@vzn/vx-migrate 0.0.652 → 0.0.653

package/src/migrate.ts

@@ -12,7 +12,18 @@
 // The mappers return a plan; core's migration seam
 // (`applyMigration`) renders, guards, writes and reports.
 
-import { existsSync, readFileSync, realpathSync } from 'node:fs'
+import {
+  closeSync,
+  constants,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readlinkSync,
+  realpathSync,
+  writeFileSync,
+} from 'node:fs'
 import { mkdtemp, rm } from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
@@ -36,6 +47,7 @@ import {
   type PackageMeta,
   type PackageWorkspace,
   reachesManifest,
+  undecodableMembers,
   unreachedHint,
   unreachedPackages,
 } from './packages.js'
@@ -55,6 +67,7 @@ import {
   MODE_QUESTION,
   ownVersion,
   packageManagerOf,
+  type PackageManager,
   parseModeAnswer,
   uninstall,
 } from './adopt.js'
@@ -327,9 +340,11 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
     writesWorkspace && !bare
       ? [
           ...kept,
-          ...workspacePlugins(root, runner === 'vite-task' ? undefined : runner).filter(
-            (p) => !kept.some((k) => k.factory === p.factory),
-          ),
+          ...workspacePlugins(
+            root,
+            runner === 'vite-task' ? undefined : runner,
+            installer(root, parsed),
+          ).filter((p) => !kept.some((k) => k.factory === p.factory)),
         ]
       : []
   let workspaceText: string | undefined
@@ -490,10 +505,60 @@ async function rewriteWorkspace(
   const names = dropped.map((p) => `${p.factory}()`).join(', ')
   if (dry)
     return [['config', `would ${dropped.length > 0 ? `drop ${names} from` : 'rewrite'} ${file}`]]
-  await Bun.write(path.join(root, file), text)
+  writeNoFollow(root, path.join(root, file), text)
   return [['config', `${dropped.length > 0 ? `dropped ${names} from` : 'rewrote'} ${file}`]]
 }
 
+/**
+ * Refuses a `file` that is a symlink, a dangling one too: a repo can carry
+ * `.vx/.gitignore -> /anywhere`, and a write through it lands outside.
+ */
+function refuseSymlink(root: string, file: string): void {
+  let link: string
+  try {
+    if (!lstatSync(file).isSymbolicLink()) return
+    link = readlinkSync(file)
+  } catch {
+    // quiet: nothing there to write through
+    return
+  }
+  throw new UserError(
+    `refusing to write ${relPosix(root, file)}: it is a symlink to ${link}; remove the link and run again`,
+  )
+}
+
+/**
+ * Writes `text` to `file`, never through a link: O_NOFOLLOW refuses one
+ * put there after `refuseSymlink`'s check.
+ */
+function writeNoFollow(root: string, file: string, text: string): void {
+  refuseSymlink(root, file)
+  mkdirSync(path.dirname(file), { recursive: true })
+  let fd: number
+  try {
+    fd = openSync(
+      file,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW,
+      0o666,
+    )
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === 'ELOOP') refuseSymlink(root, file)
+    throw err
+  }
+  try {
+    writeFileSync(fd, text)
+  } finally {
+    closeSync(fd)
+  }
+}
+
+/** The manager `prepareRepo` installs with, or none under `--no-install`. */
+function installer(root: string, args: MigrateArgs): PackageManager | undefined {
+  return args.noInstall === true
+    ? undefined
+    : packageManagerOf(root, process.env['npm_config_user_agent'])
+}
+
 /**
  * Install what the written files import and remove what they no longer
  * do. Returns the report's rows; changes nothing under `--dry`.
@@ -555,7 +620,10 @@ async function keep(
 ): Promise<number> {
   const format: MigrationFormat = args.mjs ? 'mjs' : 'ts'
   const name = `.vx/workspace.${format}`
-  const all = [{ pkg: '@vzn/vx-migrate', factory: runner }, ...workspacePlugins(root, runner)]
+  const all = [
+    { pkg: '@vzn/vx-migrate', factory: runner },
+    ...workspacePlugins(root, runner, installer(root, args)),
+  ]
   const existing = workspaceFileAt(root)
   const before =
     existing === undefined || args.force
@@ -571,6 +639,14 @@ async function keep(
   const extended = before === undefined ? null : extendWorkspaceFile(before, all)
   const text = before === undefined ? renderWorkspaceFile(all, format) : (extended ?? before)
   const declares = before === undefined || extended !== null
+  const ignore = existsSync(path.join(root, '.vx', '.gitignore')) ? [] : ['.vx/.gitignore']
+  const writes = [
+    ...(before === undefined ? [name] : text !== before ? [existing!] : []),
+    ...ignore,
+  ].map((f) => path.join(root, f))
+  // Before the install and the first write: a link (a dangling one reads
+  // as absent above) is refused with nothing changed.
+  if (!args.dry) for (const f of writes) refuseSymlink(root, f)
   const steps = await prepareRepo(
     root,
     [
@@ -585,14 +661,12 @@ async function keep(
   )
   if (args.json)
     for (const [label, value] of steps) ui.say('info', `vx-migrate: ${label}: ${value}`)
-  const ignore = existsSync(path.join(root, '.vx', '.gitignore')) ? [] : ['.vx/.gitignore']
   if (!args.dry) {
-    if (before === undefined) {
-      if (existing !== undefined && existing !== name) await rm(path.join(root, existing))
-      await Bun.write(path.join(root, name), text)
-    } else if (text !== before) await Bun.write(path.join(root, existing!), text)
+    if (before === undefined && existing !== undefined && existing !== name)
+      await rm(path.join(root, existing))
     // vx's own housekeeping, as a run's first cache open writes it.
-    if (ignore.length > 0) await Bun.write(path.join(root, '.vx', '.gitignore'), DOT_VX_GITIGNORE)
+    for (const f of writes)
+      writeNoFollow(root, f, f.endsWith('.gitignore') ? DOT_VX_GITIGNORE : text)
   }
   const cache = REMOTE_CACHE[runner]
   const cacheLine =
@@ -735,7 +809,8 @@ async function scripts(
   }
   const unmapped = namelessNotes(root, nameless)
   // Only a workspace file this run writes declares it; one already here is the user's.
-  const lockfile = workspaceFileAt(root) === undefined ? lockfilePlugin(root) : undefined
+  const lockfile =
+    workspaceFileAt(root) === undefined ? lockfilePlugin(root, installer(root, args)) : undefined
   const plugins =
     lockfile === undefined ? [] : [{ pkg: '@vzn/vx-lockfile', factory: lockfile.factory }]
   const plan = migrateScripts(
@@ -751,12 +826,21 @@ async function scripts(
   // to fix (M-42). Asked of the globs, not of `metas`: a nameless or
   // shared-name member is matched yet absent from `metas` (M-46).
   const globs = workspace.packageGlobs.filter((g) => g !== '.')
-  const noMembers =
+  const unread =
     empty && globs.length > 0 && !(await reachesManifest(workspace))
-      ? [
-          `the workspace globs (${globs.map((g) => `"${g}"`).join(', ')}) match no package.json: add a package under one, or fix the glob`,
-        ]
-      : []
+      ? await undecodableMembers(workspace)
+      : undefined
+  const noMembers =
+    unread === undefined
+      ? []
+      : unread.length > 0
+        ? unread.map(
+            (d) =>
+              `${d}: the directory's name is not valid UTF-8, so its package.json cannot be read — rename it`,
+          )
+        : [
+            `the workspace globs (${globs.map((g) => `"${g}"`).join(', ')}) match no package.json: add a package under one, or fix the glob`,
+          ]
   const installed = await prepareRepo(root, [...new Set(plugins.map((p) => p.pkg))], args)
   const code = await applyMigration({
     root,

package/src/nx/index.ts

@@ -53,18 +53,43 @@ export type {
 } from './nx-map.js'
 import { listDotenv } from './nx-dotenv.js'
 import { trackedKinds } from '../tracked-outputs.js'
-import { relPosix } from '../paths.js'
+import { isRecord, relPosix } from '../paths.js'
 import { memberProjects, withManifests } from '../manifests.js'
 import type { AdoptionMapping } from '../mapping-cache.js'
 import { yarnrcText } from '../script-command.js'
+import { lockfilePlugin } from '../workspace-notes.js'
 
 /** The snapshot's name under vx's cache dir — local to the machine, like the cache. */
 const SNAPSHOT = 'nx-project-graph.json'
 /** What the snapshot was exported from (`graphInputKey`), beside it. */
 const SNAPSHOT_KEY = 'nx-project-graph.key'
-/** The files at the workspace root whose edit can move Nx's graph. */
+/**
+ * The files at the workspace root whose edit can move Nx's graph: Nx's own,
+ * and the tool configs an inferring `@nx/*` plugin reads (a root project's
+ * `jest.config.ts`, the `jest.preset.js` a project's extends).
+ */
 const ROOT_GRAPH_FILE =
-  /^(nx\.json|package\.json|\.nxignore|tsconfig[^/]*\.json|pnpm-workspace\.yaml|pnpm-lock\.yaml|package-lock\.json|yarn\.lock|bun\.lockb?)$/
+  /^(nx\.json|package\.json|\.nxignore|tsconfig[^/]*\.json|pnpm-workspace\.yaml|pnpm-lock\.yaml|package-lock\.json|yarn\.lock|bun\.lockb?|jest\.(config|preset)\.[cm]?[jt]s|\.eslintrc(\.[a-z]+)?|eslint\.config\.[cm]?[jt]s|(vite|vitest|playwright|cypress|webpack|rollup|rspack|next)\.config\.[cm]?[jt]s|vitest\.workspace\.[cm]?[jt]s)$/
+
+/**
+ * Whether a root-relative path can be part of a local plugin nx.json names
+ * by path (`./tools/plugin.js`, `{ plugin: './plugins/obj' }`): anything in
+ * the plugin's directory, where the modules it imports sit; one at the root
+ * is the file itself, with any extension, or its directory.
+ */
+function localPlugins(json: Record<string, unknown> | undefined): (p: string) => boolean {
+  const plugins = Array.isArray(json?.['plugins']) ? (json['plugins'] as unknown[]) : []
+  const tests = plugins.flatMap((e): ((p: string) => boolean)[] => {
+    const spec = typeof e === 'string' ? e : isRecord(e) ? e['plugin'] : undefined
+    if (typeof spec !== 'string' || !spec.startsWith('./')) return []
+    const file = path.posix.normalize(spec)
+    const dir = path.posix.dirname(file)
+    if (dir !== '.') return [(p) => p.startsWith(`${dir}/`)]
+    const stem = file.replace(/\.[^.]+$/, '')
+    return [(p) => p === file || p.startsWith(`${file}/`) || p.startsWith(`${stem}.`)]
+  })
+  return (p) => tests.some((t) => t(p))
+}
 
 export interface NxPluginOptions {
   /**
@@ -118,6 +143,9 @@ export function nx(options: NxPluginOptions = {}): VxPlugin {
   const rootOf = (workspaceRoot: string): string =>
     options.root === undefined ? workspaceRoot : path.resolve(workspaceRoot, options.root)
   refuseExecutors(options.executors)
+  // The root files the workspace's plugins claim, read by `config`: a
+  // lockfile no plugin claims is in no key unless a task lists it.
+  let claimed: ReadonlySet<string> = new Set()
   // One graph load per RUN, shared by `discover` and `project`: the run
   // hands both stages the same projects array (discover's, grown by what
   // it named), so its identity is the run's, as the mapping's is.
@@ -141,17 +169,26 @@ export function nx(options: NxPluginOptions = {}): VxPlugin {
     import.meta,
     async (ctx) => {
       const root = rootOf(ctx.workspaceRoot)
+      const lock = lockfilePlugin(root)?.file
+      const unclaimed =
+        lock !== undefined && !(root === ctx.workspaceRoot && claimed.has(lock)) ? lock : undefined
       return mapAll(
         root,
         ctx.projects,
         await graphOf(root, ctx.cacheDir, ctx.projects),
         options.executors,
+        unclaimed,
       )
     },
     // At the workspace root only, as `turbo()` claims its file.
     options.root === undefined ? ['nx.json'] : [],
     {
       async config(workspace, ctx) {
+        claimed = new Set(
+          (workspace.plugins ?? []).flatMap((p) =>
+            p ? ((p as VxPlugin).fingerprint?.files ?? []) : [],
+          ),
+        )
         const root = rootOf(ctx.workspaceRoot)
         const nxBaseCommit = Bun.env['NX_BASE']?.trim()
         if (nxBaseCommit) ctx.setBranch({ base: nxBaseCommit })
@@ -305,6 +342,7 @@ async function mapAll(
   projects: readonly ProjectMeta[],
   loaded: LoadedGraph,
   executors: NxExecutors | undefined,
+  lockfile: string | undefined,
 ): Promise<AdoptionRun> {
   const metas = await withManifests(projects)
   const { text, graph, notes } = loaded
@@ -312,11 +350,12 @@ async function mapAll(
   // The mapping is cached on what it read; a translator is code it ran.
   if (executors !== undefined)
     reads.push(JSON.stringify(Object.entries(executors).map(([k, fn]) => [k, String(fn)])))
+  reads.push(`unclaimed lockfile: ${lockfile ?? ''}`)
   return {
     name: 'nx',
     spareTracked: true,
     reads,
-    map: (tracked) => index(root, metas, graph, notes, tracked, executors),
+    map: (tracked) => index(root, metas, graph, notes, tracked, executors, lockfile),
   }
 }
 
@@ -335,7 +374,7 @@ const textOf = (file: string): Promise<string> =>
  * and the package.json of each graph node no package matches (its
  * synthetic project's name), the `.env` names in every project dir,
  * NX_LOAD_DOT_ENV_FILES, whether the bins the tasks run are installed,
- * and the graph load's own notes.
+ * which root tsconfig exists, and the graph load's own notes.
  */
 async function nxReads(
   root: string,
@@ -379,6 +418,13 @@ async function nxReads(
     ...(await Promise.all(
       ['package.json', '.npmrc', 'pnpm-workspace.yaml'].map((f) => textOf(path.join(root, f))),
     )),
+    // Which root tsconfig every task keys (`rootTsConfig`), decided by
+    // existence: an untracked new one changes no git index.
+    JSON.stringify(
+      await Promise.all(
+        ['tsconfig.base.json', 'tsconfig.json'].map((f) => Bun.file(path.join(root, f)).exists()),
+      ),
+    ),
     ...notes,
   ]
 }
@@ -390,6 +436,7 @@ async function index(
   loadNotes: readonly string[],
   trackedFiles: () => Promise<readonly string[] | null>,
   executors: NxExecutors | undefined,
+  lockfile: string | undefined,
 ): Promise<AdoptionMapping> {
   const notes: string[] = []
   const live = [...loadNotes]
@@ -407,6 +454,7 @@ async function index(
     ...(tracked === null ? {} : { tracked: trackedKinds(tracked) }),
     ownConfig: (rel) => configs.get(relRoot(rel)) ?? null,
     ...(executors === undefined ? {} : { executors }),
+    ...(lockfile === undefined ? {} : { lockfile }),
   })
   notes.push(...mapped.notes)
   const byName = new Map<string, GeneratedProject>()
@@ -587,21 +635,23 @@ async function graphInputKey(
   // A `.gitignore` anywhere too: Nx's project walk honours each one, so an
   // edit between project roots hides or shows a project.
   const roots = dirs.map((d) => relPosix(root, d))
+  // A manifest needs no read of its own: git lists it when it is edited, and
+  // HEAD moves when an edit is committed (reading all 2,000 cost 50 ms at
+  // 1,000 projects). nx.json's chain does: a base may sit in node_modules,
+  // where git does not look.
+  const nxJson = await readNxJson(root).catch(() => null)
+  const plugin = localPlugins(nxJson?.json)
   const graphFile = (p: string): boolean =>
     p === 'project.json' ||
     p.endsWith('/project.json') ||
     p === '.gitignore' ||
     p.endsWith('/.gitignore') ||
     roots.some((r) => r === '' || p.startsWith(`${r}/`)) ||
-    (!p.includes('/') && ROOT_GRAPH_FILE.test(p))
+    (!p.includes('/') && ROOT_GRAPH_FILE.test(p)) ||
+    plugin(p)
   const listed = [
     ...new Set(changed.filter((p) => !inCache(p) && !nxCache(p) && !vxDir(p) && graphFile(p))),
   ]
-  // A manifest needs no read of its own: git lists it when it is edited, and
-  // HEAD moves when an edit is committed (reading all 2,000 cost 50 ms at
-  // 1,000 projects). nx.json's chain does: a base may sit in node_modules,
-  // where git does not look.
-  const nxJson = await readNxJson(root).catch(() => null)
   const files = [
     ...(nxJson?.files ?? [path.join(root, 'nx.json')]),
     ...listed.sort().map((p) => path.join(root, p)),

package/src/nx/nx-inputs.ts

@@ -7,10 +7,13 @@
 // (`dependentTasksOutputFiles`) is nothing; `externalDependencies` is a todo saying
 // so. Extracted from `buildTask` in item 606.
 
-import path from 'node:path'
 import { nxWorkspacePath, underProject, withProjectDir } from './nx-outputs.js'
-import type { TrackedKinds } from '../tracked-outputs.js'
-import { gluedGlobstarAsStar, minimatchToVx, nxBareGroups } from '../glob-grammar.js'
+import {
+  apartTakeBacks,
+  gluedGlobstarAsStar,
+  minimatchToVx,
+  nxBareGroups,
+} from '../glob-grammar.js'
 import { shellQuote } from '../nx-command.js'
 
 export interface NxInputs {
@@ -37,6 +40,8 @@ export interface NxInputs {
   }>
   /** `{ dependentTasksOutputFiles }` globs: keyed only through a `dependsOn` edge. */
   readonly dependentOutputs: string[]
+  /** Those of them marked `transitive`: read from every task below, not only the direct ones. */
+  readonly transitiveOutputs: string[]
 }
 
 export function emptyNxInputs(): NxInputs {
@@ -47,6 +52,7 @@ export function emptyNxInputs(): NxInputs {
     runtimeCmds: [],
     upstream: [],
     dependentOutputs: [],
+    transitiveOutputs: [],
   }
 }
 
@@ -78,14 +84,19 @@ export function expandNxInputs(
     readonly rel: string
     readonly name: string
     readonly outputs?: readonly string[]
-    /** git's tracked files by directory; unknown, every output counts as ignored. */
-    readonly tracked?: (rel: string) => TrackedKinds
-    /** The root package.json's dependency names: every task's key holds them. */
+    /** The root-relative outputs git ignores; unknown, every output counts as ignored. */
+    readonly ignoredOutputs?: ReadonlySet<string>
+    /** The root package.json's dependency names: a lockfile plugin keys them into every task. */
     readonly rootDeps?: ReadonlySet<string>
+    /** The root lockfile no plugin claims, which nothing keys unless a task lists it. */
+    readonly lockfile?: string
   },
   into: NxInputs,
   todos: string[],
 ): void {
+  // A `{workspaceRoot}` path into the project, kept apart from the
+  // project's own set until the end (see there).
+  const wsOwn: string[] = []
   const expand = (entry: unknown, seen: Set<string>): void => {
     if (typeof entry === 'string') {
       let s = entry
@@ -113,14 +124,7 @@ export function expandNxInputs(
         // An output git tracks (a generator writing into `src`) is hashed,
         // and dropping it keyed `build` on no file (stale hit, 2026-10-28).
         const lit = withProjectDir(p, at.rel, false)
-        const ignored = (o: string): boolean => {
-          if (at.tracked === undefined) return true
-          const dir = path.posix.dirname(o)
-          return (
-            at.tracked(o).files.length === 0 &&
-            !at.tracked(dir).files.includes(dir === '.' ? o : o.slice(dir.length + 1))
-          )
-        }
+        const ignored = (o: string): boolean => at.ignoredOutputs?.has(o) ?? true
         if (
           neg === '' &&
           at.outputs?.some((o) => (lit === o || lit.startsWith(`${o}/`)) && ignored(o))
@@ -141,7 +145,10 @@ export function expandNxInputs(
             ? null
             : underProject(g, at.rel)
         if (own === null) into.wsFiles.push(neg + withProjectDir(g, at.rel, true))
-        else into.files.push(neg + (own === '' ? '**/*' : withProjectDir(own, at.rel, true)))
+        else
+          (s.startsWith('{workspaceRoot}') ? wsOwn : into.files).push(
+            neg + (own === '' ? '**/*' : withProjectDir(own, at.rel, true)),
+          )
         return
       }
       // Bare string = named-input reference.
@@ -192,18 +199,23 @@ export function expandNxInputs(
         return
       }
       if (o.externalDependencies !== undefined) {
-        // Not the project's package.json: Nx's inferred targets name root
-        // devDependencies (eslint, vitest), which only the lockfile keys.
-        // One the root declares is keyed already, with or without a
-        // lockfile plugin (it keys the root's dependencies): nothing to
-        // say. The todo sat on 32 tasks of analogjs for `eslint`.
+        // Nx hashes each named package's resolved version, and core keys no
+        // lockfile. With no plugin claiming the file, the task keys it whole,
+        // a superset: a `left-pad` bump was a hit where Nx re-ran. A lockfile
+        // plugin keys the project's and the root's dependencies, so a name
+        // the root declares is keyed there: the todo sat on 32 tasks of
+        // analogjs for `eslint`. Nx's inferred targets name root
+        // devDependencies (eslint, vitest), not the project's package.json.
         const names = Array.isArray(o.externalDependencies) ? o.externalDependencies : []
+        if (at.lockfile !== undefined) {
+          expand(`{workspaceRoot}/${at.lockfile}`, seen)
+          return
+        }
         if (names.length > 0 && names.every((n) => typeof n === 'string' && at.rootDeps?.has(n)))
           return
         todos.push(
-          `input {externalDependencies: ${JSON.stringify(o.externalDependencies)}}: vx keys ` +
-            'every task on the lockfile (the whole file, or with a @vzn/vx-lockfile plugin the ' +
-            "project's and the root's dependencies) — safe to drop unless only another project installs one",
+          `input {externalDependencies: ${JSON.stringify(o.externalDependencies)}}: a @vzn/vx-lockfile ` +
+            "plugin keys each task on its project's and the root's dependencies — one only another project installs is not keyed",
         )
         return
       }
@@ -214,7 +226,9 @@ export function expandNxInputs(
       // The mapper checks an edge is left to carry them.
       if (o.dependentTasksOutputFiles !== undefined) {
         const g = o.dependentTasksOutputFiles
-        into.dependentOutputs.push(typeof g === 'string' ? g : JSON.stringify(g))
+        const glob = typeof g === 'string' ? g : JSON.stringify(g)
+        into.dependentOutputs.push(glob)
+        if (o.transitive === true) into.transitiveOutputs.push(glob)
         return
       }
       // `{ workingDirectory }` hashes where Nx was started (`cwd:relative`
@@ -276,6 +290,16 @@ export function expandNxInputs(
       )
   }
   for (const entry of entries) expand(entry, new Set())
+  // Nx hashes the `{projectRoot}` and `{workspaceRoot}` filesets as two
+  // sets, a `!` acting only inside its own; core subtracts every `!` in
+  // `files` from every entry. Production's `!{projectRoot}/jest.config.[jt]s`
+  // took out a target's `{workspaceRoot}/libs/a/jest.config.ts`, and an
+  // edit to it replayed (stale hit). A `!` that may reach the other set
+  // goes: more keyed, never less.
+  if (wsOwn.length > 0) {
+    const [own, ws] = apartTakeBacks(into.files, wsOwn)
+    into.files.splice(0, into.files.length, ...own, ...ws)
+  }
   // Nx matches a project fileset with no positive glob against every project
   // file, the negations taken out: nx-recipes' `noMarkdown` is
   // `["!{projectRoot}/**/*.md"]`, and a `.tsx` edit re-runs its build while a