@vzn/vx-lockfile 0.0.639 → 0.0.640

package/README.md

@@ -56,7 +56,7 @@ A file has one claimant, so two of these plugins that share a settings file (`pn
 
 ## `package.json` as an input
 
-Every cached task of a project the lockfile lists gets its literal `package.json` appended to `cache.inputs.files` (the `project` stage), so an edit to a manifest re-keys that project's tasks and, through `^` keys, its dependants. A task with no `cache` block stays uncached; one whose inputs already name `package.json` is left alone. A task that rewrites its own `package.json` with the same bytes (tsdown) keeps its hits under `inputStability: { strategy: 'mutable' }`.
+Every task with `inputs` of a project the lockfile lists, cached or not, gets its literal `package.json` appended to `inputs.files` (the `project` stage), so an edit to a manifest re-keys that project's tasks and, through `^` keys, its dependants. A task with no `inputs` stays keyless; one whose inputs already name `package.json` is left alone. A task that rewrites its own `package.json` with the same bytes (tsdown) keeps its hits under `inputStability: { strategy: 'mutable' }`.
 
 ## Project edges
 
@@ -65,7 +65,8 @@ Every cached task of a project the lockfile lists gets its literal `package.json
 - **deps** (order `^task`, reach `--filter …` and `--affected`): a dependency the lockfile resolves to a workspace package — pnpm `link:`, bun's `workspace:` entries (a `workspace:` path or alias, and an `npm:` alias Bun links to the workspace package, by the spec it records), npm's `link: true` entries, yarn berry's workspace entries and `link:` / `portal:` paths.
 - **peers**: a peer with no installed entry of the same name that resolves to a workspace package orders the build too, unless it would close a cycle through the order edges; then it is reach only (in project-name order, so the edge kept is stable). pnpm records an auto-installed peer under `dependencies`, so `pnpm()` asks the project's `package.json` which of those entries are peers; yarn berry resolves a peer to the workspace of its name, which Yarn hoists.
 - Each importer with a `package.json` is a project: one with no vx config joins as a project a plugin added (its tasks come from the `project` stage, else the default `build`). The root importer is the exception: it is a project only by its own vx config. An importer with no `package.json`, and an edge to one, is skipped. A project is named by its `package.json` `name` unless its config names it, or another importer's `package.json` shares the name; then its path names it.
-- A yarn classic (v1) lockfile records no workspaces: `yarn()` gives no edges and warns `yarn.lock: yarn classic (v1) records no workspaces, so yarn() gives vx no project edges — upgrade to Yarn 2+`.
+- A yarn classic (v1) lockfile records no workspaces, so `yarn()` reads them as Yarn 1 does: the directories the root `package.json` `workspaces` globs (an array or `{ packages }`) name. A dependency on a workspace's name is a link unless the lockfile keys its descriptor, which Yarn 1 writes only for the registry copy it fetched because the workspace's version missed the range.
+- A workspace the root `package.json` `workspaces` names that `bun()`, `npm()` or berry `yarn()` finds no importer for (added after the last install) is a warning at `vx lock` naming the install that adds it: until then core names it by its path, so a `dependsOn` naming it finds no project.
 
 These edges are what was installed, so they differ from a guess over manifest ranges where the manager decided otherwise: pnpm installs a plain range (`^2.0.0`, `*`, `catalog:`) from the registry unless it is `workspace:`, yarn packs a `file:` directory as a copy, bun installs `dependencies` over a devDependency of the same key. They are the only package edges vx has: core reads none from a `package.json`, so a workspace whose tasks use `^build` declares one of these plugins (or another that returns `deps`), and without one vx refuses the `^` naming the fix. A dependency an install adds or removes reaches `--affected` as this lockfile's change.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-lockfile",
-  "version": "0.0.639",
+  "version": "0.0.640",
   "license": "MIT",
   "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer.",
   "keywords": [
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.639"
+    "@vzn/vx": "^0.0.640"
   },
   "repository": {
     "type": "git",

package/src/index.ts

@@ -69,8 +69,16 @@ interface Manager {
   readonly settings: readonly string[]
   /** The lockfile files a peer under `dependencies`: the manifest says which entries are peers. */
   readonly peersInManifest?: true
-  /** Warned when the file records no importer at all, which only this format can. */
-  readonly noImporters?: () => string
+  /**
+   * Importers a format leaves out of the lockfile (yarn classic), from the
+   * workspace's manifests through `manifest`; undefined where the file
+   * records them itself.
+   */
+  readonly manifestImporters?: (
+    text: string,
+    workspaceRoot: string,
+    manifest: (dir: string) => Promise<Record<string, unknown> | null>,
+  ) => Promise<ReadonlyMap<string, LockfileImporter> | undefined>
 }
 
 /**
@@ -127,7 +135,18 @@ const MANAGERS = {
     digest: (t) => yarnLock().importerDigests(yarnParse(t)),
     importers: (t) => yarnLock().importerLinks(yarnParse(t)),
     settings: ['.yarnrc.yml'],
-    noImporters: () => `yarn.lock${yarnLock().CLASSIC_EDGES}`,
+    async manifestImporters(t, root, manifest) {
+      const lock = yarnParse(t)
+      if (lock.generation !== 'classic') return undefined
+      const pkg = await manifest(root)
+      const manifests = new Map<string, Record<string, unknown>>()
+      if (pkg !== null) manifests.set('.', pkg)
+      for (const dir of await workspaceDirs(root, pkg)) {
+        const m = await manifest(path.join(root, dir))
+        if (m !== null) manifests.set(dir, m)
+      }
+      return yarnLock().classicLinks(lock, manifests)
+    },
   },
 } satisfies Record<string, Manager>
 
@@ -196,13 +215,16 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
       `${unreadable.file}: ${manager.name}() reads ${manager.files.join(' or ')} and finds none — ${unreadable.fix}`,
     )
   }
-  const importersOf = async (ctx: {
-    readonly workspaceRoot: string
-    readonly cacheDir: string
-  }): Promise<ReadonlyMap<string, LockfileImporter> | undefined> => {
-    for (const { claim } of claims) {
+  const importersOf = async (
+    ctx: { readonly workspaceRoot: string; readonly cacheDir: string },
+    manifest: (dir: string) => Promise<Record<string, unknown> | null>,
+  ): Promise<ReadonlyMap<string, LockfileImporter> | undefined> => {
+    for (const { file, claim } of claims) {
       const importers = await claim.importers(ctx)
-      if (importers !== undefined) return importers
+      if (importers === undefined) continue
+      if (importers.size > 0 || manager.manifestImporters === undefined) return importers
+      const text = await Bun.file(path.join(ctx.workspaceRoot, file)).text()
+      return (await manager.manifestImporters(text, ctx.workspaceRoot, manifest)) ?? importers
     }
     await refuseUnreadable(ctx.workspaceRoot)
     return undefined
@@ -246,41 +268,66 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
         : { ...deps, ...folded }
     },
     async discover(ctx) {
-      const importers = await importersOf(ctx)
+      const manifest = manifestReader()
+      const importers = await importersOf(ctx, manifest)
       if (importers === undefined) return []
-      if (importers.size === 0 && manager.noImporters !== undefined) ctx.warn(manager.noImporters())
+      // A workspace the root manifest names and the lockfile lacks is no
+      // project until an install adds it: lerna's 31 added Nx projects
+      // failed \`vx lock\` as "no such project" and nothing said why
+      // (Growth, 2026-10-16). pnpm reads pnpm-workspace.yaml instead.
+      if (manager.name !== 'pnpm') {
+        const missing = (
+          await workspaceDirs(ctx.workspaceRoot, await manifest(ctx.workspaceRoot))
+        ).filter((d) => !importers.has(d))
+        if (missing.length > 0) {
+          let file = manager.files[0]!
+          for (const f of manager.files)
+            if (await Bun.file(path.join(ctx.workspaceRoot, f)).exists()) {
+              file = f
+              break
+            }
+          ctx.warn(
+            `${file} does not list the workspace${missing.length > 1 ? 's' : ''} ${listed(missing)} that package.json names — run \`${manager.name} install\` to add ${missing.length > 1 ? 'them; until then each is' : 'it; until then it is'} named by its path, and a dependsOn naming it finds no project`,
+          )
+        }
+      }
       const rootIsProject = ctx.projects.some((p) => importerOf(ctx.workspaceRoot, p.dir) === '.')
       return await discovered(
         ctx.workspaceRoot,
         importers,
         manager.peersInManifest === true,
         rootIsProject,
+        manifest,
       )
     },
     async project(config, ctx) {
       let importers = perRun.get(ctx.projects)
       if (importers === undefined) {
-        importers = importersOf(ctx)
+        importers = importersOf(ctx, manifestReader())
         perRun.set(ctx.projects, importers)
       }
       if ((await importers)?.has(importerOf(ctx.workspaceRoot, ctx.dir)) !== true) return
       const tasks = config.tasks ?? {}
       for (const [name, task] of Object.entries(tasks)) {
-        const inputs = task.cache?.inputs
+        const inputs = task.inputs
         if (inputs === undefined || inputs.files.includes('package.json')) continue
         // A copy: a loaded config may be shared or frozen.
         tasks[name] = {
           ...task,
-          cache: {
-            ...task.cache!,
-            inputs: { ...inputs, files: [...inputs.files, 'package.json'] },
-          },
+          inputs: { ...inputs, files: [...inputs.files, 'package.json'] },
         }
       }
     },
   })
 }
 
+/** Up to five names, then a count of the rest. */
+function listed(names: readonly string[]): string {
+  return names.length <= 5
+    ? names.join(', ')
+    : `${names.slice(0, 5).join(', ')} and ${names.length - 5} more`
+}
+
 /** Each present settings file's content hash, by name. */
 async function readSettings(
   workspaceRoot: string,
@@ -316,6 +363,44 @@ async function manifestOf(dir: string): Promise<Record<string, unknown> | null>
   }
 }
 
+/** `manifestOf`, each directory read once. */
+function manifestReader(): (dir: string) => Promise<Record<string, unknown> | null> {
+  const read = new Map<string, Promise<Record<string, unknown> | null>>()
+  return (dir) => {
+    let pkg = read.get(dir)
+    if (pkg === undefined) {
+      pkg = manifestOf(dir)
+      read.set(dir, pkg)
+    }
+    return pkg
+  }
+}
+
+/**
+ * The directories a root manifest's `workspaces` globs (an array, or
+ * Yarn 1's `{ packages }`) name that hold a `package.json`, root-relative
+ * POSIX, sorted; none under `node_modules`.
+ */
+async function workspaceDirs(root: string, pkg: Record<string, unknown> | null): Promise<string[]> {
+  const field = pkg?.['workspaces']
+  const list = Array.isArray(field)
+    ? field
+    : field !== null && typeof field === 'object'
+      ? (field as Record<string, unknown>)['packages']
+      : undefined
+  if (!Array.isArray(list)) return []
+  const dirs = new Set<string>()
+  for (const pattern of list) {
+    if (typeof pattern !== 'string' || pattern.startsWith('!')) continue
+    const glob = new Bun.Glob(`${pattern.replace(/^\.\//, '').replace(/\/+$/, '')}/package.json`)
+    for await (const file of glob.scan({ cwd: root, onlyFiles: true })) {
+      const dir = path.dirname(file).split(path.sep).join('/')
+      if (dir !== '.' && !dir.split('/').includes('node_modules')) dirs.add(dir)
+    }
+  }
+  return [...dirs].sort()
+}
+
 /**
  * One entry per importer with a `package.json` (core reads none): a
  * directory that is no project yet becomes one, the root aside, which is
@@ -332,12 +417,13 @@ async function discovered(
   importers: ReadonlyMap<string, LockfileImporter>,
   peersInManifest: boolean,
   rootIsProject: boolean,
+  manifest: (dir: string) => Promise<Record<string, unknown> | null>,
 ): Promise<DiscoveredProject[]> {
   const dirOf = (importer: string): string => (importer === '.' ? root : path.join(root, importer))
   const read = await Promise.all(
     [...importers.keys()]
       .filter((i) => i !== '.' || rootIsProject)
-      .map(async (i) => [i, await manifestOf(dirOf(i))] as const),
+      .map(async (i) => [i, await manifest(dirOf(i))] as const),
   )
   const manifests = new Map<string, Record<string, unknown>>()
   for (const [i, pkg] of read) if (pkg !== null) manifests.set(i, pkg)
@@ -443,7 +529,7 @@ export function npm(options: LockfileOptions = {}): VxPlugin {
   return plugin(MANAGERS.npm, options)
 }
 
-/** `yarn.lock`: berry (yarn 2+, per workspace) and classic (yarn 1, one digest for the root). */
+/** `yarn.lock`: berry (yarn 2+, per workspace) and classic (yarn 1: one digest for the root, links from the workspaces' manifests). */
 export function yarn(options: LockfileOptions = {}): VxPlugin {
   refuseUnknownOptions('yarn()', options, LOCKFILE_KEYS)
   return plugin(MANAGERS.yarn, options)

package/src/yarn.ts

@@ -6,20 +6,16 @@
 // dependency `bar: "npm:^2"` resolves to the entry keyed `bar@npm:^2`.
 // Classic (yarn 1) is its own text format: `"foo@^1.0.0", "foo@^1.2.0":`
 // then indented `version`, `resolved`, `integrity` and `dependencies:`
-// with `bar "^2"` lines; classic has no workspace entries, so workspaces
-// resolve from their own `package.json` — which the digest reads from the
-// lockfile's root descriptors only, so a workspace's digest is the root's
-// reach through the descriptors the file resolves.
+// with `bar "^2"` lines; classic has no workspace entries: Yarn 1 links a
+// dependency on a workspace's name and keys no entry for it, so its links
+// come from the workspaces' own `package.json` (`classicLinks`), and its
+// one digest is the root's reach through every entry the file resolves.
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
 import { stable } from './pnpm.js'
 import { depsOf, record } from './json.js'
 import { joinPosix } from './posix.js'
 
-/** What yarn() warns of a classic lockfile, after its name: the static part a test holds. */
-export const CLASSIC_EDGES =
-  ': yarn classic (v1) records no workspaces, so yarn() gives vx no project edges — upgrade to Yarn 2+ (`yarn set version stable`)'
-
 export interface Lockfile {
   readonly generation: 'berry' | 'classic'
   /** entry id (the resolution, or the first descriptor) → entry */
@@ -197,6 +193,50 @@ function unquote(s: string): string {
   return s.length >= 2 && s.startsWith('"') && s.endsWith('"') ? s.slice(1, -1) : s
 }
 
+/**
+ * Classic's links: Yarn 1 records no workspace, so they come from each
+ * workspace's manifest (`manifests`: importer dir → `package.json`, `.`
+ * the root). A dependency on a workspace's name is linked unless the file
+ * keys its descriptor, which Yarn writes only for the registry copy it
+ * fetched when the workspace's version misses the range. A peer on a
+ * workspace with no installed entry of that name is a peer link.
+ */
+export function classicLinks(
+  lock: Lockfile,
+  manifests: ReadonlyMap<string, Record<string, unknown>>,
+): ReadonlyMap<string, LockfileImporter> {
+  const count = new Map<string, number>()
+  const dirOf = new Map<string, string>()
+  for (const [dir, pkg] of manifests) {
+    const n = pkg['name']
+    if (typeof n !== 'string' || n === '') continue
+    count.set(n, (count.get(n) ?? 0) + 1)
+    dirOf.set(n, dir)
+  }
+  const workspace = (name: string): string | undefined =>
+    count.get(name) === 1 ? dirOf.get(name) : undefined
+  const out = new Map<string, LockfileImporter>()
+  for (const [dir, pkg] of manifests) {
+    const links = { deps: {} as Record<string, string>, peers: {} as Record<string, string> }
+    const installed = new Set<string>()
+    for (const field of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+      for (const [name, range] of depsOf(pkg, [field])) {
+        installed.add(name)
+        const target = workspace(name)
+        if (target !== undefined && target !== dir && !lock.descriptors.has(`${name}@${range}`)) {
+          links.deps[name] = target
+        }
+      }
+    }
+    for (const name of depsOf(pkg, ['peerDependencies']).keys()) {
+      const target = workspace(name)
+      if (target !== undefined && target !== dir && !installed.has(name)) links.peers[name] = target
+    }
+    out.set(dir, links)
+  }
+  return out
+}
+
 /**
  * `bar` + `npm:^2` → the entry keyed `bar@npm:^2`; classic: `bar@^2`. A
  * bare range gets berry's `npm:` prefix. A `workspace:` range resolves to
@@ -256,7 +296,7 @@ function resolveDescriptor(
  * workspace of that name, which Yarn hoists whatever the range. Only a
  * descriptor the file keys counts: the name fallbacks the digest takes
  * (a catalog, an override) name no link. Classic records no workspaces,
- * so it has none.
+ * so it has none here (`classicLinks`).
  */
 export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImporter> {
   const out = new Map<string, LockfileImporter>()