nx 23.1.1 → 23.1.2

package/dist/src/utils/package-manager-config/npmrc.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readNpmrcEntries = readNpmrcEntries;
+exports.parseNpmrcContent = parseNpmrcContent;
+exports.readNpmrcMap = readNpmrcMap;
+exports.npmrcEntriesToMap = npmrcEntriesToMap;
+const fs_1 = require("fs");
+/**
+ * Parses an .npmrc file into its `key = value` entries the way npm/yarn/pnpm do
+ * (via the `ini` package). Returns null when the file is missing, and
+ * 'unreadable' when it exists but cannot be read (permissions, a directory):
+ * package managers diverge on that state, so each caller decides whether to
+ * skip, warn, or abort rather than having it collapsed into "absent" here.
+ */
+function readNpmrcEntries(path) {
+    let raw;
+    try {
+        raw = (0, fs_1.readFileSync)(path, 'utf-8');
+    }
+    catch (e) {
+        // ENOTDIR (a path through a non-directory) is another shape of absent, not an
+        // unreadable file.
+        return e?.code === 'ENOENT' || e?.code === 'ENOTDIR' ? null : 'unreadable';
+    }
+    return parseNpmrcContent(raw);
+}
+function parseNpmrcContent(raw) {
+    const entries = [];
+    // ini breaks lines on any run of CR/LF, so splitting on `\r?\n` here would
+    // hide everything after a bare CR that npm still reads.
+    for (const line of raw.split(/[\r\n]+/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';')) {
+            continue;
+        }
+        // ini matches the header on the raw line, so an indented one stays a literal
+        // bare-flag key. Everything after a header nests under it, out of npm's flat
+        // lookup, so stop here.
+        if (/^\[[^\]]*\]\s*$/.test(line)) {
+            break;
+        }
+        // ini reads a valueless line as the flag `true`; dropping it would lose a bare
+        // `always-auth`/`strict-ssl` and flip the credential/TLS decision built on it.
+        const eq = trimmed.indexOf('=');
+        const rawKey = iniUnsafe(eq === -1 ? trimmed : trimmed.slice(0, eq));
+        const value = eq === -1 ? 'true' : iniUnsafe(trimmed.slice(eq + 1));
+        // ini enables bracketedArray by default, so a `key[]` suffix appends under the
+        // bare key instead of making a literal `key[]` entry.
+        if (rawKey.length > 2 && rawKey.endsWith('[]')) {
+            entries.push({ key: rawKey.slice(0, -2), value, array: true });
+        }
+        else {
+            entries.push({ key: rawKey, value });
+        }
+    }
+    return entries;
+}
+/**
+ * Reads an .npmrc-format file into a map with ini's semantics for repeated
+ * keys: scalars last-write-wins, `key[]` values joined. Null and 'unreadable'
+ * pass through from {@link readNpmrcEntries}.
+ */
+function readNpmrcMap(path) {
+    const entries = readNpmrcEntries(path);
+    return Array.isArray(entries) ? npmrcEntriesToMap(entries) : entries;
+}
+/** Those entries under ini's semantics for repeated keys. */
+function npmrcEntriesToMap(entries) {
+    const map = new Map();
+    for (const { key, value, array } of entries) {
+        // ini collects repeated `key[]` values into an array under the bare key, and
+        // npm rebuilds a config array from the env by splitting on a blank line, so
+        // join them that way.
+        const existing = map.get(key);
+        map.set(key, array && existing !== undefined ? `${existing}\n\n${value}` : value);
+    }
+    return map;
+}
+function isQuoted(val) {
+    return (val.length >= 2 &&
+        ((val.startsWith('"') && val.endsWith('"')) ||
+            (val.startsWith("'") && val.endsWith("'"))));
+}
+/**
+ * Mirrors the `ini` package's `unsafe()`, except that ini JSON-decodes a
+ * single-quoted value's contents and we keep them verbatim; that only differs
+ * when the contents are valid JSON, never true for a registry, token, or path.
+ * See https://github.com/isaacs/ini/blob/a0c72fe9e335a3f949d734fb5ef13371a850bbe3/lib/ini.js#L230
+ */
+function iniUnsafe(raw) {
+    const val = raw.trim();
+    if (isQuoted(val)) {
+        if (val.startsWith("'")) {
+            return val.slice(1, -1);
+        }
+        try {
+            return JSON.parse(val);
+        }
+        catch {
+            return val;
+        }
+    }
+    let esc = false;
+    let unesc = '';
+    for (const c of val) {
+        if (esc) {
+            unesc += '\\;#'.includes(c) ? c : `\\${c}`;
+            esc = false;
+        }
+        else if (c === ';' || c === '#') {
+            break;
+        }
+        else if (c === '\\') {
+            esc = true;
+        }
+        else {
+            unesc += c;
+        }
+    }
+    if (esc) {
+        unesc += '\\';
+    }
+    return unesc.trim();
+}

package/dist/src/utils/package-manager-config/pnpm-config.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Mirrors pnpm's getConfigDir. Hosts pnpm's global config.yaml and (v11+)
+ * auth.ini.
+ * See https://github.com/pnpm/pnpm/blob/b7195db5c8469c80908d625c648302b26c2f9977/config/reader/src/dirs.ts#L73-L92
+ */
+export declare function getPnpmConfigDir(env: NodeJS.ProcessEnv): string;
+/**
+ * Reads a pnpm YAML config file (pnpm-workspace.yaml or the global
+ * config.yaml). An absent file returns null so callers can fall through to
+ * lower surfaces; everything else returns 'unusable', which every caller turns
+ * into a throw. pnpm's own reader tolerates ENOENT alone and rethrows the rest,
+ * and it dies the same way on a document it cannot parse or that is not a
+ * mapping, so the two failures need no separate states. Requiring an object
+ * also keeps the sentinel out of the success domain: a returned string can only
+ * ever mean unusable.
+ */
+export declare function readPnpmYamlConfig(path: string): Record<string, unknown> | 'unusable' | null;

package/dist/src/utils/package-manager-config/pnpm-config.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPnpmConfigDir = getPnpmConfigDir;
+exports.readPnpmYamlConfig = readPnpmYamlConfig;
+const os_1 = require("os");
+const path_1 = require("path");
+const fileutils_1 = require("../fileutils");
+/**
+ * Mirrors pnpm's getConfigDir. Hosts pnpm's global config.yaml and (v11+)
+ * auth.ini.
+ * See https://github.com/pnpm/pnpm/blob/b7195db5c8469c80908d625c648302b26c2f9977/config/reader/src/dirs.ts#L73-L92
+ */
+function getPnpmConfigDir(env) {
+    if (env.XDG_CONFIG_HOME) {
+        return (0, path_1.join)(env.XDG_CONFIG_HOME, 'pnpm');
+    }
+    if (process.platform === 'darwin') {
+        return (0, path_1.join)((0, os_1.homedir)(), 'Library/Preferences/pnpm');
+    }
+    if (process.platform !== 'win32') {
+        return (0, path_1.join)((0, os_1.homedir)(), '.config/pnpm');
+    }
+    if (env.LOCALAPPDATA) {
+        return (0, path_1.join)(env.LOCALAPPDATA, 'pnpm/config');
+    }
+    return (0, path_1.join)((0, os_1.homedir)(), '.config/pnpm');
+}
+/**
+ * Reads a pnpm YAML config file (pnpm-workspace.yaml or the global
+ * config.yaml). An absent file returns null so callers can fall through to
+ * lower surfaces; everything else returns 'unusable', which every caller turns
+ * into a throw. pnpm's own reader tolerates ENOENT alone and rethrows the rest,
+ * and it dies the same way on a document it cannot parse or that is not a
+ * mapping, so the two failures need no separate states. Requiring an object
+ * also keeps the sentinel out of the success domain: a returned string can only
+ * ever mean unusable.
+ */
+function readPnpmYamlConfig(path) {
+    let doc;
+    try {
+        doc = (0, fileutils_1.readYamlFile)(path);
+    }
+    catch (e) {
+        // Only ENOENT resolves on, so a path through a non-directory or a file that
+        // will not open is fatal here. Callers whose pnpm counterpart looks the file
+        // up before reading it widen "absent" themselves.
+        if (e?.code === 'ENOENT') {
+            return null;
+        }
+        return 'unusable';
+    }
+    // An empty file declares nothing; pnpm accepts it.
+    if (doc === null || doc === undefined) {
+        return {};
+    }
+    if (typeof doc !== 'object' || Array.isArray(doc)) {
+        return 'unusable';
+    }
+    return doc;
+}

package/dist/src/utils/package-manager.d.ts

@@ -118,14 +118,33 @@ export declare function resolvePackageVersionUsingRegistry(packageName: string,
  * package.json.
  */
 export declare function resolvePackageVersionUsingInstallation(packageName: string, version: string): Promise<string>;
-export declare function packageRegistryView(pkg: string, version: string, args: string, options?: {
+/**
+ * The registry the fetch for `pkg` went to, with its userinfo masked because a
+ * registry URL can carry a bare token. The lookup is spawned the way
+ * `packageRegistryView` spawns the fetch this describes (same manager, same
+ * environment), so a registry the package manager keeps outside the .npmrc
+ * chain and a scope resolved for itself both land on the value that fetch used.
+ * Null where the manager yields no usable registry URL; throws where it cannot be run.
+ */
+export declare function getWorkspaceRegistryUrlForDisplay(pkg: string): string | null;
+export declare function packageRegistryView(pkg: string, version: string, args: string[], options?: {
     forceNpm?: boolean;
 }): Promise<string>;
-export declare function packageRegistryPack(cwd: string, pkg: string, version: string, options?: {
+/**
+ * Only `npm pack` supports downloading a tarball of a specified remote
+ * package. `yarn` packs the active workspace, `pnpm pack` only packs
+ * the local project, and `bun` doesn't support pack.
+ *
+ * @param packDestination Directory passed to npm's `--pack-destination`, where
+ * the `.tgz` is written.
+ * @see https://github.com/nrwl/nx/pull/9667#discussion_r842553994
+ */
+export declare function packageRegistryPack(packDestination: string, pkg: string, version: string, options?: {
     bypassMinReleaseAge?: boolean;
 }): Promise<{
     tarballPath: string;
 }>;
+export declare function clearPackageManagerVersionCache(): void;
 /**
  * Gets the workspaces defined in the package manager configuration.
  * @returns workspaces defined in the package manager configuration, empty array if none are defined

package/dist/src/utils/package-manager.js

@@ -13,8 +13,10 @@ exports.copyPackageManagerConfigurationFiles = copyPackageManagerConfigurationFi
 exports.createTempNpmDirectory = createTempNpmDirectory;
 exports.resolvePackageVersionUsingRegistry = resolvePackageVersionUsingRegistry;
 exports.resolvePackageVersionUsingInstallation = resolvePackageVersionUsingInstallation;
+exports.getWorkspaceRegistryUrlForDisplay = getWorkspaceRegistryUrlForDisplay;
 exports.packageRegistryView = packageRegistryView;
 exports.packageRegistryPack = packageRegistryPack;
+exports.clearPackageManagerVersionCache = clearPackageManagerVersionCache;
 exports.getPackageWorkspaces = getPackageWorkspaces;
 exports.addPackagePathToWorkspaces = addPackagePathToWorkspaces;
 const child_process_1 = require("child_process");
@@ -30,9 +32,36 @@ const file_utils_1 = require("../project-graph/file-utils");
 const catalog_1 = require("./catalog");
 const fileutils_1 = require("./fileutils");
 const installation_directory_1 = require("./installation-directory");
+const logger_1 = require("./logger");
 const package_json_1 = require("./package-json");
+const shell_quoting_1 = require("./shell-quoting");
 const workspace_root_1 = require("./workspace-root");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * Shell-less spawn for the registry-bridged fetches: `exec` goes through
+ * /bin/sh, which is dash on Debian-family systems, and dash drops environment
+ * names that are not valid shell identifiers, i.e. every `//...:_authToken`
+ * credential and `@scope:registry` entry the overlay carries. Windows stays on
+ * `exec`, with every argument quoted, because Node refuses to execFile the
+ * package manager's `.cmd` shim without a shell.
+ *
+ * That quoting is the whole defence on Windows, so it goes through
+ * quoteShellArg, which throws on the one argument it cannot make safe.
+ */
+function execPackageManagerAsync(pm, args, options) {
+    if (process.platform === 'win32') {
+        return execAsync([pm, ...args].map(shell_quoting_1.quoteShellArg).join(' '), options);
+    }
+    return execFileAsync(pm, args, options);
+}
+/** Same split, and the same quoting, for a blocking caller. */
+function execPackageManagerSync(pm, args, options) {
+    if (process.platform === 'win32') {
+        return (0, child_process_1.execSync)([pm, ...args].map(shell_quoting_1.quoteShellArg).join(' '), options);
+    }
+    return (0, child_process_1.execFileSync)(pm, args, options);
+}
 /**
  * Detects which package manager is used in the workspace based on the lock file.
  */
@@ -408,6 +437,27 @@ function copyPackageManagerConfigurationFiles(root, destination) {
         }
     }
 }
+/**
+ * A non-JS workspace has no root package.json and keeps its package manager
+ * files under the Nx installation directory instead.
+ */
+function getPackageManagerConfigRoot() {
+    if ((0, fs_1.existsSync)((0, path_1.join)(workspace_root_1.workspaceRoot, 'package.json'))) {
+        return workspace_root_1.workspaceRoot;
+    }
+    const installationPath = (0, installation_directory_1.getNxInstallationPath)(workspace_root_1.workspaceRoot);
+    // The installation directory can be missing or not a directory, and spawning
+    // with such a cwd fails outright (ENOENT/ENOTDIR).
+    try {
+        return (0, fs_1.statSync)(installationPath).isDirectory()
+            ? installationPath
+            : workspace_root_1.workspaceRoot;
+    }
+    catch (e) {
+        logger_1.logger.verbose(`Failed to stat the Nx installation directory at "${installationPath}".`, e);
+        return workspace_root_1.workspaceRoot;
+    }
+}
 /**
  * Creates a temporary directory where you can run package manager commands safely.
  *
@@ -424,8 +474,7 @@ function createTempNpmDirectory(skipCopy = false) {
     // A package.json is needed for pnpm pack and for .npmrc to resolve
     (0, fileutils_1.writeJsonFile)(`${dir}/package.json`, {});
     if (!skipCopy) {
-        const isNonJs = !(0, fs_1.existsSync)((0, path_1.join)(workspace_root_1.workspaceRoot, 'package.json'));
-        copyPackageManagerConfigurationFiles(isNonJs ? (0, installation_directory_1.getNxInstallationPath)(workspace_root_1.workspaceRoot) : workspace_root_1.workspaceRoot, dir);
+        copyPackageManagerConfigurationFiles(getPackageManagerConfigRoot(), dir);
     }
     const cleanup = async () => {
         try {
@@ -444,7 +493,9 @@ function createTempNpmDirectory(skipCopy = false) {
 async function resolvePackageVersionUsingRegistry(packageName, version) {
     try {
         const resolvedVersion = (0, catalog_1.resolveCatalogReferenceIfNeeded)(packageName, version);
-        const result = await packageRegistryView(packageName, resolvedVersion, 'version');
+        const result = await packageRegistryView(packageName, resolvedVersion, [
+            'version',
+        ]);
         if (!result) {
             throw new Error(`Unable to resolve version ${packageName}@${resolvedVersion}.`);
         }
@@ -466,10 +517,30 @@ async function resolvePackageVersionUsingRegistry(packageName, version) {
             .replace(/'/g, '');
         return finalResolvedVersion;
     }
-    catch {
-        throw new Error(`Unable to resolve version ${packageName}@${version}.`);
+    catch (e) {
+        // npm masks a URL credential only in the password position, so a bare token
+        // in the registry URL survives into the error kept as the cause.
+        throw new Error(`Unable to resolve version ${packageName}@${version}.`, {
+            cause: redactErrorCause(e),
+        });
     }
 }
+// Masks the userinfo in a URL: `user`, `user:pass`, or a bare token.
+function redactUrlCredentials(text) {
+    return text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/gi, '$1***@');
+}
+function redactErrorCause(error) {
+    if (error && typeof error === 'object') {
+        const e = error;
+        // An exec error carries the command and both output streams as fields.
+        for (const field of ['message', 'stack', 'stderr', 'stdout', 'cmd']) {
+            if (typeof e[field] === 'string') {
+                e[field] = redactUrlCredentials(e[field]);
+            }
+        }
+    }
+    return error;
+}
 /**
  * Return the resolved version for a given package and version tag using by
  * installing it in a temporary directory and fetching the version from the
@@ -498,12 +569,86 @@ async function resolvePackageVersionUsingInstallation(packageName, version) {
         await cleanup();
     }
 }
-async function packageRegistryView(pkg, version, args, 
-// `forceNpm` runs the view through npm even in a pnpm workspace: npm projects
-// a field across every matched version, whereas `pnpm view <pkg>@<range>`
-// collapses to the single highest match (breaks per-version field queries).
-options) {
-    let pm = detectPackageManager();
+/**
+ * What every registry-bound npm spawn resolves the same way: where npm runs,
+ * and an environment reproducing the workspace package manager's own registry,
+ * auth and TLS resolution for `pkg`. `buildEnv` adds the caller's own entries.
+ */
+function createRegistrySpawnContext(pkg) {
+    // Deferred so the registry resolvers load only for the commands that spawn
+    // npm, not with every package-manager.ts import.
+    const { getNpmSpawnRegistryEnv, getPackageScope, ignoresNpmConfigEnv, mergeNpmConfigEnv, } = require('./registry-config');
+    const workspacePm = detectPackageManager();
+    const configRoot = getPackageManagerConfigRoot();
+    const workspacePmVersion = getPackageManagerVersionSafe(workspacePm, configRoot);
+    return {
+        workspacePm,
+        workspacePmVersion,
+        configRoot,
+        scope: getPackageScope(pkg),
+        buildEnv: (extra) => mergeNpmConfigEnv(process.env, {
+            ...getNpmSpawnRegistryEnv(pkg, configRoot, workspacePm, workspacePmVersion),
+            ...extra,
+        }, ignoresNpmConfigEnv(workspacePm, workspacePmVersion)),
+    };
+}
+/**
+ * The registry the fetch for `pkg` went to, with its userinfo masked because a
+ * registry URL can carry a bare token. The lookup is spawned the way
+ * `packageRegistryView` spawns the fetch this describes (same manager, same
+ * environment), so a registry the package manager keeps outside the .npmrc
+ * chain and a scope resolved for itself both land on the value that fetch used.
+ * Null where the manager yields no usable registry URL; throws where it cannot be run.
+ */
+function getWorkspaceRegistryUrlForDisplay(pkg) {
+    const { workspacePm, workspacePmVersion, configRoot, scope, buildEnv } = createRegistrySpawnContext(pkg);
+    const { pm, env, usesNativePnpm } = resolveRegistrySpawnTarget(workspacePm, workspacePmVersion, buildEnv);
+    // Ask for the package scope first. Native pnpm can keep the workspace
+    // `registries.default` separate from the flat `registry`, so it is queried
+    // in between.
+    const keys = scope ? [`${scope}:registry`] : [];
+    if (usesNativePnpm) {
+        keys.push('registries.default');
+    }
+    keys.push('registry');
+    for (const key of keys) {
+        const value = execPackageManagerSync(pm, ['config', 'get', key], {
+            cwd: configRoot,
+            timeout: 5000,
+            windowsHide: true,
+            encoding: 'utf-8',
+            // The downgraded pin warns on stderr, which is noise on a path that only
+            // decorates an error message.
+            stdio: ['ignore', 'pipe', 'ignore'],
+            env,
+        }).trim();
+        if (!value || value === 'undefined' || value === 'null') {
+            continue;
+        }
+        // A present but unusable answer (a `registries:` map with a non-string
+        // default serializes as JSON; a non-HTTP(S) scheme) also aborted the fetch
+        // this describes, so a key below it was never contacted either.
+        if (!URL.canParse(value)) {
+            return null;
+        }
+        const protocol = new URL(value).protocol;
+        if (protocol !== 'http:' && protocol !== 'https:') {
+            return null;
+        }
+        return redactUrlCredentials(value);
+    }
+    return null;
+}
+/**
+ * Which manager answers a registry read for this workspace, and the environment
+ * it reads under. pnpm 11 reimplemented `view` natively, resolving registry and
+ * credentials (tokenHelper included) itself, so it runs on the untouched
+ * environment; pnpm 10 passed `view` through to the npm CLI, which needs the
+ * overlay. Shared so a lookup describing a fetch cannot resolve against a
+ * different environment than the fetch used.
+ */
+function resolveRegistrySpawnTarget(workspacePm, workspacePmVersion, buildEnv, options) {
+    let pm = workspacePm;
     if (options?.forceNpm || pm === 'yarn' || pm === 'bun') {
         /**
          * yarn has `yarn info` but it behaves differently than (p)npm,
@@ -517,46 +662,98 @@ options) {
          */
         pm = 'npm';
     }
+    if (pm === 'pnpm' && ((0, semver_1.parse)(workspacePmVersion)?.major ?? 0) >= 11) {
+        return { pm, env: process.env, usesNativePnpm: true };
+    }
+    // npm_config_force downgrades npm's `devEngines.packageManager` enforcement,
+    // which otherwise aborts even a read-only lookup when the pin sets
+    // `onFail: error`. Only set for npm so a pnpm spawn is untouched.
+    return {
+        pm,
+        env: buildEnv(pm === 'npm' ? { npm_config_force: 'true' } : {}),
+        usesNativePnpm: false,
+    };
+}
+async function packageRegistryView(pkg, version, args, 
+// `forceNpm` runs the view through npm even in a pnpm workspace: npm projects
+// a field across every matched version, whereas `pnpm view <pkg>@<range>`
+// collapses to the single highest match (breaks per-version field queries).
+options) {
+    const { workspacePm, workspacePmVersion, configRoot, buildEnv } = createRegistrySpawnContext(pkg);
+    const { pm, env } = resolveRegistrySpawnTarget(workspacePm, workspacePmVersion, buildEnv, options);
     // An empty version means we want the full packument; omit the trailing `@`.
-    // Quote the spec so range operators (e.g. `>=0.0.0`) are not parsed as shell
-    // redirections.
     const spec = version ? `${pkg}@${version}` : pkg;
-    // npm enforces `devEngines.packageManager` on every command, even a read-only
-    // `view`; in a yarn/bun workspace we run npm, so a non-npm pin with
-    // `onFail: error` aborts the lookup. force downgrades that to a warning.
-    // Scoped to npm so a `pnpm view` spawn is left untouched.
-    const { stdout } = await execAsync(`${pm} view "${spec}" ${args}`, {
-        windowsHide: true,
-        ...(pm === 'npm'
-            ? { env: { ...process.env, npm_config_force: 'true' } }
-            : {}),
-    });
-    return stdout.toString().trim();
+    try {
+        const { stdout } = await execPackageManagerAsync(pm, ['view', spec, ...args], {
+            windowsHide: true,
+            cwd: configRoot,
+            env,
+        });
+        return stdout.toString().trim();
+    }
+    catch (e) {
+        throw redactErrorCause(e);
+    }
 }
-async function packageRegistryPack(cwd, pkg, version, options) {
-    /**
-     * Only `npm pack` supports downloading a tarball of a specified remote
-     * package. `yarn` packs the active workspace, `pnpm pack` only packs
-     * the local project, and `bun` doesn't support pack.
-     *
-     * @see https://github.com/nrwl/nx/pull/9667#discussion_r842553994
-     */
+/**
+ * Only `npm pack` supports downloading a tarball of a specified remote
+ * package. `yarn` packs the active workspace, `pnpm pack` only packs
+ * the local project, and `bun` doesn't support pack.
+ *
+ * @param packDestination Directory passed to npm's `--pack-destination`, where
+ * the `.tgz` is written.
+ * @see https://github.com/nrwl/nx/pull/9667#discussion_r842553994
+ */
+async function packageRegistryPack(packDestination, pkg, version, options) {
     const pm = 'npm';
-    const { stdout } = await execAsync(`${pm} pack ${pkg}@${version}`, {
-        cwd,
-        windowsHide: true,
-        // npm enforces `devEngines.packageManager` even on `pack`; force keeps the
-        // download working in workspaces that pin a non-npm manager (onFail: error).
-        env: {
-            ...process.env,
-            npm_config_force: 'true',
-            ...(options?.bypassMinReleaseAge
-                ? { npm_config_min_release_age: '0' }
-                : {}),
-        },
-    });
-    const tarballPath = stdout.trim();
-    return { tarballPath };
+    const { configRoot, buildEnv } = createRegistrySpawnContext(pkg);
+    // Run from the config root, not the temp dir, so npm reads the workspace
+    // .npmrc natively; --pack-destination still writes the tarball to the temp
+    // dir. npm prints the tarball basename to stdout.
+    try {
+        const { stdout } = await execPackageManagerAsync(pm, ['pack', `${pkg}@${version}`, '--pack-destination', packDestination], {
+            cwd: configRoot,
+            windowsHide: true,
+            env: buildEnv({
+                // downgrade npm's devEngines.packageManager enforcement (onFail:
+                // error) to a warning so pack still runs in a non-npm workspace
+                npm_config_force: 'true',
+                ...(options?.bypassMinReleaseAge
+                    ? { npm_config_min_release_age: '0' }
+                    : {}),
+            }),
+        });
+        const tarballPath = stdout.trim();
+        return { tarballPath };
+    }
+    catch (e) {
+        throw redactErrorCause(e);
+    }
+}
+// The version probe shells out when the packageManager field is absent, and
+// packageRegistryView/packageRegistryPack run in tight resolution loops.
+const packageManagerVersionCache = new Map();
+/**
+ * A null version is tolerated per package manager: pnpm and yarn skip bridging,
+ * bun assumes a current version.
+ */
+function getPackageManagerVersionSafe(packageManager, root) {
+    const key = `${packageManager}:${root}`;
+    if (!packageManagerVersionCache.has(key)) {
+        let version = null;
+        try {
+            version = getPackageManagerVersion(packageManager, root);
+        }
+        catch (e) {
+            logger_1.logger.verbose(`Failed to determine the ${packageManager} version in "${root}".`, e);
+        }
+        packageManagerVersionCache.set(key, version);
+    }
+    return packageManagerVersionCache.get(key);
+}
+// Test-only: production never re-resolves a version mid-run.
+function clearPackageManagerVersionCache() {
+    packageManagerVersionCache.clear();
 }
 /**
  * Gets the workspaces defined in the package manager configuration.

package/dist/src/utils/provenance.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProvenanceError = void 0;
 exports.ensurePackageHasProvenance = ensurePackageHasProvenance;
 exports.getNxPackageGroup = getNxPackageGroup;
-const child_process_1 = require("child_process");
 const module_1 = require("module");
 const fileutils_1 = require("./fileutils");
 const package_manager_1 = require("./package-manager");
@@ -21,7 +20,10 @@ async function ensurePackageHasProvenance(packageName, packageVersion) {
         return;
     }
     try {
-        const result = await (0, package_manager_1.packageRegistryView)(packageName, packageVersion, '--json --silent');
+        const result = await (0, package_manager_1.packageRegistryView)(packageName, packageVersion, [
+            '--json',
+            '--silent',
+        ]);
         const parsed = JSON.parse(result);
         // `npm view <pkg>@<spec> --json` returns a bare object on npm <= 11 but an
         // array on npm 12 and pnpm, even for a single resolved version. A version
@@ -77,19 +79,9 @@ class ProvenanceError extends Error {
     constructor(packageName, packageVersion, error) {
         let customRegistry = undefined;
         try {
-            const packageManager = (0, package_manager_1.detectPackageManager)();
-            const commands = (0, package_manager_1.getPackageManagerCommand)(packageManager);
-            // Try to get registry from current package manager, fall back to npm
-            const registryCommand = commands.getRegistryUrl ?? 'npm config get registry';
-            const registry = (0, child_process_1.execSync)(registryCommand, {
-                timeout: 5000,
-                windowsHide: true,
-                encoding: 'utf-8',
-            }).trim();
+            const registry = (0, package_manager_1.getWorkspaceRegistryUrlForDisplay)(packageName);
             // Only consider it custom if it's not the default npm registry
-            if (registry &&
-                registry !== 'undefined' &&
-                !registry.includes('registry.npmjs.org')) {
+            if (registry && !registry.includes('registry.npmjs.org')) {
                 customRegistry = registry;
             }
         }

package/dist/src/utils/registry-config/bun.d.ts

@@ -0,0 +1,2 @@
+import { type NpmConfigEnv } from './utils';
+export declare function getBunSpawnRegistryEnv(packageName: string, root: string, bunVersion: string | null): NpmConfigEnv;