a diff
+* cannot disagree about what a document declares or how it is seeded.
+*
+* @remarks
+* Rules are SEEDED, not merged afterwards: the workspace file's block goes
+* into the threaded config so the hooks merge onto it, exactly as pnpm seeds
+* its own config and takes back what the hooks return. Not part of the public
+* surface; `WorkspaceSnapshots` imports it directly.
+*/
+const injectFromDocument = (hooks, root, document, inline) => Effect.map(hooks.inject(root, configDependenciesOf(document), inline.entries, inlinePeerDependencyRules(document)), (injection) => ({
+	injected: CatalogSet.fromCatalogs(injection.catalogs),
+	injection
+}));
+/**
 * Assembles a workspace's catalogs, package-manager-aware.
 *
 * @remarks
@@ -378,7 +354,8 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 			let injected;
 			let inlineGate = {};
 			let hookGate = {};
-			let peerDependencyRules = EMPTY_PEER_RULES;
+			let peerDependencyRules = NoPeerDependencyRules;
+			let hookReplays = {};
 			if (hasPnpmWorkspace) {
 				const text = yield* fs.readFileString(workspaceYaml).pipe(Effect.mapError((cause) => new CatalogAssemblyError({
 					source: "manifest",
@@ -393,17 +370,19 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 				yield* validatePnpmWorkspaceCatalogs(document);
 				inline = CatalogSet.fromCatalogs(inlineCatalogs(catalogBlocksOf(document)));
 				inlineGate = yield* inlineReleaseAge(document);
-				const injection = yield* hooks.inject(root, configDependenciesOf(document), inline.entries, inlinePeerDependencyRules(document));
-				injected = CatalogSet.fromCatalogs(injection.catalogs);
-				hookGate = injection.releaseAge;
-				peerDependencyRules = injection.peerDependencyRules;
+				const replayed = yield* injectFromDocument(hooks, root, document, inline);
+				injected = replayed.injected;
+				hookGate = replayed.injection.releaseAge;
+				peerDependencyRules = replayed.injection.peerDependencyRules;
+				hookReplays = replayed.injection.replays;
 			} else {
 				const manifestPath = path.join(root, "package.json");
 				if (!(yield* probeExists(manifestPath))) return {
 					catalogs: fromLockfile,
 					releaseAgeGate: ReleaseAgeGate.combine(),
 					importerVersions,
-					peerDependencyRules: EMPTY_PEER_RULES
+					peerDependencyRules: NoPeerDependencyRules,
+					hookReplays: {}
 				};
 				const text = yield* fs.readFileString(manifestPath).pipe(Effect.mapError((cause) => new CatalogAssemblyError({
 					source: "manifest",
@@ -424,7 +403,8 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 				catalogs: assembled,
 				releaseAgeGate,
 				importerVersions,
-				peerDependencyRules
+				peerDependencyRules,
+				hookReplays
 			};
 		});
 		const [resolveOnce, invalidate] = yield* Effect.cachedInvalidateWithTTL(assemble, Duration.infinity);
@@ -445,10 +425,33 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 			importerVersions: Effect.fn("WorkspaceCatalogs.importerVersions")(function* () {
 				return (yield* memo).importerVersions;
 			}),
+			hookReplays: Effect.fn("WorkspaceCatalogs.hookReplays")(function* () {
+				return (yield* memo).hookReplays;
+			}),
 			refresh: () => invalidate
 		};
 	});
 	/**
+	* The service over an explicit {@link ConfigDependencyHooks} layer — the
+	* one builder every `layer*` static and the `Workspaces` composites
+	* delegate to, so the hooks layer is provided to {@link WorkspaceCatalogs.make}
+	* in exactly one place.
+	*
+	* @remarks
+	* Reach for it when the hooks layer is chosen elsewhere — a composite that
+	* must hand ONE hooks reference to both this service and
+	* `WorkspaceSnapshots` (layers memoize by reference, so two references
+	* would replay twice and could run two policies), or a test wiring
+	* {@link ConfigDependencyHooks.layerFrom}. The three `layer*` statics are
+	* this with the hooks layer fixed. `R` is the hooks layer's own
+	* requirement (the subprocess variant's `ChildProcessSpawner`), threaded
+	* through. Parameterized, so bind it to a `const` and reuse it.
+	*
+	* @param hooks - The {@link ConfigDependencyHooks} layer to replay through.
+	* @param options - The same options the other layer statics take.
+	*/
+	static layerWithHooks = (hooks, options) => Layer.effect(WorkspaceCatalogs, WorkspaceCatalogs.make(options)).pipe(Layer.provide(hooks));
+	/**
 	* The live layer — the default, which **never executes config-dependency
 	* code**: it wires {@link ConfigDependencyHooks.layerNoop}, whose hooks return
 	* the inline-catalog seed untouched.
@@ -457,7 +460,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 	* Parameterized, so it mints a fresh reference per call — bind it to a
 	* `const` and reuse it, or layer memoization does not apply.
 	*/
-	static layer = (options) => Layer.effect(WorkspaceCatalogs, WorkspaceCatalogs.make(options)).pipe(Layer.provide(ConfigDependencyHooks.layerNoop));
+	static layer = (options) => WorkspaceCatalogs.layerWithHooks(ConfigDependencyHooks.layerNoop, options);
 	/**
 	* The opt-in live layer that **does** replay config-dependency `pnpmfile.cjs`
 	* hooks: it wires {@link ConfigDependencyHooks.layerLive}, which dynamically
@@ -469,7 +472,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 	* the default catalog path stays free of any config-dependency execution.
 	* Parameterized, so bind it to a `const` and reuse it.
 	*/
-	static layerWithConfigDependencies = (options) => Layer.effect(WorkspaceCatalogs, WorkspaceCatalogs.make(options)).pipe(Layer.provide(ConfigDependencyHooks.layerLive));
+	static layerWithConfigDependencies = (options) => WorkspaceCatalogs.layerWithHooks(ConfigDependencyHooks.layerLive, options);
 	/**
 	* The opt-in layer that replays config-dependency `pnpmfile` hooks in a
 	* `node` **child process**: it wires
@@ -487,7 +490,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 	* same sanctioned R-widening as `Workspaces.layerWithGit`. Parameterized, so
 	* bind it to a `const` and reuse it.
 	*/
-	static layerWithConfigDependenciesSubprocess = (options) => Layer.effect(WorkspaceCatalogs, WorkspaceCatalogs.make(options)).pipe(Layer.provide(ConfigDependencyHooks.layerSubprocess));
+	static layerWithConfigDependenciesSubprocess = (options) => WorkspaceCatalogs.layerWithHooks(ConfigDependencyHooks.layerSubprocess, options);
 	/**
 	* A test double satisfying the full {@link WorkspaceCatalogsShape} with no
 	* filesystem, lockfile read, or hook replay.
@@ -505,9 +508,10 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 	* `resolveSpecifier` answers from that `CatalogSet`'s own
 	* {@link CatalogSet.resolveSpecifier} — exactly what the live service runs
 	* over its assembled set — so the two stay consistent by construction.
-	* `releaseAgeGate` and `importerVersions` are **not** derivable from a
-	* catalog set (the gate comes from release-age keys and hook contributions,
-	* the importer index from the lockfile's importer blocks — neither is in a
+	* `releaseAgeGate`, `importerVersions` and `hookReplays` are **not**
+	* derivable from a catalog set (the gate comes from release-age keys and
+	* hook contributions, the importer index from the lockfile's importer
+	* blocks, the replay record from the hooks layer — none is in a
 	* `CatalogSet`) and always die unless stubbed.
 	*
 	* `refresh` defaults to `Effect.void` honestly: the double holds no memo,
@@ -534,6 +538,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 			peerDependencyRules: () => unstubbed("peerDependencyRules"),
 			releaseAgeGate: () => unstubbed("releaseAgeGate"),
 			importerVersions: () => unstubbed("importerVersions"),
+			hookReplays: () => unstubbed("hookReplays"),
 			refresh: () => Effect.void,
 			...overrides
 		};
@@ -585,4 +590,4 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 };
 
 //#endregion
-export { CatalogSet, WorkspaceCatalogs };
+export { CatalogSet, WorkspaceCatalogs, injectFromDocument };

package/WorkspaceSnapshots.js

@@ -1,8 +1,9 @@
 import { manifestPatternsOf, pnpmPatternsOf } from "./internal/patterns.js";
 import { WorkspaceRoot } from "./WorkspaceRoot.js";
 import { WorkspaceDiscovery } from "./WorkspaceDiscovery.js";
+import { ConfigDependencyHooks } from "./ConfigDependencyHooks.js";
 import { importerVersionsOf } from "./internal/importerVersions.js";
-import { CatalogSet, WorkspaceCatalogs } from "./WorkspaceCatalogs.js";
+import { CatalogSet, WorkspaceCatalogs, injectFromDocument } from "./WorkspaceCatalogs.js";
 import { PackageStateSnapshot, WorkspaceStateSnapshot } from "./WorkspaceStateSnapshot.js";
 import { Git } from "@effected/git";
 import { Context, Duration, Effect, Exit, Layer, Option } from "effect";
@@ -12,6 +13,17 @@ import { Yaml } from "@effected/yaml";
 import { Lockfile, filenameFor } from "@effected/lockfiles";
 
 //#region src/WorkspaceSnapshots.ts
+/**
+* Project the live replay record onto the snapshot's `name → version` field:
+* a snapshot is "what the workspace looked like then", and WHERE this machine
+* found each pnpmfile is machine-local provenance that does not belong on a
+* serializable value.
+*/
+const hookVersionsOf = (replays) => {
+	const versions = {};
+	for (const [name, replay] of Object.entries(replays)) versions[name] = replay.version;
+	return versions;
+};
 /** Whether `value` is a non-null, non-array object. */
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Whether every value in a record is a string — a usable dependency map. */
@@ -98,12 +110,22 @@ const unstubbed = (method) => Effect.die(/* @__PURE__ */ new Error(`WorkspaceSna
 * @public
 */
 var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@effected/workspaces/WorkspaceSnapshots") {
-	/** Builds the service over `Git`, {@link WorkspaceRoot}, {@link WorkspaceDiscovery} and {@link WorkspaceCatalogs}. */
+	/**
+	* Builds the service over `Git`, {@link WorkspaceRoot}, {@link WorkspaceDiscovery},
+	* {@link WorkspaceCatalogs} and {@link ConfigDependencyHooks}.
+	*
+	* @remarks
+	* `ConfigDependencyHooks` is what `at(ref)` replays a ref's
+	* `configDependencies` through — at the versions THAT ref declares, which is
+	* why the composites hand the same hooks layer to this service and to
+	* `WorkspaceCatalogs`. Under `layerNoop` the ref read executes nothing.
+	*/
 	static make = (options) => Effect.gen(function* () {
 		const git = yield* Git;
 		const roots = yield* WorkspaceRoot;
 		const discovery = yield* WorkspaceDiscovery;
 		const catalogsService = yield* WorkspaceCatalogs;
+		const hooks = yield* ConfigDependencyHooks;
 		const seeded = (snapshot) => options?.seedCatalogs === void 0 ? snapshot : snapshot.withSeededCatalogs(options.seedCatalogs);
 		/**
 		* What a manager's lockfile records at the ref: its catalog set and its
@@ -118,15 +140,16 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@ef
 			})), Effect.catch(() => Effect.succeed(EMPTY_LOCKFILE_RECORD)))
 		})));
 		const computeAt = (root, ref) => Effect.gen(function* () {
-			const pnpmWorkspaceText = yield* git.show(root, ref, "./pnpm-workspace.yaml");
-			const rootManifestText = yield* git.show(root, ref, "./package.json");
+			const [pnpmWorkspaceText, rootManifestText] = yield* Effect.all([git.show(root, ref, "./pnpm-workspace.yaml"), git.show(root, ref, "./package.json")], { concurrency: 2 });
 			const rootManifest = Option.match(rootManifestText, {
 				onNone: () => ({}),
 				onSome: parseJsonObject
 			});
 			let patterns;
 			let inline;
+			let injected;
 			let recorded;
+			let hookReplays = {};
 			if (Option.isSome(pnpmWorkspaceText)) {
 				const document = yield* Yaml.parse(pnpmWorkspaceText.value).pipe(Effect.mapError((cause) => new CatalogAssemblyError({
 					source: "manifest",
@@ -136,13 +159,17 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@ef
 				const pnpmPatterns = pnpmPatternsOf(document);
 				patterns = pnpmPatterns.length > 0 ? pnpmPatterns : manifestPatternsOf(rootManifest);
 				inline = yield* CatalogSet.fromWorkspaceYaml(pnpmWorkspaceText.value);
+				const replayed = yield* injectFromDocument(hooks, root, document, inline);
+				injected = replayed.injected;
+				hookReplays = replayed.injection.replays;
 				recorded = yield* lockfileRecord(root, ref, "pnpm");
 			} else {
 				patterns = manifestPatternsOf(rootManifest);
 				inline = bunInlineCatalogs(rootManifest);
+				injected = CatalogSet.empty();
 				recorded = yield* lockfileRecord(root, ref, "bun");
 			}
-			const catalogs = CatalogSet.merge(recorded.catalogs, inline);
+			const catalogs = CatalogSet.merge(recorded.catalogs, inline, injected);
 			const globs = yield* GlobSet.compile(patterns).pipe(Effect.mapError((error) => new CatalogAssemblyError({
 				source: "manifest",
 				path: error.pattern,
@@ -170,7 +197,8 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@ef
 			return seeded(WorkspaceStateSnapshot.make({
 				packages,
 				catalogs,
-				importerVersions: recorded.importerVersions
+				importerVersions: recorded.importerVersions,
+				hookReplays: hookVersionsOf(hookReplays)
 			}));
 		});
 		const atCaches = /* @__PURE__ */ new Map();
@@ -195,6 +223,7 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@ef
 				const packages = yield* discovery.listPackages();
 				const catalogs = yield* catalogsService.set();
 				const importerVersions = yield* catalogsService.importerVersions();
+				const hookReplays = yield* catalogsService.hookReplays();
 				const snapshotPackages = packages.map((pkg) => PackageStateSnapshot.make({
 					name: pkg.name,
 					version: pkg.version ?? "",
@@ -207,7 +236,8 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@ef
 				return seeded(WorkspaceStateSnapshot.make({
 					packages: snapshotPackages,
 					catalogs,
-					importerVersions
+					importerVersions,
+					hookReplays: hookVersionsOf(hookReplays)
 				}));
 			})
 		};

package/WorkspaceStateSnapshot.js

@@ -117,6 +117,23 @@ var WorkspaceStateSnapshot = class WorkspaceStateSnapshot extends Schema.Class("
 	*/
 	importerVersions: Schema.optionalKey(Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.String))),
 	/**
+	* Which version each declared config dependency's hook was replayed from at
+	* this moment, keyed by name.
+	*
+	* @remarks
+	* Versions only — WHERE this machine found each pnpmfile (the `source` of a
+	* live `HookReplay`) is machine-local provenance, not part of "what the
+	* workspace looked like then", so it stays on the live `HookInjection`
+	* diagnostic and off this serializable value. Every fresh read sets the
+	* field: `{}` under the no-op layer, which resolves nothing, when the file
+	* declares no config dependencies, or on the bun / `package.json` path,
+	* where config dependencies do not exist. Absent only when decoding a
+	* snapshot serialized before the field existed, so stored values stay
+	* readable. Carried through `withSeededCatalogs` and `crossSeed`
+	* unchanged, like `importerVersions`.
+	*/
+	hookReplays: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	/**
 	* Catalogs supplied from OUTSIDE this moment, consulted only when
 	* `catalogs` cannot answer.
 	*
@@ -129,11 +146,14 @@ var WorkspaceStateSnapshot = class WorkspaceStateSnapshot extends Schema.Class("
 	* always wins and both halves stay readable.
 	*
 	* The motivating case is a catalog injected by a config-dependency
-	* `pnpmfile` hook. It is recorded in no committed catalog source, so
-	* `WorkspaceSnapshots.at(ref)` — which never replays hooks, by design — cannot
-	* see it, and a `catalog:` specifier against it resolves to nothing on BOTH
-	* sides of a diff. Seeding the live hook-injected set, or the other side's
-	* set, restores a declared RANGE without executing any historical code.
+	* `pnpmfile` hook. It is recorded in no committed catalog source, so under
+	* a non-replaying `ConfigDependencyHooks` layer (`layerNoop`, the default)
+	* `WorkspaceSnapshots.at(ref)` cannot see it, and a `catalog:` specifier
+	* against it resolves to nothing on BOTH sides of a diff. Seeding the live
+	* hook-injected set, or the other side's set, restores a declared RANGE
+	* without executing any historical code. Under a replaying layer `at(ref)`
+	* replays the ref's own pinned hook and the seed answers only what neither
+	* source declared.
 	*
 	* Defaults to absent, which makes the seed inert — exactly the behavior of
 	* every snapshot captured before this field existed.
@@ -280,8 +300,8 @@ var WorkspaceStateSnapshot = class WorkspaceStateSnapshot extends Schema.Class("
 	* value, and an accumulating seed would make precedence depend on call
 	* order). {@link WorkspaceStateSnapshot.crossSeed} is the deliberate
 	* exception: it composes the two seeds explicitly, precisely because a bare
-	* replace would discard a layer-level seed. `catalogs`, `packages` and `importerVersions` are carried through
-	* unchanged, so what the ref declared is still exactly what it declared.
+	* replace would discard a layer-level seed. `catalogs`, `packages`, `importerVersions` and `hookReplays` are
+	* carried through unchanged, so what the ref declared is still exactly what it declared.
 	*
 	* The two seeds worth reaching for: the LIVE hook-injected catalog set (from
 	* a `WorkspaceCatalogs` built by one of the config-dependency layers), or the
@@ -311,6 +331,7 @@ var WorkspaceStateSnapshot = class WorkspaceStateSnapshot extends Schema.Class("
 			packages: this.packages,
 			catalogs: this.catalogs,
 			...this.importerVersions === void 0 ? {} : { importerVersions: this.importerVersions },
+			...this.hookReplays === void 0 ? {} : { hookReplays: this.hookReplays },
 			seededCatalogs: seed
 		});
 	}
@@ -326,16 +347,19 @@ var WorkspaceStateSnapshot = class WorkspaceStateSnapshot extends Schema.Class("
 	* missing it, at strictly lower precedence than that side's own catalogs, so
 	* a genuine change between the refs still reads as a change.
 	*
-	* **The limitation is inherent and is not a defect to work around.** A range
-	* change made purely by bumping the config dependency BETWEEN the two refs is
-	* suppressed: neither committed source declares the catalog, so each side
-	* falls back to the other's value and the two agree by construction. Seeding
-	* the live hook-injected set via
-	* {@link WorkspaceStateSnapshot.withSeededCatalogs} has the same blind spot
-	* against history — recovering it would mean replaying each ref's pinned
-	* config-dependency code, which `at(ref)` will not do. If that case must be
-	* detected, diff `configDependencies` in `pnpm-workspace.yaml` directly; it
-	* is the only committed evidence that the injection changed.
+	* **What cross-seeding can and cannot see depends on the hooks layer.** A
+	* range change made purely by bumping the config dependency BETWEEN the two
+	* refs is detected when the snapshots were read under a replaying
+	* `ConfigDependencyHooks` layer: `WorkspaceSnapshots.at(ref)` replays each
+	* ref's hook at the version that ref's `configDependencies` declares, so
+	* each side's OWN catalogs carry that side's injected range and the seed
+	* never gets a say. Under `layerNoop` the case stays suppressed — neither
+	* committed source declares the catalog, so each side falls back to the
+	* other's value and the two agree by construction; there, diff
+	* `configDependencies` in `pnpm-workspace.yaml` directly, the only committed
+	* evidence that the injection changed. Cross-seeding is harmless under a
+	* replaying layer (own catalogs take precedence) and still worthwhile under
+	* the no-op one, which is why it stays.
 	*
 	* **The seeding relationship is symmetric; the RETURN ORDER is not.** Each
 	* snapshot is seeded with the other's catalogs, so neither argument is

package/Workspaces.js

@@ -1,6 +1,7 @@
 import { WorkspaceRoot } from "./WorkspaceRoot.js";
 import { WorkspaceDiscovery } from "./WorkspaceDiscovery.js";
 import { ChangeDetector } from "./ChangeDetector.js";
+import { ConfigDependencyHooks } from "./ConfigDependencyHooks.js";
 import { PackageManagerDetector } from "./PackageManagerName.js";
 import { LockfileReader } from "./LockfileReader.js";
 import { WorkspaceCatalogs } from "./WorkspaceCatalogs.js";
@@ -10,39 +11,34 @@ import { Effect, Layer, Option } from "effect";
 import { ExecContext, LocalExec, LocalExecError } from "@effected/commands";
 
 //#region src/Workspaces.ts
-const compose = (options, catalogsFactory) => {
+const compose = (options, hooks) => {
 	const roots = WorkspaceRoot.layer;
 	const detector = PackageManagerDetector.layer;
 	const discovery = WorkspaceDiscovery.layer(options).pipe(Layer.provide(roots));
 	const lockfiles = LockfileReader.layer(options).pipe(Layer.provide(roots), Layer.provide(detector), Layer.provide(discovery));
-	const catalogs = catalogsFactory(options).pipe(Layer.provide(roots), Layer.provide(lockfiles));
+	const catalogs = WorkspaceCatalogs.layerWithHooks(hooks, options).pipe(Layer.provide(roots), Layer.provide(lockfiles));
 	return Layer.mergeAll(roots, detector, discovery, lockfiles, catalogs);
 };
-const layer = (options) => compose(options, WorkspaceCatalogs.layer);
+const layer = (options) => compose(options, ConfigDependencyHooks.layerNoop);
 /**
-* The git half, over an ALREADY-BUILT core composite.
-*
-* @remarks
-* Taking the core as a parameter rather than building it is what lets the
-* config-dependency composites exist at all: the git services are identical
-* across all three, and only the catalogs layer underneath differs. Copying
-* this graph per variant is exactly what a consumer had to do downstream
-* before `layerWithGitAndConfigDependencies` existed.
-*
-* `core` is threaded in as a value, so the caller's single `layer(options)`
-* reference is shared by `ChangeDetector`, `WorkspaceSnapshots` and the merge —
-* building it twice here would defeat layer memoization inside one composite.
+* The core composite widened with the git tier: `Git`, `ChangeDetector` and
+* `WorkspaceSnapshots`. It builds the core over `hooks` ITSELF, so the SAME
+* hooks layer reaches `WorkspaceCatalogs` (through `compose`) and
+* `WorkspaceSnapshots` by construction — `at(ref)` replays a ref's config
+* dependencies exactly as the live assembler replays the worktree's: one
+* reference, one memo, one policy for both sides of a diff.
 */
-const withGit = (core, options) => {
+const withGit = (hooks, options) => {
+	const core = compose(options, hooks);
 	const git = Git.layer;
-	return Layer.mergeAll(core, git, ChangeDetector.layer.pipe(Layer.provide(git), Layer.provide(core)), WorkspaceSnapshots.layer(options).pipe(Layer.provide(git), Layer.provide(core)));
+	return Layer.mergeAll(core, git, ChangeDetector.layer.pipe(Layer.provide(git), Layer.provide(core)), WorkspaceSnapshots.layer(options).pipe(Layer.provide(git), Layer.provide(hooks), Layer.provide(core)));
 };
-const layerWithGit = (options) => withGit(layer(options), options);
+const layerWithGit = (options) => withGit(ConfigDependencyHooks.layerNoop, options);
 const resolvers = Layer.mergeAll(WorkspaceCatalogs.catalogResolver, WorkspaceDiscovery.workspaceResolver);
-const layerWithConfigDependencies = (options) => compose(options, WorkspaceCatalogs.layerWithConfigDependencies);
-const layerWithConfigDependenciesSubprocess = (options) => compose(options, WorkspaceCatalogs.layerWithConfigDependenciesSubprocess);
-const layerWithGitAndConfigDependencies = (options) => withGit(layerWithConfigDependencies(options), options);
-const layerWithGitAndConfigDependenciesSubprocess = (options) => withGit(layerWithConfigDependenciesSubprocess(options), options);
+const layerWithConfigDependencies = (options) => compose(options, ConfigDependencyHooks.layerLive);
+const layerWithConfigDependenciesSubprocess = (options) => compose(options, ConfigDependencyHooks.layerSubprocess);
+const layerWithGitAndConfigDependencies = (options) => withGit(ConfigDependencyHooks.layerLive, options);
+const layerWithGitAndConfigDependenciesSubprocess = (options) => withGit(ConfigDependencyHooks.layerSubprocess, options);
 const resolverLayer = (options) => resolvers.pipe(Layer.provide(layerWithConfigDependencies(options)));
 const resolveManifest = Effect.fn("Workspaces.resolveManifest")(function* (manifest, options) {
 	return yield* manifest.resolve().pipe(Effect.provide(resolverLayer(options)));
@@ -226,6 +222,43 @@ var Workspaces = class {
 	*/
 	static layerWithGitAndConfigDependenciesSubprocess = layerWithGitAndConfigDependenciesSubprocess;
 	/**
+	* The git composite over a **caller-supplied** hooks layer — the same graph
+	* as {@link Workspaces.layerWithGit} and its two config-dependency
+	* variants, with the `ConfigDependencyHooks` policy chosen by the caller.
+	*
+	* @remarks
+	* The three fixed git composites are this function applied to
+	* {@link ConfigDependencyHooks.layerNoop}, {@link ConfigDependencyHooks.layerLive}
+	* and {@link ConfigDependencyHooks.layerSubprocess}. It exists for the fourth
+	* policy: {@link ConfigDependencyHooks.layerFrom}, the hermetic seam, which a
+	* snapshot-backed test otherwise cannot reach without rebuilding the whole
+	* git graph by hand — the copy `layerWithGitAndConfigDependencies` was added
+	* to delete. The ONE hooks reference is handed to both `WorkspaceCatalogs`
+	* and `WorkspaceSnapshots`, so `at(ref)` and `worktree()` cannot drift on
+	* which policy they replay. A hooks layer carrying its own requirement (the
+	* subprocess variant's `ChildProcessSpawner`) threads it through to the
+	* composite's `R` unchanged.
+	*
+	* **Bind the result to a `const`.**
+	*
+	* @param hooks - The `ConfigDependencyHooks` layer to wire on both sides.
+	* @param options - The composite options, as for {@link Workspaces.layerWithGit}.
+	*
+	* @example
+	* ```ts
+	* import { ConfigDependencyHooks, Workspaces } from "@effected/workspaces";
+	*
+	* // A test pinning what at(ref) replays for two declared plugin versions.
+	* const KitLayer = Workspaces.layerWithGitAndHooks(
+	*   ConfigDependencyHooks.layerFrom({
+	*     "@scope/plugin@1.0.0": "/fixtures/plugin-1/pnpmfile.mjs",
+	*     "@scope/plugin@2.0.0": "/fixtures/plugin-2/pnpmfile.mjs",
+	*   }),
+	* );
+	* ```
+	*/
+	static layerWithGitAndHooks = withGit;
+	/**
 	* This package's implementation of `@effected/commands`' `LocalExec`
 	* contract: how to run a project-local binary here.
 	*