@effected/workspaces 0.26.0 → 0.28.0-next-20260927062352

package/index.d.ts

@@ -1,10 +1,11 @@
 import { Git, GitCommandError, NotARepositoryError, UnknownRefError } from "@effected/git";
-import { Context, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
+import { Context, Effect, FileSystem, Layer, Option, Path, Result, Schema } from "effect";
 import { CatalogAssemblyError, CatalogResolver, DependencyResolutionError, Manifest, PartialReleaseAgeGate, ReleaseAgeGate, UnresolvedDependencyError, WorkspaceResolver } from "@effected/npm";
 import { GlobPattern } from "@effected/glob";
 import { Lockfile, LockfileFramingError, LockfileIntegrity, LockfileParseError, ResolvedPackage, WorkspaceManifest } from "@effected/lockfiles";
 import { Package } from "@effected/package-json";
 import { ChildProcessSpawner } from "effect/unstable/process";
+import { SemVer } from "@effected/semver";
 import { LocalExec } from "@effected/commands";
 //#region src/WorkspacePackage.d.ts
 declare const PublishConfig_base: Schema.Class<PublishConfig, Schema.Struct<{
@@ -934,12 +935,43 @@ interface PeerDependencyRules {
 export declare const NoPeerDependencyRules: PeerDependencyRules;
 /**
  * Where a replayed config dependency's declared version was found: the
- * `node_modules/.pnpm-config` copy, the pnpm store's `links/` tree, or a
+ * `node_modules/.pnpm-config` copy, the pnpm store's `links/` tree, the store
+ * after {@link ConfigDependencyHooks.layerSubprocess} fetched it, or a
  * {@link ConfigDependencyHooks.layerFrom} entry.
  *
  * @public
  */
-type HookReplaySource = "installed" | "store" | "supplied";
+type HookReplaySource = "installed" | "store" | "fetched" | "supplied";
+/**
+ * What the side whose `configDependencies` are being replayed recorded beyond
+ * that map — the input the fetch rung needs to verify what it fetches.
+ *
+ * @remarks
+ * Both fields are optional, and omitting the whole context is always valid:
+ * nothing here changes which version is replayed. `lockfile` matters only when
+ * a replaying layer must fetch a version installed nowhere, and only
+ * {@link ConfigDependencyHooks.layerSubprocess} fetches. Without it, a bare
+ * `configDependencies` spec has no integrity to verify a fetch against, so the
+ * fetch fails closed with `reason: "integrityUnavailable"`.
+ *
+ * `WorkspaceCatalogs` passes the working tree's lockfile, and
+ * `WorkspaceSnapshots.at(ref)` passes the lockfile and the ref it read at, so
+ * each side of a diff is verified against its own record.
+ *
+ * @public
+ */
+interface HookReplayContext {
+  /**
+   * The declaring side's `pnpm-lock.yaml` text, whose env preamble records each
+   * config dependency's integrity. `undefined` when that side has no lockfile.
+   */
+  readonly lockfile?: string | undefined;
+  /**
+   * The git ref whose `pnpm-workspace.yaml` declared the `configDependencies`,
+   * used to name the side in error messages. `undefined` for the working tree.
+   */
+  readonly ref?: string | undefined;
+}
 /**
  * Which version of a config dependency a replay actually loaded, and where
  * that version came from.
@@ -949,7 +981,9 @@ type HookReplaySource = "installed" | "store" | "supplied";
  * WHAT the hooks injected but which pinned version injected it — the
  * evidence that a "range moved" row came from a config-dependency bump and
  * not from a hook edit. `installed` is the `node_modules/.pnpm-config` copy,
- * `store` the pnpm store's `links/` tree, `supplied` a
+ * `store` the pnpm store's `links/` tree, `fetched` the store copy
+ * {@link ConfigDependencyHooks.layerSubprocess} fetched, verified, because
+ * neither held the declared version, and `supplied` a
  * {@link ConfigDependencyHooks.layerFrom} entry.
  *
  * @public
@@ -1048,8 +1082,12 @@ interface ConfigDependencyHooksShape {
    *   threaded config so hooks merge onto them rather than replacing them.
    *   Omitted means "the workspace file declares none", which is different
    *   from "nobody looked" — the caller owns that distinction.
+   * @param context - What the declaring side recorded beyond the map: its
+   *   lockfile, which verifies a fetched version, and its ref, which names it
+   *   in errors. Only {@link ConfigDependencyHooks.layerSubprocess} reads the
+   *   lockfile; omitting the context never changes which version is replayed.
    */
-  readonly inject: (root: string, configDependencies: Readonly<Record<string, string>>, seed: Readonly<Record<string, Readonly<Record<string, string>>>>, rules?: PeerDependencyRules) => Effect.Effect<HookInjection, CatalogAssemblyError>;
+  readonly inject: (root: string, configDependencies: Readonly<Record<string, string>>, seed: Readonly<Record<string, Readonly<Record<string, string>>>>, rules?: PeerDependencyRules, context?: HookReplayContext) => Effect.Effect<HookInjection, CatalogAssemblyError>;
 }
 declare const ConfigDependencyHooks_base: Context.ServiceClass<ConfigDependencyHooks, "@effected/workspaces/ConfigDependencyHooks", ConfigDependencyHooksShape>;
 /**
@@ -1100,9 +1138,10 @@ export declare class ConfigDependencyHooks extends ConfigDependencyHooks_base {
    * `links/<name>/<declared>/*\/node_modules/<name>` (the store is located
    * from `node_modules/.modules.yaml`, the realpath of any `.pnpm-config`
    * entry, then `$PNPM_HOME` / `$XDG_DATA_HOME` / the platform default), else
-   * a typed error naming the package, the declared version, what is
-   * installed, the stores searched, and the remediation
-   * (`pnpm add --config <name>@<version>` in a throwaway workspace). In the
+   * a typed error with `reason: "notInstalled"` naming the package, the
+   * declared version, what is installed, the stores searched, and the
+   * remediation (`pnpm add --config <name>@<version>` in a throwaway
+   * workspace, or the subprocess layer, which fetches). In the
    * chosen directory the first of `pnpmfile.mjs`, `pnpmfile.cjs`,
    * `pnpmfile.js` present in one directory listing is loaded; a listed but
    * unreadable file fails typed at import time, never as "ships no hook".
@@ -1174,9 +1213,24 @@ export declare class ConfigDependencyHooks extends ConfigDependencyHooks_base {
    *
    * The declared-version resolution is the PARENT's: the same ladder as
    * `layerLive` (`.pnpm-config` when it holds the declared version, else the
-   * pnpm store, else a typed fail-closed error) runs here, and the child
-   * receives the resolved `[name, fileUrl]` pairs as one JSON argv
-   * argument. An empty `configDependencies`, or one whose dependencies all
+   * pnpm store) runs here, and the child receives the resolved
+   * `[name, fileUrl]` pairs as one JSON argv argument.
+   *
+   * One rung more than `layerLive`: a version held nowhere is FETCHED into
+   * the store rather than failing, so a diff whose base side declares a
+   * version this checkout never installed still replays that version. pnpm
+   * runs `install --frozen-lockfile` in a scratch workspace (removed
+   * afterwards) whose lockfile pins the integrity the declaring side recorded
+   * — the inline `<version>+<integrity>` spec, else that side's
+   * `pnpm-lock.yaml` env preamble ({@link HookReplayContext.lockfile}) — so
+   * pnpm itself refuses a download that does not match. It writes to the
+   * first store the ladder searched, so the next replay finds the version
+   * there. The replay records `source: "fetched"`. Fail-closed: two recorded
+   * integrities that disagree fail with `reason: "integrityMismatch"`, none
+   * with `reason: "integrityUnavailable"` — nothing is fetched in either case
+   * — and a fetch that fails with `reason: "fetchFailed"`, keeping the
+   * not-installed remediation. The fetch needs `pnpm` 11 or 12 on `PATH` and
+   * registry access, and is bounded at two minutes. An empty `configDependencies`, or one whose dependencies all
    * ship no pnpmfile, returns the seed without spawning anything; a `..` path
    * segment in a dependency name fails typed **before** any spawn; a
    * load failure in the child — a syntax error, a throwing top level, an
@@ -1210,6 +1264,157 @@ export declare class ConfigDependencyHooks extends ConfigDependencyHooks_base {
   static readonly layerSubprocess: Layer.Layer<ConfigDependencyHooks, never, ChildProcessSpawner.ChildProcessSpawner>;
 }
 //#endregion
+//#region src/ConfigDependencySpec.d.ts
+declare const InvalidConfigDependencySpecError_base: Schema.Class<InvalidConfigDependencySpecError, Schema.TaggedStruct<"InvalidConfigDependencySpecError", {
+  /** The raw spec string that failed validation. */
+  readonly input: Schema.String;
+  /**
+   * Which half of the spec failed: `version` (the text before the first
+   * `+` is not an exact SemVer version — ranges, partial versions,
+   * dist-tags and padded values all land here) or `integrity` (the text
+   * after the first `+` is not an SRI `<algo>-<base64>` hash).
+   */
+  readonly reason: Schema.Literals<readonly ["version", "integrity"]>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * Indicates that a string could not be parsed as a pnpm `configDependencies`
+ * spec (`<version>[+<integrity>]`).
+ *
+ * Raised by {@link ConfigDependencySpec.parse} and
+ * {@link ConfigDependencySpec.parseResult}; the decode direction of
+ * {@link ConfigDependencySpec.FromString} reports the same failure through a
+ * generic `Schema` parse error carrying the same message. The offending string
+ * is preserved on `input`; `reason` says which half failed.
+ *
+ * @public
+ */
+export declare class InvalidConfigDependencySpecError extends InvalidConfigDependencySpecError_base {
+  get message(): string;
+}
+declare const ConfigDependencySpec_base: Schema.Class<ConfigDependencySpec, Schema.Struct<{
+  /**
+   * The exact declared version. Never carries build metadata — the spec
+   * grammar cannot express it (see the class remarks), and a version
+   * constructed with build identifiers is rejected at construction.
+   */
+  readonly version: Schema.decodeTo<Schema.declareConstructor<SemVer, {
+    readonly major: number;
+    readonly minor: number;
+    readonly patch: number;
+    readonly prerelease: readonly (string | number)[];
+    readonly build: readonly string[];
+  }, readonly [Schema.Struct<{
+    readonly major: Schema.Number;
+    readonly minor: Schema.Number;
+    readonly patch: Schema.Number;
+    readonly prerelease: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>;
+    readonly build: Schema.$Array<Schema.String>;
+  }>], {
+    readonly major: number;
+    readonly minor: number;
+    readonly patch: number;
+    readonly prerelease: readonly (string | number)[];
+    readonly build: readonly string[];
+  }>, Schema.Struct<{
+    readonly major: Schema.Number;
+    readonly minor: Schema.Number;
+    readonly patch: Schema.Number;
+    readonly prerelease: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>;
+    readonly build: Schema.$Array<Schema.String>;
+  }>, never, never>;
+  /**
+   * The inline integrity (e.g. `sha512-m35m…==`): `@effected/npm`'s
+   * `SriIntegrityHash`, the shared restriction of the `IntegrityHash` brand
+   * to the SRI `<algo>-<base64>` form. `None` on the bare form pnpm 11+
+   * writes.
+   */
+  readonly integrity: Schema.Option<Schema.brand<Schema.String, "IntegrityHash">>;
+}>, {}>;
+/**
+ * A pnpm `configDependencies` spec from `pnpm-workspace.yaml`: an exact
+ * `version` and, on the legacy inline form only, an SRI `integrity`.
+ *
+ * @remarks
+ * pnpm 11 and later write the **bare** form — `pnpm add --config` records
+ * `0.11.1`, and the integrity lives in the lockfile. The inline form
+ * `0.11.1+sha512-<base64>` is deprecated but still read, and workspaces in the
+ * wild still carry it. {@link ConfigDependencySpec.bare} renders the bare form
+ * (a tool normalizing the field writes this); `toString()` re-renders the form
+ * that was parsed, so a tool that must not rewrite the field round-trips it
+ * byte-identically.
+ *
+ * The first `+` always begins the integrity, never semver build metadata, so
+ * `0.11.1+sha512-…` is version `0.11.1` plus integrity `sha512-…`; a tail that
+ * is not an SRI hash fails with `reason: "integrity"` rather than falling back
+ * to build-metadata parsing.
+ *
+ * `version` is `@effected/semver`'s `SemVer`: prerelease versions are
+ * accepted, ranges (`^0.11.1`), partial versions, dist-tags, a `v` prefix and
+ * padded values are not.
+ *
+ * @example
+ * ```ts
+ * import { ConfigDependencySpec } from "@effected/workspaces";
+ * import { Effect } from "effect";
+ *
+ * const program = Effect.gen(function* () {
+ *   const spec = yield* ConfigDependencySpec.parse("0.11.1+sha512-m35m…==");
+ *   return [spec.bare, spec.hasIntegrity] as const; // ["0.11.1", true]
+ * });
+ * ```
+ *
+ * @public
+ */
+export declare class ConfigDependencySpec extends ConfigDependencySpec_base {
+  /**
+   * Schema transformation between the `<version>[+<integrity>]` string and a
+   * {@link ConfigDependencySpec}. Decoding parses via
+   * {@link ConfigDependencySpec.parseResult} (the surfaces share one grammar);
+   * encoding prints `toString()`, the form that was parsed.
+   */
+  static readonly FromString: Schema.Codec<ConfigDependencySpec, string>;
+  /**
+   * Parse a `configDependencies` spec, synchronously, returning a `Result`
+   * instead of an `Effect`.
+   *
+   * @remarks
+   * The text before the first `+` must be an exact SemVer version that
+   * renders back to itself byte for byte (`SemVer.isPinnable`, plus a
+   * canonical-spelling check so `toString()` round-trips); the text after it,
+   * when present, must be an SRI `<algo>-<base64>` hash. An empty tail
+   * (`0.11.1+`) is an integrity failure, not a bare spec.
+   * {@link ConfigDependencySpec.parse} is defined in terms of this function.
+   *
+   * @param input - the spec string to parse
+   * @returns a `Result` succeeding with the parsed {@link ConfigDependencySpec},
+   * or failing with {@link InvalidConfigDependencySpecError} naming the half
+   * that failed.
+   */
+  static parseResult(input: string): Result.Result<ConfigDependencySpec, InvalidConfigDependencySpecError>;
+  /**
+   * Parse a `configDependencies` spec. Defined in terms of
+   * {@link ConfigDependencySpec.parseResult} — synchronous callers can use
+   * that variant directly.
+   *
+   * @param input - the spec string to parse
+   * @returns the parsed {@link ConfigDependencySpec}. Fails with
+   * {@link InvalidConfigDependencySpecError} when `input` is not a valid spec.
+   */
+  static readonly parse: (input: string) => Effect.Effect<ConfigDependencySpec, InvalidConfigDependencySpecError, never>;
+  /** Whether the spec carries an inline integrity (the legacy form). */
+  get hasIntegrity(): boolean;
+  /**
+   * The bare `<version>` form — what pnpm 11+ writes to `configDependencies`
+   * — with any inline integrity dropped.
+   */
+  get bare(): string;
+  /**
+   * The spec as parsed: `<version>` or `<version>+<integrity>`. The encode
+   * direction of {@link ConfigDependencySpec.FromString} prints exactly this.
+   */
+  toString(): string;
+}
+//#endregion
 //#region src/DependencyGraph.d.ts
 declare const CyclicDependencyError_base: Schema.Class<CyclicDependencyError, Schema.TaggedStruct<"CyclicDependencyError", {
   /** The packages participating in the cycle. */
@@ -4312,5 +4517,5 @@ interface GetWorkspacePackagesSyncOptions extends WorkspacesSyncOptions {
  */
 export declare const getWorkspacePackagesSync: (root: string, options: GetWorkspacePackagesSyncOptions) => ReadonlyArray<WorkspacePackage>;
 //#endregion
-export type { CatalogAssemblyFailure, ChangeDetectionFailure, ChangeDetectorShape, ClassifyOptions, ConfigDependencyHooksShape, DependencyDiff, DuplicateCheckOptions, FindWorkspaceRootOptions, GetWorkspacePackagesSyncOptions, HookInjection, HookReplay, HookReplaySource, ImporterVersions, LockfileReadFailure, LockfileReaderOptions, LockfileReaderShape, PackageManagerDetectionFailure, PackageManagerDetectorShape, PackageRelease, PeerCheckOptions, PeerDependencyRules, PublishabilityDetectorShape, SyncDirectoryEntry, SyncFileSystem, SyncPath, TagClassification, TagFormatOptions, TrackingTagOptions, UnverifiedReason, VersioningDetectOptions, WorkspaceCatalogsOptions, WorkspaceCatalogsShape, WorkspaceDiscoveryFailure, WorkspaceDiscoveryOptions, WorkspaceDiscoveryShape, WorkspaceDiscoverySkip, WorkspaceDiscoverySkipKind, WorkspaceLookupFailure, WorkspaceRootShape, WorkspaceSnapshotAtFailure, WorkspaceSnapshotWorktreeFailure, WorkspaceSnapshotsOptions, WorkspaceSnapshotsShape, WorkspacesGitOptions, WorkspacesOptions, WorkspacesServices, WorkspacesSyncOptions };
+export type { CatalogAssemblyFailure, ChangeDetectionFailure, ChangeDetectorShape, ClassifyOptions, ConfigDependencyHooksShape, DependencyDiff, DuplicateCheckOptions, FindWorkspaceRootOptions, GetWorkspacePackagesSyncOptions, HookInjection, HookReplay, HookReplayContext, HookReplaySource, ImporterVersions, LockfileReadFailure, LockfileReaderOptions, LockfileReaderShape, PackageManagerDetectionFailure, PackageManagerDetectorShape, PackageRelease, PeerCheckOptions, PeerDependencyRules, PublishabilityDetectorShape, SyncDirectoryEntry, SyncFileSystem, SyncPath, TagClassification, TagFormatOptions, TrackingTagOptions, UnverifiedReason, VersioningDetectOptions, WorkspaceCatalogsOptions, WorkspaceCatalogsShape, WorkspaceDiscoveryFailure, WorkspaceDiscoveryOptions, WorkspaceDiscoveryShape, WorkspaceDiscoverySkip, WorkspaceDiscoverySkipKind, WorkspaceLookupFailure, WorkspaceRootShape, WorkspaceSnapshotAtFailure, WorkspaceSnapshotWorktreeFailure, WorkspaceSnapshotsOptions, WorkspaceSnapshotsShape, WorkspacesGitOptions, WorkspacesOptions, WorkspacesServices, WorkspacesSyncOptions };
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -4,6 +4,7 @@ import { PackageNotFoundError, WorkspaceDiscovery, WorkspaceDiscoveryError, Work
 import { CyclicDependencyError, DependencyGraph } from "./DependencyGraph.js";
 import { ChangeDetectionError, ChangeDetectionOptions, ChangeDetector } from "./ChangeDetector.js";
 import { ConfigDependencyHooks, NoPeerDependencyRules } from "./ConfigDependencyHooks.js";
+import { ConfigDependencySpec, InvalidConfigDependencySpecError } from "./ConfigDependencySpec.js";
 import { Dependent, DuplicateCheck, DuplicateInstance, DuplicatedPackage, DuplicatedVersion } from "./DuplicateCheck.js";
 import { DetectedPackageManager, PackageManagerDetectionError, PackageManagerDetector, PackageManagerEvidence, PackageManagerName } from "./PackageManagerName.js";
 import { LockfileReadError, LockfileReader } from "./LockfileReader.js";
@@ -17,4 +18,4 @@ import { WorkspaceSnapshots } from "./WorkspaceSnapshots.js";
 import { Workspaces } from "./Workspaces.js";
 import { findWorkspaceRootSync, getWorkspacePackagesSync } from "./WorkspacesSync.js";
 
-export { CatalogSet, ChangeDetectionError, ChangeDetectionOptions, ChangeDetector, ConfigDependencyHooks, CyclicDependencyError, DependencyGraph, Dependent, DetectedPackageManager, DuplicateCheck, DuplicateInstance, DuplicatedPackage, DuplicatedVersion, LockfileReadError, LockfileReader, NoPeerDependencyRules, PackageManagerDetectionError, PackageManagerDetector, PackageManagerEvidence, PackageManagerName, PackageNotFoundError, PackageStateSnapshot, PeerCheck, PeerParent, PublishConfig, PublishTarget, PublishabilityDetector, ReleaseTag, TagStyle, TrackingTag, UnsatisfiedPeer, VersioningStrategy, VersioningStrategyType, WORKSPACE_MARKERS, WorkspaceCatalogs, WorkspaceDiscovery, WorkspaceDiscoveryError, WorkspaceInfo, WorkspaceManifestError, WorkspacePackage, WorkspacePatternError, WorkspaceRoot, WorkspaceRootNotFoundError, WorkspaceSnapshots, WorkspaceStateSnapshot, Workspaces, classifyTag, findWorkspaceRootSync, getWorkspacePackagesSync };
+export { CatalogSet, ChangeDetectionError, ChangeDetectionOptions, ChangeDetector, ConfigDependencyHooks, ConfigDependencySpec, CyclicDependencyError, DependencyGraph, Dependent, DetectedPackageManager, DuplicateCheck, DuplicateInstance, DuplicatedPackage, DuplicatedVersion, InvalidConfigDependencySpecError, LockfileReadError, LockfileReader, NoPeerDependencyRules, PackageManagerDetectionError, PackageManagerDetector, PackageManagerEvidence, PackageManagerName, PackageNotFoundError, PackageStateSnapshot, PeerCheck, PeerParent, PublishConfig, PublishTarget, PublishabilityDetector, ReleaseTag, TagStyle, TrackingTag, UnsatisfiedPeer, VersioningStrategy, VersioningStrategyType, WORKSPACE_MARKERS, WorkspaceCatalogs, WorkspaceDiscovery, WorkspaceDiscoveryError, WorkspaceInfo, WorkspaceManifestError, WorkspacePackage, WorkspacePatternError, WorkspaceRoot, WorkspaceRootNotFoundError, WorkspaceSnapshots, WorkspaceStateSnapshot, Workspaces, classifyTag, findWorkspaceRootSync, getWorkspacePackagesSync };

package/internal/configDependencyFetch.js

@@ -0,0 +1,146 @@
+import { carries, manifestVersion, messageOf, sideLabel } from "./configDependencyShared.js";
+import { splitConfigDependencySpec } from "./configDependencySpecGrammar.js";
+import { Duration, Effect } from "effect";
+import { IntegrityHash } from "@effected/npm";
+import { Run } from "@effected/commands";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+import { mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+
+//#region src/internal/configDependencyFetch.ts
+const fetchFailure = (reason, message, cause) => cause === void 0 ? {
+	reason,
+	message
+} : {
+	reason,
+	message,
+	cause
+};
+/**
+* The ceiling on one fetch. It downloads one small tarball; two minutes covers
+* a slow registry without letting a hung pnpm stall catalog assembly forever.
+*/
+const FETCH_TIMEOUT = Duration.minutes(2);
+/**
+* The integrity the fetched copy must match, decided before anything is
+* spawned: the inline spec integrity (legacy) and the declaring side's
+* lockfile preamble entry for exactly `<name>@<version>`. Both present and
+* different, neither present, an inline integrity that is not SRI, or a
+* lockfile that cannot be read all fail typed. A lockfile that records the
+* name at a different version is not a source for this version.
+*
+* @remarks
+* An unreadable lockfile fails closed even when the spec carries an inline
+* integrity: the lockfile is the declaring side's own checksum store, and a
+* store that cannot be read cannot be confirmed to agree with the inline pin.
+*/
+const expectedIntegrity = (request) => Effect.gen(function* () {
+	const { name, version, side } = request;
+	const key = `${name}@${version}`;
+	const inline = splitConfigDependencySpec(request.spec).integrity;
+	if (inline !== void 0 && !IntegrityHash.isSri(inline)) return yield* Effect.fail(fetchFailure("integrityUnavailable", `config dependency ${key} declared by ${sideLabel(side)} carries an inline integrity that is not an SRI hash, so a fetched copy cannot be verified and nothing was fetched.`));
+	const lock = (yield* request.locks.pipe(Effect.mapError((cause) => fetchFailure("integrityUnavailable", `config dependency ${key} must be fetched, but the pnpm-lock.yaml of ${sideLabel(side)} cannot be read (${messageOf(cause)}), so its recorded integrity cannot be checked and nothing was fetched.`, cause))))?.get(name);
+	const locked = lock !== void 0 && lock.version === version ? lock.integrity : void 0;
+	if (inline !== void 0 && locked !== void 0 && inline !== locked) return yield* Effect.fail(fetchFailure("integrityMismatch", `config dependency ${key} declared by ${sideLabel(side)} has two different recorded integrities: pnpm-workspace.yaml pins ${inline} and pnpm-lock.yaml records ${locked}. Nothing was fetched; reconcile the two (a fresh \`pnpm install\` rewrites the lockfile) before retrying.`));
+	const integrity = inline ?? locked;
+	if (integrity === void 0) return yield* Effect.fail(fetchFailure("integrityUnavailable", `config dependency ${key} must be fetched, but ${sideLabel(side)} records no integrity for it (no inline integrity in pnpm-workspace.yaml and no pnpm-lock.yaml entry for that version), so a fetched copy could not be verified and nothing was fetched.`));
+	return integrity;
+});
+/**
+* The scratch workspace's `pnpm-workspace.yaml`. Every scalar is a
+* JSON-quoted string, which YAML reads verbatim, so no declared text can
+* change the document's structure.
+*/
+const scratchWorkspaceYaml = (name, version) => `configDependencies:\n  ${JSON.stringify(name)}: ${JSON.stringify(version)}\n`;
+/**
+* The scratch workspace's `pnpm-lock.yaml`: the env preamble pnpm 11 and 12
+* write for a lone config dependency, pinned to `integrity`, followed by the
+* empty lockfile document they write when there are no projects.
+*/
+const scratchLockfile = (name, version, integrity) => {
+	const key = JSON.stringify(`${name}@${version}`);
+	return [
+		"---",
+		"lockfileVersion: '9.0'",
+		"",
+		"importers:",
+		"",
+		"  .:",
+		"    configDependencies:",
+		`      ${JSON.stringify(name)}:`,
+		`        specifier: ${JSON.stringify(version)}`,
+		`        version: ${JSON.stringify(version)}`,
+		"",
+		"packages:",
+		"",
+		`  ${key}:`,
+		`    resolution: {integrity: ${JSON.stringify(integrity)}}`,
+		"",
+		"snapshots:",
+		"",
+		`  ${key}: {}`,
+		"",
+		"---",
+		""
+	].join("\n");
+};
+/**
+* The `--store-dir` to hand pnpm so it writes into the store the ladder
+* searched first. Discovered stores are the versioned directories
+* (`<root>/v11`), and pnpm appends that segment itself, so a versioned
+* directory is passed as its parent. `undefined` (pnpm's own default) when no
+* store was discovered.
+*/
+const storeDirArgument = (stores) => {
+	const first = stores[0];
+	if (first === void 0) return void 0;
+	return /^v\d+$/.test(basename(first)) ? dirname(first) : first;
+};
+/** The pnpm argv for the verified fetch. */
+const fetchArgs = (scratch, stores) => {
+	const storeDir = storeDirArgument(stores);
+	return [
+		"install",
+		"--frozen-lockfile",
+		"--dir",
+		scratch,
+		...storeDir === void 0 ? [] : ["--store-dir", storeDir]
+	];
+};
+/** Whether `resolved` sits under a store's `links/<name>/<version>/` tree. */
+const isStoreEntry = (resolved, name, version) => resolved.split(/[/\\]/).join("/").includes(`/links/${name}/${version}/`);
+/**
+* Build the fetch rung over a spawner. Wired only by
+* `ConfigDependencyHooks.layerSubprocess`.
+*/
+const makeFetchConfigDependency = (spawner) => (request) => Effect.scoped(Effect.gen(function* () {
+	const { name, version } = request;
+	const key = `${name}@${version}`;
+	const failed = (message, cause) => fetchFailure("fetchFailed", message, cause);
+	const io = (what, run) => Effect.tryPromise({
+		try: run,
+		catch: (cause) => failed(`${what} failed: ${messageOf(cause)}`, cause)
+	});
+	const integrity = yield* expectedIntegrity(request);
+	const scratch = yield* Effect.acquireRelease(io("creating a scratch workspace", () => mkdtemp(join(tmpdir(), "effected-config-dependency-"))), (dir) => Effect.promise(() => rm(dir, {
+		recursive: true,
+		force: true
+	}).catch(() => void 0)));
+	const lockfile = scratchLockfile(name, version, integrity);
+	yield* io("writing the scratch workspace", async () => {
+		await writeFile(join(scratch, "pnpm-workspace.yaml"), scratchWorkspaceYaml(name, version));
+		await writeFile(join(scratch, "pnpm-lock.yaml"), lockfile);
+	});
+	const command = ChildProcess.make("pnpm", fetchArgs(scratch, request.stores), { cwd: scratch });
+	yield* Run.text(command, { timeout: FETCH_TIMEOUT }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner), Effect.mapError((cause) => failed(`fetching ${key} with \`pnpm ${fetchArgs("<scratch>", request.stores).join(" ")}\` failed: ${messageOf(cause)}`, cause)));
+	if ((yield* io("reading back the scratch lockfile", () => readFile(join(scratch, "pnpm-lock.yaml"), "utf8"))) !== lockfile) return yield* Effect.fail(failed(`fetching ${key}: pnpm rewrote the integrity-pinned scratch lockfile instead of installing from it, so the installed copy was not verified against the recorded integrity and is not used.`));
+	const linked = join(scratch, "node_modules", ".pnpm-config", name);
+	const resolved = yield* io(`resolving ${linked}`, () => realpath(linked));
+	const manifest = yield* manifestVersion(name, resolved).pipe(Effect.mapError((error) => failed(`the fetched ${key} has an unreadable package.json: ${messageOf(error.cause)}`, error.cause)));
+	if (!carries(manifest, version) || !isStoreEntry(resolved, name, version)) return yield* Effect.fail(failed(`fetching ${key}: pnpm linked ${resolved}, which is not a store copy of that version (its manifest reads ${manifest._tag === "version" ? manifest.version : "no version"}).`));
+	return resolved;
+}));
+
+//#endregion
+export { expectedIntegrity, fetchArgs, makeFetchConfigDependency, storeDirArgument };