@vzn/vx-migrate 0.0.636 → 0.0.638

package/src/nx/export-graph.ts

@@ -1,7 +1,7 @@
 // The resolved Nx graph, exported by the workspace's own nx: `nx()` keys and
 // keeps it, `vx-migrate --from nx` maps it once.
 
-import { readFileSync, realpathSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import { mkdir } from 'node:fs/promises'
 import path from 'node:path'
 
@@ -11,10 +11,9 @@ import path from 'node:path'
  * daemon up the export is served from memory, without it Nx computes.
  */
 export async function exportGraph(root: string, snapshot: string): Promise<string | null> {
-  const linked = path.join(root, 'node_modules', '.bin', 'nx')
-  const bin = (await Bun.file(linked).exists()) ? linked : lernasNx(root)
+  const bin = nxBin(root)
   if (bin === undefined) {
-    return `no ${path.relative(root, linked)} — install nx, or export a graph with \`nx graph --file=<path>\` and pass it as graph: '<path>'`
+    return `no node_modules/.bin/nx — install nx, or export a graph with \`nx graph --file=<path>\` and pass it as graph: '<path>'`
   }
   // `discover` runs before the run opens (and makes) the cache dir.
   await mkdir(path.dirname(snapshot), { recursive: true })
@@ -30,6 +29,18 @@ export async function exportGraph(root: string, snapshot: string): Promise<strin
   return `nx graph --file exited ${code}${tail ? `: ${tail}` : ''}`
 }
 
+/**
+ * The workspace's own nx: the linked bin, else where Nx's wrapper installs
+ * it in a repo with no package.json (`.nx/installation`), else Lerna's.
+ */
+export function nxBin(root: string): string | undefined {
+  for (const dir of [root, path.join(root, '.nx', 'installation')]) {
+    const bin = path.join(dir, 'node_modules', '.bin', 'nx')
+    if (existsSync(bin)) return bin
+  }
+  return lernasNx(root)
+}
+
 /**
  * The nx Lerna 6+ runs on, from Lerna's own dependencies: pnpm links only
  * a root's direct dependencies into `node_modules/.bin`, so a Lerna repo

package/src/nx/index.ts

@@ -23,6 +23,7 @@ import { stat } from 'node:fs/promises'
 import { availableParallelism } from 'node:os'
 import path from 'node:path'
 import {
+  type DiscoveredProject,
   refuseUnknownOptions,
   type PluginOptionKinds,
   type GeneratedProject,
@@ -30,6 +31,7 @@ import {
   UserError,
   type VxPlugin,
 } from '@vzn/vx'
+import type { PackageMeta } from '../packages.js'
 import { type AdoptionRun, adoptionPlugin } from '../adoption-plugin.js'
 import { collectGaps } from '../plugin-gaps.js'
 import {
@@ -43,6 +45,7 @@ import {
 } from './nx-map.js'
 import { exportGraph } from './export-graph.js'
 import { lernaJsonText } from './lerna.js'
+import { nxDependencyRules } from './nx-boundaries.js'
 export type {
   NxExecutors,
   NxExecutorTarget,
@@ -52,6 +55,7 @@ export type {
 import { listDotenv } from './nx-dotenv.js'
 import { trackedKinds } from '../tracked-outputs.js'
 import { relPosix } from '../paths.js'
+import { memberProjects, withManifests } from '../manifests.js'
 import type { AdoptionMapping } from '../mapping-cache.js'
 import { yarnrcText } from '../script-command.js'
 
@@ -119,10 +123,12 @@ export function nx(options: NxPluginOptions = {}): VxPlugin {
     cacheDir: string,
     projects: readonly ProjectMeta[],
     changes?: WorktreeChanges,
+    members: readonly DiscoveredProject[] = [],
   ) => {
     if (graphFor !== projects) {
       graphFor = projects
-      graph = loadGraph(root, cacheDir, projects, options.graph, changes)
+      const also = members.map((m) => ({ name: m.name ?? '', dir: m.dir, configPath: null }))
+      graph = loadGraph(root, cacheDir, [...projects, ...also], options.graph, changes)
     }
     return graph!
   }
@@ -142,33 +148,45 @@ export function nx(options: NxPluginOptions = {}): VxPlugin {
     {
       async config(workspace, ctx) {
         const root = options.root ?? ctx.workspaceRoot
-        if (workspace.affectedBase === undefined) {
+        if (workspace.run?.affectedBase === undefined) {
           const base = await nxBase(root)
-          if (base !== undefined) workspace.affectedBase = base
+          if (base !== undefined) workspace.run = { ...workspace.run, affectedBase: base }
         }
-        if (workspace.concurrency === undefined) {
+        if (workspace.run?.concurrency === undefined) {
           const parallel = await nxParallel(root)
-          if (parallel !== undefined) workspace.concurrency = parallel
+          if (parallel !== undefined) workspace.run = { ...workspace.run, concurrency: parallel }
         }
-        if (workspace.cacheRetention === undefined) {
+        if (workspace.run?.rules?.dependencies === undefined) {
+          const dependencies = await nxDependencyRules(root)
+          if (dependencies !== undefined && dependencies.length > 0)
+            workspace.run = {
+              ...workspace.run,
+              rules: { ...workspace.run?.rules, dependencies },
+            }
+        }
+        if (workspace.cache?.retention === undefined) {
           const maxSize = await nxMaxCacheSize(root)
-          if (maxSize !== undefined) workspace.cacheRetention = { maxSize }
+          if (maxSize !== undefined)
+            workspace.cache = { ...workspace.cache, retention: { maxSize } }
         }
       },
-      // An integrated Nx repo keeps projects out of the package manager's
-      // list (analogjs: `project.json` libraries no glob names), and their
+      // The package manager's members are projects, each with no vx.config
+      // written. An integrated Nx repo keeps projects out of that list
+      // (analogjs: `project.json` libraries no glob names), and their
       // targets had nowhere to attach: 1 of 21 `build` tasks ran. Each
-      // graph node with targets at a directory core did not find is named
-      // a project, by its package.json name or else its Nx name; a name a
+      // graph node with targets at a directory neither found is named a
+      // project, by its package.json name or else its Nx name; a name a
       // project already holds stays unattached, and the mapping says so.
       async discover(ctx) {
         const root = options.root ?? ctx.workspaceRoot
+        const members = await memberProjects(ctx.workspaceRoot)
         // Core's status is the workspace's: a root elsewhere asks git itself.
         const changes = options.root === undefined ? () => ctx.worktreeChanges() : undefined
-        const { graph } = await graphOf(root, ctx.cacheDir, ctx.projects, changes)
-        const dirs = new Set(ctx.projects.map((m) => path.resolve(m.dir)))
-        const names = new Set(ctx.projects.map((m) => m.name))
-        const named: Array<{ dir: string; name: string }> = []
+        const { graph } = await graphOf(root, ctx.cacheDir, ctx.projects, changes, members)
+        const found = [...ctx.projects, ...members]
+        const dirs = new Set(found.map((m) => path.resolve(m.dir)))
+        const names = new Set(found.map((m) => m.name))
+        const named = members.map((m) => ({ dir: path.resolve(m.dir), name: m.name! }))
         for (const [nodeName, node] of Object.entries(graph.nodes)) {
           if (node?.data?.targets === undefined) continue
           const dir = path.resolve(root, node.data.root ?? '')
@@ -190,12 +208,45 @@ export function nx(options: NxPluginOptions = {}): VxPlugin {
           dirs.add(dir)
           named.push({ dir, name })
         }
-        return named
+        const entries = withGraphEdges(root, graph, dirs, named)
+        const covered = new Set(entries.map((e) => e.dir))
+        return [...entries, ...named.filter((n) => !covered.has(n.dir))]
       },
     },
   )
 }
 
+/**
+ * Every project the graph and the workspace share, with its Nx graph edges
+ * (package deps, `implicitDependencies`, imports) as `deps`: nx() is an Nx
+ * repo's edge source, so `^task` follows Nx's graph with no lockfile plugin.
+ */
+function withGraphEdges(
+  root: string,
+  graph: NxGraph,
+  dirs: ReadonlySet<string>,
+  named: ReadonlyArray<{ dir: string; name: string }>,
+): DiscoveredProject[] {
+  const dirOf = new Map<string, string>()
+  for (const [nodeName, node] of Object.entries(graph.nodes)) {
+    const dir = path.resolve(root, node?.data?.root ?? '')
+    if (dirs.has(dir)) dirOf.set(nodeName, dir)
+  }
+  const nameOf = new Map(named.map((n) => [n.dir, n.name]))
+  const edges = (graph.dependencies ?? {}) as Record<string, ReadonlyArray<{ target?: unknown }>>
+  const out: DiscoveredProject[] = []
+  for (const [nodeName, dir] of dirOf) {
+    const deps = new Set<string>()
+    for (const e of edges[nodeName] ?? []) {
+      const to = typeof e?.target === 'string' ? dirOf.get(e.target) : undefined
+      if (to !== undefined && to !== dir) deps.add(to)
+    }
+    const name = nameOf.get(dir)
+    out.push({ dir, ...(name === undefined ? {} : { name }), deps: [...deps].sort() })
+  }
+  return out
+}
+
 function isWithin(root: string, dir: string): boolean {
   const rel = path.relative(root, dir)
   return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel))
@@ -268,10 +319,11 @@ interface LoadedGraph {
 
 async function mapAll(
   root: string,
-  metas: readonly ProjectMeta[],
+  projects: readonly ProjectMeta[],
   loaded: LoadedGraph,
   executors: NxExecutors | undefined,
 ): Promise<AdoptionRun> {
+  const metas = await withManifests(projects)
   const { text, graph, notes } = loaded
   const reads = await nxReads(root, metas, text, graph, notes)
   // The mapping is cached on what it read; a translator is code it ran.
@@ -304,7 +356,7 @@ const textOf = (file: string): Promise<string> =>
  */
 async function nxReads(
   root: string,
-  metas: readonly ProjectMeta[],
+  metas: readonly PackageMeta[],
   graphText: string,
   graph: NxGraph,
   notes: readonly string[],
@@ -346,13 +398,14 @@ async function nxReads(
 
 async function index(
   root: string,
-  metas: readonly ProjectMeta[],
+  metas: readonly PackageMeta[],
   graph: NxGraph,
   loadNotes: readonly string[],
   trackedFiles: () => Promise<readonly string[] | null>,
   executors: NxExecutors | undefined,
 ): Promise<AdoptionMapping> {
-  const notes = [...loadNotes]
+  const notes: string[] = []
+  const live = [...loadNotes]
   const tracked = await trackedFiles()
   const configs = new Map(
     metas.flatMap((m) =>
@@ -406,7 +459,7 @@ async function index(
     if (!uses(bin)) continue
     loadsNx = true
     if (!(await Bun.file(path.join(root, 'node_modules', '.bin', bin)).exists())) {
-      notes.push(
+      live.push(
         `${what} through \`${bin}\`, which is not in node_modules/.bin — add ` +
           "@vzn/vx-migrate to the workspace's devDependencies so its bin is on every task's PATH",
       )
@@ -418,7 +471,7 @@ async function index(
     loadsNx &&
     !(await Bun.file(path.join(root, 'node_modules', 'nx', 'package.json')).exists())
   ) {
-    notes.push(
+    live.push(
       'nx-exec and nx-env load Nx from the workspace, and node_modules/nx is not there — ' +
         'install nx, or those tasks fail',
     )
@@ -428,6 +481,7 @@ async function index(
     gaps: collectGaps(
       mapped.projects.filter((p) => byName.has(p.name)),
       notes,
+      live,
     ),
   }
 }
@@ -535,6 +589,9 @@ async function graphInputKey(
   // and stays in.
   const nxCache = (p: string): boolean =>
     p.startsWith('.nx/cache/') || p.startsWith('.nx/workspace-data/')
+  // vx's own directory (the lock `vx lock` rewrites, the workspace file):
+  // Nx reads nothing there, and under a root project each lock re-exported.
+  const vxDir = (p: string): boolean => p.startsWith('.vx/')
   // What can move the graph: a file under a project root (its sources, the
   // configs a plugin infers targets from), or a root file Nx reads. A task's
   // stray write at the root (a report, a log) is not, and counting it
@@ -546,7 +603,9 @@ async function graphInputKey(
     p.endsWith('/project.json') ||
     roots.some((r) => r === '' || p.startsWith(`${r}/`)) ||
     (!p.includes('/') && ROOT_GRAPH_FILE.test(p))
-  const listed = [...new Set(changed.filter((p) => !inCache(p) && !nxCache(p) && graphFile(p)))]
+  const listed = [
+    ...new Set(changed.filter((p) => !inCache(p) && !nxCache(p) && !vxDir(p) && graphFile(p))),
+  ]
   // A manifest needs no read of its own: git lists it when it is edited, and
   // HEAD moves when an edit is committed (reading all 2,000 cost 50 ms at
   // 1,000 projects). nx.json's chain does: a base may sit in node_modules,

package/src/nx/nx-boundaries.ts

@@ -0,0 +1,191 @@
+import path from 'node:path'
+
+/** `run.rules.dependencies`' entry, as core takes it. */
+interface DependencyRule {
+  from: string
+  allow?: string[]
+  deny?: string[]
+}
+
+const RULE_NAMES = ['@nx/enforce-module-boundaries', '@nrwl/nx/enforce-module-boundaries']
+const FLAT = ['eslint.config.mjs', 'eslint.config.js', 'eslint.config.cjs', 'eslint.config.ts']
+const LEGACY = ['.eslintrc.json', '.eslintrc']
+
+/**
+ * The root ESLint config's `@nx/enforce-module-boundaries` `depConstraints`,
+ * as vx's lock-time dependency rules. A flat config is read, never run:
+ * importing it loads ESLint's plugins on every vx run, for a rule only
+ * `vx lock` checks. So the constraints must be a literal array there; a
+ * spread or a variable maps nothing. Undefined when no rule is found.
+ */
+export async function nxDependencyRules(root: string): Promise<DependencyRule[] | undefined> {
+  for (const name of [...FLAT, ...LEGACY]) {
+    const file = Bun.file(path.join(root, name))
+    if (!(await file.exists())) continue
+    const text = await file.text()
+    const constraints = LEGACY.includes(name) ? fromJson(text) : fromSource(text)
+    return constraints === undefined ? undefined : mapConstraints(constraints)
+  }
+  return undefined
+}
+
+/** `rules` and each `overrides[].rules` of a JSON config, first rule found. */
+function fromJson(text: string): unknown[] | undefined {
+  let json: unknown
+  try {
+    json = Bun.JSONC.parse(text)
+  } catch {
+    return undefined
+  }
+  const configs = [json, ...((json as { overrides?: unknown[] })?.overrides ?? [])]
+  for (const c of configs) {
+    const rules = (c as { rules?: Record<string, unknown> } | null)?.rules
+    for (const r of RULE_NAMES) {
+      const entry = rules?.[r]
+      const options = Array.isArray(entry) ? entry[1] : undefined
+      const dc = (options as { depConstraints?: unknown } | undefined)?.depConstraints
+      if (Array.isArray(dc)) return dc
+    }
+  }
+  return undefined
+}
+
+/** The literal after the rule's `depConstraints:` in JS source. */
+function fromSource(text: string): unknown[] | undefined {
+  for (const r of RULE_NAMES) {
+    const at = text.indexOf(r)
+    if (at === -1) continue
+    const m = /depConstraints['"]?\s*:\s*\[/.exec(text.slice(at))
+    if (m === null) return undefined
+    try {
+      const v = new Literal(text, at + m.index + m[0].length - 1).value()
+      return Array.isArray(v) ? v : undefined
+    } catch {
+      return undefined
+    }
+  }
+  return undefined
+}
+
+/**
+ * Nx's constraint as a vx rule: `sourceTag` is `from`,
+ * `onlyDependOnLibsWithTags` is `allow`, `notDependOnLibsWithTags` is
+ * `deny`; `*` means any project. A constraint vx cannot say is left out:
+ * `allSourceTags` (every tag at once), a `/regex/` tag, or one that bans
+ * only external imports.
+ */
+function mapConstraints(constraints: unknown[]): DependencyRule[] {
+  const out: DependencyRule[] = []
+  const sel = (t: unknown) => (t === '*' ? '*' : `tag:${String(t)}`)
+  const tags = (v: unknown): string[] | undefined =>
+    Array.isArray(v) && v.every((t) => typeof t === 'string' && t !== '' && !t.startsWith('/'))
+      ? v.map(sel)
+      : undefined
+  for (const c of constraints) {
+    const { sourceTag, onlyDependOnLibsWithTags, notDependOnLibsWithTags } = (c ?? {}) as Record<
+      string,
+      unknown
+    >
+    if (typeof sourceTag !== 'string' || sourceTag === '' || sourceTag.startsWith('/')) continue
+    const allow = tags(onlyDependOnLibsWithTags)
+    const deny = tags(notDependOnLibsWithTags)
+    if (allow === undefined && deny === undefined) continue
+    out.push({
+      from: sel(sourceTag),
+      ...(allow !== undefined ? { allow } : {}),
+      ...(deny !== undefined ? { deny } : {}),
+    })
+  }
+  return out
+}
+
+/** A JS literal: arrays, objects, strings, numbers, booleans, null. Anything else throws. */
+class Literal {
+  constructor(
+    private readonly s: string,
+    private i: number,
+  ) {}
+
+  value(): unknown {
+    this.skip()
+    const c = this.s[this.i]
+    if (c === '[') {
+      this.i++
+      const out: unknown[] = []
+      while (!this.eat(']')) {
+        out.push(this.value())
+        if (!this.eat(',')) {
+          this.expect(']')
+          break
+        }
+      }
+      return out
+    }
+    if (c === '{') {
+      this.i++
+      const out: Record<string, unknown> = {}
+      while (!this.eat('}')) {
+        const key = this.key()
+        this.expect(':')
+        out[key] = this.value()
+        if (!this.eat(',')) {
+          this.expect('}')
+          break
+        }
+      }
+      return out
+    }
+    if (c === "'" || c === '"' || c === '`') return this.string(c)
+    const m = this.match(/true|false|null|-?\d+(?:\.\d+)?/y)
+    if (m === null) throw new Error('not a literal')
+    return JSON.parse(m)
+  }
+
+  private key(): string {
+    this.skip()
+    const c = this.s[this.i]
+    if (c === "'" || c === '"') return this.string(c)
+    const m = this.match(/[A-Za-z_$][\w$]*/y)
+    if (m === null) throw new Error('not a key')
+    return m
+  }
+
+  private string(q: string): string {
+    let out = ''
+    for (this.i++; this.i < this.s.length; this.i++) {
+      const c = this.s[this.i]!
+      if (c === q) {
+        this.i++
+        return out
+      }
+      if (c === '\\') out += this.s[++this.i]
+      else if (q === '`' && c === '$' && this.s[this.i + 1] === '{') throw new Error('template')
+      else out += c
+    }
+    throw new Error('unterminated')
+  }
+
+  private skip(): void {
+    while (this.match(/\s+|\/\/[^\n]*|\/\*[\s\S]*?\*\//y) !== null);
+  }
+
+  /** The sticky `re`'s match at the cursor, consumed; null when none. */
+  private match(re: RegExp): string | null {
+    re.lastIndex = this.i
+    const m = re.exec(this.s)
+    if (m === null || m[0] === '') return null
+    this.i += m[0].length
+    return m[0]
+  }
+
+  private eat(c: string): boolean {
+    this.skip()
+    if (this.s[this.i] !== c) return false
+    this.i++
+    return true
+  }
+
+  private expect(c: string): void {
+    if (!this.eat(c)) throw new Error(`expected ${c}`)
+  }
+}

package/src/nx/nx-deps.ts

@@ -6,7 +6,7 @@
 // vx-migrate itself wrote (walked the Nx path, 2026-09-20). Extracted from
 // `buildTask` in item 606; the rules are unchanged.
 
-import type { ProjectMeta } from '@vzn/vx'
+import type { PackageMeta } from '../packages.js'
 
 /** The vx task an Nx `project:target:configuration` reaches, or null when the target lacks it. */
 export type TaskNameFor = (project: string, target: string, configuration: string) => string | null
@@ -16,7 +16,7 @@ export type TaskNameFor = (project: string, target: string, configuration: strin
  * target (`processTasksForSingleProject`), and says nothing otherwise:
  * nx-examples' `targetDefaults` give every `typecheck` a `codegen` that
  * one project declares. Passed through, core refused the whole run —
- * "depends on …#codegen but no such task is declared". Dropped here as
+ * "dependsOn …#codegen but no such task is declared". Dropped here as
  * Nx drops it, for this project and a named one alike.
  */
 type HasTarget = (project: string, target: string) => boolean
@@ -142,7 +142,7 @@ function expandTargetGlobs(
 
 export function mapNxDeps(
   raw: readonly unknown[],
-  metaByNode: ReadonlyMap<string, ProjectMeta>,
+  metaByNode: ReadonlyMap<string, PackageMeta>,
   ownTarget: (name: string) => boolean,
   taskNameFor: TaskNameFor,
   hasTarget: HasTarget,