@savvy-web/silk 3.4.1 → 3.5.0

package/changesets-changelog.d.cts

@@ -3298,7 +3298,7 @@ type Label = Label$1;
 type Severity = Severity$1;
 type Plugin<Tree extends Node$3 = Node$3, Option extends unknown = unknown> = (config?: [level: Label | Severity | boolean, option?: Option] | Label | Option | Severity) => ((tree: Tree, file: VFile, next: TransformCallback<Tree>) => undefined) | undefined;
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+git@0.5.2_effect@4.0.0-beta.101/node_modules/@effected/git/index.d.ts
+//#region ../../node_modules/.pnpm/@effected+git@0.6.0_effect@4.0.0-beta.101/node_modules/@effected/git/index.d.ts
 //#region src/Git.d.ts
 declare const GitCommandError_base: Schema.Class<GitCommandError, Schema.TaggedStruct<"GitCommandError", {
   /**
@@ -3309,7 +3309,16 @@ declare const GitCommandError_base: Schema.Class<GitCommandError, Schema.TaggedS
    * logic routes on this instead of matching `detail` prose.
    */
   readonly kind: Schema.Literals<readonly ["refused", "failed"]>;
-  /** The argument vector, without the leading `git`. */
+  /**
+   * The REDACTED argument vector, without the leading `git`.
+   *
+   * Sensitive positionals — config values, a URL's embedded userinfo — are
+   * already masked by the constructor's redaction mask before this error is
+   * constructed (`configSet`'s value reads `<redacted>`; a
+   * `https://user:token@host/...` remote keeps everything but its
+   * `userinfo@`). The raw argv is never persisted in an error value, and
+   * `message` renders this redacted vector.
+   */
   readonly args: Schema.$Array<Schema.String>;
   /** The working directory the command ran in. */
   readonly cwd: Schema.String;
@@ -3368,6 +3377,70 @@ declare class UnknownRefError extends UnknownRefError_base {
   /** Renders the unresolvable ref into a one-line message. */
   get message(): string;
 }
+declare const NonFastForwardError_base: Schema.Class<NonFastForwardError, Schema.TaggedStruct<"NonFastForwardError", {
+  /** The working directory the push ran in. */
+  readonly cwd: Schema.String;
+  /** The refspec that was rejected, when the caller passed one. */
+  readonly refspec: Schema.optionalKey<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A `git push` was rejected because the remote ref has moved: the classic
+ * non-fast-forward rejection (`fetch first` / `non-fast-forward`), or a
+ * `--force-with-lease` lease failure (`stale info`).
+ *
+ * @remarks
+ * The typed signal a fetch-then-retry (or rebase-then-retry) fallback
+ * branches on — every other push failure stays a {@link GitCommandError}.
+ * Only `Git.push` can fail with this error.
+ *
+ * @public
+ */
+declare class NonFastForwardError extends NonFastForwardError_base {
+  /** Renders the rejected push into a one-line message. */
+  get message(): string;
+}
+declare const MergeConflictError_base: Schema.Class<MergeConflictError, Schema.TaggedStruct<"MergeConflictError", {
+  /** The working directory the merge ran in. */
+  readonly cwd: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A merge-shaped operation (`pull`, `stash pop`, `stash apply`) stopped with
+ * conflict markers in the working tree.
+ *
+ * @remarks
+ * The typed signal a resolve-or-abort recovery branches on. The conflicted
+ * state is REAL: git has already written conflict markers, and (for `pull`)
+ * `MERGE_HEAD` is set — the caller owns resolving or aborting. Detection
+ * matches git's conflict report, which lands on STDOUT for a merge and on
+ * stderr for a rebase-mode pull; both streams are inspected.
+ *
+ * @public
+ */
+declare class MergeConflictError extends MergeConflictError_base {
+  /** Renders the conflicted merge into a one-line message. */
+  get message(): string;
+}
+declare const DirtyWorktreeError_base: Schema.Class<DirtyWorktreeError, Schema.TaggedStruct<"DirtyWorktreeError", {
+  /** The working directory whose local changes blocked the operation. */
+  readonly cwd: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A merge-shaped operation refused to start because local modifications would
+ * be overwritten — git's refusal reads
+ * `Your local changes ... would be overwritten by merge`.
+ *
+ * @remarks
+ * The typed "commit or stash first" signal. Unlike {@link MergeConflictError}
+ * the working tree is UNTOUCHED — git aborted before changing anything.
+ * Only the merge-shaped methods (`pull`, `stashPop`, `stashApply`) can fail
+ * with this error.
+ *
+ * @public
+ */
+declare class DirtyWorktreeError extends DirtyWorktreeError_base {
+  /** Renders the blocked operation into a one-line message. */
+  get message(): string;
+}
 declare const LsTreeEntry_base: Schema.Class<LsTreeEntry, Schema.Struct<{
   /** The entry's file mode, e.g. `100644`. */
   readonly mode: Schema.String;
@@ -3423,6 +3496,21 @@ declare const CommitInfo_base: Schema.Class<CommitInfo, Schema.Struct<{
  * @public
  */
 declare class CommitInfo extends CommitInfo_base {}
+/**
+ * Options for {@link StatusEntry.toLine} / {@link StatusEntry.format}: how a
+ * rename/copy entry's path field renders.
+ *
+ * @public
+ */
+interface StatusRenderOptions {
+  /**
+   * `"new"` (the default) renders only the NEW path — the entry's current
+   * path, the one that exists on disk. `"arrow"` renders git's own non-`-z`
+   * porcelain form, `<origPath> -> <path>`. Non-rename entries are
+   * unaffected either way.
+   */
+  readonly renames?: "new" | "arrow";
+}
 declare const StatusEntry_base: Schema.Class<StatusEntry, Schema.Struct<{
   /** The index-side status code (first porcelain column). */
   readonly x: Schema.Literals<readonly [" ", "M", "T", "A", "D", "R", "C", "U", "?", "!"]>;
@@ -3438,7 +3526,209 @@ declare const StatusEntry_base: Schema.Class<StatusEntry, Schema.Struct<{
  *
  * @public
  */
-declare class StatusEntry extends StatusEntry_base {}
+declare class StatusEntry extends StatusEntry_base {
+  /**
+   * Renders this entry back to one porcelain-shaped line: `XY <path>`.
+   *
+   * @remarks
+   * **The rename convention is decided here, once, for every consumer.** By
+   * default a rename/copy entry renders its NEW path only — `path` IS the
+   * entry's current path, the one a line-oriented downstream can actually
+   * open — which is a deliberate divergence from git's own non-`-z`
+   * rendering (`orig -> new`). The arrow form is ambiguous to naive
+   * line/whitespace splitters (paths may contain spaces, or a literal
+   * `" -> "`), so it is opt-in via `renames: "arrow"` for consumers that
+   * want git parity.
+   *
+   * A second recorded divergence: git's non-`-z` porcelain C-quotes paths
+   * containing special characters; this renderer emits paths raw. It exists
+   * for whitespace-insensitive text consumers — a machine parser should
+   * consume the decoded {@link StatusEntry} values (or `-z` output)
+   * directly, never re-parse this rendering.
+   */
+  toLine(options?: StatusRenderOptions): string;
+  /**
+   * Renders entries back to porcelain-shaped text: one {@link StatusEntry.toLine}
+   * line per entry, newline-joined, no trailing newline.
+   *
+   * @remarks
+   * The route back from `Git.status`'s parsed entries to line-oriented text,
+   * so a consumer whose downstream contract is porcelain-shaped text does
+   * not hand-roll its own renderer (and re-decide the rename convention —
+   * see {@link StatusEntry.toLine} for that decision). An empty array
+   * renders as the empty string.
+   */
+  static readonly format: (entries: ReadonlyArray<StatusEntry>, options?: StatusRenderOptions) => string;
+}
+declare const SubmoduleStatusEntry_base: Schema.Class<SubmoduleStatusEntry, Schema.Struct<{
+  /** The decoded state prefix. */
+  readonly state: Schema.Literals<readonly ["current", "uninitialized", "outOfSync", "conflict"]>;
+  /** The submodule's checked-out (or, uninitialized, gitlink) commit sha. */
+  readonly sha: Schema.String;
+  /** The submodule's path relative to the superproject root. */
+  readonly path: Schema.String;
+  /** The `git describe` suffix, present only for initialized submodules. */
+  readonly describe: Schema.optionalKey<Schema.String>;
+}>, {}>;
+/**
+ * One line of a `git submodule status` listing.
+ *
+ * @remarks
+ * The `state` decodes git's one-character prefix: `" "` → `"current"` (the
+ * checked-out commit matches the index gitlink), `"-"` → `"uninitialized"`,
+ * `"+"` → `"outOfSync"` (the checked-out commit differs from the gitlink),
+ * `"U"` → `"conflict"` (merge conflicts). `describe` carries the
+ * parenthesized `git describe` suffix git appends for initialized
+ * submodules.
+ *
+ * @public
+ */
+declare class SubmoduleStatusEntry extends SubmoduleStatusEntry_base {}
+declare const LsRemoteEntry_base: Schema.Class<LsRemoteEntry, Schema.Struct<{
+  /** The sha the advertised ref points at. */
+  readonly sha: Schema.String;
+  /** The full advertised refname, `^{}` peel suffix included. */
+  readonly ref: Schema.String;
+}>, {}>;
+/**
+ * One ref a remote advertises, from `git ls-remote`.
+ *
+ * @remarks
+ * `ref` is the FULL refname as advertised (`refs/heads/main`,
+ * `refs/tags/v1`), including the `^{}` suffix on an annotated tag's peeled
+ * entry — an annotated tag appears twice, once as the tag object and once
+ * peeled to its commit.
+ *
+ * @public
+ */
+declare class LsRemoteEntry extends LsRemoteEntry_base {
+  /**
+   * The human-facing short name of an advertised refname: the
+   * `refs/heads/` / `refs/tags/` / `refs/remotes/` prefix and any `^{}`
+   * peel suffix stripped (`refs/tags/v1^{}` → `v1`).
+   */
+  static readonly shortName: (ref: string) => string;
+  /**
+   * The entries whose short name is a NEAR MISS for `ref`: not an exact
+   * match, but ending in `ref` right behind a separator (`@`, `/`, `-`,
+   * `_`) — the monorepo-prefixed-tag case, where a caller asks for
+   * `4.0.0-beta.101` and the remote advertises `effect@4.0.0-beta.101`.
+   *
+   * @remarks
+   * A pure, decode-side helper for validate-before-mutate flows: run
+   * `lsRemote`, look for the wanted ref, and when it is absent hand the
+   * listing to this to compute a suggestion. Deliberately a helper on the
+   * ENTRY value rather than behavior baked into the service — the service
+   * returns the full listing and the caller owns the matching policy. An
+   * annotated tag's peeled `^{}` entry shares its base short name, so a
+   * near miss on such a tag can surface both of its entries.
+   */
+  static readonly nearMatches: (entries: ReadonlyArray<LsRemoteEntry>, ref: string) => ReadonlyArray<LsRemoteEntry>;
+}
+declare const StashEntry_base: Schema.Class<StashEntry, Schema.Struct<{
+  /** The reflog selector (`stash@{0}`) — the index other stash methods take. */
+  readonly ref: Schema.String;
+  /** The stash commit's sha. */
+  readonly sha: Schema.String;
+  /** The reflog subject: `WIP on <branch>: ...` or `On <branch>: <message>`. */
+  readonly message: Schema.String;
+}>, {}>;
+/**
+ * One stash entry, from `git stash list`.
+ *
+ * @public
+ */
+declare class StashEntry extends StashEntry_base {}
+declare const BranchEntry_base: Schema.Class<BranchEntry, Schema.Struct<{
+  /** The short branch name (`main`, or `origin/main` for a remote branch). */
+  readonly name: Schema.String;
+  /** The branch tip's sha. */
+  readonly sha: Schema.String;
+  /** Whether this branch is checked out in the current working tree. */
+  readonly current: Schema.Boolean;
+}>, {}>;
+/**
+ * One local (or remote-tracking) branch, from `git branch --list`.
+ *
+ * @public
+ */
+declare class BranchEntry extends BranchEntry_base {}
+declare const RefEntry_base: Schema.Class<RefEntry, Schema.Struct<{
+  /** The full refname (`refs/tags/v1`). */
+  readonly ref: Schema.String;
+  /** The sha of the object the ref points at. */
+  readonly sha: Schema.String;
+  /**
+   * The pointed-at object's type. An annotated tag is `tag` (the tag
+   * object itself, not its target commit).
+   */
+  readonly objectType: Schema.Literals<readonly ["commit", "tag", "tree", "blob"]>;
+}>, {}>;
+/**
+ * One ref, from `git for-each-ref`.
+ *
+ * @public
+ */
+declare class RefEntry extends RefEntry_base {}
+declare const ConfigListEntry_base: Schema.Class<ConfigListEntry, Schema.Struct<{
+  /** The canonical dotted key (`section.subsection.key`). */
+  readonly key: Schema.String;
+  /**
+   * The raw value. A valueless key (git's boolean-true shorthand,
+   * `[section]` + bare `key`) surfaces as the empty string — distinguish it
+   * with `configGetAll` if the difference matters.
+   */
+  readonly value: Schema.String;
+}>, {}>;
+/**
+ * One configuration entry, from `git config --list`.
+ *
+ * @public
+ */
+declare class ConfigListEntry extends ConfigListEntry_base {}
+declare const WorktreeEntry_base: Schema.Class<WorktreeEntry, Schema.Struct<{
+  /** The working tree's absolute path. */
+  readonly path: Schema.String;
+  /** The checked-out commit sha; absent for a bare repository entry. */
+  readonly head: Schema.optionalKey<Schema.String>;
+  /** The checked-out branch's full refname; absent when detached or bare. */
+  readonly branch: Schema.optionalKey<Schema.String>;
+  /** Whether the working tree is in detached-HEAD state. */
+  readonly detached: Schema.Boolean;
+  /** Whether the entry is the bare repository itself. */
+  readonly bare: Schema.Boolean;
+  /** Present when the worktree is locked; holds the lock reason (possibly empty). */
+  readonly locked: Schema.optionalKey<Schema.String>;
+  /** Present when the worktree is prunable; holds the reason (possibly empty). */
+  readonly prunable: Schema.optionalKey<Schema.String>;
+}>, {}>;
+/**
+ * One working tree, from `git worktree list --porcelain`.
+ *
+ * @public
+ */
+declare class WorktreeEntry extends WorktreeEntry_base {}
+declare const LsFilesEntry_base: Schema.Class<LsFilesEntry, Schema.Struct<{
+  /** The entry's file mode, e.g. `100644` — `160000` for a gitlink. */
+  readonly mode: Schema.String;
+  /** The staged object id. */
+  readonly oid: Schema.String;
+  /** The merge stage: `0` normally; `1`/`2`/`3` during an unresolved merge. */
+  readonly stage: Schema.Number;
+  /** The entry's path, relative to `cwd`. May contain spaces or newlines. */
+  readonly path: Schema.String;
+}>, {}>;
+/**
+ * One index (staging area) entry, from `git ls-files --stage`.
+ *
+ * @remarks
+ * The index-side sibling of {@link LsTreeEntry}: this is the ONLY place a
+ * staged-but-uncommitted gitlink (`mode` `160000`) is visible — `lsTree`
+ * reads the committed tree and misses exactly that window.
+ *
+ * @public
+ */
+declare class LsFilesEntry extends LsFilesEntry_base {}
 /**
  * The {@link Git} service shape.
  *
@@ -3529,6 +3819,115 @@ interface GitShape {
     readonly remote?: string;
     readonly depth?: number;
   }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git fetch --unshallow <remote>` — converts a shallow clone
+   * into a complete one by fetching all missing history from
+   * `options.remote` (default `origin`).
+   *
+   * `--unshallow` is a distinct mode, not a depth value: **git rejects it in
+   * a repository that is not shallow**, with
+   * `--unshallow on a complete repository does not make sense` — and this
+   * method deliberately does NOT tolerate that; the failure surfaces typed
+   * as `GitCommandError`, because swallowing it would also swallow every
+   * other fetch failure shape. The caller owns the guard: probe with
+   * `isShallow` first and skip the fetch when the repository is already
+   * complete.
+   */
+  readonly fetchUnshallow: (cwd: string, options?: {
+    readonly remote?: string;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git rev-parse --is-shallow-repository` — whether the repository is a
+   * shallow clone.
+   *
+   * A dedicated predicate, deliberately not folded into `revParse`: that
+   * method's contract is "resolve this REF"; this one takes no ref and
+   * answers a repository-shape question. The intended pairing is
+   * `isShallow` → `fetchUnshallow`.
+   */
+  readonly isShallow: (cwd: string) => Effect.Effect<boolean, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git reset --soft|--mixed|--hard [<ref>]` — moves `HEAD` (and,
+   * per `options.mode`, the index and working tree) to `options.ref`
+   * (default `HEAD`, i.e. unstage/discard against the current commit).
+   *
+   * The restore-before-retry primitive: **a failed reset fails loudly and
+   * typed** (`GitCommandError` on any non-zero exit), never a silent no-op —
+   * a reset that silently did nothing would hand a retry of a
+   * non-idempotent operation the same dirty tree. `mode` defaults to
+   * `"mixed"` (git's own default), emitted explicitly in the argv.
+   */
+  readonly reset: (cwd: string, options?: {
+    readonly mode?: "soft" | "mixed" | "hard";
+    readonly ref?: string;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git clean --force [-d] [-x] [-- <paths>...]` — deletes
+   * untracked files (and, with `options.directories`, untracked directories;
+   * with `options.ignored`, ignored files too), optionally scoped to
+   * `options.paths`.
+   *
+   * `--force` is unconditional: this member exists so a consumer can restore
+   * a tree to a known state before retrying a non-idempotent operation, and
+   * without it git refuses to clean under the default `clean.requireForce`
+   * config — **a clean that silently did nothing corrupts the retry**. Any
+   * non-zero exit fails loudly as `GitCommandError`.
+   */
+  readonly clean: (cwd: string, options?: {
+    readonly directories?: boolean;
+    readonly ignored?: boolean;
+    readonly paths?: ReadonlyArray<string>;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git restore [--source <ref>] [--staged] [--worktree] -- <paths...>`
+   * — restores `paths` from the index, or from `options.source`. The
+   * `checkout -- .`-shaped operation: `restore(cwd, ["."])` discards all
+   * unstaged working-tree changes.
+   *
+   * A separate member deliberately, because `checkout`'s option-injection
+   * guard refuses `--` and option-like refs by design and stays that way.
+   * `restore`'s paths always sit behind a literal `--`, so they are
+   * injection-safe by construction; only `options.source` is a guarded ref.
+   * With neither `staged` nor `worktree` set, git restores the working tree.
+   */
+  readonly restore: (cwd: string, paths: ReadonlyArray<string>, options?: {
+    readonly source?: string;
+    readonly staged?: boolean;
+    readonly worktree?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git branch [-f] <name> [<start-point>]` — creates a branch,
+   * optionally from `options.startPoint`; `options.checkout` switches to it
+   * on creation (`git checkout -b <name> [<start-point>]`), and
+   * `options.force` resets the branch if it already exists (`branch -f`,
+   * or `checkout -B` with `checkout`).
+   *
+   * Branch creation is a branch-member concern, not a `checkout` option:
+   * `checkout`'s contract stays "move to an existing ref" with its
+   * option-like-ref refusal intact. Both `name` and `startPoint` are
+   * guarded — an option-like value is refused typed before any spawn.
+   *
+   * `force` with `checkout` replaces the delete-then-create longhand — a
+   * swallowed `branchDelete(force: true)` followed by a plain create —
+   * which papers over a real edge: `git branch -D` refuses to delete the
+   * currently checked-out branch, so on a runner already sitting on that
+   * branch the swallowed delete fails and the create then fails for real.
+   * `checkout -B` handles both states in one invocation.
+   */
+  readonly branchCreate: (cwd: string, name: string, options?: {
+    readonly startPoint?: string;
+    readonly checkout?: boolean;
+    readonly force?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git branch -d <name>` (or `-D` with `options.force`) —
+   * deletes a local branch. The default `-d` refuses a branch that is not
+   * fully merged — a typed `GitCommandError`, which is usually the honest
+   * answer; `force: true` deletes regardless.
+   */
+  readonly branchDelete: (cwd: string, name: string, options?: {
+    readonly force?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
   /**
    * Mutating: `git submodule update [--init] [--depth <n>] [-- <paths>...]`
    * — updates registered submodules in the working tree, optionally
@@ -3550,6 +3949,85 @@ interface GitShape {
     readonly path: string;
     readonly depth?: number;
   }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git submodule status [--recursive] [-- <paths>...]` — one
+   * {@link SubmoduleStatusEntry} per registered submodule, decoding git's
+   * state prefix (`current` / `uninitialized` / `outOfSync` / `conflict`).
+   *
+   * The output is line-based (git offers no `-z` mode here), so a submodule
+   * path containing a newline would corrupt the parse — a git-imposed
+   * limitation, recorded on the entry class.
+   */
+  readonly submoduleStatus: (cwd: string, options?: {
+    readonly paths?: ReadonlyArray<string>;
+    readonly recursive?: boolean;
+  }) => Effect.Effect<ReadonlyArray<SubmoduleStatusEntry>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git submodule init [-- <paths>...]` — registers submodules
+   * from `.gitmodules` into `.git/config` (all of them, or only
+   * `options.paths`) without cloning or checking anything out.
+   */
+  readonly submoduleInit: (cwd: string, options?: {
+    readonly paths?: ReadonlyArray<string>;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git submodule deinit [--force] (--all | -- <paths>...)` —
+   * unregisters submodules: clears their working trees and removes their
+   * `.git/config` registration. Requires either `options.paths` or
+   * `options.all: true`; neither is refused typed before any spawn, exactly
+   * as git itself would refuse it. `options.force` discards local changes
+   * in the submodule working tree.
+   */
+  readonly submoduleDeinit: (cwd: string, options: {
+    readonly paths?: ReadonlyArray<string>;
+    readonly all?: boolean;
+    readonly force?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git submodule sync [--recursive] [-- <paths>...]` — re-copies
+   * each submodule's URL from `.gitmodules` into `.git/config` (and the
+   * submodule's own `remote.origin.url`), so a `.gitmodules` URL change
+   * actually reaches git's live configuration.
+   */
+  readonly submoduleSync: (cwd: string, options?: {
+    readonly paths?: ReadonlyArray<string>;
+    readonly recursive?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git submodule set-url -- <path> <url>` — rewrites the
+   * submodule's URL in `.gitmodules` and synchronizes it into `.git/config`.
+   *
+   * The url never surfaces raw in an error — an embedded `userinfo@`
+   * credential is masked in `GitCommandError.args`/`.message` — and the
+   * method's span annotates `cwd` and `path` only.
+   */
+  readonly submoduleSetUrl: (cwd: string, path: string, url: string) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git submodule set-branch (--branch <branch> | --default) -- <path>`
+   * — records the branch the submodule tracks in `.gitmodules`, or clears
+   * it back to the default when `options.branch` is omitted.
+   */
+  readonly submoduleSetBranch: (cwd: string, path: string, options?: {
+    readonly branch?: string;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git submodule absorbgitdirs [-- <paths>...]` — moves each
+   * submodule's embedded `.git` directory into the superproject's
+   * `.git/modules/` and leaves a gitfile pointer behind.
+   */
+  readonly submoduleAbsorbgitdirs: (cwd: string, options?: {
+    readonly paths?: ReadonlyArray<string>;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git submodule foreach [--recursive] <command>` — runs one
+   * shell command string in every checked-out submodule and returns the
+   * collected stdout. The command can mutate anything, which is why the
+   * method is marked mutating regardless of what it runs; a command
+   * beginning with `-` is refused typed before any spawn.
+   */
+  readonly submoduleForeach: (cwd: string, command: string, options?: {
+    readonly recursive?: boolean;
+  }) => Effect.Effect<string, GitCommandError | NotARepositoryError | UnknownRefError>;
   /**
    * Mutating: `git sparse-checkout set (--cone | --no-cone) <patterns...>`
    * — rewrites which paths are checked out in the working tree to
@@ -3562,6 +4040,10 @@ interface GitShape {
    * Mutating: `git config [-f <file>] <key> <value>` — writes `value` for
    * `key` into the repository config, or into `options.file` when given
    * (e.g. `.gitmodules`).
+   *
+   * The value never surfaces in an error: a failing `configSet` carries
+   * `<redacted>` in `GitCommandError.args` and `.message`, and the method's
+   * span annotates `key` and `file` only.
    */
   readonly configSet: (cwd: string, key: string, value: string, options?: {
     readonly file?: string;
@@ -3622,21 +4104,296 @@ interface GitShape {
   readonly commitInfo: (cwd: string, ref?: string) => Effect.Effect<CommitInfo, GitCommandError | NotARepositoryError | UnknownRefError>;
   /** `git status --porcelain -z` — the working tree's porcelain status listing. */
   readonly status: (cwd: string) => Effect.Effect<ReadonlyArray<StatusEntry>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git ls-remote [--heads] [--tags] <remote> [<patterns>...]` — the refs
+   * `remote` advertises, as {@link LsRemoteEntry} values, optionally
+   * filtered to branch heads and/or tags and/or shell-glob patterns.
+   *
+   * The one read that talks to the NETWORK. Auth failure and an unreachable
+   * remote stay {@link GitCommandError} deliberately — no consumer branches
+   * on them, so they carry no dedicated type. The validate-before-mutate
+   * consumer story: look for the wanted ref in the listing, and on a miss
+   * hand the entries to `LsRemoteEntry.nearMatches` for a suggestion (the
+   * monorepo-prefixed-tag case, `effect@<ref>`). `remote` may be a URL; an
+   * embedded credential never surfaces in an error value.
+   */
+  readonly lsRemote: (cwd: string, remote: string, options?: {
+    readonly heads?: boolean;
+    readonly tags?: boolean;
+    readonly patterns?: ReadonlyArray<string>;
+  }) => Effect.Effect<ReadonlyArray<LsRemoteEntry>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git remote add <name> <url>` — registers a new remote.
+   * `url`'s embedded credential (if any) never surfaces in an error value,
+   * and the method's span annotates `name` only.
+   */
+  readonly remoteAdd: (cwd: string, name: string, url: string) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git remote remove <name>` — deletes a remote, its
+   * remote-tracking refs and its configuration. A missing remote fails
+   * loudly as {@link GitCommandError} — probe with `remoteUrl` first when
+   * idempotency is wanted.
+   */
+  readonly remoteRemove: (cwd: string, name: string) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git remote set-url <name> <url>` — rewrites a remote's fetch
+   * URL. `url`'s embedded credential (if any) never surfaces in an error
+   * value, and the method's span annotates `name` only.
+   */
+  readonly remoteSetUrl: (cwd: string, name: string, url: string) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git stash push [--include-untracked] [-m <message>] [-- <paths>...]`
+   * — saves the working-tree (and index) state onto the stash stack and
+   * resets the tree to `HEAD`.
+   */
+  readonly stashPush: (cwd: string, options?: {
+    readonly message?: string;
+    readonly includeUntracked?: boolean;
+    readonly paths?: ReadonlyArray<string>;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git stash pop [stash@{n}]` — applies a stash entry
+   * (`options.index`, default the latest) and drops it on success.
+   *
+   * The two branchable failures are typed: {@link DirtyWorktreeError} when
+   * local changes would be overwritten (the tree is untouched), and
+   * {@link MergeConflictError} when the apply stopped on conflicts — in
+   * that case the stash entry is KEPT, and the caller owns resolving. A
+   * non-integer index is refused typed before any spawn.
+   */
+  readonly stashPop: (cwd: string, options?: {
+    readonly index?: number;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError | MergeConflictError | DirtyWorktreeError>;
+  /**
+   * Mutating: `git stash apply [stash@{n}]` — applies a stash entry and
+   * keeps it on the stack. Fails exactly like `stashPop`
+   * ({@link DirtyWorktreeError} / {@link MergeConflictError} are the
+   * branchable shapes).
+   */
+  readonly stashApply: (cwd: string, options?: {
+    readonly index?: number;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError | MergeConflictError | DirtyWorktreeError>;
+  /**
+   * Mutating: `git stash drop [stash@{n}]` — deletes a stash entry
+   * (`options.index`, default the latest) without applying it.
+   */
+  readonly stashDrop: (cwd: string, options?: {
+    readonly index?: number;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git stash list -z --format=%gd%x1f%H%x1f%gs` — every stash entry as a
+   * {@link StashEntry} (reflog selector, sha, subject). The entry's
+   * position in the returned array IS its current index — `entries[2]` is
+   * `stash@{2}` — which is what the index-taking stash methods consume.
+   */
+  readonly stashList: (cwd: string) => Effect.Effect<ReadonlyArray<StashEntry>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git branch --list [--remotes | --all]` — every branch as a
+   * {@link BranchEntry} (short name, tip sha, current marker), via the
+   * NUL-separated for-each-ref format. `all` wins when both flags are set.
+   */
+  readonly branchList: (cwd: string, options?: {
+    readonly remotes?: boolean;
+    readonly all?: boolean;
+  }) => Effect.Effect<ReadonlyArray<BranchEntry>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git tag [--force] [-m <message>] <name> [<ref>]` — creates a
+   * lightweight tag at `options.ref` (default `HEAD`), or an annotated one
+   * when `options.message` is given. An existing tag fails loudly unless
+   * `options.force` is set.
+   */
+  readonly tagCreate: (cwd: string, name: string, options?: {
+    readonly ref?: string;
+    readonly message?: string;
+    readonly force?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /** Mutating: `git tag --delete <name>` — deletes a local tag. */
+  readonly tagDelete: (cwd: string, name: string) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git tag --list [<pattern>]` — tag names, optionally filtered by a
+   * shell-glob `options.pattern`.
+   */
+  readonly tagList: (cwd: string, options?: {
+    readonly pattern?: string;
+  }) => Effect.Effect<ReadonlyArray<string>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git for-each-ref [<patterns>...]` — every matching ref as a
+   * {@link RefEntry} (full refname, sha, object type), via this package's
+   * fixed `%(refname)%00%(objectname)%00%(objecttype)` format.
+   */
+  readonly forEachRef: (cwd: string, options?: {
+    readonly patterns?: ReadonlyArray<string>;
+  }) => Effect.Effect<ReadonlyArray<RefEntry>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git rev-list [--max-count=<n>] [--first-parent] <ref>` — the commit
+   * shas reachable from `ref` (which may be a range, `main..feat`), newest
+   * first. A non-integer `options.limit` is refused typed before any spawn.
+   */
+  readonly revList: (cwd: string, ref: string, options?: {
+    readonly limit?: number;
+    readonly firstParent?: boolean;
+  }) => Effect.Effect<ReadonlyArray<string>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git commit [--all] [--allow-empty] [--amend] [--author=<author>] -m <message>`
+   * — records a commit. The message rides argv; committer identity comes
+   * from the caller's ENVIRONMENT (this package sets only `LC_ALL`), and
+   * `options.author` is the explicit `--author=` override. "Nothing to
+   * commit" fails loudly as {@link GitCommandError}.
+   */
+  readonly commit: (cwd: string, message: string, options?: {
+    readonly all?: boolean;
+    readonly allowEmpty?: boolean;
+    readonly amend?: boolean;
+    readonly author?: string;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git push [--force | --force-with-lease] [--tags] [--set-upstream] <remote> [<refspec>]`
+   * — updates remote refs.
+   *
+   * A rejected push — the remote moved (`fetch first` /
+   * `non-fast-forward`), or a `--force-with-lease` lease failure
+   * (`stale info`) — fails typed as {@link NonFastForwardError}, the signal
+   * a fetch-then-retry fallback branches on. Every other failure stays
+   * {@link GitCommandError}. `remote` may be a URL; an embedded credential
+   * never surfaces in an error value.
+   */
+  readonly push: (cwd: string, options?: {
+    readonly remote?: string;
+    readonly refspec?: string;
+    readonly force?: boolean;
+    readonly forceWithLease?: boolean;
+    readonly tags?: boolean;
+    readonly setUpstream?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError | NonFastForwardError>;
+  /**
+   * Mutating: `git pull [--rebase] [--ff-only] <remote> [<ref>]` — fetches
+   * and integrates.
+   *
+   * The two branchable failures are typed: {@link DirtyWorktreeError} when
+   * local modifications block the merge before it starts (the tree is
+   * untouched — commit or stash first), and {@link MergeConflictError} when
+   * the merge stopped on conflicts (markers are in the tree; resolve or
+   * abort). `remote` may be a URL; an embedded credential never surfaces in
+   * an error value.
+   */
+  readonly pull: (cwd: string, options?: {
+    readonly remote?: string;
+    readonly ref?: string;
+    readonly rebase?: boolean;
+    readonly ffOnly?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError | MergeConflictError | DirtyWorktreeError>;
+  /**
+   * `git config [-f <file>] --list -z` — every configuration entry in scope
+   * (or in `options.file` only) as {@link ConfigListEntry} values. `-z`
+   * keeps multi-line values lossless.
+   */
+  readonly configList: (cwd: string, options?: {
+    readonly file?: string;
+  }) => Effect.Effect<ReadonlyArray<ConfigListEntry>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git config [-f <file>] --get-all -z <key>` — every value of a
+   * (possibly multi-valued) key, in order. An unset key degrades to the
+   * empty array, never an error — the multi-valued sibling of `configGet`'s
+   * `Option.none`.
+   */
+  readonly configGetAll: (cwd: string, key: string, options?: {
+    readonly file?: string;
+  }) => Effect.Effect<ReadonlyArray<string>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git config [-f <file>] (--unset | --unset-all) <key>` —
+   * removes `key` (or, with `options.all`, every value of a multi-valued
+   * key). Unsetting a key that was never set fails LOUDLY (git exits 5) —
+   * an unset that silently did nothing is indistinguishable from one that
+   * worked; probe with `configGet` first when idempotency is wanted.
+   */
+  readonly configUnset: (cwd: string, key: string, options?: {
+    readonly file?: string;
+    readonly all?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git rm [--cached] [-r] [--force] -- <paths...>` — removes
+   * `paths` from the index and (without `options.cached`) the working tree.
+   * `cached: true` is the unstage-but-keep-file form a submodule removal
+   * sequence needs.
+   */
+  readonly rm: (cwd: string, paths: ReadonlyArray<string>, options?: {
+    readonly cached?: boolean;
+    readonly recursive?: boolean;
+    readonly force?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git mv [--force] -- <source> <destination>` — moves or
+   * renames a tracked path, updating the index and the working tree
+   * together.
+   */
+  readonly mv: (cwd: string, source: string, destination: string, options?: {
+    readonly force?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git check-ignore -z --stdin` — the subset of `paths` git would ignore,
+   * predicate-shaped: paths in, the ignored ones back. Paths are fed via
+   * STDIN (NUL-separated both directions), so nothing caller-controlled
+   * enters the argv and special-character paths survive unquoted. No path
+   * ignored degrades to the empty array, never an error.
+   */
+  readonly checkIgnore: (cwd: string, paths: ReadonlyArray<string>) => Effect.Effect<ReadonlyArray<string>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git worktree add [--force] [--detach] <path> [<ref>]` —
+   * creates a linked working tree at `path`, checked out at `options.ref`
+   * (or a branch named after `path`'s basename).
+   */
+  readonly worktreeAdd: (cwd: string, path: string, options?: {
+    readonly ref?: string;
+    readonly detach?: boolean;
+    readonly force?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git worktree list --porcelain -z` — every working tree (the main one
+   * first) as a {@link WorktreeEntry}.
+   */
+  readonly worktreeList: (cwd: string) => Effect.Effect<ReadonlyArray<WorktreeEntry>, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * Mutating: `git worktree remove [--force] <path>` — removes a linked
+   * working tree. A dirty worktree fails loudly unless `options.force` is
+   * set.
+   */
+  readonly worktreeRemove: (cwd: string, path: string, options?: {
+    readonly force?: boolean;
+  }) => Effect.Effect<void, GitCommandError | NotARepositoryError | UnknownRefError>;
+  /**
+   * `git ls-files --stage -z [-- <pathspec>...]` — every INDEX entry as an
+   * {@link LsFilesEntry} (mode, oid, merge stage, path), optionally scoped
+   * to `options.pathspec`.
+   *
+   * The index-side sibling of `lsTree`: the only read that sees a
+   * staged-but-uncommitted gitlink (`160000 <oid> 0 <path>`) — the state a
+   * stage-without-commit window (a submodule pin/add) deliberately
+   * produces, which a HEAD-side `lsTree` misreports.
+   */
+  readonly lsFiles: (cwd: string, options?: {
+    readonly pathspec?: ReadonlyArray<string>;
+  }) => Effect.Effect<ReadonlyArray<LsFilesEntry>, GitCommandError | NotARepositoryError | UnknownRefError>;
 }
 declare const Git_base: Context.ServiceClass<Git, "@effected/git/Git", GitShape>;
 /**
  * Typed git introspection over core's `ChildProcessSpawner`: read a
- * repository's state at any ref without checking it out, plus the mutating
- * tier (`checkout`, `fetch`, `fetchAny`, `submoduleUpdate`, `submoduleAdd`,
- * `sparseCheckoutSet`, `configSet`, `add`) that changes it.
+ * repository's state at any ref without checking it out (including the
+ * network read `lsRemote` and the index read `lsFiles`), plus the mutating
+ * tier — checkout/fetch, the working-tree restore trio and stash, branches
+ * and tags, remotes, worktrees, commit/push/pull, submodules,
+ * sparse-checkout, config writes and staging — that changes it. Every
+ * mutating method's TSDoc opens with the literal word `Mutating:`.
  *
  * @remarks
  * Every method takes `cwd` explicitly and classifies git's stderr/exit-code
  * taxonomy exactly once, in this module's private `classify` step — a
  * spawn-level `PlatformError` and `Cause.TimeoutError` never escape a `Git`
  * method; every failure surfaces as {@link GitCommandError},
- * {@link NotARepositoryError}, or {@link UnknownRefError}, or degrades to
- * the documented non-error (`Option.none`, `false`).
+ * {@link NotARepositoryError}, {@link UnknownRefError}, or one of the three
+ * consumer-branchable classifications ({@link NonFastForwardError} from
+ * `push`; {@link MergeConflictError} and {@link DirtyWorktreeError} from the
+ * merge-shaped `pull` / `stashPop` / `stashApply`), or degrades to the
+ * documented non-error (`Option.none`, `false`, the empty array).
  *
  * Every method whose TSDoc opens "Mutating:" changes the working tree,
  * `HEAD`, the index, the repository config, the object database and
@@ -3645,6 +4402,12 @@ declare const Git_base: Context.ServiceClass<Git, "@effected/git/Git", GitShape>
  * that — a caller running two mutating calls (or a mutating call alongside a
  * read) against one `cwd` at once owns the race.
  *
+ * **Redaction policy (documented, not just convention).** Error values
+ * persist only the constructor's REDACTED argv (see `GitCommandError.args`),
+ * and span annotations carry stable identifiers only — `cwd`, refs, keys,
+ * paths, remote names — never config values and never URLs, which can embed
+ * userinfo. A new method must follow both halves before it ships.
+ *
  * @public
  */
 declare class Git extends Git_base {
@@ -3656,7 +4419,7 @@ declare class Git extends Git_base {
    *
    * @remarks
    * Unlike `WorkspaceDiscovery.makeTest`, **no method here has an honest
-   * default** — the shape is twenty-six unrelated git operations, and a
+   * default** — the shape is unrelated git operations, and a
    * fabricated answer for any of them (an empty tree, a made-up sha, a silent
    * no-op `checkout`) would leak into consumer logic as fact. So every
    * unstubbed method fails loudly as a defect
@@ -4395,7 +5158,7 @@ declare class UnsatisfiableConstraintError extends UnsatisfiableConstraintError_
   get message(): string;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/index.d.ts
+//#region ../../node_modules/.pnpm/@effected+npm@0.8.3_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/index.d.ts
 //#region src/CatalogAssemblyError.d.ts
 declare const CatalogAssemblyError_base: Schema.Class<CatalogAssemblyError, Schema.TaggedStruct<"CatalogAssemblyError", {
   /**
@@ -4969,7 +5732,7 @@ declare class GlobPattern extends GlobPattern_base {
   static readonly FromString: Schema.Codec<GlobPattern, string>;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._ff048038a9678f5144f817ad24d8f96e/node_modules/@effected/lockfiles/index.d.ts
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.3.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+npm@0._3c1784fba62fde9a5bac4cf15387fd04/node_modules/@effected/lockfiles/index.d.ts
 //#region src/BunExtension.d.ts
 declare const BunExtension_base: Schema.Class<BunExtension, Schema.Struct<{
   readonly _tag: Schema.tag<"bun">;
@@ -5981,7 +6744,7 @@ declare class Package extends Package_base {
   toJsonString(options?: PackageFormatOptions): string;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.9.5_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/index.d.ts
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/index.d.ts
 //#region src/WorkspacePackage.d.ts
 declare const PublishConfig_base: Schema.Class<PublishConfig, Schema.Struct<{
   /** Scoped-package visibility. Its presence overrides `private`. */
@@ -6748,6 +7511,58 @@ declare class ConfigDependencyHooks extends ConfigDependencyHooks_base {
    * `WorkspaceCatalogs.layerWithConfigDependencies`.
    */
   static readonly layerLive: Layer.Layer<ConfigDependencyHooks>;
+  /**
+   * The subprocess layer: replays each config dependency's pnpmfile in a `node`
+   * child process instead of an in-process dynamic `import()`, with identical
+   * typed semantics to {@link ConfigDependencyHooks.layerLive} — the two are
+   * drop-in interchangeable.
+   *
+   * @remarks
+   * `layerLive` computes the `import()` path at runtime, and a bundler (rspack,
+   * for one) compiles a *computed* dynamic import into a context module that
+   * throws `Cannot find module 'file:///…'` at runtime — so in any bundled
+   * consumer, a GitHub Action above all, the in-process replay is unreachable.
+   * This layer keeps every computed load out of the bundle graph: the replay
+   * program is a **static** string constant passed via argv
+   * (`node --input-type=module -e <script> <root> <seed> <...names>`), and the
+   * child process performs the computed imports where no bundler rewrote them.
+   * A subprocess also keeps config-dependency code out of the consumer's own
+   * process.
+   *
+   * The contract's semantics are unchanged, not the downstream fail-open shape:
+   * an empty `configDependencies` returns the seed without spawning anything; a
+   * `..` path segment in a dependency name fails typed **before** any spawn; a
+   * missing pnpmfile (neither `.mjs` nor `.cjs`) is the one legitimate skip,
+   * discriminated inside the child by `err.url` equality exactly as
+   * `layerLive` discriminates in process; any other load failure — a syntax
+   * error, a throwing top level, an `ERR_MODULE_NOT_FOUND` for a module the
+   * pnpmfile itself imports — and a hook that throws when called are serialized
+   * back per-name and surface typed as a `hooks`-source `CatalogAssemblyError`
+   * naming that dependency. A hook's returned *data* stays tolerantly threaded
+   * (last well-formed write wins), never fatal. Spawn and transport failures —
+   * `node` absent, a non-zero exit without a result payload, unparseable
+   * output — fail typed too, never a defect and never a silent skip.
+   *
+   * Two bounds this layer imposes that `layerLive` cannot: the replay is
+   * given thirty seconds (a pnpmfile that loops or awaits forever fails typed
+   * instead of hanging the memoized assemble pass — a subprocess is killable,
+   * while `layerLive`'s in-process synchronous hook call is not interruptible
+   * by any means, so the asymmetry is inherent, not a parity violation), and
+   * the child's stdout is captured under `Run.jsonLine`'s 16 MiB default
+   * ceiling (a hook that logs more than that fails typed as `tooLarge`, where
+   * `layerLive` — which captures nothing — would succeed).
+   *
+   * Catalog folding and normalization stay in the **parent** (the same
+   * `@pnpm/catalogs`-derived path `layerLive` uses); the child returns only the
+   * raw threaded config slice, since the script cannot import kit code.
+   *
+   * Requires core's `ChildProcessSpawner`, resolved when the layer is built —
+   * the consumer provides it once at the edge (`@effect/platform-node`'s
+   * `NodeServices.layer`), the same discharge `@effected/git` uses. Wired by
+   * `WorkspaceCatalogs.layerWithConfigDependenciesSubprocess` /
+   * `Workspaces.layerWithConfigDependenciesSubprocess`.
+   */
+  static readonly layerSubprocess: Layer.Layer<ConfigDependencyHooks, never, ChildProcessSpawner.ChildProcessSpawner>;
 }
 declare const DetectedPackageManager_base: Schema.Class<DetectedPackageManager, Schema.Struct<{
   /** The detected manager. */
@@ -7480,6 +8295,24 @@ declare class WorkspaceCatalogs extends WorkspaceCatalogs_base {
    * Parameterized, so bind it to a `const` and reuse it.
    */
   static readonly layerWithConfigDependencies: (options?: WorkspaceCatalogsOptions) => Layer.Layer<WorkspaceCatalogs, never, WorkspaceRoot | LockfileReader | FileSystem.FileSystem | Path.Path>;
+  /**
+   * The opt-in layer that replays config-dependency `pnpmfile` hooks in a
+   * `node` **child process**: it wires
+   * {@link ConfigDependencyHooks.layerSubprocess} in place of the in-process
+   * `layerLive`.
+   *
+   * @remarks
+   * Same typed semantics as {@link WorkspaceCatalogs.layerWithConfigDependencies}
+   * — the two hook layers are drop-in interchangeable — but the replay's
+   * computed dynamic `import()` runs in the subprocess, so it survives bundling
+   * (a bundler compiles a computed in-process `import()` into a context module
+   * that cannot resolve at runtime — every bundled GitHub Action hits this).
+   * The cost is one extra requirement: core's `ChildProcessSpawner`, provided
+   * once at the edge (`@effect/platform-node`'s `NodeServices.layer`) — the
+   * same sanctioned R-widening as `Workspaces.layerWithGit`. Parameterized, so
+   * bind it to a `const` and reuse it.
+   */
+  static readonly layerWithConfigDependenciesSubprocess: (options?: WorkspaceCatalogsOptions) => Layer.Layer<WorkspaceCatalogs, never, WorkspaceRoot | LockfileReader | FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner>;
   /**
    * A test double satisfying the full {@link WorkspaceCatalogsShape} with no
    * filesystem, lockfile read, or hook replay.