@savvy-web/silk 3.8.0 → 3.8.2

package/changesets-markdownlint.js

@@ -2353,7 +2353,7 @@ var GlobSet = class GlobSet extends Schema.Class("GlobSet")(Schema.Struct({ patt
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/BunExtension.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/BunExtension.js
 /**
 * Extension data specific to bun lockfiles, attached to `Lockfile.extension`
 * when the format is `"bun"`.
@@ -4170,7 +4170,7 @@ input: Schema.String }) {
 	}
 };
 const CATALOG_PREFIX = "catalog:";
-const WORKSPACE_PREFIX = "workspace:";
+const WORKSPACE_PREFIX$1 = "workspace:";
 const isBarePath = (value) => value.startsWith("./") || value.startsWith("../") || value.startsWith("~/") || value.startsWith("/");
 const isGitHubShorthand = (value) => !value.startsWith(".") && !value.startsWith("~") && !value.startsWith("/") && /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+(#.*)?$/.test(value);
 const isGit = (value) => value.startsWith("git+") || value.startsWith("git://") || value.startsWith("github:") || value.startsWith("gist:") || value.startsWith("bitbucket:") || value.startsWith("gitlab:") || isGitHubShorthand(value);
@@ -4178,7 +4178,7 @@ const isLocal = (value) => value.startsWith("file:") || value.startsWith("link:"
 const isLink = (value) => value.startsWith("link:");
 const isPortal = (value) => value.startsWith("portal:");
 const isCatalog = (value) => value.startsWith(CATALOG_PREFIX);
-const isWorkspace = (value) => value.startsWith(WORKSPACE_PREFIX);
+const isWorkspace = (value) => value.startsWith(WORKSPACE_PREFIX$1);
 const isUrl$1 = (value) => value.startsWith("http://") || value.startsWith("https://");
 const parseRange = (value) => {
 	const exit = Schema.decodeUnknownExit(Range$1.FromString)(value);
@@ -4187,7 +4187,7 @@ const parseRange = (value) => {
 const isRange = (value) => Option.isSome(parseRange(value));
 const protocolOf = (value) => {
 	if (value.startsWith(CATALOG_PREFIX)) return "catalog";
-	if (value.startsWith(WORKSPACE_PREFIX)) return "workspace";
+	if (value.startsWith(WORKSPACE_PREFIX$1)) return "workspace";
 	if (value.startsWith("link:")) return "link";
 	if (value.startsWith("portal:")) return "portal";
 	if (value.startsWith("file:") || isBarePath(value)) return "file";
@@ -5621,7 +5621,7 @@ var ReleaseAgeGate = class ReleaseAgeGate extends Schema.Class("ReleaseAgeGate")
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/ImporterDependency.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/ImporterDependency.js
 /**
 * One declared dependency of one workspace importer, as the lockfile records it.
 *
@@ -5660,7 +5660,7 @@ var ImporterDependency = class extends Schema.Class("ImporterDependency")({
 }) {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/LockfileImporter.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/LockfileImporter.js
 /**
 * One workspace importer's declared dependencies, as the lockfile records them.
 *
@@ -5685,14 +5685,23 @@ var LockfileImporter = class extends Schema.Class("LockfileImporter")({
 }) {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/ResolvedPackage.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/ResolvedPackage.js
 const EMPTY_DEPENDENCIES = {};
+const EMPTY_PEER_META = {};
+const EMPTY_EDGE_NAMES = [];
 /**
 * A package resolved from a lockfile.
 *
 * @remarks
 * The common shape every format's entries normalize into:
 *
+* - `instanceId` — the lockfile-native identity of this *instance*, verbatim:
+*   pnpm's snapshot key (`react-dom@18.3.1(react@17.0.2)`), npm's full entry
+*   key (`node_modules/express/node_modules/debug`), bun's `packages` key
+*   (`@acme/lib/react-dom`) or yarn's locator (`react-dom@npm:18.3.1`). It is
+*   **opaque** — no scheme is synthesized and none should be parsed by a
+*   consumer; it exists so `resolved` can name an instance, and so two
+*   peer-resolved variants of one `name@version` stay distinguishable.
 * - `name` — the resolved package name. For pnpm *workspace* packages
 *   straight out of `Lockfile.parse` this is the importer path until
 *   `Lockfile#withImporterNames` rewrites it.
@@ -5708,20 +5717,66 @@ const EMPTY_DEPENDENCIES = {};
 *   packages, when the lockfile records one.
 * - `dependencies` — the package's own dependency map, defaulting to `{}`
 *   both at construction and when decoding serialized data.
+* - `peerDependencies` — the package's *declared* peer ranges, keyed by peer
+*   name. Every format records them (pnpm and npm as their own section, bun
+*   inline in the package tuple's info object, yarn Berry as an entry
+*   section), so this is populated across all four. Declarations only: what
+*   the package *asks for*, never what actually resolved.
+* - `peerDependenciesMeta` — the per-peer flags, normalized to
+*   `{ optional: boolean }`. bun spells optional peers as an `optionalPeers`
+*   array of names rather than a meta object; that spelling is normalized
+*   into this shape so one consumer algorithm serves every format. A peer
+*   with no meta entry is required.
+* - `resolved` — this instance's *outgoing edges*: dependency (and, where the
+*   format records it, peer) name → the `instanceId` that name actually
+*   resolved to in this instance's context. This is the answer to "which
+*   concrete version of P did X get", which `peerDependencies` deliberately
+*   does not answer.
+*
+*   Every entry is **verified**: an edge is emitted only when the composed or
+*   walked-up identity matches a real instance in the same lockfile. An edge
+*   that cannot be resolved honestly is *omitted*, never guessed — a wrong
+*   resolved edge is a silent wrong answer, an absent one is a visible gap.
+*   yarn records peer resolution virtually and is therefore dependency-edges
+*   only.
+*
+* - `unresolvedEdges` — dependency names whose edge the lockfile **records**
+*   but this model could not name: a `link:` target that is not a workspace
+*   importer, a composed identity matching no instance. It is the companion
+*   `resolved` needs to be honest, because an absent key in `resolved` would
+*   otherwise mean two different things — "nothing is there" and "something is
+*   there that I could not name" — and a consumer reading the first meaning
+*   for the second turns this package's gap into its own false positive.
+*
+*   A dependency the lockfile simply does not record is **not** an unresolved
+*   edge; it is an absence, and must not appear here. npm and bun contribute
+*   nothing at all: their sections are *declarations* resolved positionally, so
+*   "the walk found nothing" is genuine absence. A fail-closed signal that is
+*   always on is a signal nobody reads.
+*
+* All four record fields — `dependencies`, `peerDependencies`,
+* `peerDependenciesMeta` and `resolved` — default to `{}` at construction and
+* when decoding, and `unresolvedEdges` defaults to `[]`. An absent section is
+* therefore an empty collection, never `undefined`.
 *
 * @public
 */
 var ResolvedPackage = class extends Schema.Class("ResolvedPackage")({
 	name: Schema.NonEmptyString,
 	version: Schema.String,
+	instanceId: Schema.NonEmptyString,
 	integrity: Schema.optionalKey(IntegrityHash),
 	isWorkspace: Schema.Boolean,
 	relativePath: Schema.optionalKey(Schema.String),
-	dependencies: Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY_DEPENDENCIES)), Schema.withConstructorDefault(Effect.succeed(EMPTY_DEPENDENCIES)))
+	dependencies: Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY_DEPENDENCIES)), Schema.withConstructorDefault(Effect.succeed(EMPTY_DEPENDENCIES))),
+	peerDependencies: Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY_DEPENDENCIES)), Schema.withConstructorDefault(Effect.succeed(EMPTY_DEPENDENCIES))),
+	peerDependenciesMeta: Schema.Record(Schema.String, Schema.Struct({ optional: Schema.Boolean })).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY_PEER_META)), Schema.withConstructorDefault(Effect.succeed(EMPTY_PEER_META))),
+	resolved: Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY_DEPENDENCIES)), Schema.withConstructorDefault(Effect.succeed(EMPTY_DEPENDENCIES))),
+	unresolvedEdges: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY_EDGE_NAMES)), Schema.withConstructorDefault(Effect.succeed(EMPTY_EDGE_NAMES)))
 }) {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/WorkspaceDependency.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/WorkspaceDependency.js
 /**
 * A directed dependency edge between two workspace packages as recorded in
 * the lockfile.
@@ -5744,7 +5799,7 @@ var WorkspaceDependency = class extends Schema.Class("WorkspaceDependency")({
 }) {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/PnpmExtension.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/PnpmExtension.js
 /**
 * Extension data specific to pnpm lockfiles, attached to `Lockfile.extension`
 * when the format is `"pnpm"`.
@@ -5770,10 +5825,10 @@ var PnpmExtension = class extends Schema.Class("PnpmExtension")({
 }) {};
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/LockfileFormat.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/LockfileFormat.js
 /**
 * The lockfile formats this package parses: bun's `bun.lock` (JSONC), npm's
-* `package-lock.json` (v2/v3 JSON), pnpm's `pnpm-lock.yaml` and yarn Berry's
+* `package-lock.json` (JSON), pnpm's `pnpm-lock.yaml` and yarn Berry's
 * `yarn.lock` (both YAML).
 *
 * @remarks
@@ -5782,6 +5837,10 @@ var PnpmExtension = class extends Schema.Class("PnpmExtension")({
 * Berry only; classic (v1) `yarn.lock` is not YAML and fails
 * `Lockfile.parse` with a typed `LockfileParseError`.
 *
+* The format literal says nothing about which *versions* of that format are
+* supported: pnpm `lockfileVersion` 9+ and npm `lockfileVersion` 3+ parse,
+* and older ones fail typed. See `Lockfile.parse`.
+*
 * @public
 */
 const LockfileFormat = Schema.Literals([
@@ -5809,7 +5868,7 @@ const FILENAMES = {
 const filenameFor = (format) => FILENAMES[format][0];
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/shared.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/internal/shared.js
 /**
 * The four dependency sections of a manifest, in a stable order — the shared
 * dependency-sections table (v3's `DEP_SECTIONS`). Each entry is both the
@@ -5920,6 +5979,79 @@ const importerDependencies = (entry, read) => {
 	}
 	return deps;
 };
+const EMPTY_PEERS = {
+	peerDependencies: {},
+	peerDependenciesMeta: {}
+};
+/**
+* Normalize one format's peer declarations into the unified pair.
+*
+* Every format records the ranges the same way (a name→range map), but the
+* optional flag has two spellings: a `peerDependenciesMeta` object (pnpm, npm,
+* yarn Berry) and bun's `optionalPeers` array of names. Both are accepted and
+* collapse to `{ optional: boolean }` per peer, so a consumer reads one shape
+* regardless of which manager wrote the lockfile.
+*
+* Absence yields empty records, never `undefined` — an absent section means
+* "declares no peers", which is a fact, not a gap. Records are built with
+* `Object.fromEntries` (own-property semantics), so a `__proto__` peer name
+* neither pollutes nor drops.
+*
+* @internal
+*/
+const peerDeclarations = (peers, meta, optionalPeers) => {
+	if (peers === void 0 && meta === void 0 && optionalPeers === void 0) return EMPTY_PEERS;
+	const flags = /* @__PURE__ */ new Map();
+	if (meta !== void 0) for (const [name, value] of Object.entries(meta)) flags.set(name, value?.optional === true);
+	if (optionalPeers !== void 0) for (const name of optionalPeers) flags.set(name, true);
+	return {
+		peerDependencies: peers === void 0 ? {} : Object.fromEntries(Object.entries(peers)),
+		peerDependenciesMeta: Object.fromEntries([...flags].map(([name, optional]) => [name, { optional }]))
+	};
+};
+/**
+* The minimum lockfile-format version each gated format is parsed at.
+*
+* This is a deliberate narrowing of the supported input domain, not an
+* implementation detail: an older lockfile fails typed rather than parsing
+* into a model that cannot answer resolution questions. Note the gate is on
+* the **lockfile format version**, which is the only version a lockfile
+* records — the writing package manager's version is not recoverable from the
+* file, so no manager-version claim could be enforced here.
+*
+* @internal
+*/
+const MINIMUM_LOCKFILE_VERSION = {
+	pnpm: 9,
+	npm: 3
+};
+/**
+* Fail typed when a lockfile predates the supported format version.
+*
+* Routed through {@link validationFailure} rather than {@link framingFailure}:
+* the document was located perfectly well, so this is a shape judgement about
+* a located document, not a framing problem. The cause is a structured record
+* rather than an engine error, so a consumer can tell "your lockfile is too
+* old" from "your lockfile is malformed" without parsing a message.
+*
+* A version that is not a number at all (`lockfileVersion: "next"`) is not a
+* supported version either, and fails the same way.
+*
+* @internal
+*/
+const requireLockfileVersion = (format, raw) => {
+	const minimum = MINIMUM_LOCKFILE_VERSION[format];
+	const parsed = typeof raw === "number" ? raw : Number.parseFloat(raw);
+	if (Number.isFinite(parsed) && parsed >= minimum) return Effect.void;
+	const cause = {
+		_tag: "UnsupportedLockfileVersion",
+		format,
+		lockfileVersion: raw,
+		minimumSupported: minimum,
+		message: `${format} lockfileVersion ${JSON.stringify(raw)} is not supported: @effected/lockfiles parses ${format} lockfileVersion ${minimum} and newer`
+	};
+	return Effect.fail(validationFailure(cause));
+};
 /** @internal */
 const syntaxFailure = (cause) => ({
 	stage: "syntax",
@@ -7781,16 +7913,38 @@ var JsoncModifier = class {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/bun.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/internal/bun.js
 const DepRecord$2 = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
+const OptionalPeers = Schema.optionalKey(Schema.Array(Schema.String));
 const BunWorkspaceEntry = Schema.Struct({
 	name: Schema.optionalKey(Schema.String),
 	version: Schema.optionalKey(Schema.String),
 	dependencies: DepRecord$2,
 	devDependencies: DepRecord$2,
 	peerDependencies: DepRecord$2,
-	optionalDependencies: DepRecord$2
+	optionalDependencies: DepRecord$2,
+	optionalPeers: OptionalPeers
+});
+/**
+* The info object at package-tuple index 2. bun's tuple shape is
+* under-documented upstream, so it is read permissively and *out of band*: a
+* shape that does not decode is skipped (the package still lands, with no
+* peers) rather than failing the whole parse.
+*
+* @internal
+*/
+const BunPackageInfo = Schema.Struct({
+	dependencies: DepRecord$2,
+	devDependencies: DepRecord$2,
+	optionalDependencies: DepRecord$2,
+	peerDependencies: DepRecord$2,
+	optionalPeers: OptionalPeers
 });
+const decodeBunPackageInfo = Schema.decodeUnknownExit(BunPackageInfo);
+const readBunPackageInfo = (value) => {
+	const exit = decodeBunPackageInfo(value);
+	return Exit.isSuccess(exit) ? exit.value : void 0;
+};
 const BunLockfileRaw = Schema.Struct({
 	lockfileVersion: Schema.Number,
 	workspaces: Schema.optionalKey(Schema.Record(Schema.String, BunWorkspaceEntry)),
@@ -7813,8 +7967,60 @@ const parseBun = (content) => Effect.gen(function* () {
 	const validated = yield* Schema.decodeUnknownEffect(BunLockfileRaw)(parsed).pipe(Effect.mapError(validationFailure));
 	return yield* toFields$3(validated);
 });
+/**
+* Resolve one entry's outgoing edges by replaying bun's own key scheme.
+*
+* bun encodes install position in the `packages` key: a nested install is
+* keyed `<parent-key>/<name>`, so `"react-dom/react"` is literally "the react
+* react-dom got". Package names are themselves slash-bearing when scoped, so
+* the parent chain is **not** computed by splitting on `/` — it is read off
+* the key space, taking those prefixes of the key that are themselves keys,
+* longest first. Deepest wins; the root (`<name>` alone) is tried last.
+*
+* Only keys that exist are emitted, so an edge bun did not record is omitted
+* rather than invented.
+*
+* @internal
+*/
+const resolveBunEdges = (key, sections, keys) => {
+	const names = /* @__PURE__ */ new Set();
+	for (const section of sections) {
+		if (!section) continue;
+		for (const name of Object.keys(section)) if (name !== "") names.add(name);
+	}
+	if (names.size === 0) return {};
+	const prefixes = [key];
+	for (let i = key.indexOf("/"); i !== -1; i = key.indexOf("/", i + 1)) {
+		const candidate = key.slice(0, i);
+		if (keys.has(candidate)) prefixes.push(candidate);
+	}
+	prefixes.sort((a, b) => b.length - a.length);
+	prefixes.push("");
+	const edges = /* @__PURE__ */ new Map();
+	for (const name of names) for (const prefix of prefixes) {
+		const candidate = prefix === "" ? name : `${prefix}/${name}`;
+		if (keys.has(candidate)) {
+			edges.set(name, candidate);
+			break;
+		}
+	}
+	return Object.fromEntries(edges);
+};
+const infoSections = (info) => [
+	info?.dependencies,
+	info?.devDependencies,
+	info?.optionalDependencies,
+	info?.peerDependencies
+];
+const workspaceSections = (entry) => [
+	entry.dependencies,
+	entry.devDependencies,
+	entry.optionalDependencies,
+	entry.peerDependencies
+];
 const toFields$3 = (raw) => Effect.gen(function* () {
 	const packages = [];
+	const keys = new Set(raw.packages ? Object.keys(raw.packages) : []);
 	const workspaceNames = /* @__PURE__ */ new Set();
 	const workspaceEntries = /* @__PURE__ */ new Map();
 	const importers = [];
@@ -7827,11 +8033,16 @@ const toFields$3 = (raw) => Effect.gen(function* () {
 			if (wsPath === "") continue;
 			const name = wsEntry.name === void 0 || wsEntry.name === "" ? wsPath : wsEntry.name;
 			workspaceNames.add(name);
+			const instanceId = keys.has(name) ? name : wsPath;
+			if (instanceId === "") continue;
 			packages.push(ResolvedPackage.make({
 				name,
 				version: wsEntry.version ?? "0.0.0",
+				instanceId,
 				isWorkspace: true,
-				relativePath: wsPath
+				relativePath: wsPath,
+				...peerDeclarations(wsEntry.peerDependencies, void 0, wsEntry.optionalPeers),
+				resolved: resolveBunEdges(instanceId, workspaceSections(wsEntry), keys)
 			}));
 			workspaceEntries.set(name, {
 				...wsEntry.dependencies ? { dependencies: wsEntry.dependencies } : {},
@@ -7841,7 +8052,8 @@ const toFields$3 = (raw) => Effect.gen(function* () {
 			});
 		}
 	}
-	if (raw.packages) for (const tuple of Object.values(raw.packages)) {
+	if (raw.packages) for (const [key, tuple] of Object.entries(raw.packages)) {
+		if (key === "") continue;
 		if (tuple.length < 1) continue;
 		const first = tuple[0];
 		if (typeof first !== "string") continue;
@@ -7851,11 +8063,15 @@ const toFields$3 = (raw) => Effect.gen(function* () {
 		const version = first.slice(atIdx + 1);
 		if (workspaceNames.has(name)) continue;
 		const integrity = yield* toIntegrityHash(tuple.length >= 4 && typeof tuple[3] === "string" ? tuple[3] : void 0);
+		const info = tuple.length >= 3 ? readBunPackageInfo(tuple[2]) : void 0;
 		packages.push(ResolvedPackage.make({
 			name,
 			version,
+			instanceId: key,
 			...integrity !== void 0 ? { integrity } : {},
-			isWorkspace: false
+			isWorkspace: false,
+			...peerDeclarations(info?.peerDependencies, void 0, info?.optionalPeers),
+			resolved: resolveBunEdges(key, infoSections(info), keys)
 		}));
 	}
 	const workspaceDependencies = extractWorkspaceDeps(workspaceEntries, workspaceNames);
@@ -7875,8 +8091,9 @@ const toFields$3 = (raw) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/npm.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/internal/npm.js
 const DepRecord$1 = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
+const PeerMetaRecord = Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({ optional: Schema.optionalKey(Schema.Boolean) })));
 const NpmPackageEntry = Schema.Struct({
 	name: Schema.optionalKey(Schema.String),
 	version: Schema.optionalKey(Schema.String),
@@ -7887,8 +8104,22 @@ const NpmPackageEntry = Schema.Struct({
 	dependencies: DepRecord$1,
 	devDependencies: DepRecord$1,
 	peerDependencies: DepRecord$1,
+	peerDependenciesMeta: PeerMetaRecord,
 	optionalDependencies: DepRecord$1
 });
+/**
+* The version gate's own input: `lockfileVersion` and nothing else.
+*
+* The gate has to read the version *before* the shape decode, because the
+* shape it would decode against is the shape of a supported version. `packages`
+* is a required key here and a v1 tree does not have one, so a shape-first
+* order reports npm v1 as **malformed** rather than as **too old** — losing
+* exactly the distinction the `UnsupportedLockfileVersion` cause exists to
+* carry.
+*
+* @internal
+*/
+const NpmVersionProbe = Schema.Struct({ lockfileVersion: Schema.Union([Schema.Number, Schema.String]) });
 const NpmLockfileRaw = Schema.Struct({
 	name: Schema.optionalKey(Schema.String),
 	version: Schema.optionalKey(Schema.String),
@@ -7897,10 +8128,73 @@ const NpmLockfileRaw = Schema.Struct({
 	packages: Schema.Record(Schema.String, NpmPackageEntry)
 });
 const NODE_MODULES_PREFIX = "node_modules/";
+const NESTED_NODE_MODULES = "/node_modules/";
 /**
-* Parse npm `package-lock.json` (v2/v3) content into the unified field
-* bundle. Native `JSON.parse` inside `Effect.try` — its throw on hostile
-* input (including V8's `RangeError` on pathological depth) lands typed as
+* Where a `packages` key's package name starts: after the **last**
+* `node_modules/` segment, not the first.
+*
+* npm encodes the whole install position in the key, so
+* `node_modules/express/node_modules/debug` is *debug*, nested under express —
+* and `packages/lib/node_modules/react` is *react*, nested under a workspace
+* directory and carrying no `node_modules/` prefix at all. Returns `-1` for a
+* key that is not a package position (the root `""` entry, a workspace path
+* entry), which the caller skips.
+*
+* @internal
+*/
+const packageNameIndex = (key) => {
+	const nested = key.lastIndexOf(NESTED_NODE_MODULES);
+	if (nested !== -1) return nested + 14;
+	return key.startsWith(NODE_MODULES_PREFIX) ? 13 : -1;
+};
+/**
+* Resolve one entry's outgoing edges by replaying node resolution over the key
+* space: from the depending package's own directory, try
+* `<prefix>/node_modules/<name>`, then strip one path segment and try again,
+* out to the root — **deepest first**, first hit wins. That order is the whole
+* algorithm: outermost-first would return the hoisted copy and silently
+* mis-report every shadowed dependency.
+*
+* Only keys that actually exist in the lockfile are emitted, so an edge npm
+* did not record is omitted rather than invented.
+*
+* @internal
+*/
+const resolveNpmEdges = (start, sections, packages) => {
+	const names = /* @__PURE__ */ new Set();
+	for (const section of sections) {
+		if (!section) continue;
+		for (const name of Object.keys(section)) if (name !== "") names.add(name);
+	}
+	if (names.size === 0) return {};
+	const prefixes = [];
+	for (let prefix = start;;) {
+		prefixes.push(prefix);
+		if (prefix === "") break;
+		const slash = prefix.lastIndexOf("/");
+		prefix = slash === -1 ? "" : prefix.slice(0, slash);
+	}
+	const edges = /* @__PURE__ */ new Map();
+	for (const name of names) for (const prefix of prefixes) {
+		const candidate = prefix === "" ? `${NODE_MODULES_PREFIX}${name}` : `${prefix}${NESTED_NODE_MODULES}${name}`;
+		if (Object.hasOwn(packages, candidate)) {
+			edges.set(name, candidate);
+			break;
+		}
+	}
+	return Object.fromEntries(edges);
+};
+const entrySections = (entry) => [
+	entry?.dependencies,
+	entry?.devDependencies,
+	entry?.optionalDependencies,
+	entry?.peerDependencies
+];
+/**
+* Parse npm `package-lock.json` content into the unified field bundle —
+* `lockfileVersion` 3 and newer; v2 and older fail typed at validation.
+* Native `JSON.parse` inside `Effect.try` — its throw on hostile input
+* (including V8's `RangeError` on pathological depth) lands typed as
 * `stage: "syntax"`.
 *
 * @internal
@@ -7910,6 +8204,8 @@ const parseNpm = (content) => Effect.gen(function* () {
 		try: () => JSON.parse(content),
 		catch: syntaxFailure
 	});
+	const probe = yield* Schema.decodeUnknownEffect(NpmVersionProbe)(raw).pipe(Effect.mapError(validationFailure));
+	yield* requireLockfileVersion("npm", probe.lockfileVersion);
 	const validated = yield* Schema.decodeUnknownEffect(NpmLockfileRaw)(raw).pipe(Effect.mapError(validationFailure));
 	return yield* toFields$2(validated);
 });
@@ -7923,22 +8219,30 @@ const toFields$2 = (raw) => Effect.gen(function* () {
 		path: ".",
 		dependencies: importerDependencies(rootEntry, (s) => ({ specifier: s }))
 	}));
-	for (const [key, entry] of Object.entries(raw.packages)) if (key.startsWith(NODE_MODULES_PREFIX) && entry.link === true) {
-		const name = (entry.resolved !== void 0 ? raw.packages[entry.resolved] : void 0)?.name ?? entry.name ?? key.slice(13);
-		if (name !== "") workspaceNames.add(name);
+	for (const [key, entry] of Object.entries(raw.packages)) {
+		const nameIndex = packageNameIndex(key);
+		if (nameIndex !== -1 && entry.link === true) {
+			const name = (entry.resolved !== void 0 ? raw.packages[entry.resolved] : void 0)?.name ?? entry.name ?? key.slice(nameIndex);
+			if (name !== "") workspaceNames.add(name);
+		}
 	}
 	for (const [key, entry] of Object.entries(raw.packages)) {
 		if (key === "") continue;
-		if (key.startsWith(NODE_MODULES_PREFIX) && entry.link === true) {
+		const nameIndex = packageNameIndex(key);
+		if (nameIndex === -1) continue;
+		if (entry.link === true) {
 			const resolved = entry.resolved;
 			const wsEntry = resolved !== void 0 ? raw.packages[resolved] : void 0;
-			const name = wsEntry?.name ?? entry.name ?? key.slice(13);
+			const name = wsEntry?.name ?? entry.name ?? key.slice(nameIndex);
 			if (name === "") continue;
 			packages.push(ResolvedPackage.make({
 				name,
 				version: wsEntry?.version ?? "0.0.0",
+				instanceId: key,
 				isWorkspace: true,
-				...resolved !== void 0 ? { relativePath: resolved } : {}
+				...resolved !== void 0 ? { relativePath: resolved } : {},
+				...peerDeclarations(wsEntry?.peerDependencies, wsEntry?.peerDependenciesMeta),
+				resolved: resolveNpmEdges(resolved !== void 0 && resolved !== "" ? resolved : key, entrySections(wsEntry), raw.packages)
 			}));
 			if (wsEntry) workspaceEntries.set(name, {
 				...wsEntry.dependencies ? { dependencies: wsEntry.dependencies } : {},
@@ -7950,16 +8254,19 @@ const toFields$2 = (raw) => Effect.gen(function* () {
 				path: resolved,
 				dependencies: wsEntry ? importerDependencies(wsEntry, (s) => ({ specifier: s })) : []
 			}));
-		} else if (key.startsWith(NODE_MODULES_PREFIX)) {
-			const name = key.slice(13);
+		} else {
+			const name = key.slice(nameIndex);
 			if (name !== "" && entry.version !== void 0) {
 				const integrity = yield* toIntegrityHash(entry.integrity);
 				packages.push(ResolvedPackage.make({
 					name,
 					version: entry.version,
+					instanceId: key,
 					...integrity !== void 0 ? { integrity } : {},
 					isWorkspace: false,
-					dependencies: entry.dependencies ?? {}
+					dependencies: entry.dependencies ?? {},
+					...peerDeclarations(entry.peerDependencies, entry.peerDependenciesMeta),
+					resolved: resolveNpmEdges(key, entrySections(entry), raw.packages)
 				}));
 			}
 		}
@@ -15757,7 +16064,7 @@ function deepEqualValues(a, b) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/documents.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/internal/documents.js
 /**
 * An empty YAML document composes to `null` (`Yaml.parseAll("")` is `[null]`,
 * and the trailing document of an env-only `pnpm-lock.yaml` is `null` too).
@@ -15828,7 +16135,7 @@ const selectSoleDocument = (content) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/pnpm.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/internal/pnpm.js
 const PnpmImporterDeps = Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({
 	specifier: Schema.String,
 	version: Schema.String
@@ -15839,6 +16146,18 @@ const PnpmImporter = Schema.Struct({
 	peerDependencies: PnpmImporterDeps,
 	optionalDependencies: PnpmImporterDeps
 });
+/**
+* The version gate's own input: `lockfileVersion` and nothing else.
+*
+* The gate has to read the version *before* the shape decode, because the
+* shape it decodes against is the shape of a supported version. `importers` is
+* a required key here and a pre-v9 single-project lockfile has none — it
+* records its dependencies at the top level — so a shape-first order reports a
+* lockfile we reject for being too old as merely malformed instead.
+*
+* @internal
+*/
+const PnpmVersionProbe = Schema.Struct({ lockfileVersion: Schema.Union([Schema.String, Schema.Number]) });
 const PnpmLockfileRaw = Schema.Struct({
 	lockfileVersion: Schema.Union([Schema.String, Schema.Number]),
 	settings: Schema.optionalKey(Schema.Struct({
@@ -15851,7 +16170,17 @@ const PnpmLockfileRaw = Schema.Struct({
 		version: Schema.String
 	})])))),
 	importers: Schema.Record(Schema.String, PnpmImporter),
-	packages: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({ resolution: Schema.optionalKey(Schema.Struct({ integrity: Schema.optionalKey(Schema.String) })) })))
+	packages: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({
+		resolution: Schema.optionalKey(Schema.Struct({ integrity: Schema.optionalKey(Schema.String) })),
+		peerDependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+		peerDependenciesMeta: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({ optional: Schema.optionalKey(Schema.Boolean) }))),
+		dependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+		optionalDependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String))
+	}))),
+	snapshots: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({
+		dependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+		optionalDependencies: Schema.optionalKey(Schema.Record(Schema.String, Schema.String))
+	})))
 });
 /**
 * Parse pnpm `pnpm-lock.yaml` content into the unified field bundle.
@@ -15871,10 +16200,142 @@ const PnpmLockfileRaw = Schema.Struct({
 */
 const parsePnpm = (content) => Effect.gen(function* () {
 	const { document, documents } = yield* selectPnpmDocument(content);
+	const probe = yield* Schema.decodeUnknownEffect(PnpmVersionProbe)(document).pipe(Effect.mapError(validationFailure));
+	yield* requireLockfileVersion("pnpm", probe.lockfileVersion);
 	const validated = yield* Schema.decodeUnknownEffect(PnpmLockfileRaw)(document).pipe(Effect.mapError(validationFailure));
 	if (Object.keys(validated.importers).length === 0) return yield* Effect.fail(framingFailure("noImporters", documents));
 	return yield* toFields$1(validated);
 });
+/**
+* Resolve one instance's outgoing edges to instance ids.
+*
+* pnpm names a resolved dependency as `name` → `version`, where the version may
+* itself carry a peer suffix (`1.6.0(react@17.0.2)`); the referenced instance's
+* key is those two composed back together. The composition is *verified*
+* against the lockfile's own key set rather than trusted — the composed key is
+* v9's bare `name@version` and nothing else, because the format gate admits no
+* lockfile that spells keys the pre-v9 leading-slash way — and an edge that
+* matches nothing is **omitted**. That is what keeps a `link:`/`file:`
+* resolution, which names no instance in this lockfile, from becoming a
+* plausible lie.
+*
+* @internal
+*/
+const resolveEdges = (sections, instanceIds) => {
+	const edges = /* @__PURE__ */ new Map();
+	const unnameable = /* @__PURE__ */ new Set();
+	for (const section of sections) {
+		if (!section) continue;
+		for (const [name, version] of Object.entries(section)) {
+			if (name === "") continue;
+			if (version.startsWith(LINK_PREFIX)) {
+				const target = resolveLinkTarget("", version.slice(LINK_PREFIX.length));
+				if (target !== void 0 && instanceIds.has(target)) edges.set(name, target);
+				else unnameable.add(name);
+				continue;
+			}
+			const bare = `${name}@${version}`;
+			if (instanceIds.has(bare)) edges.set(name, bare);
+			else unnameable.add(name);
+		}
+	}
+	return {
+		resolved: Object.fromEntries(edges),
+		unresolvedEdges: [...unnameable].sort()
+	};
+};
+/** The protocol pnpm records a workspace-directory resolution under. @internal */
+const LINK_PREFIX = "link:";
+/**
+* Normalize a `link:` target against the linking importer's path, so a
+* workspace edge can name the workspace importer's instance id.
+* Total: a target that walks above the root yields `undefined`.
+*
+* @internal
+*/
+const resolveLinkTarget = (importerPath, target) => {
+	const segments = [];
+	for (const segment of `${importerPath}/${target}`.split("/")) {
+		if (segment === "" || segment === ".") continue;
+		if (segment === "..") {
+			if (segments.pop() === void 0) return void 0;
+			continue;
+		}
+		segments.push(segment);
+	}
+	return segments.length === 0 ? void 0 : segments.join("/");
+};
+/** The specifier protocol pnpm resolves through the workspace itself. @internal */
+const WORKSPACE_PREFIX = "workspace:";
+/**
+* The importer a `link:` target lands INSIDE, longest path first.
+*
+* pnpm's `publishConfig.linkDirectory` makes a workspace link point at the
+* package's publish directory rather than its root — `link:../bundler/dist/dev/pkg`
+* where `packages/bundler` is the importer — so the target itself is a build
+* output that is no importer and never will be. The owning importer is the
+* longest ancestor of the target that IS one; longest-first so a nested importer
+* beats its parent.
+*
+* The root importer (`"."`) is deliberately unreachable here: it is an ancestor
+* of every path in the workspace, so admitting it would resolve every stray link
+* to the root rather than leaving it unnamed.
+*
+* @internal
+*/
+const owningImporter = (target, importerPaths) => {
+	const segments = target.split("/");
+	for (let end = segments.length - 1; end > 0; end--) {
+		const candidate = segments.slice(0, end).join("/");
+		if (importerPaths.has(candidate)) return candidate;
+	}
+};
+/**
+* Resolve one importer's outgoing edges. pnpm records `{ specifier, version }`
+* per importer dependency, where the version is either a registry version (the
+* instance-id composition {@link resolveEdges} performs) or a `link:` target
+* naming another importer — normalized against this importer's own path. Both
+* are checked against the lockfile's instance ids before being emitted.
+*
+* A `link:` target that is no importer gets one further chance, and only under
+* a `workspace:` SPECIFIER: pnpm resolved that edge through the workspace, so
+* the target directory is known to belong to a workspace package, and
+* {@link owningImporter} names it. The specifier is what makes this a
+* resolution rather than a guess — a hand-written `link:../vendor/stub`
+* specifier names a directory pnpm never claimed was a workspace package, and
+* attributing it to whichever importer happens to contain it would answer with
+* the wrong package's peers instead of admitting it could not name the edge.
+*
+* The snapshot path ({@link resolveEdges}) deliberately does NOT do this: a
+* snapshot body records `name: link:<path>` with no specifier beside it, so the
+* evidence this rule turns on is not available there.
+*
+* @internal
+*/
+const resolveImporterEdges = (importer, importerPath, instanceIds, importerPaths) => {
+	const edges = /* @__PURE__ */ new Map();
+	const unnameable = /* @__PURE__ */ new Set();
+	for (const group of importerDepGroups(importer)) {
+		if (!group) continue;
+		for (const [name, info] of Object.entries(group)) {
+			if (name === "") continue;
+			if (info.version.startsWith(LINK_PREFIX)) {
+				const target = resolveLinkTarget(importerPath, info.version.slice(5));
+				const owner = target === void 0 ? void 0 : instanceIds.has(target) ? target : info.specifier.startsWith(WORKSPACE_PREFIX) ? owningImporter(target, importerPaths) : void 0;
+				if (owner !== void 0) edges.set(name, owner);
+				else unnameable.add(name);
+				continue;
+			}
+			const bare = `${name}@${info.version}`;
+			if (instanceIds.has(bare)) edges.set(name, bare);
+			else unnameable.add(name);
+		}
+	}
+	return {
+		resolved: Object.fromEntries(edges),
+		unresolvedEdges: [...unnameable].sort()
+	};
+};
 const toVersionMap = (deps) => {
 	if (!deps) return void 0;
 	return Object.fromEntries(Object.entries(deps).map(([name, info]) => [name, info.specifier]));
@@ -15915,28 +16376,51 @@ const toFields$1 = (raw) => Effect.gen(function* () {
 	}
 	for (const path of Object.keys(raw.importers)) if (path !== "." && path !== "") workspaceNames.add(path);
 	const packages = [];
-	for (const importerPath of Object.keys(raw.importers)) {
+	const snapshots = raw.snapshots;
+	const instanceIds = /* @__PURE__ */ new Set([
+		...snapshots ? Object.keys(snapshots) : [],
+		...raw.packages ? Object.keys(raw.packages) : [],
+		...Object.keys(raw.importers)
+	]);
+	const importerPaths = new Set(Object.keys(raw.importers).filter((path) => path !== "." && path !== ""));
+	const emitted = /* @__PURE__ */ new Set();
+	for (const [importerPath, importer] of Object.entries(raw.importers)) {
 		if (importerPath === "." || importerPath === "") continue;
 		packages.push(ResolvedPackage.make({
 			name: importerPath,
 			version: "0.0.0",
+			instanceId: importerPath,
 			isWorkspace: true,
-			relativePath: importerPath
+			relativePath: importerPath,
+			...resolveImporterEdges(importer, importerPath, instanceIds, importerPaths)
 		}));
 	}
-	if (raw.packages) for (const [key, pkg] of Object.entries(raw.packages)) {
-		const { plain: bare } = splitPeerSuffix(key);
+	const emit = (instanceId, meta, edges) => Effect.gen(function* () {
+		const { plain: bare } = splitPeerSuffix(instanceId);
 		const atIndex = bare.lastIndexOf("@");
-		if (atIndex <= 0) continue;
+		if (atIndex <= 0) return;
 		const name = bare.slice(0, atIndex);
 		const version = bare.slice(atIndex + 1);
-		const integrity = yield* toIntegrityHash(pkg.resolution?.integrity);
+		const integrity = yield* toIntegrityHash(meta?.resolution?.integrity);
+		emitted.add(instanceId);
 		packages.push(ResolvedPackage.make({
 			name,
 			version,
+			instanceId,
 			...integrity !== void 0 ? { integrity } : {},
-			isWorkspace: false
+			isWorkspace: false,
+			...peerDeclarations(meta?.peerDependencies, meta?.peerDependenciesMeta),
+			...resolveEdges(edges, instanceIds)
 		}));
+	});
+	if (snapshots) for (const [key, snapshot] of Object.entries(snapshots)) {
+		const plain = splitPeerSuffix(key).plain;
+		yield* emit(key, raw.packages !== void 0 && Object.hasOwn(raw.packages, plain) ? raw.packages[plain] : void 0, [snapshot.dependencies, snapshot.optionalDependencies]);
+	}
+	const covered = new Set([...emitted].map((key) => splitPeerSuffix(key).plain));
+	if (raw.packages) for (const [key, pkg] of Object.entries(raw.packages)) {
+		if (covered.has(key)) continue;
+		yield* emit(key, pkg, [pkg.dependencies, pkg.optionalDependencies]);
 	}
 	const workspaceDependencies = extractWorkspaceDeps(workspaceEntries, workspaceNames);
 	const extension = PnpmExtension.make({
@@ -15954,7 +16438,7 @@ const toFields$1 = (raw) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/internal/yarn.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/internal/yarn.js
 const YarnLockfileRaw = Schema.Record(Schema.String, Schema.Unknown);
 const DepRecord = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
 const YarnEntry = Schema.Struct({
@@ -15963,6 +16447,7 @@ const YarnEntry = Schema.Struct({
 	dependencies: DepRecord,
 	devDependencies: DepRecord,
 	peerDependencies: DepRecord,
+	peerDependenciesMeta: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({ optional: Schema.optionalKey(Schema.Boolean) }))),
 	optionalDependencies: DepRecord,
 	checksum: Schema.optionalKey(Schema.String),
 	languageName: Schema.optionalKey(Schema.String),
@@ -15996,6 +16481,13 @@ const toFields = (lockfileVersion, decoded) => Effect.gen(function* () {
 	const packages = [];
 	const workspaceNames = /* @__PURE__ */ new Set();
 	const workspaceEntries = /* @__PURE__ */ new Map();
+	const locators = /* @__PURE__ */ new Map();
+	for (const [key, entry] of decoded) {
+		const descriptors = key.split(", ");
+		const locator = entry.resolution ?? descriptors[0];
+		if (locator === void 0 || locator === "") continue;
+		for (const descriptor of descriptors) if (descriptor !== "") locators.set(descriptor, locator);
+	}
 	for (const [key, entry] of decoded) if (entry.linkType === "soft") {
 		const name = extractYarnPackageName(key);
 		if (name !== void 0) workspaceNames.add(name);
@@ -16006,12 +16498,17 @@ const toFields = (lockfileVersion, decoded) => Effect.gen(function* () {
 		const isWorkspace = entry.linkType === "soft";
 		const relativePath = isWorkspace ? extractYarnWorkspacePath(key) : void 0;
 		const integrity = yield* toIntegrityHash(entry.checksum);
+		const instanceId = entry.resolution ?? key.split(", ")[0] ?? "";
+		if (instanceId === "") continue;
 		packages.push(ResolvedPackage.make({
 			name,
 			version: entry.version ?? "0.0.0",
+			instanceId,
 			...integrity !== void 0 ? { integrity } : {},
 			isWorkspace,
-			...relativePath !== void 0 ? { relativePath } : {}
+			...relativePath !== void 0 ? { relativePath } : {},
+			...peerDeclarations(entry.peerDependencies, entry.peerDependenciesMeta),
+			...resolveYarnEdges(entry, locators)
 		}));
 		if (isWorkspace) {
 			const deps = cleanYarnDeps(entry.dependencies);
@@ -16034,6 +16531,46 @@ const toFields = (lockfileVersion, decoded) => Effect.gen(function* () {
 	};
 });
 /**
+* Resolve one entry's outgoing edges through the descriptor→locator index.
+*
+* A yarn dependency value is a *descriptor* range (`"npm:5.3.0"`), and the
+* lockfile keys enumerate exactly which descriptors resolve to which locator,
+* so the lookup is exact rather than reconstructed.
+*
+* **`devDependencies` is not a section a Berry lockfile has.** yarn folds a
+* workspace's dev declarations into the entry's `dependencies` map — the
+* lockfile a project produces is byte-identical whether a dependency is
+* declared under `dependencies` or `devDependencies` (probed against yarn
+* 4.9.1). Dev edges are therefore already resolved here; iterating
+* `entry.devDependencies` would be dead code, and the schema keeps the field
+* only as permissive scaffolding for hand-edited input.
+*
+* **Dependency edges only.** yarn resolves peers virtually — a peer-bearing
+* package gets a `@virtual:` locator per consumer, and this lockfile shape does
+* not record which one satisfied which peer. Emitting a peer edge here would
+* mean guessing, so peers are left out: an absent edge is a true statement, a
+* plausible one would not be.
+*
+* @internal
+*/
+const resolveYarnEdges = (entry, locators) => {
+	const edges = /* @__PURE__ */ new Map();
+	const unnameable = /* @__PURE__ */ new Set();
+	for (const section of [entry.dependencies, entry.optionalDependencies]) {
+		if (!section) continue;
+		for (const [name, range] of Object.entries(section)) {
+			if (name === "") continue;
+			const locator = locators.get(`${name}@${range}`);
+			if (locator !== void 0) edges.set(name, locator);
+			else unnameable.add(name);
+		}
+	}
+	return {
+		resolved: Object.fromEntries(edges),
+		unresolvedEdges: [...unnameable].sort()
+	};
+};
+/**
 * Extract the package name from a yarn lockfile key. Handles compound keys
 * (`"a@workspace:*, a@workspace:packages/a"`) via the first descriptor and
 * `@patch:` descriptors (which embed `@npm:` inside). Total: malformed keys
@@ -16078,7 +16615,7 @@ const cleanYarnDeps = (deps) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/Lockfile.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/Lockfile.js
 const EMPTY_IMPORTERS = [];
 /**
 * Failure of `Lockfile.parse`: the given content is not a valid lockfile of
@@ -16250,10 +16787,15 @@ var Lockfile = class Lockfile extends Schema.Class("Lockfile")({
 			return ResolvedPackage.make({
 				name: realName,
 				version: pkg.version,
+				instanceId: pkg.instanceId,
 				...pkg.integrity !== void 0 ? { integrity: pkg.integrity } : {},
 				isWorkspace: pkg.isWorkspace,
 				relativePath: pkg.relativePath,
-				dependencies: pkg.dependencies
+				dependencies: pkg.dependencies,
+				peerDependencies: pkg.peerDependencies,
+				peerDependenciesMeta: pkg.peerDependenciesMeta,
+				resolved: pkg.resolved,
+				unresolvedEdges: pkg.unresolvedEdges
 			});
 		});
 		const workspaceDependencies = this.workspaceDependencies.map((dep) => {
@@ -16323,7 +16865,7 @@ var Lockfile = class Lockfile extends Schema.Class("Lockfile")({
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+lockfiles@0.5.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_d53253b32eb6a388ea04dc81d5e132f1/node_modules/@effected/lockfiles/LockfileIntegrity.js
+//#region ../../node_modules/.pnpm/@effected+lockfiles@0.6.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__@effected+npm@0.11_b5e24f85b508eca09bd100b8bd2084bb/node_modules/@effected/lockfiles/LockfileIntegrity.js
 /**
 * The minimal manifest shape {@link LockfileIntegrity.compare} checks a
 * lockfile against: a package name plus the four optional dependency maps.
@@ -19199,7 +19741,7 @@ var Package = class Package extends Schema.Class("Package")({
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspacePackage.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspacePackage.js
 const EMPTY$1 = Object.freeze(Object.create(null));
 const EMPTY_MANIFEST = Object.freeze(Object.create(null));
 /**
@@ -19801,7 +20343,7 @@ var Walker$1 = class {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceRoot.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceRoot.js
 /**
 * The marker filenames {@link WorkspaceRoot} probes for, in priority order.
 *
@@ -19989,7 +20531,7 @@ var WorkspaceRoot = class WorkspaceRoot extends Context.Service()("@effected/wor
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/limits.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/limits.js
 /**
 * Hard ceiling on directories the enumerator will visit for one pattern set.
 * Guards the pathological case a depth cap alone does not: a wide, shallow
@@ -20008,7 +20550,7 @@ const MAX_ENUMERATION_ENTRIES = 1e5;
 const PRUNED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/traverse.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/traverse.js
 /** Directory names never descended into. */
 const isPruned = (entry) => PRUNED_DIRECTORIES.has(entry);
 /** Join root-relative POSIX segments; `""` is the root itself. */
@@ -20099,7 +20641,7 @@ var Traversal = class {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/enumerate.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/enumerate.js
 /** Strip a trailing slash from `GlobPattern.enumerationPrefix` to get a relative directory. */
 const baseOf = (pattern) => pattern.enumerationPrefix.replace(/\/$/, "");
 /**
@@ -20116,6 +20658,8 @@ const enumerate = (root, globs, options) => Effect.gen(function* () {
 	if (!isValidMaxDepth(maxDepth)) return yield* Effect.die(/* @__PURE__ */ new Error(`enumerate: ${badMaxDepthMessage(maxDepth)}`));
 	const isPackage = (absolute) => fs.exists(path.join(absolute, "package.json")).pipe(Effect.orElseSucceed(() => false));
 	const isDirectory = (absolute) => fs.stat(absolute).pipe(Effect.map((info) => info.type === "Directory"), Effect.orElseSucceed(() => false));
+	const excludes = globs.excludes;
+	const isExcluded = excludes.length === 0 ? (_) => false : (relative) => excludes.some((exclude) => exclude.matches(relative));
 	const included = /* @__PURE__ */ new Map();
 	/** A shared-traversal stop, materialized as this module's failure record. */
 	const failureOf = (stop, pattern) => ({
@@ -20124,6 +20668,7 @@ const enumerate = (root, globs, options) => Effect.gen(function* () {
 		detail: stop.detail
 	});
 	for (const literal of globs.literals) {
+		if (isExcluded(literal)) continue;
 		const absolute = path.join(root, literal);
 		if (yield* isPackage(absolute)) included.set(literal, absolute);
 	}
@@ -20151,26 +20696,23 @@ const enumerate = (root, globs, options) => Effect.gen(function* () {
 				const absolute = path.join(frame.absolute, entry);
 				if (!(yield* isDirectory(absolute))) continue;
 				if (wildcard.crossesSegments && !traversal.admits(frame)) return yield* Effect.fail(failureOf(traversal.depthStop(), wildcard.source));
-				if (wildcard.matches(relative) && (yield* isPackage(absolute))) included.set(relative, absolute);
+				if (wildcard.matches(relative) && !isExcluded(relative) && (yield* isPackage(absolute))) included.set(relative, absolute);
 				if (!wildcard.crossesSegments) continue;
 				traversal.push(frame, relative, absolute);
 			}
 		}
 	}
 	const results = [];
-	for (const [relativePath, absolute] of included) {
-		if (globs.excludes.some((exclude) => exclude.matches(relativePath))) continue;
-		results.push({
-			relativePath,
-			path: absolute
-		});
-	}
+	for (const [relativePath, absolute] of included) results.push({
+		relativePath,
+		path: absolute
+	});
 	results.sort((a, b) => a.relativePath < b.relativePath ? -1 : a.relativePath > b.relativePath ? 1 : 0);
 	return results;
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/patterns.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/patterns.js
 const stringsOf = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : void 0;
 /** The `packages:` list of a `pnpm-workspace.yaml` document. Total on a parsed document. */
 const pnpmPatternsOf = (document) => {
@@ -20228,7 +20770,7 @@ const readPatterns = (root) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceDiscovery.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceDiscovery.js
 /**
 * Raised when a workspace member's `package.json` cannot be read, parsed, or
 * used — it is missing, malformed, or lacks a `name` or `version`.
@@ -20685,7 +21227,7 @@ var WorkspaceDiscovery = class WorkspaceDiscovery extends Context.Service()("@ef
 const isStringRecord$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((entry) => typeof entry === "string");
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/DependencyGraph.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/DependencyGraph.js
 /**
 * Raised when the workspace dependency graph cannot be topologically ordered
 * because it contains a cycle.
@@ -24385,7 +24927,7 @@ var Git = class Git extends Context.Service()("@effected/git/Git") {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/ChangeDetector.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/ChangeDetector.js
 /**
 * Which git refs to compare, and whether to fold in the working tree.
 *
@@ -24685,7 +25227,7 @@ function resolveFromCatalog(catalogs, wantedDependency) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/catalogs.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/catalogs.js
 /** Project a pnpm-workspace manifest's `catalog` / `catalogs` fields into a `Catalogs` map. */
 const inlineCatalogs = (manifest) => {
 	if (manifest.catalog === void 0 && manifest.catalogs === void 0) return {};
@@ -24751,7 +25293,28 @@ const rangeOf = (catalogs, dependency, specifier) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/ConfigDependencyHooks.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/ConfigDependencyHooks.js
+/**
+* The empty {@link PeerDependencyRules}: every axis present and empty.
+*
+* @remarks
+* Exported so that "I assert this workspace's rules are empty" is **one token**
+* rather than three hand-written empty axes. That matters where the distinction
+* is load-bearing — supplying rules asserts they were looked up, while omitting
+* them asserts nothing — and a caller spelling the object out by hand will
+* eventually fill two of the three axes and mean the third.
+*
+* Frozen, since it is shared.
+*
+* @public
+*/
+const NoPeerDependencyRules = Object.freeze({
+	allowedVersions: Object.freeze({}),
+	ignoreMissing: Object.freeze([]),
+	allowAny: Object.freeze([])
+});
+/** Internal alias, kept short at the many call sites in this module. */
+const NO_PEER_RULES = NoPeerDependencyRules;
 /** Whether `value` is a non-null, non-array object. */
 const isObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
@@ -24779,7 +25342,7 @@ const moduleNotFoundUrl = (cause) => isObject$2(cause) && cause.code === "ERR_MO
 */
 const hasTraversalSegment = (name) => name.split(/[/\\]/).includes("..");
 /** Turn the seed record into the pnpm hook config, with the default catalog split out under `catalog`. */
-const seedToConfig = (seed) => {
+const seedToConfig = (seed, rules) => {
 	const catalogs = {};
 	let catalog = {};
 	for (const [name, entries] of Object.entries(seed)) if (name === "default") catalog = { ...entries };
@@ -24788,7 +25351,8 @@ const seedToConfig = (seed) => {
 		catalog,
 		catalogs,
 		minimumReleaseAge: void 0,
-		minimumReleaseAgeExclude: void 0
+		minimumReleaseAgeExclude: void 0,
+		peerDependencyRules: rules
 	};
 };
 /** A finite number if `value` is one, else the prior threaded value — a garbage age is dropped, not fatal. */
@@ -24813,10 +25377,33 @@ const configOf = (value, fallback) => {
 		catalog: isObject$2(value.catalog) ? value.catalog : fallback.catalog,
 		catalogs: isObject$2(value.catalogs) ? value.catalogs : fallback.catalogs,
 		minimumReleaseAge: finiteNumberOr(value.minimumReleaseAge, fallback.minimumReleaseAge),
-		minimumReleaseAgeExclude: stringArrayOr(value.minimumReleaseAgeExclude, fallback.minimumReleaseAgeExclude)
+		minimumReleaseAgeExclude: stringArrayOr(value.minimumReleaseAgeExclude, fallback.minimumReleaseAgeExclude),
+		peerDependencyRules: peerRulesOr(value.peerDependencyRules, fallback.peerDependencyRules)
 	};
 };
 /**
+* A peer-rules block if `value` is one, else the prior threaded value — a
+* malformed block is dropped, not fatal, matching the other slices.
+*
+* Each axis is normalized independently: a hook that rewrites `allowedVersions`
+* and leaves `ignoreMissing` alone must not blank the latter.
+*/
+const stringRecordOr = (value, fallback) => isObject$2(value) && Object.values(value).every((entry) => typeof entry === "string") ? value : fallback;
+const peerRulesOr = (value, fallback) => {
+	if (!isObject$2(value)) return fallback;
+	const allowed = stringRecordOr(value.allowedVersions, fallback?.allowedVersions);
+	const ignoreMissing = stringArrayOr(value.ignoreMissing, fallback?.ignoreMissing);
+	const allowAny = stringArrayOr(value.allowAny, fallback?.allowAny);
+	if (allowed === void 0 && ignoreMissing === void 0 && allowAny === void 0) return fallback;
+	return {
+		allowedVersions: allowed ?? {},
+		ignoreMissing: ignoreMissing ?? [],
+		allowAny: allowAny ?? []
+	};
+};
+/** Project the threaded config's rules into the slice, defaulting every axis to empty. */
+const peerRulesOf = (config) => config.peerDependencyRules ?? NO_PEER_RULES;
+/**
 * Project the threaded config's release-age keys into a partial gate
 * contribution, omitting a key the hooks never set (never an explicit
 * `undefined` — the fields are `optionalKey`).
@@ -24869,13 +25456,23 @@ const updateConfigOf = (mod) => {
 * noise on stdout.
 */
 const REPLAY_SCRIPT = `
-const [root, seedJson, ...names] = process.argv.slice(1);
+const [root, seedJson, rulesJson, ...names] = process.argv.slice(1);
 const { pathToFileURL } = await import("node:url");
 const { join } = await import("node:path");
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const finiteNumberOr = (value, fallback) => (typeof value === "number" && Number.isFinite(value) ? value : fallback);
 const stringArrayOr = (value, fallback) =>
 	Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : fallback;
+const stringRecordOr = (value, fallback) =>
+	isObject(value) && Object.values(value).every((entry) => typeof entry === "string") ? value : fallback;
+const peerRulesOr = (value, fallback) => {
+	if (!isObject(value)) return fallback;
+	const allowed = stringRecordOr(value.allowedVersions, fallback && fallback.allowedVersions);
+	const ignoreMissing = stringArrayOr(value.ignoreMissing, fallback && fallback.ignoreMissing);
+	const allowAny = stringArrayOr(value.allowAny, fallback && fallback.allowAny);
+	if (allowed === undefined && ignoreMissing === undefined && allowAny === undefined) return fallback;
+	return { allowedVersions: allowed || {}, ignoreMissing: ignoreMissing || [], allowAny: allowAny || [] };
+};
 const configOf = (value, fallback) =>
 	isObject(value)
 		? {
@@ -24883,6 +25480,7 @@ const configOf = (value, fallback) =>
 				catalogs: isObject(value.catalogs) ? value.catalogs : fallback.catalogs,
 				minimumReleaseAge: finiteNumberOr(value.minimumReleaseAge, fallback.minimumReleaseAge),
 				minimumReleaseAgeExclude: stringArrayOr(value.minimumReleaseAgeExclude, fallback.minimumReleaseAgeExclude),
+				peerDependencyRules: peerRulesOr(value.peerDependencyRules, fallback.peerDependencyRules),
 			}
 		: fallback;
 const failure = (name, cause) => ({
@@ -24898,7 +25496,13 @@ const replay = async () => {
 		if (name === "default") catalog = { ...entries };
 		else catalogs[name] = { ...entries };
 	}
-	let config = { catalog, catalogs, minimumReleaseAge: undefined, minimumReleaseAgeExclude: undefined };
+	let config = {
+		catalog,
+		catalogs,
+		minimumReleaseAge: undefined,
+		minimumReleaseAgeExclude: undefined,
+		peerDependencyRules: JSON.parse(rulesJson),
+	};
 	for (const name of names) {
 		let loaded;
 		let found = false;
@@ -24999,9 +25603,10 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	* config dependency. The default {@link WorkspaceCatalogs} layer wires this, so
 	* the default catalog path provably executes no config-dependency code.
 	*/
-	static layerNoop = Layer.succeed(ConfigDependencyHooks, { inject: (_root, _configDependencies, seed) => Effect.succeed({
+	static layerNoop = Layer.succeed(ConfigDependencyHooks, { inject: (_root, _configDependencies, seed, rules) => Effect.succeed({
 		catalogs: seed,
-		releaseAge: {}
+		releaseAge: {},
+		peerDependencyRules: rules ?? NO_PEER_RULES
 	}) });
 	/**
 	* The live layer: dynamically imports each config dependency's `pnpmfile.cjs`
@@ -25019,13 +25624,14 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	* import, so this layer runs on either runtime. Only ever wired by
 	* `WorkspaceCatalogs.layerWithConfigDependencies`.
 	*/
-	static layerLive = Layer.succeed(ConfigDependencyHooks, { inject: (root, configDependencies, seed) => Effect.gen(function* () {
+	static layerLive = Layer.succeed(ConfigDependencyHooks, { inject: (root, configDependencies, seed, rules) => Effect.gen(function* () {
 		const names = Object.keys(configDependencies);
 		if (names.length === 0) return {
 			catalogs: seed,
-			releaseAge: {}
+			releaseAge: {},
+			peerDependencyRules: rules ?? NO_PEER_RULES
 		};
-		let config = seedToConfig(seed);
+		let config = seedToConfig(seed, rules);
 		for (const name of names) {
 			if (hasTraversalSegment(name)) return yield* Effect.fail(new CatalogAssemblyError({
 				source: "hooks",
@@ -25071,7 +25677,8 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 		}
 		return {
 			catalogs: configToEntries(config),
-			releaseAge: releaseAgeOf(config)
+			releaseAge: releaseAgeOf(config),
+			peerDependencyRules: peerRulesOf(config)
 		};
 	}) });
 	/**
@@ -25127,11 +25734,12 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	*/
 	static layerSubprocess = Layer.effect(ConfigDependencyHooks, Effect.gen(function* () {
 		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-		return { inject: (root, configDependencies, seed) => Effect.gen(function* () {
+		return { inject: (root, configDependencies, seed, rules) => Effect.gen(function* () {
 			const names = Object.keys(configDependencies);
 			if (names.length === 0) return {
 				catalogs: seed,
-				releaseAge: {}
+				releaseAge: {},
+				peerDependencyRules: rules ?? NO_PEER_RULES
 			};
 			for (const name of names) if (hasTraversalSegment(name)) return yield* Effect.fail(new CatalogAssemblyError({
 				source: "hooks",
@@ -25144,6 +25752,7 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 				REPLAY_SCRIPT,
 				root,
 				JSON.stringify(seed),
+				JSON.stringify(rules ?? NO_PEER_RULES),
 				...names
 			]);
 			const payload = yield* Run.jsonLine(command, ReplayPayload, { timeout: REPLAY_TIMEOUT }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner), Effect.catch((cause) => Effect.fail(new CatalogAssemblyError({
@@ -25156,17 +25765,18 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 				path: payload.name ?? root,
 				cause: replayFailureCause(payload)
 			}));
-			const config = configOf(payload.config, seedToConfig(seed));
+			const config = configOf(payload.config, seedToConfig(seed, rules));
 			return {
 				catalogs: configToEntries(config),
-				releaseAge: releaseAgeOf(config)
+				releaseAge: releaseAgeOf(config),
+				peerDependencyRules: peerRulesOf(config)
 			};
 		}) };
 	}));
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/PackageManagerName.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/PackageManagerName.js
 /**
 * The four package managers this package understands.
 *
@@ -25542,7 +26152,7 @@ var PackageManagerDetector = class PackageManagerDetector extends Context.Servic
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/LockfileReader.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/LockfileReader.js
 /**
 * Raised when the workspace's lockfile cannot be read off disk.
 *
@@ -25723,7 +26333,7 @@ var LockfileReader = class LockfileReader extends Context.Service()("@effected/w
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/Publishability.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/Publishability.js
 /** The public npm registry, used when `publishConfig.registry` says nothing. */
 const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 /**
@@ -25883,7 +26493,7 @@ var PublishabilityDetector = class extends Context.Service()("@effected/workspac
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/importerVersions.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/internal/importerVersions.js
 /**
 * Strip pnpm's peer-disambiguation suffix from a recorded importer version.
 *
@@ -25970,7 +26580,7 @@ const unanimousVersionOf = (index, dependency) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceCatalogs.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceCatalogs.js
 /**
 * An immutable, fully-normalized catalog collection — the one catalog
 * resolution semantic in the package.
@@ -26174,6 +26784,41 @@ const inlineReleaseAge = (document) => {
 		cause
 	})));
 };
+/**
+* The `peerDependencyRules` a `pnpm-workspace.yaml` declares inline — the half
+* `pnpm:export` materializes into the file, as opposed to the half a config
+* dependency injects at replay time.
+*
+* @remarks
+* **Tolerant, unlike the catalog blocks**, and the asymmetry is deliberate: a
+* malformed catalog block must hard-fail because a silently-empty catalog makes
+* every dependency look newly added, whereas a malformed rules block costs only
+* suppression — the failure mode is reporting a peer pnpm would have hidden,
+* which is visible and safe. Failing the whole assembly over it would take the
+* catalogs down with it.
+*
+* Every axis is read independently, so a malformed `ignoreMissing` does not
+* discard a well-formed `allowedVersions`.
+*/
+const EMPTY_PEER_RULES = {
+	allowedVersions: {},
+	ignoreMissing: [],
+	allowAny: []
+};
+const inlinePeerDependencyRules = (document) => {
+	if (!isObject$1(document) || !isObject$1(document.peerDependencyRules)) return EMPTY_PEER_RULES;
+	const block = document.peerDependencyRules;
+	const allowedVersions = {};
+	if (isObject$1(block.allowedVersions)) {
+		for (const [key, value] of Object.entries(block.allowedVersions)) if (typeof value === "string") allowedVersions[key] = value;
+	}
+	const strings = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+	return {
+		allowedVersions,
+		ignoreMissing: strings(block.ignoreMissing),
+		allowAny: strings(block.allowAny)
+	};
+};
 /** A hard-fail catalog-assembly failure naming the malformed part of a `workspaces` field. */
 const malformed = (source, path, detail) => new CatalogAssemblyError({
 	source,
@@ -26306,6 +26951,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 			let injected;
 			let inlineGate = {};
 			let hookGate = {};
+			let peerDependencyRules = EMPTY_PEER_RULES;
 			if (hasPnpmWorkspace) {
 				const text = yield* fs.readFileString(workspaceYaml).pipe(Effect.mapError((cause) => new CatalogAssemblyError({
 					source: "manifest",
@@ -26320,15 +26966,17 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 				yield* validatePnpmWorkspaceCatalogs(document);
 				inline = CatalogSet.fromCatalogs(inlineCatalogs(catalogBlocksOf(document)));
 				inlineGate = yield* inlineReleaseAge(document);
-				const injection = yield* hooks.inject(root, configDependenciesOf(document), inline.entries);
+				const injection = yield* hooks.inject(root, configDependenciesOf(document), inline.entries, inlinePeerDependencyRules(document));
 				injected = CatalogSet.fromCatalogs(injection.catalogs);
 				hookGate = injection.releaseAge;
+				peerDependencyRules = injection.peerDependencyRules;
 			} else {
 				const manifestPath = path.join(root, "package.json");
 				if (!(yield* probeExists(manifestPath))) return {
 					catalogs: fromLockfile,
 					releaseAgeGate: ReleaseAgeGate.combine(),
-					importerVersions
+					importerVersions,
+					peerDependencyRules: EMPTY_PEER_RULES
 				};
 				const text = yield* fs.readFileString(manifestPath).pipe(Effect.mapError((cause) => new CatalogAssemblyError({
 					source: "manifest",
@@ -26348,7 +26996,8 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 			return {
 				catalogs: assembled,
 				releaseAgeGate,
-				importerVersions
+				importerVersions,
+				peerDependencyRules
 			};
 		});
 		const [resolveOnce, invalidate] = yield* Effect.cachedInvalidateWithTTL(assemble, Duration.infinity);
@@ -26360,6 +27009,9 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 			resolveSpecifier: Effect.fn("WorkspaceCatalogs.resolveSpecifier")(function* (dependency, specifier) {
 				return (yield* memo).catalogs.resolveSpecifier(dependency, specifier);
 			}),
+			peerDependencyRules: Effect.fn("WorkspaceCatalogs.peerDependencyRules")(function* () {
+				return (yield* memo).peerDependencyRules;
+			}),
 			releaseAgeGate: Effect.fn("WorkspaceCatalogs.releaseAgeGate")(function* () {
 				return (yield* memo).releaseAgeGate;
 			}),
@@ -26446,6 +27098,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 		return {
 			set: () => unstubbed$1("set"),
 			resolveSpecifier: set !== void 0 ? (dependency, specifier) => Effect.map(set(), (catalogs) => catalogs.resolveSpecifier(dependency, specifier)) : () => unstubbed$1("resolveSpecifier"),
+			peerDependencyRules: () => unstubbed$1("peerDependencyRules"),
 			releaseAgeGate: () => unstubbed$1("releaseAgeGate"),
 			importerVersions: () => unstubbed$1("importerVersions"),
 			...overrides
@@ -26498,7 +27151,7 @@ var WorkspaceCatalogs = class WorkspaceCatalogs extends Context.Service()("@effe
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceStateSnapshot.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceStateSnapshot.js
 const EMPTY = Object.freeze(Object.create(null));
 const DependencyMap = Schema.Record(Schema.String, Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(EMPTY)), Schema.withConstructorDefault(Effect.succeed(EMPTY)));
 /**
@@ -26722,7 +27375,7 @@ var WorkspaceStateSnapshot = class extends Schema.Class("WorkspaceStateSnapshot"
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceSnapshots.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/WorkspaceSnapshots.js
 /** Whether `value` is a non-null, non-array object. */
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Whether every value in a record is a string — a usable dependency map. */
@@ -27000,7 +27653,7 @@ var WorkspaceSnapshots = class WorkspaceSnapshots extends Context.Service()("@ef
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@effected+workspaces@0.14.2_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/Workspaces.js
+//#region ../../node_modules/.pnpm/@effected+workspaces@0.15.1_@effected+jsonc@0.7.0_effect@4.0.0-rc.109__effect@4.0.0-rc.109/node_modules/@effected/workspaces/Workspaces.js
 const compose = (options, catalogsFactory) => {
 	const roots = WorkspaceRoot.layer;
 	const detector = PackageManagerDetector.layer;