@codependix/nx 0.0.1 → 0.0.3

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 0.0.3 (2026-10-13)
+
+### 🩹 Fixes
+
+- **callidescope,codependix,configuration:** 🐛 harden the codependix nx plugin for consumers outside this workspace ([#1444](https://github.com/organizzolini/codebase/pull/1444), [#1433](https://github.com/organizzolini/codebase/issues/1433))
+
+### 🧱 Updated Dependencies
+
+- Updated codependix-cli to 0.0.18
+
+## 0.0.2 (2026-10-13)
+
+### 🧱 Updated Dependencies
+
+- Updated codependix-cli to 0.0.17
+
 ## 0.0.1 (2026-10-13)
 
 ### 🚀 Features

package/README.md

@@ -44,16 +44,19 @@ Register it in `nx.json`:
 | `configurationPath` | Where the codependix configuration lives. `codependix.config.ts`, then `configuration/codependix.config.ts`, are searched when omitted |
 | `gateTargetName` | Name of the inferred gate target. `codependix-gate` when omitted |
 
-The gate runs the command line under `node --import
-@swc-node/register/esm-register` from the workspace root, so the root must
-resolve `@swc-node/register` and carry a `tsconfig.json` that emits decorator
-metadata — the boundary check boots NestJS containers from their TypeScript
-sources, and constructor injection reads that metadata.
+The gate runs the command line under the `@swc-node/register` hooks, which
+this plugin depends on and registers itself — the workspace does not need to
+install them. The workspace root does need a `tsconfig.json` that emits
+decorator metadata: the hooks read it from the working directory, the
+boundary check boots NestJS containers from their TypeScript sources, and
+constructor injection reads that metadata.
 
 ## Usage
 
-The gate is inferred onto every project except the workspace root, whose
-dependency closure is the whole workspace:
+The gate is inferred onto every project described by a `project.json`,
+except the workspace root, whose dependency closure is the whole workspace. A
+project Nx infers from a `package.json` alone gets no gate until it is given
+a `project.json` as well.
 
 ```bash
 nx run lexico-entities:codependix-gate          # one project
@@ -66,15 +69,20 @@ nx affected -t codependix-gate                  # only what changed
 Each gate runs, from the workspace root:
 
 ```bash
-node --import @swc-node/register/esm-register <@codependix/cli/main> \
+node --import <file URL of @codependix/nx/loader> <@codependix/cli/main> \
   map --directory <workspaceRoot> --config <configurationPath> \
   --check boundaries --projects <project>
 ```
 
-The command line's entry is resolved through `@codependix/cli`'s package
-exports, so the same gate runs the TypeScript source inside this workspace and
-the built `dist/src/main.js` from an installed copy. Its output is streamed to
-the task as it arrives, and the task passes only when it exits zero.
+`@codependix/nx/loader` registers the `@swc-node/register` hooks resolved from
+this plugin's own location. The hook's own `@swc-node/register/esm-register`
+would resolve them from the working directory instead — the consumer's root,
+where a package manager such as pnpm does not expose this plugin's
+dependencies. The loader and the command line's entry are both resolved
+through package exports, so the same gate runs the TypeScript sources inside
+this workspace and the built `dist/` files from an installed copy. Its output
+is streamed to the task as it arrives, and the task passes only when it exits
+zero.
 
 **A dependency's broken boundary is that dependency's gate's business.** The
 graphs are built over the project and everything it depends on, so a cycle
@@ -88,21 +96,76 @@ live in, the project's own `codependix.config.*`, and the codependix command
 line itself — because no judged project depends on the code that decides its
 verdict, a change to that code would otherwise replay every cached pass:
 
-- When `@codependix/cli` is a package of the same workspace, a
-  `{workspaceRoot}/<package>/src/**/*` and `{workspaceRoot}/<package>/package.json`
-  input for it and for every workspace package it reaches through
-  `workspace:` dependencies. File globs rather than `{ "input", "projects" }`
-  inputs, because Nx's affected computation follows `{workspaceRoot}` globs
-  and ignores the latter — so a branch that changes the command line selects
-  every gate.
+- When `@codependix/cli` is a package of the same workspace, two
+  `{workspaceRoot}` inputs for it and for every workspace package it reaches
+  through `workspace:` dependencies: `<package>/package.json` and
+  `<package>/src/**/!(*.test.*|*.spec.*)` — the sources without their tests,
+  so a test-only edit to the command line invalidates no gate beyond that
+  package's own and its dependents'. File globs
+  rather than `{ "input", "projects" }` inputs, because Nx's affected
+  computation follows `{workspaceRoot}` globs and ignores the latter — so a
+  branch that changes the command line's sources selects every gate, and one
+  that changes only its tests does not. The tests are excluded inside the
+  glob rather than by a `!`-prefixed input, which the affected computation
+  ignores.
 - When it is installed from a registry, an `externalDependencies` input naming
   it and the `@codependix/*` packages it depends on, so a version bump
-  invalidates the cache.
-
-If the command line cannot be resolved while the graph is built, those inputs
-are left out rather than failing the graph. The target declares no
-`configurations`, so an aggregator run with `--configuration=check` falls
-through to the defaults.
+  invalidates the cache. Nx hashes an external dependency together with
+  everything it depends on, so the `@codependix/*` packages beneath those are
+  covered too.
+- In either case, `{workspaceRoot}/tsconfig.json` and every tsconfig it
+  `extends`. The loader (`@swc-node/register`) takes its compiler options —
+  `emitDecoratorMetadata` among them, which decides how NestJS sources
+  compile — from `SWC_NODE_PROJECT` or `TS_NODE_PROJECT`, else from the
+  `tsconfig.json` in the gate's working directory, the workspace root, and
+  never from a package's own. That file reaches its bases through `extends`,
+  so inference follows the chain much as TypeScript resolves it — a string
+  or an array, through every level, comments and trailing commas allowed,
+  `.json` appended to a path naming no file, and a bare package name taken
+  to its `tsconfig.json` or its `exports` (not to a `tsconfig` field in its
+  manifest, which is rare):
+  - A base in the workspace, by relative path or through a package of the
+    same workspace, is another `{workspaceRoot}` input. So is one that is
+    missing or cannot be parsed — the edit that fixes it invalidates the
+    gate — though what it would extend cannot be followed, and Nx's logger
+    warns naming it.
+  - A base an installed package provides, such as `@tsconfig/node24` —
+    named by package or by a path into `node_modules` — is named in an
+    `externalDependencies` input, so a version bump invalidates the cache,
+    but only when the root `package.json` declares the package from a
+    registry. Nx fails every task whose `externalDependencies` names a
+    package missing from its graph, so one declared only by another package,
+    or through `workspace:`, `file:`, `link:`, or `portal:`, is skipped with
+    a warning instead: declare it in the root `package.json` to have it
+    hashed.
+  - A base outside the workspace, or a package base that resolves to no file,
+    cannot be named by any input, and is skipped with a warning.
+
+  A `SWC_NODE_PROJECT` or `TS_NODE_PROJECT` pointing elsewhere is not
+  followed: add that file to the target's inputs yourself. Nor does a
+  gitignored base, such as a generated framework tsconfig, invalidate
+  anything: it is named, but Nx's file map leaves ignored files out.
+
+Each workspace package is resolved on its own, through its entry rather than
+its manifest, so one that cannot be resolved costs only its own inputs: Nx's
+logger warns naming it, and every other package keeps its inputs. If the
+command line itself cannot be resolved while the graph is built, the tool
+inputs are left out and the warning names it — never failing the graph. The
+tsconfig chain is resolved apart from the command line, so either failing
+keeps the other's inputs. The
+target declares no `configurations`, so an aggregator run with
+`--configuration=check` falls through to the defaults.
+
+**A gate whose `projects` or `tags` select anything other than its own project
+is never replayed from the cache.** Its inputs cover its own project and that project's dependencies,
+not the projects such a run judges, so a hash built from them could replay a
+pass after an edit to the very project that now fails. The executor's hasher
+gives such a run a hash no other run shares, whether the selection came from
+the command line, the target's options, or a configuration; a gate judging
+only its own project — including one whose `projects` names exactly that
+project — is hashed from its inputs exactly as Nx would hash it. Because
+the target has a hasher, `nx show target inputs` prints a custom-hasher
+warning instead of a file list — the inputs above still decide the hash.
 
 ### Executor options
 
@@ -196,6 +259,9 @@ graph LR
   file_src_executors_gate_executor_ts["src/executors/gate/executor.ts"]
   file_src_executors_gate_executor_types_ts["src/executors/gate/executor.types.ts"]
   file_src_executors_gate_executor_unit_test_ts["src/executors/gate/executor.unit.test.ts"]
+  file_src_executors_gate_hasher_ts["src/executors/gate/hasher.ts"]
+  file_src_executors_gate_hasher_unit_test_ts["src/executors/gate/hasher.unit.test.ts"]
+  file_src_executors_gate_loader_unit_test_ts["src/executors/gate/loader.unit.test.ts"]
   file_src_index_ts["src/index.ts"]
   file_src_index_unit_test_ts["src/index.unit.test.ts"]
   file_src_main_module_ts["src/main.module.ts"]
@@ -208,6 +274,8 @@ graph LR
   file_src_modules_plugin_plugin_context_utilities_unit_test_ts["src/modules/plugin/plugin-context.utilities.unit.test.ts"]
   file_src_modules_plugin_plugin_inputs_utilities_ts["src/modules/plugin/plugin-inputs.utilities.ts"]
   file_src_modules_plugin_plugin_inputs_utilities_unit_test_ts["src/modules/plugin/plugin-inputs.utilities.unit.test.ts"]
+  file_src_modules_plugin_plugin_tsconfig_utilities_ts["src/modules/plugin/plugin-tsconfig.utilities.ts"]
+  file_src_modules_plugin_plugin_tsconfig_utilities_unit_test_ts["src/modules/plugin/plugin-tsconfig.utilities.unit.test.ts"]
   file_src_modules_plugin_plugin_constants_ts["src/modules/plugin/plugin.constants.ts"]
   file_src_modules_plugin_plugin_module_ts["src/modules/plugin/plugin.module.ts"]
   file_src_modules_plugin_plugin_service_ts["src/modules/plugin/plugin.service.ts"]
@@ -224,8 +292,14 @@ graph LR
   file_src_executors_gate_executor_types_ts --> file_src_modules_gate_gate_types_ts
   file_src_executors_gate_executor_unit_test_ts --> file_src_executors_gate_executor_ts
   file_src_executors_gate_executor_unit_test_ts --> file_src_modules_gate_gate_service_ts
+  file_src_executors_gate_hasher_ts --> file_src_modules_gate_gate_types_ts
+  file_src_executors_gate_hasher_ts --> file_src_modules_plugin_plugin_context_utilities_ts
+  file_src_executors_gate_hasher_unit_test_ts --> file_src_executors_gate_hasher_ts
+  file_src_executors_gate_hasher_unit_test_ts --> file_src_modules_gate_gate_service_ts
+  file_src_executors_gate_hasher_unit_test_ts --> file_src_modules_gate_gate_types_ts
   file_src_index_ts --> file_src_modules_plugin_plugin_context_utilities_ts
   file_src_index_ts --> file_src_modules_plugin_plugin_inputs_utilities_ts
+  file_src_index_ts --> file_src_modules_plugin_plugin_tsconfig_utilities_ts
   file_src_index_ts --> file_src_modules_plugin_plugin_constants_ts
   file_src_index_unit_test_ts --> file_src_index_ts
   file_src_index_unit_test_ts --> file_src_modules_plugin_plugin_service_ts
@@ -238,6 +312,7 @@ graph LR
   file_src_modules_gate_gate_service_ts --> file_src_modules_gate_gate_types_ts
   file_src_modules_gate_gate_service_ts --> file_src_modules_plugin_plugin_service_ts
   file_src_modules_gate_gate_service_unit_test_ts --> file_src_modules_gate_gate_service_ts
+  file_src_modules_gate_gate_service_unit_test_ts --> file_src_modules_gate_gate_types_ts
   file_src_modules_gate_gate_service_unit_test_ts --> file_src_modules_plugin_plugin_service_ts
   file_src_modules_plugin_plugin_context_utilities_ts --> file_src_main_module_ts
   file_src_modules_plugin_plugin_context_utilities_ts --> file_src_modules_gate_gate_service_ts
@@ -250,6 +325,12 @@ graph LR
   file_src_modules_plugin_plugin_inputs_utilities_ts --> file_src_modules_plugin_plugin_constants_ts
   file_src_modules_plugin_plugin_inputs_utilities_ts --> file_src_modules_plugin_plugin_types_ts
   file_src_modules_plugin_plugin_inputs_utilities_unit_test_ts --> file_src_modules_plugin_plugin_inputs_utilities_ts
+  file_src_modules_plugin_plugin_inputs_utilities_unit_test_ts --> file_src_modules_plugin_plugin_types_ts
+  file_src_modules_plugin_plugin_tsconfig_utilities_ts --> file_src_modules_plugin_plugin_inputs_utilities_ts
+  file_src_modules_plugin_plugin_tsconfig_utilities_ts --> file_src_modules_plugin_plugin_constants_ts
+  file_src_modules_plugin_plugin_tsconfig_utilities_ts --> file_src_modules_plugin_plugin_types_ts
+  file_src_modules_plugin_plugin_tsconfig_utilities_unit_test_ts --> file_src_modules_plugin_plugin_tsconfig_utilities_ts
+  file_src_modules_plugin_plugin_tsconfig_utilities_unit_test_ts --> file_src_modules_plugin_plugin_types_ts
   file_src_modules_plugin_plugin_module_ts --> file_src_modules_plugin_plugin_service_ts
   file_src_modules_plugin_plugin_service_ts --> file_src_modules_plugin_plugin_constants_ts
   file_src_modules_plugin_plugin_service_ts --> file_src_modules_plugin_plugin_types_ts
@@ -258,42 +339,166 @@ graph LR
 ```
 <!-- codependix:end name="codependix-file-imports" -->
 
+<!-- callidescope:start -->
+
+## 🔭 Callidescope
+
+Call stacks traced through `packages/ic-suite/codependix/codependix-nx`, deepest first. Each frame shows what it takes, what it returns, and what its documentation says.
+
+| Measure | Value |
+| --- | --- |
+| Callables | 77 |
+| Files | 22 |
+| Calls traced | 89 |
+| Call stacks | 3 |
+| Deepest stack | 6 |
+| Stacks through recursion | 0 |
+| Unfollowable calls | 7 |
+
+### Limits
+
+What this project is judged against, as declared in its own `callidescope.config.ts`.
+
+| Limit | Value |
+| --- | --- |
+| `maximumDepth` | 6 |
+| `maximumBreadth` | 5 |
+
+### Call stacks (depth)
+
+**1. `anonymous`** — depth ≥ 6 · orphan-root
+
+```text
+🚀 anonymous(…): Promise<CreateNodesResultArray> [packages/ic-suite/codependix/codependix-nx/src/index.ts:45]
+  └─> resolveToolInputs(args: ResolveToolInputsArguments): InferredInput[] [packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:65]
+     ↳ The cache inputs that tie a gate to the codependix command line it runs.
+    └─> resolveWorkspaceInputs(…): InferredInput[] [packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:209]
+       ↳ Globs over the sources and manifest of the command line and of every workspace package it reaches, sorted so the cache…
+      └─> collectWorkspacePackages(cliDirectory: string): WorkspacePackages [packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:103]
+         ↳ Collects a workspace package and every workspace package it reaches, development dependencies included: a package this…
+        └─> readDependencies(directory: string): [string, unknown][] [packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:41]
+           ↳ Every dependency a package's manifest declares, in either map.
+          └─> readManifest(directory: string): Record<string, unknown> [packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:173]
+             ↳ Reads a package directory's manifest, or an empty one when there is none or it cannot be parsed — which leaves that…
+```
+
+**2. `gateExecutor`** — depth ≥ 6 · orphan-root
+
+```text
+🚀 gateExecutor(…): Promise<{ success: boolean; }> [packages/ic-suite/codependix/codependix-nx/src/executors/gate/executor.ts:21]
+   ↳ Fails one project's task when a codependix boundary finding is charged to it.
+  └─> GateService.run(args: RunGateArguments): Promise<boolean> [packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:287]
+     ↳ Runs one gate, and settles on whether it passed.
+    └─> GateService.resolveConfigurationPath(…): string [packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:241]
+       ↳ Resolves the configuration path one gate runs with.
+      └─> PluginService.readRegisteredOptions(nxConfiguration: unknown): unknown [packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.service.ts:136]
+         ↳ Finds this plugin's own entry in an `nx.json` and returns its options.
+        └─> PluginService.map(…)(entry: unknown): Record<string, unknown> [packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.service.ts:144]
+          └─> PluginService.toRecord(value: unknown): Record<string, unknown> [packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.service.ts:79]
+             ↳ Copies an untrusted value into a record, or an empty one.
+```
+
+**3. `gateHasher`** — depth 6 · orphan-root
+
+```text
+🚀 gateHasher(task: Task, context: GateHasherContext): Promise<Hash> [packages/ic-suite/codependix/codependix-nx/src/executors/gate/hasher.ts:17]
+   ↳ Hashes one gate task for Nx's cache.
+  └─> GateService.hashTask(args: HashGateTaskArguments): Promise<Hash> [packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:215]
+     ↳ Hashes one gate task for Nx's cache — or, when it judges any project but its own, gives it a hash no run shares, so its…
+    └─> GateService.judgesOwnProject(args: HashGateTaskArguments): boolean [packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:55]
+       ↳ Whether a gate task judges exactly the project it belongs to.
+      └─> GateService.resolveSelection(…): GateSelection [packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:266]
+         ↳ Resolves which projects one gate judges.
+        └─> GateService.readNameList(value: readonly string[] | undefined): string[] [packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:81]
+           ↳ Reads a list of names out of an executor's options.
+          └─> GateService.filter(…)(entry: string): boolean [packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:85]
+```
+
+### Breadth
+
+| Callable | Breadth | Calls directly | Location |
+| --- | --- | --- | --- |
+| `resolveToolInputs` | 5 | `locatePackage`, `warnUnresolved`, `isInsideWorkspace`, `resolveWorkspaceInputs`, `resolveExternalInputs` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:65` |
+| `anonymous` | 5 | `resolvePluginService`, `PluginService.inferTargets`, `resolveToolInputs`, `resolveTsconfigInputs`, `flatMap(…)` | `packages/ic-suite/codependix/codependix-nx/src/index.ts:45` |
+| `PluginService.readRegisteredOptions` | 4 | `PluginService.toRecord`, `PluginService.isUnknownArray`, `PluginService.find(…)`, `PluginService.map(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.service.ts:136` |
+
+<details>
+<summary>32 more callables</summary>
+
+| Callable | Breadth | Calls directly | Location |
+| --- | --- | --- | --- |
+| `GateService.run` | 4 | `GateService.buildCommandArguments`, `GateService.resolveSelection`, `GateService.resolveConfigurationPath`, `GateService.spawnCommandLine` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:287` |
+| `collectWorkspacePackages` | 4 | `map(…)`, `filter(…)`, `readDependencies`, `locatePackage` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:103` |
+| `followExtendsChain` | 4 | `readRegistryDependencies`, `readExtends`, `resolveExtendedBase`, `warnSkipped` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-tsconfig.utilities.ts:89` |
+| `resolveExtendedBase` | 4 | `resolvePathBase`, `resolvePackageBase`, `isInsideWorkspace`, `readInstalledPackageName` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-tsconfig.utilities.ts:204` |
+| `PluginService.selectProjectRoots` | 3 | `PluginService.filter(…)`, `PluginService.map(…)`, `PluginService.filter(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.service.ts:65` |
+| `PluginService.inferTargets` | 3 | `PluginService.resolvePluginOptions`, `PluginService.map(…)`, `PluginService.selectProjectRoots` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.service.ts:99` |
+| `PluginService.resolvePluginOptions` | 3 | `PluginService.toRecord`, `PluginService.readString`, `PluginService.find(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.service.ts:158` |
+| `GateService.judgesOwnProject` | 3 | `GateService.readTaskOptions`, `GateService.resolveSelection`, `GateService.toNameList` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:55` |
+| `GateService.readNameList` | 3 | `GateService.filter(…)`, `GateService.map(…)`, `GateService.flatMap(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:81` |
+| `GateService.anonymous` | 3 | `GateService.on(…)`, `GateService.on(…)`, `GateService.on(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:143` |
+| `GateService.resolveConfigurationPath` | 3 | `PluginService.resolvePluginOptions`, `PluginService.readRegisteredOptions`, `GateService.readNxConfiguration` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:241` |
+| `resolveExternalInputs` | 3 | `filter(…)`, `map(…)`, `readDependencies` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:197` |
+| `resolveWorkspaceInputs` | 3 | `collectWorkspacePackages`, `warnUnresolved`, `flatMap(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:209` |
+| `readRegistryDependencies` | 3 | `map(…)`, `filter(…)`, `readDependencies` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-tsconfig.utilities.ts:180` |
+| `readDependencies` | 2 | `readManifest`, `toRecord` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:41` |
+| `resolveTsconfigInputs` | 2 | `followExtendsChain`, `map(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-tsconfig.utilities.ts:42` |
+| `gateExecutor` | 2 | `resolveGateService`, `GateService.run` | `packages/ic-suite/codependix/codependix-nx/src/executors/gate/executor.ts:21` |
+| `gateHasher` | 2 | `resolveGateService`, `GateService.hashTask` | `packages/ic-suite/codependix/codependix-nx/src/executors/gate/hasher.ts:17` |
+| `PluginService.map(…)` | 1 | `PluginService.toRecord` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.service.ts:144` |
+| `GateService.readTaskOptions` | 1 | `GateService.toRecord` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:111` |
+| `GateService.spawnCommandLine` | 1 | `GateService.anonymous` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:139` |
+| `GateService.toNameList` | 1 | `GateService.filter(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:162` |
+| `GateService.hashTask` | 1 | `GateService.judgesOwnProject` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:215` |
+| `GateService.resolveSelection` | 1 | `GateService.readNameList` | `packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.service.ts:266` |
+| `resolveGateService` | 1 | `resolvePluginContext` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-context.utilities.ts:16` |
+| `resolvePluginService` | 1 | `resolvePluginContext` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-context.utilities.ts:23` |
+| `locatePackage` | 1 | `readManifest` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:145` |
+| `flatMap(…)` | 1 | `map(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts:224` |
+| `readExtends` | 1 | `filter(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-tsconfig.utilities.ts:133` |
+| `filter(…)` | 1 | `some(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-tsconfig.utilities.ts:184` |
+| `resolvePackageBase` | 1 | `flatMap(…)` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-tsconfig.utilities.ts:247` |
+| `warnSkipped` | 1 | `describeSkippedBase` | `packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-tsconfig.utilities.ts:291` |
+
+</details>
+<!-- callidescope:end -->
+
 <!-- codometer:start -->
 
 ## ⏲️ Codometer
 
 ### Project
 
-![Lines of Code](https://img.shields.io/badge/Lines_of_Code-2323-22c55e?style=flat-square)
-![Repository Size](https://img.shields.io/badge/Repository_Size-87.65_kB-6b7280?style=flat-square)
+![Lines of Code](https://img.shields.io/badge/Lines_of_Code-3917-22c55e?style=flat-square)
+![Repository Size](https://img.shields.io/badge/Repository_Size-140.31_kB-6b7280?style=flat-square)
 ![Folders](https://img.shields.io/badge/Folders-7-4a4a4a?style=flat-square)
-![Source Files](https://img.shields.io/badge/Source_Files-29-3178c6?style=flat-square)
+![Source Files](https://img.shields.io/badge/Source_Files-35-3178c6?style=flat-square)
 
 ### TypeScript
 
-![TypeScript Files](https://img.shields.io/badge/TypeScript_Files-29-3178c6?style=flat-square)
-![Interfaces](https://img.shields.io/badge/Interfaces-8-0ea5e9?style=flat-square)
+![TypeScript Files](https://img.shields.io/badge/TypeScript_Files-34-3178c6?style=flat-square)
+![Interfaces](https://img.shields.io/badge/Interfaces-14-0ea5e9?style=flat-square)
 ![Generic Declarations](https://img.shields.io/badge/Generic_Declarations-0-0369a1?style=flat-square)
 ![Enums](https://img.shields.io/badge/Enums-0-f97316?style=flat-square)
 ![Decorators](https://img.shields.io/badge/Decorators-5-db2777?style=flat-square)
-![Doc Comments](https://img.shields.io/badge/Doc_Comments-80-6366f1?style=flat-square)
+![Doc Comments](https://img.shields.io/badge/Doc_Comments-119-6366f1?style=flat-square)
 ![Static Methods](https://img.shields.io/badge/Static_Methods-0-166534?style=flat-square)
 
 ### JavaScript
 
-![JavaScript Files](https://img.shields.io/badge/JavaScript_Files-0-f7df1e?style=flat-square)
-![Test Files](https://img.shields.io/badge/Test_Files-7-10b981?style=flat-square)
-![External Packages](https://img.shields.io/badge/External_Packages-13-8b5cf6?style=flat-square)
+![JavaScript Files](https://img.shields.io/badge/JavaScript_Files-1-f7df1e?style=flat-square)
+![Test Files](https://img.shields.io/badge/Test_Files-10-10b981?style=flat-square)
+![External Packages](https://img.shields.io/badge/External_Packages-14-8b5cf6?style=flat-square)
 ![Classes](https://img.shields.io/badge/Classes-5-7c3aed?style=flat-square)
-![Functions](https://img.shields.io/badge/Functions-138-16a34a?style=flat-square)
-![Methods](https://img.shields.io/badge/Methods-30-15803d?style=flat-square)
-![Sync Functions](https://img.shields.io/badge/Sync_Functions-132-4ade80?style=flat-square)
-![Async Functions](https://img.shields.io/badge/Async_Functions-36-059669?style=flat-square)
-![Constants](https://img.shields.io/badge/Constants-75-dc2626?style=flat-square)
-![Imports](https://img.shields.io/badge/Imports-96-0284c7?style=flat-square)
-![Exported Symbols](https://img.shields.io/badge/Exported_Symbols-37-ea580c?style=flat-square)
-![Comments](https://img.shields.io/badge/Comments-125-64748b?style=flat-square)
-![Comment Lines](https://img.shields.io/badge/Comment_Lines-342-475569?style=flat-square)
+![Functions](https://img.shields.io/badge/Functions-208-16a34a?style=flat-square)
+![Methods](https://img.shields.io/badge/Methods-36-15803d?style=flat-square)
+![Sync Functions](https://img.shields.io/badge/Sync_Functions-199-4ade80?style=flat-square)
+![Async Functions](https://img.shields.io/badge/Async_Functions-45-059669?style=flat-square)
+![Constants](https://img.shields.io/badge/Constants-163-dc2626?style=flat-square)
+![Imports](https://img.shields.io/badge/Imports-132-0284c7?style=flat-square)
+![Exported Symbols](https://img.shields.io/badge/Exported_Symbols-53-ea580c?style=flat-square)
+![Comments](https://img.shields.io/badge/Comments-211-64748b?style=flat-square)
+![Comment Lines](https://img.shields.io/badge/Comment_Lines-511-475569?style=flat-square)
 ![TODO Comments](https://img.shields.io/badge/TODO_Comments-0-ca8a04?style=flat-square)
 
 ### Python
@@ -314,16 +519,16 @@ graph LR
 ### JSON
 
 ![JSON Files](https://img.shields.io/badge/JSON_Files-6-a16207?style=flat-square)
-![JSON Lines](https://img.shields.io/badge/JSON_Lines-219-ca8a04?style=flat-square)
-![JSON Objects](https://img.shields.io/badge/JSON_Objects-51-7c3aed?style=flat-square)
+![JSON Lines](https://img.shields.io/badge/JSON_Lines-227-ca8a04?style=flat-square)
+![JSON Objects](https://img.shields.io/badge/JSON_Objects-52-7c3aed?style=flat-square)
 ![JSON Arrays](https://img.shields.io/badge/JSON_Arrays-15-8b5cf6?style=flat-square)
-![JSON Properties](https://img.shields.io/badge/JSON_Properties-143-0284c7?style=flat-square)
-![JSON Strings](https://img.shields.io/badge/JSON_Strings-120-16a34a?style=flat-square)
+![JSON Properties](https://img.shields.io/badge/JSON_Properties-148-0284c7?style=flat-square)
+![JSON Strings](https://img.shields.io/badge/JSON_Strings-126-16a34a?style=flat-square)
 ![JSON Numbers](https://img.shields.io/badge/JSON_Numbers-1-059669?style=flat-square)
 ![JSON Booleans](https://img.shields.io/badge/JSON_Booleans-8-0ea5e9?style=flat-square)
 ![JSON Nulls](https://img.shields.io/badge/JSON_Nulls-0-64748b?style=flat-square)
-![JSON Items](https://img.shields.io/badge/JSON_Items-46-475569?style=flat-square)
-![JSON Nodes](https://img.shields.io/badge/JSON_Nodes-195-dc2626?style=flat-square)
+![JSON Items](https://img.shields.io/badge/JSON_Items-48-475569?style=flat-square)
+![JSON Nodes](https://img.shields.io/badge/JSON_Nodes-202-dc2626?style=flat-square)
 ![JSON Max Depth](https://img.shields.io/badge/JSON_Max_Depth-5-ea580c?style=flat-square)
 
 ### YAML
@@ -409,9 +614,9 @@ graph LR
 ![Command Files](https://img.shields.io/badge/Command_Files-0-16a34a?style=flat-square)
 ![Constants Files](https://img.shields.io/badge/Constants_Files-2-ea580c?style=flat-square)
 ![Types Files](https://img.shields.io/badge/Types_Files-3-db2777?style=flat-square)
-![Utilities Files](https://img.shields.io/badge/Utilities_Files-2-0ea5e9?style=flat-square)
+![Utilities Files](https://img.shields.io/badge/Utilities_Files-3-0ea5e9?style=flat-square)
 ![TypeORM Entities](https://img.shields.io/badge/TypeORM_Entities-0-059669?style=flat-square)
-![Unit Tests](https://img.shields.io/badge/Unit_Tests-6-ca8a04?style=flat-square)
+![Unit Tests](https://img.shields.io/badge/Unit_Tests-9-ca8a04?style=flat-square)
 ![Integration Tests](https://img.shields.io/badge/Integration_Tests-1-7c3aed?style=flat-square)
 ![End To End Tests](https://img.shields.io/badge/End_To_End_Tests-0-0284c7?style=flat-square)
 ![CSS Comment Budget](https://img.shields.io/badge/CSS_Comment_Budget-0-16a34a?style=flat-square)
@@ -449,23 +654,23 @@ graph LR
 ### Markdown
 
 ![Markdown Files](https://img.shields.io/badge/Markdown_Files-2-083fa1?style=flat-square)
-![Markdown Lines](https://img.shields.io/badge/Markdown_Lines-254-1f6feb?style=flat-square)
+![Markdown Lines](https://img.shields.io/badge/Markdown_Lines-178-1f6feb?style=flat-square)
 ![H1](https://img.shields.io/badge/H1-1-7c3aed?style=flat-square)
-![H2](https://img.shields.io/badge/H2-8-8b5cf6?style=flat-square)
-![H3](https://img.shields.io/badge/H3-14-a78bfa?style=flat-square)
+![H2](https://img.shields.io/badge/H2-7-8b5cf6?style=flat-square)
+![H3](https://img.shields.io/badge/H3-11-a78bfa?style=flat-square)
 ![H4](https://img.shields.io/badge/H4-0-c4b5fd?style=flat-square)
 ![H5](https://img.shields.io/badge/H5-0-ddd6fe?style=flat-square)
 ![H6](https://img.shields.io/badge/H6-0-ede9fe?style=flat-square)
-![Paragraphs](https://img.shields.io/badge/Paragraphs-50-64748b?style=flat-square)
+![Paragraphs](https://img.shields.io/badge/Paragraphs-31-64748b?style=flat-square)
 ![Lists](https://img.shields.io/badge/Lists-8-16a34a?style=flat-square)
-![List Items](https://img.shields.io/badge/List_Items-27-22c55e?style=flat-square)
+![List Items](https://img.shields.io/badge/List_Items-20-22c55e?style=flat-square)
 ![Task List Items](https://img.shields.io/badge/Task_List_Items-0-4ade80?style=flat-square)
-![Tables](https://img.shields.io/badge/Tables-2-0284c7?style=flat-square)
-![Table Rows](https://img.shields.io/badge/Table_Rows-10-0ea5e9?style=flat-square)
-![Links](https://img.shields.io/badge/Links-11-059669?style=flat-square)
+![Tables](https://img.shields.io/badge/Tables-0-0284c7?style=flat-square)
+![Table Rows](https://img.shields.io/badge/Table_Rows-0-0ea5e9?style=flat-square)
+![Links](https://img.shields.io/badge/Links-14-059669?style=flat-square)
 ![Images](https://img.shields.io/badge/Images-0-10b981?style=flat-square)
-![Code Blocks](https://img.shields.io/badge/Code_Blocks-11-dc2626?style=flat-square)
-![Inline Code](https://img.shields.io/badge/Inline_Code-89-ef4444?style=flat-square)
+![Code Blocks](https://img.shields.io/badge/Code_Blocks-4-dc2626?style=flat-square)
+![Inline Code](https://img.shields.io/badge/Inline_Code-51-ef4444?style=flat-square)
 ![Block Quotes](https://img.shields.io/badge/Block_Quotes-0-ca8a04?style=flat-square)
 ![Thematic Breaks](https://img.shields.io/badge/Thematic_Breaks-0-a16207?style=flat-square)
 <!-- codometer:end -->

package/dist/{plugin-context.utilities-Bre57JBa.js → plugin-context.utilities-BR1ONpzC.js}

@@ -4,12 +4,22 @@ import { Injectable as t, Module as n } from "@nestjs/common";
 import { existsSync as r, readFileSync as i } from "node:fs";
 import a from "node:path";
 import { spawn as o } from "node:child_process";
-import { createRequire as s } from "node:module";
+import { randomUUID as s } from "node:crypto";
+import { createRequire as c } from "node:module";
+import { pathToFileURL as l } from "node:url";
 //#region \0rolldown/runtime.js
-var c = Object.defineProperty, __name = (e, t) => c(e, "name", {
+var u = Object.defineProperty, __name = (e, t) => u(e, "name", {
 	value: t,
 	configurable: !0
-}), l = "**/{project.json,codependix.config.*}", u = "project.json", d = "{projectRoot}/codependix.config.*", f = "__codependixPluginContext", p = "@codependix/nx", m = "codependix-gate", h = ["codependix.config.ts", "configuration/codependix.config.ts"], g = "@codependix/cli", _ = "workspace:", v = ["package.json", "src/**/*"];
+}), d = "**/{project.json,codependix.config.*}", f = "project.json", p = "{projectRoot}/codependix.config.*", m = "__codependixPluginContext", h = "@codependix/nx", g = "codependix-gate", _ = ["codependix.config.ts", "configuration/codependix.config.ts"], v = "@codependix/cli", y = "workspace:", b = [
+	"file:",
+	"link:",
+	"portal:",
+	y
+], x = ["package.json", "src/**/!(*.test.*|*.spec.*)"], S = "{workspaceRoot}/tsconfig.json", C = "tsconfig.json", w = {
+	outside: "it lies outside the workspace",
+	unresolved: "it resolves to no file"
+};
 //#endregion
 //#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(e, t) {
@@ -25,7 +35,7 @@ function __decorate(e, t, n, r) {
 }
 //#endregion
 //#region packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.service.ts
-var y = class PluginService {
+var T = class PluginService {
 	constructor() {}
 	isUnknownArray(e) {
 		return Array.isArray(e);
@@ -35,7 +45,7 @@ var y = class PluginService {
 		return typeof t == "string" && t !== "" ? t : void 0;
 	}
 	selectProjectRoots(e) {
-		return e.filter((e) => a.basename(e) === u).map((e) => a.dirname(e)).filter((e) => e !== ".");
+		return e.filter((e) => a.basename(e) === f).map((e) => a.dirname(e)).filter((e) => e !== ".");
 	}
 	toRecord(e) {
 		return typeof e == "object" && e ? { ...e } : {};
@@ -46,12 +56,12 @@ var y = class PluginService {
 			options: e.options
 		}), n = { [t.gateTargetName]: {
 			cache: !0,
-			executor: `${p}:gate`,
+			executor: `${h}:gate`,
 			inputs: [
 				"default",
 				"^default",
 				`{workspaceRoot}/${t.configurationPath}`,
-				d,
+				p,
 				...e.toolInputs
 			],
 			options: {}
@@ -70,7 +80,7 @@ var y = class PluginService {
 			configurationPath: this.readString({
 				key: "configurationPath",
 				record: t
-			}) ?? h.find((t) => e.exists(t)) ?? h[0],
+			}) ?? _.find((t) => e.exists(t)) ?? _[0],
 			gateTargetName: this.readString({
 				key: "gateTargetName",
 				record: t
@@ -78,33 +88,51 @@ var y = class PluginService {
 		};
 	}
 };
-y = __decorate([t(), __decorateMetadata("design:paramtypes", [])], y);
+T = __decorate([t(), __decorateMetadata("design:paramtypes", [])], T);
 //#endregion
 //#region packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin.module.ts
-var b = class PluginModule {};
-b = __decorate([n({
+var E = class PluginModule {};
+E = __decorate([n({
 	controllers: [],
-	exports: [y],
+	exports: [T],
 	imports: [],
-	providers: [y]
-})], b);
+	providers: [T]
+})], E);
 //#endregion
 //#region packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.constants.ts
-var x = "@swc-node/register/esm-register", S = "@codependix/cli/main", C = "nx.json", w = class GateService {
+var D = "@codependix/nx/loader", O = "@codependix/cli/main", k = "nx.json", A = class GateService {
 	pluginService;
 	constructor(e) {
 		this.pluginService = e;
 	}
+	judgesOwnProject(e) {
+		let { project: t } = e.task.target, n = this.readTaskOptions(e), r = this.resolveSelection({
+			options: {
+				projects: this.toNameList(n.projects),
+				tags: this.toNameList(n.tags)
+			},
+			projectName: t
+		});
+		return r.tags.length === 0 && r.projects.length === 1 && r.projects[0] === t;
+	}
 	readNameList(e) {
 		return (e ?? []).flatMap((e) => e.split(",")).map((e) => e.trim()).filter((e) => e !== "");
 	}
 	readNxConfiguration(e) {
 		try {
-			return JSON.parse(i(a.join(e, C), "utf8"));
+			return JSON.parse(i(a.join(e, k), "utf8"));
 		} catch {
 			return;
 		}
 	}
+	readTaskOptions(e) {
+		let { configuration: t, project: n, target: r } = e.task.target, i = this.toRecord(e.context.projectsConfigurations.projects[n]?.targets?.[r]), a = this.toRecord(i.configurations);
+		return {
+			...this.toRecord(i.options),
+			...this.toRecord(t === void 0 ? void 0 : a[t]),
+			...e.task.overrides
+		};
+	}
 	async spawnCommandLine(e) {
 		return await new Promise((t, n) => {
 			let r = o(process.execPath, e.argv, {
@@ -120,10 +148,16 @@ var x = "@swc-node/register/esm-register", S = "@codependix/cli/main", C = "nx.j
 			});
 		});
 	}
+	toNameList(e) {
+		return (Array.isArray(e) ? e : [e]).filter((e) => typeof e == "string" || typeof e == "number").map(String);
+	}
+	toRecord(e) {
+		return typeof e == "object" && e ? { ...e } : {};
+	}
 	buildCommandArguments(e) {
 		return [
 			"--import",
-			e.loaderSpecifier,
+			e.loaderUrl,
 			e.cliEntryPath,
 			"map",
 			"--directory",
@@ -137,6 +171,15 @@ var x = "@swc-node/register/esm-register", S = "@codependix/cli/main", C = "nx.j
 			...e.dependencies ? [] : ["--no-dependencies"]
 		];
 	}
+	async hashTask(e) {
+		return this.judgesOwnProject(e) ? await e.context.hasher.hashTask(e.task, e.context.taskGraph, e.context.env ?? process.env) : {
+			details: {
+				command: `${e.task.id} judges projects its inputs do not cover`,
+				nodes: {}
+			},
+			value: s()
+		};
+	}
 	resolveConfigurationPath(e) {
 		return e.configurationPath !== void 0 && e.configurationPath !== "" ? e.configurationPath : this.pluginService.resolvePluginOptions({
 			exists: (t) => r(a.join(e.workspaceRoot, t)),
@@ -158,13 +201,13 @@ var x = "@swc-node/register/esm-register", S = "@codependix/cli/main", C = "nx.j
 	async run(e) {
 		let t = this.buildCommandArguments({
 			...this.resolveSelection(e),
-			cliEntryPath: s(import.meta.url).resolve(S),
+			cliEntryPath: c(import.meta.url).resolve(O),
 			configurationPath: this.resolveConfigurationPath({
 				configurationPath: e.options.configurationPath,
 				workspaceRoot: e.workspaceRoot
 			}),
 			dependencies: e.options.dependencies !== !1,
-			loaderSpecifier: x,
+			loaderUrl: l(c(import.meta.url).resolve(D)).href,
 			workspaceRoot: e.workspaceRoot
 		});
 		return await this.spawnCommandLine({
@@ -173,39 +216,39 @@ var x = "@swc-node/register/esm-register", S = "@codependix/cli/main", C = "nx.j
 		});
 	}
 };
-w = __decorate([t(), __decorateMetadata("design:paramtypes", [y === void 0 ? Object : y])], w);
+A = __decorate([t(), __decorateMetadata("design:paramtypes", [T === void 0 ? Object : T])], A);
 //#endregion
 //#region packages/ic-suite/codependix/codependix-nx/src/modules/gate/gate.module.ts
-var T = class GateModule {};
-T = __decorate([n({
+var j = class GateModule {};
+j = __decorate([n({
 	controllers: [],
-	exports: [w],
-	imports: [b],
-	providers: [w]
-})], T);
+	exports: [A],
+	imports: [E],
+	providers: [A]
+})], j);
 //#endregion
 //#region packages/ic-suite/codependix/codependix-nx/src/main.module.ts
-var E = class MainModule {};
-E = __decorate([n({
+var M = class MainModule {};
+M = __decorate([n({
 	controllers: [],
-	exports: [T, b],
-	imports: [T, b],
+	exports: [j, E],
+	imports: [j, E],
 	providers: []
-})], E);
+})], M);
 //#endregion
 //#region packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-context.utilities.ts
 async function resolveGateService() {
-	return (await resolvePluginContext()).get(w);
+	return (await resolvePluginContext()).get(A);
 }
 async function resolvePluginService() {
-	return (await resolvePluginContext()).get(y);
+	return (await resolvePluginContext()).get(T);
 }
 async function resolvePluginContext() {
 	let t = globalThis;
-	return t[f] ??= e.createApplicationContext(E, {
+	return t[m] ??= e.createApplicationContext(M, {
 		abortOnError: !1,
 		logger: !1
-	}), await t[f];
+	}), await t[m];
 }
 //#endregion
-export { w as a, g as c, l as d, v as f, T as i, p as l, __name as m, resolvePluginService as n, b as o, _ as p, E as r, y as s, resolveGateService as t, m as u };
+export { S as _, A as a, v as c, b as d, C as f, y as g, x as h, j as i, h as l, w as m, resolvePluginService as n, E as o, d as p, M as r, T as s, resolveGateService as t, g as u, __name as v };

package/dist/src/executors/gate/executor.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../plugin-context.utilities-Bre57JBa.js";
+import { t as e } from "../../../plugin-context.utilities-BR1ONpzC.js";
 //#region packages/ic-suite/codependix/codependix-nx/src/executors/gate/executor.ts
 async function gateExecutor(t, n) {
 	return { success: await (await e()).run({

package/dist/src/executors/gate/hasher.d.ts

@@ -0,0 +1,25 @@
+import { Hash } from '@nx/devkit';
+import { HasherContext } from '@nx/devkit';
+import { Task } from '@nx/devkit';
+
+/**
+ * Hashes one gate task for Nx's cache.
+ *
+ * Nx consults an executor's hasher instead of hashing the target's inputs
+ * itself, which is the one place a run's own options can change whether it
+ * is cacheable at all: `cache` is fixed per target, before any option is
+ * read. A gate judging its own project is hashed exactly as Nx would; one
+ * whose `projects` or `tags` select any other project is never replayed.
+ */
+declare function gateHasher(task: Task, context: GateHasherContext): Promise<Hash>;
+export default gateHasher;
+
+/**
+ * What Nx hands an executor's hasher: its declared context, plus the task's
+ * own environment, which it passes without declaring.
+ */
+declare type GateHasherContext = HasherContext & {
+    readonly env?: NodeJS.ProcessEnv | undefined;
+};
+
+export { }

package/dist/src/executors/gate/hasher.js

@@ -0,0 +1,10 @@
+import { t as e } from "../../../plugin-context.utilities-BR1ONpzC.js";
+//#region packages/ic-suite/codependix/codependix-nx/src/executors/gate/hasher.ts
+async function gateHasher(t, n) {
+	return await (await e()).hashTask({
+		context: n,
+		task: t
+	});
+}
+//#endregion
+export { gateHasher as default };

package/dist/src/index.d.ts

@@ -1,4 +1,7 @@
 import { CreateNodes } from '@nx/devkit';
+import { Hash } from '@nx/devkit';
+import { HasherContext } from '@nx/devkit';
+import { Task } from '@nx/devkit';
 
 /** Arguments for building the command line one gate runs. */
 declare interface BuildCommandArguments extends GateSelection {
@@ -6,8 +9,8 @@ declare interface BuildCommandArguments extends GateSelection {
     readonly cliEntryPath: string;
     readonly configurationPath: string;
     readonly dependencies: boolean;
-    /** What `node --import` registers the TypeScript loader from. */
-    readonly loaderSpecifier: string;
+    /** File URL of the module `node --import` registers the loader from. */
+    readonly loaderUrl: string;
     readonly workspaceRoot: string;
 }
 
@@ -38,6 +41,14 @@ export declare interface CodependixPluginOptions {
  */
 export declare const DEFAULT_GATE_TARGET_NAME = "codependix-gate";
 
+/**
+ * What Nx hands an executor's hasher: its declared context, plus the task's
+ * own environment, which it passes without declaring.
+ */
+declare type GateHasherContext = HasherContext & {
+    readonly env?: NodeJS.ProcessEnv | undefined;
+};
+
 /** Provides the run behind the gate executor. */
 export declare class GateModule {
 }
@@ -72,6 +83,14 @@ export declare interface GateSelection {
 export declare class GateService {
     private readonly pluginService;
     constructor(pluginService: PluginService);
+    /**
+     * Whether a gate task judges exactly the project it belongs to.
+     *
+     * Read from the options the executor will actually run with — the target's
+     * own, then the configuration's, then the command line's — through the
+     * same selection the run makes, so the two can never disagree.
+     */
+    private judgesOwnProject;
     /**
      * Reads a list of names out of an executor's options.
      *
@@ -88,6 +107,11 @@ export declare class GateService {
      * conventional paths, which a workspace with no registration gets anyway.
      */
     private readNxConfiguration;
+    /**
+     * The options one gate task runs with, merged as Nx merges them: the
+     * target's, then the named configuration's, then the command line's.
+     */
+    private readTaskOptions;
     /**
      * Starts the command line and settles on whether it exited zero.
      *
@@ -97,6 +121,13 @@ export declare class GateService {
      * verdict was reached, so none may be recorded as a pass.
      */
     private spawnCommandLine;
+    /**
+     * Reads a name list from an untrusted option: a list from configuration,
+     * or the single string, or number, a command line parses it into.
+     */
+    private toNameList;
+    /** Copies an untrusted value into a record, or an empty one. */
+    private toRecord;
     /**
      * Builds the `node` arguments one gate runs.
      *
@@ -106,6 +137,17 @@ export declare class GateService {
      * dependency's own gate rather than every gate downstream of it.
      */
     buildCommandArguments(args: BuildCommandArguments): string[];
+    /**
+     * Hashes one gate task for Nx's cache — or, when it judges any project but
+     * its own, gives it a hash no run shares, so its verdict is never replayed.
+     *
+     * A gate's inputs cover its own project and that project's dependencies.
+     * One handed `projects` or `tags` judges projects those inputs need not
+     * reach, so a hash built from them could replay a pass after an edit to
+     * the very project that now fails. A gate judging its own project is
+     * hashed exactly as Nx would hash it without this hasher.
+     */
+    hashTask(args: HashGateTaskArguments): Promise<Hash>;
     /**
      * Resolves the configuration path one gate runs with.
      *
@@ -134,6 +176,12 @@ export declare class GateService {
     run(args: RunGateArguments): Promise<boolean>;
 }
 
+/** Arguments for hashing one gate task. */
+declare interface HashGateTaskArguments {
+    readonly context: GateHasherContext;
+    readonly task: Task;
+}
+
 /**
  * One cache input of an inferred target: a file glob, or the npm packages an
  * installed command line is versioned by.
@@ -160,7 +208,10 @@ declare interface InferTargetsArguments {
     readonly options: unknown;
     /** Every file Nx matched, workspace-root relative. */
     readonly projectConfigurationFiles: readonly string[];
-    /** The command line's own inputs, from `resolveToolInputs`. */
+    /**
+     * The command line's own inputs and its loader's tsconfig chain, from
+     * `resolveToolInputs` and `resolveTsconfigInputs`.
+     */
     readonly toolInputs: readonly InferredInput[];
     readonly workspaceRoot: string;
 }
@@ -212,8 +263,9 @@ export declare class PluginService {
      * sources through `^default`; the workspace configuration holds the rules,
      * so editing it invalidates every gate; the project's own configuration is
      * the one file only this project's gate reads; and the command line's own
-     * code decides every verdict, through the `toolInputs` the caller resolved
-     * with `resolveToolInputs`. No `configurations` are
+     * code and its loader's tsconfig chain decide every verdict, through the
+     * `toolInputs` the caller resolved with `resolveToolInputs` and
+     * `resolveTsconfigInputs`. No `configurations` are
      * declared, so an aggregator run with `--configuration=check` falls through
      * to the defaults rather than failing for a configuration this target lacks.
      */

package/dist/src/index.js

@@ -1,78 +1,214 @@
-import { a as e, c as t, d as n, f as r, i, l as a, n as o, o as s, p as c, r as l, s as u, t as d, u as f } from "../plugin-context.utilities-Bre57JBa.js";
-import { readFileSync as p, realpathSync as m } from "node:fs";
-import h from "node:path";
-import { createRequire as g } from "node:module";
+import { _ as e, a as t, c as n, d as r, f as i, g as a, h as o, i as s, l as c, m as l, n as u, o as d, p as f, r as p, s as m, t as h, u as g } from "../plugin-context.utilities-BR1ONpzC.js";
+import { existsSync as _, readFileSync as v, realpathSync as y, statSync as b } from "node:fs";
+import x from "node:path";
+import { createRequire as S } from "node:module";
+import { logger as C, readJsonFile as w } from "@nx/devkit";
 //#region packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-inputs.utilities.ts
+function isInsideWorkspace(e) {
+	let t = x.relative(y(e.workspaceRoot), e.directory);
+	return !(t.startsWith("..") || x.isAbsolute(t) || t.split(x.sep).includes("node_modules"));
+}
+function readDependencies(e) {
+	let t = readManifest(e);
+	return Object.entries({
+		...toRecord(t.dependencies),
+		...toRecord(t.devDependencies)
+	});
+}
 function resolveToolInputs(e) {
 	try {
-		let t = locateCommandLine();
-		return toWorkspacePath({
-			directory: t,
-			workspaceRoot: e
-		}) === void 0 ? resolveExternalInputs(t) : resolveWorkspaceInputs({
-			cliDirectory: t,
-			workspaceRoot: e
+		let t = locatePackage({
+			fromFile: e.resolveFrom ?? import.meta.url,
+			name: n
 		});
-	} catch {
-		return [];
+		return t === void 0 ? (warnUnresolved({
+			logger: e.logger,
+			names: [n]
+		}), []) : isInsideWorkspace({
+			directory: t,
+			workspaceRoot: e.workspaceRoot
+		}) ? resolveWorkspaceInputs({
+			...e,
+			cliDirectory: t
+		}) : resolveExternalInputs(t);
+	} catch (t) {
+		return e.logger.warn(`🕸️ Skipped the cache inputs of ${n}, so a change to it will not invalidate a cached codependix gate: ${String(t)}`), [];
 	}
 }
 function collectWorkspacePackages(e) {
-	e.visited.add(e.packageDirectory);
-	let t = readDependencies(e.packageDirectory).filter(([, e]) => String(e).startsWith(c)).map(([t]) => locateDependency({
-		fromDirectory: e.packageDirectory,
-		name: t
-	})).filter((t) => !e.visited.has(t));
-	for (let n of t) collectWorkspacePackages({
-		packageDirectory: n,
-		visited: e.visited
-	});
-	return e.visited;
-}
-function locateCommandLine() {
-	return h.dirname(m(g(import.meta.url).resolve(`${t}/package.json`)));
+	let t = /* @__PURE__ */ new Set([e]), n = /* @__PURE__ */ new Set(), r = [e];
+	for (let e = r.pop(); e !== void 0; e = r.pop()) {
+		let i = readDependencies(e).filter(([, e]) => String(e).startsWith(a)).map(([e]) => e);
+		for (let a of i) {
+			let i = locatePackage({
+				fromFile: x.join(e, "package.json"),
+				name: a
+			});
+			i === void 0 ? n.add(a) : t.has(i) || (t.add(i), r.push(i));
+		}
+	}
+	return {
+		directories: t,
+		unresolved: [...n].toSorted()
+	};
 }
-function locateDependency(e) {
-	return h.dirname(m(g(h.join(e.fromDirectory, "package.json")).resolve(`${e.name}/package.json`)));
+function locatePackage(e) {
+	let t;
+	try {
+		t = x.dirname(y(S(e.fromFile).resolve(e.name)));
+	} catch {
+		return;
+	}
+	for (;; t = x.dirname(t)) {
+		if (readManifest(t).name === e.name) return t;
+		if (x.dirname(t) === t) return;
+	}
 }
-function readDependencies(e) {
-	let t = toRecord(JSON.parse(p(h.join(e, "package.json"), "utf8")));
-	return [...Object.entries(toRecord(t.dependencies)), ...Object.entries(toRecord(t.devDependencies))];
+function readManifest(e) {
+	let t = x.join(e, "package.json");
+	try {
+		let e = _(t) ? JSON.parse(v(t, "utf8")) : void 0;
+		return typeof e == "object" && e ? { ...e } : {};
+	} catch {
+		return {};
+	}
 }
 function resolveExternalInputs(e) {
-	let n = readDependencies(e).map(([e]) => e).filter((e) => e.startsWith("@codependix/"));
-	return [{ externalDependencies: [t, ...n].toSorted() }];
+	let t = readDependencies(e).map(([e]) => e).filter((e) => e.startsWith("@codependix/"));
+	return [{ externalDependencies: [n, ...t].toSorted() }];
 }
 function resolveWorkspaceInputs(e) {
-	let t = m(e.workspaceRoot);
-	return [...collectWorkspacePackages({
-		packageDirectory: e.cliDirectory,
-		visited: /* @__PURE__ */ new Set()
-	})].flatMap((e) => r.map((n) => `{workspaceRoot}/${h.relative(t, e)}/${n}`)).toSorted();
+	let t = y(e.workspaceRoot), { directories: n, unresolved: r } = collectWorkspacePackages(e.cliDirectory);
+	return r.length > 0 && warnUnresolved({
+		logger: e.logger,
+		names: r
+	}), [...n].flatMap((e) => o.map((n) => `{workspaceRoot}/${x.relative(t, e)}/${n}`)).toSorted();
 }
 function toRecord(e) {
 	return typeof e == "object" && e ? { ...e } : {};
 }
-function toWorkspacePath(e) {
-	let t = h.relative(m(e.workspaceRoot), e.directory);
-	return t.startsWith("..") || h.isAbsolute(t) || t.split(h.sep).includes("node_modules") ? void 0 : t;
+function warnUnresolved(e) {
+	e.logger.warn(`🕸️ Skipped the cache inputs of ${e.names.join(", ")}, which could not be resolved, so a change to ${e.names.length === 1 ? "it" : "them"} will not invalidate a cached codependix gate.`);
+}
+//#endregion
+//#region packages/ic-suite/codependix/codependix-nx/src/modules/plugin/plugin-tsconfig.utilities.ts
+function resolveTsconfigInputs(t) {
+	try {
+		let e = y(t.workspaceRoot), { files: n, packages: r } = followExtendsChain({
+			logger: t.logger,
+			workspaceRoot: e
+		}), i = [...n].map((t) => `{workspaceRoot}/${x.relative(e, t).split(x.sep).join("/")}`).toSorted();
+		return r.size === 0 ? i : [...i, { externalDependencies: [...r].toSorted() }];
+	} catch (n) {
+		return t.logger.warn(`🕸️ Skipped following the bases the root tsconfig.json extends, so a change to one will not invalidate a cached codependix gate: ${String(n)}`), [e];
+	}
+}
+function describeSkippedBase(e) {
+	return e.kind === "undeclared" ? `the root package.json does not declare ${e.name} from a registry` : l[e.kind];
+}
+function followExtendsChain(e) {
+	let t = x.join(e.workspaceRoot, "tsconfig.json"), n = readRegistryDependencies(e.workspaceRoot), r = /* @__PURE__ */ new Set([t]), i = /* @__PURE__ */ new Set(), a = _(t) ? [t] : [];
+	for (let t = a.pop(); t !== void 0; t = a.pop()) for (let o of readExtends({
+		...e,
+		file: t
+	})) {
+		let s = resolveExtendedBase({
+			...e,
+			declared: n,
+			file: t,
+			specifier: o
+		});
+		s.kind === "file" ? r.has(s.file) || (r.add(s.file), a.push(s.file)) : s.kind === "package" ? i.add(s.name) : warnSkipped({
+			...e,
+			base: s,
+			file: t,
+			specifier: o
+		});
+	}
+	return {
+		files: r,
+		packages: i
+	};
+}
+function readExtends(e) {
+	try {
+		return [w(e.file, { expectComments: !0 }).extends].flat().filter((e) => typeof e == "string");
+	} catch (t) {
+		return e.logger.warn(`🕸️ Skipped the bases ${x.relative(e.workspaceRoot, e.file)} extends, which could not be read, so a change to one will not invalidate a cached codependix gate: ${String(t)}`), [];
+	}
+}
+function readInstalledPackageName(e) {
+	let t = e.split(x.sep), n = t.lastIndexOf("node_modules") + 1, r = t[n];
+	if (n !== 0 && r !== void 0) return t.slice(n, r.startsWith("@") ? n + 2 : n + 1).join("/");
+}
+function readRegistryDependencies(e) {
+	return new Set(readDependencies(e).filter(([, e]) => !r.some((t) => String(e).startsWith(t))).map(([e]) => e));
+}
+function resolveExtendedBase(e) {
+	let t = e.specifier.replaceAll("\\", "/"), n = x.isAbsolute(t) || t.startsWith("./") || t.startsWith("../") ? resolvePathBase({
+		file: e.file,
+		specifier: t
+	}) : resolvePackageBase({
+		file: e.file,
+		specifier: t
+	});
+	if (n === void 0) return { kind: "unresolved" };
+	if (isInsideWorkspace({
+		directory: n,
+		workspaceRoot: e.workspaceRoot
+	})) return {
+		file: n,
+		kind: "file"
+	};
+	let r = readInstalledPackageName(n);
+	return r === void 0 ? { kind: "outside" } : e.declared.has(r) ? {
+		kind: "package",
+		name: r
+	} : {
+		kind: "undeclared",
+		name: r
+	};
+}
+function resolvePackageBase(e) {
+	let { specifier: t } = e, n = t.split("/").length > (t.startsWith("@") ? 2 : 1) ? [t, `${t}.json`] : [`${t}/${i}`, t], r = S(e.file), [a] = n.flatMap((e) => {
+		try {
+			let t = y(r.resolve(e));
+			return t.endsWith(".json") ? [t] : [];
+		} catch {
+			return [];
+		}
+	});
+	return a;
+}
+function resolvePathBase(e) {
+	let t = x.resolve(x.dirname(e.file), e.specifier), n = b(t, { throwIfNoEntry: !1 })?.isFile() === !0 || t.endsWith(".json") ? t : `${t}.json`;
+	return _(n) ? y(n) : n;
+}
+function warnSkipped(e) {
+	e.logger.warn(`🕸️ Skipped the cache input of ${e.specifier}, which ${x.relative(e.workspaceRoot, e.file)} extends, because ${describeSkippedBase(e.base)}, so a change to it will not invalidate a cached codependix gate.`);
 }
 //#endregion
 //#region packages/ic-suite/codependix/codependix-nx/src/index.ts
-var _ = {
-	createNodes: [n, async (e, t, n) => {
-		let r = (await o()).inferTargets({
+var T = {
+	createNodes: [f, async (e, t, n) => {
+		let r = (await u()).inferTargets({
 			options: t,
 			projectConfigurationFiles: e,
-			toolInputs: resolveToolInputs(n.workspaceRoot),
+			toolInputs: [...resolveToolInputs({
+				logger: C,
+				workspaceRoot: n.workspaceRoot
+			}), ...resolveTsconfigInputs({
+				logger: C,
+				workspaceRoot: n.workspaceRoot
+			})],
 			workspaceRoot: n.workspaceRoot
 		});
-		return e.map((e) => {
-			let t = h.dirname(e), n = r.get(t);
-			return [e, n === void 0 ? {} : { projects: { [t]: { targets: n } } }];
-		}).filter(([, e]) => Object.keys(e).length > 0);
+		return e.flatMap((e) => {
+			let t = x.dirname(e), n = r.get(t);
+			return n === void 0 ? [] : [[e, { projects: { [t]: { targets: n } } }]];
+		});
 	}],
 	name: "@codependix/nx"
 };
 //#endregion
-export { a as CODEPENDIX_NX_PLUGIN_NAME, f as DEFAULT_GATE_TARGET_NAME, i as GateModule, e as GateService, l as MainModule, s as PluginModule, u as PluginService, _ as default, d as resolveGateService, o as resolvePluginService };
+export { c as CODEPENDIX_NX_PLUGIN_NAME, g as DEFAULT_GATE_TARGET_NAME, s as GateModule, t as GateService, p as MainModule, d as PluginModule, m as PluginService, T as default, h as resolveGateService, u as resolvePluginService };

package/executors.json

@@ -3,7 +3,8 @@
   "executors": {
     "gate": {
       "description": "Fail a project whose dependency graphs break a codependix boundary rule charged to it, built over the project and its Nx dependencies.",
-      "implementation": "./src/executors/gate/executor",
+      "hasher": "@codependix/nx/src/executors/gate/hasher",
+      "implementation": "@codependix/nx/src/executors/gate/executor",
       "schema": "./src/executors/gate/schema.json"
     }
   }

package/package.json

@@ -4,7 +4,7 @@
     "url": "https://github.com/organizzolini/codebase/issues"
   },
   "dependencies": {
-    "@codependix/cli": "0.0.16",
+    "@codependix/cli": "0.0.18",
     "@nestjs/common": "^11.1.21 || ^12.0.1",
     "@nestjs/core": "^11.1.21 || ^12.0.1",
     "@nx/devkit": "^23.0.0",
@@ -30,6 +30,7 @@
       "default": "./dist/src/index.js"
     },
     "./executors.json": "./executors.json",
+    "./loader": "./src/executors/gate/loader.mjs",
     "./package.json": "./package.json",
     "./src/executors/*": "./dist/src/executors/*.js"
   },
@@ -38,7 +39,9 @@
     "dist",
     "executors.json",
     "LICENSE",
-    "README.md"
+    "README.md",
+    "src/executors/*/schema.json",
+    "src/executors/gate/loader.mjs"
   ],
   "homepage": "https://github.com/organizzolini/codebase/tree/main/packages/ic-suite/codependix/codependix-nx#readme",
   "keywords": [
@@ -55,6 +58,9 @@
   "nx": {
     "executors": "./executors.json"
   },
+  "peerDependencies": {
+    "typescript": "^6.0.3"
+  },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
@@ -70,5 +76,5 @@
     "strict": true
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.0.1"
+  "version": "0.0.3"
 }

package/src/executors/gate/loader.mjs

@@ -0,0 +1,20 @@
+// Registers the `@swc-node/register` hooks the codependix command line runs
+// under, resolved from this plugin's own dependencies. The gate hands
+// `node --import` this module's file URL.
+
+// The hook's own `@swc-node/register/esm-register` cannot stand in for it:
+// that registers `@swc-node/register/esm` relative to the working directory —
+// the consumer's workspace root, which need not have the hook installed, and
+// under pnpm cannot see this plugin's copy of it. Resolving from this module's
+// URL reaches the copy this plugin depends on wherever it is installed. The
+// hooks still read `tsconfig.json` from the working directory.
+
+// `module.register` is deprecated (DEP0205) in favor of `module.registerHooks`,
+// which runs synchronous hooks in-thread and so cannot run swc's asynchronous
+// ones: there is no replacement to move to. This file is JavaScript, shipped
+// as written, so the type-aware `no-deprecated` lint never reads the call. If
+// a Node release removes `register`, every gate fails loudly rather than
+// passing. Node 26 prints DEP0205 on each gate's child process.
+import { register } from "node:module";
+
+register("@swc-node/register/esm", import.meta.url);

package/src/executors/gate/schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "description": "Fail a project whose dependency graphs break a codependix boundary rule charged to it, built over the project and its Nx dependencies.",
+  "properties": {
+    "configurationPath": {
+      "description": "Path to the codependix configuration file, relative to the workspace root. The path this plugin is registered with in nx.json when omitted.",
+      "type": "string"
+    },
+    "dependencies": {
+      "default": true,
+      "description": "Build the graphs over the judged projects' Nx dependency closure. False builds over the judged projects alone.",
+      "type": "boolean"
+    },
+    "projects": {
+      "description": "Nx project names to judge, replacing the project this target belongs to.",
+      "items": { "type": "string" },
+      "type": "array"
+    },
+    "tags": {
+      "description": "Nx project tags to judge, selecting every project carrying ANY of them.",
+      "items": { "type": "string" },
+      "type": "array"
+    }
+  },
+  "required": [],
+  "title": "Codependix gate",
+  "type": "object"
+}