nx 23.1.1 → 23.1.3

package/dist/src/project-graph/utils/project-configuration/target-normalization.js

@@ -5,10 +5,13 @@ exports.normalizeTarget = normalizeTarget;
 exports.validateAndNormalizeProjectRootMap = validateAndNormalizeProjectRootMap;
 const executor_utils_1 = require("../../../command-line/run/executor-utils");
 const fileutils_1 = require("../../../utils/fileutils");
+const long_running_target_1 = require("../../../utils/long-running-target");
+const output_1 = require("../../../utils/output");
 const to_project_name_1 = require("../../../config/to-project-name");
 const error_types_1 = require("../../error-types");
 const target_merging_1 = require("./target-merging");
 const node_fs_1 = require("node:fs");
+const git_worktrees_1 = require("../../../utils/git-worktrees");
 const path_1 = require("path");
 function validateProject(project, 
 // name -> project
@@ -65,15 +68,137 @@ function normalizeTarget(target, project, workspaceRoot, projectsMap, errorMsgKe
     }
     return target;
 }
+// TODO(v24): remove the legacy target-name cache fallback and its warning.
+// Removal needs a second mechanism for plugin-inferred targets, which the
+// accompanying migration cannot reach.
+/**
+ * Whether `target` is cacheable only by way of the legacy name-based fallback:
+ * the exact target-name key of `targetDefaults` declares `cache: true`, but an
+ * executor key won target-default resolution instead, so the merged target never
+ * received it.
+ *
+ * A `true` result means the user's `cache: true` silently lost, so this doubles
+ * as the condition for warning them that the name key is being shadowed.
+ */
+function isLegacyCachedTarget(targetName, targetDefaults, target) {
+    // Resolution already decided `cache`, so the name key isn't shadowed.
+    if (target.cache !== undefined) {
+        return false;
+    }
+    if (isLongRunningTarget(targetName, target)) {
+        return false;
+    }
+    // Restricted to shadowing, which is narrower than what pre-23 restored: that
+    // derivation matched on target name alone, so a name key dropped as
+    // incompatible (its entry declared a foreign executor) was cacheable too.
+    // Restoring that as well would mean writing `cache` with no key to name in
+    // the warning, and no migration able to retire it. Deliberately not covered.
+    if (!findShadowingTargetDefaultKey(targetDefaults, target)) {
+        return false;
+    }
+    return declaresCacheTrue(targetDefaults?.[targetName]);
+}
+/**
+ * Whether the name key declares `cache: true` on an entry that always applies.
+ *
+ * Filters are deliberately not evaluated. They cannot express a pre-23 config
+ * (the filtered array shape postdates the behavior being restored), and a
+ * filtered entry declaring `cache` may or may not apply to this project — so
+ * rather than guess, a filtered `cache` declares the value unknowable and
+ * nothing is restored. Among unfiltered entries the last wins, matching the
+ * in-key merge order.
+ */
+function declaresCacheTrue(value) {
+    if (!value) {
+        return false;
+    }
+    const entries = Array.isArray(value) ? value : [value];
+    let declared;
+    for (const entry of entries) {
+        // `nx.json` is hand-edited; a null or scalar entry would throw here.
+        if (!entry || typeof entry !== 'object')
+            continue;
+        if (entry.cache === undefined)
+            continue;
+        if (entry.filter)
+            return false;
+        declared = entry.cache;
+    }
+    return declared === true;
+}
+/**
+ * The normalization-time half of the pre-23 `longRunningTask` guard, which kept
+ * `cacheableOperations` from ever making these cacheable. Its remaining clause
+ * — `task.overrides['watch']` — is a runtime invocation override with no target
+ * equivalent, so it has no counterpart here.
+ */
+function isLongRunningTarget(targetName, target) {
+    return !!target.continuous || (0, long_running_target_1.isLongRunningTargetName)(targetName);
+}
+/**
+ * The `targetDefaults` key that beat the target-name key for `target`. Only an
+ * executor key can: key precedence puts the exact target name ahead of every
+ * glob, so nothing else outranks it. Undefined when the name key lost for
+ * another reason (e.g. its entry declared a foreign executor and was dropped as
+ * incompatible) — see {@link isLegacyCachedTarget} for why that case is left
+ * alone even though pre-23 restored it.
+ *
+ * `hasOwnProperty` rather than a lookup: an executor named `__proto__` resolves
+ * through the prototype chain to a truthy object, which would report a key the
+ * user never wrote.
+ */
+function findShadowingTargetDefaultKey(targetDefaults, target) {
+    return target.executor &&
+        targetDefaults &&
+        Object.prototype.hasOwnProperty.call(targetDefaults, target.executor)
+        ? target.executor
+        : undefined;
+}
+/**
+ * Emits a single grouped warning for every (shadowing key, target-name key)
+ * pair that relied on the deprecated fallback. Grouping matters because the
+ * same pair recurs in every affected project — a per-target warning would
+ * print hundreds of identical lines in a large workspace.
+ */
+function warnAboutLegacyCachedTargets(legacyCacheReads) {
+    if (legacyCacheReads.size === 0) {
+        return;
+    }
+    const bodyLines = [];
+    for (const [shadowingKey, targetKeys] of legacyCacheReads) {
+        for (const targetKey of targetKeys) {
+            bodyLines.push(`  - "${shadowingKey}" does not set "cache", so it was read from "${targetKey}"`);
+        }
+    }
+    bodyLines.push('', 'An executor key applies to every target that resolves through it, so exclude any continuous target before setting "cache" on one — a target that is both cacheable and continuous is rejected.', 'Target defaults resolve to a single key rather than merging, so an executor key hides the target name key entirely.', 'Set "cache" on the executor key to keep these targets cacheable — reading it from the target name key is deprecated and will be removed in Nx 24.');
+    output_1.output.warn({
+        title: 'Some targets are only cacheable through a deprecated fallback.',
+        bodyLines,
+    });
+}
 function normalizeTargets(project, sourceMaps, nxJsonConfiguration, workspaceRoot, 
 /**
  * Project configurations keyed by project name
  */
-projects) {
+projects, 
+/**
+ * Shadowing `targetDefaults` key -> target name keys its `cache` was read
+ * from. Accumulated across projects so the deprecation warns once per pair.
+ */
+legacyCacheReads) {
     const targetErrorMessage = [];
     for (const targetName in project.targets) {
         project.targets[targetName] = normalizeTarget(project.targets[targetName], project, workspaceRoot, projects, [project.root, targetName].join(':'));
         const target = project.targets[targetName];
+        const targetDefaults = nxJsonConfiguration.targetDefaults;
+        if (isLegacyCachedTarget(targetName, targetDefaults, target)) {
+            target.cache = true;
+            // Always defined: `isLegacyCachedTarget` returns false without it.
+            const shadowingKey = findShadowingTargetDefaultKey(targetDefaults, target);
+            const targetKeys = legacyCacheReads.get(shadowingKey) ?? new Set();
+            targetKeys.add(targetName);
+            legacyCacheReads.set(shadowingKey, targetKeys);
+        }
         if (
         // If the target has no executor or command, it doesn't do anything
         !target.executor &&
@@ -106,6 +231,7 @@ function validateAndNormalizeProjectRootMap(workspaceRoot, projectRootMap, nxJso
     const conflicts = new Map();
     const projectRootsWithNoName = [];
     const validityErrors = [];
+    const legacyCacheReads = new Map();
     for (const root in projectRootMap) {
         const project = projectRootMap[root];
         // We're setting `// targets` as a comment `targets` is empty due to Project Crystal.
@@ -155,7 +281,7 @@ function validateAndNormalizeProjectRootMap(workspaceRoot, projectRootMap, nxJso
     for (const root in projectRootMap) {
         const project = projectRootMap[root];
         try {
-            normalizeTargets(project, sourceMaps, nxJsonConfiguration, workspaceRoot, projects);
+            normalizeTargets(project, sourceMaps, nxJsonConfiguration, workspaceRoot, projects, legacyCacheReads);
         }
         catch (e) {
             if (e instanceof error_types_1.WorkspaceValidityError) {
@@ -166,9 +292,13 @@ function validateAndNormalizeProjectRootMap(workspaceRoot, projectRootMap, nxJso
             }
         }
     }
+    warnAboutLegacyCachedTargets(legacyCacheReads);
     const errors = [];
     if (conflicts.size > 0) {
-        errors.push(new error_types_1.MultipleProjectsWithSameNameError(conflicts, projects));
+        // Only on the way to throwing, so a workspace without duplicates never
+        // pays for reading git's worktree registry.
+        const worktreeAdvice = (0, git_worktrees_1.analyzeWorktreeConflicts)(workspaceRoot, conflicts);
+        errors.push(new error_types_1.MultipleProjectsWithSameNameError(conflicts, projects, worktreeAdvice ?? undefined));
     }
     if (projectRootsWithNoName.length > 0) {
         errors.push(new error_types_1.ProjectsWithNoNameError(projectRootsWithNoName, projects));

package/dist/src/tasks-runner/task-env.js

@@ -166,10 +166,13 @@ function getOwnerTargetForTask(task, graph) {
         for (const targets of Object.values(project.data.metadata.targetGroups)) {
             if (targets.includes(task.target.target)) {
                 for (const target of targets) {
-                    if (project.data.targets[target].metadata?.nonAtomizedTarget) {
+                    // a target group can name a target the project does not define —
+                    // inference plugins build the group and the targets separately, so
+                    // the two can disagree. skip the phantom rather than dereferencing it.
+                    if (project.data.targets[target]?.metadata?.nonAtomizedTarget) {
                         return [
                             target,
-                            project.data.targets[target].metadata?.nonAtomizedTarget,
+                            project.data.targets[target]?.metadata?.nonAtomizedTarget,
                         ];
                     }
                 }

package/dist/src/tasks-runner/utils.js

@@ -36,6 +36,7 @@ const fileutils_1 = require("../utils/fileutils");
 const find_matching_projects_1 = require("../utils/find-matching-projects");
 const legacy_depends_on_warning_1 = require("./legacy-depends-on-warning");
 const globs_1 = require("../utils/globs");
+const long_running_target_1 = require("../utils/long-running-target");
 const path_1 = require("../utils/path");
 const serialize_overrides_into_command_line_1 = require("../utils/serialize-overrides-into-command-line");
 const split_target_1 = require("../utils/split-target");
@@ -429,14 +430,9 @@ function isCacheableTask(task) {
     return task.cache;
 }
 function longRunningTask(task) {
-    const t = task.target.target;
     return (task.continuous ||
         (!!task.overrides['watch'] && task.overrides['watch'] !== 'false') ||
-        t.endsWith(':watch') ||
-        t.endsWith('-watch') ||
-        t === 'serve' ||
-        t === 'dev' ||
-        t === 'start');
+        (0, long_running_target_1.isLongRunningTargetName)(task.target.target));
 }
 // TODO: vsavkin remove when nx-cloud doesn't depend on it
 function unparse(options) {

package/dist/src/utils/assert-workspace-validity.js

@@ -3,7 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.assertWorkspaceValidity = assertWorkspaceValidity;
 const find_matching_projects_1 = require("./find-matching-projects");
 const output_1 = require("./output");
-const devkit_internals_1 = require("../devkit-internals");
+// Import from the defining module, not the devkit-internals barrel: this file
+// is on the project-graph construction path, and the barrel now eagerly
+// re-exports the project-graph modules, which would create a require cycle back
+// through build-project-graph. (Release modules cross the barrel as erased
+// types only — see the note in packages/devkit/internal.ts.)
+const error_types_1 = require("../project-graph/error-types");
 function assertWorkspaceValidity(projects, nxJson) {
     const projectNames = Object.keys(projects);
     const projectGraphNodes = projectNames.reduce((graph, project) => {
@@ -65,7 +70,7 @@ function assertWorkspaceValidity(projects, nxJson) {
         })
             .join('\n\n');
     }
-    throw new devkit_internals_1.WorkspaceValidityError(message);
+    throw new error_types_1.WorkspaceValidityError(message);
 }
 function detectAndSetInvalidProjectGlobValues(map, sourceName, desiredImplicitDeps, projectConfigurations, projects) {
     const invalidProjectsOrGlobs = desiredImplicitDeps.filter((implicit) => {

package/dist/src/utils/fileutils.d.ts

@@ -27,6 +27,11 @@ interface YamlReadOptions {
      * Compatibility with JSON.parse behaviour. If true, then duplicate keys in a mapping will override values rather than throwing an error.
      */
     json?: boolean;
+    /**
+     * Resolves only the tags every YAML parser must support, so every scalar stays
+     * a string instead of `true` or `12`.
+     */
+    failsafe?: boolean;
 }
 /**
  * Reads a YAML file and returns the object the YAML content represents.

package/dist/src/utils/fileutils.js

@@ -41,8 +41,13 @@ function readJsonFile(path, options) {
  */
 function readYamlFile(path, options) {
     const content = (0, node_fs_1.readFileSync)(path, 'utf-8');
-    const { load } = require('@zkochan/js-yaml');
-    return load(content, { ...options, filename: path });
+    const { load, FAILSAFE_SCHEMA } = require('@zkochan/js-yaml');
+    const { failsafe, ...loadOptions } = options ?? {};
+    return load(content, {
+        ...loadOptions,
+        ...(failsafe ? { schema: FAILSAFE_SCHEMA } : {}),
+        filename: path,
+    });
 }
 /**
  * Serializes the given data to JSON and writes it to a file.

package/dist/src/utils/git-worktrees.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Roots of the git linked worktrees that live inside `workspaceRoot`,
+ * relative to it and separator-normalized.
+ *
+ * Reads git's own registry rather than probing the workspace, so it costs one
+ * `readdir` plus a small file per worktree. Worktrees outside the workspace
+ * are dropped - nothing walks them. Submodules use the same gitfile mechanism
+ * but register under `<git-dir>/modules`, so they never appear here.
+ */
+export declare function nestedWorktreeRoots(workspaceRoot: string): string[];
+/**
+ * Whether `path` sits inside `root`, comparing whole path segments so that
+ * `wt-other` is not read as living inside `wt`.
+ */
+export declare function isInside(path: string, root: string): boolean;
+/** Advice for duplicate project names that come from nested git worktrees. */
+export interface WorktreeConflictAdvice {
+    /** Paths to add to `.gitignore`. */
+    ignoreTargets: string[];
+    /**
+     * Whether ignoring them settles every duplicate. When false the caller still
+     * owes the reader the ordinary advice for the ones left over.
+     */
+    explainsAllConflicts: boolean;
+}
+/**
+ * What to tell someone whose duplicate project names come from git worktrees
+ * nested in the workspace, or null when none of them do.
+ */
+export declare function analyzeWorktreeConflicts(workspaceRoot: string, conflicts: Map<string, string[]>): WorktreeConflictAdvice | null;

package/dist/src/utils/git-worktrees.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nestedWorktreeRoots = nestedWorktreeRoots;
+exports.isInside = isInside;
+exports.analyzeWorktreeConflicts = analyzeWorktreeConflicts;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const GITDIR_PREFIX = 'gitdir:';
+function readRecordedPath(file, base) {
+    let contents;
+    try {
+        contents = (0, node_fs_1.readFileSync)(file, 'utf-8').trim();
+    }
+    catch {
+        return null;
+    }
+    const raw = contents.startsWith(GITDIR_PREFIX)
+        ? contents.slice(GITDIR_PREFIX.length).trim()
+        : contents;
+    return raw ? (0, node_path_1.resolve)(base, raw) : null;
+}
+function isDirectory(path) {
+    try {
+        return (0, node_fs_1.statSync)(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The nearest directory at or above `from` holding a `.git`, or null when
+ * there is no repository above it.
+ *
+ * The workspace root and the repository root are often the same directory, but
+ * a workspace nested in a larger repo is ordinary - and its worktrees are
+ * registered against the repository, not against the workspace.
+ */
+function findGitRoot(from) {
+    let current = (0, node_path_1.resolve)(from);
+    while (!(0, node_fs_1.existsSync)((0, node_path_1.join)(current, '.git'))) {
+        const parent = (0, node_path_1.dirname)(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+    return current;
+}
+/**
+ * `<git-dir>/worktrees`, where git registers every linked worktree of the
+ * repository `workspaceRoot` belongs to - found by walking up, since the
+ * workspace need not be the repository root. Null when there is no `.git`, or
+ * when it is a gitfile that names nothing. The registry itself is not checked -
+ * reading it is what tells us whether anything is registered.
+ */
+function worktreeRegistry(workspaceRoot) {
+    const gitRoot = findGitRoot(workspaceRoot);
+    if (!gitRoot) {
+        return null;
+    }
+    const dotGit = (0, node_path_1.join)(gitRoot, '.git');
+    let gitDir;
+    try {
+        gitDir = (0, node_fs_1.statSync)(dotGit).isDirectory()
+            ? dotGit
+            : readRecordedPath(dotGit, gitRoot);
+    }
+    catch {
+        return null;
+    }
+    if (!gitDir) {
+        return null;
+    }
+    // Running from inside a linked worktree lands on
+    // `<main>/.git/worktrees/<name>`, whose `commondir` names the real git dir.
+    // Ignored unless it names a directory that exists. That is a sanity check
+    // on a path out of a file we did not write, not a bound on where it may
+    // point - it can still name any directory on the machine.
+    const commonDir = readRecordedPath((0, node_path_1.join)(gitDir, 'commondir'), gitDir);
+    return (0, node_path_1.join)(commonDir && isDirectory(commonDir) ? commonDir : gitDir, 'worktrees');
+}
+/**
+ * Roots of the git linked worktrees that live inside `workspaceRoot`,
+ * relative to it and separator-normalized.
+ *
+ * Reads git's own registry rather than probing the workspace, so it costs one
+ * `readdir` plus a small file per worktree. Worktrees outside the workspace
+ * are dropped - nothing walks them. Submodules use the same gitfile mechanism
+ * but register under `<git-dir>/modules`, so they never appear here.
+ */
+function nestedWorktreeRoots(workspaceRoot) {
+    const registry = worktreeRegistry(workspaceRoot);
+    if (!registry) {
+        return [];
+    }
+    let entries;
+    try {
+        entries = (0, node_fs_1.readdirSync)(registry);
+    }
+    catch {
+        return [];
+    }
+    const roots = [];
+    for (const entry of entries) {
+        // Points at the worktree's own `.git` gitfile, so its parent is the root.
+        const gitfile = readRecordedPath((0, node_path_1.join)(registry, entry, 'gitdir'), (0, node_path_1.join)(registry, entry));
+        if (!gitfile || !(0, node_fs_1.existsSync)(gitfile)) {
+            continue;
+        }
+        const root = (0, node_path_1.relative)(workspaceRoot, (0, node_path_1.dirname)(gitfile));
+        // Neither the workspace itself nor anything outside it is a nested
+        // worktree Nx would walk into. Compared by whole segments, because `..` is
+        // a traversal and `..hidden` is an ordinary directory name; and by
+        // absoluteness, because `relative` across Windows drives returns its
+        // second argument, which is outside by definition and carries no `..`.
+        if (!root || (0, node_path_1.isAbsolute)(root) || root.split(node_path_1.sep)[0] === '..') {
+            continue;
+        }
+        roots.push(root.split(node_path_1.sep).join('/'));
+    }
+    return roots;
+}
+/**
+ * Whether `path` sits inside `root`, comparing whole path segments so that
+ * `wt-other` is not read as living inside `wt`.
+ */
+function isInside(path, root) {
+    return path === root || path.startsWith(`${root}/`);
+}
+/**
+ * What to tell someone whose duplicate project names come from git worktrees
+ * nested in the workspace, or null when none of them do.
+ */
+function analyzeWorktreeConflicts(workspaceRoot, conflicts) {
+    const worktrees = nestedWorktreeRoots(workspaceRoot);
+    if (!worktrees.length) {
+        return null;
+    }
+    const offending = [];
+    let explainsAllConflicts = true;
+    for (const roots of conflicts.values()) {
+        const fromWorktrees = worktrees.filter((worktree) => roots.some((root) => isInside(root, worktree)));
+        // What would still be defined twice once the worktrees are out of the way.
+        const remaining = roots.filter((root) => !worktrees.some((worktree) => isInside(root, worktree)));
+        // Worth naming whenever a worktree is involved, even if ignoring it
+        // doesn't settle the whole conflict.
+        for (const worktree of fromWorktrees) {
+            if (!offending.includes(worktree)) {
+                offending.push(worktree);
+            }
+        }
+        if (!fromWorktrees.length || remaining.length > 1) {
+            explainsAllConflicts = false;
+        }
+    }
+    if (!offending.length) {
+        return null;
+    }
+    return {
+        ignoreTargets: ignoreTargetsFor(workspaceRoot, offending, worktrees),
+        explainsAllConflicts,
+    };
+}
+/**
+ * The worktree roots themselves, or the one directory holding them.
+ *
+ * Collapsing to the directory is only worth anything when it saves lines, and
+ * only safe when it holds nothing else. With a single worktree it saves
+ * nothing and risks everything: a lone worktree in `apps/` would have us name
+ * `apps/`, which holds only that worktree today and is where the reader will
+ * put projects tomorrow.
+ */
+function ignoreTargetsFor(workspaceRoot, offending, worktrees) {
+    if (offending.length < 2) {
+        return offending.map(anchored);
+    }
+    const parent = commonParent(offending);
+    return (parent && holdsOnlyWorktrees(workspaceRoot, parent, worktrees)
+        ? [parent]
+        : offending).map(anchored);
+}
+/**
+ * A gitignore pattern rooted at the workspace rather than matched anywhere.
+ *
+ * Without the leading slash a single-segment path like `wt1` is a name, not a
+ * location - it would ignore every `wt1` at any depth. Applied to all of them
+ * so the emitted line reads the same way wherever it came from.
+ */
+function anchored(root) {
+    return `/${root}`;
+}
+/**
+ * The directory every one of `roots` sits directly inside, or null when they
+ * don't share one - including when it would be the workspace root, which is
+ * never something to ignore.
+ */
+function commonParent(roots) {
+    const parents = new Set(roots.map((root) => root.split('/').slice(0, -1).join('/')));
+    const [parent] = parents;
+    return parents.size === 1 && parent ? parent : null;
+}
+function holdsOnlyWorktrees(workspaceRoot, directory, worktrees) {
+    let entries;
+    try {
+        entries = (0, node_fs_1.readdirSync)((0, node_path_1.join)(workspaceRoot, directory));
+    }
+    catch {
+        return false;
+    }
+    return (entries.length > 0 &&
+        entries.every((entry) => worktrees.includes(`${directory}/${entry}`)));
+}

package/dist/src/utils/ignore.d.ts

@@ -1,7 +1,134 @@
 import ignore = require('ignore');
 import { Tree } from '../generators/tree';
 export declare function getIgnoreObject(root?: string): ReturnType<typeof ignore>;
-export declare function getIgnoreObjectForTree(tree: Tree): ignore.Ignore;
+/** One directory's ignore files, and the directory its patterns are rooted at. */
+export type ScopedIgnoreMatcher = {
+    /** Workspace-relative POSIX directory, `''` for the workspace root. */
+    dir: string;
+    /** How they relate is decided at build time - see `merge`. */
+    matchers: ReturnType<typeof ignore>[];
+};
+/**
+ * Resolves the ignore files that apply to a directory: its own and every one
+ * above it, up to the workspace root.
+ *
+ * Ignore files cascade - a `.gitignore` covers its own directory and below, and
+ * its patterns are relative to *itself*, not to the workspace root. Reading only
+ * the root file, which is what `getIgnoreObject` does, silently misses every
+ * nested one.
+ *
+ * A directory's answer is its own files plus its parent's, so every directory on
+ * the way up is memoized rather than only the one asked for: sibling leaves
+ * share the whole trunk, and a later walk stops at the first directory already
+ * known.
+ *
+ * `read` decides where the files come from - `tree.read` for a generator, disk
+ * for a caller with no tree - and returns an empty string or null when there is
+ * no such file. Paths handed to it are workspace-relative POSIX.
+ *
+ * `merge` decides how the files *within one directory* relate, and the two
+ * consumers genuinely need different rules:
+ *
+ * - `false` is prettier's: one matcher per file, any of them excluding wins, and
+ *   a negation counts only if none excluded. `createIsIgnoredFunction` builds an
+ *   ignorer per `--ignore-path` and ORs them, so a `!x` in `.prettierignore`
+ *   cannot re-include an `x` that `.gitignore` excluded.
+ * - `true` is git's and the native walker's: all files in one matcher, so
+ *   `.nxignore`'s `!x` removes `.gitignore`'s exclusion of `x` outright. It has
+ *   to be a merge rather than a precedence check between separate matchers,
+ *   because a lone `!x` in its own matcher reports an opinion on `x/` but *none*
+ *   on `x/a.ts` (measured), so the exclusion would still reach the children.
+ *   The merge only removes the exclusion within that one directory - a negation
+ *   in a nested file still loses to an ancestor's exclusion.
+ *
+ * When `merge` is true, `filenames` order matters: they go into one matcher in
+ * order and the last matching pattern decides, so list them lowest-authority
+ * first.
+ */
+export declare function createIgnoreChainResolver(read: (path: string) => string | null | undefined, filenames: string[], merge: boolean): (dir: string) => ScopedIgnoreMatcher[];
+/**
+ * True when the file is ignored, resolving the chain nearest file first.
+ *
+ * Each matcher is tested against the path relative to its own directory, which
+ * is what makes a nested pattern like `/build` mean that directory's `build`
+ * rather than the workspace's.
+ *
+ * Nearest directory with an *opinion* wins, not the first match: a nested
+ * `!keep.log` must override the root's `*.log`, which is git's rule for files.
+ * A nested negation of a *directory* does not reach its children - see the
+ * `merge` note on `createIgnoreChainResolver`.
+ *
+ * How the files of one directory relate is decided when the chain is built - see
+ * that same note. Here they are simply the entry's matchers: any one excluding
+ * wins, and a negation counts only if none excluded.
+ *
+ * Two preconditions, both satisfied by a pruning walk and neither enforced:
+ *
+ * - `filePath` is workspace-relative POSIX and must sit under every `dir` in the
+ *   chain, which holds when the chain came from that file's own directory.
+ * - No ancestor directory of `filePath` may itself be ignored. git refuses to
+ *   re-include a file inside an excluded directory, and this does not implement
+ *   that rule: asked directly about `dist/keep.ts` with a root `dist/` and a
+ *   nested `dist/.gitignore` holding `!keep.ts`, it answers "not ignored" where
+ *   git says ignored (measured). `visitNotIgnoredFiles` never asks, because it
+ *   prunes `dist/` before descending - which is what makes its answers match
+ *   git, and why that pruning is load-bearing for correctness rather than speed.
+ */
+export declare function isIgnoredByChain(chain: ScopedIgnoreMatcher[], filePath: string): boolean;
+/**
+ * Directories that should never be walked, whatever the workspace's own ignore
+ * files say - `node_modules`, `.git`, the nx caches.
+ *
+ * The list comes from the native walker rather than a second copy here, so a
+ * filesystem walk and a tree walk cannot drift apart.
+ *
+ * Checked ahead of the cascading chain rather than folded into it: these are not
+ * re-includable, and as ordinary patterns a nested negation could resurrect
+ * `node_modules`.
+ */
+export declare function isAlwaysIgnored(path: string): boolean;
+/**
+ * The chain bound to a tree, as predicates over workspace-relative POSIX paths.
+ *
+ * Files and directories are asked separately because the answers differ: a
+ * pattern is only directory-only if it ends in a slash, and `ignore` will not
+ * match `dist/` against the path `dist`. Callers must not have to know that, so
+ * the slash is appended inside and never leaves this module.
+ */
+export type TreeIgnoreChecker = {
+    isIgnoredFile: (path: string) => boolean;
+    isIgnoredDirectory: (path: string) => boolean;
+};
+/**
+ * What git ignores, which is also what the native walker ignores.
+ *
+ * `.nxignore` outranks `.gitignore` - `walker.rs` registers it with
+ * `add_custom_ignore_filename` - which a merge with `.nxignore` last reproduces.
+ * git itself does not read it.
+ *
+ * Reads from the tree rather than disk because a generator can create or amend
+ * an ignore file in the same run, which would leave the on-disk copy stale.
+ */
+export declare function createGitIgnoreChecker(tree: Tree): TreeIgnoreChecker;
+/**
+ * What prettier ignores: the workspace root only, and one ignorer per
+ * `--ignore-path` ORed rather than merged (both measured), so a `!` in
+ * `.prettierignore` cannot re-include what `.gitignore` excluded. That is the
+ * CLI `nx format:check` shells out to.
+ *
+ * Not an exact match for that command: `isAlwaysIgnored` is wider than
+ * prettier's built-ins, and `format.ts` filters its own patterns through
+ * `.nxignore`, which this does not read.
+ *
+ * Reads from the tree rather than disk, as above.
+ */
+export declare function createPrettierIgnoreChecker(tree: Tree): TreeIgnoreChecker;
+/**
+ * `path.dirname` for the workspace-relative POSIX paths the chain is keyed by,
+ * except that the workspace root is `''` rather than `.` - that is the key
+ * `createIgnoreChainResolver` terminates on.
+ */
+export declare function posixDirname(relativePath: string): string;
 /**
  * Adds an entry to a .gitignore file if it's not already covered by existing patterns.
  * Creates the file if it doesn't exist.