@memberjunction/cli 6.2.0-edge.5 → 6.2.0-edge.7

package/dist/init-templates/citizen-builder/scripts/docker-entrypoint.sh

@@ -58,31 +58,37 @@ if [ ! -f "$STATE_DIR/provisioned" ]; then
   echo "========================================================================"
 
   if [ ! -f "$STATE_DIR/core-installed" ]; then
-    # Generate install configuration
-    cat << EOF > /tmp/install.config.json
-{
-  "PackageManager": "pnpm",
-  "dbUrl": "$DB_HOST",
-  "dbInstance": "",
-  "dbTrustServerCertificate": "Y",
-  "dbDatabase": "$DB_DATABASE",
-  "dbPort": $DB_PORT,
-  "codeGenLogin": "sa",
-  "codeGenPwD": "$DB_PASSWORD",
-  "mjAPILogin": "sa",
-  "mjAPIPwD": "$DB_PASSWORD",
-  "graphQLPort": 4000,
-  "authType": "Local",
-  "createNewUser": "Y",
-  "userEmail": "admin@memberjunction.org",
-  "userFirstName": "Admin",
-  "userLastName": "User",
-  "userName": "admin",
-  "openAIAPIKey": "${AI_VENDOR_API_KEY__OpenAILLM:-}",
-  "anthropicAPIKey": "${AI_VENDOR_API_KEY__AnthropicLLM:-}",
-  "geminiAPIKey": "${AI_VENDOR_API_KEY__GeminiLLM:-}"
-}
-EOF
+    # Generate install configuration safely via JSON.stringify so special characters in passwords/keys are escaped
+    node -e "
+      const fs = require('fs');
+      const cfg = {
+        PackageManager: 'pnpm',
+        DatabaseHost: process.env.DB_HOST || 'sqlserver',
+        DatabasePort: Number(process.env.DB_PORT || 1433),
+        DatabaseName: process.env.DB_DATABASE || 'MemberJunction',
+        DatabaseTrustCert: true,
+        DatabaseAdminUser: 'sa',
+        DatabaseAdminPassword: process.env.DB_PASSWORD || '',
+        CodeGenUser: 'sa',
+        CodeGenPassword: process.env.DB_PASSWORD || '',
+        APIUser: 'sa',
+        APIPassword: process.env.DB_PASSWORD || '',
+        APIPort: 4000,
+        AuthProvider: 'local',
+        BaseEncryptionKey: process.env.MJ_BASE_ENCRYPTION_KEY || 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=',
+        CreateNewUser: {
+          Username: 'admin',
+          Email: 'admin@memberjunction.org',
+          FirstName: 'Admin',
+          LastName: 'User'
+        },
+        OpenAIKey: process.env.AI_VENDOR_API_KEY__OpenAILLM || '',
+        AnthropicKey: process.env.AI_VENDOR_API_KEY__AnthropicLLM || '',
+        GeminiKey: process.env.AI_VENDOR_API_KEY__GeminiLLM || '',
+        MistralKey: process.env.AI_VENDOR_API_KEY__MistralLLM || ''
+      };
+      fs.writeFileSync('/tmp/install.config.json', JSON.stringify(cfg, null, 2), { mode: 0o600 });
+    "
 
     # Install the release this workspace is pinned to (MJ_VERSION, the same release as the CLI
     # in this container). Without a tag, `mj install --yes` takes the newest stable GitHub
@@ -96,20 +102,17 @@ EOF
 
     # Execute headless install. Safe to retry: the installer checkpoints completed phases.
     mj install --yes --fast --config /tmp/install.config.json --dir /workspace "${INSTALL_TAG_ARGS[@]}"
+    rm -f /tmp/install.config.json
     touch "$STATE_DIR/core-installed"
     pnpm add -w @angular/compiler@21.2.22 2>/dev/null || true
   fi
 
   # Install Open App business context (More Cheese default or custom enterprise app)
+  # Note: GITHUB_TOKEN is read directly from the environment by OpenAppEngine's GitHubClient
   if [ ! -f "$STATE_DIR/app-installed" ]; then
     APP_URL="${OPEN_APP_INSTALL_URL:-https://github.com/MemberJunction/more-cheese}"
     echo "Installing business context Open App: $APP_URL..."
-    if [ -n "$GITHUB_TOKEN" ]; then
-      AUTH_APP_URL=$(echo "$APP_URL" | sed -E "s|https://github.com/|https://$GITHUB_TOKEN@github.com/|")
-      mj app install "$AUTH_APP_URL"
-    else
-      mj app install "$APP_URL"
-    fi
+    mj app install "$APP_URL"
     touch "$STATE_DIR/app-installed"
   fi
 
@@ -120,8 +123,8 @@ EOF
       || echo "WARNING: capabilities catalog generation failed, so the catalog may be missing or stale. Re-run scripts/generate-capabilities.sh."
   fi
 
-  # Push starter metadata. --ci: never prompt (there is no terminal here) and exit non-zero
-  # on error. Safe to repeat on a retry: mj sync push upserts.
+  # Push starter metadata. --ci: never prompt (there is no terminal here), create
+  # Template records for @file: prompt templates on first push, and exit non-zero on error.
   if [ -d "/work/metadata" ]; then
     mj sync push --dir /work/metadata --ci
   fi
@@ -156,10 +159,82 @@ if [ -f "apps/MJExplorer/package.json" ]; then
   "
 fi
 
+# Ensure turbo.json passes through AI vendor API keys, DB settings, and MJ_DEV_AUTH_ENABLED to child processes
+if [ -f "turbo.json" ]; then
+  node -e "
+    const fs = require('fs');
+    try {
+      const turbo = JSON.parse(fs.readFileSync('turbo.json', 'utf8'));
+      const passThrough = new Set(turbo.globalPassThroughEnv || []);
+      let changed = false;
+      for (const entry of ['AI_VENDOR_API_KEY__*', 'MJ_*', 'DB_*', 'CODEGEN_DB_*', 'GRAPHQL_*', 'OPEN_APP_*', 'GITHUB_TOKEN']) {
+        if (!passThrough.has(entry)) {
+          passThrough.add(entry);
+          changed = true;
+        }
+      }
+      if (changed) {
+        turbo.globalPassThroughEnv = Array.from(passThrough);
+        fs.writeFileSync('turbo.json', JSON.stringify(turbo, null, 2) + '\n');
+      }
+    } catch (e) {
+      console.warn('Notice: turbo.json check skipped:', e.message);
+    }
+  "
+fi
+
+# Sync container environment variables (API keys, encryption key, DB_USER, local dev auth) into workspace .env files
+export MJ_DEV_AUTH_ENABLED="${MJ_DEV_AUTH_ENABLED:-true}"
+node -e "
+  const fs = require('fs');
+  const upsertVar = (content, key, val) => {
+    const re = new RegExp('^' + key + '=.*$', 'm');
+    const line = key + '=' + JSON.stringify(String(val));
+    if (re.test(content)) return content.replace(re, () => line);
+    return content + (content.endsWith('\n') ? '' : '\n') + line + '\n';
+  };
+  const keysToSync = [
+    'DB_HOST', 'DB_PORT', 'DB_DATABASE', 'DB_USERNAME', 'DB_PASSWORD',
+    'MJ_BASE_ENCRYPTION_KEY', 'MJ_DEV_AUTH_ENABLED',
+    'AI_VENDOR_API_KEY__OpenAILLM', 'AI_VENDOR_API_KEY__AnthropicLLM',
+    'AI_VENDOR_API_KEY__GeminiLLM', 'AI_VENDOR_API_KEY__GroqLLM', 'AI_VENDOR_API_KEY__MistralLLM'
+  ];
+  for (const envFile of ['.env', 'apps/MJAPI/.env', 'packages/MJAPI/.env']) {
+    if (fs.existsSync(envFile)) {
+      let content = fs.readFileSync(envFile, 'utf8');
+      for (const k of keysToSync) {
+        const v = process.env[k];
+        if (v !== undefined && v !== '') {
+          content = upsertVar(content, k, v);
+        }
+      }
+      content = upsertVar(content, 'DB_USER', process.env.DB_USERNAME || 'sa');
+      fs.writeFileSync(envFile, content);
+    }
+  }
+  if (process.env.MJ_DEV_AUTH_ENABLED === 'true') {
+    for (const ngEnv of [
+      'apps/MJExplorer/src/environments/environment.ts',
+      'apps/MJExplorer/src/environments/environment.development.ts',
+      'packages/MJExplorer/src/environments/environment.ts',
+      'packages/MJExplorer/src/environments/environment.development.ts',
+    ]) {
+      if (fs.existsSync(ngEnv)) {
+        const src = fs.readFileSync(ngEnv, 'utf8');
+        const next = src.replace(/AUTH_TYPE:\s*['\"][^'\"]*['\"]/g, \"AUTH_TYPE: 'local'\");
+        if (next !== src) {
+          fs.writeFileSync(ngEnv, next);
+        }
+      }
+    }
+  }
+"
+
 # Sanitize dynamicPackages.client so non-browser packages are not bundled into MJExplorer
 if [ -f "mj.config.cjs" ]; then
   node -e "
     const fs = require('fs');
+    const vm = require('vm');
     try {
       const config = require('./mj.config.cjs');
       if (config.dynamicPackages && Array.isArray(config.dynamicPackages.client)) {
@@ -173,10 +248,37 @@ if [ -f "mj.config.cjs" ]; then
           }
         });
         if (changed) {
-          let code = fs.readFileSync('mj.config.cjs', 'utf8');
-          const regex = /client:\s*\[[\s\S]*?\]\s*\},/m;
-          code = code.replace(regex, 'client: ' + JSON.stringify(config.dynamicPackages.client, null, 2) + '\n  },');
-          fs.writeFileSync('mj.config.cjs', code);
+          const code = fs.readFileSync('mj.config.cjs', 'utf8');
+          const dynMatch = code.match(/dynamicPackages\s*:\s*\{/);
+          if (dynMatch && dynMatch.index !== undefined) {
+            const afterDyn = code.slice(dynMatch.index);
+            const clientRel = afterDyn.match(/client\s*:\s*\[/);
+            if (clientRel && clientRel.index !== undefined) {
+              const openPos = dynMatch.index + clientRel.index + clientRel[0].length - 1;
+              let depth = 1, pos = openPos + 1, inStr = null;
+              while (pos < code.length && depth > 0) {
+                const ch = code[pos];
+                if (inStr) {
+                  if (ch === '\\\\') { pos += 2; continue; }
+                  if (ch === inStr) inStr = null;
+                } else if (ch === '\"' || ch === \"'\" || ch === '\`') {
+                  inStr = ch;
+                } else if (ch === '[') {
+                  depth++;
+                } else if (ch === ']') {
+                  depth--;
+                }
+                pos++;
+              }
+              if (depth === 0) {
+                const closePos = pos - 1;
+                const serialized = JSON.stringify(config.dynamicPackages.client, null, 2).replace(/\n/g, '\n    ');
+                const updated = code.slice(0, openPos) + serialized + code.slice(closePos + 1);
+                vm.compileFunction(updated);
+                fs.writeFileSync('mj.config.cjs', updated);
+              }
+            }
+          }
         }
       }
     } catch (e) {
@@ -212,7 +314,7 @@ fi
 echo "========================================================================"
 echo " 🎉 MemberJunction Stack is Running!"
 echo "    MJAPI:       http://localhost:4000 (GraphQL & API)"
-echo "    MJExplorer:  http://localhost:4200 (Web Interface)"
+echo "    MJExplorer:  http://localhost:4200 (Web Interface — Zero-Config Local Dev Auth active)"
 echo "    Database:    localhost:$DB_PORT (DB: $DB_DATABASE)"
 echo "========================================================================"
 

package/dist/init-templates/citizen-builder/scripts/sync-metadata.sh

@@ -9,6 +9,6 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$DIR"
 
 echo "Pushing metadata changes to MemberJunction database..."
-docker compose exec -T mj mj sync push --dir /work/metadata
+docker compose exec -T mj mj sync push --dir /work/metadata "$@"
 
 echo "Metadata sync complete!"

package/dist/lib/dev-workspace/build-output.d.ts

@@ -0,0 +1,22 @@
+import type { BuildOutputEntry, MemberPackageJson } from './types.js';
+/**
+ * The entry file a package declares, relative to its directory, or null when it declares none.
+ * `main` first: it is what Node and the Angular builders resolve for every MJ package. Pure.
+ */
+export declare function ResolveEntryFile(pkg: MemberPackageJson): string | null;
+/**
+ * The output folder for a declared entry file: its first path segment (`dist/esm/index.js` →
+ * `dist`). Null when the entry sits at the package root or inside `src/` — such a package ships
+ * its source, so there is no build output to compare. Pure.
+ */
+export declare function OutputDirOf(entryFile: string): string | null;
+/**
+ * Reads the build state of every member package that has a `build` script and a `src/` folder.
+ *
+ * `memberNames` is passed in for the same reason {@link CollectClientPackageCensus} takes it:
+ * detection finds every Open App repo on disk, and an excluded sibling is not this workspace's
+ * concern. A package whose entry points into `src/` or sits at its root ships source and is left
+ * out — it has no output to go stale.
+ */
+export declare function CollectBuildOutputCensus(parentDir: string, memberNames: readonly string[]): BuildOutputEntry[];
+//# sourceMappingURL=build-output.d.ts.map

package/dist/lib/dev-workspace/build-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-output.d.ts","sourceRoot":"","sources":["../../../src/lib/dev-workspace/build-output.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,gBAAgB,EAAoB,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgCxF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAItE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5D;AAuCD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAsB9G"}

package/dist/lib/dev-workspace/build-output.js

@@ -0,0 +1,146 @@
+/**
+ * Build-output census for `mj dev workspace doctor`.
+ *
+ * SIDE EFFECTS: READ-ONLY filesystem access — `existsSync`, `readdirSync` and `statSync` under
+ * member package directories. Never writes, never spawns a build.
+ *
+ * Linking a member package into the workspace links its SOURCE folder, so a package whose output
+ * was never built, or was built before its last source edit, still resolves at install time. It
+ * fails only when a host imports it: a missing export, or "No form is registered for …" in
+ * Explorer. This census names those packages before anything starts (#5494).
+ *
+ * @module lib/dev-workspace/build-output
+ */
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { DetectCandidates } from './detect.js';
+/** Where a package builds to when its package.json names no entry point. */
+const DEFAULT_OUTPUT_DIR = 'dist';
+/** Source folder whose files the output is compared against. */
+const SOURCE_DIR = 'src';
+/** Directories never descended into while finding the newest file. */
+const SKIPPED_DIRS = new Set(['node_modules', '__tests__', '__mocks__']);
+/** Test files: editing one does not make the build output stale. */
+const TEST_FILE_PATTERN = /\.(spec|test)\.[cm]?[jt]sx?$/;
+/**
+ * The root export's file from an `exports` field: a string, or the `.` entry of a conditions
+ * object, itself a string or a conditions object whose `import` / `default` / `require` is one.
+ * Any other shape returns null, and the caller falls back to `main` / `module`. Pure.
+ */
+function rootExportPath(exportsField) {
+    if (typeof exportsField === 'string')
+        return exportsField;
+    if (exportsField === null || typeof exportsField !== 'object')
+        return null;
+    const root = exportsField['.'];
+    if (typeof root === 'string')
+        return root;
+    if (root === null || typeof root !== 'object')
+        return null;
+    for (const condition of ['import', 'default', 'require']) {
+        const target = root[condition];
+        if (typeof target === 'string')
+            return target;
+    }
+    return null;
+}
+/**
+ * The entry file a package declares, relative to its directory, or null when it declares none.
+ * `main` first: it is what Node and the Angular builders resolve for every MJ package. Pure.
+ */
+export function ResolveEntryFile(pkg) {
+    const entry = pkg.main ?? pkg.module ?? rootExportPath(pkg.exports);
+    if (entry === undefined || entry === null || entry.length === 0)
+        return null;
+    return path.normalize(entry);
+}
+/**
+ * The output folder for a declared entry file: its first path segment (`dist/esm/index.js` →
+ * `dist`). Null when the entry sits at the package root or inside `src/` — such a package ships
+ * its source, so there is no build output to compare. Pure.
+ */
+export function OutputDirOf(entryFile) {
+    const segments = entryFile.split(path.sep).filter((segment) => segment.length > 0 && segment !== '.');
+    if (segments.length < 2)
+        return null;
+    const first = segments[0];
+    if (first === '..' || first === SOURCE_DIR)
+        return null;
+    return first;
+}
+/**
+ * Newest modification time of any file under `dir`, skipping {@link SKIPPED_DIRS}, dot
+ * directories and (when `skipTests`) test files. Returns 0 for a missing or empty folder.
+ */
+function newestFileTime(dir, skipTests) {
+    let newest = 0;
+    const pending = [dir];
+    for (let current = pending.pop(); current !== undefined; current = pending.pop()) {
+        let entries;
+        try {
+            entries = readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                if (!SKIPPED_DIRS.has(entry.name) && !entry.name.startsWith('.'))
+                    pending.push(path.join(current, entry.name));
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (skipTests && TEST_FILE_PATTERN.test(entry.name))
+                continue;
+            newest = Math.max(newest, statSync(path.join(current, entry.name)).mtimeMs);
+        }
+    }
+    return newest;
+}
+/** Build state of one package directory with the given output folder and optional entry file. */
+function readBuildState(packageDir, outputDir, entryFile) {
+    const outputPath = path.join(packageDir, outputDir);
+    const builtMarker = entryFile === null ? outputPath : path.join(packageDir, entryFile);
+    if (!existsSync(builtMarker))
+        return 'missing';
+    const newestOutput = newestFileTime(outputPath, false);
+    if (newestOutput === 0)
+        return 'missing';
+    return newestFileTime(path.join(packageDir, SOURCE_DIR), true) > newestOutput ? 'stale' : 'fresh';
+}
+/**
+ * Reads the build state of every member package that has a `build` script and a `src/` folder.
+ *
+ * `memberNames` is passed in for the same reason {@link CollectClientPackageCensus} takes it:
+ * detection finds every Open App repo on disk, and an excluded sibling is not this workspace's
+ * concern. A package whose entry points into `src/` or sits at its root ships source and is left
+ * out — it has no output to go stale.
+ */
+export function CollectBuildOutputCensus(parentDir, memberNames) {
+    const inWorkspace = new Set(memberNames);
+    const entries = [];
+    for (const member of DetectCandidates(parentDir).filter((candidate) => inWorkspace.has(candidate.Name))) {
+        for (const pkg of member.Packages) {
+            const name = pkg.PackageJson.name;
+            if (name === undefined || name.length === 0 || pkg.PackageJson.scripts?.build === undefined)
+                continue;
+            const packageDir = path.join(member.Path, pkg.RelPath);
+            if (!existsSync(path.join(packageDir, SOURCE_DIR)))
+                continue;
+            const entryFile = ResolveEntryFile(pkg.PackageJson);
+            const outputDir = entryFile === null ? DEFAULT_OUTPUT_DIR : OutputDirOf(entryFile);
+            if (outputDir === null)
+                continue;
+            entries.push({
+                Package: name,
+                Repo: member.Name,
+                RelPath: pkg.RelPath,
+                OutputDir: outputDir,
+                State: readBuildState(packageDir, outputDir, entryFile),
+            });
+        }
+    }
+    return entries.sort((a, b) => (a.Package < b.Package ? -1 : a.Package > b.Package ? 1 : 0));
+}
+//# sourceMappingURL=build-output.js.map

package/dist/lib/dev-workspace/build-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-output.js","sourceRoot":"","sources":["../../../src/lib/dev-workspace/build-output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,gEAAgE;AAChE,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB,sEAAsE;AACtE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAEzE,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AAEzD;;;;GAIG;AACH,SAAS,cAAc,CAAC,YAAqB;IAC3C,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC1D,IAAI,YAAY,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,IAAI,GAAI,YAAwC,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAI,IAAgC,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;IACtG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,SAAkB;IACrD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,KAAK,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACjF,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/G,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC9B,IAAI,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9D,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iGAAiG;AACjG,SAAS,cAAc,CAAC,UAAkB,EAAE,SAAiB,EAAE,SAAwB;IACrF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACvF,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACpG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,WAA8B;IACxF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS;gBAAE,SAAS;YACtG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAAE,SAAS;YAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,SAAS,KAAK,IAAI;gBAAE,SAAS;YACjC,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,SAAS;gBACpB,KAAK,EAAE,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC"}

package/dist/lib/dev-workspace/build.d.ts

@@ -1,4 +1,4 @@
-import type { CandidateRepo, DevDepConflict, DuplicateClientPackage, DuplicateFamilyPackage, DuplicateProviderLink, MemberPackageJson, OpenAppClientPackage, PackageExtension, RootPackageJsonResult, ShellPeerGap, TurboJsonResult, WorkspaceShell } from './types.js';
+import type { CandidateRepo, DevDepConflict, DuplicateClientPackage, DuplicateFamilyPackage, DuplicateProviderLink, MemberPackageJson, OpenAppClientPackage, PackageExtension, RootPackageJsonResult, ShellPeerGap, WorkspaceShell } from './types.js';
 /** Build-scripts allowlist proven on the core-monorepo spike. */
 export declare const ONLY_BUILT_DEPENDENCIES: readonly string[];
 /**
@@ -65,6 +65,11 @@ export declare const PEER_DEPENDENCY_RULES: {
 export declare const FALLBACK_PNPM_PIN = "pnpm@10.33.0";
 /** The proven root-manifest devDependency baseline; fills gaps the union leaves. */
 export declare const BASELINE_DEV_DEPENDENCIES: Readonly<Record<string, string>>;
+/**
+ * The parent `build` script: pnpm's own recursion in dependency order, one package at a time, so
+ * no turbo.json has to act as root over the members' own (#4913).
+ */
+export declare const PARENT_BUILD_SCRIPT = "pnpm -r --workspace-concurrency=1 run build";
 /**
  * The #3795 guard, made explicit for admitted app shells: every package an `--apps` glob
  * enumerates must have a name no other workspace package uses, or pnpm would silently pick one.
@@ -309,9 +314,4 @@ export declare const SENTINEL_MARKER = "mj dev workspace";
  * workspace must produce a byte-identical sentinel.
  */
 export declare function BuildSentinel(fileNames: readonly string[], memberNames: readonly string[]): string;
-/**
- * Picks the parent `turbo.json`: copied verbatim from the first member (sorted by
- * name) that carries one; a minimal proven config otherwise.
- */
-export declare function PickTurboJson(members: readonly CandidateRepo[]): TurboJsonResult;
 //# sourceMappingURL=build.d.ts.map

package/dist/lib/dev-workspace/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/lib/dev-workspace/build.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EAEjB,oBAAoB,EACpB,gBAAgB,EAEhB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EACf,cAAc,EAEf,MAAM,YAAY,CAAC;AAEpB,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAiBpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAqC,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAiB7F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;CASxB,CAAC;AAEX,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGtE,CAAC;AAmDF;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC,GAC5E,MAAM,EAAE,CAoBV;AA6CD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB,GAAG,UAAU,CAAC,CAAC,EACnF,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAC/C,MAAM,CAoBR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAOjD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AASD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQlE;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,gHAAgH;IAChH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oGAAoG;IACpG,gBAAgB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AA4BD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,WAAW,GAAE,WAAW,CAAC,MAAM,CAAa,GAC3C,wBAAwB,CAkB1B;AA2BD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUjG;AAaD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACtC,CAgBA;AAED,wGAAwG;AACxG,MAAM,WAAW,4BAA4B;IAC3C,sGAAsG;IACtG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAAA;KAAE,CAAC,CAAC;CACpH;AAOD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,UAAU,EAAE,SAAS,sBAAsB,EAAE,GAC5C,4BAA4B,CA2B9B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAUxG;AAuED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACxD;IAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IAAC,UAAU,EAAE,sBAAsB,EAAE,CAAA;CAAE,CA8B5E;AAKD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,cAAc,EAAE,CAmB1F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,SAAS,oBAAoB,EAAE,EAC/C,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACzD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,YAAY,EAAE,CAchB;AAuBD,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACpD,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,sBAAsB,CAoCjG;AAyED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,qFAAqF;IACrF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wGAAwG;IACxG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,eAAe,GAAE,SAAS,MAAM,EAAO,GACtC,kBAAkB,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBrI;AAED;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM/G;AAED,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,qBAAqB,CA0CpH;AA0CD;;;;GAIG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAalG;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,eAAe,CAOhF"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/lib/dev-workspace/build.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EAEjB,oBAAoB,EACpB,gBAAgB,EAEhB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EAEf,MAAM,YAAY,CAAC;AAEpB,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAiBpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAqC,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAiB7F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;CASxB,CAAC;AAEX,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGtE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,gDAAgD,CAAC;AAyCjF;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC,GAC5E,MAAM,EAAE,CAoBV;AA6CD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB,GAAG,UAAU,CAAC,CAAC,EACnF,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAC/C,MAAM,CAoBR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAOjD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AASD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQlE;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,gHAAgH;IAChH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oGAAoG;IACpG,gBAAgB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AA4BD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,WAAW,GAAE,WAAW,CAAC,MAAM,CAAa,GAC3C,wBAAwB,CAkB1B;AA2BD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUjG;AAaD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACtC,CAgBA;AAED,wGAAwG;AACxG,MAAM,WAAW,4BAA4B;IAC3C,sGAAsG;IACtG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAAA;KAAE,CAAC,CAAC;CACpH;AAOD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,UAAU,EAAE,SAAS,sBAAsB,EAAE,GAC5C,4BAA4B,CA2B9B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAUxG;AAyGD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACxD;IAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IAAC,UAAU,EAAE,sBAAsB,EAAE,CAAA;CAAE,CA8B5E;AAKD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,cAAc,EAAE,CAmB1F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,SAAS,oBAAoB,EAAE,EAC/C,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACzD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,YAAY,EAAE,CAchB;AAuBD,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACpD,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,sBAAsB,CAoCjG;AAyED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,qFAAqF;IACrF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wGAAwG;IACxG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,eAAe,GAAE,SAAS,MAAM,EAAO,GACtC,kBAAkB,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBrI;AAED;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM/G;AAED,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,qBAAqB,CA+CpH;AA0CD;;;;GAIG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAalG"}

package/dist/lib/dev-workspace/build.js

@@ -1,5 +1,5 @@
 /**
- * Pure content builders for the four generated workspace files.
+ * Pure content builders for the three generated workspace files.
  *
  * NO SIDE EFFECTS in this module: every function maps member metadata (already
  * loaded by `detect.ts`) to file content strings. Writing is `write.ts`'s job.
@@ -22,10 +22,12 @@
  *    A package name two members both provide (every MJ-based app repo has a
  *    `mj_generatedentities`) gets consumer-scoped `link:` overrides so each
  *    member's own consumers keep its own copy — see {@link ResolveDuplicateProviderLinks}.
- *  - package.json: private root manifest, pnpm `packageManager` pin, and the
- *    devDependency union of member roots (highest version wins, every conflict
- *    reported). No `pnpm` block — see pnpm-workspace.yaml above.
- *  - turbo.json: copied verbatim from a member, with a minimal fallback.
+ *  - package.json: private root manifest, pnpm `packageManager` pin, a `build`
+ *    script ({@link PARENT_BUILD_SCRIPT}), and the devDependency union of member
+ *    roots (highest version wins, every conflict reported). No `pnpm` block — see
+ *    pnpm-workspace.yaml above.
+ *  - No turbo.json (#4913): a member's copy at the parent makes turbo treat the
+ *    parent as root, and MJ's own turbo.json then fails on its root-only keys.
  *
  * Why no hoist block: the 78-entry `public-hoist-pattern[]` set the manual setup
  * carried was written for the npm-hoisted era, when a library could import a
@@ -145,11 +147,11 @@ export const BASELINE_DEV_DEPENDENCIES = {
     turbo: '^2.5.0',
     'tsc-alias': '^1.8.16',
 };
-/** Minimal parent turbo.json used only when no member carries one. */
-const FALLBACK_TURBO_JSON = `${JSON.stringify({
-    $schema: 'https://turbo.build/schema.json',
-    tasks: { build: { dependsOn: ['^build'], outputs: ['dist/**', 'build/**'] } },
-}, null, 2)}\n`;
+/**
+ * The parent `build` script: pnpm's own recursion in dependency order, one package at a time, so
+ * no turbo.json has to act as root over the members' own (#4913).
+ */
+export const PARENT_BUILD_SCRIPT = 'pnpm -r --workspace-concurrency=1 run build';
 const GENERATED_HEADER = 'Generated by `mj dev workspace` — never commit to any repo; teardown = delete.';
 /** Quotes a YAML list entry the proven way: scoped names quoted, bare names not. */
 function yamlListEntry(name) {
@@ -552,6 +554,13 @@ export function IndexWorkspacePackages(members) {
  * contract `readJsonFile` already sets ("Unparseable JSON at <path>"). Without it a missing `name`
  * surfaced as `Cannot read properties of undefined (reading 'length')`, which names neither the
  * repo nor the file — and a developer may have a dozen of them.
+ *
+ * Also validates `platform`, when present, against the same three literals `runsInBrowser` below
+ * understands. `MjAppPackageEntry.platform` is a closed three-literal union, so the final
+ * `declared as MjAppPackageEntry[]` cast is a LIE unless this loop enforces it — an unvalidated
+ * typo like `"platform": "Node"` would satisfy the cast, fail every `=== 'node'`/`'browser'`/`'both'`
+ * comparison in `runsInBrowser`, and silently fall through its Node-only branch, dropping the
+ * package from the shell import set with no error (#4428).
  */
 function readDeclaredEntries(member, section) {
     const declared = member.MjAppJson?.packages?.[section];
@@ -568,33 +577,58 @@ function readDeclaredEntries(member, section) {
         if (typeof entry.name !== 'string') {
             throw new Error(`${where}[${index}] has no "name" string — a package entry must name its package`);
         }
+        const platform = entry.platform;
+        if (platform !== undefined && !VALID_PLATFORMS.includes(platform)) {
+            throw new Error(`${where}[${index}] has an invalid "platform" value ${JSON.stringify(platform)} — must be one of ${VALID_PLATFORMS.join(', ')}`);
+        }
     }
     return declared;
 }
+/** The only valid values for a manifest package entry's `platform` field — see {@link runsInBrowser}. */
+const VALID_PLATFORMS = ['node', 'browser', 'both'];
 /**
  * Every package a member declares that an app shell will be asked to import.
  *
  * This set mirrors the HOST's rule exactly, because the host is the only thing that decides what
  * the shell imports. `GetClientPackagesFromManifest`
  * (`packages/OpenApp/Engine/src/install/config-manager.ts`) builds the client dynamic-package list
- * as `[...packages.client, ...packages.shared]` with **no role test** — its own comment: "every
- * client/shared package is emitted regardless of startupExport — client entries are side-effect
- * imports" — and `mj codegen manifest --open-app-client-bootstrap` turns every enabled entry into
- * an import in the shell's generated class-registrations manifest, with no role field even present
- * on its entry type.
+ * as `[...packages.client, ...packages.shared]` minus anything whose platform excludes the
+ * browser, and `mj codegen manifest --open-app-client-bootstrap` turns every enabled entry into an
+ * import in the shell's generated class-registrations manifest.
  *
- * So there is deliberately no `role` filter here. An earlier revision kept only `role: 'bootstrap'`
- * on the premise that other roles "are imported normally"; the host contradicts that, and `role`
- * is a required seven-value enum whose `components` / `module` members are the documented Angular
- * roles. Anything narrower leaves a schema-valid package imported by the shell and linked by
- * nobody — the exact page-load-with-a-green-build failure this module exists to prevent (#4364).
+ * There is deliberately no `role` FILTER here beyond the platform rule. An earlier revision kept
+ * only `role: 'bootstrap'` on the premise that other roles "are imported normally"; the host
+ * contradicts that, and `role` is a required seven-value enum whose `components` / `module`
+ * members are the documented Angular roles. Anything narrower leaves a schema-valid package
+ * imported by the shell and linked by nobody — the page-load-with-a-green-build failure this
+ * module exists to prevent (#4364).
+ *
+ * The platform rule itself IS a role test, but a targeted one: it drops only what cannot run in a
+ * browser at all. Before it existed, a Node-only actions package declared `shared` was imported
+ * into the Angular bundle and the host could not build (#4428).
  *
  * `packages.server[]` is NOT here, and that is not an oversight: the host routes it to
  * `dynamicPackages.server`, a Node process that resolves importer-relative rather than from the
  * vite root, so it is not part of the shell's resolution problem.
  */
 function readShellImportedEntries(member) {
-    return [...readDeclaredEntries(member, 'client'), ...readDeclaredEntries(member, 'shared')];
+    return [...readDeclaredEntries(member, 'client'), ...readDeclaredEntries(member, 'shared')].filter(runsInBrowser);
+}
+/**
+ * Whether a declared package may be imported by the app shell.
+ *
+ * DELIBERATE COPY of `ResolvePackagePlatform` / `PackageRunsOnTier` in
+ * `packages/OpenApp/Engine/src/manifest/package-platform.ts`, which is canonical;
+ * `packages/DynamicPackages/src/discover.ts` keeps a third copy. Importing the engine's version
+ * here would bind this command to that package's built `dist/`. Change one, change all three. The
+ * engine's `package-platform.test.ts` holds the canonical case list; this module's spec mirrors its
+ * cases by hand, because it cannot import the engine.
+ */
+function runsInBrowser(pkg) {
+    // `readDeclaredEntries` has already rejected every `platform` other than absent or one of the
+    // three literals, so only `undefined` needs the role default here.
+    const platform = pkg.platform ?? (pkg.role === 'actions' ? 'node' : 'both');
+    return platform === 'both' || platform === 'browser';
 }
 export function CollectOpenAppClientPackages(members, workspacePackages) {
     const collected = new Map();
@@ -962,7 +996,9 @@ export function BuildRootPackageJson(parentDirName, members) {
     // which is the whole point of registering it.
     for (const name of Object.keys(clientDependencies))
         delete union.DevDependencies[name];
-    const pins = DeriveLockfilePins(members.flatMap((m) => (m.Lockfile !== null && m.Lockfile.Kind !== 'unsupported' ? [{ Repo: m.Name, Lockfile: m.Lockfile }] : [])), new Set(family.Names));
+    const pins = DeriveLockfilePins(members.flatMap((m) => m.Lockfile !== null && m.Lockfile.Kind !== 'unsupported'
+        ? [{ Repo: m.Name, Lockfile: m.Lockfile, IncludedImporters: new Set(['.', ...m.Packages.map((p) => p.RelPath)]) }]
+        : []), new Set(family.Names));
     const blocks = ResolveMemberPnpmBlocks(members);
     const assembled = AssembleParentOverrides(pins.Pins, blocks.Overrides, family.Names, Object.keys(blocks.PatchedDependencies));
     const duplicateLinks = ResolveDuplicateProviderLinks(members, family.Duplicates);
@@ -972,6 +1008,7 @@ export function BuildRootPackageJson(parentDirName, members) {
         name: workspaceName(parentDirName),
         private: true,
         packageManager: Pin,
+        scripts: { build: PARENT_BUILD_SCRIPT },
         // Omitted entirely when empty, so a parent with no Open App member regenerates byte-identically.
         ...(Object.keys(clientDependencies).length > 0 ? { dependencies: clientDependencies } : {}),
         devDependencies: union.DevDependencies,
@@ -1038,16 +1075,4 @@ export function BuildSentinel(fileNames, memberNames) {
     };
     return `${JSON.stringify(sentinel, null, 2)}\n`;
 }
-/**
- * Picks the parent `turbo.json`: copied verbatim from the first member (sorted by
- * name) that carries one; a minimal proven config otherwise.
- */
-export function PickTurboJson(members) {
-    for (const member of [...members].sort((a, b) => a.Name.localeCompare(b.Name))) {
-        if (member.TurboJson !== null) {
-            return { Content: member.TurboJson, Source: member.Name };
-        }
-    }
-    return { Content: FALLBACK_TURBO_JSON, Source: 'generator fallback' };
-}
 //# sourceMappingURL=build.js.map