@savvy-web/silk 3.4.1 → 3.4.2

package/changesets-changelog.js

@@ -1,5 +1,5 @@
 import { builtinModules, createRequire } from "node:module";
-import { Context, Data, Duration, Effect, Equal, Exit, FileSystem, Function, Hash, HashMap, Layer, Option, Order, Path, Pipeable, PlatformError, Predicate, Result, Schema, SchemaIssue, SchemaTransformation, Stream } from "effect";
+import { Context, Data, Duration, Effect, Equal, Exit, FileSystem, Function, Hash, HashMap, Layer, Option, Order, Path, Pipeable, PlatformError, Predicate, Redacted, Ref, Result, Schema, SchemaIssue, SchemaTransformation, Stdio, Stream } from "effect";
 import * as path$1 from "node:path";
 import { basename, delimiter, dirname, isAbsolute, join, normalize, relative, resolve } from "node:path";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
@@ -2352,7 +2352,7 @@ var GlobSet = class GlobSet extends Schema.Class("GlobSet")(Schema.Struct({ patt
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/BunExtension.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/BunExtension.js
 /**
 * Extension data specific to bun lockfiles, attached to `Lockfile.extension`
 * when the format is `"bun"`.
@@ -2374,7 +2374,7 @@ var BunExtension = class extends Schema.Class("BunExtension")({
 }) {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/CatalogResolver.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.3_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/CatalogResolver.js
 /**
 * Contract for resolving pnpm `catalog:` dependency specifiers to concrete
 * version ranges.
@@ -2410,7 +2410,7 @@ var BunExtension = class extends Schema.Class("BunExtension")({
 *
 * @public
 */
-var CatalogResolver = class CatalogResolver extends Context.Service()("@effected/npm/CatalogResolver") {
+var CatalogResolver$1 = class CatalogResolver extends Context.Service()("@effected/npm/CatalogResolver") {
 	/**
 	* No-op default: `rangeOf` always succeeds with `Option.none()`, never
 	* consulting an actual catalog. A pure `Layer.succeed`, bound to a const
@@ -2421,7 +2421,7 @@ var CatalogResolver = class CatalogResolver extends Context.Service()("@effected
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/WorkspaceResolver.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.3_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/WorkspaceResolver.js
 /**
 * Raised when a `catalog:` or `workspace:` specifier cannot be resolved
 * because the resolution mechanism itself failed — not for an ordinary
@@ -2435,7 +2435,7 @@ var CatalogResolver = class CatalogResolver extends Context.Service()("@effected
 *
 * @public
 */
-var DependencyResolutionError = class extends Schema.TaggedErrorClass()("DependencyResolutionError", {
+var DependencyResolutionError$1 = class extends Schema.TaggedErrorClass()("DependencyResolutionError", {
 	specifier: Schema.String,
 	cause: Schema.Defect()
 }) {
@@ -2473,7 +2473,7 @@ var DependencyResolutionError = class extends Schema.TaggedErrorClass()("Depende
 *
 * @public
 */
-var WorkspaceResolver = class WorkspaceResolver extends Context.Service()("@effected/npm/WorkspaceResolver") {
+var WorkspaceResolver$1 = class WorkspaceResolver extends Context.Service()("@effected/npm/WorkspaceResolver") {
 	/**
 	* No-op default: `versionOf` always succeeds with `Option.none()`, never
 	* consulting an actual workspace. A pure `Layer.succeed`, bound to a
@@ -2483,7 +2483,7 @@ var WorkspaceResolver = class WorkspaceResolver extends Context.Service()("@effe
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/CatalogAssemblyError.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.3_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/CatalogAssemblyError.js
 /**
 * Raised when a workspace's catalogs cannot be assembled — a `pnpm-workspace.yaml`
 * that is unreadable or not valid YAML, a root `package.json` `workspaces` field
@@ -2528,14 +2528,14 @@ var CatalogAssemblyError = class extends Schema.TaggedErrorClass()("CatalogAssem
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/DependencySection.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.3_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/DependencySection.js
 /**
 * The short dependency kind: which dependency map an entry came from, named the
 * way consumers branch on it.
 *
 * @public
 */
-const DependencyKind = Schema.Literals([
+const DependencyKind$1 = Schema.Literals([
 	"prod",
 	"dev",
 	"peer",
@@ -2547,19 +2547,19 @@ const DependencyKind = Schema.Literals([
 *
 * @public
 */
-const DependencyField = Schema.Literals([
+const DependencyField$1 = Schema.Literals([
 	"dependencies",
 	"devDependencies",
 	"peerDependencies",
 	"optionalDependencies"
 ]);
-const KIND_TO_FIELD = {
+const KIND_TO_FIELD$1 = {
 	prod: "dependencies",
 	dev: "devDependencies",
 	peer: "peerDependencies",
 	optional: "optionalDependencies"
 };
-const FIELD_TO_KIND = Object.fromEntries(Object.entries(KIND_TO_FIELD).map(([kind, field]) => [field, kind]));
+const FIELD_TO_KIND$1 = Object.fromEntries(Object.entries(KIND_TO_FIELD$1).map(([kind, field]) => [field, kind]));
 
 //#endregion
 //#region ../../node_modules/.pnpm/@effected+semver@0.3.2_effect@4.0.0-beta.101/node_modules/@effected/semver/internal/desugar.js
@@ -2937,7 +2937,7 @@ const parseRangeComparators = (s) => {
 * Parse a range expression into comparator sets (OR of ANDs). The empty
 * string parses as the match-all range.
 */
-const parseRange$1 = (raw) => {
+const parseRange$2 = (raw) => {
 	const trimmed = raw.trim();
 	if (trimmed.length === 0) return {
 		ok: true,
@@ -3841,7 +3841,7 @@ sets: Schema.Array(Schema.Array(Comparator)) }) {
 	*/
 	static FromString = Schema.String.pipe(Schema.decodeTo(Range, SchemaTransformation.transformOrFail({
 		decode: (input) => {
-			const result = parseRange$1(input);
+			const result = parseRange$2(input);
 			return result.ok ? Effect.succeed({ sets: normalizeSets(result.value) }) : Effect.fail(new SchemaIssue.InvalidValue(Option.some(input), { message: `Invalid range expression: "${result.input}" at position ${result.position}` }));
 		},
 		encode: (parts) => Effect.succeed(formatRange(parts.sets))
@@ -3872,7 +3872,7 @@ sets: Schema.Array(Schema.Array(Comparator)) }) {
 	* with {@link InvalidRangeError}.
 	*/
 	static parseResult(input) {
-		const result = parseRange$1(input);
+		const result = parseRange$2(input);
 		if (!result.ok) return Result.fail(new InvalidRangeError({
 			input: result.input,
 			position: result.position
@@ -4152,7 +4152,7 @@ const isComparatorSetSubset = (sub, sup) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/DependencySpecifier.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.3_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/DependencySpecifier.js
 /**
 * Indicates that a string could not be parsed as a valid dependency specifier.
 *
@@ -4161,50 +4161,50 @@ const isComparatorSetSubset = (sub, sup) => {
 *
 * @public
 */
-var InvalidDependencySpecifierError = class extends Schema.TaggedErrorClass()("InvalidDependencySpecifierError", { 
+var InvalidDependencySpecifierError$1 = class extends Schema.TaggedErrorClass()("InvalidDependencySpecifierError", { 
 /** The raw input string that failed validation. */
 input: Schema.String }) {
 	get message() {
 		return `Invalid dependency specifier "${this.input}": not a recognized specifier`;
 	}
 };
-const CATALOG_PREFIX = "catalog:";
-const WORKSPACE_PREFIX = "workspace:";
-const isBarePath = (value) => value.startsWith("./") || value.startsWith("../") || value.startsWith("~/") || value.startsWith("/");
-const isGitHubShorthand = (value) => !value.startsWith(".") && !value.startsWith("~") && !value.startsWith("/") && /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+(#.*)?$/.test(value);
-const isGit = (value) => value.startsWith("git+") || value.startsWith("git://") || value.startsWith("github:") || value.startsWith("gist:") || value.startsWith("bitbucket:") || value.startsWith("gitlab:") || isGitHubShorthand(value);
-const isLocal = (value) => value.startsWith("file:") || value.startsWith("link:") || value.startsWith("portal:") || isBarePath(value);
-const isLink = (value) => value.startsWith("link:");
-const isPortal = (value) => value.startsWith("portal:");
-const isCatalog = (value) => value.startsWith(CATALOG_PREFIX);
-const isWorkspace = (value) => value.startsWith(WORKSPACE_PREFIX);
-const isUrl$1 = (value) => value.startsWith("http://") || value.startsWith("https://");
-const parseRange = (value) => {
+const CATALOG_PREFIX$1 = "catalog:";
+const WORKSPACE_PREFIX$1 = "workspace:";
+const isBarePath$1 = (value) => value.startsWith("./") || value.startsWith("../") || value.startsWith("~/") || value.startsWith("/");
+const isGitHubShorthand$1 = (value) => !value.startsWith(".") && !value.startsWith("~") && !value.startsWith("/") && /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+(#.*)?$/.test(value);
+const isGit$1 = (value) => value.startsWith("git+") || value.startsWith("git://") || value.startsWith("github:") || value.startsWith("gist:") || value.startsWith("bitbucket:") || value.startsWith("gitlab:") || isGitHubShorthand$1(value);
+const isLocal$1 = (value) => value.startsWith("file:") || value.startsWith("link:") || value.startsWith("portal:") || isBarePath$1(value);
+const isLink$1 = (value) => value.startsWith("link:");
+const isPortal$1 = (value) => value.startsWith("portal:");
+const isCatalog$1 = (value) => value.startsWith(CATALOG_PREFIX$1);
+const isWorkspace$1 = (value) => value.startsWith(WORKSPACE_PREFIX$1);
+const isUrl$2 = (value) => value.startsWith("http://") || value.startsWith("https://");
+const parseRange$1 = (value) => {
 	const exit = Schema.decodeUnknownExit(Range$1.FromString)(value);
 	return Exit.isSuccess(exit) ? Option.some(exit.value) : Option.none();
 };
-const isRange = (value) => Option.isSome(parseRange(value));
-const protocolOf = (value) => {
-	if (value.startsWith(CATALOG_PREFIX)) return "catalog";
-	if (value.startsWith(WORKSPACE_PREFIX)) return "workspace";
+const isRange$1 = (value) => Option.isSome(parseRange$1(value));
+const protocolOf$1 = (value) => {
+	if (value.startsWith(CATALOG_PREFIX$1)) return "catalog";
+	if (value.startsWith(WORKSPACE_PREFIX$1)) return "workspace";
 	if (value.startsWith("link:")) return "link";
 	if (value.startsWith("portal:")) return "portal";
-	if (value.startsWith("file:") || isBarePath(value)) return "file";
+	if (value.startsWith("file:") || isBarePath$1(value)) return "file";
 	if (value.startsWith("npm:")) return "npm";
-	if (isGit(value)) return "git";
-	if (isUrl$1(value)) return "url";
-	if (isRange(value)) return "range";
+	if (isGit$1(value)) return "git";
+	if (isUrl$2(value)) return "url";
+	if (isRange$1(value)) return "range";
 	if (/^[a-zA-Z][a-zA-Z0-9._-]*$/.test(value)) return "tag";
 	return "unknown";
 };
-const isTag = (value) => protocolOf(value) === "tag";
-const catalogNameOf$1 = (specifier) => {
-	if (!isCatalog(specifier)) return Option.none();
+const isTag$1 = (value) => protocolOf$1(value) === "tag";
+const catalogNameOf$2 = (specifier) => {
+	if (!isCatalog$1(specifier)) return Option.none();
 	const rest = specifier.slice(8).trim();
 	return rest.length === 0 ? Option.none() : Option.some(rest);
 };
-const projectRangeModifier = (range, version) => range === "*" || range === "" ? version : range === "~" ? `~${version}` : range === "^" ? `^${version}` : range;
-const splitWorkspaceRest = (rest) => {
+const projectRangeModifier$1 = (range, version) => range === "*" || range === "" ? version : range === "~" ? `~${version}` : range === "^" ? `^${version}` : range;
+const splitWorkspaceRest$1 = (rest) => {
 	const at = rest.lastIndexOf("@");
 	return at > 0 ? {
 		target: rest.slice(0, at),
@@ -4214,15 +4214,15 @@ const splitWorkspaceRest = (rest) => {
 		range: rest
 	};
 };
-const projectWorkspaceRange = (rest, version) => {
-	const { target, range } = splitWorkspaceRest(rest);
-	const projected = projectRangeModifier(range, version);
+const projectWorkspaceRange$1 = (rest, version) => {
+	const { target, range } = splitWorkspaceRest$1(rest);
+	const projected = projectRangeModifier$1(range, version);
 	return target === void 0 ? projected : `npm:${target}@${projected}`;
 };
-const resolveWorkspace = (specifier, version) => isWorkspace(specifier) ? projectWorkspaceRange(specifier.slice(10), version) : specifier;
-const workspaceTargetOf = (specifier) => {
-	if (!isWorkspace(specifier)) return Option.none();
-	const { target } = splitWorkspaceRest(specifier.slice(10));
+const resolveWorkspace$1 = (specifier, version) => isWorkspace$1(specifier) ? projectWorkspaceRange$1(specifier.slice(10), version) : specifier;
+const workspaceTargetOf$1 = (specifier) => {
+	if (!isWorkspace$1(specifier)) return Option.none();
+	const { target } = splitWorkspaceRest$1(specifier.slice(10));
 	return target === void 0 ? Option.none() : Option.some(target);
 };
 /**
@@ -4232,14 +4232,14 @@ const workspaceTargetOf = (specifier) => {
 *
 * @public
 */
-const isValidDependencySpecifier = (value) => value.length > 0 && protocolOf(value) !== "unknown";
+const isValidDependencySpecifier$1 = (value) => value.length > 0 && protocolOf$1(value) !== "unknown";
 /**
 * A `catalog:` reference. `name` carries the catalog name, or `Option.none()`
 * for the default catalog (`catalog:`).
 *
 * @public
 */
-var CatalogSpecifier = class extends Schema.TaggedClass()("catalog", {
+var CatalogSpecifier$1 = class extends Schema.TaggedClass()("catalog", {
 	/** The original specifier string. */
 	raw: Schema.String,
 	/** The catalog name, or `Option.none()` for the default catalog. */
@@ -4251,7 +4251,7 @@ var CatalogSpecifier = class extends Schema.TaggedClass()("catalog", {
 *
 * @public
 */
-var WorkspaceSpecifier = class extends Schema.TaggedClass()("workspace", {
+var WorkspaceSpecifier$1 = class extends Schema.TaggedClass()("workspace", {
 	/** The original specifier string. */
 	raw: Schema.String,
 	/** The part after `workspace:` (e.g. `*`, `^1.2.3`, or an alias form). */
@@ -4275,7 +4275,7 @@ var WorkspaceSpecifier = class extends Schema.TaggedClass()("workspace", {
 	*   specifier points at (the alias target's version for the alias form).
 	*/
 	resolve(version) {
-		return projectWorkspaceRange(this.range, version);
+		return projectWorkspaceRange$1(this.range, version);
 	}
 };
 /**
@@ -4283,7 +4283,7 @@ var WorkspaceSpecifier = class extends Schema.TaggedClass()("workspace", {
 *
 * @public
 */
-var RangeSpecifier = class extends Schema.TaggedClass()("range", { 
+var RangeSpecifier$1 = class extends Schema.TaggedClass()("range", { 
 /** The original specifier string. */
 raw: Schema.String }) {};
 /**
@@ -4291,7 +4291,7 @@ raw: Schema.String }) {};
 *
 * @public
 */
-var DistTagSpecifier = class extends Schema.TaggedClass()("dist-tag", { 
+var DistTagSpecifier$1 = class extends Schema.TaggedClass()("dist-tag", { 
 /** The original specifier string (also the tag name). */
 raw: Schema.String }) {};
 /**
@@ -4300,35 +4300,35 @@ raw: Schema.String }) {};
 *
 * @public
 */
-var RawSpecifier = class extends Schema.TaggedClass()("raw", { 
+var RawSpecifier$1 = class extends Schema.TaggedClass()("raw", { 
 /** The original specifier string. */
 raw: Schema.String }) {};
-const Classified = Schema.Union([
-	CatalogSpecifier,
-	WorkspaceSpecifier,
-	RangeSpecifier,
-	DistTagSpecifier,
-	RawSpecifier
+const Classified$1 = Schema.Union([
+	CatalogSpecifier$1,
+	WorkspaceSpecifier$1,
+	RangeSpecifier$1,
+	DistTagSpecifier$1,
+	RawSpecifier$1
 ]);
-const classify$1 = (value) => {
-	if (isCatalog(value)) return CatalogSpecifier.make({
+const classify$2 = (value) => {
+	if (isCatalog$1(value)) return CatalogSpecifier$1.make({
 		raw: value,
-		name: catalogNameOf$1(value)
+		name: catalogNameOf$2(value)
 	});
-	if (isWorkspace(value)) return WorkspaceSpecifier.make({
+	if (isWorkspace$1(value)) return WorkspaceSpecifier$1.make({
 		raw: value,
 		range: value.slice(10)
 	});
-	if (isRange(value)) return RangeSpecifier.make({ raw: value });
-	if (isTag(value)) return DistTagSpecifier.make({ raw: value });
-	return RawSpecifier.make({ raw: value });
+	if (isRange$1(value)) return RangeSpecifier$1.make({ raw: value });
+	if (isTag$1(value)) return DistTagSpecifier$1.make({ raw: value });
+	return RawSpecifier$1.make({ raw: value });
 };
-const fromString = Schema.String.pipe(Schema.decodeTo(Classified, SchemaTransformation.transformOrFail({
-	decode: (input) => isValidDependencySpecifier(input) ? Effect.succeed(classify$1(input)) : Effect.fail(new SchemaIssue.InvalidValue(Option.some(input), { message: `Invalid dependency specifier: "${input}"` })),
+const fromString$1 = Schema.String.pipe(Schema.decodeTo(Classified$1, SchemaTransformation.transformOrFail({
+	decode: (input) => isValidDependencySpecifier$1(input) ? Effect.succeed(classify$2(input)) : Effect.fail(new SchemaIssue.InvalidValue(Option.some(input), { message: `Invalid dependency specifier: "${input}"` })),
 	encode: (classified) => Effect.succeed(classified.raw)
 })));
-const brandedSpecifier = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidDependencySpecifier(value) ? void 0 : "Expected a valid dependency specifier")), Schema.brand("DependencySpecifier"));
-const decode$3 = (input) => Schema.decodeUnknownEffect(brandedSpecifier)(input).pipe(Effect.mapError(() => new InvalidDependencySpecifierError({ input })));
+const brandedSpecifier$1 = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidDependencySpecifier$1(value) ? void 0 : "Expected a valid dependency specifier")), Schema.brand("DependencySpecifier"));
+const decode$5 = (input) => Schema.decodeUnknownEffect(brandedSpecifier$1)(input).pipe(Effect.mapError(() => new InvalidDependencySpecifierError$1({ input })));
 /**
 * A valid dependency version specifier, carrying the protocol taxonomy statics
 * (`DependencySpecifier.protocolOf` and friends) that classify any specifier
@@ -4339,44 +4339,44 @@ const decode$3 = (input) => Schema.decodeUnknownEffect(brandedSpecifier)(input).
 *
 * @public
 */
-const DependencySpecifier = Object.assign(brandedSpecifier, {
-	protocolOf,
-	parseRange,
-	isRange,
-	isTag,
-	isGit,
-	isUrl: isUrl$1,
-	isLocal,
-	isLink,
-	isPortal,
-	isCatalog,
-	isWorkspace,
-	catalogNameOf: catalogNameOf$1,
-	resolveWorkspace,
-	workspaceTargetOf,
-	isValid: isValidDependencySpecifier,
-	decode: decode$3,
-	FromString: fromString
+const DependencySpecifier$1 = Object.assign(brandedSpecifier$1, {
+	protocolOf: protocolOf$1,
+	parseRange: parseRange$1,
+	isRange: isRange$1,
+	isTag: isTag$1,
+	isGit: isGit$1,
+	isUrl: isUrl$2,
+	isLocal: isLocal$1,
+	isLink: isLink$1,
+	isPortal: isPortal$1,
+	isCatalog: isCatalog$1,
+	isWorkspace: isWorkspace$1,
+	catalogNameOf: catalogNameOf$2,
+	resolveWorkspace: resolveWorkspace$1,
+	workspaceTargetOf: workspaceTargetOf$1,
+	isValid: isValidDependencySpecifier$1,
+	decode: decode$5,
+	FromString: fromString$1
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/IntegrityHash.js
-const SRI_RE = /^(sha1|sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2}$/;
-const COREPACK_RE = /^(sha1|sha224|sha256|sha384|sha512)\.[0-9a-f]+$/;
-const YARN_RE = /^[0-9]+(c[0-9]+)?\/[0-9a-f]+$/;
-const isSri = (value) => SRI_RE.test(value);
-const isCorepack = (value) => COREPACK_RE.test(value);
-const isYarnChecksum = (value) => YARN_RE.test(value);
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.3_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/IntegrityHash.js
+const SRI_RE$1 = /^(sha1|sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2}$/;
+const COREPACK_RE$1 = /^(sha1|sha224|sha256|sha384|sha512)\.[0-9a-f]+$/;
+const YARN_RE$1 = /^[0-9]+(c[0-9]+)?\/[0-9a-f]+$/;
+const isSri$1 = (value) => SRI_RE$1.test(value);
+const isCorepack$1 = (value) => COREPACK_RE$1.test(value);
+const isYarnChecksum$1 = (value) => YARN_RE$1.test(value);
 /**
 * Whether a string is a valid integrity hash in the SRI (`<algo>-<base64>`),
 * corepack (`<algo>.<hex>`) or yarn (`<cachekey>/<hex>`) form.
 *
 * @public
 */
-const isValidIntegrityHash = (value) => isSri(value) || isCorepack(value) || isYarnChecksum(value);
-const algorithmOf = (value) => {
-	if (isSri(value)) return Option.some(value.slice(0, value.indexOf("-")));
-	if (isCorepack(value)) return Option.some(value.slice(0, value.indexOf(".")));
+const isValidIntegrityHash$1 = (value) => isSri$1(value) || isCorepack$1(value) || isYarnChecksum$1(value);
+const algorithmOf$1 = (value) => {
+	if (isSri$1(value)) return Option.some(value.slice(0, value.indexOf("-")));
+	if (isCorepack$1(value)) return Option.some(value.slice(0, value.indexOf(".")));
 	return Option.none();
 };
 /**
@@ -4387,15 +4387,15 @@ const algorithmOf = (value) => {
 *
 * @public
 */
-var InvalidIntegrityHashError = class extends Schema.TaggedErrorClass()("InvalidIntegrityHashError", { 
+var InvalidIntegrityHashError$1 = class extends Schema.TaggedErrorClass()("InvalidIntegrityHashError", { 
 /** The raw input string that failed validation. */
 input: Schema.String }) {
 	get message() {
 		return `Invalid integrity hash "${this.input}": expected an SRI (<algo>-<base64>), corepack (<algo>.<hex>) or yarn (<cachekey>/<hex>) form`;
 	}
 };
-const brandedIntegrity = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidIntegrityHash(value) ? void 0 : "Expected an SRI, corepack or yarn integrity hash")), Schema.brand("IntegrityHash"));
-const decode$2 = (input) => Schema.decodeUnknownEffect(brandedIntegrity)(input).pipe(Effect.mapError(() => new InvalidIntegrityHashError({ input })));
+const brandedIntegrity$1 = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidIntegrityHash$1(value) ? void 0 : "Expected an SRI, corepack or yarn integrity hash")), Schema.brand("IntegrityHash"));
+const decode$4 = (input) => Schema.decodeUnknownEffect(brandedIntegrity$1)(input).pipe(Effect.mapError(() => new InvalidIntegrityHashError$1({ input })));
 /**
 * A subresource-integrity hash, covering the SRI (`sha512-<base64>`), corepack
 * (`sha512.<hex>`) and yarn (`10c0/<hex>`) textual forms, carrying taxonomy
@@ -4404,13 +4404,13 @@ const decode$2 = (input) => Schema.decodeUnknownEffect(brandedIntegrity)(input).
 *
 * @public
 */
-const IntegrityHash = Object.assign(brandedIntegrity, {
-	isSri,
-	isCorepack,
-	isYarnChecksum,
-	isValid: isValidIntegrityHash,
-	algorithmOf,
-	decode: decode$2
+const IntegrityHash$1 = Object.assign(brandedIntegrity$1, {
+	isSri: isSri$1,
+	isCorepack: isCorepack$1,
+	isYarnChecksum: isYarnChecksum$1,
+	isValid: isValidIntegrityHash$1,
+	algorithmOf: algorithmOf$1,
+	decode: decode$4
 });
 /**
 * {@link (IntegrityHash:variable)} narrowed to the corepack `<algo>.<hex>` form
@@ -4463,10 +4463,10 @@ const IntegrityHash = Object.assign(brandedIntegrity, {
 *
 * @public
 */
-const CorepackIntegrityHash = brandedIntegrity.pipe(Schema.check(Schema.makeFilter((value) => isCorepack(value) ? void 0 : "Expected a corepack (<algo>.<hex>) integrity hash")));
+const CorepackIntegrityHash$1 = brandedIntegrity$1.pipe(Schema.check(Schema.makeFilter((value) => isCorepack$1(value) ? void 0 : "Expected a corepack (<algo>.<hex>) integrity hash")));
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+commands@0.2.1_effect@4.0.0-beta.101/node_modules/@effected/commands/LocalExec.js
+//#region ../../node_modules/.pnpm/@effected+commands@0.3.1_effect@4.0.0-beta.101/node_modules/@effected/commands/LocalExec.js
 /**
 * The package managers whose project-local exec argv this package knows.
 *
@@ -4675,723 +4675,1397 @@ var LocalExec = class LocalExec extends Context.Service()("@effected/commands/Lo
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/ReleaseAgeGate.js
-const MS_PER_MINUTE = 6e4;
+//#region ../../node_modules/.pnpm/@effected+commands@0.3.1_effect@4.0.0-beta.101/node_modules/@effected/commands/Redaction.js
 /**
-* A source's partial contribution to a {@link ReleaseAgeGate}: the effective
-* gate is assembled from more than one place (inline `pnpm-workspace.yaml`
-* keys, replayed `updateConfig` hooks, `pnpm config get` output), and each
-* source may set the age, the exclude list, both, or neither. Absent fields
-* contribute nothing to the combination.
+* Argument tokens whose *following* positional (or `=`-joined value) is a
+* secret. Lowercase; matching is case-insensitive.
 *
-* Deliberately permissive: unlike {@link ReleaseAgeGate} it does not constrain
-* `ageMinutes` to be non-negative, because the raw values arrive from arbitrary
-* config sources and {@link ReleaseAgeGate.combine} is the single authority
-* that clamps them.
+* @remarks
+* This is the heuristic backstop, not the primary mechanism — it can only know
+* about flags someone thought to list. The primary mechanism is
+* {@link Redaction.applyArgs}, which redacts by **value**: the caller says what
+* its secrets are and every occurrence goes, whatever flag carried it.
 *
 * @public
 */
-const PartialReleaseAgeGate = Schema.Struct({
-	/** Minutes a release must age; absent means this source sets no age. */
-	ageMinutes: Schema.optionalKey(Schema.Number),
-	/** Exempt package-name patterns; absent means this source adds no exemptions. */
-	exclude: Schema.optionalKey(Schema.Array(Schema.String))
-});
-const AgeMinutes = Schema.Number.check(Schema.isGreaterThanOrEqualTo(0), Schema.isFinite());
-const matchesPattern = (name, pattern) => {
-	if (pattern === name) return true;
-	if (!pattern.includes("*")) return false;
-	let nameIndex = 0;
-	let patternIndex = 0;
-	let starIndex = -1;
-	let retryNameIndex = 0;
-	while (nameIndex < name.length) if (pattern[patternIndex] === "*") {
-		starIndex = patternIndex;
-		patternIndex += 1;
-		retryNameIndex = nameIndex;
-	} else if (pattern[patternIndex] === name[nameIndex]) {
-		patternIndex += 1;
-		nameIndex += 1;
-	} else if (starIndex !== -1) {
-		patternIndex = starIndex + 1;
-		retryNameIndex += 1;
-		nameIndex = retryNameIndex;
-	} else return false;
-	while (pattern[patternIndex] === "*") patternIndex += 1;
-	return patternIndex === pattern.length;
-};
-const matchesExclude = (name, patterns) => patterns.some((pattern) => matchesPattern(name, pattern));
+const SECRET_FLAGS = /* @__PURE__ */ new Set([
+	"--access-token",
+	"--api-key",
+	"--auth",
+	"--auth-token",
+	"--otp",
+	"--password",
+	"--registry-token",
+	"--token"
+]);
 /**
-* pnpm's publish-time release-age gate: the number of minutes a published
-* version must age before it is eligible, and the set of package-name patterns
-* exempt from the gate. Mirrors pnpm's `minimumReleaseAge` /
-* `minimumReleaseAgeExclude` config so a resolver can drop too-young candidate
-* versions before picking, avoiding `ERR_PNPM_NO_MATURE_MATCHING_VERSION`.
-*
-* `ageMinutes` is constrained non-negative and finite; a `ReleaseAgeGate` with
-* `ageMinutes <= 0` is an inert gate that filters nothing. Assemble a gate from
-* multiple config sources with {@link ReleaseAgeGate.combine}, and apply it to
-* a package's candidate versions with {@link ReleaseAgeGate.filterVersions}.
-*
-* @example
-* ```ts
-* import { ReleaseAgeGate } from "@effected/npm";
+* npm config keys whose value is a credential (`//registry/:_authToken`,
+* `//registry/:_password`).
+*/
+const AUTH_KEY = /:(?:_authtoken|_password)$/i;
+/**
+* The distinct, non-empty secret values, longest first.
 *
-* const gate = ReleaseAgeGate.combine(
-*   { ageMinutes: 1440 },
-*   { exclude: ["@my-scope/*"] },
-* );
-* // gate.ageMinutes === 1440, gate.exclude === ["@my-scope/*"]
+* @remarks
+* Longest-first is load-bearing: redacting `"ab"` before `"abcd"` rewrites
+* `"abcd"` to `"***cd"`, leaking `"cd"` — a fragment of the longer secret.
+* Empty values are dropped because `"abc".split("").join("***")` would insert
+* the placeholder between every character.
+*/
+const prepare = (secrets) => [...new Set(secrets.map(Redacted.value))].filter((value) => value.length > 0).sort((a, b) => b.length - a.length);
+/** Replaces each prepared value with {@link REDACTED}, literally (never as a pattern). */
+const replaceAll = (text, values) => {
+	let out = text;
+	for (const value of values) out = out.split(value).join("***");
+	return out;
+};
+const apply = (text, secrets) => secrets.length === 0 ? text : replaceAll(text, prepare(secrets));
+const applyArgs = (args, secrets) => {
+	if (secrets.length === 0) return args;
+	const values = prepare(secrets);
+	return args.map((arg) => replaceAll(arg, values));
+};
+/** Whether `name` introduces a credential value. */
+const isSecretName = (name, extra) => {
+	const lower = name.toLowerCase();
+	return SECRET_FLAGS.has(lower) || extra.has(lower) || AUTH_KEY.test(name);
+};
+const scrubArgs = (args, options) => {
+	const extra = new Set((options?.flags ?? []).map((flag) => flag.toLowerCase()));
+	const out = [];
+	for (let index = 0; index < args.length; index++) {
+		const arg = args[index] ?? "";
+		const equals = arg.indexOf("=");
+		if (equals > 0 && isSecretName(arg.slice(0, equals), extra)) {
+			out.push(`${arg.slice(0, equals)}=***`);
+			continue;
+		}
+		out.push(arg);
+		if (isSecretName(arg, extra) && index + 1 < args.length) {
+			out.push("***");
+			index++;
+		}
+	}
+	return out;
+};
+/**
+* Secret scrubbing for command arguments and captured output.
 *
-* const eligible = gate.filterVersions(
-*   ["1.0.0", "1.0.1"],
-*   { "1.0.0": "2020-01-01T00:00:00Z", "1.0.1": "2026-07-21T00:00:00Z" },
-*   "prettier",
-*   Date.now(),
-* );
-* ```
+* @remarks
+* Two mechanisms, deliberately layered. {@link Redaction.apply} and
+* {@link Redaction.applyArgs} redact **by value** — the caller declares its
+* secrets as `Redacted` and every occurrence is removed wherever it appears.
+* {@link Redaction.scrubArgs} is a **flag heuristic** that runs in addition, for
+* the secrets a caller forgot to declare.
 *
 * @public
 */
-var ReleaseAgeGate = class ReleaseAgeGate extends Schema.Class("ReleaseAgeGate")({
-	/** Minutes a published version must age before it is eligible (non-negative, finite). */
-	ageMinutes: AgeMinutes,
-	/** Package-name patterns exempt from the gate (exact names or `*`-globs). */
-	exclude: Schema.Array(Schema.String)
-}) {
-	/**
-	* Combine partial contributions from multiple sources into one effective
-	* gate: **strictest age wins** (the maximum of the contributed ages,
-	* clamped to be non-negative) and the exclude sets **union** (deduplicated,
-	* lexicographically sorted — a canonical wire form, so the combined gate is
-	* deterministic regardless of the order contributions arrive in). A
-	* contribution's absent field adds nothing; a
-	* negative or non-finite contributed age is ignored by the clamp. With no
-	* contributions (or only empty ones) the result is the inert zero gate
-	* (`ageMinutes: 0`, `exclude: []`).
-	*
-	* `combine` is total — it never throws on a fractional, negative, or
-	* non-finite contribution — which is why {@link (PartialReleaseAgeGate:variable)}
-	* does not constrain its `ageMinutes` and this method owns the clamp.
-	*
-	* @param contributions - the partial gates to merge, one per source.
-	*/
-	static combine(...contributions) {
-		const ages = contributions.map((contribution) => contribution.ageMinutes).filter((age) => typeof age === "number" && Number.isFinite(age));
-		const ageMinutes = ages.length > 0 ? Math.max(0, ...ages) : 0;
-		const exclude = [...new Set(contributions.flatMap((contribution) => contribution.exclude ?? []))].sort();
-		return ReleaseAgeGate.make({
-			ageMinutes,
-			exclude
-		});
-	}
+var Redaction = class {
+	constructor() {}
 	/**
-	* Whether a package name matches any of `patterns`, using pnpm's
-	* `@pnpm/matcher` semantics: an exact-name match, or a `*`-glob where `*`
-	* matches any run of characters **including `/`** — so a bare `*` matches a
-	* scoped name like `@scope/pkg`, and `@scope/*` matches every package in a
-	* scope.
+	* Replaces every occurrence of every secret's value in `text` with
+	* {@link REDACTED}.
 	*
 	* @remarks
-	* This is deliberately **NOT** `@effected/glob`'s minimatch dialect, in
-	* which `*` refuses to cross `/` (there `*` matches `pkg` but not
-	* `@scope/pkg`, and you would need `**`). pnpm treats the package name as a
-	* flat string, so this matcher does too. Do not "fix" this to route through
-	* `@effected/glob`: it would silently change which packages a gate exempts
-	* and diverge from pnpm's own behavior.
+	* Exact, literal matching — no pattern compilation, no encoding-aware search. A
+	* secret that reaches the text base64-encoded, URL-encoded, or split across a
+	* line break is **not** found; declare the encoded form as a secret too if that
+	* is a real risk.
 	*
-	* @param name - the package name to test.
-	* @param patterns - the exclude patterns (exact names or `*`-globs).
+	* A secret composed only of the placeholder's own characters (`*`, `**`, `***`)
+	* cannot be fully removed, because the replacement reintroduces it. That is a
+	* documented limitation, not a defect.
 	*/
-	static matchesExclude(name, patterns) {
-		return matchesExclude(name, patterns);
-	}
+	static apply = apply;
 	/**
-	* Whether this gate exempts the given package name from the release-age
-	* check — `ReleaseAgeGate.matchesExclude(name, this.exclude)`.
-	*
-	* @param name - the package name to test.
+	* {@link Redaction.apply} over each entry of an argv array. An entry is
+	* redacted whether it *is* a secret or merely *contains* one
+	* (`--url=https://u:s3cr3t@host`).
 	*/
-	isExcluded(name) {
-		return matchesExclude(name, this.exclude);
-	}
+	static applyArgs = applyArgs;
 	/**
-	* Filter a package's candidate versions to those old enough to pass the
-	* gate, given each version's publish timestamp and a caller-supplied `now`.
-	*
-	* A version is kept when it has a parseable publish timestamp at or before
-	* the cutoff (`now - ageMinutes * 60000`). A version with a **missing or
-	* unparseable** timestamp in `times` is **dropped** — matching pnpm's strict
-	* posture: a version whose age cannot be established is treated as too young.
-	* The clock is the caller's; this method reads no wall clock.
+	* Heuristic backstop: redact any argv value that is introduced by a known
+	* secret-bearing flag or npm auth key, in either the separated
+	* (`--token abc`) or inline (`--token=abc`) form.
 	*
-	* Returns all versions unchanged (a no-op) when the gate is inert
-	* (`ageMinutes <= 0`) or the package name is excluded.
-	*
-	* @param versions - the candidate version strings.
-	* @param times - a map from version string to its ISO-8601 publish date.
-	* @param name - the package name (checked against the gate's `exclude` list).
-	* @param now - the current time in epoch milliseconds (the caller's clock).
+	* @remarks
+	* This catches secrets the caller forgot to declare; it cannot catch a flag
+	* nobody listed. Prefer {@link Redaction.applyArgs} with the actual
+	* `Redacted` values — this runs *in addition*, never instead.
 	*/
-	filterVersions(versions, times, name, now) {
-		if (this.ageMinutes <= 0 || this.isExcluded(name)) return versions;
-		const cutoff = now - this.ageMinutes * MS_PER_MINUTE;
-		return versions.filter((version) => {
-			const time = times[version];
-			if (time === void 0) return false;
-			const published = Date.parse(time);
-			return Number.isFinite(published) && published <= cutoff;
-		});
-	}
+	static scrubArgs = scrubArgs;
+	/** Flags treated as secret-bearing by {@link Redaction.scrubArgs}. See {@link SECRET_FLAGS}. */
+	static SECRET_FLAGS = SECRET_FLAGS;
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/ImporterDependency.js
+//#region ../../node_modules/.pnpm/@effected+commands@0.3.1_effect@4.0.0-beta.101/node_modules/@effected/commands/internal/capture.js
 /**
-* One declared dependency of one workspace importer, as the lockfile records it.
+* Raised when a captured stream exceeds its byte budget.
 *
 * @remarks
-* - `name` — the dependency's package name.
-* - `specifier` — the declared range, typed through `@effected/npm`'s
-*   `DependencySpecifier.FromString` codec: the decoded value is a tag-matchable
-*   `ClassifiedSpecifier` (`catalog:` / `workspace:` / range / dist-tag / raw),
-*   while encoding round-trips the **exact original string byte-for-byte** — the
-*   guarantee a before/after lockfile diff relies on.
-* - `version` — the concrete resolved version, **populated by pnpm only**:
-*   comparable across refs and printable. pnpm records `{ specifier, version }`
-*   per importer dependency, and the parser splits pnpm's peer-disambiguation
-*   suffix off into `peerSuffix`, so `version` is always the plain version — or
-*   a non-registry resolution (`link:../utils`, `file:...`), passed through
-*   verbatim. bun and npm record resolved versions on their package entries
-*   instead, so for those formats `version` is absent and a consumer joins by
-*   `name` against `Lockfile.packages`.
-* - `peerSuffix` — pnpm's peer-disambiguation context: the raw parenthesized
-*   chain the lockfile recorded after the version, e.g.
-*   `(effect@4.0.0-beta.101)(ioredis@5.11.1(supports-color@8.1.1))`. Present
-*   only when the lockfile recorded one — never for suffix-free pnpm entries,
-*   and never for the other formats, which do not record peer context per
-*   importer dependency.
-* - `depType` — which dependency map declared it, spelled with `@effected/npm`'s
-*   kit-wide `DependencyField` vocabulary.
-*
-* @public
+* Internal and never exported from the package: `Run` maps it to the public
+* `CommandOutputError`. `Data.TaggedError` is appropriate precisely because it
+* never escapes — it is an in-process signal, not a contract.
 */
-var ImporterDependency = class extends Schema.Class("ImporterDependency")({
-	name: Schema.NonEmptyString,
-	specifier: DependencySpecifier.FromString,
-	version: Schema.optionalKey(Schema.String),
-	peerSuffix: Schema.optionalKey(Schema.String),
-	depType: DependencyField
-}) {};
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/LockfileImporter.js
+var OutputTooLarge = class extends Data.TaggedError("OutputTooLarge") {};
 /**
-* One workspace importer's declared dependencies, as the lockfile records them.
+* Collects a byte stream into a string, failing once more than `limit` bytes
+* have arrived.
 *
 * @remarks
-* - `path` — the importer path relative to the workspace root, `"."` for the
-*   root package (never empty — a `NonEmptyString`) — the same keys as
-*   `WorkspaceDiscovery.importerMap()` in
-*   `@effected/workspaces`. This is the stable join key: `Lockfile#importer`
-*   looks importers up by it, and `Lockfile#withImporterNames` deliberately
-*   leaves importers untouched because the path — not a package name — keys
-*   them.
-* - `dependencies` — each declared dependency as an {@link ImporterDependency}.
-*
-* Populated by the pnpm, bun and npm parsers. yarn does not record importers,
-* so a yarn lockfile always yields an empty `importers` array.
-*
-* @public
-*/
-var LockfileImporter = class extends Schema.Class("LockfileImporter")({
-	path: Schema.NonEmptyString,
-	dependencies: Schema.Array(ImporterDependency)
-}) {};
+* The budget is enforced **during** accumulation, not after: checking the
+* length of an already-collected string would mean the memory was already
+* spent, which is the exact failure the budget exists to prevent. Counting is
+* on raw bytes, before decoding, because bytes are what the process actually
+* produced.
+*/
+const collectBounded = (stream, limit) => Effect.gen(function* () {
+	const seen = yield* Ref.make(0);
+	const bounded = Stream.mapEffect(stream, (chunk) => Effect.flatMap(Ref.updateAndGet(seen, (total) => total + chunk.length), (total) => total > limit ? Effect.fail(new OutputTooLarge({ limit })) : Effect.succeed(chunk)));
+	return yield* Stream.mkString(Stream.decodeText(bounded));
+});
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/ResolvedPackage.js
-const EMPTY_DEPENDENCIES = {};
+//#region ../../node_modules/.pnpm/@effected+commands@0.3.1_effect@4.0.0-beta.101/node_modules/@effected/commands/Run.js
 /**
-* A package resolved from a lockfile.
+* Default ceiling on captured bytes per stream (16 MiB).
 *
 * @remarks
-* The common shape every format's entries normalize into:
-*
-* - `name` — the resolved package name. For pnpm *workspace* packages
-*   straight out of `Lockfile.parse` this is the importer path until
-*   `Lockfile#withImporterNames` rewrites it.
-* - `version` — the resolved version string (pnpm workspace packages carry
-*   `"0.0.0"`; the lockfile does not record their real versions).
-* - `integrity` — optional `@effected/npm` `IntegrityHash`, covering npm/pnpm
-*   `sha512-...` SRI and yarn Berry's `10c0/...` cache checksums (the yarn
-*   textual form). An *absent* integrity is omitted, so a `ResolvedPackage` may
-*   carry none; a *present but unparseable* integrity fails the parse typed at
-*   validation rather than being silently dropped.
-* - `isWorkspace` — `true` for workspace-local packages.
-* - `relativePath` — the workspace-relative directory for workspace
-*   packages, when the lockfile records one.
-* - `dependencies` — the package's own dependency map, defaulting to `{}`
-*   both at construction and when decoding serialized data.
+* Collecting a child's output without a bound is a memory-exhaustion vector.
+* Output genuinely larger than this belongs on {@link Run.stream}, which never
+* accumulates.
 *
 * @public
 */
-var ResolvedPackage = class extends Schema.Class("ResolvedPackage")({
-	name: Schema.NonEmptyString,
-	version: Schema.String,
-	integrity: Schema.optionalKey(IntegrityHash),
-	isWorkspace: Schema.Boolean,
-	relativePath: Schema.optionalKey(Schema.String),
-	dependencies: Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY_DEPENDENCIES)), Schema.withConstructorDefault(Effect.succeed(EMPTY_DEPENDENCIES)))
-}) {};
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/WorkspaceDependency.js
+const DEFAULT_MAX_OUTPUT_BYTES = 16777216;
+/** Characters shown from the tail of captured output in an error message. */
+const MAX_MESSAGE_CHARS = 2e3;
 /**
-* A directed dependency edge between two workspace packages as recorded in
-* the lockfile.
-*
-* @remarks
-* - `from` — the workspace package declaring the dependency. For pnpm this
-*   is the importer path until `Lockfile#withImporterNames` rewrites it.
-* - `to` — the workspace package depended upon.
-* - `depType` — which dependency map holds the edge, spelled with
-*   `@effected/npm`'s kit-wide `DependencyField` vocabulary.
-* - `constraint` — the declared specifier (e.g. `"workspace:*"`, `"^1.0.0"`).
+* What one completed run produced.
 *
 * @public
 */
-var WorkspaceDependency = class extends Schema.Class("WorkspaceDependency")({
-	from: Schema.NonEmptyString,
-	to: Schema.NonEmptyString,
-	depType: DependencyField,
-	constraint: Schema.String
-}) {};
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/PnpmExtension.js
+var CommandOutput = class extends Schema.Class("CommandOutput")({
+	/** Captured standard output, redacted. */
+	stdout: Schema.String,
+	/** Captured standard error, redacted. */
+	stderr: Schema.String,
+	/** The process exit code. A non-zero value is NOT an error at this level. */
+	exitCode: Schema.Number
+}) {
+	/** Whether the process exited zero. */
+	get succeeded() {
+		return this.exitCode === 0;
+	}
+};
+/** The executable and argv an error should report for `command`. */
+const describeCommand = (command) => {
+	if (ChildProcess.isStandardCommand(command)) return {
+		command: command.command,
+		args: command.args
+	};
+	const left = describeCommand(command.left);
+	const right = describeCommand(command.right);
+	return {
+		command: `${left.command} | ${right.command}`,
+		args: []
+	};
+};
+/** argv as an error should store it: declared secrets removed, then the flag heuristic. */
+const safeArgs = (args, secrets) => Redaction.scrubArgs(Redaction.applyArgs(args, secrets ?? []));
+/** Captured text as an error should store it. */
+const safeText = (text, secrets) => Redaction.apply(text, secrets ?? []);
+/** Tail-bounded rendering: tools write warnings first and the real error last. */
+const tail = (text) => {
+	const trimmed = text.trim();
+	if (trimmed.length <= MAX_MESSAGE_CHARS) return trimmed;
+	return `...[${trimmed.length - MAX_MESSAGE_CHARS} chars truncated from head]...\n${trimmed.slice(-2e3)}`;
+};
 /**
-* Extension data specific to pnpm lockfiles, attached to `Lockfile.extension`
-* when the format is `"pnpm"`.
+* A command that could not be run, or that ran and failed.
 *
 * @remarks
-* - `catalogs` — pnpm catalog definitions ({@link PnpmCatalogs}).
-* - `overrides` — the version override map recorded in the lockfile header.
-* - `settings` — pnpm settings recorded in the lockfile header.
+* `kind` is the routing surface, never the message: `"nonZero"` (the process
+* ran and exited non-zero), `"spawn"` (it never started — the executable is
+* missing, or the platform refused), `"timeout"` (a caller-supplied ceiling
+* elapsed). Composed retry and fallback logic branches on `kind`; nothing in
+* this package asks a caller to match on prose.
+*
+* `args` is **always** stored redacted.
 *
 * @public
 */
-var PnpmExtension = class extends Schema.Class("PnpmExtension")({
-	_tag: Schema.tag("pnpm"),
-	catalogs: Schema.optionalKey(Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.Union([Schema.String, Schema.Struct({
-		specifier: Schema.String,
-		version: Schema.String
-	})])))),
-	overrides: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
-	settings: Schema.optionalKey(Schema.Struct({
-		autoInstallPeers: Schema.optionalKey(Schema.Boolean),
-		excludeLinksFromLockfile: Schema.optionalKey(Schema.Boolean)
-	}))
-}) {};
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/LockfileFormat.js
+var CommandFailedError = class CommandFailedError extends Schema.TaggedErrorClass()("CommandFailedError", {
+	/** Why it failed. */
+	kind: Schema.Literals([
+		"nonZero",
+		"spawn",
+		"timeout"
+	]),
+	/** The executable (or `"a | b"` for a pipeline). */
+	command: Schema.String,
+	/** argv, redacted. */
+	args: Schema.Array(Schema.String),
+	/** The exit code, when the process ran. */
+	exitCode: Schema.optionalKey(Schema.Number),
+	/** Captured standard error, redacted, when the process ran. */
+	stderr: Schema.optionalKey(Schema.String),
+	/** Captured standard output, redacted, when the process ran. */
+	stdout: Schema.optionalKey(Schema.String),
+	/** The absorbed platform failure, for `"spawn"`. */
+	cause: Schema.optionalKey(Schema.Defect())
+}) {
+	/** The process ran and exited non-zero. */
+	static nonZero = (command, output, secrets) => {
+		const described = describeCommand(command);
+		return new CommandFailedError({
+			kind: "nonZero",
+			command: described.command,
+			args: safeArgs(described.args, secrets),
+			exitCode: output.exitCode,
+			stderr: output.stderr,
+			stdout: output.stdout
+		});
+	};
+	/** The process never started. */
+	static spawn = (command, cause, secrets) => {
+		const described = describeCommand(command);
+		return new CommandFailedError({
+			kind: "spawn",
+			command: described.command,
+			args: safeArgs(described.args, secrets),
+			cause
+		});
+	};
+	/** A caller-supplied ceiling elapsed; the child was killed with its scope. */
+	static timedOut = (command, secrets) => {
+		const described = describeCommand(command);
+		return new CommandFailedError({
+			kind: "timeout",
+			command: described.command,
+			args: safeArgs(described.args, secrets)
+		});
+	};
+	/**
+	* Whether this is a spawn failure caused by the executable not existing —
+	* the structural "tool is not installed" signal.
+	*/
+	get notFound() {
+		return this.kind === "spawn" && this.cause instanceof PlatformError.PlatformError && this.cause.reason._tag === "NotFound";
+	}
+	/** Names the command and surfaces the tail of whichever stream carries the cause. */
+	get message() {
+		const parts = [`Command "${this.args.length > 0 ? `${this.command} ${this.args.join(" ")}` : this.command}" failed`];
+		if (this.kind === "timeout") parts.push("(timed out)");
+		if (this.exitCode !== void 0) parts.push(`(exit ${this.exitCode})`);
+		const stream = this.stderr?.trim() ? this.stderr : this.stdout?.trim() ? this.stdout : void 0;
+		if (stream !== void 0) parts.push(`:\n${tail(stream)}`);
+		return parts.join(" ");
+	}
+};
 /**
-* The lockfile formats this package parses: bun's `bun.lock` (JSONC), npm's
-* `package-lock.json` (v2/v3 JSON), pnpm's `pnpm-lock.yaml` and yarn Berry's
-* `yarn.lock` (both YAML).
+* A command ran, but its output could not be used.
 *
 * @remarks
-* The literal names the *lockfile format*, not the package manager that
-* happens to write it — this package models lockfiles. Yarn support is
-* Berry only; classic (v1) `yarn.lock` is not YAML and fails
-* `Lockfile.parse` with a typed `LockfileParseError`.
+* Separate from {@link CommandFailedError} because the process itself
+* succeeded: `"notJson"` (stdout is not JSON), `"schema"` (it is JSON but does
+* not decode), `"tooLarge"` (capture exceeded its byte budget). Keeping the two
+* distinguishable is the point — a schema drift and a crashed tool call for
+* different responses.
+*
+* The context fields (`exitCode`, `stderr`, `stdout`) are populated by
+* {@link Run.jsonLine}, whose payload framing parses regardless of exit code —
+* when no payload arrives, the exit code and captured streams are the only
+* evidence of what actually went wrong. Both streams are **always** stored
+* redacted.
 *
 * @public
 */
-const LockfileFormat = Schema.Literals([
-	"bun",
-	"npm",
-	"pnpm",
-	"yarn"
-]);
-const FILENAMES = {
-	bun: ["bun.lock", "bun.lockb"],
-	npm: ["package-lock.json", "npm-shrinkwrap.json"],
-	pnpm: ["pnpm-lock.yaml"],
-	yarn: ["yarn.lock"]
+var CommandOutputError = class extends Schema.TaggedErrorClass()("CommandOutputError", {
+	/** Which way the output was unusable. */
+	kind: Schema.Literals([
+		"notJson",
+		"schema",
+		"tooLarge"
+	]),
+	/** The executable that produced it. */
+	command: Schema.String,
+	/** The underlying parse or decode failure. */
+	cause: Schema.optionalKey(Schema.Defect()),
+	/** The exit code, when the combinator parses independently of it. */
+	exitCode: Schema.optionalKey(Schema.Number),
+	/** Captured standard error, redacted, when the process ran. */
+	stderr: Schema.optionalKey(Schema.String),
+	/** Captured standard output, redacted, when the process ran. */
+	stdout: Schema.optionalKey(Schema.String)
+}) {
+	get message() {
+		const parts = [];
+		if (this.kind === "notJson") parts.push(`Command "${this.command}" did not produce JSON`);
+		else if (this.kind === "schema") parts.push(`Command "${this.command}" produced JSON that did not match the expected schema`);
+		else parts.push(`Command "${this.command}" produced more output than the configured limit`);
+		if (this.exitCode !== void 0) parts.push(`(exit ${this.exitCode})`);
+		if (this.stderr !== void 0 && this.stderr.trim().length > 0) parts.push(`:\n${tail(this.stderr)}`);
+		return parts.join(" ");
+	}
+};
+/** Spawns, collects both streams concurrently, and awaits exit. */
+const collectRaw = (command, options, tee) => Effect.scoped(Effect.gen(function* () {
+	const handle = yield* (yield* ChildProcessSpawner.ChildProcessSpawner).spawn(command);
+	const limit = options?.maxOutputBytes ?? 16777216;
+	const out = tee === void 0 ? handle.stdout : Stream.tapSink(handle.stdout, tee.stdout());
+	const err = tee === void 0 ? handle.stderr : Stream.tapSink(handle.stderr, tee.stderr());
+	const [stdout, stderr, exitCode] = yield* Effect.all([
+		collectBounded(out, limit),
+		collectBounded(err, limit),
+		handle.exitCode
+	], { concurrency: "unbounded" });
+	const secrets = options?.redact;
+	return CommandOutput.make({
+		stdout: safeText(stdout, secrets),
+		stderr: safeText(stderr, secrets),
+		exitCode: Number(exitCode)
+	});
+}));
+/** Maps the raw failure modes onto this package's taxonomy, and applies any ceiling. */
+const collectClassified = (command, options, tee) => {
+	const described = describeCommand(command);
+	const classified = collectRaw(command, options, tee).pipe(Effect.catch((error) => Effect.fail(error instanceof OutputTooLarge ? new CommandOutputError({
+		kind: "tooLarge",
+		command: described.command,
+		cause: error
+	}) : CommandFailedError.spawn(command, error, options?.redact))));
+	return options?.timeout === void 0 ? classified : Effect.timeoutOrElse(classified, {
+		duration: options.timeout,
+		orElse: () => Effect.fail(CommandFailedError.timedOut(command, options.redact))
+	});
 };
+/** Fails a run whose process exited non-zero. */
+const requireZero = (command, output, options) => output.succeeded ? Effect.succeed(output) : Effect.fail(CommandFailedError.nonZero(command, output, options?.redact));
+/** Span attributes: what ran and how many arguments — never the arguments. */
+const annotate = (command) => {
+	const described = describeCommand(command);
+	return Effect.annotateCurrentSpan({
+		command: described.command,
+		argc: described.args.length
+	});
+};
+const collect = Effect.fn("Run.collect")(function* (command, options) {
+	yield* annotate(command);
+	return yield* collectClassified(command, options, void 0);
+});
+const collectTee = Effect.fn("Run.collectTee")(function* (command, options) {
+	yield* annotate(command);
+	const stdio = yield* Stdio.Stdio;
+	return yield* collectClassified(command, options, stdio);
+});
+const text$4 = Effect.fn("Run.text")(function* (command, options) {
+	yield* annotate(command);
+	const output = yield* collectClassified(command, options, void 0);
+	return (yield* requireZero(command, output, options)).stdout.trim();
+});
+const lines = Effect.fn("Run.lines")(function* (command, options) {
+	yield* annotate(command);
+	const output = yield* collectClassified(command, options, void 0);
+	return (yield* requireZero(command, output, options)).stdout.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0);
+});
+const json = Effect.fn("Run.json")(function* (command, schema, options) {
+	yield* annotate(command);
+	const described = describeCommand(command);
+	const output = yield* collectClassified(command, options, void 0);
+	const checked = yield* requireZero(command, output, options);
+	const parsed = yield* Effect.try({
+		try: () => JSON.parse(checked.stdout),
+		catch: (cause) => new CommandOutputError({
+			kind: "notJson",
+			command: described.command,
+			cause
+		})
+	});
+	return yield* Schema.decodeUnknownEffect(schema)(parsed).pipe(Effect.catch((cause) => Effect.fail(new CommandOutputError({
+		kind: "schema",
+		command: described.command,
+		cause
+	}))));
+});
+const jsonLine = Effect.fn("Run.jsonLine")(function* (command, schema, options) {
+	yield* annotate(command);
+	const described = describeCommand(command);
+	const output = yield* collectClassified(command, options, void 0);
+	const context = {
+		exitCode: output.exitCode,
+		stderr: output.stderr,
+		stdout: output.stdout
+	};
+	const candidates = output.stdout.split(/\r?\n/).filter((candidate) => candidate.trim().length > 0);
+	if (candidates.length === 0) return yield* Effect.fail(new CommandOutputError({
+		kind: "notJson",
+		command: described.command,
+		cause: /* @__PURE__ */ new Error("stdout carried no non-empty line"),
+		...context
+	}));
+	let notJsonCause;
+	let schemaCause;
+	for (let index = candidates.length - 1; index >= 0; index--) {
+		const candidate = candidates[index];
+		if (candidate === void 0) continue;
+		let parsed;
+		try {
+			parsed = JSON.parse(candidate);
+		} catch (cause) {
+			notJsonCause ??= cause;
+			continue;
+		}
+		const decoded = yield* Effect.result(Schema.decodeUnknownEffect(schema)(parsed));
+		if (Result.isSuccess(decoded)) return decoded.success;
+		schemaCause ??= decoded.failure;
+	}
+	return yield* Effect.fail(schemaCause !== void 0 ? new CommandOutputError({
+		kind: "schema",
+		command: described.command,
+		cause: schemaCause,
+		...context
+	}) : new CommandOutputError({
+		kind: "notJson",
+		command: described.command,
+		cause: notJsonCause,
+		...context
+	}));
+});
+const exitCode = Effect.fn("Run.exitCode")(function* (command, options) {
+	yield* annotate(command);
+	return (yield* collectClassified(command, options, void 0)).exitCode;
+});
+const succeeds = Effect.fn("Run.succeeds")(function* (command, options) {
+	yield* annotate(command);
+	return yield* collectClassified(command, options, void 0).pipe(Effect.map((output) => output.succeeded), Effect.catch(() => Effect.succeed(false)));
+});
+const detach = Effect.fn("Run.detach")(function* (command) {
+	yield* annotate(command);
+	return yield* Effect.scoped(Effect.gen(function* () {
+		const handle = yield* (yield* ChildProcessSpawner.ChildProcessSpawner).spawn(command);
+		yield* handle.unref;
+		return handle.pid;
+	})).pipe(Effect.catch((error) => Effect.fail(CommandFailedError.spawn(command, error))));
+});
+const stream = (command, options) => Stream.unwrap(Effect.map(ChildProcessSpawner.ChildProcessSpawner, (spawner) => spawner.streamLines(command, { includeStderr: options?.includeStderr ?? false }))).pipe(Stream.mapError((error) => CommandFailedError.spawn(command, error)));
+const extendEnv = Function.dual(2, (self, env) => {
+	if (ChildProcess.isStandardCommand(self)) {
+		const merged = self.options.env === void 0 ? env : {
+			...self.options.env,
+			...env
+		};
+		return ChildProcess.make(self.command, self.args, {
+			...self.options,
+			env: merged,
+			extendEnv: true
+		});
+	}
+	return ChildProcess.pipeTo(extendEnv(self.left, env), extendEnv(self.right, env), self.options);
+});
 /**
-* The conventional lockfile filename for a format: `"bun.lock"`,
-* `"package-lock.json"`, `"pnpm-lock.yaml"` or `"yarn.lock"`.
+* Structured running of core `ChildProcess.Command` values.
 *
 * @remarks
-* The primary name only — the first element of {@link filenamesFor}, which is
-* what detection that must also see the genuine alternates should use.
+* These are free functions over core's contract, **not** a service: core's
+* `ChildProcessSpawner` already is the subprocess service, and wrapping it in a
+* second one is the re-declaration this package exists not to repeat. Tests
+* stub the spawner (`ChildProcessSpawner.make(mockSpawn)`), not these.
+*
+* A non-zero exit is a *result* for {@link Run.collect}, {@link Run.exitCode},
+* {@link Run.succeeds} and {@link Run.jsonLine}, and a typed *failure* for
+* {@link Run.text}, {@link Run.lines} and {@link Run.json} — the split is
+* deliberate, matching core (where a non-zero exit is a success) at the
+* reporting level while giving the interpreting helpers the ergonomics callers
+* actually want.
+*
+* The interpreting helpers also **trim**: {@link Run.text} strips leading and
+* trailing whitespace from the whole result — not just a trailing newline —
+* and {@link Run.lines} trims each line. Fixed-column output whose first
+* column can be whitespace (`git status --porcelain`) silently loses that
+* column through either, producing plausible wrong values rather than an
+* error. Parse that kind of output from the untrimmed `stdout` of
+* {@link Run.collect}'s {@link CommandOutput} instead.
 *
 * @public
 */
-const filenameFor = (format) => FILENAMES[format][0];
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/internal/shared.js
-/**
-* The four dependency sections of a manifest, in a stable order — the shared
-* dependency-sections table (v3's `DEP_SECTIONS`). Each entry is both the
-* manifest field name to read and the `@effected/npm` `DependencyField` it maps
-* to, since the two coincide. Consumed by `extractWorkspaceDeps` and by the
-* pnpm/bun/npm importer builders.
-*
-* @internal
-*/
-const DEP_TYPES = [
-	"dependencies",
-	"devDependencies",
-	"peerDependencies",
-	"optionalDependencies"
-];
-/**
-* Coerce a raw lockfile integrity string to the `@effected/npm` `IntegrityHash`
-* brand, which recognizes the SRI (`<algo>-<base64>`), corepack (`<algo>.<hex>`)
-* and yarn (`<cachekey>/<hex>`) textual forms.
-*
-* Absence and corruption are treated differently, and the distinction is the
-* point. An *absent* integrity (input `undefined`) succeeds with `undefined`,
-* so the caller omits the field — a lockfile that records no integrity is
-* legitimate. A *present but unparseable* integrity fails through the same
-* validation channel the shape checks use ({@link validationFailure}), so
-* `Lockfile.parse` surfaces it as a `LockfileParseError` with
-* `stage: "validation"` rather than silently dropping a corrupt value. Never a
-* defect. yarn's `10c0/<hex>` cache checksums are a recognized form, so real
-* yarn/npm/pnpm/bun integrity all still parses; only genuine corruption fails.
-*
-* @internal
-*/
-const toIntegrityHash = (raw) => {
-	if (raw === void 0) return Effect.succeed(void 0);
-	return Schema.decodeUnknownEffect(IntegrityHash)(raw).pipe(Effect.mapError(validationFailure));
-};
-const decodeSpecifier = Schema.decodeUnknownExit(DependencySpecifier.FromString);
-/**
-* Split pnpm's peer-disambiguation suffix off a recorded string: everything
-* from the first `(` on is suffix, since package names and versions never
-* contain `(`. Handles both shapes pnpm records — a bare version
-* (`"1.0.0(effect@4.0.0)"`, importer entries) and a `name@version` snapshot key
-* (`"fdir@6.5.0(picomatch@4.0.4)"`). A string with no `(` — including
-* `link:...` / `file:...` resolutions — passes through untouched. So does a
-* protocol-bearing string (a `:` ahead of the first `(`), where a parenthesis
-* is path or URL text rather than a peer suffix: pnpm attaches suffixes to
-* registry versions only. This is the single stripping implementation — do not
-* hand-roll an `indexOf("(")` split elsewhere.
-*
-* @internal
-*/
-const splitPeerSuffix = (raw) => {
-	const parenIndex = raw.indexOf("(");
-	if (parenIndex === -1) return { plain: raw };
-	if (raw.lastIndexOf(":", parenIndex) !== -1) return { plain: raw };
-	return {
-		plain: raw.slice(0, parenIndex),
-		peerSuffix: raw.slice(parenIndex)
-	};
+var Run = class {
+	constructor() {}
+	/**
+	* Spawns `command`, collects stdout and stderr concurrently, and resolves
+	* with the {@link CommandOutput} once the process exits.
+	*
+	* @remarks
+	* A non-zero exit is a *result* here, not a failure — see {@link Run}'s
+	* remarks for the split against {@link Run.text}, {@link Run.lines} and
+	* {@link Run.json}.
+	*/
+	static collect = collect;
+	/**
+	* Like {@link Run.collect}, but also tees each stream to the `Stdio` in `R`
+	* as it arrives, for a caller that wants live output alongside the captured
+	* {@link CommandOutput}.
+	*/
+	static collectTee = collectTee;
+	/**
+	* Runs `command` and resolves with trimmed stdout on a zero exit.
+	*
+	* @remarks
+	* A non-zero exit is a typed failure here — {@link CommandFailedError} —
+	* unlike {@link Run.collect}, {@link Run.exitCode} and {@link Run.succeeds},
+	* which treat it as a result.
+	*
+	* The trim strips **leading and trailing whitespace**, not just the trailing
+	* newline. For parse-sensitive output where leading whitespace is data
+	* (`git status --porcelain`, whose first entry's status column it would
+	* silently eat), use {@link Run.collect} and read its {@link CommandOutput}'s
+	* untrimmed `stdout` instead.
+	*/
+	static text = text$4;
+	/**
+	* Runs `command` and resolves with stdout split into trimmed, non-empty
+	* lines on a zero exit.
+	*
+	* @remarks
+	* A non-zero exit is a typed failure here — {@link CommandFailedError} —
+	* matching {@link Run.text} and {@link Run.json}.
+	*/
+	static lines = lines;
+	/**
+	* Runs `command`, parses stdout as JSON and decodes it against `schema` on
+	* a zero exit.
+	*
+	* @remarks
+	* Fails with {@link CommandOutputError} when stdout is not JSON or does not
+	* decode; a non-zero exit fails with {@link CommandFailedError}, matching
+	* {@link Run.text} and {@link Run.lines}.
+	*
+	* This parses the **whole** of stdout and requires a zero exit. For a
+	* protocol payload located by scanning stdout lines from the end — tolerant
+	* of noise around it and of a non-zero exit — use {@link Run.jsonLine}
+	* instead.
+	*/
+	static json = json;
+	/**
+	* Runs `command` and, **scanning stdout lines from the end**, resolves with
+	* the first line that both parses as JSON and decodes against `schema` —
+	* the framing variant of {@link Run.json}, for a child that reports through
+	* a single JSON protocol payload near the end of its output.
+	*
+	* @remarks
+	* The framing tolerates noise on **both sides** of the payload: noise before
+	* it (a subprocess-loaded hook's own `console.log`, a tool's warnings) and
+	* noise after it (a hook logging from `process.on("exit", ...)` fires after
+	* the payload has flushed — the trigger for widening the old "last non-empty
+	* line must decode" contract, spencerbeggs/effected#292). Lines are split on
+	* `\r?\n`, whitespace-only lines are dropped, and the scan runs from the last
+	* line backwards until one decodes. The tolerance is positional, not
+	* volumetric: the whole of stdout is still captured under
+	* {@link RunOptions.maxOutputBytes} (default
+	* {@link DEFAULT_MAX_OUTPUT_BYTES}, 16 MiB), so a child whose noise exceeds
+	* the ceiling fails typed as `"tooLarge"` before any line is examined —
+	* raise the ceiling for a child known to be loud in volume.
+	*
+	* The scan's consequence: when **multiple** lines decode under `schema`, the
+	* **last** one wins. A child must therefore never emit two schema-valid
+	* lines, and a consumer schema should be shaped so an accidental log line
+	* cannot satisfy it — a discriminated envelope with a required literal field
+	* (`ok: true | false`, the shape `@effected/workspaces`' `ReplayPayload`
+	* uses) rather than a permissive record a stray `console.log(someObject)`
+	* might match.
+	*
+	* Unlike {@link Run.json}, this parses **regardless of the exit code** — a
+	* deliberate posture, not an oversight. A protocol payload discriminates
+	* success in-band (its own `ok` field, its own error shape), so the payload
+	* outranks the exit code: a child that crashes *after* flushing its payload
+	* still reported, and a caller that wants exit-code semantics has
+	* {@link Run.json}. When no line decodes anywhere, the typed
+	* {@link CommandOutputError} carries the exit code and both captured streams
+	* (redacted) as context, so the failure is diagnosable without re-running.
+	* Its `kind` preserves the near-miss diagnostic: `"schema"` when at least
+	* one line parsed as JSON but none decoded — with the **last parseable
+	* line's** decode failure as `cause`, that line being the most probable
+	* intended payload — and `"notJson"` only when no non-empty line was JSON at
+	* all (carrying the last non-empty line's parse error). A spawn failure or
+	* an opted-in timeout still fails with {@link CommandFailedError}.
+	*/
+	static jsonLine = jsonLine;
+	/**
+	* Runs `command` and resolves with its exit code alone.
+	*
+	* @remarks
+	* A non-zero exit is a *result* here, not a failure — see {@link Run}'s
+	* remarks for the split against {@link Run.text}, {@link Run.lines} and
+	* {@link Run.json}.
+	*/
+	static exitCode = exitCode;
+	/**
+	* Runs `command` and resolves with whether it exited zero, collapsing a
+	* spawn or other classified failure to `false` rather than propagating it.
+	*/
+	static succeeds = succeeds;
+	/** Decoded stdout lines as they arrive, for output too large or too long-lived to collect. */
+	static stream = stream;
+	/**
+	* Spawns `command` and resolves with its pid without waiting for exit.
+	*
+	* @remarks
+	* Unrefs the child **before** this scope closes, so it survives the
+	* caller's scope closing — the Node backend's release skips the kill for an
+	* unref'd child, and reversing that order kills it with the scope instead.
+	* Fails with {@link CommandFailedError} if the process never starts.
+	*/
+	static detach = detach;
+	/**
+	* Adds environment variables to a command WITHOUT losing the parent
+	* environment: merges `env` over any existing command environment (new values
+	* win, matching core's `ChildProcess.setEnv`) and sets `extendEnv: true`.
+	*
+	* @remarks
+	* This combinator exists because of a core trap: `ChildProcess.setEnv` merges
+	* into `options.env` but never sets `extendEnv`, and the Node spawner resolves
+	* the child environment as `extendEnv ? { ...process.env, ...env } : env` — so
+	* a command built with bare `setEnv({ SOME_VAR: x })` spawns a child whose
+	* ENTIRE environment is that one variable: no `PATH`, no `HOME`. The failure is
+	* silent at the type level and surfaces as "spawned tool cannot find its own
+	* binary" at runtime.
+	*
+	* Deliberately forces `extendEnv: true` even where construction set it `false`
+	* — inheriting the parent environment is this combinator's entire purpose. A
+	* caller who wants a hermetic environment uses core's `setEnv` or construction
+	* options (`ChildProcess.make(cmd, args, { env, extendEnv: false })`) directly.
+	*
+	* For a pipeline, applies to every command in the pipeline (mirroring core's
+	* `setEnv`), preserving the pipe's own options. Composes core's public
+	* vocabulary (`ChildProcess.make`, `ChildProcess.pipeTo`) — it re-declares
+	* nothing.
+	*/
+	static extendEnv = extendEnv;
+	/** Default ceiling on captured bytes per stream. See {@link DEFAULT_MAX_OUTPUT_BYTES}. */
+	static DEFAULT_MAX_OUTPUT_BYTES = DEFAULT_MAX_OUTPUT_BYTES;
+	/** The placeholder written in place of a redacted secret. See {@link REDACTED}. */
+	static REDACTED = "***";
 };
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.3_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/ReleaseAgeGate.js
+const MS_PER_MINUTE = 6e4;
 /**
-* Build one {@link ImporterDependency}, decoding the raw specifier string into
-* the `@effected/npm` `ClassifiedSpecifier` tagged union. Returns `undefined`
-* — a skip, never a throw — when the name is empty or the specifier does not
-* classify (e.g. an empty specifier), per the total-string-surgery discipline.
-*
-* A pnpm-recorded version is normalized through {@link splitPeerSuffix}: the
-* `version` field carries the plain version and the split-off peer chain lands
-* in `peerSuffix`. A version that is *only* a peer chain (empty plain part) is
-* treated as no concrete version — a skip of both fields, never a throw.
+* A source's partial contribution to a {@link ReleaseAgeGate}: the effective
+* gate is assembled from more than one place (inline `pnpm-workspace.yaml`
+* keys, replayed `updateConfig` hooks, `pnpm config get` output), and each
+* source may set the age, the exclude list, both, or neither. Absent fields
+* contribute nothing to the combination.
 *
-* @internal
-*/
-const buildImporterDependency = (name, specifier, depType, version) => {
-	if (name === "") return void 0;
-	const exit = decodeSpecifier(specifier);
-	if (Exit.isFailure(exit)) return void 0;
-	const resolved = version !== void 0 && version !== "" ? splitPeerSuffix(version) : void 0;
-	return ImporterDependency.make({
-		name,
-		specifier: exit.value,
-		depType,
-		...resolved !== void 0 && resolved.plain !== "" ? {
-			version: resolved.plain,
-			...resolved.peerSuffix !== void 0 ? { peerSuffix: resolved.peerSuffix } : {}
-		} : {}
-	});
-};
-/**
-* Collect an importer's declared dependencies off the shared dependency-sections
-* table. Iterates {@link DEP_TYPES} in order, projecting each section value with
-* `read`; malformed rows are skipped (never thrown). Key-bearing intermediates
-* are the schema-decoded records, whose own-property `Object.entries` iteration
-* neither pollutes nor drops a `__proto__` key.
+* Deliberately permissive: unlike {@link ReleaseAgeGate} it does not constrain
+* `ageMinutes` to be non-negative, because the raw values arrive from arbitrary
+* config sources and {@link ReleaseAgeGate.combine} is the single authority
+* that clamps them.
 *
-* @internal
+* @public
 */
-const importerDependencies = (entry, read) => {
-	const deps = [];
-	for (const field of DEP_TYPES) {
-		const section = entry[field];
-		if (!section) continue;
-		for (const [name, value] of Object.entries(section)) {
-			const { specifier, version } = read(value);
-			const dep = buildImporterDependency(name, specifier, field, version);
-			if (dep !== void 0) deps.push(dep);
-		}
-	}
-	return deps;
-};
-/** @internal */
-const syntaxFailure = (cause) => ({
-	stage: "syntax",
-	cause
-});
-/** @internal */
-const validationFailure = (cause) => ({
-	stage: "validation",
-	cause
-});
-/** @internal */
-const framingFailure = (reason, documents) => ({
-	stage: "framing",
-	reason,
-	documents
+const PartialReleaseAgeGate = Schema.Struct({
+	/** Minutes a release must age; absent means this source sets no age. */
+	ageMinutes: Schema.optionalKey(Schema.Number),
+	/** Exempt package-name patterns; absent means this source adds no exemptions. */
+	exclude: Schema.optionalKey(Schema.Array(Schema.String))
 });
-/**
-* Whether the specifier is a workspace, link or file reference
-* (`"workspace:*"`, `"link:../foo"`, `"file:../bar"`).
-*
-* @internal
-*/
-const isWorkspaceSpecifier = (specifier) => specifier.startsWith("workspace:") || specifier.startsWith("link:") || specifier.startsWith("file:");
-/**
-* Extract inter-workspace dependency edges: for every workspace entry and
-* dependency type, emit an edge for each dependency whose name is itself a
-* workspace. Key-bearing intermediates are `Map`/`Set` — lockfile keys are
-* attacker-adjacent strings (`__proto__`, `constructor`) and must never be
-* assigned onto plain objects here.
-*
-* @internal
-*/
-const extractWorkspaceDeps = (workspaces, workspaceNames) => {
-	const deps = [];
-	for (const [from, entry] of workspaces) for (const depType of DEP_TYPES) {
-		const depMap = entry[depType];
-		if (!depMap) continue;
-		for (const [name, constraint] of Object.entries(depMap)) if (workspaceNames.has(name)) deps.push(WorkspaceDependency.make({
-			from,
-			to: name,
-			depType,
-			constraint
-		}));
-	}
-	return deps;
+const AgeMinutes = Schema.Number.check(Schema.isGreaterThanOrEqualTo(0), Schema.isFinite());
+const matchesPattern = (name, pattern) => {
+	if (pattern === name) return true;
+	if (!pattern.includes("*")) return false;
+	let nameIndex = 0;
+	let patternIndex = 0;
+	let starIndex = -1;
+	let retryNameIndex = 0;
+	while (nameIndex < name.length) if (pattern[patternIndex] === "*") {
+		starIndex = patternIndex;
+		patternIndex += 1;
+		retryNameIndex = nameIndex;
+	} else if (pattern[patternIndex] === name[nameIndex]) {
+		patternIndex += 1;
+		nameIndex += 1;
+	} else if (starIndex !== -1) {
+		patternIndex = starIndex + 1;
+		retryNameIndex += 1;
+		nameIndex = retryNameIndex;
+	} else return false;
+	while (pattern[patternIndex] === "*") patternIndex += 1;
+	return patternIndex === pattern.length;
 };
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+jsonc@0.5.2_effect@4.0.0-beta.101/node_modules/@effected/jsonc/JsoncNode.js
+const matchesExclude = (name, patterns) => patterns.some((pattern) => matchesPattern(name, pattern));
 /**
-* Discriminator values for JSONC AST node types: the JSON value types
-* (`string`/`number`/`boolean`/`null`), the structural types
-* (`object`/`array`) and the `property` key-value pair type.
+* pnpm's publish-time release-age gate: the number of minutes a published
+* version must age before it is eligible, and the set of package-name patterns
+* exempt from the gate. Mirrors pnpm's `minimumReleaseAge` /
+* `minimumReleaseAgeExclude` config so a resolver can drop too-young candidate
+* versions before picking, avoiding `ERR_PNPM_NO_MATURE_MATCHING_VERSION`.
 *
-* @public
-*/
-const JsoncNodeType = Schema.Literals([
-	"object",
-	"array",
-	"property",
-	"string",
-	"number",
-	"boolean",
-	"null"
-]);
-/**
-* An immutable JSONC AST node produced by `Jsonc.parseTree`.
+* `ageMinutes` is constrained non-negative and finite; a `ReleaseAgeGate` with
+* `ageMinutes <= 0` is an inert gate that filters nothing. Assemble a gate from
+* multiple config sources with {@link ReleaseAgeGate.combine}, and apply it to
+* a package's candidate versions with {@link ReleaseAgeGate.filterVersions}.
 *
-* The `parent` field present in Microsoft's `jsonc-parser` is intentionally
-* omitted: circular references would break structural equality, serialization
-* and Schema encode/decode. Child relationships are expressed via `children`,
-* and the recursive type is handled with `Schema.suspend`.
+* @example
+* ```ts
+* import { ReleaseAgeGate } from "@effected/npm";
 *
-* - `type` — the `JsoncNodeType` discriminator.
-* - `offset` / `length` — the node's span in the source (tight token-end
-*   discipline: spans never swallow trailing whitespace or comments).
-* - `value` — the decoded JS value for leaf nodes; omitted for structural nodes.
-* - `colonOffset` — for `property` nodes, the offset of the `:` separator.
-* - `children` — child nodes for `object`, `array` and `property` nodes.
+* const gate = ReleaseAgeGate.combine(
+*   { ageMinutes: 1440 },
+*   { exclude: ["@my-scope/*"] },
+* );
+* // gate.ageMinutes === 1440, gate.exclude === ["@my-scope/*"]
 *
-* Construct via `JsoncNode.make(...)`, never `new JsoncNode(...)`.
+* const eligible = gate.filterVersions(
+*   ["1.0.0", "1.0.1"],
+*   { "1.0.0": "2020-01-01T00:00:00Z", "1.0.1": "2026-07-21T00:00:00Z" },
+*   "prettier",
+*   Date.now(),
+* );
+* ```
 *
 * @public
 */
-var JsoncNode = class JsoncNode extends Schema.Class("JsoncNode")({
-	type: JsoncNodeType,
-	offset: Schema.Number,
-	length: Schema.Number,
-	value: Schema.optionalKey(Schema.Unknown),
-	colonOffset: Schema.optionalKey(Schema.Number),
-	children: Schema.optionalKey(Schema.Array(Schema.suspend(() => JsoncNode)))
+var ReleaseAgeGate = class ReleaseAgeGate extends Schema.Class("ReleaseAgeGate")({
+	/** Minutes a published version must age before it is eligible (non-negative, finite). */
+	ageMinutes: AgeMinutes,
+	/** Package-name patterns exempt from the gate (exact names or `*`-globs). */
+	exclude: Schema.Array(Schema.String)
 }) {
 	/**
-	* Find a descendant node by path. String segments navigate object
-	* properties; number segments navigate array indices. Returns
-	* `Option.none()` when any segment cannot be resolved. Pure.
+	* Combine partial contributions from multiple sources into one effective
+	* gate: **strictest age wins** (the maximum of the contributed ages,
+	* clamped to be non-negative) and the exclude sets **union** (deduplicated,
+	* lexicographically sorted — a canonical wire form, so the combined gate is
+	* deterministic regardless of the order contributions arrive in). A
+	* contribution's absent field adds nothing; a
+	* negative or non-finite contributed age is ignored by the clamp. With no
+	* contributions (or only empty ones) the result is the inert zero gate
+	* (`ageMinutes: 0`, `exclude: []`).
 	*
-	* @param path - The path to resolve, relative to this node.
-	* @returns The descendant node, or `Option.none()` when `path` cannot be
-	*   resolved.
+	* `combine` is total — it never throws on a fractional, negative, or
+	* non-finite contribution — which is why {@link (PartialReleaseAgeGate:variable)}
+	* does not constrain its `ageMinutes` and this method owns the clamp.
+	*
+	* @param contributions - the partial gates to merge, one per source.
 	*/
-	find(path) {
-		let current = this;
-		for (const segment of path) {
-			if (current?.children === void 0) return Option.none();
-			if (typeof segment === "string") {
-				if (current.type !== "object") return Option.none();
-				current = current.children.find((child) => child.type === "property" && child.children !== void 0 && child.children[0]?.value === segment)?.children?.[1];
-			} else {
-				if (current.type !== "array") return Option.none();
-				current = current.children[segment];
-			}
-		}
-		return current !== void 0 ? Option.some(current) : Option.none();
+	static combine(...contributions) {
+		const ages = contributions.map((contribution) => contribution.ageMinutes).filter((age) => typeof age === "number" && Number.isFinite(age));
+		const ageMinutes = ages.length > 0 ? Math.max(0, ...ages) : 0;
+		const exclude = [...new Set(contributions.flatMap((contribution) => contribution.exclude ?? []))].sort();
+		return ReleaseAgeGate.make({
+			ageMinutes,
+			exclude
+		});
 	}
 	/**
-	* Find the innermost node whose span covers `offset`, or `Option.none()`
-	* if the offset is outside this subtree. Pure.
+	* Whether a package name matches any of `patterns`, using pnpm's
+	* `@pnpm/matcher` semantics: an exact-name match, or a `*`-glob where `*`
+	* matches any run of characters **including `/`** — so a bare `*` matches a
+	* scoped name like `@scope/pkg`, and `@scope/*` matches every package in a
+	* scope.
 	*
-	* @param offset - The zero-based character offset to locate.
-	* @returns The innermost covering node, or `Option.none()` when `offset`
-	*   falls outside this subtree.
+	* @remarks
+	* This is deliberately **NOT** `@effected/glob`'s minimatch dialect, in
+	* which `*` refuses to cross `/` (there `*` matches `pkg` but not
+	* `@scope/pkg`, and you would need `**`). pnpm treats the package name as a
+	* flat string, so this matcher does too. Do not "fix" this to route through
+	* `@effected/glob`: it would silently change which packages a gate exempts
+	* and diverge from pnpm's own behavior.
+	*
+	* @param name - the package name to test.
+	* @param patterns - the exclude patterns (exact names or `*`-globs).
 	*/
-	findAtOffset(offset) {
-		return findAtOffsetImpl(this, offset, 0);
+	static matchesExclude(name, patterns) {
+		return matchesExclude(name, patterns);
 	}
 	/**
-	* Return the JSON path to the innermost node covering `offset`, or
-	* `Option.none()` if the offset is outside this subtree. The inverse of
-	* {@link JsoncNode.find}. Pure.
+	* Whether this gate exempts the given package name from the release-age
+	* check — `ReleaseAgeGate.matchesExclude(name, this.exclude)`.
 	*
-	* @param offset - The zero-based character offset to locate.
-	* @returns The path to the innermost covering node, or `Option.none()`
-	*   when `offset` falls outside this subtree.
+	* @param name - the package name to test.
 	*/
-	pathAt(offset) {
-		return buildPath(this, offset, []);
+	isExcluded(name) {
+		return matchesExclude(name, this.exclude);
 	}
 	/**
-	* Reconstruct the plain JavaScript value represented by this subtree. Pure
-	* and total — never fails, so no `Effect` wrapper.
+	* Filter a package's candidate versions to those old enough to pass the
+	* gate, given each version's publish timestamp and a caller-supplied `now`.
 	*
-	* @returns The plain JavaScript value (object, array, string, number,
-	*   boolean or `null`) this subtree represents.
+	* A version is kept when it has a parseable publish timestamp at or before
+	* the cutoff (`now - ageMinutes * 60000`). A version with a **missing or
+	* unparseable** timestamp in `times` is **dropped** — matching pnpm's strict
+	* posture: a version whose age cannot be established is treated as too young.
+	* The clock is the caller's; this method reads no wall clock.
+	*
+	* Returns all versions unchanged (a no-op) when the gate is inert
+	* (`ageMinutes <= 0`) or the package name is excluded.
+	*
+	* @param versions - the candidate version strings.
+	* @param times - a map from version string to its ISO-8601 publish date.
+	* @param name - the package name (checked against the gate's `exclude` list).
+	* @param now - the current time in epoch milliseconds (the caller's clock).
 	*/
-	toValue() {
-		return evaluateNode(this, 0);
+	filterVersions(versions, times, name, now) {
+		if (this.ageMinutes <= 0 || this.isExcluded(name)) return versions;
+		const cutoff = now - this.ageMinutes * MS_PER_MINUTE;
+		return versions.filter((version) => {
+			const time = times[version];
+			if (time === void 0) return false;
+			const published = Date.parse(time);
+			return Number.isFinite(published) && published <= cutoff;
+		});
 	}
 };
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/ImporterDependency.js
 /**
-* Validation-free construction path for the trusted tree builder in
-* `internal/parser.ts` — NOT part of the public surface (not re-exported from
-* `index.ts`); external callers construct via the fully validating
-* `JsoncNode.make`.
-*
-* Constructing a `JsoncNode` through `make`/`new` re-parses the recursive
-* `children` field, and each element parse re-runs the class transformation,
-* which re-parses ITS children — construction cost doubles per nesting level
-* (issue #13; measured ~4s at depth 20, effectively hanging past 25). The
-* parser guarantees validity by construction — every field comes straight off
-* a scanner token — so it skips schema construction entirely.
+* One declared dependency of one workspace importer, as the lockfile records it.
 *
-* A `Schema.Class` instance is its props assigned onto the class prototype:
-* the base `Data.Class` constructor is exactly `Object.assign(this, props)`,
-* and the prototype chain carries the methods, the class brand getter and
-* structural equality (verified against effect@4.0.0-beta.97). Mirroring that
-* with `Object.create` + `Object.assign` yields an instance identical to a
-* `make`-built one, minus the validating parse.
+* @remarks
+* - `name` — the dependency's package name.
+* - `specifier` — the declared range, typed through `@effected/npm`'s
+*   `DependencySpecifier.FromString` codec: the decoded value is a tag-matchable
+*   `ClassifiedSpecifier` (`catalog:` / `workspace:` / range / dist-tag / raw),
+*   while encoding round-trips the **exact original string byte-for-byte** — the
+*   guarantee a before/after lockfile diff relies on.
+* - `version` — the concrete resolved version, **populated by pnpm only**:
+*   comparable across refs and printable. pnpm records `{ specifier, version }`
+*   per importer dependency, and the parser splits pnpm's peer-disambiguation
+*   suffix off into `peerSuffix`, so `version` is always the plain version — or
+*   a non-registry resolution (`link:../utils`, `file:...`), passed through
+*   verbatim. bun and npm record resolved versions on their package entries
+*   instead, so for those formats `version` is absent and a consumer joins by
+*   `name` against `Lockfile.packages`.
+* - `peerSuffix` — pnpm's peer-disambiguation context: the raw parenthesized
+*   chain the lockfile recorded after the version, e.g.
+*   `(effect@4.0.0-beta.101)(ioredis@5.11.1(supports-color@8.1.1))`. Present
+*   only when the lockfile recorded one — never for suffix-free pnpm entries,
+*   and never for the other formats, which do not record peer context per
+*   importer dependency.
+* - `depType` — which dependency map declared it, spelled with `@effected/npm`'s
+*   kit-wide `DependencyField` vocabulary.
 *
-* Contract: absent optional fields must be OMITTED, never passed as an
-* explicit `undefined` (a present `undefined` would create an own property
-* that `make` would have rejected).
+* @public
 */
-const makeNodeUnsafe = (props) => Object.assign(Object.create(JsoncNode.prototype), props);
-function findAtOffsetImpl(node, offset, depth) {
-	if (offset < node.offset || offset >= node.offset + node.length) return Option.none();
-	if (node.children === void 0 || depth >= 256) return Option.some(node);
-	for (const child of node.children) if (offset >= child.offset && offset < child.offset + child.length) return findAtOffsetImpl(child, offset, depth + 1);
-	return Option.some(node);
-}
-function buildPath(node, targetOffset, currentPath, depth = 0) {
-	if (targetOffset < node.offset || targetOffset >= node.offset + node.length) return Option.none();
-	if (node.children === void 0 || depth >= 256) return Option.some(currentPath);
-	if (node.type === "object") {
-		for (const prop of node.children) if (prop.type === "property" && prop.children !== void 0 && targetOffset >= prop.offset && targetOffset < prop.offset + prop.length) {
-			const key = prop.children[0]?.value;
-			const valuePath = [...currentPath, key];
-			const valueChild = prop.children[1];
-			if (valueChild !== void 0 && targetOffset >= valueChild.offset && targetOffset < valueChild.offset + valueChild.length) return buildPath(valueChild, targetOffset, valuePath, depth + 1);
-			return Option.some(valuePath);
-		}
-	} else if (node.type === "array") for (let i = 0; i < node.children.length; i++) {
-		const child = node.children[i];
-		if (targetOffset >= child.offset && targetOffset < child.offset + child.length) return buildPath(child, targetOffset, [...currentPath, i], depth + 1);
-	}
-	return Option.some(currentPath);
-}
-function evaluateNode(node, depth) {
-	if (depth >= 256) return node.type === "object" ? {} : node.type === "array" ? [] : null;
-	switch (node.type) {
-		case "object": {
-			const obj = {};
-			if (node.children !== void 0) {
-				for (const prop of node.children) if (prop.type === "property" && prop.children !== void 0 && prop.children.length === 2) {
-					const key = prop.children[0].value;
-					const value = evaluateNode(prop.children[1], depth + 1);
-					if (key === "__proto__") Object.defineProperty(obj, key, {
-						value,
-						writable: true,
-						enumerable: true,
-						configurable: true
-					});
-					else obj[key] = value;
-				}
-			}
-			return obj;
-		}
-		case "array": return (node.children ?? []).map((child) => evaluateNode(child, depth + 1));
-		case "property": return node.children?.[1] !== void 0 ? evaluateNode(node.children[1], depth + 1) : void 0;
-		default: return node.value;
-	}
-}
+var ImporterDependency = class extends Schema.Class("ImporterDependency")({
+	name: Schema.NonEmptyString,
+	specifier: DependencySpecifier$1.FromString,
+	version: Schema.optionalKey(Schema.String),
+	peerSuffix: Schema.optionalKey(Schema.String),
+	depType: DependencyField$1
+}) {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+jsonc@0.5.2_effect@4.0.0-beta.101/node_modules/@effected/jsonc/internal/scanner.js
-const isWhitespace = (ch) => ch === 32 || ch === 9 || ch === 11 || ch === 12 || ch === 160 || ch === 65279;
-const isLineBreak$1 = (ch) => ch === 10 || ch === 13 || ch === 8232 || ch === 8233;
-const isDigit$1 = (ch) => ch >= 48 && ch <= 57;
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/LockfileImporter.js
 /**
-* Create a stateful {@link Scanner} for the given JSONC string.
+* One workspace importer's declared dependencies, as the lockfile records them.
 *
-* @param text - JSONC string to tokenize.
-* @param ignoreTrivia - When `true`, whitespace, line-break and comment tokens
-*   are skipped so only structural tokens are returned.
+* @remarks
+* - `path` — the importer path relative to the workspace root, `"."` for the
+*   root package (never empty — a `NonEmptyString`) — the same keys as
+*   `WorkspaceDiscovery.importerMap()` in
+*   `@effected/workspaces`. This is the stable join key: `Lockfile#importer`
+*   looks importers up by it, and `Lockfile#withImporterNames` deliberately
+*   leaves importers untouched because the path — not a package name — keys
+*   them.
+* - `dependencies` — each declared dependency as an {@link ImporterDependency}.
+*
+* Populated by the pnpm, bun and npm parsers. yarn does not record importers,
+* so a yarn lockfile always yields an empty `importers` array.
+*
+* @public
 */
-const createScanner$2 = (text, ignoreTrivia = false) => {
-	const len = text.length;
-	let pos = 0;
-	let tokenOffset = 0;
-	let token = "Unknown";
-	let tokenValue = "";
-	let tokenError = "None";
-	const scanHexDigits = (count) => {
-		let value = 0;
-		for (let i = 0; i < count; i++) {
-			if (pos >= len) return -1;
-			const ch = text.charCodeAt(pos);
+var LockfileImporter = class extends Schema.Class("LockfileImporter")({
+	path: Schema.NonEmptyString,
+	dependencies: Schema.Array(ImporterDependency)
+}) {};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/ResolvedPackage.js
+const EMPTY_DEPENDENCIES = {};
+/**
+* A package resolved from a lockfile.
+*
+* @remarks
+* The common shape every format's entries normalize into:
+*
+* - `name` — the resolved package name. For pnpm *workspace* packages
+*   straight out of `Lockfile.parse` this is the importer path until
+*   `Lockfile#withImporterNames` rewrites it.
+* - `version` — the resolved version string (pnpm workspace packages carry
+*   `"0.0.0"`; the lockfile does not record their real versions).
+* - `integrity` — optional `@effected/npm` `IntegrityHash`, covering npm/pnpm
+*   `sha512-...` SRI and yarn Berry's `10c0/...` cache checksums (the yarn
+*   textual form). An *absent* integrity is omitted, so a `ResolvedPackage` may
+*   carry none; a *present but unparseable* integrity fails the parse typed at
+*   validation rather than being silently dropped.
+* - `isWorkspace` — `true` for workspace-local packages.
+* - `relativePath` — the workspace-relative directory for workspace
+*   packages, when the lockfile records one.
+* - `dependencies` — the package's own dependency map, defaulting to `{}`
+*   both at construction and when decoding serialized data.
+*
+* @public
+*/
+var ResolvedPackage = class extends Schema.Class("ResolvedPackage")({
+	name: Schema.NonEmptyString,
+	version: Schema.String,
+	integrity: Schema.optionalKey(IntegrityHash$1),
+	isWorkspace: Schema.Boolean,
+	relativePath: Schema.optionalKey(Schema.String),
+	dependencies: Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY_DEPENDENCIES)), Schema.withConstructorDefault(Effect.succeed(EMPTY_DEPENDENCIES)))
+}) {};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/WorkspaceDependency.js
+/**
+* A directed dependency edge between two workspace packages as recorded in
+* the lockfile.
+*
+* @remarks
+* - `from` — the workspace package declaring the dependency. For pnpm this
+*   is the importer path until `Lockfile#withImporterNames` rewrites it.
+* - `to` — the workspace package depended upon.
+* - `depType` — which dependency map holds the edge, spelled with
+*   `@effected/npm`'s kit-wide `DependencyField` vocabulary.
+* - `constraint` — the declared specifier (e.g. `"workspace:*"`, `"^1.0.0"`).
+*
+* @public
+*/
+var WorkspaceDependency = class extends Schema.Class("WorkspaceDependency")({
+	from: Schema.NonEmptyString,
+	to: Schema.NonEmptyString,
+	depType: DependencyField$1,
+	constraint: Schema.String
+}) {};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/PnpmExtension.js
+/**
+* Extension data specific to pnpm lockfiles, attached to `Lockfile.extension`
+* when the format is `"pnpm"`.
+*
+* @remarks
+* - `catalogs` — pnpm catalog definitions ({@link PnpmCatalogs}).
+* - `overrides` — the version override map recorded in the lockfile header.
+* - `settings` — pnpm settings recorded in the lockfile header.
+*
+* @public
+*/
+var PnpmExtension = class extends Schema.Class("PnpmExtension")({
+	_tag: Schema.tag("pnpm"),
+	catalogs: Schema.optionalKey(Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.Union([Schema.String, Schema.Struct({
+		specifier: Schema.String,
+		version: Schema.String
+	})])))),
+	overrides: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	settings: Schema.optionalKey(Schema.Struct({
+		autoInstallPeers: Schema.optionalKey(Schema.Boolean),
+		excludeLinksFromLockfile: Schema.optionalKey(Schema.Boolean)
+	}))
+}) {};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/LockfileFormat.js
+/**
+* The lockfile formats this package parses: bun's `bun.lock` (JSONC), npm's
+* `package-lock.json` (v2/v3 JSON), pnpm's `pnpm-lock.yaml` and yarn Berry's
+* `yarn.lock` (both YAML).
+*
+* @remarks
+* The literal names the *lockfile format*, not the package manager that
+* happens to write it — this package models lockfiles. Yarn support is
+* Berry only; classic (v1) `yarn.lock` is not YAML and fails
+* `Lockfile.parse` with a typed `LockfileParseError`.
+*
+* @public
+*/
+const LockfileFormat = Schema.Literals([
+	"bun",
+	"npm",
+	"pnpm",
+	"yarn"
+]);
+const FILENAMES = {
+	bun: ["bun.lock", "bun.lockb"],
+	npm: ["package-lock.json", "npm-shrinkwrap.json"],
+	pnpm: ["pnpm-lock.yaml"],
+	yarn: ["yarn.lock"]
+};
+/**
+* The conventional lockfile filename for a format: `"bun.lock"`,
+* `"package-lock.json"`, `"pnpm-lock.yaml"` or `"yarn.lock"`.
+*
+* @remarks
+* The primary name only — the first element of {@link filenamesFor}, which is
+* what detection that must also see the genuine alternates should use.
+*
+* @public
+*/
+const filenameFor = (format) => FILENAMES[format][0];
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/internal/shared.js
+/**
+* The four dependency sections of a manifest, in a stable order — the shared
+* dependency-sections table (v3's `DEP_SECTIONS`). Each entry is both the
+* manifest field name to read and the `@effected/npm` `DependencyField` it maps
+* to, since the two coincide. Consumed by `extractWorkspaceDeps` and by the
+* pnpm/bun/npm importer builders.
+*
+* @internal
+*/
+const DEP_TYPES = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
+/**
+* Coerce a raw lockfile integrity string to the `@effected/npm` `IntegrityHash`
+* brand, which recognizes the SRI (`<algo>-<base64>`), corepack (`<algo>.<hex>`)
+* and yarn (`<cachekey>/<hex>`) textual forms.
+*
+* Absence and corruption are treated differently, and the distinction is the
+* point. An *absent* integrity (input `undefined`) succeeds with `undefined`,
+* so the caller omits the field — a lockfile that records no integrity is
+* legitimate. A *present but unparseable* integrity fails through the same
+* validation channel the shape checks use ({@link validationFailure}), so
+* `Lockfile.parse` surfaces it as a `LockfileParseError` with
+* `stage: "validation"` rather than silently dropping a corrupt value. Never a
+* defect. yarn's `10c0/<hex>` cache checksums are a recognized form, so real
+* yarn/npm/pnpm/bun integrity all still parses; only genuine corruption fails.
+*
+* @internal
+*/
+const toIntegrityHash = (raw) => {
+	if (raw === void 0) return Effect.succeed(void 0);
+	return Schema.decodeUnknownEffect(IntegrityHash$1)(raw).pipe(Effect.mapError(validationFailure));
+};
+const decodeSpecifier = Schema.decodeUnknownExit(DependencySpecifier$1.FromString);
+/**
+* Split pnpm's peer-disambiguation suffix off a recorded string: everything
+* from the first `(` on is suffix, since package names and versions never
+* contain `(`. Handles both shapes pnpm records — a bare version
+* (`"1.0.0(effect@4.0.0)"`, importer entries) and a `name@version` snapshot key
+* (`"fdir@6.5.0(picomatch@4.0.4)"`). A string with no `(` — including
+* `link:...` / `file:...` resolutions — passes through untouched. So does a
+* protocol-bearing string (a `:` ahead of the first `(`), where a parenthesis
+* is path or URL text rather than a peer suffix: pnpm attaches suffixes to
+* registry versions only. This is the single stripping implementation — do not
+* hand-roll an `indexOf("(")` split elsewhere.
+*
+* @internal
+*/
+const splitPeerSuffix = (raw) => {
+	const parenIndex = raw.indexOf("(");
+	if (parenIndex === -1) return { plain: raw };
+	if (raw.lastIndexOf(":", parenIndex) !== -1) return { plain: raw };
+	return {
+		plain: raw.slice(0, parenIndex),
+		peerSuffix: raw.slice(parenIndex)
+	};
+};
+/**
+* Build one {@link ImporterDependency}, decoding the raw specifier string into
+* the `@effected/npm` `ClassifiedSpecifier` tagged union. Returns `undefined`
+* — a skip, never a throw — when the name is empty or the specifier does not
+* classify (e.g. an empty specifier), per the total-string-surgery discipline.
+*
+* A pnpm-recorded version is normalized through {@link splitPeerSuffix}: the
+* `version` field carries the plain version and the split-off peer chain lands
+* in `peerSuffix`. A version that is *only* a peer chain (empty plain part) is
+* treated as no concrete version — a skip of both fields, never a throw.
+*
+* @internal
+*/
+const buildImporterDependency = (name, specifier, depType, version) => {
+	if (name === "") return void 0;
+	const exit = decodeSpecifier(specifier);
+	if (Exit.isFailure(exit)) return void 0;
+	const resolved = version !== void 0 && version !== "" ? splitPeerSuffix(version) : void 0;
+	return ImporterDependency.make({
+		name,
+		specifier: exit.value,
+		depType,
+		...resolved !== void 0 && resolved.plain !== "" ? {
+			version: resolved.plain,
+			...resolved.peerSuffix !== void 0 ? { peerSuffix: resolved.peerSuffix } : {}
+		} : {}
+	});
+};
+/**
+* Collect an importer's declared dependencies off the shared dependency-sections
+* table. Iterates {@link DEP_TYPES} in order, projecting each section value with
+* `read`; malformed rows are skipped (never thrown). Key-bearing intermediates
+* are the schema-decoded records, whose own-property `Object.entries` iteration
+* neither pollutes nor drops a `__proto__` key.
+*
+* @internal
+*/
+const importerDependencies = (entry, read) => {
+	const deps = [];
+	for (const field of DEP_TYPES) {
+		const section = entry[field];
+		if (!section) continue;
+		for (const [name, value] of Object.entries(section)) {
+			const { specifier, version } = read(value);
+			const dep = buildImporterDependency(name, specifier, field, version);
+			if (dep !== void 0) deps.push(dep);
+		}
+	}
+	return deps;
+};
+/** @internal */
+const syntaxFailure = (cause) => ({
+	stage: "syntax",
+	cause
+});
+/** @internal */
+const validationFailure = (cause) => ({
+	stage: "validation",
+	cause
+});
+/** @internal */
+const framingFailure = (reason, documents) => ({
+	stage: "framing",
+	reason,
+	documents
+});
+/**
+* Whether the specifier is a workspace, link or file reference
+* (`"workspace:*"`, `"link:../foo"`, `"file:../bar"`).
+*
+* @internal
+*/
+const isWorkspaceSpecifier = (specifier) => specifier.startsWith("workspace:") || specifier.startsWith("link:") || specifier.startsWith("file:");
+/**
+* Extract inter-workspace dependency edges: for every workspace entry and
+* dependency type, emit an edge for each dependency whose name is itself a
+* workspace. Key-bearing intermediates are `Map`/`Set` — lockfile keys are
+* attacker-adjacent strings (`__proto__`, `constructor`) and must never be
+* assigned onto plain objects here.
+*
+* @internal
+*/
+const extractWorkspaceDeps = (workspaces, workspaceNames) => {
+	const deps = [];
+	for (const [from, entry] of workspaces) for (const depType of DEP_TYPES) {
+		const depMap = entry[depType];
+		if (!depMap) continue;
+		for (const [name, constraint] of Object.entries(depMap)) if (workspaceNames.has(name)) deps.push(WorkspaceDependency.make({
+			from,
+			to: name,
+			depType,
+			constraint
+		}));
+	}
+	return deps;
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+jsonc@0.5.2_effect@4.0.0-beta.101/node_modules/@effected/jsonc/JsoncNode.js
+/**
+* Discriminator values for JSONC AST node types: the JSON value types
+* (`string`/`number`/`boolean`/`null`), the structural types
+* (`object`/`array`) and the `property` key-value pair type.
+*
+* @public
+*/
+const JsoncNodeType = Schema.Literals([
+	"object",
+	"array",
+	"property",
+	"string",
+	"number",
+	"boolean",
+	"null"
+]);
+/**
+* An immutable JSONC AST node produced by `Jsonc.parseTree`.
+*
+* The `parent` field present in Microsoft's `jsonc-parser` is intentionally
+* omitted: circular references would break structural equality, serialization
+* and Schema encode/decode. Child relationships are expressed via `children`,
+* and the recursive type is handled with `Schema.suspend`.
+*
+* - `type` — the `JsoncNodeType` discriminator.
+* - `offset` / `length` — the node's span in the source (tight token-end
+*   discipline: spans never swallow trailing whitespace or comments).
+* - `value` — the decoded JS value for leaf nodes; omitted for structural nodes.
+* - `colonOffset` — for `property` nodes, the offset of the `:` separator.
+* - `children` — child nodes for `object`, `array` and `property` nodes.
+*
+* Construct via `JsoncNode.make(...)`, never `new JsoncNode(...)`.
+*
+* @public
+*/
+var JsoncNode = class JsoncNode extends Schema.Class("JsoncNode")({
+	type: JsoncNodeType,
+	offset: Schema.Number,
+	length: Schema.Number,
+	value: Schema.optionalKey(Schema.Unknown),
+	colonOffset: Schema.optionalKey(Schema.Number),
+	children: Schema.optionalKey(Schema.Array(Schema.suspend(() => JsoncNode)))
+}) {
+	/**
+	* Find a descendant node by path. String segments navigate object
+	* properties; number segments navigate array indices. Returns
+	* `Option.none()` when any segment cannot be resolved. Pure.
+	*
+	* @param path - The path to resolve, relative to this node.
+	* @returns The descendant node, or `Option.none()` when `path` cannot be
+	*   resolved.
+	*/
+	find(path) {
+		let current = this;
+		for (const segment of path) {
+			if (current?.children === void 0) return Option.none();
+			if (typeof segment === "string") {
+				if (current.type !== "object") return Option.none();
+				current = current.children.find((child) => child.type === "property" && child.children !== void 0 && child.children[0]?.value === segment)?.children?.[1];
+			} else {
+				if (current.type !== "array") return Option.none();
+				current = current.children[segment];
+			}
+		}
+		return current !== void 0 ? Option.some(current) : Option.none();
+	}
+	/**
+	* Find the innermost node whose span covers `offset`, or `Option.none()`
+	* if the offset is outside this subtree. Pure.
+	*
+	* @param offset - The zero-based character offset to locate.
+	* @returns The innermost covering node, or `Option.none()` when `offset`
+	*   falls outside this subtree.
+	*/
+	findAtOffset(offset) {
+		return findAtOffsetImpl(this, offset, 0);
+	}
+	/**
+	* Return the JSON path to the innermost node covering `offset`, or
+	* `Option.none()` if the offset is outside this subtree. The inverse of
+	* {@link JsoncNode.find}. Pure.
+	*
+	* @param offset - The zero-based character offset to locate.
+	* @returns The path to the innermost covering node, or `Option.none()`
+	*   when `offset` falls outside this subtree.
+	*/
+	pathAt(offset) {
+		return buildPath(this, offset, []);
+	}
+	/**
+	* Reconstruct the plain JavaScript value represented by this subtree. Pure
+	* and total — never fails, so no `Effect` wrapper.
+	*
+	* @returns The plain JavaScript value (object, array, string, number,
+	*   boolean or `null`) this subtree represents.
+	*/
+	toValue() {
+		return evaluateNode(this, 0);
+	}
+};
+/**
+* Validation-free construction path for the trusted tree builder in
+* `internal/parser.ts` — NOT part of the public surface (not re-exported from
+* `index.ts`); external callers construct via the fully validating
+* `JsoncNode.make`.
+*
+* Constructing a `JsoncNode` through `make`/`new` re-parses the recursive
+* `children` field, and each element parse re-runs the class transformation,
+* which re-parses ITS children — construction cost doubles per nesting level
+* (issue #13; measured ~4s at depth 20, effectively hanging past 25). The
+* parser guarantees validity by construction — every field comes straight off
+* a scanner token — so it skips schema construction entirely.
+*
+* A `Schema.Class` instance is its props assigned onto the class prototype:
+* the base `Data.Class` constructor is exactly `Object.assign(this, props)`,
+* and the prototype chain carries the methods, the class brand getter and
+* structural equality (verified against effect@4.0.0-beta.97). Mirroring that
+* with `Object.create` + `Object.assign` yields an instance identical to a
+* `make`-built one, minus the validating parse.
+*
+* Contract: absent optional fields must be OMITTED, never passed as an
+* explicit `undefined` (a present `undefined` would create an own property
+* that `make` would have rejected).
+*/
+const makeNodeUnsafe = (props) => Object.assign(Object.create(JsoncNode.prototype), props);
+function findAtOffsetImpl(node, offset, depth) {
+	if (offset < node.offset || offset >= node.offset + node.length) return Option.none();
+	if (node.children === void 0 || depth >= 256) return Option.some(node);
+	for (const child of node.children) if (offset >= child.offset && offset < child.offset + child.length) return findAtOffsetImpl(child, offset, depth + 1);
+	return Option.some(node);
+}
+function buildPath(node, targetOffset, currentPath, depth = 0) {
+	if (targetOffset < node.offset || targetOffset >= node.offset + node.length) return Option.none();
+	if (node.children === void 0 || depth >= 256) return Option.some(currentPath);
+	if (node.type === "object") {
+		for (const prop of node.children) if (prop.type === "property" && prop.children !== void 0 && targetOffset >= prop.offset && targetOffset < prop.offset + prop.length) {
+			const key = prop.children[0]?.value;
+			const valuePath = [...currentPath, key];
+			const valueChild = prop.children[1];
+			if (valueChild !== void 0 && targetOffset >= valueChild.offset && targetOffset < valueChild.offset + valueChild.length) return buildPath(valueChild, targetOffset, valuePath, depth + 1);
+			return Option.some(valuePath);
+		}
+	} else if (node.type === "array") for (let i = 0; i < node.children.length; i++) {
+		const child = node.children[i];
+		if (targetOffset >= child.offset && targetOffset < child.offset + child.length) return buildPath(child, targetOffset, [...currentPath, i], depth + 1);
+	}
+	return Option.some(currentPath);
+}
+function evaluateNode(node, depth) {
+	if (depth >= 256) return node.type === "object" ? {} : node.type === "array" ? [] : null;
+	switch (node.type) {
+		case "object": {
+			const obj = {};
+			if (node.children !== void 0) {
+				for (const prop of node.children) if (prop.type === "property" && prop.children !== void 0 && prop.children.length === 2) {
+					const key = prop.children[0].value;
+					const value = evaluateNode(prop.children[1], depth + 1);
+					if (key === "__proto__") Object.defineProperty(obj, key, {
+						value,
+						writable: true,
+						enumerable: true,
+						configurable: true
+					});
+					else obj[key] = value;
+				}
+			}
+			return obj;
+		}
+		case "array": return (node.children ?? []).map((child) => evaluateNode(child, depth + 1));
+		case "property": return node.children?.[1] !== void 0 ? evaluateNode(node.children[1], depth + 1) : void 0;
+		default: return node.value;
+	}
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+jsonc@0.5.2_effect@4.0.0-beta.101/node_modules/@effected/jsonc/internal/scanner.js
+const isWhitespace = (ch) => ch === 32 || ch === 9 || ch === 11 || ch === 12 || ch === 160 || ch === 65279;
+const isLineBreak$1 = (ch) => ch === 10 || ch === 13 || ch === 8232 || ch === 8233;
+const isDigit$1 = (ch) => ch >= 48 && ch <= 57;
+/**
+* Create a stateful {@link Scanner} for the given JSONC string.
+*
+* @param text - JSONC string to tokenize.
+* @param ignoreTrivia - When `true`, whitespace, line-break and comment tokens
+*   are skipped so only structural tokens are returned.
+*/
+const createScanner$2 = (text, ignoreTrivia = false) => {
+	const len = text.length;
+	let pos = 0;
+	let tokenOffset = 0;
+	let token = "Unknown";
+	let tokenValue = "";
+	let tokenError = "None";
+	const scanHexDigits = (count) => {
+		let value = 0;
+		for (let i = 0; i < count; i++) {
+			if (pos >= len) return -1;
+			const ch = text.charCodeAt(pos);
 			if (ch >= 48 && ch <= 57) value = value * 16 + (ch - 48);
 			else if (ch >= 65 && ch <= 70) value = value * 16 + (ch - 65 + 10);
 			else if (ch >= 97 && ch <= 102) value = value * 16 + (ch - 97 + 10);
@@ -7006,7 +7680,7 @@ var JsoncModifier = class {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/internal/bun.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/internal/bun.js
 const DepRecord$2 = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
 const BunWorkspaceEntry = Schema.Struct({
 	name: Schema.optionalKey(Schema.String),
@@ -7100,7 +7774,7 @@ const toFields$3 = (raw) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/internal/npm.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/internal/npm.js
 const DepRecord$1 = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
 const NpmPackageEntry = Schema.Struct({
 	name: Schema.optionalKey(Schema.String),
@@ -14128,7 +14802,7 @@ function deepEqualValues(a, b) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/internal/documents.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/internal/documents.js
 /**
 * An empty YAML document composes to `null` (`Yaml.parseAll("")` is `[null]`,
 * and the trailing document of an env-only `pnpm-lock.yaml` is `null` too).
@@ -14199,7 +14873,7 @@ const selectSoleDocument = (content) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/internal/pnpm.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/internal/pnpm.js
 const PnpmImporterDeps = Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({
 	specifier: Schema.String,
 	version: Schema.String
@@ -14225,590 +14899,1047 @@ const PnpmLockfileRaw = Schema.Struct({
 	packages: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({ resolution: Schema.optionalKey(Schema.Struct({ integrity: Schema.optionalKey(Schema.String) })) })))
 });
 /**
-* Parse pnpm `pnpm-lock.yaml` content into the unified field bundle.
+* Parse pnpm `pnpm-lock.yaml` content into the unified field bundle.
+*
+* `pnpm-lock.yaml` is a YAML *stream*, not a single document: a workspace
+* using `configDependencies` gets a config-dependencies preamble document
+* ahead of the lockfile. {@link selectPnpmDocument} locates the lockfile
+* deterministically (it is the last document); a stream carrying no lockfile
+* document fails through the typed framing channel rather than silently
+* reporting the preamble as an empty workspace.
+*
+* Workspace packages are keyed by importer *path* with version `"0.0.0"`;
+* `Lockfile#withImporterNames` is the explicit second stage that rewrites
+* them to real names.
+*
+* @internal
+*/
+const parsePnpm = (content) => Effect.gen(function* () {
+	const { document, documents } = yield* selectPnpmDocument(content);
+	const validated = yield* Schema.decodeUnknownEffect(PnpmLockfileRaw)(document).pipe(Effect.mapError(validationFailure));
+	if (Object.keys(validated.importers).length === 0) return yield* Effect.fail(framingFailure("noImporters", documents));
+	return yield* toFields$1(validated);
+});
+const toVersionMap = (deps) => {
+	if (!deps) return void 0;
+	return Object.fromEntries(Object.entries(deps).map(([name, info]) => [name, info.specifier]));
+};
+const importerDepGroups = (importer) => [
+	importer.dependencies,
+	importer.devDependencies,
+	importer.peerDependencies,
+	importer.optionalDependencies
+];
+const toFields$1 = (raw) => Effect.gen(function* () {
+	const workspaceEntries = /* @__PURE__ */ new Map();
+	const workspaceNames = /* @__PURE__ */ new Set();
+	const importers = [];
+	for (const [importerPath, importer] of Object.entries(raw.importers)) {
+		if (importerPath === "") continue;
+		importers.push(LockfileImporter.make({
+			path: importerPath,
+			dependencies: importerDependencies(importer, (info) => ({
+				specifier: info.specifier,
+				version: info.version
+			}))
+		}));
+		const deps = toVersionMap(importer.dependencies);
+		const devDeps = toVersionMap(importer.devDependencies);
+		const peerDeps = toVersionMap(importer.peerDependencies);
+		const optDeps = toVersionMap(importer.optionalDependencies);
+		workspaceEntries.set(importerPath, {
+			...deps ? { dependencies: deps } : {},
+			...devDeps ? { devDependencies: devDeps } : {},
+			...peerDeps ? { peerDependencies: peerDeps } : {},
+			...optDeps ? { optionalDependencies: optDeps } : {}
+		});
+		for (const group of importerDepGroups(importer)) {
+			if (!group) continue;
+			for (const [name, info] of Object.entries(group)) if (name !== "" && info.version.startsWith("link:")) workspaceNames.add(name);
+		}
+	}
+	for (const path of Object.keys(raw.importers)) if (path !== "." && path !== "") workspaceNames.add(path);
+	const packages = [];
+	for (const importerPath of Object.keys(raw.importers)) {
+		if (importerPath === "." || importerPath === "") continue;
+		packages.push(ResolvedPackage.make({
+			name: importerPath,
+			version: "0.0.0",
+			isWorkspace: true,
+			relativePath: importerPath
+		}));
+	}
+	if (raw.packages) for (const [key, pkg] of Object.entries(raw.packages)) {
+		const { plain: bare } = splitPeerSuffix(key);
+		const atIndex = bare.lastIndexOf("@");
+		if (atIndex <= 0) continue;
+		const name = bare.slice(0, atIndex);
+		const version = bare.slice(atIndex + 1);
+		const integrity = yield* toIntegrityHash(pkg.resolution?.integrity);
+		packages.push(ResolvedPackage.make({
+			name,
+			version,
+			...integrity !== void 0 ? { integrity } : {},
+			isWorkspace: false
+		}));
+	}
+	const workspaceDependencies = extractWorkspaceDeps(workspaceEntries, workspaceNames);
+	const extension = PnpmExtension.make({
+		...raw.catalogs !== void 0 ? { catalogs: raw.catalogs } : {},
+		...raw.overrides !== void 0 ? { overrides: raw.overrides } : {},
+		...raw.settings !== void 0 ? { settings: raw.settings } : {}
+	});
+	return {
+		lockfileVersion: String(raw.lockfileVersion),
+		packages,
+		workspaceDependencies,
+		importers,
+		extension
+	};
+});
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/internal/yarn.js
+const YarnLockfileRaw = Schema.Record(Schema.String, Schema.Unknown);
+const DepRecord = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
+const YarnEntry = Schema.Struct({
+	version: Schema.optionalKey(Schema.String),
+	resolution: Schema.optionalKey(Schema.String),
+	dependencies: DepRecord,
+	devDependencies: DepRecord,
+	peerDependencies: DepRecord,
+	optionalDependencies: DepRecord,
+	checksum: Schema.optionalKey(Schema.String),
+	languageName: Schema.optionalKey(Schema.String),
+	linkType: Schema.optionalKey(Schema.String),
+	bin: Schema.optionalKey(Schema.Unknown)
+});
+const YarnMetadata = Schema.Struct({ version: Schema.optionalKey(Schema.Union([Schema.String, Schema.Number])) });
+/**
+* Parse yarn Berry `yarn.lock` content into the unified field bundle.
+*
+* Yarn Berry lockfiles are YAML with a flat key structure where each key
+* encodes package name + resolution descriptor(s) (e.g.
+* `"@scope/name@npm:^1.0.0"`); workspace entries carry `linkType: "soft"`.
+*
+* @internal
+*/
+const parseYarn = (content) => Effect.gen(function* () {
+	const { document } = yield* selectSoleDocument(content);
+	const raw = yield* Schema.decodeUnknownEffect(YarnLockfileRaw)(document).pipe(Effect.mapError(validationFailure));
+	const metadata = raw.__metadata === void 0 ? void 0 : yield* Schema.decodeUnknownEffect(YarnMetadata)(raw.__metadata).pipe(Effect.mapError(validationFailure));
+	const lockfileVersion = metadata?.version === void 0 ? "unknown" : String(metadata.version);
+	const decoded = /* @__PURE__ */ new Map();
+	for (const [key, value] of Object.entries(raw)) {
+		if (key === "__metadata") continue;
+		const entry = yield* Schema.decodeUnknownEffect(YarnEntry)(value).pipe(Effect.mapError(validationFailure));
+		decoded.set(key, entry);
+	}
+	return yield* toFields(lockfileVersion, decoded);
+});
+const toFields = (lockfileVersion, decoded) => Effect.gen(function* () {
+	const packages = [];
+	const workspaceNames = /* @__PURE__ */ new Set();
+	const workspaceEntries = /* @__PURE__ */ new Map();
+	for (const [key, entry] of decoded) if (entry.linkType === "soft") {
+		const name = extractYarnPackageName(key);
+		if (name !== void 0) workspaceNames.add(name);
+	}
+	for (const [key, entry] of decoded) {
+		const name = extractYarnPackageName(key);
+		if (name === void 0) continue;
+		const isWorkspace = entry.linkType === "soft";
+		const relativePath = isWorkspace ? extractYarnWorkspacePath(key) : void 0;
+		const integrity = yield* toIntegrityHash(entry.checksum);
+		packages.push(ResolvedPackage.make({
+			name,
+			version: entry.version ?? "0.0.0",
+			...integrity !== void 0 ? { integrity } : {},
+			isWorkspace,
+			...relativePath !== void 0 ? { relativePath } : {}
+		}));
+		if (isWorkspace) {
+			const deps = cleanYarnDeps(entry.dependencies);
+			const devDeps = cleanYarnDeps(entry.devDependencies);
+			const peerDeps = cleanYarnDeps(entry.peerDependencies);
+			const optDeps = cleanYarnDeps(entry.optionalDependencies);
+			workspaceEntries.set(name, {
+				...deps ? { dependencies: deps } : {},
+				...devDeps ? { devDependencies: devDeps } : {},
+				...peerDeps ? { peerDependencies: peerDeps } : {},
+				...optDeps ? { optionalDependencies: optDeps } : {}
+			});
+		}
+	}
+	return {
+		lockfileVersion,
+		packages,
+		workspaceDependencies: extractWorkspaceDeps(workspaceEntries, workspaceNames),
+		importers: []
+	};
+});
+/**
+* Extract the package name from a yarn lockfile key. Handles compound keys
+* (`"a@workspace:*, a@workspace:packages/a"`) via the first descriptor and
+* `@patch:` descriptors (which embed `@npm:` inside). Total: malformed keys
+* yield `undefined`.
+*
+* @internal
+*/
+const extractYarnPackageName = (key) => {
+	const commaIdx = key.indexOf(", ");
+	const descriptor = commaIdx === -1 ? key : key.slice(0, commaIdx);
+	const patchIdx = descriptor.indexOf("@patch:");
+	if (patchIdx > 0) return descriptor.slice(0, patchIdx);
+	const npmIdx = descriptor.lastIndexOf("@npm:");
+	const wsIdx = descriptor.lastIndexOf("@workspace:");
+	const idx = Math.max(npmIdx, wsIdx);
+	if (idx <= 0) return void 0;
+	return descriptor.slice(0, idx);
+};
+/**
+* Extract the workspace-relative path from a yarn lockfile key: the segment
+* after `@workspace:` in the first descriptor carrying a non-`*` path.
+*
+* @internal
+*/
+const extractYarnWorkspacePath = (key) => {
+	for (const desc of key.split(", ")) {
+		const wsIdx = desc.lastIndexOf("@workspace:");
+		if (wsIdx >= 0) {
+			const path = desc.slice(wsIdx + 11);
+			if (path !== "" && path !== "*") return path;
+		}
+	}
+};
+/**
+* Strip the `"npm:"` prefix from yarn dependency specifiers.
+*
+* @internal
+*/
+const cleanYarnDeps = (deps) => {
+	if (!deps) return void 0;
+	return Object.fromEntries(Object.entries(deps).map(([name, value]) => [name, value.startsWith("npm:") ? value.slice(4) : value]));
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/Lockfile.js
+const EMPTY_IMPORTERS = [];
+/**
+* Failure of `Lockfile.parse`: the given content is not a valid lockfile of
+* the requested format.
+*
+* @remarks
+* - `format` — which format was being parsed.
+* - `stage` — `"syntax"` when the text itself failed to parse (YAML, JSON,
+*   JSONC), `"validation"` when the text parsed but did not have the
+*   format's expected shape.
+* - `cause` — the underlying jsonc/yaml/JSON/Schema error, preserved
+*   structurally.
+*
+* Malformed input always exits through this typed failure, never as a
+* defect. Parse takes content, not a path — the caller that did the IO owns
+* any path context.
+*
+* @public
+*/
+var LockfileParseError = class extends Schema.TaggedErrorClass()("LockfileParseError", {
+	format: LockfileFormat,
+	stage: Schema.Literals(["syntax", "validation"]),
+	cause: Schema.Defect()
+}) {
+	get message() {
+		return this.stage === "syntax" ? `Failed to parse ${this.format} lockfile: the content is not well-formed` : `Failed to parse ${this.format} lockfile: the content does not have the expected ${this.format} shape`;
+	}
+};
+/**
+* Failure of `Lockfile.parse`: the content parsed as text, but no single
+* lockfile document could be located in it.
 *
-* `pnpm-lock.yaml` is a YAML *stream*, not a single document: a workspace
-* using `configDependencies` gets a config-dependencies preamble document
-* ahead of the lockfile. {@link selectPnpmDocument} locates the lockfile
-* deterministically (it is the last document); a stream carrying no lockfile
-* document fails through the typed framing channel rather than silently
-* reporting the preamble as an empty workspace.
+* @remarks
+* `pnpm-lock.yaml` is a YAML **stream**. pnpm 11 writes a
+* config-dependencies preamble document ahead of the lockfile whenever the
+* workspace uses `configDependencies`, so the file holds two documents. The
+* lockfile is the last one — pnpm composes the preamble as a prefix — and a
+* parser that reads only the first document gets the preamble: a document
+* that *validates*, and yields a lockfile with an empty workspace. This error
+* exists so that case can never again succeed quietly.
 *
-* Workspace packages are keyed by importer *path* with version `"0.0.0"`;
-* `Lockfile#withImporterNames` is the explicit second stage that rewrites
-* them to real names.
+* - `format` — which format was being parsed.
+* - `documents` — how many YAML documents the stream carried.
+* - `reason`:
+*   - `"noLockfileDocument"` — the stream carries no lockfile document. An
+*     env-only `pnpm-lock.yaml` (a config-dependencies preamble and nothing
+*     after it) reads this way, as does empty content. pnpm itself treats
+*     such a file as having no lockfile.
+*   - `"noImporters"` — the located document declares no importers, so it
+*     describes no workspace. pnpm always records at least the root importer.
+*   - `"unexpectedDocuments"` — the stream carries several documents in a
+*     format that defines no document framing (yarn). Rather than silently
+*     taking the first, parsing refuses to guess.
 *
-* @internal
+* It carries typed fields rather than a `cause`: unlike
+* {@link LockfileParseError}, there is no underlying engine failure to wrap —
+* the text parsed fine.
+*
+* @public
 */
-const parsePnpm = (content) => Effect.gen(function* () {
-	const { document, documents } = yield* selectPnpmDocument(content);
-	const validated = yield* Schema.decodeUnknownEffect(PnpmLockfileRaw)(document).pipe(Effect.mapError(validationFailure));
-	if (Object.keys(validated.importers).length === 0) return yield* Effect.fail(framingFailure("noImporters", documents));
-	return yield* toFields$1(validated);
-});
-const toVersionMap = (deps) => {
-	if (!deps) return void 0;
-	return Object.fromEntries(Object.entries(deps).map(([name, info]) => [name, info.specifier]));
+var LockfileFramingError = class extends Schema.TaggedErrorClass()("LockfileFramingError", {
+	format: LockfileFormat,
+	reason: Schema.Literals([
+		"noLockfileDocument",
+		"noImporters",
+		"unexpectedDocuments"
+	]),
+	documents: Schema.Int
+}) {
+	get message() {
+		const detail = this.reason === "noImporters" ? "the lockfile document declares no importers, so it describes no workspace" : this.reason === "unexpectedDocuments" ? `expected a single YAML document but the content carries ${this.documents}` : `the content carries no lockfile document (${this.documents} YAML document(s) found)`;
+		return `Failed to parse ${this.format} lockfile: ${detail}`;
+	}
 };
-const importerDepGroups = (importer) => [
-	importer.dependencies,
-	importer.devDependencies,
-	importer.peerDependencies,
-	importer.optionalDependencies
-];
-const toFields$1 = (raw) => Effect.gen(function* () {
-	const workspaceEntries = /* @__PURE__ */ new Map();
-	const workspaceNames = /* @__PURE__ */ new Set();
-	const importers = [];
-	for (const [importerPath, importer] of Object.entries(raw.importers)) {
-		if (importerPath === "") continue;
-		importers.push(LockfileImporter.make({
-			path: importerPath,
-			dependencies: importerDependencies(importer, (info) => ({
-				specifier: info.specifier,
-				version: info.version
-			}))
-		}));
-		const deps = toVersionMap(importer.dependencies);
-		const devDeps = toVersionMap(importer.devDependencies);
-		const peerDeps = toVersionMap(importer.peerDependencies);
-		const optDeps = toVersionMap(importer.optionalDependencies);
-		workspaceEntries.set(importerPath, {
-			...deps ? { dependencies: deps } : {},
-			...devDeps ? { devDependencies: devDeps } : {},
-			...peerDeps ? { peerDependencies: peerDeps } : {},
-			...optDeps ? { optionalDependencies: optDeps } : {}
+const dispatch = (format, content) => {
+	switch (format) {
+		case "bun": return parseBun(content);
+		case "npm": return parseNpm(content);
+		case "pnpm": return parsePnpm(content);
+		case "yarn": return parseYarn(content);
+	}
+};
+/**
+* The unified lockfile model all four formats normalize into.
+*
+* @remarks
+* - `format` — which lockfile format produced the data.
+* - `lockfileVersion` — the lockfile format version string.
+* - `packages` — every resolved package.
+* - `workspaceDependencies` — inter-workspace dependency edges.
+* - `importers` — each workspace importer's declared dependencies
+*   ({@link LockfileImporter}), keyed by importer path. Populated by the pnpm,
+*   bun and npm parsers; always empty for yarn, which records no importers.
+* - `extension` — format-specific residue (`PnpmExtension` or
+*   `BunExtension`) when the format records any.
+*
+* For pnpm, `Lockfile.parse` emits the honest importer-path-keyed model
+* (workspace packages named by importer path, version `"0.0.0"`);
+* {@link Lockfile.withImporterNames} is the explicit, pure second stage
+* that rewrites those names once the caller has read the workspace
+* manifests. npm, yarn and bun lockfiles carry real names and need no
+* second stage.
+*
+* @public
+*/
+var Lockfile = class Lockfile extends Schema.Class("Lockfile")({
+	format: LockfileFormat,
+	lockfileVersion: Schema.String,
+	packages: Schema.Array(ResolvedPackage),
+	workspaceDependencies: Schema.Array(WorkspaceDependency),
+	importers: Schema.Array(LockfileImporter).pipe(Schema.withDecodingDefaultKey(Effect.succeed([])), Schema.withConstructorDefault(Effect.succeed(EMPTY_IMPORTERS))),
+	extension: Schema.optionalKey(Schema.Union([PnpmExtension, BunExtension]))
+}) {
+	/** Lazily built name → packages index; deliberately outside the schema, never encodes. */
+	#nameIndex;
+	/** Lazily built importer-path → importer index; deliberately outside the schema, never encodes. */
+	#importerIndex;
+	/**
+	* Parse lockfile content of a known format into the unified model — the
+	* package's only fallible boundary.
+	*
+	* @param content - The lockfile text (this package does no IO; the caller
+	*   reads the file).
+	* @param options - The lockfile format to parse as.
+	* @returns An `Effect` succeeding with the {@link Lockfile}, or failing
+	*   with {@link LockfileParseError} (malformed text or the wrong shape) or
+	*   {@link LockfileFramingError} (the text parsed, but no lockfile document
+	*   could be located in the stream — see that error for why a
+	*   multi-document `pnpm-lock.yaml` needs it).
+	*/
+	static parse = Effect.fn("Lockfile.parse")(function* (content, options) {
+		const fields = yield* dispatch(options.format, content).pipe(Effect.mapError((failure) => failure.stage === "framing" ? new LockfileFramingError({
+			format: options.format,
+			reason: failure.reason,
+			documents: failure.documents
+		}) : new LockfileParseError({
+			format: options.format,
+			stage: failure.stage,
+			cause: failure.cause
+		})));
+		return Lockfile.make({
+			format: options.format,
+			lockfileVersion: fields.lockfileVersion,
+			packages: fields.packages,
+			workspaceDependencies: fields.workspaceDependencies,
+			importers: fields.importers,
+			...fields.extension !== void 0 ? { extension: fields.extension } : {}
 		});
-		for (const group of importerDepGroups(importer)) {
-			if (!group) continue;
-			for (const [name, info] of Object.entries(group)) if (name !== "" && info.version.startsWith("link:")) workspaceNames.add(name);
+	});
+	/**
+	* Rewrite pnpm importer-path names to real package names — the explicit
+	* second stage of pnpm parsing. Total and pure.
+	*
+	* @remarks
+	* Workspace packages whose `relativePath` appears in `names` are renamed;
+	* dependency edge ends are rewritten through the same map. Entries not in
+	* the map keep their path name, and non-pnpm lockfiles are unaffected (no
+	* key matches). Versions are not touched — pnpm workspace packages keep
+	* `"0.0.0"` (the lockfile does not record their real versions).
+	*
+	* @param names - Importer path → real package name.
+	* @returns A new {@link Lockfile} with names rewritten.
+	*/
+	withImporterNames(names) {
+		const packages = this.packages.map((pkg) => {
+			if (!pkg.isWorkspace || pkg.relativePath === void 0) return pkg;
+			const realName = names.get(pkg.relativePath);
+			if (realName === void 0 || realName === "" || realName === pkg.name) return pkg;
+			return ResolvedPackage.make({
+				name: realName,
+				version: pkg.version,
+				...pkg.integrity !== void 0 ? { integrity: pkg.integrity } : {},
+				isWorkspace: pkg.isWorkspace,
+				relativePath: pkg.relativePath,
+				dependencies: pkg.dependencies
+			});
+		});
+		const workspaceDependencies = this.workspaceDependencies.map((dep) => {
+			const mappedFrom = names.get(dep.from);
+			const mappedTo = names.get(dep.to);
+			const from = mappedFrom === void 0 || mappedFrom === "" ? dep.from : mappedFrom;
+			const to = mappedTo === void 0 || mappedTo === "" ? dep.to : mappedTo;
+			if (from === dep.from && to === dep.to) return dep;
+			return WorkspaceDependency.make({
+				from,
+				to,
+				depType: dep.depType,
+				constraint: dep.constraint
+			});
+		});
+		return Lockfile.make({
+			format: this.format,
+			lockfileVersion: this.lockfileVersion,
+			packages,
+			workspaceDependencies,
+			importers: this.importers,
+			...this.extension !== void 0 ? { extension: this.extension } : {}
+		});
+	}
+	/**
+	* Every resolved package with the given name — one entry per resolved
+	* version. Backed by a lazily built index, so repeated lookups are O(1).
+	*
+	* @param name - The package name to look up.
+	* @returns The matching packages, empty when the name is not in the
+	*   lockfile.
+	*/
+	packagesNamed(name) {
+		if (this.#nameIndex === void 0) {
+			const index = /* @__PURE__ */ new Map();
+			for (const pkg of this.packages) {
+				const bucket = index.get(pkg.name);
+				if (bucket === void 0) index.set(pkg.name, [pkg]);
+				else bucket.push(pkg);
+			}
+			this.#nameIndex = index;
 		}
+		return this.#nameIndex.get(name) ?? [];
 	}
-	for (const path of Object.keys(raw.importers)) if (path !== "." && path !== "") workspaceNames.add(path);
-	const packages = [];
-	for (const importerPath of Object.keys(raw.importers)) {
-		if (importerPath === "." || importerPath === "") continue;
-		packages.push(ResolvedPackage.make({
-			name: importerPath,
-			version: "0.0.0",
-			isWorkspace: true,
-			relativePath: importerPath
-		}));
+	/**
+	* The importer at the given path — `"."` for the workspace root — or
+	* `Option.none()` when the lockfile records no importer there. Backed by a
+	* lazily built index, so repeated lookups are O(1). The index is a `Map`,
+	* so an attacker-adjacent path (`__proto__`, `constructor`) neither pollutes
+	* nor collides.
+	*
+	* @param path - The importer path to look up.
+	* @returns The matching {@link LockfileImporter}, or `Option.none()`.
+	*/
+	importer(path) {
+		if (this.#importerIndex === void 0) {
+			const index = /* @__PURE__ */ new Map();
+			for (const imp of this.importers) index.set(imp.path, imp);
+			this.#importerIndex = index;
+		}
+		return Option.fromUndefinedOr(this.#importerIndex.get(path));
 	}
-	if (raw.packages) for (const [key, pkg] of Object.entries(raw.packages)) {
-		const { plain: bare } = splitPeerSuffix(key);
-		const atIndex = bare.lastIndexOf("@");
-		if (atIndex <= 0) continue;
-		const name = bare.slice(0, atIndex);
-		const version = bare.slice(atIndex + 1);
-		const integrity = yield* toIntegrityHash(pkg.resolution?.integrity);
-		packages.push(ResolvedPackage.make({
-			name,
-			version,
-			...integrity !== void 0 ? { integrity } : {},
-			isWorkspace: false
-		}));
+	/** The workspace-local packages. */
+	get workspacePackages() {
+		return this.packages.filter((pkg) => pkg.isWorkspace);
 	}
-	const workspaceDependencies = extractWorkspaceDeps(workspaceEntries, workspaceNames);
-	const extension = PnpmExtension.make({
-		...raw.catalogs !== void 0 ? { catalogs: raw.catalogs } : {},
-		...raw.overrides !== void 0 ? { overrides: raw.overrides } : {},
-		...raw.settings !== void 0 ? { settings: raw.settings } : {}
-	});
-	return {
-		lockfileVersion: String(raw.lockfileVersion),
-		packages,
-		workspaceDependencies,
-		importers,
-		extension
-	};
-});
+};
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/internal/yarn.js
-const YarnLockfileRaw = Schema.Record(Schema.String, Schema.Unknown);
-const DepRecord = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
-const YarnEntry = Schema.Struct({
-	version: Schema.optionalKey(Schema.String),
-	resolution: Schema.optionalKey(Schema.String),
-	dependencies: DepRecord,
-	devDependencies: DepRecord,
-	peerDependencies: DepRecord,
-	optionalDependencies: DepRecord,
-	checksum: Schema.optionalKey(Schema.String),
-	languageName: Schema.optionalKey(Schema.String),
-	linkType: Schema.optionalKey(Schema.String),
-	bin: Schema.optionalKey(Schema.Unknown)
-});
-const YarnMetadata = Schema.Struct({ version: Schema.optionalKey(Schema.Union([Schema.String, Schema.Number])) });
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/LockfileIntegrity.js
 /**
-* Parse yarn Berry `yarn.lock` content into the unified field bundle.
+* The minimal manifest shape {@link LockfileIntegrity.compare} checks a
+* lockfile against: a package name plus the four optional dependency maps.
 *
-* Yarn Berry lockfiles are YAML with a flat key structure where each key
-* encodes package name + resolution descriptor(s) (e.g.
-* `"@scope/name@npm:^1.0.0"`); workspace entries carry `linkType: "soft"`.
+* @remarks
+* Deliberately *not* a `@effected/package-json` type — this package takes
+* manifests as plain values so its consumers own the manifest IO (and may
+* derive these from any richer model).
 *
-* @internal
+* @public
 */
-const parseYarn = (content) => Effect.gen(function* () {
-	const { document } = yield* selectSoleDocument(content);
-	const raw = yield* Schema.decodeUnknownEffect(YarnLockfileRaw)(document).pipe(Effect.mapError(validationFailure));
-	const metadata = raw.__metadata === void 0 ? void 0 : yield* Schema.decodeUnknownEffect(YarnMetadata)(raw.__metadata).pipe(Effect.mapError(validationFailure));
-	const lockfileVersion = metadata?.version === void 0 ? "unknown" : String(metadata.version);
-	const decoded = /* @__PURE__ */ new Map();
-	for (const [key, value] of Object.entries(raw)) {
-		if (key === "__metadata") continue;
-		const entry = yield* Schema.decodeUnknownEffect(YarnEntry)(value).pipe(Effect.mapError(validationFailure));
-		decoded.set(key, entry);
-	}
-	return yield* toFields(lockfileVersion, decoded);
-});
-const toFields = (lockfileVersion, decoded) => Effect.gen(function* () {
-	const packages = [];
-	const workspaceNames = /* @__PURE__ */ new Set();
-	const workspaceEntries = /* @__PURE__ */ new Map();
-	for (const [key, entry] of decoded) if (entry.linkType === "soft") {
-		const name = extractYarnPackageName(key);
-		if (name !== void 0) workspaceNames.add(name);
-	}
-	for (const [key, entry] of decoded) {
-		const name = extractYarnPackageName(key);
-		if (name === void 0) continue;
-		const isWorkspace = entry.linkType === "soft";
-		const relativePath = isWorkspace ? extractYarnWorkspacePath(key) : void 0;
-		const integrity = yield* toIntegrityHash(entry.checksum);
-		packages.push(ResolvedPackage.make({
-			name,
-			version: entry.version ?? "0.0.0",
-			...integrity !== void 0 ? { integrity } : {},
-			isWorkspace,
-			...relativePath !== void 0 ? { relativePath } : {}
-		}));
-		if (isWorkspace) {
-			const deps = cleanYarnDeps(entry.dependencies);
-			const devDeps = cleanYarnDeps(entry.devDependencies);
-			const peerDeps = cleanYarnDeps(entry.peerDependencies);
-			const optDeps = cleanYarnDeps(entry.optionalDependencies);
-			workspaceEntries.set(name, {
-				...deps ? { dependencies: deps } : {},
-				...devDeps ? { devDependencies: devDeps } : {},
-				...peerDeps ? { peerDependencies: peerDeps } : {},
-				...optDeps ? { optionalDependencies: optDeps } : {}
-			});
+var WorkspaceManifest = class extends Schema.Class("WorkspaceManifest")({
+	name: Schema.NonEmptyString,
+	dependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	devDependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	peerDependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	optionalDependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String))
+}) {};
+const decodeRange = Schema.decodeUnknownExit(Range$1.FromString);
+const decodeSemVer = Schema.decodeUnknownExit(SemVer.FromString);
+/**
+* Result of checking a parsed lockfile against the workspace's declared
+* manifests.
+*
+* @remarks
+* A data type, not an error: it reports *what* mismatches exist without
+* failing anything.
+*
+* - `valid` — `true` when the lockfile is fully consistent.
+* - `missingWorkspaces` — workspace names present in the manifests but
+*   absent from the lockfile.
+* - `extraWorkspaces` — workspace names in the lockfile with no matching
+*   manifest.
+* - `unsatisfiedConstraints` — declared constraints the lockfile's resolved
+*   versions do not satisfy.
+*
+* @public
+*/
+var LockfileIntegrity = class LockfileIntegrity extends Schema.Class("LockfileIntegrity")({
+	valid: Schema.Boolean,
+	missingWorkspaces: Schema.Array(Schema.String),
+	extraWorkspaces: Schema.Array(Schema.String),
+	unsatisfiedConstraints: Schema.Array(Schema.Struct({
+		workspace: Schema.String,
+		dependency: Schema.String,
+		constraint: Schema.String,
+		resolved: Schema.String,
+		depType: DependencyField$1
+	}))
+}) {
+	/**
+	* Check a lockfile's consistency against workspace manifests — a total,
+	* pure function: no Effect, no error channel, no IO.
+	*
+	* @remarks
+	* Constraint checking is best-effort by design: `workspace:` / `link:` /
+	* `file:` specifiers and rows whose range (or every resolved version) does
+	* not parse as SemVer are skipped, exactly as in the v3 implementation.
+	* A lockfile may resolve the same package at several versions; a
+	* constraint is satisfied when *any* resolved version matches, and an
+	* unsatisfied row reports every candidate in `resolved`. The
+	* caller reads the manifests (this package does no IO). For pnpm, apply
+	* `Lockfile#withImporterNames` first so workspace names align with
+	* manifest names.
+	*
+	* (Named `compare`, not `check`: every v4 `Schema.Class` already carries
+	* a `static check(...checks)` for attaching schema checks, and statics
+	* cannot be shadowed with an incompatible signature.)
+	*
+	* @param lockfile - The parsed lockfile.
+	* @param manifests - The workspace manifests to compare against.
+	* @returns The integrity report.
+	*/
+	static compare(lockfile, manifests) {
+		const workspacePackages = lockfile.packages.filter((p) => p.isWorkspace && p.relativePath !== void 0);
+		const lockfileWsNames = new Set(workspacePackages.map((p) => p.name));
+		const manifestNames = new Set(manifests.map((m) => m.name));
+		const missingWorkspaces = [...manifestNames].filter((n) => !lockfileWsNames.has(n));
+		const extraWorkspaces = [...lockfileWsNames].filter((n) => !manifestNames.has(n));
+		const resolvedIndex = /* @__PURE__ */ new Map();
+		for (const p of lockfile.packages) {
+			const versions = resolvedIndex.get(p.name);
+			if (versions === void 0) resolvedIndex.set(p.name, [p.version]);
+			else versions.push(p.version);
+		}
+		const unsatisfiedConstraints = [];
+		for (const manifest of manifests) for (const depType of DEP_TYPES) {
+			const depMap = manifest[depType];
+			if (!depMap) continue;
+			for (const [dependency, constraint] of Object.entries(depMap)) {
+				if (isWorkspaceSpecifier(constraint)) continue;
+				const candidates = resolvedIndex.get(dependency);
+				if (candidates === void 0) continue;
+				const rangeExit = decodeRange(constraint);
+				if (Exit.isFailure(rangeExit)) continue;
+				const versions = candidates.map((candidate) => decodeSemVer(candidate)).filter(Exit.isSuccess);
+				if (versions.length === 0) continue;
+				if (!versions.some((v) => rangeExit.value.test(v.value))) unsatisfiedConstraints.push({
+					workspace: manifest.name,
+					dependency,
+					constraint,
+					resolved: candidates.join(", "),
+					depType
+				});
+			}
 		}
+		return LockfileIntegrity.make({
+			valid: missingWorkspaces.length === 0 && extraWorkspaces.length === 0 && unsatisfiedConstraints.length === 0,
+			missingWorkspaces,
+			extraWorkspaces,
+			unsatisfiedConstraints
+		});
 	}
-	return {
-		lockfileVersion,
-		packages,
-		workspaceDependencies: extractWorkspaceDeps(workspaceEntries, workspaceNames),
-		importers: []
-	};
-});
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/CatalogResolver.js
 /**
-* Extract the package name from a yarn lockfile key. Handles compound keys
-* (`"a@workspace:*, a@workspace:packages/a"`) via the first descriptor and
-* `@patch:` descriptors (which embed `@npm:` inside). Total: malformed keys
-* yield `undefined`.
+* Contract for resolving pnpm `catalog:` dependency specifiers to concrete
+* version ranges.
+*
+* `rangeOf` takes a package name and an optional catalog name
+* (`Option.none()` selects the default catalog) and returns the configured
+* range as `Option.some`, or `Option.none()` when the specifier is absent
+* from the catalog. By convention the error channel is reserved for a
+* failure in the resolution mechanism itself — an unmatched package or
+* catalog name is an `Option.none()` success, never an error. A failure to
+* *assemble* the catalogs (an unreadable or malformed catalog source)
+* surfaces typed as a {@link CatalogAssemblyError}; any other mechanism
+* failure is a {@link DependencyResolutionError}.
+*
+* This is a contract-only service: {@link CatalogResolver.noop} is the sole
+* implementation this package ships, and it resolves nothing. Real consumers
+* (e.g. `@effected/workspaces`) provide a working implementation at the
+* application boundary.
+*
+* @example
+* ```ts
+* import { Effect, Option } from "effect";
+* import { CatalogResolver } from "@effected/npm";
+*
+* const program = Effect.gen(function* () {
+*   const resolver = yield* CatalogResolver;
+*   return yield* resolver.rangeOf("effect", Option.none());
+* });
+*
+* Effect.runPromise(Effect.provide(program, CatalogResolver.noop));
+* // => Option.none()
+* ```
 *
-* @internal
+* @public
 */
-const extractYarnPackageName = (key) => {
-	const commaIdx = key.indexOf(", ");
-	const descriptor = commaIdx === -1 ? key : key.slice(0, commaIdx);
-	const patchIdx = descriptor.indexOf("@patch:");
-	if (patchIdx > 0) return descriptor.slice(0, patchIdx);
-	const npmIdx = descriptor.lastIndexOf("@npm:");
-	const wsIdx = descriptor.lastIndexOf("@workspace:");
-	const idx = Math.max(npmIdx, wsIdx);
-	if (idx <= 0) return void 0;
-	return descriptor.slice(0, idx);
+var CatalogResolver = class CatalogResolver extends Context.Service()("@effected/npm/CatalogResolver") {
+	/**
+	* No-op default: `rangeOf` always succeeds with `Option.none()`, never
+	* consulting an actual catalog. A pure `Layer.succeed`, bound to a const
+	* so it memoizes by reference — the layer is built once, not once per
+	* reference to `CatalogResolver.noop`.
+	*/
+	static noop = Layer.succeed(CatalogResolver, { rangeOf: () => Effect.succeed(Option.none()) });
 };
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/WorkspaceResolver.js
 /**
-* Extract the workspace-relative path from a yarn lockfile key: the segment
-* after `@workspace:` in the first descriptor carrying a non-`*` path.
+* Raised when a `catalog:` or `workspace:` specifier cannot be resolved
+* because the resolution mechanism itself failed — not for an ordinary
+* unmatched specifier, which resolves to `Option.none()` instead. Both
+* {@link CatalogResolver} and {@link WorkspaceResolver} fail with it.
 *
-* @internal
+* `cause` preserves the originating failure on a structured `Schema.Defect`
+* field rather than folding it into a string, so callers can branch on the
+* original value (an `Error`, a parsed diagnostic, anything); `specifier`
+* records the specifier string that failed to resolve.
+*
+* @public
 */
-const extractYarnWorkspacePath = (key) => {
-	for (const desc of key.split(", ")) {
-		const wsIdx = desc.lastIndexOf("@workspace:");
-		if (wsIdx >= 0) {
-			const path = desc.slice(wsIdx + 11);
-			if (path !== "" && path !== "*") return path;
-		}
+var DependencyResolutionError = class extends Schema.TaggedErrorClass()("DependencyResolutionError", {
+	specifier: Schema.String,
+	cause: Schema.Defect()
+}) {
+	/** Renders `specifier` into a one-line failure message. */
+	get message() {
+		return `Failed to resolve dependency specifier "${this.specifier}"`;
 	}
 };
 /**
-* Strip the `"npm:"` prefix from yarn dependency specifiers.
+* Contract for resolving pnpm `workspace:` dependency specifiers to concrete
+* versions.
 *
-* @internal
+* `versionOf` takes a workspace package name and returns its concrete
+* version (the range modifier stripped) as `Option.some`, or
+* `Option.none()` when the name is not a known workspace member.
+*
+* This is a contract-only service: {@link WorkspaceResolver.noop} is the
+* sole implementation this package ships, and it resolves nothing. Real
+* consumers (e.g. `@effected/workspaces`) provide a working implementation
+* at the application boundary.
+*
+* @example
+* ```ts
+* import { Effect } from "effect";
+* import { WorkspaceResolver } from "@effected/npm";
+*
+* const program = Effect.gen(function* () {
+*   const resolver = yield* WorkspaceResolver;
+*   return yield* resolver.versionOf("@effected/semver");
+* });
+*
+* Effect.runPromise(Effect.provide(program, WorkspaceResolver.noop));
+* // => Option.none()
+* ```
+*
+* @public
 */
-const cleanYarnDeps = (deps) => {
-	if (!deps) return void 0;
-	return Object.fromEntries(Object.entries(deps).map(([name, value]) => [name, value.startsWith("npm:") ? value.slice(4) : value]));
+var WorkspaceResolver = class WorkspaceResolver extends Context.Service()("@effected/npm/WorkspaceResolver") {
+	/**
+	* No-op default: `versionOf` always succeeds with `Option.none()`, never
+	* consulting an actual workspace. A pure `Layer.succeed`, bound to a
+	* const so it memoizes by reference.
+	*/
+	static noop = Layer.succeed(WorkspaceResolver, { versionOf: () => Effect.succeed(Option.none()) });
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/Lockfile.js
-const EMPTY_IMPORTERS = [];
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/DependencySection.js
 /**
-* Failure of `Lockfile.parse`: the given content is not a valid lockfile of
-* the requested format.
-*
-* @remarks
-* - `format` — which format was being parsed.
-* - `stage` — `"syntax"` when the text itself failed to parse (YAML, JSON,
-*   JSONC), `"validation"` when the text parsed but did not have the
-*   format's expected shape.
-* - `cause` — the underlying jsonc/yaml/JSON/Schema error, preserved
-*   structurally.
+* The short dependency kind: which dependency map an entry came from, named the
+* way consumers branch on it.
 *
-* Malformed input always exits through this typed failure, never as a
-* defect. Parse takes content, not a path — the caller that did the IO owns
-* any path context.
+* @public
+*/
+const DependencyKind = Schema.Literals([
+	"prod",
+	"dev",
+	"peer",
+	"optional"
+]);
+/**
+* The manifest field name a dependency is declared under, matching the
+* `package.json` / `package-lock.json` key exactly.
 *
 * @public
 */
-var LockfileParseError = class extends Schema.TaggedErrorClass()("LockfileParseError", {
-	format: LockfileFormat,
-	stage: Schema.Literals(["syntax", "validation"]),
-	cause: Schema.Defect()
-}) {
-	get message() {
-		return this.stage === "syntax" ? `Failed to parse ${this.format} lockfile: the content is not well-formed` : `Failed to parse ${this.format} lockfile: the content does not have the expected ${this.format} shape`;
-	}
+const DependencyField = Schema.Literals([
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
+]);
+const KIND_TO_FIELD = {
+	prod: "dependencies",
+	dev: "devDependencies",
+	peer: "peerDependencies",
+	optional: "optionalDependencies"
 };
+const FIELD_TO_KIND = Object.fromEntries(Object.entries(KIND_TO_FIELD).map(([kind, field]) => [field, kind]));
+
+//#endregion
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/DependencySpecifier.js
 /**
-* Failure of `Lockfile.parse`: the content parsed as text, but no single
-* lockfile document could be located in it.
-*
-* @remarks
-* `pnpm-lock.yaml` is a YAML **stream**. pnpm 11 writes a
-* config-dependencies preamble document ahead of the lockfile whenever the
-* workspace uses `configDependencies`, so the file holds two documents. The
-* lockfile is the last one — pnpm composes the preamble as a prefix — and a
-* parser that reads only the first document gets the preamble: a document
-* that *validates*, and yields a lockfile with an empty workspace. This error
-* exists so that case can never again succeed quietly.
-*
-* - `format` — which format was being parsed.
-* - `documents` — how many YAML documents the stream carried.
-* - `reason`:
-*   - `"noLockfileDocument"` — the stream carries no lockfile document. An
-*     env-only `pnpm-lock.yaml` (a config-dependencies preamble and nothing
-*     after it) reads this way, as does empty content. pnpm itself treats
-*     such a file as having no lockfile.
-*   - `"noImporters"` — the located document declares no importers, so it
-*     describes no workspace. pnpm always records at least the root importer.
-*   - `"unexpectedDocuments"` — the stream carries several documents in a
-*     format that defines no document framing (yarn). Rather than silently
-*     taking the first, parsing refuses to guess.
+* Indicates that a string could not be parsed as a valid dependency specifier.
 *
-* It carries typed fields rather than a `cause`: unlike
-* {@link LockfileParseError}, there is no underlying engine failure to wrap —
-* the text parsed fine.
+* Raised by {@link DependencySpecifier.decode}. The offending string is
+* preserved on `input`.
 *
 * @public
 */
-var LockfileFramingError = class extends Schema.TaggedErrorClass()("LockfileFramingError", {
-	format: LockfileFormat,
-	reason: Schema.Literals([
-		"noLockfileDocument",
-		"noImporters",
-		"unexpectedDocuments"
-	]),
-	documents: Schema.Int
-}) {
+var InvalidDependencySpecifierError = class extends Schema.TaggedErrorClass()("InvalidDependencySpecifierError", { 
+/** The raw input string that failed validation. */
+input: Schema.String }) {
 	get message() {
-		const detail = this.reason === "noImporters" ? "the lockfile document declares no importers, so it describes no workspace" : this.reason === "unexpectedDocuments" ? `expected a single YAML document but the content carries ${this.documents}` : `the content carries no lockfile document (${this.documents} YAML document(s) found)`;
-		return `Failed to parse ${this.format} lockfile: ${detail}`;
+		return `Invalid dependency specifier "${this.input}": not a recognized specifier`;
 	}
 };
-const dispatch = (format, content) => {
-	switch (format) {
-		case "bun": return parseBun(content);
-		case "npm": return parseNpm(content);
-		case "pnpm": return parsePnpm(content);
-		case "yarn": return parseYarn(content);
-	}
+const CATALOG_PREFIX = "catalog:";
+const WORKSPACE_PREFIX = "workspace:";
+const isBarePath = (value) => value.startsWith("./") || value.startsWith("../") || value.startsWith("~/") || value.startsWith("/");
+const isGitHubShorthand = (value) => !value.startsWith(".") && !value.startsWith("~") && !value.startsWith("/") && /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+(#.*)?$/.test(value);
+const isGit = (value) => value.startsWith("git+") || value.startsWith("git://") || value.startsWith("github:") || value.startsWith("gist:") || value.startsWith("bitbucket:") || value.startsWith("gitlab:") || isGitHubShorthand(value);
+const isLocal = (value) => value.startsWith("file:") || value.startsWith("link:") || value.startsWith("portal:") || isBarePath(value);
+const isLink = (value) => value.startsWith("link:");
+const isPortal = (value) => value.startsWith("portal:");
+const isCatalog = (value) => value.startsWith(CATALOG_PREFIX);
+const isWorkspace = (value) => value.startsWith(WORKSPACE_PREFIX);
+const isUrl$1 = (value) => value.startsWith("http://") || value.startsWith("https://");
+const parseRange = (value) => {
+	const exit = Schema.decodeUnknownExit(Range$1.FromString)(value);
+	return Exit.isSuccess(exit) ? Option.some(exit.value) : Option.none();
+};
+const isRange = (value) => Option.isSome(parseRange(value));
+const protocolOf = (value) => {
+	if (value.startsWith(CATALOG_PREFIX)) return "catalog";
+	if (value.startsWith(WORKSPACE_PREFIX)) return "workspace";
+	if (value.startsWith("link:")) return "link";
+	if (value.startsWith("portal:")) return "portal";
+	if (value.startsWith("file:") || isBarePath(value)) return "file";
+	if (value.startsWith("npm:")) return "npm";
+	if (isGit(value)) return "git";
+	if (isUrl$1(value)) return "url";
+	if (isRange(value)) return "range";
+	if (/^[a-zA-Z][a-zA-Z0-9._-]*$/.test(value)) return "tag";
+	return "unknown";
+};
+const isTag = (value) => protocolOf(value) === "tag";
+const catalogNameOf$1 = (specifier) => {
+	if (!isCatalog(specifier)) return Option.none();
+	const rest = specifier.slice(8).trim();
+	return rest.length === 0 ? Option.none() : Option.some(rest);
+};
+const projectRangeModifier = (range, version) => range === "*" || range === "" ? version : range === "~" ? `~${version}` : range === "^" ? `^${version}` : range;
+const splitWorkspaceRest = (rest) => {
+	const at = rest.lastIndexOf("@");
+	return at > 0 ? {
+		target: rest.slice(0, at),
+		range: rest.slice(at + 1)
+	} : {
+		target: void 0,
+		range: rest
+	};
+};
+const projectWorkspaceRange = (rest, version) => {
+	const { target, range } = splitWorkspaceRest(rest);
+	const projected = projectRangeModifier(range, version);
+	return target === void 0 ? projected : `npm:${target}@${projected}`;
+};
+const resolveWorkspace = (specifier, version) => isWorkspace(specifier) ? projectWorkspaceRange(specifier.slice(10), version) : specifier;
+const workspaceTargetOf = (specifier) => {
+	if (!isWorkspace(specifier)) return Option.none();
+	const { target } = splitWorkspaceRest(specifier.slice(10));
+	return target === void 0 ? Option.none() : Option.some(target);
 };
 /**
-* The unified lockfile model all four formats normalize into.
-*
-* @remarks
-* - `format` — which lockfile format produced the data.
-* - `lockfileVersion` — the lockfile format version string.
-* - `packages` — every resolved package.
-* - `workspaceDependencies` — inter-workspace dependency edges.
-* - `importers` — each workspace importer's declared dependencies
-*   ({@link LockfileImporter}), keyed by importer path. Populated by the pnpm,
-*   bun and npm parsers; always empty for yarn, which records no importers.
-* - `extension` — format-specific residue (`PnpmExtension` or
-*   `BunExtension`) when the format records any.
+* Whether a string is a recognized dependency specifier: a semver range, exact
+* version, dist-tag, URL, git ref, GitHub shorthand, file path, or an
+* `npm:` / `catalog:` / `workspace:` protocol.
+*
+* @public
+*/
+const isValidDependencySpecifier = (value) => value.length > 0 && protocolOf(value) !== "unknown";
+/**
+* A `catalog:` reference. `name` carries the catalog name, or `Option.none()`
+* for the default catalog (`catalog:`).
 *
-* For pnpm, `Lockfile.parse` emits the honest importer-path-keyed model
-* (workspace packages named by importer path, version `"0.0.0"`);
-* {@link Lockfile.withImporterNames} is the explicit, pure second stage
-* that rewrites those names once the caller has read the workspace
-* manifests. npm, yarn and bun lockfiles carry real names and need no
-* second stage.
+* @public
+*/
+var CatalogSpecifier = class extends Schema.TaggedClass()("catalog", {
+	/** The original specifier string. */
+	raw: Schema.String,
+	/** The catalog name, or `Option.none()` for the default catalog. */
+	name: Schema.Option(Schema.String)
+}) {};
+/**
+* A `workspace:` reference. `range` carries the part after `workspace:` — a
+* range modifier (`*`, `^`, `~`), a concrete range, or an alias form.
 *
 * @public
 */
-var Lockfile = class Lockfile extends Schema.Class("Lockfile")({
-	format: LockfileFormat,
-	lockfileVersion: Schema.String,
-	packages: Schema.Array(ResolvedPackage),
-	workspaceDependencies: Schema.Array(WorkspaceDependency),
-	importers: Schema.Array(LockfileImporter).pipe(Schema.withDecodingDefaultKey(Effect.succeed([])), Schema.withConstructorDefault(Effect.succeed(EMPTY_IMPORTERS))),
-	extension: Schema.optionalKey(Schema.Union([PnpmExtension, BunExtension]))
+var WorkspaceSpecifier = class extends Schema.TaggedClass()("workspace", {
+	/** The original specifier string. */
+	raw: Schema.String,
+	/** The part after `workspace:` (e.g. `*`, `^1.2.3`, or an alias form). */
+	range: Schema.String
 }) {
-	/** Lazily built name → packages index; deliberately outside the schema, never encodes. */
-	#nameIndex;
-	/** Lazily built importer-path → importer index; deliberately outside the schema, never encodes. */
-	#importerIndex;
-	/**
-	* Parse lockfile content of a known format into the unified model — the
-	* package's only fallible boundary.
-	*
-	* @param content - The lockfile text (this package does no IO; the caller
-	*   reads the file).
-	* @param options - The lockfile format to parse as.
-	* @returns An `Effect` succeeding with the {@link Lockfile}, or failing
-	*   with {@link LockfileParseError} (malformed text or the wrong shape) or
-	*   {@link LockfileFramingError} (the text parsed, but no lockfile document
-	*   could be located in the stream — see that error for why a
-	*   multi-document `pnpm-lock.yaml` needs it).
-	*/
-	static parse = Effect.fn("Lockfile.parse")(function* (content, options) {
-		const fields = yield* dispatch(options.format, content).pipe(Effect.mapError((failure) => failure.stage === "framing" ? new LockfileFramingError({
-			format: options.format,
-			reason: failure.reason,
-			documents: failure.documents
-		}) : new LockfileParseError({
-			format: options.format,
-			stage: failure.stage,
-			cause: failure.cause
-		})));
-		return Lockfile.make({
-			format: options.format,
-			lockfileVersion: fields.lockfileVersion,
-			packages: fields.packages,
-			workspaceDependencies: fields.workspaceDependencies,
-			importers: fields.importers,
-			...fields.extension !== void 0 ? { extension: fields.extension } : {}
-		});
-	});
 	/**
-	* Rewrite pnpm importer-path names to real package names — the explicit
-	* second stage of pnpm parsing. Total and pure.
+	* The pnpm publish-time projection of this specifier against a concrete
+	* workspace version: `*` (or an empty range) becomes `version`, `~` becomes
+	* `~version`, `^` becomes `^version`, and a pinned range passes through
+	* unchanged. The alias form (`workspace:<name>@<range>`) becomes pnpm's
+	* publish-time aliased dependency `npm:<name>@<projected>`, with the range
+	* modifier projected the same way — `version` must then be the TARGET
+	* package's version (see `DependencySpecifier.workspaceTargetOf`).
 	*
 	* @remarks
-	* Workspace packages whose `relativePath` appears in `names` are renamed;
-	* dependency edge ends are rewritten through the same map. Entries not in
-	* the map keep their path name, and non-pnpm lockfiles are unaffected (no
-	* key matches). Versions are not touched — pnpm workspace packages keep
-	* `"0.0.0"` (the lockfile does not record their real versions).
-	*
-	* @param names - Importer path → real package name.
-	* @returns A new {@link Lockfile} with names rewritten.
-	*/
-	withImporterNames(names) {
-		const packages = this.packages.map((pkg) => {
-			if (!pkg.isWorkspace || pkg.relativePath === void 0) return pkg;
-			const realName = names.get(pkg.relativePath);
-			if (realName === void 0 || realName === "" || realName === pkg.name) return pkg;
-			return ResolvedPackage.make({
-				name: realName,
-				version: pkg.version,
-				...pkg.integrity !== void 0 ? { integrity: pkg.integrity } : {},
-				isWorkspace: pkg.isWorkspace,
-				relativePath: pkg.relativePath,
-				dependencies: pkg.dependencies
-			});
-		});
-		const workspaceDependencies = this.workspaceDependencies.map((dep) => {
-			const mappedFrom = names.get(dep.from);
-			const mappedTo = names.get(dep.to);
-			const from = mappedFrom === void 0 || mappedFrom === "" ? dep.from : mappedFrom;
-			const to = mappedTo === void 0 || mappedTo === "" ? dep.to : mappedTo;
-			if (from === dep.from && to === dep.to) return dep;
-			return WorkspaceDependency.make({
-				from,
-				to,
-				depType: dep.depType,
-				constraint: dep.constraint
-			});
-		});
-		return Lockfile.make({
-			format: this.format,
-			lockfileVersion: this.lockfileVersion,
-			packages,
-			workspaceDependencies,
-			importers: this.importers,
-			...this.extension !== void 0 ? { extension: this.extension } : {}
-		});
-	}
-	/**
-	* Every resolved package with the given name — one entry per resolved
-	* version. Backed by a lazily built index, so repeated lookups are O(1).
-	*
-	* @param name - The package name to look up.
-	* @returns The matching packages, empty when the name is not in the
-	*   lockfile.
-	*/
-	packagesNamed(name) {
-		if (this.#nameIndex === void 0) {
-			const index = /* @__PURE__ */ new Map();
-			for (const pkg of this.packages) {
-				const bucket = index.get(pkg.name);
-				if (bucket === void 0) index.set(pkg.name, [pkg]);
-				else bucket.push(pkg);
-			}
-			this.#nameIndex = index;
-		}
-		return this.#nameIndex.get(name) ?? [];
-	}
-	/**
-	* The importer at the given path — `"."` for the workspace root — or
-	* `Option.none()` when the lockfile records no importer there. Backed by a
-	* lazily built index, so repeated lookups are O(1). The index is a `Map`,
-	* so an attacker-adjacent path (`__proto__`, `constructor`) neither pollutes
-	* nor collides.
+	* The same projection as `DependencySpecifier.resolveWorkspace`, applied to
+	* this instance's already-extracted `range`; the two share one internal
+	* implementation.
 	*
-	* @param path - The importer path to look up.
-	* @returns The matching {@link LockfileImporter}, or `Option.none()`.
+	* @param version - The concrete version of the workspace package the
+	*   specifier points at (the alias target's version for the alias form).
 	*/
-	importer(path) {
-		if (this.#importerIndex === void 0) {
-			const index = /* @__PURE__ */ new Map();
-			for (const imp of this.importers) index.set(imp.path, imp);
-			this.#importerIndex = index;
-		}
-		return Option.fromUndefinedOr(this.#importerIndex.get(path));
-	}
-	/** The workspace-local packages. */
-	get workspacePackages() {
-		return this.packages.filter((pkg) => pkg.isWorkspace);
+	resolve(version) {
+		return projectWorkspaceRange(this.range, version);
 	}
 };
+/**
+* A plain semver range or exact version (e.g. `^1.2.3`, `1.x`, `>=1 <2`).
+*
+* @public
+*/
+var RangeSpecifier = class extends Schema.TaggedClass()("range", { 
+/** The original specifier string. */
+raw: Schema.String }) {};
+/**
+* A bare dist-tag (e.g. `latest`, `next`).
+*
+* @public
+*/
+var DistTagSpecifier = class extends Schema.TaggedClass()("dist-tag", { 
+/** The original specifier string (also the tag name). */
+raw: Schema.String }) {};
+/**
+* The honest fallback for `file:` / `link:` / `portal:` / git / URL / `npm:`
+* forms this concept does not further interpret.
+*
+* @public
+*/
+var RawSpecifier = class extends Schema.TaggedClass()("raw", { 
+/** The original specifier string. */
+raw: Schema.String }) {};
+const Classified = Schema.Union([
+	CatalogSpecifier,
+	WorkspaceSpecifier,
+	RangeSpecifier,
+	DistTagSpecifier,
+	RawSpecifier
+]);
+const classify$1 = (value) => {
+	if (isCatalog(value)) return CatalogSpecifier.make({
+		raw: value,
+		name: catalogNameOf$1(value)
+	});
+	if (isWorkspace(value)) return WorkspaceSpecifier.make({
+		raw: value,
+		range: value.slice(10)
+	});
+	if (isRange(value)) return RangeSpecifier.make({ raw: value });
+	if (isTag(value)) return DistTagSpecifier.make({ raw: value });
+	return RawSpecifier.make({ raw: value });
+};
+const fromString = Schema.String.pipe(Schema.decodeTo(Classified, SchemaTransformation.transformOrFail({
+	decode: (input) => isValidDependencySpecifier(input) ? Effect.succeed(classify$1(input)) : Effect.fail(new SchemaIssue.InvalidValue(Option.some(input), { message: `Invalid dependency specifier: "${input}"` })),
+	encode: (classified) => Effect.succeed(classified.raw)
+})));
+const brandedSpecifier = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidDependencySpecifier(value) ? void 0 : "Expected a valid dependency specifier")), Schema.brand("DependencySpecifier"));
+const decode$3 = (input) => Schema.decodeUnknownEffect(brandedSpecifier)(input).pipe(Effect.mapError(() => new InvalidDependencySpecifierError({ input })));
+/**
+* A valid dependency version specifier, carrying the protocol taxonomy statics
+* (`DependencySpecifier.protocolOf` and friends) that classify any specifier
+* string, plus the {@link (DependencySpecifier:variable).FromString} codec that
+* decodes a string into a {@link ClassifiedSpecifier} tagged union. Use it as a
+* schema for a specifier field and reach for the statics to inspect a raw
+* string.
+*
+* @public
+*/
+const DependencySpecifier = Object.assign(brandedSpecifier, {
+	protocolOf,
+	parseRange,
+	isRange,
+	isTag,
+	isGit,
+	isUrl: isUrl$1,
+	isLocal,
+	isLink,
+	isPortal,
+	isCatalog,
+	isWorkspace,
+	catalogNameOf: catalogNameOf$1,
+	resolveWorkspace,
+	workspaceTargetOf,
+	isValid: isValidDependencySpecifier,
+	decode: decode$3,
+	FromString: fromString
+});
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/LockfileIntegrity.js
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/IntegrityHash.js
+const SRI_RE = /^(sha1|sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2}$/;
+const COREPACK_RE = /^(sha1|sha224|sha256|sha384|sha512)\.[0-9a-f]+$/;
+const YARN_RE = /^[0-9]+(c[0-9]+)?\/[0-9a-f]+$/;
+const isSri = (value) => SRI_RE.test(value);
+const isCorepack = (value) => COREPACK_RE.test(value);
+const isYarnChecksum = (value) => YARN_RE.test(value);
 /**
-* The minimal manifest shape {@link LockfileIntegrity.compare} checks a
-* lockfile against: a package name plus the four optional dependency maps.
+* Whether a string is a valid integrity hash in the SRI (`<algo>-<base64>`),
+* corepack (`<algo>.<hex>`) or yarn (`<cachekey>/<hex>`) form.
 *
-* @remarks
-* Deliberately *not* a `@effected/package-json` type — this package takes
-* manifests as plain values so its consumers own the manifest IO (and may
-* derive these from any richer model).
+* @public
+*/
+const isValidIntegrityHash = (value) => isSri(value) || isCorepack(value) || isYarnChecksum(value);
+const algorithmOf = (value) => {
+	if (isSri(value)) return Option.some(value.slice(0, value.indexOf("-")));
+	if (isCorepack(value)) return Option.some(value.slice(0, value.indexOf(".")));
+	return Option.none();
+};
+/**
+* Indicates that a string could not be parsed as a valid integrity hash.
+*
+* Raised by {@link IntegrityHash.decode}. The offending string is preserved on
+* `input`.
 *
 * @public
 */
-var WorkspaceManifest = class extends Schema.Class("WorkspaceManifest")({
-	name: Schema.NonEmptyString,
-	dependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
-	devDependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
-	peerDependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
-	optionalDependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String))
-}) {};
-const decodeRange = Schema.decodeUnknownExit(Range$1.FromString);
-const decodeSemVer = Schema.decodeUnknownExit(SemVer.FromString);
+var InvalidIntegrityHashError = class extends Schema.TaggedErrorClass()("InvalidIntegrityHashError", { 
+/** The raw input string that failed validation. */
+input: Schema.String }) {
+	get message() {
+		return `Invalid integrity hash "${this.input}": expected an SRI (<algo>-<base64>), corepack (<algo>.<hex>) or yarn (<cachekey>/<hex>) form`;
+	}
+};
+const brandedIntegrity = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidIntegrityHash(value) ? void 0 : "Expected an SRI, corepack or yarn integrity hash")), Schema.brand("IntegrityHash"));
+const decode$2 = (input) => Schema.decodeUnknownEffect(brandedIntegrity)(input).pipe(Effect.mapError(() => new InvalidIntegrityHashError({ input })));
 /**
-* Result of checking a parsed lockfile against the workspace's declared
-* manifests.
+* A subresource-integrity hash, covering the SRI (`sha512-<base64>`), corepack
+* (`sha512.<hex>`) and yarn (`10c0/<hex>`) textual forms, carrying taxonomy
+* statics (`IntegrityHash.algorithmOf` and friends). Use it as a schema for an
+* integrity field and reach for the statics to inspect a raw string.
+*
+* @public
+*/
+const IntegrityHash = Object.assign(brandedIntegrity, {
+	isSri,
+	isCorepack,
+	isYarnChecksum,
+	isValid: isValidIntegrityHash,
+	algorithmOf,
+	decode: decode$2
+});
+/**
+* {@link (IntegrityHash:variable)} narrowed to the corepack `<algo>.<hex>` form
+* — `sha512.deadbeef`, and corepack's own sha224 default pins
+* (`sha224.877304e3…`). An SRI (`sha512-<base64>`) or yarn (`10c0/<hex>`)
+* hash, both valid `IntegrityHash` values, fails this schema.
 *
 * @remarks
-* A data type, not an error: it reports *what* mismatches exist without
-* failing anything.
+* The corepack pin tail (`<name>@<version>+<integrity>`) is the one place the
+* kit meets this form, and two schemas name it: `PackageManagerPin.integrity`
+* here and `@effected/package-json`'s `PackageManager.integrity`. Both consume
+* **this** schema — the restriction existed privately in each module until they
+* were consolidated, and a private copy is exactly how the two drift (the
+* widening that admitted sha224 had to be made twice).
 *
-* - `valid` — `true` when the lockfile is fully consistent.
-* - `missingWorkspaces` — workspace names present in the manifests but
-*   absent from the lockfile.
-* - `extraWorkspaces` — workspace names in the lockfile with no matching
-*   manifest.
-* - `unsatisfiedConstraints` — declared constraints the lockfile's resolved
-*   versions do not satisfy.
+* It decodes to the same {@link IntegrityHashBrand} the unrestricted schema
+* does, so a corepack-validated value assigns anywhere an `IntegrityHash` is
+* expected; there is no second brand. Reach for
+* `IntegrityHash.isCorepack(value)` to ask the same question about a raw
+* string without decoding.
+*
+* That single brand is also why sharing this schema is not type-enforced, and
+* the consequence is sharper than it looks: a `Schema.check` is **erased from
+* the built type**, so this schema and the unrestricted one are the same
+* declared type. A consumer that quietly reverts to a private copy compiles
+* clean, and — if the copy is faithful — passes every rejection test too.
+* Neither `tsc` nor behaviour can see the re-fork.
+*
+* What does see it is **object identity**, so each consumer's suite asserts
+* that its field schema IS this export:
+* `PackageManagerPin.fields.integrity.schema === CorepackIntegrityHash` (an
+* `optionalKey` field keeps the inner schema on `.schema`), and
+* `PackageManager.fields.integrity.value === CorepackIntegrityHash` on the
+* `@effected/package-json` side (a `Schema.Option` keeps it on `.value`). Both
+* assertions carry a control against the unrestricted brand, so they discriminate
+* rather than passing on any schema at all. That identity assertion is the only
+* thing standing between the two surfaces and a silent re-fork; do not replace
+* it with a behavioural test, which cannot fail.
+*
+* @example
+* ```ts
+* import { CorepackIntegrityHash } from "@effected/npm";
+* import { Schema } from "effect";
+*
+* const decode = Schema.decodeUnknownExit(CorepackIntegrityHash);
+*
+* decode("sha512.deadbeef"); // success
+* decode("sha512-3q2+7w=="); // failure — SRI form
+* ```
 *
 * @public
 */
-var LockfileIntegrity = class LockfileIntegrity extends Schema.Class("LockfileIntegrity")({
-	valid: Schema.Boolean,
-	missingWorkspaces: Schema.Array(Schema.String),
-	extraWorkspaces: Schema.Array(Schema.String),
-	unsatisfiedConstraints: Schema.Array(Schema.Struct({
-		workspace: Schema.String,
-		dependency: Schema.String,
-		constraint: Schema.String,
-		resolved: Schema.String,
-		depType: DependencyField
-	}))
-}) {
-	/**
-	* Check a lockfile's consistency against workspace manifests — a total,
-	* pure function: no Effect, no error channel, no IO.
-	*
-	* @remarks
-	* Constraint checking is best-effort by design: `workspace:` / `link:` /
-	* `file:` specifiers and rows whose range (or every resolved version) does
-	* not parse as SemVer are skipped, exactly as in the v3 implementation.
-	* A lockfile may resolve the same package at several versions; a
-	* constraint is satisfied when *any* resolved version matches, and an
-	* unsatisfied row reports every candidate in `resolved`. The
-	* caller reads the manifests (this package does no IO). For pnpm, apply
-	* `Lockfile#withImporterNames` first so workspace names align with
-	* manifest names.
-	*
-	* (Named `compare`, not `check`: every v4 `Schema.Class` already carries
-	* a `static check(...checks)` for attaching schema checks, and statics
-	* cannot be shadowed with an incompatible signature.)
-	*
-	* @param lockfile - The parsed lockfile.
-	* @param manifests - The workspace manifests to compare against.
-	* @returns The integrity report.
-	*/
-	static compare(lockfile, manifests) {
-		const workspacePackages = lockfile.packages.filter((p) => p.isWorkspace && p.relativePath !== void 0);
-		const lockfileWsNames = new Set(workspacePackages.map((p) => p.name));
-		const manifestNames = new Set(manifests.map((m) => m.name));
-		const missingWorkspaces = [...manifestNames].filter((n) => !lockfileWsNames.has(n));
-		const extraWorkspaces = [...lockfileWsNames].filter((n) => !manifestNames.has(n));
-		const resolvedIndex = /* @__PURE__ */ new Map();
-		for (const p of lockfile.packages) {
-			const versions = resolvedIndex.get(p.name);
-			if (versions === void 0) resolvedIndex.set(p.name, [p.version]);
-			else versions.push(p.version);
-		}
-		const unsatisfiedConstraints = [];
-		for (const manifest of manifests) for (const depType of DEP_TYPES) {
-			const depMap = manifest[depType];
-			if (!depMap) continue;
-			for (const [dependency, constraint] of Object.entries(depMap)) {
-				if (isWorkspaceSpecifier(constraint)) continue;
-				const candidates = resolvedIndex.get(dependency);
-				if (candidates === void 0) continue;
-				const rangeExit = decodeRange(constraint);
-				if (Exit.isFailure(rangeExit)) continue;
-				const versions = candidates.map((candidate) => decodeSemVer(candidate)).filter(Exit.isSuccess);
-				if (versions.length === 0) continue;
-				if (!versions.some((v) => rangeExit.value.test(v.value))) unsatisfiedConstraints.push({
-					workspace: manifest.name,
-					dependency,
-					constraint,
-					resolved: candidates.join(", "),
-					depType
-				});
-			}
-		}
-		return LockfileIntegrity.make({
-			valid: missingWorkspaces.length === 0 && extraWorkspaces.length === 0 && unsatisfiedConstraints.length === 0,
-			missingWorkspaces,
-			extraWorkspaces,
-			unsatisfiedConstraints
-		});
-	}
-};
+const CorepackIntegrityHash = brandedIntegrity.pipe(Schema.check(Schema.makeFilter((value) => isCorepack(value) ? void 0 : "Expected a corepack (<algo>.<hex>) integrity hash")));
 
 //#endregion
 //#region ../../node_modules/.pnpm/@effected+package-json@0.7.3_effect@4.0.0-beta.101/node_modules/@effected/package-json/Dependency.js
@@ -17555,7 +18686,7 @@ var Package = class Package extends Schema.Class("Package")({
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspacePackage.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspacePackage.js
 const EMPTY$1 = Object.freeze(Object.create(null));
 const EMPTY_MANIFEST = Object.freeze(Object.create(null));
 /**
@@ -18157,7 +19288,7 @@ var Walker$1 = class {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceRoot.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceRoot.js
 /**
 * The marker filenames {@link WorkspaceRoot} probes for, in priority order.
 *
@@ -18345,7 +19476,7 @@ var WorkspaceRoot = class WorkspaceRoot extends Context.Service()("@effected/wor
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/limits.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/limits.js
 /**
 * Hard ceiling on directories the enumerator will visit for one pattern set.
 * Guards the pathological case a depth cap alone does not: a wide, shallow
@@ -18364,7 +19495,7 @@ const MAX_ENUMERATION_ENTRIES = 1e5;
 const PRUNED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/traverse.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/traverse.js
 /** Directory names never descended into. */
 const isPruned = (entry) => PRUNED_DIRECTORIES.has(entry);
 /** Join root-relative POSIX segments; `""` is the root itself. */
@@ -18455,7 +19586,7 @@ var Traversal = class {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/enumerate.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/enumerate.js
 /** Strip a trailing slash from `GlobPattern.enumerationPrefix` to get a relative directory. */
 const baseOf = (pattern) => pattern.enumerationPrefix.replace(/\/$/, "");
 /**
@@ -18526,7 +19657,7 @@ const enumerate = (root, globs, options) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/patterns.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/patterns.js
 const stringsOf = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : void 0;
 /** The `packages:` list of a `pnpm-workspace.yaml` document. Total on a parsed document. */
 const pnpmPatternsOf = (document) => {
@@ -18584,7 +19715,7 @@ const readPatterns = (root) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceDiscovery.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceDiscovery.js
 /**
 * Raised when a workspace member's `package.json` cannot be read, parsed, or
 * used — it is missing, malformed, or lacks a `name` or `version`.
@@ -18837,6 +19968,15 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 			for (const entry of index) if (filePath.startsWith(entry.prefix)) return Option.some(entry.package);
 			return Option.none();
 		};
+		const packageIndexes = /* @__PURE__ */ new WeakMap();
+		const packagesByName = (all) => {
+			const cached = packageIndexes.get(all);
+			if (cached !== void 0) return cached;
+			const index = /* @__PURE__ */ new Map();
+			for (const pkg of all) if (!index.has(pkg.name)) index.set(pkg.name, pkg);
+			packageIndexes.set(all, index);
+			return index;
+		};
 		return {
 			info: Effect.fn("WorkspaceDiscovery.info")(function* () {
 				return (yield* memo).info;
@@ -18850,7 +19990,7 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 			}),
 			getPackage: Effect.fn("WorkspaceDiscovery.getPackage")(function* (name) {
 				const all = yield* packages;
-				const found = all.find((pkg) => pkg.name === name);
+				const found = packagesByName(all).get(name);
 				if (found !== void 0) return found;
 				return yield* Effect.fail(new PackageNotFoundError({
 					name,
@@ -19012,9 +20152,18 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 	* // `Package.resolve` now resolves `workspace:*` for real.
 	* ```
 	*/
-	static workspaceResolver = Layer.effect(WorkspaceResolver, Effect.gen(function* () {
+	static workspaceResolver = Layer.effect(WorkspaceResolver$1, Effect.gen(function* () {
 		const discovery = yield* WorkspaceDiscovery;
-		return { versionOf: (packageName) => discovery.listPackages().pipe(Effect.map((all) => Option.fromUndefinedOr(all.find((pkg) => pkg.name === packageName)?.version)), Effect.mapError((cause) => new DependencyResolutionError({
+		const versionIndexes = /* @__PURE__ */ new WeakMap();
+		const versionsByName = (all) => {
+			const cached = versionIndexes.get(all);
+			if (cached !== void 0) return cached;
+			const index = /* @__PURE__ */ new Map();
+			for (const pkg of all) if (!index.has(pkg.name)) index.set(pkg.name, pkg.version);
+			versionIndexes.set(all, index);
+			return index;
+		};
+		return { versionOf: (packageName) => discovery.listPackages().pipe(Effect.map((all) => Option.fromUndefinedOr(versionsByName(all).get(packageName))), Effect.mapError((cause) => new DependencyResolutionError$1({
 			specifier: `workspace:${packageName}`,
 			cause
 		}))) };
@@ -19023,7 +20172,7 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 const isStringRecord$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((entry) => typeof entry === "string");
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/DependencyGraph.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/DependencyGraph.js
 /**
 * Raised when the workspace dependency graph cannot be topologically ordered
 * because it contains a cycle.
@@ -20669,7 +21818,7 @@ var Git = class Git extends Context.Service()("@effected/git/Git") {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/ChangeDetector.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/ChangeDetector.js
 /**
 * Which git refs to compare, and whether to fold in the working tree.
 *
@@ -20969,7 +22118,7 @@ function resolveFromCatalog(catalogs, wantedDependency) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/catalogs.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/catalogs.js
 /** Project a pnpm-workspace manifest's `catalog` / `catalogs` fields into a `Catalogs` map. */
 const inlineCatalogs = (manifest) => {
 	if (manifest.catalog === void 0 && manifest.catalogs === void 0) return {};
@@ -21035,7 +22184,7 @@ const rangeOf = (catalogs, dependency, specifier) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/ConfigDependencyHooks.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/ConfigDependencyHooks.js
 /** Whether `value` is a non-null, non-array object. */
 const isObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
@@ -21128,6 +22277,137 @@ const updateConfigOf = (mod) => {
 	}
 };
 /**
+* The subprocess replay program {@link ConfigDependencyHooks.layerSubprocess}
+* hands to `node --input-type=module -e`.
+*
+* @remarks
+* A **static** string constant, deliberately: a bundler compiles a *computed*
+* dynamic `import()` into a context module that cannot resolve a runtime path
+* (`Cannot find module 'file:///…'`), so the computed import has to run in a
+* child process whose program text carries **no interpolated runtime value** —
+* the workspace root, the seed and the dependency names all arrive via argv
+* (`process.argv.slice(1)` under `-e`), never spliced into the script.
+*
+* The script mirrors this module's in-process semantics exactly so the two
+* layers are drop-in interchangeable: `pnpmfile.mjs` before `pnpmfile.cjs`
+* (pnpm 11's loader order), the `ERR_MODULE_NOT_FOUND`-for-the-candidate-itself
+* skip discrimination (`err.url` equality), the same hook-locator shapes, the
+* same tolerant threading of returned data (`configOf` / `finiteNumberOr` /
+* `stringArrayOr` clones below), and the same synchronous hook call. Only the
+* *mechanism* failures are reported: the script prints one final line of JSON —
+* `{ ok: true, config }` on success, `{ ok: false, name, message, stack? }`
+* naming the offending dependency on a load/replay failure — and exits through
+* the write callback so the payload is flushed even if a hook left the event
+* loop occupied. The final-line framing tolerates a hook's own `console.log`
+* noise on stdout.
+*/
+const REPLAY_SCRIPT = `
+const [root, seedJson, ...names] = process.argv.slice(1);
+const { pathToFileURL } = await import("node:url");
+const { join } = await import("node:path");
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const finiteNumberOr = (value, fallback) => (typeof value === "number" && Number.isFinite(value) ? value : fallback);
+const stringArrayOr = (value, fallback) =>
+	Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : fallback;
+const configOf = (value, fallback) =>
+	isObject(value)
+		? {
+				catalog: isObject(value.catalog) ? value.catalog : fallback.catalog,
+				catalogs: isObject(value.catalogs) ? value.catalogs : fallback.catalogs,
+				minimumReleaseAge: finiteNumberOr(value.minimumReleaseAge, fallback.minimumReleaseAge),
+				minimumReleaseAgeExclude: stringArrayOr(value.minimumReleaseAgeExclude, fallback.minimumReleaseAgeExclude),
+			}
+		: fallback;
+const failure = (name, cause) => ({
+	ok: false,
+	name,
+	message: cause instanceof Error ? cause.message : String(cause),
+	...(cause instanceof Error && typeof cause.stack === "string" ? { stack: cause.stack } : {}),
+});
+const replay = async () => {
+	let catalog = {};
+	const catalogs = {};
+	for (const [name, entries] of Object.entries(JSON.parse(seedJson))) {
+		if (name === "default") catalog = { ...entries };
+		else catalogs[name] = { ...entries };
+	}
+	let config = { catalog, catalogs, minimumReleaseAge: undefined, minimumReleaseAgeExclude: undefined };
+	for (const name of names) {
+		let loaded;
+		let found = false;
+		for (const filename of ["pnpmfile.mjs", "pnpmfile.cjs"]) {
+			const candidate = pathToFileURL(join(root, "node_modules", ".pnpm-config", name, filename)).href;
+			try {
+				loaded = await import(candidate);
+				found = true;
+				break;
+			} catch (cause) {
+				const url =
+					isObject(cause) && cause.code === "ERR_MODULE_NOT_FOUND" && typeof cause.url === "string"
+						? cause.url
+						: undefined;
+				if (url === candidate) continue;
+				return failure(name, cause);
+			}
+		}
+		if (!found) continue;
+		let hook;
+		for (const candidate of [loaded, isObject(loaded) ? loaded.default : undefined]) {
+			if (!isObject(candidate)) continue;
+			if (isObject(candidate.hooks) && typeof candidate.hooks.updateConfig === "function") {
+				hook = candidate.hooks.updateConfig;
+				break;
+			}
+			if (typeof candidate.updateConfig === "function") {
+				hook = candidate.updateConfig;
+				break;
+			}
+		}
+		if (hook === undefined) continue;
+		try {
+			config = configOf(hook(config), config);
+		} catch (cause) {
+			return failure(name, cause);
+		}
+	}
+	return { ok: true, config };
+};
+const payload = await replay();
+process.stdout.write("\\n" + JSON.stringify(payload) + "\\n", () => process.exit(0));
+`;
+/**
+* The ceiling on one subprocess replay. A config dependency's `updateConfig`
+* reads and rewrites a config object — no install work, no network — so thirty
+* seconds is generous. Without a ceiling a pnpmfile that loops or awaits a
+* promise that never settles hangs `inject`, and through it the one memoized
+* {@link WorkspaceCatalogs} assemble pass every catalog read blocks on. Expiry
+* kills the child (`Run` scopes it) and surfaces as a `CommandFailedError`
+* through the same typed transport-failure path as any other mechanism failure.
+*/
+const REPLAY_TIMEOUT = Duration.seconds(30);
+/**
+* The subprocess protocol payload — the child's final stdout line, framed and
+* parsed by `Run.jsonLine`. The envelope is strict (a payload without a usable
+* `ok` discriminant is a mechanism failure, typed); the `config` slice inside a
+* success stays `Unknown` because a hook's returned *data* is tolerantly
+* threaded (`configOf`), never fatal.
+*/
+const ReplayPayload = Schema.Union([Schema.Struct({
+	ok: Schema.Literal(true),
+	config: Schema.Unknown
+}), Schema.Struct({
+	ok: Schema.Literal(false),
+	name: Schema.optionalKey(Schema.String),
+	message: Schema.optionalKey(Schema.String),
+	stack: Schema.optionalKey(Schema.String)
+})]);
+/** Rebuild the subprocess's serialized failure as an `Error`, preserving the child-side stack when it carried one. */
+const replayFailureCause = (payload) => {
+	const error = new Error(payload.message ?? "config dependency hook replay failed");
+	if (payload.stack !== void 0) error.stack = payload.stack;
+	return error;
+};
+/**
 * Replays a workspace's `configDependencies` `updateConfig` hooks over the inline
 * catalogs — the opt-in seam that lets hook-injected catalogs participate in
 * assembly.
@@ -21220,10 +22500,99 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 			releaseAge: releaseAgeOf(config)
 		};
 	}) });
+	/**
+	* The subprocess layer: replays each config dependency's pnpmfile in a `node`
+	* child process instead of an in-process dynamic `import()`, with identical
+	* typed semantics to {@link ConfigDependencyHooks.layerLive} — the two are
+	* drop-in interchangeable.
+	*
+	* @remarks
+	* `layerLive` computes the `import()` path at runtime, and a bundler (rspack,
+	* for one) compiles a *computed* dynamic import into a context module that
+	* throws `Cannot find module 'file:///…'` at runtime — so in any bundled
+	* consumer, a GitHub Action above all, the in-process replay is unreachable.
+	* This layer keeps every computed load out of the bundle graph: the replay
+	* program is a **static** string constant passed via argv
+	* (`node --input-type=module -e <script> <root> <seed> <...names>`), and the
+	* child process performs the computed imports where no bundler rewrote them.
+	* A subprocess also keeps config-dependency code out of the consumer's own
+	* process.
+	*
+	* The contract's semantics are unchanged, not the downstream fail-open shape:
+	* an empty `configDependencies` returns the seed without spawning anything; a
+	* `..` path segment in a dependency name fails typed **before** any spawn; a
+	* missing pnpmfile (neither `.mjs` nor `.cjs`) is the one legitimate skip,
+	* discriminated inside the child by `err.url` equality exactly as
+	* `layerLive` discriminates in process; any other load failure — a syntax
+	* error, a throwing top level, an `ERR_MODULE_NOT_FOUND` for a module the
+	* pnpmfile itself imports — and a hook that throws when called are serialized
+	* back per-name and surface typed as a `hooks`-source `CatalogAssemblyError`
+	* naming that dependency. A hook's returned *data* stays tolerantly threaded
+	* (last well-formed write wins), never fatal. Spawn and transport failures —
+	* `node` absent, a non-zero exit without a result payload, unparseable
+	* output — fail typed too, never a defect and never a silent skip.
+	*
+	* Two bounds this layer imposes that `layerLive` cannot: the replay is
+	* given thirty seconds (a pnpmfile that loops or awaits forever fails typed
+	* instead of hanging the memoized assemble pass — a subprocess is killable,
+	* while `layerLive`'s in-process synchronous hook call is not interruptible
+	* by any means, so the asymmetry is inherent, not a parity violation), and
+	* the child's stdout is captured under `Run.jsonLine`'s 16 MiB default
+	* ceiling (a hook that logs more than that fails typed as `tooLarge`, where
+	* `layerLive` — which captures nothing — would succeed).
+	*
+	* Catalog folding and normalization stay in the **parent** (the same
+	* `@pnpm/catalogs`-derived path `layerLive` uses); the child returns only the
+	* raw threaded config slice, since the script cannot import kit code.
+	*
+	* Requires core's `ChildProcessSpawner`, resolved when the layer is built —
+	* the consumer provides it once at the edge (`@effect/platform-node`'s
+	* `NodeServices.layer`), the same discharge `@effected/git` uses. Wired by
+	* `WorkspaceCatalogs.layerWithConfigDependenciesSubprocess` /
+	* `Workspaces.layerWithConfigDependenciesSubprocess`.
+	*/
+	static layerSubprocess = Layer.effect(ConfigDependencyHooks, Effect.gen(function* () {
+		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+		return { inject: (root, configDependencies, seed) => Effect.gen(function* () {
+			const names = Object.keys(configDependencies);
+			if (names.length === 0) return {
+				catalogs: seed,
+				releaseAge: {}
+			};
+			for (const name of names) if (hasTraversalSegment(name)) return yield* Effect.fail(new CatalogAssemblyError({
+				source: "hooks",
+				path: name,
+				cause: /* @__PURE__ */ new Error(`config dependency name has a '..' path segment: ${name}`)
+			}));
+			const command = ChildProcess.make("node", [
+				"--input-type=module",
+				"-e",
+				REPLAY_SCRIPT,
+				root,
+				JSON.stringify(seed),
+				...names
+			]);
+			const payload = yield* Run.jsonLine(command, ReplayPayload, { timeout: REPLAY_TIMEOUT }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner), Effect.catch((cause) => Effect.fail(new CatalogAssemblyError({
+				source: "hooks",
+				path: root,
+				cause
+			}))));
+			if (payload.ok === false) return yield* Effect.fail(new CatalogAssemblyError({
+				source: "hooks",
+				path: payload.name ?? root,
+				cause: replayFailureCause(payload)
+			}));
+			const config = configOf(payload.config, seedToConfig(seed));
+			return {
+				catalogs: configToEntries(config),
+				releaseAge: releaseAgeOf(config)
+			};
+		}) };
+	}));
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/PackageManagerName.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/PackageManagerName.js
 /**
 * The four package managers this package understands.
 *
@@ -21552,7 +22921,7 @@ var PackageManagerDetector = class PackageManagerDetector extends Context.Servic
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/LockfileReader.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/LockfileReader.js
 /**
 * Raised when the workspace's lockfile cannot be read off disk.
 *
@@ -21733,7 +23102,7 @@ var LockfileReader = class LockfileReader extends Context.Service()("@effected/w
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/Publishability.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/Publishability.js
 /** The public npm registry, used when `publishConfig.registry` says nothing. */
 const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 /**
@@ -21893,7 +23262,7 @@ var PublishabilityDetector = class extends Context.Service()("@effected/workspac
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/importerVersions.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/importerVersions.js
 /**
 * Strip pnpm's peer-disambiguation suffix from a recorded importer version.
 *
@@ -21980,7 +23349,7 @@ const unanimousVersionOf = (index, dependency) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceCatalogs.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceCatalogs.js
 /**
 * An immutable, fully-normalized catalog collection — the one catalog
 * resolution semantic in the package.
@@ -22401,6 +23770,24 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 	*/
 	static layerWithConfigDependencies = (options) => Layer.effect(WorkspaceCatalogs, WorkspaceCatalogs.make(options)).pipe(Layer.provide(ConfigDependencyHooks.layerLive));
 	/**
+	* The opt-in layer that replays config-dependency `pnpmfile` hooks in a
+	* `node` **child process**: it wires
+	* {@link ConfigDependencyHooks.layerSubprocess} in place of the in-process
+	* `layerLive`.
+	*
+	* @remarks
+	* Same typed semantics as {@link WorkspaceCatalogs.layerWithConfigDependencies}
+	* — the two hook layers are drop-in interchangeable — but the replay's
+	* computed dynamic `import()` runs in the subprocess, so it survives bundling
+	* (a bundler compiles a computed in-process `import()` into a context module
+	* that cannot resolve at runtime — every bundled GitHub Action hits this).
+	* The cost is one extra requirement: core's `ChildProcessSpawner`, provided
+	* once at the edge (`@effect/platform-node`'s `NodeServices.layer`) — the
+	* same sanctioned R-widening as `Workspaces.layerWithGit`. Parameterized, so
+	* bind it to a `const` and reuse it.
+	*/
+	static layerWithConfigDependenciesSubprocess = (options) => Layer.effect(WorkspaceCatalogs, WorkspaceCatalogs.make(options)).pipe(Layer.provide(ConfigDependencyHooks.layerSubprocess));
+	/**
 	* A test double satisfying the full {@link WorkspaceCatalogsShape} with no
 	* filesystem, lockfile read, or hook replay.
 	*
@@ -22477,9 +23864,9 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 	* consumers to `_tag`-sniff `unknown`); only the remaining mechanism failure,
 	* an unfindable workspace root, is wrapped as `DependencyResolutionError`.
 	*/
-	static catalogResolver = Layer.effect(CatalogResolver, Effect.gen(function* () {
+	static catalogResolver = Layer.effect(CatalogResolver$1, Effect.gen(function* () {
 		const catalogs = yield* WorkspaceCatalogs;
-		return { rangeOf: (packageName, catalog) => catalogs.set().pipe(Effect.map((set) => set.rangeOf(packageName, catalog)), Effect.catchTag("WorkspaceRootNotFoundError", (cause) => Effect.fail(new DependencyResolutionError({
+		return { rangeOf: (packageName, catalog) => catalogs.set().pipe(Effect.map((set) => set.rangeOf(packageName, catalog)), Effect.catchTag("WorkspaceRootNotFoundError", (cause) => Effect.fail(new DependencyResolutionError$1({
 			specifier: Option.match(catalog, {
 				onNone: () => "catalog:",
 				onSome: (name) => `catalog:${name}`
@@ -22490,7 +23877,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceStateSnapshot.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceStateSnapshot.js
 const EMPTY = Object.freeze(Object.create(null));
 const DependencyMap = Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY)), Schema.withConstructorDefault(Effect.succeed(EMPTY)));
 /**
@@ -22669,7 +24056,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 	* resolving to `Option.none()` so the caller falls back to the raw string.
 	*/
 	#resolveWith(dependency, specifier, onUnresolvedCatalog) {
-		const exit = Schema.decodeUnknownExit(DependencySpecifier.FromString)(specifier);
+		const exit = Schema.decodeUnknownExit(DependencySpecifier$1.FromString)(specifier);
 		if (!Exit.isSuccess(exit)) return Option.none();
 		const classified = exit.value;
 		switch (classified._tag) {
@@ -22694,7 +24081,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 	* `rangeOf` never fails.
 	*/
 	get catalogResolver() {
-		if (this.#catalogResolver === void 0) this.#catalogResolver = Layer.succeed(CatalogResolver, { rangeOf: (packageName, catalog) => Effect.succeed(this.catalogs.rangeOf(packageName, catalog)) });
+		if (this.#catalogResolver === void 0) this.#catalogResolver = Layer.succeed(CatalogResolver$1, { rangeOf: (packageName, catalog) => Effect.succeed(this.catalogs.rangeOf(packageName, catalog)) });
 		return this.#catalogResolver;
 	}
 	/**
@@ -22703,7 +24090,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 	* `workspace:` specifiers as of this ref. Built once per instance and cached.
 	*/
 	get workspaceResolver() {
-		if (this.#workspaceResolver === void 0) this.#workspaceResolver = Layer.succeed(WorkspaceResolver, { versionOf: (packageName) => Effect.succeed(Option.fromUndefinedOr(this.#versions().get(packageName))) });
+		if (this.#workspaceResolver === void 0) this.#workspaceResolver = Layer.succeed(WorkspaceResolver$1, { versionOf: (packageName) => Effect.succeed(Option.fromUndefinedOr(this.#versions().get(packageName))) });
 		return this.#workspaceResolver;
 	}
 	/** Both snapshot-scoped resolver layers merged. Built once per instance and cached. */
@@ -22714,7 +24101,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceSnapshots.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceSnapshots.js
 /** Whether `value` is a non-null, non-array object. */
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Whether every value in a record is a string — a usable dependency map. */
@@ -22992,7 +24379,7 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@ef
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/Workspaces.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/Workspaces.js
 const compose = (options, catalogsFactory) => {
 	const roots = WorkspaceRoot.layer;
 	const detector = PackageManagerDetector.layer;
@@ -23009,6 +24396,7 @@ const layerWithGit = (options) => {
 };
 const resolvers = Layer.mergeAll(WorkspaceCatalogs.catalogResolver, WorkspaceDiscovery.workspaceResolver);
 const layerWithConfigDependencies = (options) => compose(options, WorkspaceCatalogs.layerWithConfigDependencies);
+const layerWithConfigDependenciesSubprocess = (options) => compose(options, WorkspaceCatalogs.layerWithConfigDependenciesSubprocess);
 const resolverLayer = (options) => resolvers.pipe(Layer.provide(layerWithConfigDependencies(options)));
 const resolveManifest = Effect.fn("Workspaces.resolveManifest")(function* (manifest, options) {
 	return yield* manifest.resolve().pipe(Effect.provide(resolverLayer(options)));
@@ -23090,6 +24478,32 @@ var Workspaces = class {
 	*/
 	static layerWithConfigDependencies = layerWithConfigDependencies;
 	/**
+	* The git-free composite with config-dependency hook replay in a `node`
+	* **child process** —
+	* {@link WorkspaceCatalogs.layerWithConfigDependenciesSubprocess} in place of
+	* the in-process replay.
+	*
+	* @remarks
+	* Same typed semantics as {@link Workspaces.layerWithConfigDependencies}; the
+	* difference is mechanism, and it matters in exactly one environment class: a
+	* **bundled** consumer. The in-process replay's computed dynamic `import()`
+	* is compiled by bundlers (rspack among them) into a context module that
+	* throws `Cannot find module 'file:///…'` at runtime, which makes
+	* `WorkspaceCatalogs.releaseAgeGate()` unreachable from any bundled GitHub
+	* Action. Here the computed import runs inside a `node` child process whose
+	* program text is a static string handed over argv, so nothing computed
+	* enters the bundle graph.
+	*
+	* The extra requirement is core's `ChildProcessSpawner`, provided once at
+	* the edge (`@effect/platform-node`'s `NodeServices.layer`) — the same
+	* sanctioned R-widening as {@link Workspaces.layerWithGit}, and the reason
+	* this is a separate composite rather than a flag: a consumer that keeps the
+	* in-process replay should not have to be able to spawn a subprocess.
+	*
+	* **Bind the result to a `const`.**
+	*/
+	static layerWithConfigDependenciesSubprocess = layerWithConfigDependenciesSubprocess;
+	/**
 	* The git-free composite plus {@link ChangeDetector} and
 	* {@link WorkspaceSnapshots}, over `@effected/git`'s `Git` service.
 	*