pipework 0.251.0 → 0.252.1

package/src/workspace/discover.ts

@@ -0,0 +1,206 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import type { ModuleConfig } from '../core/config/schema.js'
+
+export interface ResolvedModule {
+  readonly key: string
+  readonly relativePath: string
+  readonly config: ModuleConfig
+  // Set by sync (which has fs access) — true when the module imports pipework at runtime,
+  // so the generator declares pipework in the module's dependencies. See generateModulePackageJson.
+  readonly importsPipework?: boolean
+  // The `name` in the module's own package.json — set only for a module with `managed: false`.
+  readonly packageName?: string
+}
+
+export function resolveModules(
+  modules: Record<string, string | ModuleConfig> | undefined,
+  cwd: string,
+): ResolvedModule[] {
+  if (modules === undefined) return []
+
+  const globs: Array<{ pattern: string; config: ModuleConfig }> = []
+  const explicit: Array<{ key: string; config: ModuleConfig }> = []
+
+  for (const [key, value] of Object.entries(modules)) {
+    const config = typeof value === 'string' ? {} : value
+    if (key.includes('*')) {
+      globs.push({ pattern: key, config })
+    } else {
+      explicit.push({ key, config })
+    }
+  }
+
+  const expanded = new Map<string, ModuleConfig>()
+
+  for (const { pattern, config } of globs) {
+    for (const path of expandGlob(pattern, cwd)) {
+      expanded.set(path, config)
+    }
+  }
+
+  for (const { key, config } of explicit) {
+    const existing = expanded.get(key)
+    if (existing !== undefined) {
+      expanded.set(key, mergeConfigs(existing, config))
+    } else {
+      expanded.set(key, config)
+    }
+  }
+
+  const results: ResolvedModule[] = []
+  for (const [relativePath, config] of [...expanded.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    const packageName = config.managed === false ? readOwnPackageName(relativePath, cwd) : undefined
+    results.push({ key: relativePath, relativePath, config, ...(packageName !== undefined ? { packageName } : {}) })
+  }
+
+  return results
+}
+
+function readOwnPackageName(relativePath: string, cwd: string): string {
+  const file = join(relativePath, 'package.json')
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(readFileSync(join(cwd, file), 'utf-8'))
+  } catch (err) {
+    const why = (err as NodeJS.ErrnoException).code === 'ENOENT' ? 'does not exist' : 'is not valid JSON'
+    throw new Error(
+      `[pipework] Module "${relativePath}" has managed: false, but ${file} ${why}.\n\n` +
+      `  A module that owns its manifests needs its own package.json with a "name".\n` +
+      `  Fix: create ${file}, or remove managed: false to let pipework generate it.\n`,
+    )
+  }
+  const name = (parsed as Record<string, unknown> | null)?.['name']
+  if (typeof name !== 'string' || name === '') {
+    throw new Error(
+      `[pipework] Module "${relativePath}" has managed: false, but ${file} has no string "name".\n\n` +
+      `  Pipework reads the package name from that file.\n` +
+      `  Fix: add a "name" to ${file}, or remove managed: false to let pipework generate it.\n`,
+    )
+  }
+  return name
+}
+
+export function expandGlob(pattern: string, cwd: string): string[] {
+  const parts = pattern.split('/')
+  const starIndex = parts.indexOf('*')
+
+  if (starIndex === -1) {
+    throw new Error(
+      `[pipework] Invalid modules glob: "${pattern}".\n\n` +
+      '  Expected a glob pattern like "packages/*" or "apps/connectors/*".\n',
+    )
+  }
+
+  const prefix = parts.slice(0, starIndex).join('/')
+  const parentDir = resolve(cwd, prefix)
+
+  let entries: string[]
+  try {
+    entries = readdirSync(parentDir)
+  } catch {
+    return []
+  }
+
+  const results: string[] = []
+  for (const entry of entries.sort()) {
+    const fullPath = join(parentDir, entry)
+    try {
+      if (statSync(fullPath).isDirectory()) {
+        results.push(prefix + '/' + entry)
+      }
+    } catch {
+      continue
+    }
+  }
+
+  return results
+}
+
+function mergeConfigs(base: ModuleConfig, override: ModuleConfig): ModuleConfig {
+  return {
+    ...base,
+    ...override,
+    dependencies: override.dependencies !== undefined || base.dependencies !== undefined
+      ? { ...base.dependencies, ...override.dependencies }
+      : undefined,
+    devDependencies: override.devDependencies !== undefined || base.devDependencies !== undefined
+      ? { ...base.devDependencies, ...override.devDependencies }
+      : undefined,
+    scripts: override.scripts !== undefined || base.scripts !== undefined
+      ? { ...base.scripts, ...override.scripts }
+      : undefined,
+    exports: override.exports !== undefined || base.exports !== undefined
+      ? { ...base.exports, ...override.exports }
+      : undefined,
+    tsconfig: override.tsconfig !== undefined || base.tsconfig !== undefined
+      ? { ...base.tsconfig, ...override.tsconfig }
+      : undefined,
+  }
+}
+
+/**
+ * Every workspace package under `dir`, as paths relative to `dir`, deepest last.
+ *
+ * A package is a directory named by `dir`'s own workspace manifest (pnpm-workspace.yaml,
+ * or `workspaces` in package.json) that carries a package.json. A package that is itself
+ * a workspace root is expanded too — `packages/backend` declaring `app/*` yields
+ * `packages/backend`, `packages/backend/app/api`, and so on. Lint globs and lint targets
+ * are built from this, so a nested workspace is covered rather than silently skipped.
+ */
+export function discoverWorkspacePackages(dir: string, depth = 0): string[] {
+  if (depth > 8) return []
+
+  const out: string[] = []
+  for (const rel of readWorkspacePatterns(dir).flatMap(p => expandWorkspacePattern(p, dir))) {
+    if (!existsSync(join(dir, rel, 'package.json'))) continue
+    out.push(rel)
+    for (const nested of discoverWorkspacePackages(join(dir, rel), depth + 1)) {
+      out.push(rel + '/' + nested)
+    }
+  }
+  return [...new Set(out)].sort()
+}
+
+function readWorkspacePatterns(dir: string): string[] {
+  const yamlPath = join(dir, 'pnpm-workspace.yaml')
+  if (existsSync(yamlPath)) {
+    const patterns: string[] = []
+    for (const line of readFileSync(yamlPath, 'utf-8').split('\n')) {
+      const match = line.match(/^\s*-\s*["']?([^"'\s]+)["']?/)
+      if (match?.[1] !== undefined && match[1] !== '.') patterns.push(match[1])
+    }
+    return patterns
+  }
+
+  const pkgPath = join(dir, 'package.json')
+  if (!existsSync(pkgPath)) return []
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(readFileSync(pkgPath, 'utf-8'))
+  } catch {
+    return []
+  }
+  const workspaces = (parsed as Record<string, unknown> | null)?.['workspaces']
+  if (Array.isArray(workspaces)) return workspaces.filter((w): w is string => typeof w === 'string')
+  const packages = (workspaces as Record<string, unknown> | undefined)?.['packages']
+  if (Array.isArray(packages)) return packages.filter((w): w is string => typeof w === 'string')
+  return []
+}
+
+// pnpm patterns are globs; only the trailing-`*` form (`packages/*`, `apps/**`) and a
+// literal path appear in practice. Anything else is taken literally.
+function expandWorkspacePattern(pattern: string, dir: string): string[] {
+  if (pattern.startsWith('!')) return []
+  const trimmed = pattern.replace(/\/\*\*?$/, '')
+  if (trimmed === pattern) return [pattern]
+
+  const baseDir = resolve(dir, trimmed)
+  let entries: string[]
+  try {
+    entries = readdirSync(baseDir, { withFileTypes: true }).filter(e => e.isDirectory()).map(e => e.name)
+  } catch {
+    return []
+  }
+  return entries.sort().map(name => (trimmed === '' ? name : trimmed + '/' + name))
+}

package/src/workspace/generate.ts

@@ -0,0 +1,401 @@
+import { computeChecksum } from './checksum.js'
+import type { ResolvedModule } from './discover.js'
+import { modulePackageName } from './module-package-name.js'
+import { workspaceSourcePaths } from './source-paths.js'
+
+const GENERATED_NOTICE = 'DO NOT EDIT — managed by Pipework. Deleted and regenerated by `pipework sync`.'
+
+const DEFAULT_SCRIPTS: Readonly<Record<string, string>> = {
+  build: 'tsc',
+  lint: 'pipework lint',
+  test: 'vitest run',
+  // The config `pipework check` type-checks with: it resolves sibling packages from source.
+  'type-check': 'tsc --noEmit -p tsconfig.check.json',
+}
+
+// The pnpm a consumer gets when their config does not pin one. A box fact, not
+// a pipework fact — `packageManager` in the config overrides it.
+const DEFAULT_PACKAGE_MANAGER = 'pnpm@10.33.0'
+
+const DEFAULT_DEV_DEPS: Readonly<Record<string, string>> = {
+  typescript: '^6.0.3',
+  vitest: '^4.1.5',
+}
+
+export interface WorkspaceConfig {
+  readonly name: string
+  readonly scripts?: Readonly<Record<string, string>>
+  readonly packageManager?: string
+  readonly dependencies?: Readonly<Record<string, string>>
+  readonly devDependencies?: Readonly<Record<string, string>>
+  readonly modules: readonly ResolvedModule[]
+  readonly pipeworkVersion: string
+  readonly hasVitest: boolean
+}
+
+export interface GeneratedFile {
+  readonly relativePath: string
+  readonly content: string
+}
+
+export function generateWorkspace(config: WorkspaceConfig): GeneratedFile[] {
+  const files: GeneratedFile[] = []
+
+  files.push(generateRootPackageJson(config))
+  files.push(generatePreinstallGuard())
+  files.push(generateWorkspaceYaml(config))
+  files.push(generateBaseTsconfig())
+
+  files.push(generateEslintConfig())
+
+  if (config.hasVitest) {
+    files.push(generateVitestConfig())
+  }
+
+  if (config.modules.length > 0) {
+    files.push(generateCheckBaseTsconfig(config))
+  }
+
+  for (const mod of config.modules) {
+    if (mod.config.managed === false) continue
+    files.push(generateModulePackageJson(mod, config))
+    files.push(generateModuleTsconfig(mod))
+    files.push(generateModuleCheckTsconfig(mod))
+  }
+
+  return files
+}
+
+function generatePreinstallGuard(): GeneratedFile {
+  const script = [
+    `// ${GENERATED_NOTICE}`,
+    `'use strict';`,
+    `const fs = require('fs');`,
+    `const crypto = require('crypto');`,
+    ``,
+    `function checksum(content) {`,
+    `  const withoutChecksum = content.replace(/"_checksum":\\s*"[^"]*",?\\n?/, '');`,
+    `  const hash = crypto.createHash('sha256').update(withoutChecksum).digest('hex').slice(0, 16);`,
+    `  return 'sha256:' + hash;`,
+    `}`,
+    ``,
+    `function check(file) {`,
+    `  if (!fs.existsSync(file)) return;`,
+    `  const raw = fs.readFileSync(file, 'utf8');`,
+    `  let pkg;`,
+    `  try { pkg = JSON.parse(raw); } catch { return; }`,
+    `  if (!pkg._generated || !pkg._checksum) return;`,
+    `  const expected = pkg._checksum;`,
+    `  delete pkg._checksum;`,
+    `  const actual = checksum(JSON.stringify(pkg, null, 2) + '\\n');`,
+    `  if (expected !== actual) {`,
+    `    console.error('\\n  Pipework workspace files are stale.\\n  Run: npx pipework install\\n');`,
+    `    process.exit(1);`,
+    `  }`,
+    `}`,
+    ``,
+    `check('package.json');`,
+    ``,
+  ].join('\n')
+
+  return {
+    relativePath: 'pipework-guard.cjs',
+    content: script,
+  }
+}
+
+function generateRootPackageJson(config: WorkspaceConfig): GeneratedFile {
+  const pkg: Record<string, unknown> = {
+    _generated: GENERATED_NOTICE,
+    name: config.name,
+    private: true,
+    type: 'module',
+    packageManager: config.packageManager ?? DEFAULT_PACKAGE_MANAGER,
+    engines: { node: '>=22' },
+    scripts: {
+      preinstall: 'node -e "try{require(\'./pipework-guard.cjs\')}catch{}"',
+      ...Object.fromEntries(
+        Object.entries(config.scripts ?? {}).filter(([k]) => k !== 'preinstall'),
+      ),
+    },
+    ...(config.dependencies !== undefined ? { dependencies: sortKeys(config.dependencies) } : {}),
+    devDependencies: sortKeys({
+      pipework: `^${config.pipeworkVersion}`,
+      ...DEFAULT_DEV_DEPS,
+    }),
+  }
+
+  const content = JSON.stringify(pkg, null, 2) + '\n'
+  const checksum = computeChecksum(content)
+  pkg['_checksum'] = checksum
+
+  return {
+    relativePath: 'package.json',
+    content: JSON.stringify(pkg, null, 2) + '\n',
+  }
+}
+
+function generateWorkspaceYaml(config: WorkspaceConfig): GeneratedFile {
+  const packages: string[] = ['.']
+
+  for (const mod of config.modules) {
+    packages.push(mod.relativePath)
+  }
+
+  const lines = [
+    `# ${GENERATED_NOTICE}`,
+    'packages:',
+    ...packages.map(p => `  - "${p}"`),
+    '',
+  ]
+
+  return {
+    relativePath: 'pnpm-workspace.yaml',
+    content: lines.join('\n'),
+  }
+}
+
+function generateBaseTsconfig(): GeneratedFile {
+  const tsconfig = {
+    compilerOptions: {
+      target: 'ES2022',
+      module: 'ESNext',
+      moduleResolution: 'bundler',
+      declaration: true,
+      declarationMap: true,
+      sourceMap: true,
+      strict: true,
+      exactOptionalPropertyTypes: true,
+      noUncheckedIndexedAccess: true,
+      noPropertyAccessFromIndexSignature: true,
+      useUnknownInCatchVariables: true,
+      noImplicitReturns: true,
+      noUnusedLocals: true,
+      esModuleInterop: true,
+      skipLibCheck: true,
+      forceConsistentCasingInFileNames: true,
+      resolveJsonModule: true,
+      isolatedModules: true,
+      verbatimModuleSyntax: true,
+    },
+  }
+
+  return {
+    relativePath: 'tsconfig.base.json',
+    content: JSON.stringify(tsconfig, null, 2) + '\n',
+  }
+}
+
+export const ESLINT_CONFIG_CONTENT = [
+  `// ${GENERATED_NOTICE}`,
+  `import { resolveLintConfig } from 'pipework/eslint'`,
+  ``,
+  `// import.meta.dirname, not the process cwd: eslint resolves flat-config \`files\` globs`,
+  `// against this file's directory, so that is the root the globs must be built from.`,
+  `export default await resolveLintConfig(import.meta.dirname)`,
+  '',
+].join('\n')
+
+function generateEslintConfig(): GeneratedFile {
+  return {
+    relativePath: 'eslint.config.js',
+    content: ESLINT_CONFIG_CONTENT,
+  }
+}
+
+export const VITEST_CONFIG_CONTENT = [
+  `// ${GENERATED_NOTICE}`,
+  `import { defineConfig } from 'vitest/config'`,
+  `import { resolveVitestConfig } from 'pipework/vitest'`,
+  ``,
+  `export default defineConfig(await resolveVitestConfig())`,
+  '',
+].join('\n')
+
+function generateVitestConfig(): GeneratedFile {
+  return {
+    relativePath: 'vitest.config.ts',
+    content: VITEST_CONFIG_CONTENT,
+  }
+}
+
+// A merged map where a module set a key to null: the key is removed, defaults included.
+function withoutRemoved(map: Readonly<Record<string, string | null>>): Record<string, string> {
+  const kept: Record<string, string> = {}
+  for (const [key, value] of Object.entries(map)) {
+    if (value !== null) kept[key] = value
+  }
+  return kept
+}
+
+function generateModulePackageJson(
+  mod: ResolvedModule,
+  config: WorkspaceConfig,
+): GeneratedFile {
+  const moduleName = modulePackageName(mod, config.name)
+  const isPrivate = mod.config.private !== false
+
+  const mergedScripts = sortKeys(withoutRemoved({ ...DEFAULT_SCRIPTS, ...mod.config.scripts }))
+  const mergedDevDeps = sortKeys(withoutRemoved({
+    ...DEFAULT_DEV_DEPS,
+    ...config.devDependencies,
+    ...mod.config.devDependencies,
+  }))
+
+  const pkg: Record<string, unknown> = {
+    _generated: GENERATED_NOTICE,
+    name: moduleName,
+    version: mod.config.version ?? '0.0.0',
+    private: isPrivate,
+    type: 'module',
+    engines: { node: '>=22' },
+  }
+
+  const projectedExports = projectExports(mod.config.exports)
+  if (projectedExports !== undefined) {
+    pkg['exports'] = projectedExports
+  }
+
+  if (mod.config.files !== undefined) {
+    pkg['files'] = mod.config.files
+  }
+  if (mod.config.publishConfig !== undefined) {
+    pkg['publishConfig'] = mod.config.publishConfig
+  }
+
+  pkg['scripts'] = mergedScripts
+
+  const peerDeps = mod.config.peerDependencies
+  const deps: Record<string, string> = { ...mod.config.dependencies }
+  // A module that imports pipework at runtime declares it (not via root hoisting) — UNLESS it
+  // declares pipework as a peer (a leaf library), in which case the consumer provides pipework.
+  if (
+    mod.importsPipework === true &&
+    deps['pipework'] === undefined &&
+    peerDeps?.['pipework'] === undefined
+  ) {
+    deps['pipework'] = config.pipeworkVersion
+  }
+  if (Object.keys(deps).length > 0) {
+    pkg['dependencies'] = sortKeys(deps)
+  }
+  if (peerDeps !== undefined && Object.keys(peerDeps).length > 0) {
+    pkg['peerDependencies'] = sortKeys(peerDeps)
+  }
+
+  pkg['devDependencies'] = mergedDevDeps
+
+  const content = JSON.stringify(pkg, null, 2) + '\n'
+  const checksum = computeChecksum(content)
+  pkg['_checksum'] = checksum
+
+  return {
+    relativePath: mod.relativePath + '/package.json',
+    content: JSON.stringify(pkg, null, 2) + '\n',
+  }
+}
+
+function generateModuleTsconfig(mod: ResolvedModule): GeneratedFile {
+  const depth = mod.relativePath.split('/').length
+  const extendsPath = '../'.repeat(depth) + 'tsconfig.base.json'
+
+  const tsconfig: Record<string, unknown> = {
+    extends: extendsPath,
+    compilerOptions: {
+      rootDir: 'src',
+      outDir: 'dist',
+      ...mod.config.tsconfig,
+    },
+    include: ['src'],
+  }
+
+  return {
+    relativePath: mod.relativePath + '/tsconfig.json',
+    content: JSON.stringify(tsconfig, null, 2) + '\n',
+  }
+}
+
+// `pipework check` type-checks each module from source, with no prior build.
+// The build config (`tsconfig.json`) resolves siblings through `exports` →
+// `dist/`, so it can only type-check once every dependency is built. The check
+// config adds `paths` mappings (via `tsconfig.check.base.json`) that resolve
+// `@scope/foo` straight to its `src/`, and overrides `rootDir` to the repo root
+// so pulling a sibling's source into the program does not trip TS6059.
+function generateModuleCheckTsconfig(mod: ResolvedModule): GeneratedFile {
+  const depth = mod.relativePath.split('/').length
+  const upToRoot = '../'.repeat(depth)
+
+  const tsconfig: Record<string, unknown> = {
+    extends: ['./tsconfig.json', upToRoot + 'tsconfig.check.base.json'],
+    compilerOptions: {
+      noEmit: true,
+      rootDir: upToRoot.slice(0, -1),
+    },
+  }
+
+  return {
+    relativePath: mod.relativePath + '/tsconfig.check.json',
+    content: JSON.stringify(tsconfig, null, 2) + '\n',
+  }
+}
+
+// Maps every workspace package's export subpaths to their `src/` files, so
+// `tsconfig.check.json` can resolve cross-package imports without a build.
+// Shares `workspaceSourcePaths` with the vitest cross-package resolver so the
+// two never drift.
+function generateCheckBaseTsconfig(config: WorkspaceConfig): GeneratedFile {
+  const paths: Record<string, string[]> = {}
+
+  for (const [key, relPath] of workspaceSourcePaths(config.modules, config.name)) {
+    paths[key] = [`./${relPath}`]
+  }
+
+  const tsconfig = {
+    compilerOptions: {
+      paths: sortKeys(paths),
+    },
+  }
+
+  return {
+    relativePath: 'tsconfig.check.base.json',
+    content: JSON.stringify(tsconfig, null, 2) + '\n',
+  }
+}
+
+function projectExports(
+  exports: Readonly<Record<string, string | { types: string; import: string }>> | undefined,
+): Record<string, { types: string; import: string }> | undefined {
+  if (exports === undefined) {
+    return {
+      '.': { types: './dist/index.d.ts', import: './dist/index.js' },
+    }
+  }
+
+  const result: Record<string, { types: string; import: string }> = {}
+
+  for (const [subpath, value] of Object.entries(exports)) {
+    if (typeof value === 'object') {
+      result[subpath] = value
+    } else {
+      result[subpath] = projectSourcePath(value)
+    }
+  }
+
+  return result
+}
+
+function projectSourcePath(sourcePath: string): { types: string; import: string } {
+  const distPath = sourcePath.replace(/^\.\/src\//, './dist/')
+  const jsPath = distPath.replace(/\.ts$/, '.js')
+  const dtsPath = distPath.replace(/\.ts$/, '.d.ts')
+
+  return { types: dtsPath, import: jsPath }
+}
+
+function sortKeys<T>(obj: Readonly<Record<string, T>>): Record<string, T> {
+  const sorted: Record<string, T> = {}
+  for (const key of Object.keys(obj).sort()) {
+    sorted[key] = obj[key]!
+  }
+  return sorted
+}

package/src/workspace/index.ts

@@ -0,0 +1,7 @@
+export { sync, type SyncInput, type SyncResult } from './sync.js'
+export { computeChecksum, checksumFromPackageJson, isStale } from './checksum.js'
+export { resolveModules, type ResolvedModule } from './discover.js'
+export { generateWorkspace, VITEST_CONFIG_CONTENT, type WorkspaceConfig, type GeneratedFile } from './generate.js'
+export { buildModuleGraph, type ModuleGraph } from './dependency-graph.js'
+export { changedFiles, filesToModules, type DiffMode } from './changed-files.js'
+export { resolveAffected, type ScopeResult, type ScopeMode } from './affected.js'

package/src/workspace/module-imports-pipework.ts

@@ -0,0 +1,39 @@
+import { readdirSync, readFileSync, type Dirent } from 'node:fs'
+import { join } from 'node:path'
+
+// A module that imports pipework at RUNTIME must declare pipework as a dependency rather
+// than lean on root hoisting (the dep resolves today, but the module is not self-contained
+// and breaks if hoisting changes). Detection: any non-test source file under the module's
+// src/ with a value (non-type-only) import or re-export from 'pipework' or a 'pipework/...'
+// subpath. Type-only imports are erased at build, and a module that imports pipework only
+// from its tests is already covered by the generated devDependencies.
+const RUNTIME_PIPEWORK_IMPORT =
+  /(?:^|\n)\s*(?:import|export)\s+(?!type\s)[^\n;]*?from\s*['"]pipework(?:\/[^'"]*)?['"]/
+
+export function moduleImportsPipework(cwd: string, relativePath: string): boolean {
+  return scan(join(cwd, relativePath, 'src'))
+}
+
+function scan(dir: string): boolean {
+  let entries: Dirent[]
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return false
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === 'dist') continue
+      if (scan(join(dir, entry.name))) return true
+      continue
+    }
+    if (!entry.name.endsWith('.ts')) continue
+    if (entry.name.endsWith('.d.ts') || entry.name.endsWith('.test.ts') || entry.name.endsWith('.spec.ts')) continue
+    try {
+      if (RUNTIME_PIPEWORK_IMPORT.test(readFileSync(join(dir, entry.name), 'utf-8'))) return true
+    } catch {
+      continue
+    }
+  }
+  return false
+}

package/src/workspace/module-package-name.ts

@@ -0,0 +1,12 @@
+import { basename } from 'node:path'
+import type { ResolvedModule } from './discover.js'
+
+export function modulePackageName(mod: ResolvedModule, projectName: string): string {
+  if (mod.config.managed === false) {
+    if (mod.packageName === undefined) {
+      throw new Error(`[pipework] Module "${mod.relativePath}" has managed: false but its package name was not read from ${mod.relativePath}/package.json (resolve modules with resolveModules).`)
+    }
+    return mod.packageName
+  }
+  return mod.config.name ?? `@${projectName}/${basename(mod.relativePath)}`
+}

package/src/workspace/scrub-git-env.ts

@@ -0,0 +1,23 @@
+// Git resolves the repository from environment variables (GIT_DIR,
+// GIT_WORK_TREE, GIT_INDEX_FILE, ...) in preference to a subprocess's working
+// directory. When git tooling runs inside a git hook, those variables are set
+// and point at the hook's repository — so a `git` call meant to inspect a
+// given `cwd` silently operates on the hook's repo instead, reads the wrong
+// index, and can even mutate the wrong repo. Stripping them makes `cwd`
+// authoritative again.
+const GIT_LOCATION_VARS = [
+  'GIT_DIR',
+  'GIT_WORK_TREE',
+  'GIT_INDEX_FILE',
+  'GIT_OBJECT_DIRECTORY',
+  'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+  'GIT_COMMON_DIR',
+  'GIT_NAMESPACE',
+  'GIT_PREFIX',
+] as const
+
+export function scrubGitEnv(): NodeJS.ProcessEnv {
+  const env = { ...process.env }
+  for (const key of GIT_LOCATION_VARS) delete env[key]
+  return env
+}