@effected/workspaces 0.28.0-next-20260927071821 → 0.28.0

package/ConfigDependencyHooks.js

@@ -482,7 +482,19 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	* with `reason: "integrityUnavailable"` — nothing is fetched in either case
 	* — and a fetch that fails with `reason: "fetchFailed"`, keeping the
 	* not-installed remediation. The fetch needs `pnpm` 11 or 12 on `PATH` and
-	* registry access, and is bounded at two minutes. An empty `configDependencies`, or one whose dependencies all
+	* registry access, and is bounded at two minutes.
+	*
+	* The scratch workspace fetches through the same registries a
+	* `pnpm install` in the workspace would: the workspace root's `.npmrc` (scoped
+	* registries, mirrors, auth) is copied into it as-is, with `${VAR}`
+	* references left for pnpm to expand, never read or logged, and removed
+	* with the scratch; and the root `pnpm-workspace.yaml`'s `registry` and
+	* `registries` keys are carried into the scratch's. That is the CURRENT
+	* checkout's registry config for both sides of a diff — a base ref's
+	* `.npmrc` is not read through git — and relative paths inside the `.npmrc`
+	* (a `cafile=./ca.pem`) resolve against the scratch, not the root.
+	*
+	* An empty `configDependencies`, or one whose dependencies all
 	* ship no pnpmfile, returns the seed without spawning anything; a `..` path
 	* segment in a dependency name fails typed **before** any spawn; a
 	* load failure in the child — a syntax error, a throwing top level, an

package/LockfileReader.js

@@ -1,3 +1,4 @@
+import { findLayerRoot } from "./internal/layerRoot.js";
 import { WorkspaceRoot } from "./WorkspaceRoot.js";
 import { WorkspaceDiscovery } from "./WorkspaceDiscovery.js";
 import { PackageManagerDetector } from "./PackageManagerName.js";
@@ -60,7 +61,7 @@ var LockfileReader = class LockfileReader extends Context.Service()("@effected/w
 		const fs = yield* FileSystem.FileSystem;
 		const path = yield* Path.Path;
 		const init = Effect.gen(function* () {
-			const root = yield* Effect.suspend(() => roots.find(options?.cwd ?? process.cwd()));
+			const root = yield* findLayerRoot(roots, options);
 			const format = (yield* detector.detect(root)).name;
 			const lockfilePath = path.join(root, filenameFor(format));
 			const content = yield* fs.readFileString(lockfilePath).pipe(Effect.mapError((cause) => new LockfileReadError({

package/WorkspaceCatalogs.js

@@ -1,3 +1,4 @@
+import { findLayerRoot } from "./internal/layerRoot.js";
 import { WorkspaceRoot } from "./WorkspaceRoot.js";
 import { inlineCatalogs, merge, normalize, rangeOf } from "./internal/catalogs.js";
 import { ConfigDependencyHooks, NoPeerDependencyRules } from "./ConfigDependencyHooks.js";
@@ -342,7 +343,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 			}));
 		}));
 		const assemble = Effect.gen(function* () {
-			const root = yield* Effect.suspend(() => roots.find(options?.cwd ?? process.cwd()));
+			const root = yield* findLayerRoot(roots, options);
 			const lockfileOutputs = yield* lockfiles.read().pipe(Effect.map((lockfile) => ({
 				catalogs: CatalogSet.fromLockfile(lockfile),
 				importerVersions: importerVersionsOf(lockfile)

package/WorkspaceDiscovery.js

@@ -1,4 +1,5 @@
 import { enumerate } from "./internal/enumerate.js";
+import { findLayerRoot } from "./internal/layerRoot.js";
 import { readPatterns } from "./internal/patterns.js";
 import { WorkspacePackage } from "./WorkspacePackage.js";
 import { WorkspaceRoot } from "./WorkspaceRoot.js";
@@ -256,8 +257,7 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 			};
 		}).pipe(Effect.provideService(FileSystem.FileSystem, fs), Effect.provideService(Path.Path, path));
 		const discover = Effect.gen(function* () {
-			const stopAt = options?.stopAt;
-			const root = yield* Effect.suspend(() => roots.find(options?.cwd ?? process.cwd(), stopAt === void 0 ? void 0 : { stopAt }));
+			const root = yield* findLayerRoot(roots, options);
 			return yield* discoverAt(root);
 		});
 		const [resolveOnce, invalidate] = yield* Effect.cachedInvalidateWithTTL(discover, Duration.infinity);

package/WorkspaceSnapshots.js

@@ -1,3 +1,4 @@
+import { findLayerRoot } from "./internal/layerRoot.js";
 import { manifestPatternsOf, pnpmPatternsOf } from "./internal/patterns.js";
 import { WorkspaceRoot } from "./WorkspaceRoot.js";
 import { WorkspaceDiscovery } from "./WorkspaceDiscovery.js";
@@ -210,7 +211,7 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@ef
 		const atCaches = /* @__PURE__ */ new Map();
 		return {
 			at: Effect.fn("WorkspaceSnapshots.at")(function* (ref) {
-				const root = yield* Effect.suspend(() => roots.find(options?.cwd ?? process.cwd()));
+				const root = yield* findLayerRoot(roots, options);
 				const key = `${root}\0${ref}`;
 				let memo = atCaches.get(key);
 				if (memo === void 0) {

package/Workspaces.js

@@ -48,7 +48,8 @@ const localExecLayer = (options) => Layer.effect(LocalExec, Effect.gen(function*
 	const detector = yield* PackageManagerDetector;
 	return { context: Effect.gen(function* () {
 		const cwd = options?.cwd ?? globalThis.process?.cwd?.() ?? "/";
-		const root = yield* roots.find(cwd).pipe(Effect.asSome, Effect.orElseSucceed(Option.none));
+		const stopAt = options?.stopAt;
+		const root = yield* roots.find(cwd, stopAt === void 0 ? void 0 : { stopAt }).pipe(Effect.asSome, Effect.orElseSucceed(Option.none));
 		if (Option.isNone(root)) return Option.none();
 		const detected = yield* detector.detect(root.value).pipe(Effect.asSome, Effect.catchTag("PackageManagerDetectionError", () => Effect.succeed(Option.none())), Effect.mapError((cause) => new LocalExecError({
 			directory: root.value,
@@ -289,7 +290,10 @@ var Workspaces = class {
 	* verbatim.
 	*
 	* `directory` is the resolved **workspace root**, not the caller's cwd: a
-	* project-local launcher has to run where the workspace is.
+	* project-local launcher has to run where the workspace is. `stopAt` caps
+	* that ascent exactly as {@link WorkspacesOptions.stopAt} does, and a
+	* ceiling with no root at or below it is the same `Option.none()` as no
+	* root at all.
 	*
 	* A consumer with no monorepo never needs this layer, and therefore never
 	* installs this package — `LocalExec.layerNone` and `LocalExec.layerFor`

package/index.d.ts

@@ -560,6 +560,11 @@ interface WorkspaceDiscoveryOptions {
    * directory the caller names, which a single layer-level ceiling cannot
    * sensibly bound, so they ascend unbounded as before.
    *
+   * `LockfileReader`, `WorkspaceCatalogs` and `WorkspaceSnapshots` each
+   * take the same option; give them the same
+   * value when wiring by hand, or let a `Workspaces.*` composite forward one
+   * `stopAt` to all of them, so no service adopts a root another refused.
+   *
    * @defaultValue no ceiling — the ascent runs to the filesystem root.
    */
   readonly stopAt?: string | undefined;
@@ -1252,7 +1257,19 @@ export declare class ConfigDependencyHooks extends ConfigDependencyHooks_base {
    * with `reason: "integrityUnavailable"` — nothing is fetched in either case
    * — and a fetch that fails with `reason: "fetchFailed"`, keeping the
    * not-installed remediation. The fetch needs `pnpm` 11 or 12 on `PATH` and
-   * registry access, and is bounded at two minutes. An empty `configDependencies`, or one whose dependencies all
+   * registry access, and is bounded at two minutes.
+   *
+   * The scratch workspace fetches through the same registries a
+   * `pnpm install` in the workspace would: the workspace root's `.npmrc` (scoped
+   * registries, mirrors, auth) is copied into it as-is, with `${VAR}`
+   * references left for pnpm to expand, never read or logged, and removed
+   * with the scratch; and the root `pnpm-workspace.yaml`'s `registry` and
+   * `registries` keys are carried into the scratch's. That is the CURRENT
+   * checkout's registry config for both sides of a diff — a base ref's
+   * `.npmrc` is not read through git — and relative paths inside the `.npmrc`
+   * (a `cafile=./ca.pem`) resolve against the scratch, not the root.
+   *
+   * An empty `configDependencies`, or one whose dependencies all
    * ship no pnpmfile, returns the seed without spawning anything; a `..` path
    * segment in a dependency name fails typed **before** any spawn; a
    * load failure in the child — a syntax error, a throwing top level, an
@@ -2054,6 +2071,21 @@ interface LockfileReaderOptions {
    * @defaultValue `process.cwd()`, read lazily on first use.
    */
   readonly cwd?: string;
+  /**
+   * A ceiling for the root ascent from `cwd`, passed straight through to the
+   * `stopAt` of {@link WorkspaceRoot}'s `find`.
+   *
+   * @remarks
+   * Inclusive, and resolved to an absolute path exactly as `cwd` is. When no
+   * root is found at or below the ceiling, `read` fails with
+   * {@link WorkspaceRootNotFoundError} carrying the resolved `stopAt` rather
+   * than adopting an enclosing directory's workspace. Pass the same value as
+   * {@link WorkspaceDiscoveryOptions.stopAt} so every service agrees on the
+   * root; the `Workspaces.*` composites forward one `stopAt` to all of them.
+   *
+   * @defaultValue no ceiling — the ascent runs to the filesystem root.
+   */
+  readonly stopAt?: string | undefined;
 }
 declare const LockfileReader_base: Context.ServiceClass<LockfileReader, "@effected/workspaces/LockfileReader", LockfileReaderShape>;
 /**
@@ -3131,6 +3163,21 @@ interface WorkspaceCatalogsOptions {
    * @defaultValue `process.cwd()`, read lazily on first use.
    */
   readonly cwd?: string;
+  /**
+   * A ceiling for the root ascent from `cwd`, passed straight through to the
+   * `stopAt` of {@link WorkspaceRoot}'s `find`.
+   *
+   * @remarks
+   * Inclusive, and resolved to an absolute path exactly as `cwd` is. When no
+   * root is found at or below the ceiling, catalog assembly fails with
+   * {@link WorkspaceRootNotFoundError} carrying the resolved `stopAt` rather
+   * than adopting an enclosing directory's workspace. Pass the same value as
+   * {@link WorkspaceDiscoveryOptions.stopAt} so every service agrees on the
+   * root; the `Workspaces.*` composites forward one `stopAt` to all of them.
+   *
+   * @defaultValue no ceiling — the ascent runs to the filesystem root.
+   */
+  readonly stopAt?: string | undefined;
 }
 declare const WorkspaceCatalogs_base: Context.ServiceClass<WorkspaceCatalogs, "@effected/workspaces/WorkspaceCatalogs", WorkspaceCatalogsShape>;
 /**
@@ -3684,6 +3731,21 @@ interface WorkspaceSnapshotsOptions {
    *   first call is honoured.
    */
   readonly cwd?: string;
+  /**
+   * A ceiling for the root ascent from `cwd`, passed straight through to the
+   * `stopAt` of {@link WorkspaceRoot}'s `find`.
+   *
+   * @remarks
+   * Inclusive, and resolved to an absolute path exactly as `cwd` is. When no
+   * root is found at or below the ceiling, `at(ref)` fails with
+   * {@link WorkspaceRootNotFoundError} carrying the resolved `stopAt` rather
+   * than adopting an enclosing directory's workspace. Pass the same value as
+   * {@link WorkspaceDiscoveryOptions.stopAt} so every service agrees on the
+   * root; the `Workspaces.*` composites forward one `stopAt` to all of them.
+   *
+   * @defaultValue no ceiling — the ascent runs to the filesystem root.
+   */
+  readonly stopAt?: string | undefined;
   /**
    * Catalogs every snapshot this service produces carries as its
    * `seededCatalogs` — consulted only where the snapshot's own catalogs cannot
@@ -3851,9 +3913,17 @@ export declare class WorkspaceSnapshots extends WorkspaceSnapshots_base {
 /**
  * Options shared by the composite layers.
  *
+ * @remarks
+ * Derived from the option shapes of the services a composite builds —
+ * {@link WorkspaceDiscoveryOptions}, {@link LockfileReaderOptions} and
+ * {@link WorkspaceCatalogsOptions} — and handed to each of them unchanged, so a
+ * root-resolving option one service grows cannot silently stop at the
+ * composite. `cwd` and `stopAt` are re-declared here only to document them as
+ * the one concern they are across the composite.
+ *
  * @public
  */
-interface WorkspacesOptions {
+interface WorkspacesOptions extends WorkspaceDiscoveryOptions, LockfileReaderOptions, WorkspaceCatalogsOptions {
   /**
    * The directory every root-consuming service resolves the workspace root
    * from — one explicit concern, applied uniformly.
@@ -3861,8 +3931,23 @@ interface WorkspacesOptions {
    * @defaultValue `process.cwd()`, read lazily on first use.
    */
   readonly cwd?: string;
-  /** Descent cap for segment-crossing `packages:` patterns. Defaults to 32. */
-  readonly maxDepth?: number;
+  /**
+   * A ceiling for the root ascent from `cwd`, forwarded to EVERY
+   * root-resolving service the composite builds — {@link WorkspaceDiscovery},
+   * {@link LockfileReader}, {@link WorkspaceCatalogs} and, on the git
+   * composites, {@link WorkspaceSnapshots}.
+   *
+   * @remarks
+   * Inclusive and resolved to an absolute path, as {@link WorkspaceRoot}'s
+   * `find` does. Pass `stopAt: cwd` for a checkout nested inside someone
+   * else's workspace: every service then fails with
+   * {@link WorkspaceRootNotFoundError} consistently, instead of discovery
+   * refusing the enclosing workspace while the lockfile and catalog reads
+   * adopt it. A checkout that is itself a workspace root still resolves.
+   *
+   * @defaultValue no ceiling — the ascent runs to the filesystem root.
+   */
+  readonly stopAt?: string | undefined;
 }
 /**
  * Options for the composites that additionally provide {@link WorkspaceSnapshots}
@@ -4108,7 +4193,10 @@ export declare class Workspaces {
    * verbatim.
    *
    * `directory` is the resolved **workspace root**, not the caller's cwd: a
-   * project-local launcher has to run where the workspace is.
+   * project-local launcher has to run where the workspace is. `stopAt` caps
+   * that ascent exactly as {@link WorkspacesOptions.stopAt} does, and a
+   * ceiling with no root at or below it is the same `Option.none()` as no
+   * root at all.
    *
    * A consumer with no monorepo never needs this layer, and therefore never
    * installs this package — `LocalExec.layerNone` and `LocalExec.layerFor`
@@ -4137,6 +4225,7 @@ export declare class Workspaces {
    */
   static readonly localExecLayer: (options?: {
     readonly cwd?: string;
+    readonly stopAt?: string | undefined;
   }) => Layer.Layer<LocalExec, never, PackageManagerDetector | WorkspaceRoot>;
   /**
    * Resolve every `catalog:` and `workspace:` specifier in one `Manifest`

package/internal/configDependencyFetch.js

@@ -1,10 +1,11 @@
 import { carries, manifestVersion, messageOf, sideLabel } from "./configDependencyShared.js";
 import { splitConfigDependencySpec } from "./configDependencySpecGrammar.js";
-import { Duration, Effect } from "effect";
+import { Duration, Effect, Predicate } from "effect";
 import { IntegrityHash } from "@effected/npm";
+import { Yaml } from "@effected/yaml";
 import { Run } from "@effected/commands";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { copyFile, mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 
@@ -47,12 +48,36 @@ const expectedIntegrity = (request) => Effect.gen(function* () {
 	if (integrity === void 0) return yield* Effect.fail(fetchFailure("integrityUnavailable", `config dependency ${key} must be fetched, but ${sideLabel(side)} records no integrity for it (no inline integrity in pnpm-workspace.yaml and no pnpm-lock.yaml entry for that version), so a fetched copy could not be verified and nothing was fetched.`));
 	return integrity;
 });
+/** The {@link RegistrySettings} of a parsed `pnpm-workspace.yaml` document. */
+const registrySettingsOf = (document) => {
+	if (!Predicate.isObject(document)) return { registries: {} };
+	const registries = {};
+	if (Predicate.isObject(document.registries)) {
+		for (const [scope, url] of Object.entries(document.registries)) if (typeof url === "string") registries[scope] = url;
+	}
+	return typeof document.registry === "string" ? {
+		registry: document.registry,
+		registries
+	} : { registries };
+};
 /**
-* The scratch workspace's `pnpm-workspace.yaml`. Every scalar is a
+* The scratch workspace's `pnpm-workspace.yaml`: the one config dependency,
+* plus the declaring workspace's registry settings. Every key and scalar is a
 * JSON-quoted string, which YAML reads verbatim, so no declared text can
 * change the document's structure.
 */
-const scratchWorkspaceYaml = (name, version) => `configDependencies:\n  ${JSON.stringify(name)}: ${JSON.stringify(version)}\n`;
+const scratchWorkspaceYaml = (name, version, settings = { registries: {} }) => {
+	const lines = ["configDependencies:", `  ${JSON.stringify(name)}: ${JSON.stringify(version)}`];
+	if (settings.registry !== void 0) lines.push(`registry: ${JSON.stringify(settings.registry)}`);
+	const scopes = Object.entries(settings.registries);
+	if (scopes.length > 0) {
+		lines.push("registries:");
+		for (const [scope, url] of scopes) lines.push(`  ${JSON.stringify(scope)}: ${JSON.stringify(url)}`);
+	}
+	return `${lines.join("\n")}\n`;
+};
+/** Whether `error` is a node filesystem "no such file" failure. */
+const isNotFound = (error) => Predicate.isObject(error) && error.code === "ENOENT";
 /**
 * The scratch workspace's `pnpm-lock.yaml`: the env preamble pnpm 11 and 12
 * write for a lone config dependency, pinned to `integrity`, followed by the
@@ -123,14 +148,22 @@ const makeFetchConfigDependency = (spawner) => (request) => Effect.scoped(Effect
 		catch: (cause) => failed(`${what} failed: ${messageOf(cause)}`, cause)
 	});
 	const integrity = yield* expectedIntegrity(request);
+	const rootYaml = yield* io("reading the workspace pnpm-workspace.yaml", () => readFile(join(request.root, "pnpm-workspace.yaml"), "utf8").catch((error) => {
+		if (isNotFound(error)) return void 0;
+		throw error;
+	}));
+	const settings = rootYaml === void 0 ? registrySettingsOf(void 0) : registrySettingsOf(yield* Yaml.parse(rootYaml).pipe(Effect.mapError((cause) => failed(`reading the workspace pnpm-workspace.yaml failed: ${messageOf(cause)}`, cause))));
 	const scratch = yield* Effect.acquireRelease(io("creating a scratch workspace", () => mkdtemp(join(tmpdir(), "effected-config-dependency-"))), (dir) => Effect.promise(() => rm(dir, {
 		recursive: true,
 		force: true
 	}).catch(() => void 0)));
 	const lockfile = scratchLockfile(name, version, integrity);
 	yield* io("writing the scratch workspace", async () => {
-		await writeFile(join(scratch, "pnpm-workspace.yaml"), scratchWorkspaceYaml(name, version));
+		await writeFile(join(scratch, "pnpm-workspace.yaml"), scratchWorkspaceYaml(name, version, settings));
 		await writeFile(join(scratch, "pnpm-lock.yaml"), lockfile);
+		await copyFile(join(request.root, ".npmrc"), join(scratch, ".npmrc")).catch((error) => {
+			if (!isNotFound(error)) throw error;
+		});
 	});
 	const command = ChildProcess.make("pnpm", fetchArgs(scratch, request.stores), { cwd: scratch });
 	yield* Run.text(command, { timeout: FETCH_TIMEOUT }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner), Effect.mapError((cause) => failed(`fetching ${key} with \`pnpm ${fetchArgs("<scratch>", request.stores).join(" ")}\` failed: ${messageOf(cause)}`, cause)));
@@ -143,4 +176,4 @@ const makeFetchConfigDependency = (spawner) => (request) => Effect.scoped(Effect
 }));
 
 //#endregion
-export { expectedIntegrity, fetchArgs, makeFetchConfigDependency, storeDirArgument };
+export { expectedIntegrity, fetchArgs, makeFetchConfigDependency, registrySettingsOf, scratchWorkspaceYaml, storeDirArgument };

package/internal/configDependencyResolution.js

@@ -266,6 +266,7 @@ const resolveDirectory = (root, entry, stores, locks, options) => Effect.gen(fun
 	if (options.fetch === void 0) return yield* Effect.fail(notInstalled(Option.none()));
 	return {
 		dir: yield* options.fetch({
+			root,
 			name,
 			version: declared,
 			spec: entry.spec,

package/internal/layerRoot.js

@@ -0,0 +1,14 @@
+import { Effect } from "effect";
+
+//#region src/internal/layerRoot.ts
+/**
+* Resolve the workspace root a layer's options name. `Effect.suspend` so the
+* ambient `process.cwd()` is read at first use, not at layer construction.
+*/
+const findLayerRoot = (roots, options) => Effect.suspend(() => {
+	const stopAt = options?.stopAt;
+	return roots.find(options?.cwd ?? process.cwd(), stopAt === void 0 ? void 0 : { stopAt });
+});
+
+//#endregion
+export { findLayerRoot };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/workspaces",
-	"version": "0.28.0-next-20260927071821",
+	"version": "0.28.0",
 	"private": false,
 	"description": "Monorepo workspace tooling as Effect services — root discovery, package enumeration, the dependency graph, package-manager detection, pnpm catalog resolution, lockfile IO and git-based change detection.",
 	"keywords": [
@@ -55,9 +55,9 @@
 		"@effected/git": "^0.17.0",
 		"@effected/glob": "^0.8.0",
 		"@effected/jsonc": "^0.13.0",
-		"@effected/lockfiles": "^0.12.0-next-20260927071821",
-		"@effected/npm": "^0.17.0-next-20260927071821",
-		"@effected/package-json": "^0.18.0-next-20260927071821",
+		"@effected/lockfiles": "^0.12.0",
+		"@effected/npm": "^0.17.0",
+		"@effected/package-json": "^0.18.0",
 		"@effected/semver": "^0.9.0",
 		"@effected/walker": "^0.12.0",
 		"@effected/yaml": "^0.17.0",

package/testing.d.ts

@@ -652,6 +652,11 @@ interface WorkspaceDiscoveryOptions {
    * directory the caller names, which a single layer-level ceiling cannot
    * sensibly bound, so they ascend unbounded as before.
    *
+   * `LockfileReader`, `WorkspaceCatalogs` and `WorkspaceSnapshots` each
+   * take the same option; give them the same
+   * value when wiring by hand, or let a `Workspaces.*` composite forward one
+   * `stopAt` to all of them, so no service adopts a root another refused.
+   *
    * @defaultValue no ceiling — the ascent runs to the filesystem root.
    */
   readonly stopAt?: string | undefined;