@vzn/vx 0.0.0 → 0.0.14

package/src/workspace/affected.ts

@@ -0,0 +1,118 @@
+// `--affected` — git-relative project selection.
+//
+// Resolves the set of project names whose files have changed since a
+// given git ref. The diff is `<since>...HEAD` plus working-tree
+// changes (uncommitted edits), so it captures everything you've
+// touched on the current branch.
+//
+// We use `git diff --name-only <since>` which by default compares the
+// `<since>` commit to the working tree — i.e. commits-from-`<since>`
+// + index + unstaged. Matches Turbo's `[<since>]` filter semantics.
+
+import path from 'node:path'
+import { UserError } from '../util/index.js'
+import { LOCKFILE_NAME } from './lockfile.js'
+import type { ProjectMeta } from './workspace.js'
+
+export interface AffectedArgs {
+  workspaceRoot: string
+  /** Git ref / commit / branch to compare against. Required. */
+  since: string
+  projects: readonly ProjectMeta[]
+}
+
+/**
+ * Return the set of project names whose files changed between
+ * `<since>` and the current working tree. Errors if `git` is missing
+ * or `<since>` doesn't resolve to a commit.
+ */
+export async function affectedProjects(args: AffectedArgs): Promise<Set<string>> {
+  await verifyRef(args.workspaceRoot, args.since)
+
+  const proc = Bun.spawn({
+    // `--no-renames` is crucial for project-affected detection: with
+    // git's auto rename-detection on (the default in modern git), a
+    // cross-project `git mv` collapses to a single rename entry that
+    // surfaces only the destination path. We'd then miss flagging the
+    // source project as affected. Treating renames as delete+add gives
+    // us both halves so both projects get correctly marked.
+    cmd: ['git', 'diff', '--no-renames', '--name-only', args.since],
+    cwd: args.workspaceRoot,
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+  const stdout = await new Response(proc.stdout).text()
+  const stderr = await new Response(proc.stderr).text()
+  const exit = await proc.exited
+  if (exit !== 0) {
+    throw new UserError(`git diff failed (exit ${exit}): ${stderr.trim()}`)
+  }
+
+  // vx-lock.json (workspace-root metadata) is excluded like a gitignored
+  // file: re-running `vx lock` must not mark every project affected.
+  const changed = stdout.split('\n').filter((s) => s.length > 0 && s !== LOCKFILE_NAME)
+  return projectsContaining(args.workspaceRoot, changed, args.projects)
+}
+
+/**
+ * Resolve the default base for `--affected` with no explicit value.
+ * Tries the remote's HEAD branch first (`origin/main`, `origin/master`,
+ * etc.), then falls back to `HEAD~1` which always exists once there
+ * are at least two commits.
+ */
+export async function defaultAffectedBase(workspaceRoot: string): Promise<string> {
+  const probe = Bun.spawnSync({
+    cmd: ['git', 'symbolic-ref', '--short', '-q', 'refs/remotes/origin/HEAD'],
+    cwd: workspaceRoot,
+    stdout: 'pipe',
+    stderr: 'ignore',
+  })
+  const out = new TextDecoder().decode(probe.stdout).trim()
+  if (probe.exitCode === 0 && out.length > 0) return out
+  return 'HEAD~1'
+}
+
+async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
+  const proc = Bun.spawnSync({
+    cmd: ['git', 'rev-parse', '--verify', '--quiet', ref],
+    cwd: workspaceRoot,
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+  if (proc.exitCode !== 0) {
+    throw new UserError(
+      `git ref "${ref}" did not resolve. Pass a branch or commit you have locally.`,
+    )
+  }
+}
+
+function projectsContaining(
+  workspaceRoot: string,
+  changedRelPaths: readonly string[],
+  projects: readonly ProjectMeta[],
+): Set<string> {
+  // Index projects by their (canonical) dir, then for each changed path walk
+  // its ancestor dirs bottom-up until one is a project dir. The FIRST hit is
+  // the DEEPEST containing project — so a nested project still wins over its
+  // parent, exactly as the prior longest-dir sort did — but this is
+  // O(files · path-depth) instead of O(files · projects): independent of the
+  // project count, which is what a big --affected diff on a 1000-project repo
+  // pays for.
+  const dirToName = new Map<string, string>()
+  for (const p of projects) dirToName.set(p.dir, p.name)
+  const out = new Set<string>()
+  for (const rel of changedRelPaths) {
+    let dir = path.resolve(workspaceRoot, rel)
+    for (;;) {
+      const name = dirToName.get(dir)
+      if (name !== undefined) {
+        out.add(name)
+        break
+      }
+      const parent = path.dirname(dir)
+      if (parent === dir) break // reached the filesystem root
+      dir = parent
+    }
+  }
+  return out
+}

package/src/workspace/filter.ts

@@ -0,0 +1,155 @@
+// Filter DSL — pnpm-style selectors for `-F / --filter`.
+//
+//   <pattern>        name glob (e.g. foo, @scope/*)
+//   ./<dir>          packages whose dir is at or under <dir> (relative to workspace root)
+//   {<dir>}          same as ./<dir>
+//   <pattern>...     pattern + its transitive workspace dependencies
+//   ...<pattern>     pattern + its transitive workspace dependents
+//   <pattern>^...    only the transitive deps of pattern (excluding the matched package)
+//   !<pattern>       exclude packages matching pattern from the selection
+//   [<since>]        projects affected since the given git ref
+//                    (Turbo-style; resolved upstream of applyFilters via
+//                    `affectedProjects` since it needs FS + git access)
+//
+// Filters are evaluated in order. If any include filter is present, the base
+// set is empty and matched/expanded packages are added. If only excludes are
+// given, the base set is "all projects" and excluded packages are removed.
+
+import path from 'node:path'
+import type { PackageGraph } from './package-graph.js'
+import type { ProjectMeta } from './workspace.js'
+
+export interface ParsedFilter {
+  raw: string
+  negate: boolean
+  withDeps: boolean
+  withDependents: boolean
+  onlyDeps: boolean
+  isPath: boolean
+  /** Glob pattern (for name match) or absolute path (for path match). */
+  matcher: string
+  /**
+   * When non-undefined, this filter is a git-relative `[<since>]`
+   * selector. The matcher field is unused; the CLI resolves the ref
+   * to a concrete set of project names before calling applyFilters.
+   */
+  gitSince?: string
+}
+
+export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
+  let s = raw
+  const negate = s.startsWith('!')
+  if (negate) s = s.slice(1)
+
+  const withDependents = s.startsWith('...')
+  if (withDependents) s = s.slice(3)
+
+  let onlyDeps = false
+  let withDeps = false
+  if (s.endsWith('^...')) {
+    onlyDeps = true
+    s = s.slice(0, -4)
+  } else if (s.endsWith('...')) {
+    withDeps = true
+    s = s.slice(0, -3)
+  }
+
+  // `[<since>]` git-relative selector. Suffix walks already ran above,
+  // so `[main]...` parses as `[main]` with withDeps=true.
+  if (s.startsWith('[') && s.endsWith(']')) {
+    return {
+      raw,
+      negate,
+      withDeps,
+      withDependents,
+      onlyDeps,
+      isPath: false,
+      matcher: '',
+      gitSince: s.slice(1, -1),
+    }
+  }
+
+  let isPath = false
+  let matcher = s
+  if (s.startsWith('./') || s === '.') {
+    isPath = true
+    matcher = path.resolve(workspaceRoot, s)
+  } else if (s.startsWith('{') && s.endsWith('}')) {
+    isPath = true
+    matcher = path.resolve(workspaceRoot, s.slice(1, -1))
+  }
+
+  return { raw, negate, withDeps, withDependents, onlyDeps, isPath, matcher }
+}
+
+function matchProjects(
+  filter: ParsedFilter,
+  projects: ProjectMeta[],
+  affectedByFilter: Map<ParsedFilter, Set<string>> | undefined,
+): string[] {
+  // `[<since>]` selectors are pre-resolved by the caller (the parser
+  // is pure; git access happens upstream). Use the provided set as
+  // the match set for this filter.
+  if (filter.gitSince !== undefined) {
+    return [...(affectedByFilter?.get(filter) ?? new Set())]
+  }
+  const out: string[] = []
+  if (filter.isPath) {
+    const prefix = filter.matcher + path.sep
+    for (const p of projects) {
+      if (p.dir === filter.matcher || p.dir.startsWith(prefix)) out.push(p.name)
+    }
+    return out
+  }
+  if (!filter.matcher.includes('*')) {
+    for (const p of projects) {
+      if (p.name === filter.matcher) out.push(p.name)
+    }
+    return out
+  }
+  const glob = new Bun.Glob(filter.matcher)
+  for (const p of projects) {
+    if (glob.match(p.name)) out.push(p.name)
+  }
+  return out
+}
+
+export interface ApplyFiltersOptions {
+  filters: ParsedFilter[]
+  projects: ProjectMeta[]
+  graph: PackageGraph
+  /**
+   * Pre-resolved affected-project sets for each `[<since>]` filter.
+   * The caller (CLI / programmatic embedder) runs the git work and
+   * stuffs results in this map before calling applyFilters, which
+   * stays pure + sync.
+   */
+  affectedByFilter?: Map<ParsedFilter, Set<string>>
+}
+
+export function applyFilters(opts: ApplyFiltersOptions): Set<string> {
+  const allNames = opts.projects.map((p) => p.name)
+  const hasInclude = opts.filters.some((f) => !f.negate)
+  const selected = new Set<string>(hasInclude ? [] : allNames)
+
+  for (const f of opts.filters) {
+    const matched = matchProjects(f, opts.projects, opts.affectedByFilter)
+    const expanded = new Set<string>()
+    for (const name of matched) {
+      if (!f.onlyDeps) expanded.add(name)
+      if (f.withDeps || f.onlyDeps) {
+        for (const d of opts.graph.transitiveDeps(name)) expanded.add(d)
+      }
+      if (f.withDependents) {
+        for (const d of opts.graph.transitiveDependents(name)) expanded.add(d)
+      }
+    }
+    if (f.negate) {
+      for (const name of expanded) selected.delete(name)
+    } else {
+      for (const name of expanded) selected.add(name)
+    }
+  }
+
+  return selected
+}

package/src/workspace/fingerprint.ts

@@ -0,0 +1,41 @@
+import path from 'node:path'
+import { xxh3 } from '../util/index.js'
+
+// Every package-manager lockfile we know about, plus the workspace
+// definition files. Whichever ones exist get folded into the
+// fingerprint; missing ones are skipped. Hashed in declaration order
+// for determinism — adding a new entry here changes the fingerprint
+// for projects that have that file present, which is fine: that's the
+// whole point of bumping CACHE_VERSION when the fingerprint surface
+// expands.
+const WORKSPACE_FINGERPRINT_FILES = [
+  // Lockfiles
+  'pnpm-lock.yaml',
+  'package-lock.json',
+  'npm-shrinkwrap.json',
+  'yarn.lock',
+  'bun.lock',
+  'bun.lockb',
+  // Workspace definition (pnpm); package.json is hashed per-project
+  // via projectPackageJsonHash, not here.
+  'pnpm-workspace.yaml',
+]
+
+/**
+ * One hash for the workspace as a whole, derived from whichever
+ * lockfile + workspace-definition files exist at the root. Folded
+ * into every task's cache key so any lockfile bump (`pnpm update`,
+ * `npm install`, `bun install`, …) or a workspace-shape change
+ * invalidates every cached entry. Coarse but correct.
+ */
+export async function computeWorkspaceFingerprint(workspaceRoot: string): Promise<string> {
+  let h = 0n
+  for (const f of WORKSPACE_FINGERPRINT_FILES) {
+    const full = path.join(workspaceRoot, f)
+    const file = Bun.file(full)
+    if (!(await file.exists())) continue
+    h = xxh3(`${f}\0`, h)
+    h = xxh3(await file.bytes(), h)
+  }
+  return h.toString(16).padStart(16, '0')
+}

package/src/workspace/index.ts

@@ -0,0 +1,27 @@
+// Module contract. Cross-module imports must come through here; see
+// docs/design/module-isolation-2026-06.md and tests/module-boundaries.test.ts.
+
+export { affectedProjects, defaultAffectedBase } from './affected.js'
+export { applyFilters, parseFilter } from './filter.js'
+export { computeWorkspaceFingerprint } from './fingerprint.js'
+export { computeNestedProjectDirs } from './nested-dirs.js'
+export { buildPackageGraph, type PackageGraph } from './package-graph.js'
+export {
+  frozenProjectConfig,
+  LOCKFILE_NAME,
+  LOCKFILE_VERSION,
+  lockfilePath,
+  readLockfile,
+  writeLockfile,
+  type Lockfile,
+  type LockfileEntry,
+} from './lockfile.js'
+export { loadProjectConfig, loadWorkspaceConfig } from './project-loader.js'
+export {
+  findWorkspaceRoot,
+  listProjects,
+  loadWorkspace,
+  resolveCacheDir,
+  type ProjectEntry,
+  type ProjectMeta,
+} from './workspace.js'

package/src/workspace/lockfile.ts

@@ -0,0 +1,118 @@
+// vx-lock.json — frozen resolved-config lockfile.
+//
+// `vx lock` evaluates every project's vx.config.* in the CURRENT
+// environment and freezes the resolved objects (plus a content hash of
+// each config file) into `vx-lock.json` at the workspace root. While the
+// lock exists, runs load configs from it instead of evaluating —
+// frozen-env semantics. See docs/design/config-lock-2026-06.md.
+//
+// Verification asymmetry (deliberate):
+//   - runs TRUST the lock: hash-only staleness check, eval-free.
+//   - `vx lock --check` AUDITS it: full re-evaluation + deep equality,
+//     which catches eval-time env drift that file hashes cannot see.
+
+import path from 'node:path'
+import type { ProjectConfig } from '../config.js'
+import { relPosix, UserError } from '../util/index.js'
+import { validateProjectConfig } from './project-loader.js'
+
+export const LOCKFILE_NAME = 'vx-lock.json'
+export const LOCKFILE_VERSION = 1
+
+export interface LockfileEntry {
+  /** Workspace-root-relative POSIX path to the project's config file. */
+  configPath: string
+  /** xxh3 hex of the config file bytes at lock time. */
+  configHash: string
+  /** The resolved (post-evaluation) config object, JSON-normalized. */
+  config: ProjectConfig
+}
+
+export interface Lockfile {
+  version: number
+  projects: Record<string, LockfileEntry>
+}
+
+export function lockfilePath(root: string): string {
+  return path.join(root, LOCKFILE_NAME)
+}
+
+/**
+ * Read and shape-validate `vx-lock.json`. Returns `null` when no lock
+ * exists (the common case — the feature is opt-in). The lock is a
+ * user-editable file, so this is a system boundary: malformed content
+ * throws a `UserError` instead of crashing deeper in the run.
+ */
+export async function readLockfile(root: string): Promise<Lockfile | null> {
+  const file = Bun.file(lockfilePath(root))
+  if (!(await file.exists())) return null
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(await file.text())
+  } catch {
+    throw new UserError(`${LOCKFILE_NAME} is not valid JSON — re-run \`vx lock\` or delete it`)
+  }
+  if (typeof parsed !== 'object' || parsed === null) {
+    throw new UserError(`${LOCKFILE_NAME} must be a JSON object — re-run \`vx lock\``)
+  }
+  const lock = parsed as { version?: unknown; projects?: unknown }
+  if (lock.version !== LOCKFILE_VERSION) {
+    throw new UserError(
+      `${LOCKFILE_NAME} has unsupported version ${String(lock.version)} ` +
+        `(this vx expects ${LOCKFILE_VERSION}) — re-run \`vx lock\``,
+    )
+  }
+  if (typeof lock.projects !== 'object' || lock.projects === null) {
+    throw new UserError(`${LOCKFILE_NAME}: \`projects\` must be an object — re-run \`vx lock\``)
+  }
+  for (const [name, entry] of Object.entries(lock.projects)) {
+    const e = entry as Partial<LockfileEntry> | null
+    if (
+      !e ||
+      typeof e.configPath !== 'string' ||
+      typeof e.configHash !== 'string' ||
+      typeof e.config !== 'object' ||
+      e.config === null
+    ) {
+      throw new UserError(`${LOCKFILE_NAME}: entry for "${name}" is malformed — re-run \`vx lock\``)
+    }
+  }
+  return parsed as Lockfile
+}
+
+export async function writeLockfile(root: string, lock: Lockfile): Promise<void> {
+  await Bun.write(lockfilePath(root), `${JSON.stringify(lock, null, 2)}\n`)
+}
+
+/**
+ * Run-time config load from the lock: verify the config file's content
+ * hash against the lock entry, then return the FROZEN resolved config.
+ * No evaluation happens — this is the fast, eval-free trust path. A
+ * changed file or an unlocked project is a hard error: the lock's
+ * contract is "what runs is what was locked", and silently falling
+ * back to evaluation would break frozen-env semantics.
+ */
+export async function frozenProjectConfig(
+  lock: Lockfile,
+  meta: { name: string; configPath: string },
+  root: string,
+): Promise<ProjectConfig> {
+  const rel = relPosix(root, meta.configPath)
+  const entry = lock.projects[meta.name]
+  if (!entry || entry.configPath !== rel) {
+    throw new UserError(
+      `${LOCKFILE_NAME} has no entry for "${meta.name}" (${rel}) — ` +
+        `run \`vx lock\` to refresh, or delete ${LOCKFILE_NAME}`,
+    )
+  }
+  // No staleness checks here, deliberately: --frozen runs after
+  // `vx lock --check` in any sane pipeline, and that audit re-
+  // evaluates everything — a per-file byte-hash re-check would be
+  // redundant work and a weaker guarantee pretending to add safety
+  // (it can't see import closures or env anyway). configHash stays
+  // in the file solely for --check's fast file-changed reporting.
+  // The lock is hand-editable; the stored config crosses the same
+  // boundary a freshly evaluated one does.
+  validateProjectConfig(entry.config, `${LOCKFILE_NAME} (${meta.name})`)
+  return entry.config
+}

package/src/workspace/nested-dirs.ts

@@ -0,0 +1,34 @@
+import path from 'node:path'
+import type { ProjectEntry } from './workspace.js'
+
+/**
+ * For each project, the absolute dirs of other projects that live
+ * underneath it. Used to enforce project-boundary isolation: a
+ * project's task cannot see files inside another project, even if its
+ * globs would otherwise match.
+ *
+ * Sort once, then scan: nested projects of `p` form a contiguous run
+ * immediately after `p` in the sorted order (any non-descendant breaks
+ * the prefix-match). O(P log P) instead of the naive O(P²) cross
+ * product. Stable for any project set with no dir collisions, which
+ * the workspace loader already enforces.
+ */
+export function computeNestedProjectDirs(
+  entries: Array<Pick<ProjectEntry, 'name' | 'dir'>>,
+): Map<string, string[]> {
+  const result = new Map<string, string[]>()
+  if (entries.length === 0) return result
+  const sorted = [...entries].sort((a, b) => (a.dir < b.dir ? -1 : a.dir > b.dir ? 1 : 0))
+  for (let i = 0; i < sorted.length; i++) {
+    const p = sorted[i]!
+    const prefix = p.dir + path.sep
+    const nested: string[] = []
+    for (let j = i + 1; j < sorted.length; j++) {
+      const other = sorted[j]!
+      if (!other.dir.startsWith(prefix)) break
+      nested.push(other.dir)
+    }
+    result.set(p.name, nested)
+  }
+  return result
+}

package/src/workspace/package-graph.ts

@@ -0,0 +1,148 @@
+import type { ProjectMeta } from './workspace.js'
+
+export interface PackageGraph {
+  /** Immediate workspace deps (sorted). */
+  directDeps: (name: string) => string[]
+  /** All transitive workspace deps for each project. */
+  transitiveDeps: (name: string) => string[]
+  /** All transitive workspace dependents (packages that depend on the named one). */
+  transitiveDependents: (name: string) => string[]
+}
+
+export function buildPackageGraph(projects: ProjectMeta[]): PackageGraph {
+  const byName = new Map<string, ProjectMeta>()
+  for (const p of projects) byName.set(p.name, p)
+
+  const directDeps = new Map<string, string[]>()
+  for (const p of projects) {
+    const seen = new Set<string>()
+    for (const field of [
+      'dependencies',
+      'devDependencies',
+      'peerDependencies',
+      'optionalDependencies',
+    ] as const) {
+      const obj = p.packageJson[field]
+      if (!obj) continue
+      for (const name of Object.keys(obj)) {
+        if (name === p.name) continue
+        if (byName.has(name)) seen.add(name)
+      }
+    }
+    directDeps.set(p.name, [...seen].sort())
+  }
+
+  // Reverse adjacency: who declares X as a workspace dep.
+  const directDependents = new Map<string, string[]>()
+  for (const [name, deps] of directDeps) {
+    for (const d of deps) {
+      const arr = directDependents.get(d)
+      if (arr) arr.push(name)
+      else directDependents.set(d, [name])
+    }
+  }
+  for (const arr of directDependents.values()) arr.sort()
+
+  // Set-union DFS closures are O(P²) entries on dense layered graphs
+  // (same disease the scheduler's reachOf had — 68 ms at 1090
+  // projects). Bitset closures swept in topo order are O(E·P/32),
+  // and indexing projects in sorted-name order means materializing a
+  // closure is a single ascending bit-scan — already sorted, no
+  // per-call sort. Package graphs (unlike task graphs) may legally
+  // contain cycles; the bitset sweep requires a DAG, so a cycle
+  // (detected by the Kahn pass not draining) falls back wholesale to
+  // the legacy DFS — byte-identical behavior for that rare case.
+  const names = [...byName.keys()].sort()
+  const index = new Map<string, number>()
+  for (let i = 0; i < names.length; i++) index.set(names[i]!, i)
+
+  function bitsetClosures(edges: Map<string, string[]>): Uint32Array | null {
+    const n = names.length
+    const words = (n + 31) >>> 5
+    const adj: number[][] = Array.from({ length: n }, () => [])
+    const indegree = new Uint32Array(n)
+    for (const [from, tos] of edges) {
+      const fi = index.get(from)!
+      for (const to of tos) {
+        const ti = index.get(to)
+        if (ti === undefined) continue
+        adj[fi]!.push(ti) // edge from → to; closure(from) ⊇ {to} ∪ closure(to)
+        indegree[ti]!++
+      }
+    }
+    const topo = new Int32Array(n)
+    let head = 0
+    let tail = 0
+    for (let i = 0; i < n; i++) if (indegree[i] === 0) topo[tail++] = i
+    while (head < tail) {
+      const v = topo[head++]!
+      for (const t of adj[v]!) if (--indegree[t]! === 0) topo[tail++] = t
+    }
+    if (tail < n) return null // cycle — caller falls back to DFS
+    const closure = new Uint32Array(n * words)
+    for (let t = tail - 1; t >= 0; t--) {
+      const i = topo[t]!
+      const base = i * words
+      for (const d of adj[i]!) {
+        closure[base + (d >>> 5)]! |= 1 << (d & 31)
+        const dbase = d * words
+        for (let w = 0; w < words; w++) closure[base + w]! |= closure[dbase + w]!
+      }
+    }
+    return closure
+  }
+
+  function legacyTransitive(
+    name: string,
+    edges: Map<string, string[]>,
+    cache: Map<string, string[]>,
+    stack: Set<string> = new Set(),
+  ): string[] {
+    const cached = cache.get(name)
+    if (cached) return cached
+    if (stack.has(name)) return []
+    stack.add(name)
+    const out = new Set<string>()
+    for (const d of edges.get(name) ?? []) {
+      out.add(d)
+      for (const t of legacyTransitive(d, edges, cache, stack)) out.add(t)
+    }
+    stack.delete(name)
+    const result = [...out].sort()
+    cache.set(name, result)
+    return result
+  }
+
+  function makeAccessor(edges: Map<string, string[]>): (name: string) => string[] {
+    const closures = bitsetClosures(edges)
+    const memo = new Map<string, string[]>()
+    if (closures === null) {
+      return (name) => legacyTransitive(name, edges, memo)
+    }
+    const words = (names.length + 31) >>> 5
+    return (name) => {
+      const cached = memo.get(name)
+      if (cached) return cached
+      const i = index.get(name)
+      if (i === undefined) return []
+      const base = i * words
+      const out: string[] = []
+      for (let w = 0; w < words; w++) {
+        let v = closures[base + w]!
+        while (v !== 0) {
+          const bit = 31 - Math.clz32(v & -v)
+          out.push(names[(w << 5) + bit]!)
+          v &= v - 1
+        }
+      }
+      memo.set(name, out)
+      return out
+    }
+  }
+
+  return {
+    directDeps: (name) => directDeps.get(name) ?? [],
+    transitiveDeps: makeAccessor(directDeps),
+    transitiveDependents: makeAccessor(directDependents),
+  }
+}