@vzn/vx 0.0.18 → 0.0.21

package/src/workspace/filter.ts

@@ -34,6 +34,10 @@ export interface ParsedFilter {
    * to a concrete set of project names before calling applyFilters.
    */
   gitSince?: string
+  /** A path form carrying a glob (`./packages/*`): matched over the root-relative project dir. */
+  pathGlob?: Bun.Glob
+  /** The workspace root `pathGlob` is relative to. */
+  pathRoot?: string
 }
 
 export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
@@ -71,15 +75,35 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
 
   let isPath = false
   let matcher = s
-  if (s.startsWith('./') || s === '.') {
+  let pathGlob: Bun.Glob | undefined
+  const pathForm =
+    s.startsWith('./') || s === '.'
+      ? s
+      : s.startsWith('{') && s.endsWith('}')
+        ? s.slice(1, -1)
+        : undefined
+  if (pathForm !== undefined) {
     isPath = true
-    matcher = path.resolve(workspaceRoot, s)
-  } else if (s.startsWith('{') && s.endsWith('}')) {
-    isPath = true
-    matcher = path.resolve(workspaceRoot, s.slice(1, -1))
+    matcher = path.resolve(workspaceRoot, pathForm)
+    // `./packages/*` — pnpm's and Turbo's spelling for "every package under
+    // packages": a glob over the root-relative project dir. Resolved
+    // against the workspace root like the literal form.
+    if (/[*?[\]{}]/.test(pathForm)) {
+      const rel = path.relative(workspaceRoot, matcher).split(path.sep).join('/')
+      pathGlob = new Bun.Glob(rel.replace(/\/+$/, ''))
+    }
   }
 
-  return { raw, negate, withDeps, withDependents, onlyDeps, isPath, matcher }
+  return {
+    raw,
+    negate,
+    withDeps,
+    withDependents,
+    onlyDeps,
+    isPath,
+    matcher,
+    ...(pathGlob !== undefined ? { pathGlob, pathRoot: workspaceRoot } : {}),
+  }
 }
 
 function matchProjects(
@@ -95,6 +119,19 @@ function matchProjects(
   }
   const out: string[] = []
   if (filter.isPath) {
+    if (filter.pathGlob !== undefined) {
+      // The glob is matched against the project's own dir, as pnpm and
+      // Turbo do: `./packages/*` is the packages directly under `packages`,
+      // `./packages/**` reaches the nested ones too.
+      for (const p of projects) {
+        const rel = path
+          .relative(filter.pathRoot ?? '', p.dir)
+          .split(path.sep)
+          .join('/')
+        if (filter.pathGlob.match(rel)) out.push(p.name)
+      }
+      return out
+    }
     const prefix = filter.matcher + path.sep
     for (const p of projects) {
       if (p.dir === filter.matcher || p.dir.startsWith(prefix)) out.push(p.name)

package/src/workspace/fingerprint.ts

@@ -44,13 +44,47 @@ export const WORKSPACE_FINGERPRINT_FILES = [
  * invalidates every cached entry. Coarse but correct.
  */
 export async function computeWorkspaceFingerprint(workspaceRoot: string): Promise<string> {
-  let h = 0n
+  return (await computeWorkspaceFingerprints(workspaceRoot, NONE)).all
+}
+
+const NONE: ReadonlySet<string> = new Set()
+
+export interface WorkspaceFingerprints {
+  /** Every file folded — what the config-evaluation cache keys on. */
+  readonly all: string
+  /**
+   * The same fold minus the files a plugin claims (`VxPlugin.fingerprint`)
+   * — what every task key folds. Identical to `all` with nothing claimed.
+   */
+  readonly unclaimed: string
+}
+
+/**
+ * Both digests from one read of each file. A claimed file leaves the key
+ * digest entirely (its name too): the claimant folds what it means per
+ * project, and a fold of "present" would still re-key the workspace when
+ * the file appeared.
+ */
+export async function computeWorkspaceFingerprints(
+  workspaceRoot: string,
+  claimed: ReadonlySet<string>,
+): Promise<WorkspaceFingerprints> {
+  let all = 0n
+  let unclaimed = 0n
   for (const f of WORKSPACE_FINGERPRINT_FILES) {
     const full = path.join(workspaceRoot, f)
     const file = Bun.file(full)
     if (!(await file.exists())) continue
-    h = xxh3(`${f}\0`, h)
-    h = xxh3(await file.bytes(), h)
+    const bytes = await file.bytes()
+    all = xxh3(`${f}\0`, all)
+    all = xxh3(bytes, all)
+    if (claimed.has(f)) continue
+    unclaimed = xxh3(`${f}\0`, unclaimed)
+    unclaimed = xxh3(bytes, unclaimed)
   }
+  return { all: hex(all), unclaimed: hex(unclaimed) }
+}
+
+function hex(h: bigint): string {
   return h.toString(16).padStart(16, '0')
 }

package/src/workspace/index.ts

@@ -1,9 +1,19 @@
 // Module contract. Cross-module imports must come through here; see
 // docs/design/module-isolation-2026-06.md and tests/module-boundaries.test.ts.
 
-export { affectedProjects, defaultAffectedBase, workspaceGlobsMatch } from './affected.js'
+export {
+  affectedProjects,
+  defaultAffectedBase,
+  type FingerprintClaims,
+  workspaceGlobsMatch,
+} from './affected.js'
 export { applyFilters, parseFilter } from './filter.js'
-export { computeWorkspaceFingerprint, WORKSPACE_FINGERPRINT_FILES } from './fingerprint.js'
+export {
+  computeWorkspaceFingerprint,
+  computeWorkspaceFingerprints,
+  WORKSPACE_FINGERPRINT_FILES,
+  type WorkspaceFingerprints,
+} from './fingerprint.js'
 export { computeNestedProjectDirs } from './nested-dirs.js'
 export { buildPackageGraph, type PackageGraph } from './package-graph.js'
 export {
@@ -11,6 +21,7 @@ export {
   LOCKFILE_NAME,
   LOCKFILE_VERSION,
   lockfilePath,
+  FROZEN_WITHOUT_LOCK,
   readLockfile,
   writeLockfile,
   type Lockfile,
@@ -20,8 +31,9 @@ export {
   loadProjectConfig,
   loadProjectConfigs,
   loadWorkspaceConfig,
-  validateProjectConfig,
+  WORKSPACE_CONFIG_FILENAMES,
 } from './project-loader.js'
+export { validateProjectConfig } from './config-schema.js'
 export type { LoadProjectConfigOptions } from './project-loader.js'
 export {
   blobOidOf,
@@ -33,7 +45,22 @@ export {
   findWorkspaceRoot,
   listProjects,
   loadWorkspace,
+  memberBaseDirs,
   resolveCacheDir,
   type ProjectEntry,
   type ProjectMeta,
 } from './workspace.js'
+// The migration seam (see migration.ts) and core's own mapper, the scripts one.
+export {
+  applyMigration,
+  PERSISTENT_TASK_NAMES,
+  PERSISTENT_TODO,
+  quoteTsLiteral,
+  type ApplyMigrationArgs,
+  type MigrationFormat,
+  type GeneratedProject,
+  type GeneratedTask,
+  type MigrationPlan,
+  type RawExpr,
+} from './migration.js'
+export { delegatedScript, migrateScripts } from './migrate-scripts.js'

package/src/workspace/lockfile.ts

@@ -14,7 +14,7 @@
 import path from 'node:path'
 import type { ProjectConfig } from '../config.js'
 import { relPosix, UserError } from '../util/index.js'
-import { validateProjectConfig } from './project-loader.js'
+import { validateProjectConfig } from './config-schema.js'
 
 export const LOCKFILE_NAME = 'vx-lock.json'
 export const LOCKFILE_VERSION = 1
@@ -43,6 +43,10 @@ export function lockfilePath(root: string): string {
  * user-editable file, so this is a system boundary: malformed content
  * throws a `UserError` instead of crashing deeper in the run.
  */
+/** What a `--frozen` verb says when there is no lock to read. */
+export const FROZEN_WITHOUT_LOCK =
+  "--frozen requires vx-lock.json at the workspace root — run 'vx lock' and commit it"
+
 export async function readLockfile(root: string): Promise<Lockfile | null> {
   const file = Bun.file(lockfilePath(root))
   if (!(await file.exists())) return null
@@ -96,12 +100,13 @@ export async function writeLockfile(root: string, lock: Lockfile): Promise<void>
 }
 
 /**
- * Run-time config load from the lock: verify the config file's content
- * hash against the lock entry, then return the FROZEN resolved config.
- * No evaluation happens — this is the fast, eval-free trust path. A
- * changed file or an unlocked project is a hard error: the lock's
- * contract is "what runs is what was locked", and silently falling
- * back to evaluation would break frozen-env semantics.
+ * Run-time config load from the lock: return the FROZEN resolved config
+ * for a project the lock has an entry for. No evaluation happens — this
+ * is the fast, eval-free trust path — and no staleness check either (see
+ * below): the lock's contract is "what runs is what was locked", so a
+ * config file edited since `vx lock` still runs as locked until
+ * `vx lock --check` says otherwise. An unlocked project is a hard error;
+ * silently falling back to evaluation would break frozen-env semantics.
  */
 export async function frozenProjectConfig(
   lock: Lockfile,

package/src/{cli → workspace}/migrate-scripts.ts

@@ -3,15 +3,18 @@
 //
 // Scripts carry a command and nothing else, so the mapping is honest about
 // what it cannot know: every task gets `exec.command` verbatim; `build`
-// gets the conventional `dependsOn: ['^build']` and `test` / `lint` /
-// `typecheck` wait for `build` when the package has one; a dev-server
+// gets the conventional `dependsOn: ['^build']` and `test` / `typecheck`
+// wait for `build` when the package has one (`lint` does not); a dev-server
 // shaped script becomes persistent. Caching is opt-in and needs declared
-// inputs AND outputs, which a script cannot tell us — so `build` is
-// emitted with a cache block whose inputs are the whole project and whose
-// outputs are EMPTY, under a TODO naming what to fill in. A cache block
-// that guessed `dist/**` would restore the wrong tree for every package
-// that writes somewhere else, and a wrong restore is the worst failure
-// vx has.
+// inputs AND outputs, which a script cannot tell us — so NO task gets a
+// cache block; `build` carries a TODO showing the block to add. Until
+// 2026-09-04 `build` was emitted with whole-project inputs and EMPTY
+// outputs "to fill in": that is not an uncached task but a no-output one —
+// it hits on unchanged inputs and skips the build with nothing to restore,
+// so a deleted `dist` stayed deleted under a green `up-to-date` run
+// (reproduced on the init walkthrough). A block that guessed `dist/**`
+// would restore the wrong tree for every package that writes somewhere
+// else, and a wrong restore is the worst failure vx has.
 //
 // Two npm conventions are mapped rather than copied, because copying them
 // loses behaviour: `pre<x>` / `post<x>` hooks, which npm runs around `x`
@@ -21,11 +24,18 @@
 // `<pm> run <other>` becomes a GROUP over `<other>`, so the graph sees the
 // dependency instead of a package-manager subprocess it cannot cache.
 
-import type { ProjectMeta } from '../workspace/index.js'
-import type { GeneratedProject, GeneratedTask, MigrationPlan } from './migrate.js'
+import type { ProjectMeta } from './workspace.js'
+import {
+  type GeneratedProject,
+  type GeneratedTask,
+  type MigrationPlan,
+  PERSISTENT_TASK_NAMES,
+  PERSISTENT_TODO,
+} from './migration.js'
 
-const PERSISTENT = new Set(['dev', 'start', 'serve', 'watch', 'preview'])
-const AFTER_BUILD = new Set(['test', 'lint', 'typecheck', 'check', 'e2e'])
+// `lint` is not here: a linter reads sources, and an edge to `build`
+// serialises the two for nothing (the init walkthrough, 2026-09-04).
+const AFTER_BUILD = new Set(['test', 'typecheck', 'check', 'e2e'])
 const LIFECYCLE = /^(pre|post)(install|publish|pack|version)$|^(prepare|prepublishOnly|install)$/
 
 /**
@@ -97,17 +107,14 @@ export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
         )
       }
       const task: Record<string, unknown> = { exec: { command } }
-      if (PERSISTENT.has(name)) {
+      if (PERSISTENT_TASK_NAMES.has(name)) {
         task['exec'] = { command, persistent: {} }
-        todos.push(
-          'persistent: add `readyWhen: "<line the server prints when ready>"` so dependents wait for it',
-        )
+        todos.push(PERSISTENT_TODO)
       }
       if (name === 'build') {
         task['dependsOn'] = ['^build']
-        task['cache'] = { inputs: { files: ['**/*'] }, outputs: { files: [] } }
         todos.push(
-          "cache: inputs default to the whole project ('**/*'); narrow them (e.g. 'src/**') and declare outputs (e.g. 'dist/**') — nothing is cached until outputs are declared",
+          "cache: add `cache: { inputs: { files: ['src/**'] }, outputs: { files: ['dist/**'] } }` with this package's real inputs and outputs — without it the task always runs; a block with EMPTY outputs would be a cached no-op, not an uncached task",
         )
       } else if (AFTER_BUILD.has(name) && hasBuild) {
         task['dependsOn'] = ['build']
@@ -118,7 +125,7 @@ export function migrateScripts(metas: readonly ProjectMeta[]): MigrationPlan {
   }
   return {
     headerNotes: [
-      'each script became a task with its command verbatim; caching needs declared inputs and outputs, so only `build` got a cache block, with empty outputs to fill in',
+      'each script became a task with its command verbatim; caching needs declared inputs and outputs, so no task got a cache block — `build` carries a TODO showing the one to add',
     ],
     projects,
     extraFiles: [],