@monster-orange/den 0.2.6 → 0.2.7

package/src/ui/cli/index.ts

@@ -16,7 +16,8 @@ import { noun, plural } from "../../shared/plural.js";
 // Spinners: progress on stderr (a terminal) or stdout (piped); plain lines
 // where they cannot animate. See spinner.ts.
 import { spinner as ora } from "./spinner.js";
-import Table from "cli-table3";
+import { newTable } from "./table.js";
+import { validateAll, validateAllFailed } from "./validate-all.js";
 import { cliPrompts } from "./prompts.js";
 import { resultsViewer } from "./results-viewer.js";
 import { testRunner } from "./test-runner.js";
@@ -139,7 +140,10 @@ import {
 } from "../../shared/environment-manager/up-plan.js";
 import { execSync } from "child_process";
 import * as fs from "fs";
-import { readManifest } from "../../shared/manifest/read-manifest.js";
+import {
+  heldManifestsDir,
+  readManifest,
+} from "../../shared/manifest/read-manifest.js";
 import * as nodePath from "path";
 import { runInit } from "./init.js";
 import {
@@ -168,6 +172,20 @@ import { cmdConfig } from "./config-command.js";
 import { cmdEdge } from "./edge-command.js";
 import { cmdService } from "./service-command.js";
 import { cmdStack } from "./stack-command.js";
+import {
+  cmdOrg,
+  orgFlag,
+  orgListRows,
+  printOrgWarnings,
+  registerOrg,
+  sameOrg,
+} from "./org-command.js";
+import {
+  buildSetupPlan,
+  renderClonePlan,
+  workspaceClonePlan,
+} from "./clone-plan.js";
+import { githubOrgFor } from "../../shared/environment-manager/workspace-org.js";
 import { cmdWeb, displayWebHelp } from "./web-command.js";
 import { cmdGraph } from "./graph-command.js";
 import { resolveLogsTarget, tailServiceLogs } from "./logs-command.js";
@@ -205,8 +223,11 @@ const WORKSPACE_SUBCOMMANDS: {
 }[] = [
   {
     name: "list",
-    usage: "list",
-    lines: ["every workspace, the active set and the focus"],
+    usage: "list [--org <id>]",
+    lines: [
+      "every workspace, the active set, the focus and its org;",
+      "--org <id> lists one org's workspaces",
+    ],
   },
   {
     name: "activate",
@@ -294,19 +315,31 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
     lines: ["List all registered services in the catalog."],
   },
   register: {
-    usage: "register [path]",
+    usage: "register [path] [--org <id>]",
     lines: [
       "With a path: add that checkout (dev-managed) under its manifest name.",
-      "Without one: pick the repo interactively.",
+      "Without one: pick the repo interactively. A managed clone is picked",
+      "from the focused workspace's org; --org <id> picks from another.",
     ],
   },
   setup: {
-    usage: "setup [service...] [--force|-f]",
+    usage: "setup [service...] [--force|-f] [--plan]",
     lines: [
       "Run 'make setup' once per system (clones missing managed repos first).",
       "Default targets MANAGED clones only — setup's codegen/installs",
       "shouldn't touch your own dev-managed checkouts uninvited.",
       "--force (-f) includes dev-managed repos; naming a service always works.",
+      "--plan prints each repo's org and clone URL and stops: nothing is",
+      "cloned, seeded or written (on a fresh machine: the blueprint's plan).",
+    ],
+  },
+  org: {
+    usage: "org list [--org <id>]",
+    lines: [
+      "Every org: its label, its workspaces, whether it is the default",
+      "(github_org), and any org warnings. A workspace's org is its own org:,",
+      "then the blueprint's org:, then its repos' one catalog owner, then",
+      "github_org.",
     ],
   },
   sync: {
@@ -439,6 +472,7 @@ const TELEMETRY_COMMANDS = new Set<string>([
   `use-managed`,
   "setup",
   "workspace",
+  "org",
   "sync",
   "init",
   "validate",
@@ -745,6 +779,10 @@ class DenCLI {
           await this.cmdWorkspace(args.slice(1));
           break;
 
+        case "org":
+          cmdOrg(args.slice(1));
+          break;
+
         case "sync":
           await this.cmdSync(args.slice(1));
           break;
@@ -752,9 +790,23 @@ class DenCLI {
         case "init": {
           // In the den root, `init` seeds/resets the default workspace; pointed
           // at a service repo it scaffolds that repo's .den.yml (manifest init).
-          const initTarget = args[1] ?? getInvokeCwd();
-          if (nodePath.resolve(initTarget) === getDistRoot()) {
-            await this.seedDefaultWorkspaceFlow("init");
+          const initTarget =
+            args.slice(1).find((a) => !a.startsWith("-")) ?? getInvokeCwd();
+          // Compare real paths: a symlinked tmp or home (/var → /private/var)
+          // must not turn a seed into a manifest scaffold.
+          const real = (p: string) => {
+            try {
+              return fs.realpathSync(nodePath.resolve(p));
+            } catch {
+              return nodePath.resolve(p);
+            }
+          };
+          if (real(initTarget) === real(getDistRoot())) {
+            await this.seedDefaultWorkspaceFlow(
+              "init",
+              args.slice(1).includes("--reset"),
+              "init",
+            );
           } else {
             await runInit(initTarget);
           }
@@ -1088,7 +1140,14 @@ class DenCLI {
       if (!catalogEntry) continue;
       const branch = wsEntry.branch ?? "main";
       try {
-        ensureManagedServiceClone(repoName, catalogEntry.gh, branch);
+        // An entry with `gh: ""` clones from the workspace's org, as `up`
+        // does (and `setup --plan` says), instead of failing on an empty slug.
+        const ghSlug = resolveRepoGhSlug(repoName, catalog, () =>
+          githubOrgFor(ws.name),
+        );
+        if (!catalogEntry.gh?.trim())
+          upsertCatalogEntry(repoName, { ...catalogEntry, gh: ghSlug });
+        ensureManagedServiceClone(repoName, ghSlug, branch);
       } catch (err) {
         console.log(
           chalk.red(
@@ -1189,7 +1248,9 @@ class DenCLI {
       // Catalog entries written by the dev-managed add flow carry `gh: ""`, so
       // an entry can exist yet be unclonable. Derive the conventional slug and
       // persist the repair rather than cloning from an empty URL.
-      const ghSlug = resolveRepoGhSlug(repoName, catalog);
+      const ghSlug = resolveRepoGhSlug(repoName, catalog, () =>
+        githubOrgFor(ws.name),
+      );
       if (!catalog[repoName]?.gh) upsertCatalogEntry(repoName, { gh: ghSlug });
       try {
         // runSetup=false: clone only — setup is run below, hidden + non-interactive.
@@ -1892,6 +1953,25 @@ class DenCLI {
     return seed && knownRepos.has(seed) ? seed : undefined;
   }
 
+  /**
+   * `up --plan`'s clone half (ORG-1a): each repo's org and the URL a missing
+   * managed clone would come from. Read-only, like the rest of the plan.
+   */
+  private renderUpClonePlan(repos: readonly string[]): void {
+    const ws = getActiveWorkspace();
+    if (!ws) return;
+    const lines = renderClonePlan(
+      {
+        fromBlueprint: false,
+        workspaces: [workspaceClonePlan(ws.name, repos)],
+      },
+      product().cli,
+    );
+    console.log(chalk.bold("  Repos and clone URLs:\n"));
+    for (const line of lines) console.log(chalk.gray(`  ${line}`.trimEnd()));
+    console.log();
+  }
+
   /** Render the read-only `den up --plan` view: per-node command + flags. */
   private renderUpPlan(nodes: NodePlan[]): void {
     const tag = (n: NodePlan): string => {
@@ -2005,6 +2085,7 @@ class DenCLI {
       this.renderUpPlan(
         buildUpPlan(graph, rawOrder, { noAutostart: noAutostartSet }),
       );
+      this.renderUpClonePlan(rawOrder);
       return;
     }
     if (dryRun) {
@@ -2216,6 +2297,7 @@ class DenCLI {
       this.renderUpPlan(
         buildUpPlan(graph, rawOrder, { noAutostart: noAutostartSet }),
       );
+      this.renderUpClonePlan(rawOrder);
       return;
     }
     if (dryRun) {
@@ -2494,6 +2576,8 @@ class DenCLI {
    */
   private async seedDefaultWorkspaceFlow(
     reason: "auto" | "init",
+    reset = false,
+    via: "init" | "workspace seed" = "workspace seed",
   ): Promise<boolean> {
     const bps = blueprintWorkspaces();
     if (bps.length === 0) {
@@ -2520,6 +2604,23 @@ class DenCLI {
     }
     const willReset = defaultWorkspaceHasServices();
     const interactive = !!(process.stdin.isTTY && process.stdout.isTTY);
+    // A reset replaces every entry, dev-managed checkouts included. On a TTY
+    // the user is asked (default No); without one there is nobody to ask, so
+    // only an explicit --reset may do it (SEED-0).
+    if (willReset && !interactive && !reset) {
+      const what = multi
+        ? "the blueprint's workspaces"
+        : "the default workspace";
+      console.error(
+        chalk.red(
+          `\n  ❌ Not resetting ${what}: it has entries, and a reset replaces them all\n` +
+            `     (your own dev-managed checkouts included) with managed clones.\n` +
+            `     Nothing changed. To reset anyway: ${product().cli} ${via} --reset\n`,
+        ),
+      );
+      process.exitCode = 1;
+      return false;
+    }
 
     for (const bp of bps) {
       const label = multi ? `Workspace ${bp.name}` : "Default workspace";
@@ -2865,7 +2966,7 @@ class DenCLI {
       chalk.cyan(`\n  Workspace: ${chalk.bold(ws?.name ?? "none")}\n`),
     );
 
-    const table = new Table({
+    const table = newTable({
       head: ["Service", "Mode", "Branch", "Health", "Reason"],
       style: { head: ["cyan"] },
     });
@@ -3027,7 +3128,7 @@ class DenCLI {
       return;
     }
 
-    const table = new Table({
+    const table = newTable({
       head: ["Service", "Mode", "Health", "Commands"],
       style: { head: ["cyan"] },
     });
@@ -3092,7 +3193,8 @@ class DenCLI {
     }
 
     const repoPathArg = args.find(
-      (a, i) => !a.startsWith("-") && !/^--(name|gh)$/.test(args[i - 1] ?? ""),
+      (a, i) =>
+        !a.startsWith("-") && !/^--(name|gh|org)$/.test(args[i - 1] ?? ""),
     );
     if (repoPathArg) {
       const flag = (n: string) => {
@@ -3108,7 +3210,7 @@ class DenCLI {
     if (source === "local") {
       await this.registerLinked(ws);
     } else {
-      await this.registerManaged(ws);
+      await this.registerManaged(ws, orgFlag(args));
     }
   }
 
@@ -3187,26 +3289,24 @@ class DenCLI {
     );
   }
 
-  /** List org repos via `gh`, let user pick one + branch → managed service. */
-  private async registerManaged(ws: {
-    name: string;
-    config: import("../../shared/types/index.js").WorkspaceConfig;
-  }): Promise<void> {
-    // Derive org from den's own git remote
-    const { fileURLToPath: ftu } = await import("url");
-    const { default: pathMod } = await import("path");
-    const distRoot = pathMod.resolve(
-      pathMod.dirname(ftu(import.meta.url)),
-      "../../..",
-    );
-    const denCoords = getGitHubCoords(distRoot);
-    // The instance's config names its org; the checkout's own remote is only a
-    // fallback (inside a package it would name the engine's repo, not the org's).
-    const org = readDenConfig().github_org ?? denCoords?.owner;
-    if (!org || !/^[A-Za-z0-9][A-Za-z0-9-]*$/.test(org)) {
+  /**
+   * List an org's repos via `gh`, let the user pick one + branch → managed
+   * service. The org is `--org <id>`, else the focused workspace's resolved
+   * org (ORG-1a). Never Den's own checkout or remote (SEC-0).
+   */
+  private async registerManaged(
+    ws: {
+      name: string;
+      config: import("../../shared/types/index.js").WorkspaceConfig;
+    },
+    orgArg?: string,
+  ): Promise<void> {
+    const org = registerOrg(ws.name, orgArg);
+    if (!org) {
       console.log(
         chalk.red(
-          `\n  ❌ No GitHub org to list: set github_org in ${product().configFile}\n`,
+          `\n  ❌ No GitHub org to list: set github_org in ${product().configFile}, ` +
+            `org: on workspace ${ws.name}, or pass --org <id>\n`,
         ),
       );
       return;
@@ -3463,6 +3563,15 @@ class DenCLI {
     const force = args.includes("--force") || args.includes("-f");
     const names = args.filter((a) => !a.startsWith("-"));
 
+    // `--plan`: each repo's org and clone URL, then stop. Read-only.
+    if (args.includes("--plan")) {
+      console.log(chalk.bold("\n  Setup plan (no changes will be made):\n"));
+      for (const line of renderClonePlan(buildSetupPlan(names), product().cli))
+        console.log(`  ${line}`.trimEnd());
+      console.log();
+      return;
+    }
+
     // Clone any managed repos that aren't on disk yet before reading manifests.
     this.cloneMissingManagedRepos();
 
@@ -3550,13 +3659,20 @@ class DenCLI {
 
     switch (sub) {
       case "list": {
-        const table = new Table({
-          head: ["Workspace", "Active", "Focus", "Services", "Type"],
+        const only = orgFlag(args.slice(1));
+        const { resolved, warnings } = orgListRows();
+        const orgOfWs = new Map(resolved.map((w) => [w.workspace, w.org]));
+        const table = newTable({
+          head: ["Workspace", "Org", "Active", "Focus", "Services", "Type"],
           style: { head: ["cyan"] },
         });
-        for (const [name, cfg] of Object.entries(file.workspaces)) {
+        const shown = Object.entries(file.workspaces).filter(
+          ([name]) => !only || sameOrg(orgOfWs.get(name) ?? null, only),
+        );
+        for (const [name, cfg] of shown) {
           table.push([
             chalk.bold(name),
+            orgOfWs.get(name) ?? chalk.gray("none"),
             activeSet.has(name) ? chalk.green("✓") : "",
             name === focus ? chalk.cyan("●") : "",
             Object.keys(cfg.services).join(", ") || chalk.gray("none"),
@@ -3564,6 +3680,14 @@ class DenCLI {
           ]);
         }
         console.log(table.toString());
+        if (only && shown.length === 0)
+          console.log(chalk.yellow(`  No workspace in org ${only}.`));
+        const names = new Set(shown.map(([n]) => n));
+        printOrgWarnings(
+          warnings.filter((w) =>
+            [...names].some((n) => w.startsWith(`workspace ${n}:`)),
+          ),
+        );
         break;
       }
       case "activate": {
@@ -3669,7 +3793,7 @@ class DenCLI {
         break;
       }
       case "seed": {
-        await this.seedDefaultWorkspaceFlow("init");
+        await this.seedDefaultWorkspaceFlow("init", args.includes("--reset"));
         break;
       }
       case "create": {
@@ -3862,7 +3986,15 @@ class DenCLI {
   // ── den validate ────────────────────────────────────────────────────────
 
   private async cmdValidate(args: string[]): Promise<void> {
-    const target = args[0] ?? getInvokeCwd();
+    const positional = args.filter((a) => !a.startsWith("-"));
+    const held = args.includes("--held");
+    // Bare `validate` in the distribution root (which has no manifest of its
+    // own), or `--held`: every manifest the distribution uses.
+    if (held || (positional.length === 0 && this.invokedInDistRoot())) {
+      this.validateEverything(held);
+      return;
+    }
+    const target = positional[0] ?? getInvokeCwd();
     const fs = await import("fs");
     const nodePath = await import("path");
 
@@ -3928,6 +4060,78 @@ class DenCLI {
     if (!result.valid) process.exit(1);
   }
 
+  /** Whether the CLI was run from the distribution root (real paths). */
+  private invokedInDistRoot(): boolean {
+    const real = (p: string) => {
+      try {
+        return fs.realpathSync(nodePath.resolve(p));
+      } catch {
+        return nodePath.resolve(p);
+      }
+    };
+    return (
+      real(getInvokeCwd()) === real(getDistRoot()) &&
+      !fs.existsSync(nodePath.join(getDistRoot(), product().manifestYml))
+    );
+  }
+
+  /** `validate` (bare, in the root) / `validate --held`: see validate-all.ts. */
+  private validateEverything(held: boolean): void {
+    const results = validateAll({ held, validate: validateManifestLayers });
+    console.log();
+    if (results.length === 0) {
+      console.log(
+        chalk.yellow(
+          held
+            ? `  No manifests in ${heldManifestsDir()}.`
+            : "  No repos in any workspace and no held manifests.",
+        ),
+      );
+      console.log();
+      return;
+    }
+    const width = Math.max(...results.map((r) => r.repo.length));
+    for (const r of results) {
+      const where = r.checkout ?? "manifests/";
+      const ws = r.workspaces.length ? `  [${r.workspaces.join(", ")}]` : "";
+      const note = r.note ? `  (${r.note})` : "";
+      const head = `${r.repo.padEnd(width)}  ${r.source.padEnd(15)} ${where}${ws}${note}`;
+      if (r.missing) {
+        console.log(chalk.yellow(`  ⚠  ${head}`));
+        continue;
+      }
+      const warnings = r.result.layers.reduce(
+        (n, l) => n + l.result.warnings.length,
+        0,
+      );
+      if (r.result.valid && warnings === 0) {
+        console.log(chalk.green(`  ✓  ${head}`));
+        continue;
+      }
+      console.log(
+        r.result.valid
+          ? chalk.yellow(`  ⚠  ${head}`)
+          : chalk.red(`  ✗  ${head}`),
+      );
+      for (const l of r.result.layers)
+        if (!l.result.valid || l.result.warnings.length)
+          printValidation(
+            `    ${l.file ?? "merged"}`,
+            l.result,
+            l.layer === "merged" ? "merged" : l.layer,
+          );
+    }
+    const failed = results.filter((r) => !r.missing && !r.result.valid).length;
+    const missing = results.filter((r) => r.missing).length;
+    console.log();
+    console.log(
+      `  ${plural(results.length, held ? "manifest" : "repo")}: ${failed ? chalk.red(`${failed} failed`) : chalk.green("all valid")}` +
+        (missing ? chalk.yellow(`, ${missing} with no manifest to check`) : ""),
+    );
+    console.log();
+    if (validateAllFailed(results)) process.exitCode = 1;
+  }
+
   // ── den local-dev ───────────────────────────────────────────────────────
 
   private async cmdLocalDev(arg?: string): Promise<void> {
@@ -4008,7 +4212,9 @@ class DenCLI {
       "  register [path]      Register a repo in the service catalog",
     );
     console.log();
-    console.log("  setup [service...]   Run make setup for services");
+    console.log(
+      "  setup [service...]   Run make setup for services (--plan: orgs + clone URLs, no changes)",
+    );
     console.log("  sync [service...]    Check for updates and offer to pull");
     console.log(
       "  create <name> [dir]  Scaffold a new distribution of your own (--title, --cli, --env-prefix)",
@@ -4039,6 +4245,9 @@ class DenCLI {
     console.log(
       "  workspace code [n]       Open workspace in VS Code (generates .code-workspace)",
     );
+    console.log(
+      "  org list [--org <id>]    List orgs: label, workspaces, default, warnings",
+    );
     console.log("\nTest commands:");
     console.log(
       "  menu                 Open the interactive menu (pillar/module/env picker)",

package/src/ui/cli/org-command.ts

@@ -0,0 +1,162 @@
+/**
+ * `<cli> org list` (ORG-1a): every org with its label, its workspaces on
+ * this machine, whether it is the default (`github_org`), and the org
+ * warnings (C1). The orgs are `/api/orgs`'s (catalog owners plus `orgs:`),
+ * then the default org and any workspace's org that list does not name.
+ *
+ * `--org <id>` (on `org list` and `workspace list`) keeps one org's rows.
+ */
+import chalk from "chalk";
+import { product } from "../../shared/product.js";
+import { listOrgs } from "../../shared/manifest/service-links.js";
+import {
+  defaultOrg,
+  githubOrgFor,
+  readOrgContext,
+  resolveAllWorkspaceOrgs,
+  withOrgMembership,
+  type OrgContext,
+  type WorkspaceOrg,
+} from "../../shared/environment-manager/workspace-org.js";
+import { newTable } from "./table.js";
+
+/** `--org <id>`'s value from `args` (also `--org=<id>`), or undefined. */
+export function orgFlag(args: readonly string[]): string | undefined {
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--org") return args[i + 1];
+    if (a.startsWith("--org=")) return a.slice("--org=".length);
+  }
+  return undefined;
+}
+
+/** `args` without `--org <id>` / `--org=<id>`. */
+export function withoutOrgFlag(args: readonly string[]): string[] {
+  const out: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--org") {
+      i++;
+      continue;
+    }
+    if (args[i].startsWith("--org=")) continue;
+    out.push(args[i]);
+  }
+  return out;
+}
+
+export const sameOrg = (a: string | null, b: string): boolean =>
+  a !== null && a.toLowerCase() === b.toLowerCase();
+
+export interface OrgListRow {
+  id: string;
+  label: string;
+  default: boolean;
+  workspaces: string[];
+}
+
+/** The rows `org list` prints, and every workspace's warnings. */
+export function orgListRows(ctx: OrgContext = readOrgContext()): {
+  rows: OrgListRow[];
+  warnings: string[];
+  resolved: WorkspaceOrg[];
+} {
+  const resolved = resolveAllWorkspaceOrgs(ctx);
+  const listed = withOrgMembership(
+    listOrgs(ctx.catalog, ctx.config.orgs ?? {}),
+    resolved,
+    ctx.file,
+    ctx.config,
+  ).map((o) => ({
+    id: o.id,
+    label: o.label,
+    default: o.default,
+    workspaces: o.workspaces,
+  }));
+  const local = new Set(Object.keys(ctx.file.workspaces));
+  const extra = new Map<string, OrgListRow>();
+  const add = (id: string, isDefault: boolean): void => {
+    if (listed.some((r) => sameOrg(r.id, id))) return;
+    const key = id.toLowerCase();
+    if (!extra.has(key))
+      extra.set(key, { id, label: id, default: isDefault, workspaces: [] });
+  };
+  const d = defaultOrg(ctx.config);
+  if (d) add(d, true);
+  for (const w of resolved)
+    if (w.org && local.has(w.workspace)) {
+      add(w.org, sameOrg(d, w.org));
+      extra.get(w.org.toLowerCase())?.workspaces.push(w.workspace);
+    }
+  return {
+    rows: [...listed, ...extra.values()],
+    warnings: resolved
+      .filter((w) => local.has(w.workspace))
+      .flatMap((w) => w.warnings),
+    resolved,
+  };
+}
+
+/**
+ * The GitHub org `register` lists repos from: `--org <id>`, else the
+ * workspace's resolved org. Never Den's own checkout or remote (SEC-0).
+ * Undefined when there is none, or it is not a GitHub owner name.
+ */
+export function registerOrg(
+  workspace: string,
+  orgArg?: string,
+  ctx?: OrgContext,
+): string | undefined {
+  let org = orgArg?.trim();
+  if (!org) {
+    try {
+      org = githubOrgFor(workspace, ctx);
+    } catch {
+      return undefined;
+    }
+  }
+  return /^[A-Za-z0-9][A-Za-z0-9-]*$/.test(org) ? org : undefined;
+}
+
+/** Print the org warnings under a listing. */
+export function printOrgWarnings(warnings: readonly string[]): void {
+  for (const w of warnings) console.log(chalk.yellow(`  ⚠ ${w}`));
+  if (warnings.length) console.log();
+}
+
+export function cmdOrg(args: string[]): void {
+  const sub = args[0] ?? "list";
+  if (sub !== "list") {
+    console.log(chalk.red(`Usage: ${product().cli} org list [--org <id>]`));
+    process.exitCode = 1;
+    return;
+  }
+  const only = orgFlag(args.slice(1));
+  const { rows, warnings, resolved } = orgListRows();
+  const shown = only ? rows.filter((r) => sameOrg(r.id, only)) : rows;
+  const table = newTable({
+    head: ["Org", "Label", "Default", "Workspaces"],
+    style: { head: ["cyan"] },
+  });
+  for (const r of shown)
+    table.push([
+      chalk.bold(r.id),
+      r.label,
+      r.default ? chalk.green("✓") : "",
+      r.workspaces.join(", ") || chalk.gray("none"),
+    ]);
+  console.log(table.toString());
+  if (only && shown.length === 0)
+    console.log(chalk.yellow(`  No org ${only}.`));
+  const inScope = only
+    ? new Set(
+        resolved.filter((w) => sameOrg(w.org, only)).map((w) => w.workspace),
+      )
+    : null;
+  printOrgWarnings(
+    inScope
+      ? warnings.filter((w) =>
+          [...inScope].some((n) => w.startsWith(`workspace ${n}:`)),
+        )
+      : warnings,
+  );
+}