Package shape: derive PACKAGES list from workspaces instead of hardcoding

[misama-ct]

Background

scripts/check-package-shape.mjs maintains a hardcoded PACKAGES array (~120 lines) listing every publishable workspace. New publishable workspaces don't get shape-checked until someone remembers to update this file; renames/moves require touching it; and the list duplicates information that already exists in each workspace's package.json.

Suggested change

Derive the list at runtime from pnpm m ls --json --depth -1, filtered by "private" !== true. Today that yields exactly the same 6 workspaces; future publishable workspaces would be picked up automatically.

async function discoverPackages() {
  const { code, stdout, stderr } = await runCommand(
    "pnpm",
    ["m", "ls", "--json", "--depth", "-1"],
    { cwd: ROOT }
  );
  if (code !== 0) throw new Error(`pnpm m ls exited ${code}\n${stderr}`);
  return JSON.parse(stdout)
    .filter((w) => w.private !== true)
    .map((w) => ({ name: w.name, dir: w.path }))
    .sort((a, b) => a.name.localeCompare(b.name));
}

Precedent

Applied to the merchant-center-application-kit port of this same script in commercetools/merchant-center-application-kit#4018 (review feedback from @tdeekens). Same outcome: ~−130 / +30 lines, identical baseline findings preserved.

Notes

• Relies on "private": true being set on non-published workspaces. Nimbus already maintains this — all 5 internal workspaces carry the flag.
• Worth dropping along the way: the defensive existsSync check on workspace paths (paths come from pnpm, always exist) and the safeRun wrapper around the tool runners.