# nsx lock

Resolve every module declared in nsx.yml to its current upstream commit and content hash, and write the resulting nsx.lock receipt. Does not modify the modules/ tree.

## Usage

```text
nsx lock [-h] [--app-dir APP_DIR] [--update] [--module MODULES]
                [--check] [--timeout SECONDS]
```

## Options

| Option | Value | Default | Description |
| --- | --- | --- | --- |
| --app-dir APP_DIR | value | . | App directory containing nsx.yml |
| --update | flag | optional | Re-resolve constraints to current upstream tip (otherwise reuses prior SHAs) |
| --module MODULE | repeatable | optional | Only re-resolve the named module (may be repeated; implies --update) |
| --check | flag | optional | Exit non-zero if nsx.lock is out of date with nsx.yml (do not write); useful in CI |
| --timeout SECONDS | value | optional | Wall-clock budget per subprocess (seconds). Kills the whole process group on timeout. |

`-v/--verbose`, `-q/--quiet` are parsed by `nsx` itself, so they go before the command name, as `nsx -v lock`.