nx 23.3.0-beta.0 → 23.3.0-beta.2

package/dist/src/utils/command-line-utils.js

@@ -198,12 +198,13 @@ function getUncommittedFiles() {
         '--name-only',
         '--no-renames',
         '--relative',
+        '-z',
         'HEAD',
         '.',
     ]);
 }
 function getUntrackedFiles() {
-    return parseGitOutput(['ls-files', '--others', '--exclude-standard']);
+    return parseGitOutput(['ls-files', '--others', '--exclude-standard', '-z']);
 }
 function getMergeBase(base, head = 'HEAD') {
     (0, git_revision_1.assertValidGitRevision)(base);
@@ -230,6 +231,7 @@ function getFilesUsingBaseAndHead(base, head) {
         '--name-only',
         '--no-renames',
         '--relative',
+        '-z',
         base,
         head,
     ]);
@@ -242,11 +244,16 @@ function runGit(args) {
         windowsHide: true,
     });
 }
+/**
+ * Parses NUL-terminated paths, so callers must pass `-z`, and must pass it
+ * before the pathspec — git fatals on a `-z` that follows one. Without `-z` git
+ * escapes paths that contain non-ASCII or quoting characters, and honours
+ * `core.quotepath`, which is on by default.
+ */
 function parseGitOutput(args) {
     return runGit(args)
         .toString('utf-8')
-        .split('\n')
-        .map((a) => a.trim())
+        .split('\0')
         .filter((a) => a.length > 0);
 }
 function getProjectRoots(projectNames, { nodes }) {

package/dist/src/utils/formatters/index.d.ts

@@ -1,4 +1,6 @@
 import type { Tree } from '../../generators/tree';
+import { getOxfmtBinPath } from './oxfmt';
+import { getPrettierPath } from './prettier';
 /**
  * Adding a member here does NOT reliably break compilation: the repo builds
  * with `strict: false`, so a `switch` that omits one is not an error. The
@@ -7,6 +9,10 @@ import type { Tree } from '../../generators/tree';
  * its emitted declarations, so those only fail once it has been rebuilt.
  */
 export type FormatterType = 'prettier' | 'oxfmt';
+export declare const resolveFormatterBin: {
+    oxfmt: typeof getOxfmtBinPath;
+    prettier: typeof getPrettierPath;
+};
 /** Test-only: the warn-once flag is module state and would leak between cases. */
 export declare function resetFormatterWarningsForTesting(): void;
 export declare function detectFormatter(root: string): FormatterType | null;

package/dist/src/utils/formatters/index.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveFormatterBin = void 0;
 exports.resetFormatterWarningsForTesting = resetFormatterWarningsForTesting;
 exports.detectFormatter = detectFormatter;
 exports.detectFormatterInTree = detectFormatterInTree;
@@ -10,6 +11,10 @@ const fileutils_1 = require("../fileutils");
 const oxfmt_1 = require("./oxfmt");
 const prettier_1 = require("./prettier");
 const logger_1 = require("../logger");
+exports.resolveFormatterBin = {
+    oxfmt: oxfmt_1.getOxfmtBinPath,
+    prettier: prettier_1.getPrettierPath,
+};
 // Once per process: detection runs on every one of 200+ `formatFiles` call sites.
 let warnedBothConfigured = false;
 function warnBothConfigured() {

package/dist/src/utils/formatters/prettier.d.ts

@@ -16,11 +16,3 @@ export declare function filterToPrettierSupportedFiles(files: string[]): Promise
 export declare function writeWithPrettier(patterns: string[], cwd?: string): void;
 export declare function checkWithPrettier(patterns: string[]): Promise<string[]>;
 export declare function getPrettierPath(): string;
-/**
- * Quote a pattern for prettier's shell-based exec calls; oxfmt uses execFile
- * and takes raw paths.
- *
- * Exported so `nx format` can size its chunks against the quoted length -
- * patterns are chunked before they get here, and quoting grows each one.
- */
-export declare function quoteForShell(pattern: string): string;

package/dist/src/utils/formatters/prettier.js

@@ -7,7 +7,6 @@ exports.filterToPrettierSupportedFiles = filterToPrettierSupportedFiles;
 exports.writeWithPrettier = writeWithPrettier;
 exports.checkWithPrettier = checkWithPrettier;
 exports.getPrettierPath = getPrettierPath;
-exports.quoteForShell = quoteForShell;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
@@ -98,19 +97,17 @@ cwd) {
     if (patterns.length === 0) {
         // Prettier with no file arguments reads stdin, and `stdio: [0, 1, 2]` hands
         // it nx's own - from a terminal it blocks forever with nothing on screen. At
-        // EOF it exits 0 under `--list-different` and 2 (which `execSync` throws on)
+        // EOF it exits 0 under `--list-different` and 2 (which `execFileSync` throws on)
         // without it, so which failure you get depends on `shouldUseListDifferent`.
         return;
     }
     const prettierPath = getPrettierPath();
-    const listDifferentArg = shouldUseListDifferent() ? '--list-different ' : '';
+    const listDifferentArg = shouldUseListDifferent() ? ['--list-different'] : [];
     // No `--parser json` special case for `.swcrc`: prettier's own language table
     // maps it to the json parser, so it formats correctly on its own (measured).
     // Splitting the batch also meant one of the two spawns could receive zero
     // files, which is the error above.
-    (0, node_child_process_1.execSync)(`node ${quoteForShell(prettierPath)} --write ${listDifferentArg}-- ${patterns
-        .map(quoteForShell)
-        .join(' ')}`, {
+    (0, node_child_process_1.execFileSync)(process.execPath, [prettierPath, '--write', ...listDifferentArg, '--', ...patterns], {
         cwd,
         stdio: [0, 1, 2],
         windowsHide: true,
@@ -119,9 +116,7 @@ cwd) {
 function checkWithPrettier(patterns) {
     const prettierPath = getPrettierPath();
     return new Promise((resolve, reject) => {
-        (0, node_child_process_1.exec)(`node ${quoteForShell(prettierPath)} --list-different -- ${patterns
-            .map(quoteForShell)
-            .join(' ')}`, { encoding: 'utf-8', windowsHide: true, maxBuffer: shared_1.FORMATTER_MAX_BUFFER }, (error, stdout) => {
+        (0, node_child_process_1.execFile)(process.execPath, [prettierPath, '--list-different', '--', ...patterns], { encoding: 'utf-8', windowsHide: true, maxBuffer: shared_1.FORMATTER_MAX_BUFFER }, (error, stdout) => {
             if (error) {
                 // As the oxfmt sibling: a spawn failure, kill or maxBuffer overrun reports a
                 // string `code` or none. Prettier signals "files differ" numerically, so
@@ -182,20 +177,3 @@ function shouldUseListDifferent() {
     }
     return useListDifferent;
 }
-/**
- * Quote a pattern for prettier's shell-based exec calls; oxfmt uses execFile
- * and takes raw paths.
- *
- * Exported so `nx format` can size its chunks against the quoted length -
- * patterns are chunked before they get here, and quoting grows each one.
- */
-function quoteForShell(pattern) {
-    // Interpolated into a command string, so every character special *inside
-    // double quotes* needs escaping, not just `$`: a backtick substitutes, `"`
-    // closes the quoting, `\` escapes what follows. One pass over the original,
-    // since `String.replace` never re-scans what it inserted.
-    const escaped = process.platform !== 'win32'
-        ? pattern.replace(/([\\"`$])/g, '\\$1')
-        : pattern;
-    return `"${escaped}"`;
-}

package/dist/src/utils/handle-errors.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleErrors = handleErrors;
+const error_types_1 = require("../project-graph/error-types");
 const logger_1 = require("./logger");
 const output_1 = require("./output");
 const handle_import_1 = require("./handle-import");
@@ -17,35 +18,9 @@ async function handleErrors(isVerbose, fn) {
         if (err.constructor.name === 'UnsuccessfulWorkflowExecution') {
             logger_1.logger.error('The generator workflow failed. See above.');
         }
-        else if (err.name === 'ProjectGraphError') {
-            const projectGraphError = err;
-            let title = projectGraphError.message;
-            if (projectGraphError.cause &&
-                typeof projectGraphError.cause === 'object' &&
-                'message' in projectGraphError.cause) {
-                title += ' ' + projectGraphError.cause.message + '.';
-            }
-            output_1.output.error({
-                title,
-                bodyLines: isVerbose
-                    ? formatErrorStackAndCause(projectGraphError, isVerbose)
-                    : projectGraphError.getErrors().map((e) => e.message),
-            });
-        }
-        else if (err.name === 'ProjectConfigurationsError') {
-            const projectConfigurationsError = err;
-            let title = projectConfigurationsError.message;
-            if (projectConfigurationsError.cause &&
-                typeof projectConfigurationsError.cause === 'object' &&
-                'message' in projectConfigurationsError.cause) {
-                title += ' ' + projectConfigurationsError.cause.message + '.';
-            }
-            output_1.output.error({
-                title,
-                bodyLines: isVerbose
-                    ? formatErrorStackAndCause(projectConfigurationsError, isVerbose)
-                    : projectConfigurationsError.errors.map((e) => e.message),
-            });
+        else if (err.name === 'ProjectGraphError' ||
+            err.name === 'ProjectConfigurationsError') {
+            output_1.output.error((0, error_types_1.formatProjectGraphError)(err, isVerbose));
         }
         else if (err.name === 'MinReleaseAgeViolationError') {
             // A cooldown violation already carries a user-shaped headline plus
@@ -59,7 +34,7 @@ async function handleErrors(isVerbose, fn) {
             const lines = (err.message ? err.message : err.toString()).split('\n');
             const bodyLines = lines.slice(1);
             if (isVerbose) {
-                bodyLines.push(...formatErrorStackAndCause(err, isVerbose));
+                bodyLines.push((0, error_types_1.formatErrorStackAndCause)(err));
             }
             else if (err.stack) {
                 bodyLines.push('Pass --verbose to see the stacktrace.');
@@ -76,16 +51,3 @@ async function handleErrors(isVerbose, fn) {
         return 1;
     }
 }
-function formatErrorStackAndCause(error, verbose) {
-    return [
-        verbose ? error.stack || error.message : error.message,
-        ...(error.cause && typeof error.cause === 'object'
-            ? [
-                'Caused by:',
-                verbose && 'stack' in error.cause
-                    ? error.cause.stack.toString()
-                    : error.cause.toString(),
-            ]
-            : []),
-    ];
-}

package/dist/src/utils/installed-nx-version.js

@@ -4,8 +4,6 @@ exports.getInstalledVersion = getInstalledVersion;
 exports.getInstalledNxVersion = getInstalledNxVersion;
 exports.getInstalledLegacyNrwlWorkspaceVersion = getInstalledLegacyNrwlWorkspaceVersion;
 exports.getInstalledPackageGroup = getInstalledPackageGroup;
-const tslib_1 = require("tslib");
-const node_module_1 = tslib_1.__importStar(require("node:module"));
 const fileutils_1 = require("./fileutils");
 const package_json_1 = require("./package-json");
 const workspace_root_1 = require("./workspace-root");
@@ -15,15 +13,11 @@ const installation_directory_1 = require("./installation-directory");
  * resolver. The resolver always reflects the workspace's `node_modules`/PnP
  * store rather than whichever copy happens to be loaded in the current process
  * (e.g. the temp `nx@latest` install used by the migrate bootstrap). See
- * nrwl/nx#35444 and `resolvePackageJsonWithoutCachePollution` below.
+ * nrwl/nx#35444 and `resolveWithoutCachePollution`.
  */
 function readInstalledPackageJson(packageName) {
-    const path = resolvePackageJsonWithoutCachePollution(packageName, (0, installation_directory_1.getNxRequirePaths)(workspace_root_1.workspaceRoot));
-    if (!path) {
-        return null;
-    }
     try {
-        return (0, fileutils_1.readJsonFile)(path);
+        return (0, fileutils_1.readJsonFile)((0, package_json_1.resolveWithoutCachePollution)(`${packageName}/package.json`, (0, installation_directory_1.getNxRequirePaths)(workspace_root_1.workspaceRoot)));
     }
     catch {
         return null;
@@ -71,43 +65,3 @@ function getInstalledPackageGroup(packageName) {
     }
     return set;
 }
-/**
- * Resolve `<packageName>/package.json` via Node's CJS resolver while
- * neutralising both ways `require.resolve(req, { paths })` can lie about
- * the `paths` argument:
- *
- *   1. Process-wide `Module._pathCache` — swapped out for the duration of
- *      the call, so any cache entries written are discarded and any
- *      previously-poisoned entries are not read. Without this, an
- *      in-process load of a second `nx` package (e.g. the temp `nx@latest`
- *      install used by the daemon's AI-agents and console-status checks)
- *      can poison the cache key this call uses and make us read the temp
- *      path instead of the workspace path.
- *
- *   2. Package self-reference — when a file inside package `nx` calls
- *      `require.resolve('nx/...')`, Node returns that calling package's
- *      own file regardless of `paths`. We avoid that by issuing the
- *      resolve from a `createRequire` rooted at a synthetic path that is
- *      outside any package, so the resolver has no "self" to reference
- *      and must honour `paths`.
- *
- * Node's single-threaded synchronous execution means `require.resolve` does
- * not yield, so no other code in the process can observe the swapped cache.
- */
-function resolvePackageJsonWithoutCachePollution(packageName, requirePaths) {
-    // `_pathCache` is an internal Node API not exposed in @types/node.
-    const realCache = node_module_1.default._pathCache;
-    node_module_1.default._pathCache = Object.create(null);
-    try {
-        const detachedRequire = (0, node_module_1.createRequire)('/__nx_detached_resolver__/x.js');
-        return detachedRequire.resolve(`${packageName}/package.json`, {
-            paths: requirePaths,
-        });
-    }
-    catch {
-        return null;
-    }
-    finally {
-        node_module_1.default._pathCache = realCache;
-    }
-}

package/dist/src/utils/min-release-age/packument.js

@@ -17,7 +17,7 @@ function toArray(value) {
  */
 async function fetchRegistryMetadata(pkg) {
     const raw = await (0, package_manager_1.packageRegistryView)(pkg, '', ['--json']);
-    const parsed = JSON.parse(raw);
+    const parsed = (0, package_manager_1.parseRegistryViewJson)(raw);
     const time = parsed.time ?? null;
     if (time) {
         // The time map carries 'created'/'modified' alongside versions; they are

package/dist/src/utils/output.d.ts

@@ -12,14 +12,33 @@ export type CollapsibleTaskStatus = Extract<TaskStatus, 'success' | 'local-cache
  * routed, the two behave identically.
  */
 export declare function isStaticOutputStyle(outputStyle: string | undefined): boolean;
+/**
+ * Whether a style puts task output on the terminal at all.
+ *
+ * `summary` does not - it prints a status line and the path to each task's log,
+ * deliberately addressing the output instead of reproducing it. So every
+ * decision that would put a task's bytes on the terminal has to consult this
+ * first, including ones that bypass the life cycle: both batch folds and
+ * `BatchProcess`'s live forward write to `output` directly, and under `summary`
+ * each would dump exactly what the style exists to keep off the screen.
+ *
+ * Withholding is only half of it. Whatever a caller suppresses here has to be
+ * readable somewhere else, because the style's contract is that the output
+ * moved, not that it is gone - `BatchProcess` captures to a file rather than
+ * dropping, and `runBatch` hands its path to the life cycle.
+ */
+export declare function printsTaskOutput(outputStyle: string | undefined): boolean;
 /**
  * Whether a run prints every task's output in full rather than collapsing the
  * ones that succeeded. Both static life cycles and the batch renderer have to
  * agree on this, so they read it from here rather than each deriving it.
  *
- * Exactly one style collapses, and it is also what a run that named no style
- * gets. Every other style prints in full because it was asked for explicitly,
- * so none may quietly withhold output. Note the static life cycles serve more
+ * Two styles collapse. `static-failures-only` shows only what failed, and is
+ * what a run that named no style gets; `summary` withholds task output
+ * altogether, addressing each log by path instead, and outranks `verbose` -
+ * asking for more detail cannot turn a style whose whole contract is "the
+ * output is on disk" back into one that prints. Every other style prints in
+ * full because it was asked for explicitly. Note the static life cycles serve more
  * styles than the static-sounding ones: `shouldUseDynamicLifeCycle` bails on
  * `isCI()` before it looks at the style at all, so in CI `dynamic` and `tui`
  * land here too. This is written as a deny-list for that reason — a new style

package/dist/src/utils/output.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.output = void 0;
 exports.isStaticOutputStyle = isStaticOutputStyle;
+exports.printsTaskOutput = printsTaskOutput;
 exports.printsFullTaskOutput = printsFullTaskOutput;
 exports.isLogGroupingEnabled = isLogGroupingEnabled;
 exports.shouldGroupBatchOutput = shouldGroupBatchOutput;
@@ -23,14 +24,35 @@ const GH_GROUP_SUFFIX = '::endgroup::';
 function isStaticOutputStyle(outputStyle) {
     return outputStyle === 'static' || outputStyle === 'static-failures-only';
 }
+/**
+ * Whether a style puts task output on the terminal at all.
+ *
+ * `summary` does not - it prints a status line and the path to each task's log,
+ * deliberately addressing the output instead of reproducing it. So every
+ * decision that would put a task's bytes on the terminal has to consult this
+ * first, including ones that bypass the life cycle: both batch folds and
+ * `BatchProcess`'s live forward write to `output` directly, and under `summary`
+ * each would dump exactly what the style exists to keep off the screen.
+ *
+ * Withholding is only half of it. Whatever a caller suppresses here has to be
+ * readable somewhere else, because the style's contract is that the output
+ * moved, not that it is gone - `BatchProcess` captures to a file rather than
+ * dropping, and `runBatch` hands its path to the life cycle.
+ */
+function printsTaskOutput(outputStyle) {
+    return outputStyle !== 'summary';
+}
 /**
  * Whether a run prints every task's output in full rather than collapsing the
  * ones that succeeded. Both static life cycles and the batch renderer have to
  * agree on this, so they read it from here rather than each deriving it.
  *
- * Exactly one style collapses, and it is also what a run that named no style
- * gets. Every other style prints in full because it was asked for explicitly,
- * so none may quietly withhold output. Note the static life cycles serve more
+ * Two styles collapse. `static-failures-only` shows only what failed, and is
+ * what a run that named no style gets; `summary` withholds task output
+ * altogether, addressing each log by path instead, and outranks `verbose` -
+ * asking for more detail cannot turn a style whose whole contract is "the
+ * output is on disk" back into one that prints. Every other style prints in
+ * full because it was asked for explicitly. Note the static life cycles serve more
  * styles than the static-sounding ones: `shouldUseDynamicLifeCycle` bails on
  * `isCI()` before it looks at the style at all, so in CI `dynamic` and `tui`
  * land here too. This is written as a deny-list for that reason — a new style
@@ -43,8 +65,9 @@ function isStaticOutputStyle(outputStyle) {
  * ever being consulted — including for the continuous tasks that must stream.
  */
 function printsFullTaskOutput(args) {
-    return (!!args.verbose ||
-        (args.outputStyle ?? 'static-failures-only') !== 'static-failures-only');
+    return (printsTaskOutput(args.outputStyle) &&
+        (!!args.verbose ||
+            (args.outputStyle ?? 'static-failures-only') !== 'static-failures-only'));
 }
 /**
  * Whether task output should be wrapped in collapsible log groups. Grouping

package/dist/src/utils/package-json.d.ts

@@ -143,6 +143,31 @@ export declare function readModulePackageJson(moduleSpecifier: string, requirePa
     packageJson: PackageJson;
     path: string;
 };
+/**
+ * Resolve `request` via Node's CJS resolver while neutralising both ways
+ * `require.resolve(req, { paths })` can lie about the `paths` argument:
+ *
+ *   1. Process-wide `Module._pathCache`. It is swapped out for the duration
+ *      of the call, so any cache entries written are discarded and any
+ *      previously-poisoned entries are not read. Without this, an
+ *      in-process load of a second `nx` package (e.g. the temp `nx@latest`
+ *      install used by the daemon's AI-agents and console-status checks)
+ *      can poison the cache key this call uses and make us read the temp
+ *      path instead of the workspace path.
+ *
+ *   2. Package self-reference. When a file inside package `nx` calls
+ *      `require.resolve('nx/...')`, Node returns that calling package's
+ *      own file regardless of `paths`. We avoid that by issuing the
+ *      resolve from a `createRequire` rooted at a synthetic path that is
+ *      outside any package, so the resolver has no "self" to reference
+ *      and must honour `paths`.
+ *
+ * Node's single-threaded synchronous execution means `require.resolve` does
+ * not yield, so no other code in the process can observe the swapped cache.
+ *
+ * Throws like `require.resolve` when nothing matches.
+ */
+export declare function resolveWithoutCachePollution(request: string, requirePaths: string[]): string;
 export declare function installPackageToTmp(pkg: string, requiredVersion: string, packageManager: PackageManager): {
     tempDir: string;
     cleanup: () => void;

package/dist/src/utils/package-json.js

@@ -8,12 +8,15 @@ exports.getTagsFromPackageJson = getTagsFromPackageJson;
 exports.readTargetsFromPackageJson = readTargetsFromPackageJson;
 exports.readModulePackageJsonWithoutFallbacks = readModulePackageJsonWithoutFallbacks;
 exports.readModulePackageJson = readModulePackageJson;
+exports.resolveWithoutCachePollution = resolveWithoutCachePollution;
 exports.installPackageToTmp = installPackageToTmp;
 exports.installPackageToTmpAsync = installPackageToTmpAsync;
 exports.getDependencyVersionFromPackageJson = getDependencyVersionFromPackageJson;
+const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const fs_1 = require("fs");
+const node_module_1 = tslib_1.__importStar(require("node:module"));
 const path_1 = require("path");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 const tmp_1 = require("tmp");
@@ -169,9 +172,7 @@ function readTargetsFromPackageJson(packageJson, nxJson, projectRoot, workspaceR
  * @returns package json contents and path
  */
 function readModulePackageJsonWithoutFallbacks(moduleSpecifier, requirePaths = (0, installation_directory_1.getNxRequirePaths)()) {
-    const packageJsonPath = require.resolve(`${moduleSpecifier}/package.json`, {
-        paths: requirePaths,
-    });
+    const packageJsonPath = resolveWithoutCachePollution(`${moduleSpecifier}/package.json`, requirePaths);
     const packageJson = (0, fileutils_1.readJsonFile)(packageJsonPath);
     return {
         path: packageJsonPath,
@@ -200,9 +201,7 @@ function readModulePackageJson(moduleSpecifier, requirePaths = (0, installation_
             readModulePackageJsonWithoutFallbacks(moduleSpecifier, requirePaths));
     }
     catch {
-        const entryPoint = require.resolve(moduleSpecifier, {
-            paths: requirePaths,
-        });
+        const entryPoint = resolveWithoutCachePollution(moduleSpecifier, requirePaths);
         let moduleRootPath = (0, path_1.dirname)(entryPoint);
         packageJsonPath = (0, path_1.join)(moduleRootPath, 'package.json');
         while (!(0, fs_1.existsSync)(packageJsonPath)) {
@@ -219,6 +218,42 @@ function readModulePackageJson(moduleSpecifier, requirePaths = (0, installation_
         path: packageJsonPath,
     };
 }
+/**
+ * Resolve `request` via Node's CJS resolver while neutralising both ways
+ * `require.resolve(req, { paths })` can lie about the `paths` argument:
+ *
+ *   1. Process-wide `Module._pathCache`. It is swapped out for the duration
+ *      of the call, so any cache entries written are discarded and any
+ *      previously-poisoned entries are not read. Without this, an
+ *      in-process load of a second `nx` package (e.g. the temp `nx@latest`
+ *      install used by the daemon's AI-agents and console-status checks)
+ *      can poison the cache key this call uses and make us read the temp
+ *      path instead of the workspace path.
+ *
+ *   2. Package self-reference. When a file inside package `nx` calls
+ *      `require.resolve('nx/...')`, Node returns that calling package's
+ *      own file regardless of `paths`. We avoid that by issuing the
+ *      resolve from a `createRequire` rooted at a synthetic path that is
+ *      outside any package, so the resolver has no "self" to reference
+ *      and must honour `paths`.
+ *
+ * Node's single-threaded synchronous execution means `require.resolve` does
+ * not yield, so no other code in the process can observe the swapped cache.
+ *
+ * Throws like `require.resolve` when nothing matches.
+ */
+function resolveWithoutCachePollution(request, requirePaths) {
+    // `_pathCache` is an internal Node API not exposed in @types/node.
+    const realCache = node_module_1.default._pathCache;
+    node_module_1.default._pathCache = Object.create(null);
+    try {
+        const detachedRequire = (0, node_module_1.createRequire)('/__nx_detached_resolver__/x.js');
+        return detachedRequire.resolve(request, { paths: requirePaths });
+    }
+    finally {
+        node_module_1.default._pathCache = realCache;
+    }
+}
 /**
  * Prepares all necessary information for installing a package to a temporary directory.
  * This is used by both sync and async installation functions.

package/dist/src/utils/package-manager.d.ts

@@ -130,6 +130,12 @@ export declare function getWorkspaceRegistryUrlForDisplay(pkg: string): string |
 export declare function packageRegistryView(pkg: string, version: string, args: string[], options?: {
     forceNpm?: boolean;
 }): Promise<string>;
+/**
+ * Parses `npm view --json` output. npm 12 wraps the result in an array even
+ * when a single version matches; npm <= 11 and pnpm print the bare value. A
+ * multi-version match (range spec) stays an array.
+ */
+export declare function parseRegistryViewJson<T = unknown>(raw: string): T;
 /**
  * Only `npm pack` supports downloading a tarball of a specified remote
  * package. `yarn` packs the active workspace, `pnpm pack` only packs

package/dist/src/utils/package-manager.js

@@ -15,6 +15,7 @@ exports.resolvePackageVersionUsingRegistry = resolvePackageVersionUsingRegistry;
 exports.resolvePackageVersionUsingInstallation = resolvePackageVersionUsingInstallation;
 exports.getWorkspaceRegistryUrlForDisplay = getWorkspaceRegistryUrlForDisplay;
 exports.packageRegistryView = packageRegistryView;
+exports.parseRegistryViewJson = parseRegistryViewJson;
 exports.packageRegistryPack = packageRegistryPack;
 exports.clearPackageManagerVersionCache = clearPackageManagerVersionCache;
 exports.getPackageWorkspaces = getPackageWorkspaces;
@@ -705,6 +706,15 @@ options) {
         throw redactErrorCause(e);
     }
 }
+/**
+ * Parses `npm view --json` output. npm 12 wraps the result in an array even
+ * when a single version matches; npm <= 11 and pnpm print the bare value. A
+ * multi-version match (range spec) stays an array.
+ */
+function parseRegistryViewJson(raw) {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) && parsed.length === 1 ? parsed[0] : parsed;
+}
 /**
  * Only `npm pack` supports downloading a tarball of a specified remote
  * package. `yarn` packs the active workspace, `pnpm pack` only packs

package/dist/src/utils/plugins/plugin-capabilities.js

@@ -63,12 +63,17 @@ async function tryGetModule(packageJson, workspaceRoot) {
             packageJson['nx-migrations'] ??
             packageJson['schematics'] ??
             packageJson['builders']) {
-            const [pluginPromise] = (0, in_process_loader_1.loadNxPlugin)(packageJson.name, workspaceRoot);
-            return await pluginPromise;
+            return await (0, in_process_loader_1.loadNxPlugin)(packageJson.name, workspaceRoot);
         }
         else {
             return {
                 name: packageJson.name,
+                capabilities: () => ({
+                    hasCreateDependencies: false,
+                    hasCreateMetadata: false,
+                    hasPreTasksExecution: false,
+                    hasPostTasksExecution: false,
+                }),
             };
         }
     }

package/dist/src/utils/provenance.js

@@ -13,6 +13,15 @@ const package_manager_1 = require("./package-manager");
  *
  * Will throw if the package does not have valid provenance.
  */
+/**
+ * A build the publish workflow cuts from master rather than from a tag:
+ * `23.3.0-pr.36841.f66e88b` from a pull request, `23.2.0-canary.20260908-89f02c1`
+ * from the nightly. Each segment is matched with its leading digits so an
+ * ordinary prerelease like `1.0.0-preview.1` does not qualify.
+ */
+function isPublishedFromMaster(version) {
+    return /-pr\.\d+\./.test(version) || /-canary\.\d/.test(version);
+}
 async function ensurePackageHasProvenance(packageName, packageVersion) {
     // this is used for locally released versions without provenance
     // do not set this for other reasons or you might be exposed to security risks
@@ -25,8 +34,8 @@ async function ensurePackageHasProvenance(packageName, packageVersion) {
             '--silent',
         ]);
         const parsed = JSON.parse(result);
-        // `npm view <pkg>@<spec> --json` returns a bare object on npm <= 11 but an
-        // array on npm 12 and pnpm, even for a single resolved version. A version
+        // `npm view <pkg>@<spec> --json` returns a bare object on npm <= 11 and
+        // pnpm but an array on npm 12, even for a single resolved version. A version
         // range matches several versions and the registry lists all of them
         // (including deprecated ones the installer skips), so we cannot tell which
         // one will actually be installed; refuse rather than verify the wrong
@@ -57,8 +66,15 @@ async function ensurePackageHasProvenance(packageName, packageVersion) {
         if (workflowParameters.path !== '.github/workflows/publish.yml') {
             throw new ProvenanceError(packageName, packageVersion, 'Publishing workflow does not match .github/workflows/publish.yml');
         }
-        if (workflowParameters.ref !== `refs/tags/${npmViewResult.version}`) {
-            throw new ProvenanceError(packageName, packageVersion, `Version ref does not match refs/tags/${npmViewResult.version}`);
+        // PR and canary releases are published by this same workflow running on
+        // master, so a tag for them does not exist and never will. Repository,
+        // workflow path and the artifact digest are still checked, so this only
+        // widens which ref of nrwl/nx is allowed to have built it.
+        const allowedRefs = isPublishedFromMaster(npmViewResult.version)
+            ? [`refs/tags/${npmViewResult.version}`, 'refs/heads/master']
+            : [`refs/tags/${npmViewResult.version}`];
+        if (!allowedRefs.includes(workflowParameters.ref)) {
+            throw new ProvenanceError(packageName, packageVersion, `Version ref does not match ${allowedRefs.join(' or ')}`);
         }
         // verify that provenance was generated from the exact same artifact as the one we are installing
         const distSha = Buffer.from(npmViewResult.dist.integrity.replace('sha512-', ''), 'base64').toString('hex');

package/dist/src/utils/serialize-overrides-into-command-line.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.serializeOverridesIntoCommandLine = serializeOverridesIntoCommandLine;
-const flat_1 = require("flat");
 const shell_quoting_1 = require("./shell-quoting");
 function serializeOverridesIntoCommandLine(options) {
     const unparsed = options._ ? [...options._] : [];
@@ -24,9 +23,8 @@ function serializeOption(key, value, unparsed) {
         value.forEach((item) => serializeOption(key, item, unparsed));
     }
     else if (Object.prototype.toString.call(value) === '[object Object]') {
-        const flattened = (0, flat_1.flatten)(value, { safe: true });
-        for (const flattenedKey in flattened) {
-            serializeOption(`${key}.${flattenedKey}`, flattened[flattenedKey], unparsed);
+        for (const nestedKey of Object.keys(value)) {
+            serializeOption(`${key}.${nestedKey}`, value[nestedKey], unparsed);
         }
     }
     else if (typeof value === 'string' &&