@ohos-ports/nx 23.2.1-beta.0 → 23.3.0-beta.0

package/dist/src/utils/min-release-age/pick.js

@@ -0,0 +1,206 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifySpec = classifySpec;
+exports.splitPackageDescriptor = splitPackageDescriptor;
+exports.isVersionMature = isVersionMature;
+exports.newestInRange = newestInRange;
+exports.degradeTagToCompliant = degradeTagToCompliant;
+exports.blockedVersionsFrom = blockedVersionsFrom;
+exports.pickMinReleaseAgeCompliantVersion = pickMinReleaseAgeCompliantVersion;
+const semver_1 = require("semver");
+const bun_1 = require("./behavior/bun");
+const npm_1 = require("./behavior/npm");
+const pnpm_1 = require("./behavior/pnpm");
+const yarn_1 = require("./behavior/yarn");
+/**
+ * Classifies a version spec the way the package managers do: an exact semver is
+ * a pin, a valid range is a range, anything else (latest, hot, canary, ...) is
+ * a dist-tag. Catalog refs are dereferenced before this layer.
+ */
+function classifySpec(spec) {
+    if ((0, semver_1.valid)(spec)) {
+        return 'exact';
+    }
+    if ((0, semver_1.validRange)(spec)) {
+        return 'range';
+    }
+    return 'tag';
+}
+/**
+ * Splits an npm package descriptor into its name and the raw version part after
+ * the separating `@`, honoring scoped names where the leading `@` is part of the
+ * name. `versionPart` is null when there is no separator (bare name) and an
+ * empty string for a trailing `@`; callers interpret the version part.
+ */
+function splitPackageDescriptor(entry) {
+    const scoped = entry.startsWith('@');
+    const at = entry.indexOf('@', scoped ? 1 : 0);
+    if (at === -1) {
+        return { name: entry, versionPart: null };
+    }
+    return { name: entry.slice(0, at), versionPart: entry.slice(at + 1) };
+}
+/**
+ * Shared maturity test: a version passes when its publish time is at or before
+ * the cutoff (inclusive), or when it is explicitly excluded.
+ */
+function isVersionMature(name, version, metadata, policy) {
+    if (policy.isExcluded(name, version)) {
+        return true;
+    }
+    const time = metadata.time?.[version];
+    if (!time) {
+        // Missing individual time: callers that diverge (pnpm blocks, yarn
+        // quarantines) handle it themselves; the default is to pass like npm/bun.
+        return true;
+    }
+    return Date.parse(time) <= policy.cutoffMs;
+}
+/**
+ * Newest version satisfying the range, ignoring the cooldown gate. Used only to
+ * compute PickOutcome.unconstrained (messaging); never gates a pick. Falls back
+ * to the raw range when nothing matches.
+ */
+function newestInRange(metadata, range) {
+    return (metadata.versions
+        .filter((v) => (0, semver_1.satisfies)(v, range, { includePrerelease: false }))
+        .sort(semver_1.rcompare)[0] ?? range);
+}
+/**
+ * The prerelease channel of a version: the first dotted identifier of its
+ * prerelease tag (e.g. `rc` for `23.0.0-rc.0`, `pr` for `23.0.0-pr.123`), or
+ * null for a stable release. Channels keep parallel prerelease lines apart so a
+ * cooldown degrade never crosses from `rc` into an internal `pr` build.
+ */
+function prereleaseChannel(version) {
+    const pre = (0, semver_1.prerelease)(version);
+    return pre && pre.length > 0 ? String(pre[0]) : null;
+}
+// The stable `major.minor.patch` of a version, ignoring any prerelease tag
+// (e.g. `23.0.0` for both `23.0.0-rc.0` and `23.0.0`).
+function releaseLine(version) {
+    const parsed = (0, semver_1.parse)(version);
+    return parsed ? `${parsed.major}.${parsed.minor}.${parsed.patch}` : version;
+}
+// Publish time in epoch ms; a version with no registry time sorts last.
+function publishedAtMs(metadata, version) {
+    const time = metadata.time?.[version];
+    const parsed = time ? Date.parse(time) : NaN;
+    return Number.isNaN(parsed) ? -Infinity : parsed;
+}
+// Prerelease channels with a conventional maturity order, least mature first.
+// A blocked target may descend to a lower rung of its own release line
+// (rc.0 -> beta.x); channels off the ladder (pr, canary, ...) have no implied
+// ordering and stay walled off. `next` is deliberately omitted: it is pre-rc
+// in some ecosystems (Angular) but a rolling dev snapshot in others - exactly
+// the kind of build a degrade must never land on.
+const ORDERED_CHANNELS = ['alpha', 'beta', 'rc'];
+// Whether a prerelease channel may serve as a degrade candidate for a target
+// on `targetChannel`: the target's own channel always; a strictly lower rung
+// when both sit on the ladder. A stable target (null channel) admits none.
+function channelAdmits(targetChannel, channel) {
+    if (channel === targetChannel) {
+        return true;
+    }
+    if (targetChannel === null) {
+        return false;
+    }
+    const rank = ORDERED_CHANNELS.indexOf(channel);
+    const targetRank = ORDERED_CHANNELS.indexOf(targetChannel);
+    return rank !== -1 && targetRank !== -1 && rank < targetRank;
+}
+/**
+ * Degrades a too-new dist-tag target to a cooldown-compliant version "of the
+ * same kind", shared by every package manager.
+ *
+ * The candidate pool is every version at or below the resolved target that is
+ * stable, in the target's prerelease channel, or on a lower rung of the
+ * channel ladder (alpha < beta < rc). It is ordered so that prereleases of
+ * the target's exact release line come first - own channel, then lower rungs -
+ * then everything else; within each group the most recently published version
+ * comes first (semver breaks ties and orders versions with no publish time).
+ * The first compliant version in that order wins.
+ *
+ * So a stable target degrades to the newest compliant stable, and a prerelease
+ * target keeps a compliant prerelease of the release it points at when one
+ * exists (an rc may fall to a same-line beta), otherwise drops to the newest
+ * compliant version below it - never crossing into a channel with no place on
+ * the ladder (e.g. an internal `pr` build) and never climbing up it. Returns
+ * null when nothing in the pool is compliant; callers turn that into their
+ * package manager's violation.
+ *
+ * `isCompliant` is the caller's per-PM maturity test (package managers differ
+ * on missing publish times and excludes).
+ */
+function degradeTagToCompliant(target, metadata, isCompliant) {
+    // semver.compare throws on a non-semver string; a tag pointing at one has no
+    // channel or ordering to reason about, so report no candidate and let the
+    // caller raise its violation.
+    if (!(0, semver_1.valid)(target)) {
+        return null;
+    }
+    const targetChannel = prereleaseChannel(target);
+    const targetLine = releaseLine(target);
+    const pool = metadata.versions.filter((version) => {
+        if (!(0, semver_1.valid)(version) || (0, semver_1.compare)(version, target) > 0) {
+            return false; // unparseable or newer than the target
+        }
+        const channel = prereleaseChannel(version);
+        // Stables always stay; a prerelease stays only in the target's channel or
+        // on a lower ladder rung (every prerelease is out for a stable target).
+        return channel === null || channelAdmits(targetChannel, channel);
+    });
+    // Prereleases of the target's exact release line rank ahead of the rest -
+    // own channel before lower rungs - then everything else; within each tier,
+    // newest published first.
+    const tier = (version) => {
+        if (releaseLine(version) !== targetLine) {
+            return 2;
+        }
+        const channel = prereleaseChannel(version);
+        if (channel === targetChannel) {
+            return 0;
+        }
+        return channel === null ? 2 : 1;
+    };
+    pool.sort((a, b) => {
+        const tierDelta = tier(a) - tier(b);
+        if (tierDelta !== 0) {
+            return tierDelta;
+        }
+        const publishedA = publishedAtMs(metadata, a);
+        const publishedB = publishedAtMs(metadata, b);
+        if (publishedA !== publishedB) {
+            return publishedB - publishedA;
+        }
+        return (0, semver_1.compare)(b, a);
+    });
+    return pool.find((version) => isCompliant(version)) ?? null;
+}
+/**
+ * Maps a list of held-back versions to the blocked-candidate shape carried by
+ * MinReleaseAgeViolationError, keeping only versions the registry has a publish
+ * time for.
+ */
+function blockedVersionsFrom(metadata, versions) {
+    return versions
+        .filter((v) => !!metadata.time?.[v])
+        .map((v) => ({ version: v, publishedAt: metadata.time[v] }));
+}
+/**
+ * Resolves a spec to a version that complies with the effective cooldown
+ * policy, dispatching to the per-PM pick rules. Throws
+ * MinReleaseAgeViolationError when the PM at this version would fail.
+ */
+function pickMinReleaseAgeCompliantVersion(spec, metadata, policy) {
+    switch (policy.behavior.packageManager) {
+        case 'npm':
+            return (0, npm_1.pickNpmVersion)(spec, metadata, policy);
+        case 'pnpm':
+            return (0, pnpm_1.pickPnpmVersion)(spec, metadata, policy);
+        case 'yarn':
+            return (0, yarn_1.pickYarnVersion)(spec, metadata, policy);
+        case 'bun':
+            return (0, bun_1.pickBunVersion)(spec, metadata, policy);
+    }
+}

package/dist/src/utils/min-release-age/pnpm-exclude-writer.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Appends `<name>@<version>` entries to `minimumReleaseAgeExclude` in
+ * pnpm-workspace.yaml, mirroring what pnpm's loose-mode policy handler writes at
+ * install time (deduped, existing order preserved, new entries appended). The
+ * edit is comment-preserving (yaml document API); the file is created when
+ * absent. Returns the entries that were newly added (empty when all were
+ * already present or `entries` is empty).
+ *
+ * Each entry must already be in `<name>@<version>` form. The caller is
+ * responsible for building it from the resolved package name and version.
+ */
+export declare function appendMinimumReleaseAgeExcludes(root: string, entries: string[]): string[];

package/dist/src/utils/min-release-age/pnpm-exclude-writer.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appendMinimumReleaseAgeExcludes = appendMinimumReleaseAgeExcludes;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const yaml_1 = require("yaml");
+const EXCLUDE_KEY = 'minimumReleaseAgeExclude';
+/**
+ * Appends `<name>@<version>` entries to `minimumReleaseAgeExclude` in
+ * pnpm-workspace.yaml, mirroring what pnpm's loose-mode policy handler writes at
+ * install time (deduped, existing order preserved, new entries appended). The
+ * edit is comment-preserving (yaml document API); the file is created when
+ * absent. Returns the entries that were newly added (empty when all were
+ * already present or `entries` is empty).
+ *
+ * Each entry must already be in `<name>@<version>` form. The caller is
+ * responsible for building it from the resolved package name and version.
+ */
+function appendMinimumReleaseAgeExcludes(root, entries) {
+    const deduped = [...new Set(entries)].filter(Boolean);
+    if (deduped.length === 0) {
+        return [];
+    }
+    const path = (0, path_1.join)(root, 'pnpm-workspace.yaml');
+    const raw = (0, fs_1.existsSync)(path) ? (0, fs_1.readFileSync)(path, 'utf-8') : '';
+    const parsed = (0, yaml_1.parseDocument)(raw);
+    // A present root that isn't a mapping (a bare scalar or sequence) is malformed
+    // for pnpm; bail rather than overwrite the file with just the exclude key and
+    // drop the user's content. Empty/comments-only files have null contents and
+    // fall through to a fresh mapping document below.
+    if (parsed.contents != null && !(parsed.contents instanceof yaml_1.YAMLMap)) {
+        return [];
+    }
+    const doc = parsed.contents instanceof yaml_1.YAMLMap ? parsed : new yaml_1.Document(new yaml_1.YAMLMap());
+    const seq = doc.get(EXCLUDE_KEY);
+    const existingSeq = seq instanceof yaml_1.YAMLSeq ? seq : undefined;
+    const existing = new Set(seqStringValues(existingSeq));
+    const added = deduped.filter((entry) => !existing.has(entry));
+    if (added.length === 0) {
+        return [];
+    }
+    if (existingSeq) {
+        for (const entry of added) {
+            existingSeq.add(entry);
+        }
+    }
+    else {
+        doc.set(EXCLUDE_KEY, added);
+    }
+    (0, fs_1.writeFileSync)(path, doc.toString());
+    return added;
+}
+function seqStringValues(seq) {
+    if (!seq) {
+        return [];
+    }
+    return seq.items.map((item) => item instanceof yaml_1.Scalar ? String(item.value) : String(item));
+}

package/dist/src/utils/min-release-age/policy.d.ts

@@ -0,0 +1,38 @@
+export type MinReleaseAgePolicyReadResult = {
+    outcome: 'active';
+    policy: MinReleaseAgePolicy;
+} | {
+    outcome: 'inactive';
+} | {
+    outcome: 'ambiguous';
+    reason: string;
+};
+export interface MinReleaseAgePolicy {
+    packageManagerVersion: string;
+    cutoffMs: number;
+    windowMs: number;
+    sourceDescription: string;
+    isExcluded(packageName: string, version: string): boolean;
+    behavior: PmMinReleaseAgeBehavior;
+}
+export type PmMinReleaseAgeBehavior = {
+    packageManager: 'npm';
+} | {
+    packageManager: 'pnpm';
+    strict: boolean;
+    looseFallback: boolean;
+    writesExcludes: boolean;
+    missingTimeMap: 'error' | 'skip';
+} | {
+    packageManager: 'yarn';
+    missingVersionTime: 'pass' | 'quarantine';
+} | {
+    packageManager: 'bun';
+};
+/**
+ * Reads the package manager, its version, and the relevant cooldown config
+ * surfaces once, then dispatches to the per-PM reader. PM versions below the
+ * feature's introduction boundary short-circuit to 'inactive' without touching
+ * any config surface.
+ */
+export declare function readMinReleaseAgePolicy(root?: string): Promise<MinReleaseAgePolicyReadResult>;

package/dist/src/utils/min-release-age/policy.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readMinReleaseAgePolicy = readMinReleaseAgePolicy;
+const semver_1 = require("semver");
+const package_manager_1 = require("../package-manager");
+const workspace_root_1 = require("../workspace-root");
+const bun_1 = require("./behavior/bun");
+const npm_1 = require("./behavior/npm");
+const pnpm_1 = require("./behavior/pnpm");
+const yarn_1 = require("./behavior/yarn");
+// Lowest PM version that ships the cooldown feature; below it the gate is inert.
+const INTRODUCED = {
+    npm: '11.10.0',
+    pnpm: '10.16.0',
+    yarn: '4.10.0',
+    bun: '1.3.0',
+};
+/**
+ * Reads the package manager, its version, and the relevant cooldown config
+ * surfaces once, then dispatches to the per-PM reader. PM versions below the
+ * feature's introduction boundary short-circuit to 'inactive' without touching
+ * any config surface.
+ */
+async function readMinReleaseAgePolicy(root = workspace_root_1.workspaceRoot) {
+    const packageManager = (0, package_manager_1.detectPackageManager)(root);
+    let pmVersion;
+    try {
+        pmVersion = (0, package_manager_1.getPackageManagerVersion)(packageManager, root);
+    }
+    catch {
+        // Can't determine the version -> can't reason about the gate; let callers
+        // fall back to a real PM install which will apply the right behavior.
+        return {
+            outcome: 'ambiguous',
+            reason: `Unable to determine the ${packageManager} version.`,
+        };
+    }
+    if (!(0, semver_1.valid)(pmVersion)) {
+        // A non-semver version string can't be reasoned about (gte would throw);
+        // defer to a real PM install rather than guess.
+        return {
+            outcome: 'ambiguous',
+            reason: `Unable to parse the ${packageManager} version "${pmVersion}".`,
+        };
+    }
+    if (!(0, semver_1.gte)(pmVersion, INTRODUCED[packageManager])) {
+        return { outcome: 'inactive' };
+    }
+    switch (packageManager) {
+        case 'npm':
+            return (0, npm_1.readNpmPolicy)(root, pmVersion);
+        case 'pnpm':
+            return (0, pnpm_1.readPnpmPolicy)(root, pmVersion);
+        case 'yarn':
+            return (0, yarn_1.readYarnPolicy)(root, pmVersion);
+        case 'bun':
+            return (0, bun_1.readBunPolicy)(root, pmVersion);
+    }
+}

package/dist/src/utils/min-release-age/resolve.d.ts

@@ -0,0 +1,8 @@
+import { type PickOutcome } from './pick';
+import type { MinReleaseAgePolicy } from './policy';
+/**
+ * Resolves an already catalog-dereferenced spec to a cooldown-compliant version
+ * under the given policy: fetches the packument, then picks. Throws
+ * MinReleaseAgeViolationError when the PM at this version would refuse to resolve.
+ */
+export declare function resolveCompliantVersion(packageName: string, spec: string, policy: MinReleaseAgePolicy): Promise<PickOutcome>;

package/dist/src/utils/min-release-age/resolve.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCompliantVersion = resolveCompliantVersion;
+const packument_1 = require("./packument");
+const pick_1 = require("./pick");
+/**
+ * Resolves an already catalog-dereferenced spec to a cooldown-compliant version
+ * under the given policy: fetches the packument, then picks. Throws
+ * MinReleaseAgeViolationError when the PM at this version would refuse to resolve.
+ */
+async function resolveCompliantVersion(packageName, spec, policy) {
+    const metadata = await (0, packument_1.fetchRegistryMetadata)(packageName);
+    return (0, pick_1.pickMinReleaseAgeCompliantVersion)(spec, metadata, policy);
+}

package/dist/src/utils/nx-cloud-utils.d.ts

@@ -0,0 +1,6 @@
+import { NxJsonConfiguration } from '../config/nx-json';
+export declare function isNxCloudDisabled(nxJson: NxJsonConfiguration): boolean;
+export declare function isNxCloudUsed(nxJson: NxJsonConfiguration): boolean;
+/** Whether nx.json connects the workspace to Nx Cloud, ignoring the env. */
+export declare function isNxCloudConfigured(nxJson: NxJsonConfiguration): boolean;
+export declare function getNxCloudUrl(nxJson: NxJsonConfiguration): string;

package/dist/src/utils/nx-cloud-utils.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNxCloudDisabled = isNxCloudDisabled;
+exports.isNxCloudUsed = isNxCloudUsed;
+exports.isNxCloudConfigured = isNxCloudConfigured;
+exports.getNxCloudUrl = getNxCloudUrl;
+function isNxCloudDisabled(nxJson) {
+    return process.env.NX_NO_CLOUD === 'true' || nxJson.neverConnectToCloud;
+}
+function isNxCloudUsed(nxJson) {
+    if (isNxCloudDisabled(nxJson)) {
+        return false;
+    }
+    return (!!process.env.NX_CLOUD_AUTH_TOKEN ||
+        !!process.env.NX_CLOUD_ACCESS_TOKEN ||
+        isNxCloudConfigured(nxJson));
+}
+/** Whether nx.json connects the workspace to Nx Cloud, ignoring the env. */
+function isNxCloudConfigured(nxJson) {
+    return (!!nxJson.nxCloudAccessToken ||
+        !!nxJson.nxCloudId ||
+        !!Object.values(nxJson.tasksRunnerOptions ?? {}).find((r) => r.runner == '@nrwl/nx-cloud' || r.runner == 'nx-cloud'));
+}
+function getNxCloudUrl(nxJson) {
+    const cloudRunner = Object.values(nxJson.tasksRunnerOptions ?? {}).find((r) => r.runner == '@nrwl/nx-cloud' || r.runner == 'nx-cloud');
+    if (!cloudRunner &&
+        !(nxJson.nxCloudAccessToken ||
+            process.env.NX_CLOUD_AUTH_TOKEN ||
+            process.env.NX_CLOUD_ACCESS_TOKEN) &&
+        !nxJson.nxCloudId)
+        throw new Error('nx-cloud runner not found in nx.json');
+    return cloudRunner?.options?.url ?? nxJson.nxCloudUrl ?? 'https://nx.app';
+}

package/dist/src/utils/nx-console-prompt.d.ts

@@ -0,0 +1 @@
+export declare function ensureNxConsoleInstalled(): Promise<void>;

package/dist/src/utils/nx-console-prompt.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureNxConsoleInstalled = ensureNxConsoleInstalled;
+const prompt_helpers_1 = require("./prompt-helpers");
+const os_1 = require("os");
+const output_1 = require("./output");
+const native_1 = require("../native");
+const is_ci_1 = require("./is-ci");
+async function ensureNxConsoleInstalled() {
+    const preferences = new native_1.NxConsolePreferences((0, os_1.homedir)());
+    let setting = preferences.getAutoInstallPreference();
+    const canInstallConsole = await (0, native_1.canInstallNxConsole)();
+    // If user previously opted in but extension is not installed,
+    // they must have manually uninstalled it - respect that choice
+    if (setting === true && canInstallConsole) {
+        // User had auto-install enabled but extension is missing
+        // This means they manually uninstalled it
+        preferences.setAutoInstallPreference(false);
+        return;
+    }
+    // Noop
+    if (!canInstallConsole) {
+        return;
+    }
+    // Only prompt if both stdin and stdout are TTY (interactive terminal)
+    // and we're not in a CI environment
+    const isInteractive = process.stdin.isTTY && process.stdout.isTTY && !(0, is_ci_1.isCI)();
+    if (isInteractive && typeof setting !== 'boolean') {
+        setting = await promptForNxConsoleInstallation();
+        preferences.setAutoInstallPreference(setting);
+    }
+    if (setting) {
+        const installed = await (0, native_1.installNxConsole)();
+        if (installed) {
+            output_1.output.log({ title: 'Successfully installed Nx Console!' });
+        }
+    }
+}
+/**
+ * Prompts the user whether they want to automatically install the Nx Console extension
+ * and persists their preference using the NxConsolePreferences struct
+ */
+async function promptForNxConsoleInstallation() {
+    try {
+        output_1.output.log({
+            title: "Install Nx's official editor extension to:",
+            bodyLines: [
+                '- Enable your AI assistant to do more by understanding your workspace',
+                '- Add IntelliSense for Nx configuration files',
+                '- Explore your workspace visually',
+            ],
+        });
+        return await (0, prompt_helpers_1.confirmationPrompt)({
+            message: 'Install Nx Console? (you can uninstall anytime)',
+            onCancel: () => false,
+        });
+    }
+    catch (error) {
+        return false;
+    }
+}

package/dist/src/utils/nx-key.d.ts

@@ -0,0 +1,6 @@
+import type { NxKey } from '@nx/key';
+export declare function createNxKeyLicenseeInformation(nxKey: NxKey): string;
+export declare function getNxKeyInformation(): Promise<NxKey | null>;
+export declare class NxKeyNotInstalledError extends Error {
+    constructor(e: Error);
+}

package/dist/src/utils/nx-key.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NxKeyNotInstalledError = void 0;
+exports.createNxKeyLicenseeInformation = createNxKeyLicenseeInformation;
+exports.getNxKeyInformation = getNxKeyInformation;
+const installation_directory_1 = require("./installation-directory");
+const package_manager_1 = require("./package-manager");
+const workspace_root_1 = require("./workspace-root");
+function createNxKeyLicenseeInformation(nxKey) {
+    if ('isPowerpack' in nxKey && nxKey.isPowerpack) {
+        return `Licensed to ${nxKey.organizationName} for ${nxKey.seatCount} user${nxKey.seatCount > 1 ? 's' : ''} in ${nxKey.workspaceCount === 9999
+            ? 'an unlimited number of'
+            : nxKey.workspaceCount} workspace${nxKey.workspaceCount > 1 ? 's' : ''}.`;
+    }
+    else {
+        return `Licensed to ${nxKey.organizationName}.`;
+    }
+}
+// `await handleImport` walks node_modules and pays ~25ms per miss; `resolve`
+// is just the filesystem lookup and is microseconds when the package is absent.
+// Only treat MODULE_NOT_FOUND as "not installed" so unrelated errors (permission,
+// corrupt package.json, etc.) still surface instead of being silently hidden.
+function packageInstalled(name) {
+    try {
+        require.resolve(name, { paths: (0, installation_directory_1.getNxRequirePaths)() });
+        return true;
+    }
+    catch (e) {
+        if (e?.code === 'MODULE_NOT_FOUND')
+            return false;
+        throw e;
+    }
+}
+async function getNxKeyInformation() {
+    if (packageInstalled('@nx/key')) {
+        const { getNxKeyInformationAsync } = await import('@nx/key');
+        return getNxKeyInformationAsync(workspace_root_1.workspaceRoot);
+    }
+    if (packageInstalled('@nx/powerpack-license')) {
+        const { getPowerpackLicenseInformation, getPowerpackLicenseInformationAsync, } = await import('@nx/powerpack-license');
+        return (getPowerpackLicenseInformationAsync ?? getPowerpackLicenseInformation)(workspace_root_1.workspaceRoot);
+    }
+    throw new NxKeyNotInstalledError(new Error('MODULE_NOT_FOUND'));
+}
+class NxKeyNotInstalledError extends Error {
+    constructor(e) {
+        super(`The "@nx/key" package is needed to use Nx key enabled features. Please install it with ${(0, package_manager_1.getPackageManagerCommand)().addDev} @nx/key`, { cause: e });
+    }
+}
+exports.NxKeyNotInstalledError = NxKeyNotInstalledError;

package/dist/src/utils/nx-package-group.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The first-party Nx package set declared in nx's own
+ * `nx-migrations.packageGroup`. Used by `nx report` (to know which
+ * package versions to print) and by `nx add` shell completion (to
+ * suggest first-party plugins). Auto-updates as new plugins land in
+ * the package group — no hand-maintained list.
+ */
+export declare function readNxPackageGroup(): string[];

package/dist/src/utils/nx-package-group.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readNxPackageGroup = readNxPackageGroup;
+const fileutils_1 = require("./fileutils");
+/**
+ * The first-party Nx package set declared in nx's own
+ * `nx-migrations.packageGroup`. Used by `nx report` (to know which
+ * package versions to print) and by `nx add` shell completion (to
+ * suggest first-party plugins). Auto-updates as new plugins land in
+ * the package group — no hand-maintained list.
+ */
+function readNxPackageGroup() {
+    const nxPkg = (0, fileutils_1.readJsonFile)(require.resolve('nx/package.json'));
+    return (nxPkg['nx-migrations']?.packageGroup ?? []).map((e) => typeof e === 'string' ? e : e.package);
+}

package/dist/src/utils/nx-tmp-dir.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Stable root for Nx runtime artifacts that need an OS tmp location. On POSIX a
+ * literal `/tmp`, not `os.tmpdir()`, which honours `$TMPDIR` — per-user on
+ * macOS, rewritten by sandboxes, stripped from the daemon env, so client and
+ * daemon would disagree. Windows has no `/tmp`, and `%TMP%` is already per-user
+ * and stable, so it keeps `os.tmpdir()`.
+ *
+ * Consumed by the native binding loader, so keep this file limited to local
+ * helpers that themselves use Node builtins only.
+ */
+export declare const NX_TMP_DIR_POSIX = "/tmp/.nx";
+/**
+ * Windows has no /tmp, named pipes are not subject to filesystem sandboxing,
+ * and per-user temp dirs are stable there, so the OS temp dir is fine.
+ */
+export declare const NX_TMP_DIR: string;
+/**
+ * Owner-only runtime root for the current user. No user segment on Windows —
+ * `%TMP%` is already per-account, and the segment would only cost path length.
+ */
+export declare const NX_USER_TMP_DIR: string;
+/** Runtime root under the user's home, used when the shared container cannot be established. */
+export declare const NX_HOME_TMP_DIR: string;

package/dist/src/utils/nx-tmp-dir.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NX_HOME_TMP_DIR = exports.NX_USER_TMP_DIR = exports.NX_TMP_DIR = exports.NX_TMP_DIR_POSIX = void 0;
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const owned_private_dir_1 = require("./owned-private-dir");
+/**
+ * Stable root for Nx runtime artifacts that need an OS tmp location. On POSIX a
+ * literal `/tmp`, not `os.tmpdir()`, which honours `$TMPDIR` — per-user on
+ * macOS, rewritten by sandboxes, stripped from the daemon env, so client and
+ * daemon would disagree. Windows has no `/tmp`, and `%TMP%` is already per-user
+ * and stable, so it keeps `os.tmpdir()`.
+ *
+ * Consumed by the native binding loader, so keep this file limited to local
+ * helpers that themselves use Node builtins only.
+ */
+exports.NX_TMP_DIR_POSIX = '/tmp/.nx';
+/**
+ * Windows has no /tmp, named pipes are not subject to filesystem sandboxing,
+ * and per-user temp dirs are stable there, so the OS temp dir is fine.
+ */
+exports.NX_TMP_DIR = (0, node_os_1.platform)() === 'win32' ? (0, node_path_1.join)((0, node_os_1.tmpdir)(), '.nx') : exports.NX_TMP_DIR_POSIX;
+/**
+ * Owner-only runtime root for the current user. No user segment on Windows —
+ * `%TMP%` is already per-account, and the segment would only cost path length.
+ */
+exports.NX_USER_TMP_DIR = (0, node_os_1.platform)() === 'win32' ? exports.NX_TMP_DIR : (0, node_path_1.join)(exports.NX_TMP_DIR, (0, owned_private_dir_1.getUserSegment)());
+/** Runtime root under the user's home, used when the shared container cannot be established. */
+exports.NX_HOME_TMP_DIR = resolveHomeTmpDir();
+/**
+ * Absolute, not merely non-empty: a relative `$HOME` would make `join` return
+ * `.nx`, putting sockets under the cwd and aiming `removeSocketDir`'s recursive
+ * delete at it. A rootless container has no `$HOME` and no passwd entry, so
+ * `homedir()` throws or returns empty — caught here because this runs at module
+ * scope and the native binding loader imports this file.
+ */
+function resolveHomeTmpDir() {
+    try {
+        const home = (0, node_os_1.homedir)();
+        return home && (0, node_path_1.isAbsolute)(home) ? (0, node_path_1.join)(home, '.nx') : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/utils/object-sort.d.ts

@@ -0,0 +1 @@
+export declare function sortObjectByKeys(originalObject: object): {};