@xemahq/repo-build-tooling 0.10.0 → 0.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM with zero dependencies so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -42,6 +42,6 @@
     "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/ghcr-manifest.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/registry-fetch.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:525d85f0cc251fa763bc18261159ae689b59c3465d9da0d3c9f6037445d68713"
+    "sourceDigest": "sha256:35b4aafd2345b2d892fff707b22790985f6ae1e20f75d0f7467f3401f8b583d2"
   }
 }

package/src/scrub-swagger-plugin-paths.mjs

@@ -167,12 +167,15 @@ const FLAT_LEAK_REGEX = new RegExp(
 // a relative path from the service source file back up to the workspace root
 // and down into the contracts package.  There is no `node_modules/` segment
 // so shapes 1 and 2 above never fire.
-// Capture group 1: package directory name (= npm name without @xemahq/ scope).
+// Capture group 1: relative path from the scrubbed file to the package directory.
 // Capture group 2: first path segment after dist/ = the subpath export name.
+// The public package name is NOT derived from the directory name or a fixed
+// scope: it is read from the target package's own package.json `name`, so
+// unscoped and differently-named workspace packages resolve correctly.
 // Scoped to paths that pass through `packages/`, `biomes/`, or `kernel/` to
 // avoid false-positive matches on intra-service relative requires.
 const RELATIVE_WORKSPACE_REGEX = new RegExp(
-  `require\\("(?:\\.\\./)+(?:packages|biomes|kernel)/(?:[a-z0-9][a-z0-9.-]*/)*([a-z0-9][a-z0-9.-]*)/dist/([a-z0-9][a-z0-9-]*)(?:/[^"]*)?"\\)`,
+  `require\\("((?:\\.\\./)+(?:packages|biomes|kernel)/(?:[a-z0-9][a-z0-9.-]*/)*[a-z0-9][a-z0-9.-]*)/dist/([a-z0-9][a-z0-9-]*)(?:/[^"]*)?"\\)`,
   'g',
 );
 
@@ -416,6 +419,28 @@ function publicSpecifierFor(resolveFrom, pkg, subpath, original) {
   );
 }
 
+/**
+ * The npm name of the workspace package at `packageDir`, read from the
+ * package.json AT that directory. No walk-up: an ancestor's manifest (usually
+ * the workspace root) names a different package. Never a fixed scope or the
+ * directory name.
+ */
+function packageNameAt(packageDir, original) {
+  const manifest = join(packageDir, 'package.json');
+  let raw;
+  try {
+    raw = readFileSync(manifest, 'utf8');
+  } catch (err) {
+    if (err.code !== 'ENOENT' && err.code !== 'ENOTDIR') throw err;
+    throw new ScrubFailure(`${packageDir} has no package.json, so no specifier can be derived for\n  ${original}`);
+  }
+  const { name } = JSON.parse(raw);
+  if (typeof name !== 'string' || name === '') {
+    throw new ScrubFailure(`${manifest} has no "name", so no specifier can be derived for\n  ${original}`);
+  }
+  return name;
+}
+
 async function* walk(dir) {
   let entries;
   try {
@@ -561,9 +586,10 @@ async function scrubFile(path) {
         `  rather than reaching through dist/.`,
     );
   }
-  out = out.replace(RELATIVE_WORKSPACE_REGEX, (_match, pkgName, subpath) => {
+  out = out.replace(RELATIVE_WORKSPACE_REGEX, (match, relPackageDir, subpath) => {
     count += 1;
-    return `require("@xemahq/${pkgName}/${subpath}")`;
+    const name = packageNameAt(resolve(dirname(path), relPackageDir), match);
+    return `require("${name}/${subpath}")`;
   });
   if (count > 0) {
     await writeFile(path, out, 'utf8');
@@ -796,6 +822,59 @@ async function selfTest() {
       throw new Error(`self-test: rewritten file still leaks: ${greenAfter}`);
     }
 
+    // 4b. RELATIVE-WORKSPACE — the rewritten specifier is the target package's
+    // own manifest `name`: scoped, unscoped, and name != directory.
+    const ws = join(root, 'ws');
+    const pkgs = [
+      ['packages/contracts/scoped-dir', '@xemahq/scoped-dir'],
+      ['packages/contracts/plain-dir', 'plain-contract'],
+      ['packages/contracts/other-dir', '@xemahq/renamed'],
+    ];
+    for (const [dir, name] of pkgs) {
+      await mkdir(join(ws, dir, 'dist/lib'), { recursive: true });
+      await writeFile(join(ws, dir, 'package.json'), JSON.stringify({ name }), 'utf8');
+    }
+    await mkdir(join(ws, 'services/svc/dist'), { recursive: true });
+    const wsFile = join(ws, 'services/svc/dist/dto.js');
+    const relOf = (dir) => `../../../${dir}/dist/lib/x`;
+    await writeFile(
+      wsFile,
+      `class Dto {\n  static _OPENAPI_METADATA_FACTORY() {\n    return { ${pkgs
+        .map(([dir], i) => `k${i}: () => require("${relOf(dir)}")`)
+        .join(', ')} };\n  }\n}\n`,
+      'utf8',
+    );
+    await run([join(ws, 'services/svc/dist')]);
+    const wsAfter = await readFile(wsFile, 'utf8');
+    for (const expected of ['require("@xemahq/scoped-dir/lib")', 'require("plain-contract/lib")', 'require("@xemahq/renamed/lib")']) {
+      if (!wsAfter.includes(expected)) {
+        throw new Error(`self-test: relative-workspace rewrite missing ${expected}: ${wsAfter}`);
+      }
+    }
+    // A target directory without its own package.json is a hard failure.
+    const orphan = join(root, 'orphan');
+    await mkdir(join(orphan, 'svc/dist'), { recursive: true });
+    await writeFile(
+      join(orphan, 'svc/dist/dto.js'),
+      'class D {\n  static _OPENAPI_METADATA_FACTORY() {\n    return { a: () => require("../../packages/none/dist/lib/x") };\n  }\n}\n',
+      'utf8',
+    );
+    await expectFailure('relative workspace target without package.json', () => run([join(orphan, 'svc/dist')]));
+
+    // An ANCESTOR's package.json must not stand in for the target's own.
+    const walkup = join(root, 'walkup');
+    await mkdir(join(walkup, 'packages/none/dist/lib'), { recursive: true });
+    await mkdir(join(walkup, 'svc/dist'), { recursive: true });
+    await writeFile(join(walkup, 'package.json'), JSON.stringify({ name: 'workspace-root' }), 'utf8');
+    await writeFile(
+      join(walkup, 'svc/dist/dto.js'),
+      'class D {\n  static _OPENAPI_METADATA_FACTORY() {\n    return { a: () => require("../../packages/none/dist/lib/x") };\n  }\n}\n',
+      'utf8',
+    );
+    await expectFailure('relative workspace target without package.json but with an ancestor that has one', () =>
+      run([join(walkup, 'svc/dist')]),
+    );
+
     // 5. End-to-end RED — a DOUBLY-nested literal. One `String.replace` pass
     //    does not re-scan its own replacement, so the rewrite leaves a literal
     //    that is still a leak. This is the case the old script shipped