@depup/nx 23.1.2-depup.1 → 23.2.0-depup.0

package/dist/src/utils/output.js

@@ -1,13 +1,80 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.output = void 0;
+exports.isStaticOutputStyle = isStaticOutputStyle;
+exports.printsFullTaskOutput = printsFullTaskOutput;
+exports.isLogGroupingEnabled = isLogGroupingEnabled;
+exports.shouldGroupBatchOutput = shouldGroupBatchOutput;
 exports.orange = orange;
 const tslib_1 = require("tslib");
+const figures = tslib_1.__importStar(require("figures"));
+const fs_1 = require("fs");
 const os_1 = require("os");
 const pc = tslib_1.__importStar(require("picocolors"));
 const readline = tslib_1.__importStar(require("readline"));
 const GH_GROUP_PREFIX = '::group::';
 const GH_GROUP_SUFFIX = '::endgroup::';
+/**
+ * `static-failures-only` is `static` with successful tasks collapsed to a single
+ * line. They select the same life cycle and differ only in what it prints, so
+ * everywhere the life cycle is chosen, the TUI is ruled out, or output is
+ * routed, the two behave identically.
+ */
+function isStaticOutputStyle(outputStyle) {
+    return outputStyle === 'static' || outputStyle === 'static-failures-only';
+}
+/**
+ * Whether a run prints every task's output in full rather than collapsing the
+ * ones that succeeded. Both static life cycles and the batch renderer have to
+ * agree on this, so they read it from here rather than each deriving it.
+ *
+ * Exactly one style collapses, and it is also what a run that named no style
+ * gets. Every other style prints in full because it was asked for explicitly,
+ * so none may quietly withhold output. Note the static life cycles serve more
+ * styles than the static-sounding ones: `shouldUseDynamicLifeCycle` bails on
+ * `isCI()` before it looks at the style at all, so in CI `dynamic` and `tui`
+ * land here too. This is written as a deny-list for that reason — a new style
+ * prints in full until someone decides otherwise, rather than silently
+ * collapsing because an allow-list did not list it.
+ *
+ * Resolving the absent case here rather than assigning `outputStyle` upstream is
+ * deliberate: the value is also read by the orchestrator to decide whether a
+ * task streams, and naming the default there stops `shouldStreamOutput` from
+ * ever being consulted — including for the continuous tasks that must stream.
+ */
+function printsFullTaskOutput(args) {
+    return (!!args.verbose ||
+        (args.outputStyle ?? 'static-failures-only') !== 'static-failures-only');
+}
+/**
+ * Whether task output should be wrapped in collapsible log groups. Grouping
+ * requires each task's output to be written as one contiguous block, which is
+ * why batch mode's implicit streaming backs off when this is on. It does not
+ * govern streaming in general — an explicit `--output-style`, the TUI, and
+ * long running tasks all still stream.
+ */
+function isLogGroupingEnabled() {
+    return (process.env.NX_SKIP_LOG_GROUPING !== 'true' && !!process.env.GITHUB_ACTIONS);
+}
+/**
+ * Whether a batch task's output should be held back from the live stream and
+ * rendered inside a fold instead. A batch worker writes to stdout/stderr live,
+ * so forwarding that copy would put its bytes outside the group and defeat the
+ * fold; what is held back is written to a file and rendered by the orchestrator.
+ *
+ * Note it is the captured file, not each task's `terminalOutput`, that makes
+ * this lossless. A worker is free to write bytes it attributes to no task —
+ * `@nx/maven`'s exit-code dump, `@nx/gradle`'s configuration phase — and those
+ * appear in no `terminalOutput` at all, so the fold has to be able to fall back
+ * to the file. See `TaskOrchestrator.printGroupedBatchOutput` for when it does.
+ *
+ * This is only worth doing when grouping is on and the user has not asked to
+ * stream — an explicit stream style (which sets NX_STREAM_OUTPUT) wants the
+ * live copy, folds or not.
+ */
+function shouldGroupBatchOutput() {
+    return isLogGroupingEnabled() && process.env.NX_STREAM_OUTPUT !== 'true';
+}
 /**
  * Custom orange color using ANSI 256-color code 214.
  * picocolors does not support keyword-based colors like chalk,
@@ -50,6 +117,45 @@ class CLIOutput {
         this.bold = pc.bold;
         this.underline = pc.underline;
         this.dim = pc.dim;
+        /**
+         * Whether the terminal is positioned at the start of a line. Task output does
+         * not reliably end in a newline, so writers that must begin on a fresh line
+         * ask for one via {@link ensureLineStart} rather than guessing.
+         *
+         * Holding that true means a writer that can leave the cursor mid-line has to
+         * be routed through this class or declared to it. The ones that exist today:
+         *
+         * - This class's own writes, via {@link writeToStream}.
+         * - A batch worker's live output, via {@link writeTaskOutputChunk}.
+         * - `nx:run-commands`, which is the only executor that runs in the main
+         *   process (`task-orchestrator.ts` gates that on the executor name), and
+         *   whose raw writes go through {@link writeTaskOutputChunk} for this reason.
+         *   Its `addColorAndPrefix` splits on newlines without ever appending one, so
+         *   its chunks routinely end mid-line.
+         * - A pseudo-terminal task, which cannot be routed: the native side writes to
+         *   this process's stdout from Rust, at arbitrary PTY read boundaries. It
+         *   declares itself via {@link noteExternalWrite} instead, which is why that
+         *   exists.
+         *
+         * Two bypasses are deliberate and safe, both because they re-emit output a
+         * whole line at a time via `formatPrefixedLines`, which appends `EOL` to every
+         * line it writes: forked task streaming through
+         * `NodeChildProcessWithNonDirectOutput`'s `addPrefixTransformer`, and
+         * `writePrefixedLines` for a main-process `nx:run-commands` under
+         * `NX_PREFIX_OUTPUT`.
+         *
+         * One bypass is known and is NOT safe. With `NX_NATIVE_COMMAND_RUNNER=false`,
+         * `forkProcessLegacy` forks with inherited stdio and yields
+         * `NodeChildProcessWithDirectOutput`, whose child writes straight to this
+         * process's fd 1 at arbitrary boundaries — unroutable and undeclarable from
+         * here. Line tracking is simply wrong on that path; it degrades to the
+         * pre-tracking behavior of a glued marker rather than to anything new. Do not
+         * read this list as closed: it is what is known, and the way to tell you are
+         * adding to it is that you are writing to stdout during a run without going
+         * through {@link writeToStream}, {@link writeTaskOutputChunk} or
+         * {@link noteExternalWrite}.
+         */
+        this.atLineStart = true;
     }
     /**
      * Longer dash character which forms more of a continuous line when place side to side
@@ -63,8 +169,59 @@ class CLIOutput {
         return divider;
     }
     writeToStream(str, stream = process.stdout) {
+        // stdout and stderr share one cursor wherever this matters — a CI log, a
+        // terminal — so a write to either moves it.
+        if ((stream === process.stdout || stream === process.stderr) &&
+            str.length > 0) {
+            this.atLineStart = str.endsWith('\n');
+        }
         stream.write(str);
     }
+    /**
+     * Forwards a chunk of a task's output live, keeping {@link atLineStart}
+     * accurate. Batch workers write raw chunks that routinely end mid-line, and a
+     * collapsed summary line must not be glued onto one.
+     *
+     * @internal Not part of the output API plugins may rely on.
+     */
+    writeTaskOutputChunk(chunk, stream = process.stdout) {
+        if (chunk.length > 0 &&
+            (stream === process.stdout || stream === process.stderr)) {
+            // A Buffer is written through undecoded so a chunk that splits a
+            // multi-byte character is not mangled; 0x0a only ever encodes a newline
+            // in UTF-8, so its last byte answers the question on its own.
+            this.atLineStart =
+                typeof chunk === 'string'
+                    ? chunk.endsWith('\n')
+                    : chunk[chunk.length - 1] === 0x0a;
+        }
+        stream.write(chunk);
+    }
+    /**
+     * Declares output this class could not route — a pseudo-terminal task's, which
+     * the native side writes straight to our stdout — so the next writer needing a
+     * fresh line asks for one instead of trusting a stale position.
+     *
+     * The chunk is inspected rather than assumed mid-line, so output that did end
+     * on a line boundary does not cost a blank line. PTY chunks often end in an
+     * escape sequence after the newline, and that reads as mid-line, which is the
+     * safe direction to be wrong in: a spare newline, never a glued one.
+     */
+    noteExternalWrite(chunk) {
+        if (chunk === undefined || chunk.length === 0) {
+            this.atLineStart = false;
+            return;
+        }
+        this.atLineStart =
+            typeof chunk === 'string'
+                ? chunk.endsWith('\n')
+                : chunk[chunk.length - 1] === 0x0a;
+    }
+    ensureLineStart() {
+        if (!this.atLineStart) {
+            this.addNewline();
+        }
+    }
     overwriteLine(lineText = '') {
         // Ensure we always start writing from column 0.
         readline.cursorTo(process.stdout, 0);
@@ -182,8 +339,8 @@ class CLIOutput {
     }
     logCommandOutput(message, taskStatus, output) {
         let commandOutputWithStatus = this.getCommandWithStatus(message, taskStatus);
-        if (process.env.NX_SKIP_LOG_GROUPING !== 'true' &&
-            process.env.GITHUB_ACTIONS) {
+        const grouped = isLogGroupingEnabled();
+        if (grouped) {
             const icon = this.getStatusIcon(taskStatus);
             commandOutputWithStatus = `${GH_GROUP_PREFIX}${icon} ${commandOutputWithStatus}`;
         }
@@ -192,9 +349,120 @@ class CLIOutput {
         this.addNewline();
         this.addNewline();
         this.writeToStream(output);
-        if (process.env.NX_SKIP_LOG_GROUPING !== 'true' &&
-            process.env.GITHUB_ACTIONS) {
-            this.writeToStream(GH_GROUP_SUFFIX);
+        if (grouped) {
+            // GitHub only recognizes ::endgroup:: as a workflow command when it
+            // starts a line, and task output routinely lacks a trailing newline.
+            this.ensureLineStart();
+            this.writeToStream(`${GH_GROUP_SUFFIX}${os_1.EOL}`);
+        }
+    }
+    /**
+     * A single line standing in for a task's full output, used when the output
+     * itself carries no information worth printing (a success, or a cache hit).
+     * Statuses that carry a diagnosable body are deliberately not accepted here.
+     */
+    logCommandSummary(message, taskStatus) {
+        // The preceding task may have left the cursor mid-line, and this line must
+        // not be glued onto the end of that task's output.
+        this.ensureLineStart();
+        const icon = pc.green(figures.tick);
+        const command = this.addTaskStatus(taskStatus, this.formatCommand(this.normalizeMessage(message)));
+        this.writeToStream(`${icon}  ${command}${os_1.EOL}`);
+    }
+    /**
+     * A one-line stand-in for a task whose full output is shown elsewhere — used
+     * for the tasks of a batch rendered as a single log group rather than per
+     * task. `note` points the reader at that group.
+     */
+    logCommandRedirect(message, 
+    // A skipped task never ran, so it has no fold to be redirected to - and the
+    // icon ladder below would render it with the success tick. Excluding it
+    // makes the call site's `status !== 'skipped'` check a consequence of the
+    // type rather than a convention to remember.
+    taskStatus, note) {
+        this.ensureLineStart();
+        // A stopped task did not fail; it never got to finish. The TUI summary
+        // already draws that distinction, so use the same glyph.
+        const icon = taskStatus === 'stopped'
+            ? pc.cyan(figures.squareSmallFilled)
+            : taskStatus === 'failure'
+                ? pc.red(figures.cross)
+                : pc.green(figures.tick);
+        const command = this.formatCommand(this.normalizeMessage(message));
+        this.writeToStream(`${icon}  ${command}  ${pc.dim(note)}${os_1.EOL}`);
+    }
+    /**
+     * Prints a batch's combined output as one log group. A batch runner's
+     * diagnostics — a crash, a config-phase error, a runner summary — belong to no
+     * single task, so the group is labelled with the batch rather than a task.
+     *
+     * The batch's own output is copied straight from the file it was captured
+     * into, so an arbitrarily long log costs a fixed amount of memory here.
+     * Nothing is withheld: this rendering is chosen because the whole log was
+     * asked for, because no task claimed any of it, or because a task failed or
+     * was stopped — in which case repeating claimed bytes beside the per-task
+     * blocks is deliberate (see TaskOrchestrator.printGroupedBatchOutput).
+     */
+    logBatchGroup(label, body, taskStatus) {
+        const grouped = isLogGroupingEnabled();
+        let header = `${pc.dim('> ')}${pc.bold(label)}`;
+        if (grouped) {
+            header = `${GH_GROUP_PREFIX}${this.getStatusIcon(taskStatus)} ${header}`;
+        }
+        this.addNewline();
+        this.writeToStream(header);
+        this.addNewline();
+        this.addNewline();
+        try {
+            if (body.capturedOutputPath) {
+                this.copyFileToStream(body.capturedOutputPath);
+            }
+            if (body.trailer) {
+                this.ensureLineStart();
+                this.writeToStream(`${body.trailer}${os_1.EOL}`);
+            }
+        }
+        finally {
+            // The header is already on the stream, so an exception while rendering
+            // the body must not skip the terminator: GitHub would fold every line
+            // after this point into a group that never closes, swallowing the rest of
+            // the run's output rather than just this batch's.
+            if (grouped) {
+                this.ensureLineStart();
+                this.writeToStream(`${GH_GROUP_SUFFIX}${os_1.EOL}`);
+            }
+            else {
+                this.ensureLineStart();
+            }
+        }
+    }
+    /**
+     * Copies a file to stdout a chunk at a time. Reading it into one string would
+     * reintroduce the unbounded growth that writing it to disk avoided, and a
+     * long batch log can exceed the maximum length of a JS string.
+     */
+    copyFileToStream(path) {
+        let fd;
+        try {
+            fd = (0, fs_1.openSync)(path, 'r');
+        }
+        catch {
+            // The batch left nothing behind, or it is already cleaned up. The tasks'
+            // own redirect lines still point at this group.
+            return;
+        }
+        try {
+            const buffer = Buffer.allocUnsafe(64 * 1024);
+            let bytesRead;
+            while ((bytesRead = (0, fs_1.readSync)(fd, buffer, 0, buffer.length, null)) > 0) {
+                // Copy before writing. `stream.write` queues a Buffer by reference, and
+                // stdout is a pipe wherever grouping is on, so a backed-up write would
+                // still be holding this memory when the next read overwrites it.
+                this.writeTaskOutputChunk(Buffer.from(buffer.subarray(0, bytesRead)));
+            }
+        }
+        finally {
+            (0, fs_1.closeSync)(fd);
         }
     }
     getCommandWithStatus(message, taskStatus) {
@@ -207,12 +475,28 @@ class CLIOutput {
                 return '✅';
             case 'failure':
                 return '❌';
+            case 'stopped':
+                return '⏹️';
             case 'skipped':
             case 'local-cache-kept-existing':
                 return '⏩';
             case 'local-cache':
             case 'remote-cache':
                 return '🔁';
+            default: {
+                // The repo compiles with `strict: false`, so a `: string` return type
+                // alone does not reject a fallthrough - `undefined` stays assignable.
+                // This does: a new `TaskStatus` member fails to narrow to `never` here.
+                // Worth the lines because the gap already shipped once, rendering
+                // `::group::undefined > nx run ...` for a stopped task.
+                const unhandled = taskStatus;
+                void unhandled;
+                // Returning `unhandled` would print the status text where an icon goes
+                // (`::group::queued > nx run ...`) for a value that reached us over IPC
+                // or from cache metadata without passing the compiler. No icon reads
+                // better than a wrong one.
+                return '';
+            }
         }
     }
     normalizeMessage(message) {

package/dist/src/utils/owned-private-dir.d.ts

@@ -72,6 +72,19 @@ export declare class DirectoryRefusedError extends Error {
     readonly refusal: DirRefusal;
     constructor(refusal: DirRefusal);
 }
+/**
+ * The spelling to compare a directory by. `resolve` does not dereference
+ * symlinks, and on macOS `/tmp` is a symlink to `/private/tmp`, so an
+ * exact-match list would wave through an alias of a root it means to refuse.
+ *
+ * Resolves the longest ancestor that exists and re-appends the rest: Nx's own
+ * roots are absent before its first run, and canonicalizing whole paths only
+ * would degrade this to a string match on exactly a fresh machine.
+ *
+ * Only `ENOENT` walks up — any other errno means the path exists and cannot be
+ * read through, which `ensureOwnedPrivateDir` cannot establish either.
+ */
+export declare function canonicalDir(dir: string): string;
 /**
  * Whether a shared container is safe to keep an owner-only directory under.
  *

package/dist/src/utils/owned-private-dir.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DirectoryRefusedError = void 0;
 exports.describeRefusal = describeRefusal;
 exports.remedyFor = remedyFor;
+exports.canonicalDir = canonicalDir;
 exports.isSafeSharedRoot = isSafeSharedRoot;
 exports.isPeerWritable = isPeerWritable;
 exports.ensureSafeSharedRoot = ensureSafeSharedRoot;
@@ -11,6 +12,7 @@ exports.getUserSegment = getUserSegment;
 exports.ensureOwnedPrivateDir = ensureOwnedPrivateDir;
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
 // A string discriminant, not a boolean `ok`: this repo compiles with
 // `strict: false`, where TypeScript does not narrow a union on a boolean literal.
 const allow = (path) => ({ status: 'ok', path });
@@ -127,6 +129,43 @@ function chmodRealDirectory(path, mode) {
         (0, node_fs_1.closeSync)(fd);
     }
 }
+/**
+ * The spelling to compare a directory by. `resolve` does not dereference
+ * symlinks, and on macOS `/tmp` is a symlink to `/private/tmp`, so an
+ * exact-match list would wave through an alias of a root it means to refuse.
+ *
+ * Resolves the longest ancestor that exists and re-appends the rest: Nx's own
+ * roots are absent before its first run, and canonicalizing whole paths only
+ * would degrade this to a string match on exactly a fresh machine.
+ *
+ * Only `ENOENT` walks up — any other errno means the path exists and cannot be
+ * read through, which `ensureOwnedPrivateDir` cannot establish either.
+ */
+function canonicalDir(dir) {
+    const resolved = (0, node_path_1.resolve)(dir);
+    const missing = [];
+    let candidate = resolved;
+    // Terminates at the filesystem root, where `dirname` is a fixed point.
+    while ((0, node_path_1.dirname)(candidate) !== candidate) {
+        try {
+            return (0, node_path_1.join)((0, node_fs_1.realpathSync)(candidate), ...missing);
+        }
+        catch (e) {
+            if (e?.code !== 'ENOENT') {
+                return resolved;
+            }
+            missing.unshift((0, node_path_1.basename)(candidate));
+            candidate = (0, node_path_1.dirname)(candidate);
+        }
+    }
+    // The root itself: resolve it directly rather than walking past it.
+    try {
+        return (0, node_path_1.join)((0, node_fs_1.realpathSync)(candidate), ...missing);
+    }
+    catch {
+        return resolved;
+    }
+}
 /**
  * Sticky. Restricts rename and unlink in a writable directory to the owner of
  * each entry — plus the directory's own owner, which is why the ownership check

package/dist/src/utils/package-json.d.ts

@@ -61,6 +61,8 @@ export interface PackageJson {
             libc?: string[];
         };
         ignoredOptionalDependencies?: string[];
+        packageExtensions?: Record<string, unknown>;
+        patchedDependencies?: Record<string, string>;
     };
     overrides?: PackageOverride;
     allowScripts?: Record<string, boolean>;

package/dist/src/utils/package-manager.js

@@ -175,19 +175,22 @@ function getPackageManagerCommand(packageManager = detectPackageManager(), root
             };
         },
         pnpm: () => {
-            let modernPnpm, includeDoubleDashBeforeArgs, allowRegistryConfigKey;
+            let modernPnpm, includeDoubleDashBeforeArgs, configForm, scopedForm;
             try {
                 const pnpmVersion = getPackageManagerVersion('pnpm', root);
                 modernPnpm = (0, semver_1.gte)(pnpmVersion, '6.13.0');
                 includeDoubleDashBeforeArgs = (0, semver_1.lt)(pnpmVersion, '7.0.0');
-                // Support for --@scope:registry was added in pnpm v10.5.0 and backported to v9.15.7.
-                // Versions >=10.0.0 and <10.5.0 do NOT support this CLI option.
-                allowRegistryConfigKey = (0, semver_1.satisfies)(pnpmVersion, '>=9.15.7 <10.0.0 || >=10.5.0');
+                configForm = (0, semver_1.gte)(pnpmVersion, '11.0.0');
+                // Support for --@scope:registry was added in pnpm v10.5.0 and
+                // backported to v9.15.7. Starting with pnpm 11, the equivalent
+                // option is --config.@scope:registry.
+                scopedForm = (0, semver_1.satisfies)(pnpmVersion, '>=9.15.7 <10.0.0 || >=10.5.0 <11.0.0');
             }
             catch {
                 modernPnpm = true;
                 includeDoubleDashBeforeArgs = true;
-                allowRegistryConfigKey = false;
+                configForm = false;
+                scopedForm = false;
             }
             const isPnpmWorkspace = (0, fs_1.existsSync)((0, path_1.join)(root, 'pnpm-workspace.yaml'));
             return {
@@ -211,7 +214,11 @@ function getPackageManagerCommand(packageManager = detectPackageManager(), root
                 list: 'pnpm ls --depth 100',
                 why: 'pnpm why',
                 getRegistryUrl: 'pnpm config get registry',
-                publish: (packageRoot, registry, registryConfigKey, tag) => `pnpm publish "${packageRoot}" --json --"${allowRegistryConfigKey ? registryConfigKey : 'registry'}=${registry}" --tag=${tag} --no-git-checks`,
+                publish: (packageRoot, registry, registryConfigKey, tag) => `pnpm publish "${packageRoot}" --json --"${configForm
+                    ? `config.${registryConfigKey}`
+                    : scopedForm
+                        ? registryConfigKey
+                        : 'registry'}=${registry}" --tag=${tag} --no-git-checks`,
                 ignoreScriptsFlag: '--ignore-scripts',
             };
         },
@@ -268,7 +275,10 @@ function getPackageManagerVersion(packageManager = detectPackageManager(), cwd =
     }
     if (!version) {
         try {
-            version = (0, child_process_1.execSync)(`${packageManager} --version`, {
+            const versionArgs = packageManager === 'pnpm'
+                ? '--ignore-workspace --version'
+                : '--version';
+            version = (0, child_process_1.execSync)(`${packageManager} ${versionArgs}`, {
                 cwd,
                 encoding: 'utf-8',
                 windowsHide: true,

package/dist/src/utils/params.d.ts

@@ -125,16 +125,22 @@ export declare function warnDeprecations(opts: {
 export declare function convertSmartDefaultsIntoNamedParams(opts: {
     [k: string]: any;
 }, schema: Schema, defaultProjectName: string | null, relativeCwd: string | null): void;
-type Prompt = ConstructorParameters<typeof import('enquirer').Prompt>[0] & {
+type Prompt = {
     name: string;
     type: 'input' | 'autocomplete' | 'multiselect' | 'confirm' | 'numeral';
     message: string;
     initial?: any;
+    /**
+     * Retained because {@link getPromptsForSchema} is exported and asserted on;
+     * the prompt itself scrolls rather than truncating.
+     */
     limit?: number;
     choices?: (string | {
         name: string;
         message: string;
     })[];
+    /** Returns `true` when valid, otherwise the message to show. */
+    validate?: (value: any) => boolean | string;
 };
 export declare function getPromptsForSchema(opts: Options, schema: Schema, projectsConfigurations: ProjectsConfigurations): Prompt[];
 export {};

package/dist/src/utils/params.js

@@ -14,7 +14,7 @@ exports.warnDeprecations = warnDeprecations;
 exports.convertSmartDefaultsIntoNamedParams = convertSmartDefaultsIntoNamedParams;
 exports.getPromptsForSchema = getPromptsForSchema;
 const logger_1 = require("./logger");
-const handle_import_1 = require("./handle-import");
+const prompt_helpers_1 = require("./prompt-helpers");
 function camelCase(input) {
     if (input.indexOf('-') > 1) {
         return input
@@ -658,13 +658,71 @@ function getPromptsForSchema(opts, schema, projectsConfigurations) {
     return prompts;
 }
 async function promptForValues(opts, schema, projectsConfigurations) {
-    return await (await (0, handle_import_1.handleImport)('enquirer'))
-        .prompt(getPromptsForSchema(opts, schema, projectsConfigurations))
-        .then((values) => ({ ...opts, ...values }))
-        .catch((e) => {
+    try {
+        const values = {};
+        // Asked one at a time; a schema prompt has no cross-question state, so the
+        // order is just the schema's own.
+        for (const question of getPromptsForSchema(opts, schema, projectsConfigurations)) {
+            values[question.name] = await askSchemaQuestion(question);
+        }
+        return { ...opts, ...values };
+    }
+    catch (e) {
         console.error(e);
         process.exit(1);
-    });
+    }
+}
+async function askSchemaQuestion(question) {
+    const validate = question.validate
+        ? (value) => {
+            const result = question.validate(value);
+            return result === true
+                ? undefined
+                : typeof result === 'string'
+                    ? result
+                    : 'Invalid value';
+        }
+        : undefined;
+    const choices = (question.choices ?? []).map((c) => typeof c === 'string' ? { value: c } : { value: c.name, label: c.message });
+    switch (question.type) {
+        case 'confirm':
+            return (0, prompt_helpers_1.confirmationPrompt)({
+                message: question.message,
+                initial: question.initial !== false,
+            });
+        case 'multiselect':
+            return (0, prompt_helpers_1.multiselectPrompt)({
+                message: question.message,
+                choices,
+                initialValues: Array.isArray(question.initial)
+                    ? question.initial
+                    : undefined,
+            });
+        case 'autocomplete':
+            return (0, prompt_helpers_1.selectPrompt)({
+                message: question.message,
+                choices,
+                initial: question.initial,
+            });
+        case 'numeral': {
+            // No numeric prompt; the answer is parsed back so the schema still
+            // receives a number.
+            const answer = await (0, prompt_helpers_1.textPrompt)({
+                message: question.message,
+                initialValue: question.initial === undefined ? undefined : String(question.initial),
+                validate: (value) => value !== '' && !Number.isNaN(Number(value))
+                    ? validate?.(Number(value))
+                    : 'Please enter a number',
+            });
+            return Number(answer);
+        }
+        default:
+            return (0, prompt_helpers_1.textPrompt)({
+                message: question.message,
+                initialValue: typeof question.initial === 'string' ? question.initial : undefined,
+                validate,
+            });
+    }
 }
 function findSchemaForProperty(propName, schema) {
     if (propName in schema.properties) {

package/dist/src/utils/permission-errors.d.ts

@@ -0,0 +1,11 @@
+/**
+ * EACCES and EPERM are the two errnos that mean the operating system refused
+ * us, rather than that nothing was there or nothing was listening. What they
+ * call for differs by what was being opened -- a socket owned by another user,
+ * a sandbox denying a bind, a settings file the agent harness protects -- but
+ * they share the property that retrying cannot change the answer.
+ *
+ * Deliberately import-free: the plugin worker entry point and the daemon client
+ * both reach this, and neither can afford to pull a module graph in for it.
+ */
+export declare function isPermissionDenied(error: unknown): boolean;

package/dist/src/utils/permission-errors.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPermissionDenied = isPermissionDenied;
+/**
+ * EACCES and EPERM are the two errnos that mean the operating system refused
+ * us, rather than that nothing was there or nothing was listening. What they
+ * call for differs by what was being opened -- a socket owned by another user,
+ * a sandbox denying a bind, a settings file the agent harness protects -- but
+ * they share the property that retrying cannot change the answer.
+ *
+ * Deliberately import-free: the plugin worker entry point and the daemon client
+ * both reach this, and neither can afford to pull a module graph in for it.
+ */
+function isPermissionDenied(error) {
+    const code = error?.code;
+    return code === 'EACCES' || code === 'EPERM';
+}

package/dist/src/utils/plugins/core-plugins.js

@@ -42,6 +42,10 @@ exports.CORE_PLUGINS = [
         name: '@nx/eslint',
         capabilities: 'executors,generators',
     },
+    {
+        name: '@nx/oxlint',
+        capabilities: 'generators',
+    },
     {
         name: '@nx/nest',
         capabilities: 'generators',