[Bug]: `js_image_layer` error reading aspect_rules_js_metadata.json

[tbarrella]

What happened?

Hello,

I'm encountering an issue with js_image_layer + pnpm v8/v9 related to pnpm.onlyBuiltDependencies:

ERROR: .../app/BUILD.bazel:85:16: JsImageLayer package_store_3p //app:layer failed: (Exit 1): tar failed: error executing JsImageLayer command (from target //app:layer) external/aspect_bazel_lib++toolchains+bsd_tar_darwin_arm64/tar --create --file bazel-out/darwin_arm64-fastbuild/bin/app/layer_package_store_3p.tar.gz --gzip '--options=gzip:!timestamp' ... (remaining 1 argument skipped)
...
tar: Error reading archive bazel-out/darwin_arm64-fastbuild/bin/app/layer_package_store_3p.mtree: Can't open bazel-out/darwin_arm64-fastbuild/bin/node_modules/.aspect_rules_js/agent-base@7.1.3/node_modules/agent-base/aspect_rules_js_metadata.json

Version

Development (host) and target OS/architectures: macos arm64

Output of bazel --version: 8.2.1

Version of the Aspect rules, or other relevant rules from your
WORKSPACE or MODULE.bazel file: 2.3.5

Language(s) and/or frameworks involved: JS

How to reproduce

Roughly,
1. Build a `js_image_layer` target
2. Modify package.json to remove one of the layer's dependencies from `onlyBuiltDependencies`
3. Rebuild the `js_image_layer` target

Any other information?

Step 1 produces a file declared here

$(bazel info bazel-bin)/app/layer_package_store_3p.mtree

including the line

./app/app.runfiles/_main/node_modules/.aspect_rules_js/agent-base@7.1.3/node_modules/agent-base/aspect_rules_js_metadata.json uid=0 gid=0 time=0 mode=0555 type=file content=bazel-out/darwin_arm64-fastbuild/bin/node_modules/.aspect_rules_js/agent-base@7.1.3/node_modules/agent-base/aspect_rules_js_metadata.json

Which is still there on step 3, even though step 2 caused aspect_rules_js_metadata.json (created here) to go away

One way we can fix this is to make the js_image_layer binary depend on package.json, although is this the right way/is there something else we should do? It seems maybe this "splitter" action should have package.json (v8/v9, I think pnpm-workspace.yaml for v10) as an input somehow since it depends on onlyBuiltDependencies