@effected/workspaces 0.9.5 → 0.10.0

package/ConfigDependencyHooks.js

@@ -1,8 +1,10 @@
 import { normalize } from "./internal/catalogs.js";
-import { Context, Effect, Layer, Predicate, Result } from "effect";
+import { Context, Duration, Effect, Layer, Predicate, Result, Schema } from "effect";
 import { CatalogAssemblyError } from "@effected/npm";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
+import { Run } from "@effected/commands";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 
 //#region src/ConfigDependencyHooks.ts
 /** Whether `value` is a non-null, non-array object. */
@@ -97,6 +99,137 @@ const updateConfigOf = (mod) => {
 	}
 };
 /**
+* The subprocess replay program {@link ConfigDependencyHooks.layerSubprocess}
+* hands to `node --input-type=module -e`.
+*
+* @remarks
+* A **static** string constant, deliberately: a bundler compiles a *computed*
+* dynamic `import()` into a context module that cannot resolve a runtime path
+* (`Cannot find module 'file:///…'`), so the computed import has to run in a
+* child process whose program text carries **no interpolated runtime value** —
+* the workspace root, the seed and the dependency names all arrive via argv
+* (`process.argv.slice(1)` under `-e`), never spliced into the script.
+*
+* The script mirrors this module's in-process semantics exactly so the two
+* layers are drop-in interchangeable: `pnpmfile.mjs` before `pnpmfile.cjs`
+* (pnpm 11's loader order), the `ERR_MODULE_NOT_FOUND`-for-the-candidate-itself
+* skip discrimination (`err.url` equality), the same hook-locator shapes, the
+* same tolerant threading of returned data (`configOf` / `finiteNumberOr` /
+* `stringArrayOr` clones below), and the same synchronous hook call. Only the
+* *mechanism* failures are reported: the script prints one final line of JSON —
+* `{ ok: true, config }` on success, `{ ok: false, name, message, stack? }`
+* naming the offending dependency on a load/replay failure — and exits through
+* the write callback so the payload is flushed even if a hook left the event
+* loop occupied. The final-line framing tolerates a hook's own `console.log`
+* noise on stdout.
+*/
+const REPLAY_SCRIPT = `
+const [root, seedJson, ...names] = process.argv.slice(1);
+const { pathToFileURL } = await import("node:url");
+const { join } = await import("node:path");
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const finiteNumberOr = (value, fallback) => (typeof value === "number" && Number.isFinite(value) ? value : fallback);
+const stringArrayOr = (value, fallback) =>
+	Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : fallback;
+const configOf = (value, fallback) =>
+	isObject(value)
+		? {
+				catalog: isObject(value.catalog) ? value.catalog : fallback.catalog,
+				catalogs: isObject(value.catalogs) ? value.catalogs : fallback.catalogs,
+				minimumReleaseAge: finiteNumberOr(value.minimumReleaseAge, fallback.minimumReleaseAge),
+				minimumReleaseAgeExclude: stringArrayOr(value.minimumReleaseAgeExclude, fallback.minimumReleaseAgeExclude),
+			}
+		: fallback;
+const failure = (name, cause) => ({
+	ok: false,
+	name,
+	message: cause instanceof Error ? cause.message : String(cause),
+	...(cause instanceof Error && typeof cause.stack === "string" ? { stack: cause.stack } : {}),
+});
+const replay = async () => {
+	let catalog = {};
+	const catalogs = {};
+	for (const [name, entries] of Object.entries(JSON.parse(seedJson))) {
+		if (name === "default") catalog = { ...entries };
+		else catalogs[name] = { ...entries };
+	}
+	let config = { catalog, catalogs, minimumReleaseAge: undefined, minimumReleaseAgeExclude: undefined };
+	for (const name of names) {
+		let loaded;
+		let found = false;
+		for (const filename of ["pnpmfile.mjs", "pnpmfile.cjs"]) {
+			const candidate = pathToFileURL(join(root, "node_modules", ".pnpm-config", name, filename)).href;
+			try {
+				loaded = await import(candidate);
+				found = true;
+				break;
+			} catch (cause) {
+				const url =
+					isObject(cause) && cause.code === "ERR_MODULE_NOT_FOUND" && typeof cause.url === "string"
+						? cause.url
+						: undefined;
+				if (url === candidate) continue;
+				return failure(name, cause);
+			}
+		}
+		if (!found) continue;
+		let hook;
+		for (const candidate of [loaded, isObject(loaded) ? loaded.default : undefined]) {
+			if (!isObject(candidate)) continue;
+			if (isObject(candidate.hooks) && typeof candidate.hooks.updateConfig === "function") {
+				hook = candidate.hooks.updateConfig;
+				break;
+			}
+			if (typeof candidate.updateConfig === "function") {
+				hook = candidate.updateConfig;
+				break;
+			}
+		}
+		if (hook === undefined) continue;
+		try {
+			config = configOf(hook(config), config);
+		} catch (cause) {
+			return failure(name, cause);
+		}
+	}
+	return { ok: true, config };
+};
+const payload = await replay();
+process.stdout.write("\\n" + JSON.stringify(payload) + "\\n", () => process.exit(0));
+`;
+/**
+* The ceiling on one subprocess replay. A config dependency's `updateConfig`
+* reads and rewrites a config object — no install work, no network — so thirty
+* seconds is generous. Without a ceiling a pnpmfile that loops or awaits a
+* promise that never settles hangs `inject`, and through it the one memoized
+* {@link WorkspaceCatalogs} assemble pass every catalog read blocks on. Expiry
+* kills the child (`Run` scopes it) and surfaces as a `CommandFailedError`
+* through the same typed transport-failure path as any other mechanism failure.
+*/
+const REPLAY_TIMEOUT = Duration.seconds(30);
+/**
+* The subprocess protocol payload — the child's final stdout line, framed and
+* parsed by `Run.jsonLine`. The envelope is strict (a payload without a usable
+* `ok` discriminant is a mechanism failure, typed); the `config` slice inside a
+* success stays `Unknown` because a hook's returned *data* is tolerantly
+* threaded (`configOf`), never fatal.
+*/
+const ReplayPayload = Schema.Union([Schema.Struct({
+	ok: Schema.Literal(true),
+	config: Schema.Unknown
+}), Schema.Struct({
+	ok: Schema.Literal(false),
+	name: Schema.optionalKey(Schema.String),
+	message: Schema.optionalKey(Schema.String),
+	stack: Schema.optionalKey(Schema.String)
+})]);
+/** Rebuild the subprocess's serialized failure as an `Error`, preserving the child-side stack when it carried one. */
+const replayFailureCause = (payload) => {
+	const error = new Error(payload.message ?? "config dependency hook replay failed");
+	if (payload.stack !== void 0) error.stack = payload.stack;
+	return error;
+};
+/**
 * Replays a workspace's `configDependencies` `updateConfig` hooks over the inline
 * catalogs — the opt-in seam that lets hook-injected catalogs participate in
 * assembly.
@@ -189,6 +322,95 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 			releaseAge: releaseAgeOf(config)
 		};
 	}) });
+	/**
+	* The subprocess layer: replays each config dependency's pnpmfile in a `node`
+	* child process instead of an in-process dynamic `import()`, with identical
+	* typed semantics to {@link ConfigDependencyHooks.layerLive} — the two are
+	* drop-in interchangeable.
+	*
+	* @remarks
+	* `layerLive` computes the `import()` path at runtime, and a bundler (rspack,
+	* for one) compiles a *computed* dynamic import into a context module that
+	* throws `Cannot find module 'file:///…'` at runtime — so in any bundled
+	* consumer, a GitHub Action above all, the in-process replay is unreachable.
+	* This layer keeps every computed load out of the bundle graph: the replay
+	* program is a **static** string constant passed via argv
+	* (`node --input-type=module -e <script> <root> <seed> <...names>`), and the
+	* child process performs the computed imports where no bundler rewrote them.
+	* A subprocess also keeps config-dependency code out of the consumer's own
+	* process.
+	*
+	* The contract's semantics are unchanged, not the downstream fail-open shape:
+	* an empty `configDependencies` returns the seed without spawning anything; a
+	* `..` path segment in a dependency name fails typed **before** any spawn; a
+	* missing pnpmfile (neither `.mjs` nor `.cjs`) is the one legitimate skip,
+	* discriminated inside the child by `err.url` equality exactly as
+	* `layerLive` discriminates in process; any other load failure — a syntax
+	* error, a throwing top level, an `ERR_MODULE_NOT_FOUND` for a module the
+	* pnpmfile itself imports — and a hook that throws when called are serialized
+	* back per-name and surface typed as a `hooks`-source `CatalogAssemblyError`
+	* naming that dependency. A hook's returned *data* stays tolerantly threaded
+	* (last well-formed write wins), never fatal. Spawn and transport failures —
+	* `node` absent, a non-zero exit without a result payload, unparseable
+	* output — fail typed too, never a defect and never a silent skip.
+	*
+	* Two bounds this layer imposes that `layerLive` cannot: the replay is
+	* given thirty seconds (a pnpmfile that loops or awaits forever fails typed
+	* instead of hanging the memoized assemble pass — a subprocess is killable,
+	* while `layerLive`'s in-process synchronous hook call is not interruptible
+	* by any means, so the asymmetry is inherent, not a parity violation), and
+	* the child's stdout is captured under `Run.jsonLine`'s 16 MiB default
+	* ceiling (a hook that logs more than that fails typed as `tooLarge`, where
+	* `layerLive` — which captures nothing — would succeed).
+	*
+	* Catalog folding and normalization stay in the **parent** (the same
+	* `@pnpm/catalogs`-derived path `layerLive` uses); the child returns only the
+	* raw threaded config slice, since the script cannot import kit code.
+	*
+	* Requires core's `ChildProcessSpawner`, resolved when the layer is built —
+	* the consumer provides it once at the edge (`@effect/platform-node`'s
+	* `NodeServices.layer`), the same discharge `@effected/git` uses. Wired by
+	* `WorkspaceCatalogs.layerWithConfigDependenciesSubprocess` /
+	* `Workspaces.layerWithConfigDependenciesSubprocess`.
+	*/
+	static layerSubprocess = Layer.effect(ConfigDependencyHooks, Effect.gen(function* () {
+		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+		return { inject: (root, configDependencies, seed) => Effect.gen(function* () {
+			const names = Object.keys(configDependencies);
+			if (names.length === 0) return {
+				catalogs: seed,
+				releaseAge: {}
+			};
+			for (const name of names) if (hasTraversalSegment(name)) return yield* Effect.fail(new CatalogAssemblyError({
+				source: "hooks",
+				path: name,
+				cause: /* @__PURE__ */ new Error(`config dependency name has a '..' path segment: ${name}`)
+			}));
+			const command = ChildProcess.make("node", [
+				"--input-type=module",
+				"-e",
+				REPLAY_SCRIPT,
+				root,
+				JSON.stringify(seed),
+				...names
+			]);
+			const payload = yield* Run.jsonLine(command, ReplayPayload, { timeout: REPLAY_TIMEOUT }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner), Effect.catch((cause) => Effect.fail(new CatalogAssemblyError({
+				source: "hooks",
+				path: root,
+				cause
+			}))));
+			if (payload.ok === false) return yield* Effect.fail(new CatalogAssemblyError({
+				source: "hooks",
+				path: payload.name ?? root,
+				cause: replayFailureCause(payload)
+			}));
+			const config = configOf(payload.config, seedToConfig(seed));
+			return {
+				catalogs: configToEntries(config),
+				releaseAge: releaseAgeOf(config)
+			};
+		}) };
+	}));
 };
 
 //#endregion

package/README.md

@@ -223,6 +223,7 @@ A name miss in the derived `getPackage` fails with the service's own typed `Pack
 ## Features
 
 - `Workspaces.layer` / `Workspaces.layerWithGit` / `Workspaces.resolvers` — the composite layers, split on requirements rather than feature flags: a filesystem, a filesystem plus a subprocess, and the two `@effected/npm` resolver contracts.
+- `Workspaces.layerWithConfigDependencies` / `Workspaces.layerWithConfigDependenciesSubprocess` — opt in to replaying a pnpm config dependency's pnpmfile hooks, which is what lets catalogs and `releaseAgeGate()` see the entries a hook injects. The default layer runs no config-dependency code at all. The two spellings differ only in where the replay happens: in process, or in a `node` child process for a consumer whose code is bundled (a GitHub Action, say), where the in-process form's computed dynamic import cannot survive the bundler. The subprocess form asks for core's `ChildProcessSpawner`; `WorkspaceCatalogs` carries the same pair.
 - `Workspaces.resolverLayer` / `Workspaces.resolveManifest` — the one-call manifest-resolution path: a fresh, unmemoized layer per call so root discovery follows your cwd, and one-shot resolution of a whole `Manifest` against the real workspace.
 - `WorkspaceRoot` — root discovery from a `cwd`, over `WORKSPACE_MARKERS`.
 - `WorkspaceDiscovery` — package enumeration with a bounded descent for segment-crossing `packages/**` patterns, per-package lookup and the `makeTest` / `layerTest` in-memory test doubles.

package/WorkspaceCatalogs.js

@@ -428,6 +428,24 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 	*/
 	static layerWithConfigDependencies = (options) => Layer.effect(WorkspaceCatalogs, WorkspaceCatalogs.make(options)).pipe(Layer.provide(ConfigDependencyHooks.layerLive));
 	/**
+	* The opt-in layer that replays config-dependency `pnpmfile` hooks in a
+	* `node` **child process**: it wires
+	* {@link ConfigDependencyHooks.layerSubprocess} in place of the in-process
+	* `layerLive`.
+	*
+	* @remarks
+	* Same typed semantics as {@link WorkspaceCatalogs.layerWithConfigDependencies}
+	* — the two hook layers are drop-in interchangeable — but the replay's
+	* computed dynamic `import()` runs in the subprocess, so it survives bundling
+	* (a bundler compiles a computed in-process `import()` into a context module
+	* that cannot resolve at runtime — every bundled GitHub Action hits this).
+	* The cost is one extra requirement: core's `ChildProcessSpawner`, provided
+	* once at the edge (`@effect/platform-node`'s `NodeServices.layer`) — the
+	* same sanctioned R-widening as `Workspaces.layerWithGit`. Parameterized, so
+	* bind it to a `const` and reuse it.
+	*/
+	static layerWithConfigDependenciesSubprocess = (options) => Layer.effect(WorkspaceCatalogs, WorkspaceCatalogs.make(options)).pipe(Layer.provide(ConfigDependencyHooks.layerSubprocess));
+	/**
 	* A test double satisfying the full {@link WorkspaceCatalogsShape} with no
 	* filesystem, lockfile read, or hook replay.
 	*

package/WorkspaceDiscovery.js

@@ -259,6 +259,15 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 			for (const entry of index) if (filePath.startsWith(entry.prefix)) return Option.some(entry.package);
 			return Option.none();
 		};
+		const packageIndexes = /* @__PURE__ */ new WeakMap();
+		const packagesByName = (all) => {
+			const cached = packageIndexes.get(all);
+			if (cached !== void 0) return cached;
+			const index = /* @__PURE__ */ new Map();
+			for (const pkg of all) if (!index.has(pkg.name)) index.set(pkg.name, pkg);
+			packageIndexes.set(all, index);
+			return index;
+		};
 		return {
 			info: Effect.fn("WorkspaceDiscovery.info")(function* () {
 				return (yield* memo).info;
@@ -272,7 +281,7 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 			}),
 			getPackage: Effect.fn("WorkspaceDiscovery.getPackage")(function* (name) {
 				const all = yield* packages;
-				const found = all.find((pkg) => pkg.name === name);
+				const found = packagesByName(all).get(name);
 				if (found !== void 0) return found;
 				return yield* Effect.fail(new PackageNotFoundError({
 					name,
@@ -436,7 +445,16 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 	*/
 	static workspaceResolver = Layer.effect(WorkspaceResolver, Effect.gen(function* () {
 		const discovery = yield* WorkspaceDiscovery;
-		return { versionOf: (packageName) => discovery.listPackages().pipe(Effect.map((all) => Option.fromUndefinedOr(all.find((pkg) => pkg.name === packageName)?.version)), Effect.mapError((cause) => new DependencyResolutionError({
+		const versionIndexes = /* @__PURE__ */ new WeakMap();
+		const versionsByName = (all) => {
+			const cached = versionIndexes.get(all);
+			if (cached !== void 0) return cached;
+			const index = /* @__PURE__ */ new Map();
+			for (const pkg of all) if (!index.has(pkg.name)) index.set(pkg.name, pkg.version);
+			versionIndexes.set(all, index);
+			return index;
+		};
+		return { versionOf: (packageName) => discovery.listPackages().pipe(Effect.map((all) => Option.fromUndefinedOr(versionsByName(all).get(packageName))), Effect.mapError((cause) => new DependencyResolutionError({
 			specifier: `workspace:${packageName}`,
 			cause
 		}))) };

package/Workspaces.js

@@ -26,6 +26,7 @@ const layerWithGit = (options) => {
 };
 const resolvers = Layer.mergeAll(WorkspaceCatalogs.catalogResolver, WorkspaceDiscovery.workspaceResolver);
 const layerWithConfigDependencies = (options) => compose(options, WorkspaceCatalogs.layerWithConfigDependencies);
+const layerWithConfigDependenciesSubprocess = (options) => compose(options, WorkspaceCatalogs.layerWithConfigDependenciesSubprocess);
 const resolverLayer = (options) => resolvers.pipe(Layer.provide(layerWithConfigDependencies(options)));
 const resolveManifest = Effect.fn("Workspaces.resolveManifest")(function* (manifest, options) {
 	return yield* manifest.resolve().pipe(Effect.provide(resolverLayer(options)));
@@ -107,6 +108,32 @@ var Workspaces = class {
 	*/
 	static layerWithConfigDependencies = layerWithConfigDependencies;
 	/**
+	* The git-free composite with config-dependency hook replay in a `node`
+	* **child process** —
+	* {@link WorkspaceCatalogs.layerWithConfigDependenciesSubprocess} in place of
+	* the in-process replay.
+	*
+	* @remarks
+	* Same typed semantics as {@link Workspaces.layerWithConfigDependencies}; the
+	* difference is mechanism, and it matters in exactly one environment class: a
+	* **bundled** consumer. The in-process replay's computed dynamic `import()`
+	* is compiled by bundlers (rspack among them) into a context module that
+	* throws `Cannot find module 'file:///…'` at runtime, which makes
+	* `WorkspaceCatalogs.releaseAgeGate()` unreachable from any bundled GitHub
+	* Action. Here the computed import runs inside a `node` child process whose
+	* program text is a static string handed over argv, so nothing computed
+	* enters the bundle graph.
+	*
+	* The extra requirement is core's `ChildProcessSpawner`, provided once at
+	* the edge (`@effect/platform-node`'s `NodeServices.layer`) — the same
+	* sanctioned R-widening as {@link Workspaces.layerWithGit}, and the reason
+	* this is a separate composite rather than a flag: a consumer that keeps the
+	* in-process replay should not have to be able to spawn a subprocess.
+	*
+	* **Bind the result to a `const`.**
+	*/
+	static layerWithConfigDependenciesSubprocess = layerWithConfigDependenciesSubprocess;
+	/**
 	* The git-free composite plus {@link ChangeDetector} and
 	* {@link WorkspaceSnapshots}, over `@effected/git`'s `Git` service.
 	*

package/index.d.ts

@@ -4,8 +4,8 @@ import { CatalogAssemblyError, CatalogResolver, DependencyResolutionError, Manif
 import { GlobPattern } from "@effected/glob";
 import { Lockfile, LockfileFramingError, LockfileIntegrity, LockfileParseError, ResolvedPackage, WorkspaceManifest } from "@effected/lockfiles";
 import { Package } from "@effected/package-json";
-import { LocalExec } from "@effected/commands";
 import { ChildProcessSpawner } from "effect/unstable/process";
+import { LocalExec } from "@effected/commands";
 //#region src/WorkspacePackage.d.ts
 declare const PublishConfig_base: Schema.Class<PublishConfig, Schema.Struct<{
   /** Scoped-package visibility. Its presence overrides `private`. */
@@ -896,6 +896,58 @@ declare class ConfigDependencyHooks extends ConfigDependencyHooks_base {
    * `WorkspaceCatalogs.layerWithConfigDependencies`.
    */
   static readonly layerLive: Layer.Layer<ConfigDependencyHooks>;
+  /**
+   * The subprocess layer: replays each config dependency's pnpmfile in a `node`
+   * child process instead of an in-process dynamic `import()`, with identical
+   * typed semantics to {@link ConfigDependencyHooks.layerLive} — the two are
+   * drop-in interchangeable.
+   *
+   * @remarks
+   * `layerLive` computes the `import()` path at runtime, and a bundler (rspack,
+   * for one) compiles a *computed* dynamic import into a context module that
+   * throws `Cannot find module 'file:///…'` at runtime — so in any bundled
+   * consumer, a GitHub Action above all, the in-process replay is unreachable.
+   * This layer keeps every computed load out of the bundle graph: the replay
+   * program is a **static** string constant passed via argv
+   * (`node --input-type=module -e <script> <root> <seed> <...names>`), and the
+   * child process performs the computed imports where no bundler rewrote them.
+   * A subprocess also keeps config-dependency code out of the consumer's own
+   * process.
+   *
+   * The contract's semantics are unchanged, not the downstream fail-open shape:
+   * an empty `configDependencies` returns the seed without spawning anything; a
+   * `..` path segment in a dependency name fails typed **before** any spawn; a
+   * missing pnpmfile (neither `.mjs` nor `.cjs`) is the one legitimate skip,
+   * discriminated inside the child by `err.url` equality exactly as
+   * `layerLive` discriminates in process; any other load failure — a syntax
+   * error, a throwing top level, an `ERR_MODULE_NOT_FOUND` for a module the
+   * pnpmfile itself imports — and a hook that throws when called are serialized
+   * back per-name and surface typed as a `hooks`-source `CatalogAssemblyError`
+   * naming that dependency. A hook's returned *data* stays tolerantly threaded
+   * (last well-formed write wins), never fatal. Spawn and transport failures —
+   * `node` absent, a non-zero exit without a result payload, unparseable
+   * output — fail typed too, never a defect and never a silent skip.
+   *
+   * Two bounds this layer imposes that `layerLive` cannot: the replay is
+   * given thirty seconds (a pnpmfile that loops or awaits forever fails typed
+   * instead of hanging the memoized assemble pass — a subprocess is killable,
+   * while `layerLive`'s in-process synchronous hook call is not interruptible
+   * by any means, so the asymmetry is inherent, not a parity violation), and
+   * the child's stdout is captured under `Run.jsonLine`'s 16 MiB default
+   * ceiling (a hook that logs more than that fails typed as `tooLarge`, where
+   * `layerLive` — which captures nothing — would succeed).
+   *
+   * Catalog folding and normalization stay in the **parent** (the same
+   * `@pnpm/catalogs`-derived path `layerLive` uses); the child returns only the
+   * raw threaded config slice, since the script cannot import kit code.
+   *
+   * Requires core's `ChildProcessSpawner`, resolved when the layer is built —
+   * the consumer provides it once at the edge (`@effect/platform-node`'s
+   * `NodeServices.layer`), the same discharge `@effected/git` uses. Wired by
+   * `WorkspaceCatalogs.layerWithConfigDependenciesSubprocess` /
+   * `Workspaces.layerWithConfigDependenciesSubprocess`.
+   */
+  static readonly layerSubprocess: Layer.Layer<ConfigDependencyHooks, never, ChildProcessSpawner.ChildProcessSpawner>;
 }
 //#endregion
 //#region src/DependencyGraph.d.ts
@@ -2097,6 +2149,24 @@ declare class WorkspaceCatalogs extends WorkspaceCatalogs_base {
    * Parameterized, so bind it to a `const` and reuse it.
    */
   static readonly layerWithConfigDependencies: (options?: WorkspaceCatalogsOptions) => Layer.Layer<WorkspaceCatalogs, never, WorkspaceRoot | LockfileReader | FileSystem.FileSystem | Path.Path>;
+  /**
+   * The opt-in layer that replays config-dependency `pnpmfile` hooks in a
+   * `node` **child process**: it wires
+   * {@link ConfigDependencyHooks.layerSubprocess} in place of the in-process
+   * `layerLive`.
+   *
+   * @remarks
+   * Same typed semantics as {@link WorkspaceCatalogs.layerWithConfigDependencies}
+   * — the two hook layers are drop-in interchangeable — but the replay's
+   * computed dynamic `import()` runs in the subprocess, so it survives bundling
+   * (a bundler compiles a computed in-process `import()` into a context module
+   * that cannot resolve at runtime — every bundled GitHub Action hits this).
+   * The cost is one extra requirement: core's `ChildProcessSpawner`, provided
+   * once at the edge (`@effect/platform-node`'s `NodeServices.layer`) — the
+   * same sanctioned R-widening as `Workspaces.layerWithGit`. Parameterized, so
+   * bind it to a `const` and reuse it.
+   */
+  static readonly layerWithConfigDependenciesSubprocess: (options?: WorkspaceCatalogsOptions) => Layer.Layer<WorkspaceCatalogs, never, WorkspaceRoot | LockfileReader | FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner>;
   /**
    * A test double satisfying the full {@link WorkspaceCatalogsShape} with no
    * filesystem, lockfile read, or hook replay.
@@ -2569,6 +2639,32 @@ declare class Workspaces {
    * **Bind the result to a `const`.**
    */
   static readonly layerWithConfigDependencies: (options?: WorkspacesOptions) => Layer.Layer<WorkspacesServices, never, FileSystem.FileSystem | Path.Path>;
+  /**
+   * The git-free composite with config-dependency hook replay in a `node`
+   * **child process** —
+   * {@link WorkspaceCatalogs.layerWithConfigDependenciesSubprocess} in place of
+   * the in-process replay.
+   *
+   * @remarks
+   * Same typed semantics as {@link Workspaces.layerWithConfigDependencies}; the
+   * difference is mechanism, and it matters in exactly one environment class: a
+   * **bundled** consumer. The in-process replay's computed dynamic `import()`
+   * is compiled by bundlers (rspack among them) into a context module that
+   * throws `Cannot find module 'file:///…'` at runtime, which makes
+   * `WorkspaceCatalogs.releaseAgeGate()` unreachable from any bundled GitHub
+   * Action. Here the computed import runs inside a `node` child process whose
+   * program text is a static string handed over argv, so nothing computed
+   * enters the bundle graph.
+   *
+   * The extra requirement is core's `ChildProcessSpawner`, provided once at
+   * the edge (`@effect/platform-node`'s `NodeServices.layer`) — the same
+   * sanctioned R-widening as {@link Workspaces.layerWithGit}, and the reason
+   * this is a separate composite rather than a flag: a consumer that keeps the
+   * in-process replay should not have to be able to spawn a subprocess.
+   *
+   * **Bind the result to a `const`.**
+   */
+  static readonly layerWithConfigDependenciesSubprocess: (options?: WorkspacesOptions) => Layer.Layer<WorkspacesServices, never, FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner>;
   /**
    * The git-free composite plus {@link ChangeDetector} and
    * {@link WorkspaceSnapshots}, over `@effected/git`'s `Git` service.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/workspaces",
-	"version": "0.9.5",
+	"version": "0.10.0",
 	"private": false,
 	"description": "Monorepo workspace tooling as Effect services — root discovery, package enumeration, the dependency graph, package-manager detection, pnpm catalog resolution, lockfile IO and git-based change detection.",
 	"keywords": [
@@ -46,11 +46,11 @@
 		"./package.json": "./package.json"
 	},
 	"dependencies": {
-		"@effected/commands": "^0.2.1",
+		"@effected/commands": "^0.3.0",
 		"@effected/git": "^0.5.2",
 		"@effected/glob": "^0.2.2",
 		"@effected/lockfiles": "^0.3.2",
-		"@effected/npm": "^0.8.2",
+		"@effected/npm": "^0.8.3",
 		"@effected/package-json": "^0.7.3",
 		"@effected/semver": "^0.3.2",
 		"@effected/walker": "^0.3.4",