@vzn/vx 0.0.636 → 0.0.638

package/src/workspace/dependency-rules.ts

@@ -0,0 +1,65 @@
+import type { DependencyRule } from '../config.js'
+import { refusal } from '../util/index.js'
+import { compileNameGlob } from './filter.js'
+import type { PackageGraph } from './package-graph.js'
+
+/**
+ * `run.rules.dependencies`, held to each project's direct workspace
+ * dependencies (`PackageGraph.directDeps`: the manifest's and the
+ * cross-project `dependsOn` edges). A rule constrains the projects its
+ * `from` selects: each dependency must match an `allow` selector when
+ * `allow` is given, and no `deny` one. Every rule that selects a project
+ * applies, so a deny beats any allow. Checked by `vx lock` only (owner,
+ * 2026-10-13); every broken edge is named in one refusal.
+ */
+export function checkDependencyRules(
+  rules: readonly DependencyRule[],
+  projects: readonly string[],
+  tags: ReadonlyMap<string, readonly string[]>,
+  graph: PackageGraph,
+): void {
+  if (rules.length === 0) return
+  const compiled = rules.map((r) => ({
+    from: selector(r.from),
+    allow: r.allow?.map(selector),
+    deny: r.deny?.map(selector),
+  }))
+  const broken: string[] = []
+  for (const name of projects) {
+    const own = tags.get(name) ?? []
+    for (const [i, rule] of compiled.entries()) {
+      if (!rule.from(name, own)) continue
+      for (const dep of graph.directDeps(name)) {
+        const theirs = tags.get(dep) ?? []
+        const denied = rule.deny?.some((s) => s(dep, theirs)) === true
+        if (denied || (rule.allow !== undefined && !rule.allow.some((s) => s(dep, theirs))))
+          broken.push(
+            `${name} depends on ${dep}, which run.rules.dependencies[${i}] (from '${rules[i]!.from}') ${denied ? 'denies' : 'does not allow'}`,
+          )
+      }
+    }
+  }
+  if (broken.length === 0) return
+  const headline = `${broken.length === 1 ? '1 dependency breaks' : `${broken.length} dependencies break`} run.rules.dependencies`
+  throw refusal(
+    {
+      headline,
+      what: broken,
+      fix: "drop the dependency, or change the project's tags or the rule",
+    },
+    {
+      code: 'VX_E_DEPENDENCY_RULE',
+      message: `${headline}:\n${broken.map((b) => `  ${b}`).join('\n')}\nDrop the dependency, or change the project's tags or the rule.`,
+    },
+  )
+}
+
+/** `tag:<glob>` matches a project carrying a matching tag; anything else, its name. */
+function selector(s: string): (name: string, tags: readonly string[]) => boolean {
+  if (s.startsWith('tag:')) {
+    const re = compileNameGlob(s.slice(4))
+    return (_, tags) => tags.some((t) => re.test(t))
+  }
+  const re = compileNameGlob(s)
+  return (name) => re.test(name)
+}

package/src/workspace/filter.ts

@@ -131,8 +131,8 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
   if (s === '') throw new UserError(`filter "${raw}" names no project`)
 
   // `//` is Turbo's name for the root package (`--filter=//`, `//...`,
-  // `!//`, probed on 2.8.17). vx names the root project by its
-  // package.json name, so `//` is its directory, and only a project
+  // `!//`, probed on 2.8.17), and vx's for the root project unless
+  // something names it, so `//` is its directory, and only a project
   // there: read as `.`, it would select every project when the root is
   // none.
   if (s === '//') {

package/src/workspace/fingerprint.ts

@@ -1,129 +1,23 @@
 import path from 'node:path'
-import { xxh3 } from '../util/index.js'
 import { type LoadReads, readOnce } from './load-reads.js'
 
-// Every package-manager lockfile we know about, plus the workspace
-// definition files. Whichever ones exist get folded into the
-// fingerprint; missing ones are skipped. Hashed in declaration order
-// for determinism — adding a new entry here changes the fingerprint
-// for projects that have that file present, which is fine: that's the
-// whole point of bumping CACHE_VERSION when the fingerprint surface
-// expands.
-// Exported so `--affected` can consult the SAME list. A change to any of
-// these re-keys every task in the workspace, so selection has to widen to
-// match — two copies of this list would silently drift into a run that
-// rebuilds everything while selecting nothing.
-export const WORKSPACE_FINGERPRINT_FILES = [
-  // Lockfiles
-  'pnpm-lock.yaml',
-  'package-lock.json',
-  'npm-shrinkwrap.json',
-  'yarn.lock',
-  'bun.lock',
-  'bun.lockb',
-  // Workspace definition (pnpm); package.json is hashed per-project
-  // via projectPackageJsonHash, not here.
-  'pnpm-workspace.yaml',
-  // Yarn 4 catalogs: yarn.lock records a `catalog:` dependency as that
-  // literal, so a catalog flip to a range the file already resolves
-  // leaves it byte-identical while the workspace's install moves
-  // (turborepo#12635). pnpm's catalogs live in pnpm-workspace.yaml, and
-  // its lockfile records each importer's resolved version besides.
-  '.yarnrc.yml',
-  // Install settings no lockfile records: bun's `linker = "isolated"` and
-  // pnpm's `node-linker` / hoisting lay `node_modules` out anew under a
-  // byte-identical lockfile, and a build that imported an undeclared
-  // hoisted package kept its green hit where it now fails (D-7).
-  '.npmrc',
-  'bunfig.toml',
-]
-
-// DELIBERATELY ABSENT: `vx.workspace.{ts,mts,js,mjs,cts,cjs}`. Everything it can
-// declare — `concurrency`, `cacheDir`, `timeout`, and the
-// plugin list — is placement, storage or observability, never what a
-// command produces; core's three seams may change WHERE a task runs, not
-// WHAT it runs (architecture principle #3). Folding it in would also do
-// active harm: a laptop declaring only the local plugins and a CI runner
-// declaring `reapi()` would compute different fingerprints and share not
-// one cache entry — the same split the rejected `NODE_OPTIONS` non-goal
-// describes. A per-task input that genuinely varies belongs in
-// `cache.inputs`, which is the surface built for it.
-
-/**
- * One hash for the workspace as a whole, derived from whichever
- * lockfile + workspace-definition files exist at the root. Folded
- * into every task's cache key so any lockfile bump (`pnpm update`,
- * `npm install`, `bun install`, …) or a workspace-shape change
- * invalidates every cached entry. Coarse but correct.
- */
-export async function computeWorkspaceFingerprint(
-  workspaceRoot: string,
-  reads?: LoadReads,
-): Promise<string> {
-  return (await computeWorkspaceFingerprints(workspaceRoot, NONE, reads)).all
-}
-
-const NONE: ReadonlySet<string> = new Set()
-
-export interface WorkspaceFingerprints {
-  /** Every file folded — what the config-evaluation cache keys on. */
-  readonly all: string
-  /**
-   * The same fold minus the files a plugin claims (`VxPlugin.fingerprint`)
-   * — what every task key folds. Identical to `all` with nothing claimed.
-   */
-  readonly unclaimed: string
-  /**
-   * The bytes folded, by file name — what a mid-run check compares against
-   * when a task may have rewritten one (orchestrator/fingerprint-watch.ts).
-   * Already in memory for the fold; kept, not copied.
-   */
-  readonly files: ReadonlyMap<string, Uint8Array>
-}
-
 /**
- * Both digests from one read of each file — none at all for the
- * `pnpm-workspace.yaml` discovery already read into the load's `reads`. A
- * claimed file leaves the key digest entirely (its name too): the claimant
- * folds what it means per project, and a fold of "present" would still
- * re-key the workspace when the file appeared.
+ * The bytes of each named root file that exists: the files the plugins
+ * claim (`VxPlugin.fingerprint`), read once at run start so a task that
+ * rewrites one is caught (orchestrator/fingerprint-watch.ts). Core folds
+ * none of them into a key; the claimant does.
  */
-export async function computeWorkspaceFingerprints(
+export async function readClaimedFiles(
   workspaceRoot: string,
-  claimed: ReadonlySet<string>,
+  names: Iterable<string>,
   reads?: LoadReads,
-): Promise<WorkspaceFingerprints> {
-  let all = 0n
-  let unclaimed = 0n
+): Promise<ReadonlyMap<string, Uint8Array>> {
   const files = new Map<string, Uint8Array>()
-  for (const f of WORKSPACE_FINGERPRINT_FILES) {
+  for (const f of names) {
     const bytes = await readOnce(reads, path.join(workspaceRoot, f))
-    if (bytes === null) continue
-    files.set(f, bytes)
-    all = xxh3(`${f}\0`, all)
-    all = xxh3(bytes, all)
-    if (claimed.has(f)) continue
-    unclaimed = xxh3(`${f}\0`, unclaimed)
-    unclaimed = xxh3(bytes, unclaimed)
+    if (bytes !== null) files.set(f, bytes)
   }
-  // bun.lock names a patch by PATH, never by its content: an edited patch
-  // left the lockfile byte-identical and every key unmoved while the
-  // install applied the new one (item 1014, where only `bun()`'s claim
-  // learned it). Each file it names folds here; a claimed bun.lock's
-  // plugin folds them itself.
-  const bunLock = files.get('bun.lock')
-  if (bunLock !== undefined) {
-    for (const rel of bunPatchFiles(bunLock)) {
-      const bytes = await readOnce(reads, path.join(workspaceRoot, rel))
-      const mark = `patch\0${rel}\0${bytes === null ? 'gone' : 'present'}`
-      all = xxh3(mark, all)
-      if (bytes !== null) all = xxh3(bytes, all)
-      if (claimed.has('bun.lock')) continue
-      unclaimed = xxh3(mark, unclaimed)
-      if (bytes !== null) unclaimed = xxh3(bytes, unclaimed)
-    }
-  }
-  return { all: hex(all), unclaimed: hex(unclaimed), files }
+  return files
 }
 
 const PATCHED = new TextEncoder().encode('"patchedDependencies"')
@@ -132,7 +26,7 @@ const PATCHED = new TextEncoder().encode('"patchedDependencies"')
  * The workspace-relative patch files a `bun.lock` names, sorted; none
  * outside the workspace. A lockfile without the key is not parsed (the
  * common case costs one byte search), and one that will not parse names
- * none: its bytes still fold whole.
+ * none.
  */
 export function bunPatchFiles(bytes: Uint8Array): string[] {
   if (Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).indexOf(PATCHED) < 0) return []
@@ -153,7 +47,3 @@ export function bunPatchFiles(bytes: Uint8Array): string[] {
   }
   return [...out].sort()
 }
-
-function hex(h: bigint): string {
-  return h.toString(16).padStart(16, '0')
-}

package/src/workspace/index.ts

@@ -10,24 +10,23 @@ export {
   refIsHead,
 } from './affected.js'
 export { applyFilters, parseFilter } from './filter.js'
-export {
-  computeWorkspaceFingerprint,
-  computeWorkspaceFingerprints,
-  WORKSPACE_FINGERPRINT_FILES,
-  type WorkspaceFingerprints,
-} from './fingerprint.js'
+export { readClaimedFiles } from './fingerprint.js'
+export { checkDependencyRules } from './dependency-rules.js'
 export { computeNestedProjectDirs } from './nested-dirs.js'
 export { buildPackageGraph, type PackageGraph } from './package-graph.js'
 export {
   frozenProjectConfigs,
   LOCKFILE_NAME,
   LOCKFILE_VERSION,
+  LOCK_INVALID,
+  lockEntryBroken,
   lockfilePath,
-  FROZEN_WITHOUT_LOCK,
+  lockKey,
+  NO_LOCK,
   readLockfile,
   writeLockfile,
   type Lockfile,
-  type LockfileEntry,
+  type LockedProject,
 } from './lockfile.js'
 export {
   loadProjectConfig,
@@ -40,47 +39,41 @@ export {
   cacheScopeError,
   inputStabilityEnv,
   isCacheScope,
+  taskNameProblem,
   validateProjectConfig,
   validateWorkspace,
 } from './config-schema.js'
-export type { LoadProjectConfigOptions } from './project-loader.js'
-export {
-  blobOidOf,
-  configEvalKey,
-  configEvalKeyFromClosure,
-  configImports,
-  type ConfigEvalStore,
-} from './config-cache.js'
+export { configImports } from './config-imports.js'
 export {
+  checkProjectNames,
   findWorkspaceRoot,
-  discoverProjects,
-  listProjects,
-  namedProject,
-  loadWorkspace,
-  unreachedHint,
-  unreachedPackages,
-  memberBaseDirs,
+  findProjectConfigs,
+  discoveredProject,
+  linkDiscoveredEdges,
+  lockedProjects,
+  pathName,
   PROJECT_CONFIG_FILENAMES,
   resolveCacheDir,
   resolveStoreRoot,
+  ROOT_NAME,
+  type ConfigDir,
   type ProjectEntry,
   type ProjectMeta,
-  type Workspace,
 } from './workspace.js'
 export type { LoadReads } from './load-reads.js'
-// The migration seam (see migration.ts) and core's own mapper, the scripts one.
+// The migration seam (see migration.ts).
 export {
   applyMigration,
   foldScriptHooks,
-  PERSISTENT_TASK_NAMES,
   PERSISTENT_TODO,
   pruneOrphanPersistentNotes,
   quoteTsLiteral,
   type ApplyMigrationArgs,
   type MigrationFormat,
+  type MigrationMember,
   type GeneratedProject,
   type GeneratedTask,
   type MigrationPlan,
   type RawExpr,
+  vxInvocation,
 } from './migration.js'
-export { delegatedScript, migrateScripts } from './migrate-scripts.js'

package/src/workspace/load-reads.ts

@@ -1,6 +1,6 @@
 // A load reads each root file once. Finding the root reads its manifest,
-// listing the package globs read it again and the workspace fingerprint a
-// third time. Every such read goes through a `LoadReads` the load owns, so
+// listing the package globs read it again, and the claimed root files are
+// read for the run (`readClaimedFiles`). Every such read goes through a `LoadReads` the load owns, so
 // a file costs one probe and one read per load however many stages ask for
 // it. The map lives exactly as long as the load: a `vx watch` cycle is a
 // new load and reads fresh bytes.
@@ -14,8 +14,8 @@ export type LoadReads = Map<string, Promise<Uint8Array | null>>
  * `file`'s bytes, read at most once per `reads`; null when there is no file
  * there (`Bun.file(<dir>).exists()` is false, so a directory is none).
  *
- * The probe stays ahead of the read: most names asked about are absent (six
- * of the seven fingerprint files, three of the four workspace config names),
+ * The probe stays ahead of the read: most names asked about are absent
+ * (three of the four workspace config names, a manager's settings files),
  * and a failed read costs 90–200 µs building its error where `exists()`
  * answers in 15–40 µs (measured 2026-09-24) — so one stat per present file
  * is cheaper than letting the open answer both questions.