nx 23.0.0-beta.2 → 23.0.0-beta.21

package/dist/src/project-graph/utils/project-configuration/target-defaults.js

@@ -2,19 +2,51 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createTargetDefaultsResults = createTargetDefaultsResults;
 exports.readTargetDefaultsForTarget = readTargetDefaultsForTarget;
+exports.findBestTargetDefault = findBestTargetDefault;
+exports.normalizeTargetDefaults = normalizeTargetDefaults;
+exports.normalizeTargetDefaultsAgainstRootMaps = normalizeTargetDefaultsAgainstRootMaps;
+const tslib_1 = require("tslib");
 const minimatch_1 = require("minimatch");
+const find_matching_projects_1 = require("../../../utils/find-matching-projects");
 const globs_1 = require("../../../utils/globs");
+const source_maps_1 = require("./source-maps");
 const target_merging_1 = require("./target-merging");
 const utils_1 = require("./utils");
+const os_1 = require("os");
+const pc = tslib_1.__importStar(require("picocolors"));
 /**
  * Builds a synthetic plugin result from nx.json's `targetDefaults`, layered
  * between specified-plugin and default-plugin results during merging.
+ *
+ * Synthesis sees the two layers separately to avoid re-merging specified
+ * results into a parallel rootMap — for each (root, target) where both
+ * layers contribute, it computes the eventual executor/command on the
+ * fly. That's all the matcher needs; the full target merge happens
+ * downstream in the real merge.
  */
-function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMap, nxJsonConfiguration) {
+function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMap, nxJsonConfiguration, specifiedSourceMaps, defaultSourceMaps) {
     const targetDefaultsConfig = nxJsonConfiguration.targetDefaults;
     if (!targetDefaultsConfig) {
         return [];
     }
+    // Disambiguate `:`-shaped record keys against the actual targets and
+    // executors present in the rootMaps. This is the same idea the v23
+    // `convert-target-defaults-to-array` migration uses against the project
+    // graph — we just consult the rootMaps directly here since we don't have
+    // a graph yet during construction.
+    const entries = normalizeTargetDefaultsAgainstRootMaps(targetDefaultsConfig, specifiedPluginRootMap, defaultPluginRootMap);
+    if (entries.length === 0) {
+        return [];
+    }
+    // `projectNodesByName` and `rootToName` are only consulted when an entry
+    // has a `projects:` filter — that's the only matcher branch that needs
+    // either the project name or its node. Source-plugin attribution is
+    // root-keyed via `resolveSourcePlugin`, not name-keyed, so it doesn't
+    // need either map. Skip both builds in the common no-filter path.
+    const needsProjectNodes = entries.some((e) => e.projects !== undefined);
+    const projectNodes = needsProjectNodes
+        ? buildProjectNodesAndRootToName(specifiedPluginRootMap, defaultPluginRootMap)
+        : undefined;
     const syntheticProjects = {};
     const allRoots = new Set([
         ...Object.keys(specifiedPluginRootMap),
@@ -23,8 +55,16 @@ function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMa
     for (const root of allRoots) {
         const specifiedTargets = specifiedPluginRootMap[root]?.targets ?? {};
         const defaultTargets = defaultPluginRootMap[root]?.targets ?? {};
+        const projectName = projectNodes?.rootToName.get(root);
+        const projectNode = projectName
+            ? projectNodes.projectNodesByName[projectName]
+            : undefined;
         for (const targetName of (0, utils_1.uniqueKeysInObjects)(specifiedTargets, defaultTargets)) {
-            const syntheticTarget = buildSyntheticTargetForRoot(targetName, root, specifiedTargets[targetName], defaultTargets[targetName], targetDefaultsConfig);
+            const effective = effectiveTargetForLookup(specifiedTargets[targetName], defaultTargets[targetName], root);
+            if (!effective)
+                continue;
+            const sourcePlugin = resolveSourcePlugin(root, targetName, specifiedSourceMaps, defaultSourceMaps);
+            const syntheticTarget = buildSyntheticTargetForRoot(targetName, root, effective, entries, projectName, projectNode, sourcePlugin);
             if (!syntheticTarget)
                 continue;
             syntheticProjects[root] ??= { root, targets: {} };
@@ -44,92 +84,499 @@ function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMa
         ],
     ];
 }
-// Returns the synthetic defaults target to insert for `targetName` at
-// `root`, or undefined if no defaults apply.
-// Layering: specified plugins < target defaults < default plugins.
-function buildSyntheticTargetForRoot(targetName, root, specifiedTarget, defaultTarget, targetDefaultsConfig) {
+// Returns the (executor, command) pair the real merge will land on at
+// `(root, targetName)` — only the fields the matcher needs. Incompatible
+// pairs wholesale-replace specified with default; compatible pairs let
+// the default's executor win, otherwise the specified's.
+function effectiveTargetForLookup(specifiedTarget, defaultTarget, root) {
     const resolvedSpecified = specifiedTarget
         ? (0, target_merging_1.resolveCommandSyntacticSugar)(specifiedTarget, root)
         : undefined;
     const resolvedDefault = defaultTarget
         ? (0, target_merging_1.resolveCommandSyntacticSugar)(defaultTarget, root)
         : undefined;
-    // Specified-only: layer defaults on top, but only when the resulting
-    // synthetic is compatible with the specified target. An incompatible
-    // synthetic (e.g. `targetDefaults['test-native'] = { executor:
-    // '@monodon/rust:test' }` while a polyglot plugin infers `test-native`
-    // with `nx:run-commands`) would otherwise replace the specified target
-    // wholesale during the downstream merge.
-    if (resolvedSpecified && !resolvedDefault) {
-        const targetDefaults = readAndPrepareTargetDefaults(targetName, resolvedSpecified.executor, root, targetDefaultsConfig);
-        if (targetDefaults &&
-            !(0, target_merging_1.isCompatibleTarget)(resolvedSpecified, targetDefaults)) {
-            return undefined;
+    if (resolvedSpecified && resolvedDefault) {
+        if (!(0, target_merging_1.isCompatibleTarget)(resolvedSpecified, resolvedDefault)) {
+            return {
+                executor: resolvedDefault.executor,
+                command: resolvedDefault.command,
+            };
         }
-        return targetDefaults;
-    }
-    // Default-only.
-    if (resolvedDefault && !resolvedSpecified) {
-        return readAndPrepareTargetDefaults(targetName, resolvedDefault.executor, root, targetDefaultsConfig);
+        return {
+            executor: resolvedDefault.executor ?? resolvedSpecified.executor,
+            command: resolvedDefault.command ?? resolvedSpecified.command,
+        };
     }
-    if (!resolvedSpecified || !resolvedDefault)
-        return undefined;
-    // Both compatible: use the default plugin's executor for the lookup.
-    // The same incompatibility check applies — a project.json `{}` entry
-    // asks defaults to fill in the target, but the lookup can still fall
-    // back to a target-name keyed default with a foreign executor that
-    // would replace the inferred target. Skip the synthetic in that case.
-    if ((0, target_merging_1.isCompatibleTarget)(resolvedSpecified, resolvedDefault)) {
-        const targetDefaults = readAndPrepareTargetDefaults(targetName, resolvedDefault.executor || resolvedSpecified.executor, root, targetDefaultsConfig);
-        if (targetDefaults &&
-            !(0, target_merging_1.isCompatibleTarget)(resolvedSpecified, targetDefaults)) {
-            return undefined;
-        }
-        return targetDefaults;
+    if (resolvedSpecified) {
+        return {
+            executor: resolvedSpecified.executor,
+            command: resolvedSpecified.command,
+        };
     }
-    // Incompatible: default plugin will replace specified; only defaults
-    // matching the default plugin's executor are useful.
-    const targetDefaults = readAndPrepareTargetDefaults(targetName, resolvedDefault.executor, root, targetDefaultsConfig);
-    if (targetDefaults && (0, target_merging_1.isCompatibleTarget)(resolvedDefault, targetDefaults)) {
-        // Stamp executor/command so the default layer merges cleanly on top.
+    if (resolvedDefault) {
         return {
-            ...targetDefaults,
             executor: resolvedDefault.executor,
             command: resolvedDefault.command,
         };
     }
     return undefined;
 }
-function readAndPrepareTargetDefaults(targetName, executor, root, targetDefaultsConfig) {
-    const rawTargetDefaults = readTargetDefaultsForTarget(targetName, targetDefaultsConfig, executor);
+/**
+ * Returns the synthetic defaults target to insert for `targetName` at
+ * `root`, or undefined if no defaults apply. The synthetic stamps the
+ * effective executor/command so neither merge neighbor can
+ * incompatible-replace it and drop its contributions.
+ *
+ * @param effective The `(executor, command)` shape the real merge will
+ *   land on. Used both to pick the highest-ranked compatible default
+ *   (falling back to less-specific matches if the best one would be
+ *   incompatible) and as the locked shape stamped onto the synthetic.
+ */
+function buildSyntheticTargetForRoot(targetName, root, effective, targetDefaults, projectName, projectNode, sourcePlugin) {
+    const rawTargetDefaults = findBestTargetDefault(targetName, effective.executor, projectName, projectNode, sourcePlugin, targetDefaults, effective.command, (candidate) => (0, target_merging_1.isCompatibleTarget)({ executor: effective.executor, command: effective.command }, candidate));
     if (!rawTargetDefaults)
         return undefined;
-    return (0, target_merging_1.resolveCommandSyntacticSugar)((0, target_merging_1.deepClone)(rawTargetDefaults), root);
-}
-function readTargetDefaultsForTarget(targetName, targetDefaults, executor) {
-    if (executor && targetDefaults?.[executor]) {
-        // If an executor is defined in project.json, defaults should be read
-        // from the most specific key that matches that executor.
-        // e.g. If executor === run-commands, and the target is named build:
-        // Use, use nx:run-commands if it is present
-        // If not, use build if it is present.
-        return targetDefaults?.[executor];
-    }
-    else if (targetDefaults?.[targetName]) {
-        // If the executor is not defined, the only key we have is the target name.
-        return targetDefaults?.[targetName];
-    }
-    let matchingTargetDefaultKey = null;
-    for (const key in targetDefaults ?? {}) {
-        if ((0, globs_1.isGlobPattern)(key) && (0, minimatch_1.minimatch)(targetName, key)) {
-            if (!matchingTargetDefaultKey ||
-                matchingTargetDefaultKey.length < key.length) {
-                matchingTargetDefaultKey = key;
+    const synthetic = (0, target_merging_1.resolveCommandSyntacticSugar)((0, target_merging_1.deepClone)(rawTargetDefaults), root);
+    // Pre-stamp executor/command from the effective shape so the
+    // synthetic can't be incompatible-replaced during the real merge.
+    if (effective.executor !== undefined)
+        synthetic.executor = effective.executor;
+    if (effective.command !== undefined)
+        synthetic.command = effective.command;
+    return synthetic;
+}
+/**
+ * Public, backwards-compatible reader that looks up the most-specific
+ * target default for a given target. Accepts either the new array shape
+ * or the legacy record shape (devkit support).
+ *
+ * When called without project context, entries that require a `projects`
+ * filter or a `plugin` filter are skipped.
+ *
+ * The normalized entries are cached per `targetDefaults` reference so
+ * repeated reads against the same nx.json don't re-normalize (and don't
+ * re-fire the legacy-record-shape warning).
+ */
+function readTargetDefaultsForTarget(targetName, targetDefaults, executor, opts) {
+    if (!targetDefaults)
+        return null;
+    return findBestTargetDefault(targetName, executor, opts?.projectName, opts?.projectNode, opts?.sourcePlugin, getCachedNormalizedEntries(targetDefaults), opts?.command);
+}
+const normalizedEntriesCache = new WeakMap();
+function getCachedNormalizedEntries(targetDefaults) {
+    // WeakMap keys must be objects — both array and record forms are objects,
+    // so this is safe regardless of shape.
+    const key = targetDefaults;
+    let entries = normalizedEntriesCache.get(key);
+    if (!entries) {
+        entries = normalizeTargetDefaults(targetDefaults);
+        normalizedEntriesCache.set(key, entries);
+    }
+    return entries;
+}
+/**
+ * Find the highest-specificity `targetDefaults` entry that applies to the
+ * given (target, project, sourcePlugin) tuple. Ties are broken by match
+ * kind, then by later array index. Returns the config slice with filter
+ * keys (`target`, `projects`, `plugin`) stripped.
+ *
+ * Tier = (1 if a target/executor locator matched, else 0) + 1 per
+ * applied filter (`projects`, `plugin`). So locator-bearing entries:
+ *   - tier 3: target/executor + projects + plugin
+ *   - tier 2: target/executor + projects, or target/executor + plugin
+ *   - tier 1: target/executor alone
+ * And filter-only entries (no `target` and no `executor`):
+ *   - tier 2: projects + plugin
+ *   - tier 1: projects alone, or plugin alone
+ *
+ * `executor` matching contributes to matchKind only, not to tier — it's
+ * not a filter, it's a refinement of the match. Within the same tier,
+ * tie-break order (highest first):
+ *   targetAndExecutor > executorOnly > exactTarget > globTarget > filterOnly
+ *
+ * `filterOnly` ranks below every locator-bearing kind, so a filter-only
+ * entry can never tie-break ahead of one that names a target or executor
+ * at the same tier.
+ *
+ * `executor` only acts as an "injector" (matches a target with neither
+ * executor nor command) when the entry also sets `target`. Executor-only
+ * entries require the workspace target to actually have an executor.
+ *
+ * When `predicate` is provided, ranked candidates are iterated and the
+ * first one that satisfies the predicate is returned. This lets synthesis
+ * fall back to a less-specific compatible default when the most-specific
+ * match would be incompatible with the target it's being applied to.
+ * Without a predicate, the highest-ranked candidate is returned directly.
+ */
+function findBestTargetDefault(targetName, executor, projectName, projectNode, sourcePlugin, entries, targetCommand, predicate) {
+    if (!entries?.length)
+        return null;
+    // Single greedy best-so-far loop in both the predicate and no-predicate
+    // paths. With a predicate, we filter candidates as they appear and only
+    // promote one to `best` when it passes — equivalent to the previous
+    // "collect-all + sort + first-passing" approach because `beats` is a
+    // total order, but without the sort allocation.
+    let best = null;
+    for (let i = 0; i < entries.length; i++) {
+        const candidate = matchEntry(entries[i], i, targetName, executor, projectName, projectNode, sourcePlugin, targetCommand);
+        if (!candidate)
+            continue;
+        if (predicate && !predicate(candidate.config))
+            continue;
+        if (!best || beats(candidate, best)) {
+            best = candidate;
+        }
+    }
+    return best ? best.config : null;
+}
+/**
+ * Classify the runtime intent of an entry's `projects:` value:
+ *   - `none`: filter is absent — the entry is unscoped on the projects axis.
+ *   - `empty`: filter is `[]` — matches no project, so the whole entry is
+ *     dead. Treated as a never-match by the matcher rather than allowing
+ *     the entry to silently apply nowhere (which is almost always a bug).
+ *   - `wildcard`: filter is exactly `'*'` or `['*']` (or any combination of
+ *     pure-wildcard patterns) — matches every project, equivalent to no
+ *     filter at all. Doesn't count toward the broadcast guard or the
+ *     specificity tier so the entry doesn't outrank a real, narrower one.
+ *   - `filter`: a real pattern set the matcher needs to evaluate.
+ */
+function classifyProjectsFilter(projects) {
+    if (projects === undefined)
+        return 'none';
+    const arr = Array.isArray(projects) ? projects : [projects];
+    if (arr.length === 0)
+        return 'empty';
+    if (arr.every((p) => p === '*'))
+        return 'wildcard';
+    return 'filter';
+}
+/**
+ * Test a single `targetDefaults` entry against the (target, executor,
+ * project, plugin, command) tuple of the target being resolved. Returns
+ * a `Candidate` with its tier and match kind, or null when the entry
+ * doesn't apply.
+ *
+ * The match facts (`targetName`, `executor`, `projectName`, `projectNode`,
+ * `sourcePlugin`, `targetCommand`) are passed in instead of being read
+ * from the graph node here because callers — `findBestTargetDefault` and
+ * `buildSyntheticTargetForRoot` — work in different graph contexts. The
+ * synthetic builder, in particular, evaluates against the *effective*
+ * executor/command (what the merge will land on), which doesn't always
+ * equal the node's current executor; threading the values explicitly
+ * keeps that asymmetry visible at the call sites.
+ */
+function matchEntry(entry, index, targetName, executor, projectName, projectNode, sourcePlugin, targetCommand) {
+    if (!entry)
+        return null;
+    // `normalizeTargetDefaults` already drops entries with neither locator
+    // nor real filter. Empty-array `projects:` is an explicit never-match
+    // shape — kept by the normalizer because it's named, rejected here.
+    const projectsKind = classifyProjectsFilter(entry.projects);
+    if (projectsKind === 'empty')
+        return null;
+    let targetKind = null;
+    if (entry.target !== undefined) {
+        if (entry.target === targetName)
+            targetKind = 'exact';
+        else if ((0, globs_1.isGlobPattern)(entry.target) && (0, minimatch_1.minimatch)(targetName, entry.target))
+            targetKind = 'glob';
+        else
+            return null;
+    }
+    let executorMatched = false;
+    if (entry.executor !== undefined) {
+        if (executor && executor === entry.executor) {
+            executorMatched = true;
+        }
+        else if (targetKind !== null && !executor && !targetCommand) {
+            // Bare target with no executor — safe to inject the entry's
+            // executor because the target locator has already narrowed the match.
+            executorMatched = true;
+        }
+        else {
+            return null;
+        }
+    }
+    // Locator-bearing entries get a base tier of 1 (the locator match);
+    // filter-only entries start at 0 so a single filter doesn't tie a
+    // single locator. Filters then add 1 each — with the matchKind
+    // tie-break below, filter-only always loses to locator-bearing at
+    // the same final tier.
+    const hasLocator = targetKind !== null || executorMatched;
+    let tier = hasLocator ? 1 : 0;
+    if (projectsKind === 'filter') {
+        if (!projectName || !projectNode)
+            return null;
+        // Copy — `findMatchingProjects` prepends `*` for a leading negation
+        // and would otherwise mutate the shared nxJson entry.
+        const patterns = Array.isArray(entry.projects)
+            ? [...entry.projects]
+            : [entry.projects];
+        const matched = (0, find_matching_projects_1.findMatchingProjects)(patterns, {
+            [projectName]: projectNode,
+        });
+        if (!matched.includes(projectName))
+            return null;
+        tier++;
+    }
+    if (entry.plugin !== undefined) {
+        if (entry.plugin !== sourcePlugin)
+            return null;
+        tier++;
+    }
+    // Safety net for callers (e.g. direct unit-test calls) that bypass
+    // `normalizeTargetDefaults`: an entry with no locator and no real
+    // filter has tier 0 after processing — it would broadcast to every
+    // (root, target) in the workspace.
+    if (!hasLocator && tier === 0)
+        return null;
+    const matchKind = targetKind !== null && executorMatched
+        ? 'targetAndExecutor'
+        : executorMatched
+            ? 'executorOnly'
+            : targetKind === 'exact'
+                ? 'exactTarget'
+                : targetKind === 'glob'
+                    ? 'globTarget'
+                    : 'filterOnly';
+    return {
+        config: stripFilterKeys(entry),
+        tier,
+        matchKind,
+        index,
+    };
+}
+/**
+ * Specificity ordering for two candidate matches. Higher specificity
+ * wins because the more specific entry is the one the user most likely
+ * wrote to override a broader rule.
+ *
+ * 1. Tier — entries with `projects` or `plugin` filters are scoped
+ *    narrower than unfiltered entries, so they outrank.
+ * 2. Match kind — within the same tier, more locator slots is more
+ *    specific: `target+executor` > `executor-only` > `exactTarget` >
+ *    `globTarget` > `filterOnly`. Note `executor-only` outranks
+ *    `exactTarget`: a workspace-wide rule keyed on a specific executor
+ *    is treated as more intentional than a target-name rule that might
+ *    accidentally catch unrelated executors. `filterOnly` (no `target`
+ *    and no `executor`, just `projects` and/or `plugin`) sits at the
+ *    bottom — it's the explicit "least specific" tier that lets a bare
+ *    `plugin: '@nx/jest/plugin'` apply to every jest-attributed target
+ *    while still losing to any entry that names the target or executor.
+ * 3. Tie-break — later array index wins, so users can append an entry
+ *    to override earlier ones without rewriting them.
+ */
+function beats(a, b) {
+    if (a.tier !== b.tier)
+        return a.tier > b.tier;
+    const aRank = matchKindRank(a.matchKind);
+    const bRank = matchKindRank(b.matchKind);
+    if (aRank !== bRank)
+        return aRank > bRank;
+    return a.index > b.index;
+}
+function matchKindRank(kind) {
+    switch (kind) {
+        case 'targetAndExecutor':
+            return 4;
+        case 'executorOnly':
+            return 3;
+        case 'exactTarget':
+            return 2;
+        case 'globTarget':
+            return 1;
+        case 'filterOnly':
+            return 0;
+    }
+}
+/** Removes keys used only for locating the defaults, leaving the merge payload. */
+function stripFilterKeys(entry) {
+    const { target, projects, plugin, ...rest } = entry;
+    return rest;
+}
+let hasWarnedAboutLegacyRecordShape = false;
+/**
+ * Accept either the new array shape or the legacy record shape and return
+ * a normalized array. Record entries become `{ target: key, ...value }`
+ * — except executor-shaped keys (e.g. `@nx/vite:test`, `nx:run-commands`)
+ * which become `{ executor: key, ...value }` so the matcher treats them
+ * as executor matches rather than target-name matches.
+ *
+ * Disambiguation here is purely syntactic — `:` in a record key is
+ * genuinely ambiguous (target names can contain `:`). Callers that have
+ * access to the workspace's targets (the graph-construction path, the
+ * v23 migration) should prefer
+ * {@link normalizeTargetDefaultsAgainstRootMaps} or the migration's
+ * graph-based classifier so that ambiguous keys get classified by what
+ * the workspace actually contains. The warning below points end-users
+ * at `nx repair`, which runs the migration that durably resolves the
+ * ambiguity in nx.json on disk.
+ */
+function normalizeTargetDefaults(raw) {
+    if (!raw)
+        return [];
+    const entries = Array.isArray(raw) ? raw : recordToEntries(raw);
+    return entries.filter(isWellFormedEntry);
+}
+function recordToEntries(raw) {
+    warnAboutLegacyRecordShapeOnce();
+    const out = [];
+    for (const key of Object.keys(raw)) {
+        const value = raw[key] ?? {};
+        out.push(...syntacticallyClassifyLegacyKey(key, value));
+    }
+    return out;
+}
+/**
+ * An entry is well-formed when it has at least one locator (`target` /
+ * `executor`) or a real filter (`projects` resolving to something other
+ * than empty/wildcard, or `plugin`). Pre-filtering here lets the matcher
+ * trust its inputs and skip the per-entry broadcast guard.
+ */
+function isWellFormedEntry(entry) {
+    if (entry.target !== undefined)
+        return true;
+    if (entry.executor !== undefined)
+        return true;
+    if (entry.plugin !== undefined)
+        return true;
+    return classifyProjectsFilter(entry.projects) === 'filter';
+}
+/**
+ * Same shape contract as {@link normalizeTargetDefaults}, but classifies
+ * `:`-shaped record keys against the targets and executors actually
+ * present in the supplied rootMaps. When a key matches a target name in
+ * the workspace, it becomes a `target:` entry; when it matches an
+ * executor, an `executor:` entry; when it matches both, both entries are
+ * emitted (matching the v23 migration's "duplicate rather than guess"
+ * behavior so neither side of the match silently drops). Falls back to
+ * the syntactic heuristic when there's no evidence either way.
+ */
+function normalizeTargetDefaultsAgainstRootMaps(raw, ...rootMaps) {
+    if (!raw)
+        return [];
+    if (Array.isArray(raw))
+        return raw;
+    warnAboutLegacyRecordShapeOnce();
+    const targetNames = new Set();
+    const executors = new Set();
+    for (const map of rootMaps) {
+        for (const cfg of Object.values(map)) {
+            const targets = cfg?.targets;
+            if (!targets)
+                continue;
+            for (const [name, target] of Object.entries(targets)) {
+                targetNames.add(name);
+                if (target?.executor)
+                    executors.add(target.executor);
             }
         }
     }
-    if (matchingTargetDefaultKey) {
-        return targetDefaults[matchingTargetDefaultKey];
+    const out = [];
+    for (const key of Object.keys(raw)) {
+        const value = raw[key] ?? {};
+        if ((0, globs_1.isGlobPattern)(key)) {
+            out.push({ ...value, target: key });
+            continue;
+        }
+        const matchesTarget = targetNames.has(key);
+        const matchesExecutor = executors.has(key);
+        if (matchesTarget && matchesExecutor) {
+            out.push({ ...value, target: key }, { ...value, executor: key });
+        }
+        else if (matchesExecutor) {
+            out.push({ ...value, executor: key });
+        }
+        else if (matchesTarget) {
+            out.push({ ...value, target: key });
+        }
+        else {
+            out.push(...syntacticallyClassifyLegacyKey(key, value));
+        }
+    }
+    return out;
+}
+function syntacticallyClassifyLegacyKey(key, value) {
+    return [
+        key.includes(':') && !(0, globs_1.isGlobPattern)(key)
+            ? { ...value, executor: key }
+            : { ...value, target: key },
+    ];
+}
+function warnAboutLegacyRecordShapeOnce() {
+    if (hasWarnedAboutLegacyRecordShape)
+        return;
+    hasWarnedAboutLegacyRecordShape = true;
+    // Written to stderr (not stdout) so commands with structured stdout —
+    // e.g. `nx show project --json` — remain parseable.
+    const title = pc.yellow('NX  nx.json uses the legacy record-shape `targetDefaults`');
+    const bodyLines = [
+        'The object/record form of `targetDefaults` is deprecated. Nx still reads it for now, but the array form is required to use the new `projects` and `plugin` filters.',
+        'Run `nx repair` to automatically convert `targetDefaults` to the array shape.',
+    ];
+    process.stderr.write(`${os_1.EOL}${title}${os_1.EOL}${os_1.EOL}${bodyLines
+        .map((l) => `  ${l}`)
+        .join(os_1.EOL)}${os_1.EOL}${os_1.EOL}`);
+}
+function resolveSourcePlugin(root, targetName, specifiedSourceMaps, defaultSourceMaps) {
+    // Default-plugin attribution overrides specified-plugin attribution in
+    // the merge, so we check it first. Only the executor/command keys are
+    // reliable — the top-level `targets.<name>` key tracks the last writer.
+    const executorKey = (0, source_maps_1.targetOptionSourceMapKey)(targetName, 'executor');
+    const commandKey = (0, source_maps_1.targetOptionSourceMapKey)(targetName, 'command');
+    const candidates = [
+        pluginFromSourceMap(defaultSourceMaps, root, executorKey),
+        pluginFromSourceMap(defaultSourceMaps, root, commandKey),
+        pluginFromSourceMap(specifiedSourceMaps, root, executorKey),
+        pluginFromSourceMap(specifiedSourceMaps, root, commandKey),
+    ];
+    for (const candidate of candidates) {
+        if (candidate && candidate !== 'nx/target-defaults')
+            return candidate;
     }
-    return null;
+    return undefined;
+}
+function pluginFromSourceMap(maps, root, key) {
+    const entry = maps?.[root]?.[key];
+    return entry?.[1];
+}
+// Walks both layered rootMaps and produces a name → ProjectGraphProjectNode
+// view for `findMatchingProjects` to consult. Default-plugin-only
+// projects are included — they're the bulk of typical workspaces and
+// `projects:` filters need to apply to them too. Tags are unioned across
+// layers so tag-based filters see all contributions.
+//
+// We don't reuse `mergeProjectConfigurationIntoRootMap` here: it does a
+// full project-config merge (targets, named inputs, source maps, ...)
+// keyed by root, while this function only needs name + tags keyed by
+// name. The full merge would be substantial wasted work on every graph
+// build.
+function buildProjectNodesAndRootToName(specifiedPluginRootMap, defaultPluginRootMap) {
+    const projectNodesByName = {};
+    const rootToName = new Map();
+    const addFromMap = (map) => {
+        for (const root of Object.keys(map)) {
+            const cfg = map[root];
+            const name = cfg?.name;
+            if (!name)
+                continue;
+            if (projectNodesByName[name]) {
+                const existingTags = projectNodesByName[name].data.tags ?? [];
+                const newTags = cfg.tags ?? [];
+                projectNodesByName[name].data.tags = Array.from(new Set([...existingTags, ...newTags]));
+            }
+            else {
+                projectNodesByName[name] = {
+                    name,
+                    type: cfg.projectType === 'application' ? 'app' : 'lib',
+                    data: { root, tags: cfg.tags ?? [] },
+                };
+                rootToName.set(root, name);
+            }
+        }
+    };
+    addFromMap(specifiedPluginRootMap);
+    addFromMap(defaultPluginRootMap);
+    return { projectNodesByName, rootToName };
 }

package/dist/src/project-graph/utils/project-configuration-utils.d.ts

@@ -60,11 +60,19 @@ export type MergeError = AggregateCreateNodesError | MergeNodesError | ProjectsW
 /**
  * Merges create nodes results into a single rootMap.
  *
- * Default plugin results are merged twice: first into an intermediate
- * rootMap with unresolved spread sentinels preserved, so target
- * defaults selection sees the real merged shape of defaults; then
- * applied as a single layer onto the main rootMap where the preserved
- * spreads resolve against the specified + target-defaults base.
+ * Specified plugin results are merged once into the manager. Default
+ * plugin results are first staged into an intermediate rootMap (with
+ * `'...'` spreads deferred) so that synthesis can read each layer's
+ * contribution without re-running the merge. The synthetic result from
+ * `createTargetDefaultsResults` is then merged into the manager, and
+ * the staged intermediate is replayed on top — that replay is where
+ * deferred spreads expand against the final (specified + synth) base.
+ *
+ * Synthesis itself doesn't materialize a second rootMap. Per
+ * (root, target) it does an on-the-fly merge of the two layered
+ * contributions to learn the eventual executor/command, then matches
+ * defaults against that merged shape. This keeps specified-plugin
+ * merge work to a single pass.
  */
 export declare function mergeCreateNodesResults(specifiedResults: CreateNodesResultEntry[][], defaultResults: CreateNodesResultEntry[][], nxJsonConfiguration: NxJsonConfiguration, workspaceRoot: string, errors: MergeError[]): {
     projectRootMap: Record<string, ProjectConfiguration>;