nx 23.1.1 → 23.1.3

package/dist/src/utils/owned-private-dir.js

@@ -0,0 +1,323 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DirectoryRefusedError = void 0;
+exports.describeRefusal = describeRefusal;
+exports.remedyFor = remedyFor;
+exports.isSafeSharedRoot = isSafeSharedRoot;
+exports.isPeerWritable = isPeerWritable;
+exports.ensureSafeSharedRoot = ensureSafeSharedRoot;
+exports.isOwnedRealDirectory = isOwnedRealDirectory;
+exports.getUserSegment = getUserSegment;
+exports.ensureOwnedPrivateDir = ensureOwnedPrivateDir;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+// A string discriminant, not a boolean `ok`: this repo compiles with
+// `strict: false`, where TypeScript does not narrow a union on a boolean literal.
+const allow = (path) => ({ status: 'ok', path });
+const deny = (refusal) => ({
+    status: 'refused',
+    refusal,
+});
+const notADirectory = (dir, stats) => stats.isSymbolicLink()
+    ? { kind: 'not-a-directory', dir, symlink: true }
+    : { kind: 'not-a-directory', dir };
+// Four octal digits, so a sticky container reads `1777` and a plain directory
+// `0755` — the notation `chmod` and `ls` use. Prefixing a literal `0` instead
+// renders sticky modes as `01777`, which is not a form anyone writes.
+const asMode = (mode) => (mode & 0o7777).toString(8).padStart(4, '0');
+/** The user-facing sentence for a refusal. The only place wording is decided. */
+function describeRefusal(r) {
+    switch (r.kind) {
+        case 'not-created':
+            return `${r.dir} could not be created${r.code ? ` (${r.code})` : ''}`;
+        case 'not-inspectable':
+            return `${r.dir} could not be inspected${r.code ? ` (${r.code})` : ''}`;
+        case 'not-a-directory':
+            return r.symlink
+                ? `${r.dir} is a symlink, not a real directory — something replaced the path Nx expected to create`
+                : `${r.dir} exists and is not a directory`;
+        case 'foreign-owner':
+            return `${r.dir} is owned by uid ${r.uid}, not by you`;
+        case 'foreign-shared-container':
+            return `${r.dir} belongs to another user (uid ${r.uid}) rather than to you or to root`;
+        case 'not-tightenable':
+            return `${r.dir} is reachable by other users (mode ${asMode(r.mode)}) and could not be tightened to 0700`;
+        case 'peer-writable-not-sticky':
+            return `${r.dir} is writable by other users but not sticky (mode ${asMode(r.mode)}), so a peer could replace directories inside it`;
+        default: {
+            // This repo sets `strict: false` and leaves `noImplicitReturns` unset, so
+            // a new DirRefusal member would otherwise compile here and render as
+            // `undefined` inside the aggregate message. Assignability to `never` still
+            // holds under these settings, so this is a real compile-time guard.
+            const unhandled = r;
+            throw new Error(`Unhandled directory refusal: ${unhandled.kind}`);
+        }
+    }
+}
+/** Single-quoted for a shell, so a path with a space or quote survives a paste. */
+const shellQuote = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+/** What the user can do about a refusal, or `undefined` when there is nothing. */
+function remedyFor(r) {
+    switch (r.kind) {
+        case 'not-a-directory':
+            return r.symlink
+                ? `${r.dir} is a symlink where Nx expects a directory. If you did not create it, treat it as hostile: remove the link itself (not what it points at) and run the command again.`
+                : undefined;
+        case 'foreign-owner':
+            return `${r.dir} belongs to another user on this machine, so Nx cannot keep its own directory there. Set NX_SOCKET_DIR to a short directory your user owns, or move it aside — which you can do yourself if you own the directory it sits in, and otherwise needs an administrator.`;
+        case 'not-tightenable':
+            // Both producers reach here having already established that the directory
+            // is ours, so `chmod` is the user's to run. Names no cause: one producer
+            // is a mount that discards the mode, the other is any `chmod` failure.
+            return `${r.dir} is reachable by other users (mode ${asMode(r.mode)}) and Nx could not restrict it. Run \`chmod 0700 ${shellQuote(r.dir)}\` and try again; if the mode does not stick, set NX_SOCKET_DIR to a short directory on a filesystem that keeps POSIX permissions.`;
+        case 'foreign-shared-container':
+            // Unreachable today: `isSafeSharedRoot` denies with this kind only when
+            // `stats.uid !== 0`, so a root-owned container never reaches here.
+            if (r.uid === 0) {
+                return undefined;
+            }
+            const q = shellQuote(r.dir);
+            return `${r.dir} belongs to another user on this machine, so Nx cannot keep a private directory beneath it. Ask an administrator to hand it to root with \`sudo chown root ${q} && sudo chmod 1777 ${q}\`; every user can then keep their own directory under it.`;
+        case 'not-created':
+        case 'not-inspectable':
+        case 'peer-writable-not-sticky':
+            return undefined;
+        default: {
+            // Matches `describeRefusal`'s arm, so a new kind cannot ship with a
+            // sentence and no advice — which is how `not-tightenable` went unadvised.
+            const unhandled = r;
+            return undefined;
+        }
+    }
+}
+/** One refusal as an `Error`, so several can travel in an `AggregateError`. */
+class DirectoryRefusedError extends Error {
+    constructor(refusal) {
+        super(describeRefusal(refusal));
+        this.refusal = refusal;
+        this.name = 'DirectoryRefusedError';
+    }
+}
+exports.DirectoryRefusedError = DirectoryRefusedError;
+/**
+ * chmod a path only if it is a real directory, never following a symlink at its
+ * final component — `chmodSync` follows them, retargeting the mode change. The
+ * directory check is on the descriptor, not the errno: a deny-list fails *open*
+ * on codes it does not know. `O_NONBLOCK` stops a planted FIFO blocking `openSync`.
+ */
+function chmodRealDirectory(path, mode) {
+    let fd;
+    try {
+        fd = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_NOFOLLOW | node_fs_1.constants.O_NONBLOCK);
+    }
+    catch {
+        return false;
+    }
+    try {
+        if (!(0, node_fs_1.fstatSync)(fd).isDirectory()) {
+            return false;
+        }
+        (0, node_fs_1.fchmodSync)(fd, mode);
+        return true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+}
+/**
+ * Sticky. Restricts rename and unlink in a writable directory to the owner of
+ * each entry — plus the directory's own owner, which is why the ownership check
+ * below is not redundant with this one.
+ */
+const S_ISVTX = 0o1000;
+/**
+ * Whether a shared container is safe to keep an owner-only directory under.
+ *
+ * On POSIX, a container writable by other users must be sticky, and it must be
+ * owned by either root or the current user. Windows short-circuits after the
+ * directory test — the OS temp root is already scoped to one account, so there
+ * is no shared level whose ownership could matter.
+ *
+ * Sticky directories still let the directory's own owner rename entries, so a
+ * container owned by another unprivileged user could replace a previously
+ * verified private directory beneath it.
+ */
+function isSafeSharedRoot(dir) {
+    try {
+        const stats = (0, node_fs_1.lstatSync)(dir);
+        if (!stats.isDirectory()) {
+            return deny(notADirectory(dir, stats));
+        }
+        if (process.platform === 'win32') {
+            // The OS temp root is already scoped to the current Windows user.
+            return allow(dir);
+        }
+        if (typeof process.getuid === 'function' &&
+            stats.uid !== process.getuid() &&
+            stats.uid !== 0) {
+            return deny({ kind: 'foreign-shared-container', dir, uid: stats.uid });
+        }
+        return !(stats.mode & 0o022) || !!(stats.mode & S_ISVTX)
+            ? allow(dir)
+            : deny({ kind: 'peer-writable-not-sticky', dir, mode: stats.mode });
+    }
+    catch (e) {
+        return deny({ kind: 'not-inspectable', dir, code: e?.code });
+    }
+}
+/**
+ * Whether other users on this machine can write into `dir`. Gates whether a
+ * refusal message may cite other users, so it must not over-report: `false` on
+ * Windows, where libuv synthesizes `st_mode` from the READONLY attribute and
+ * reports an ordinary per-account directory as `0666`, and `false` on a path
+ * that cannot be inspected.
+ *
+ * `statSync`, not `lstatSync`: the question is about the directory that will be
+ * used, not the link pointing at it. Link modes mislead in both directions —
+ * Linux creates symlinks `0777`, macOS applies the umask. Nothing here decides
+ * whether a path is accepted, so following the link costs nothing the guards
+ * do not already re-check.
+ */
+function isPeerWritable(dir) {
+    if (process.platform === 'win32') {
+        return false;
+    }
+    try {
+        return !!((0, node_fs_1.statSync)(dir).mode & 0o022);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Create a shared container as sticky + world-writable if it does not exist,
+ * and report whether the resulting path is safe for the current user.
+ *
+ * **A container that already exists is never modified — only judged.** Do not
+ * chmod before deciding trust: `CAP_FOWNER` (root's default in Docker and most
+ * CI images) can chmod a directory it does not own, so a peer-owned root would
+ * be widened to `1777` and then refused, and an operator who deliberately
+ * tightened this root would have it re-widened on every `nx` process.
+ */
+function ensureSafeSharedRoot(dir) {
+    if (process.platform === 'win32') {
+        try {
+            (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+            return allow(dir);
+        }
+        catch (e) {
+            return deny({ kind: 'not-created', dir, code: e?.code });
+        }
+    }
+    try {
+        (0, node_fs_1.mkdirSync)(dir, { mode: 0o1777 });
+        // Ours, created a statement ago. Load-bearing on macOS: XNU strips S_ISVTX
+        // at mkdir, so the sticky bit exists solely because of this call.
+        chmodRealDirectory(dir, 0o1777);
+    }
+    catch (e) {
+        if (e?.code !== 'EEXIST') {
+            return deny({ kind: 'not-created', dir, code: e?.code });
+        }
+    }
+    // One verdict for both branches: the chmod above can fail and leave a
+    // peer-writable non-sticky container, which trusting the creation would brand
+    // safe.
+    const verdict = isSafeSharedRoot(dir);
+    return verdict.status === 'ok'
+        ? allow(dir)
+        : deny(verdict.refusal);
+}
+/**
+ * Whether `dir` is an existing real directory owned by us. Unlike
+ * `ensureOwnedPrivateDir` it creates nothing and repairs nothing — for callers
+ * that only want to know whether a path is safe to act on, such as deleting.
+ */
+function isOwnedRealDirectory(dir) {
+    try {
+        const stats = (0, node_fs_1.lstatSync)(dir);
+        if (!stats.isDirectory()) {
+            return null;
+        }
+        return typeof process.getuid !== 'function' ||
+            stats.uid === process.getuid()
+            ? dir
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The path segment separating one user's Nx runtime state from another's. */
+function getUserSegment() {
+    try {
+        if (typeof process.getuid === 'function') {
+            return String(process.getuid());
+        }
+    }
+    catch { }
+    try {
+        const { username } = (0, node_os_1.userInfo)();
+        if (username) {
+            return username;
+        }
+    }
+    catch { }
+    return 'unknown';
+}
+/**
+ * Ensure `dir` exists, is a real directory owned by us, and carries no group or
+ * other bits at all — read and search alone reach a socket inside it, so 0755 is
+ * re-locked rather than accepted. A `refused` status carries which check said
+ * no — usually `foreign-owner` for a directory another user planted, but also
+ * `not-created`/`not-inspectable` for a filesystem error, `not-a-directory`, or
+ * `not-tightenable` when the re-lock did not land.
+ *
+ * Node builtins only: reached from the native binding loader.
+ */
+function ensureOwnedPrivateDir(dir) {
+    try {
+        (0, node_fs_1.mkdirSync)(dir, { mode: 0o700 });
+    }
+    catch (e) {
+        if (e?.code !== 'EEXIST') {
+            return deny({ kind: 'not-created', dir, code: e?.code });
+        }
+    }
+    // One verdict for both branches, as in `ensureSafeSharedRoot`: mounts that
+    // ignore the mode argument can land a directory Nx asked for at 0700 on 0777,
+    // so the creation path is judged like any other.
+    try {
+        const stats = (0, node_fs_1.lstatSync)(dir);
+        // Before the Windows short-circuit: "is a real directory" holds on every
+        // platform.
+        if (!stats.isDirectory()) {
+            return deny(notADirectory(dir, stats));
+        }
+        if (typeof process.getuid !== 'function') {
+            // Windows: the roots there are per-user OS temp dirs, not a shared /tmp.
+            return allow(dir);
+        }
+        if (stats.uid !== process.getuid()) {
+            return deny({ kind: 'foreign-owner', dir, uid: stats.uid });
+        }
+        if (stats.mode & 0o077) {
+            if (!chmodRealDirectory(dir, 0o700)) {
+                return deny({ kind: 'not-tightenable', dir, mode: stats.mode });
+            }
+            // Read the mode back rather than trusting the chmod's return: mounts that
+            // ignore modes report success and change nothing.
+            const after = (0, node_fs_1.lstatSync)(dir);
+            if (after.mode & 0o077) {
+                return deny({ kind: 'not-tightenable', dir, mode: after.mode });
+            }
+        }
+        return allow(dir);
+    }
+    catch (e) {
+        return deny({ kind: 'not-inspectable', dir, code: e?.code });
+    }
+}

package/dist/src/utils/package-manager-config/bunfig.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The directory holding bun's global config files (.bunfig.toml and, for bun's
+ * npmrc support, .npmrc): $XDG_CONFIG_HOME when set, else the home dir (bun's
+ * getHomeConfigPath). Null when neither is set, where bun reads no global
+ * config.
+ */
+export declare function getBunGlobalConfigBase(env: NodeJS.ProcessEnv): string | null;
+/**
+ * Parses a bunfig.toml: null when absent, 'unreadable' when it cannot be read
+ * (bun skips it and resolves on, so most callers collapse the two), 'invalid'
+ * when bun's own TOML parser would reject it (bun hard-errors there, so no
+ * resolution is left for a caller to reproduce).
+ */
+export declare function readBunfigRaw(path: string): Record<string, unknown> | 'unreadable' | 'invalid' | null;

package/dist/src/utils/package-manager-config/bunfig.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBunGlobalConfigBase = getBunGlobalConfigBase;
+exports.readBunfigRaw = readBunfigRaw;
+const fs_1 = require("fs");
+/**
+ * The directory holding bun's global config files (.bunfig.toml and, for bun's
+ * npmrc support, .npmrc): $XDG_CONFIG_HOME when set, else the home dir (bun's
+ * getHomeConfigPath). Null when neither is set, where bun reads no global
+ * config.
+ */
+function getBunGlobalConfigBase(env) {
+    // bun's getenvZ treats a set-but-empty var as present, so an exported empty
+    // XDG_CONFIG_HOME still short-circuits HOME (bun: `XDG_CONFIG_HOME orelse HOME`).
+    if (env.XDG_CONFIG_HOME !== undefined) {
+        return env.XDG_CONFIG_HOME;
+    }
+    // Mirrors bun's platform-specific HOME accessor (env_var.zig).
+    const home = process.platform === 'win32' ? env.USERPROFILE : env.HOME;
+    return home ?? null;
+}
+/**
+ * Parses a bunfig.toml: null when absent, 'unreadable' when it cannot be read
+ * (bun skips it and resolves on, so most callers collapse the two), 'invalid'
+ * when bun's own TOML parser would reject it (bun hard-errors there, so no
+ * resolution is left for a caller to reproduce).
+ */
+function readBunfigRaw(path) {
+    // Outside the try because a parser that will not load is a broken
+    // installation, not a corrupt bunfig.
+    const { parse } = require('smol-toml');
+    let raw;
+    try {
+        raw = (0, fs_1.readFileSync)(path, 'utf-8');
+    }
+    catch (error) {
+        // ENOTDIR (a path through a non-directory) is another shape of absent, the
+        // same way the .npmrc reader classifies it.
+        return error?.code === 'ENOENT' || error?.code === 'ENOTDIR'
+            ? null
+            : 'unreadable';
+    }
+    try {
+        return parse(raw);
+    }
+    catch {
+        return 'invalid';
+    }
+}

package/dist/src/utils/package-manager-config/npmrc.d.ts

@@ -0,0 +1,23 @@
+export interface NpmrcEntry {
+    key: string;
+    value: string;
+    /** True when the source used ini's `key[]` array-append syntax. */
+    array?: boolean;
+}
+/**
+ * Parses an .npmrc file into its `key = value` entries the way npm/yarn/pnpm do
+ * (via the `ini` package). Returns null when the file is missing, and
+ * 'unreadable' when it exists but cannot be read (permissions, a directory):
+ * package managers diverge on that state, so each caller decides whether to
+ * skip, warn, or abort rather than having it collapsed into "absent" here.
+ */
+export declare function readNpmrcEntries(path: string): NpmrcEntry[] | 'unreadable' | null;
+export declare function parseNpmrcContent(raw: string): NpmrcEntry[];
+/**
+ * Reads an .npmrc-format file into a map with ini's semantics for repeated
+ * keys: scalars last-write-wins, `key[]` values joined. Null and 'unreadable'
+ * pass through from {@link readNpmrcEntries}.
+ */
+export declare function readNpmrcMap(path: string): Map<string, string> | 'unreadable' | null;
+/** Those entries under ini's semantics for repeated keys. */
+export declare function npmrcEntriesToMap(entries: NpmrcEntry[]): Map<string, string>;

package/dist/src/utils/package-manager-config/npmrc.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readNpmrcEntries = readNpmrcEntries;
+exports.parseNpmrcContent = parseNpmrcContent;
+exports.readNpmrcMap = readNpmrcMap;
+exports.npmrcEntriesToMap = npmrcEntriesToMap;
+const fs_1 = require("fs");
+/**
+ * Parses an .npmrc file into its `key = value` entries the way npm/yarn/pnpm do
+ * (via the `ini` package). Returns null when the file is missing, and
+ * 'unreadable' when it exists but cannot be read (permissions, a directory):
+ * package managers diverge on that state, so each caller decides whether to
+ * skip, warn, or abort rather than having it collapsed into "absent" here.
+ */
+function readNpmrcEntries(path) {
+    let raw;
+    try {
+        raw = (0, fs_1.readFileSync)(path, 'utf-8');
+    }
+    catch (e) {
+        // ENOTDIR (a path through a non-directory) is another shape of absent, not an
+        // unreadable file.
+        return e?.code === 'ENOENT' || e?.code === 'ENOTDIR' ? null : 'unreadable';
+    }
+    return parseNpmrcContent(raw);
+}
+function parseNpmrcContent(raw) {
+    const entries = [];
+    // ini breaks lines on any run of CR/LF, so splitting on `\r?\n` here would
+    // hide everything after a bare CR that npm still reads.
+    for (const line of raw.split(/[\r\n]+/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';')) {
+            continue;
+        }
+        // ini matches the header on the raw line, so an indented one stays a literal
+        // bare-flag key. Everything after a header nests under it, out of npm's flat
+        // lookup, so stop here.
+        if (/^\[[^\]]*\]\s*$/.test(line)) {
+            break;
+        }
+        // ini reads a valueless line as the flag `true`; dropping it would lose a bare
+        // `always-auth`/`strict-ssl` and flip the credential/TLS decision built on it.
+        const eq = trimmed.indexOf('=');
+        const rawKey = iniUnsafe(eq === -1 ? trimmed : trimmed.slice(0, eq));
+        const value = eq === -1 ? 'true' : iniUnsafe(trimmed.slice(eq + 1));
+        // ini enables bracketedArray by default, so a `key[]` suffix appends under the
+        // bare key instead of making a literal `key[]` entry.
+        if (rawKey.length > 2 && rawKey.endsWith('[]')) {
+            entries.push({ key: rawKey.slice(0, -2), value, array: true });
+        }
+        else {
+            entries.push({ key: rawKey, value });
+        }
+    }
+    return entries;
+}
+/**
+ * Reads an .npmrc-format file into a map with ini's semantics for repeated
+ * keys: scalars last-write-wins, `key[]` values joined. Null and 'unreadable'
+ * pass through from {@link readNpmrcEntries}.
+ */
+function readNpmrcMap(path) {
+    const entries = readNpmrcEntries(path);
+    return Array.isArray(entries) ? npmrcEntriesToMap(entries) : entries;
+}
+/** Those entries under ini's semantics for repeated keys. */
+function npmrcEntriesToMap(entries) {
+    const map = new Map();
+    for (const { key, value, array } of entries) {
+        // ini collects repeated `key[]` values into an array under the bare key, and
+        // npm rebuilds a config array from the env by splitting on a blank line, so
+        // join them that way.
+        const existing = map.get(key);
+        map.set(key, array && existing !== undefined ? `${existing}\n\n${value}` : value);
+    }
+    return map;
+}
+function isQuoted(val) {
+    return (val.length >= 2 &&
+        ((val.startsWith('"') && val.endsWith('"')) ||
+            (val.startsWith("'") && val.endsWith("'"))));
+}
+/**
+ * Mirrors the `ini` package's `unsafe()`, except that ini JSON-decodes a
+ * single-quoted value's contents and we keep them verbatim; that only differs
+ * when the contents are valid JSON, never true for a registry, token, or path.
+ * See https://github.com/isaacs/ini/blob/a0c72fe9e335a3f949d734fb5ef13371a850bbe3/lib/ini.js#L230
+ */
+function iniUnsafe(raw) {
+    const val = raw.trim();
+    if (isQuoted(val)) {
+        if (val.startsWith("'")) {
+            return val.slice(1, -1);
+        }
+        try {
+            return JSON.parse(val);
+        }
+        catch {
+            return val;
+        }
+    }
+    let esc = false;
+    let unesc = '';
+    for (const c of val) {
+        if (esc) {
+            unesc += '\\;#'.includes(c) ? c : `\\${c}`;
+            esc = false;
+        }
+        else if (c === ';' || c === '#') {
+            break;
+        }
+        else if (c === '\\') {
+            esc = true;
+        }
+        else {
+            unesc += c;
+        }
+    }
+    if (esc) {
+        unesc += '\\';
+    }
+    return unesc.trim();
+}

package/dist/src/utils/package-manager-config/pnpm-config.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Mirrors pnpm's getConfigDir. Hosts pnpm's global config.yaml and (v11+)
+ * auth.ini.
+ * See https://github.com/pnpm/pnpm/blob/b7195db5c8469c80908d625c648302b26c2f9977/config/reader/src/dirs.ts#L73-L92
+ */
+export declare function getPnpmConfigDir(env: NodeJS.ProcessEnv): string;
+/**
+ * Reads a pnpm YAML config file (pnpm-workspace.yaml or the global
+ * config.yaml). An absent file returns null so callers can fall through to
+ * lower surfaces; everything else returns 'unusable', which every caller turns
+ * into a throw. pnpm's own reader tolerates ENOENT alone and rethrows the rest,
+ * and it dies the same way on a document it cannot parse or that is not a
+ * mapping, so the two failures need no separate states. Requiring an object
+ * also keeps the sentinel out of the success domain: a returned string can only
+ * ever mean unusable.
+ */
+export declare function readPnpmYamlConfig(path: string): Record<string, unknown> | 'unusable' | null;

package/dist/src/utils/package-manager-config/pnpm-config.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPnpmConfigDir = getPnpmConfigDir;
+exports.readPnpmYamlConfig = readPnpmYamlConfig;
+const os_1 = require("os");
+const path_1 = require("path");
+const fileutils_1 = require("../fileutils");
+/**
+ * Mirrors pnpm's getConfigDir. Hosts pnpm's global config.yaml and (v11+)
+ * auth.ini.
+ * See https://github.com/pnpm/pnpm/blob/b7195db5c8469c80908d625c648302b26c2f9977/config/reader/src/dirs.ts#L73-L92
+ */
+function getPnpmConfigDir(env) {
+    if (env.XDG_CONFIG_HOME) {
+        return (0, path_1.join)(env.XDG_CONFIG_HOME, 'pnpm');
+    }
+    if (process.platform === 'darwin') {
+        return (0, path_1.join)((0, os_1.homedir)(), 'Library/Preferences/pnpm');
+    }
+    if (process.platform !== 'win32') {
+        return (0, path_1.join)((0, os_1.homedir)(), '.config/pnpm');
+    }
+    if (env.LOCALAPPDATA) {
+        return (0, path_1.join)(env.LOCALAPPDATA, 'pnpm/config');
+    }
+    return (0, path_1.join)((0, os_1.homedir)(), '.config/pnpm');
+}
+/**
+ * Reads a pnpm YAML config file (pnpm-workspace.yaml or the global
+ * config.yaml). An absent file returns null so callers can fall through to
+ * lower surfaces; everything else returns 'unusable', which every caller turns
+ * into a throw. pnpm's own reader tolerates ENOENT alone and rethrows the rest,
+ * and it dies the same way on a document it cannot parse or that is not a
+ * mapping, so the two failures need no separate states. Requiring an object
+ * also keeps the sentinel out of the success domain: a returned string can only
+ * ever mean unusable.
+ */
+function readPnpmYamlConfig(path) {
+    let doc;
+    try {
+        doc = (0, fileutils_1.readYamlFile)(path);
+    }
+    catch (e) {
+        // Only ENOENT resolves on, so a path through a non-directory or a file that
+        // will not open is fatal here. Callers whose pnpm counterpart looks the file
+        // up before reading it widen "absent" themselves.
+        if (e?.code === 'ENOENT') {
+            return null;
+        }
+        return 'unusable';
+    }
+    // An empty file declares nothing; pnpm accepts it.
+    if (doc === null || doc === undefined) {
+        return {};
+    }
+    if (typeof doc !== 'object' || Array.isArray(doc)) {
+        return 'unusable';
+    }
+    return doc;
+}

package/dist/src/utils/package-manager.d.ts

@@ -118,14 +118,33 @@ export declare function resolvePackageVersionUsingRegistry(packageName: string,
  * package.json.
  */
 export declare function resolvePackageVersionUsingInstallation(packageName: string, version: string): Promise<string>;
-export declare function packageRegistryView(pkg: string, version: string, args: string, options?: {
+/**
+ * The registry the fetch for `pkg` went to, with its userinfo masked because a
+ * registry URL can carry a bare token. The lookup is spawned the way
+ * `packageRegistryView` spawns the fetch this describes (same manager, same
+ * environment), so a registry the package manager keeps outside the .npmrc
+ * chain and a scope resolved for itself both land on the value that fetch used.
+ * Null where the manager yields no usable registry URL; throws where it cannot be run.
+ */
+export declare function getWorkspaceRegistryUrlForDisplay(pkg: string): string | null;
+export declare function packageRegistryView(pkg: string, version: string, args: string[], options?: {
     forceNpm?: boolean;
 }): Promise<string>;
-export declare function packageRegistryPack(cwd: string, pkg: string, version: string, options?: {
+/**
+ * Only `npm pack` supports downloading a tarball of a specified remote
+ * package. `yarn` packs the active workspace, `pnpm pack` only packs
+ * the local project, and `bun` doesn't support pack.
+ *
+ * @param packDestination Directory passed to npm's `--pack-destination`, where
+ * the `.tgz` is written.
+ * @see https://github.com/nrwl/nx/pull/9667#discussion_r842553994
+ */
+export declare function packageRegistryPack(packDestination: string, pkg: string, version: string, options?: {
     bypassMinReleaseAge?: boolean;
 }): Promise<{
     tarballPath: string;
 }>;
+export declare function clearPackageManagerVersionCache(): void;
 /**
  * Gets the workspaces defined in the package manager configuration.
  * @returns workspaces defined in the package manager configuration, empty array if none are defined