@xemahq/repo-build-tooling 0.2.2 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM with zero dependencies so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",

package/src/check-workspace-range-matches-local.mjs

@@ -29,7 +29,7 @@
 // examined.
 // ═══════════════════════════════════════════════════════════════════════════
 import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { join, relative } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
@@ -173,6 +173,42 @@ function main() {
 
 // Importing this module must not run the scan — the test suite imports it for
 // `satisfies` alone.
-if (import.meta.url === pathToFileURL(process.argv[1] ?? '.').href) {
+//
+// COMPARE REALPATHS. `import.meta.url` is the RESOLVED path of this file;
+// `process.argv[1]` is the path the shell was handed. Inside the xema-monorepo
+// aggregator those are different strings for the same file, because
+// `node_modules/@xemahq/repo-build-tooling` is a symlink into the workspace and
+// pnpm's bin shim execs THROUGH it:
+//
+//   argv[1]  …/node_modules/@xemahq/repo-build-tooling/src/check-…mjs
+//   resolved …/repos/xema-runtime-core/packages/sdks/repo-build-tooling/src/check-…mjs
+//
+// So the guard was false, `main()` never ran, and the bin printed NOTHING and
+// exited 0 — the check reporting green while executing nothing, which is this
+// fleet's most-repeated defect and the one it has the most machinery against.
+//
+// Measured 2026-08-21: `repos/xema-biome-sdk` carried two `workspace:^6.1.0`
+// declarations against a local `@xemahq/biome-sdk@7.0.0` — the exact dropped
+// build edge this file exists to catch, and a range pnpm refuses outright with
+// ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE. `xema-check-workspace-ranges`
+// exited 0 in silence; the same file run by its real path exited 1 and named
+// both. Every carved repo's `pnpm check` and every pre-push hook in this
+// checkout invoked it the silent way.
+//
+// A carved repo's own CI installs the PUBLISHED tarball, so there argv[1] is
+// already a real path and the guard held. That is why the hole survived: it is
+// invisible in exactly the lane people point at as proof.
+const invokedPath = process.argv[1];
+let invokedRealPath = null;
+if (typeof invokedPath === 'string' && invokedPath.length > 0) {
+  try {
+    invokedRealPath = realpathSync(invokedPath);
+  } catch {
+    // Not a path on disk (a `node -e` entry, say). Nothing was invoked, so
+    // nothing should run — fall through as a plain import.
+    invokedRealPath = null;
+  }
+}
+if (invokedRealPath !== null && import.meta.url === pathToFileURL(invokedRealPath).href) {
   process.exit(main());
 }

package/src/scrub-swagger-plugin-paths.mjs

@@ -303,7 +303,6 @@ function reExportsReach(entry, target, depth = 6, seen = new Set()) {
   } catch {
     return false;
   }
-  const dir = dirname(entry);
   for (const m of src.matchAll(/require\("(\.[^"]*)"\)/g)) {
     let next;
     try {
@@ -499,7 +498,7 @@ async function assertScannable(dir) {
   }
   if (!s.isDirectory()) throw new ScrubFailure(`not a directory: ${dir}`);
 
-  for await (const _file of walk(dir)) return; // eslint-disable-line no-unused-vars
+  for await (const _file of walk(dir)) return;
   throw new ScrubFailure(
     `output directory holds no compiled .js: ${dir}\n` +
       `  Same failure as a missing directory: nothing was scrubbed and nothing was verified.`,