@effected/workspaces 0.26.0 → 0.28.0-next-20260927062352

package/internal/configDependencyResolution.js

@@ -1,6 +1,9 @@
+import { carries, hooksError, ioOrNone, manifestVersion, sideLabel } from "./configDependencyShared.js";
+import { splitConfigDependencySpec } from "./configDependencySpecGrammar.js";
 import { Array, Duration, Effect, Exit, Option, Predicate, Result } from "effect";
-import { CatalogAssemblyError, PackageManagerCache } from "@effected/npm";
+import { PackageManagerCache } from "@effected/npm";
 import { Yaml } from "@effected/yaml";
+import { PnpmEnvLockfile } from "@effected/lockfiles";
 import { readFile, readdir, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
@@ -15,11 +18,13 @@ const PNPMFILE_CANDIDATES = [
 /**
 * The version part of a `configDependencies` spec: the text before the first
 * `+` (`0.9.0+sha512-…` → `0.9.0`); a bare `0.9.0` is returned whole.
+*
+* Deliberately lenient — it goes through the same split as the public
+* `ConfigDependencySpec` but validates neither half. See
+* `configDependencySpecGrammar.ts` for why replay must not adopt the strict
+* model's rejections.
 */
-const declaredVersionOf = (spec) => {
-	const plus = spec.indexOf("+");
-	return plus === -1 ? spec : spec.slice(0, plus);
-};
+const declaredVersionOf = (spec) => splitConfigDependencySpec(spec).version;
 /**
 * Whether a config-dependency `name` carries a `..` path segment. A scoped name
 * legitimately contains `/` (`@scope/pkg`), so only a `..` *segment* is rejected —
@@ -27,12 +32,6 @@ const declaredVersionOf = (spec) => {
 * dynamic `import()`.
 */
 const hasTraversalSegment = (name) => name.split(/[/\\]/).includes("..");
-/** The typed `hooks`-source failure every rung of the ladder reports through. */
-const hooksError = (path, cause) => new CatalogAssemblyError({
-	source: "hooks",
-	path,
-	cause
-});
 /**
 * The declared `(name, version)` pairs of a `configDependencies` map, in
 * declaration order, with EVERY name validated before any path is built from
@@ -42,36 +41,12 @@ const hooksError = (path, cause) => new CatalogAssemblyError({
 const declaredEntries = (configDependencies) => {
 	const entries = Object.entries(configDependencies).map(([name, spec]) => ({
 		name,
-		version: declaredVersionOf(spec)
+		version: declaredVersionOf(spec),
+		spec
 	}));
 	const traversal = entries.find((entry) => hasTraversalSegment(entry.name));
 	return traversal === void 0 ? Effect.succeed(entries) : Effect.fail(hooksError(traversal.name, /* @__PURE__ */ new Error(`config dependency name has a '..' path segment: ${traversal.name}`)));
 };
-/** Whether a `node:fs` rejection means "nothing there" (as opposed to a real IO failure). */
-const isAbsent = (cause) => Predicate.isObject(cause) && (cause.code === "ENOENT" || cause.code === "ENOTDIR");
-/**
-* Run a `node:fs/promises` call, mapping an absent target to `Option.none()`
-* and ANY other rejection (`EACCES`, `EIO`, …) to a typed `hooks` error
-* attributed to `path` — never a silent skip.
-*/
-const ioOrNone = (path, run) => Effect.tryPromise({
-	try: run,
-	catch: (cause) => cause
-}).pipe(Effect.map(Option.some), Effect.catch((cause) => isAbsent(cause) ? Effect.succeed(Option.none()) : Effect.fail(hooksError(path, cause))));
-/**
-* The `version` of the `package.json` in `dir`: `None` when the manifest is
-* absent, `Some("")` when present but carrying no string version (so it can
-* never match a declared version), typed on any other IO failure or on
-* unparseable JSON — a manifest that exists but cannot be read is not
-* evidence of absence.
-*/
-const manifestVersion = (name, dir) => ioOrNone(name, () => readFile(join(dir, "package.json"), "utf8")).pipe(Effect.flatMap((text) => {
-	if (Option.isNone(text)) return Effect.succeed(Option.none());
-	return Effect.try({
-		try: () => JSON.parse(text.value),
-		catch: (cause) => hooksError(name, cause)
-	}).pipe(Effect.map((parsed) => Option.some(Predicate.isObject(parsed) && typeof parsed.version === "string" ? parsed.version : "")));
-}));
 /** Directory entries of `dir`, or `[]` when it is absent; typed on any other failure. */
 const entriesOf = (path, dir) => ioOrNone(path, () => readdir(dir)).pipe(Effect.map(Option.getOrElse(() => [])));
 /** The `<root>/node_modules/.pnpm-config` directory. */
@@ -206,7 +181,7 @@ const findInStores = (name, declared, stores) => Effect.gen(function* () {
 		for (const hash of yield* entriesOf(name, versionDir)) {
 			const dir = join(versionDir, hash, "node_modules", name);
 			const version = yield* manifestVersion(name, dir);
-			if (Option.isSome(version) && version.value === declared) matches.push(dir);
+			if (carries(version, declared)) matches.push(dir);
 		}
 		if (matches.length > 0) return {
 			store,
@@ -220,12 +195,23 @@ const findInStores = (name, declared, stores) => Effect.gen(function* () {
 });
 /** The fail-closed message for a version ONE store holds more than once: which store, which copies, how to disambiguate. */
 const ambiguousMessage = (name, declared, store, matches) => `config dependency ${name}@${declared} is ambiguous: the pnpm store at ${store} holds ${matches.length} copies of that version (${matches.join(", ")}) and the store records no integrity to tell them apart, so none is replayed. Remove the stale copies, or install ${name}@${declared} in this workspace so node_modules/.pnpm-config answers instead.`;
-/** The fail-closed message: what was declared, what is installed, where we looked, and how to fix it. */
-const notInstalledMessage = (name, declared, installed, stores) => {
-	return `config dependency ${name}@${declared} is not installed: node_modules/.pnpm-config/${name} holds ${Option.match(installed, {
-		onNone: () => "nothing",
-		onSome: (version) => version === "" ? "a package with no version" : `version ${version}`
-	})}, and no store copy of ${name}@${declared} was found (${stores.length === 0 ? "no pnpm store directory could be located" : `searched ${stores.join(", ")}`}). Run \`pnpm add --config ${name}@${declared}\` in a throwaway workspace to populate the store, then retry.`;
+/**
+* The fail-closed message: what was declared, by which side, what is
+* installed, where we looked, why that happens, and how to fix it. `fetch`
+* is the fetch rung's failure when one ran.
+*/
+const notInstalledMessage = (name, declared, installed, stores, side, fetch) => {
+	const holds = installed._tag === "absent" ? "nothing" : installed._tag === "unversioned" ? "a package with no version" : `version ${installed.version}`;
+	const searched = stores.length === 0 ? "no pnpm store directory could be located" : `searched ${stores.join(", ")}`;
+	return [
+		`config dependency ${name}@${declared}${side.ref === void 0 ? "" : ` (declared at ${sideLabel(side)})`} is not installed: node_modules/.pnpm-config/${name} holds ${holds}, and no store copy of ${name}@${declared} was found (${searched}).`,
+		installed._tag === "version" && installed.version !== declared ? "This side declares a different version from the installed one, as the base side of a diff across a config-dependency bump does: that version was never installed in this checkout." : "",
+		Option.match(fetch, {
+			onNone: () => "This replay layer does not fetch; ConfigDependencyHooks.layerSubprocess, which the *Subprocess Workspaces composites use, fetches the declared version, verified, into the store.",
+			onSome: (failure) => failure.reason === "fetchFailed" ? `Fetching it into the store failed: ${failure.message}` : failure.message
+		}),
+		Option.exists(fetch, (failure) => failure.reason === "integrityMismatch") ? "" : `Run \`pnpm add --config ${name}@${declared}\` in a throwaway workspace to populate the store, then retry.`
+	].filter((sentence) => sentence !== "").join(" ");
 };
 /**
 * The first pnpmfile candidate present in `dir`, from ONE directory listing.
@@ -238,14 +224,26 @@ const pnpmfileIn = (name, dir) => entriesOf(name, dir).pipe(Effect.map((entries)
 /**
 * Resolve one declared config dependency to the directory holding its
 * declared version: `.pnpm-config` when it holds exactly that version, else
-* the store, else a typed fail-closed error. `stores` is the memoized
-* discovery, run at most once per {@link resolvePnpmfiles} call and only on
-* the first `.pnpm-config` miss.
+* the store, else the fetch rung when one is wired, else a typed fail-closed
+* error. `stores` is the memoized discovery, run at most once per
+* {@link resolvePnpmfiles} call and only on the first `.pnpm-config` miss;
+* `locks` is the declaring side's memoized lockfile decode, run at most once
+* per call and only by the fetch rung.
+*
+* @remarks
+* A fetch failure is folded into the not-installed message, so the error
+* still says what was declared, what is installed and where the ladder
+* looked, and it keeps the fetch rung's own `reason` (`integrityMismatch`,
+* `integrityUnavailable`, `fetchFailed`). The `pnpm add --config`
+* remediation is kept except for `integrityMismatch`, where the pins must be
+* reconciled first.
 */
-const resolveDirectory = (root, name, declared, stores) => Effect.gen(function* () {
+const resolveDirectory = (root, entry, stores, locks, options) => Effect.gen(function* () {
+	const { name, version: declared } = entry;
+	const side = options.side ?? {};
 	const installedDir = join(pnpmConfigDir(root), name);
 	const installed = yield* manifestVersion(name, installedDir);
-	if (Option.isSome(installed) && installed.value === declared) return {
+	if (carries(installed, declared)) return {
 		dir: installedDir,
 		source: "installed"
 	};
@@ -256,23 +254,51 @@ const resolveDirectory = (root, name, declared, stores) => Effect.gen(function*
 		dir: only,
 		source: "store"
 	};
-	if (only !== void 0) return yield* Effect.fail(hooksError(name, new Error(ambiguousMessage(name, declared, store, matches))));
-	return yield* Effect.fail(hooksError(name, new Error(notInstalledMessage(name, declared, installed, searched))));
+	if (only !== void 0) return yield* Effect.fail(hooksError(name, new Error(ambiguousMessage(name, declared, store, matches)), "ambiguous"));
+	const notInstalled = (fetch) => {
+		const message = notInstalledMessage(name, declared, installed, searched, side, fetch);
+		const cause = Option.getOrUndefined(fetch)?.cause;
+		return hooksError(name, cause === void 0 ? new Error(message) : new Error(message, { cause }), Option.match(fetch, {
+			onNone: () => "notInstalled",
+			onSome: (failure) => failure.reason
+		}));
+	};
+	if (options.fetch === void 0) return yield* Effect.fail(notInstalled(Option.none()));
+	return {
+		dir: yield* options.fetch({
+			name,
+			version: declared,
+			spec: entry.spec,
+			stores: searched,
+			side,
+			locks
+		}).pipe(Effect.mapError((failure) => notInstalled(Option.some(failure)))),
+		source: "fetched"
+	};
 });
 /**
+* A lazy memo of `effect`, scoped to one {@link resolvePnpmfiles} call: the
+* house success-only memo (never `Effect.cached`, which would pin an
+* interrupt), so a failed or interrupted run is retried by the next user.
+*/
+const memoizeSuccess = (effect) => Effect.map(Effect.cachedInvalidateWithTTL(effect, Duration.infinity), ([once, invalidate]) => Effect.onExit(once, (exit) => Exit.isSuccess(exit) ? Effect.void : invalidate));
+/**
 * Resolve every declared config dependency at its declared version, in
 * declaration order. A dependency that ships no pnpmfile is still returned
 * (resolved, `path` undefined — the one legitimate skip at replay time); a
 * `..` segment in a name, an unresolvable declared version, or any
 * non-absent IO failure fails typed as a `hooks`-source
-* `CatalogAssemblyError`.
+* `CatalogAssemblyError`. `options.fetch`, when wired, is tried for a version
+* found nowhere before that fails.
 */
-const resolvePnpmfiles = (root, configDependencies) => Effect.gen(function* () {
+const resolvePnpmfiles = (root, configDependencies, options = {}) => Effect.gen(function* () {
 	const entries = yield* declaredEntries(configDependencies);
-	const [discoverOnce, invalidate] = yield* Effect.cachedInvalidateWithTTL(discoverStores(root), Duration.infinity);
-	const stores = Effect.onExit(discoverOnce, (exit) => Exit.isSuccess(exit) ? Effect.void : invalidate);
-	return yield* Effect.forEach(entries, ({ name, version }) => Effect.gen(function* () {
-		const { dir, source } = yield* resolveDirectory(root, name, version, stores);
+	const stores = yield* memoizeSuccess(discoverStores(root));
+	const lockfile = options.side?.lockfile;
+	const locks = lockfile === void 0 ? Effect.succeed(void 0) : yield* memoizeSuccess(PnpmEnvLockfile.configDependencies(lockfile));
+	return yield* Effect.forEach(entries, (entry) => Effect.gen(function* () {
+		const { name, version } = entry;
+		const { dir, source } = yield* resolveDirectory(root, entry, stores, locks, options);
 		const pnpmfile = yield* pnpmfileIn(name, dir);
 		return {
 			name,

package/internal/configDependencyShared.js

@@ -0,0 +1,51 @@
+import { Effect, Option, Predicate } from "effect";
+import { CatalogAssemblyError } from "@effected/npm";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+//#region src/internal/configDependencyShared.ts
+/** The typed `hooks`-source failure every rung of the ladder reports through. */
+const hooksError = (path, cause, reason) => new CatalogAssemblyError({
+	source: "hooks",
+	path,
+	cause,
+	...reason === void 0 ? {} : { reason }
+});
+/** The message of a cause, for splicing into ours. */
+const messageOf = (cause) => cause instanceof Error ? cause.message : String(cause);
+/** Where the declared spec came from, for messages: `the working tree` or `ref <ref>`. */
+const sideLabel = (side) => side.ref === void 0 ? "the working tree" : `ref ${side.ref}`;
+/** Whether a `node:fs` rejection means "nothing there" (as opposed to a real IO failure). */
+const isAbsent = (cause) => Predicate.isObject(cause) && (cause.code === "ENOENT" || cause.code === "ENOTDIR");
+/**
+* Run a `node:fs/promises` call, mapping an absent target to `Option.none()`
+* and ANY other rejection (`EACCES`, `EIO`, …) to a typed `hooks` error
+* attributed to `path` — never a silent skip.
+*/
+const ioOrNone = (path, run) => Effect.tryPromise({
+	try: run,
+	catch: (cause) => cause
+}).pipe(Effect.map(Option.some), Effect.catch((cause) => isAbsent(cause) ? Effect.succeed(Option.none()) : Effect.fail(hooksError(path, cause))));
+const ABSENT = { _tag: "absent" };
+const UNVERSIONED = { _tag: "unversioned" };
+/** Whether a manifest carries exactly `declared`. Only a `version` state can. */
+const carries = (manifest, declared) => manifest._tag === "version" && manifest.version === declared;
+/**
+* The version state of the `package.json` in `dir`: `absent` when there is
+* no manifest, `unversioned` when it carries no non-empty string `version`,
+* typed on any other IO failure or on unparseable JSON — a manifest that
+* exists but cannot be read is not evidence of absence.
+*/
+const manifestVersion = (name, dir) => ioOrNone(name, () => readFile(join(dir, "package.json"), "utf8")).pipe(Effect.flatMap((text) => {
+	if (Option.isNone(text)) return Effect.succeed(ABSENT);
+	return Effect.try({
+		try: () => JSON.parse(text.value),
+		catch: (cause) => hooksError(name, cause)
+	}).pipe(Effect.map((parsed) => Predicate.isObject(parsed) && typeof parsed.version === "string" && parsed.version !== "" ? {
+		_tag: "version",
+		version: parsed.version
+	} : UNVERSIONED));
+}));
+
+//#endregion
+export { carries, hooksError, ioOrNone, manifestVersion, messageOf, sideLabel };

package/internal/configDependencySpecGrammar.js

@@ -0,0 +1,15 @@
+//#region src/internal/configDependencySpecGrammar.ts
+/** Split a spec on its first `+`: `0.9.0+sha512-…` → `{ version: "0.9.0", integrity: "sha512-…" }`. */
+const splitConfigDependencySpec = (spec) => {
+	const plus = spec.indexOf("+");
+	return plus === -1 ? {
+		version: spec,
+		integrity: void 0
+	} : {
+		version: spec.slice(0, plus),
+		integrity: spec.slice(plus + 1)
+	};
+};
+
+//#endregion
+export { splitConfigDependencySpec };

package/internal/packedInstallPlan.js

@@ -1,5 +1,5 @@
 import { RUNTIME_DEPENDENCY_FIELDS } from "./dependencyFields.js";
-import { Result } from "effect";
+import { Predicate, Result } from "effect";
 
 //#region src/internal/packedInstallPlan.ts
 /** Variables that carry the PARENT run's context into a child package manager. */
@@ -153,22 +153,87 @@ const installArgs = (manager, version) => {
 * is left alone: it resolves wherever the file exists.
 */
 const UNRESOLVABLE = /^(?:workspace:|catalog:|link:|file:(?!\/))/;
-/** Every specifier in a packed manifest's runtime maps that only the workspace could resolve (see `UNRESOLVABLE`). */
-const unresolvedSpecifiers = (manifestJson) => {
+/** Parse a packed manifest into the facts the run checks; the failure is the parse error or a non-object. */
+const readPackedManifest = (manifestJson) => {
 	let manifest;
 	try {
 		manifest = JSON.parse(manifestJson);
 	} catch (cause) {
 		return Result.fail(cause);
 	}
-	if (typeof manifest !== "object" || manifest === null) return Result.fail(/* @__PURE__ */ new Error("package.json is not an object"));
+	if (typeof manifest !== "object" || manifest === null || Array.isArray(manifest)) return Result.fail(/* @__PURE__ */ new Error("package.json is not an object"));
 	const record = manifest;
-	return Result.succeed(RUNTIME_DEPENDENCY_FIELDS.flatMap((field) => {
+	const name = typeof record.name === "string" ? record.name : void 0;
+	const unresolved = RUNTIME_DEPENDENCY_FIELDS.flatMap((field) => {
 		const block = record[field];
 		if (typeof block !== "object" || block === null) return [];
-		return Object.entries(block).filter(([, spec]) => typeof spec === "string" && UNRESOLVABLE.test(spec)).map(([name, spec]) => `${field}.${name}: ${String(spec)}`);
-	}));
+		return Object.entries(block).filter(([, spec]) => typeof spec === "string" && UNRESOLVABLE.test(spec)).map(([dependency, spec]) => `${field}.${dependency}: ${String(spec)}`);
+	});
+	const bin = record.bin;
+	const bins = typeof bin === "string" ? name === void 0 ? [] : [name.replace(/^@[^/]+\//, "")] : typeof bin === "object" && bin !== null && !Array.isArray(bin) ? Object.keys(bin) : [];
+	return Result.succeed({
+		name,
+		unresolved,
+		bins
+	});
+};
+/**
+* The file a manifest's `bin` declares for `name`: a `bin` object's entry, or
+* a `bin` string when `name` is the unscoped package name. `undefined` when
+* the manifest is not a JSON object or declares no such bin.
+*/
+const binTargetOf = (manifestJson, name) => {
+	let manifest;
+	try {
+		manifest = JSON.parse(manifestJson);
+	} catch {
+		return;
+	}
+	if (!Predicate.isObject(manifest) || Array.isArray(manifest)) return void 0;
+	const bin = manifest.bin;
+	if (typeof bin === "string") return typeof manifest.name === "string" && manifest.name.replace(/^@[^/]+\//, "") === name ? bin : void 0;
+	if (!Predicate.isObject(bin) || Array.isArray(bin)) return void 0;
+	const target = bin[name];
+	return typeof target === "string" && Object.hasOwn(bin, name) ? target : void 0;
+};
+/**
+* The first bin the carrier declares that another packed package declares
+* too. Under a flat layout (npm, bun, Yarn's `node-modules` linker) either
+* package can take `node_modules/.bin/<bin>`, so a bin check or a bin run
+* could pass on the wrong package. `PackedInstall.run` refuses it unless the
+* caller shares bin names deliberately (`allowSharedBins`).
+*/
+const binConflict = (carrier, others) => {
+	for (const bin of carrier.bins) {
+		const other = others.find((pkg) => pkg.name !== carrier.name && pkg.bins.includes(bin));
+		if (other !== void 0) return {
+			bin,
+			package: other.name
+		};
+	}
+};
+/** A bare package name, scoped or not: an override key carrying a selector (`a>b`, `a@1`) is not one. */
+const BARE_NAME = /^(?:@[^/@\s>]+\/)?[^/@\s>]+$/;
+/**
+* The `file:` entries of a parsed `pnpm-workspace.yaml`'s `overrides:` map,
+* name to the path after `file:` (relative paths are the caller's to resolve,
+* against the workspace root, as pnpm does). Entries that are not strings,
+* not `file:`, or keyed by anything but a bare package name are skipped, and
+* so is `__proto__`, which no npm package can be named. The map has no
+* prototype, so a package named `constructor` or `prototype` is an ordinary
+* own entry and a missing name never resolves to an inherited member.
+*/
+const fileOverridesOf = (document) => {
+	const out = Object.create(null);
+	if (!Predicate.isObject(document) || !Predicate.isObject(document.overrides) || Array.isArray(document.overrides)) return out;
+	for (const [name, spec] of Object.entries(document.overrides)) {
+		if (name === "__proto__") continue;
+		if (typeof spec === "string" && spec.startsWith("file:") && BARE_NAME.test(name)) out[name] = spec.slice(5);
+	}
+	return out;
 };
+/** An `overrides` value without the `file:` prefix a caller may copy from a workspace file. */
+const overridePath = (spec) => spec.startsWith("file:") ? spec.slice(5) : spec;
 
 //#endregion
-export { closureOf, consumerFiles, installArgs, scrubEnv, unresolvedSpecifiers, versionOf };
+export { binConflict, binTargetOf, closureOf, consumerFiles, fileOverridesOf, installArgs, overridePath, readPackedManifest, scrubEnv, versionOf };

package/internal/sourceText.js

@@ -19,6 +19,13 @@ const REGEX_AFTER = /* @__PURE__ */ new Set([
 	"yield",
 	"await"
 ]);
+/** Declaration keywords: the word after one is a binding name, so a `for (const of of xs)` binding named `of` is not the keyword. */
+const DECLARATIONS = /* @__PURE__ */ new Set([
+	"const",
+	"let",
+	"var",
+	"using"
+]);
 /** Keywords whose parenthesized condition may be followed directly by a statement, so a `/` after its `)` opens a regex. */
 const CONTROL = /* @__PURE__ */ new Set([
 	"if",
@@ -63,26 +70,45 @@ const lex = (text) => {
 		while (start >= 0 && isIdentifierChar(code[start])) start--;
 		return code.slice(start + 1, end + 1).join("");
 	};
+	/**
+	* Whether the code at offset `j` ends a binding a `for...of` head iterates
+	* into: a destructuring pattern, or a name that is neither a declaration
+	* keyword nor itself a keyword (`for (x in of / 2)` divides).
+	*/
+	const endsBinding = (j) => {
+		const char = code[j] ?? "";
+		if (char === "]" || char === "}") return true;
+		return isIdentifierChar(char) && !DECLARATIONS.has(wordAt(j)) && !isRegexKeyword(j);
+	};
+	/** Whether the identifier ending at code offset `j` is a keyword after which a `/` opens a regex. */
+	const isRegexKeyword = (j) => {
+		const word = wordAt(j);
+		if (!REGEX_AFTER.has(word)) return false;
+		const before = lastCode(j - word.length);
+		if (code[before] === "." && !(code[before - 1] === "." && code[before - 2] === ".")) return false;
+		if (word === "of") return parens.at(-1) === "for" && before >= 0 && endsBinding(before);
+		return true;
+	};
 	/** Whether the code at offset `j` ends an operand (a value a postfix operator or a `/` division can follow). */
 	const endsOperand = (j) => {
 		const char = code[j] ?? "";
-		return char === ")" || char === "]" || isIdentifierChar(char) && !REGEX_AFTER.has(wordAt(j));
+		return char === ")" || char === "]" || isIdentifierChar(char) && !isRegexKeyword(j);
 	};
 	/** Whether a `/` here opens a regex, judged by the last code token. */
 	const regexAllowed = () => {
 		const j = lastCode(code.length - 1);
 		if (j < 0) return true;
 		const last = code[j] ?? "";
-		if (isIdentifierChar(last)) return REGEX_AFTER.has(wordAt(j));
+		if (isIdentifierChar(last)) return isRegexKeyword(j);
 		if (last === "!") return !endsOperand(j - 1);
 		if ((last === "+" || last === "-") && code[j - 1] === last) return !endsOperand(lastCode(j - 2));
 		if (last === ")") return controlCloses.has(j);
 		return !"]}\"'`".includes(last);
 	};
-	/** Whether the `(` about to be emitted opens an if/while/for/with condition. */
+	/** The if/while/for/with keyword whose condition the `(` about to be emitted opens, if any. */
 	const opensCondition = () => {
 		const j = lastCode(code.length - 1);
-		if (j < 0 || !isIdentifierChar(code[j])) return false;
+		if (j < 0 || !isIdentifierChar(code[j])) return void 0;
 		let word = wordAt(j);
 		let end = j - word.length;
 		if (word === "await") {
@@ -90,7 +116,7 @@ const lex = (text) => {
 			word = end < 0 ? "" : wordAt(end);
 			end -= word.length;
 		}
-		return CONTROL.has(word) && code[lastCode(end)] !== ".";
+		return CONTROL.has(word) && code[lastCode(end)] !== "." ? word : void 0;
 	};
 	/** Consume a regex literal at `i` if one closes on this line; `false` leaves `i` untouched. */
 	const regex = () => {
@@ -212,7 +238,7 @@ const lex = (text) => {
 			emit(char, true, true);
 			i++;
 		} else if (char === ")") {
-			if (parens.pop() === true) controlCloses.add(code.length);
+			if (parens.pop() !== void 0) controlCloses.add(code.length);
 			emit(char, true, true);
 			i++;
 		} else if (char === "{") {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/workspaces",
-	"version": "0.26.0",
+	"version": "0.28.0-next-20260927062352",
 	"private": false,
 	"description": "Monorepo workspace tooling as Effect services — root discovery, package enumeration, the dependency graph, package-manager detection, pnpm catalog resolution, lockfile IO and git-based change detection.",
 	"keywords": [
@@ -55,9 +55,9 @@
 		"@effected/git": "^0.17.0",
 		"@effected/glob": "^0.8.0",
 		"@effected/jsonc": "^0.13.0",
-		"@effected/lockfiles": "^0.11.0",
-		"@effected/npm": "^0.16.0",
-		"@effected/package-json": "^0.17.0",
+		"@effected/lockfiles": "^0.12.0-next-20260927062352",
+		"@effected/npm": "^0.17.0-next-20260927062352",
+		"@effected/package-json": "^0.18.0-next-20260927062352",
 		"@effected/semver": "^0.9.0",
 		"@effected/walker": "^0.12.0",
 		"@effected/yaml": "^0.17.0",