nx 23.1.0 → 23.1.2

package/dist/src/utils/provenance.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProvenanceError = void 0;
 exports.ensurePackageHasProvenance = ensurePackageHasProvenance;
 exports.getNxPackageGroup = getNxPackageGroup;
-const child_process_1 = require("child_process");
 const module_1 = require("module");
 const fileutils_1 = require("./fileutils");
 const package_manager_1 = require("./package-manager");
@@ -21,9 +20,22 @@ async function ensurePackageHasProvenance(packageName, packageVersion) {
         return;
     }
     try {
-        const result = await (0, package_manager_1.packageRegistryView)(packageName, packageVersion, '--json --silent');
-        const npmViewResult = JSON.parse(result);
-        const attURL = npmViewResult.dist?.attestations?.url;
+        const result = await (0, package_manager_1.packageRegistryView)(packageName, packageVersion, [
+            '--json',
+            '--silent',
+        ]);
+        const parsed = JSON.parse(result);
+        // `npm view <pkg>@<spec> --json` returns a bare object on npm <= 11 but an
+        // array on npm 12 and pnpm, even for a single resolved version. A version
+        // range matches several versions and the registry lists all of them
+        // (including deprecated ones the installer skips), so we cannot tell which
+        // one will actually be installed; refuse rather than verify the wrong
+        // artifact.
+        if (Array.isArray(parsed) && parsed.length > 1) {
+            throw new ProvenanceError(packageName, packageVersion, 'Provenance can only be verified for a single version, but this version resolved to multiple candidates. Specify an exact version.');
+        }
+        const npmViewResult = Array.isArray(parsed) ? parsed[0] : parsed;
+        const attURL = npmViewResult?.dist?.attestations?.url;
         if (!attURL)
             throw new ProvenanceError(packageName, packageVersion, 'No attestation URL found');
         const response = await fetch(attURL);
@@ -67,19 +79,9 @@ class ProvenanceError extends Error {
     constructor(packageName, packageVersion, error) {
         let customRegistry = undefined;
         try {
-            const packageManager = (0, package_manager_1.detectPackageManager)();
-            const commands = (0, package_manager_1.getPackageManagerCommand)(packageManager);
-            // Try to get registry from current package manager, fall back to npm
-            const registryCommand = commands.getRegistryUrl ?? 'npm config get registry';
-            const registry = (0, child_process_1.execSync)(registryCommand, {
-                timeout: 5000,
-                windowsHide: true,
-                encoding: 'utf-8',
-            }).trim();
+            const registry = (0, package_manager_1.getWorkspaceRegistryUrlForDisplay)(packageName);
             // Only consider it custom if it's not the default npm registry
-            if (registry &&
-                registry !== 'undefined' &&
-                !registry.includes('registry.npmjs.org')) {
+            if (registry && !registry.includes('registry.npmjs.org')) {
                 customRegistry = registry;
             }
         }

package/dist/src/utils/registry-config/bun.d.ts

@@ -0,0 +1,2 @@
+import { type NpmConfigEnv } from './utils';
+export declare function getBunSpawnRegistryEnv(packageName: string, root: string, bunVersion: string | null): NpmConfigEnv;

package/dist/src/utils/registry-config/bun.js

@@ -0,0 +1,257 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBunSpawnRegistryEnv = getBunSpawnRegistryEnv;
+const path_1 = require("path");
+const semver_1 = require("semver");
+const bunfig_1 = require("../package-manager-config/bunfig");
+const npmrc_1 = require("../package-manager-config/npmrc");
+const utils_1 = require("./utils");
+/*
+ * bun registry resolution (verified on 1.2.23 and 1.3.14, gates bisected):
+ *
+ * CLI --registry > BUN_CONFIG_REGISTRY > NPM_CONFIG_REGISTRY >
+ * npm_config_registry > project .npmrc > global ($XDG_CONFIG_HOME else
+ * $HOME)/.npmrc > project bunfig.toml > global bunfig > registry.npmjs.org.
+ * .npmrc beats bunfig at every level, including scoped keys. Env registry
+ * values must start with http(s):// or they are ignored. .npmrc support
+ * exists from bun 1.1.18; [install].ca/cafile from 1.1.31. When
+ * XDG_CONFIG_HOME is set, bun reads $XDG_CONFIG_HOME/.npmrc INSTEAD of
+ * ~/.npmrc, which npm always reads.
+ * See https://github.com/oven-sh/bun/blob/bun-v1.2.23/src/install/PackageManager.zig#L791
+ *
+ * The final default/scoped registry is always injected: bun does not read
+ * npm-only surfaces (e.g. $PREFIX/etc/npmrc), so npm must not fall back to
+ * them.
+ */
+const BUN_DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
+function getBunSpawnRegistryEnv(packageName, root, bunVersion) {
+    const env = {};
+    const scope = (0, utils_1.getPackageScope)(packageName);
+    const npmrcSupported = !bunVersion || (0, semver_1.gte)(bunVersion, '1.1.18');
+    const tlsSupported = !bunVersion || (0, semver_1.gte)(bunVersion, '1.1.31');
+    const globalConfigBase = (0, bunfig_1.getBunGlobalConfigBase)(process.env);
+    const projectNpmrc = npmrcSupported
+        ? readBunNpmrcMap((0, path_1.join)(root, '.npmrc'))
+        : null;
+    const globalNpmrc = npmrcSupported && globalConfigBase
+        ? readBunNpmrcMap((0, path_1.join)(globalConfigBase, '.npmrc'))
+        : null;
+    const projectBunfig = readBunfigInstall((0, path_1.join)(root, 'bunfig.toml'));
+    const globalBunfig = globalConfigBase
+        ? readBunfigInstall((0, path_1.join)(globalConfigBase, '.bunfig.toml'))
+        : null;
+    // Swap npm's userconfig so the auth/TLS keys npm reads natively come from
+    // the same file bun would use.
+    if (npmrcSupported && process.env.XDG_CONFIG_HOME) {
+        env['npm_config_userconfig'] = (0, path_1.join)(process.env.XDG_CONFIG_HOME, '.npmrc');
+    }
+    const envRegistry = [
+        process.env.BUN_CONFIG_REGISTRY,
+        process.env.NPM_CONFIG_REGISTRY,
+        process.env.npm_config_registry,
+    ].find((value) => value && /^https?:\/\//.test(value));
+    // An .npmrc registry goes through both of bun's expansions: its ini reader
+    // resolves `${VAR}` anywhere in the value, and the scope it then builds
+    // resolves a whole-value `$VAR`. Without the second, `registry=$MY_REGISTRY`
+    // stays a literal npm rejects as an invalid URL.
+    const npmrcRegistryValue = (key) => {
+        const raw = projectNpmrc?.get(key) ?? globalNpmrc?.get(key);
+        return raw === undefined
+            ? undefined
+            : expandBunRegistryUrl((0, utils_1.expandEnvVars)(raw));
+    };
+    const bunfigValue = (read, fallbackUrl) => {
+        for (const install of [projectBunfig, globalBunfig]) {
+            if (!install) {
+                continue;
+            }
+            const value = read(install);
+            if (value !== undefined) {
+                return normalizeBunRegistryValue(value, fallbackUrl);
+            }
+        }
+        return undefined;
+    };
+    const npmrcRegistry = npmrcRegistryValue('registry');
+    const defaultPick = envRegistry
+        ? { url: envRegistry }
+        : npmrcRegistry
+            ? { url: npmrcRegistry }
+            : (bunfigValue((install) => install.registry, BUN_DEFAULT_REGISTRY) ?? {
+                url: BUN_DEFAULT_REGISTRY,
+            });
+    (0, utils_1.setRegistry)(env, defaultPick.url);
+    applyBunAuth(env, defaultPick);
+    if (scope) {
+        const npmrcScoped = npmrcRegistryValue(`${scope}:registry`);
+        // [install.scopes] keys are accepted with or without the leading @.
+        const scopedPick = npmrcScoped
+            ? { url: npmrcScoped }
+            : (bunfigValue((install) => install.scopes?.[scope] ?? install.scopes?.[scope.slice(1)], 
+            // A scope entry that declares only credentials keeps the default
+            // registry as its url, so its token still reaches the right host.
+            defaultPick.url) ?? defaultPick);
+        (0, utils_1.setScopedRegistry)(env, scope, scopedPick.url);
+        if (scopedPick !== defaultPick) {
+            applyBunAuth(env, scopedPick);
+        }
+    }
+    if (tlsSupported) {
+        // .npmrc TLS keys beat bunfig's; npm reads the npmrc family natively.
+        const npmrcHasTls = projectNpmrc?.has('cafile') ||
+            projectNpmrc?.has('ca') ||
+            globalNpmrc?.has('cafile') ||
+            globalNpmrc?.has('ca');
+        if (!npmrcHasTls) {
+            const cafile = projectBunfig?.cafile ?? globalBunfig?.cafile;
+            if (cafile) {
+                // bun resolves cafile relative to the project dir.
+                (0, utils_1.setCafile)(env, (0, path_1.resolve)(root, cafile));
+            }
+            else {
+                const ca = projectBunfig?.ca ?? globalBunfig?.ca;
+                if (ca) {
+                    // npm reconstructs a config array from the env by splitting the
+                    // value on a blank line.
+                    env['npm_config_ca'] = Array.isArray(ca) ? ca.join('\n\n') : ca;
+                }
+            }
+        }
+    }
+    return env;
+}
+// bun silently resolves as though an .npmrc it cannot read were absent
+// (verified on 1.3.13, EACCES and EISDIR both), so collapse that state the
+// same way rather than warning or aborting.
+function readBunNpmrcMap(path) {
+    const map = (0, npmrc_1.readNpmrcMap)(path);
+    return map === 'unreadable' ? null : map;
+}
+function normalizeBunRegistryValue(value, fallbackUrl) {
+    if (typeof value !== 'string') {
+        const result = {
+            url: value.url ? expandBunRegistryUrl(value.url) : fallbackUrl,
+        };
+        for (const field of ['token', 'username', 'password']) {
+            const expanded = expandBunAuthValue(value[field]);
+            if (expanded !== undefined) {
+                result[field] = expanded;
+            }
+        }
+        return result;
+    }
+    const expanded = expandBunRegistryUrl(value);
+    try {
+        const url = new URL(expanded);
+        if (url.username || url.password) {
+            // bun treats a username with no password as no credentials at all.
+            const credentials = url.username && url.password
+                ? { username: url.username, password: url.password }
+                : url.password
+                    ? // `https://:token@host/` carries a token as the bare password.
+                        { token: url.password }
+                    : {};
+            url.username = '';
+            url.password = '';
+            return { url: url.toString(), ...credentials };
+        }
+    }
+    catch { }
+    return { url: expanded };
+}
+// bun expands a whole-value `$VARNAME` (no braces) in bunfig credential fields
+// via env.getAuto; an unset var keeps the literal, and `${VAR}` is expanded
+// only in its .npmrc.
+function expandBunAuthValue(value) {
+    if (value === undefined || value.length < 2 || value[0] !== '$') {
+        return value;
+    }
+    return process.env[value.slice(1)] ?? value;
+}
+// Bun expands a `$`-prefixed bunfig registry URL (Scope.fromAPI): it looks up
+// the name with surrounding slashes trimmed and uses it only when the result is
+// longer than one character, else keeps the literal.
+function expandBunRegistryUrl(value) {
+    if (!value || value[0] !== '$') {
+        return value;
+    }
+    const name = value.slice(1).replace(/^\/+|\/+$/g, '');
+    const replaced = process.env[name];
+    return replaced && replaced.length > 1 ? replaced : value;
+}
+function applyBunAuth(env, value) {
+    if (value.token) {
+        (0, utils_1.setAuthToken)(env, value.url, value.token);
+    }
+    else if (value.username && value.password) {
+        const dart = (0, utils_1.requestNerfDart)(value.url);
+        if (dart) {
+            env[`npm_config_${dart}:username`] = value.username;
+            // npm expects _password base64-encoded.
+            env[`npm_config_${dart}:_password`] = Buffer.from(value.password).toString('base64');
+        }
+    }
+}
+function readBunfigInstall(path) {
+    const parsed = (0, bunfig_1.readBunfigRaw)(path);
+    if (parsed === null || parsed === 'unreadable') {
+        return null;
+    }
+    if (parsed === 'invalid') {
+        // The throw reaches the caller's fall-open. Skipping the file instead would
+        // pin npm to the default registry as though the workspace configured none,
+        // overriding a registry npm resolves from a file of its own.
+        throw new Error(`The bunfig at ${path} could not be parsed.`);
+    }
+    const install = parsed.install;
+    if (!install || typeof install !== 'object' || Array.isArray(install)) {
+        return null;
+    }
+    validateBunfigInstall(install, path);
+    return install;
+}
+/**
+ * bun type-checks the [install] table before it resolves anything and aborts on
+ * a value of the wrong shape. Reproduce that rather than carrying a number into
+ * a URL parse or a path join, where it would throw somewhere unrelated or
+ * bridge a value bun never accepted.
+ */
+function validateBunfigInstall(install, path) {
+    const fail = (what) => {
+        throw new Error(`The bunfig at ${path} declares ${what}.`);
+    };
+    if (install.registry !== undefined) {
+        validateBunRegistryValue(install.registry, 'install.registry', fail);
+    }
+    if (install.scopes !== undefined) {
+        if (typeof install.scopes !== 'object' || Array.isArray(install.scopes)) {
+            fail('an install.scopes that is not a table');
+        }
+        for (const [key, value] of Object.entries(install.scopes)) {
+            validateBunRegistryValue(value, `install.scopes["${key}"]`, fail);
+        }
+    }
+    if (install.cafile !== undefined && typeof install.cafile !== 'string') {
+        fail('an install.cafile that is not a string');
+    }
+    if (install.ca !== undefined &&
+        typeof install.ca !== 'string' &&
+        !(Array.isArray(install.ca) &&
+            install.ca.every((entry) => typeof entry === 'string'))) {
+        fail('an install.ca that is neither a string nor an array of strings');
+    }
+}
+function validateBunRegistryValue(value, setting, fail) {
+    if (typeof value === 'string') {
+        return;
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        fail(`a ${setting} that is neither a URL string nor a table`);
+    }
+    for (const field of ['url', 'token', 'username', 'password']) {
+        const field_ = value[field];
+        if (field_ !== undefined && typeof field_ !== 'string') {
+            fail(`a ${setting}.${field} that is not a string`);
+        }
+    }
+}

package/dist/src/utils/registry-config/index.d.ts

@@ -0,0 +1,13 @@
+import { type NpmConfigEnv } from './utils';
+import type { PackageManager } from '../package-manager';
+export type { NpmConfigEnv } from './utils';
+export { getPackageScope, mergeNpmConfigEnv, ignoresNpmConfigEnv, } from './utils';
+/**
+ * Computes the npm_config_* environment entries a spawned `npm view`/`npm pack`
+ * (or a pre-v11 `pnpm view`, which passes through to npm) needs so its registry,
+ * auth and TLS resolution reproduces what the workspace's package manager would
+ * do for `packageName`. Returns an empty object when nothing needs bridging (npm
+ * workspaces, or config npm already resolves identically on its own) and when
+ * resolution fails, which is warned about rather than thrown.
+ */
+export declare function getNpmSpawnRegistryEnv(packageName: string, root: string, packageManager: PackageManager, packageManagerVersion: string | null): NpmConfigEnv;

package/dist/src/utils/registry-config/index.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ignoresNpmConfigEnv = exports.mergeNpmConfigEnv = exports.getPackageScope = void 0;
+exports.getNpmSpawnRegistryEnv = getNpmSpawnRegistryEnv;
+const semver_1 = require("semver");
+const logger_1 = require("../logger");
+const bun_1 = require("./bun");
+const pnpm_1 = require("./pnpm");
+const yarn_berry_1 = require("./yarn-berry");
+const yarn_classic_1 = require("./yarn-classic");
+const utils_1 = require("./utils");
+var utils_2 = require("./utils");
+Object.defineProperty(exports, "getPackageScope", { enumerable: true, get: function () { return utils_2.getPackageScope; } });
+Object.defineProperty(exports, "mergeNpmConfigEnv", { enumerable: true, get: function () { return utils_2.mergeNpmConfigEnv; } });
+Object.defineProperty(exports, "ignoresNpmConfigEnv", { enumerable: true, get: function () { return utils_2.ignoresNpmConfigEnv; } });
+/**
+ * Computes the npm_config_* environment entries a spawned `npm view`/`npm pack`
+ * (or a pre-v11 `pnpm view`, which passes through to npm) needs so its registry,
+ * auth and TLS resolution reproduces what the workspace's package manager would
+ * do for `packageName`. Returns an empty object when nothing needs bridging (npm
+ * workspaces, or config npm already resolves identically on its own) and when
+ * resolution fails, which is warned about rather than thrown.
+ */
+function getNpmSpawnRegistryEnv(packageName, root, packageManager, packageManagerVersion) {
+    try {
+        const env = resolveSpawnRegistryEnv(packageName, root, packageManager, packageManagerVersion);
+        reconcileScopedRegistryKey(env, packageName);
+        return env;
+    }
+    catch (e) {
+        // The warning omits the cause because an rc parse error quotes the lines
+        // around the fault, which in these files is credential material.
+        warnUnresolvedConfig(packageManager);
+        logger_1.logger.verbose(`Failed to resolve the ${packageManager} registry configuration; falling back to npm's own resolution.`, e);
+        return {};
+    }
+}
+function resolveSpawnRegistryEnv(packageName, root, packageManager, packageManagerVersion) {
+    switch (packageManager) {
+        case 'npm':
+            // npm resolves its own config; the spawned npm IS the package manager.
+            return {};
+        case 'pnpm':
+            if (!packageManagerVersion) {
+                // Which surfaces pnpm honors depends on its version.
+                warnUnknownVersion('pnpm', 'a registry configured only in pnpm-workspace.yaml');
+                return {};
+            }
+            return (0, pnpm_1.getPnpmSpawnRegistryEnv)(packageName, root, packageManagerVersion);
+        case 'yarn':
+            if (!packageManagerVersion) {
+                // Without the version we cannot tell classic from berry.
+                warnUnknownVersion('yarn', 'a registry configured only in .yarnrc.yml');
+                return {};
+            }
+            return (0, semver_1.major)(packageManagerVersion) >= 2
+                ? (0, yarn_berry_1.getYarnBerrySpawnRegistryEnv)(packageName, root, packageManagerVersion)
+                : (0, yarn_classic_1.getYarnClassicSpawnRegistryEnv)(packageName, root);
+        case 'bun':
+            return (0, bun_1.getBunSpawnRegistryEnv)(packageName, root, packageManagerVersion);
+        default: {
+            // getNpmSpawnRegistryEnv catches this and falls open to no bridging.
+            const _exhaustive = packageManager;
+            throw new Error(`Unhandled package manager: ${_exhaustive}`);
+        }
+    }
+}
+// npm's loadEnv lowercases an env key and rewrites its non-leading `_` to `-`,
+// but looks @scope:registry up verbatim, so a bridged override for such a scope
+// is never found. The command targets this package, so redirect the default.
+function reconcileScopedRegistryKey(env, packageName) {
+    const scope = (0, utils_1.getPackageScope)(packageName);
+    if (!scope) {
+        return;
+    }
+    const scopedRegistry = env[`npm_config_${scope}:registry`];
+    if (!scopedRegistry) {
+        return;
+    }
+    const key = `${scope}:registry`;
+    if ((0, utils_1.normalizeNpmConfigKey)(key) !== key) {
+        (0, utils_1.setRegistry)(env, scopedRegistry);
+    }
+}
+const warnedUnresolvedConfigs = new Set();
+// Reached by a failed read and equally by a malformed value the read returned,
+// so the wording stays on resolution rather than naming a file.
+function warnUnresolvedConfig(packageManager) {
+    if (warnedUnresolvedConfigs.has(packageManager)) {
+        return;
+    }
+    warnedUnresolvedConfigs.add(packageManager);
+    logger_1.logger.warn(`Could not resolve the ${packageManager} configuration; packages will be fetched using npm's own registry resolution, which may differ from ${packageManager}'s. Run with NX_VERBOSE_LOGGING=true for the cause.`);
+}
+const warnedUnknownVersions = new Set();
+function warnUnknownVersion(packageManager, example) {
+    if (warnedUnknownVersions.has(packageManager)) {
+        return;
+    }
+    warnedUnknownVersions.add(packageManager);
+    logger_1.logger.warn(`Could not determine the ${packageManager} version; skipping ${packageManager} registry configuration when fetching packages. They will be fetched using npm's own registry resolution, which may differ from ${packageManager}'s (for example, ${example}).`);
+}

package/dist/src/utils/registry-config/pnpm.d.ts

@@ -0,0 +1,2 @@
+import { type NpmConfigEnv } from './utils';
+export declare function getPnpmSpawnRegistryEnv(packageName: string, root: string, pnpmVersion: string | null): NpmConfigEnv;