@nx/js 23.2.0-beta.1 → 23.2.0-beta.10

package/dist/src/migrations/update-23-2-0/add-pnpm-deploy-output-cache-inputs.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = update;
+const devkit_1 = require("@nx/devkit");
+const internal_1 = require("@nx/devkit/internal");
+const path_1 = require("path");
+const pnpm_deploy_output_cache_inputs_1 = require("../../utils/pnpm-deploy-output-cache-inputs");
+const target_defaults_matching_1 = require("../../utils/target-defaults-matching");
+// The executors that emit the pruned pnpm deploy output (lockfile,
+// settings-only pnpm-workspace.yaml, patches, vendored local paths), each with
+// the option that turns the emission on. webpack, rspack, vite and esbuild
+// gate it on `generatePackageJson`; next, remix, tsc and swc emit the manifest
+// regardless and gate only the deploy output on `generateLockfile`.
+const DEPLOY_OUTPUT_EXECUTORS = {
+    '@nx/webpack:webpack': 'generatePackageJson',
+    '@nx/rspack:rspack': 'generatePackageJson',
+    '@nx/vite:build': 'generatePackageJson',
+    '@nx/esbuild:esbuild': 'generatePackageJson',
+    '@nx/next:build': 'generateLockfile',
+    '@nx/remix:build': 'generateLockfile',
+    '@nx/js:tsc': 'generateLockfile',
+    '@nx/js:swc': 'generateLockfile',
+};
+// The config-file plugins whose inferred build target can emit the deploy
+// output (NxAppWebpackPlugin/NxAppRspackPlugin with generatePackageJson).
+// The globs mirror each plugin's own createNodes pattern; the commands are
+// what each plugin sets on the build target it creates.
+const INFERRED_DEPLOY_PLUGINS = {
+    '@nx/webpack/plugin': {
+        configGlob: '**/webpack.config.{js,ts,mjs,cjs}',
+        command: 'webpack-cli build',
+    },
+    '@nx/rspack/plugin': {
+        configGlob: '**/rspack.config.{js,ts,mjs,mts,cjs,cts}',
+        command: 'rspack build',
+    },
+};
+/**
+ * Adds the workspace-root pnpm install settings sources to the `inputs` of
+ * build targets that emit the pruned pnpm deploy output. The build approvals
+ * and `supportedArchitectures` those outputs carry reach no lockfile, so
+ * without these a revoked approval leaves the task hash unchanged and a cached
+ * run replays an output that still grants it. Inferred targets are covered by
+ * the `@nx/webpack` and `@nx/rspack` plugins themselves; this migration covers
+ * the explicitly configured executor targets, plus overlays of inferred
+ * targets (a project-level entry, under the exact name or a glob-pattern key
+ * matching it, or a matching `targetDefaults` entry) whose replacing `inputs`
+ * array discards the plugin-generated one.
+ */
+async function update(tree) {
+    // The deploy output's install settings are pnpm-specific; other package
+    // managers' outputs hash everything they are built from already.
+    if (!tree.exists('pnpm-lock.yaml')) {
+        return;
+    }
+    const nxJson = (0, devkit_1.readNxJson)(tree);
+    const targetDefaults = nxJson?.targetDefaults;
+    const projects = new Map();
+    const changedProjects = new Set();
+    let defaultsChanged = false;
+    for (const [projectName, project] of (0, devkit_1.getProjects)(tree)) {
+        projects.set(projectName, project);
+        const projectNode = {
+            name: projectName,
+            type: 'lib',
+            data: { root: project.root, tags: project.tags },
+        };
+        for (const [targetName, target] of Object.entries(project.targets ?? {})) {
+            // The executor may come from a matching targetDefaults entry rather
+            // than the target itself. A `command` target resolves to nx:run-commands
+            // before defaults apply, so a default can never re-identify it.
+            const executor = target.executor ??
+                (target.command
+                    ? 'nx:run-commands'
+                    : (0, target_defaults_matching_1.resolveDefaultsExecutor)(targetName, projectName, projectNode, targetDefaults));
+            if (!executor || !DEPLOY_OUTPUT_EXECUTORS[executor]) {
+                continue;
+            }
+            const ref = {
+                targetName,
+                projectName,
+                projectNode,
+                matcherExecutor: target.executor,
+                target,
+            };
+            const selectedKey = targetDefaults
+                ? (0, target_defaults_matching_1.selectDefaultsKey)(ref, targetDefaults, executor)
+                : null;
+            const entries = (0, target_defaults_matching_1.compatibleDefaultsEntries)(ref, selectedKey, targetDefaults);
+            const defaults = entries.length
+                ? (0, internal_1.readTargetDefaultsForTarget)(targetName, { [selectedKey]: entries }, ref.matcherExecutor, { projectName, projectNode })
+                : null;
+            // The effective view, not the target's own: the gating option may be
+            // supplied by a matching defaults entry or set only in a configuration.
+            const effective = (0, internal_1.mergeTargetConfigurations)(target, defaults ?? {});
+            if (!emitsDeployOutput(effective, DEPLOY_OUTPUT_EXECUTORS[executor])) {
+                continue;
+            }
+            const changed = (0, pnpm_deploy_output_cache_inputs_1.addPnpmDeployOutputCacheInputs)(ref, targetDefaults, executor);
+            if (changed === 'target') {
+                changedProjects.add(projectName);
+            }
+            else if (changed === 'defaults') {
+                defaultsChanged = true;
+            }
+        }
+    }
+    // Overlays of plugin-inferred build targets carry no executor, so the loop
+    // above cannot see them, yet a replacing `inputs` array in one discards the
+    // settings inputs the plugin generates. The plugin adds those inputs without
+    // knowing whether the config enables generatePackageJson (that lives inside
+    // the user's config file), so the overlay repair is equally unconditional.
+    // It appends the runtime probe even where the plugin omits it under a valid
+    // pnpm pin: the repair runs once and the pin can be removed later.
+    for (const ref of await inferredDeployTargetOverlayRefs(tree, nxJson, projects)) {
+        const changed = (0, pnpm_deploy_output_cache_inputs_1.addPnpmDeployOutputCacheInputsToInferredTargetOverlay)(ref, targetDefaults);
+        if (changed === 'target') {
+            changedProjects.add(ref.projectName);
+        }
+        else if (changed === 'defaults') {
+            defaultsChanged = true;
+        }
+    }
+    for (const projectName of changedProjects) {
+        (0, devkit_1.updateProjectConfiguration)(tree, projectName, projects.get(projectName));
+    }
+    if (defaultsChanged) {
+        (0, devkit_1.updateNxJson)(tree, nxJson);
+    }
+    await (0, devkit_1.formatFiles)(tree);
+}
+/**
+ * One ref per (project, inferred build target) the registered `@nx/webpack` or
+ * `@nx/rspack` config-file plugins would create, resolved the way the plugins
+ * do: their createNodes glob filtered by each registration's include/exclude,
+ * the config file's directory as the project root, and the registration's
+ * `buildTargetName` option. The overlaying project-level entry may sit under
+ * the exact target name or a glob-pattern key matching it; one that replaces
+ * what the target runs disqualifies the target instead.
+ */
+async function inferredDeployTargetOverlayRefs(tree, nxJson, projects) {
+    const rootToProject = new Map();
+    for (const [projectName, project] of projects) {
+        rootToProject.set(project.root, projectName);
+    }
+    const refs = [];
+    for (const registration of nxJson?.plugins ?? []) {
+        const pluginName = typeof registration === 'string' ? registration : registration.plugin;
+        const inferredPlugin = INFERRED_DEPLOY_PLUGINS[pluginName];
+        if (!inferredPlugin) {
+            continue;
+        }
+        const options = typeof registration === 'string'
+            ? undefined
+            : registration.options;
+        const targetName = options?.buildTargetName ?? 'build';
+        const configFiles = (0, internal_1.findMatchingConfigFiles)(await (0, devkit_1.globAsync)(tree, [inferredPlugin.configGlob]), typeof registration === 'string' ? undefined : registration.include, typeof registration === 'string' ? undefined : registration.exclude);
+        for (const configFile of configFiles) {
+            const projectName = rootToProject.get((0, path_1.dirname)(configFile));
+            if (!projectName) {
+                continue;
+            }
+            const project = projects.get(projectName);
+            const target = inferredTargetOverlayEntry(project.targets, targetName);
+            // An entry that changes what the target runs is not an overlay; the
+            // executor loop covers the deploy executors among those.
+            if (target &&
+                replacesInferredRunCommandsIdentity(target, inferredPlugin.command, project.root)) {
+                continue;
+            }
+            refs.push({
+                targetName,
+                projectName,
+                projectNode: {
+                    name: projectName,
+                    type: 'lib',
+                    data: { root: project.root, tags: project.tags },
+                },
+                // the runtime matcher sees the plugin target's effective identity:
+                // its `command` payload resolves to nx:run-commands
+                matcherExecutor: 'nx:run-commands',
+                // the runtime drops the plugin attribution as soon as the project
+                // entry authors an executor or command, restated or not, so a
+                // plugin-filtered defaults entry no longer applies to the target
+                sourcePlugin: target?.executor !== undefined || target?.command !== undefined
+                    ? undefined
+                    : pluginName,
+                target: target ?? {},
+            });
+        }
+    }
+    return refs;
+}
+/**
+ * The project-level entry that overlays the inferred `targetName`. Its key is
+ * the exact name or a glob pattern the name matches; the inferred target
+ * exists before any project-level entry merges, so a matching glob key
+ * overlays it too. When several keys match, each entry merges against the
+ * inferred target independently and the last write wins, so only the last
+ * one applies. A glob key matching an earlier same-file sibling never
+ * surfaces here: the project read already collapsed it onto that sibling and
+ * dropped the key.
+ */
+function inferredTargetOverlayEntry(targets, targetName) {
+    const matching = Object.entries(targets ?? {}).filter(([key]) => key === targetName ||
+        (0, internal_1.findMatchingTargetNames)(key, [targetName]).length > 0);
+    return matching[matching.length - 1]?.[1];
+}
+/**
+ * Whether the entry changes what the inferred run-commands target runs when
+ * merged, resolved with nx's own merge so `"..."` placement and restated
+ * identities land the way the runtime lands them: a merged executor other
+ * than nx:run-commands, an effective command differing from the plugin's, or
+ * a `command`/`commands` clash the run-commands schema rejects. An entry
+ * restating the identity the plugin infers is still an overlay.
+ */
+function replacesInferredRunCommandsIdentity(target, inferredCommand, projectRoot) {
+    // `command` alongside `executor` fails graph construction outright;
+    // there is nothing running to repair.
+    if (target.command && target.executor) {
+        return true;
+    }
+    const merged = (0, internal_1.mergeTargetConfigurations)((0, internal_1.resolveCommandSyntacticSugar)(target, projectRoot), { executor: 'nx:run-commands', options: { command: inferredCommand } });
+    if (merged.executor !== 'nx:run-commands') {
+        return true;
+    }
+    // Both present fails the run-commands schema's oneOf; the target cannot run.
+    if (merged.options?.command && merged.options?.commands) {
+        return true;
+    }
+    const command = merged.options?.command ?? merged.options?.commands?.join(' && ');
+    return command !== inferredCommand;
+}
+/**
+ * Whether the target ships the deploy output in any of its runs: the gating
+ * option can sit in `options` or in any configuration, and `inputs` cannot
+ * vary per configuration, so one enabled configuration is enough.
+ */
+function emitsDeployOutput(effective, gate) {
+    return (Boolean(effective.options?.[gate]) ||
+        Object.values(effective.configurations ?? {}).some((configuration) => Boolean(configuration?.[gate])));
+}

package/dist/src/migrations/update-23-2-0/add-pnpm-deploy-output-cache-inputs.md

@@ -0,0 +1,64 @@
+#### Add the pnpm install settings sources to the inputs of build targets that emit the pruned deploy output
+
+In a pnpm workspace, build executors that generate a deployable `package.json` also emit the pruned deploy output next to it: the pruned `pnpm-lock.yaml`, a settings-only `pnpm-workspace.yaml`, the `.patch` files of a `pnpm patch` workspace, and vendored local-path dependencies. webpack, rspack, vite and esbuild builds do this when `generatePackageJson` is enabled; next, remix, tsc and swc builds when `generateLockfile` is.
+
+The build-script approvals and `supportedArchitectures` those artifacts carry come from the workspace root `pnpm-workspace.yaml` and the `pnpm` field of the root `package.json`, and are recorded in no lockfile, so nothing in the build target's default task hash moves when they change. Revoking an approval after a package turns out to be malicious would replay the previous build from cache and ship an output that still grants it.
+
+The migration adds three inputs to the affected targets: the root `pnpm-workspace.yaml` as a fileset; a `json` input hashing only the fields of the root `package.json` the output is built from (`packageManager`, which selects whether the settings land in the emitted `pnpm-workspace.yaml` or the emitted `package.json`, plus `pnpm.onlyBuiltDependencies`, `pnpm.neverBuiltDependencies`, `pnpm.allowBuilds`, `pnpm.supportedArchitectures` and `pnpm.patchedDependencies`), so ordinary dependency bumps in the root manifest do not invalidate every build; and a `runtime` input probing the pnpm major, which decides that same file selection when the `packageManager` field is absent. The probe prints only the major, so pnpm patch and minor releases do not move the hash, and a sentinel when no pnpm binary is available, so it is safe in every workspace. It is added even when the field currently pins a pnpm version: the migration runs once, and the pin can be removed later.
+
+The contents of vendored non-workspace local-path dependencies (`file:` directories and tarballs, `link:` targets) also ship in the deploy output but are not covered by these inputs: their set is derived from the lockfile at build time, so no statically written input list can stay correct as dependencies change.
+
+A target's own `inputs` array replaces the defaults' rather than merging with it, so the inputs are added to the layer whose array the runtime actually uses: the target's own `inputs` when it declares them, otherwise the `targetDefaults` entry supplying the array it inherits, and otherwise the target itself with nx's own default spelled out first, so nothing that was hashed stops being hashed. The gating option is read from the merged view, so one supplied by a matching `targetDefaults` entry or set only in a configuration still counts. A source the target already hashes, including via a whole-file root `package.json` fileset or an existing `json` input covering the settings fields, is left alone. The migration never authors a `"..."` of its own.
+
+Targets inferred by the `@nx/webpack` and `@nx/rspack` plugins declare the `pnpm-workspace.yaml` and `json` inputs themselves on every graph build, and the `runtime` probe while the root `package.json` has no `packageManager` field pinning a pnpm version, but a project-level target entry (under the exact name or a matching glob-pattern key) or a matching `targetDefaults` entry that supplies its own `inputs` array without `"..."` replaces the plugin-generated one and discards them. The migration repairs those overlays the same way, appending the complete set of three inputs to the replacing array, because it runs once and the pin can be removed later; when several entries match, only the last one applies, and it takes the repair. An inferred target with no such overlay is left alone, as is one whose entry changes what the target runs once merged: a different executor or effective command means the plugin's build no longer runs there. An entry that merely restates the identity the plugin infers is still an overlay and gets the repair.
+
+#### Sample code changes
+
+##### Before
+
+```json title="apps/app1/project.json"
+{
+  "targets": {
+    "build": {
+      "executor": "@nx/webpack:webpack",
+      "options": {
+        "generatePackageJson": true
+      }
+    }
+  }
+}
+```
+
+##### After
+
+```json title="apps/app1/project.json"
+{
+  "targets": {
+    "build": {
+      "executor": "@nx/webpack:webpack",
+      "inputs": [
+        "default",
+        "^default",
+        "{workspaceRoot}/pnpm-workspace.yaml",
+        {
+          "json": "{workspaceRoot}/package.json",
+          "fields": [
+            "packageManager",
+            "pnpm.onlyBuiltDependencies",
+            "pnpm.neverBuiltDependencies",
+            "pnpm.allowBuilds",
+            "pnpm.supportedArchitectures",
+            "pnpm.patchedDependencies"
+          ]
+        },
+        {
+          "runtime": "node -e \"try{console.log('pnpm major '+require('child_process').execSync('pnpm --version',{stdio:['ignore','pipe','ignore']}).toString().trim().split('.')[0])}catch{console.log('pnpm major unavailable')}\""
+        }
+      ],
+      "options": {
+        "generatePackageJson": true
+      }
+    }
+  }
+}
+```

package/dist/src/migrations/update-23-2-0/add-pnpm-prune-lockfile-cache-config.d.ts

@@ -0,0 +1,2 @@
+import { type Tree } from '@nx/devkit';
+export default function update(tree: Tree): Promise<void>;

package/dist/src/migrations/update-23-2-0/add-pnpm-prune-lockfile-cache-config.js

@@ -0,0 +1,305 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = update;
+const devkit_1 = require("@nx/devkit");
+const internal_1 = require("@nx/devkit/internal");
+const pnpm_install_settings_inputs_1 = require("../../utils/pnpm-install-settings-inputs");
+const target_defaults_matching_1 = require("../../utils/target-defaults-matching");
+const PRUNE_LOCKFILE_EXECUTOR = '@nx/js:prune-lockfile';
+const PNPM_LOCKFILE = 'pnpm-lock.yaml';
+// Artifacts the executor emits next to the pruned lockfile; without them in
+// `outputs`, a cache replay restores only the manifest and the lockfile.
+const PNPM_PRUNE_ARTIFACTS = [
+    'pnpm-workspace.yaml',
+    'patches',
+    'local_path_modules',
+];
+// The workspace root files those artifacts are built from. Neither the pnpm
+// build approvals nor `supportedArchitectures` are recorded in the lockfile, so
+// nothing else in the hash moves when they change. The pnpm major decides
+// which emitted file carries them, and the ambient binary supplies it when the
+// manifest's `packageManager` field is absent, so the major probe is added
+// alongside.
+const PNPM_ROOT_SETTINGS_SOURCES = [
+    '{workspaceRoot}/pnpm-workspace.yaml',
+    '{workspaceRoot}/package.json',
+];
+async function update(tree) {
+    const nxJson = (0, devkit_1.readNxJson)(tree);
+    const targetDefaults = nxJson?.targetDefaults;
+    const pruneTargets = [];
+    const projects = new Map();
+    const changedProjects = new Set();
+    for (const [projectName, project] of (0, devkit_1.getProjects)(tree)) {
+        projects.set(projectName, project);
+        const projectNode = {
+            name: projectName,
+            type: 'lib',
+            data: { root: project.root, tags: project.tags },
+        };
+        for (const [targetName, target] of Object.entries(project.targets ?? {})) {
+            // The executor may come from a matching targetDefaults entry rather
+            // than the target itself. A `command` target resolves to nx:run-commands
+            // before defaults apply, so a default can never make it a prune target.
+            const executor = target.executor ??
+                (target.command
+                    ? 'nx:run-commands'
+                    : (0, target_defaults_matching_1.resolveDefaultsExecutor)(targetName, projectName, projectNode, targetDefaults, PRUNE_LOCKFILE_EXECUTOR));
+            if (executor !== PRUNE_LOCKFILE_EXECUTOR) {
+                continue;
+            }
+            pruneTargets.push({
+                targetName,
+                projectName,
+                projectNode,
+                matcherExecutor: target.executor,
+                target,
+            });
+            if (appendPnpmPruneOutputs(target)) {
+                changedProjects.add(projectName);
+            }
+        }
+    }
+    let defaultsChanged = false;
+    // runtime applies only the first key that resolves for a target (executor,
+    // exact name, then longest glob), so anchor each prune target to its
+    // selected key
+    const keyedPruneTargets = pruneTargets.map((ref) => ({
+        ref,
+        selectedKey: targetDefaults
+            ? (0, target_defaults_matching_1.selectDefaultsKey)(ref, targetDefaults, PRUNE_LOCKFILE_EXECUTOR)
+            : null,
+    }));
+    if (targetDefaults) {
+        for (const [key, value] of Object.entries(targetDefaults)) {
+            // a value may be the plain object form or the filtered array form
+            for (const config of Array.isArray(value) ? value : [value]) {
+                if (!appliesToPruneLockfileTargets(key, config, keyedPruneTargets)) {
+                    continue;
+                }
+                defaultsChanged = appendPnpmPruneOutputs(config) || defaultsChanged;
+            }
+        }
+    }
+    // `inputs` is decided separately from `outputs`, because the two can be
+    // authored on different layers and a target's own `inputs` replaces the
+    // defaults' array rather than merging with it. The sources are only ever
+    // appended to an array that already exists, or written with nx's default as
+    // the base when no layer declares one. The migration never authors a `'...'`
+    // of its own: whether the entry it would expand against survives depends on
+    // the document-order identity resets in nx's own merge, and a spread that
+    // ends up with nothing to expand narrows the target to the two root files.
+    for (const { ref, selectedKey } of keyedPruneTargets) {
+        const entries = (0, target_defaults_matching_1.compatibleDefaultsEntries)(ref, selectedKey, targetDefaults);
+        const defaults = entries.length
+            ? (0, internal_1.readTargetDefaultsForTarget)(ref.targetName, { [selectedKey]: entries }, ref.matcherExecutor, { projectName: ref.projectName, projectNode: ref.projectNode })
+            : null;
+        // The effective outputs, not the target's own array: a target inheriting
+        // its lockfile entry, or spreading the defaults' outputs into its own, is
+        // still a pnpm prune target.
+        const effective = (0, internal_1.mergeTargetConfigurations)(ref.target, defaults ?? {});
+        if (!declaresPnpmLockfile(effective.outputs)) {
+            continue;
+        }
+        if (ref.target.inputs !== undefined) {
+            // A target's own array wins outright, so nothing else can carry them.
+            if (addRootSettingsInputs(ref.target, effective.inputs)) {
+                changedProjects.add(ref.projectName);
+            }
+            continue;
+        }
+        // Otherwise they belong to the entry supplying the array the target
+        // inherits, which is the last matching one declaring `inputs`.
+        const supplier = (0, target_defaults_matching_1.lastMatchingInputsSupplier)(ref, selectedKey, entries);
+        if (supplier) {
+            defaultsChanged =
+                addRootSettingsInputs(supplier, effective.inputs) || defaultsChanged;
+        }
+        else if (addRootSettingsInputs(ref.target, effective.inputs)) {
+            changedProjects.add(ref.projectName);
+        }
+    }
+    // A workspace configuring its prune targets purely through `targetDefaults`
+    // has no concrete target to carry the decision above.
+    if (targetDefaults && pruneTargets.length === 0) {
+        for (const [key, value] of Object.entries(targetDefaults)) {
+            const entries = Array.isArray(value) ? value : [value];
+            // The key qualifies only when it locates the executor without a
+            // concrete target to resolve against: the key itself, an entry pinning
+            // it, or an entry filtering on it. Every identity-compatible sibling
+            // still merges for such a target, an identity-neutral one included.
+            const compatible = entries.filter(entryIdentityCompatible);
+            const locatesExecutor = key === PRUNE_LOCKFILE_EXECUTOR ||
+                compatible.some((config) => config.executor === PRUNE_LOCKFILE_EXECUTOR ||
+                    config.filter?.executor === PRUNE_LOCKFILE_EXECUTOR);
+            if (!locatesExecutor ||
+                !compatible.some((config) => declaresPnpmLockfile(config.outputs))) {
+                continue;
+            }
+            // Every compatible entry declaring `inputs` can be the array a future
+            // target inherits (a later filtered one replaces it for its projects),
+            // so each carries the sources itself; a sibling's array covers nothing
+            // unless a `'...'` spread pulls it in, in which case only the strictly
+            // filter-less earlier entries are the base it expands against: a
+            // filtered one supplies nothing to the targets its filter excludes,
+            // an executor filter failing for a target whose executor a sibling
+            // supplies (earlier entries are updated first, so the base is checked
+            // with the sources already added).
+            const suppliers = compatible.filter((config) => config.inputs !== undefined);
+            for (const [index, config] of compatible.entries()) {
+                if (config.inputs === undefined) {
+                    continue;
+                }
+                const reference = config.inputs.includes('...')
+                    ? [
+                        ...config.inputs,
+                        ...compatible
+                            .slice(0, index)
+                            .filter((earlier) => !earlier.filter)
+                            .flatMap((earlier) => earlier.inputs ?? []),
+                    ]
+                    : config.inputs;
+                defaultsChanged =
+                    addRootSettingsInputs(config, reference) || defaultsChanged;
+            }
+            // Targets no filtered supplier matches fall back to nx's own default
+            // when no filter-less entry declares an array, so the spelled-out
+            // default is prepended as its own entry: prepending keeps it from
+            // replacing a later supplier's array. A prepended carrier must match
+            // only targets an existing entry already matched, or the key starts
+            // winning selection for targets that previously fell through to their
+            // name or glob defaults. That holds under an executor key with a
+            // filter-less entry (a neutral carrier), and under a name or glob key
+            // with a filter-less pin (a pinned carrier, which a same-name target of
+            // another executor cannot inherit). An all-filtered array gets no
+            // fallback: any carrier would widen the key. The object form has no
+            // room to prepend; its single filter-less entry carries it instead.
+            if (!suppliers.some((supplier) => !supplier.filter)) {
+                const canCarry = key === PRUNE_LOCKFILE_EXECUTOR
+                    ? compatible.some((config) => !config.filter)
+                    : compatible.some((config) => !config.filter && config.executor === PRUNE_LOCKFILE_EXECUTOR);
+                if (canCarry) {
+                    if (Array.isArray(value)) {
+                        const fallback = key === PRUNE_LOCKFILE_EXECUTOR
+                            ? {}
+                            : { executor: PRUNE_LOCKFILE_EXECUTOR };
+                        addRootSettingsInputs(fallback, []);
+                        value.unshift(fallback);
+                        defaultsChanged = true;
+                    }
+                    else {
+                        defaultsChanged =
+                            addRootSettingsInputs(value, []) || defaultsChanged;
+                    }
+                }
+            }
+        }
+    }
+    for (const projectName of changedProjects) {
+        (0, devkit_1.updateProjectConfiguration)(tree, projectName, projects.get(projectName));
+    }
+    if (defaultsChanged) {
+        (0, devkit_1.updateNxJson)(tree, nxJson);
+    }
+    await (0, devkit_1.formatFiles)(tree);
+}
+function declaresPnpmLockfile(outputs) {
+    return pnpmLockfileEntry(outputs) !== undefined;
+}
+function pnpmLockfileEntry(outputs) {
+    return outputs?.find((output) => typeof output === 'string' &&
+        (output === PNPM_LOCKFILE || output.endsWith(`/${PNPM_LOCKFILE}`)));
+}
+/**
+ * Adds the workspace root files the pnpm install settings live in, and the
+ * pnpm major probe, skipping any the target already hashes: a `'...'` in the
+ * owner's array can carry one in from the layer below, where a check against
+ * the owner's own entries cannot see it. An absent `inputs` means nx's own
+ * default, so that is spelled out before adding to it rather than narrowing
+ * the configuration to the settings sources alone.
+ */
+function addRootSettingsInputs(config, referenceInputs = []) {
+    const alreadyHashed = (0, target_defaults_matching_1.namedFilesets)(referenceInputs);
+    const missing = PNPM_ROOT_SETTINGS_SOURCES.filter((source) => !alreadyHashed.has(source) && !config.inputs?.includes(source));
+    if (!hasPnpmMajorProbe(referenceInputs) &&
+        !hasPnpmMajorProbe(config.inputs)) {
+        missing.push(pnpm_install_settings_inputs_1.PNPM_MAJOR_RUNTIME_INPUT);
+    }
+    if (missing.length === 0) {
+        return false;
+    }
+    config.inputs = [...(config.inputs ?? target_defaults_matching_1.DEFAULT_INPUTS), ...missing];
+    return true;
+}
+function hasPnpmMajorProbe(inputs) {
+    return (inputs ?? []).some((existing) => typeof existing === 'object' &&
+        existing !== null &&
+        'runtime' in existing &&
+        existing.runtime === pnpm_install_settings_inputs_1.PNPM_MAJOR_RUNTIME_INPUT.runtime);
+}
+/**
+ * Whether a `targetDefaults` entry applies to `@nx/js:prune-lockfile` targets,
+ * mirroring nx's runtime matching: the entry's `filter` and merge-time
+ * payload compatibility are evaluated first, then the entry must sit under a
+ * prune target's selected key and match its context. Entries locating the
+ * executor (key, `executor` field, or `filter.executor`) match without a
+ * concrete target so a defaults-only workspace still gets the update. The
+ * in-key merge accumulation (identity replacement, outputs replacement, `...`
+ * spreads) is deliberately not replicated: an entry the merge ends up
+ * discarding for the prune target may still get the artifacts appended, which
+ * is additive-only for the target's own replay.
+ */
+function appliesToPruneLockfileTargets(key, config, pruneTargets) {
+    if (!entryIdentityCompatible(config)) {
+        return false;
+    }
+    const filter = config.filter;
+    if (pruneTargets.length === 0) {
+        const locatesExecutor = key === PRUNE_LOCKFILE_EXECUTOR ||
+            config.executor === PRUNE_LOCKFILE_EXECUTOR ||
+            filter?.executor === PRUNE_LOCKFILE_EXECUTOR;
+        return locatesExecutor && !filter?.projects;
+    }
+    return pruneTargets.some(({ ref, selectedKey }) => selectedKey === key &&
+        (0, internal_1.readTargetDefaultsForTarget)(ref.targetName, { [key]: [config] }, ref.matcherExecutor, { projectName: ref.projectName, projectNode: ref.projectNode }) !== null);
+}
+/**
+ * Whether a `targetDefaults` entry can merge into an `@nx/js:prune-lockfile`
+ * target at all: a filter or payload pinning another executor or a command
+ * identity never does (isCompatibleTarget), and prune-lockfile targets are
+ * always explicitly configured, never inferred, so a plugin-filtered entry
+ * never applies either.
+ */
+function entryIdentityCompatible(config) {
+    const filter = config.filter;
+    if (filter?.executor && filter.executor !== PRUNE_LOCKFILE_EXECUTOR) {
+        return false;
+    }
+    if (filter?.plugin) {
+        return false;
+    }
+    return !((config.executor && config.executor !== PRUNE_LOCKFILE_EXECUTOR) ||
+        config.command);
+}
+/**
+ * Appends the pnpm prune artifacts next to an existing pnpm-lock.yaml entry,
+ * reusing that entry's own path spelling. Configurations with no `outputs` or no
+ * pnpm lockfile entry are left alone: the lockfile entry is what identifies the
+ * target as pnpm's, and one without `outputs` caches nothing to begin with.
+ */
+function appendPnpmPruneOutputs(config) {
+    const lockfileEntry = pnpmLockfileEntry(config.outputs);
+    if (!lockfileEntry) {
+        return false;
+    }
+    const prefix = lockfileEntry.slice(0, -PNPM_LOCKFILE.length);
+    let changed = false;
+    for (const artifact of PNPM_PRUNE_ARTIFACTS) {
+        const entry = `${prefix}${artifact}`;
+        if (!config.outputs.includes(entry)) {
+            config.outputs.push(entry);
+            changed = true;
+        }
+    }
+    return changed;
+}