@depup/nx 23.1.3-depup.0 → 23.2.0-depup.0

package/dist/src/utils/git-utils.js

@@ -1,25 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GitRepository = void 0;
+exports.GIT_SHA = exports.GitRepository = void 0;
 exports.cloneFromUpstream = cloneFromUpstream;
 exports.parseVcsRemoteUrl = parseVcsRemoteUrl;
+exports.locateGitDir = locateGitDir;
 exports.getVcsRemoteInfo = getVcsRemoteInfo;
 exports.getGitRootPath = getGitRootPath;
 exports.getGitRootRelativePath = getGitRootRelativePath;
 exports.isShallowRepository = isShallowRepository;
 exports.getFirstCommitSha = getFirstCommitSha;
 exports.isGitRepository = isGitRepository;
+exports.getGitRepositoryStatus = getGitRepositoryStatus;
+exports.getGitCurrentBranch = getGitCurrentBranch;
+exports.getGitRemoteNames = getGitRemoteNames;
+exports.getWorkingTreeStatus = getWorkingTreeStatus;
 exports.hasUncommittedChanges = hasUncommittedChanges;
+exports.getPathCommitExposure = getPathCommitExposure;
 exports.getUncommittedChangesSnapshot = getUncommittedChangesSnapshot;
 exports.commitChanges = commitChanges;
 exports.tryCommitChanges = tryCommitChanges;
 exports.getLatestCommitSha = getLatestCommitSha;
+exports.isAncestorCommit = isAncestorCommit;
 const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
 const crypto = tslib_1.__importStar(require("crypto"));
 const fs = tslib_1.__importStar(require("fs"));
 const path_1 = require("path");
-const logger_1 = require("./logger");
+const owned_private_dir_1 = require("./owned-private-dir");
 function execFileAsync(file, args, execOptions) {
     return new Promise((res, rej) => {
         (0, child_process_1.execFile)(file, args, { ...execOptions, windowsHide: true }, (err, stdout) => {
@@ -253,7 +260,239 @@ function parseVcsRemoteUrl(url) {
     }
     return null;
 }
+/**
+ * Where `directory`'s repository keeps its working root and its shared config.
+ *
+ * Walking up for `.git` is what lets the caller answer "which repo, and where
+ * am I inside it" without spawning git. It also reports the root as the caller
+ * referred to it, where `git rev-parse --show-toplevel` reports the realpath —
+ * relevant wherever a path crosses a symlink, macOS's /tmp being the common
+ * case.
+ *
+ * A linked worktree and a submodule both have `.git` as a FILE holding
+ * `gitdir: <path>`, and their remotes live in the shared common dir rather than
+ * in that per-worktree gitdir, which `commondir` names when it is not the
+ * gitdir itself.
+ */
+/**
+ * Contents of `path`, or null unless it is a regular file belonging to us.
+ *
+ * Three flags carry three separate guarantees, and the read needs all of them:
+ * `O_NOFOLLOW` refuses a symlink, keeping the read inside the repository;
+ * `O_NONBLOCK` stops a FIFO blocking the open forever, which at module scope of
+ * `cache-directory.ts` would hang every command in the workspace before it
+ * printed anything; and taking the type and owner from `fstat` on the
+ * descriptor that is then read leaves no window for the path to be swapped
+ * between the check and the read.
+ */
+function readOwnedFileSync(path) {
+    let fd;
+    try {
+        fd = fs.openSync(path, fs.constants.O_RDONLY |
+            (fs.constants.O_NOFOLLOW ?? 0) |
+            (fs.constants.O_NONBLOCK ?? 0));
+        const stats = fs.fstatSync(fd);
+        if (!stats.isFile() ||
+            (typeof process.getuid === 'function' && stats.uid !== process.getuid())) {
+            return null;
+        }
+        return fs.readFileSync(fd, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch { }
+        }
+    }
+}
+function locateGitDir(directory) {
+    let current = (0, path_1.resolve)(directory);
+    // Terminates at the filesystem root, where `dirname` is a fixed point.
+    while ((0, path_1.dirname)(current) !== current) {
+        const located = gitDirAt(current);
+        if (located !== undefined) {
+            return located;
+        }
+        current = (0, path_1.dirname)(current);
+    }
+    // The root itself: check it directly rather than walking past it.
+    return gitDirAt(current) ?? null;
+}
+/**
+ * The repository whose working root is `directory`, or:
+ *
+ * - `null` when a `.git` is there but is not one we will read, which ends the
+ *   walk rather than continuing past it -- git would not look further either.
+ * - `undefined` when there is no `.git` there at all, so the caller keeps
+ *   walking up.
+ */
+function gitDirAt(directory) {
+    const dotGit = (0, path_1.join)(directory, '.git');
+    let entry;
+    try {
+        entry = fs.statSync(dotGit);
+    }
+    catch {
+        return undefined;
+    }
+    if (entry.isDirectory()) {
+        // A directory named `.git` is not a repository. Git checks this before
+        // reading config, and asking git is what this function replaced -- so
+        // without it a `.git` planted in any writable ancestor (`/tmp` is 1777)
+        // decides the workspace identity for everything beneath it.
+        if (!fs.existsSync((0, path_1.join)(dotGit, 'HEAD')) ||
+            !fs.existsSync((0, path_1.join)(dotGit, 'objects'))) {
+            return null;
+        }
+        // Shape says it is a repository; ownership says it is ours. A real
+        // repository belonging to another user passes the check above, and git
+        // refuses exactly that (`safe.directory`, CVE-2022-24765). `lstat`
+        // inside also refuses a symlink standing in for `.git`.
+        return (0, owned_private_dir_1.isOwnedRealDirectory)(dotGit)
+            ? { gitRoot: directory, commonDir: dotGit }
+            : null;
+    }
+    if (entry.isFile()) {
+        const pointer = readOwnedFileSync(dotGit)?.match(/^gitdir:\s*(.+)$/m);
+        if (!pointer) {
+            return null;
+        }
+        const gitDir = (0, path_1.resolve)(directory, pointer[1].trim());
+        // No commondir file: the gitdir is its own common dir.
+        const shared = readOwnedFileSync((0, path_1.join)(gitDir, 'commondir'))?.trim();
+        const commonDir = shared ? (0, path_1.resolve)(gitDir, shared) : gitDir;
+        // `gitdir:` and `commondir` are paths taken from file contents, so this
+        // branch can be pointed anywhere; the directory checks above apply to it
+        // just as much.
+        return (0, owned_private_dir_1.isOwnedRealDirectory)(commonDir)
+            ? { gitRoot: directory, commonDir }
+            : null;
+    }
+    return undefined;
+}
+/**
+ * Remote name -> url from a git config file, or null when this parser cannot
+ * answer for the whole file.
+ *
+ * Null on `include`/`includeIf` specifically: git resolves those by reading
+ * other files, so a remote could live somewhere this does not look, and
+ * answering from a partial view would be worse than paying for git.
+ */
+function parseGitConfigRemotes(contents) {
+    const remotes = {};
+    let remoteName = null;
+    for (const rawLine of contents.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';')) {
+            continue;
+        }
+        if (line.startsWith('[')) {
+            const close = line.indexOf(']');
+            const section = (close === -1 ? line.slice(1) : line.slice(1, close)).trim();
+            if (/^include(If)?\b/i.test(section)) {
+                return null;
+            }
+            // `git remote -v` prints the rewritten url; resolving `insteadOf` here
+            // would mean reimplementing the longest-prefix match, so defer instead.
+            // A rewrite in the *global* config stays an accepted divergence: this
+            // parser deliberately never opens `~/.gitconfig`.
+            if (/^url\s+"/i.test(section)) {
+                return null;
+            }
+            const named = section.match(/^remote\s+"(.*)"$/i);
+            remoteName = named ? named[1] : null;
+            continue;
+        }
+        if (!remoteName) {
+            continue;
+        }
+        const equals = line.indexOf('=');
+        if (equals === -1) {
+            continue;
+        }
+        if (line.slice(0, equals).trim().toLowerCase() !== 'url') {
+            continue;
+        }
+        const raw = line.slice(equals + 1).trim();
+        // Git ends a value at an unquoted `#`/`;` and honours `\` escapes. Both are
+        // enough to change the url, and reimplementing them is how a parser starts
+        // answering confidently wrong, so hand the file to git when either appears.
+        if (/[#;\\]/.test(raw)) {
+            return null;
+        }
+        const value = raw.replace(/^"(.*)"$/, '$1');
+        if (value.includes('"')) {
+            return null;
+        }
+        // `remote.<name>.url` is multi-valued and git fetches from the first, so
+        // taking the first here matches it.
+        if (remotes[remoteName] === undefined) {
+            remotes[remoteName] = value;
+        }
+    }
+    return remotes;
+}
+/** `origin`, then `upstream`, then `base`, then whichever came first. */
+function selectRemote(found, first) {
+    for (const remote of ['origin', 'upstream', 'base']) {
+        if (found[remote]) {
+            return found[remote];
+        }
+    }
+    return first;
+}
+/**
+ * The remote read straight from `.git/config`, or null when that cannot settle
+ * it and git itself has to be asked.
+ *
+ * Worth having because this runs on the import path of every Nx process:
+ * `cacheDir` is resolved at module scope, which reaches the repo identity, and
+ * `git remote -v` spawns a shell and git to answer a question a file read
+ * answers in microseconds.
+ */
+function remoteInfoFromGitConfig(directory) {
+    try {
+        const located = locateGitDir(directory);
+        if (!located) {
+            return null;
+        }
+        const contents = readOwnedFileSync((0, path_1.join)(located.commonDir, 'config'));
+        if (contents === null) {
+            return null;
+        }
+        const remotes = parseGitConfigRemotes(contents);
+        if (!remotes) {
+            return null;
+        }
+        const found = {};
+        let first = null;
+        for (const [name, url] of Object.entries(remotes)) {
+            const info = parseVcsRemoteUrl(url);
+            if (info && !found[name]) {
+                found[name] = info;
+                first ??= info;
+            }
+        }
+        return selectRemote(found, first);
+    }
+    catch {
+        return null;
+    }
+}
 function getVcsRemoteInfo(directory) {
+    const fromConfig = remoteInfoFromGitConfig(directory ?? process.cwd());
+    if (fromConfig) {
+        return fromConfig;
+    }
+    // Reached when there is no readable config, no remote in it, or an `include`
+    // this parser will not follow. Note for anyone running a spec that asserts no
+    // subprocess: a repository with no remote at all lands here every time, so
+    // the shell-out is on the failure path rather than gone.
     try {
         const gitRemote = (0, child_process_1.execSync)('git remote -v', {
             stdio: 'pipe',
@@ -266,7 +505,6 @@ function getVcsRemoteInfo(directory) {
             return null;
         }
         const lines = gitRemote.split('\n').filter((line) => line.trim());
-        const remotesPriority = ['origin', 'upstream', 'base'];
         const foundRemotes = {};
         let firstRemote = null;
         for (const line of lines) {
@@ -282,20 +520,20 @@ function getVcsRemoteInfo(directory) {
                 }
             }
         }
-        // Return high-priority remote if found
-        for (const remote of remotesPriority) {
-            if (foundRemotes[remote]) {
-                return foundRemotes[remote];
-            }
-        }
-        // Return first found remote
-        return firstRemote;
+        return selectRemote(foundRemotes, firstRemote);
     }
     catch (e) {
         return null;
     }
 }
 function getGitRootPath(cwd) {
+    const located = locateGitDir(cwd ?? process.cwd());
+    if (located) {
+        return located.gitRoot;
+    }
+    // Outside a repository this throws, which is what `getGitRootRelativePath`
+    // turns into null. Kept as the fallback rather than the primary so the common
+    // case pays no subprocess.
     return (0, child_process_1.execFileSync)('git', ['rev-parse', '--show-toplevel'], {
         cwd,
         windowsHide: true,
@@ -367,21 +605,134 @@ function isGitRepository(directory) {
         return false;
     }
 }
+/**
+ * Like `isGitRepository`, but separates "this is not a git repository" from
+ * "the probe itself failed" (git not installed, permissions). Callers gating
+ * destructive or unverifiable behavior on the answer must fail closed on
+ * 'unknown' instead of reading a broken probe as a missing repository.
+ */
+function getGitRepositoryStatus(directory) {
+    try {
+        (0, child_process_1.execSync)('git rev-parse --is-inside-work-tree', {
+            stdio: 'pipe',
+            cwd: directory,
+            windowsHide: true,
+            // Force untranslated messages; the classification matches on the
+            // English "not a git repository".
+            env: { ...process.env, LC_ALL: 'C' },
+        });
+        return 'git';
+    }
+    catch (err) {
+        const stderr = err?.stderr?.toString() ?? '';
+        return /not a git repository/i.test(stderr) ? 'not-git' : 'unknown';
+    }
+}
+// Checked-out branch name, or null when there isn't one to act on: a detached
+// HEAD reports the literal "HEAD" (treated as no branch), and any git error
+// (not a repo, no commits yet) also yields null.
+function getGitCurrentBranch(directory) {
+    try {
+        const branch = (0, child_process_1.execSync)('git rev-parse --abbrev-ref HEAD', {
+            encoding: 'utf8',
+            cwd: directory,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        }).trim();
+        return branch && branch !== 'HEAD' ? branch : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Names of the remotes configured in the repository, empty when there are
+// none or the probe itself failed.
+function getGitRemoteNames(directory) {
+    try {
+        return (0, child_process_1.execSync)('git remote', {
+            encoding: 'utf8',
+            cwd: directory,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        })
+            .split('\n')
+            .map((name) => name.trim())
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+// Tri-state working-tree probe: 'unknown' means the probe itself failed (git
+// missing, spawn failure, permissions), not that the tree is clean. Callers
+// that gate destructive actions on tree cleanliness must treat 'unknown' as
+// unsafe rather than clean.
+// `excludePaths` are left out of the probe the way `tryCommitChanges` leaves
+// them out of the commit, so a tree dirty only under them reads as clean. An
+// exclude-only pathspec still covers the whole tree, matching `git add -A`.
+function getWorkingTreeStatus(directory, excludePaths = []) {
+    const pathspecs = excludePaths
+        .map((excludePath) => ` ":(exclude)${excludePath}"`)
+        .join('');
+    try {
+        const out = (0, child_process_1.execSync)(`git status --porcelain${pathspecs ? ` --${pathspecs}` : ''}`, {
+            encoding: 'utf8',
+            cwd: directory,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        return out.trim() === '' ? 'clean' : 'dirty';
+    }
+    catch {
+        return 'unknown';
+    }
+}
 // Sync companion to `GitRepository.hasUncommittedChanges` for callers that
-// can't drop into the async class (e.g. the migrate orchestrator, which
-// branches on this before spawning subprocesses synchronously).
-function hasUncommittedChanges(directory) {
+// can't drop into the async class. A failed probe reads as false; callers for
+// whom that tolerance is unsafe use `getWorkingTreeStatus` instead.
+function hasUncommittedChanges(directory, excludePaths = []) {
+    return getWorkingTreeStatus(directory, excludePaths) === 'dirty';
+}
+// Classifies whether `git add -A` commits made in `directory` can sweep in
+// the directory at `dirPath`. Tracked files stay committable no matter what
+// the ignore rules say (ignore rules never apply to tracked files), so
+// `git ls-files` decides 'tracked' first; `git check-ignore` then splits the
+// untracked remainder into 'ignored' (covered) vs 'unignored' (no
+// coverage). 'unknown' means the probe itself failed (not a git repository,
+// git missing); callers gating destructive behavior on the result must
+// treat it as unsafe.
+function getPathCommitExposure(dirPath, directory) {
     try {
-        const out = (0, child_process_1.execSync)('git status --porcelain', {
+        const tracked = (0, child_process_1.execSync)(`git ls-files -- ${dirPath}`, {
             encoding: 'utf8',
             cwd: directory,
             stdio: ['ignore', 'pipe', 'pipe'],
             windowsHide: true,
         });
-        return out.trim() !== '';
+        if (tracked.trim() !== '') {
+            return 'tracked';
+        }
     }
     catch {
-        return false;
+        return 'unknown';
+    }
+    // Query with a trailing slash so git treats the path as a directory even
+    // when it does not exist on disk yet: a directory-only ignore rule (a
+    // trailing-slash .gitignore entry) does not match a bare query for an
+    // absent path, which would misreport covered workspaces as unignored.
+    const asDir = dirPath.endsWith('/') ? dirPath : `${dirPath}/`;
+    try {
+        (0, child_process_1.execSync)(`git check-ignore -q -- ${asDir}`, {
+            cwd: directory,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        return 'ignored';
+    }
+    catch (e) {
+        // check-ignore exits 1 for "not ignored"; anything else is a probe
+        // failure.
+        return e?.status === 1 ? 'unignored' : 'unknown';
     }
 }
 // Returns a content-sensitive sha1 snapshot of the working tree state for
@@ -466,7 +817,12 @@ function commitChanges(commitMessage, directory) {
             // We don't want to throw during create-nx-workspace
             // because maybe there was an error when setting up git
             // initially.
-            logger_1.logger.verbose(`Git may not be set up correctly for this new workspace.
+            // Required here, not imported: `logger` reaches `daemon/*`, and this
+            // module is on the import path of `cache-directory`, whose bindings
+            // `daemon/tmp-dir.ts` reads at module scope. A static import would make
+            // that a cycle. This is the only logger use in the file.
+            const { logger } = require('./logger');
+            logger.verbose(`Git may not be set up correctly for this new workspace.
         ${err}`);
         }
         else {
@@ -485,8 +841,13 @@ function commitChanges(commitMessage, directory) {
  * Returns `null` (rather than throwing) when the commit itself succeeded
  * but `git rev-parse HEAD` failed transiently — by contract the diff is
  * no longer in the working tree, so callers must NOT report it as such.
+ *
+ * `excludePaths` are `directory`-relative paths the commit must not capture,
+ * whatever the ignore rules say. Their working-tree files are left intact;
+ * only their index entries are put back to HEAD's state. Paths come from
+ * callers' own constants, never from user input.
  */
-function tryCommitChanges(commitMessage, directory) {
+function tryCommitChanges(commitMessage, directory, excludePaths = []) {
     try {
         (0, child_process_1.execSync)('git add -A', {
             encoding: 'utf8',
@@ -494,6 +855,20 @@ function tryCommitChanges(commitMessage, directory) {
             cwd: directory,
             windowsHide: true,
         });
+        // Exclusion happens as an unstage rather than an add-time pathspec:
+        // `git add` refuses a pathspec naming an ignored directory (exit 1) even
+        // as an exclusion, and an add-time pathspec cannot cover entries that
+        // were already staged before this call. The reset is relative to cwd, so
+        // a workspace nested inside a larger repo excludes its own path; a path
+        // with no index entry is a quiet no-op, unborn HEAD included.
+        for (const excludePath of excludePaths) {
+            (0, child_process_1.execSync)(`git reset -q -- "${excludePath}"`, {
+                encoding: 'utf8',
+                stdio: 'pipe',
+                cwd: directory,
+                windowsHide: true,
+            });
+        }
         (0, child_process_1.execSync)('git commit --no-verify -F -', {
             encoding: 'utf8',
             stdio: 'pipe',
@@ -528,3 +903,31 @@ function getLatestCommitSha(directory) {
         return null;
     }
 }
+/**
+ * The shape of a recorded `git rev-parse` output: 40 hex chars, or 64 in a
+ * sha256 repository. Anything a caller persists and later interpolates into a
+ * command line has to be checked against this first.
+ */
+exports.GIT_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
+/**
+ * Whether `ancestor` is reachable from `descendant`, i.e. resetting to
+ * `descendant` keeps `ancestor` in history. Returns false when the answer
+ * cannot be established (invalid input, not a repository, unknown commits),
+ * so callers treat an unverifiable commit as not preserved.
+ */
+function isAncestorCommit(ancestor, descendant, directory) {
+    if (!exports.GIT_SHA.test(ancestor) || !exports.GIT_SHA.test(descendant)) {
+        return false;
+    }
+    try {
+        (0, child_process_1.execSync)(`git merge-base --is-ancestor ${ancestor} ${descendant}`, {
+            stdio: 'pipe',
+            windowsHide: true,
+            cwd: directory,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/utils/has-nx-js-plugin.d.ts

@@ -1,7 +1,7 @@
 /**
  * Checks if `@nx/js` is installed by attempting to resolve its `package.json`.
  *
- * Lives in its own module so unit tests can `jest.doMock` it without having to
+ * Lives in its own module so unit tests can mock it without having to
  * intercept Node's resolver at the global level. The previous in-`package-json`
  * definition was unreachable to mocks because callers in the same module
  * referenced it via the local lexical binding rather than `module.exports`.

package/dist/src/utils/has-nx-js-plugin.js

@@ -5,7 +5,7 @@ const installation_directory_1 = require("./installation-directory");
 /**
  * Checks if `@nx/js` is installed by attempting to resolve its `package.json`.
  *
- * Lives in its own module so unit tests can `jest.doMock` it without having to
+ * Lives in its own module so unit tests can mock it without having to
  * intercept Node's resolver at the global level. The previous in-`package-json`
  * definition was unreachable to mocks because callers in the same module
  * referenced it via the local lexical binding rather than `module.exports`.

package/dist/src/utils/ignore.d.ts

@@ -62,7 +62,7 @@ export declare function createIgnoreChainResolver(read: (path: string) => string
  * that same note. Here they are simply the entry's matchers: any one excluding
  * wins, and a negation counts only if none excluded.
  *
- * Two preconditions, both satisfied by a pruning walk and neither enforced:
+ * Two preconditions, neither enforced here:
  *
  * - `filePath` is workspace-relative POSIX and must sit under every `dir` in the
  *   chain, which holds when the chain came from that file's own directory.
@@ -70,11 +70,28 @@ export declare function createIgnoreChainResolver(read: (path: string) => string
  *   re-include a file inside an excluded directory, and this does not implement
  *   that rule: asked directly about `dist/keep.ts` with a root `dist/` and a
  *   nested `dist/.gitignore` holding `!keep.ts`, it answers "not ignored" where
- *   git says ignored (measured). `visitNotIgnoredFiles` never asks, because it
- *   prunes `dist/` before descending - which is what makes its answers match
- *   git, and why that pruning is load-bearing for correctness rather than speed.
+ *   git says ignored (measured). A pruning walk like `visitNotIgnoredFiles`
+ *   satisfies it by never asking about anything under `dist/`; a per-file
+ *   caller cannot, so it goes through `createAncestorAwareIgnoreChecker`,
+ *   which checks the ancestors before asking the chain.
  */
 export declare function isIgnoredByChain(chain: ScopedIgnoreMatcher[], filePath: string): boolean;
+/**
+ * The chain's answers plus git's excluded-ancestor rule: nothing inside an
+ * ignored directory can be re-included, so a nested negation must not
+ * resurrect a file whose ancestor an outer file excluded - the case
+ * `isIgnoredByChain` alone gets wrong (see its second precondition). The
+ * oxfmt CLI follows the same rule (measured against 0.60.0: a scan skips a
+ * nested `!keep.ts` under a root-ignored `dist/`), so every per-file caller -
+ * the cascading tree checkers and the disk-backed resolver in
+ * `formatters/oxfmt.ts` - goes through here.
+ *
+ * A directory's own ignore files cannot un-ignore the directory itself, so
+ * its verdict comes from its parent's chain - probed with a trailing slash,
+ * which is what makes a directory-only pattern like `dist/` match. Verdicts
+ * are memoized per directory, so a batch of files shares its ancestor walks.
+ */
+export declare function createAncestorAwareIgnoreChecker(resolve: (dir: string) => ScopedIgnoreMatcher[]): TreeIgnoreChecker;
 /**
  * Directories that should never be walked, whatever the workspace's own ignore
  * files say - `node_modules`, `.git`, the nx caches.
@@ -88,7 +105,7 @@ export declare function isIgnoredByChain(chain: ScopedIgnoreMatcher[], filePath:
  */
 export declare function isAlwaysIgnored(path: string): boolean;
 /**
- * The chain bound to a tree, as predicates over workspace-relative POSIX paths.
+ * A chain's answers as predicates over workspace-relative POSIX paths.
  *
  * Files and directories are asked separately because the answers differ: a
  * pattern is only directory-only if it ends in a slash, and `ignore` will not
@@ -123,6 +140,31 @@ export declare function createGitIgnoreChecker(tree: Tree): TreeIgnoreChecker;
  * Reads from the tree rather than disk, as above.
  */
 export declare function createPrettierIgnoreChecker(tree: Tree): TreeIgnoreChecker;
+/**
+ * What oxfmt ignores: prettier's two files, but resolved from each file's own
+ * directory upwards rather than the workspace root - measured against the
+ * oxfmt 0.60.0 CLI, which differs from prettier on exactly that axis. Still
+ * one matcher per file rather than merged.
+ *
+ * A config's `ignorePatterns` is not an ignore file and is not read here;
+ * `formatFilesWithOxfmt` applies it rooted at that config's directory.
+ */
+export declare function createOxfmtIgnoreChecker(tree: Tree): TreeIgnoreChecker;
+/**
+ * Exported, unlike git's and prettier's, because oxfmt has two consumers:
+ * this tree-backed checker and the disk-backed resolver in
+ * `formatters/oxfmt.ts`. A shared value is the only thing that keeps them
+ * agreeing, so do not restate these three anywhere.
+ *
+ * `satisfies` rather than an annotation keeps the values literal - an
+ * annotation widens `cascade` and `merge` to `boolean` (measured in the
+ * declaration emit).
+ */
+export declare const OXFMT_IGNORE_OPTIONS: {
+    filenames: string[];
+    cascade: true;
+    merge: false;
+};
 /**
  * `path.dirname` for the workspace-relative POSIX paths the chain is keyed by,
  * except that the workspace root is `''` rather than `.` - that is the key