nx 23.2.1 → 23.3.0-beta.1

package/dist/src/utils/chunkify.js

@@ -3,18 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.chunkify = chunkify;
 exports.getMaxArgLength = getMaxArgLength;
 const TERMINAL_SIZE = getMaxArgLength();
-function chunkify(target, maxChunkLength = TERMINAL_SIZE - 500, 
-/**
- * How long each entry will be once it reaches the command line. Callers that
- * quote or escape afterwards pass that transformation's length here, so the
- * chunk is sized against what is actually spawned rather than the raw string.
- */
-measure = (item) => item.length) {
+function chunkify(target, maxChunkLength = TERMINAL_SIZE - 500) {
     const chunks = [];
     let currentChunk = [];
     let currentChunkLength = 0;
     for (const file of target) {
-        const length = measure(file);
+        const length = file.length;
         if (
         // Prevent empty chunk if first file path is longer than maxChunkLength
         currentChunk.length &&

package/dist/src/utils/command-line-utils.d.ts

@@ -1,6 +1,7 @@
 import type { Arguments } from 'yargs';
 import { NxJsonConfiguration } from '../config/nx-json';
 import { ProjectGraph } from '../config/project-graph';
+import type { OutputStyle } from '../command-line/yargs-utils/shared-options';
 export interface RawNxArgs extends NxArgs {
     prod?: boolean;
 }
@@ -28,6 +29,24 @@ export interface NxArgs {
     graph?: string | boolean;
     skipNxCache?: boolean;
     skipRemoteCache?: boolean;
+    /**
+     * The style the user named - CLI flag or `NX_DEFAULT_OUTPUT_STYLE`. Left
+     * undefined when they named none, and that absence is load-bearing: it is how
+     * the streaming and renderer-selection decisions tell "the user wants static"
+     * from "we defaulted to static", which stream continuous tasks differently.
+     */
+    specifiedOutputStyle?: OutputStyle;
+    /**
+     * What the run actually renders with, after the TUI, agent and failures-only
+     * defaults are applied. Always set. Every decision about what to PRINT reads
+     * this; every decision about what the user ASKED FOR reads the field above.
+     */
+    resolvedOutputStyle?: OutputStyle;
+    /**
+     * @deprecated Read `specifiedOutputStyle` for what the user named, or
+     * `resolvedOutputStyle` for what the run renders with. This will be removed
+     * in Nx 24.
+     */
     outputStyle?: string;
     tui?: boolean;
     nxBail?: boolean;

package/dist/src/utils/command-line-utils.js

@@ -198,12 +198,13 @@ function getUncommittedFiles() {
         '--name-only',
         '--no-renames',
         '--relative',
+        '-z',
         'HEAD',
         '.',
     ]);
 }
 function getUntrackedFiles() {
-    return parseGitOutput(['ls-files', '--others', '--exclude-standard']);
+    return parseGitOutput(['ls-files', '--others', '--exclude-standard', '-z']);
 }
 function getMergeBase(base, head = 'HEAD') {
     (0, git_revision_1.assertValidGitRevision)(base);
@@ -230,6 +231,7 @@ function getFilesUsingBaseAndHead(base, head) {
         '--name-only',
         '--no-renames',
         '--relative',
+        '-z',
         base,
         head,
     ]);
@@ -242,11 +244,16 @@ function runGit(args) {
         windowsHide: true,
     });
 }
+/**
+ * Parses NUL-terminated paths, so callers must pass `-z`, and must pass it
+ * before the pathspec — git fatals on a `-z` that follows one. Without `-z` git
+ * escapes paths that contain non-ASCII or quoting characters, and honours
+ * `core.quotepath`, which is on by default.
+ */
 function parseGitOutput(args) {
     return runGit(args)
         .toString('utf-8')
-        .split('\n')
-        .map((a) => a.trim())
+        .split('\0')
         .filter((a) => a.length > 0);
 }
 function getProjectRoots(projectNames, { nodes }) {

package/dist/src/utils/formatters/index.d.ts

@@ -1,4 +1,6 @@
 import type { Tree } from '../../generators/tree';
+import { getOxfmtBinPath } from './oxfmt';
+import { getPrettierPath } from './prettier';
 /**
  * Adding a member here does NOT reliably break compilation: the repo builds
  * with `strict: false`, so a `switch` that omits one is not an error. The
@@ -7,6 +9,10 @@ import type { Tree } from '../../generators/tree';
  * its emitted declarations, so those only fail once it has been rebuilt.
  */
 export type FormatterType = 'prettier' | 'oxfmt';
+export declare const resolveFormatterBin: {
+    oxfmt: typeof getOxfmtBinPath;
+    prettier: typeof getPrettierPath;
+};
 /** Test-only: the warn-once flag is module state and would leak between cases. */
 export declare function resetFormatterWarningsForTesting(): void;
 export declare function detectFormatter(root: string): FormatterType | null;

package/dist/src/utils/formatters/index.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveFormatterBin = void 0;
 exports.resetFormatterWarningsForTesting = resetFormatterWarningsForTesting;
 exports.detectFormatter = detectFormatter;
 exports.detectFormatterInTree = detectFormatterInTree;
@@ -10,6 +11,10 @@ const fileutils_1 = require("../fileutils");
 const oxfmt_1 = require("./oxfmt");
 const prettier_1 = require("./prettier");
 const logger_1 = require("../logger");
+exports.resolveFormatterBin = {
+    oxfmt: oxfmt_1.getOxfmtBinPath,
+    prettier: prettier_1.getPrettierPath,
+};
 // Once per process: detection runs on every one of 200+ `formatFiles` call sites.
 let warnedBothConfigured = false;
 function warnBothConfigured() {

package/dist/src/utils/formatters/prettier.d.ts

@@ -16,11 +16,3 @@ export declare function filterToPrettierSupportedFiles(files: string[]): Promise
 export declare function writeWithPrettier(patterns: string[], cwd?: string): void;
 export declare function checkWithPrettier(patterns: string[]): Promise<string[]>;
 export declare function getPrettierPath(): string;
-/**
- * Quote a pattern for prettier's shell-based exec calls; oxfmt uses execFile
- * and takes raw paths.
- *
- * Exported so `nx format` can size its chunks against the quoted length -
- * patterns are chunked before they get here, and quoting grows each one.
- */
-export declare function quoteForShell(pattern: string): string;

package/dist/src/utils/formatters/prettier.js

@@ -7,7 +7,6 @@ exports.filterToPrettierSupportedFiles = filterToPrettierSupportedFiles;
 exports.writeWithPrettier = writeWithPrettier;
 exports.checkWithPrettier = checkWithPrettier;
 exports.getPrettierPath = getPrettierPath;
-exports.quoteForShell = quoteForShell;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
@@ -98,19 +97,17 @@ cwd) {
     if (patterns.length === 0) {
         // Prettier with no file arguments reads stdin, and `stdio: [0, 1, 2]` hands
         // it nx's own - from a terminal it blocks forever with nothing on screen. At
-        // EOF it exits 0 under `--list-different` and 2 (which `execSync` throws on)
+        // EOF it exits 0 under `--list-different` and 2 (which `execFileSync` throws on)
         // without it, so which failure you get depends on `shouldUseListDifferent`.
         return;
     }
     const prettierPath = getPrettierPath();
-    const listDifferentArg = shouldUseListDifferent() ? '--list-different ' : '';
+    const listDifferentArg = shouldUseListDifferent() ? ['--list-different'] : [];
     // No `--parser json` special case for `.swcrc`: prettier's own language table
     // maps it to the json parser, so it formats correctly on its own (measured).
     // Splitting the batch also meant one of the two spawns could receive zero
     // files, which is the error above.
-    (0, node_child_process_1.execSync)(`node ${quoteForShell(prettierPath)} --write ${listDifferentArg}-- ${patterns
-        .map(quoteForShell)
-        .join(' ')}`, {
+    (0, node_child_process_1.execFileSync)(process.execPath, [prettierPath, '--write', ...listDifferentArg, '--', ...patterns], {
         cwd,
         stdio: [0, 1, 2],
         windowsHide: true,
@@ -119,9 +116,7 @@ cwd) {
 function checkWithPrettier(patterns) {
     const prettierPath = getPrettierPath();
     return new Promise((resolve, reject) => {
-        (0, node_child_process_1.exec)(`node ${quoteForShell(prettierPath)} --list-different -- ${patterns
-            .map(quoteForShell)
-            .join(' ')}`, { encoding: 'utf-8', windowsHide: true, maxBuffer: shared_1.FORMATTER_MAX_BUFFER }, (error, stdout) => {
+        (0, node_child_process_1.execFile)(process.execPath, [prettierPath, '--list-different', '--', ...patterns], { encoding: 'utf-8', windowsHide: true, maxBuffer: shared_1.FORMATTER_MAX_BUFFER }, (error, stdout) => {
             if (error) {
                 // As the oxfmt sibling: a spawn failure, kill or maxBuffer overrun reports a
                 // string `code` or none. Prettier signals "files differ" numerically, so
@@ -182,20 +177,3 @@ function shouldUseListDifferent() {
     }
     return useListDifferent;
 }
-/**
- * Quote a pattern for prettier's shell-based exec calls; oxfmt uses execFile
- * and takes raw paths.
- *
- * Exported so `nx format` can size its chunks against the quoted length -
- * patterns are chunked before they get here, and quoting grows each one.
- */
-function quoteForShell(pattern) {
-    // Interpolated into a command string, so every character special *inside
-    // double quotes* needs escaping, not just `$`: a backtick substitutes, `"`
-    // closes the quoting, `\` escapes what follows. One pass over the original,
-    // since `String.replace` never re-scans what it inserted.
-    const escaped = process.platform !== 'win32'
-        ? pattern.replace(/([\\"`$])/g, '\\$1')
-        : pattern;
-    return `"${escaped}"`;
-}

package/dist/src/utils/installed-nx-version.js

@@ -4,8 +4,6 @@ exports.getInstalledVersion = getInstalledVersion;
 exports.getInstalledNxVersion = getInstalledNxVersion;
 exports.getInstalledLegacyNrwlWorkspaceVersion = getInstalledLegacyNrwlWorkspaceVersion;
 exports.getInstalledPackageGroup = getInstalledPackageGroup;
-const tslib_1 = require("tslib");
-const node_module_1 = tslib_1.__importStar(require("node:module"));
 const fileutils_1 = require("./fileutils");
 const package_json_1 = require("./package-json");
 const workspace_root_1 = require("./workspace-root");
@@ -15,15 +13,11 @@ const installation_directory_1 = require("./installation-directory");
  * resolver. The resolver always reflects the workspace's `node_modules`/PnP
  * store rather than whichever copy happens to be loaded in the current process
  * (e.g. the temp `nx@latest` install used by the migrate bootstrap). See
- * nrwl/nx#35444 and `resolvePackageJsonWithoutCachePollution` below.
+ * nrwl/nx#35444 and `resolveWithoutCachePollution`.
  */
 function readInstalledPackageJson(packageName) {
-    const path = resolvePackageJsonWithoutCachePollution(packageName, (0, installation_directory_1.getNxRequirePaths)(workspace_root_1.workspaceRoot));
-    if (!path) {
-        return null;
-    }
     try {
-        return (0, fileutils_1.readJsonFile)(path);
+        return (0, fileutils_1.readJsonFile)((0, package_json_1.resolveWithoutCachePollution)(`${packageName}/package.json`, (0, installation_directory_1.getNxRequirePaths)(workspace_root_1.workspaceRoot)));
     }
     catch {
         return null;
@@ -71,43 +65,3 @@ function getInstalledPackageGroup(packageName) {
     }
     return set;
 }
-/**
- * Resolve `<packageName>/package.json` via Node's CJS resolver while
- * neutralising both ways `require.resolve(req, { paths })` can lie about
- * the `paths` argument:
- *
- *   1. Process-wide `Module._pathCache` — swapped out for the duration of
- *      the call, so any cache entries written are discarded and any
- *      previously-poisoned entries are not read. Without this, an
- *      in-process load of a second `nx` package (e.g. the temp `nx@latest`
- *      install used by the daemon's AI-agents and console-status checks)
- *      can poison the cache key this call uses and make us read the temp
- *      path instead of the workspace path.
- *
- *   2. Package self-reference — when a file inside package `nx` calls
- *      `require.resolve('nx/...')`, Node returns that calling package's
- *      own file regardless of `paths`. We avoid that by issuing the
- *      resolve from a `createRequire` rooted at a synthetic path that is
- *      outside any package, so the resolver has no "self" to reference
- *      and must honour `paths`.
- *
- * Node's single-threaded synchronous execution means `require.resolve` does
- * not yield, so no other code in the process can observe the swapped cache.
- */
-function resolvePackageJsonWithoutCachePollution(packageName, requirePaths) {
-    // `_pathCache` is an internal Node API not exposed in @types/node.
-    const realCache = node_module_1.default._pathCache;
-    node_module_1.default._pathCache = Object.create(null);
-    try {
-        const detachedRequire = (0, node_module_1.createRequire)('/__nx_detached_resolver__/x.js');
-        return detachedRequire.resolve(`${packageName}/package.json`, {
-            paths: requirePaths,
-        });
-    }
-    catch {
-        return null;
-    }
-    finally {
-        node_module_1.default._pathCache = realCache;
-    }
-}

package/dist/src/utils/min-release-age/packument.js

@@ -17,7 +17,7 @@ function toArray(value) {
  */
 async function fetchRegistryMetadata(pkg) {
     const raw = await (0, package_manager_1.packageRegistryView)(pkg, '', ['--json']);
-    const parsed = JSON.parse(raw);
+    const parsed = (0, package_manager_1.parseRegistryViewJson)(raw);
     const time = parsed.time ?? null;
     if (time) {
         // The time map carries 'created'/'modified' alongside versions; they are

package/dist/src/utils/output.d.ts

@@ -12,14 +12,33 @@ export type CollapsibleTaskStatus = Extract<TaskStatus, 'success' | 'local-cache
  * routed, the two behave identically.
  */
 export declare function isStaticOutputStyle(outputStyle: string | undefined): boolean;
+/**
+ * Whether a style puts task output on the terminal at all.
+ *
+ * `summary` does not - it prints a status line and the path to each task's log,
+ * deliberately addressing the output instead of reproducing it. So every
+ * decision that would put a task's bytes on the terminal has to consult this
+ * first, including ones that bypass the life cycle: both batch folds and
+ * `BatchProcess`'s live forward write to `output` directly, and under `summary`
+ * each would dump exactly what the style exists to keep off the screen.
+ *
+ * Withholding is only half of it. Whatever a caller suppresses here has to be
+ * readable somewhere else, because the style's contract is that the output
+ * moved, not that it is gone - `BatchProcess` captures to a file rather than
+ * dropping, and `runBatch` hands its path to the life cycle.
+ */
+export declare function printsTaskOutput(outputStyle: string | undefined): boolean;
 /**
  * Whether a run prints every task's output in full rather than collapsing the
  * ones that succeeded. Both static life cycles and the batch renderer have to
  * agree on this, so they read it from here rather than each deriving it.
  *
- * Exactly one style collapses, and it is also what a run that named no style
- * gets. Every other style prints in full because it was asked for explicitly,
- * so none may quietly withhold output. Note the static life cycles serve more
+ * Two styles collapse. `static-failures-only` shows only what failed, and is
+ * what a run that named no style gets; `summary` withholds task output
+ * altogether, addressing each log by path instead, and outranks `verbose` -
+ * asking for more detail cannot turn a style whose whole contract is "the
+ * output is on disk" back into one that prints. Every other style prints in
+ * full because it was asked for explicitly. Note the static life cycles serve more
  * styles than the static-sounding ones: `shouldUseDynamicLifeCycle` bails on
  * `isCI()` before it looks at the style at all, so in CI `dynamic` and `tui`
  * land here too. This is written as a deny-list for that reason — a new style

package/dist/src/utils/output.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.output = void 0;
 exports.isStaticOutputStyle = isStaticOutputStyle;
+exports.printsTaskOutput = printsTaskOutput;
 exports.printsFullTaskOutput = printsFullTaskOutput;
 exports.isLogGroupingEnabled = isLogGroupingEnabled;
 exports.shouldGroupBatchOutput = shouldGroupBatchOutput;
@@ -23,14 +24,35 @@ const GH_GROUP_SUFFIX = '::endgroup::';
 function isStaticOutputStyle(outputStyle) {
     return outputStyle === 'static' || outputStyle === 'static-failures-only';
 }
+/**
+ * Whether a style puts task output on the terminal at all.
+ *
+ * `summary` does not - it prints a status line and the path to each task's log,
+ * deliberately addressing the output instead of reproducing it. So every
+ * decision that would put a task's bytes on the terminal has to consult this
+ * first, including ones that bypass the life cycle: both batch folds and
+ * `BatchProcess`'s live forward write to `output` directly, and under `summary`
+ * each would dump exactly what the style exists to keep off the screen.
+ *
+ * Withholding is only half of it. Whatever a caller suppresses here has to be
+ * readable somewhere else, because the style's contract is that the output
+ * moved, not that it is gone - `BatchProcess` captures to a file rather than
+ * dropping, and `runBatch` hands its path to the life cycle.
+ */
+function printsTaskOutput(outputStyle) {
+    return outputStyle !== 'summary';
+}
 /**
  * Whether a run prints every task's output in full rather than collapsing the
  * ones that succeeded. Both static life cycles and the batch renderer have to
  * agree on this, so they read it from here rather than each deriving it.
  *
- * Exactly one style collapses, and it is also what a run that named no style
- * gets. Every other style prints in full because it was asked for explicitly,
- * so none may quietly withhold output. Note the static life cycles serve more
+ * Two styles collapse. `static-failures-only` shows only what failed, and is
+ * what a run that named no style gets; `summary` withholds task output
+ * altogether, addressing each log by path instead, and outranks `verbose` -
+ * asking for more detail cannot turn a style whose whole contract is "the
+ * output is on disk" back into one that prints. Every other style prints in
+ * full because it was asked for explicitly. Note the static life cycles serve more
  * styles than the static-sounding ones: `shouldUseDynamicLifeCycle` bails on
  * `isCI()` before it looks at the style at all, so in CI `dynamic` and `tui`
  * land here too. This is written as a deny-list for that reason — a new style
@@ -43,8 +65,9 @@ function isStaticOutputStyle(outputStyle) {
  * ever being consulted — including for the continuous tasks that must stream.
  */
 function printsFullTaskOutput(args) {
-    return (!!args.verbose ||
-        (args.outputStyle ?? 'static-failures-only') !== 'static-failures-only');
+    return (printsTaskOutput(args.outputStyle) &&
+        (!!args.verbose ||
+            (args.outputStyle ?? 'static-failures-only') !== 'static-failures-only'));
 }
 /**
  * Whether task output should be wrapped in collapsible log groups. Grouping

package/dist/src/utils/package-json.d.ts

@@ -143,6 +143,31 @@ export declare function readModulePackageJson(moduleSpecifier: string, requirePa
     packageJson: PackageJson;
     path: string;
 };
+/**
+ * Resolve `request` via Node's CJS resolver while neutralising both ways
+ * `require.resolve(req, { paths })` can lie about the `paths` argument:
+ *
+ *   1. Process-wide `Module._pathCache`. It is swapped out for the duration
+ *      of the call, so any cache entries written are discarded and any
+ *      previously-poisoned entries are not read. Without this, an
+ *      in-process load of a second `nx` package (e.g. the temp `nx@latest`
+ *      install used by the daemon's AI-agents and console-status checks)
+ *      can poison the cache key this call uses and make us read the temp
+ *      path instead of the workspace path.
+ *
+ *   2. Package self-reference. When a file inside package `nx` calls
+ *      `require.resolve('nx/...')`, Node returns that calling package's
+ *      own file regardless of `paths`. We avoid that by issuing the
+ *      resolve from a `createRequire` rooted at a synthetic path that is
+ *      outside any package, so the resolver has no "self" to reference
+ *      and must honour `paths`.
+ *
+ * Node's single-threaded synchronous execution means `require.resolve` does
+ * not yield, so no other code in the process can observe the swapped cache.
+ *
+ * Throws like `require.resolve` when nothing matches.
+ */
+export declare function resolveWithoutCachePollution(request: string, requirePaths: string[]): string;
 export declare function installPackageToTmp(pkg: string, requiredVersion: string, packageManager: PackageManager): {
     tempDir: string;
     cleanup: () => void;

package/dist/src/utils/package-json.js

@@ -8,12 +8,15 @@ exports.getTagsFromPackageJson = getTagsFromPackageJson;
 exports.readTargetsFromPackageJson = readTargetsFromPackageJson;
 exports.readModulePackageJsonWithoutFallbacks = readModulePackageJsonWithoutFallbacks;
 exports.readModulePackageJson = readModulePackageJson;
+exports.resolveWithoutCachePollution = resolveWithoutCachePollution;
 exports.installPackageToTmp = installPackageToTmp;
 exports.installPackageToTmpAsync = installPackageToTmpAsync;
 exports.getDependencyVersionFromPackageJson = getDependencyVersionFromPackageJson;
+const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const fs_1 = require("fs");
+const node_module_1 = tslib_1.__importStar(require("node:module"));
 const path_1 = require("path");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 const tmp_1 = require("tmp");
@@ -169,9 +172,7 @@ function readTargetsFromPackageJson(packageJson, nxJson, projectRoot, workspaceR
  * @returns package json contents and path
  */
 function readModulePackageJsonWithoutFallbacks(moduleSpecifier, requirePaths = (0, installation_directory_1.getNxRequirePaths)()) {
-    const packageJsonPath = require.resolve(`${moduleSpecifier}/package.json`, {
-        paths: requirePaths,
-    });
+    const packageJsonPath = resolveWithoutCachePollution(`${moduleSpecifier}/package.json`, requirePaths);
     const packageJson = (0, fileutils_1.readJsonFile)(packageJsonPath);
     return {
         path: packageJsonPath,
@@ -200,9 +201,7 @@ function readModulePackageJson(moduleSpecifier, requirePaths = (0, installation_
             readModulePackageJsonWithoutFallbacks(moduleSpecifier, requirePaths));
     }
     catch {
-        const entryPoint = require.resolve(moduleSpecifier, {
-            paths: requirePaths,
-        });
+        const entryPoint = resolveWithoutCachePollution(moduleSpecifier, requirePaths);
         let moduleRootPath = (0, path_1.dirname)(entryPoint);
         packageJsonPath = (0, path_1.join)(moduleRootPath, 'package.json');
         while (!(0, fs_1.existsSync)(packageJsonPath)) {
@@ -219,6 +218,42 @@ function readModulePackageJson(moduleSpecifier, requirePaths = (0, installation_
         path: packageJsonPath,
     };
 }
+/**
+ * Resolve `request` via Node's CJS resolver while neutralising both ways
+ * `require.resolve(req, { paths })` can lie about the `paths` argument:
+ *
+ *   1. Process-wide `Module._pathCache`. It is swapped out for the duration
+ *      of the call, so any cache entries written are discarded and any
+ *      previously-poisoned entries are not read. Without this, an
+ *      in-process load of a second `nx` package (e.g. the temp `nx@latest`
+ *      install used by the daemon's AI-agents and console-status checks)
+ *      can poison the cache key this call uses and make us read the temp
+ *      path instead of the workspace path.
+ *
+ *   2. Package self-reference. When a file inside package `nx` calls
+ *      `require.resolve('nx/...')`, Node returns that calling package's
+ *      own file regardless of `paths`. We avoid that by issuing the
+ *      resolve from a `createRequire` rooted at a synthetic path that is
+ *      outside any package, so the resolver has no "self" to reference
+ *      and must honour `paths`.
+ *
+ * Node's single-threaded synchronous execution means `require.resolve` does
+ * not yield, so no other code in the process can observe the swapped cache.
+ *
+ * Throws like `require.resolve` when nothing matches.
+ */
+function resolveWithoutCachePollution(request, requirePaths) {
+    // `_pathCache` is an internal Node API not exposed in @types/node.
+    const realCache = node_module_1.default._pathCache;
+    node_module_1.default._pathCache = Object.create(null);
+    try {
+        const detachedRequire = (0, node_module_1.createRequire)('/__nx_detached_resolver__/x.js');
+        return detachedRequire.resolve(request, { paths: requirePaths });
+    }
+    finally {
+        node_module_1.default._pathCache = realCache;
+    }
+}
 /**
  * Prepares all necessary information for installing a package to a temporary directory.
  * This is used by both sync and async installation functions.

package/dist/src/utils/package-manager.d.ts

@@ -130,6 +130,12 @@ export declare function getWorkspaceRegistryUrlForDisplay(pkg: string): string |
 export declare function packageRegistryView(pkg: string, version: string, args: string[], options?: {
     forceNpm?: boolean;
 }): Promise<string>;
+/**
+ * Parses `npm view --json` output. npm 12 wraps the result in an array even
+ * when a single version matches; npm <= 11 and pnpm print the bare value. A
+ * multi-version match (range spec) stays an array.
+ */
+export declare function parseRegistryViewJson<T = unknown>(raw: string): T;
 /**
  * Only `npm pack` supports downloading a tarball of a specified remote
  * package. `yarn` packs the active workspace, `pnpm pack` only packs

package/dist/src/utils/package-manager.js

@@ -15,6 +15,7 @@ exports.resolvePackageVersionUsingRegistry = resolvePackageVersionUsingRegistry;
 exports.resolvePackageVersionUsingInstallation = resolvePackageVersionUsingInstallation;
 exports.getWorkspaceRegistryUrlForDisplay = getWorkspaceRegistryUrlForDisplay;
 exports.packageRegistryView = packageRegistryView;
+exports.parseRegistryViewJson = parseRegistryViewJson;
 exports.packageRegistryPack = packageRegistryPack;
 exports.clearPackageManagerVersionCache = clearPackageManagerVersionCache;
 exports.getPackageWorkspaces = getPackageWorkspaces;
@@ -705,6 +706,15 @@ options) {
         throw redactErrorCause(e);
     }
 }
+/**
+ * Parses `npm view --json` output. npm 12 wraps the result in an array even
+ * when a single version matches; npm <= 11 and pnpm print the bare value. A
+ * multi-version match (range spec) stays an array.
+ */
+function parseRegistryViewJson(raw) {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) && parsed.length === 1 ? parsed[0] : parsed;
+}
 /**
  * Only `npm pack` supports downloading a tarball of a specified remote
  * package. `yarn` packs the active workspace, `pnpm pack` only packs

package/dist/src/utils/provenance.js

@@ -13,6 +13,15 @@ const package_manager_1 = require("./package-manager");
  *
  * Will throw if the package does not have valid provenance.
  */
+/**
+ * A build the publish workflow cuts from master rather than from a tag:
+ * `23.3.0-pr.36841.f66e88b` from a pull request, `23.2.0-canary.20260908-89f02c1`
+ * from the nightly. Each segment is matched with its leading digits so an
+ * ordinary prerelease like `1.0.0-preview.1` does not qualify.
+ */
+function isPublishedFromMaster(version) {
+    return /-pr\.\d+\./.test(version) || /-canary\.\d/.test(version);
+}
 async function ensurePackageHasProvenance(packageName, packageVersion) {
     // this is used for locally released versions without provenance
     // do not set this for other reasons or you might be exposed to security risks
@@ -25,8 +34,8 @@ async function ensurePackageHasProvenance(packageName, packageVersion) {
             '--silent',
         ]);
         const parsed = JSON.parse(result);
-        // `npm view <pkg>@<spec> --json` returns a bare object on npm <= 11 but an
-        // array on npm 12 and pnpm, even for a single resolved version. A version
+        // `npm view <pkg>@<spec> --json` returns a bare object on npm <= 11 and
+        // pnpm but an array on npm 12, even for a single resolved version. A version
         // range matches several versions and the registry lists all of them
         // (including deprecated ones the installer skips), so we cannot tell which
         // one will actually be installed; refuse rather than verify the wrong
@@ -57,8 +66,15 @@ async function ensurePackageHasProvenance(packageName, packageVersion) {
         if (workflowParameters.path !== '.github/workflows/publish.yml') {
             throw new ProvenanceError(packageName, packageVersion, 'Publishing workflow does not match .github/workflows/publish.yml');
         }
-        if (workflowParameters.ref !== `refs/tags/${npmViewResult.version}`) {
-            throw new ProvenanceError(packageName, packageVersion, `Version ref does not match refs/tags/${npmViewResult.version}`);
+        // PR and canary releases are published by this same workflow running on
+        // master, so a tag for them does not exist and never will. Repository,
+        // workflow path and the artifact digest are still checked, so this only
+        // widens which ref of nrwl/nx is allowed to have built it.
+        const allowedRefs = isPublishedFromMaster(npmViewResult.version)
+            ? [`refs/tags/${npmViewResult.version}`, 'refs/heads/master']
+            : [`refs/tags/${npmViewResult.version}`];
+        if (!allowedRefs.includes(workflowParameters.ref)) {
+            throw new ProvenanceError(packageName, packageVersion, `Version ref does not match ${allowedRefs.join(' or ')}`);
         }
         // verify that provenance was generated from the exact same artifact as the one we are installing
         const distSha = Buffer.from(npmViewResult.dist.integrity.replace('sha512-', ''), 'base64').toString('hex');

package/dist/src/utils/workspace-context.d.ts

@@ -1,5 +1,9 @@
-import type { NxWorkspaceFilesExternals } from '../native';
-export declare function setupWorkspaceContext(workspaceRoot: string): void;
+import type { ChangeBatch, NxWorkspaceFilesExternals, WorkspaceContext, WorkspaceContextOptions } from '../native';
+/** The shapes the native watch calls back with, taken from the binding. A
+ * failure arrives as an Error with no batch or events, so both are nullable. */
+export type WorkspaceChangesListener = Parameters<WorkspaceContext['onChanges']>[0];
+export type WatchEventsListener = Parameters<WorkspaceContext['onWatchEvents']>[0];
+export declare function setupWorkspaceContext(workspaceRoot: string, options?: WorkspaceContextOptions): void;
 export declare function getNxWorkspaceFilesFromContext(workspaceRoot: string, projectRootMap: Record<string, string>, useDaemonProcess?: boolean): Promise<import("../native").NxWorkspaceFiles>;
 /**
  * Sync method to get files matching globs from workspace context.
@@ -14,8 +18,48 @@ export declare function multiGlobWithWorkspaceContext(workspaceRoot: string, glo
 export declare function hashWithWorkspaceContext(workspaceRoot: string, globs: string[], exclude?: string[]): Promise<string>;
 export declare function hashMultiGlobWithWorkspaceContext(workspaceRoot: string, globGroups: string[][]): Promise<string[]>;
 export declare function updateContextWithChangedFiles(workspaceRoot: string, createdFiles: string[], updatedFiles: string[], deletedFiles: string[]): Promise<void>;
-export declare function updateFilesInContext(workspaceRoot: string, updatedFiles: string[], deletedFiles: string[]): Record<string, string>;
+/**
+ * The subset of `paths` the workspace file map holds: what the watch tracks,
+ * with the ignore rules applied.
+ */
+export declare function trackedFilesInContext(workspaceRoot: string, paths: string[]): string[];
+export declare function updateFilesInContext(workspaceRoot: string, updatedFiles: string[], deletedFiles: string[]): ChangeBatch;
 export declare function getAllFileDataInContext(workspaceRoot: string): Promise<import("../native").FileData[]>;
+/**
+ * Listens for the changes a watching context applies: each change reaches the
+ * listeners once, here or in `settleWorkspaceContext`, whichever takes it
+ * first. Any number of listeners may listen. Returns a function that stops
+ * this one.
+ */
+export declare function subscribeToWorkspaceChanges(workspaceRoot: string, listener: WorkspaceChangesListener): () => void;
+/**
+ * Applies every change the watcher has delivered, waiting out the kernel hop,
+ * and takes every change applied and not yet handed out. Empty when the
+ * context is not watching.
+ */
+export declare function settleWorkspaceContext(workspaceRoot: string): ChangeBatch;
+/**
+ * Takes every change applied and not yet handed out, without waiting for the
+ * watcher: for a caller that has just applied changes itself.
+ */
+export declare function takeAppliedWorkspaceChanges(workspaceRoot: string): ChangeBatch;
+export declare function isWatchingWorkspaceContext(): boolean;
+/**
+ * Listens for every event the context's watch delivers, including writes
+ * under ignored directories and the `rescan` marker. Any number of listeners
+ * may listen. Returns a function that stops this one.
+ */
+export declare function subscribeToWatchEvents(workspaceRoot: string, listener: WatchEventsListener): () => void;
+/** Whether a batch carries no change at all. */
+export declare function isEmptyBatch(batch: ChangeBatch): boolean;
+export declare function stopWatchingWorkspaceContext(): void;
 export declare function getFilesInDirectoryUsingContext(workspaceRoot: string, dir: string): Promise<string[]>;
 export declare function updateProjectFiles(projectRootMappings: Record<string, string>, rustReferences: NxWorkspaceFilesExternals, updatedFiles: Record<string, string>, deletedFiles: string[]): import("../native").UpdatedWorkspaceFiles;
+/**
+ * Re-walks the host's files so the archive its plugin workers load includes
+ * writes made since the last walk, such as a migration flushing to disk. The
+ * walk is selective and shared through the files lock; one still running is
+ * reused rather than repeated.
+ */
+export declare function refreshWorkspaceContext(workspaceRoot: string): void;
 export declare function resetWorkspaceContext(): void;