@vzn/vx-migrate 0.0.636 → 0.0.638

package/src/nx/nx-map.ts

@@ -2,9 +2,10 @@
 // consumers: `bunx @vzn/vx-migrate --from nx` writes it to files, and the
 // `nx()` plugin runs it live. Static by design: targets that Nx plugins
 // infer at runtime are whatever the graph says. Named inputs expand from
-// nx.json when readable; the graph's dependency edges are ignored (vx
-// derives package edges from package.json manifests) except for one
-// report line counting edges with no manifest counterpart.
+// nx.json when readable; the graph's dependency edges are ignored (vx's
+// package edges come from a lockfile plugin, which installs what the
+// manifests name) except for one report line counting edges with no
+// manifest counterpart.
 //
 // Executors: `nx:run-commands`, a plain `command` and `nx:run-script` are
 // shell; `nx:noop` is a group; an executor the workspace translates
@@ -16,14 +17,10 @@
 // default configuration is folded into the base task.
 
 import path from 'node:path'
-import {
-  buildPackageGraph,
-  type GeneratedProject,
-  type GeneratedTask,
-  type ProjectMeta,
-  UserError,
-} from '@vzn/vx'
+import { type Duration, type GeneratedProject, type GeneratedTask, UserError } from '@vzn/vx'
+import type { PackageMeta } from '../packages.js'
 import { withoutTakenBack } from '../glob-grammar.js'
+import { manifestGraph, type ManifestGraph } from '../manifest-graph.js'
 import { mapRunCommands, shellQuote } from '../nx-command.js'
 import { scriptCommand, yarnPnp } from '../script-command.js'
 import {
@@ -251,8 +248,8 @@ export interface NxExecutorTarget {
 /** What a translated target runs as. The command runs in the project dir. */
 export interface NxExecutorTranslation {
   readonly command: string
-  /** `exec.timeout`, in ms. */
-  readonly timeout?: number
+  /** `exec.timeout`, a duration with its unit (`'10m'`). */
+  readonly timeout?: Duration
   /** Defined in the task's environment, as a run-commands `env` is. */
   readonly env?: Readonly<Record<string, string>>
 }
@@ -298,7 +295,7 @@ function normRel(p: string): string {
 
 export async function mapNxWorkspace(
   root: string,
-  metas: readonly ProjectMeta[],
+  metas: readonly PackageMeta[],
   graph: NxGraph,
   opts: MapNxOptions,
 ): Promise<NxMapping> {
@@ -324,11 +321,11 @@ export async function mapNxWorkspace(
     syncTasks: new Map(),
   }
 
-  const metaByRel = new Map<string, ProjectMeta>()
+  const metaByRel = new Map<string, PackageMeta>()
   for (const meta of metas) metaByRel.set(normRel(relPosix(root, meta.dir)), meta)
-  const metaByNode = new Map<string, ProjectMeta>()
-  const nodeByMeta = new Map<ProjectMeta, NxNode>()
-  const nodeNameOf = new Map<ProjectMeta, string>()
+  const metaByNode = new Map<string, PackageMeta>()
+  const nodeByMeta = new Map<PackageMeta, NxNode>()
+  const nodeNameOf = new Map<PackageMeta, string>()
   for (const [nodeName, node] of Object.entries(nodeMap)) {
     const meta = metaByRel.get(normRel(node?.data?.root ?? ''))
     if (meta) {
@@ -343,16 +340,16 @@ export async function mapNxWorkspace(
   // workspace root, but Nx routinely defines root targets. Synthesize
   // a meta for any unmatched node whose root resolves inside the
   // workspace, so its targets migrate too.
-  const allMetas: ProjectMeta[] = [...metas]
+  const allMetas: PackageMeta[] = [...metas]
   const taken = new Set(metas.map((m) => m.name))
   for (const [nodeName, node] of Object.entries(nodeMap)) {
     if (metaByNode.has(nodeName)) continue
     const relRoot = normRel(node?.data?.root ?? '')
     if (node?.data?.targets === undefined) continue
     const dir = relRoot === '' || relRoot === '.' ? root : path.join(root, relRoot)
-    let pkg: ProjectMeta['packageJson'] = { name: nodeName }
+    let pkg: PackageMeta['packageJson'] = { name: nodeName }
     try {
-      pkg = (await Bun.file(path.join(dir, 'package.json')).json()) as ProjectMeta['packageJson']
+      pkg = (await Bun.file(path.join(dir, 'package.json')).json()) as PackageMeta['packageJson']
     } catch {
       // No manifest at the node root — keep the synthetic one.
     }
@@ -362,7 +359,7 @@ export async function mapNxWorkspace(
     const name = [pkg.name, nodeName].find((n) => n && !taken.has(n))
     if (name === undefined) continue
     taken.add(name)
-    const synthetic: ProjectMeta = {
+    const synthetic: PackageMeta = {
       name,
       dir,
       packageJson: pkg,
@@ -388,7 +385,7 @@ export async function mapNxWorkspace(
 
   // Once per project, not per task and variant: `path.relative` was a
   // fifth of the mapping at 1,000 projects (item 608).
-  const relOf = new Map<ProjectMeta, string>()
+  const relOf = new Map<PackageMeta, string>()
   for (const meta of allMetas) {
     if (nodeByMeta.get(meta)?.data?.targets) relOf.set(meta, normRel(relPosix(root, meta.dir)))
   }
@@ -399,7 +396,7 @@ export async function mapNxWorkspace(
       ? null
       : await listDotenv(root, [...relOf.values()])
 
-  const mapped: Array<{ meta: ProjectMeta; tasks: GeneratedTask[] }> = []
+  const mapped: Array<{ meta: PackageMeta; tasks: GeneratedTask[] }> = []
   let releasePublish = 0
   // A configuration variant's task (`build:production`) and what it runs.
   const configured = new WeakMap<GeneratedTask, string>()
@@ -521,11 +518,11 @@ export async function mapNxWorkspace(
     nxClosureMemo.set(from, (r = seen))
     return r
   }
-  // What vx's `^` already reaches: a manifest path, direct or through
-  // another project, orders `^x` and folds its key (item 931). Built once,
-  // on the first `^` edge.
-  let pkgGraph: ReturnType<typeof buildPackageGraph> | undefined
-  const packageGraph = () => (pkgGraph ??= buildPackageGraph([...metas]))
+  // What vx's `^` already reaches: a manifest path (the lockfile plugin's
+  // edges), direct or through another project, orders `^x` and folds its
+  // key (item 931). Built once, on the first `^` edge.
+  let pkgGraph: ManifestGraph | undefined
+  const packageGraph = () => (pkgGraph ??= manifestGraph(metas))
   let reach: ((name: string) => ReadonlySet<string>) | undefined
   const reached = (name: string): ReadonlySet<string> => {
     if (reach === undefined) {
@@ -776,7 +773,7 @@ function allTargetNames(nodeMap: Readonly<Record<string, NxNode>>): string[] {
 }
 
 function buildTask(
-  meta: ProjectMeta,
+  meta: PackageMeta,
   projectRel: string,
   scripts: Record<string, unknown>,
   projectName: string,
@@ -785,7 +782,7 @@ function buildTask(
   variant: Variant,
   nodeName: string,
   upstream: NxUpstream,
-  metaByNode: ReadonlyMap<string, ProjectMeta>,
+  metaByNode: ReadonlyMap<string, PackageMeta>,
   nodeMap: Readonly<Record<string, NxNode>>,
   taskNameFor: TaskNameFor,
   opts: MapOpts,
@@ -874,9 +871,8 @@ function buildTask(
   const readyWhen = mapped?.readyWhen
   const persistent = readyWhen !== undefined || persistentTarget(target)
   // vx cleans outputs before a run and Nx never does. With git's file list
-  // known, a wildcard-first output (`**/*.d.ts`) stays cached: each
-  // committed file it reaches is taken back with `!` after mapping
-  // (`spareTrackedOutputs`), and what the clean removes is what the task
+  // known, a wildcard-first output (`**/*.d.ts`) stays cached: core never
+  // cleans a committed file, so what the clean removes is what the task
   // writes (owner, 2026-10-03). Without it, the sources cannot be told apart.
   const wild =
     opts.tracked === undefined
@@ -1023,7 +1019,7 @@ interface MappedCommand {
   /** The `.env` files the command loads, relative to the project dir: key inputs. */
   readonly envInputs: readonly string[]
   /** A translated executor's `exec.timeout`. */
-  readonly timeout?: number
+  readonly timeout?: Duration
   /** The Nx targets a leading `nx <target> <project>` ran: dependency edges (nx-command.ts). */
   readonly nxCalls?: readonly { readonly project: string; readonly target: string }[]
 }
@@ -1169,7 +1165,7 @@ function mapCommand(
 function translation(
   t: unknown,
   at: string,
-): { command: string; env: Record<string, unknown>; timeout: number | undefined } {
+): { command: string; env: Record<string, unknown>; timeout: Duration | undefined } {
   if (!isRecord(t)) throw new UserError(`${at}: must return { command } or undefined`)
   for (const key of Object.keys(t))
     if (key !== 'command' && key !== 'timeout' && key !== 'env')
@@ -1179,13 +1175,13 @@ function translation(
   const timeout = t.timeout
   if (
     timeout !== undefined &&
-    !(typeof timeout === 'number' && Number.isInteger(timeout) && timeout > 0)
+    !(typeof timeout === 'string' && /^[1-9]\d*(ms|s|m|h|d)$/.test(timeout))
   )
-    throw new UserError(`${at}: timeout must be a positive integer (ms)`)
+    throw new UserError(`${at}: timeout must be a duration with its unit, like '30s' or '10m'`)
   const env = t.env ?? {}
   if (!isRecord(env) || Object.values(env).some((v) => typeof v !== 'string'))
     throw new UserError(`${at}: env must map names to strings`)
-  return { command: t.command, env, timeout }
+  return { command: t.command, env, timeout: timeout as Duration | undefined }
 }
 
 /**
@@ -1354,7 +1350,7 @@ function passConfiguration(
   nodeName: string,
   configuration: string,
   nxEdges: (from: string, target: string) => readonly string[],
-  metaByNode: ReadonlyMap<string, ProjectMeta>,
+  metaByNode: ReadonlyMap<string, PackageMeta>,
   emittedIds: ReadonlySet<string>,
   taskNameFor: TaskNameFor,
 ): void {
@@ -1394,7 +1390,7 @@ function narrowToNxGraph(
   pkgName: string,
   nxClosure: (node: string) => ReadonlySet<string>,
   nxEdges: (from: string, target: string) => readonly string[],
-  metaByNode: ReadonlyMap<string, ProjectMeta>,
+  metaByNode: ReadonlyMap<string, PackageMeta>,
   emittedIds: ReadonlySet<string>,
   directDeps: (pkg: string) => readonly string[],
 ): void {
@@ -1436,7 +1432,7 @@ function followNxGraph(
   nodeName: string,
   pkgName: string,
   nxEdges: (from: string, target: string) => readonly string[],
-  metaByNode: ReadonlyMap<string, ProjectMeta>,
+  metaByNode: ReadonlyMap<string, PackageMeta>,
   emittedIds: ReadonlySet<string>,
   reached: (name: string) => ReadonlySet<string>,
 ): void {

package/src/nx/nx-upstream.ts

@@ -16,7 +16,8 @@
 // goes on through it. Nx allows a project cycle and vx's task graph does
 // not: inside a cycle a twin carries its peers' files as workspace globs
 // and edges only out of the cycle.
-import type { GeneratedTask, ProjectMeta } from '@vzn/vx'
+import type { GeneratedTask } from '@vzn/vx'
+import type { PackageMeta } from '../packages.js'
 import { emptyNxInputs, expandNxInputs, type NxInputs } from './nx-inputs.js'
 import { nxProjectOutputs } from './nx-outputs.js'
 import { matchNxProjects } from './nx-deps.js'
@@ -70,7 +71,7 @@ export function planNxUpstream(
   nodes: Readonly<Record<string, GraphNode>>,
   dependencies: unknown,
   workspaceNamed: Readonly<Record<string, unknown[]>> | null,
-  metaByNode: ReadonlyMap<string, ProjectMeta>,
+  metaByNode: ReadonlyMap<string, PackageMeta>,
 ): NxUpstream {
   const isProject = (n: string): boolean => typeof nodes[n]?.data?.root === 'string'
   const projectTags = Object.entries(nodes).map(([name, n]) => ({

package/src/nx-cache/index.ts

@@ -5,7 +5,7 @@
 // The wire is Nx's; the bytes are vx's own artifacts under vx's own keys,
 // so the server is storage — an Nx binary cannot read them.
 //
-// Nothing is on by default: declare `nxCache()` in `vx.workspace.ts` (the
+// Nothing is on by default: declare `nxCache()` in `.vx/workspace.ts` (the
 // local store is the floor beneath it) and give it a server (options, or Nx's own
 // environment variables so a self-hosted setup carries over). Without one
 // the plugin DECLINES and the run stays local.
@@ -13,8 +13,6 @@
 // Imports core only through the public `@vzn/vx` specifier.
 import {
   definePlugin,
-  LayeredCache,
-  type CacheLayer,
   type RemoteCacheLayer,
   type VxPlugin,
   refuseUnknownOptions,
@@ -95,7 +93,7 @@ export function resolveNxCacheConfig(
  * `get` of the same hash, which no caller makes. Bodies stream: `get` returns the `fetch` Response and `put`
  * sends the Blob core hands it. `put` treats `409` as success:
  * the record is immutable and content-addressed, so "already there" is the
- * outcome wanted. An auth failure (401/403) throws ONCE — LayeredCache
+ * outcome wanted. An auth failure (401/403) throws ONCE — core
  * reports it — and then turns the layer off for the rest of the process
  * (a write's 403 turns off writes alone: the read-only token);
  * the requests already in flight when it lands degrade in silence rather
@@ -220,7 +218,7 @@ const NX_CACHE_KEYS: PluginOptionKinds<NxCacheOptions> = {
 }
 
 /**
- * Declare in `vx.workspace.ts`; the local store stays the floor beneath it:
+ * Declare in `.vx/workspace.ts`; the local store stays the floor beneath it:
  *
  * ```ts
  * plugins: [nxCache({ server: 'https://cache.example.com', accessToken: process.env.CACHE_TOKEN })]
@@ -231,13 +229,9 @@ const NX_CACHE_KEYS: PluginOptionKinds<NxCacheOptions> = {
 export function nxCache(options: NxCacheOptions = {}): VxPlugin {
   refuseUnknownOptions('nxCache()', options, NX_CACHE_KEYS)
   return definePlugin(import.meta, {
-    cache(ctx): CacheLayer | undefined {
+    cache(): RemoteCacheLayer | undefined {
       const config = resolveNxCacheConfig(options)
-      if (config === undefined) return undefined
-      return new LayeredCache(ctx.localCache, new NxRemoteCache(config), {
-        policy: ctx.policy,
-        onRemoteError: (err) => ctx.warn(`vx/nx-cache: ${err.message}`),
-      })
+      return config === undefined ? undefined : new NxRemoteCache(config)
     },
   })
 }

package/src/package-fs.ts

@@ -0,0 +1,152 @@
+// What packages.ts needs of the file system and of globs, as core has
+// them: core's copies are not on the façade, and these left core with the
+// package-manager discovery (M, 2026-10-14).
+
+import { readlinkSync, realpathSync } from 'node:fs'
+import path from 'node:path'
+import { UserError } from '@vzn/vx'
+
+/** An `EACCES`, `EPERM` or `EROFS`: not this user's to read or write. */
+export function isPermissionError(err: unknown): err is NodeJS.ErrnoException {
+  if (!(err instanceof Error)) return false
+  const code = (err as NodeJS.ErrnoException).code
+  return code === 'EACCES' || code === 'EPERM' || code === 'EROFS'
+}
+
+/** `EMFILE` or `ENFILE`: out of file descriptors, never "no file here". */
+export function isOutOfFds(err: unknown): err is NodeJS.ErrnoException {
+  if (!(err instanceof Error)) return false
+  const code = (err as NodeJS.ErrnoException).code
+  return code === 'EMFILE' || code === 'ENFILE'
+}
+
+/** `Bun.Glob`'s own alphabet, the class included: member globs follow npm/pnpm. */
+export const BUN_GLOB_WILDCARDS = /[*?[\]{}]/
+
+/** An extglob group (`!(…)`, `@(…)`, …), which `Bun.Glob` does not read. */
+export const EXTGLOB = /[!@+*?]\(/
+
+/**
+ * The spellings npm and pnpm accept that a matcher fed the raw string
+ * turns into nothing: a leading `./`, an inner `/./`, a doubled `//`, and a
+ * trailing `/` on a pattern. Applied after an optional `!`.
+ */
+export function normalizeBunGlob(glob: string): string {
+  const neg = glob.startsWith('!')
+  let g = neg ? glob.slice(1) : glob
+  g = g.replace(/\/{2,}/g, '/').replace(/(^|\/)(\.\/)+/g, '$1')
+  if (g === '.') g = ''
+  if (BUN_GLOB_WILDCARDS.test(g) && g.endsWith('/')) g = `${g.replace(/\/+$/, '')}/**`
+  return neg ? `!${g}` : g
+}
+
+/**
+ * `pattern` with its first brace group expanded, recursively, while that
+ * group holds a `/`: `Bun.Glob`'s scan finds nothing for one.
+ */
+export function slashBraceExpansions(pattern: string): string[] {
+  if (pattern.includes('\\')) return [pattern]
+  for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
+    let depth = 0
+    const cuts: number[] = []
+    let close = -1
+    for (let i = open; i < pattern.length && close === -1; i++) {
+      const c = pattern[i]
+      if (c === '{') depth++
+      else if (c === '}' && --depth === 0) close = i
+      else if (c === ',' && depth === 1) cuts.push(i)
+    }
+    if (close === -1) return [pattern]
+    if (cuts.length === 0 || !pattern.slice(open + 1, close).includes('/')) continue
+    const head = pattern.slice(0, open)
+    const tail = pattern.slice(close + 1)
+    const bounds = [open, ...cuts, close]
+    const out: string[] = []
+    for (let k = 0; k + 1 < bounds.length; k++) {
+      out.push(...slashBraceExpansions(head + pattern.slice(bounds[k]! + 1, bounds[k + 1]) + tail))
+    }
+    return [...new Set(out)]
+  }
+  return [pattern]
+}
+
+/**
+ * `realpathSync`, for a path holding a backslash too: Bun's answers ENOENT
+ * for any such path (1.4.2), so its links are read one by one.
+ */
+export function realpathOf(p: string): string {
+  try {
+    return realpathSync(p)
+  } catch (err) {
+    if (!p.includes('\\')) throw err
+    // Not `path.resolve`: it folds `link/..` lexically, and the kernel
+    // takes `..` from where the link leads.
+    const abs = path.isAbsolute(p) ? p : `${process.cwd()}${path.sep}${p}`
+    let at = path.parse(abs).root
+    const pending = abs.slice(at.length).split(path.sep).filter(Boolean).reverse()
+    let hops = 0
+    while (pending.length > 0) {
+      const next = path.join(at, pending.pop()!)
+      let link: string
+      try {
+        link = readlinkSync(next)
+      } catch (e) {
+        if ((e as NodeJS.ErrnoException).code !== 'EINVAL') throw e
+        at = next
+        continue
+      }
+      // Linux's own bound on links followed in one lookup (MAXSYMLINKS).
+      if (++hops > 40) {
+        throw Object.assign(
+          new Error(`ELOOP: too many symbolic links encountered, realpath '${p}'`),
+          {
+            code: 'ELOOP',
+          },
+        )
+      }
+      if (path.isAbsolute(link)) at = path.parse(link).root
+      pending.push(...link.split('/').filter(Boolean).reverse())
+    }
+    return at
+  }
+}
+
+/**
+ * The git top-level holding `dir`, or null outside git: the nearest `.git`
+ * up from it. A submodule's `.git` file points into its superproject's
+ * `.git/modules`, so the walk goes on to the superproject's.
+ */
+export async function gitTop(dir: string): Promise<string | null> {
+  for (let d = dir; ; d = d.slice(0, d.lastIndexOf('/'))) {
+    if (await Bun.file(`${d}/.git/HEAD`).exists()) return d || '/'
+    const file = Bun.file(`${d}/.git`)
+    if (await file.exists()) {
+      const gitdir = await file.text().catch(() => '')
+      if (!/(^|[\s/])\.git\/modules\//.test(gitdir)) return d || '/'
+    }
+    if (d === '') return null
+  }
+}
+
+/** The files one discovery has read, by absolute path: the bytes, or null when none is there. */
+export type LoadReads = Map<string, Promise<Uint8Array | null>>
+
+/** `file`'s bytes, read at most once per `reads`; null when there is no file there. */
+export function readOnce(reads: LoadReads | undefined, file: string): Promise<Uint8Array | null> {
+  const held = reads?.get(file)
+  if (held !== undefined) return held
+  const f = Bun.file(file)
+  const pending = f
+    .exists()
+    .then((there) => (there ? f.bytes().catch((err: unknown) => unreadable(err, file)) : null))
+  reads?.set(file, pending)
+  return pending
+}
+
+/** A read the file system refused, named as a read; anything else rethrown. */
+export function unreadable(err: unknown, file: string): never {
+  if (isPermissionError(err)) {
+    throw new UserError(`${file}: not readable by this user (${err.code})`)
+  }
+  throw err
+}