@empire-builder-kit/nx 1.0.0-rc.2 → 1.0.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.2",
+  "version": "1.0.0-rc.4",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -126,7 +126,7 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.2",
+    "@empire-builder-kit/runtime": "1.0.0-rc.4",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
     "@aws-sdk/client-iam": "^3.700.0",
     "@nx/devkit": "23.1.0",
@@ -152,7 +152,7 @@
   },
   "homepage": "https://github.com/empire-builder-kit/empire-builder-kit#readme",
   "engines": {
-    "node": ">=22.12.0"
+    "node": ">=22.13.0"
   },
-  "gitHead": "daa31d9fc11699516d1a85072ca46548cd929e50"
+  "gitHead": "c29757a0dc5efb67eb10c3c8aa1f09b967ec10ca"
 }

package/src/generators/post-generation-install.d.ts

@@ -55,6 +55,7 @@ export interface PostGenerationInstallPnpmInvocation {
 export declare function postGenerationInstallPnpmInvocation(args: string[], options: {
     environment?: NodeJS.ProcessEnv;
     isolatedHome: string;
+    npmrcAuthFile?: string;
     toolchain: PnpmToolchainAuthority;
 }): PostGenerationInstallPnpmInvocation;
 /**

package/src/generators/post-generation-install.js

@@ -53,7 +53,6 @@ const PHASE_CONTROLLED_PNPM_SETTINGS = new Set([
     'deployallfiles',
     'dir',
     'enablemodulesdir',
-    'enableglobalvirtualstore',
     'enableprepostscripts',
     'filter',
     'filterprod',
@@ -101,7 +100,6 @@ const PHASE_CONTROLLED_PNPM_SETTINGS = new Set([
     'symlink',
     'storedir',
     'statedir',
-    'usestoreserver',
     'uselockfile',
     'verifystoreintegrity',
     'virtualstoredir',
@@ -123,12 +121,15 @@ const ALLOWED_STRUCTURED_PNPM_SETTINGS = new Set([
     'cleanupunusedcatalogs',
     'dedupedirectdeps',
     'dedupeinjecteddeps',
+    'enableglobalvirtualstore',
     'enginestrict',
     'excludelinksfromlockfile',
     'ignoredbuiltdependencies',
     'linkworkspacepackages',
     'minimumreleaseage',
     'minimumreleaseageexclude',
+    'minimumreleaseageignoremissingtime',
+    'minimumreleaseagestrict',
     'neverbuiltdependencies',
     'onlybuiltdependencies',
     'overrides',
@@ -146,39 +147,9 @@ const ALLOWED_STRUCTURED_PNPM_SETTINGS = new Set([
     'trustpolicy',
     'trustpolicyexclude',
     'trustpolicyignoreafter',
+    'verifydepsbeforerun',
 ]);
-const ALLOWED_NPMRC_RESOLUTION_SETTINGS = new Set([
-    'alwaysauth',
-    'autoinstallpeers',
-    'cafile',
-    'certfile',
-    'dedupeinjecteddeps',
-    'dedupepeerdependents',
-    'fetchretries',
-    'fetchretryfactor',
-    'fetchretrymaxtimeout',
-    'fetchretrymintimeout',
-    'fetchtimeout',
-    'httpsproxy',
-    'keyfile',
-    'linkworkspacepackages',
-    'maxsockets',
-    'minimumreleaseage',
-    'minimumreleaseageexclude',
-    'networkconcurrency',
-    'noproxy',
-    'preferworkspacepackages',
-    'proxy',
-    'registry',
-    'resolutionmode',
-    'resolvepeersfromworkspaceroot',
-    'saveworkspaceprotocol',
-    'strictpeerdependencies',
-    'strictssl',
-    'trustpolicy',
-    'trustpolicyexclude',
-    'trustpolicyignoreafter',
-]);
+const ALLOWED_NPMRC_RESOLUTION_SETTINGS = new Set(['cafile', 'registry']);
 class SimulatedProtocolCrash extends Error {
     constructor(checkpoint) {
         super(`Simulated post-generation install crash ${checkpoint}.`);
@@ -1028,11 +999,10 @@ function npmrcResolutionSemantics(source) {
             throw new Error(`Post-generation install controls pnpm ${key} per protocol phase; .npmrc cannot override it.`);
         }
         if (!ALLOWED_NPMRC_RESOLUTION_SETTINGS.has(normalizedKey) &&
-            !key.endsWith(':registry') &&
-            !/(?:^|:)always-auth$/u.test(key)) {
-            throw new Error(`Post-generation install .npmrc setting ${key} is outside the explicit resolution-setting allowlist.`);
+            !key.endsWith(':registry')) {
+            throw new Error(`Post-generation install .npmrc setting ${key} is outside the explicit pnpm 11 authentication, registry, and CA-file allowlist.`);
         }
-        if (/^(?:cafile|certfile|keyfile|pnpmfile)$/u.test(key) && value) {
+        if (/^(?:cafile|pnpmfile)$/u.test(key) && value) {
             referencedFiles.add(value);
         }
         try {
@@ -1067,6 +1037,46 @@ function assertPhaseControlledPnpmSettings(value, label) {
             value[key] === POST_GENERATION_STORE_DIRECTORY) {
             continue;
         }
+        if (normalizedKey === 'enableglobalvirtualstore' &&
+            label === 'pnpm-workspace.yaml settings') {
+            // Durable, not phase-controlled: pnpm records this setting in the
+            // installed modules state, so an install-time-only override would make
+            // every later ordinary command fail its verifyDepsBeforeRun check.
+            if (key !== 'enableGlobalVirtualStore' || value[key] !== false) {
+                throw new Error('Post-generation install requires pnpm enableGlobalVirtualStore: false so installed dependency state stays local to the workspace.');
+            }
+            continue;
+        }
+        if (normalizedKey === 'blockexoticsubdeps' &&
+            label === 'pnpm-workspace.yaml settings') {
+            if (key !== 'blockExoticSubdeps' || value[key] !== true) {
+                throw new Error('Post-generation install requires pnpm blockExoticSubdeps: true so later installs cannot substitute a private-hoist dependency.');
+            }
+            continue;
+        }
+        if (normalizedKey === 'ignorepnpmfile' &&
+            label === 'pnpm-workspace.yaml settings') {
+            if (key !== 'ignorePnpmfile' || value[key] !== true) {
+                throw new Error('Post-generation install requires pnpm ignorePnpmfile: true so explicit installs and later script or exec verification retain one pnpmfile authority.');
+            }
+            continue;
+        }
+        if (normalizedKey === 'pnpmfile' &&
+            label === 'pnpm-workspace.yaml settings') {
+            if (key !== 'pnpmfile' ||
+                !Array.isArray(value[key]) ||
+                value[key].length !== 0) {
+                throw new Error('Post-generation install requires pnpm pnpmfile: [] so pnpm records one empty hook authority across install, script, and exec phases.');
+            }
+            continue;
+        }
+        if (normalizedKey === 'verifydepsbeforerun' &&
+            label === 'pnpm-workspace.yaml settings') {
+            if (key !== 'verifyDepsBeforeRun' || value[key] !== 'error') {
+                throw new Error('Post-generation install requires pnpm verifyDepsBeforeRun: error so script and exec commands cannot mutate dependency state implicitly.');
+            }
+            continue;
+        }
         if (PHASE_CONTROLLED_PNPM_SETTINGS.has(normalizedKey)) {
             throw new Error(`Post-generation install controls pnpm ${key} per protocol phase; ${label} cannot override it.`);
         }
@@ -1079,11 +1089,50 @@ function assertRetainedPnpmStore(value) {
         throw new Error(`Post-generation install requires pnpm storeDir ${POST_GENERATION_STORE_DIRECTORY}.`);
     }
 }
+function assertRetainedPnpmVirtualStorePolicy(value) {
+    if (!isRecord(value) ||
+        !Object.prototype.hasOwnProperty.call(value, 'enableGlobalVirtualStore') ||
+        value.enableGlobalVirtualStore !== false) {
+        throw new Error('Post-generation install requires pnpm enableGlobalVirtualStore: false so installed dependency state stays local to the workspace.');
+    }
+}
+function assertRetainedPnpmExoticSubdepPolicy(value) {
+    if (!isRecord(value) ||
+        !Object.prototype.hasOwnProperty.call(value, 'blockExoticSubdeps') ||
+        value.blockExoticSubdeps !== true) {
+        throw new Error('Post-generation install requires pnpm blockExoticSubdeps: true so later installs cannot substitute a private-hoist dependency.');
+    }
+}
+function assertRetainedPnpmVerificationPolicy(value) {
+    if (!isRecord(value) ||
+        !Object.prototype.hasOwnProperty.call(value, 'verifyDepsBeforeRun') ||
+        value.verifyDepsBeforeRun !== 'error') {
+        throw new Error('Post-generation install requires pnpm verifyDepsBeforeRun: error so script and exec commands cannot mutate dependency state implicitly.');
+    }
+}
+function assertRetainedPnpmfilePolicy(value) {
+    if (!isRecord(value) ||
+        !Object.prototype.hasOwnProperty.call(value, 'ignorePnpmfile') ||
+        value.ignorePnpmfile !== true) {
+        throw new Error('Post-generation install requires pnpm ignorePnpmfile: true so explicit installs and later script or exec verification suppress executable pnpmfile hooks.');
+    }
+    if (!Object.prototype.hasOwnProperty.call(value, 'pnpmfile') ||
+        !Array.isArray(value.pnpmfile) ||
+        value.pnpmfile.length !== 0) {
+        throw new Error('Post-generation install requires pnpm pnpmfile: [] so explicit installs and later script or exec verification retain one empty pnpmfile authority.');
+    }
+}
 function assertSupportedPnpmSettings(value, label) {
     if (!isRecord(value))
         return;
     for (const key of Object.keys(value)) {
         const normalizedKey = key.toLowerCase().replace(/[^a-z0-9]/gu, '');
+        if (label === 'pnpm-workspace.yaml settings' &&
+            key === 'pnpmfile' &&
+            Array.isArray(value[key]) &&
+            value[key].length === 0) {
+            continue;
+        }
         if (UNSUPPORTED_EXECUTABLE_PNPM_SETTINGS.has(normalizedKey)) {
             throw new Error(`Post-generation install does not accept executable or externally loaded pnpm setting ${key} in ${label}.`);
         }
@@ -1120,7 +1169,7 @@ function buildInstallAuthority(reader) {
     const addDigest = (kind, path, contents, mode = null) => {
         const bytes = Buffer.byteLength(contents);
         if (bytes > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_FILE_BYTES) {
-            throw new Error(`Install-authority input exceeds 8 MiB at ${path}.`);
+            throw new Error(`Install-authority input exceeds ${pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_FILE_BYTES / (1024 * 1024)} MiB at ${path}.`);
         }
         observedBytes += bytes;
         if (observedBytes > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_TOTAL_BYTES) {
@@ -1162,15 +1211,19 @@ function buildInstallAuthority(reader) {
     }
     const rootManifest = parseBoundedJson(rootManifestSource, 'Post-generation install root package.json');
     (0, pnpm_toolchain_authority_js_1.parsePnpmPackageManagerAuthority)(rootManifestSource.toString('utf8'));
+    if (isRecord(rootManifest) && rootManifest.pnpm !== undefined) {
+        throw new Error('Post-generation install does not accept package.json#pnpm because pnpm 11 ignores that configuration; move reviewed settings to pnpm-workspace.yaml.');
+    }
     const workspaceSource = addFile('workspace-config', 'pnpm-workspace.yaml');
     const workspace = parseBoundedYaml(workspaceSource, 'Post-generation install pnpm-workspace.yaml');
-    assertPhaseControlledPnpmSettings(isRecord(rootManifest) ? rootManifest.pnpm : undefined, 'root package.json pnpm settings');
     assertPhaseControlledPnpmSettings(workspace, 'pnpm-workspace.yaml settings');
-    assertNoAmbientInterpolation(isRecord(rootManifest) ? rootManifest.pnpm : undefined, 'root package.json pnpm settings');
     assertNoAmbientInterpolation(workspace, 'pnpm-workspace.yaml settings');
-    assertSupportedPnpmSettings(isRecord(rootManifest) ? rootManifest.pnpm : undefined, 'root package.json pnpm settings');
     assertSupportedPnpmSettings(workspace, 'pnpm-workspace.yaml settings');
     assertRetainedPnpmStore(workspace);
+    assertRetainedPnpmExoticSubdepPolicy(workspace);
+    assertRetainedPnpmVirtualStorePolicy(workspace);
+    assertRetainedPnpmfilePolicy(workspace);
+    assertRetainedPnpmVerificationPolicy(workspace);
     const manifests = ['package.json'];
     for (const manifestPath of exactWorkspaceManifestPaths(reader, workspace)) {
         addFile('workspace-manifest', manifestPath);
@@ -1196,16 +1249,6 @@ function buildInstallAuthority(reader) {
             localReferences.add(reference);
         }
         if (manifestPath === 'package.json' && isRecord(manifest)) {
-            if (isRecord(manifest.pnpm)) {
-                for (const key of [
-                    'catalog',
-                    'catalogs',
-                    'overrides',
-                    'packageExtensions',
-                ]) {
-                    collectNestedLocalReferences(manifest.pnpm[key], '', localReferences);
-                }
-            }
             collectNestedLocalReferences(manifest.resolutions, '', localReferences);
         }
     }
@@ -1224,8 +1267,9 @@ function buildInstallAuthority(reader) {
             throw new Error(`Post-generation install does not accept executable pnpm hooks at ${candidate}; use declarative, bound resolution configuration.`);
         }
     }
-    if (isRecord(workspace) && typeof workspace.pnpmfile === 'string') {
-        throw new Error('Post-generation install does not accept executable pnpmfile hooks in pnpm-workspace.yaml.');
+    if (isRecord(workspace) &&
+        (!Array.isArray(workspace.pnpmfile) || workspace.pnpmfile.length !== 0)) {
+        throw new Error('Post-generation install requires one exact empty pnpmfile authority in pnpm-workspace.yaml.');
     }
     const npmrcSource = reader.read('.npmrc');
     if (npmrcSource !== null) {
@@ -1248,9 +1292,6 @@ function buildInstallAuthority(reader) {
             }
         }
     };
-    if (isRecord(rootManifest) && isRecord(rootManifest.pnpm)) {
-        collectPatchValues(rootManifest.pnpm.patchedDependencies);
-    }
     if (isRecord(workspace))
         collectPatchValues(workspace.patchedDependencies);
     for (const patch of [...patches].sort(literalCompare)) {
@@ -2525,11 +2566,6 @@ function postGenerationInstallPnpmInvocation(args, options) {
         /[\0\r\n"]/u.test(options.isolatedHome)) {
         throw new Error('Post-generation install pnpm execution authority is invalid.');
     }
-    const userConfig = (0, node_path_1.join)(options.isolatedHome, 'npm-user.rc');
-    const globalConfig = (0, node_path_1.join)(options.isolatedHome, 'npm-global.rc');
-    if ((0, node_fs_1.existsSync)(userConfig) || (0, node_fs_1.existsSync)(globalConfig)) {
-        throw new Error('Post-generation install isolated npm configuration paths must remain absent.');
-    }
     for (const directory of [
         'appdata',
         'cache',
@@ -2555,6 +2591,30 @@ function postGenerationInstallPnpmInvocation(args, options) {
             ? [(0, node_path_1.join)(systemRoot, 'System32')]
             : []),
     ].join(node_path_1.delimiter);
+    let npmrcAuthFile;
+    if (options.npmrcAuthFile !== undefined) {
+        try {
+            if (!(0, node_path_1.isAbsolute)(options.npmrcAuthFile) ||
+                /[\0\r\n"]/u.test(options.npmrcAuthFile)) {
+                throw new Error('invalid authority path');
+            }
+            const requestedMetadata = (0, node_fs_1.lstatSync)(options.npmrcAuthFile);
+            const canonicalAuthFile = (0, node_fs_1.realpathSync)(options.npmrcAuthFile);
+            const metadata = (0, node_fs_1.lstatSync)(canonicalAuthFile);
+            if (requestedMetadata.isSymbolicLink() ||
+                metadata.isSymbolicLink() ||
+                !metadata.isFile() ||
+                metadata.nlink !== 1 ||
+                metadata.size === 0 ||
+                metadata.size > 64 * 1024) {
+                throw new Error('invalid authority');
+            }
+            npmrcAuthFile = canonicalAuthFile;
+        }
+        catch {
+            throw new Error('Post-generation install npm authentication authority must be one exact, non-empty, bounded regular file.');
+        }
+    }
     const environment = {
         ...Object.fromEntries(Object.entries(inheritedEnvironment).filter(([key]) => /^EBK_/u.test(key) ||
             /^LC_/u.test(key) ||
@@ -2565,13 +2625,17 @@ function postGenerationInstallPnpmInvocation(args, options) {
         HOME: options.isolatedHome,
         LOCALAPPDATA: (0, node_path_1.join)(options.isolatedHome, 'localappdata'),
         PATH: controlledPath,
+        ...(npmrcAuthFile
+            ? {
+                PNPM_CONFIG_NPMRC_AUTH_FILE: npmrcAuthFile,
+                pnpm_config_npmrc_auth_file: npmrcAuthFile,
+            }
+            : {}),
         USERPROFILE: options.isolatedHome,
         XDG_CACHE_HOME: (0, node_path_1.join)(options.isolatedHome, 'cache'),
         XDG_CONFIG_HOME: (0, node_path_1.join)(options.isolatedHome, 'config'),
         XDG_DATA_HOME: (0, node_path_1.join)(options.isolatedHome, 'data'),
         XDG_STATE_HOME: (0, node_path_1.join)(options.isolatedHome, 'state'),
-        npm_config_globalconfig: globalConfig,
-        npm_config_userconfig: userConfig,
     };
     return {
         args: [options.toolchain.entryPoint, ...args],
@@ -2661,6 +2725,7 @@ function defaultInstall(workspaceRoot, frozen, packageManager) {
     // the generated install instead of inheriting a deleted store authority.
     ensureSafeDirectory(workspaceRoot, POST_GENERATION_STORE_DIRECTORY);
     withIsolatedPnpmHome(workspaceRoot, (isolatedHome) => {
+        const npmrcAuthFile = (0, node_path_1.join)(workspaceRoot, '.npmrc');
         const invocation = postGenerationInstallPnpmInvocation([
             'install',
             frozen ? '--frozen-lockfile' : '--no-frozen-lockfile',
@@ -2668,7 +2733,6 @@ function defaultInstall(workspaceRoot, frozen, packageManager) {
             `--config.cache-dir=${(0, node_path_1.join)(isolatedHome, 'cache')}`,
             '--config.deploy-all-files=false',
             '--config.enable-modules-dir=true',
-            '--config.enable-global-virtual-store=false',
             '--config.git-branch-lockfile=false',
             '--config.ignore-pnpmfile=true',
             '--config.ignore-scripts=true',
@@ -2687,9 +2751,12 @@ function defaultInstall(workspaceRoot, frozen, packageManager) {
             `--config.state-dir=${(0, node_path_1.join)(isolatedHome, 'state')}`,
             `--config.store-dir=${POST_GENERATION_STORE_DIRECTORY}`,
             '--config.symlink=true',
-            '--config.use-store-server=false',
             '--config.verify-store-integrity=true',
-        ], { isolatedHome, toolchain });
+        ], {
+            isolatedHome,
+            ...((0, node_fs_1.existsSync)(npmrcAuthFile) ? { npmrcAuthFile } : {}),
+            toolchain,
+        });
         (0, node_child_process_1.execFileSync)(invocation.command, invocation.args, {
             cwd: workspaceRoot,
             env: invocation.env,