@savvy-web/silk 3.8.0 → 3.8.2

package/changesets-markdownlint.d.cts

@@ -5829,7 +5829,7 @@ declare class GlobPattern extends GlobPattern_base {
   static readonly FromString: Schema.Codec<GlobPattern, string>;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/index.d.ts
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/index.d.ts
 //#region src/BunExtension.d.ts
 declare const BunExtension_base: Schema.Class<BunExtension, Schema.Struct<{
   readonly _tag: Schema.tag<"bun">;
@@ -5894,7 +5894,7 @@ declare class ImporterDependency extends ImporterDependency_base {}
 //#region src/LockfileFormat.d.ts
 /**
  * The lockfile formats this package parses: bun's `bun.lock` (JSONC), npm's
- * `package-lock.json` (v2/v3 JSON), pnpm's `pnpm-lock.yaml` and yarn Berry's
+ * `package-lock.json` (JSON), pnpm's `pnpm-lock.yaml` and yarn Berry's
  * `yarn.lock` (both YAML).
  *
  * @remarks
@@ -5903,6 +5903,10 @@ declare class ImporterDependency extends ImporterDependency_base {}
  * Berry only; classic (v1) `yarn.lock` is not YAML and fails
  * `Lockfile.parse` with a typed `LockfileParseError`.
  *
+ * The format literal says nothing about which *versions* of that format are
+ * supported: pnpm `lockfileVersion` 9+ and npm `lockfileVersion` 3+ parse,
+ * and older ones fail typed. See `Lockfile.parse`.
+ *
  * @public
  */
 declare const LockfileFormat: Schema.Literals<readonly ["bun", "npm", "pnpm", "yarn"]>;
@@ -5966,6 +5970,7 @@ declare class PnpmExtension extends PnpmExtension_base {}
 declare const ResolvedPackage_base: Schema.Class<ResolvedPackage, Schema.Struct<{
   readonly name: Schema.NonEmptyString;
   readonly version: Schema.String;
+  readonly instanceId: Schema.NonEmptyString;
   readonly integrity: Schema.optionalKey<Schema.brand<Schema.String, "IntegrityHash"> & {
     isSri: (value: string) => boolean;
     isCorepack: (value: string) => boolean;
@@ -5977,6 +5982,12 @@ declare const ResolvedPackage_base: Schema.Class<ResolvedPackage, Schema.Struct<
   readonly isWorkspace: Schema.Boolean;
   readonly relativePath: Schema.optionalKey<Schema.String>;
   readonly dependencies: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>>;
+  readonly peerDependencies: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>>;
+  readonly peerDependenciesMeta: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.Struct<{
+    readonly optional: Schema.Boolean;
+  }>>, never>>;
+  readonly resolved: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>>;
+  readonly unresolvedEdges: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Array<Schema.String>, never>>;
 }>, {}>;
 /**
  * A package resolved from a lockfile.
@@ -5984,6 +5995,13 @@ declare const ResolvedPackage_base: Schema.Class<ResolvedPackage, Schema.Struct<
  * @remarks
  * The common shape every format's entries normalize into:
  *
+ * - `instanceId` — the lockfile-native identity of this *instance*, verbatim:
+ *   pnpm's snapshot key (`react-dom@18.3.1(react@17.0.2)`), npm's full entry
+ *   key (`node_modules/express/node_modules/debug`), bun's `packages` key
+ *   (`@acme/lib/react-dom`) or yarn's locator (`react-dom@npm:18.3.1`). It is
+ *   **opaque** — no scheme is synthesized and none should be parsed by a
+ *   consumer; it exists so `resolved` can name an instance, and so two
+ *   peer-resolved variants of one `name@version` stay distinguishable.
  * - `name` — the resolved package name. For pnpm *workspace* packages
  *   straight out of `Lockfile.parse` this is the importer path until
  *   `Lockfile#withImporterNames` rewrites it.
@@ -5999,6 +6017,47 @@ declare const ResolvedPackage_base: Schema.Class<ResolvedPackage, Schema.Struct<
  *   packages, when the lockfile records one.
  * - `dependencies` — the package's own dependency map, defaulting to `{}`
  *   both at construction and when decoding serialized data.
+ * - `peerDependencies` — the package's *declared* peer ranges, keyed by peer
+ *   name. Every format records them (pnpm and npm as their own section, bun
+ *   inline in the package tuple's info object, yarn Berry as an entry
+ *   section), so this is populated across all four. Declarations only: what
+ *   the package *asks for*, never what actually resolved.
+ * - `peerDependenciesMeta` — the per-peer flags, normalized to
+ *   `{ optional: boolean }`. bun spells optional peers as an `optionalPeers`
+ *   array of names rather than a meta object; that spelling is normalized
+ *   into this shape so one consumer algorithm serves every format. A peer
+ *   with no meta entry is required.
+ * - `resolved` — this instance's *outgoing edges*: dependency (and, where the
+ *   format records it, peer) name → the `instanceId` that name actually
+ *   resolved to in this instance's context. This is the answer to "which
+ *   concrete version of P did X get", which `peerDependencies` deliberately
+ *   does not answer.
+ *
+ *   Every entry is **verified**: an edge is emitted only when the composed or
+ *   walked-up identity matches a real instance in the same lockfile. An edge
+ *   that cannot be resolved honestly is *omitted*, never guessed — a wrong
+ *   resolved edge is a silent wrong answer, an absent one is a visible gap.
+ *   yarn records peer resolution virtually and is therefore dependency-edges
+ *   only.
+ *
+ * - `unresolvedEdges` — dependency names whose edge the lockfile **records**
+ *   but this model could not name: a `link:` target that is not a workspace
+ *   importer, a composed identity matching no instance. It is the companion
+ *   `resolved` needs to be honest, because an absent key in `resolved` would
+ *   otherwise mean two different things — "nothing is there" and "something is
+ *   there that I could not name" — and a consumer reading the first meaning
+ *   for the second turns this package's gap into its own false positive.
+ *
+ *   A dependency the lockfile simply does not record is **not** an unresolved
+ *   edge; it is an absence, and must not appear here. npm and bun contribute
+ *   nothing at all: their sections are *declarations* resolved positionally, so
+ *   "the walk found nothing" is genuine absence. A fail-closed signal that is
+ *   always on is a signal nobody reads.
+ *
+ * All four record fields — `dependencies`, `peerDependencies`,
+ * `peerDependenciesMeta` and `resolved` — default to `{}` at construction and
+ * when decoding, and `unresolvedEdges` defaults to `[]`. An absent section is
+ * therefore an empty collection, never `undefined`.
  *
  * @public
  */
@@ -6844,7 +6903,7 @@ declare class Package extends Package_base {
   toJsonString(options?: PackageFormatOptions): string;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/index.d.ts
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/index.d.ts
 //#region src/WorkspacePackage.d.ts
 declare const PublishConfig_base: Schema.Class<PublishConfig, Schema.Struct<{
   /** Scoped-package visibility. Its presence overrides `private`. */
@@ -7512,6 +7571,37 @@ declare class WorkspaceDiscovery extends WorkspaceDiscovery_base {
 }
 //#endregion
 //#region src/ConfigDependencyHooks.d.ts
+/**
+ * pnpm's `peerDependencyRules` block — the suppression policy pnpm applies
+ * **after** computing peer violations, in pnpm's own shape.
+ *
+ * @remarks
+ * The shape is pnpm's rather than ours because that is what comes back off the
+ * threaded config: measured against `@savvy-web/pnpm-plugin-silk@0.27.0`, a
+ * replayed hook returns `{ allowedVersions, ignoreMissing, allowAny }` intact,
+ * needing no reshaping.
+ *
+ * Two keys are **carried but not yet consumed**. `ignoreMissing` and
+ * `allowAny` are separate suppression axes that have not been measured, and an
+ * unmeasured suppression is precisely what produced the false positives this
+ * seam exists to remove — so they travel through the seam and no kit code acts
+ * on them. Only `allowedVersions` is consumed today.
+ *
+ * `allowedVersions` keys come in two spellings in the wild, and both must be
+ * handled: parent-versioned (`"@effect/ai-anthropic@4.0.0-rc.109>effect"`, as
+ * `pnpm:export` materializes them into `pnpm-workspace.yaml`) and unversioned
+ * (`"@effect/vitest>vitest"`, as a config-dependency plugin injects them).
+ *
+ * @public
+ */
+interface PeerDependencyRules {
+  /** `parent>peer` → the peer version or range the rule permits. */
+  readonly allowedVersions: Readonly<Record<string, string>>;
+  /** Peer names whose absence pnpm does not report. Carried, not consumed. */
+  readonly ignoreMissing: ReadonlyArray<string>;
+  /** Peer names for which any version is accepted. Carried, not consumed. */
+  readonly allowAny: ReadonlyArray<string>;
+}
 /**
  * The result of replaying a workspace's `configDependencies` hooks: the catalogs
  * the hooks yield, and the release-age gate contribution they leave on the
@@ -7531,6 +7621,24 @@ interface HookInjection {
   readonly catalogs: Readonly<Record<string, Readonly<Record<string, string>>>>;
   /** The release-age gate contribution the replayed hooks leave on the config. */
   readonly releaseAge: PartialReleaseAgeGate;
+  /**
+   * The **effective** peer-dependency rules: the seeded workspace-file rules
+   * with every replayed hook's contribution threaded over them.
+   *
+   * @remarks
+   * Effective rather than hook-only because the rules are **seeded** into the
+   * threaded config and the hooks merge onto them, exactly as pnpm seeds its
+   * own config and takes back what the hooks return. That is deliberate: a
+   * kit-owned merge function would be a second implementation of a rule this
+   * seam already enforces, and the two would drift the first time pnpm changed
+   * its threading.
+   *
+   * Measured caveat, and **not a bug to fix**: this repo's plugin *merges*
+   * onto the seeded rules; another plugin could overwrite them. Under seeding
+   * that is pnpm's own behaviour reproduced — a hook that overwrites
+   * overwrites for pnpm too — so do not "repair" it into a merger.
+   */
+  readonly peerDependencyRules: PeerDependencyRules;
 }
 /**
  * The {@link ConfigDependencyHooks} service shape.
@@ -7568,8 +7676,12 @@ interface ConfigDependencyHooksShape {
    * @param configDependencies - The `configDependencies` map (name →
    *   version+integrity) declared in `pnpm-workspace.yaml`.
    * @param seed - The inline catalogs, as `catalog name → dependency → range`.
+   * @param rules - The workspace file's `peerDependencyRules`, seeded into the
+   *   threaded config so hooks merge onto them rather than replacing them.
+   *   Omitted means "the workspace file declares none", which is different
+   *   from "nobody looked" — the caller owns that distinction.
    */
-  readonly inject: (root: string, configDependencies: Readonly<Record<string, string>>, seed: Readonly<Record<string, Readonly<Record<string, string>>>>) => Effect.Effect<HookInjection, CatalogAssemblyError>;
+  readonly inject: (root: string, configDependencies: Readonly<Record<string, string>>, seed: Readonly<Record<string, Readonly<Record<string, string>>>>, rules?: PeerDependencyRules) => Effect.Effect<HookInjection, CatalogAssemblyError>;
 }
 declare const ConfigDependencyHooks_base: Context.ServiceClass<ConfigDependencyHooks, "@effected/workspaces/ConfigDependencyHooks", ConfigDependencyHooksShape>;
 /**
@@ -8048,7 +8160,16 @@ declare class PublishTarget extends PublishTarget_base {}
  * @public
  */
 interface PublishabilityDetectorShape {
-  /** The publish targets for a package; empty means it does not publish. */
+  /**
+   * The publish targets for a package; empty means it does not publish.
+   *
+   * @remarks
+   * `VersioningStrategy.detect` probes a whole workspace by invoking this
+   * concurrently — up to ten packages in flight at once, in no guaranteed
+   * order. An overriding implementation backed by shared mutable state or a
+   * rate-limited client must tolerate that interleaving itself; the caller
+   * does not serialize on its behalf.
+   */
   readonly detect: (pkg: WorkspacePackage) => Effect.Effect<ReadonlyArray<PublishTarget>>;
 }
 declare const PublishabilityDetector_base: Context.ServiceClass<PublishabilityDetector, "@effected/workspaces/PublishabilityDetector", PublishabilityDetectorShape>;
@@ -8333,6 +8454,26 @@ interface WorkspaceCatalogsShape {
    * workspace) has no release-age keys, so the gate is the inert zero gate.
    */
   readonly releaseAgeGate: () => Effect.Effect<ReleaseAgeGate, CatalogAssemblyFailure>;
+  /**
+   * The workspace's **effective** `peerDependencyRules` — pnpm's post-hoc
+   * suppression policy, which the lockfile does not record at all.
+   *
+   * @remarks
+   * Assembled from the same single read and hook replay as `set`, and memoized
+   * with it. The `pnpm-workspace.yaml` block (what `pnpm:export` materializes)
+   * is **seeded** into the replayed config and the config-dependency hooks
+   * merge onto it, so one object carries both sources — the kit never merges
+   * them itself, because that would be a second implementation of a rule the
+   * hook seam already enforces.
+   *
+   * A consumer needs these to avoid **reporting** what pnpm suppresses: pnpm
+   * computes the same peer violations and then hides the ones a rule allows,
+   * so a checker without them reports findings pnpm calls clean.
+   *
+   * `ignoreMissing` and `allowAny` are carried but unmeasured — no kit code
+   * acts on them today.
+   */
+  readonly peerDependencyRules: () => Effect.Effect<PeerDependencyRules, CatalogAssemblyFailure>;
   /**
    * Each importer's dependency-name → resolved-version map, as the manager's
    * lockfile records it. Read from the same single lockfile read as `set`, and

package/changesets-markdownlint.d.ts

@@ -5829,7 +5829,7 @@ declare class GlobPattern extends GlobPattern_base {
   static readonly FromString: Schema.Codec<GlobPattern, string>;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/index.d.ts
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/index.d.ts
 //#region src/BunExtension.d.ts
 declare const BunExtension_base: Schema.Class<BunExtension, Schema.Struct<{
   readonly _tag: Schema.tag<"bun">;
@@ -5894,7 +5894,7 @@ declare class ImporterDependency extends ImporterDependency_base {}
 //#region src/LockfileFormat.d.ts
 /**
  * The lockfile formats this package parses: bun's `bun.lock` (JSONC), npm's
- * `package-lock.json` (v2/v3 JSON), pnpm's `pnpm-lock.yaml` and yarn Berry's
+ * `package-lock.json` (JSON), pnpm's `pnpm-lock.yaml` and yarn Berry's
  * `yarn.lock` (both YAML).
  *
  * @remarks
@@ -5903,6 +5903,10 @@ declare class ImporterDependency extends ImporterDependency_base {}
  * Berry only; classic (v1) `yarn.lock` is not YAML and fails
  * `Lockfile.parse` with a typed `LockfileParseError`.
  *
+ * The format literal says nothing about which *versions* of that format are
+ * supported: pnpm `lockfileVersion` 9+ and npm `lockfileVersion` 3+ parse,
+ * and older ones fail typed. See `Lockfile.parse`.
+ *
  * @public
  */
 declare const LockfileFormat: Schema.Literals<readonly ["bun", "npm", "pnpm", "yarn"]>;
@@ -5966,6 +5970,7 @@ declare class PnpmExtension extends PnpmExtension_base {}
 declare const ResolvedPackage_base: Schema.Class<ResolvedPackage, Schema.Struct<{
   readonly name: Schema.NonEmptyString;
   readonly version: Schema.String;
+  readonly instanceId: Schema.NonEmptyString;
   readonly integrity: Schema.optionalKey<Schema.brand<Schema.String, "IntegrityHash"> & {
     isSri: (value: string) => boolean;
     isCorepack: (value: string) => boolean;
@@ -5977,6 +5982,12 @@ declare const ResolvedPackage_base: Schema.Class<ResolvedPackage, Schema.Struct<
   readonly isWorkspace: Schema.Boolean;
   readonly relativePath: Schema.optionalKey<Schema.String>;
   readonly dependencies: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>>;
+  readonly peerDependencies: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>>;
+  readonly peerDependenciesMeta: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.Struct<{
+    readonly optional: Schema.Boolean;
+  }>>, never>>;
+  readonly resolved: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>>;
+  readonly unresolvedEdges: Schema.withConstructorDefault<Schema.withDecodingDefaultKey<Schema.$Array<Schema.String>, never>>;
 }>, {}>;
 /**
  * A package resolved from a lockfile.
@@ -5984,6 +5995,13 @@ declare const ResolvedPackage_base: Schema.Class<ResolvedPackage, Schema.Struct<
  * @remarks
  * The common shape every format's entries normalize into:
  *
+ * - `instanceId` — the lockfile-native identity of this *instance*, verbatim:
+ *   pnpm's snapshot key (`react-dom@18.3.1(react@17.0.2)`), npm's full entry
+ *   key (`node_modules/express/node_modules/debug`), bun's `packages` key
+ *   (`@acme/lib/react-dom`) or yarn's locator (`react-dom@npm:18.3.1`). It is
+ *   **opaque** — no scheme is synthesized and none should be parsed by a
+ *   consumer; it exists so `resolved` can name an instance, and so two
+ *   peer-resolved variants of one `name@version` stay distinguishable.
  * - `name` — the resolved package name. For pnpm *workspace* packages
  *   straight out of `Lockfile.parse` this is the importer path until
  *   `Lockfile#withImporterNames` rewrites it.
@@ -5999,6 +6017,47 @@ declare const ResolvedPackage_base: Schema.Class<ResolvedPackage, Schema.Struct<
  *   packages, when the lockfile records one.
  * - `dependencies` — the package's own dependency map, defaulting to `{}`
  *   both at construction and when decoding serialized data.
+ * - `peerDependencies` — the package's *declared* peer ranges, keyed by peer
+ *   name. Every format records them (pnpm and npm as their own section, bun
+ *   inline in the package tuple's info object, yarn Berry as an entry
+ *   section), so this is populated across all four. Declarations only: what
+ *   the package *asks for*, never what actually resolved.
+ * - `peerDependenciesMeta` — the per-peer flags, normalized to
+ *   `{ optional: boolean }`. bun spells optional peers as an `optionalPeers`
+ *   array of names rather than a meta object; that spelling is normalized
+ *   into this shape so one consumer algorithm serves every format. A peer
+ *   with no meta entry is required.
+ * - `resolved` — this instance's *outgoing edges*: dependency (and, where the
+ *   format records it, peer) name → the `instanceId` that name actually
+ *   resolved to in this instance's context. This is the answer to "which
+ *   concrete version of P did X get", which `peerDependencies` deliberately
+ *   does not answer.
+ *
+ *   Every entry is **verified**: an edge is emitted only when the composed or
+ *   walked-up identity matches a real instance in the same lockfile. An edge
+ *   that cannot be resolved honestly is *omitted*, never guessed — a wrong
+ *   resolved edge is a silent wrong answer, an absent one is a visible gap.
+ *   yarn records peer resolution virtually and is therefore dependency-edges
+ *   only.
+ *
+ * - `unresolvedEdges` — dependency names whose edge the lockfile **records**
+ *   but this model could not name: a `link:` target that is not a workspace
+ *   importer, a composed identity matching no instance. It is the companion
+ *   `resolved` needs to be honest, because an absent key in `resolved` would
+ *   otherwise mean two different things — "nothing is there" and "something is
+ *   there that I could not name" — and a consumer reading the first meaning
+ *   for the second turns this package's gap into its own false positive.
+ *
+ *   A dependency the lockfile simply does not record is **not** an unresolved
+ *   edge; it is an absence, and must not appear here. npm and bun contribute
+ *   nothing at all: their sections are *declarations* resolved positionally, so
+ *   "the walk found nothing" is genuine absence. A fail-closed signal that is
+ *   always on is a signal nobody reads.
+ *
+ * All four record fields — `dependencies`, `peerDependencies`,
+ * `peerDependenciesMeta` and `resolved` — default to `{}` at construction and
+ * when decoding, and `unresolvedEdges` defaults to `[]`. An absent section is
+ * therefore an empty collection, never `undefined`.
  *
  * @public
  */
@@ -6844,7 +6903,7 @@ declare class Package extends Package_base {
   toJsonString(options?: PackageFormatOptions): string;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/index.d.ts
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/index.d.ts
 //#region src/WorkspacePackage.d.ts
 declare const PublishConfig_base: Schema.Class<PublishConfig, Schema.Struct<{
   /** Scoped-package visibility. Its presence overrides `private`. */
@@ -7512,6 +7571,37 @@ declare class WorkspaceDiscovery extends WorkspaceDiscovery_base {
 }
 //#endregion
 //#region src/ConfigDependencyHooks.d.ts
+/**
+ * pnpm's `peerDependencyRules` block — the suppression policy pnpm applies
+ * **after** computing peer violations, in pnpm's own shape.
+ *
+ * @remarks
+ * The shape is pnpm's rather than ours because that is what comes back off the
+ * threaded config: measured against `@savvy-web/pnpm-plugin-silk@0.27.0`, a
+ * replayed hook returns `{ allowedVersions, ignoreMissing, allowAny }` intact,
+ * needing no reshaping.
+ *
+ * Two keys are **carried but not yet consumed**. `ignoreMissing` and
+ * `allowAny` are separate suppression axes that have not been measured, and an
+ * unmeasured suppression is precisely what produced the false positives this
+ * seam exists to remove — so they travel through the seam and no kit code acts
+ * on them. Only `allowedVersions` is consumed today.
+ *
+ * `allowedVersions` keys come in two spellings in the wild, and both must be
+ * handled: parent-versioned (`"@effect/ai-anthropic@4.0.0-rc.109>effect"`, as
+ * `pnpm:export` materializes them into `pnpm-workspace.yaml`) and unversioned
+ * (`"@effect/vitest>vitest"`, as a config-dependency plugin injects them).
+ *
+ * @public
+ */
+interface PeerDependencyRules {
+  /** `parent>peer` → the peer version or range the rule permits. */
+  readonly allowedVersions: Readonly<Record<string, string>>;
+  /** Peer names whose absence pnpm does not report. Carried, not consumed. */
+  readonly ignoreMissing: ReadonlyArray<string>;
+  /** Peer names for which any version is accepted. Carried, not consumed. */
+  readonly allowAny: ReadonlyArray<string>;
+}
 /**
  * The result of replaying a workspace's `configDependencies` hooks: the catalogs
  * the hooks yield, and the release-age gate contribution they leave on the
@@ -7531,6 +7621,24 @@ interface HookInjection {
   readonly catalogs: Readonly<Record<string, Readonly<Record<string, string>>>>;
   /** The release-age gate contribution the replayed hooks leave on the config. */
   readonly releaseAge: PartialReleaseAgeGate;
+  /**
+   * The **effective** peer-dependency rules: the seeded workspace-file rules
+   * with every replayed hook's contribution threaded over them.
+   *
+   * @remarks
+   * Effective rather than hook-only because the rules are **seeded** into the
+   * threaded config and the hooks merge onto them, exactly as pnpm seeds its
+   * own config and takes back what the hooks return. That is deliberate: a
+   * kit-owned merge function would be a second implementation of a rule this
+   * seam already enforces, and the two would drift the first time pnpm changed
+   * its threading.
+   *
+   * Measured caveat, and **not a bug to fix**: this repo's plugin *merges*
+   * onto the seeded rules; another plugin could overwrite them. Under seeding
+   * that is pnpm's own behaviour reproduced — a hook that overwrites
+   * overwrites for pnpm too — so do not "repair" it into a merger.
+   */
+  readonly peerDependencyRules: PeerDependencyRules;
 }
 /**
  * The {@link ConfigDependencyHooks} service shape.
@@ -7568,8 +7676,12 @@ interface ConfigDependencyHooksShape {
    * @param configDependencies - The `configDependencies` map (name →
    *   version+integrity) declared in `pnpm-workspace.yaml`.
    * @param seed - The inline catalogs, as `catalog name → dependency → range`.
+   * @param rules - The workspace file's `peerDependencyRules`, seeded into the
+   *   threaded config so hooks merge onto them rather than replacing them.
+   *   Omitted means "the workspace file declares none", which is different
+   *   from "nobody looked" — the caller owns that distinction.
    */
-  readonly inject: (root: string, configDependencies: Readonly<Record<string, string>>, seed: Readonly<Record<string, Readonly<Record<string, string>>>>) => Effect.Effect<HookInjection, CatalogAssemblyError>;
+  readonly inject: (root: string, configDependencies: Readonly<Record<string, string>>, seed: Readonly<Record<string, Readonly<Record<string, string>>>>, rules?: PeerDependencyRules) => Effect.Effect<HookInjection, CatalogAssemblyError>;
 }
 declare const ConfigDependencyHooks_base: Context.ServiceClass<ConfigDependencyHooks, "@effected/workspaces/ConfigDependencyHooks", ConfigDependencyHooksShape>;
 /**
@@ -8048,7 +8160,16 @@ declare class PublishTarget extends PublishTarget_base {}
  * @public
  */
 interface PublishabilityDetectorShape {
-  /** The publish targets for a package; empty means it does not publish. */
+  /**
+   * The publish targets for a package; empty means it does not publish.
+   *
+   * @remarks
+   * `VersioningStrategy.detect` probes a whole workspace by invoking this
+   * concurrently — up to ten packages in flight at once, in no guaranteed
+   * order. An overriding implementation backed by shared mutable state or a
+   * rate-limited client must tolerate that interleaving itself; the caller
+   * does not serialize on its behalf.
+   */
   readonly detect: (pkg: WorkspacePackage) => Effect.Effect<ReadonlyArray<PublishTarget>>;
 }
 declare const PublishabilityDetector_base: Context.ServiceClass<PublishabilityDetector, "@effected/workspaces/PublishabilityDetector", PublishabilityDetectorShape>;
@@ -8333,6 +8454,26 @@ interface WorkspaceCatalogsShape {
    * workspace) has no release-age keys, so the gate is the inert zero gate.
    */
   readonly releaseAgeGate: () => Effect.Effect<ReleaseAgeGate, CatalogAssemblyFailure>;
+  /**
+   * The workspace's **effective** `peerDependencyRules` — pnpm's post-hoc
+   * suppression policy, which the lockfile does not record at all.
+   *
+   * @remarks
+   * Assembled from the same single read and hook replay as `set`, and memoized
+   * with it. The `pnpm-workspace.yaml` block (what `pnpm:export` materializes)
+   * is **seeded** into the replayed config and the config-dependency hooks
+   * merge onto it, so one object carries both sources — the kit never merges
+   * them itself, because that would be a second implementation of a rule the
+   * hook seam already enforces.
+   *
+   * A consumer needs these to avoid **reporting** what pnpm suppresses: pnpm
+   * computes the same peer violations and then hides the ones a rule allows,
+   * so a checker without them reports findings pnpm calls clean.
+   *
+   * `ignoreMissing` and `allowAny` are carried but unmeasured — no kit code
+   * acts on them today.
+   */
+  readonly peerDependencyRules: () => Effect.Effect<PeerDependencyRules, CatalogAssemblyFailure>;
   /**
    * Each importer's dependency-name → resolved-version map, as the manager's
    * lockfile records it. Read from the same single lockfile read as `set`, and