@effected/workspaces 0.28.0 → 0.29.0

package/LockfileReader.js

@@ -69,7 +69,11 @@ var LockfileReader = class LockfileReader extends Context.Service()("@effected/w
 				format,
 				cause
 			})));
-			const lockfile = yield* Lockfile.parse(content, { format });
+			const configOnly = format === "pnpm" && !(yield* fs.exists(path.join(root, "package.json")).pipe(Effect.orElseSucceed(() => true)));
+			const lockfile = yield* Lockfile.parse(content, {
+				format,
+				configOnly
+			});
 			if (format !== "pnpm") return lockfile;
 			const importers = lockfile.packages.filter((pkg) => pkg.isWorkspace && pkg.relativePath !== void 0);
 			const resolved = yield* Effect.forEach(importers, (pkg) => readName(path.join(root, pkg.relativePath, "package.json")).pipe(Effect.map((name) => [pkg.relativePath, name])), { concurrency: 10 });

package/PeerCheck.js

@@ -1,6 +1,6 @@
 import { indexInstances, rootInstances } from "./internal/roots.js";
 import { peerNameMatcher } from "./internal/peerPatterns.js";
-import { Result, Schema } from "effect";
+import { Option, Result, Schema } from "effect";
 import { Range, SemVer } from "@effected/semver";
 
 //#region src/PeerCheck.ts
@@ -79,6 +79,316 @@ const PEER_RESOLVING_FORMATS = /* @__PURE__ */ new Set([
 /** @internal */
 const supportsPeerResolution = (format) => PEER_RESOLVING_FORMATS.has(format);
 /**
+* The protocol pnpm records a workspace-directory resolution under, passed
+* through verbatim on `ImporterDependency.version` by `@effected/lockfiles`.
+*
+* @internal
+*/
+const LINK_PREFIX = "link:";
+/**
+* The workspace-relative directory a `link:` version names, resolved against
+* the importer that recorded it.
+*
+* @remarks
+* `link:../a` in `packages/b` is `packages/a`. Deliberately pure string
+* arithmetic rather than `node:path`: `link:` targets are spelled POSIX in a
+* lockfile, and a Windows host would otherwise translate them to backslashes
+* and stop matching the importer paths the same file uses.
+*
+* @internal
+*/
+const linkTargetPath = (importerPath, target) => {
+	const segments = importerPath === "." ? [] : importerPath.split("/");
+	const resolved = [];
+	for (const segment of [...segments, ...target.split("/")]) {
+		if (segment === "" || segment === ".") continue;
+		if (segment === "..") {
+			resolved.pop();
+			continue;
+		}
+		resolved.push(segment);
+	}
+	return resolved.length === 0 ? "." : resolved.join("/");
+};
+/**
+* An importer's walk roots with its `link:` targets seeded in.
+*
+* @remarks
+* An importer with its own workspace row already reaches its link targets
+* through that row's `resolved` edges. One without — the ROOT under pnpm —
+* does not: the shared join composes `name@link:…`, matches no instance, and
+* drops the dependency, so a covered target there would never be walked.
+* Seeding the target rows here, rather than forking the shared join in
+* `internal/roots.ts`, keeps `DuplicateCheck` on the join it was measured
+* against while letting the peer walk judge the root's linked parents against
+* the root's own provider context, as pnpm does (`linkdeep-root/`).
+*
+* An importer the shared join gave up on is rescued only when EVERY versioned
+* dependency it has is a `link:` edge with a row: that failure was then the
+* missing link seed and nothing else. Any other unjoinable dependency keeps the
+* importer unresolved.
+*
+* @internal
+*/
+const withLinkRoots = (roots, links, dependencies) => {
+	const rows = links.flatMap((link) => link.row === void 0 ? [] : [link.row]);
+	if (roots?._tag === "own" || rows.length === 0) return roots;
+	if (roots === void 0) {
+		if (dependencies.filter((dep) => dep.version !== void 0).length !== rows.length) return void 0;
+		return {
+			_tag: "dependencies",
+			instances: rows
+		};
+	}
+	return {
+		_tag: "dependencies",
+		instances: [...roots.instances, ...rows]
+	};
+};
+/**
+* The workspace-relative directories a `link:` to `pkg` can name.
+*
+* @remarks
+* The package directory always, and — when `publishConfig.directory` is set
+* and `publishConfig.linkDirectory` is not `false` — the publish directory
+* inside it, because that is where pnpm links a workspace dependency then.
+* Measured against pnpm 12.6.0, not assumed: `directory` alone records
+* `link:../a/dist` (`linkdeep-directory/`, byte-identical with and without
+* `linkDirectory: true`), and `linkDirectory: false` records `link:../a`
+* (`linkdeep-directory-false/`). pnpm defaults `linkDirectory` to true.
+*
+* pnpm reads a publish-directory target's peers from the manifest AT that
+* target — the built one — while the join reads the supplied source manifest
+* and resolves `catalog:` ranges through the caller's catalogs. The two agree
+* exactly when the build emits the peer ranges the source's specifiers
+* resolve to, which is the contract a publish-directory build keeps.
+*
+* @internal
+*/
+const linkTargetsOf = (relativePath, pkg) => {
+	const directory = pkg.publishConfig?.directory;
+	if (directory === void 0 || pkg.publishConfig?.linkDirectory === false) return [relativePath];
+	const published = linkTargetPath(relativePath, directory);
+	return published === relativePath ? [relativePath] : [relativePath, published];
+};
+/**
+* The dependency instances a joined parent's peers resolve against.
+*
+* @remarks
+* **The importer's own dependency set, not the workspace's.** Measured
+* against pnpm 12.5.1 and 12.6.0 on the `linkdeep*` probe workspace, one
+* variable at a time: `react@18.3.1` as `packages/b`'s OWN dependency leaves
+* the linked `probe-a`'s `react: ^18.0.0` peer satisfied (pnpm 12.5.1 reports
+* the importer clean), the same version installed only by a SIBLING importer
+* does not (`packages/b` reports it missing), and `react@17.0.2` of its own
+* is a `bad` row carrying `foundVersion: "17.0.2"`. A workspace-wide
+* name lookup — the obvious shortcut, since the instances are all in one
+* lockfile — would have reported the sibling case clean, which pnpm does not.
+*
+* Both root shapes answer the same question: an importer with its own
+* workspace row resolves peers against that row's recorded edges, and an
+* importer without one (the root under pnpm, npm and bun) against the
+* instances its dependency records joined to.
+*
+* @internal
+*/
+const providerContext = (roots, byId, links) => {
+	const context = /* @__PURE__ */ new Map();
+	if (roots._tag === "dependencies") {
+		for (const instance of roots.instances) context.set(instance.name, instance);
+		for (const link of links) if (link.row !== void 0) context.set(link.name, link.row);
+		return context;
+	}
+	for (const [name, instanceId] of Object.entries(roots.instance.resolved)) {
+		const provider = byId.get(instanceId);
+		if (provider !== void 0) context.set(name, provider);
+	}
+	return context;
+};
+/**
+* The supplied manifest for a node the walk reached through a covered `link:`
+* edge, or `undefined` for every other node.
+*
+* @remarks
+* The importer's OWN node is deliberately excluded — {@link collect} only
+* consults this for nodes with a non-empty chain. pnpm reports nothing for a
+* linked package's own unsatisfied peers (it reports them through a consumer),
+* so joining them onto the importer's own chain would emit rows the oracle
+* does not have.
+*
+* @internal
+*/
+const joinedManifest = (join, instance) => {
+	if (instance.relativePath === void 0 || !join.joinable.has(instance.instanceId)) return void 0;
+	return join.manifests.get(instance.relativePath);
+};
+/**
+* The peers a joined manifest marks optional.
+*
+* @remarks
+* Read from the raw manifest record rather than from a typed model, because
+* `WorkspacePackage` carries `peerDependenciesMeta` as it was written, exactly
+* as the lockfile model carries its own. A malformed block yields no optional
+* peers, which is the stricter answer: an unsatisfied peer is reported rather
+* than silently excused.
+*
+* @internal
+*/
+const optionalPeers = (manifest) => {
+	const optional = /* @__PURE__ */ new Set();
+	const meta = manifest.manifestRecord.peerDependenciesMeta;
+	if (typeof meta !== "object" || meta === null) return optional;
+	for (const [name, entry] of Object.entries(meta)) if (typeof entry === "object" && entry !== null && entry.optional === true) optional.add(name);
+	return optional;
+};
+/**
+* The chain element a node contributes, named from the supplied manifest when
+* the node is a joined link target.
+*
+* @remarks
+* The lockfile names a workspace row by its DIRECTORY (`packages/a`) at the
+* placeholder version `0.0.0`, because pnpm records neither for an importer;
+* `pnpm peers check` reports the real `probe-a@1.0.0` it read from the
+* manifest, and the supplied manifest is the only place those two facts exist.
+*
+* @internal
+*/
+const parentLabel = (join, instance) => {
+	const manifest = joinedManifest(join, instance);
+	return PeerParent.make({
+		name: manifest?.name ?? instance.name,
+		version: manifest?.version ?? instance.version
+	});
+};
+/**
+* A range or version that is really a protocol specifier (`catalog:`,
+* `workspace:`, `npm:`, `file:` …). Neither a semver range nor a semver
+* version starts with `<scheme>:`.
+*
+* @internal
+*/
+const PROTOCOL_SPECIFIER = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+/**
+* Whether a declared range or a resolved version is a protocol specifier
+* rather than something semver can compare.
+*
+* @remarks
+* The one test both halves of a comparison use: a range that is one yields
+* `"peerRangeUnresolved"`, a provider version that is one (`file:vendor/x`,
+* which `@effected/lockfiles` passes through for a `file:` provider) yields
+* `"peerVersionUnresolved"`.
+*
+* @internal
+*/
+const isProtocolSpecifier = (value) => PROTOCOL_SPECIFIER.test(value);
+/** @internal */
+const CATALOG_PREFIX = "catalog:";
+/**
+* The range a joined manifest's declared peer specifier stands for, or
+* `undefined` when it is a protocol specifier that cannot be resolved.
+*
+* @remarks
+* A `catalog:` specifier resolves through the caller's catalogs; an omitted
+* set resolves nothing, since nothing was looked up. A resolution that is
+* itself a protocol specifier is no more a range than the input was. A plain
+* range passes through untouched, parseable or not — an unparseable
+* non-protocol range is declined as {@link judge} declines one.
+*
+* @internal
+*/
+const resolvePeerRange = (catalogs, peer, wanted) => {
+	let range = wanted;
+	if (wanted.startsWith(CATALOG_PREFIX)) {
+		const resolved = catalogs === void 0 ? Option.none() : catalogs.resolveSpecifier(peer, wanted);
+		if (Option.isNone(resolved)) return void 0;
+		range = resolved.value;
+	}
+	return isProtocolSpecifier(range) ? void 0 : range;
+};
+/** @internal */
+const SATISFIED = { _tag: "satisfied" };
+/**
+* A lockfile row's {@link Verdict}, carrying the declared range as `wanted`.
+*
+* @internal
+*/
+const withWanted = (verdict, wanted) => verdict._tag === "unsatisfied" ? {
+	...verdict,
+	wanted
+} : verdict;
+/**
+* Compare a resolved version against a wanted range, both already known not
+* to be protocol specifiers.
+*
+* @remarks
+* Either side failing to parse is `"satisfied"` in the sense of "no row":
+* asserting "unsatisfied" on a comparison that was never performed would be a
+* wrong answer rather than a gap (see {@link PeerCheck.run}).
+*
+* @internal
+*/
+const compare = (wanted, found) => {
+	const range = Range.parseResult(wanted);
+	const version = SemVer.parseResult(found);
+	if (Result.isFailure(range) || Result.isFailure(version)) return SATISFIED;
+	if (Range.satisfies(version.success, range.success)) return SATISFIED;
+	return {
+		_tag: "unsatisfied",
+		found
+	};
+};
+/**
+* Decide whether one peer DECLARED BY A JOINED MANIFEST is unsatisfied.
+*
+* @remarks
+* Same three judgements as {@link judge}, against a different provider set:
+* the linked parent's own `resolved` map is empty by construction (pnpm
+* records no peer declarations or resolutions for workspace projects), so the
+* provider is whatever the importer's own dependency set gives that name —
+* see {@link providerContext}.
+*
+* A manifest range may be a protocol specifier rather than a range —
+* `catalog:build:peers` in a repo that sources peers from a catalog,
+* `workspace:*` in one that pins peers to its own version. A `catalog:`
+* specifier is resolved through the supplied catalogs (see
+* {@link resolvePeerRange}) and reported by its resolved range, as pnpm does.
+* One that stays unresolvable with a non-workspace provider present is
+* `"unjudged"`: the comparison was never performed, so the report is marked
+* `"peerRangeUnresolved"` rather than calling the peer satisfied. With NO
+* provider the row needs no range, so it is still reported, echoing whatever
+* range could be named.
+*
+* A non-workspace provider whose version is a protocol specifier (a `file:`
+* dependency) is `"unjudged"` the same way, as `"peerVersionUnresolved"`: see
+* {@link judge}. pnpm reads such a provider's real version off disk for a
+* joined parent (`filedep-joined/`), which this check cannot, so it declines
+* rather than guessing. An unresolvable range and version raise both reasons.
+*
+* @internal
+*/
+const judgeJoined = (context, catalogs, peer, declared, optional) => {
+	const resolvedRange = resolvePeerRange(catalogs, peer, declared);
+	const wanted = resolvedRange ?? declared;
+	const provider = context.get(peer);
+	if (provider === void 0) {
+		if (optional) return SATISFIED;
+		return {
+			_tag: "unsatisfied",
+			found: null,
+			wanted
+		};
+	}
+	if (provider.isWorkspace) return SATISFIED;
+	const reasons = [];
+	if (resolvedRange === void 0) reasons.push("peerRangeUnresolved");
+	if (isProtocolSpecifier(provider.version)) reasons.push("peerVersionUnresolved");
+	if (resolvedRange === void 0 || reasons.length > 0) return {
+		_tag: "unjudged",
+		reasons
+	};
+	return withWanted(compare(resolvedRange, provider.version), wanted);
+};
+/**
 * The result of checking a lockfile for unsatisfied peer dependencies.
 *
 * @remarks
@@ -138,10 +448,15 @@ var PeerCheck = class PeerCheck extends Schema.Class("PeerCheck")({
 	*
 	* @remarks
 	* See {@link UnverifiedReason}. A gate must treat a non-empty `unverified`
-	* as **not proven clean** rather than as a pass: both reasons mean some
+	* as **not proven clean** rather than as a pass: every reason means some
 	* finding may be missing or spurious, and failing closed is the requirement.
 	*/
-	unverified: Schema.Array(Schema.Literals(["peerRulesNotApplied", "unresolvedEdge"]))
+	unverified: Schema.Array(Schema.Literals([
+		"peerRulesNotApplied",
+		"unresolvedEdge",
+		"peerRangeUnresolved",
+		"peerVersionUnresolved"
+	]))
 }) {
 	/** The unsatisfied peers a gate should act on — the non-optional ones. */
 	get required() {
@@ -159,8 +474,13 @@ var PeerCheck = class PeerCheck extends Schema.Class("PeerCheck")({
 	* `resolved` edges, so a peer declared by a *transitive* dependency is
 	* attributed to the importer that pulls it in, with the chain in
 	* `parents` — matching how `pnpm peers check` attributes them.
+	* Attribution stops at a workspace package: a linked package's own
+	* dependencies — registry or linked — are judged by that package's own
+	* importer, and a linked package's manifest peers are judged only for the
+	* importer that links it DIRECTLY, against that importer's dependencies.
+	* pnpm never surfaces them on a consumer one link further out.
 	*
-	* Three judgements are deliberate:
+	* Four judgements are deliberate:
 	*
 	* - **A required peer with nothing resolved is reported** (`found: null`),
 	*   whether or not the declared range is parseable — a peer with no
@@ -173,6 +493,9 @@ var PeerCheck = class PeerCheck extends Schema.Class("PeerCheck")({
 	* - **An unparseable range or version with something resolved is skipped.**
 	*   The check cannot judge it, and asserting "unsatisfied" on a comparison
 	*   that was never performed would be a wrong answer rather than a gap.
+	*   Two protocol-specifier cases are the exception and fail the report
+	*   closed instead: a joined manifest's range, and a provider whose version
+	*   is a protocol specifier (both below).
 	* - **A workspace-linked provider counts.** Resolution is followed through
 	*   whatever the edge names, including a workspace row.
 	*
@@ -180,7 +503,44 @@ var PeerCheck = class PeerCheck extends Schema.Class("PeerCheck")({
 	* bun root importer (see `unresolvedImporters`), and pnpm recording no peer
 	* declarations for workspace projects themselves — under pnpm a workspace
 	* package's *own* unsatisfied peers are not in the lockfile at all, and
-	* `pnpm peers check` does not report them either.
+	* `pnpm peers check` does not report them either. A `link:`-resolved
+	* importer dependency is the same blind spot from the other side, and there
+	* `pnpm peers check` DOES report the linked parent's peers (it reads the
+	* manifest on disk): every `link:` edge whose target the caller did not
+	* supply therefore fails the report closed rather than letting the
+	* invisible parent pass as checked (effected#800).
+	*
+	* Supplying {@link PeerCheckOptions.workspacePackages} closes that gap for
+	* every `link:` target the set covers — the root importer's included,
+	* whose linked targets the walk seeds itself because the root has no
+	* workspace row to reach them through: the claimed manifest's declared
+	* peers are walked, judged against the importer's own dependency set
+	* (never a sibling importer's), and reported with the manifest's name and
+	* version in `parents` — the two facts a workspace row cannot carry, since
+	* the lockfile names an importer by directory at the placeholder version
+	* `0.0.0`.
+	*
+	* A joined manifest's peer range may be a protocol specifier rather than a
+	* range. A `catalog:` specifier is resolved through
+	* {@link PeerCheckOptions.catalogs} and judged and reported by its
+	* resolved range, as `pnpm peers check` reports `wantedRange`. One that
+	* stays unresolvable — the catalogs key omitted, a catalog naming nothing
+	* for the peer, or another protocol such as `workspace:*` — is not judged
+	* against a provider that resolved for it, and the report carries
+	* `"peerRangeUnresolved"` rather than passing the peer as satisfied. With
+	* nothing resolved for it, the row is still reported, since "no provider"
+	* needs no range.
+	*
+	* The provider side has the same hole: a peer that resolved to a `file:`
+	* dependency, directly or through a `file:` override, carries the specifier
+	* (`file:vendor/react`) where a version belongs, and for a `file:` directory
+	* the lockfile records no version anywhere. `pnpm peers check` reports such a
+	* peer as a `bad` row with the specifier as its found version, even when the
+	* directory's manifest satisfies the range. Such a peer is neither reported
+	* nor passed: no row is fabricated, and the report carries
+	* `"peerVersionUnresolved"`, for a lockfile row's peer and a joined
+	* manifest's peer alike. A workspace-row provider is still accepted without a
+	* version check, and a plain unparseable version is still skipped.
 	*
 	* @param lockfile - a lockfile parsed by `@effected/lockfiles`
 	* @returns the report; never fails
@@ -202,18 +562,60 @@ var PeerCheck = class PeerCheck extends Schema.Class("PeerCheck")({
 		});
 		const index = indexInstances(lockfile);
 		const { byId } = index;
+		const manifests = /* @__PURE__ */ new Map();
+		const byLinkTarget = /* @__PURE__ */ new Map();
+		for (const pkg of options?.workspacePackages ?? []) {
+			const relativePath = linkTargetPath(".", pkg.relativePath);
+			if (!manifests.has(relativePath)) manifests.set(relativePath, pkg);
+			for (const target of linkTargetsOf(relativePath, pkg)) if (!byLinkTarget.has(target)) byLinkTarget.set(target, pkg);
+		}
+		const joinable = /* @__PURE__ */ new Set();
+		const linksByImporter = /* @__PURE__ */ new Map();
+		let unjoinedLink = false;
+		for (const importer of lockfile.importers) {
+			const edges = [];
+			for (const dep of importer.dependencies) {
+				const version = dep.version;
+				if (version?.startsWith(LINK_PREFIX) !== true) continue;
+				const target = linkTargetPath(importer.path, version.slice(5));
+				const pkg = byLinkTarget.get(target);
+				const row = index.workspaceByPath.get(pkg === void 0 ? target : linkTargetPath(".", pkg.relativePath));
+				const covered = pkg !== void 0;
+				if (!covered) unjoinedLink = true;
+				if (covered && row !== void 0) joinable.add(row.instanceId);
+				edges.push({
+					name: dep.name,
+					row,
+					covered
+				});
+			}
+			if (edges.length > 0) linksByImporter.set(importer.path, edges);
+		}
 		const rows = [];
 		const unresolved = [];
+		const unjudged = /* @__PURE__ */ new Set();
 		const seen = /* @__PURE__ */ new Set();
 		for (const importer of lockfile.importers) {
-			const roots = rootInstances(lockfile, importer.path, index);
+			const links = linksByImporter.get(importer.path) ?? [];
+			const roots = withLinkRoots(rootInstances(lockfile, importer.path, index), links, importer.dependencies);
 			if (roots === void 0) {
 				unresolved.push(importer.path);
+				if (links.length > 0) unjoinedLink = true;
 				continue;
 			}
-			collect(importer.path, walksFrom(roots), byId, rows, seen, policy);
+			const join = {
+				manifests,
+				joinable,
+				context: providerContext(roots, byId, links),
+				catalogs: options?.catalogs
+			};
+			const judged = /* @__PURE__ */ new Set();
+			collect(importer.path, walksFrom(roots, join), byId, rows, seen, policy, join, judged, unjudged);
+			for (const edge of links) if (edge.covered && (edge.row === void 0 || !judged.has(edge.row.instanceId))) unjoinedLink = true;
 		}
-		if (lockfile.packages.some((pkg) => pkg.unresolvedEdges.length > 0)) unverified.push("unresolvedEdge");
+		if (unjoinedLink || lockfile.packages.some((pkg) => pkg.unresolvedEdges.length > 0)) unverified.push("unresolvedEdge");
+		if (unjudged.has("peerRangeUnresolved")) unverified.push("peerRangeUnresolved");
+		if (unjudged.has("peerVersionUnresolved")) unverified.push("peerVersionUnresolved");
 		return PeerCheck.make({
 			supported: true,
 			unsatisfied: rows,
@@ -231,23 +633,24 @@ var PeerCheck = class PeerCheck extends Schema.Class("PeerCheck")({
 *
 * @internal
 */
-const walksFrom = (roots) => roots._tag === "own" ? [{
+const walksFrom = (roots, join) => roots._tag === "own" ? [{
 	instance: roots.instance,
 	path: []
 }] : roots.instances.map((instance) => ({
 	instance,
-	path: [PeerParent.make({
-		name: instance.name,
-		version: instance.version
-	})]
+	path: [parentLabel(join, instance)]
 }));
 /**
 * Walk the resolution graph from an importer's roots, emitting a row for every
 * unsatisfied peer declared anywhere along the way.
 *
+* Adds to `unjudged` the reason each peer it could not judge was never
+* compared (see {@link judge} and {@link judgeJoined}); the caller surfaces
+* them on `unverified`.
+*
 * @internal
 */
-const collect = (importerPath, roots, byId, rows, seen, policy) => {
+const collect = (importerPath, roots, byId, rows, seen, policy, join, judged, unjudged) => {
 	const visited = /* @__PURE__ */ new Set();
 	const queue = [...roots];
 	while (queue.length > 0) {
@@ -255,33 +658,37 @@ const collect = (importerPath, roots, byId, rows, seen, policy) => {
 		if (current === void 0) break;
 		if (visited.has(current.instance.instanceId)) continue;
 		visited.add(current.instance.instanceId);
-		for (const [peer, wanted] of Object.entries(current.instance.peerDependencies)) {
+		const linked = current.path.length === 0 ? void 0 : joinedManifest(join, current.instance);
+		const declared = linked?.peerDependencies ?? current.instance.peerDependencies;
+		const optionalNames = linked === void 0 ? void 0 : optionalPeers(linked);
+		const declaring = linked?.name ?? current.instance.name;
+		if (linked !== void 0) judged.add(current.instance.instanceId);
+		for (const [peer, wanted] of Object.entries(declared)) {
 			if (peer === "") continue;
-			const optional = current.instance.peerDependenciesMeta[peer]?.optional === true;
-			const verdict = judge(current.instance, peer, wanted, optional, byId);
-			if (verdict === void 0) continue;
-			if (suppressedByRule(policy, current.instance.name, peer, verdict.found)) continue;
+			const optional = optionalNames === void 0 ? current.instance.peerDependenciesMeta[peer]?.optional === true : optionalNames.has(peer);
+			const verdict = linked === void 0 ? withWanted(judge(current.instance, peer, wanted, optional, byId), wanted) : judgeJoined(join.context, join.catalogs, peer, wanted, optional);
+			if (verdict._tag === "unjudged") for (const reason of verdict.reasons) unjudged.add(reason);
+			if (verdict._tag !== "unsatisfied") continue;
+			if (suppressedByRule(policy, declaring, peer, verdict.found)) continue;
 			const key = `${importerPath}\u0000${peer}\u0000${current.instance.instanceId}`;
 			if (seen.has(key)) continue;
 			seen.add(key);
 			rows.push(UnsatisfiedPeer.make({
 				importer: importerPath,
 				dependency: peer,
-				wanted,
+				wanted: verdict.wanted,
 				found: verdict.found,
 				optional,
 				parents: current.path
 			}));
 		}
+		if (current.path.length > 0 && current.instance.isWorkspace) continue;
 		for (const targetId of Object.values(current.instance.resolved)) {
 			const next = byId.get(targetId);
 			if (next === void 0 || visited.has(targetId)) continue;
 			queue.push({
 				instance: next,
-				path: [...current.path, PeerParent.make({
-					name: next.name,
-					version: next.version
-				})]
+				path: [...current.path, parentLabel(join, next)]
 			});
 		}
 	}
@@ -360,9 +767,12 @@ const suppressedByRule = (policy, parentName, peer, found) => {
 /**
 * Decide whether one declared peer is unsatisfied.
 *
-* Returns `undefined` for "satisfied, or not judgeable" — the two cases that
-* produce no row. They are deliberately merged here and separated in the
-* TSDoc on {@link PeerCheck.run}, since neither yields output.
+* Returns `"satisfied"` for "satisfied, or not judgeable and skipped" — the
+* two cases that produce no row and no marker. They are deliberately merged
+* here and separated in the TSDoc on {@link PeerCheck.run}. A provider whose
+* version is a protocol specifier is the one unjudgeable case that is NOT
+* skipped: it is `"unjudged"`, and the report carries
+* `"peerVersionUnresolved"`.
 *
 * @internal
 */
@@ -370,16 +780,19 @@ const judge = (instance, peer, wanted, optional, byId) => {
 	const providerId = instance.resolved[peer];
 	const provider = providerId === void 0 ? void 0 : byId.get(providerId);
 	if (provider === void 0) {
-		if (optional) return void 0;
-		if (instance.unresolvedEdges.includes(peer)) return void 0;
-		return { found: null };
+		if (optional) return SATISFIED;
+		if (instance.unresolvedEdges.includes(peer)) return SATISFIED;
+		return {
+			_tag: "unsatisfied",
+			found: null
+		};
 	}
-	if (provider.isWorkspace) return void 0;
-	const range = Range.parseResult(wanted);
-	const version = SemVer.parseResult(provider.version);
-	if (Result.isFailure(range) || Result.isFailure(version)) return void 0;
-	if (Range.satisfies(version.success, range.success)) return void 0;
-	return { found: provider.version };
+	if (provider.isWorkspace) return SATISFIED;
+	if (isProtocolSpecifier(provider.version)) return {
+		_tag: "unjudged",
+		reasons: ["peerVersionUnresolved"]
+	};
+	return compare(wanted, provider.version);
 };
 
 //#endregion

package/README.md

@@ -163,16 +163,21 @@ A specifier the workspace cannot answer fails typed as `UnresolvedDependencyErro
 `PeerCheck.run(lockfile, options?)` reports unsatisfied peer dependencies as a pure value: no IO, no error channel, nothing in `R`, and no per-manager traversal logic. It reads `lockfile.format` once, to reject a format whose lockfile does not record peer resolution; past that gate the walk is the same for every manager. The answer comes from the resolved graph `@effected/lockfiles` normalizes, not from shelling out to a package manager's own peer command — bun has none, so the subprocess route cannot answer for every manager the rest of this package supports.
 
 ```ts
-import { LockfileReader, PeerCheck, WorkspaceCatalogs } from "@effected/workspaces";
+import { LockfileReader, PeerCheck, WorkspaceCatalogs, WorkspaceDiscovery } from "@effected/workspaces";
 import { Effect } from "effect";
 
 const program = Effect.gen(function* () {
   const reader = yield* LockfileReader;
   const catalogs = yield* WorkspaceCatalogs;
+  const discovery = yield* WorkspaceDiscovery;
 
   const lockfile = yield* reader.read();
-  // Presence of the key is the assertion — see below.
-  const report = PeerCheck.run(lockfile, { peerDependencyRules: yield* catalogs.peerDependencyRules() });
+  // Presence of each key is the assertion — see below.
+  const report = PeerCheck.run(lockfile, {
+    peerDependencyRules: yield* catalogs.peerDependencyRules(),
+    workspacePackages: yield* discovery.listPackages(),
+    catalogs: yield* catalogs.set(),
+  });
 
   return {
     clean:
@@ -190,10 +195,20 @@ const program = Effect.gen(function* () {
 
 - `supported` is `false` for yarn, which resolves peers virtually and does not record which virtual instance satisfied which peer. The answer is unrecoverable, so it is not fabricated.
 - `unresolvedImporters` names importers that could not be joined to package instances — in practice the root importer under npm and bun, neither of which records a resolved version per importer dependency.
-- `unverified` says why the report is not a complete answer: `"peerRulesNotApplied"` when the suppression policy could not be applied, `"unresolvedEdge"` when an instance records an edge the model could not name. Both mean fail closed.
+- `unverified` says why the report is not a complete answer, and every reason means fail closed:
+  - `"peerRulesNotApplied"` — the `peerDependencyRules` key was omitted, so pnpm's suppression policy was not applied.
+  - `"unresolvedEdge"` — an instance records an edge the model could not name, or an importer dependency resolved through `link:` whose linked manifest's peers were not judged: its target was not supplied in `workspacePackages`, or the lockfile records no workspace row to walk. A linked parent's manifest peers are never in the lockfile, though `pnpm peers check` reads them from disk.
+  - `"peerRangeUnresolved"` — a linked manifest declares a peer as a protocol specifier that could not be turned into a range (`catalog:` with the `catalogs` key omitted or no matching entry, `workspace:*`), and something resolved for that peer, so the comparison never ran.
+  - `"peerVersionUnresolved"` — a peer resolved to a non-workspace provider whose version is a protocol specifier rather than a version: a `file:` directory or tarball, directly or through a `file:` override, which the lockfile records as `file:vendor/x` with no version for a directory, and a git or remote-tarball provider, which pnpm keys by its URL (`https://codeload.github.com/…`). The comparison never runs, so the peer is neither reported nor passed as satisfied; for a `file:` directory `pnpm peers check` reports it as a `bad` row even when the directory's manifest satisfies the range. It applies to peers declared by lockfile rows and by joined manifests alike.
 - `required` is the getter for the rows a gate should act on — the non-optional ones. An unsatisfied *optional* peer is normal, so `optional` travels with the row rather than being filtered out at the source.
 
-`WorkspaceCatalogs.peerDependencyRules()` returns the workspace's effective merged pnpm suppression rules, which the lockfile records nowhere; without them a checker reports findings pnpm itself calls clean. **Presence of the `peerDependencyRules` option key is the assertion, not its contents.** Passing `NoPeerDependencyRules` asserts the workspace has none, so the report carries no `"peerRulesNotApplied"` — though it can still be unverified for another reason, or unsupported; omitting the key says nobody looked, and always yields `"peerRulesNotApplied"`. Only `allowedVersions` is applied — rules populating `ignoreMissing` or `allowAny` describe a policy this package does not replicate, so they fail closed through the same reason rather than being silently ignored. All three key spellings pnpm accepts are honoured: `parent@version>peer` (what `pnpm:export` writes), `parent>peer` (what a config-dependency plugin injects) and a bare `peer`, which pnpm applies to every parent that declares it.
+`WorkspaceCatalogs.peerDependencyRules()` returns the workspace's effective merged pnpm suppression rules, which the lockfile records nowhere; without them a checker reports findings pnpm itself calls clean. **Presence of the `peerDependencyRules` option key is the assertion, not its contents.** Passing `NoPeerDependencyRules` asserts the workspace has none, so the report carries no `"peerRulesNotApplied"` — though it can still be unverified for another reason, or unsupported; omitting the key says nobody looked, and always yields `"peerRulesNotApplied"`. **All three axes of the supplied rules are applied**, with pnpm's measured semantics. `allowedVersions` hides a row whose resolved version a matching key's range permits, in all three key spellings pnpm accepts: `parent@version>peer` (what `pnpm:export` writes; the parent version is ignored, as pnpm ignores it), `parent>peer` (what a config-dependency plugin injects) and a bare `peer`, which pnpm applies to every parent that declares it. `ignoreMissing` hides a required peer nothing resolved for, and `allowAny` hides a peer that resolved outside its range; both are `@pnpm/matcher` patterns over the PEER name (`*` wildcard, leading `!` negates), never `parent>peer` keys, and the two never cross.
+
+The `workspacePackages` option takes the packages `WorkspaceDiscovery` already returned, and supplying it is what turns a `link:`-resolved parent from a refusal into an answer: the matched manifest's declared peers join the walk, named from the manifest (`probe-a@1.0.0`, not the row's `packages/a@0.0.0`) and judged against the **importer's own** dependency set, which is where pnpm resolves them from. Measured one variable at a time on the probe workspace, against pnpm 12.5.1 and 12.6.0: a consumer's own `react@18.3.1` satisfies the linked parent's `^18.0.0` peer, the same version installed only by a sibling importer does not, and a consumer's own `react@17.0.2` is a `bad` row carrying `foundVersion`. A target the set does not cover — every target, when the key is omitted — keeps `"unresolvedEdge"`, so the option answers only for what it covers and says so about the rest. A covered target the walk cannot reach — one the lockfile records no workspace row for — keeps the marker too; the root importer's linked targets are walked and judged against the root's own dependencies, as pnpm does.
+
+A `link:` target matches a supplied package by its directory or by its publish directory: pnpm links a workspace dependency into `publishConfig.directory` unless `publishConfig.linkDirectory` is `false` (it defaults to true), recording `link:../a/dist`. For such a link pnpm reads the built manifest at the target, while `PeerCheck` reads the source manifest and resolves its `catalog:` ranges through `catalogs`; the two agree when the build emits the ranges the source's specifiers resolve to. Attribution stops at a workspace package: a linked package's manifest peers are judged only for the importer that links it directly, and its own dependencies (registry or linked) only for its own importer, never for a consumer one link further out. Each `link:` edge is cleared only by the walk of the importer that records it.
+
+The `catalogs` option takes `WorkspaceCatalogs.set()`, which already includes hook-injected catalogs. A linked manifest may declare a peer as a catalog specifier (`"typescript": "catalog:build:peers"`) rather than a range; with the set supplied it is resolved, judged, and reported by the resolved range, which is what `pnpm peers check` reports as `wantedRange`. A specifier that stays unresolvable — the key omitted, a catalog naming nothing for the peer, or another protocol such as `workspace:*` — is never passed as satisfied: when something resolved for that peer the report carries `"peerRangeUnresolved"`, and when nothing did the `found: null` row is reported anyway, since a missing provider needs no range.
 
 ## The synchronous escape hatch