nx 23.2.0-beta.0 → 23.2.0-beta.10

package/dist/src/native/index.js

@@ -1,15 +1,11 @@
 const { join, basename } = require('path');
-const {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-} = require('fs');
+const { copyFileSync, renameSync, statSync, unlinkSync } = require('fs');
+const { createHash } = require('crypto');
 const Module = require('module');
 const { nxVersion } = require('../utils/versions');
-const { getNativeFileCacheLocation } = require('./native-file-cache-location');
+const {
+  ensureSecureNativeFileCacheLocation,
+} = require('./native-file-cache-location');
 
 const MAX_COPY_RETRIES = 3;
 
@@ -73,6 +69,14 @@ function statsOrNull(path) {
   }
 }
 
+function removeIfPresent(path) {
+  try {
+    unlinkSync(path);
+  } catch {
+    // Ignore cleanup errors
+  }
+}
+
 function isNoExecError(e) {
   return e.code === 'EACCES' || e.code === 'EPERM';
 }
@@ -95,20 +99,44 @@ Module._load = function (request, parent, isMain) {
     const nativeLocation = require.resolve(modulePath);
     const fileName = basename(nativeLocation);
 
-    // we copy the file to a workspace-scoped tmp directory and prefix with nxVersion to avoid stale files being loaded
-    const nativeFileCacheLocation = getNativeFileCacheLocation();
+    // null when the cache dir cannot be created *and trusted*; loading in place
+    // from node_modules is safer than loading out of a directory we don't own.
+    const nativeFileCacheLocation = ensureSecureNativeFileCacheLocation();
+    if (!nativeFileCacheLocation) {
+      return originalLoad.apply(this, [nativeLocation, parent, isMain]);
+    }
+
+    // nxVersion alone is not enough: in a source checkout it is the placeholder
+    // 0.0.1 for every worktree, so hashing the resolved binding path keeps each
+    // checkout in its own entry.
+    const cacheKey =
+      nxVersion +
+      '-' +
+      createHash('sha256')
+        .update(nativeLocation)
+        .digest('hex')
+        .substring(0, 12);
+
     // This is a path to copy to, not the one that gets loaded
     const tmpTmpFile = join(
       nativeFileCacheLocation,
-      nxVersion + '-' + Math.random() + fileName
+      cacheKey + '-' + Math.random() + fileName
     );
     // This is the path that will get loaded
-    const tmpFile = join(nativeFileCacheLocation, nxVersion + '-' + fileName);
-    const expectedFileSize = statSync(nativeLocation).size;
+    const tmpFile = join(nativeFileCacheLocation, cacheKey + '-' + fileName);
+    const sourceStats = statSync(nativeLocation);
+    const expectedFileSize = sourceStats.size;
     const existingFileStats = statsOrNull(tmpFile);
 
-    // If the file to be loaded already exists, just load it
-    if (existingFileStats?.size === expectedFileSize) {
+    // Size alone does not detect a rebuilt binding: a small Rust edit routinely
+    // produces a byte-identical size. The copy is taken after the build, so a
+    // cache entry older than the source means the source was rebuilt since.
+    const isFresh =
+      existingFileStats?.size === expectedFileSize &&
+      existingFileStats.mtimeMs >= sourceStats.mtimeMs;
+
+    // If the file to be loaded already exists and is current, just load it
+    if (isFresh) {
       try {
         return originalLoad.apply(this, [tmpFile, parent, isMain]);
       } catch (e) {
@@ -119,20 +147,36 @@ Module._load = function (request, parent, isMain) {
         throw e;
       }
     }
-    if (!existsSync(nativeFileCacheLocation)) {
-      mkdirSync(nativeFileCacheLocation, { recursive: true });
-    }
 
     // Retry copying up to 3 times, validating after each copy
+    let attemptsMade = 0;
+    let cacheError = null;
     for (let attempt = 1; attempt <= MAX_COPY_RETRIES; attempt++) {
+      attemptsMade = attempt;
       // First copy to a unique location for each process
-      copyFileSync(nativeLocation, tmpTmpFile);
+      try {
+        copyFileSync(nativeLocation, tmpTmpFile);
+      } catch (e) {
+        // Permission errors won't heal on retry, and a throwing copy can still
+        // have left a partial file behind.
+        cacheError = e;
+        removeIfPresent(tmpTmpFile);
+        break;
+      }
 
       // Validate the copy - check file size matches expected
       const copiedFileStats = statsOrNull(tmpTmpFile);
       if (copiedFileStats?.size === expectedFileSize) {
         // Copy succeeded, rename to final location and load
-        renameSync(tmpTmpFile, tmpFile);
+        try {
+          renameSync(tmpTmpFile, tmpFile);
+        } catch (e) {
+          // Unguarded, this throws out of `require` and native-bindings.js
+          // reports it as a missing optional dependency, which it is not.
+          cacheError = e;
+          removeIfPresent(tmpTmpFile);
+          break;
+        }
         try {
           return originalLoad.apply(this, [tmpFile, parent, isMain]);
         } catch (e) {
@@ -145,16 +189,15 @@ Module._load = function (request, parent, isMain) {
       }
 
       // Copy failed validation, clean up the malformed file
-      try {
-        unlinkSync(tmpTmpFile);
-      } catch {
-        // Ignore cleanup errors
-      }
+      removeIfPresent(tmpTmpFile);
     }
 
-    // All retries failed - warn and load from original location
+    // Name the errno: ENOSPC, EROFS, EACCES and EDQUOT are all actionable and
+    // otherwise indistinguishable.
     console.warn(
-      `Warning: Failed to copy native module to cache after ${MAX_COPY_RETRIES} attempts. ` +
+      `Warning: Failed to copy native module to cache after ${attemptsMade} attempt${
+        attemptsMade === 1 ? '' : 's'
+      }${cacheError ? ` (${cacheError.code ?? cacheError.message})` : ''}. ` +
         `Loading from original location instead. ` +
         `This may cause file locking issues on Windows.`
     );

package/dist/src/native/native-bindings.js

@@ -610,6 +610,7 @@ module.exports.getBinaryTarget = nativeBinding.getBinaryTarget
 module.exports.getDefaultMaxCacheSize = nativeBinding.getDefaultMaxCacheSize
 module.exports.getEventDimensions = nativeBinding.getEventDimensions
 module.exports.getFilesForOutputsBatch = nativeBinding.getFilesForOutputsBatch
+module.exports.getHardcodedIgnorePatterns = nativeBinding.getHardcodedIgnorePatterns
 module.exports.getMainWorktreeRoot = nativeBinding.getMainWorktreeRoot
 module.exports.getTransformableOutputs = nativeBinding.getTransformableOutputs
 module.exports.GroupType = nativeBinding.GroupType
@@ -625,6 +626,8 @@ module.exports.isEditorInstalled = nativeBinding.isEditorInstalled
 module.exports.killProcessTree = nativeBinding.killProcessTree
 module.exports.killProcessTreeGraceful = nativeBinding.killProcessTreeGraceful
 module.exports.logDebug = nativeBinding.logDebug
+module.exports.matchGlobPaths = nativeBinding.matchGlobPaths
+module.exports.matchOutputPaths = nativeBinding.matchOutputPaths
 module.exports.parseTaskStatus = nativeBinding.parseTaskStatus
 module.exports.remove = nativeBinding.remove
 module.exports.restoreTerminal = nativeBinding.restoreTerminal

package/dist/src/native/native-file-cache-location.d.ts

@@ -1 +1,17 @@
-export declare function getNativeFileCacheLocation(): string;
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+export declare const NATIVE_CACHE_ROOT: string;
+export declare function getNativeFileCacheLocationToDelete(): string | null;
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+export declare function ensureSecureNativeFileCacheLocation(cacheRoot?: string): string | null;

package/dist/src/native/native-file-cache-location.js

@@ -1,23 +1,97 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getNativeFileCacheLocation = getNativeFileCacheLocation;
-const os_1 = require("os");
+exports.NATIVE_CACHE_ROOT = void 0;
+exports.getNativeFileCacheLocationToDelete = getNativeFileCacheLocationToDelete;
+exports.ensureSecureNativeFileCacheLocation = ensureSecureNativeFileCacheLocation;
 const path_1 = require("path");
-const crypto_1 = require("crypto");
-const workspace_root_1 = require("../utils/workspace-root");
+const fs_1 = require("fs");
+const nx_tmp_dir_1 = require("../utils/nx-tmp-dir");
 const versions_1 = require("../utils/versions");
-function getNativeFileCacheLocation() {
-    if (process.env.NX_NATIVE_FILE_CACHE_DIRECTORY) {
-        return process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+const owned_private_dir_1 = require("../utils/owned-private-dir");
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+exports.NATIVE_CACHE_ROOT = (0, path_1.join)(nx_tmp_dir_1.NX_USER_TMP_DIR, 'native-cache');
+/**
+ * The configured cache dir, normalized. `resolve` strips a trailing slash, which
+ * would otherwise defeat the guards downstream: `lstat` on a path ending in `/`
+ * resolves a symlink rather than reporting it, and `O_NOFOLLOW` then opens the
+ * target. `NX_SOCKET_DIR` is normalized for the same reason.
+ */
+function configuredCacheDir() {
+    const dir = process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+    return dir ? (0, path_1.resolve)(dir) : undefined;
+}
+function getNativeFileCacheLocationToDelete() {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        // Checked for ownership before it is handed to a recursive delete: being
+        // configured does not make it ours. Weaker than the load path below, which
+        // also enforces mode and validates the version directory.
+        return (0, owned_private_dir_1.isOwnedRealDirectory)(configured) ? configured : null;
     }
-    else {
-        const hash = (0, crypto_1.createHash)('sha256').update(workspace_root_1.workspaceRoot).update(versions_1.nxVersion);
+    return (0, owned_private_dir_1.isSafeSharedRoot)(nx_tmp_dir_1.NX_TMP_DIR).status === 'ok' &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(nx_tmp_dir_1.NX_USER_TMP_DIR) &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(exports.NATIVE_CACHE_ROOT)
+        ? (0, path_1.join)(exports.NATIVE_CACHE_ROOT, versions_1.nxVersion)
+        : null;
+}
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+function ensureSecureNativeFileCacheLocation(
+// Test seam: lets a spec plant a hostile directory under a root it controls.
+cacheRoot = exports.NATIVE_CACHE_ROOT) {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        const dir = configured;
         try {
-            hash.update((0, os_1.userInfo)().username);
+            // Held to the same 0700 bar as the default location: a `.node` is loaded
+            // out of here. Unlike NX_SOCKET_DIR it is not additionally refused for
+            // naming one of Nx's own roots, which is the only case that throws.
+            (0, fs_1.mkdirSync)((0, path_1.dirname)(dir), { recursive: true });
+            const established = (0, owned_private_dir_1.ensureOwnedPrivateDir)(dir);
+            if (established.status !== 'ok') {
+                // The guard's own reason rather than a fixed sentence: `not-created
+                // (EACCES)` and `foreign-owner` are exactly what the catch below
+                // promises to tell apart, and one string for all of them cannot.
+                throw new owned_private_dir_1.DirectoryRefusedError(established.refusal);
+            }
+            return dir;
         }
         catch (e) {
-            // if there's no user, we only use the workspace root for the hash and move on
+            // Never discard a configured directory silently — the socket directory
+            // follows the same rule. A typo, EACCES or EROFS is otherwise
+            // indistinguishable from a working cache.
+            console.warn(`Nx could not use the configured native file cache directory ${dir} (${e?.code ?? e?.message ?? e}). Loading the native binding in place instead.`);
+            return null;
+        }
+    }
+    const userRoot = (0, path_1.dirname)(cacheRoot);
+    const sharedRoot = (0, path_1.dirname)(userRoot);
+    // Outermost first: the stable shared container must either belong to root or
+    // to us, and must be sticky if peers can write there. The uid directory then
+    // becomes the owner-only boundary for sockets and native-cache alike.
+    if ((0, owned_private_dir_1.ensureSafeSharedRoot)(sharedRoot).status !== 'ok') {
+        return null;
+    }
+    for (const root of [userRoot, cacheRoot]) {
+        if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(root).status !== 'ok') {
+            return null;
         }
-        return (0, path_1.join)((0, os_1.tmpdir)(), `nx-native-file-cache-${hash.digest('hex').substring(0, 7)}`);
     }
+    // Verified, not assumed: this is the directory we load a `.node` out of.
+    const versionDir = (0, path_1.join)(cacheRoot, versions_1.nxVersion);
+    if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(versionDir).status !== 'ok') {
+        return null;
+    }
+    return versionDir;
 }

package/dist/src/nx-cloud/generators/connect-to-nx-cloud/connect-to-nx-cloud.js

@@ -6,7 +6,7 @@ const child_process_1 = require("child_process");
 const output_1 = require("../../../utils/output");
 const json_1 = require("../../../generators/utils/json");
 const nx_json_1 = require("../../../generators/utils/nx-json");
-const format_changed_files_with_prettier_if_available_1 = require("../../../generators/internal-utils/format-changed-files-with-prettier-if-available");
+const format_changed_files_1 = require("../../../generators/internal-utils/format-changed-files");
 const url_shorten_1 = require("../../utilities/url-shorten");
 const get_cloud_options_1 = require("../../utilities/get-cloud-options");
 const path_1 = require("path");
@@ -137,14 +137,14 @@ async function connectToNxCloud(tree, schema, nxJson = (0, nx_json_1.readNxJson)
     }
     if (responseFromCreateNxCloudWorkspaceV2) {
         addNxCloudIdToNxJson(tree, responseFromCreateNxCloudWorkspaceV2?.nxCloudId, schema.directory);
-        await (0, format_changed_files_with_prettier_if_available_1.formatChangedFilesWithPrettierIfAvailable)(tree, {
+        await (0, format_changed_files_1.formatChangedFiles)(tree, {
             silent: schema.hideFormatLogs,
         });
         return responseFromCreateNxCloudWorkspaceV2.nxCloudId;
     }
     else if (responseFromCreateNxCloudWorkspaceV1) {
         addNxCloudAccessTokenToNxJson(tree, responseFromCreateNxCloudWorkspaceV1?.token, schema.directory);
-        await (0, format_changed_files_with_prettier_if_available_1.formatChangedFilesWithPrettierIfAvailable)(tree, {
+        await (0, format_changed_files_1.formatChangedFiles)(tree, {
             silent: schema.hideFormatLogs,
         });
         return responseFromCreateNxCloudWorkspaceV1.token;

package/dist/src/nx-cloud/utilities/get-cloud-options.js

@@ -5,12 +5,15 @@ exports.getCloudUrl = getCloudUrl;
 exports.removeTrailingSlash = removeTrailingSlash;
 exports.isNxCloudId = isNxCloudId;
 const nx_json_1 = require("../../config/nx-json");
-const run_command_1 = require("../../tasks-runner/run-command");
 const workspace_root_1 = require("../../utils/workspace-root");
 function getCloudOptions(directory = workspace_root_1.workspaceRoot) {
+    // Required lazily: this module is reachable from the @nx/devkit/internal
+    // barrel that plugin workers load, and run-command eagerly pulls in the whole
+    // task-execution subsystem.
+    const { getRunnerOptions, } = require('../../tasks-runner/run-command');
     const nxJson = (0, nx_json_1.readNxJson)(directory);
     // TODO: The default is not always cloud? But it's not handled at the moment
-    return (0, run_command_1.getRunnerOptions)('default', nxJson, {}, true);
+    return getRunnerOptions('default', nxJson, {}, true);
 }
 function getCloudUrl() {
     return removeTrailingSlash(process.env.NX_CLOUD_API || process.env.NRWL_API || `https://cloud.nx.app`);

package/dist/src/nx-cloud/utilities/onboarding.js

@@ -5,7 +5,6 @@ exports.getNxCloudAppOnBoardingUrl = getNxCloudAppOnBoardingUrl;
 exports.readNxCloudToken = readNxCloudToken;
 const is_workspace_claimed_1 = require("./is-workspace-claimed");
 const url_shorten_1 = require("./url-shorten");
-const run_command_1 = require("../../tasks-runner/run-command");
 const nx_json_1 = require("../../generators/utils/nx-json");
 async function createNxCloudOnboardingURLForWelcomeApp(tree, token) {
     token = token || readNxCloudToken(tree);
@@ -22,7 +21,11 @@ async function getNxCloudAppOnBoardingUrl(token) {
     return onboardingUrl;
 }
 function readNxCloudToken(tree) {
+    // Required lazily: this module is re-exported from the @nx/devkit/internal
+    // barrel that plugin workers load, and run-command eagerly pulls in the whole
+    // task-execution subsystem.
+    const { getRunnerOptions, } = require('../../tasks-runner/run-command');
     const nxJson = (0, nx_json_1.readNxJson)(tree);
-    const { accessToken, nxCloudId } = (0, run_command_1.getRunnerOptions)('default', nxJson, {}, true);
+    const { accessToken, nxCloudId } = getRunnerOptions('default', nxJson, {}, true);
     return accessToken || nxCloudId;
 }

package/dist/src/nx-cloud/utilities/url-shorten.d.ts

@@ -1,5 +1,2 @@
-/**
- * This is currently duplicated in Nx Console. Please let @MaxKless know if you make changes here.
- */
-export declare function createNxCloudOnboardingURL(onboardingSource: string, accessToken?: string, meta?: string, forceManual?: boolean, forceGithub?: boolean, directory?: string): Promise<string>;
+export declare function createNxCloudOnboardingURL(onboardingSource: string, accessToken?: string, meta?: string, forceManual?: boolean, forceGithub?: boolean, directory?: string, signal?: AbortSignal): Promise<string>;
 export declare function getURLifShortenFailed(usesGithub: boolean, githubSlug: string | null, apiUrl: string, source: string, accessToken?: string): string;

package/dist/src/nx-cloud/utilities/url-shorten.js

@@ -5,13 +5,14 @@ exports.getURLifShortenFailed = getURLifShortenFailed;
 const logger_1 = require("../../utils/logger");
 const get_cloud_options_1 = require("./get-cloud-options");
 const git_utils_1 = require("../../utils/git-utils");
-/**
- * This is currently duplicated in Nx Console. Please let @MaxKless know if you make changes here.
- */
-async function createNxCloudOnboardingURL(onboardingSource, accessToken, meta, forceManual = false, forceGithub = false, directory) {
+async function createNxCloudOnboardingURL(onboardingSource, accessToken, meta, forceManual = false, forceGithub = false, directory, 
+// Aborting tears down the in-flight request; without it a caller that stops
+// waiting (see prefetchRemoteCacheOnboardingUrl) leaves the socket holding
+// the event loop open, since axios has no default timeout.
+signal) {
     const remoteInfo = (0, git_utils_1.getVcsRemoteInfo)(directory);
     const apiUrl = (0, get_cloud_options_1.getCloudUrl)();
-    const installationSupportsGitHub = await getInstallationSupportsGitHub(apiUrl);
+    const installationSupportsGitHub = await getInstallationSupportsGitHub(apiUrl, signal);
     let usesGithub = false;
     if (forceGithub) {
         usesGithub = installationSupportsGitHub;
@@ -32,7 +33,7 @@ async function createNxCloudOnboardingURL(onboardingSource, accessToken, meta, f
             selectedRepositoryName: remoteInfo?.slug ?? null,
             repositoryDomain: remoteInfo?.domain ?? null,
             meta,
-        });
+        }, { signal });
         if (!response?.data || response.data.message) {
             throw new Error(response?.data?.message ?? 'Failed to shorten Nx Cloud URL');
         }
@@ -66,9 +67,9 @@ function getURLifShortenFailed(usesGithub, githubSlug, apiUrl, source, accessTok
     }
     return `${apiUrl}/setup/connect-workspace/manual?accessToken=${accessToken}&source=${source}`;
 }
-async function getInstallationSupportsGitHub(apiUrl) {
+async function getInstallationSupportsGitHub(apiUrl, signal) {
     try {
-        const response = await require('axios').get(`${apiUrl}/nx-cloud/system/features`);
+        const response = await require('axios').get(`${apiUrl}/nx-cloud/system/features`, { signal });
         if (!response?.data || response.data.message) {
             throw new Error(response?.data?.message ?? 'Failed to shorten Nx Cloud URL');
         }

package/dist/src/plugins/js/lock-file/bun-parser.js

@@ -12,6 +12,16 @@ const project_graph_1 = require("../../../config/project-graph");
 const file_hasher_1 = require("../../../hasher/file-hasher");
 const project_graph_builder_1 = require("../../../project-graph/project-graph-builder");
 const json_1 = require("../../../utils/json");
+// Highest bun.lock version this parser has been verified against:
+// - 1: workspace packages are no longer listed with their dependencies
+// - 2: identical content, stricter validation in Bun's own reader
+// - 3: values in "overrides" may be objects holding rules scoped to a parent
+//      package (`"parent": { "child": "1.0.0" }`) and keys may carry a version
+//      selector (`"parent@1"`, `"child@<2"`). This parser never reads
+//      "overrides"; the resolved packages are listed in "packages" as before.
+// Newer versions are parsed on a best-effort basis instead of being rejected
+// outright.
+const MAX_KNOWN_LOCKFILE_VERSION = 3;
 const DEPENDENCY_TYPES = [
     'dependencies',
     'devDependencies',
@@ -356,9 +366,12 @@ function parseLockFile(lockFileContent, lockFileHash) {
             if (typeof result.lockfileVersion !== 'number') {
                 throw new Error(`Lockfile version must be a number, got ${typeof result.lockfileVersion}`);
             }
-            const supportedVersions = [0, 1];
-            if (!supportedVersions.includes(result.lockfileVersion)) {
-                throw new Error(`Unsupported lockfile version ${result.lockfileVersion}. Supported versions: ${supportedVersions.join(', ')}`);
+            if (!Number.isInteger(result.lockfileVersion) ||
+                result.lockfileVersion < 0) {
+                throw new Error(`Unsupported lockfile version ${result.lockfileVersion}. Lockfile version must be a non-negative integer`);
+            }
+            if (result.lockfileVersion > MAX_KNOWN_LOCKFILE_VERSION) {
+                console.warn(`bun.lock has lockfileVersion ${result.lockfileVersion}, which is newer than the version ${MAX_KNOWN_LOCKFILE_VERSION} this version of Nx was tested with. Attempting to parse it anyway.`);
             }
         }
         if (!result.packages || typeof result.packages !== 'object') {
@@ -616,7 +629,7 @@ function processPackageForDependencies(packageKey, packageData, lockFile, index,
         const deps = packageDependencies[depType];
         if (!deps || typeof deps !== 'object')
             continue;
-        const depDependencies = processDependencyEntries(deps, sourceNodeName, index, ctx, workspacePackages, lockFile.manifests);
+        const depDependencies = processDependencyEntries(deps, packageKey, sourceNodeName, lockFile, index, ctx, workspacePackages);
         dependencies.push(...depDependencies);
     }
     return dependencies;
@@ -634,12 +647,12 @@ function extractPackageDependencies(packageData) {
     }
     return undefined;
 }
-function processDependencyEntries(deps, sourceNodeName, index, ctx, workspacePackages, manifests) {
+function processDependencyEntries(deps, sourcePackageKey, sourceNodeName, lockFile, index, ctx, workspacePackages) {
     const dependencies = [];
     const depsEntries = Object.entries(deps);
     for (const [packageName, versionSpec] of depsEntries) {
         try {
-            const dependency = processSingleDependency(packageName, versionSpec, sourceNodeName, index, ctx, workspacePackages, manifests);
+            const dependency = processSingleDependency(packageName, versionSpec, sourcePackageKey, sourceNodeName, lockFile, index, ctx, workspacePackages);
             if (dependency) {
                 dependencies.push(dependency);
             }
@@ -650,7 +663,7 @@ function processDependencyEntries(deps, sourceNodeName, index, ctx, workspacePac
     }
     return dependencies;
 }
-function processSingleDependency(packageName, versionSpec, sourceNodeName, index, ctx, workspacePackages, manifests) {
+function processSingleDependency(packageName, versionSpec, sourcePackageKey, sourceNodeName, lockFile, index, ctx, workspacePackages) {
     if (typeof packageName !== 'string' || typeof versionSpec !== 'string') {
         return null;
     }
@@ -663,14 +676,22 @@ function processSingleDependency(packageName, versionSpec, sourceNodeName, index
     }
     let targetPackageName = packageName;
     let targetVersion = versionSpec;
-    const aliasTarget = resolveAliasTarget(versionSpec);
-    if (aliasTarget) {
+    // A "<parent>/<name>" entry records what this parent actually resolved the
+    // dependency to. Overrides scoped to a parent (bun.lock v3) can pick a
+    // version outside the declared range, so it takes precedence over matching
+    // the range against the versions in the lockfile.
+    const nestedVersion = resolveNestedVersion(sourcePackageKey, packageName, lockFile);
+    const aliasTarget = nestedVersion ? null : resolveAliasTarget(versionSpec);
+    if (nestedVersion) {
+        targetVersion = nestedVersion;
+    }
+    else if (aliasTarget) {
         targetPackageName = aliasTarget.packageName;
         targetVersion = aliasTarget.version;
     }
     else {
         // O(1) lookup using index instead of O(n) scan
-        const resolvedVersion = findResolvedVersion(packageName, versionSpec, index, manifests);
+        const resolvedVersion = findResolvedVersion(packageName, versionSpec, index, lockFile.manifests);
         if (!resolvedVersion) {
             return null;
         }
@@ -693,6 +714,18 @@ function processSingleDependency(packageName, versionSpec, sourceNodeName, index
         return null;
     }
 }
+function resolveNestedVersion(sourcePackageKey, packageName, lockFile) {
+    const nestedEntry = lockFile.packages[`${sourcePackageKey}/${packageName}`];
+    if (!Array.isArray(nestedEntry) || typeof nestedEntry[0] !== 'string') {
+        return null;
+    }
+    const { name, version } = getCachedSpecInfo(nestedEntry[0]);
+    // aliases ("alias@npm:real@1.0.0") are resolved to the real package by the caller
+    if (name !== packageName || !version || version.startsWith('npm:')) {
+        return null;
+    }
+    return version;
+}
 function resolveTargetNodeName(targetPackageName, targetVersion, ctx) {
     const hoistedNodeName = `npm:${targetPackageName}`;
     const versionedNodeName = `npm:${targetPackageName}@${targetVersion}`;

package/dist/src/plugins/js/lock-file/lock-file.d.ts

@@ -35,9 +35,51 @@ export declare function getLockFilePath(packageManager: PackageManager): string;
 /**
  * Create lock file based on the root level lock file and (pruned) package.json
  *
- * @param packageJson
- * @param isProduction
- * @param packageManager
- * @returns
+ * A pruned pnpm lockfile no longer declares the resolution-time pnpm config it
+ * bakes into its snapshots, so the config is dropped from `packageJson` too:
+ * pnpm 10 and below validate the manifest against the lockfile and abort a
+ * frozen install with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH when the two disagree.
+ * An inherited `pnpm.patchedDependencies` goes with it, since the prune scopes
+ * the lockfile's patches to the packages that survive it and rewrites their
+ * paths onto the output.
+ * The manifest is left alone for npm and yarn, which never read that block.
+ * Mutating it means callers must write or emit the manifest after this returns.
+ *
+ * The lockfile alone does not make a complete pnpm output. A workspace
+ * declaring build-script approvals, patches or vendored local paths also needs
+ * the artifacts `generatePrunedDeployOutput` ships, and this warns when that is
+ * the case.
+ *
+ * On a pruning error the root lockfile is returned as a fail-open fallback,
+ * with the manifest left as authored.
+ *
+ * @deprecated Use `generatePrunedDeployOutput` instead. This will be removed in Nx 25.
  */
 export declare function createLockFile(packageJson: PackageJson, graph: ProjectGraph, packageManager?: PackageManager): string;
+type PrunedDeploySink = {
+    outputDirectory: string;
+    emit?: never;
+} | {
+    emit: (path: string, content: string | Buffer) => void;
+    outputDirectory?: never;
+};
+/**
+ * Generates the standalone deploy output a generate-package-json flow ships
+ * alongside its manifest: the pruned lockfile and, for pnpm, the install-time
+ * artifacts that lockfile needs (the settings-only pnpm-workspace.yaml, the
+ * `pnpm patch` files, and the vendored non-workspace local-path dependencies).
+ * `options` carries either an `outputDirectory` to write into or an `emit` sink
+ * for a bundler's asset pipeline, never both.
+ *
+ * Mutates `packageJson` into the form the output must ship (the relocated
+ * local-path specifiers, the pnpm config strip, the pnpm <=10 build settings),
+ * so write or emit the manifest after this returns.
+ *
+ * Bun has no lockfile generation, so it warns and ships nothing, leaving the
+ * manifest as authored.
+ */
+export declare function generatePrunedDeployOutput(packageJson: PackageJson, graph: ProjectGraph, projectRoot: string, options: PrunedDeploySink & {
+    packageManager: PackageManager;
+    workspaceRoot?: string;
+}): void;
+export {};