@ws-test-realm/admin-kit 0.1.7 → 0.1.10

package/bin/ws-modules.js

@@ -3,58 +3,76 @@
 // workspace.
 //
 // Usage:
-//   ws-modules <names...|all> [--build] [--pack] [--deploy] [--with-deps]
+//   ws-modules <names...|all> [--build] [--pack] [--deploy] [--purge] [--with-deps]
 //
 //   <names...>      one or more project names from angular.json
 //   all             expand to every project in angular.json
 //   --build         ng build each lib (topo-ordered)
 //   --pack          federation-pack each lib into dist/admin-remotes/<id>/
 //   --deploy        push jar + types into <wpmRoot>/<modulesFolder>/<id>-*.jar
+//   --purge         strip prior federation contribution from the jar (or ext
+//                   dir) and host's .federation/<id>/ types dir. Resolves the
+//                   target the same way --deploy does (wsconfig override >
+//                   project package.json's wsmodules.target / pom).
 //   --with-deps     expand selection to include each name's in-workspace deps
 //
 // Behaviour:
 //   - No args at all                 → print usage, exit 1
 //   - Positional + step flag(s)      → run exactly those steps, non-interactive
 //   - Positional, no step flags      → prompt y/n for each of build/pack/deploy
-//                                       (and --with-deps); run the selected set
+//                                       (and --with-deps); run the selected set.
+//                                       Purge is NOT prompted (destructive +
+//                                       not part of the normal wire cycle).
 //   - Step flag(s) but no positional → error (need to know what to operate on)
 //
+// Step ordering when multiple are passed: purge → build → pack → deploy.
+//
 // Examples:
 //   ws-modules all                              # interactive
 //   ws-modules db-login                         # interactive, just this project
 //   ws-modules all --build --pack --deploy      # wire the whole stack
 //   ws-modules db-login --build --with-deps     # build db-login + its deps
 //   ws-modules crm shop-common --pack           # pack two specific projects
+//   ws-modules all --purge                      # strip stale contributions
+//   ws-modules all --purge --build --pack --deploy   # nuke + rewire
 
 const readline = require("readline");
 const { buildLibs, packRemotes } = require("../lib/build-modules");
 const { deployRemotes } = require("../lib/deploy-remotes");
+const { purgeRemotes } = require("../lib/purge-remotes");
 
-const STEP_FLAGS = ["build", "pack", "deploy"];
+const STEP_FLAGS = ["purge", "build", "pack", "deploy"];
 const PASSIVE_FLAGS = ["with-deps"];
 const KNOWN_FLAGS = new Set([...STEP_FLAGS, ...PASSIVE_FLAGS]);
 
-const USAGE = `ws-modules <names...|all> [--build] [--pack] [--deploy] [--with-deps]
+const USAGE = `ws-modules <names...|all> [--build] [--pack] [--deploy] [--purge] [--with-deps]
 
-Drive build / pack / deploy across an admin-modules workspace.
+Drive build / pack / deploy / purge across an admin-modules workspace.
 
 Positional:
   <names...>      one or more project names from angular.json
   all             expand to every project in angular.json
 
-Step flags (run exactly the steps you list — if none, you'll be prompted):
+Step flags (run exactly the steps you list — if none, you'll be prompted for
+build/pack/deploy; purge is never prompted):
   --build         ng build each lib (topo-ordered)
   --pack          federation-pack each lib into dist/admin-remotes/<id>/
   --deploy        push jar + types into <wpmRoot>/<modulesFolder>/<id>-*.jar
+  --purge         strip prior federation contribution from the jar (or ext
+                  dir) and host's .federation/<id>/ types dir
 
 Other:
   --with-deps     expand selection to include each name's in-workspace deps
 
+Order when multiple steps are passed: purge → build → pack → deploy.
+
 Examples:
   ws-modules all
   ws-modules db-login --build
   ws-modules all --build --pack --deploy
   ws-modules crm shop-common --pack
+  ws-modules all --purge
+  ws-modules all --purge --build --pack --deploy
 `;
 
 function parseArgv(argv) {
@@ -124,10 +142,11 @@ async function main() {
     process.exit(1);
   }
 
+  // No positional but step flags present → implicit `all`. Lets npm scripts
+  // like `"wire": "ws-modules --build --pack --deploy"` run cleanly without
+  // requiring callers to remember `-- all`.
   if (!argv.positional.length) {
-    console.error("ws-modules: need module names or `all`.");
-    console.error(USAGE);
-    process.exit(1);
+    argv.positional.push("all");
   }
 
   let restrictTo;
@@ -143,6 +162,7 @@ async function main() {
   let withDeps;
   if (stepFlagsPresent) {
     steps = {
+      purge: !!argv.flags.purge,
       build: !!argv.flags.build,
       pack: !!argv.flags.pack,
       deploy: !!argv.flags.deploy,
@@ -150,11 +170,11 @@ async function main() {
     withDeps = !!argv.flags["with-deps"];
   } else {
     const ans = await promptForSteps(!!argv.flags["with-deps"]);
-    steps = { build: ans.build, pack: ans.pack, deploy: ans.deploy };
+    steps = { purge: false, build: ans.build, pack: ans.pack, deploy: ans.deploy };
     withDeps = ans.withDeps;
   }
 
-  if (!steps.build && !steps.pack && !steps.deploy) {
+  if (!steps.purge && !steps.build && !steps.pack && !steps.deploy) {
     console.log("No steps selected. Nothing to do.");
     return;
   }
@@ -164,10 +184,11 @@ async function main() {
 
   console.log(
     `\nws-modules: ${argv.positional.join(" ")} →` +
-      ` build=${steps.build} pack=${steps.pack} deploy=${steps.deploy}` +
+      ` purge=${steps.purge} build=${steps.build} pack=${steps.pack} deploy=${steps.deploy}` +
       ` with-deps=${withDeps}`
   );
 
+  if (steps.purge) purgeRemotes(common);
   if (steps.build) buildLibs(common);
   if (steps.pack) packRemotes(common);
   if (steps.deploy) deployRemotes(common);

package/bin/ws-purge.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+// ws-purge — strip prior federation contributions across an admin-modules
+// workspace's deploy targets (jars + ext dirs) + the host's .federation/<id>/
+// types dirs. Mirrors `ws-modules --deploy`'s target-resolution exactly so the
+// two stay in lockstep (same wsconfig override > package.json rules).
+//
+// Usage:
+//   ws-purge                       # all remotes, each by own resolved target
+//   ws-purge jar                   # only jar-targeted remotes
+//   ws-purge ext                   # only ext-targeted remotes
+//   ws-purge jar <pathtojar>       # purge a specific jar by path (drops every
+//                                    META-INF/federation/<*>/, regardless of
+//                                    which project owned it)
+//   ws-purge <name>...             # restrict to those modules (each by own
+//                                    target)
+//   ws-purge <name>... jar         # restrict + require jar-targeted; errors
+//                                    on mismatch with hint to use
+//                                    `ws-purge jar <pathtojar>`
+//   ws-purge <name>... ext         # restrict + require ext-targeted
+//
+// End-of-run report lists every target acted on (path + entries dropped or
+// dir removed), every skipped target with reason, and every error.
+
+const path = require("path");
+const fs = require("fs");
+const { purgeRemotes, purgeJarPath } = require("../lib/purge-remotes");
+
+const USAGE = `ws-purge [<name>...] [jar | ext] [<pathtojar>]
+
+Strip prior federation contributions across the workspace's deploy targets.
+
+Modes:
+  (default)                  every remote, each by its own resolved target
+  jar                        only jar-targeted remotes
+  ext                        only ext-targeted remotes
+  jar <pathtojar>            purge a specific jar by path (no module resolution)
+
+Restrict to specific modules by listing names first:
+  ws-purge crm shop-common
+  ws-purge crm jar             # errors if crm isn't jar-targeted
+  ws-purge crm ext             # errors if crm isn't ext-targeted
+
+The end-of-run report lists exactly what was purged.
+`;
+
+function parseArgv(argv) {
+  const tokens = argv.slice(2);
+  let mode = null;
+  let jarPath = null;
+  const names = [];
+
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t === "--help" || t === "-h") {
+      process.stdout.write(USAGE);
+      process.exit(0);
+    }
+    if (t === "jar" || t === "ext") {
+      if (mode) {
+        throw new Error(`mode specified twice: ${mode} then ${t}`);
+      }
+      mode = t;
+      // Look ahead: if jar and next looks like a path, consume it
+      const next = tokens[i + 1];
+      if (mode === "jar" && next && /[/.]/.test(next)) {
+        jarPath = next;
+        i++;
+      }
+      continue;
+    }
+    names.push(t);
+  }
+
+  if (jarPath && names.length) {
+    throw new Error(
+      `\`jar <pathtojar>\` can't be combined with module names — the jar path purges that file regardless of which module owned it.`
+    );
+  }
+
+  return { mode, jarPath, names };
+}
+
+function main() {
+  let parsed;
+  try {
+    parsed = parseArgv(process.argv);
+  } catch (e) {
+    console.error(`ws-purge: ${e.message}`);
+    console.error(USAGE);
+    process.exit(1);
+  }
+
+  if (parsed.jarPath) {
+    const abs = path.resolve(parsed.jarPath);
+    if (!fs.existsSync(abs)) {
+      console.error(`ws-purge: jar not found at ${abs}`);
+      process.exit(1);
+    }
+    const { errors } = purgeJarPath(abs);
+    process.exit(errors.length ? 1 : 0);
+  }
+
+  const workspaceDir = process.cwd();
+  const { errors } = purgeRemotes({
+    workspaceDir,
+    restrictTo: parsed.names,
+    modeFilter: parsed.mode,
+    strict: parsed.mode !== null && parsed.names.length > 0,
+  });
+  process.exit(errors.length ? 1 : 0);
+}
+
+main();

package/lib/deploy-remotes.js

@@ -2,85 +2,8 @@ const fs = require("fs");
 const path = require("path");
 const { packIntoJar } = require("./pack-into-jar");
 const { loadOrder, partitionByKind } = require("./build-modules");
-const { resolveProjectPom, readArtifactId } = require("./pom");
-const { resolveOne, findMatches } = require("./jar-glob");
-
-function readWsconfig(workspaceDir) {
-  const file = path.join(workspaceDir, "wsconfig.json");
-  if (!fs.existsSync(file)) {
-    throw new Error(
-      `No wsconfig.json in ${workspaceDir}. Run \`ws-wire-host <wpm-root>\` first.`
-    );
-  }
-  return JSON.parse(fs.readFileSync(file, "utf8"));
-}
-
-function readModulesJson(wpmRoot) {
-  const file = path.join(wpmRoot, "modules.json");
-  if (!fs.existsSync(file)) {
-    throw new Error(`No modules.json at ${wpmRoot}.`);
-  }
-  return JSON.parse(fs.readFileSync(file, "utf8"));
-}
-
-function readProjectPkg(workspaceDir, name) {
-  const pkgPath = path.join(workspaceDir, "projects", name, "package.json");
-  if (!fs.existsSync(pkgPath)) return {};
-  try {
-    return JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-  } catch {
-    return {};
-  }
-}
-
-// Decide jar vs ext for a project, honouring wsconfig override > package.json.
-// Returns { kind: "jar", jarPath } or { kind: "ext", extDir }.
-function resolveTarget({ workspaceDir, projectName, wsconfig, wpmRoot, modulesFolder }) {
-  const modulesDir = path.resolve(wpmRoot, modulesFolder);
-  const extDir = path.join(
-    wpmRoot,
-    "scripts",
-    "ext-admin-remotes",
-    projectName
-  );
-
-  // 1. wsconfig override
-  const override =
-    wsconfig.deployOverrides && wsconfig.deployOverrides[projectName];
-  if (override) {
-    if (override.jar && override.ext) {
-      throw new Error(
-        `wsconfig.deployOverrides.${projectName}: set exactly one of 'jar' or 'ext', not both`
-      );
-    }
-    if (override.ext === true) {
-      return { kind: "ext", extDir };
-    }
-    if (override.jar) {
-      const jarPath = resolveOne(modulesDir, override.jar, projectName);
-      return { kind: "jar", jarPath };
-    }
-  }
-
-  // 2. project package.json
-  const pkg = readProjectPkg(workspaceDir, projectName);
-  const target = (pkg.wsmodules && pkg.wsmodules.target) || "jar";
-  if (target === "ext") {
-    return { kind: "ext", extDir };
-  }
-  if (target !== "jar") {
-    throw new Error(
-      `Invalid wsmodules.target for ${projectName}: ${JSON.stringify(target)} (expected 'jar' or 'ext')`
-    );
-  }
-
-  // 3. pom-derived artifactId
-  const pomField = pkg.wsmodules && pkg.wsmodules.pom;
-  const pomPath = resolveProjectPom(workspaceDir, projectName, pomField);
-  const artifactId = readArtifactId(pomPath);
-  const jarPath = resolveOne(modulesDir, `${artifactId}-*.jar`, projectName);
-  return { kind: "jar", jarPath, pomPath, artifactId };
-}
+const { findMatches } = require("./jar-glob");
+const { loadDeployContext, resolveTarget } = require("./target-resolution");
 
 function copyTypes(distLib, hostFederationDir) {
   if (fs.existsSync(hostFederationDir)) {
@@ -94,7 +17,6 @@ function copyTypes(distLib, hostFederationDir) {
 // dir (replace-existing semantics). Also warn if a same-id-named jar exists
 // in the modules folder — possible name-collision abuse signal.
 function deployExt({ workspaceDir, id, modulesDir, extDir }) {
-  // Collision check: same constrained-glob rules as everywhere else.
   const collisions = findMatches(modulesDir, `${id}-*.jar`);
   if (collisions.length) {
     const list = collisions.map((c) => path.join(modulesDir, c)).join(", ");
@@ -113,7 +35,6 @@ function deployExt({ workspaceDir, id, modulesDir, extDir }) {
   }
   fs.mkdirSync(extDir, { recursive: true });
   fs.cpSync(srcDir, extDir, { recursive: true });
-  // Count files for the report.
   let fileCount = 0;
   const walk = (d) => {
     for (const e of fs.readdirSync(d, { withFileTypes: true })) {
@@ -131,7 +52,8 @@ function deployOne({
   id,
   wpmRoot,
   modulesFolder,
-  adminBuildFolder,
+  adminDir,
+  modulesDir,
   wsconfig,
 }) {
   const distRemoteDir = path.join(workspaceDir, "dist", "admin-remotes", id);
@@ -146,8 +68,6 @@ function deployOne({
     throw new Error(`Lib dist missing: ${distLibDir}. Run \`build\` first.`);
   }
 
-  const modulesDir = path.resolve(wpmRoot, modulesFolder);
-  const adminDir = path.resolve(wpmRoot, adminBuildFolder);
   const hostFederationDir = path.join(adminDir, ".federation", id);
 
   const target = resolveTarget({
@@ -158,7 +78,6 @@ function deployOne({
     modulesFolder,
   });
 
-  // Perform the artifact deploy first; only on success do we touch host types.
   let artifactReport;
   if (target.kind === "jar") {
     const packResult = packIntoJar({
@@ -183,22 +102,13 @@ function deployOne({
     artifactReport = { kind: "ext", ...extResult };
   }
 
-  // Artifact deploy succeeded — now publish types.
   copyTypes(distLibDir, hostFederationDir);
 
   return { ...artifactReport, hostFederationDir };
 }
 
 function deployRemotes({ workspaceDir, restrictTo = [], withDeps = false }) {
-  const wsconfig = readWsconfig(workspaceDir);
-  if (!wsconfig.wpmRoot) {
-    throw new Error(
-      "wsconfig.json missing wpmRoot. Run `ws-wire-host <wpm-root>`."
-    );
-  }
-  const modulesJson = readModulesJson(wsconfig.wpmRoot);
-  const modulesFolder = modulesJson.modulesFolder || "./modules";
-  const adminBuildFolder = modulesJson.adminBuildFolder || "./admin";
+  const ctx = loadDeployContext(workspaceDir);
 
   const { order } = loadOrder({ workspaceDir, restrictTo, withDeps });
   const { remotes, libraries } = partitionByKind(workspaceDir, order);
@@ -217,10 +127,11 @@ function deployRemotes({ workspaceDir, restrictTo = [], withDeps = false }) {
     const r = deployOne({
       workspaceDir,
       id,
-      wpmRoot: wsconfig.wpmRoot,
-      modulesFolder,
-      adminBuildFolder,
-      wsconfig,
+      wpmRoot: ctx.wpmRoot,
+      modulesFolder: ctx.modulesFolder,
+      adminDir: ctx.adminDir,
+      modulesDir: ctx.modulesDir,
+      wsconfig: ctx.wsconfig,
     });
     if (r.kind === "jar") {
       console.log(`  target:        jar`);

package/lib/purge-jar.js

@@ -0,0 +1,70 @@
+const fs = require("fs");
+const path = require("path");
+const AdmZip = require("adm-zip");
+
+// Strip federated remote contributions from a jar by dropping entries under
+// META-INF/federation/.
+//
+// purgeJar({ jarPath, id }) — drops only META-INF/federation/<id>/.
+// purgeJar({ jarPath })     — drops every META-INF/federation/<*>/.
+//
+// Returns { jarPath, droppedEntries, droppedIds[], hadContribution }.
+function purgeJar({ jarPath, id }) {
+  if (!fs.existsSync(jarPath)) {
+    throw new Error(`Jar not found: ${jarPath}`);
+  }
+
+  const federationRoot = `META-INF/federation/`;
+  const targetPrefix = id ? `${federationRoot}${id}/` : federationRoot;
+
+  const original = new AdmZip(jarPath);
+  const out = new AdmZip();
+
+  let dropped = 0;
+  const idsHit = new Set();
+  for (const entry of original.getEntries()) {
+    if (entry.entryName.startsWith(targetPrefix)) {
+      dropped++;
+      const rest = entry.entryName.slice(federationRoot.length);
+      const slash = rest.indexOf("/");
+      if (slash > 0) idsHit.add(rest.slice(0, slash));
+      continue;
+    }
+    if (entry.isDirectory) {
+      out.addFile(entry.entryName, Buffer.alloc(0), "", entry.attr);
+    } else {
+      out.addFile(
+        entry.entryName,
+        entry.getData(),
+        entry.comment,
+        entry.attr
+      );
+    }
+  }
+
+  if (dropped === 0) {
+    return {
+      jarPath,
+      droppedEntries: 0,
+      droppedIds: [],
+      hadContribution: false,
+    };
+  }
+
+  const dir = path.dirname(jarPath);
+  const tmp = path.join(
+    dir,
+    `.${path.basename(jarPath)}.repack.${process.pid}.tmp`
+  );
+  out.writeZip(tmp);
+  fs.renameSync(tmp, jarPath);
+
+  return {
+    jarPath,
+    droppedEntries: dropped,
+    droppedIds: [...idsHit].sort(),
+    hadContribution: true,
+  };
+}
+
+module.exports = { purgeJar };

package/lib/purge-remotes.js

@@ -0,0 +1,231 @@
+const fs = require("fs");
+const path = require("path");
+const { purgeJar } = require("./purge-jar");
+const { loadOrder, partitionByKind } = require("./build-modules");
+const { loadDeployContext, resolveTarget } = require("./target-resolution");
+
+// Per-remote purge action. Returns a structured action record.
+function purgeOne({ workspaceDir, id, ctx }) {
+  const hostFederationDir = path.join(ctx.adminDir, ".federation", id);
+
+  const target = resolveTarget({
+    workspaceDir,
+    projectName: id,
+    wsconfig: ctx.wsconfig,
+    wpmRoot: ctx.wpmRoot,
+    modulesFolder: ctx.modulesFolder,
+  });
+
+  let artifact;
+  if (target.kind === "jar") {
+    const r = purgeJar({ jarPath: target.jarPath, id });
+    artifact = {
+      kind: "jar",
+      jarPath: target.jarPath,
+      pomPath: target.pomPath,
+      artifactId: target.artifactId,
+      droppedEntries: r.droppedEntries,
+      hadContribution: r.hadContribution,
+    };
+  } else {
+    const removed = fs.existsSync(target.extDir);
+    if (removed) fs.rmSync(target.extDir, { recursive: true, force: true });
+    artifact = { kind: "ext", extDir: target.extDir, removedExtDir: removed };
+  }
+
+  const typesRemoved = fs.existsSync(hostFederationDir);
+  if (typesRemoved) {
+    fs.rmSync(hostFederationDir, { recursive: true, force: true });
+  }
+
+  return { id, kind: target.kind, ...artifact, hostFederationDir, typesRemoved };
+}
+
+// Purge across an admin-modules workspace.
+//
+// modeFilter: null | "jar" | "ext"
+//   null  → each remote is purged according to its own resolved target
+//   "jar" → only act on jar-targeted remotes (skip ext)
+//   "ext" → only act on ext-targeted remotes (skip jar)
+//
+// strict: when true and modeFilter is set with explicit restrictTo names,
+//   mismatches throw with an actionable error (suggests `ws-purge jar <path>`
+//   for jar-mismatch). When false (modeFilter without restrictTo), mismatches
+//   are silently filtered.
+function purgeRemotes({
+  workspaceDir,
+  restrictTo = [],
+  withDeps = false,
+  modeFilter = null,
+  strict = false,
+}) {
+  const ctx = loadDeployContext(workspaceDir);
+  const { order } = loadOrder({ workspaceDir, restrictTo, withDeps });
+  const { remotes, libraries } = partitionByKind(workspaceDir, order);
+
+  console.log(`=== Purge ===`);
+  console.log(`  mode:    ${modeFilter || "auto (each by own target)"}`);
+  console.log(
+    `  scope:   ${restrictTo.length ? restrictTo.join(", ") : "all remotes"}`
+  );
+  if (libraries.length) {
+    console.log(
+      `  skipped libraries: ${libraries.join(", ")} (wsmodules.kind=library)`
+    );
+  }
+  console.log("");
+
+  const actions = [];
+  const skipped = [];
+  const errors = [];
+
+  for (const id of remotes) {
+    let target;
+    try {
+      target = resolveTarget({
+        workspaceDir,
+        projectName: id,
+        wsconfig: ctx.wsconfig,
+        wpmRoot: ctx.wpmRoot,
+        modulesFolder: ctx.modulesFolder,
+      });
+    } catch (e) {
+      errors.push({ id, stage: "resolve", message: e.message });
+      continue;
+    }
+
+    if (modeFilter && target.kind !== modeFilter) {
+      if (strict) {
+        const hint =
+          modeFilter === "jar"
+            ? `Use \`ws-purge jar <pathtojar>\` to purge a specific jar by path.`
+            : `Use \`ws-purge\` (no mode) to purge by each module's own target.`;
+        errors.push({
+          id,
+          stage: "filter",
+          message: `${id} is ${target.kind}-targeted, not ${modeFilter}-targeted. ${hint}`,
+        });
+        continue;
+      }
+      skipped.push({ id, reason: `target is ${target.kind}, filter is ${modeFilter}` });
+      continue;
+    }
+
+    try {
+      const action = purgeOne({ workspaceDir, id, ctx });
+      actions.push(action);
+    } catch (e) {
+      errors.push({ id, stage: "purge", message: e.message });
+    }
+  }
+
+  reportActions({ actions, skipped, errors });
+  return { actions, skipped, errors };
+}
+
+// Escape hatch: purge a specific jar by path, dropping every
+// META-INF/federation/<*>/ entry regardless of which workspace owns it.
+function purgeJarPath(jarPath) {
+  console.log(`=== Purge ===`);
+  console.log(`  mode:    jar (specific path)`);
+  console.log(`  jar:     ${jarPath}`);
+  console.log("");
+
+  const actions = [];
+  const errors = [];
+  try {
+    const r = purgeJar({ jarPath });
+    actions.push({
+      id: null,
+      kind: "jar",
+      jarPath,
+      droppedEntries: r.droppedEntries,
+      droppedIds: r.droppedIds,
+      hadContribution: r.hadContribution,
+      hostFederationDir: null,
+      typesRemoved: false,
+    });
+  } catch (e) {
+    errors.push({ id: jarPath, stage: "purge", message: e.message });
+  }
+
+  reportActions({ actions, skipped: [], errors });
+  return { actions, skipped: [], errors };
+}
+
+function reportActions({ actions, skipped, errors }) {
+  console.log(`=== Actions ===`);
+  if (!actions.length) {
+    console.log(`  (nothing purged)`);
+  }
+  for (const a of actions) {
+    const label = a.id ? a.id : "(by path)";
+    if (a.kind === "jar") {
+      if (a.hadContribution) {
+        const ids = a.droppedIds && a.droppedIds.length
+          ? ` (ids: ${a.droppedIds.join(", ")})`
+          : "";
+        console.log(
+          `  ${label}  jar   purged ${a.droppedEntries} entries from ${a.jarPath}${ids}`
+        );
+      } else {
+        console.log(
+          `  ${label}  jar   no contribution to purge in ${a.jarPath}`
+        );
+      }
+    } else {
+      console.log(
+        `  ${label}  ext   ${a.removedExtDir ? "removed" : "(absent)"} ${a.extDir}`
+      );
+    }
+    if (a.hostFederationDir) {
+      console.log(
+        `       host types ${a.typesRemoved ? "removed" : "(absent)"}: ${a.hostFederationDir}`
+      );
+    }
+  }
+
+  if (skipped.length) {
+    console.log(`\n=== Skipped ===`);
+    for (const s of skipped) console.log(`  ${s.id}: ${s.reason}`);
+  }
+
+  if (errors.length) {
+    console.log(`\n=== Errors ===`);
+    for (const e of errors)
+      console.log(`  \x1b[31m${e.id}\x1b[0m [${e.stage}] ${e.message}`);
+  }
+
+  const jars = actions.filter((a) => a.kind === "jar");
+  const exts = actions.filter((a) => a.kind === "ext");
+  const typesRemoved = actions.filter((a) => a.typesRemoved).length;
+  const noopJars = jars.filter((a) => !a.hadContribution).length;
+  const removedExt = exts.filter((a) => a.removedExtDir).length;
+
+  console.log(`\n=== Summary ===`);
+  console.log(
+    `  acted on ${actions.length} target(s): ${jars.length} jar, ${exts.length} ext`
+  );
+  if (jars.length) {
+    const totalEntries = jars.reduce((s, a) => s + (a.droppedEntries || 0), 0);
+    console.log(
+      `  jar:  ${totalEntries} entries dropped` +
+        (noopJars ? `; ${noopJars} jar(s) had no contribution` : "")
+    );
+  }
+  if (exts.length) {
+    console.log(
+      `  ext:  ${removedExt} dir(s) removed` +
+        (exts.length - removedExt
+          ? `; ${exts.length - removedExt} already absent`
+          : "")
+    );
+  }
+  if (typesRemoved) {
+    console.log(`  host: ${typesRemoved} .federation/<id>/ dir(s) removed`);
+  }
+  if (skipped.length) console.log(`  skipped: ${skipped.length}`);
+  if (errors.length) console.log(`  \x1b[31merrors: ${errors.length}\x1b[0m`);
+}
+
+module.exports = { purgeRemotes, purgeOne, purgeJarPath };

package/lib/target-resolution.js

@@ -0,0 +1,121 @@
+const fs = require("fs");
+const path = require("path");
+const { resolveProjectPom, readArtifactId } = require("./pom");
+const { resolveOne } = require("./jar-glob");
+
+function readWsconfig(workspaceDir) {
+  const file = path.join(workspaceDir, "wsconfig.json");
+  if (!fs.existsSync(file)) {
+    throw new Error(
+      `No wsconfig.json in ${workspaceDir}. Run \`ws-wire-host <wpm-root>\` first.`
+    );
+  }
+  return JSON.parse(fs.readFileSync(file, "utf8"));
+}
+
+function readModulesJson(wpmRoot) {
+  const file = path.join(wpmRoot, "modules.json");
+  if (!fs.existsSync(file)) {
+    throw new Error(`No modules.json at ${wpmRoot}.`);
+  }
+  return JSON.parse(fs.readFileSync(file, "utf8"));
+}
+
+function readProjectPkg(workspaceDir, name) {
+  const pkgPath = path.join(workspaceDir, "projects", name, "package.json");
+  if (!fs.existsSync(pkgPath)) return {};
+  try {
+    return JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+// Load the deployment context once and reuse across step runners (deploy,
+// purge, ...). Returns { wsconfig, wpmRoot, modulesFolder, modulesDir,
+// adminBuildFolder, adminDir }.
+function loadDeployContext(workspaceDir) {
+  const wsconfig = readWsconfig(workspaceDir);
+  if (!wsconfig.wpmRoot) {
+    throw new Error(
+      "wsconfig.json missing wpmRoot. Run `ws-wire-host <wpm-root>`."
+    );
+  }
+  const modulesJson = readModulesJson(wsconfig.wpmRoot);
+  const modulesFolder = modulesJson.modulesFolder || "./modules";
+  const adminBuildFolder = modulesJson.adminBuildFolder || "./admin";
+  const modulesDir = path.resolve(wsconfig.wpmRoot, modulesFolder);
+  const adminDir = path.resolve(wsconfig.wpmRoot, adminBuildFolder);
+  return {
+    wsconfig,
+    wpmRoot: wsconfig.wpmRoot,
+    modulesFolder,
+    adminBuildFolder,
+    modulesDir,
+    adminDir,
+  };
+}
+
+// Decide jar vs ext for a project, honouring wsconfig override > package.json.
+// Returns { kind: "jar", jarPath, pomPath?, artifactId? } or
+// { kind: "ext", extDir }.
+function resolveTarget({
+  workspaceDir,
+  projectName,
+  wsconfig,
+  wpmRoot,
+  modulesFolder,
+}) {
+  const modulesDir = path.resolve(wpmRoot, modulesFolder);
+  const extDir = path.join(
+    wpmRoot,
+    "scripts",
+    "ext-admin-remotes",
+    projectName
+  );
+
+  // 1. wsconfig override
+  const override =
+    wsconfig.deployOverrides && wsconfig.deployOverrides[projectName];
+  if (override) {
+    if (override.jar && override.ext) {
+      throw new Error(
+        `wsconfig.deployOverrides.${projectName}: set exactly one of 'jar' or 'ext', not both`
+      );
+    }
+    if (override.ext === true) {
+      return { kind: "ext", extDir };
+    }
+    if (override.jar) {
+      const jarPath = resolveOne(modulesDir, override.jar, projectName);
+      return { kind: "jar", jarPath };
+    }
+  }
+
+  // 2. project package.json
+  const pkg = readProjectPkg(workspaceDir, projectName);
+  const target = (pkg.wsmodules && pkg.wsmodules.target) || "jar";
+  if (target === "ext") {
+    return { kind: "ext", extDir };
+  }
+  if (target !== "jar") {
+    throw new Error(
+      `Invalid wsmodules.target for ${projectName}: ${JSON.stringify(target)} (expected 'jar' or 'ext')`
+    );
+  }
+
+  // 3. pom-derived artifactId
+  const pomField = pkg.wsmodules && pkg.wsmodules.pom;
+  const pomPath = resolveProjectPom(workspaceDir, projectName, pomField);
+  const artifactId = readArtifactId(pomPath);
+  const jarPath = resolveOne(modulesDir, `${artifactId}-*.jar`, projectName);
+  return { kind: "jar", jarPath, pomPath, artifactId };
+}
+
+module.exports = {
+  readWsconfig,
+  readModulesJson,
+  readProjectPkg,
+  loadDeployContext,
+  resolveTarget,
+};

package/lib/webpack-factory.js

@@ -1,5 +1,7 @@
+const fs = require("fs");
 const path = require("path");
 const Module = require("module");
+const TsconfigPathsPlugin = require("tsconfig-paths-webpack-plugin");
 
 // Build the in-memory webpack config used to produce a federated remote
 // from a single synthetic entry that re-exports the lib's public API.
@@ -30,6 +32,19 @@ function buildWebpackConfig({
 
   const remoteOutDir = path.join(outDir, id, "remote");
 
+  // tsconfig.federation.json is the SSOT for cross-workspace paths
+  // (`@ws-remote/*` → `<adminDir>/.federation/*`, sibling lib aliases,
+  // etc.). Without this plugin webpack ignores tsconfig `paths` and
+  // walks node_modules — which fails for cross-workspace federation
+  // siblings that only live in the host's federation dir.
+  const federationTsconfig = path.join(workspaceDir, "tsconfig.federation.json");
+  const resolvePlugins = [];
+  if (fs.existsSync(federationTsconfig)) {
+    resolvePlugins.push(
+      new TsconfigPathsPlugin({ configFile: federationTsconfig })
+    );
+  }
+
   return {
     mode: "production",
     entry: syntheticEntry,
@@ -56,6 +71,7 @@ function buildWebpackConfig({
     },
     resolve: {
       alias: aliasMap,
+      plugins: resolvePlugins,
       extensions: [".ts", ".js", ".mjs", ".json"],
       // ngcc rewrites Angular packages in-place but leaves the
       // originals next to them, exposing both via package.json fields

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ws-test-realm/admin-kit",
-  "version": "0.1.7",
+  "version": "0.1.10",
   "description": "Workflow CLI + scaffolding for Wiresphere admin-modules workspaces. Ships `ws-init-workspace` (init/merge into a project, stamps @wiresphere/shared's `getOverrides()` into the workspace's npm overrides block), `ws-modules` (build/pack/deploy driver), `ws-generate-module`/`ws-drop-module`, `ws-wire-host`, `ws-wire-pom`, `ws-sync-paths`, and `ws-pack-remote`. Depends on @wiresphere/devkit (toolchain BOM, peerDeps); pairs with @wiresphere/shared (runtime BOM + MF share map + overrides manifest). Requires npm 9+ for overrides + peerDep resolution to coexist cleanly.",
   "license": "Artistic-2.0",
   "publishConfig": {
@@ -14,6 +14,7 @@
     "ws-generate-module": "./bin/ws-generate-module.js",
     "ws-drop-module": "./bin/ws-drop-module.js",
     "ws-modules": "./bin/ws-modules.js",
+    "ws-purge": "./bin/ws-purge.js",
     "ws-sync-paths": "./bin/ws-sync-paths.js"
   },
   "main": "lib/index.js",
@@ -28,6 +29,7 @@
     "@ws-test-realm/devkit": "^0.3.0",
     "@ws-test-realm/shared": "^0.3.0",
     "adm-zip": "^0.5.10",
-    "fast-xml-parser": "^4.3.0"
+    "fast-xml-parser": "^4.3.0",
+    "tsconfig-paths-webpack-plugin": "^4.1.0"
   }
 }

package/template/package.json

@@ -12,6 +12,7 @@
 		"build": "ws-modules --build",
 		"pack": "ws-modules --pack",
 		"deploy": "ws-modules --deploy",
+		"purge": "ws-purge",
 		"wire": "ws-modules --build --pack --deploy"
 	},
 	"prettier": "@ws-test-realm/devkit/prettier.config.js",