nx 23.1.0 → 23.1.1

package/dist/src/daemon/client/client.d.ts

@@ -26,8 +26,6 @@ export declare class DaemonClient {
     private _daemonStatus;
     private _waitForDaemonReady;
     private _daemonReady;
-    private _out;
-    private _err;
     private fileWatcherMessenger;
     private fileWatcherReconnecting;
     private fileWatcherCallbacks;

package/dist/src/daemon/client/client.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.daemonClient = exports.DaemonClient = void 0;
 exports.isDaemonEnabled = isDaemonEnabled;
 const child_process_1 = require("child_process");
-const promises_1 = require("fs/promises");
 const net_1 = require("net");
 const node_fs_1 = require("node:fs");
 const path_1 = require("path");
@@ -12,6 +11,7 @@ const configuration_1 = require("../../config/configuration");
 const nx_json_1 = require("../../config/nx-json");
 const native_1 = require("../../native");
 const error_types_1 = require("../../project-graph/error-types");
+const typescript_1 = require("../../plugins/js/utils/typescript");
 const project_graph_1 = require("../../project-graph/project-graph");
 const consume_messages_from_socket_1 = require("../../utils/consume-messages-from-socket");
 const delayed_spinner_1 = require("../../utils/delayed-spinner");
@@ -62,8 +62,6 @@ class DaemonClient {
         this._daemonStatus = DaemonStatus.DISCONNECTED;
         this._waitForDaemonReady = null;
         this._daemonReady = null;
-        this._out = null;
-        this._err = null;
         this.fileWatcherReconnecting = false;
         this.fileWatcherCallbacks = new Map();
         this.fileWatcherConfigs = new Map();
@@ -127,10 +125,6 @@ class DaemonClient {
         this.currentResolve = null;
         this.currentReject = null;
         this._enabled = undefined;
-        this._out?.close();
-        this._err?.close();
-        this._out = null;
-        this._err = null;
         // Clean up file watcher and project graph listener connections
         this.fileWatcherMessenger?.close();
         this.fileWatcherMessenger = undefined;
@@ -949,25 +943,29 @@ class DaemonClient {
         if (!(0, node_fs_1.existsSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE)) {
             (0, node_fs_1.writeFileSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, '');
         }
-        // Open the log handles into locals first. If the previous daemon's
-        // socket close handler fires reset() while we're awaiting these opens,
-        // it would null out this._out/this._err and the spawn below would hit
-        // `Cannot read properties of null (reading 'fd')`.
-        const [out, err] = await Promise.all([
-            (0, promises_1.open)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a'),
-            (0, promises_1.open)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a'),
-        ]);
-        this._out = out;
-        this._err = err;
+        // Redirect the detached daemon's stdout/stderr into the log file. The
+        // child dup's these descriptors at spawn, so we close ours right after
+        // instead of holding them for the life of this process (Node >=26 turns a
+        // file descriptor closed during garbage collection into a fatal error).
+        const outFd = (0, node_fs_1.openSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a');
+        const errFd = (0, node_fs_1.openSync)(tmp_dir_1.DAEMON_OUTPUT_LOG_FILE, 'a');
         logger_1.clientLogger.log(`[Client] Starting new daemon server in background`);
-        const backgroundProcess = (0, child_process_1.spawn)(process.execPath, [(0, path_1.join)(__dirname, `../server/start.js`)], {
+        const backgroundProcess = (0, child_process_1.spawn)(process.execPath, [
+            // Spawn with the same resolve conditions Nx uses for plugin entries so a
+            // source-loaded plugin's transitive workspace imports resolve to source.
+            ...(0, typescript_1.getPluginResolveConditionNodeArgs)(),
+            (0, path_1.join)(__dirname, `../server/start.js`),
+        ], {
             cwd: workspace_root_1.workspaceRoot,
-            stdio: ['ignore', out.fd, err.fd],
+            stdio: ['ignore', outFd, errFd],
             detached: true,
             windowsHide: true,
             shell: false,
             env: (0, daemon_environment_1.getDaemonEnv)(),
         });
+        // The child now owns dup'd copies of the descriptors, so release ours.
+        (0, node_fs_1.closeSync)(outFd);
+        (0, node_fs_1.closeSync)(errFd);
         // if this process is the process that spawned the daemon,
         // the daemon env is already up to date
         this.envReflectionSent = true;

package/dist/src/daemon/server/handle-tasks-execution-hooks.d.ts

@@ -1,8 +1,8 @@
 import type { PostTasksExecutionContext, PreTasksExecutionContext } from '../../project-graph/plugins/public-api';
 export declare function handleRunPreTasksExecution(context: PreTasksExecutionContext): Promise<{
-    error?: undefined;
     response: NodeJS.ProcessEnv[];
     description: string;
+    error?: undefined;
 } | {
     response?: undefined;
     error: any;

package/dist/src/daemon/server/server.js

@@ -360,6 +360,13 @@ const handleOutputsChanges = async (err, changeEvents) => {
     }
 };
 async function startServer() {
+    // Watch before scan: a file written during boot must be visible to the
+    // watcher or the scan below. Scan-first left a blind window where such
+    // files stayed invisible to both until an unrelated change arrived.
+    if (!(0, shutdown_utils_1.getWatcherInstance)()) {
+        (0, shutdown_utils_1.storeWatcherInstance)(await (0, watcher_1.watchWorkspace)(server, handleWorkspaceChanges));
+        logger_1.serverLogger.watcherLog(`Subscribed to changes within: ${workspace_root_1.workspaceRoot} (native)`);
+    }
     (0, workspace_context_1.setupWorkspaceContext)(workspace_root_1.workspaceRoot);
     // Initialize analytics for daemon process
     await (0, analytics_1.startAnalytics)();
@@ -418,10 +425,6 @@ async function startServer() {
                     logger_1.serverLogger.log(`Started listening on: ${socketPath}`);
                     // this triggers the storage of the lock file hash
                     daemonIsOutdated();
-                    if (!(0, shutdown_utils_1.getWatcherInstance)()) {
-                        (0, shutdown_utils_1.storeWatcherInstance)(await (0, watcher_1.watchWorkspace)(server, handleWorkspaceChanges));
-                        logger_1.serverLogger.watcherLog(`Subscribed to changes within: ${workspace_root_1.workspaceRoot} (native)`);
-                    }
                     if (!(0, shutdown_utils_1.getOutputWatcherInstance)()) {
                         (0, shutdown_utils_1.storeOutputWatcherInstance)(await (0, watcher_1.watchOutputFiles)(server, handleOutputsChanges));
                     }

package/dist/src/devkit-internals.d.ts

@@ -38,3 +38,6 @@ export { PluginCache, safeWriteFileCache } from './utils/plugin-cache-utils';
 export { emitPluginWorkerLog } from './project-graph/plugins/isolation/worker-streaming';
 export { resolveImplementation, resolveSchema, ImplementationResolutionError, SchemaResolutionError, } from './config/schema-utils';
 export { resolvePrompt, PromptResolutionError, } from './command-line/migrate/prompt-files';
+export { checkFilesAreInputs, checkFilesAreOutputs, } from './hasher/check-task-files';
+export { getCatalogManager, getCatalogDependenciesFromPackageJson, } from './utils/catalog';
+export { acknowledgeBuildScripts } from './utils/acknowledge-build-scripts';

package/dist/src/devkit-internals.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PromptResolutionError = exports.resolvePrompt = exports.SchemaResolutionError = exports.ImplementationResolutionError = exports.resolveSchema = exports.resolveImplementation = exports.emitPluginWorkerLog = exports.safeWriteFileCache = exports.PluginCache = exports.handleImport = exports.signalToCode = exports.globalSpinner = exports.readYamlFile = exports.isUsingPrettierInTree = exports.isCI = exports.interpolate = exports.requireWithTsconfigFallback = exports.forceRegisterEsmLoader = exports.loadTsFile = exports.registerTsProject = exports.LoadedNxPlugin = exports.retrieveProjectConfigurations = exports.findProjectForPath = exports.createProjectRootMappings = exports.createProjectRootMappingsFromProjectConfigurations = exports.hashMultiGlobWithWorkspaceContext = exports.hashWithWorkspaceContext = exports.hashObject = exports.splitByColons = exports.installPackageToTmpAsync = exports.installPackageToTmp = exports.readModulePackageJson = exports.stripIndent = exports.sortObjectByKeys = exports.combineOptionsForExecutor = exports.splitTarget = exports.getIgnoreObjectForTree = exports.readTargetDefaultsForTarget = exports.findMatchingProjects = exports.findMatchingConfigFiles = exports.readProjectConfigurationsFromRootMap = exports.mergeTargetConfigurations = exports.retrieveProjectConfigurationsWithAngularProjects = exports.calculateDefaultProjectName = exports.readNxJsonFromDisk = exports.parseExecutor = exports.getExecutorInformation = exports.createTempNpmDirectory = void 0;
+exports.checkFilesAreOutputs = exports.checkFilesAreInputs = exports.PromptResolutionError = exports.resolvePrompt = exports.SchemaResolutionError = exports.ImplementationResolutionError = exports.resolveSchema = exports.resolveImplementation = exports.emitPluginWorkerLog = exports.safeWriteFileCache = exports.PluginCache = exports.handleImport = exports.signalToCode = exports.globalSpinner = exports.readYamlFile = exports.isUsingPrettierInTree = exports.isCI = exports.interpolate = exports.requireWithTsconfigFallback = exports.forceRegisterEsmLoader = exports.loadTsFile = exports.registerTsProject = exports.LoadedNxPlugin = exports.retrieveProjectConfigurations = exports.findProjectForPath = exports.createProjectRootMappings = exports.createProjectRootMappingsFromProjectConfigurations = exports.hashMultiGlobWithWorkspaceContext = exports.hashWithWorkspaceContext = exports.hashObject = exports.splitByColons = exports.installPackageToTmpAsync = exports.installPackageToTmp = exports.readModulePackageJson = exports.stripIndent = exports.sortObjectByKeys = exports.combineOptionsForExecutor = exports.splitTarget = exports.getIgnoreObjectForTree = exports.readTargetDefaultsForTarget = exports.findMatchingProjects = exports.findMatchingConfigFiles = exports.readProjectConfigurationsFromRootMap = exports.mergeTargetConfigurations = exports.retrieveProjectConfigurationsWithAngularProjects = exports.calculateDefaultProjectName = exports.readNxJsonFromDisk = exports.parseExecutor = exports.getExecutorInformation = exports.createTempNpmDirectory = void 0;
+exports.acknowledgeBuildScripts = exports.getCatalogDependenciesFromPackageJson = exports.getCatalogManager = void 0;
 const tslib_1 = require("tslib");
 /**
  * Note to developers: STOP! These exports are available via requireNx in @nx/devkit.
@@ -90,3 +91,11 @@ Object.defineProperty(exports, "SchemaResolutionError", { enumerable: true, get:
 var prompt_files_1 = require("./command-line/migrate/prompt-files");
 Object.defineProperty(exports, "resolvePrompt", { enumerable: true, get: function () { return prompt_files_1.resolvePrompt; } });
 Object.defineProperty(exports, "PromptResolutionError", { enumerable: true, get: function () { return prompt_files_1.PromptResolutionError; } });
+var check_task_files_1 = require("./hasher/check-task-files");
+Object.defineProperty(exports, "checkFilesAreInputs", { enumerable: true, get: function () { return check_task_files_1.checkFilesAreInputs; } });
+Object.defineProperty(exports, "checkFilesAreOutputs", { enumerable: true, get: function () { return check_task_files_1.checkFilesAreOutputs; } });
+var catalog_1 = require("./utils/catalog");
+Object.defineProperty(exports, "getCatalogManager", { enumerable: true, get: function () { return catalog_1.getCatalogManager; } });
+Object.defineProperty(exports, "getCatalogDependenciesFromPackageJson", { enumerable: true, get: function () { return catalog_1.getCatalogDependenciesFromPackageJson; } });
+var acknowledge_build_scripts_1 = require("./utils/acknowledge-build-scripts");
+Object.defineProperty(exports, "acknowledgeBuildScripts", { enumerable: true, get: function () { return acknowledge_build_scripts_1.acknowledgeBuildScripts; } });

package/dist/src/generators/utils/nx-json.js

@@ -42,9 +42,19 @@ function updateNxJson(tree, nxJson) {
 }
 function readNxJsonExtends(tree, extendsPath) {
     try {
-        return (0, json_1.readJson)(tree, (0, path_1.relative)(tree.root, require.resolve(extendsPath, {
-            paths: [tree.root],
-        })));
+        let resolvedExtendsPath;
+        try {
+            resolvedExtendsPath = require.resolve(extendsPath, {
+                paths: [tree.root],
+            });
+        }
+        catch {
+            // Tree roots without a node_modules folder (e.g. the in-memory trees
+            // used in tests) can't anchor module resolution; fall back to
+            // resolving from the running nx package.
+            resolvedExtendsPath = require.resolve(extendsPath);
+        }
+        return (0, json_1.readJson)(tree, (0, path_1.relative)(tree.root, resolvedExtendsPath));
     }
     catch (e) {
         throw new Error(`Unable to resolve nx.json extends. Error: ${e.message}`);

package/dist/src/hasher/check-task-files.d.ts

@@ -0,0 +1,86 @@
+import { type NxJsonConfiguration } from '../config/nx-json';
+import type { ProjectGraph } from '../config/project-graph';
+import type { HashInputs } from '../native';
+/**
+ * A project graph the caller has already built. `nx show target` resolves one to
+ * find the target in the first place, and `createProjectGraphAsync` is not
+ * memoized, so without this the CLI would build the graph a second time.
+ */
+export interface TaskFileCheckSeed {
+    projectGraph: ProjectGraph;
+    nxJson: NxJsonConfiguration;
+}
+/** The rule that made a value an input for a task. */
+export type InputCategory = 'files' | 'depOutputs' | 'dependentTasksOutputFiles' | 'runtime' | 'environment' | 'external';
+export interface InputCandidate {
+    /** The value as supplied — matched verbatim against environment/runtime/external. */
+    value: string;
+    /** Workspace-relative path form of `value` — matched against the path categories. */
+    path: string;
+}
+/**
+ * Check which values are legitimate inputs for the given task. A value matches
+ * when it is:
+ *   - a declared environment variable, runtime input, or external dependency;
+ *   - a file in the task's declared input file list;
+ *   - a file in the task's materialized `depOutputs` (upstream has run);
+ *   - a file matching a `dependentTasksOutputFiles` glob declared on the task
+ *     that lies inside the declared outputs of an upstream task in the task
+ *     graph (static — works even when upstream tasks have not yet run).
+ *
+ * `categories` records the rule each matched value satisfied. Paths may be
+ * workspace-relative or absolute; absolute ones are relativized against the
+ * workspace root, and a path outside the workspace simply matches nothing. A
+ * caller resolving paths against a cwd passes an {@link InputCandidate} so that
+ * names are still matched verbatim.
+ */
+export declare function checkFilesAreInputs(taskId: string, files: Array<string | InputCandidate>): Promise<{
+    matched: string[];
+    unmatched: string[];
+    categories: Map<string, InputCategory>;
+}>;
+/**
+ * Check which files match the output globs declared for the given task.
+ * Uses the same path-matching logic as the task runner (directory containment
+ * + glob matching through the native `globset` engine), including negated
+ * (`!`-prefixed) patterns acting as exclusions over the whole pattern set.
+ *
+ * Paths may be workspace-relative or absolute; absolute ones are relativized
+ * against the workspace root. An output pattern whose `{options.*}` token has no
+ * value resolves to nothing — exactly as the task runner drops it — so a file it
+ * would have covered is reported `unmatched`, like any other non-output.
+ *
+ * That last case makes `unmatched` two answers in one: "not an output" and
+ * "the outputs could not be determined". A consumer judging sandbox violations
+ * cannot tell them apart, and would call the second one illegal. `getTaskOutputs`
+ * already computes the `unresolved` list this would need; surfacing it here is
+ * deliberately deferred until a consumer's contract asks for the distinction.
+ */
+export declare function checkFilesAreOutputs(taskId: string, files: string[]): Promise<{
+    matched: string[];
+    unmatched: string[];
+}>;
+/**
+ * Returns the full hash inputs for a task (files + runtime + env + depOutputs
+ * + external). Used internally by the `nx show target --inputs` renderer.
+ */
+export declare function getTaskRawInputs(taskId: string, seed?: TaskFileCheckSeed): Promise<HashInputs | null>;
+export interface TaskOutputs {
+    /** Output patterns after token substitution — what the task runner will cache. */
+    resolved: string[];
+    /** `resolved`, expanded against the files currently on disk. */
+    expanded: string[];
+    /** Configured outputs left out of `resolved` because an option had no value. */
+    unresolved: string[];
+}
+/**
+ * Returns the outputs declared for a task, resolved against its effective
+ * configuration. Used internally by the `nx show target --outputs` renderer.
+ */
+export declare function getTaskOutputs(taskId: string, seed?: TaskFileCheckSeed): Promise<TaskOutputs>;
+/**
+ * Resets all module-level caches. Call this in `beforeEach` when testing so
+ * each test gets a fresh context load. Not part of the public API.
+ * @internal
+ */
+export declare function _resetContextForTesting(): void;

package/dist/src/hasher/check-task-files.js

@@ -0,0 +1,378 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkFilesAreInputs = checkFilesAreInputs;
+exports.checkFilesAreOutputs = checkFilesAreOutputs;
+exports.getTaskRawInputs = getTaskRawInputs;
+exports.getTaskOutputs = getTaskOutputs;
+exports._resetContextForTesting = _resetContextForTesting;
+const path_1 = require("path");
+const nx_json_1 = require("../config/nx-json");
+const native_1 = require("../native");
+const project_graph_1 = require("../project-graph/project-graph");
+const create_task_graph_1 = require("../tasks-runner/create-task-graph");
+const utils_1 = require("../tasks-runner/utils");
+const path_2 = require("../utils/path");
+const project_graph_utils_1 = require("../utils/project-graph-utils");
+const split_target_1 = require("../utils/split-target");
+const workspace_root_1 = require("../utils/workspace-root");
+const hash_plan_inspector_1 = require("./hash-plan-inspector");
+const task_hasher_1 = require("./task-hasher");
+let cachedContext = null;
+function getContext(seed) {
+    // Only a fulfilled context is cached — caching a rejected promise would
+    // poison the resolver for the rest of the process after one transient failure.
+    return (cachedContext ??= loadContext(seed).catch((e) => {
+        cachedContext = null;
+        throw e;
+    }));
+}
+async function loadContext(seed) {
+    const projectGraph = seed?.projectGraph ?? (await (0, project_graph_1.createProjectGraphAsync)());
+    const nxJson = seed?.nxJson ?? (0, nx_json_1.readNxJson)(workspace_root_1.workspaceRoot) ?? {};
+    let inspector = null;
+    const getInspector = () => 
+    // As with the context itself, a rejection is not cached.
+    (inspector ??= initInspector(projectGraph, nxJson).catch((e) => {
+        inspector = null;
+        throw e;
+    }));
+    return { projectGraph, nxJson, getInspector };
+}
+async function initInspector(projectGraph, nxJson) {
+    const inspector = new hash_plan_inspector_1.HashPlanInspector(projectGraph, workspace_root_1.workspaceRoot, nxJson);
+    await inspector.init();
+    return inspector;
+}
+const identityCache = new Map();
+const hashInputsCache = new Map();
+const outputsCache = new Map();
+const taskGraphCache = new Map();
+const depsOutputsCache = new Map();
+// ── Internal resolution helpers ──────────────────────────────────────────────
+function resolveIdentity(taskId, projectGraph) {
+    const cached = identityCache.get(taskId);
+    if (cached)
+        return cached;
+    const [project, target, configuration] = (0, split_target_1.splitTarget)(taskId, projectGraph);
+    if (!project || !target) {
+        throw new Error(`Invalid taskId "${taskId}" — expected "project:target[:configuration]"`);
+    }
+    const projectNode = projectGraph.nodes[project];
+    if (!projectNode) {
+        throw new Error(`Invalid taskId "${taskId}" — project "${project}" does not exist in the project graph.`);
+    }
+    const targetConfig = projectNode.data?.targets?.[target];
+    if (!targetConfig) {
+        throw new Error(`Invalid taskId "${taskId}" — project "${project}" has no target "${target}".`);
+    }
+    // Substituting defaultConfiguration for a configuration that does not exist
+    // would answer confidently about a *different* task — and configurations
+    // routinely change `outputPath`, so the answer could be wrong in either
+    // direction. `nx run` errors here; so do we.
+    if (configuration &&
+        !(0, project_graph_utils_1.projectHasTargetAndConfiguration)(projectNode, target, configuration)) {
+        const available = Object.keys(targetConfig.configurations ?? {});
+        throw new Error(`Invalid taskId "${taskId}" — target "${target}" of project "${project}" has no configuration "${configuration}".` +
+            (available.length
+                ? ` Available configurations: ${available.join(', ')}.`
+                : ' It has no configurations.'));
+    }
+    const effectiveConfiguration = configuration ?? targetConfig.defaultConfiguration;
+    const identity = {
+        project,
+        target,
+        configuration: effectiveConfiguration,
+        canonicalTaskId: (0, utils_1.createTaskId)(project, target, effectiveConfiguration),
+        projectNode,
+    };
+    identityCache.set(taskId, identity);
+    return identity;
+}
+async function getRawInputs(taskId, { projectGraph, getInspector }) {
+    if (hashInputsCache.has(taskId)) {
+        return hashInputsCache.get(taskId) ?? null;
+    }
+    const { project, target, configuration, canonicalTaskId } = resolveIdentity(taskId, projectGraph);
+    const inspector = await getInspector();
+    // `null` means "this task is absent from the hash plan" — any other failure
+    // is a real error and propagates to the caller.
+    const planResult = inspector.inspectTaskInputs({
+        project,
+        target,
+        configuration,
+    });
+    const result = planResult[canonicalTaskId] ?? null;
+    hashInputsCache.set(taskId, result);
+    return result;
+}
+function getOutputs(taskId, projectGraph) {
+    const cached = outputsCache.get(taskId);
+    if (cached !== undefined)
+        return cached;
+    const { project, target, configuration, projectNode } = resolveIdentity(taskId, projectGraph);
+    const outputs = (0, utils_1.getOutputsForTargetAndConfiguration)({ project, target, configuration }, {}, projectNode).map(path_2.normalizePath);
+    outputsCache.set(taskId, outputs);
+    return outputs;
+}
+/**
+ * Configured outputs that `getOutputsForTargetAndConfiguration` dropped because
+ * an `{options.x}` token had no value to interpolate. The resolver discards them
+ * silently, so they have to be recovered from the target configuration.
+ */
+function getUnresolvedOutputs(taskId, projectGraph) {
+    const { target, configuration, projectNode } = resolveIdentity(taskId, projectGraph);
+    const targetConfig = projectNode.data.targets[target];
+    const options = {
+        ...targetConfig.options,
+        ...(configuration
+            ? targetConfig.configurations?.[configuration]
+            : undefined),
+    };
+    return (targetConfig.outputs ?? []).filter((output) => [...output.matchAll(/\{options\.([^}]+)\}/g)].some(([, key]) => {
+        const value = key.split('.').reduce((acc, k) => acc?.[k], options);
+        return value === undefined;
+    }));
+}
+function getTaskGraph(taskId, projectGraph) {
+    const cached = taskGraphCache.get(taskId);
+    if (cached)
+        return cached;
+    const { project, target, configuration } = resolveIdentity(taskId, projectGraph);
+    const taskGraph = (0, create_task_graph_1.createTaskGraph)(projectGraph, {}, [project], [target], configuration, {}, false);
+    taskGraphCache.set(taskId, taskGraph);
+    return taskGraph;
+}
+function getDepsOutputs(taskId, { projectGraph, nxJson }) {
+    if (depsOutputsCache.has(taskId))
+        return depsOutputsCache.get(taskId);
+    const { project, target } = resolveIdentity(taskId, projectGraph);
+    const result = (0, task_hasher_1.getInputs)({ target: { project, target } }, projectGraph, nxJson)
+        .depsOutputs ?? [];
+    depsOutputsCache.set(taskId, result);
+    return result;
+}
+function collectUpstreamTaskIds(taskGraph, rootTaskId, transitive) {
+    const direct = taskGraph.dependencies[rootTaskId] ?? [];
+    if (!transitive)
+        return [...direct];
+    const collected = new Set();
+    const walk = (id) => {
+        for (const dep of taskGraph.dependencies[id] ?? []) {
+            if (collected.has(dep))
+                continue;
+            collected.add(dep);
+            walk(dep);
+        }
+    };
+    walk(rootTaskId);
+    return [...collected];
+}
+/**
+ * Matches a single path against a task's whole output pattern list using the
+ * native glob engine (`globset`) that the task runner's expand_outputs also
+ * builds on: non-glob patterns match themselves and anything nested under them,
+ * and negated (`!`-prefixed) patterns act as exclusions over the full set.
+ */
+function isOutput(taskId, path, projectGraph) {
+    const patterns = getOutputs(taskId, projectGraph);
+    return (0, native_1.matchOutputPaths)(patterns, [(0, path_2.normalizePath)(path)])[0];
+}
+function matchesDependentTaskOutputs(taskId, path, ctx) {
+    const normalized = (0, path_2.normalizePath)(path);
+    const depsOutputs = getDepsOutputs(taskId, ctx);
+    if (depsOutputs.length === 0)
+        return false;
+    const taskGraph = getTaskGraph(taskId, ctx.projectGraph);
+    const { canonicalTaskId } = resolveIdentity(taskId, ctx.projectGraph);
+    if (!taskGraph.tasks[canonicalTaskId])
+        return false;
+    for (const { dependentTasksOutputFiles, transitive } of depsOutputs) {
+        const glob = (0, path_2.normalizePath)(dependentTasksOutputFiles);
+        if (!(0, native_1.matchGlobPaths)([glob], [normalized])[0])
+            continue;
+        const upstreamIds = collectUpstreamTaskIds(taskGraph, canonicalTaskId, !!transitive);
+        for (const upstreamId of upstreamIds) {
+            if (isOutput(upstreamId, normalized, ctx.projectGraph))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Coerces a caller-supplied path to the workspace-relative, forward-slashed
+ * form the hash plan and output patterns are expressed in. A path outside the
+ * workspace stays outside (`../…`) and simply matches nothing — it cannot be a
+ * declared input or output, so "unmatched" is the true answer rather than an
+ * error.
+ */
+function toWorkspaceRelativePath(candidatePath) {
+    // Backslash separators must be split *before* anchoring: on POSIX a backslash
+    // is an ordinary filename character, so `dep\..\..` would ride through
+    // join/relative as one opaque segment and only become a live `..` traversal
+    // after the swap. Swapped directly rather than via normalizePath, which also
+    // strips a Windows drive letter: isAbsolute accepts the drive-less form too,
+    // but relative() then resolves it against the cwd's drive, so a path on
+    // another drive (`D:\…`) could be relativized to *inside* the workspace — a
+    // Windows-only fail-open no POSIX test can catch.
+    const forwardSlashed = candidatePath.replace(/\\/g, '/');
+    // Anchoring a relative path to the workspace root before relativizing it back
+    // resolves any `..` segments. Left in, they would traverse *through* a pattern
+    // that globset had already matched — `dist/libs/dep/../../../secrets.env`
+    // matching an output of `dist/libs/dep`.
+    const absolute = (0, path_1.isAbsolute)(forwardSlashed)
+        ? forwardSlashed
+        : (0, path_1.join)(workspace_root_1.workspaceRoot, forwardSlashed);
+    return (0, path_2.normalizePath)((0, path_1.relative)(workspace_root_1.workspaceRoot, absolute));
+}
+/**
+ * The task's hash inputs, or an error. A task missing from its own hash plan is
+ * a failure to *determine* the inputs — reporting every file as unmatched would
+ * tell a sandbox-violation consumer that all of them are illegal.
+ */
+async function requireRawInputs(taskId, ctx) {
+    const raw = await getRawInputs(taskId, ctx);
+    if (!raw) {
+        throw new Error(`Could not determine the inputs of task "${taskId}" — it is not present in its own hash plan.`);
+    }
+    return raw;
+}
+function classifyInput(taskId, candidate, raw, ctx) {
+    // `environment`, `runtime` and `external` hold names rather than paths, so
+    // they are matched against the value exactly as the caller supplied it.
+    if (raw.environment.includes(candidate.value))
+        return 'environment';
+    if (raw.runtime.includes(candidate.value))
+        return 'runtime';
+    if (raw.external.includes(candidate.value))
+        return 'external';
+    const path = toWorkspaceRelativePath(candidate.path);
+    if (raw.files.includes(path))
+        return 'files';
+    if (raw.depOutputs.includes(path))
+        return 'depOutputs';
+    return matchesDependentTaskOutputs(taskId, path, ctx)
+        ? 'dependentTasksOutputFiles'
+        : null;
+}
+/**
+ * Check which values are legitimate inputs for the given task. A value matches
+ * when it is:
+ *   - a declared environment variable, runtime input, or external dependency;
+ *   - a file in the task's declared input file list;
+ *   - a file in the task's materialized `depOutputs` (upstream has run);
+ *   - a file matching a `dependentTasksOutputFiles` glob declared on the task
+ *     that lies inside the declared outputs of an upstream task in the task
+ *     graph (static — works even when upstream tasks have not yet run).
+ *
+ * `categories` records the rule each matched value satisfied. Paths may be
+ * workspace-relative or absolute; absolute ones are relativized against the
+ * workspace root, and a path outside the workspace simply matches nothing. A
+ * caller resolving paths against a cwd passes an {@link InputCandidate} so that
+ * names are still matched verbatim.
+ */
+async function checkFilesAreInputs(taskId, files) {
+    const ctx = await getContext();
+    // Resolve the task and its hash plan eagerly, so an unknown task or an
+    // undeterminable plan errors even when the file list is empty — rather than
+    // being reported as "none of these files are inputs".
+    resolveIdentity(taskId, ctx.projectGraph);
+    const raw = await requireRawInputs(taskId, ctx);
+    const matched = [];
+    const unmatched = [];
+    const categories = new Map();
+    // Results are keyed by value, so a value given two path forms could land in
+    // both matched and unmatched at once. Exact duplicates are collapsed instead.
+    const seenPaths = new Map();
+    for (const file of files) {
+        const candidate = typeof file === 'string' ? { value: file, path: file } : file;
+        const seenPath = seenPaths.get(candidate.value);
+        if (seenPath !== undefined) {
+            if (seenPath !== candidate.path) {
+                throw new Error(`Value "${candidate.value}" was given conflicting path forms "${seenPath}" and "${candidate.path}".`);
+            }
+            continue;
+        }
+        seenPaths.set(candidate.value, candidate.path);
+        const category = classifyInput(taskId, candidate, raw, ctx);
+        if (category) {
+            matched.push(candidate.value);
+            categories.set(candidate.value, category);
+        }
+        else {
+            unmatched.push(candidate.value);
+        }
+    }
+    return { matched, unmatched, categories };
+}
+/**
+ * Check which files match the output globs declared for the given task.
+ * Uses the same path-matching logic as the task runner (directory containment
+ * + glob matching through the native `globset` engine), including negated
+ * (`!`-prefixed) patterns acting as exclusions over the whole pattern set.
+ *
+ * Paths may be workspace-relative or absolute; absolute ones are relativized
+ * against the workspace root. An output pattern whose `{options.*}` token has no
+ * value resolves to nothing — exactly as the task runner drops it — so a file it
+ * would have covered is reported `unmatched`, like any other non-output.
+ *
+ * That last case makes `unmatched` two answers in one: "not an output" and
+ * "the outputs could not be determined". A consumer judging sandbox violations
+ * cannot tell them apart, and would call the second one illegal. `getTaskOutputs`
+ * already computes the `unresolved` list this would need; surfacing it here is
+ * deliberately deferred until a consumer's contract asks for the distinction.
+ */
+async function checkFilesAreOutputs(taskId, files) {
+    const ctx = await getContext();
+    // Validate taskId eagerly so callers always get an error for an unknown or
+    // malformed task, even when the file list is empty.
+    resolveIdentity(taskId, ctx.projectGraph);
+    const patterns = getOutputs(taskId, ctx.projectGraph);
+    const results = (0, native_1.matchOutputPaths)(patterns, files.map(toWorkspaceRelativePath));
+    const matched = [];
+    const unmatched = [];
+    files.forEach((file, i) => {
+        if (results[i]) {
+            matched.push(file);
+        }
+        else {
+            unmatched.push(file);
+        }
+    });
+    return { matched, unmatched };
+}
+// ── Renderer helpers (used by `nx show target`) ──────────────────────────────
+/**
+ * Returns the full hash inputs for a task (files + runtime + env + depOutputs
+ * + external). Used internally by the `nx show target --inputs` renderer.
+ */
+async function getTaskRawInputs(taskId, seed) {
+    const ctx = await getContext(seed);
+    return getRawInputs(taskId, ctx);
+}
+/**
+ * Returns the outputs declared for a task, resolved against its effective
+ * configuration. Used internally by the `nx show target --outputs` renderer.
+ */
+async function getTaskOutputs(taskId, seed) {
+    const ctx = await getContext(seed);
+    const resolved = getOutputs(taskId, ctx.projectGraph);
+    return {
+        resolved,
+        expanded: (0, native_1.expandOutputs)(workspace_root_1.workspaceRoot, resolved),
+        unresolved: getUnresolvedOutputs(taskId, ctx.projectGraph),
+    };
+}
+// ── Test utilities ───────────────────────────────────────────────────────────
+/**
+ * Resets all module-level caches. Call this in `beforeEach` when testing so
+ * each test gets a fresh context load. Not part of the public API.
+ * @internal
+ */
+function _resetContextForTesting() {
+    cachedContext = null;
+    identityCache.clear();
+    hashInputsCache.clear();
+    outputsCache.clear();
+    taskGraphCache.clear();
+    depsOutputsCache.clear();
+}