@vzn/vx 0.0.0 → 0.0.12

package/src/workspace/lockfile.ts

@@ -0,0 +1,118 @@
+// vx-lock.json — frozen resolved-config lockfile.
+//
+// `vx lock` evaluates every project's vx.config.* in the CURRENT
+// environment and freezes the resolved objects (plus a content hash of
+// each config file) into `vx-lock.json` at the workspace root. While the
+// lock exists, runs load configs from it instead of evaluating —
+// frozen-env semantics. See docs/design/config-lock-2026-06.md.
+//
+// Verification asymmetry (deliberate):
+//   - runs TRUST the lock: hash-only staleness check, eval-free.
+//   - `vx lock --check` AUDITS it: full re-evaluation + deep equality,
+//     which catches eval-time env drift that file hashes cannot see.
+
+import path from 'node:path'
+import type { ProjectConfig } from '../config.js'
+import { relPosix, UserError } from '../util/index.js'
+import { validateProjectConfig } from './project-loader.js'
+
+export const LOCKFILE_NAME = 'vx-lock.json'
+export const LOCKFILE_VERSION = 1
+
+export interface LockfileEntry {
+  /** Workspace-root-relative POSIX path to the project's config file. */
+  configPath: string
+  /** xxh3 hex of the config file bytes at lock time. */
+  configHash: string
+  /** The resolved (post-evaluation) config object, JSON-normalized. */
+  config: ProjectConfig
+}
+
+export interface Lockfile {
+  version: number
+  projects: Record<string, LockfileEntry>
+}
+
+export function lockfilePath(root: string): string {
+  return path.join(root, LOCKFILE_NAME)
+}
+
+/**
+ * Read and shape-validate `vx-lock.json`. Returns `null` when no lock
+ * exists (the common case — the feature is opt-in). The lock is a
+ * user-editable file, so this is a system boundary: malformed content
+ * throws a `UserError` instead of crashing deeper in the run.
+ */
+export async function readLockfile(root: string): Promise<Lockfile | null> {
+  const file = Bun.file(lockfilePath(root))
+  if (!(await file.exists())) return null
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(await file.text())
+  } catch {
+    throw new UserError(`${LOCKFILE_NAME} is not valid JSON — re-run \`vx lock\` or delete it`)
+  }
+  if (typeof parsed !== 'object' || parsed === null) {
+    throw new UserError(`${LOCKFILE_NAME} must be a JSON object — re-run \`vx lock\``)
+  }
+  const lock = parsed as { version?: unknown; projects?: unknown }
+  if (lock.version !== LOCKFILE_VERSION) {
+    throw new UserError(
+      `${LOCKFILE_NAME} has unsupported version ${String(lock.version)} ` +
+        `(this vx expects ${LOCKFILE_VERSION}) — re-run \`vx lock\``,
+    )
+  }
+  if (typeof lock.projects !== 'object' || lock.projects === null) {
+    throw new UserError(`${LOCKFILE_NAME}: \`projects\` must be an object — re-run \`vx lock\``)
+  }
+  for (const [name, entry] of Object.entries(lock.projects)) {
+    const e = entry as Partial<LockfileEntry> | null
+    if (
+      !e ||
+      typeof e.configPath !== 'string' ||
+      typeof e.configHash !== 'string' ||
+      typeof e.config !== 'object' ||
+      e.config === null
+    ) {
+      throw new UserError(`${LOCKFILE_NAME}: entry for "${name}" is malformed — re-run \`vx lock\``)
+    }
+  }
+  return parsed as Lockfile
+}
+
+export async function writeLockfile(root: string, lock: Lockfile): Promise<void> {
+  await Bun.write(lockfilePath(root), `${JSON.stringify(lock, null, 2)}\n`)
+}
+
+/**
+ * Run-time config load from the lock: verify the config file's content
+ * hash against the lock entry, then return the FROZEN resolved config.
+ * No evaluation happens — this is the fast, eval-free trust path. A
+ * changed file or an unlocked project is a hard error: the lock's
+ * contract is "what runs is what was locked", and silently falling
+ * back to evaluation would break frozen-env semantics.
+ */
+export async function frozenProjectConfig(
+  lock: Lockfile,
+  meta: { name: string; configPath: string },
+  root: string,
+): Promise<ProjectConfig> {
+  const rel = relPosix(root, meta.configPath)
+  const entry = lock.projects[meta.name]
+  if (!entry || entry.configPath !== rel) {
+    throw new UserError(
+      `${LOCKFILE_NAME} has no entry for "${meta.name}" (${rel}) — ` +
+        `run \`vx lock\` to refresh, or delete ${LOCKFILE_NAME}`,
+    )
+  }
+  // No staleness checks here, deliberately: --frozen runs after
+  // `vx lock --check` in any sane pipeline, and that audit re-
+  // evaluates everything — a per-file byte-hash re-check would be
+  // redundant work and a weaker guarantee pretending to add safety
+  // (it can't see import closures or env anyway). configHash stays
+  // in the file solely for --check's fast file-changed reporting.
+  // The lock is hand-editable; the stored config crosses the same
+  // boundary a freshly evaluated one does.
+  validateProjectConfig(entry.config, `${LOCKFILE_NAME} (${meta.name})`)
+  return entry.config
+}

package/src/workspace/nested-dirs.ts

@@ -0,0 +1,34 @@
+import path from 'node:path'
+import type { ProjectEntry } from './workspace.js'
+
+/**
+ * For each project, the absolute dirs of other projects that live
+ * underneath it. Used to enforce project-boundary isolation: a
+ * project's task cannot see files inside another project, even if its
+ * globs would otherwise match.
+ *
+ * Sort once, then scan: nested projects of `p` form a contiguous run
+ * immediately after `p` in the sorted order (any non-descendant breaks
+ * the prefix-match). O(P log P) instead of the naive O(P²) cross
+ * product. Stable for any project set with no dir collisions, which
+ * the workspace loader already enforces.
+ */
+export function computeNestedProjectDirs(
+  entries: Array<Pick<ProjectEntry, 'name' | 'dir'>>,
+): Map<string, string[]> {
+  const result = new Map<string, string[]>()
+  if (entries.length === 0) return result
+  const sorted = [...entries].sort((a, b) => (a.dir < b.dir ? -1 : a.dir > b.dir ? 1 : 0))
+  for (let i = 0; i < sorted.length; i++) {
+    const p = sorted[i]!
+    const prefix = p.dir + path.sep
+    const nested: string[] = []
+    for (let j = i + 1; j < sorted.length; j++) {
+      const other = sorted[j]!
+      if (!other.dir.startsWith(prefix)) break
+      nested.push(other.dir)
+    }
+    result.set(p.name, nested)
+  }
+  return result
+}

package/src/workspace/package-graph.ts

@@ -0,0 +1,148 @@
+import type { ProjectMeta } from './workspace.js'
+
+export interface PackageGraph {
+  /** Immediate workspace deps (sorted). */
+  directDeps: (name: string) => string[]
+  /** All transitive workspace deps for each project. */
+  transitiveDeps: (name: string) => string[]
+  /** All transitive workspace dependents (packages that depend on the named one). */
+  transitiveDependents: (name: string) => string[]
+}
+
+export function buildPackageGraph(projects: ProjectMeta[]): PackageGraph {
+  const byName = new Map<string, ProjectMeta>()
+  for (const p of projects) byName.set(p.name, p)
+
+  const directDeps = new Map<string, string[]>()
+  for (const p of projects) {
+    const seen = new Set<string>()
+    for (const field of [
+      'dependencies',
+      'devDependencies',
+      'peerDependencies',
+      'optionalDependencies',
+    ] as const) {
+      const obj = p.packageJson[field]
+      if (!obj) continue
+      for (const name of Object.keys(obj)) {
+        if (name === p.name) continue
+        if (byName.has(name)) seen.add(name)
+      }
+    }
+    directDeps.set(p.name, [...seen].sort())
+  }
+
+  // Reverse adjacency: who declares X as a workspace dep.
+  const directDependents = new Map<string, string[]>()
+  for (const [name, deps] of directDeps) {
+    for (const d of deps) {
+      const arr = directDependents.get(d)
+      if (arr) arr.push(name)
+      else directDependents.set(d, [name])
+    }
+  }
+  for (const arr of directDependents.values()) arr.sort()
+
+  // Set-union DFS closures are O(P²) entries on dense layered graphs
+  // (same disease the scheduler's reachOf had — 68 ms at 1090
+  // projects). Bitset closures swept in topo order are O(E·P/32),
+  // and indexing projects in sorted-name order means materializing a
+  // closure is a single ascending bit-scan — already sorted, no
+  // per-call sort. Package graphs (unlike task graphs) may legally
+  // contain cycles; the bitset sweep requires a DAG, so a cycle
+  // (detected by the Kahn pass not draining) falls back wholesale to
+  // the legacy DFS — byte-identical behavior for that rare case.
+  const names = [...byName.keys()].sort()
+  const index = new Map<string, number>()
+  for (let i = 0; i < names.length; i++) index.set(names[i]!, i)
+
+  function bitsetClosures(edges: Map<string, string[]>): Uint32Array | null {
+    const n = names.length
+    const words = (n + 31) >>> 5
+    const adj: number[][] = Array.from({ length: n }, () => [])
+    const indegree = new Uint32Array(n)
+    for (const [from, tos] of edges) {
+      const fi = index.get(from)!
+      for (const to of tos) {
+        const ti = index.get(to)
+        if (ti === undefined) continue
+        adj[fi]!.push(ti) // edge from → to; closure(from) ⊇ {to} ∪ closure(to)
+        indegree[ti]!++
+      }
+    }
+    const topo = new Int32Array(n)
+    let head = 0
+    let tail = 0
+    for (let i = 0; i < n; i++) if (indegree[i] === 0) topo[tail++] = i
+    while (head < tail) {
+      const v = topo[head++]!
+      for (const t of adj[v]!) if (--indegree[t]! === 0) topo[tail++] = t
+    }
+    if (tail < n) return null // cycle — caller falls back to DFS
+    const closure = new Uint32Array(n * words)
+    for (let t = tail - 1; t >= 0; t--) {
+      const i = topo[t]!
+      const base = i * words
+      for (const d of adj[i]!) {
+        closure[base + (d >>> 5)]! |= 1 << (d & 31)
+        const dbase = d * words
+        for (let w = 0; w < words; w++) closure[base + w]! |= closure[dbase + w]!
+      }
+    }
+    return closure
+  }
+
+  function legacyTransitive(
+    name: string,
+    edges: Map<string, string[]>,
+    cache: Map<string, string[]>,
+    stack: Set<string> = new Set(),
+  ): string[] {
+    const cached = cache.get(name)
+    if (cached) return cached
+    if (stack.has(name)) return []
+    stack.add(name)
+    const out = new Set<string>()
+    for (const d of edges.get(name) ?? []) {
+      out.add(d)
+      for (const t of legacyTransitive(d, edges, cache, stack)) out.add(t)
+    }
+    stack.delete(name)
+    const result = [...out].sort()
+    cache.set(name, result)
+    return result
+  }
+
+  function makeAccessor(edges: Map<string, string[]>): (name: string) => string[] {
+    const closures = bitsetClosures(edges)
+    const memo = new Map<string, string[]>()
+    if (closures === null) {
+      return (name) => legacyTransitive(name, edges, memo)
+    }
+    const words = (names.length + 31) >>> 5
+    return (name) => {
+      const cached = memo.get(name)
+      if (cached) return cached
+      const i = index.get(name)
+      if (i === undefined) return []
+      const base = i * words
+      const out: string[] = []
+      for (let w = 0; w < words; w++) {
+        let v = closures[base + w]!
+        while (v !== 0) {
+          const bit = 31 - Math.clz32(v & -v)
+          out.push(names[(w << 5) + bit]!)
+          v &= v - 1
+        }
+      }
+      memo.set(name, out)
+      return out
+    }
+  }
+
+  return {
+    directDeps: (name) => directDeps.get(name) ?? [],
+    transitiveDeps: makeAccessor(directDeps),
+    transitiveDependents: makeAccessor(directDependents),
+  }
+}