@savvy-web/silk-effects 5.3.1 → 5.5.0

package/README.md

@@ -13,7 +13,7 @@ Shared [Effect](https://effect.website/) library providing Silk Suite convention
 - Supply the Silk commitlint config, its prompt and formatter, and the `silk/body-no-markdown` rule
 - Run the lint-staged handlers and the `savvy lint fmt` formatters from a single implementation so the hook and the CLI cannot drift
 - Inspect a Turborepo read-only — diagnose per-package cache hits, derive the task graph and compute affected packages, all over `turbo --dry`
-- Manage the vendored reference repos declared in `.repos/config.json`, including submodule sync, pinning and drift reporting
+- Manage the vendored reference repos declared in `.repos/config.json` — submodule status, drift detection, sync, add, pin, note, remove, rename and restore — and keep every vendored tree read-only between mutations
 - Locate config files and keep Biome schema URLs in sync across workspaces
 
 ## Install
@@ -364,6 +364,33 @@ const diagnosis = await Effect.runPromise(
 // => CacheDiagnosis: per-package HIT/MISS breakdown for the task
 ```
 
+#### ReposManager, ReposDrift and ReposLockdown
+
+The `Repos` namespace drives vendored reference repos — upstream sources checked out as git submodules under `.repos/`, declared in a `.repos/config.json` manifest. `ReposConfigStore` reads and writes that manifest, and `ReposManager` does the git work: `status(root)` reports presence, the pinned commit, working-tree dirtiness and stale notes, `sync(root)` initializes missing submodules and applies each entry's sparse-checkout, `pin(root, name, ref)` moves an entry to a new ref, `add(root, options)` vendors a new one, `note(root, name, op)` adds, removes or promotes an agent note, `remove(root, name)` unvendors an entry, `rename(root, oldName, newName)` renames one in place, and `restore(root, names?)` hard-resets one or more dirty checkouts back to their pinned commit. `ReposDrift.check(root)` is a read-only companion — it reconciles the manifest, `.gitmodules`, the worktree, and `git submodule status`, reporting any mismatch as a typed drift kind.
+
+`ReposLockdown` is the permissions boundary around all of that. `lock(root, name)` chmods a vendored worktree and its submodule git metadata to files `0444` and directories `0555` (an executable file locks at `0555` instead, preserving its executable bit); `unlock` reverses it, restoring `0644`/`0755` (`0755` for a file that was executable); `withUnlocked(root, name, effect)` brackets an effect between the two. `ReposManager`'s `sync`, `add`, `pin`, `remove` and `restore` run their git mutations inside that bracket and re-lock afterwards, and `rename` hand-rolls the same unlock/relock contract across its `oldName`→`newName` move, so a vendored tree is read-only whenever the manager is not mid-write. Reads are unaffected — a locked tree needs no special handling to open a file.
+
+Two consequences for callers: `ReposManager.layer` requires `ReposLockdown` alongside `ReposConfigStore`, `Git`, `FileSystem` and `Path`, and `sync`, `add`, `pin`, `remove`, `rename` and `restore` widen their error channel with `ReposLockdownError`, which carries the offending `path` and a `reason`.
+
+```typescript
+import { Effect, Layer } from "effect";
+import { NodeServices } from "@effect/platform-node";
+import { Git } from "@effected/git";
+import { Repos } from "@savvy-web/silk-effects";
+
+const report = await Effect.runPromise(
+  Effect.gen(function* () {
+    const repos = yield* Repos.ReposManager;
+    return yield* repos.sync(process.cwd());
+  }).pipe(
+    Effect.provide(Repos.ReposManager.layer),
+    Effect.provide(Layer.mergeAll(Repos.ReposConfigStore.layer, Repos.ReposLockdown.layer, Git.layer)),
+    Effect.provide(NodeServices.layer),
+  ),
+);
+// => ReposSyncReport: per-repo initialization and sparse-checkout outcome, trees left read-only
+```
+
 ## Documentation
 
 - [Overview](./docs/01-overview.md) — what the library is, its design philosophy and platform-layer model

package/index.d.ts

@@ -8281,6 +8281,60 @@ declare class NoteNotFoundError extends NoteNotFoundErrorBase<{
 }> {
   get message(): string;
 }
+/** @internal */
+declare const ReposLockdownErrorBase: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "ReposLockdownError";
+} & Readonly<A>;
+/**
+ * A permissions (lockdown) operation on a vendored repo failed.
+ * @public
+ */
+declare class ReposLockdownError extends ReposLockdownErrorBase<{
+  readonly path: string;
+  readonly reason: string;
+}> {
+  get message(): string;
+}
+//#endregion
+//#region src/repos/schemas/drift.d.ts
+/**
+ * The kinds of drift {@link ReposDrift} can detect between the four
+ * authorities it reconciles: the manifest, `.gitmodules`, the worktree, and
+ * `git submodule status`.
+ * @public
+ */
+declare const DriftKind: Schema.Literals<readonly ["urlMismatch", "pathMismatch", "unregisteredManifestEntry", "orphanGitmodulesEntry", "missingWorktree", "checkoutDiverged", "missingShallow", "gitmodulesUnparsable"]>;
+/** @public */
+type DriftKind = typeof DriftKind.Type;
+declare const RepoDrift_base: Schema.Class<RepoDrift, Schema.Struct<{
+  readonly name: Schema.String;
+  readonly kind: Schema.Literals<readonly ["urlMismatch", "pathMismatch", "unregisteredManifestEntry", "orphanGitmodulesEntry", "missingWorktree", "checkoutDiverged", "missingShallow", "gitmodulesUnparsable"]>;
+  readonly detail: Schema.String;
+  readonly manifestValue: Schema.optionalKey<Schema.String>;
+  readonly observedValue: Schema.optionalKey<Schema.String>;
+}>, {}>;
+/**
+ * One detected disagreement between two (or more) of the four authorities
+ * for a single vendored repo.
+ *
+ * @remarks
+ * `manifestValue`/`observedValue` carry the two disagreeing values when the
+ * drift is a value mismatch (`urlMismatch`, `pathMismatch`); other kinds
+ * populate whichever side has a value to show (or neither, for
+ * `gitmodulesUnparsable`, which is not about one repo).
+ * @public
+ */
+declare class RepoDrift extends RepoDrift_base {}
+declare const ReposDriftReport_base: Schema.Class<ReposDriftReport, Schema.Struct<{
+  readonly drifts: Schema.$Array<typeof RepoDrift>;
+  readonly clean: Schema.Boolean;
+}>, {}>;
+/**
+ * The result of reconciling the manifest, `.gitmodules`, the worktree, and
+ * `git submodule status` for every vendored repo.
+ * @public
+ */
+declare class ReposDriftReport extends ReposDriftReport_base {}
 //#endregion
 //#region src/repos/schemas/manifest.d.ts
 /**
@@ -8368,6 +8422,21 @@ type ReposManifestFile = typeof ReposManifestFile.Type;
 /**
  * Status of one vendored repo: gitlink presence and dirtiness, plus notes
  * that no longer match the pinned ref.
+ *
+ * @remarks
+ * `commit` is an alias of `stagedCommit`, retained for one release so an
+ * existing consumer reading `entry.commit` keeps working while it migrates to
+ * the index-aware triple. It carries no independent release tag beyond
+ * `@public` (this schema has no narrower audience to gate it behind).
+ * Removal is scheduled by a tracked issue, not gated on a renderer migration
+ * precondition here.
+ *
+ * Not fully behavior-preserving: `commit: stagedCommit ?? null` reads `null`
+ * for a gitlink committed at `HEAD` but staged for REMOVAL, where the prior
+ * single-`commit` field showed the committed oid. `stagedCommit` is `None`
+ * in exactly that case (nothing is staged), so the alias reports "nothing
+ * staged" rather than "here is what HEAD still has" — a real, if narrow,
+ * difference from the pre-triple `commit` field's behavior.
  * @public
  */
 declare const RepoStatusEntry: Schema.Struct<{
@@ -8375,7 +8444,14 @@ declare const RepoStatusEntry: Schema.Struct<{
   readonly ref: Schema.String;
   readonly purpose: Schema.String;
   readonly present: Schema.Boolean;
+  /** @deprecated alias of `stagedCommit`; retained for one release. */
   readonly commit: Schema.NullOr<Schema.String>;
+  /** The gitlink oid staged in the index (`git ls-files --stage`) — sees a pin BEFORE it is committed. */
+  readonly stagedCommit: Schema.optionalKey<Schema.String>;
+  /** The gitlink oid committed at `HEAD` (`git ls-tree HEAD`). */
+  readonly committedCommit: Schema.optionalKey<Schema.String>;
+  /** The commit actually checked out in the submodule worktree (`git rev-parse HEAD` inside it); absent when there is no checkout. */
+  readonly checkedOutCommit: Schema.optionalKey<Schema.String>;
   readonly dirty: Schema.Boolean;
   readonly staleNoteIds: Schema.$Array<Schema.String>;
 }>;
@@ -8391,7 +8467,14 @@ declare const ReposStatusReport: Schema.Struct<{
     readonly ref: Schema.String;
     readonly purpose: Schema.String;
     readonly present: Schema.Boolean;
+    /** @deprecated alias of `stagedCommit`; retained for one release. */
     readonly commit: Schema.NullOr<Schema.String>;
+    /** The gitlink oid staged in the index (`git ls-files --stage`) — sees a pin BEFORE it is committed. */
+    readonly stagedCommit: Schema.optionalKey<Schema.String>;
+    /** The gitlink oid committed at `HEAD` (`git ls-tree HEAD`). */
+    readonly committedCommit: Schema.optionalKey<Schema.String>;
+    /** The commit actually checked out in the submodule worktree (`git rev-parse HEAD` inside it); absent when there is no checkout. */
+    readonly checkedOutCommit: Schema.optionalKey<Schema.String>;
     readonly dirty: Schema.Boolean;
     readonly staleNoteIds: Schema.$Array<Schema.String>;
   }>>;
@@ -8402,7 +8485,8 @@ type ReposStatusReport = typeof ReposStatusReport.Type;
 /**
  * Result of reconciling working-tree submodules with the manifest: missing
  * repos initialized, sparse-checkout patterns re-applied, already-present
- * repos left alone, and stale locks cleared.
+ * repos left alone, stale locks cleared, drifted submodule URLs reconciled,
+ * and orphan manifest entries (no gitlink at all) registered.
  * @public
  */
 declare const ReposSyncReport: Schema.Struct<{
@@ -8410,6 +8494,8 @@ declare const ReposSyncReport: Schema.Struct<{
   readonly sparseApplied: Schema.$Array<Schema.String>;
   readonly upToDate: Schema.$Array<Schema.String>;
   readonly clearedLocks: Schema.$Array<Schema.String>;
+  readonly urlSynced: Schema.$Array<Schema.String>;
+  readonly registered: Schema.$Array<Schema.String>;
 }>;
 /** @public */
 type ReposSyncReport = typeof ReposSyncReport.Type;
@@ -8438,6 +8524,62 @@ declare const ReposAddResult: Schema.Struct<{
 }>;
 /** @public */
 type ReposAddResult = typeof ReposAddResult.Type;
+/**
+ * Result of removing a vendored repo from the manifest: the gitlink, module
+ * gitdir, and `.gitmodules` section are all gone, and the entry's notes are
+ * surfaced so any durable ones can be promoted elsewhere before this result
+ * is committed.
+ * @public
+ */
+declare const ReposRemoveResult: Schema.Struct<{
+  readonly name: Schema.String;
+  readonly path: Schema.String;
+  readonly commitMessage: Schema.String;
+  readonly removedNotes: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly date: Schema.String;
+    readonly ref: Schema.String;
+    readonly note: Schema.String;
+  }>>;
+}>;
+/** @public */
+type ReposRemoveResult = typeof ReposRemoveResult.Type;
+/**
+ * Result of renaming a vendored repo's manifest key: the `.repos/<name>`
+ * worktree moved, the module gitdir's `core.worktree` values re-pointed, the
+ * `.gitmodules` section canonicalized to the new name, and the manifest key
+ * renamed.
+ * @public
+ */
+declare const ReposRenameResult: Schema.Struct<{
+  readonly oldName: Schema.String;
+  readonly newName: Schema.String;
+  readonly path: Schema.String;
+  readonly commitMessage: Schema.String;
+}>;
+/** @public */
+type ReposRenameResult = typeof ReposRenameResult.Type;
+/**
+ * Result of hard-resetting one or more vendored repos to their staged (or
+ * committed) gitlink commit and re-applying sparse-checkout paths.
+ *
+ * @remarks
+ * `restored` lists every repo actually reset, paired with the commit it was
+ * reset to. `skippedClean` is populated ONLY by the names-omitted form of
+ * {@link ReposManagerShape.restore} — repos left untouched because `status`
+ * reported them clean; an explicit-names call never skips anything (an
+ * explicit ask is always honored), so it always reports an empty array.
+ * @public
+ */
+declare const ReposRestoreResult: Schema.Struct<{
+  readonly restored: Schema.$Array<Schema.Struct<{
+    readonly name: Schema.String;
+    readonly commit: Schema.String;
+  }>>;
+  readonly skippedClean: Schema.$Array<Schema.String>;
+}>;
+/** @public */
+type ReposRestoreResult = typeof ReposRestoreResult.Type;
 /**
  * Result of an agent-note mutation against a vendored repo.
  * @public
@@ -8460,6 +8602,14 @@ interface ReposConfigStoreShape {
   readonly exists: (root: string) => Effect.Effect<boolean>;
   readonly read: (root: string) => Effect.Effect<ReposManifestFile, ReposConfigError>;
   readonly write: (root: string, manifest: ReposManifestFile) => Effect.Effect<void, ReposConfigError>;
+  /**
+   * Serialized read-modify-write: acquires an exclusive-create lock file
+   * beside the manifest, reads the current manifest (an absent manifest is
+   * passed to `fn` as `{ repos: {} }` — `update` can initialize), runs `fn`,
+   * writes the result, and always releases the lock. Concurrent callers
+   * queue behind the lock rather than racing a lost update.
+   */
+  readonly update: (root: string, fn: (manifest: ReposManifestFile) => ReposManifestFile | Effect.Effect<ReposManifestFile, ReposConfigError>) => Effect.Effect<ReposManifestFile, ReposConfigError>;
 }
 declare const ReposConfigStore_base: Context.ServiceClass<ReposConfigStore, "@savvy-web/silk-effects/ReposConfigStore", ReposConfigStoreShape>;
 /**
@@ -8474,6 +8624,77 @@ declare class ReposConfigStore extends ReposConfigStore_base {
   static readonly layer: Layer.Layer<ReposConfigStore, never, FileSystem.FileSystem | Path.Path>;
 }
 //#endregion
+//#region src/repos/services/drift.d.ts
+/**
+ * The {@link ReposDrift} service shape.
+ * @public
+ */
+interface ReposDriftShape {
+  readonly check: (root: string) => Effect.Effect<ReposDriftReport, ReposConfigError | GitSubmoduleError>;
+}
+declare const ReposDrift_base: Context.ServiceClass<ReposDrift, "@savvy-web/silk-effects/ReposDrift", ReposDriftShape>;
+/**
+ * Reconciles the four authorities a vendored repo's state is spread across —
+ * the manifest, `.gitmodules`, the worktree, and `git submodule status` —
+ * and reports every disagreement found. Read-only: no staging, no lockdown
+ * interaction, so it runs unmodified against a locked (`ReposLockdown`)
+ * tree.
+ * @public
+ */
+declare class ReposDrift extends ReposDrift_base {
+  /**
+   * Production implementation of {@link ReposDrift}.
+   * @public
+   */
+  static readonly layer: Layer.Layer<ReposDrift, never, ReposConfigStore | Git | FileSystem.FileSystem | Path.Path>;
+}
+//#endregion
+//#region src/repos/services/lockdown.d.ts
+/**
+ * The {@link ReposLockdown} service shape.
+ * @public
+ */
+interface ReposLockdownShape {
+  readonly lock: (root: string, name: string) => Effect.Effect<void, ReposLockdownError>;
+  readonly unlock: (root: string, name: string) => Effect.Effect<void, ReposLockdownError>;
+  readonly withUnlocked: <A, E, R>(root: string, name: string, effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | ReposLockdownError, R>;
+}
+/**
+ * Derives a submodule's git metadata directory (`.git/modules/...`) from the
+ * checkout itself rather than assuming it is named after the manifest key.
+ *
+ * A submodule worktree's `<root>/.repos/<name>/.git` is normally a FILE
+ * containing a single `gitdir: <path>` line pointing at the real metadata
+ * directory, which git names after whatever path/name the submodule was
+ * REGISTERED under — not necessarily the manifest key (e.g. this repo's own
+ * `effect` entry has gitdir `.git/modules/.repos/effect-smol`). This helper
+ * reads that pointer and resolves it (relative pointers are relative to the
+ * directory containing the `.git` file) so callers always land on the real
+ * metadata directory.
+ *
+ * Falls back to the name-based path `<root>/.git/modules/<REPOS_DIR>/<name>`
+ * whenever the pointer can't be read (submodule not initialized, `.git`
+ * missing) — this never fails, it only degrades to prior behavior. If
+ * `<root>/.repos/<name>/.git` is itself a directory (a plain, non-submodule
+ * checkout), it is used directly as the metadata directory.
+ *
+ * @internal
+ */
+declare const resolveModuleDir: (fs: FileSystem.FileSystem, path: Path.Path, root: string, name: string) => Effect.Effect<string>;
+declare const ReposLockdown_base: Context.ServiceClass<ReposLockdown, "@savvy-web/silk-effects/ReposLockdown", ReposLockdownShape>;
+/**
+ * Enforces OS-level read-only permissions on vendored repos so they cannot
+ * be accidentally edited outside the sync flow.
+ * @public
+ */
+declare class ReposLockdown extends ReposLockdown_base {
+  /**
+   * Production layer over the core FileSystem.
+   * @public
+   */
+  static readonly layer: Layer.Layer<ReposLockdown, never, FileSystem.FileSystem | Path.Path>;
+}
+//#endregion
 //#region src/repos/services/manager.d.ts
 /**
  * Minimum age (in milliseconds) a `.lock` file must reach before `sync` will
@@ -8498,15 +8719,15 @@ declare const STALE_LOCK_MAX_AGE_MS: number;
  */
 interface ReposManagerShape {
   readonly status: (root: string) => Effect.Effect<ReposStatusReport, ReposConfigError | GitSubmoduleError>;
-  readonly sync: (root: string) => Effect.Effect<ReposSyncReport, ReposConfigError | GitSubmoduleError>;
+  readonly sync: (root: string) => Effect.Effect<ReposSyncReport, ReposConfigError | GitSubmoduleError | ReposLockdownError>;
   readonly add: (root: string, options: {
     readonly url: string;
     readonly ref: string;
     readonly purpose: string;
     readonly name?: string;
     readonly sparse?: ReadonlyArray<string>;
-  }) => Effect.Effect<ReposAddResult, ReposConfigError | GitSubmoduleError>;
-  readonly pin: (root: string, name: string, ref: string) => Effect.Effect<ReposPinResult, ReposConfigError | GitSubmoduleError | RepoNotFoundError>;
+  }) => Effect.Effect<ReposAddResult, ReposConfigError | GitSubmoduleError | ReposLockdownError>;
+  readonly pin: (root: string, name: string, ref: string) => Effect.Effect<ReposPinResult, ReposConfigError | GitSubmoduleError | RepoNotFoundError | ReposLockdownError>;
   readonly note: (root: string, name: string, op: {
     readonly op: "add";
     readonly note: string;
@@ -8518,13 +8739,36 @@ interface ReposManagerShape {
     readonly id: string;
     readonly into: "layout" | "startHere";
   }) => Effect.Effect<ReposNoteResult, ReposConfigError | RepoNotFoundError | NoteNotFoundError>;
+  readonly remove: (root: string, name: string) => Effect.Effect<ReposRemoveResult, ReposConfigError | GitSubmoduleError | RepoNotFoundError | ReposLockdownError>;
+  /**
+   * Crash contract: unlike {@link add}, `rename` has no compensating
+   * rollback. `Effect.uninterruptibleMask` guards fiber interruption, not a
+   * hard process kill, so a `kill -9` between `git mv` and the manifest
+   * write can leave the tree renamed in git, the manifest still holding
+   * the old key, and the tree unlocked (the relock finalizer never runs).
+   * This is a deliberate asymmetry with `add`, which DOES roll back —
+   * `rename` does not, because unlike a fresh vendor there is no "nothing
+   * happened yet" state to unwind back to.
+   *
+   * Recovery is NOT a guaranteed clean "just run it again": `git mv` is not
+   * idempotent (a real-git probe confirms a second `git mv <old> <new>`
+   * after the first already succeeded fails with "bad source"), so a crash
+   * after `git mv` lands makes the next `rename` call fail at that same
+   * step rather than resume past it. A crash in that window needs manual
+   * inspection (`git status`, `.repos/config.json`, `.gitmodules`) before
+   * retrying, not a blind re-invocation.
+   */
+  readonly rename: (root: string, oldName: string, newName: string) => Effect.Effect<ReposRenameResult, ReposConfigError | GitSubmoduleError | RepoNotFoundError | ReposLockdownError>;
+  readonly restore: (root: string, names?: ReadonlyArray<string>) => Effect.Effect<ReposRestoreResult, ReposConfigError | GitSubmoduleError | RepoNotFoundError | ReposLockdownError>;
 }
 declare const ReposManager_base: Context.ServiceClass<ReposManager, "@savvy-web/silk-effects/ReposManager", ReposManagerShape>;
 /**
  * Drives the vendored `.repos/` submodules over git: reports status
  * (presence, dirtiness, stale notes), reconciles the working tree with the
  * manifest, vendors new entries (`add`), re-pins existing entries to a new
- * ref (`pin`), and adds, removes, or promotes agent notes (`note`).
+ * ref (`pin`), adds/removes/promotes agent notes (`note`), unvendors
+ * (`remove`), renames (`rename`), and explicitly hard-resets dirty
+ * checkouts back to their pinned commit (`restore`).
  * @public
  */
 declare class ReposManager extends ReposManager_base {
@@ -8539,10 +8783,10 @@ declare class ReposManager extends ReposManager_base {
    * this module's {@link GitSubmoduleError} to keep the declared error unions.
    * @public
    */
-  static readonly layer: Layer.Layer<ReposManager, never, ReposConfigStore | Git | FileSystem.FileSystem | Path.Path>;
+  static readonly layer: Layer.Layer<ReposManager, never, ReposConfigStore | Git | FileSystem.FileSystem | Path.Path | ReposLockdown>;
 }
 declare namespace index_d_exports$3 {
-  export { GitSubmoduleError, GitSubmoduleErrorBase, MANIFEST_PATH, NOTE_LIMIT, NoteNotFoundError, NoteNotFoundErrorBase, REPOS_DIR, RepoEntry, RepoName, RepoNotFoundError, RepoNotFoundErrorBase, RepoNote, RepoOrientation, RepoStatusEntry, ReposAddResult, ReposConfigError, ReposConfigErrorBase, ReposConfigStore, ReposConfigStoreShape, ReposManager, ReposManagerShape, ReposManifestFile, ReposNoteResult, ReposPinResult, ReposStatusReport, ReposSyncReport, STALE_LOCK_MAX_AGE_MS };
+  export { DriftKind, GitSubmoduleError, GitSubmoduleErrorBase, MANIFEST_PATH, NOTE_LIMIT, NoteNotFoundError, NoteNotFoundErrorBase, REPOS_DIR, RepoDrift, RepoEntry, RepoName, RepoNotFoundError, RepoNotFoundErrorBase, RepoNote, RepoOrientation, RepoStatusEntry, ReposAddResult, ReposConfigError, ReposConfigErrorBase, ReposConfigStore, ReposConfigStoreShape, ReposDrift, ReposDriftReport, ReposDriftShape, ReposLockdown, ReposLockdownError, ReposLockdownErrorBase, ReposLockdownShape, ReposManager, ReposManagerShape, ReposManifestFile, ReposNoteResult, ReposPinResult, ReposRemoveResult, ReposRenameResult, ReposRestoreResult, ReposStatusReport, ReposSyncReport, STALE_LOCK_MAX_AGE_MS, resolveModuleDir };
 }
 //#endregion
 //#region src/schemas/BiomeConfig.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@savvy-web/silk-effects",
-	"version": "5.3.1",
+	"version": "5.5.0",
 	"private": false,
 	"description": "Shared Effect library for Silk Suite conventions",
 	"homepage": "https://github.com/savvy-web/systems/tree/main/packages/silk-effects",
@@ -33,14 +33,14 @@
 		"@changesets/config": "^4.0.0-next.6",
 		"@changesets/get-github-info": "^1.0.0-next.4",
 		"@changesets/get-release-plan": "^5.0.0-next.9",
-		"@effected/commands": "^0.2.1",
-		"@effected/git": "^0.5.2",
+		"@effected/commands": "^0.3.1",
+		"@effected/git": "^0.6.0",
 		"@effected/glob": "^0.2.2",
 		"@effected/jsonc": "^0.5.2",
 		"@effected/package-json": "^0.7.3",
 		"@effected/templates": "^0.1.1",
 		"@effected/walker": "^0.3.4",
-		"@effected/workspaces": "^0.9.5",
+		"@effected/workspaces": "^0.10.2",
 		"@effected/yaml": "^0.6.1",
 		"@manypkg/get-packages": "^3.1.0",
 		"mdast-util-heading-range": "^4.0.0",

package/repos/errors.js

@@ -45,6 +45,17 @@ var NoteNotFoundError = class extends NoteNotFoundErrorBase {
 		return `no note "${this.id}" on vendored repo "${this.name}"`;
 	}
 };
+/** @internal */
+const ReposLockdownErrorBase = Data.TaggedError("ReposLockdownError");
+/**
+* A permissions (lockdown) operation on a vendored repo failed.
+* @public
+*/
+var ReposLockdownError = class extends ReposLockdownErrorBase {
+	get message() {
+		return `repos lockdown failed at ${this.path}: ${this.reason}`;
+	}
+};
 
 //#endregion
-export { GitSubmoduleError, GitSubmoduleErrorBase, NoteNotFoundError, NoteNotFoundErrorBase, RepoNotFoundError, RepoNotFoundErrorBase, ReposConfigError, ReposConfigErrorBase };
+export { GitSubmoduleError, GitSubmoduleErrorBase, NoteNotFoundError, NoteNotFoundErrorBase, RepoNotFoundError, RepoNotFoundErrorBase, ReposConfigError, ReposConfigErrorBase, ReposLockdownError, ReposLockdownErrorBase };

package/repos/index.js

@@ -1,13 +1,17 @@
 import { __exportAll } from "../_virtual/_rolldown/runtime.js";
 import { MANIFEST_PATH, REPOS_DIR } from "./constants.js";
-import { GitSubmoduleError, GitSubmoduleErrorBase, NoteNotFoundError, NoteNotFoundErrorBase, RepoNotFoundError, RepoNotFoundErrorBase, ReposConfigError, ReposConfigErrorBase } from "./errors.js";
+import { GitSubmoduleError, GitSubmoduleErrorBase, NoteNotFoundError, NoteNotFoundErrorBase, RepoNotFoundError, RepoNotFoundErrorBase, ReposConfigError, ReposConfigErrorBase, ReposLockdownError, ReposLockdownErrorBase } from "./errors.js";
+import { DriftKind, RepoDrift, ReposDriftReport } from "./schemas/drift.js";
 import { RepoEntry, RepoName, RepoNote, RepoOrientation, ReposManifestFile } from "./schemas/manifest.js";
-import { RepoStatusEntry, ReposAddResult, ReposNoteResult, ReposPinResult, ReposStatusReport, ReposSyncReport } from "./schemas/reports.js";
+import { RepoStatusEntry, ReposAddResult, ReposNoteResult, ReposPinResult, ReposRemoveResult, ReposRenameResult, ReposRestoreResult, ReposStatusReport, ReposSyncReport } from "./schemas/reports.js";
 import { ReposConfigStore } from "./services/config-store.js";
+import { ReposDrift } from "./services/drift.js";
+import { ReposLockdown, resolveModuleDir } from "./services/lockdown.js";
 import { ReposManager, STALE_LOCK_MAX_AGE_MS } from "./services/manager.js";
 
 //#region src/repos/index.ts
 var repos_exports = /* @__PURE__ */ __exportAll({
+	DriftKind: () => DriftKind,
 	GitSubmoduleError: () => GitSubmoduleError,
 	GitSubmoduleErrorBase: () => GitSubmoduleErrorBase,
 	MANIFEST_PATH: () => MANIFEST_PATH,
@@ -15,6 +19,7 @@ var repos_exports = /* @__PURE__ */ __exportAll({
 	NoteNotFoundError: () => NoteNotFoundError,
 	NoteNotFoundErrorBase: () => NoteNotFoundErrorBase,
 	REPOS_DIR: () => REPOS_DIR,
+	RepoDrift: () => RepoDrift,
 	RepoEntry: () => RepoEntry,
 	RepoName: () => RepoName,
 	RepoNotFoundError: () => RepoNotFoundError,
@@ -26,14 +31,23 @@ var repos_exports = /* @__PURE__ */ __exportAll({
 	ReposConfigError: () => ReposConfigError,
 	ReposConfigErrorBase: () => ReposConfigErrorBase,
 	ReposConfigStore: () => ReposConfigStore,
+	ReposDrift: () => ReposDrift,
+	ReposDriftReport: () => ReposDriftReport,
+	ReposLockdown: () => ReposLockdown,
+	ReposLockdownError: () => ReposLockdownError,
+	ReposLockdownErrorBase: () => ReposLockdownErrorBase,
 	ReposManager: () => ReposManager,
 	ReposManifestFile: () => ReposManifestFile,
 	ReposNoteResult: () => ReposNoteResult,
 	ReposPinResult: () => ReposPinResult,
+	ReposRemoveResult: () => ReposRemoveResult,
+	ReposRenameResult: () => ReposRenameResult,
+	ReposRestoreResult: () => ReposRestoreResult,
 	ReposStatusReport: () => ReposStatusReport,
 	ReposSyncReport: () => ReposSyncReport,
-	STALE_LOCK_MAX_AGE_MS: () => STALE_LOCK_MAX_AGE_MS
+	STALE_LOCK_MAX_AGE_MS: () => STALE_LOCK_MAX_AGE_MS,
+	resolveModuleDir: () => resolveModuleDir
 });
 
 //#endregion
-export { GitSubmoduleError, GitSubmoduleErrorBase, MANIFEST_PATH, NoteNotFoundError, NoteNotFoundErrorBase, REPOS_DIR, RepoEntry, RepoName, RepoNotFoundError, RepoNotFoundErrorBase, RepoNote, RepoOrientation, RepoStatusEntry, ReposAddResult, ReposConfigError, ReposConfigErrorBase, ReposConfigStore, ReposManager, ReposManifestFile, ReposNoteResult, ReposPinResult, ReposStatusReport, ReposSyncReport, STALE_LOCK_MAX_AGE_MS, repos_exports };
+export { DriftKind, GitSubmoduleError, GitSubmoduleErrorBase, MANIFEST_PATH, NoteNotFoundError, NoteNotFoundErrorBase, REPOS_DIR, RepoDrift, RepoEntry, RepoName, RepoNotFoundError, RepoNotFoundErrorBase, RepoNote, RepoOrientation, RepoStatusEntry, ReposAddResult, ReposConfigError, ReposConfigErrorBase, ReposConfigStore, ReposDrift, ReposDriftReport, ReposLockdown, ReposLockdownError, ReposLockdownErrorBase, ReposManager, ReposManifestFile, ReposNoteResult, ReposPinResult, ReposRemoveResult, ReposRenameResult, ReposRestoreResult, ReposStatusReport, ReposSyncReport, STALE_LOCK_MAX_AGE_MS, repos_exports, resolveModuleDir };

package/repos/schemas/drift.js

@@ -0,0 +1,49 @@
+import { Schema } from "effect";
+
+//#region src/repos/schemas/drift.ts
+/**
+* The kinds of drift {@link ReposDrift} can detect between the four
+* authorities it reconciles: the manifest, `.gitmodules`, the worktree, and
+* `git submodule status`.
+* @public
+*/
+const DriftKind = Schema.Literals([
+	"urlMismatch",
+	"pathMismatch",
+	"unregisteredManifestEntry",
+	"orphanGitmodulesEntry",
+	"missingWorktree",
+	"checkoutDiverged",
+	"missingShallow",
+	"gitmodulesUnparsable"
+]);
+/**
+* One detected disagreement between two (or more) of the four authorities
+* for a single vendored repo.
+*
+* @remarks
+* `manifestValue`/`observedValue` carry the two disagreeing values when the
+* drift is a value mismatch (`urlMismatch`, `pathMismatch`); other kinds
+* populate whichever side has a value to show (or neither, for
+* `gitmodulesUnparsable`, which is not about one repo).
+* @public
+*/
+var RepoDrift = class extends Schema.Class("RepoDrift")({
+	name: Schema.String,
+	kind: DriftKind,
+	detail: Schema.String,
+	manifestValue: Schema.optionalKey(Schema.String),
+	observedValue: Schema.optionalKey(Schema.String)
+}) {};
+/**
+* The result of reconciling the manifest, `.gitmodules`, the worktree, and
+* `git submodule status` for every vendored repo.
+* @public
+*/
+var ReposDriftReport = class extends Schema.Class("ReposDriftReport")({
+	drifts: Schema.Array(RepoDrift),
+	clean: Schema.Boolean
+}) {};
+
+//#endregion
+export { DriftKind, RepoDrift, ReposDriftReport };