@savvy-web/silk 3.4.2 → 3.5.0

package/changesets-changelog.js

@@ -2410,7 +2410,7 @@ var BunExtension = class extends Schema.Class("BunExtension")({
 *
 * @public
 */
-var CatalogResolver$1 = class CatalogResolver extends Context.Service()("@effected/npm/CatalogResolver") {
+var CatalogResolver = class CatalogResolver extends Context.Service()("@effected/npm/CatalogResolver") {
 	/**
 	* No-op default: `rangeOf` always succeeds with `Option.none()`, never
 	* consulting an actual catalog. A pure `Layer.succeed`, bound to a const
@@ -2435,7 +2435,7 @@ var CatalogResolver$1 = class CatalogResolver extends Context.Service()("@effect
 *
 * @public
 */
-var DependencyResolutionError$1 = class extends Schema.TaggedErrorClass()("DependencyResolutionError", {
+var DependencyResolutionError = class extends Schema.TaggedErrorClass()("DependencyResolutionError", {
 	specifier: Schema.String,
 	cause: Schema.Defect()
 }) {
@@ -2473,7 +2473,7 @@ var DependencyResolutionError$1 = class extends Schema.TaggedErrorClass()("Depen
 *
 * @public
 */
-var WorkspaceResolver$1 = class WorkspaceResolver extends Context.Service()("@effected/npm/WorkspaceResolver") {
+var WorkspaceResolver = class WorkspaceResolver extends Context.Service()("@effected/npm/WorkspaceResolver") {
 	/**
 	* No-op default: `versionOf` always succeeds with `Option.none()`, never
 	* consulting an actual workspace. A pure `Layer.succeed`, bound to a
@@ -2535,7 +2535,7 @@ var CatalogAssemblyError = class extends Schema.TaggedErrorClass()("CatalogAssem
 *
 * @public
 */
-const DependencyKind$1 = Schema.Literals([
+const DependencyKind = Schema.Literals([
 	"prod",
 	"dev",
 	"peer",
@@ -2547,19 +2547,19 @@ const DependencyKind$1 = Schema.Literals([
 *
 * @public
 */
-const DependencyField$1 = Schema.Literals([
+const DependencyField = Schema.Literals([
 	"dependencies",
 	"devDependencies",
 	"peerDependencies",
 	"optionalDependencies"
 ]);
-const KIND_TO_FIELD$1 = {
+const KIND_TO_FIELD = {
 	prod: "dependencies",
 	dev: "devDependencies",
 	peer: "peerDependencies",
 	optional: "optionalDependencies"
 };
-const FIELD_TO_KIND$1 = Object.fromEntries(Object.entries(KIND_TO_FIELD$1).map(([kind, field]) => [field, kind]));
+const FIELD_TO_KIND = Object.fromEntries(Object.entries(KIND_TO_FIELD).map(([kind, field]) => [field, kind]));
 
 //#endregion
 //#region ../../node_modules/.pnpm/@effected+semver@0.3.2_effect@4.0.0-beta.101/node_modules/@effected/semver/internal/desugar.js
@@ -2937,7 +2937,7 @@ const parseRangeComparators = (s) => {
 * Parse a range expression into comparator sets (OR of ANDs). The empty
 * string parses as the match-all range.
 */
-const parseRange$2 = (raw) => {
+const parseRange$1 = (raw) => {
 	const trimmed = raw.trim();
 	if (trimmed.length === 0) return {
 		ok: true,
@@ -3841,7 +3841,7 @@ sets: Schema.Array(Schema.Array(Comparator)) }) {
 	*/
 	static FromString = Schema.String.pipe(Schema.decodeTo(Range, SchemaTransformation.transformOrFail({
 		decode: (input) => {
-			const result = parseRange$2(input);
+			const result = parseRange$1(input);
 			return result.ok ? Effect.succeed({ sets: normalizeSets(result.value) }) : Effect.fail(new SchemaIssue.InvalidValue(Option.some(input), { message: `Invalid range expression: "${result.input}" at position ${result.position}` }));
 		},
 		encode: (parts) => Effect.succeed(formatRange(parts.sets))
@@ -3872,7 +3872,7 @@ sets: Schema.Array(Schema.Array(Comparator)) }) {
 	* with {@link InvalidRangeError}.
 	*/
 	static parseResult(input) {
-		const result = parseRange$2(input);
+		const result = parseRange$1(input);
 		if (!result.ok) return Result.fail(new InvalidRangeError({
 			input: result.input,
 			position: result.position
@@ -4161,50 +4161,50 @@ const isComparatorSetSubset = (sub, sup) => {
 *
 * @public
 */
-var InvalidDependencySpecifierError$1 = class extends Schema.TaggedErrorClass()("InvalidDependencySpecifierError", { 
+var InvalidDependencySpecifierError = class extends Schema.TaggedErrorClass()("InvalidDependencySpecifierError", { 
 /** The raw input string that failed validation. */
 input: Schema.String }) {
 	get message() {
 		return `Invalid dependency specifier "${this.input}": not a recognized specifier`;
 	}
 };
-const CATALOG_PREFIX$1 = "catalog:";
-const WORKSPACE_PREFIX$1 = "workspace:";
-const isBarePath$1 = (value) => value.startsWith("./") || value.startsWith("../") || value.startsWith("~/") || value.startsWith("/");
-const isGitHubShorthand$1 = (value) => !value.startsWith(".") && !value.startsWith("~") && !value.startsWith("/") && /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+(#.*)?$/.test(value);
-const isGit$1 = (value) => value.startsWith("git+") || value.startsWith("git://") || value.startsWith("github:") || value.startsWith("gist:") || value.startsWith("bitbucket:") || value.startsWith("gitlab:") || isGitHubShorthand$1(value);
-const isLocal$1 = (value) => value.startsWith("file:") || value.startsWith("link:") || value.startsWith("portal:") || isBarePath$1(value);
-const isLink$1 = (value) => value.startsWith("link:");
-const isPortal$1 = (value) => value.startsWith("portal:");
-const isCatalog$1 = (value) => value.startsWith(CATALOG_PREFIX$1);
-const isWorkspace$1 = (value) => value.startsWith(WORKSPACE_PREFIX$1);
-const isUrl$2 = (value) => value.startsWith("http://") || value.startsWith("https://");
-const parseRange$1 = (value) => {
+const CATALOG_PREFIX = "catalog:";
+const WORKSPACE_PREFIX = "workspace:";
+const isBarePath = (value) => value.startsWith("./") || value.startsWith("../") || value.startsWith("~/") || value.startsWith("/");
+const isGitHubShorthand = (value) => !value.startsWith(".") && !value.startsWith("~") && !value.startsWith("/") && /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+(#.*)?$/.test(value);
+const isGit = (value) => value.startsWith("git+") || value.startsWith("git://") || value.startsWith("github:") || value.startsWith("gist:") || value.startsWith("bitbucket:") || value.startsWith("gitlab:") || isGitHubShorthand(value);
+const isLocal = (value) => value.startsWith("file:") || value.startsWith("link:") || value.startsWith("portal:") || isBarePath(value);
+const isLink = (value) => value.startsWith("link:");
+const isPortal = (value) => value.startsWith("portal:");
+const isCatalog = (value) => value.startsWith(CATALOG_PREFIX);
+const isWorkspace = (value) => value.startsWith(WORKSPACE_PREFIX);
+const isUrl$1 = (value) => value.startsWith("http://") || value.startsWith("https://");
+const parseRange = (value) => {
 	const exit = Schema.decodeUnknownExit(Range$1.FromString)(value);
 	return Exit.isSuccess(exit) ? Option.some(exit.value) : Option.none();
 };
-const isRange$1 = (value) => Option.isSome(parseRange$1(value));
-const protocolOf$1 = (value) => {
-	if (value.startsWith(CATALOG_PREFIX$1)) return "catalog";
-	if (value.startsWith(WORKSPACE_PREFIX$1)) return "workspace";
+const isRange = (value) => Option.isSome(parseRange(value));
+const protocolOf = (value) => {
+	if (value.startsWith(CATALOG_PREFIX)) return "catalog";
+	if (value.startsWith(WORKSPACE_PREFIX)) return "workspace";
 	if (value.startsWith("link:")) return "link";
 	if (value.startsWith("portal:")) return "portal";
-	if (value.startsWith("file:") || isBarePath$1(value)) return "file";
+	if (value.startsWith("file:") || isBarePath(value)) return "file";
 	if (value.startsWith("npm:")) return "npm";
-	if (isGit$1(value)) return "git";
-	if (isUrl$2(value)) return "url";
-	if (isRange$1(value)) return "range";
+	if (isGit(value)) return "git";
+	if (isUrl$1(value)) return "url";
+	if (isRange(value)) return "range";
 	if (/^[a-zA-Z][a-zA-Z0-9._-]*$/.test(value)) return "tag";
 	return "unknown";
 };
-const isTag$1 = (value) => protocolOf$1(value) === "tag";
-const catalogNameOf$2 = (specifier) => {
-	if (!isCatalog$1(specifier)) return Option.none();
+const isTag = (value) => protocolOf(value) === "tag";
+const catalogNameOf$1 = (specifier) => {
+	if (!isCatalog(specifier)) return Option.none();
 	const rest = specifier.slice(8).trim();
 	return rest.length === 0 ? Option.none() : Option.some(rest);
 };
-const projectRangeModifier$1 = (range, version) => range === "*" || range === "" ? version : range === "~" ? `~${version}` : range === "^" ? `^${version}` : range;
-const splitWorkspaceRest$1 = (rest) => {
+const projectRangeModifier = (range, version) => range === "*" || range === "" ? version : range === "~" ? `~${version}` : range === "^" ? `^${version}` : range;
+const splitWorkspaceRest = (rest) => {
 	const at = rest.lastIndexOf("@");
 	return at > 0 ? {
 		target: rest.slice(0, at),
@@ -4214,15 +4214,15 @@ const splitWorkspaceRest$1 = (rest) => {
 		range: rest
 	};
 };
-const projectWorkspaceRange$1 = (rest, version) => {
-	const { target, range } = splitWorkspaceRest$1(rest);
-	const projected = projectRangeModifier$1(range, version);
+const projectWorkspaceRange = (rest, version) => {
+	const { target, range } = splitWorkspaceRest(rest);
+	const projected = projectRangeModifier(range, version);
 	return target === void 0 ? projected : `npm:${target}@${projected}`;
 };
-const resolveWorkspace$1 = (specifier, version) => isWorkspace$1(specifier) ? projectWorkspaceRange$1(specifier.slice(10), version) : specifier;
-const workspaceTargetOf$1 = (specifier) => {
-	if (!isWorkspace$1(specifier)) return Option.none();
-	const { target } = splitWorkspaceRest$1(specifier.slice(10));
+const resolveWorkspace = (specifier, version) => isWorkspace(specifier) ? projectWorkspaceRange(specifier.slice(10), version) : specifier;
+const workspaceTargetOf = (specifier) => {
+	if (!isWorkspace(specifier)) return Option.none();
+	const { target } = splitWorkspaceRest(specifier.slice(10));
 	return target === void 0 ? Option.none() : Option.some(target);
 };
 /**
@@ -4232,14 +4232,14 @@ const workspaceTargetOf$1 = (specifier) => {
 *
 * @public
 */
-const isValidDependencySpecifier$1 = (value) => value.length > 0 && protocolOf$1(value) !== "unknown";
+const isValidDependencySpecifier = (value) => value.length > 0 && protocolOf(value) !== "unknown";
 /**
 * A `catalog:` reference. `name` carries the catalog name, or `Option.none()`
 * for the default catalog (`catalog:`).
 *
 * @public
 */
-var CatalogSpecifier$1 = class extends Schema.TaggedClass()("catalog", {
+var CatalogSpecifier = class extends Schema.TaggedClass()("catalog", {
 	/** The original specifier string. */
 	raw: Schema.String,
 	/** The catalog name, or `Option.none()` for the default catalog. */
@@ -4251,7 +4251,7 @@ var CatalogSpecifier$1 = class extends Schema.TaggedClass()("catalog", {
 *
 * @public
 */
-var WorkspaceSpecifier$1 = class extends Schema.TaggedClass()("workspace", {
+var WorkspaceSpecifier = class extends Schema.TaggedClass()("workspace", {
 	/** The original specifier string. */
 	raw: Schema.String,
 	/** The part after `workspace:` (e.g. `*`, `^1.2.3`, or an alias form). */
@@ -4275,7 +4275,7 @@ var WorkspaceSpecifier$1 = class extends Schema.TaggedClass()("workspace", {
 	*   specifier points at (the alias target's version for the alias form).
 	*/
 	resolve(version) {
-		return projectWorkspaceRange$1(this.range, version);
+		return projectWorkspaceRange(this.range, version);
 	}
 };
 /**
@@ -4283,7 +4283,7 @@ var WorkspaceSpecifier$1 = class extends Schema.TaggedClass()("workspace", {
 *
 * @public
 */
-var RangeSpecifier$1 = class extends Schema.TaggedClass()("range", { 
+var RangeSpecifier = class extends Schema.TaggedClass()("range", { 
 /** The original specifier string. */
 raw: Schema.String }) {};
 /**
@@ -4291,7 +4291,7 @@ raw: Schema.String }) {};
 *
 * @public
 */
-var DistTagSpecifier$1 = class extends Schema.TaggedClass()("dist-tag", { 
+var DistTagSpecifier = class extends Schema.TaggedClass()("dist-tag", { 
 /** The original specifier string (also the tag name). */
 raw: Schema.String }) {};
 /**
@@ -4300,35 +4300,35 @@ raw: Schema.String }) {};
 *
 * @public
 */
-var RawSpecifier$1 = class extends Schema.TaggedClass()("raw", { 
+var RawSpecifier = class extends Schema.TaggedClass()("raw", { 
 /** The original specifier string. */
 raw: Schema.String }) {};
-const Classified$1 = Schema.Union([
-	CatalogSpecifier$1,
-	WorkspaceSpecifier$1,
-	RangeSpecifier$1,
-	DistTagSpecifier$1,
-	RawSpecifier$1
+const Classified = Schema.Union([
+	CatalogSpecifier,
+	WorkspaceSpecifier,
+	RangeSpecifier,
+	DistTagSpecifier,
+	RawSpecifier
 ]);
-const classify$2 = (value) => {
-	if (isCatalog$1(value)) return CatalogSpecifier$1.make({
+const classify$1 = (value) => {
+	if (isCatalog(value)) return CatalogSpecifier.make({
 		raw: value,
-		name: catalogNameOf$2(value)
+		name: catalogNameOf$1(value)
 	});
-	if (isWorkspace$1(value)) return WorkspaceSpecifier$1.make({
+	if (isWorkspace(value)) return WorkspaceSpecifier.make({
 		raw: value,
 		range: value.slice(10)
 	});
-	if (isRange$1(value)) return RangeSpecifier$1.make({ raw: value });
-	if (isTag$1(value)) return DistTagSpecifier$1.make({ raw: value });
-	return RawSpecifier$1.make({ raw: value });
+	if (isRange(value)) return RangeSpecifier.make({ raw: value });
+	if (isTag(value)) return DistTagSpecifier.make({ raw: value });
+	return RawSpecifier.make({ raw: value });
 };
-const fromString$1 = Schema.String.pipe(Schema.decodeTo(Classified$1, SchemaTransformation.transformOrFail({
-	decode: (input) => isValidDependencySpecifier$1(input) ? Effect.succeed(classify$2(input)) : Effect.fail(new SchemaIssue.InvalidValue(Option.some(input), { message: `Invalid dependency specifier: "${input}"` })),
+const fromString = Schema.String.pipe(Schema.decodeTo(Classified, SchemaTransformation.transformOrFail({
+	decode: (input) => isValidDependencySpecifier(input) ? Effect.succeed(classify$1(input)) : Effect.fail(new SchemaIssue.InvalidValue(Option.some(input), { message: `Invalid dependency specifier: "${input}"` })),
 	encode: (classified) => Effect.succeed(classified.raw)
 })));
-const brandedSpecifier$1 = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidDependencySpecifier$1(value) ? void 0 : "Expected a valid dependency specifier")), Schema.brand("DependencySpecifier"));
-const decode$5 = (input) => Schema.decodeUnknownEffect(brandedSpecifier$1)(input).pipe(Effect.mapError(() => new InvalidDependencySpecifierError$1({ input })));
+const brandedSpecifier = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidDependencySpecifier(value) ? void 0 : "Expected a valid dependency specifier")), Schema.brand("DependencySpecifier"));
+const decode$3 = (input) => Schema.decodeUnknownEffect(brandedSpecifier)(input).pipe(Effect.mapError(() => new InvalidDependencySpecifierError({ input })));
 /**
 * A valid dependency version specifier, carrying the protocol taxonomy statics
 * (`DependencySpecifier.protocolOf` and friends) that classify any specifier
@@ -4339,44 +4339,44 @@ const decode$5 = (input) => Schema.decodeUnknownEffect(brandedSpecifier$1)(input
 *
 * @public
 */
-const DependencySpecifier$1 = Object.assign(brandedSpecifier$1, {
-	protocolOf: protocolOf$1,
-	parseRange: parseRange$1,
-	isRange: isRange$1,
-	isTag: isTag$1,
-	isGit: isGit$1,
-	isUrl: isUrl$2,
-	isLocal: isLocal$1,
-	isLink: isLink$1,
-	isPortal: isPortal$1,
-	isCatalog: isCatalog$1,
-	isWorkspace: isWorkspace$1,
-	catalogNameOf: catalogNameOf$2,
-	resolveWorkspace: resolveWorkspace$1,
-	workspaceTargetOf: workspaceTargetOf$1,
-	isValid: isValidDependencySpecifier$1,
-	decode: decode$5,
-	FromString: fromString$1
+const DependencySpecifier = Object.assign(brandedSpecifier, {
+	protocolOf,
+	parseRange,
+	isRange,
+	isTag,
+	isGit,
+	isUrl: isUrl$1,
+	isLocal,
+	isLink,
+	isPortal,
+	isCatalog,
+	isWorkspace,
+	catalogNameOf: catalogNameOf$1,
+	resolveWorkspace,
+	workspaceTargetOf,
+	isValid: isValidDependencySpecifier,
+	decode: decode$3,
+	FromString: fromString
 });
 
 //#endregion
 //#region ../../node_modules/.pnpm/@effected+npm@0.8.3_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/IntegrityHash.js
-const SRI_RE$1 = /^(sha1|sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2}$/;
-const COREPACK_RE$1 = /^(sha1|sha224|sha256|sha384|sha512)\.[0-9a-f]+$/;
-const YARN_RE$1 = /^[0-9]+(c[0-9]+)?\/[0-9a-f]+$/;
-const isSri$1 = (value) => SRI_RE$1.test(value);
-const isCorepack$1 = (value) => COREPACK_RE$1.test(value);
-const isYarnChecksum$1 = (value) => YARN_RE$1.test(value);
+const SRI_RE = /^(sha1|sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2}$/;
+const COREPACK_RE = /^(sha1|sha224|sha256|sha384|sha512)\.[0-9a-f]+$/;
+const YARN_RE = /^[0-9]+(c[0-9]+)?\/[0-9a-f]+$/;
+const isSri = (value) => SRI_RE.test(value);
+const isCorepack = (value) => COREPACK_RE.test(value);
+const isYarnChecksum = (value) => YARN_RE.test(value);
 /**
 * Whether a string is a valid integrity hash in the SRI (`<algo>-<base64>`),
 * corepack (`<algo>.<hex>`) or yarn (`<cachekey>/<hex>`) form.
 *
 * @public
 */
-const isValidIntegrityHash$1 = (value) => isSri$1(value) || isCorepack$1(value) || isYarnChecksum$1(value);
-const algorithmOf$1 = (value) => {
-	if (isSri$1(value)) return Option.some(value.slice(0, value.indexOf("-")));
-	if (isCorepack$1(value)) return Option.some(value.slice(0, value.indexOf(".")));
+const isValidIntegrityHash = (value) => isSri(value) || isCorepack(value) || isYarnChecksum(value);
+const algorithmOf = (value) => {
+	if (isSri(value)) return Option.some(value.slice(0, value.indexOf("-")));
+	if (isCorepack(value)) return Option.some(value.slice(0, value.indexOf(".")));
 	return Option.none();
 };
 /**
@@ -4387,15 +4387,15 @@ const algorithmOf$1 = (value) => {
 *
 * @public
 */
-var InvalidIntegrityHashError$1 = class extends Schema.TaggedErrorClass()("InvalidIntegrityHashError", { 
+var InvalidIntegrityHashError = class extends Schema.TaggedErrorClass()("InvalidIntegrityHashError", { 
 /** The raw input string that failed validation. */
 input: Schema.String }) {
 	get message() {
 		return `Invalid integrity hash "${this.input}": expected an SRI (<algo>-<base64>), corepack (<algo>.<hex>) or yarn (<cachekey>/<hex>) form`;
 	}
 };
-const brandedIntegrity$1 = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidIntegrityHash$1(value) ? void 0 : "Expected an SRI, corepack or yarn integrity hash")), Schema.brand("IntegrityHash"));
-const decode$4 = (input) => Schema.decodeUnknownEffect(brandedIntegrity$1)(input).pipe(Effect.mapError(() => new InvalidIntegrityHashError$1({ input })));
+const brandedIntegrity = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidIntegrityHash(value) ? void 0 : "Expected an SRI, corepack or yarn integrity hash")), Schema.brand("IntegrityHash"));
+const decode$2 = (input) => Schema.decodeUnknownEffect(brandedIntegrity)(input).pipe(Effect.mapError(() => new InvalidIntegrityHashError({ input })));
 /**
 * A subresource-integrity hash, covering the SRI (`sha512-<base64>`), corepack
 * (`sha512.<hex>`) and yarn (`10c0/<hex>`) textual forms, carrying taxonomy
@@ -4404,13 +4404,13 @@ const decode$4 = (input) => Schema.decodeUnknownEffect(brandedIntegrity$1)(input
 *
 * @public
 */
-const IntegrityHash$1 = Object.assign(brandedIntegrity$1, {
-	isSri: isSri$1,
-	isCorepack: isCorepack$1,
-	isYarnChecksum: isYarnChecksum$1,
-	isValid: isValidIntegrityHash$1,
-	algorithmOf: algorithmOf$1,
-	decode: decode$4
+const IntegrityHash = Object.assign(brandedIntegrity, {
+	isSri,
+	isCorepack,
+	isYarnChecksum,
+	isValid: isValidIntegrityHash,
+	algorithmOf,
+	decode: decode$2
 });
 /**
 * {@link (IntegrityHash:variable)} narrowed to the corepack `<algo>.<hex>` form
@@ -4463,7 +4463,7 @@ const IntegrityHash$1 = Object.assign(brandedIntegrity$1, {
 *
 * @public
 */
-const CorepackIntegrityHash$1 = brandedIntegrity$1.pipe(Schema.check(Schema.makeFilter((value) => isCorepack$1(value) ? void 0 : "Expected a corepack (<algo>.<hex>) integrity hash")));
+const CorepackIntegrityHash = brandedIntegrity.pipe(Schema.check(Schema.makeFilter((value) => isCorepack(value) ? void 0 : "Expected a corepack (<algo>.<hex>) integrity hash")));
 
 //#endregion
 //#region ../../node_modules/.pnpm/@effected+commands@0.3.1_effect@4.0.0-beta.101/node_modules/@effected/commands/LocalExec.js
@@ -5552,10 +5552,10 @@ var ReleaseAgeGate = class ReleaseAgeGate extends Schema.Class("ReleaseAgeGate")
 */
 var ImporterDependency = class extends Schema.Class("ImporterDependency")({
 	name: Schema.NonEmptyString,
-	specifier: DependencySpecifier$1.FromString,
+	specifier: DependencySpecifier.FromString,
 	version: Schema.optionalKey(Schema.String),
 	peerSuffix: Schema.optionalKey(Schema.String),
-	depType: DependencyField$1
+	depType: DependencyField
 }) {};
 
 //#endregion
@@ -5613,7 +5613,7 @@ const EMPTY_DEPENDENCIES = {};
 var ResolvedPackage = class extends Schema.Class("ResolvedPackage")({
 	name: Schema.NonEmptyString,
 	version: Schema.String,
-	integrity: Schema.optionalKey(IntegrityHash$1),
+	integrity: Schema.optionalKey(IntegrityHash),
 	isWorkspace: Schema.Boolean,
 	relativePath: Schema.optionalKey(Schema.String),
 	dependencies: Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY_DEPENDENCIES)), Schema.withConstructorDefault(Effect.succeed(EMPTY_DEPENDENCIES)))
@@ -5638,7 +5638,7 @@ var ResolvedPackage = class extends Schema.Class("ResolvedPackage")({
 var WorkspaceDependency = class extends Schema.Class("WorkspaceDependency")({
 	from: Schema.NonEmptyString,
 	to: Schema.NonEmptyString,
-	depType: DependencyField$1,
+	depType: DependencyField,
 	constraint: Schema.String
 }) {};
 
@@ -5743,9 +5743,9 @@ const DEP_TYPES = [
 */
 const toIntegrityHash = (raw) => {
 	if (raw === void 0) return Effect.succeed(void 0);
-	return Schema.decodeUnknownEffect(IntegrityHash$1)(raw).pipe(Effect.mapError(validationFailure));
+	return Schema.decodeUnknownEffect(IntegrityHash)(raw).pipe(Effect.mapError(validationFailure));
 };
-const decodeSpecifier = Schema.decodeUnknownExit(DependencySpecifier$1.FromString);
+const decodeSpecifier = Schema.decodeUnknownExit(DependencySpecifier.FromString);
 /**
 * Split pnpm's peer-disambiguation suffix off a recorded string: everything
 * from the first `(` on is suffix, since package names and versions never
@@ -15416,7 +15416,7 @@ var LockfileIntegrity = class LockfileIntegrity extends Schema.Class("LockfileIn
 		dependency: Schema.String,
 		constraint: Schema.String,
 		resolved: Schema.String,
-		depType: DependencyField$1
+		depType: DependencyField
 	}))
 }) {
 	/**
@@ -15485,565 +15485,108 @@ var LockfileIntegrity = class LockfileIntegrity extends Schema.Class("LockfileIn
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/CatalogResolver.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.7.3_effect@4.0.0-beta.101/node_modules/@effected/package-json/Dependency.js
 /**
-* Contract for resolving pnpm `catalog:` dependency specifiers to concrete
-* version ranges.
-*
-* `rangeOf` takes a package name and an optional catalog name
-* (`Option.none()` selects the default catalog) and returns the configured
-* range as `Option.some`, or `Option.none()` when the specifier is absent
-* from the catalog. By convention the error channel is reserved for a
-* failure in the resolution mechanism itself — an unmatched package or
-* catalog name is an `Option.none()` success, never an error. A failure to
-* *assemble* the catalogs (an unreadable or malformed catalog source)
-* surfaces typed as a {@link CatalogAssemblyError}; any other mechanism
-* failure is a {@link DependencyResolutionError}.
-*
-* This is a contract-only service: {@link CatalogResolver.noop} is the sole
-* implementation this package ships, and it resolves nothing. Real consumers
-* (e.g. `@effected/workspaces`) provide a working implementation at the
-* application boundary.
-*
-* @example
-* ```ts
-* import { Effect, Option } from "effect";
-* import { CatalogResolver } from "@effected/npm";
-*
-* const program = Effect.gen(function* () {
-*   const resolver = yield* CatalogResolver;
-*   return yield* resolver.rangeOf("effect", Option.none());
-* });
-*
-* Effect.runPromise(Effect.provide(program, CatalogResolver.noop));
-* // => Option.none()
-* ```
+* A resolved dependency entry pairing a package name with its version
+* specifier and the `kind` of map it came from (`@effected/npm`'s
+* `DependencyKind`). The protocol predicates delegate to `DependencySpecifier`.
 *
 * @public
 */
-var CatalogResolver = class CatalogResolver extends Context.Service()("@effected/npm/CatalogResolver") {
-	/**
-	* No-op default: `rangeOf` always succeeds with `Option.none()`, never
-	* consulting an actual catalog. A pure `Layer.succeed`, bound to a const
-	* so it memoizes by reference — the layer is built once, not once per
-	* reference to `CatalogResolver.noop`.
-	*/
-	static noop = Layer.succeed(CatalogResolver, { rangeOf: () => Effect.succeed(Option.none()) });
+var Dependency = class extends Schema.Class("Dependency")({
+	/** The package name. */
+	name: Schema.String,
+	/** The raw version specifier. */
+	specifier: Schema.String,
+	/** Which dependency map this entry came from. */
+	kind: DependencyKind,
+	/** For `peer` dependencies, whether the peer is optional (from `peerDependenciesMeta`). */
+	isOptional: Schema.optionalKey(Schema.Boolean)
+}) {
+	/** The classified protocol, or `None` for an empty specifier. */
+	get protocol() {
+		return this.specifier.length === 0 ? Option.none() : Option.some(DependencySpecifier.protocolOf(this.specifier));
+	}
+	/** Parse the specifier as a semver `Range`, `None` when it is not a range. */
+	get range() {
+		return DependencySpecifier.parseRange(this.specifier);
+	}
+	/** Whether the specifier points to a local path. */
+	get isLocal() {
+		return DependencySpecifier.isLocal(this.specifier);
+	}
+	/** Whether the specifier uses the `link:` protocol. */
+	get isLink() {
+		return DependencySpecifier.isLink(this.specifier);
+	}
+	/** Whether the specifier uses the `portal:` protocol. */
+	get isPortal() {
+		return DependencySpecifier.isPortal(this.specifier);
+	}
+	/** Whether the specifier uses the `catalog:` protocol. */
+	get isCatalog() {
+		return DependencySpecifier.isCatalog(this.specifier);
+	}
+	/** Whether the specifier uses the `workspace:` protocol. */
+	get isWorkspace() {
+		return DependencySpecifier.isWorkspace(this.specifier);
+	}
+	/** Whether the specifier is an unresolved `catalog:` or `workspace:` protocol. */
+	get isUnresolved() {
+		return this.isCatalog || this.isWorkspace;
+	}
+	/** Whether the specifier resolves to a git source. */
+	get isGit() {
+		return DependencySpecifier.isGit(this.specifier);
+	}
+	/** Whether the specifier is a parseable semver range. */
+	get isRange() {
+		return DependencySpecifier.isRange(this.specifier);
+	}
+	/** Whether the specifier is a dist-tag. */
+	get isTag() {
+		return DependencySpecifier.isTag(this.specifier);
+	}
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/WorkspaceResolver.js
+//#region ../../node_modules/.pnpm/@effected+package-json@0.7.3_effect@4.0.0-beta.101/node_modules/@effected/package-json/DevEngines.js
 /**
-* Raised when a `catalog:` or `workspace:` specifier cannot be resolved
-* because the resolution mechanism itself failed — not for an ordinary
-* unmatched specifier, which resolves to `Option.none()` instead. Both
-* {@link CatalogResolver} and {@link WorkspaceResolver} fail with it.
-*
-* `cause` preserves the originating failure on a structured `Schema.Defect`
-* field rather than folding it into a string, so callers can branch on the
-* original value (an `Error`, a parsed diagnostic, anything); `specifier`
-* records the specifier string that failed to resolve.
+* A single `devEngines` constraint with a name and optional `version` / `onFail`.
 *
 * @public
 */
-var DependencyResolutionError = class extends Schema.TaggedErrorClass()("DependencyResolutionError", {
-	specifier: Schema.String,
-	cause: Schema.Defect()
-}) {
-	/** Renders `specifier` into a one-line failure message. */
-	get message() {
-		return `Failed to resolve dependency specifier "${this.specifier}"`;
-	}
-};
+var DevEngine = class extends Schema.Class("DevEngine")({
+	/** The engine name (e.g. `node`, `pnpm`). */
+	name: Schema.String,
+	/** The optional version constraint. */
+	version: Schema.optionalKey(Schema.String),
+	/** The optional behavior when the constraint is unmet. */
+	onFail: Schema.optionalKey(Schema.Literals([
+		"warn",
+		"error",
+		"ignore"
+	]))
+}) {};
 /**
-* Contract for resolving pnpm `workspace:` dependency specifiers to concrete
-* versions.
-*
-* `versionOf` takes a workspace package name and returns its concrete
-* version (the range modifier stripped) as `Option.some`, or
-* `Option.none()` when the name is not a known workspace member.
-*
-* This is a contract-only service: {@link WorkspaceResolver.noop} is the
-* sole implementation this package ships, and it resolves nothing. Real
-* consumers (e.g. `@effected/workspaces`) provide a working implementation
-* at the application boundary.
+* A `devEngines` constraint slot: a single {@link DevEngine} or an array of them.
 *
-* @example
-* ```ts
-* import { Effect } from "effect";
-* import { WorkspaceResolver } from "@effected/npm";
-*
-* const program = Effect.gen(function* () {
-*   const resolver = yield* WorkspaceResolver;
-*   return yield* resolver.versionOf("@effected/semver");
-* });
-*
-* Effect.runPromise(Effect.provide(program, WorkspaceResolver.noop));
-* // => Option.none()
-* ```
-*
-* @public
-*/
-var WorkspaceResolver = class WorkspaceResolver extends Context.Service()("@effected/npm/WorkspaceResolver") {
-	/**
-	* No-op default: `versionOf` always succeeds with `Option.none()`, never
-	* consulting an actual workspace. A pure `Layer.succeed`, bound to a
-	* const so it memoizes by reference.
-	*/
-	static noop = Layer.succeed(WorkspaceResolver, { versionOf: () => Effect.succeed(Option.none()) });
-};
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/DependencySection.js
-/**
-* The short dependency kind: which dependency map an entry came from, named the
-* way consumers branch on it.
-*
-* @public
-*/
-const DependencyKind = Schema.Literals([
-	"prod",
-	"dev",
-	"peer",
-	"optional"
-]);
-/**
-* The manifest field name a dependency is declared under, matching the
-* `package.json` / `package-lock.json` key exactly.
+* @public
+*/
+const DevEngineOrArray = Schema.Union([DevEngine, Schema.Array(DevEngine)]);
+/**
+* The `devEngines` field schema, modeling runtime and package-manager
+* constraints as optional {@link DevEngine} slots.
 *
 * @public
 */
-const DependencyField = Schema.Literals([
-	"dependencies",
-	"devDependencies",
-	"peerDependencies",
-	"optionalDependencies"
-]);
-const KIND_TO_FIELD = {
-	prod: "dependencies",
-	dev: "devDependencies",
-	peer: "peerDependencies",
-	optional: "optionalDependencies"
-};
-const FIELD_TO_KIND = Object.fromEntries(Object.entries(KIND_TO_FIELD).map(([kind, field]) => [field, kind]));
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/DependencySpecifier.js
-/**
-* Indicates that a string could not be parsed as a valid dependency specifier.
-*
-* Raised by {@link DependencySpecifier.decode}. The offending string is
-* preserved on `input`.
-*
-* @public
-*/
-var InvalidDependencySpecifierError = class extends Schema.TaggedErrorClass()("InvalidDependencySpecifierError", { 
-/** The raw input string that failed validation. */
-input: Schema.String }) {
-	get message() {
-		return `Invalid dependency specifier "${this.input}": not a recognized specifier`;
-	}
-};
-const CATALOG_PREFIX = "catalog:";
-const WORKSPACE_PREFIX = "workspace:";
-const isBarePath = (value) => value.startsWith("./") || value.startsWith("../") || value.startsWith("~/") || value.startsWith("/");
-const isGitHubShorthand = (value) => !value.startsWith(".") && !value.startsWith("~") && !value.startsWith("/") && /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+(#.*)?$/.test(value);
-const isGit = (value) => value.startsWith("git+") || value.startsWith("git://") || value.startsWith("github:") || value.startsWith("gist:") || value.startsWith("bitbucket:") || value.startsWith("gitlab:") || isGitHubShorthand(value);
-const isLocal = (value) => value.startsWith("file:") || value.startsWith("link:") || value.startsWith("portal:") || isBarePath(value);
-const isLink = (value) => value.startsWith("link:");
-const isPortal = (value) => value.startsWith("portal:");
-const isCatalog = (value) => value.startsWith(CATALOG_PREFIX);
-const isWorkspace = (value) => value.startsWith(WORKSPACE_PREFIX);
-const isUrl$1 = (value) => value.startsWith("http://") || value.startsWith("https://");
-const parseRange = (value) => {
-	const exit = Schema.decodeUnknownExit(Range$1.FromString)(value);
-	return Exit.isSuccess(exit) ? Option.some(exit.value) : Option.none();
-};
-const isRange = (value) => Option.isSome(parseRange(value));
-const protocolOf = (value) => {
-	if (value.startsWith(CATALOG_PREFIX)) return "catalog";
-	if (value.startsWith(WORKSPACE_PREFIX)) return "workspace";
-	if (value.startsWith("link:")) return "link";
-	if (value.startsWith("portal:")) return "portal";
-	if (value.startsWith("file:") || isBarePath(value)) return "file";
-	if (value.startsWith("npm:")) return "npm";
-	if (isGit(value)) return "git";
-	if (isUrl$1(value)) return "url";
-	if (isRange(value)) return "range";
-	if (/^[a-zA-Z][a-zA-Z0-9._-]*$/.test(value)) return "tag";
-	return "unknown";
-};
-const isTag = (value) => protocolOf(value) === "tag";
-const catalogNameOf$1 = (specifier) => {
-	if (!isCatalog(specifier)) return Option.none();
-	const rest = specifier.slice(8).trim();
-	return rest.length === 0 ? Option.none() : Option.some(rest);
-};
-const projectRangeModifier = (range, version) => range === "*" || range === "" ? version : range === "~" ? `~${version}` : range === "^" ? `^${version}` : range;
-const splitWorkspaceRest = (rest) => {
-	const at = rest.lastIndexOf("@");
-	return at > 0 ? {
-		target: rest.slice(0, at),
-		range: rest.slice(at + 1)
-	} : {
-		target: void 0,
-		range: rest
-	};
-};
-const projectWorkspaceRange = (rest, version) => {
-	const { target, range } = splitWorkspaceRest(rest);
-	const projected = projectRangeModifier(range, version);
-	return target === void 0 ? projected : `npm:${target}@${projected}`;
-};
-const resolveWorkspace = (specifier, version) => isWorkspace(specifier) ? projectWorkspaceRange(specifier.slice(10), version) : specifier;
-const workspaceTargetOf = (specifier) => {
-	if (!isWorkspace(specifier)) return Option.none();
-	const { target } = splitWorkspaceRest(specifier.slice(10));
-	return target === void 0 ? Option.none() : Option.some(target);
-};
-/**
-* Whether a string is a recognized dependency specifier: a semver range, exact
-* version, dist-tag, URL, git ref, GitHub shorthand, file path, or an
-* `npm:` / `catalog:` / `workspace:` protocol.
-*
-* @public
-*/
-const isValidDependencySpecifier = (value) => value.length > 0 && protocolOf(value) !== "unknown";
-/**
-* A `catalog:` reference. `name` carries the catalog name, or `Option.none()`
-* for the default catalog (`catalog:`).
-*
-* @public
-*/
-var CatalogSpecifier = class extends Schema.TaggedClass()("catalog", {
-	/** The original specifier string. */
-	raw: Schema.String,
-	/** The catalog name, or `Option.none()` for the default catalog. */
-	name: Schema.Option(Schema.String)
-}) {};
-/**
-* A `workspace:` reference. `range` carries the part after `workspace:` — a
-* range modifier (`*`, `^`, `~`), a concrete range, or an alias form.
-*
-* @public
-*/
-var WorkspaceSpecifier = class extends Schema.TaggedClass()("workspace", {
-	/** The original specifier string. */
-	raw: Schema.String,
-	/** The part after `workspace:` (e.g. `*`, `^1.2.3`, or an alias form). */
-	range: Schema.String
-}) {
-	/**
-	* The pnpm publish-time projection of this specifier against a concrete
-	* workspace version: `*` (or an empty range) becomes `version`, `~` becomes
-	* `~version`, `^` becomes `^version`, and a pinned range passes through
-	* unchanged. The alias form (`workspace:<name>@<range>`) becomes pnpm's
-	* publish-time aliased dependency `npm:<name>@<projected>`, with the range
-	* modifier projected the same way — `version` must then be the TARGET
-	* package's version (see `DependencySpecifier.workspaceTargetOf`).
-	*
-	* @remarks
-	* The same projection as `DependencySpecifier.resolveWorkspace`, applied to
-	* this instance's already-extracted `range`; the two share one internal
-	* implementation.
-	*
-	* @param version - The concrete version of the workspace package the
-	*   specifier points at (the alias target's version for the alias form).
-	*/
-	resolve(version) {
-		return projectWorkspaceRange(this.range, version);
-	}
-};
-/**
-* A plain semver range or exact version (e.g. `^1.2.3`, `1.x`, `>=1 <2`).
-*
-* @public
-*/
-var RangeSpecifier = class extends Schema.TaggedClass()("range", { 
-/** The original specifier string. */
-raw: Schema.String }) {};
-/**
-* A bare dist-tag (e.g. `latest`, `next`).
-*
-* @public
-*/
-var DistTagSpecifier = class extends Schema.TaggedClass()("dist-tag", { 
-/** The original specifier string (also the tag name). */
-raw: Schema.String }) {};
-/**
-* The honest fallback for `file:` / `link:` / `portal:` / git / URL / `npm:`
-* forms this concept does not further interpret.
-*
-* @public
-*/
-var RawSpecifier = class extends Schema.TaggedClass()("raw", { 
-/** The original specifier string. */
-raw: Schema.String }) {};
-const Classified = Schema.Union([
-	CatalogSpecifier,
-	WorkspaceSpecifier,
-	RangeSpecifier,
-	DistTagSpecifier,
-	RawSpecifier
-]);
-const classify$1 = (value) => {
-	if (isCatalog(value)) return CatalogSpecifier.make({
-		raw: value,
-		name: catalogNameOf$1(value)
-	});
-	if (isWorkspace(value)) return WorkspaceSpecifier.make({
-		raw: value,
-		range: value.slice(10)
-	});
-	if (isRange(value)) return RangeSpecifier.make({ raw: value });
-	if (isTag(value)) return DistTagSpecifier.make({ raw: value });
-	return RawSpecifier.make({ raw: value });
-};
-const fromString = Schema.String.pipe(Schema.decodeTo(Classified, SchemaTransformation.transformOrFail({
-	decode: (input) => isValidDependencySpecifier(input) ? Effect.succeed(classify$1(input)) : Effect.fail(new SchemaIssue.InvalidValue(Option.some(input), { message: `Invalid dependency specifier: "${input}"` })),
-	encode: (classified) => Effect.succeed(classified.raw)
-})));
-const brandedSpecifier = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidDependencySpecifier(value) ? void 0 : "Expected a valid dependency specifier")), Schema.brand("DependencySpecifier"));
-const decode$3 = (input) => Schema.decodeUnknownEffect(brandedSpecifier)(input).pipe(Effect.mapError(() => new InvalidDependencySpecifierError({ input })));
-/**
-* A valid dependency version specifier, carrying the protocol taxonomy statics
-* (`DependencySpecifier.protocolOf` and friends) that classify any specifier
-* string, plus the {@link (DependencySpecifier:variable).FromString} codec that
-* decodes a string into a {@link ClassifiedSpecifier} tagged union. Use it as a
-* schema for a specifier field and reach for the statics to inspect a raw
-* string.
-*
-* @public
-*/
-const DependencySpecifier = Object.assign(brandedSpecifier, {
-	protocolOf,
-	parseRange,
-	isRange,
-	isTag,
-	isGit,
-	isUrl: isUrl$1,
-	isLocal,
-	isLink,
-	isPortal,
-	isCatalog,
-	isWorkspace,
-	catalogNameOf: catalogNameOf$1,
-	resolveWorkspace,
-	workspaceTargetOf,
-	isValid: isValidDependencySpecifier,
-	decode: decode$3,
-	FromString: fromString
-});
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+npm@0.8.2_@effected+semver@0.3.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/npm/IntegrityHash.js
-const SRI_RE = /^(sha1|sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2}$/;
-const COREPACK_RE = /^(sha1|sha224|sha256|sha384|sha512)\.[0-9a-f]+$/;
-const YARN_RE = /^[0-9]+(c[0-9]+)?\/[0-9a-f]+$/;
-const isSri = (value) => SRI_RE.test(value);
-const isCorepack = (value) => COREPACK_RE.test(value);
-const isYarnChecksum = (value) => YARN_RE.test(value);
-/**
-* Whether a string is a valid integrity hash in the SRI (`<algo>-<base64>`),
-* corepack (`<algo>.<hex>`) or yarn (`<cachekey>/<hex>`) form.
-*
-* @public
-*/
-const isValidIntegrityHash = (value) => isSri(value) || isCorepack(value) || isYarnChecksum(value);
-const algorithmOf = (value) => {
-	if (isSri(value)) return Option.some(value.slice(0, value.indexOf("-")));
-	if (isCorepack(value)) return Option.some(value.slice(0, value.indexOf(".")));
-	return Option.none();
-};
-/**
-* Indicates that a string could not be parsed as a valid integrity hash.
-*
-* Raised by {@link IntegrityHash.decode}. The offending string is preserved on
-* `input`.
-*
-* @public
-*/
-var InvalidIntegrityHashError = class extends Schema.TaggedErrorClass()("InvalidIntegrityHashError", { 
-/** The raw input string that failed validation. */
-input: Schema.String }) {
-	get message() {
-		return `Invalid integrity hash "${this.input}": expected an SRI (<algo>-<base64>), corepack (<algo>.<hex>) or yarn (<cachekey>/<hex>) form`;
-	}
-};
-const brandedIntegrity = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidIntegrityHash(value) ? void 0 : "Expected an SRI, corepack or yarn integrity hash")), Schema.brand("IntegrityHash"));
-const decode$2 = (input) => Schema.decodeUnknownEffect(brandedIntegrity)(input).pipe(Effect.mapError(() => new InvalidIntegrityHashError({ input })));
-/**
-* A subresource-integrity hash, covering the SRI (`sha512-<base64>`), corepack
-* (`sha512.<hex>`) and yarn (`10c0/<hex>`) textual forms, carrying taxonomy
-* statics (`IntegrityHash.algorithmOf` and friends). Use it as a schema for an
-* integrity field and reach for the statics to inspect a raw string.
-*
-* @public
-*/
-const IntegrityHash = Object.assign(brandedIntegrity, {
-	isSri,
-	isCorepack,
-	isYarnChecksum,
-	isValid: isValidIntegrityHash,
-	algorithmOf,
-	decode: decode$2
-});
-/**
-* {@link (IntegrityHash:variable)} narrowed to the corepack `<algo>.<hex>` form
-* — `sha512.deadbeef`, and corepack's own sha224 default pins
-* (`sha224.877304e3…`). An SRI (`sha512-<base64>`) or yarn (`10c0/<hex>`)
-* hash, both valid `IntegrityHash` values, fails this schema.
-*
-* @remarks
-* The corepack pin tail (`<name>@<version>+<integrity>`) is the one place the
-* kit meets this form, and two schemas name it: `PackageManagerPin.integrity`
-* here and `@effected/package-json`'s `PackageManager.integrity`. Both consume
-* **this** schema — the restriction existed privately in each module until they
-* were consolidated, and a private copy is exactly how the two drift (the
-* widening that admitted sha224 had to be made twice).
-*
-* It decodes to the same {@link IntegrityHashBrand} the unrestricted schema
-* does, so a corepack-validated value assigns anywhere an `IntegrityHash` is
-* expected; there is no second brand. Reach for
-* `IntegrityHash.isCorepack(value)` to ask the same question about a raw
-* string without decoding.
-*
-* That single brand is also why sharing this schema is not type-enforced, and
-* the consequence is sharper than it looks: a `Schema.check` is **erased from
-* the built type**, so this schema and the unrestricted one are the same
-* declared type. A consumer that quietly reverts to a private copy compiles
-* clean, and — if the copy is faithful — passes every rejection test too.
-* Neither `tsc` nor behaviour can see the re-fork.
-*
-* What does see it is **object identity**, so each consumer's suite asserts
-* that its field schema IS this export:
-* `PackageManagerPin.fields.integrity.schema === CorepackIntegrityHash` (an
-* `optionalKey` field keeps the inner schema on `.schema`), and
-* `PackageManager.fields.integrity.value === CorepackIntegrityHash` on the
-* `@effected/package-json` side (a `Schema.Option` keeps it on `.value`). Both
-* assertions carry a control against the unrestricted brand, so they discriminate
-* rather than passing on any schema at all. That identity assertion is the only
-* thing standing between the two surfaces and a silent re-fork; do not replace
-* it with a behavioural test, which cannot fail.
-*
-* @example
-* ```ts
-* import { CorepackIntegrityHash } from "@effected/npm";
-* import { Schema } from "effect";
-*
-* const decode = Schema.decodeUnknownExit(CorepackIntegrityHash);
-*
-* decode("sha512.deadbeef"); // success
-* decode("sha512-3q2+7w=="); // failure — SRI form
-* ```
-*
-* @public
-*/
-const CorepackIntegrityHash = brandedIntegrity.pipe(Schema.check(Schema.makeFilter((value) => isCorepack(value) ? void 0 : "Expected a corepack (<algo>.<hex>) integrity hash")));
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.7.3_effect@4.0.0-beta.101/node_modules/@effected/package-json/Dependency.js
-/**
-* A resolved dependency entry pairing a package name with its version
-* specifier and the `kind` of map it came from (`@effected/npm`'s
-* `DependencyKind`). The protocol predicates delegate to `DependencySpecifier`.
-*
-* @public
-*/
-var Dependency = class extends Schema.Class("Dependency")({
-	/** The package name. */
-	name: Schema.String,
-	/** The raw version specifier. */
-	specifier: Schema.String,
-	/** Which dependency map this entry came from. */
-	kind: DependencyKind,
-	/** For `peer` dependencies, whether the peer is optional (from `peerDependenciesMeta`). */
-	isOptional: Schema.optionalKey(Schema.Boolean)
-}) {
-	/** The classified protocol, or `None` for an empty specifier. */
-	get protocol() {
-		return this.specifier.length === 0 ? Option.none() : Option.some(DependencySpecifier.protocolOf(this.specifier));
-	}
-	/** Parse the specifier as a semver `Range`, `None` when it is not a range. */
-	get range() {
-		return DependencySpecifier.parseRange(this.specifier);
-	}
-	/** Whether the specifier points to a local path. */
-	get isLocal() {
-		return DependencySpecifier.isLocal(this.specifier);
-	}
-	/** Whether the specifier uses the `link:` protocol. */
-	get isLink() {
-		return DependencySpecifier.isLink(this.specifier);
-	}
-	/** Whether the specifier uses the `portal:` protocol. */
-	get isPortal() {
-		return DependencySpecifier.isPortal(this.specifier);
-	}
-	/** Whether the specifier uses the `catalog:` protocol. */
-	get isCatalog() {
-		return DependencySpecifier.isCatalog(this.specifier);
-	}
-	/** Whether the specifier uses the `workspace:` protocol. */
-	get isWorkspace() {
-		return DependencySpecifier.isWorkspace(this.specifier);
-	}
-	/** Whether the specifier is an unresolved `catalog:` or `workspace:` protocol. */
-	get isUnresolved() {
-		return this.isCatalog || this.isWorkspace;
-	}
-	/** Whether the specifier resolves to a git source. */
-	get isGit() {
-		return DependencySpecifier.isGit(this.specifier);
-	}
-	/** Whether the specifier is a parseable semver range. */
-	get isRange() {
-		return DependencySpecifier.isRange(this.specifier);
-	}
-	/** Whether the specifier is a dist-tag. */
-	get isTag() {
-		return DependencySpecifier.isTag(this.specifier);
-	}
-};
-
-//#endregion
-//#region ../../node_modules/.pnpm/@effected+package-json@0.7.3_effect@4.0.0-beta.101/node_modules/@effected/package-json/DevEngines.js
-/**
-* A single `devEngines` constraint with a name and optional `version` / `onFail`.
-*
-* @public
-*/
-var DevEngine = class extends Schema.Class("DevEngine")({
-	/** The engine name (e.g. `node`, `pnpm`). */
-	name: Schema.String,
-	/** The optional version constraint. */
-	version: Schema.optionalKey(Schema.String),
-	/** The optional behavior when the constraint is unmet. */
-	onFail: Schema.optionalKey(Schema.Literals([
-		"warn",
-		"error",
-		"ignore"
-	]))
-}) {};
-/**
-* A `devEngines` constraint slot: a single {@link DevEngine} or an array of them.
-*
-* @public
-*/
-const DevEngineOrArray = Schema.Union([DevEngine, Schema.Array(DevEngine)]);
-/**
-* The `devEngines` field schema, modeling runtime and package-manager
-* constraints as optional {@link DevEngine} slots.
-*
-* @public
-*/
-const DevEnginesSchema = Schema.Struct({
-	packageManager: Schema.optionalKey(DevEngineOrArray),
-	runtime: Schema.optionalKey(DevEngineOrArray),
-	os: Schema.optionalKey(DevEngineOrArray),
-	cpu: Schema.optionalKey(DevEngineOrArray),
-	libc: Schema.optionalKey(DevEngineOrArray)
-});
+const DevEnginesSchema = Schema.Struct({
+	packageManager: Schema.optionalKey(DevEngineOrArray),
+	runtime: Schema.optionalKey(DevEngineOrArray),
+	os: Schema.optionalKey(DevEngineOrArray),
+	cpu: Schema.optionalKey(DevEngineOrArray),
+	libc: Schema.optionalKey(DevEngineOrArray)
+});
 
 //#endregion
 //#region ../../node_modules/.pnpm/@effected+spdx@0.1.2_effect@4.0.0-beta.101/node_modules/@effected/spdx/internal/licenseIds.js
@@ -18686,7 +18229,7 @@ var Package = class Package extends Schema.Class("Package")({
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspacePackage.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/WorkspacePackage.js
 const EMPTY$1 = Object.freeze(Object.create(null));
 const EMPTY_MANIFEST = Object.freeze(Object.create(null));
 /**
@@ -19288,7 +18831,7 @@ var Walker$1 = class {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceRoot.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/WorkspaceRoot.js
 /**
 * The marker filenames {@link WorkspaceRoot} probes for, in priority order.
 *
@@ -19476,7 +19019,7 @@ var WorkspaceRoot = class WorkspaceRoot extends Context.Service()("@effected/wor
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/limits.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/internal/limits.js
 /**
 * Hard ceiling on directories the enumerator will visit for one pattern set.
 * Guards the pathological case a depth cap alone does not: a wide, shallow
@@ -19495,7 +19038,7 @@ const MAX_ENUMERATION_ENTRIES = 1e5;
 const PRUNED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/traverse.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/internal/traverse.js
 /** Directory names never descended into. */
 const isPruned = (entry) => PRUNED_DIRECTORIES.has(entry);
 /** Join root-relative POSIX segments; `""` is the root itself. */
@@ -19586,7 +19129,7 @@ var Traversal = class {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/enumerate.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/internal/enumerate.js
 /** Strip a trailing slash from `GlobPattern.enumerationPrefix` to get a relative directory. */
 const baseOf = (pattern) => pattern.enumerationPrefix.replace(/\/$/, "");
 /**
@@ -19657,7 +19200,7 @@ const enumerate = (root, globs, options) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/patterns.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/internal/patterns.js
 const stringsOf = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : void 0;
 /** The `packages:` list of a `pnpm-workspace.yaml` document. Total on a parsed document. */
 const pnpmPatternsOf = (document) => {
@@ -19715,7 +19258,7 @@ const readPatterns = (root) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceDiscovery.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/WorkspaceDiscovery.js
 /**
 * Raised when a workspace member's `package.json` cannot be read, parsed, or
 * used — it is missing, malformed, or lacks a `name` or `version`.
@@ -20152,7 +19695,7 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 	* // `Package.resolve` now resolves `workspace:*` for real.
 	* ```
 	*/
-	static workspaceResolver = Layer.effect(WorkspaceResolver$1, Effect.gen(function* () {
+	static workspaceResolver = Layer.effect(WorkspaceResolver, Effect.gen(function* () {
 		const discovery = yield* WorkspaceDiscovery;
 		const versionIndexes = /* @__PURE__ */ new WeakMap();
 		const versionsByName = (all) => {
@@ -20163,7 +19706,7 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 			versionIndexes.set(all, index);
 			return index;
 		};
-		return { versionOf: (packageName) => discovery.listPackages().pipe(Effect.map((all) => Option.fromUndefinedOr(versionsByName(all).get(packageName))), Effect.mapError((cause) => new DependencyResolutionError$1({
+		return { versionOf: (packageName) => discovery.listPackages().pipe(Effect.map((all) => Option.fromUndefinedOr(versionsByName(all).get(packageName))), Effect.mapError((cause) => new DependencyResolutionError({
 			specifier: `workspace:${packageName}`,
 			cause
 		}))) };
@@ -20172,7 +19715,7 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 const isStringRecord$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((entry) => typeof entry === "string");
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/DependencyGraph.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/DependencyGraph.js
 /**
 * Raised when the workspace dependency graph cannot be topologically ordered
 * because it contains a cycle.
@@ -20406,10 +19949,32 @@ const kahn = (edges) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+git@0.5.2_effect@4.0.0-beta.101/node_modules/@effected/git/GitCommand.js
+//#region ../../node_modules/.pnpm/@effected+git@0.6.0_effect@4.0.0-beta.101/node_modules/@effected/git/GitCommand.js
+/** The mask every whole-value sensitive positional is replaced with. */
+const REDACTED = "<redacted>";
+const secretValue = (value) => ({
+	redact: "value",
+	value
+});
+const secretUrl = (value) => ({
+	redact: "url",
+	value
+});
+/**
+* Masks the userinfo component of a URL (`scheme://user:token@host/...` →
+* `scheme://<redacted>@host/...`). A value carrying no embedded userinfo — a
+* remote name, a credential-free URL, an scp-style `host:path` — passes
+* through untouched, so the common case stays fully debuggable.
+*
+* The userinfo match is greedy (`[^/]*@` — everything through the LAST `@`
+* before the first path slash): URL authorities split at the last `@`, so a
+* password containing a literal `@` (`user:p\@ss\@host/...`) must be
+* consumed whole or its tail would survive into `redactedArgs`.
+*/
+const redactUrlUserinfo = (value) => value.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/]*@/i, `$1${REDACTED}@`);
 /**
-* Builds a `git` `ChildProcess.StandardCommand` with the argv this package
-* classifies against.
+* Builds a `git` {@link GitInvocation} with the argv this package classifies
+* against.
 *
 * @remarks
 * `LC_ALL=C` is pinned on every invocation because git's stderr
@@ -20425,10 +19990,18 @@ const kahn = (edges) => {
 * the working directory per invocation via `ChildProcess.setCwd`, which
 * returns a new command and leaves this one unchanged.
 */
-const git = (args) => ChildProcess.make("git", args, {
-	env: { LC_ALL: "C" },
-	extendEnv: true
-});
+const git = (args, stdin) => {
+	const raw = args.map((arg) => typeof arg === "string" ? arg : arg.value);
+	const redactedArgs = args.map((arg) => typeof arg === "string" ? arg : arg.redact === "value" ? REDACTED : redactUrlUserinfo(arg.value));
+	return {
+		command: ChildProcess.make("git", raw, {
+			env: { LC_ALL: "C" },
+			extendEnv: true,
+			...stdin !== void 0 ? { stdin: Stream.make(new TextEncoder().encode(stdin)) } : {}
+		}),
+		redactedArgs
+	};
+};
 const show = (ref, path) => git(["show", `${ref}:${path}`]);
 const lsTree = (ref, pathspec = []) => git([
 	"ls-tree",
@@ -20487,7 +20060,7 @@ const checkout = (ref, detach = false) => git([
 const fetch$1 = (remote, ref, depth, tag = false) => git([
 	"fetch",
 	...depth !== void 0 ? ["--depth", String(depth)] : [],
-	remote,
+	secretUrl(remote),
 	...tag ? ["tag"] : [],
 	ref
 ]);
@@ -20503,7 +20076,7 @@ const submoduleAdd = (url, path, depth) => git([
 	"add",
 	...depth !== void 0 ? ["--depth", String(depth)] : [],
 	"--",
-	url,
+	secretUrl(url),
 	path
 ]);
 const sparseCheckoutSet = (patterns, cone) => git([
@@ -20516,13 +20089,55 @@ const configSet = (key, value, file) => git([
 	"config",
 	...file !== void 0 ? ["-f", file] : [],
 	key,
-	value
+	secretValue(value)
 ]);
 const add = (paths) => git([
 	"add",
 	"--",
 	...paths
 ]);
+const reset = (mode = "mixed", ref) => git([
+	"reset",
+	`--${mode}`,
+	...ref !== void 0 ? [ref] : []
+]);
+const clean = (directories = false, ignored = false, paths = []) => git([
+	"clean",
+	"--force",
+	...directories ? ["-d"] : [],
+	...ignored ? ["-x"] : [],
+	...paths.length > 0 ? ["--", ...paths] : []
+]);
+const restore = (paths, source, staged = false, worktree = false) => git([
+	"restore",
+	...source !== void 0 ? ["--source", source] : [],
+	...staged ? ["--staged"] : [],
+	...worktree ? ["--worktree"] : [],
+	"--",
+	...paths
+]);
+const branchCreate = (name, startPoint, checkout = false, force = false) => checkout ? git([
+	"checkout",
+	force ? "-B" : "-b",
+	name,
+	...startPoint !== void 0 ? [startPoint] : []
+]) : git([
+	"branch",
+	...force ? ["-f"] : [],
+	name,
+	...startPoint !== void 0 ? [startPoint] : []
+]);
+const branchDelete = (name, force = false) => git([
+	"branch",
+	force ? "-D" : "-d",
+	name
+]);
+const isShallow = () => git(["rev-parse", "--is-shallow-repository"]);
+const fetchUnshallow = (remote = "origin") => git([
+	"fetch",
+	"--unshallow",
+	secretUrl(remote)
+]);
 const nameStatus = (base, head, relative = false) => git([
 	"diff",
 	"--name-status",
@@ -20563,26 +20178,262 @@ const status = () => git([
 	"--porcelain",
 	"-z"
 ]);
-/**
-* Pure constructors for the `git` `ChildProcess.Command` values this package
-* spawns.
-*
-* @remarks
-* Every constructor returns a cwd-less, argv-only `Command` — no spawning,
-* no working directory baked in. `Git` applies the working directory per
-* call with `ChildProcess.setCwd` and owns the actual spawn, timeout, and
-* error classification.
-*
-* @public
-*/
-var GitCommand = class {
-	constructor() {}
-	/**
-	* `git show <ref>:<path>` — the contents of `path` as it existed at `ref`,
-	* without checking anything out.
-	*/
-	static show = show;
-	/**
+const submoduleStatus = (paths = [], recursive = false) => git([
+	"submodule",
+	"status",
+	...recursive ? ["--recursive"] : [],
+	...paths.length > 0 ? ["--", ...paths] : []
+]);
+const submoduleInit = (paths = []) => git([
+	"submodule",
+	"init",
+	...paths.length > 0 ? ["--", ...paths] : []
+]);
+const submoduleDeinit = (paths, all = false, force = false) => git([
+	"submodule",
+	"deinit",
+	...force ? ["--force"] : [],
+	...all ? ["--all"] : ["--", ...paths]
+]);
+const submoduleSync = (paths = [], recursive = false) => git([
+	"submodule",
+	"sync",
+	...recursive ? ["--recursive"] : [],
+	...paths.length > 0 ? ["--", ...paths] : []
+]);
+const submoduleSetUrl = (path, url) => git([
+	"submodule",
+	"set-url",
+	"--",
+	path,
+	secretUrl(url)
+]);
+const submoduleSetBranch = (path, branch) => git([
+	"submodule",
+	"set-branch",
+	...branch === void 0 ? ["--default"] : ["--branch", branch],
+	"--",
+	path
+]);
+const submoduleAbsorbgitdirs = (paths = []) => git([
+	"submodule",
+	"absorbgitdirs",
+	...paths.length > 0 ? ["--", ...paths] : []
+]);
+const submoduleForeach = (command, recursive = false) => git([
+	"submodule",
+	"foreach",
+	...recursive ? ["--recursive"] : [],
+	command
+]);
+const lsRemote = (remote, heads = false, tags = false, patterns = []) => git([
+	"ls-remote",
+	...heads ? ["--heads"] : [],
+	...tags ? ["--tags"] : [],
+	secretUrl(remote),
+	...patterns
+]);
+const remoteAdd = (name, url) => git([
+	"remote",
+	"add",
+	name,
+	secretUrl(url)
+]);
+const remoteRemove = (name) => git([
+	"remote",
+	"remove",
+	name
+]);
+const remoteSetUrl = (name, url) => git([
+	"remote",
+	"set-url",
+	name,
+	secretUrl(url)
+]);
+const stashRef = (index) => `stash@{${index}}`;
+const stashPush = (message, includeUntracked = false, paths = []) => git([
+	"stash",
+	"push",
+	...includeUntracked ? ["--include-untracked"] : [],
+	...message !== void 0 ? ["-m", message] : [],
+	...paths.length > 0 ? ["--", ...paths] : []
+]);
+const stashPop = (index) => git([
+	"stash",
+	"pop",
+	...index !== void 0 ? [stashRef(index)] : []
+]);
+const stashApply = (index) => git([
+	"stash",
+	"apply",
+	...index !== void 0 ? [stashRef(index)] : []
+]);
+const stashDrop = (index) => git([
+	"stash",
+	"drop",
+	...index !== void 0 ? [stashRef(index)] : []
+]);
+const stashList = () => git([
+	"stash",
+	"list",
+	"-z",
+	"--format=%gd%x1f%H%x1f%gs"
+]);
+const branchList = (remotes = false, all = false) => git([
+	"branch",
+	"--list",
+	...all ? ["--all"] : remotes ? ["--remotes"] : [],
+	"--format=%(HEAD)%00%(refname:short)%00%(objectname)"
+]);
+const tagCreate = (name, ref, message, force = false) => git([
+	"tag",
+	...force ? ["--force"] : [],
+	...message !== void 0 ? ["-m", message] : [],
+	name,
+	...ref !== void 0 ? [ref] : []
+]);
+const tagDelete = (name) => git([
+	"tag",
+	"--delete",
+	name
+]);
+const tagList = (pattern) => git([
+	"tag",
+	"--list",
+	...pattern !== void 0 ? [pattern] : []
+]);
+const forEachRef = (patterns = []) => git([
+	"for-each-ref",
+	"--format=%(refname)%00%(objectname)%00%(objecttype)",
+	...patterns
+]);
+const revList = (ref, limit, firstParent = false) => git([
+	"rev-list",
+	...limit !== void 0 ? [`--max-count=${limit}`] : [],
+	...firstParent ? ["--first-parent"] : [],
+	ref
+]);
+const commit = (message, all = false, allowEmpty = false, amend = false, author) => git([
+	"commit",
+	...all ? ["--all"] : [],
+	...allowEmpty ? ["--allow-empty"] : [],
+	...amend ? ["--amend"] : [],
+	...author !== void 0 ? [`--author=${author}`] : [],
+	"-m",
+	message
+]);
+const push$1 = (remote, refspec, force = false, forceWithLease = false, tags = false, setUpstream = false) => git([
+	"push",
+	...force ? ["--force"] : [],
+	...forceWithLease ? ["--force-with-lease"] : [],
+	...tags ? ["--tags"] : [],
+	...setUpstream ? ["--set-upstream"] : [],
+	secretUrl(remote),
+	...refspec !== void 0 ? [refspec] : []
+]);
+const pull = (remote, ref, rebase = false, ffOnly = false) => git([
+	"pull",
+	...rebase ? ["--rebase"] : [],
+	...ffOnly ? ["--ff-only"] : [],
+	secretUrl(remote),
+	...ref !== void 0 ? [ref] : []
+]);
+const configList = (file) => git([
+	"config",
+	...file !== void 0 ? ["-f", file] : [],
+	"--list",
+	"-z"
+]);
+const configGetAll = (key, file) => git([
+	"config",
+	...file !== void 0 ? ["-f", file] : [],
+	"--get-all",
+	"-z",
+	key
+]);
+const configUnset = (key, file, all = false) => git([
+	"config",
+	...file !== void 0 ? ["-f", file] : [],
+	all ? "--unset-all" : "--unset",
+	key
+]);
+const rm = (paths, cached = false, recursive = false, force = false) => git([
+	"rm",
+	...cached ? ["--cached"] : [],
+	...recursive ? ["-r"] : [],
+	...force ? ["--force"] : [],
+	"--",
+	...paths
+]);
+const mv = (source, destination, force = false) => git([
+	"mv",
+	...force ? ["--force"] : [],
+	"--",
+	source,
+	destination
+]);
+const checkIgnore = (paths) => git([
+	"check-ignore",
+	"-z",
+	"--stdin"
+], paths.map((path) => `${path}\0`).join(""));
+const worktreeAdd = (path, ref, detach = false, force = false) => git([
+	"worktree",
+	"add",
+	...force ? ["--force"] : [],
+	...detach ? ["--detach"] : [],
+	path,
+	...ref !== void 0 ? [ref] : []
+]);
+const worktreeList = () => git([
+	"worktree",
+	"list",
+	"--porcelain",
+	"-z"
+]);
+const worktreeRemove = (path, force = false) => git([
+	"worktree",
+	"remove",
+	...force ? ["--force"] : [],
+	path
+]);
+const lsFiles = (pathspec = []) => git([
+	"ls-files",
+	"--stage",
+	"-z",
+	...pathspec.length > 0 ? ["--", ...pathspec] : []
+]);
+/**
+* Pure constructors for the `git` {@link GitInvocation} values this package
+* spawns.
+*
+* @remarks
+* Every constructor returns a cwd-less, argv-only {@link GitInvocation} — no
+* spawning, no working directory baked in. `Git` applies the working
+* directory per call with `ChildProcess.setCwd` on `invocation.command` and
+* owns the actual spawn, timeout, and error classification.
+*
+* **Redaction policy.** A constructor whose argv carries a sensitive
+* positional — a config value (`configSet`), or a URL that may embed
+* userinfo (the remote of `fetch`, `fetchUnshallow`, `lsRemote`, `push` and
+* `pull`, and the url of `submoduleAdd`, `submoduleSetUrl`, `remoteAdd` and
+* `remoteSetUrl`) —
+* masks it in {@link GitInvocation.redactedArgs}: a config value becomes
+* `<redacted>` wholesale, a URL keeps everything but its `userinfo@`
+* component. The `Git` service persists only the redacted argv in error
+* values, and its span annotations carry stable identifiers only (`cwd`,
+* keys, paths, remote/ref names) — never config values, never URLs.
+*
+* @public
+*/
+var GitCommand = class {
+	constructor() {}
+	/**
+	* `git show <ref>:<path>` — the contents of `path` as it existed at `ref`,
+	* without checking anything out.
+	*/
+	static show = show;
+	/**
 	* `git ls-tree -r -z <ref> [-- <pathspec>...]` — every path in the tree at
 	* `ref`, recursively, NUL-terminated, optionally scoped to `pathspec`.
 	*
@@ -20669,9 +20520,106 @@ var GitCommand = class {
 	/**
 	* Mutating: `git fetch [--depth <n>] <remote> [tag] <ref>` — fetches the given
 	* ref from a remote, optionally with a depth limit and the `tag` keyword.
+	*
+	* @remarks
+	* `remote` may be a URL as well as a remote name; an embedded
+	* `userinfo@` credential is masked in {@link GitInvocation.redactedArgs}.
 	*/
 	static fetch = fetch$1;
 	/**
+	* Mutating: `git fetch --unshallow <remote>` — converts a shallow clone
+	* into a complete one by fetching the missing history.
+	*
+	* @remarks
+	* `--unshallow` is a distinct MODE, not a depth value: git rejects it
+	* outright in a repository that is not shallow, with
+	* `--unshallow on a complete repository does not make sense`, so it
+	* cannot be expressed as `fetch`'s `depth` option. The caller decides
+	* whether to run it — probe with `Git.isShallow` first.
+	*
+	* `remote` may be a URL as well as a remote name; an embedded `userinfo@`
+	* credential is masked in {@link GitInvocation.redactedArgs}.
+	*/
+	static fetchUnshallow = fetchUnshallow;
+	/**
+	* `git rev-parse --is-shallow-repository` — prints `true` when the
+	* repository is a shallow clone, `false` otherwise.
+	*
+	* @remarks
+	* A dedicated probe constructor, deliberately separate from
+	* {@link GitCommand.revParse}: `revParse` takes a REF and resolves it,
+	* while this takes nothing and answers a repository-shape question.
+	* Folding the flag into `revParse` would make that constructor
+	* sometimes-takes-a-ref, sometimes-takes-a-flag.
+	*/
+	static isShallow = isShallow;
+	/**
+	* Mutating: `git reset --soft|--mixed|--hard [<ref>]` — moves `HEAD` (and,
+	* per mode, the index and working tree) to `ref`.
+	*
+	* @remarks
+	* The mode flag is always explicit — `--mixed` is emitted for the default
+	* rather than omitted — so the argv states what runs. `ref` may be any
+	* commit-ish, including a gitlink sha.
+	*/
+	static reset = reset;
+	/**
+	* Mutating: `git clean --force [-d] [-x] [-- <paths>...]` — deletes
+	* untracked files from the working tree.
+	*
+	* @remarks
+	* `--force` is unconditional: this constructor exists so a consumer can
+	* restore a tree to a known state (e.g. before retrying a non-idempotent
+	* operation), and without `--force` git refuses to clean at all under the
+	* default `clean.requireForce` config — a clean that silently did nothing
+	* would hand the retry the same dirty tree. `-d` removes untracked
+	* directories too; `-x` removes ignored files as well. The literal `--`
+	* separator makes the optional pathspec injection-safe by construction.
+	*/
+	static clean = clean;
+	/**
+	* Mutating: `git restore [--source <ref>] [--staged] [--worktree] -- <paths...>`
+	* — restores the given paths from the index (or from `source`), the
+	* `checkout -- <paths>`-shaped operation.
+	*
+	* @remarks
+	* This is a separate constructor precisely because {@link GitCommand.checkout}'s
+	* service guard refuses `--` and option-like refs by design — `restore` is
+	* git's own verb for pathspec restoration, and its paths always sit behind
+	* a literal `--`, so they are injection-safe by construction. With neither
+	* `staged` nor `worktree` set, git defaults to restoring the working tree.
+	*/
+	static restore = restore;
+	/**
+	* Mutating: `git branch [-f] <name> [<start-point>]`, or
+	* `git checkout (-b | -B) <name> [<start-point>]` when `checkout` is true —
+	* creates a branch, optionally from an explicit start point, optionally
+	* switching to it, optionally force-resetting an existing branch.
+	*
+	* @remarks
+	* Branch creation is a branch-member concern, NOT a widening of
+	* {@link GitCommand.checkout}: `checkout`'s contract stays "move to an
+	* existing ref" and its option-like-ref refusal stays intact. The `-b` /
+	* `-B` here is this constructor's own literal, never caller data.
+	*
+	* `force` with `checkout` exists because the delete-then-create longhand
+	* (`branch -D` swallowed, then `checkout -b`) papers over a real edge:
+	* `git branch -D` refuses to delete the currently checked-out branch,
+	* while `checkout -B` resets it fine — one invocation handles both
+	* states.
+	*/
+	static branchCreate = branchCreate;
+	/**
+	* Mutating: `git branch -d <name>` (or `-D` when `force` is true) —
+	* deletes a local branch.
+	*
+	* @remarks
+	* The default `-d` refuses to delete a branch not fully merged — a typed
+	* failure, which is usually the honest answer. `force: true` emits `-D`
+	* and deletes regardless.
+	*/
+	static branchDelete = branchDelete;
+	/**
 	* Mutating: `git submodule update [--init] [--depth <n>] [-- <paths>...]` — updates
 	* registered submodules, optionally initializing them, with an optional depth limit,
 	* and scoped to specific paths. The literal `--` separator makes the pathspec
@@ -20682,6 +20630,10 @@ var GitCommand = class {
 	* Mutating: `git submodule add [--depth <n>] -- <url> <path>` — registers and
 	* initializes a new submodule. The literal `--` separator makes the url and path
 	* injection-safe by construction.
+	*
+	* @remarks
+	* An embedded `userinfo@` credential in `url` is masked in
+	* {@link GitInvocation.redactedArgs}.
 	*/
 	static submoduleAdd = submoduleAdd;
 	/**
@@ -20694,6 +20646,13 @@ var GitCommand = class {
 	/**
 	* Mutating: `git config [-f <file>] <key> <value>` — writes a configuration value,
 	* optionally into an explicit configuration file (e.g., `.gitmodules`).
+	*
+	* @remarks
+	* `value` may be a secret (a token, a credential-bearing URL), so it is
+	* masked wholesale — as `<redacted>` — in
+	* {@link GitInvocation.redactedArgs}. The key and file stay visible: they
+	* are stable identifiers, and they are what a caller debugging a failed
+	* write actually needs.
 	*/
 	static configSet = configSet;
 	/**
@@ -20776,10 +20735,305 @@ var GitCommand = class {
 	* Each entry is a pair of status codes followed by a space and the path.
 	*/
 	static status = status;
+	/**
+	* `git submodule status [--recursive] [-- <paths>...]` — one line per
+	* registered submodule: a state prefix, the checked-out (or gitlink) sha,
+	* the path, and — when the submodule is initialized — a `git describe`
+	* suffix in parentheses.
+	*
+	* @remarks
+	* `git submodule status` has no `-z` mode, so its output is line-based —
+	* the one path-emitting constructor in this package that cannot follow
+	* the `-z` rule. A submodule path containing a newline would corrupt the
+	* parse; accepted as a git-imposed limitation.
+	*/
+	static submoduleStatus = submoduleStatus;
+	/**
+	* Mutating: `git submodule init [-- <paths>...]` — registers the
+	* submodules from `.gitmodules` into `.git/config` (all of them, or only
+	* `paths`), without cloning or checking anything out.
+	*/
+	static submoduleInit = submoduleInit;
+	/**
+	* Mutating: `git submodule deinit [--force] (--all | -- <paths>...)` —
+	* unregisters submodules: clears their working trees and removes their
+	* `.git/config` registration. The literal `--` separator makes the
+	* pathspec injection-safe by construction.
+	*/
+	static submoduleDeinit = submoduleDeinit;
+	/**
+	* Mutating: `git submodule sync [--recursive] [-- <paths>...]` —
+	* re-copies each submodule's URL from `.gitmodules` into `.git/config`
+	* (and into the submodule's own `remote.origin.url`), so a `.gitmodules`
+	* URL change actually reaches git's live configuration.
+	*/
+	static submoduleSync = submoduleSync;
+	/**
+	* Mutating: `git submodule set-url -- <path> <url>` — rewrites the
+	* submodule's URL in `.gitmodules` and synchronizes it into
+	* `.git/config`. The literal `--` separator makes the path and url
+	* injection-safe by construction.
+	*
+	* @remarks
+	* An embedded `userinfo@` credential in `url` is masked in
+	* {@link GitInvocation.redactedArgs}.
+	*/
+	static submoduleSetUrl = submoduleSetUrl;
+	/**
+	* Mutating: `git submodule set-branch (--branch <branch> | --default) -- <path>`
+	* — records (or clears, when `branch` is omitted) the branch a submodule
+	* tracks in `.gitmodules`. The literal `--` separator makes the path
+	* injection-safe by construction.
+	*/
+	static submoduleSetBranch = submoduleSetBranch;
+	/**
+	* Mutating: `git submodule absorbgitdirs [-- <paths>...]` — moves each
+	* submodule's embedded `.git` directory into the superproject's
+	* `.git/modules/` and leaves a gitfile pointer behind.
+	*/
+	static submoduleAbsorbgitdirs = submoduleAbsorbgitdirs;
+	/**
+	* Mutating: `git submodule foreach [--recursive] <command>` — runs a shell
+	* command in every checked-out submodule. `command` is a single shell
+	* string, evaluated by git in each submodule's directory; it can mutate
+	* anything, which is why the constructor is marked mutating regardless of
+	* what the command does.
+	*
+	* @remarks
+	* This is the ONE constructor whose argument cannot be made injection-safe
+	* by construction: git evaluates `command` with `sh -c`, so every character
+	* of it is shell code — a `--` separator or quoting cannot help. Callers
+	* must treat `command` as a trusted literal and never interpolate untrusted
+	* data into it.
+	*/
+	static submoduleForeach = submoduleForeach;
+	/**
+	* `git ls-remote [--heads] [--tags] <remote> [<patterns>...]` — the refs a
+	* remote advertises (sha + refname), optionally filtered to branch heads,
+	* tags, and/or shell-glob patterns.
+	*
+	* @remarks
+	* A read that talks to the NETWORK, not to the local repository — the one
+	* non-mutating constructor in this package that does. An embedded
+	* `userinfo@` credential in `remote` is masked in
+	* {@link GitInvocation.redactedArgs}. An annotated tag advertises two
+	* entries: `refs/tags/<name>` (the tag object) and `refs/tags/<name>^{}`
+	* (the peeled commit).
+	*/
+	static lsRemote = lsRemote;
+	/**
+	* Mutating: `git remote add <name> <url>` — registers a new remote.
+	*
+	* @remarks
+	* An embedded `userinfo@` credential in `url` is masked in
+	* {@link GitInvocation.redactedArgs}.
+	*/
+	static remoteAdd = remoteAdd;
+	/**
+	* Mutating: `git remote remove <name>` — deletes a remote and its
+	* remote-tracking refs and configuration.
+	*/
+	static remoteRemove = remoteRemove;
+	/**
+	* Mutating: `git remote set-url <name> <url>` — rewrites a remote's fetch
+	* URL.
+	*
+	* @remarks
+	* An embedded `userinfo@` credential in `url` is masked in
+	* {@link GitInvocation.redactedArgs}.
+	*/
+	static remoteSetUrl = remoteSetUrl;
+	/**
+	* Mutating: `git stash push [--include-untracked] [-m <message>] [-- <paths>...]`
+	* — saves the working tree (and index) state onto the stash stack. The
+	* literal `--` separator makes the optional pathspec injection-safe by
+	* construction; the message rides behind `-m`, which git consumes as a
+	* value even when it begins with `-`.
+	*/
+	static stashPush = stashPush;
+	/**
+	* Mutating: `git stash pop [stash@{n}]` — applies a stash entry and drops
+	* it on success. The stash ref is rendered from an INTEGER index by this
+	* package, never caller text.
+	*/
+	static stashPop = stashPop;
+	/**
+	* Mutating: `git stash apply [stash@{n}]` — applies a stash entry and
+	* keeps it on the stack. The stash ref is rendered from an INTEGER index
+	* by this package, never caller text.
+	*/
+	static stashApply = stashApply;
+	/**
+	* Mutating: `git stash drop [stash@{n}]` — deletes a stash entry without
+	* applying it. The stash ref is rendered from an INTEGER index by this
+	* package, never caller text.
+	*/
+	static stashDrop = stashDrop;
+	/**
+	* `git stash list -z --format=%gd%x1f%H%x1f%gs` — every stash entry as a
+	* NUL-terminated record of unit-separated fields: the reflog selector
+	* (`stash@{0}`), the stash commit sha, and the reflog subject.
+	*
+	* @remarks
+	* The `%x1f` (ASCII unit separator) field separator plus `-z` record
+	* terminator keeps the parse split-safe: a stash message cannot contain
+	* either byte (reflog subjects are single-line).
+	*/
+	static stashList = stashList;
+	/**
+	* `git branch --list [--remotes | --all] --format=%(HEAD)%00%(refname:short)%00%(objectname)`
+	* — every branch as a NUL-separated triple: the current-branch marker, the
+	* short name, and the tip sha.
+	*
+	* @remarks
+	* Records are newline-separated, which is split-safe here: git refnames
+	* cannot contain a newline (or a space), so the only NUL bytes are the
+	* format's own field separators. `all` wins over `remotes` when both are
+	* set.
+	*/
+	static branchList = branchList;
+	/**
+	* Mutating: `git tag [--force] [-m <message>] <name> [<ref>]` — creates a
+	* lightweight tag, or an annotated one when `message` is given (`-m`
+	* implies `-a`).
+	*/
+	static tagCreate = tagCreate;
+	/** Mutating: `git tag --delete <name>` — deletes a local tag. */
+	static tagDelete = tagDelete;
+	/**
+	* `git tag --list [<pattern>]` — tag names, optionally filtered by a
+	* shell-glob pattern, one per line (refnames cannot contain newlines).
+	*/
+	static tagList = tagList;
+	/**
+	* `git for-each-ref --format=%(refname)%00%(objectname)%00%(objecttype) [<patterns>...]`
+	* — every matching ref as a NUL-separated triple: full refname, sha, and
+	* object type.
+	*
+	* @remarks
+	* The format is this package's own fixed triple — the parse contract and
+	* the argv are decided together, so the format string is a constructor
+	* literal, never caller data. An annotated tag's `objecttype` is `tag`
+	* (the tag object), not `commit`.
+	*/
+	static forEachRef = forEachRef;
+	/**
+	* `git rev-list [--max-count=<n>] [--first-parent] <ref-or-range>` — commit
+	* shas reachable from the ref (or range, e.g. `main..feat`), newest first.
+	*/
+	static revList = revList;
+	/**
+	* Mutating: `git commit [--all] [--allow-empty] [--amend] [--author=<author>] -m <message>`
+	* — records a commit. The message always rides argv behind `-m` (git
+	* consumes it as a value even when it begins with `-`); committer identity
+	* comes from the caller's environment — this constructor sets no
+	* `GIT_AUTHOR_*`/`GIT_COMMITTER_*` variables, and the optional `author`
+	* override is the fused `--author=` form.
+	*/
+	static commit = commit;
+	/**
+	* Mutating: `git push [--force | --force-with-lease] [--tags] [--set-upstream] <remote> [<refspec>]`
+	* — updates remote refs.
+	*
+	* @remarks
+	* `remote` may be a URL as well as a remote name; an embedded `userinfo@`
+	* credential is masked in {@link GitInvocation.redactedArgs}.
+	*/
+	static push = push$1;
+	/**
+	* Mutating: `git pull [--rebase] [--ff-only] <remote> [<ref>]` — fetches
+	* and integrates.
+	*
+	* @remarks
+	* `remote` may be a URL as well as a remote name; an embedded `userinfo@`
+	* credential is masked in {@link GitInvocation.redactedArgs}.
+	*/
+	static pull = pull;
+	/**
+	* `git config [-f <file>] --list -z` — every configuration entry in scope
+	* (or in the given file only), NUL-terminated, the key separated from the
+	* value by a newline within each record.
+	*
+	* @remarks
+	* `-z` is load-bearing: a config VALUE may contain newlines; only the NUL
+	* record terminator plus first-newline field split parses it losslessly.
+	* A valueless key (git's boolean-true shorthand) emits no newline at all.
+	*/
+	static configList = configList;
+	/**
+	* `git config [-f <file>] --get-all -z <key>` — every value of a
+	* (possibly multi-valued) key, NUL-terminated. An unset key exits 1 with
+	* silent stderr.
+	*/
+	static configGetAll = configGetAll;
+	/**
+	* Mutating: `git config [-f <file>] (--unset | --unset-all) <key>` —
+	* removes a key (or, with `all`, every value of a multi-valued key).
+	*
+	* @remarks
+	* git exits 5, silently, when the key was not set — a loud failure by
+	* this package's classification, deliberately: an unset that silently did
+	* nothing is indistinguishable from one that worked.
+	*/
+	static configUnset = configUnset;
+	/**
+	* Mutating: `git rm [--cached] [-r] [--force] -- <paths...>` — removes
+	* paths from the index (and, without `cached`, the working tree). The
+	* literal `--` separator makes the pathspec injection-safe by
+	* construction.
+	*/
+	static rm = rm;
+	/**
+	* Mutating: `git mv [--force] -- <source> <destination>` — moves or
+	* renames a tracked path. The literal `--` separator makes both positionals
+	* injection-safe by construction.
+	*/
+	static mv = mv;
+	/**
+	* `git check-ignore -z --stdin` — which of the given paths git would
+	* ignore, paths fed NUL-separated via stdin and answers returned
+	* NUL-separated.
+	*
+	* @remarks
+	* The `--stdin -z` form is the only fully robust one: `-z` without
+	* `--stdin` is rejected by git outright, and the non-`-z` output C-quotes
+	* special-character paths. Feeding paths via stdin also makes them
+	* injection-safe by construction — nothing caller-controlled enters the
+	* argv. When NO path is ignored, git exits 1 with silent stderr.
+	*/
+	static checkIgnore = checkIgnore;
+	/**
+	* Mutating: `git worktree add [--force] [--detach] <path> [<ref>]` —
+	* creates a linked working tree at `path`, checked out at `ref` (or the
+	* branch named after `path`'s basename).
+	*/
+	static worktreeAdd = worktreeAdd;
+	/**
+	* `git worktree list --porcelain -z` — every working tree as a block of
+	* NUL-terminated attributes (`worktree <path>`, `HEAD <sha>`,
+	* `branch <ref>` / `detached`, `bare`, `locked [<reason>]`,
+	* `prunable [<reason>]`), blocks separated by an empty attribute.
+	*/
+	static worktreeList = worktreeList;
+	/** Mutating: `git worktree remove [--force] <path>` — removes a linked working tree. */
+	static worktreeRemove = worktreeRemove;
+	/**
+	* `git ls-files --stage -z [-- <pathspec>...]` — every INDEX entry (mode,
+	* oid, stage number, path), NUL-terminated, optionally scoped to
+	* `pathspec`.
+	*
+	* @remarks
+	* The index-side sibling of {@link GitCommand.lsTree}: `lsTree` reads a
+	* COMMITTED tree at a ref, while this reads the staging area — the only
+	* place a staged-but-uncommitted gitlink (`160000 <oid> 0 <path>`) is
+	* visible. `-z` is load-bearing twice over: paths may contain newlines,
+	* and the non-`-z` output C-quotes special-character paths.
+	*/
+	static lsFiles = lsFiles;
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+git@0.5.2_effect@4.0.0-beta.101/node_modules/@effected/git/internal/run.js
+//#region ../../node_modules/.pnpm/@effected+git@0.6.0_effect@4.0.0-beta.101/node_modules/@effected/git/internal/run.js
 /**
 * Spawns `command` and collects its stdout, stderr, and exit code as a single
 * triple.
@@ -20807,7 +21061,7 @@ const runCollected = (command) => Effect.scoped(Effect.gen(function* () {
 }));
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+git@0.5.2_effect@4.0.0-beta.101/node_modules/@effected/git/Git.js
+//#region ../../node_modules/.pnpm/@effected+git@0.6.0_effect@4.0.0-beta.101/node_modules/@effected/git/Git.js
 /** git's own ceiling: a run that has not answered in 30s is not going to. */
 const GIT_TIMEOUT = Duration.seconds(30);
 /**
@@ -20835,7 +21089,16 @@ var GitCommandError = class extends Schema.TaggedErrorClass()("GitCommandError",
 	* logic routes on this instead of matching `detail` prose.
 	*/
 	kind: Schema.Literals(["refused", "failed"]),
-	/** The argument vector, without the leading `git`. */
+	/**
+	* The REDACTED argument vector, without the leading `git`.
+	*
+	* Sensitive positionals — config values, a URL's embedded userinfo — are
+	* already masked by the constructor's redaction mask before this error is
+	* constructed (`configSet`'s value reads `<redacted>`; a
+	* `https://user:token@host/...` remote keeps everything but its
+	* `userinfo@`). The raw argv is never persisted in an error value, and
+	* `message` renders this redacted vector.
+	*/
 	args: Schema.Array(Schema.String),
 	/** The working directory the command ran in. */
 	cwd: Schema.String,
@@ -20881,20 +21144,85 @@ var UnknownRefError = class extends Schema.TaggedErrorClass()("UnknownRefError",
 	}
 };
 /**
-* One entry of a `git ls-tree` listing.
+* A `git push` was rejected because the remote ref has moved: the classic
+* non-fast-forward rejection (`fetch first` / `non-fast-forward`), or a
+* `--force-with-lease` lease failure (`stale info`).
+*
+* @remarks
+* The typed signal a fetch-then-retry (or rebase-then-retry) fallback
+* branches on — every other push failure stays a {@link GitCommandError}.
+* Only `Git.push` can fail with this error.
 *
 * @public
 */
-var LsTreeEntry = class extends Schema.Class("LsTreeEntry")({
-	/** The entry's file mode, e.g. `100644`. */
-	mode: Schema.String,
-	/** The kind of object the entry points at. */
-	type: Schema.Literals([
-		"blob",
-		"tree",
-		"commit"
-	]),
-	/** The object id the entry points at. */
+var NonFastForwardError = class extends Schema.TaggedErrorClass()("NonFastForwardError", {
+	/** The working directory the push ran in. */
+	cwd: Schema.String,
+	/** The refspec that was rejected, when the caller passed one. */
+	refspec: Schema.optionalKey(Schema.String)
+}) {
+	/** Renders the rejected push into a one-line message. */
+	get message() {
+		return this.refspec !== void 0 ? `push of '${this.refspec}' rejected as non-fast-forward in ${this.cwd}` : `push rejected as non-fast-forward in ${this.cwd}`;
+	}
+};
+/**
+* A merge-shaped operation (`pull`, `stash pop`, `stash apply`) stopped with
+* conflict markers in the working tree.
+*
+* @remarks
+* The typed signal a resolve-or-abort recovery branches on. The conflicted
+* state is REAL: git has already written conflict markers, and (for `pull`)
+* `MERGE_HEAD` is set — the caller owns resolving or aborting. Detection
+* matches git's conflict report, which lands on STDOUT for a merge and on
+* stderr for a rebase-mode pull; both streams are inspected.
+*
+* @public
+*/
+var MergeConflictError = class extends Schema.TaggedErrorClass()("MergeConflictError", { 
+/** The working directory the merge ran in. */
+cwd: Schema.String }) {
+	/** Renders the conflicted merge into a one-line message. */
+	get message() {
+		return `merge conflict in ${this.cwd}: fix conflicts (or abort) before continuing`;
+	}
+};
+/**
+* A merge-shaped operation refused to start because local modifications would
+* be overwritten — git's refusal reads
+* `Your local changes ... would be overwritten by merge`.
+*
+* @remarks
+* The typed "commit or stash first" signal. Unlike {@link MergeConflictError}
+* the working tree is UNTOUCHED — git aborted before changing anything.
+* Only the merge-shaped methods (`pull`, `stashPop`, `stashApply`) can fail
+* with this error.
+*
+* @public
+*/
+var DirtyWorktreeError = class extends Schema.TaggedErrorClass()("DirtyWorktreeError", { 
+/** The working directory whose local changes blocked the operation. */
+cwd: Schema.String }) {
+	/** Renders the blocked operation into a one-line message. */
+	get message() {
+		return `local changes would be overwritten in ${this.cwd}: commit or stash them first`;
+	}
+};
+/**
+* One entry of a `git ls-tree` listing.
+*
+* @public
+*/
+var LsTreeEntry = class extends Schema.Class("LsTreeEntry")({
+	/** The entry's file mode, e.g. `100644`. */
+	mode: Schema.String,
+	/** The kind of object the entry points at. */
+	type: Schema.Literals([
+		"blob",
+		"tree",
+		"commit"
+	]),
+	/** The object id the entry points at. */
 	oid: Schema.String,
 	/** The entry's path, relative to the tree root. May contain spaces or newlines. */
 	path: Schema.String
@@ -20941,11 +21269,26 @@ const UNKNOWN_REF_PATTERNS = [
 	"couldn't find remote ref"
 ];
 const ABSENT_AT_REF_PATTERNS = ["does not exist in", "exists on disk, but not in"];
+const PUSH_REJECTED_PATTERNS = [
+	"non-fast-forward",
+	"fetch first",
+	"stale info"
+];
+const MERGE_CONFLICT_PATTERNS = [
+	"CONFLICT (",
+	"Automatic merge failed",
+	"could not apply"
+];
+const DIRTY_WORKTREE_PATTERN = "would be overwritten by";
 const matchesAny = (stderr, patterns) => patterns.some((pattern) => stderr.includes(pattern));
 /**
 * Classifies one completed run (or spawn-level `PlatformError`) against
 * git's stderr taxonomy. Written once — every `Git` method funnels through
 * this before deciding its own return value.
+*
+* `args` is the invocation's REDACTED argv: it is the only argv this
+* function may persist into a `GitCommandError`, per the #86 redaction
+* policy.
 */
 const classify = (cwd, args, outcome, kind) => {
 	if (outcome instanceof PlatformError.PlatformError) {
@@ -20968,6 +21311,11 @@ const classify = (cwd, args, outcome, kind) => {
 	};
 	if (stderr.includes(NOT_A_REPOSITORY)) return { _tag: "notARepository" };
 	if (matchesAny(stderr, UNKNOWN_REF_PATTERNS)) return { _tag: "unknownRef" };
+	if (kind === "push" && stderr.includes("[rejected]") && matchesAny(stderr, PUSH_REJECTED_PATTERNS)) return { _tag: "nonFastForward" };
+	if (kind === "merge") {
+		if (stderr.includes(DIRTY_WORKTREE_PATTERN)) return { _tag: "dirtyWorktree" };
+		if (matchesAny(stdout, MERGE_CONFLICT_PATTERNS) || matchesAny(stderr, MERGE_CONFLICT_PATTERNS)) return { _tag: "mergeConflict" };
+	}
 	if (kind === "quiet" && exitCode === 1 && stderr === "") return { _tag: "absent" };
 	if (kind === "noSuchRemote" && stderr.includes("No such remote")) return { _tag: "absent" };
 	if (kind === "show" && matchesAny(stderr, ABSENT_AT_REF_PATTERNS)) return { _tag: "absent" };
@@ -20984,13 +21332,19 @@ const classify = (cwd, args, outcome, kind) => {
 	};
 };
 /**
-* Runs `command`, classifies the outcome, and never fails: a spawn-level
-* `PlatformError` and a per-run timeout are both absorbed into the
-* `"failure"` classification rather than escaping the effect's error
-* channel.
+* Runs an invocation's command in `cwd`, classifies the outcome, and never
+* fails: a spawn-level `PlatformError` and a per-run timeout are both
+* absorbed into the `"failure"` classification rather than escaping the
+* effect's error channel.
+*
+* The argv handed to `classify` — and therefore persisted into any
+* `GitCommandError` — is the invocation's REDACTED argv, never the raw one:
+* the redaction mask the pure constructor carries is applied here, at the
+* single classification choke point (the #86 redaction policy).
 */
-const runClassified = (command, cwd, kind) => {
-	const args = ChildProcess.isStandardCommand(command) ? command.args : [];
+const runClassified = (invocation, cwd, kind) => {
+	const args = invocation.redactedArgs;
+	const command = ChildProcess.setCwd(invocation.command, cwd);
 	return runCollected(command).pipe(Effect.map((collected) => classify(cwd, args, collected, kind)), Effect.catch((platformError) => Effect.succeed(classify(cwd, args, platformError, kind))), Effect.timeoutOrElse({
 		duration: GIT_TIMEOUT,
 		orElse: () => Effect.succeed({
@@ -21022,414 +21376,1417 @@ const parseLsTree = (output) => parseNulSeparated(output).map((entry) => {
 		oid: header[2] ?? "",
 		path
 	});
-});
-/** git's one-letter name-status codes, score digits stripped (`R100` → `R`). */
-const NAME_STATUS_CODES = {
-	A: "added",
-	B: "broken",
-	C: "copied",
-	D: "deleted",
-	M: "modified",
-	R: "renamed",
-	T: "typeChanged",
-	U: "unmerged",
-	X: "unknown"
-};
-/**
-* Parses `git diff --name-status -z` output. A plain entry is two NUL tokens
-* (`<code>`, `<path>`); a rename/copy entry is three (`<R|C><score>`,
-* `<oldPath>`, `<newPath>`), and only the code's first character carries the
-* status — the similarity score digits are dropped.
-*/
-const parseNameStatus = (output) => {
-	const tokens = output.split("\0");
-	const entries = [];
-	let index = 0;
-	while (index < tokens.length) {
-		const code = tokens[index] ?? "";
-		if (code === "") {
-			index += 1;
-			continue;
+});
+/** git's one-letter name-status codes, score digits stripped (`R100` → `R`). */
+const NAME_STATUS_CODES = {
+	A: "added",
+	B: "broken",
+	C: "copied",
+	D: "deleted",
+	M: "modified",
+	R: "renamed",
+	T: "typeChanged",
+	U: "unmerged",
+	X: "unknown"
+};
+/**
+* Parses `git diff --name-status -z` output. A plain entry is two NUL tokens
+* (`<code>`, `<path>`); a rename/copy entry is three (`<R|C><score>`,
+* `<oldPath>`, `<newPath>`), and only the code's first character carries the
+* status — the similarity score digits are dropped.
+*/
+const parseNameStatus = (output) => {
+	const tokens = output.split("\0");
+	const entries = [];
+	let index = 0;
+	while (index < tokens.length) {
+		const code = tokens[index] ?? "";
+		if (code === "") {
+			index += 1;
+			continue;
+		}
+		const letter = code.charAt(0);
+		const status = NAME_STATUS_CODES[letter] ?? "unknown";
+		if (letter === "R" || letter === "C") {
+			entries.push(NameStatusEntry.make({
+				status,
+				path: tokens[index + 2] ?? "",
+				oldPath: tokens[index + 1] ?? ""
+			}));
+			index += 3;
+		} else {
+			entries.push(NameStatusEntry.make({
+				status,
+				path: tokens[index + 1] ?? ""
+			}));
+			index += 2;
+		}
+	}
+	return entries;
+};
+/**
+* The metadata of a single commit, read via `git log -1` with NUL-separated
+* `%H` / `%G?` / `%B` placeholders.
+*
+* @public
+*/
+var CommitInfo = class extends Schema.Class("CommitInfo")({
+	/** The commit's full object id (`%H`). */
+	sha: Schema.String,
+	/** git's `%G?` signature verdict: Good, Bad, Unknown validity, eXpired, expired-key (Y), Revoked, cannot-check (E), None. */
+	signatureStatus: Schema.Literals([
+		"G",
+		"B",
+		"U",
+		"X",
+		"Y",
+		"R",
+		"E",
+		"N"
+	]),
+	/** The raw commit message (`%B`), untrimmed — includes git's trailing format newline. */
+	message: Schema.String
+}) {};
+/** One two-letter porcelain v1 status axis code. */
+const porcelainCode = Schema.Literals([
+	" ",
+	"M",
+	"T",
+	"A",
+	"D",
+	"R",
+	"C",
+	"U",
+	"?",
+	"!"
+]);
+/**
+* One entry of a `git status --porcelain -z` listing.
+*
+* @public
+*/
+var StatusEntry = class extends Schema.Class("StatusEntry")({
+	/** The index-side status code (first porcelain column). */
+	x: porcelainCode,
+	/** The working-tree-side status code (second porcelain column). */
+	y: porcelainCode,
+	/** The entry's path — for a rename or copy, the NEW path. */
+	path: Schema.String,
+	/** The original path; present only on rename/copy entries. */
+	origPath: Schema.optionalKey(Schema.String)
+}) {
+	/**
+	* Renders this entry back to one porcelain-shaped line: `XY <path>`.
+	*
+	* @remarks
+	* **The rename convention is decided here, once, for every consumer.** By
+	* default a rename/copy entry renders its NEW path only — `path` IS the
+	* entry's current path, the one a line-oriented downstream can actually
+	* open — which is a deliberate divergence from git's own non-`-z`
+	* rendering (`orig -> new`). The arrow form is ambiguous to naive
+	* line/whitespace splitters (paths may contain spaces, or a literal
+	* `" -> "`), so it is opt-in via `renames: "arrow"` for consumers that
+	* want git parity.
+	*
+	* A second recorded divergence: git's non-`-z` porcelain C-quotes paths
+	* containing special characters; this renderer emits paths raw. It exists
+	* for whitespace-insensitive text consumers — a machine parser should
+	* consume the decoded {@link StatusEntry} values (or `-z` output)
+	* directly, never re-parse this rendering.
+	*/
+	toLine(options) {
+		const rendered = options?.renames === "arrow" && this.origPath !== void 0 ? `${this.origPath} -> ${this.path}` : this.path;
+		return `${this.x}${this.y} ${rendered}`;
+	}
+	/**
+	* Renders entries back to porcelain-shaped text: one {@link StatusEntry.toLine}
+	* line per entry, newline-joined, no trailing newline.
+	*
+	* @remarks
+	* The route back from `Git.status`'s parsed entries to line-oriented text,
+	* so a consumer whose downstream contract is porcelain-shaped text does
+	* not hand-roll its own renderer (and re-decide the rename convention —
+	* see {@link StatusEntry.toLine} for that decision). An empty array
+	* renders as the empty string.
+	*/
+	static format = (entries, options) => entries.map((entry) => entry.toLine(options)).join("\n");
+};
+/**
+* Parses `git log -1 --format=%H%x00%G?%x00%B` output: exactly two NUL
+* separators, everything after the second is the raw message, untrimmed.
+* Only ever called on the successful output of this package's own format
+* string, so the separators are guaranteed present.
+*/
+const parseCommitInfo = (output) => {
+	const first = output.indexOf("\0");
+	const second = output.indexOf("\0", first + 1);
+	return CommitInfo.make({
+		sha: output.slice(0, first),
+		signatureStatus: output.slice(first + 1, second),
+		message: output.slice(second + 1)
+	});
+};
+/**
+* Parses `git status --porcelain -z` output: each entry is `XY <path>`, and a
+* rename/copy entry appends the ORIGINAL path as one extra NUL token AFTER
+* the new path — the opposite order from `diff --name-status`.
+*/
+const parseStatus = (output) => {
+	const tokens = output.split("\0");
+	const entries = [];
+	let index = 0;
+	while (index < tokens.length) {
+		const token = tokens[index] ?? "";
+		if (token === "") {
+			index += 1;
+			continue;
+		}
+		const x = token.charAt(0);
+		const y = token.charAt(1);
+		const path = token.slice(3);
+		if (x === "R" || x === "C" || y === "R" || y === "C") {
+			entries.push(StatusEntry.make({
+				x,
+				y,
+				path,
+				origPath: tokens[index + 1] ?? ""
+			}));
+			index += 2;
+		} else {
+			entries.push(StatusEntry.make({
+				x,
+				y,
+				path
+			}));
+			index += 1;
+		}
+	}
+	return entries;
+};
+/**
+* One line of a `git submodule status` listing.
+*
+* @remarks
+* The `state` decodes git's one-character prefix: `" "` → `"current"` (the
+* checked-out commit matches the index gitlink), `"-"` → `"uninitialized"`,
+* `"+"` → `"outOfSync"` (the checked-out commit differs from the gitlink),
+* `"U"` → `"conflict"` (merge conflicts). `describe` carries the
+* parenthesized `git describe` suffix git appends for initialized
+* submodules.
+*
+* @public
+*/
+var SubmoduleStatusEntry = class extends Schema.Class("SubmoduleStatusEntry")({
+	/** The decoded state prefix. */
+	state: Schema.Literals([
+		"current",
+		"uninitialized",
+		"outOfSync",
+		"conflict"
+	]),
+	/** The submodule's checked-out (or, uninitialized, gitlink) commit sha. */
+	sha: Schema.String,
+	/** The submodule's path relative to the superproject root. */
+	path: Schema.String,
+	/** The `git describe` suffix, present only for initialized submodules. */
+	describe: Schema.optionalKey(Schema.String)
+}) {};
+/**
+* Parses `git submodule status` output. Line-based — the one parser in this
+* package without a `-z` mode to lean on, because git does not offer one for
+* `submodule status`; a submodule path containing a newline (or a literal
+* ` (` suffix mimicking the describe parenthesis) would corrupt the parse.
+* Accepted as a git-imposed limitation.
+*/
+const parseSubmoduleStatus = (output) => {
+	const entries = [];
+	for (const line of output.split("\n")) {
+		const trimmedEnd = line.endsWith("\r") ? line.slice(0, -1) : line;
+		if (trimmedEnd === "") continue;
+		const prefix = trimmedEnd.charAt(0);
+		const state = prefix === "-" ? "uninitialized" : prefix === "+" ? "outOfSync" : prefix === "U" ? "conflict" : "current";
+		const rest = prefix === " " || prefix === "-" || prefix === "+" || prefix === "U" ? trimmedEnd.slice(1) : trimmedEnd;
+		const shaEnd = rest.indexOf(" ");
+		const sha = shaEnd === -1 ? rest : rest.slice(0, shaEnd);
+		const remainder = shaEnd === -1 ? "" : rest.slice(shaEnd + 1);
+		const describeStart = remainder.endsWith(")") ? remainder.lastIndexOf(" (") : -1;
+		if (describeStart === -1) entries.push(SubmoduleStatusEntry.make({
+			state,
+			sha,
+			path: remainder
+		}));
+		else entries.push(SubmoduleStatusEntry.make({
+			state,
+			sha,
+			path: remainder.slice(0, describeStart),
+			describe: remainder.slice(describeStart + 2, -1)
+		}));
+	}
+	return entries;
+};
+/**
+* One ref a remote advertises, from `git ls-remote`.
+*
+* @remarks
+* `ref` is the FULL refname as advertised (`refs/heads/main`,
+* `refs/tags/v1`), including the `^{}` suffix on an annotated tag's peeled
+* entry — an annotated tag appears twice, once as the tag object and once
+* peeled to its commit.
+*
+* @public
+*/
+var LsRemoteEntry = class LsRemoteEntry extends Schema.Class("LsRemoteEntry")({
+	/** The sha the advertised ref points at. */
+	sha: Schema.String,
+	/** The full advertised refname, `^{}` peel suffix included. */
+	ref: Schema.String
+}) {
+	/**
+	* The human-facing short name of an advertised refname: the
+	* `refs/heads/` / `refs/tags/` / `refs/remotes/` prefix and any `^{}`
+	* peel suffix stripped (`refs/tags/v1^{}` → `v1`).
+	*/
+	static shortName = (ref) => {
+		const base = ref.endsWith("^{}") ? ref.slice(0, -3) : ref;
+		for (const prefix of [
+			"refs/heads/",
+			"refs/tags/",
+			"refs/remotes/"
+		]) if (base.startsWith(prefix)) return base.slice(prefix.length);
+		return base;
+	};
+	/**
+	* The entries whose short name is a NEAR MISS for `ref`: not an exact
+	* match, but ending in `ref` right behind a separator (`@`, `/`, `-`,
+	* `_`) — the monorepo-prefixed-tag case, where a caller asks for
+	* `4.0.0-beta.101` and the remote advertises `effect@4.0.0-beta.101`.
+	*
+	* @remarks
+	* A pure, decode-side helper for validate-before-mutate flows: run
+	* `lsRemote`, look for the wanted ref, and when it is absent hand the
+	* listing to this to compute a suggestion. Deliberately a helper on the
+	* ENTRY value rather than behavior baked into the service — the service
+	* returns the full listing and the caller owns the matching policy. An
+	* annotated tag's peeled `^{}` entry shares its base short name, so a
+	* near miss on such a tag can surface both of its entries.
+	*/
+	static nearMatches = (entries, ref) => {
+		const separators = [
+			"@",
+			"/",
+			"-",
+			"_"
+		];
+		return entries.filter((entry) => {
+			const short = LsRemoteEntry.shortName(entry.ref);
+			if (short === ref || !short.endsWith(ref)) return false;
+			return separators.includes(short.charAt(short.length - ref.length - 1));
+		});
+	};
+};
+/**
+* Parses `git ls-remote` output: one `<sha>\t<refname>` line per advertised
+* ref. Line-based deliberately — refnames cannot contain a newline (or a
+* tab), so the split is safe without a `-z` mode (which `ls-remote` does not
+* offer).
+*/
+const parseLsRemote = (output) => output.split("\n").filter((line) => line.length > 0).map((line) => {
+	const tabIndex = line.indexOf("	");
+	return LsRemoteEntry.make({
+		sha: line.slice(0, tabIndex),
+		ref: line.slice(tabIndex + 1)
+	});
+});
+/**
+* One stash entry, from `git stash list`.
+*
+* @public
+*/
+var StashEntry = class extends Schema.Class("StashEntry")({
+	/** The reflog selector (`stash@{0}`) — the index other stash methods take. */
+	ref: Schema.String,
+	/** The stash commit's sha. */
+	sha: Schema.String,
+	/** The reflog subject: `WIP on <branch>: ...` or `On <branch>: <message>`. */
+	message: Schema.String
+}) {};
+/**
+* Parses `git stash list -z --format=%gd%x1f%H%x1f%gs` output: NUL-terminated
+* records of unit-separated (`\x1f`) fields. Reflog subjects are single-line
+* and cannot contain either separator byte.
+*/
+const parseStashList = (output) => parseNulSeparated(output).map((record) => {
+	const [ref = "", sha = "", ...rest] = record.split("");
+	return StashEntry.make({
+		ref,
+		sha,
+		message: rest.join("")
+	});
+});
+/**
+* One local (or remote-tracking) branch, from `git branch --list`.
+*
+* @public
+*/
+var BranchEntry = class extends Schema.Class("BranchEntry")({
+	/** The short branch name (`main`, or `origin/main` for a remote branch). */
+	name: Schema.String,
+	/** The branch tip's sha. */
+	sha: Schema.String,
+	/** Whether this branch is checked out in the current working tree. */
+	current: Schema.Boolean
+}) {};
+/**
+* Parses `git branch --list --format=%(HEAD)%00%(refname:short)%00%(objectname)`
+* output: newline-separated records (refnames cannot contain newlines) of
+* NUL-separated fields. The `%(HEAD)` marker is `*` for the checked-out
+* branch; anything else (` `, or `+` for a branch checked out in a linked
+* worktree) is not-current.
+*/
+const parseBranchList = (output) => output.split("\n").filter((line) => line.length > 0).map((line) => {
+	const [marker = "", name = "", sha = ""] = line.split("\0");
+	return BranchEntry.make({
+		name,
+		sha,
+		current: marker === "*"
+	});
+});
+/**
+* One ref, from `git for-each-ref`.
+*
+* @public
+*/
+var RefEntry = class extends Schema.Class("RefEntry")({
+	/** The full refname (`refs/tags/v1`). */
+	ref: Schema.String,
+	/** The sha of the object the ref points at. */
+	sha: Schema.String,
+	/**
+	* The pointed-at object's type. An annotated tag is `tag` (the tag
+	* object itself, not its target commit).
+	*/
+	objectType: Schema.Literals([
+		"commit",
+		"tag",
+		"tree",
+		"blob"
+	])
+}) {};
+/**
+* Parses `git for-each-ref --format=%(refname)%00%(objectname)%00%(objecttype)`
+* output: newline-separated records (refnames cannot contain newlines) of
+* NUL-separated fields.
+*/
+const parseForEachRef = (output) => output.split("\n").filter((line) => line.length > 0).map((line) => {
+	const [ref = "", sha = "", objectType = "commit"] = line.split("\0");
+	return RefEntry.make({
+		ref,
+		sha,
+		objectType
+	});
+});
+/**
+* One configuration entry, from `git config --list`.
+*
+* @public
+*/
+var ConfigListEntry = class extends Schema.Class("ConfigListEntry")({
+	/** The canonical dotted key (`section.subsection.key`). */
+	key: Schema.String,
+	/**
+	* The raw value. A valueless key (git's boolean-true shorthand,
+	* `[section]` + bare `key`) surfaces as the empty string — distinguish it
+	* with `configGetAll` if the difference matters.
+	*/
+	value: Schema.String
+}) {};
+/**
+* Parses `git config --list -z` output: NUL-terminated records, key separated
+* from value by the FIRST newline (a config value may itself contain
+* newlines — the reason `-z` is load-bearing). A record with no newline is a
+* valueless boolean-shorthand key.
+*/
+const parseConfigList = (output) => parseNulSeparated(output).map((record) => {
+	const newlineIndex = record.indexOf("\n");
+	return newlineIndex === -1 ? ConfigListEntry.make({
+		key: record,
+		value: ""
+	}) : ConfigListEntry.make({
+		key: record.slice(0, newlineIndex),
+		value: record.slice(newlineIndex + 1)
+	});
+});
+/**
+* One working tree, from `git worktree list --porcelain`.
+*
+* @public
+*/
+var WorktreeEntry = class extends Schema.Class("WorktreeEntry")({
+	/** The working tree's absolute path. */
+	path: Schema.String,
+	/** The checked-out commit sha; absent for a bare repository entry. */
+	head: Schema.optionalKey(Schema.String),
+	/** The checked-out branch's full refname; absent when detached or bare. */
+	branch: Schema.optionalKey(Schema.String),
+	/** Whether the working tree is in detached-HEAD state. */
+	detached: Schema.Boolean,
+	/** Whether the entry is the bare repository itself. */
+	bare: Schema.Boolean,
+	/** Present when the worktree is locked; holds the lock reason (possibly empty). */
+	locked: Schema.optionalKey(Schema.String),
+	/** Present when the worktree is prunable; holds the reason (possibly empty). */
+	prunable: Schema.optionalKey(Schema.String)
+}) {};
+/**
+* Parses `git worktree list --porcelain -z` output: NUL-terminated attribute
+* lines, one blank attribute terminating each entry. Attribute vocabulary:
+* `worktree <path>`, `HEAD <sha>`, `branch <ref>`, and the flag/annotation
+* attributes `detached`, `bare`, `locked [<reason>]`, `prunable [<reason>]`.
+*/
+const parseWorktreeList = (output) => {
+	const entries = [];
+	let path;
+	let head;
+	let branch;
+	let detached = false;
+	let bare = false;
+	let locked;
+	let prunable;
+	const flush = () => {
+		if (path !== void 0) entries.push(WorktreeEntry.make({
+			path,
+			detached,
+			bare,
+			...head !== void 0 ? { head } : {},
+			...branch !== void 0 ? { branch } : {},
+			...locked !== void 0 ? { locked } : {},
+			...prunable !== void 0 ? { prunable } : {}
+		}));
+		path = void 0;
+		head = void 0;
+		branch = void 0;
+		detached = false;
+		bare = false;
+		locked = void 0;
+		prunable = void 0;
+	};
+	for (const attribute of output.split("\0")) if (attribute === "") flush();
+	else if (attribute.startsWith("worktree ")) path = attribute.slice(9);
+	else if (attribute.startsWith("HEAD ")) head = attribute.slice(5);
+	else if (attribute.startsWith("branch ")) branch = attribute.slice(7);
+	else if (attribute === "detached") detached = true;
+	else if (attribute === "bare") bare = true;
+	else if (attribute === "locked" || attribute.startsWith("locked ")) locked = attribute === "locked" ? "" : attribute.slice(7);
+	else if (attribute === "prunable" || attribute.startsWith("prunable ")) prunable = attribute === "prunable" ? "" : attribute.slice(9);
+	flush();
+	return entries;
+};
+/**
+* One index (staging area) entry, from `git ls-files --stage`.
+*
+* @remarks
+* The index-side sibling of {@link LsTreeEntry}: this is the ONLY place a
+* staged-but-uncommitted gitlink (`mode` `160000`) is visible — `lsTree`
+* reads the committed tree and misses exactly that window.
+*
+* @public
+*/
+var LsFilesEntry = class extends Schema.Class("LsFilesEntry")({
+	/** The entry's file mode, e.g. `100644` — `160000` for a gitlink. */
+	mode: Schema.String,
+	/** The staged object id. */
+	oid: Schema.String,
+	/** The merge stage: `0` normally; `1`/`2`/`3` during an unresolved merge. */
+	stage: Schema.Number,
+	/** The entry's path, relative to `cwd`. May contain spaces or newlines. */
+	path: Schema.String
+}) {};
+/**
+* Parses `git ls-files --stage -z` output: each NUL-terminated entry is
+* `<mode> <oid> <stage>\t<path>`. `path` is everything after the first tab,
+* so a path containing spaces or newlines is preserved intact — the same
+* split rule as `parseLsTree`.
+*/
+const parseLsFiles = (output) => parseNulSeparated(output).map((entry) => {
+	const tabIndex = entry.indexOf("	");
+	const header = entry.slice(0, tabIndex).split(" ");
+	return LsFilesEntry.make({
+		mode: header[0] ?? "",
+		oid: header[1] ?? "",
+		stage: Number(header[2] ?? "0"),
+		path: entry.slice(tabIndex + 1)
+	});
+});
+/**
+* Refuse a caller-supplied ref or range that git would parse as an option.
+*
+* Refs are caller-controlled and land in git's argv as positional entries; a
+* value beginning with `-` is read as a flag instead — `checkout("-b")` would
+* CREATE a branch. A bare `--` separator is not a safe fix for every command
+* (it switches `checkout` into pathspec mode), so option-like values are
+* refused outright, before any spawn, as a typed {@link GitCommandError}.
+* `show`'s `path` needs no guard: it is fused after the ref into one
+* `ref:path` token, which cannot begin with `-` unless the ref does.
+*
+* `sensitive` values get the same check but a REDACTED report: a refused
+* sensitive positional (a `configSet` value) must not leak into
+* `GitCommandError.args`/`detail` any more than a spawned one may — the #86
+* redaction policy applies to guard rejections too.
+*/
+const rejectOptionLikeRefs = (cwd, refs, sensitive = []) => {
+	const offending = refs.find((ref) => ref.startsWith("-"));
+	if (offending !== void 0) return Effect.fail(new GitCommandError({
+		kind: "refused",
+		args: [offending],
+		cwd,
+		stderr: "",
+		detail: `refused a ref argument git would parse as an option: ${JSON.stringify(offending)}`
+	}));
+	return sensitive.find((value) => value.startsWith("-")) === void 0 ? Effect.void : Effect.fail(new GitCommandError({
+		kind: "refused",
+		args: ["<redacted>"],
+		cwd,
+		stderr: "",
+		detail: "refused a sensitive argument git would parse as an option (value redacted)"
+	}));
+};
+/**
+* Refuse a caller-supplied numeric index/limit that is not a non-negative
+* integer.
+*
+* Every relational comparison against `NaN` is `false`, so a bare
+* `value < 0` guard admits `NaN` (and a fractional value truncates nothing —
+* it rides straight into the argv as `stash@{1.5}` / `--max-count=NaN`).
+* Integrality and range are therefore checked together, pre-spawn, as a
+* typed refusal.
+*/
+const rejectNonNaturalNumber = (cwd, label, value) => value === void 0 || Number.isInteger(value) && value >= 0 ? Effect.void : Effect.fail(new GitCommandError({
+	kind: "refused",
+	args: [String(value)],
+	cwd,
+	stderr: "",
+	detail: `refused ${label}: expected a non-negative integer, received ${value}`
+}));
+/** Builds the `Git.Service` shape over an already-resolved `ChildProcessSpawner`. */
+const make = (spawner) => {
+	const runFor = (invocation, cwd, kind) => runClassified(invocation, cwd, kind).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner));
+	const show = Effect.fn("Git.show")(function* (cwd, ref, path) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			ref,
+			path
+		});
+		yield* rejectOptionLikeRefs(cwd, [ref]);
+		const classified = yield* runFor(GitCommand.show(ref, path), cwd, "show");
+		switch (classified._tag) {
+			case "success": return Option.some(classified.output);
+			case "absent": return Option.none();
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.show: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const lsTree = Effect.fn("Git.lsTree")(function* (cwd, ref, options) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			ref
+		});
+		yield* rejectOptionLikeRefs(cwd, [ref]);
+		const classified = yield* runFor(GitCommand.lsTree(ref, options?.pathspec ?? []), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return parseLsTree(classified.output);
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.lsTree: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const refExists = Effect.fn("Git.refExists")(function* (cwd, ref) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			ref
+		});
+		yield* rejectOptionLikeRefs(cwd, [ref]);
+		const classified = yield* runFor(GitCommand.refExists(ref), cwd, "refExists");
+		switch (classified._tag) {
+			case "success": return true;
+			case "refMissing": return false;
+			case "unknownRef": return false;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.refExists: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const mergeBase = Effect.fn("Git.mergeBase")(function* (cwd, a, b) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			a,
+			b
+		});
+		yield* rejectOptionLikeRefs(cwd, [a, b]);
+		const classified = yield* runFor(GitCommand.mergeBase(a, b), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return classified.output.trim();
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: `${a}...${b}`,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.mergeBase: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const changedFiles = Effect.fn("Git.changedFiles")(function* (cwd, options) {
+		const relative = options.relative ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			base: options.base,
+			head: options.head,
+			relative
+		});
+		yield* rejectOptionLikeRefs(cwd, [options.base, options.head]);
+		const classified = yield* runFor(GitCommand.changedFiles(options.base, options.head, relative), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return parseNulSeparated(classified.output);
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: `${options.base}...${options.head}`,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.changedFiles: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const collectPaths = (method, invocation, cwd) => Effect.gen(function* () {
+		const classified = yield* runFor(invocation, cwd, "generic");
+		switch (classified._tag) {
+			case "success": return parseNulSeparated(classified.output);
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "working tree",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`${method}: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const unstagedChanges = Effect.fn("Git.unstagedChanges")(function* (cwd, options) {
+		const relative = options?.relative ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			relative
+		});
+		return yield* collectPaths("Git.unstagedChanges", GitCommand.unstagedChanges(relative), cwd);
+	});
+	const stagedChanges = Effect.fn("Git.stagedChanges")(function* (cwd, options) {
+		const relative = options?.relative ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			relative
+		});
+		return yield* collectPaths("Git.stagedChanges", GitCommand.stagedChanges(relative), cwd);
+	});
+	const untrackedFiles = Effect.fn("Git.untrackedFiles")(function* (cwd, options) {
+		const relative = options?.relative ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			relative
+		});
+		return yield* collectPaths("Git.untrackedFiles", GitCommand.untrackedFiles(relative), cwd);
+	});
+	const workingChanges = Effect.fn("Git.workingChanges")(function* (cwd, options) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			relative: options?.relative ?? false
+		});
+		const unstaged = yield* unstagedChanges(cwd, options);
+		const staged = yield* stagedChanges(cwd, options);
+		const untracked = yield* untrackedFiles(cwd, options);
+		return [.../* @__PURE__ */ new Set([
+			...unstaged,
+			...staged,
+			...untracked
+		])];
+	});
+	const nameStatus = Effect.fn("Git.nameStatus")(function* (cwd, options) {
+		const relative = options.relative ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			base: options.base,
+			head: options.head ?? "(working tree)",
+			relative
+		});
+		yield* rejectOptionLikeRefs(cwd, options.head === void 0 ? [options.base] : [options.base, options.head]);
+		const classified = yield* runFor(GitCommand.nameStatus(options.base, options.head, relative), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return parseNameStatus(classified.output);
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: options.head === void 0 ? options.base : `${options.base}...${options.head}`,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.nameStatus: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const revParse = Effect.fn("Git.revParse")(function* (cwd, ref) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			ref
+		});
+		yield* rejectOptionLikeRefs(cwd, [ref]);
+		const classified = yield* runFor(GitCommand.revParse(ref), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return classified.output.trim();
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.revParse: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const checkout = Effect.fn("Git.checkout")(function* (cwd, ref, options) {
+		const detach = options?.detach ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			ref,
+			detach
+		});
+		yield* rejectOptionLikeRefs(cwd, [ref]);
+		const classified = yield* runFor(GitCommand.checkout(ref, detach), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.checkout: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const reset = Effect.fn("Git.reset")(function* (cwd, options) {
+		const mode = options?.mode ?? "mixed";
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			mode,
+			ref: options?.ref ?? "HEAD"
+		});
+		if (options?.ref !== void 0) yield* rejectOptionLikeRefs(cwd, [options.ref]);
+		const classified = yield* runFor(GitCommand.reset(mode, options?.ref), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: options?.ref ?? "HEAD",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.reset: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const clean = Effect.fn("Git.clean")(function* (cwd, options) {
+		const directories = options?.directories ?? false;
+		const ignored = options?.ignored ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			directories,
+			ignored
+		});
+		const classified = yield* runFor(GitCommand.clean(directories, ignored, options?.paths ?? []), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "working tree",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.clean: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const restore = Effect.fn("Git.restore")(function* (cwd, paths, options) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			count: paths.length,
+			source: options?.source ?? "(index)"
+		});
+		if (options?.source !== void 0) yield* rejectOptionLikeRefs(cwd, [options.source]);
+		const classified = yield* runFor(GitCommand.restore(paths, options?.source, options?.staged ?? false, options?.worktree ?? false), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: options?.source ?? "working tree",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.restore: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const branchCreate = Effect.fn("Git.branchCreate")(function* (cwd, name, options) {
+		const checkoutBranch = options?.checkout ?? false;
+		const force = options?.force ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			name,
+			startPoint: options?.startPoint ?? "HEAD",
+			checkout: checkoutBranch,
+			force
+		});
+		yield* rejectOptionLikeRefs(cwd, [name, ...options?.startPoint !== void 0 ? [options.startPoint] : []]);
+		const classified = yield* runFor(GitCommand.branchCreate(name, options?.startPoint, checkoutBranch, force), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: options?.startPoint ?? name,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.branchCreate: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const branchDelete = Effect.fn("Git.branchDelete")(function* (cwd, name, options) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			name,
+			force: options?.force ?? false
+		});
+		yield* rejectOptionLikeRefs(cwd, [name]);
+		const classified = yield* runFor(GitCommand.branchDelete(name, options?.force ?? false), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: name,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.branchDelete: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const isShallow = Effect.fn("Git.isShallow")(function* (cwd) {
+		yield* Effect.annotateCurrentSpan({ cwd });
+		const classified = yield* runFor(GitCommand.isShallow(), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return classified.output.trim() === "true";
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "HEAD",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.isShallow: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const fetchUnshallow = Effect.fn("Git.fetchUnshallow")(function* (cwd, options) {
+		const remote = options?.remote ?? "origin";
+		yield* Effect.annotateCurrentSpan({ cwd });
+		yield* rejectOptionLikeRefs(cwd, [remote]);
+		const classified = yield* runFor(GitCommand.fetchUnshallow(remote), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "--unshallow",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.fetchUnshallow: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const fetch = Effect.fn("Git.fetch")(function* (cwd, options) {
+		const remote = options.remote ?? "origin";
+		const tag = options.tag ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			ref: options.ref,
+			tag
+		});
+		yield* rejectOptionLikeRefs(cwd, [remote, options.ref]);
+		yield* rejectNonNaturalNumber(cwd, "a fetch depth", options.depth);
+		const classified = yield* runFor(GitCommand.fetch(remote, options.ref, options.depth, tag), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: options.ref,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.fetch: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const fetchAny = Effect.fn("Git.fetchAny")(function* (cwd, options) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			ref: options.ref
+		});
+		return yield* fetch(cwd, {
+			...options,
+			tag: true
+		}).pipe(Effect.catchTag(["UnknownRefError", "GitCommandError"], (error) => error._tag === "GitCommandError" && error.kind === "refused" ? Effect.fail(error) : fetch(cwd, options)));
+	});
+	const submoduleUpdate = Effect.fn("Git.submoduleUpdate")(function* (cwd, options) {
+		const init = options?.init ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			init
+		});
+		yield* rejectNonNaturalNumber(cwd, "a submodule update depth", options?.depth);
+		const classified = yield* runFor(GitCommand.submoduleUpdate(init, options?.depth, options?.paths ?? []), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "submodule update",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.submoduleUpdate: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const submoduleAdd = Effect.fn("Git.submoduleAdd")(function* (cwd, options) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			path: options.path
+		});
+		yield* rejectNonNaturalNumber(cwd, "a submodule add depth", options.depth);
+		const classified = yield* runFor(GitCommand.submoduleAdd(options.url, options.path, options.depth), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: options.path,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.submoduleAdd: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const sparseCheckoutSet = Effect.fn("Git.sparseCheckoutSet")(function* (cwd, patterns, options) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			cone: options.cone
+		});
+		yield* rejectOptionLikeRefs(cwd, patterns);
+		const classified = yield* runFor(GitCommand.sparseCheckoutSet(patterns, options.cone), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "sparse-checkout",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.sparseCheckoutSet: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const configSet = Effect.fn("Git.configSet")(function* (cwd, key, value, options) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			key,
+			file: options?.file ?? "(repository config)"
+		});
+		yield* rejectOptionLikeRefs(cwd, [key, ...options?.file !== void 0 ? [options.file] : []], [value]);
+		const classified = yield* runFor(GitCommand.configSet(key, value, options?.file), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: key,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.configSet: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const add = Effect.fn("Git.add")(function* (cwd, paths) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			count: paths.length
+		});
+		const classified = yield* runFor(GitCommand.add(paths), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "working tree",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.add: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const defaultBranch = Effect.fn("Git.defaultBranch")(function* (cwd, options) {
+		const remote = options?.remote ?? "origin";
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			remote
+		});
+		yield* rejectOptionLikeRefs(cwd, [remote]);
+		const classified = yield* runFor(GitCommand.defaultBranch(remote), cwd, "quiet");
+		switch (classified._tag) {
+			case "success": {
+				const short = classified.output.trim();
+				const prefix = `${remote}/`;
+				return Option.some(short.startsWith(prefix) ? short.slice(prefix.length) : short);
+			}
+			case "absent": return Option.none();
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: `refs/remotes/${remote}/HEAD`,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.defaultBranch: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const currentBranch = Effect.fn("Git.currentBranch")(function* (cwd) {
+		yield* Effect.annotateCurrentSpan({ cwd });
+		const classified = yield* runFor(GitCommand.currentBranch(), cwd, "generic");
+		switch (classified._tag) {
+			case "success": {
+				const name = classified.output.trim();
+				return name === "HEAD" ? Option.none() : Option.some(name);
+			}
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "HEAD",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.currentBranch: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const repoRoot = Effect.fn("Git.repoRoot")(function* (cwd) {
+		yield* Effect.annotateCurrentSpan({ cwd });
+		const classified = yield* runFor(GitCommand.repoRoot(), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return classified.output.trim();
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "working tree",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.repoRoot: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const configGet = Effect.fn("Git.configGet")(function* (cwd, key) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			key
+		});
+		yield* rejectOptionLikeRefs(cwd, [key]);
+		const classified = yield* runFor(GitCommand.configGet(key), cwd, "quiet");
+		switch (classified._tag) {
+			case "success": return Option.some(classified.output.trim());
+			case "absent": return Option.none();
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: key,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.configGet: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const remoteUrl = Effect.fn("Git.remoteUrl")(function* (cwd, options) {
+		const remote = options?.remote ?? "origin";
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			remote
+		});
+		yield* rejectOptionLikeRefs(cwd, [remote]);
+		const classified = yield* runFor(GitCommand.remoteUrl(remote), cwd, "noSuchRemote");
+		switch (classified._tag) {
+			case "success": return Option.some(classified.output.trim());
+			case "absent": return Option.none();
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: remote,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.remoteUrl: unexpected classification "${classified._tag}"`);
 		}
-		const letter = code.charAt(0);
-		const status = NAME_STATUS_CODES[letter] ?? "unknown";
-		if (letter === "R" || letter === "C") {
-			entries.push(NameStatusEntry.make({
-				status,
-				path: tokens[index + 2] ?? "",
-				oldPath: tokens[index + 1] ?? ""
+	});
+	const commitInfo = Effect.fn("Git.commitInfo")(function* (cwd, ref) {
+		const target = ref ?? "HEAD";
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			ref: target
+		});
+		yield* rejectOptionLikeRefs(cwd, [target]);
+		const classified = yield* runFor(GitCommand.commitInfo(target), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return parseCommitInfo(classified.output);
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: target,
+				cwd
 			}));
-			index += 3;
-		} else {
-			entries.push(NameStatusEntry.make({
-				status,
-				path: tokens[index + 1] ?? ""
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.commitInfo: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const status = Effect.fn("Git.status")(function* (cwd) {
+		yield* Effect.annotateCurrentSpan({ cwd });
+		const classified = yield* runFor(GitCommand.status(), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return parseStatus(classified.output);
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "working tree",
+				cwd
 			}));
-			index += 2;
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.status: unexpected classification "${classified._tag}"`);
 		}
-	}
-	return entries;
-};
-/**
-* The metadata of a single commit, read via `git log -1` with NUL-separated
-* `%H` / `%G?` / `%B` placeholders.
-*
-* @public
-*/
-var CommitInfo = class extends Schema.Class("CommitInfo")({
-	/** The commit's full object id (`%H`). */
-	sha: Schema.String,
-	/** git's `%G?` signature verdict: Good, Bad, Unknown validity, eXpired, expired-key (Y), Revoked, cannot-check (E), None. */
-	signatureStatus: Schema.Literals([
-		"G",
-		"B",
-		"U",
-		"X",
-		"Y",
-		"R",
-		"E",
-		"N"
-	]),
-	/** The raw commit message (`%B`), untrimmed — includes git's trailing format newline. */
-	message: Schema.String
-}) {};
-/** One two-letter porcelain v1 status axis code. */
-const porcelainCode = Schema.Literals([
-	" ",
-	"M",
-	"T",
-	"A",
-	"D",
-	"R",
-	"C",
-	"U",
-	"?",
-	"!"
-]);
-/**
-* One entry of a `git status --porcelain -z` listing.
-*
-* @public
-*/
-var StatusEntry = class extends Schema.Class("StatusEntry")({
-	/** The index-side status code (first porcelain column). */
-	x: porcelainCode,
-	/** The working-tree-side status code (second porcelain column). */
-	y: porcelainCode,
-	/** The entry's path — for a rename or copy, the NEW path. */
-	path: Schema.String,
-	/** The original path; present only on rename/copy entries. */
-	origPath: Schema.optionalKey(Schema.String)
-}) {};
-/**
-* Parses `git log -1 --format=%H%x00%G?%x00%B` output: exactly two NUL
-* separators, everything after the second is the raw message, untrimmed.
-* Only ever called on the successful output of this package's own format
-* string, so the separators are guaranteed present.
-*/
-const parseCommitInfo = (output) => {
-	const first = output.indexOf("\0");
-	const second = output.indexOf("\0", first + 1);
-	return CommitInfo.make({
-		sha: output.slice(0, first),
-		signatureStatus: output.slice(first + 1, second),
-		message: output.slice(second + 1)
 	});
-};
-/**
-* Parses `git status --porcelain -z` output: each entry is `XY <path>`, and a
-* rename/copy entry appends the ORIGINAL path as one extra NUL token AFTER
-* the new path — the opposite order from `diff --name-status`.
-*/
-const parseStatus = (output) => {
-	const tokens = output.split("\0");
-	const entries = [];
-	let index = 0;
-	while (index < tokens.length) {
-		const token = tokens[index] ?? "";
-		if (token === "") {
-			index += 1;
-			continue;
+	const submoduleStatus = Effect.fn("Git.submoduleStatus")(function* (cwd, options) {
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			recursive: options?.recursive ?? false
+		});
+		const classified = yield* runFor(GitCommand.submoduleStatus(options?.paths ?? [], options?.recursive ?? false), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return parseSubmoduleStatus(classified.output);
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "submodule status",
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.submoduleStatus: unexpected classification "${classified._tag}"`);
 		}
-		const x = token.charAt(0);
-		const y = token.charAt(1);
-		const path = token.slice(3);
-		if (x === "R" || x === "C" || y === "R" || y === "C") {
-			entries.push(StatusEntry.make({
-				x,
-				y,
-				path,
-				origPath: tokens[index + 1] ?? ""
+	});
+	const submoduleInit = Effect.fn("Git.submoduleInit")(function* (cwd, options) {
+		yield* Effect.annotateCurrentSpan({ cwd });
+		const classified = yield* runFor(GitCommand.submoduleInit(options?.paths ?? []), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "submodule init",
+				cwd
 			}));
-			index += 2;
-		} else {
-			entries.push(StatusEntry.make({
-				x,
-				y,
-				path
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.submoduleInit: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const submoduleDeinit = Effect.fn("Git.submoduleDeinit")(function* (cwd, options) {
+		const paths = options.paths ?? [];
+		const all = options.all ?? false;
+		yield* Effect.annotateCurrentSpan({
+			cwd,
+			all,
+			count: paths.length
+		});
+		if (!all && paths.length === 0) return yield* Effect.fail(new GitCommandError({
+			kind: "refused",
+			args: ["submodule", "deinit"],
+			cwd,
+			stderr: "",
+			detail: "refused: submoduleDeinit needs either paths or all: true"
+		}));
+		const classified = yield* runFor(GitCommand.submoduleDeinit(paths, all, options.force ?? false), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "submodule deinit",
+				cwd
 			}));
-			index += 1;
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.submoduleDeinit: unexpected classification "${classified._tag}"`);
 		}
-	}
-	return entries;
-};
-/**
-* Refuse a caller-supplied ref or range that git would parse as an option.
-*
-* Refs are caller-controlled and land in git's argv as positional entries; a
-* value beginning with `-` is read as a flag instead — `checkout("-b")` would
-* CREATE a branch. A bare `--` separator is not a safe fix for every command
-* (it switches `checkout` into pathspec mode), so option-like values are
-* refused outright, before any spawn, as a typed {@link GitCommandError}.
-* `show`'s `path` needs no guard: it is fused after the ref into one
-* `ref:path` token, which cannot begin with `-` unless the ref does.
-*/
-const rejectOptionLikeRefs = (cwd, refs) => {
-	const offending = refs.find((ref) => ref.startsWith("-"));
-	return offending === void 0 ? Effect.void : Effect.fail(new GitCommandError({
-		kind: "refused",
-		args: [offending],
-		cwd,
-		stderr: "",
-		detail: `refused a ref argument git would parse as an option: ${JSON.stringify(offending)}`
-	}));
-};
-/** Builds the `Git.Service` shape over an already-resolved `ChildProcessSpawner`. */
-const make = (spawner) => {
-	const runFor = (command, cwd, kind) => runClassified(command, cwd, kind).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner));
-	const show = Effect.fn("Git.show")(function* (cwd, ref, path) {
+	});
+	const submoduleSync = Effect.fn("Git.submoduleSync")(function* (cwd, options) {
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			ref,
-			path
+			recursive: options?.recursive ?? false
 		});
-		yield* rejectOptionLikeRefs(cwd, [ref]);
-		const command = ChildProcess.setCwd(GitCommand.show(ref, path), cwd);
-		const classified = yield* runFor(command, cwd, "show");
+		const classified = yield* runFor(GitCommand.submoduleSync(options?.paths ?? [], options?.recursive ?? false), cwd, "generic");
 		switch (classified._tag) {
-			case "success": return Option.some(classified.output);
-			case "absent": return Option.none();
+			case "success": return;
 			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
 			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-				ref,
+				ref: "submodule sync",
 				cwd
 			}));
 			case "failure": return yield* Effect.fail(classified.error);
-			default: return yield* Effect.die(`Git.show: unexpected classification "${classified._tag}"`);
+			default: return yield* Effect.die(`Git.submoduleSync: unexpected classification "${classified._tag}"`);
 		}
 	});
-	const lsTree = Effect.fn("Git.lsTree")(function* (cwd, ref, options) {
+	const submoduleSetUrl = Effect.fn("Git.submoduleSetUrl")(function* (cwd, path, url) {
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			ref
+			path
 		});
-		yield* rejectOptionLikeRefs(cwd, [ref]);
-		const command = ChildProcess.setCwd(GitCommand.lsTree(ref, options?.pathspec ?? []), cwd);
-		const classified = yield* runFor(command, cwd, "generic");
+		const classified = yield* runFor(GitCommand.submoduleSetUrl(path, url), cwd, "generic");
 		switch (classified._tag) {
-			case "success": return parseLsTree(classified.output);
+			case "success": return;
 			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
 			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-				ref,
+				ref: path,
 				cwd
 			}));
 			case "failure": return yield* Effect.fail(classified.error);
-			default: return yield* Effect.die(`Git.lsTree: unexpected classification "${classified._tag}"`);
+			default: return yield* Effect.die(`Git.submoduleSetUrl: unexpected classification "${classified._tag}"`);
 		}
 	});
-	const refExists = Effect.fn("Git.refExists")(function* (cwd, ref) {
+	const submoduleSetBranch = Effect.fn("Git.submoduleSetBranch")(function* (cwd, path, options) {
+		const branch = options?.branch;
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			ref
+			path,
+			branch: branch ?? "(default)"
 		});
-		yield* rejectOptionLikeRefs(cwd, [ref]);
-		const command = ChildProcess.setCwd(GitCommand.refExists(ref), cwd);
-		const classified = yield* runFor(command, cwd, "refExists");
+		if (branch !== void 0) yield* rejectOptionLikeRefs(cwd, [branch]);
+		const classified = yield* runFor(GitCommand.submoduleSetBranch(path, branch), cwd, "generic");
+		switch (classified._tag) {
+			case "success": return;
+			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: branch ?? path,
+				cwd
+			}));
+			case "failure": return yield* Effect.fail(classified.error);
+			default: return yield* Effect.die(`Git.submoduleSetBranch: unexpected classification "${classified._tag}"`);
+		}
+	});
+	const submoduleAbsorbgitdirs = Effect.fn("Git.submoduleAbsorbgitdirs")(function* (cwd, options) {
+		yield* Effect.annotateCurrentSpan({ cwd });
+		const classified = yield* runFor(GitCommand.submoduleAbsorbgitdirs(options?.paths ?? []), cwd, "generic");
 		switch (classified._tag) {
-			case "success": return true;
-			case "refMissing": return false;
-			case "unknownRef": return false;
+			case "success": return;
 			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
+			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
+				ref: "submodule absorbgitdirs",
+				cwd
+			}));
 			case "failure": return yield* Effect.fail(classified.error);
-			default: return yield* Effect.die(`Git.refExists: unexpected classification "${classified._tag}"`);
+			default: return yield* Effect.die(`Git.submoduleAbsorbgitdirs: unexpected classification "${classified._tag}"`);
 		}
 	});
-	const mergeBase = Effect.fn("Git.mergeBase")(function* (cwd, a, b) {
+	const submoduleForeach = Effect.fn("Git.submoduleForeach")(function* (cwd, command, options) {
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			a,
-			b
+			recursive: options?.recursive ?? false
 		});
-		yield* rejectOptionLikeRefs(cwd, [a, b]);
-		const command = ChildProcess.setCwd(GitCommand.mergeBase(a, b), cwd);
-		const classified = yield* runFor(command, cwd, "generic");
+		yield* rejectOptionLikeRefs(cwd, [command]);
+		const classified = yield* runFor(GitCommand.submoduleForeach(command, options?.recursive ?? false), cwd, "generic");
 		switch (classified._tag) {
-			case "success": return classified.output.trim();
+			case "success": return classified.output;
 			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
 			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-				ref: `${a}...${b}`,
+				ref: "submodule foreach",
 				cwd
 			}));
 			case "failure": return yield* Effect.fail(classified.error);
-			default: return yield* Effect.die(`Git.mergeBase: unexpected classification "${classified._tag}"`);
+			default: return yield* Effect.die(`Git.submoduleForeach: unexpected classification "${classified._tag}"`);
 		}
 	});
-	const changedFiles = Effect.fn("Git.changedFiles")(function* (cwd, options) {
-		const relative = options.relative ?? false;
-		yield* Effect.annotateCurrentSpan({
-			cwd,
-			base: options.base,
-			head: options.head,
-			relative
-		});
-		yield* rejectOptionLikeRefs(cwd, [options.base, options.head]);
-		const command = ChildProcess.setCwd(GitCommand.changedFiles(options.base, options.head, relative), cwd);
-		const classified = yield* runFor(command, cwd, "generic");
+	const runVoid = (method, invocation, cwd, refLabel) => Effect.gen(function* () {
+		const classified = yield* runFor(invocation, cwd, "generic");
 		switch (classified._tag) {
-			case "success": return parseNulSeparated(classified.output);
+			case "success": return;
 			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
 			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-				ref: `${options.base}...${options.head}`,
+				ref: refLabel,
 				cwd
 			}));
 			case "failure": return yield* Effect.fail(classified.error);
-			default: return yield* Effect.die(`Git.changedFiles: unexpected classification "${classified._tag}"`);
+			default: return yield* Effect.die(`${method}: unexpected classification "${classified._tag}"`);
 		}
 	});
-	const collectPaths = (method, command, cwd) => Effect.gen(function* () {
-		const classified = yield* runFor(command, cwd, "generic");
+	const runParsed = (method, invocation, cwd, refLabel, kind, parse, absent) => Effect.gen(function* () {
+		const classified = yield* runFor(invocation, cwd, kind);
 		switch (classified._tag) {
-			case "success": return parseNulSeparated(classified.output);
+			case "success": return parse(classified.output);
+			case "absent":
+				if (absent !== void 0) return absent();
+				return yield* Effect.die(`${method}: unexpected classification "absent"`);
 			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
 			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-				ref: "working tree",
+				ref: refLabel,
 				cwd
 			}));
 			case "failure": return yield* Effect.fail(classified.error);
 			default: return yield* Effect.die(`${method}: unexpected classification "${classified._tag}"`);
 		}
 	});
-	const unstagedChanges = Effect.fn("Git.unstagedChanges")(function* (cwd, options) {
-		const relative = options?.relative ?? false;
-		yield* Effect.annotateCurrentSpan({
-			cwd,
-			relative
-		});
-		return yield* collectPaths("Git.unstagedChanges", ChildProcess.setCwd(GitCommand.unstagedChanges(relative), cwd), cwd);
-	});
-	const stagedChanges = Effect.fn("Git.stagedChanges")(function* (cwd, options) {
-		const relative = options?.relative ?? false;
-		yield* Effect.annotateCurrentSpan({
-			cwd,
-			relative
-		});
-		return yield* collectPaths("Git.stagedChanges", ChildProcess.setCwd(GitCommand.stagedChanges(relative), cwd), cwd);
-	});
-	const untrackedFiles = Effect.fn("Git.untrackedFiles")(function* (cwd, options) {
-		const relative = options?.relative ?? false;
+	const lsRemote = Effect.fn("Git.lsRemote")(function* (cwd, remote, options) {
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			relative
+			heads: options?.heads ?? false,
+			tags: options?.tags ?? false,
+			patterns: (options?.patterns ?? []).length
 		});
-		return yield* collectPaths("Git.untrackedFiles", ChildProcess.setCwd(GitCommand.untrackedFiles(relative), cwd), cwd);
+		yield* rejectOptionLikeRefs(cwd, [remote, ...options?.patterns ?? []]);
+		return yield* runParsed("Git.lsRemote", GitCommand.lsRemote(remote, options?.heads ?? false, options?.tags ?? false, options?.patterns ?? []), cwd, "ls-remote", "generic", parseLsRemote);
 	});
-	const workingChanges = Effect.fn("Git.workingChanges")(function* (cwd, options) {
+	const remoteAdd = Effect.fn("Git.remoteAdd")(function* (cwd, name, url) {
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			relative: options?.relative ?? false
+			name
 		});
-		const unstaged = yield* unstagedChanges(cwd, options);
-		const staged = yield* stagedChanges(cwd, options);
-		const untracked = yield* untrackedFiles(cwd, options);
-		return [.../* @__PURE__ */ new Set([
-			...unstaged,
-			...staged,
-			...untracked
-		])];
+		yield* rejectOptionLikeRefs(cwd, [name, url]);
+		return yield* runVoid("Git.remoteAdd", GitCommand.remoteAdd(name, url), cwd, name);
 	});
-	const nameStatus = Effect.fn("Git.nameStatus")(function* (cwd, options) {
-		const relative = options.relative ?? false;
+	const remoteRemove = Effect.fn("Git.remoteRemove")(function* (cwd, name) {
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			base: options.base,
-			head: options.head ?? "(working tree)",
-			relative
+			name
 		});
-		yield* rejectOptionLikeRefs(cwd, options.head === void 0 ? [options.base] : [options.base, options.head]);
-		const command = ChildProcess.setCwd(GitCommand.nameStatus(options.base, options.head, relative), cwd);
-		const classified = yield* runFor(command, cwd, "generic");
-		switch (classified._tag) {
-			case "success": return parseNameStatus(classified.output);
-			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-				ref: options.head === void 0 ? options.base : `${options.base}...${options.head}`,
-				cwd
-			}));
-			case "failure": return yield* Effect.fail(classified.error);
-			default: return yield* Effect.die(`Git.nameStatus: unexpected classification "${classified._tag}"`);
-		}
+		yield* rejectOptionLikeRefs(cwd, [name]);
+		return yield* runVoid("Git.remoteRemove", GitCommand.remoteRemove(name), cwd, name);
 	});
-	const revParse = Effect.fn("Git.revParse")(function* (cwd, ref) {
+	const remoteSetUrl = Effect.fn("Git.remoteSetUrl")(function* (cwd, name, url) {
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			ref
+			name
 		});
-		yield* rejectOptionLikeRefs(cwd, [ref]);
-		const command = ChildProcess.setCwd(GitCommand.revParse(ref), cwd);
-		const classified = yield* runFor(command, cwd, "generic");
-		switch (classified._tag) {
-			case "success": return classified.output.trim();
-			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-				ref,
-				cwd
-			}));
-			case "failure": return yield* Effect.fail(classified.error);
-			default: return yield* Effect.die(`Git.revParse: unexpected classification "${classified._tag}"`);
-		}
+		yield* rejectOptionLikeRefs(cwd, [name, url]);
+		return yield* runVoid("Git.remoteSetUrl", GitCommand.remoteSetUrl(name, url), cwd, name);
 	});
-	const checkout = Effect.fn("Git.checkout")(function* (cwd, ref, options) {
-		const detach = options?.detach ?? false;
+	const stashPush = Effect.fn("Git.stashPush")(function* (cwd, options) {
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			ref,
-			detach
+			includeUntracked: options?.includeUntracked ?? false
 		});
-		yield* rejectOptionLikeRefs(cwd, [ref]);
-		const command = ChildProcess.setCwd(GitCommand.checkout(ref, detach), cwd);
-		const classified = yield* runFor(command, cwd, "generic");
-		switch (classified._tag) {
-			case "success": return;
-			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-				ref,
-				cwd
-			}));
-			case "failure": return yield* Effect.fail(classified.error);
-			default: return yield* Effect.die(`Git.checkout: unexpected classification "${classified._tag}"`);
-		}
+		return yield* runVoid("Git.stashPush", GitCommand.stashPush(options?.message, options?.includeUntracked ?? false, options?.paths ?? []), cwd, "stash");
 	});
-	const fetch = Effect.fn("Git.fetch")(function* (cwd, options) {
-		const remote = options.remote ?? "origin";
-		const tag = options.tag ?? false;
+	const stashRestore = (method, invocation) => Effect.fn(method)(function* (cwd, options) {
 		yield* Effect.annotateCurrentSpan({
 			cwd,
-			remote,
-			ref: options.ref,
-			tag
+			index: options?.index ?? 0
 		});
-		yield* rejectOptionLikeRefs(cwd, [remote, options.ref]);
-		const command = ChildProcess.setCwd(GitCommand.fetch(remote, options.ref, options.depth, tag), cwd);
-		const classified = yield* runFor(command, cwd, "generic");
+		yield* rejectNonNaturalNumber(cwd, "a stash index", options?.index);
+		const classified = yield* runFor(invocation(options?.index), cwd, "merge");
 		switch (classified._tag) {
 			case "success": return;
+			case "dirtyWorktree": return yield* Effect.fail(new DirtyWorktreeError({ cwd }));
+			case "mergeConflict": return yield* Effect.fail(new MergeConflictError({ cwd }));
 			case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
 			case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-				ref: options.ref,
+				ref: "stash",
 				cwd
 			}));
 			case "failure": return yield* Effect.fail(classified.error);
-			default: return yield* Effect.die(`Git.fetch: unexpected classification "${classified._tag}"`);
+			default: return yield* Effect.die(`${method}: unexpected classification "${classified._tag}"`);
 		}
 	});
 	return {
@@ -21442,254 +22799,235 @@ const make = (spawner) => {
 		revParse,
 		checkout,
 		fetch,
-		fetchAny: Effect.fn("Git.fetchAny")(function* (cwd, options) {
-			const remote = options.remote ?? "origin";
+		fetchAny,
+		fetchUnshallow,
+		isShallow,
+		reset,
+		clean,
+		restore,
+		branchCreate,
+		branchDelete,
+		submoduleUpdate,
+		submoduleAdd,
+		submoduleStatus,
+		submoduleInit,
+		submoduleDeinit,
+		submoduleSync,
+		submoduleSetUrl,
+		submoduleSetBranch,
+		submoduleAbsorbgitdirs,
+		submoduleForeach,
+		sparseCheckoutSet,
+		configSet,
+		add,
+		nameStatus,
+		unstagedChanges,
+		stagedChanges,
+		untrackedFiles,
+		defaultBranch,
+		currentBranch,
+		repoRoot,
+		configGet,
+		remoteUrl,
+		commitInfo,
+		status,
+		lsRemote,
+		remoteAdd,
+		remoteRemove,
+		remoteSetUrl,
+		stashPush,
+		stashPop: stashRestore("Git.stashPop", GitCommand.stashPop),
+		stashApply: stashRestore("Git.stashApply", GitCommand.stashApply),
+		stashDrop: Effect.fn("Git.stashDrop")(function* (cwd, options) {
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				remote,
-				ref: options.ref
+				index: options?.index ?? 0
 			});
-			return yield* fetch(cwd, {
-				...options,
-				tag: true
-			}).pipe(Effect.catchTag(["UnknownRefError", "GitCommandError"], (error) => error._tag === "GitCommandError" && error.kind === "refused" ? Effect.fail(error) : fetch(cwd, options)));
+			yield* rejectNonNaturalNumber(cwd, "a stash index", options?.index);
+			return yield* runVoid("Git.stashDrop", GitCommand.stashDrop(options?.index), cwd, "stash");
 		}),
-		submoduleUpdate: Effect.fn("Git.submoduleUpdate")(function* (cwd, options) {
-			const init = options?.init ?? false;
+		stashList: Effect.fn("Git.stashList")(function* (cwd) {
+			yield* Effect.annotateCurrentSpan({ cwd });
+			return yield* runParsed("Git.stashList", GitCommand.stashList(), cwd, "stash", "generic", parseStashList);
+		}),
+		branchList: Effect.fn("Git.branchList")(function* (cwd, options) {
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				init
+				remotes: options?.remotes ?? false,
+				all: options?.all ?? false
 			});
-			const command = ChildProcess.setCwd(GitCommand.submoduleUpdate(init, options?.depth, options?.paths ?? []), cwd);
-			const classified = yield* runFor(command, cwd, "generic");
-			switch (classified._tag) {
-				case "success": return;
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: "submodule update",
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.submoduleUpdate: unexpected classification "${classified._tag}"`);
-			}
+			return yield* runParsed("Git.branchList", GitCommand.branchList(options?.remotes ?? false, options?.all ?? false), cwd, "branches", "generic", parseBranchList);
 		}),
-		submoduleAdd: Effect.fn("Git.submoduleAdd")(function* (cwd, options) {
+		tagCreate: Effect.fn("Git.tagCreate")(function* (cwd, name, options) {
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				url: options.url,
-				path: options.path
+				name,
+				ref: options?.ref ?? "HEAD",
+				force: options?.force ?? false
 			});
-			const command = ChildProcess.setCwd(GitCommand.submoduleAdd(options.url, options.path, options.depth), cwd);
-			const classified = yield* runFor(command, cwd, "generic");
-			switch (classified._tag) {
-				case "success": return;
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: options.url,
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.submoduleAdd: unexpected classification "${classified._tag}"`);
-			}
+			yield* rejectOptionLikeRefs(cwd, [name, ...options?.ref !== void 0 ? [options.ref] : []]);
+			return yield* runVoid("Git.tagCreate", GitCommand.tagCreate(name, options?.ref, options?.message, options?.force ?? false), cwd, options?.ref ?? name);
 		}),
-		sparseCheckoutSet: Effect.fn("Git.sparseCheckoutSet")(function* (cwd, patterns, options) {
+		tagDelete: Effect.fn("Git.tagDelete")(function* (cwd, name) {
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				cone: options.cone
+				name
 			});
-			yield* rejectOptionLikeRefs(cwd, patterns);
-			const command = ChildProcess.setCwd(GitCommand.sparseCheckoutSet(patterns, options.cone), cwd);
-			const classified = yield* runFor(command, cwd, "generic");
-			switch (classified._tag) {
-				case "success": return;
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: "sparse-checkout",
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.sparseCheckoutSet: unexpected classification "${classified._tag}"`);
-			}
+			yield* rejectOptionLikeRefs(cwd, [name]);
+			return yield* runVoid("Git.tagDelete", GitCommand.tagDelete(name), cwd, name);
+		}),
+		tagList: Effect.fn("Git.tagList")(function* (cwd, options) {
+			yield* Effect.annotateCurrentSpan({ cwd });
+			yield* rejectOptionLikeRefs(cwd, options?.pattern !== void 0 ? [options.pattern] : []);
+			return yield* runParsed("Git.tagList", GitCommand.tagList(options?.pattern), cwd, "tags", "generic", (output) => output.split("\n").filter((line) => line.length > 0));
 		}),
-		configSet: Effect.fn("Git.configSet")(function* (cwd, key, value, options) {
+		forEachRef: Effect.fn("Git.forEachRef")(function* (cwd, options) {
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				key,
-				file: options?.file ?? "(repository config)"
+				patterns: (options?.patterns ?? []).length
 			});
-			yield* rejectOptionLikeRefs(cwd, [
-				key,
-				value,
-				...options?.file !== void 0 ? [options.file] : []
-			]);
-			const command = ChildProcess.setCwd(GitCommand.configSet(key, value, options?.file), cwd);
-			const classified = yield* runFor(command, cwd, "generic");
-			switch (classified._tag) {
-				case "success": return;
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: key,
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.configSet: unexpected classification "${classified._tag}"`);
-			}
+			yield* rejectOptionLikeRefs(cwd, options?.patterns ?? []);
+			return yield* runParsed("Git.forEachRef", GitCommand.forEachRef(options?.patterns ?? []), cwd, "for-each-ref", "generic", parseForEachRef);
 		}),
-		add: Effect.fn("Git.add")(function* (cwd, paths) {
+		revList: Effect.fn("Git.revList")(function* (cwd, ref, options) {
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				count: paths.length
+				ref,
+				firstParent: options?.firstParent ?? false
 			});
-			const command = ChildProcess.setCwd(GitCommand.add(paths), cwd);
-			const classified = yield* runFor(command, cwd, "generic");
+			yield* rejectOptionLikeRefs(cwd, [ref]);
+			yield* rejectNonNaturalNumber(cwd, "a rev-list limit", options?.limit);
+			return yield* runParsed("Git.revList", GitCommand.revList(ref, options?.limit, options?.firstParent ?? false), cwd, ref, "generic", (output) => output.split("\n").filter((line) => line.length > 0));
+		}),
+		commit: Effect.fn("Git.commit")(function* (cwd, message, options) {
+			yield* Effect.annotateCurrentSpan({
+				cwd,
+				amend: options?.amend ?? false
+			});
+			return yield* runVoid("Git.commit", GitCommand.commit(message, options?.all ?? false, options?.allowEmpty ?? false, options?.amend ?? false, options?.author), cwd, "HEAD");
+		}),
+		push: Effect.fn("Git.push")(function* (cwd, options) {
+			const remote = options?.remote ?? "origin";
+			yield* Effect.annotateCurrentSpan({
+				cwd,
+				refspec: options?.refspec ?? "(current branch)",
+				forceWithLease: options?.forceWithLease ?? false
+			});
+			yield* rejectOptionLikeRefs(cwd, [remote, ...options?.refspec !== void 0 ? [options.refspec] : []]);
+			const classified = yield* runFor(GitCommand.push(remote, options?.refspec, options?.force ?? false, options?.forceWithLease ?? false, options?.tags ?? false, options?.setUpstream ?? false), cwd, "push");
 			switch (classified._tag) {
 				case "success": return;
+				case "nonFastForward": return yield* Effect.fail(new NonFastForwardError({
+					cwd,
+					...options?.refspec !== void 0 ? { refspec: options.refspec } : {}
+				}));
 				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
 				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: "working tree",
+					ref: options?.refspec ?? "HEAD",
 					cwd
 				}));
 				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.add: unexpected classification "${classified._tag}"`);
+				default: return yield* Effect.die(`Git.push: unexpected classification "${classified._tag}"`);
 			}
 		}),
-		nameStatus,
-		unstagedChanges,
-		stagedChanges,
-		untrackedFiles,
-		defaultBranch: Effect.fn("Git.defaultBranch")(function* (cwd, options) {
+		pull: Effect.fn("Git.pull")(function* (cwd, options) {
 			const remote = options?.remote ?? "origin";
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				remote
+				ref: options?.ref ?? "(upstream)",
+				rebase: options?.rebase ?? false
 			});
-			yield* rejectOptionLikeRefs(cwd, [remote]);
-			const command = ChildProcess.setCwd(GitCommand.defaultBranch(remote), cwd);
-			const classified = yield* runFor(command, cwd, "quiet");
+			yield* rejectOptionLikeRefs(cwd, [remote, ...options?.ref !== void 0 ? [options.ref] : []]);
+			const classified = yield* runFor(GitCommand.pull(remote, options?.ref, options?.rebase ?? false, options?.ffOnly ?? false), cwd, "merge");
 			switch (classified._tag) {
-				case "success": {
-					const short = classified.output.trim();
-					const prefix = `${remote}/`;
-					return Option.some(short.startsWith(prefix) ? short.slice(prefix.length) : short);
-				}
-				case "absent": return Option.none();
+				case "success": return;
+				case "dirtyWorktree": return yield* Effect.fail(new DirtyWorktreeError({ cwd }));
+				case "mergeConflict": return yield* Effect.fail(new MergeConflictError({ cwd }));
 				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
 				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: `refs/remotes/${remote}/HEAD`,
+					ref: options?.ref ?? "(upstream)",
 					cwd
 				}));
 				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.defaultBranch: unexpected classification "${classified._tag}"`);
+				default: return yield* Effect.die(`Git.pull: unexpected classification "${classified._tag}"`);
 			}
 		}),
-		currentBranch: Effect.fn("Git.currentBranch")(function* (cwd) {
-			yield* Effect.annotateCurrentSpan({ cwd });
-			const command = ChildProcess.setCwd(GitCommand.currentBranch(), cwd);
-			const classified = yield* runFor(command, cwd, "generic");
-			switch (classified._tag) {
-				case "success": {
-					const name = classified.output.trim();
-					return name === "HEAD" ? Option.none() : Option.some(name);
-				}
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: "HEAD",
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.currentBranch: unexpected classification "${classified._tag}"`);
-			}
+		configList: Effect.fn("Git.configList")(function* (cwd, options) {
+			yield* Effect.annotateCurrentSpan({
+				cwd,
+				file: options?.file ?? "(repository config)"
+			});
+			yield* rejectOptionLikeRefs(cwd, options?.file !== void 0 ? [options.file] : []);
+			return yield* runParsed("Git.configList", GitCommand.configList(options?.file), cwd, "config", "generic", parseConfigList);
 		}),
-		repoRoot: Effect.fn("Git.repoRoot")(function* (cwd) {
-			yield* Effect.annotateCurrentSpan({ cwd });
-			const command = ChildProcess.setCwd(GitCommand.repoRoot(), cwd);
-			const classified = yield* runFor(command, cwd, "generic");
-			switch (classified._tag) {
-				case "success": return classified.output.trim();
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: "working tree",
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.repoRoot: unexpected classification "${classified._tag}"`);
-			}
+		configGetAll: Effect.fn("Git.configGetAll")(function* (cwd, key, options) {
+			yield* Effect.annotateCurrentSpan({
+				cwd,
+				key,
+				file: options?.file ?? "(repository config)"
+			});
+			yield* rejectOptionLikeRefs(cwd, [key, ...options?.file !== void 0 ? [options.file] : []]);
+			return yield* runParsed("Git.configGetAll", GitCommand.configGetAll(key, options?.file), cwd, key, "quiet", parseNulSeparated, () => []);
 		}),
-		configGet: Effect.fn("Git.configGet")(function* (cwd, key) {
+		configUnset: Effect.fn("Git.configUnset")(function* (cwd, key, options) {
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				key
+				key,
+				file: options?.file ?? "(repository config)"
 			});
-			yield* rejectOptionLikeRefs(cwd, [key]);
-			const command = ChildProcess.setCwd(GitCommand.configGet(key), cwd);
-			const classified = yield* runFor(command, cwd, "quiet");
-			switch (classified._tag) {
-				case "success": return Option.some(classified.output.trim());
-				case "absent": return Option.none();
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: key,
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.configGet: unexpected classification "${classified._tag}"`);
-			}
+			yield* rejectOptionLikeRefs(cwd, [key, ...options?.file !== void 0 ? [options.file] : []]);
+			return yield* runVoid("Git.configUnset", GitCommand.configUnset(key, options?.file, options?.all ?? false), cwd, key);
 		}),
-		remoteUrl: Effect.fn("Git.remoteUrl")(function* (cwd, options) {
-			const remote = options?.remote ?? "origin";
+		rm: Effect.fn("Git.rm")(function* (cwd, paths, options) {
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				remote
+				count: paths.length,
+				cached: options?.cached ?? false
 			});
-			yield* rejectOptionLikeRefs(cwd, [remote]);
-			const command = ChildProcess.setCwd(GitCommand.remoteUrl(remote), cwd);
-			const classified = yield* runFor(command, cwd, "noSuchRemote");
-			switch (classified._tag) {
-				case "success": return Option.some(classified.output.trim());
-				case "absent": return Option.none();
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: remote,
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.remoteUrl: unexpected classification "${classified._tag}"`);
-			}
+			return yield* runVoid("Git.rm", GitCommand.rm(paths, options?.cached ?? false, options?.recursive ?? false, options?.force ?? false), cwd, "working tree");
 		}),
-		commitInfo: Effect.fn("Git.commitInfo")(function* (cwd, ref) {
-			const target = ref ?? "HEAD";
+		mv: Effect.fn("Git.mv")(function* (cwd, source, destination, options) {
 			yield* Effect.annotateCurrentSpan({
 				cwd,
-				ref: target
+				source,
+				destination
 			});
-			yield* rejectOptionLikeRefs(cwd, [target]);
-			const command = ChildProcess.setCwd(GitCommand.commitInfo(target), cwd);
-			const classified = yield* runFor(command, cwd, "generic");
-			switch (classified._tag) {
-				case "success": return parseCommitInfo(classified.output);
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: target,
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.commitInfo: unexpected classification "${classified._tag}"`);
-			}
+			return yield* runVoid("Git.mv", GitCommand.mv(source, destination, options?.force ?? false), cwd, "working tree");
+		}),
+		checkIgnore: Effect.fn("Git.checkIgnore")(function* (cwd, paths) {
+			yield* Effect.annotateCurrentSpan({
+				cwd,
+				count: paths.length
+			});
+			return yield* runParsed("Git.checkIgnore", GitCommand.checkIgnore(paths), cwd, "check-ignore", "quiet", parseNulSeparated, () => []);
 		}),
-		status: Effect.fn("Git.status")(function* (cwd) {
+		worktreeAdd: Effect.fn("Git.worktreeAdd")(function* (cwd, path, options) {
+			yield* Effect.annotateCurrentSpan({
+				cwd,
+				path,
+				ref: options?.ref ?? "(default)"
+			});
+			yield* rejectOptionLikeRefs(cwd, [path, ...options?.ref !== void 0 ? [options.ref] : []]);
+			return yield* runVoid("Git.worktreeAdd", GitCommand.worktreeAdd(path, options?.ref, options?.detach ?? false, options?.force ?? false), cwd, options?.ref ?? path);
+		}),
+		worktreeList: Effect.fn("Git.worktreeList")(function* (cwd) {
 			yield* Effect.annotateCurrentSpan({ cwd });
-			const command = ChildProcess.setCwd(GitCommand.status(), cwd);
-			const classified = yield* runFor(command, cwd, "generic");
-			switch (classified._tag) {
-				case "success": return parseStatus(classified.output);
-				case "notARepository": return yield* Effect.fail(new NotARepositoryError({ cwd }));
-				case "unknownRef": return yield* Effect.fail(new UnknownRefError({
-					ref: "working tree",
-					cwd
-				}));
-				case "failure": return yield* Effect.fail(classified.error);
-				default: return yield* Effect.die(`Git.status: unexpected classification "${classified._tag}"`);
-			}
+			return yield* runParsed("Git.worktreeList", GitCommand.worktreeList(), cwd, "worktrees", "generic", parseWorktreeList);
+		}),
+		worktreeRemove: Effect.fn("Git.worktreeRemove")(function* (cwd, path, options) {
+			yield* Effect.annotateCurrentSpan({
+				cwd,
+				path
+			});
+			yield* rejectOptionLikeRefs(cwd, [path]);
+			return yield* runVoid("Git.worktreeRemove", GitCommand.worktreeRemove(path, options?.force ?? false), cwd, path);
+		}),
+		lsFiles: Effect.fn("Git.lsFiles")(function* (cwd, options) {
+			yield* Effect.annotateCurrentSpan({
+				cwd,
+				patterns: (options?.pathspec ?? []).length
+			});
+			return yield* runParsed("Git.lsFiles", GitCommand.lsFiles(options?.pathspec ?? []), cwd, "index", "generic", parseLsFiles);
 		})
 	};
 };
@@ -21701,17 +23039,23 @@ const make = (spawner) => {
 const notStubbed = (method) => () => Effect.die(/* @__PURE__ */ new Error(`Git.makeTest: ${method}() was called but not stubbed — no honest default exists for a test double; pass a \`${method}\` override.`));
 /**
 * Typed git introspection over core's `ChildProcessSpawner`: read a
-* repository's state at any ref without checking it out, plus the mutating
-* tier (`checkout`, `fetch`, `fetchAny`, `submoduleUpdate`, `submoduleAdd`,
-* `sparseCheckoutSet`, `configSet`, `add`) that changes it.
+* repository's state at any ref without checking it out (including the
+* network read `lsRemote` and the index read `lsFiles`), plus the mutating
+* tier — checkout/fetch, the working-tree restore trio and stash, branches
+* and tags, remotes, worktrees, commit/push/pull, submodules,
+* sparse-checkout, config writes and staging — that changes it. Every
+* mutating method's TSDoc opens with the literal word `Mutating:`.
 *
 * @remarks
 * Every method takes `cwd` explicitly and classifies git's stderr/exit-code
 * taxonomy exactly once, in this module's private `classify` step — a
 * spawn-level `PlatformError` and `Cause.TimeoutError` never escape a `Git`
 * method; every failure surfaces as {@link GitCommandError},
-* {@link NotARepositoryError}, or {@link UnknownRefError}, or degrades to
-* the documented non-error (`Option.none`, `false`).
+* {@link NotARepositoryError}, {@link UnknownRefError}, or one of the three
+* consumer-branchable classifications ({@link NonFastForwardError} from
+* `push`; {@link MergeConflictError} and {@link DirtyWorktreeError} from the
+* merge-shaped `pull` / `stashPop` / `stashApply`), or degrades to the
+* documented non-error (`Option.none`, `false`, the empty array).
 *
 * Every method whose TSDoc opens "Mutating:" changes the working tree,
 * `HEAD`, the index, the repository config, the object database and
@@ -21720,6 +23064,12 @@ const notStubbed = (method) => () => Effect.die(/* @__PURE__ */ new Error(`Git.m
 * that — a caller running two mutating calls (or a mutating call alongside a
 * read) against one `cwd` at once owns the race.
 *
+* **Redaction policy (documented, not just convention).** Error values
+* persist only the constructor's REDACTED argv (see `GitCommandError.args`),
+* and span annotations carry stable identifiers only — `cwd`, refs, keys,
+* paths, remote names — never config values and never URLs, which can embed
+* userinfo. A new method must follow both halves before it ships.
+*
 * @public
 */
 var Git = class Git extends Context.Service()("@effected/git/Git") {
@@ -21734,7 +23084,7 @@ var Git = class Git extends Context.Service()("@effected/git/Git") {
 	*
 	* @remarks
 	* Unlike `WorkspaceDiscovery.makeTest`, **no method here has an honest
-	* default** — the shape is twenty-six unrelated git operations, and a
+	* default** — the shape is unrelated git operations, and a
 	* fabricated answer for any of them (an empty tree, a made-up sha, a silent
 	* no-op `checkout`) would leak into consumer logic as fact. So every
 	* unstubbed method fails loudly as a defect
@@ -21773,8 +23123,23 @@ var Git = class Git extends Context.Service()("@effected/git/Git") {
 		checkout: notStubbed("checkout"),
 		fetch: notStubbed("fetch"),
 		fetchAny: notStubbed("fetchAny"),
+		fetchUnshallow: notStubbed("fetchUnshallow"),
+		isShallow: notStubbed("isShallow"),
+		reset: notStubbed("reset"),
+		clean: notStubbed("clean"),
+		restore: notStubbed("restore"),
+		branchCreate: notStubbed("branchCreate"),
+		branchDelete: notStubbed("branchDelete"),
 		submoduleUpdate: notStubbed("submoduleUpdate"),
 		submoduleAdd: notStubbed("submoduleAdd"),
+		submoduleStatus: notStubbed("submoduleStatus"),
+		submoduleInit: notStubbed("submoduleInit"),
+		submoduleDeinit: notStubbed("submoduleDeinit"),
+		submoduleSync: notStubbed("submoduleSync"),
+		submoduleSetUrl: notStubbed("submoduleSetUrl"),
+		submoduleSetBranch: notStubbed("submoduleSetBranch"),
+		submoduleAbsorbgitdirs: notStubbed("submoduleAbsorbgitdirs"),
+		submoduleForeach: notStubbed("submoduleForeach"),
 		sparseCheckoutSet: notStubbed("sparseCheckoutSet"),
 		configSet: notStubbed("configSet"),
 		add: notStubbed("add"),
@@ -21789,6 +23154,34 @@ var Git = class Git extends Context.Service()("@effected/git/Git") {
 		remoteUrl: notStubbed("remoteUrl"),
 		commitInfo: notStubbed("commitInfo"),
 		status: notStubbed("status"),
+		lsRemote: notStubbed("lsRemote"),
+		remoteAdd: notStubbed("remoteAdd"),
+		remoteRemove: notStubbed("remoteRemove"),
+		remoteSetUrl: notStubbed("remoteSetUrl"),
+		stashPush: notStubbed("stashPush"),
+		stashPop: notStubbed("stashPop"),
+		stashApply: notStubbed("stashApply"),
+		stashDrop: notStubbed("stashDrop"),
+		stashList: notStubbed("stashList"),
+		branchList: notStubbed("branchList"),
+		tagCreate: notStubbed("tagCreate"),
+		tagDelete: notStubbed("tagDelete"),
+		tagList: notStubbed("tagList"),
+		forEachRef: notStubbed("forEachRef"),
+		revList: notStubbed("revList"),
+		commit: notStubbed("commit"),
+		push: notStubbed("push"),
+		pull: notStubbed("pull"),
+		configList: notStubbed("configList"),
+		configGetAll: notStubbed("configGetAll"),
+		configUnset: notStubbed("configUnset"),
+		rm: notStubbed("rm"),
+		mv: notStubbed("mv"),
+		checkIgnore: notStubbed("checkIgnore"),
+		worktreeAdd: notStubbed("worktreeAdd"),
+		worktreeList: notStubbed("worktreeList"),
+		worktreeRemove: notStubbed("worktreeRemove"),
+		lsFiles: notStubbed("lsFiles"),
 		...overrides
 	});
 	/**
@@ -21818,7 +23211,7 @@ var Git = class Git extends Context.Service()("@effected/git/Git") {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/ChangeDetector.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/ChangeDetector.js
 /**
 * Which git refs to compare, and whether to fold in the working tree.
 *
@@ -22118,7 +23511,7 @@ function resolveFromCatalog(catalogs, wantedDependency) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/catalogs.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/internal/catalogs.js
 /** Project a pnpm-workspace manifest's `catalog` / `catalogs` fields into a `Catalogs` map. */
 const inlineCatalogs = (manifest) => {
 	if (manifest.catalog === void 0 && manifest.catalogs === void 0) return {};
@@ -22184,7 +23577,7 @@ const rangeOf = (catalogs, dependency, specifier) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/ConfigDependencyHooks.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/ConfigDependencyHooks.js
 /** Whether `value` is a non-null, non-array object. */
 const isObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
@@ -22386,8 +23779,12 @@ process.stdout.write("\\n" + JSON.stringify(payload) + "\\n", () => process.exit
 */
 const REPLAY_TIMEOUT = Duration.seconds(30);
 /**
-* The subprocess protocol payload — the child's final stdout line, framed and
-* parsed by `Run.jsonLine`. The envelope is strict (a payload without a usable
+* The subprocess protocol payload — a single JSON line near the end of the
+* child's stdout, framed and parsed by `Run.jsonLine`, which scans lines from
+* the end for the first that decodes (so a hook logging after the payload —
+* e.g. from `process.on("exit", ...)` — cannot displace it). The `ok`
+* discriminant is what keeps an accidental log line from satisfying the
+* envelope. The envelope is strict (a payload without a usable
 * `ok` discriminant is a mechanism failure, typed); the `config` slice inside a
 * success stays `Unknown` because a hook's returned *data* is tolerantly
 * threaded (`configOf`), never fatal.
@@ -22592,7 +23989,7 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/PackageManagerName.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/PackageManagerName.js
 /**
 * The four package managers this package understands.
 *
@@ -22921,7 +24318,7 @@ var PackageManagerDetector = class PackageManagerDetector extends Context.Servic
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/LockfileReader.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/LockfileReader.js
 /**
 * Raised when the workspace's lockfile cannot be read off disk.
 *
@@ -23102,7 +24499,7 @@ var LockfileReader = class LockfileReader extends Context.Service()("@effected/w
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/Publishability.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/Publishability.js
 /** The public npm registry, used when `publishConfig.registry` says nothing. */
 const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 /**
@@ -23262,7 +24659,7 @@ var PublishabilityDetector = class extends Context.Service()("@effected/workspac
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/internal/importerVersions.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/internal/importerVersions.js
 /**
 * Strip pnpm's peer-disambiguation suffix from a recorded importer version.
 *
@@ -23349,7 +24746,7 @@ const unanimousVersionOf = (index, dependency) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceCatalogs.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/WorkspaceCatalogs.js
 /**
 * An immutable, fully-normalized catalog collection — the one catalog
 * resolution semantic in the package.
@@ -23864,9 +25261,9 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 	* consumers to `_tag`-sniff `unknown`); only the remaining mechanism failure,
 	* an unfindable workspace root, is wrapped as `DependencyResolutionError`.
 	*/
-	static catalogResolver = Layer.effect(CatalogResolver$1, Effect.gen(function* () {
+	static catalogResolver = Layer.effect(CatalogResolver, Effect.gen(function* () {
 		const catalogs = yield* WorkspaceCatalogs;
-		return { rangeOf: (packageName, catalog) => catalogs.set().pipe(Effect.map((set) => set.rangeOf(packageName, catalog)), Effect.catchTag("WorkspaceRootNotFoundError", (cause) => Effect.fail(new DependencyResolutionError$1({
+		return { rangeOf: (packageName, catalog) => catalogs.set().pipe(Effect.map((set) => set.rangeOf(packageName, catalog)), Effect.catchTag("WorkspaceRootNotFoundError", (cause) => Effect.fail(new DependencyResolutionError({
 			specifier: Option.match(catalog, {
 				onNone: () => "catalog:",
 				onSome: (name) => `catalog:${name}`
@@ -23877,7 +25274,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceStateSnapshot.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/WorkspaceStateSnapshot.js
 const EMPTY = Object.freeze(Object.create(null));
 const DependencyMap = Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY)), Schema.withConstructorDefault(Effect.succeed(EMPTY)));
 /**
@@ -24056,7 +25453,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 	* resolving to `Option.none()` so the caller falls back to the raw string.
 	*/
 	#resolveWith(dependency, specifier, onUnresolvedCatalog) {
-		const exit = Schema.decodeUnknownExit(DependencySpecifier$1.FromString)(specifier);
+		const exit = Schema.decodeUnknownExit(DependencySpecifier.FromString)(specifier);
 		if (!Exit.isSuccess(exit)) return Option.none();
 		const classified = exit.value;
 		switch (classified._tag) {
@@ -24081,7 +25478,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 	* `rangeOf` never fails.
 	*/
 	get catalogResolver() {
-		if (this.#catalogResolver === void 0) this.#catalogResolver = Layer.succeed(CatalogResolver$1, { rangeOf: (packageName, catalog) => Effect.succeed(this.catalogs.rangeOf(packageName, catalog)) });
+		if (this.#catalogResolver === void 0) this.#catalogResolver = Layer.succeed(CatalogResolver, { rangeOf: (packageName, catalog) => Effect.succeed(this.catalogs.rangeOf(packageName, catalog)) });
 		return this.#catalogResolver;
 	}
 	/**
@@ -24090,7 +25487,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 	* `workspace:` specifiers as of this ref. Built once per instance and cached.
 	*/
 	get workspaceResolver() {
-		if (this.#workspaceResolver === void 0) this.#workspaceResolver = Layer.succeed(WorkspaceResolver$1, { versionOf: (packageName) => Effect.succeed(Option.fromUndefinedOr(this.#versions().get(packageName))) });
+		if (this.#workspaceResolver === void 0) this.#workspaceResolver = Layer.succeed(WorkspaceResolver, { versionOf: (packageName) => Effect.succeed(Option.fromUndefinedOr(this.#versions().get(packageName))) });
 		return this.#workspaceResolver;
 	}
 	/** Both snapshot-scoped resolver layers merged. Built once per instance and cached. */
@@ -24101,7 +25498,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/WorkspaceSnapshots.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/WorkspaceSnapshots.js
 /** Whether `value` is a non-null, non-array object. */
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Whether every value in a record is a string — a usable dependency map. */
@@ -24379,7 +25776,7 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@ef
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.0_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__effect@4.0.0-beta.101/node_modules/@effected/workspaces/Workspaces.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.10.2_@effected+jsonc@0.5.2_effect@4.0.0-beta.101__@effected+semv_feff9e309e6abeafa28f7ea259b8a9bf/node_modules/@effected/workspaces/Workspaces.js
 const compose = (options, catalogsFactory) => {
 	const roots = WorkspaceRoot.layer;
 	const detector = PackageManagerDetector.layer;
@@ -24513,7 +25910,8 @@ var Workspaces = class {
 	* never detects changes or reads at a ref should not have to be able to
 	* spawn a subprocess. The consumer provides `ChildProcessSpawner` once at
 	* the edge (`@effect/platform-node`'s `NodeServices.layer`); a test
-	* provides `Layer.succeed(Git, …)` and needs no repository on disk.
+	* provides `Git.layerTest({ … })` — git's own shipped double, whose
+	* unstubbed members die named — and needs no repository on disk.
 	*/
 	static layerWithGit = layerWithGit;
 	/**
@@ -24562,9 +25960,14 @@ var Workspaces = class {
 	* import { Workspaces } from "@effected/workspaces";
 	* import { Layer } from "effect";
 	*
+	* // Bound to consts per the warning above: each factory call mints a
+	* // fresh layer reference, and layers memoize by reference.
+	* const LocalExecLayer = Workspaces.localExecLayer();
+	* const WorkspacesLayer = Workspaces.layer();
+	*
 	* const AppLayer = ToolDiscovery.layer.pipe(
-	*   Layer.provide(Workspaces.localExecLayer()),
-	*   Layer.provide(Workspaces.layer()),
+	*   Layer.provide(LocalExecLayer),
+	*   Layer.provide(WorkspacesLayer),
 	*   Layer.provide(NodeServices.layer),
 	* );
 	* ```