nx 23.1.0 → 23.1.2

package/dist/src/hasher/check-task-files.js

@@ -0,0 +1,378 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkFilesAreInputs = checkFilesAreInputs;
+exports.checkFilesAreOutputs = checkFilesAreOutputs;
+exports.getTaskRawInputs = getTaskRawInputs;
+exports.getTaskOutputs = getTaskOutputs;
+exports._resetContextForTesting = _resetContextForTesting;
+const path_1 = require("path");
+const nx_json_1 = require("../config/nx-json");
+const native_1 = require("../native");
+const project_graph_1 = require("../project-graph/project-graph");
+const create_task_graph_1 = require("../tasks-runner/create-task-graph");
+const utils_1 = require("../tasks-runner/utils");
+const path_2 = require("../utils/path");
+const project_graph_utils_1 = require("../utils/project-graph-utils");
+const split_target_1 = require("../utils/split-target");
+const workspace_root_1 = require("../utils/workspace-root");
+const hash_plan_inspector_1 = require("./hash-plan-inspector");
+const task_hasher_1 = require("./task-hasher");
+let cachedContext = null;
+function getContext(seed) {
+    // Only a fulfilled context is cached — caching a rejected promise would
+    // poison the resolver for the rest of the process after one transient failure.
+    return (cachedContext ??= loadContext(seed).catch((e) => {
+        cachedContext = null;
+        throw e;
+    }));
+}
+async function loadContext(seed) {
+    const projectGraph = seed?.projectGraph ?? (await (0, project_graph_1.createProjectGraphAsync)());
+    const nxJson = seed?.nxJson ?? (0, nx_json_1.readNxJson)(workspace_root_1.workspaceRoot) ?? {};
+    let inspector = null;
+    const getInspector = () => 
+    // As with the context itself, a rejection is not cached.
+    (inspector ??= initInspector(projectGraph, nxJson).catch((e) => {
+        inspector = null;
+        throw e;
+    }));
+    return { projectGraph, nxJson, getInspector };
+}
+async function initInspector(projectGraph, nxJson) {
+    const inspector = new hash_plan_inspector_1.HashPlanInspector(projectGraph, workspace_root_1.workspaceRoot, nxJson);
+    await inspector.init();
+    return inspector;
+}
+const identityCache = new Map();
+const hashInputsCache = new Map();
+const outputsCache = new Map();
+const taskGraphCache = new Map();
+const depsOutputsCache = new Map();
+// ── Internal resolution helpers ──────────────────────────────────────────────
+function resolveIdentity(taskId, projectGraph) {
+    const cached = identityCache.get(taskId);
+    if (cached)
+        return cached;
+    const [project, target, configuration] = (0, split_target_1.splitTarget)(taskId, projectGraph);
+    if (!project || !target) {
+        throw new Error(`Invalid taskId "${taskId}" — expected "project:target[:configuration]"`);
+    }
+    const projectNode = projectGraph.nodes[project];
+    if (!projectNode) {
+        throw new Error(`Invalid taskId "${taskId}" — project "${project}" does not exist in the project graph.`);
+    }
+    const targetConfig = projectNode.data?.targets?.[target];
+    if (!targetConfig) {
+        throw new Error(`Invalid taskId "${taskId}" — project "${project}" has no target "${target}".`);
+    }
+    // Substituting defaultConfiguration for a configuration that does not exist
+    // would answer confidently about a *different* task — and configurations
+    // routinely change `outputPath`, so the answer could be wrong in either
+    // direction. `nx run` errors here; so do we.
+    if (configuration &&
+        !(0, project_graph_utils_1.projectHasTargetAndConfiguration)(projectNode, target, configuration)) {
+        const available = Object.keys(targetConfig.configurations ?? {});
+        throw new Error(`Invalid taskId "${taskId}" — target "${target}" of project "${project}" has no configuration "${configuration}".` +
+            (available.length
+                ? ` Available configurations: ${available.join(', ')}.`
+                : ' It has no configurations.'));
+    }
+    const effectiveConfiguration = configuration ?? targetConfig.defaultConfiguration;
+    const identity = {
+        project,
+        target,
+        configuration: effectiveConfiguration,
+        canonicalTaskId: (0, utils_1.createTaskId)(project, target, effectiveConfiguration),
+        projectNode,
+    };
+    identityCache.set(taskId, identity);
+    return identity;
+}
+async function getRawInputs(taskId, { projectGraph, getInspector }) {
+    if (hashInputsCache.has(taskId)) {
+        return hashInputsCache.get(taskId) ?? null;
+    }
+    const { project, target, configuration, canonicalTaskId } = resolveIdentity(taskId, projectGraph);
+    const inspector = await getInspector();
+    // `null` means "this task is absent from the hash plan" — any other failure
+    // is a real error and propagates to the caller.
+    const planResult = inspector.inspectTaskInputs({
+        project,
+        target,
+        configuration,
+    });
+    const result = planResult[canonicalTaskId] ?? null;
+    hashInputsCache.set(taskId, result);
+    return result;
+}
+function getOutputs(taskId, projectGraph) {
+    const cached = outputsCache.get(taskId);
+    if (cached !== undefined)
+        return cached;
+    const { project, target, configuration, projectNode } = resolveIdentity(taskId, projectGraph);
+    const outputs = (0, utils_1.getOutputsForTargetAndConfiguration)({ project, target, configuration }, {}, projectNode).map(path_2.normalizePath);
+    outputsCache.set(taskId, outputs);
+    return outputs;
+}
+/**
+ * Configured outputs that `getOutputsForTargetAndConfiguration` dropped because
+ * an `{options.x}` token had no value to interpolate. The resolver discards them
+ * silently, so they have to be recovered from the target configuration.
+ */
+function getUnresolvedOutputs(taskId, projectGraph) {
+    const { target, configuration, projectNode } = resolveIdentity(taskId, projectGraph);
+    const targetConfig = projectNode.data.targets[target];
+    const options = {
+        ...targetConfig.options,
+        ...(configuration
+            ? targetConfig.configurations?.[configuration]
+            : undefined),
+    };
+    return (targetConfig.outputs ?? []).filter((output) => [...output.matchAll(/\{options\.([^}]+)\}/g)].some(([, key]) => {
+        const value = key.split('.').reduce((acc, k) => acc?.[k], options);
+        return value === undefined;
+    }));
+}
+function getTaskGraph(taskId, projectGraph) {
+    const cached = taskGraphCache.get(taskId);
+    if (cached)
+        return cached;
+    const { project, target, configuration } = resolveIdentity(taskId, projectGraph);
+    const taskGraph = (0, create_task_graph_1.createTaskGraph)(projectGraph, {}, [project], [target], configuration, {}, false);
+    taskGraphCache.set(taskId, taskGraph);
+    return taskGraph;
+}
+function getDepsOutputs(taskId, { projectGraph, nxJson }) {
+    if (depsOutputsCache.has(taskId))
+        return depsOutputsCache.get(taskId);
+    const { project, target } = resolveIdentity(taskId, projectGraph);
+    const result = (0, task_hasher_1.getInputs)({ target: { project, target } }, projectGraph, nxJson)
+        .depsOutputs ?? [];
+    depsOutputsCache.set(taskId, result);
+    return result;
+}
+function collectUpstreamTaskIds(taskGraph, rootTaskId, transitive) {
+    const direct = taskGraph.dependencies[rootTaskId] ?? [];
+    if (!transitive)
+        return [...direct];
+    const collected = new Set();
+    const walk = (id) => {
+        for (const dep of taskGraph.dependencies[id] ?? []) {
+            if (collected.has(dep))
+                continue;
+            collected.add(dep);
+            walk(dep);
+        }
+    };
+    walk(rootTaskId);
+    return [...collected];
+}
+/**
+ * Matches a single path against a task's whole output pattern list using the
+ * native glob engine (`globset`) that the task runner's expand_outputs also
+ * builds on: non-glob patterns match themselves and anything nested under them,
+ * and negated (`!`-prefixed) patterns act as exclusions over the full set.
+ */
+function isOutput(taskId, path, projectGraph) {
+    const patterns = getOutputs(taskId, projectGraph);
+    return (0, native_1.matchOutputPaths)(patterns, [(0, path_2.normalizePath)(path)])[0];
+}
+function matchesDependentTaskOutputs(taskId, path, ctx) {
+    const normalized = (0, path_2.normalizePath)(path);
+    const depsOutputs = getDepsOutputs(taskId, ctx);
+    if (depsOutputs.length === 0)
+        return false;
+    const taskGraph = getTaskGraph(taskId, ctx.projectGraph);
+    const { canonicalTaskId } = resolveIdentity(taskId, ctx.projectGraph);
+    if (!taskGraph.tasks[canonicalTaskId])
+        return false;
+    for (const { dependentTasksOutputFiles, transitive } of depsOutputs) {
+        const glob = (0, path_2.normalizePath)(dependentTasksOutputFiles);
+        if (!(0, native_1.matchGlobPaths)([glob], [normalized])[0])
+            continue;
+        const upstreamIds = collectUpstreamTaskIds(taskGraph, canonicalTaskId, !!transitive);
+        for (const upstreamId of upstreamIds) {
+            if (isOutput(upstreamId, normalized, ctx.projectGraph))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Coerces a caller-supplied path to the workspace-relative, forward-slashed
+ * form the hash plan and output patterns are expressed in. A path outside the
+ * workspace stays outside (`../…`) and simply matches nothing — it cannot be a
+ * declared input or output, so "unmatched" is the true answer rather than an
+ * error.
+ */
+function toWorkspaceRelativePath(candidatePath) {
+    // Backslash separators must be split *before* anchoring: on POSIX a backslash
+    // is an ordinary filename character, so `dep\..\..` would ride through
+    // join/relative as one opaque segment and only become a live `..` traversal
+    // after the swap. Swapped directly rather than via normalizePath, which also
+    // strips a Windows drive letter: isAbsolute accepts the drive-less form too,
+    // but relative() then resolves it against the cwd's drive, so a path on
+    // another drive (`D:\…`) could be relativized to *inside* the workspace — a
+    // Windows-only fail-open no POSIX test can catch.
+    const forwardSlashed = candidatePath.replace(/\\/g, '/');
+    // Anchoring a relative path to the workspace root before relativizing it back
+    // resolves any `..` segments. Left in, they would traverse *through* a pattern
+    // that globset had already matched — `dist/libs/dep/../../../secrets.env`
+    // matching an output of `dist/libs/dep`.
+    const absolute = (0, path_1.isAbsolute)(forwardSlashed)
+        ? forwardSlashed
+        : (0, path_1.join)(workspace_root_1.workspaceRoot, forwardSlashed);
+    return (0, path_2.normalizePath)((0, path_1.relative)(workspace_root_1.workspaceRoot, absolute));
+}
+/**
+ * The task's hash inputs, or an error. A task missing from its own hash plan is
+ * a failure to *determine* the inputs — reporting every file as unmatched would
+ * tell a sandbox-violation consumer that all of them are illegal.
+ */
+async function requireRawInputs(taskId, ctx) {
+    const raw = await getRawInputs(taskId, ctx);
+    if (!raw) {
+        throw new Error(`Could not determine the inputs of task "${taskId}" — it is not present in its own hash plan.`);
+    }
+    return raw;
+}
+function classifyInput(taskId, candidate, raw, ctx) {
+    // `environment`, `runtime` and `external` hold names rather than paths, so
+    // they are matched against the value exactly as the caller supplied it.
+    if (raw.environment.includes(candidate.value))
+        return 'environment';
+    if (raw.runtime.includes(candidate.value))
+        return 'runtime';
+    if (raw.external.includes(candidate.value))
+        return 'external';
+    const path = toWorkspaceRelativePath(candidate.path);
+    if (raw.files.includes(path))
+        return 'files';
+    if (raw.depOutputs.includes(path))
+        return 'depOutputs';
+    return matchesDependentTaskOutputs(taskId, path, ctx)
+        ? 'dependentTasksOutputFiles'
+        : null;
+}
+/**
+ * Check which values are legitimate inputs for the given task. A value matches
+ * when it is:
+ *   - a declared environment variable, runtime input, or external dependency;
+ *   - a file in the task's declared input file list;
+ *   - a file in the task's materialized `depOutputs` (upstream has run);
+ *   - a file matching a `dependentTasksOutputFiles` glob declared on the task
+ *     that lies inside the declared outputs of an upstream task in the task
+ *     graph (static — works even when upstream tasks have not yet run).
+ *
+ * `categories` records the rule each matched value satisfied. Paths may be
+ * workspace-relative or absolute; absolute ones are relativized against the
+ * workspace root, and a path outside the workspace simply matches nothing. A
+ * caller resolving paths against a cwd passes an {@link InputCandidate} so that
+ * names are still matched verbatim.
+ */
+async function checkFilesAreInputs(taskId, files) {
+    const ctx = await getContext();
+    // Resolve the task and its hash plan eagerly, so an unknown task or an
+    // undeterminable plan errors even when the file list is empty — rather than
+    // being reported as "none of these files are inputs".
+    resolveIdentity(taskId, ctx.projectGraph);
+    const raw = await requireRawInputs(taskId, ctx);
+    const matched = [];
+    const unmatched = [];
+    const categories = new Map();
+    // Results are keyed by value, so a value given two path forms could land in
+    // both matched and unmatched at once. Exact duplicates are collapsed instead.
+    const seenPaths = new Map();
+    for (const file of files) {
+        const candidate = typeof file === 'string' ? { value: file, path: file } : file;
+        const seenPath = seenPaths.get(candidate.value);
+        if (seenPath !== undefined) {
+            if (seenPath !== candidate.path) {
+                throw new Error(`Value "${candidate.value}" was given conflicting path forms "${seenPath}" and "${candidate.path}".`);
+            }
+            continue;
+        }
+        seenPaths.set(candidate.value, candidate.path);
+        const category = classifyInput(taskId, candidate, raw, ctx);
+        if (category) {
+            matched.push(candidate.value);
+            categories.set(candidate.value, category);
+        }
+        else {
+            unmatched.push(candidate.value);
+        }
+    }
+    return { matched, unmatched, categories };
+}
+/**
+ * Check which files match the output globs declared for the given task.
+ * Uses the same path-matching logic as the task runner (directory containment
+ * + glob matching through the native `globset` engine), including negated
+ * (`!`-prefixed) patterns acting as exclusions over the whole pattern set.
+ *
+ * Paths may be workspace-relative or absolute; absolute ones are relativized
+ * against the workspace root. An output pattern whose `{options.*}` token has no
+ * value resolves to nothing — exactly as the task runner drops it — so a file it
+ * would have covered is reported `unmatched`, like any other non-output.
+ *
+ * That last case makes `unmatched` two answers in one: "not an output" and
+ * "the outputs could not be determined". A consumer judging sandbox violations
+ * cannot tell them apart, and would call the second one illegal. `getTaskOutputs`
+ * already computes the `unresolved` list this would need; surfacing it here is
+ * deliberately deferred until a consumer's contract asks for the distinction.
+ */
+async function checkFilesAreOutputs(taskId, files) {
+    const ctx = await getContext();
+    // Validate taskId eagerly so callers always get an error for an unknown or
+    // malformed task, even when the file list is empty.
+    resolveIdentity(taskId, ctx.projectGraph);
+    const patterns = getOutputs(taskId, ctx.projectGraph);
+    const results = (0, native_1.matchOutputPaths)(patterns, files.map(toWorkspaceRelativePath));
+    const matched = [];
+    const unmatched = [];
+    files.forEach((file, i) => {
+        if (results[i]) {
+            matched.push(file);
+        }
+        else {
+            unmatched.push(file);
+        }
+    });
+    return { matched, unmatched };
+}
+// ── Renderer helpers (used by `nx show target`) ──────────────────────────────
+/**
+ * Returns the full hash inputs for a task (files + runtime + env + depOutputs
+ * + external). Used internally by the `nx show target --inputs` renderer.
+ */
+async function getTaskRawInputs(taskId, seed) {
+    const ctx = await getContext(seed);
+    return getRawInputs(taskId, ctx);
+}
+/**
+ * Returns the outputs declared for a task, resolved against its effective
+ * configuration. Used internally by the `nx show target --outputs` renderer.
+ */
+async function getTaskOutputs(taskId, seed) {
+    const ctx = await getContext(seed);
+    const resolved = getOutputs(taskId, ctx.projectGraph);
+    return {
+        resolved,
+        expanded: (0, native_1.expandOutputs)(workspace_root_1.workspaceRoot, resolved),
+        unresolved: getUnresolvedOutputs(taskId, ctx.projectGraph),
+    };
+}
+// ── Test utilities ───────────────────────────────────────────────────────────
+/**
+ * Resets all module-level caches. Call this in `beforeEach` when testing so
+ * each test gets a fresh context load. Not part of the public API.
+ * @internal
+ */
+function _resetContextForTesting() {
+    cachedContext = null;
+    identityCache.clear();
+    hashInputsCache.clear();
+    outputsCache.clear();
+    taskGraphCache.clear();
+    depsOutputsCache.clear();
+}

package/dist/src/migrations/update-23-2-0/set-cache-on-executor-target-defaults.d.ts

@@ -0,0 +1,12 @@
+import { Tree } from '../../generators/tree';
+/**
+ * Target defaults resolve to a single key rather than merging, so an executor
+ * key hides the target name key entirely. Before Nx 23 a hidden `cache: true`
+ * still took effect, because cacheability was also derived from target *names*
+ * via `cacheableOperations`; Nx 23 removed that derivation and those targets
+ * silently stopped being cacheable.
+ *
+ * Write the intent into the executor key so it no longer depends on the
+ * deprecated fallback that restores the old behavior at run time.
+ */
+export default function update(tree: Tree): Promise<void>;

package/dist/src/migrations/update-23-2-0/set-cache-on-executor-target-defaults.js

@@ -0,0 +1,250 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = update;
+const executor_utils_1 = require("../../command-line/run/executor-utils");
+const format_changed_files_with_prettier_if_available_1 = require("../../generators/internal-utils/format-changed-files-with-prettier-if-available");
+const json_1 = require("../../generators/utils/json");
+const project_configuration_1 = require("../../generators/utils/project-configuration");
+const path_1 = require("../../utils/path");
+// TODO(v24): remove this migration alongside the runtime fallback it exists to
+// retire (`isLegacyCachedTarget` in `target-normalization.ts`), along with its
+// registration in `packages/nx/migrations.json`.
+/**
+ * Target defaults resolve to a single key rather than merging, so an executor
+ * key hides the target name key entirely. Before Nx 23 a hidden `cache: true`
+ * still took effect, because cacheability was also derived from target *names*
+ * via `cacheableOperations`; Nx 23 removed that derivation and those targets
+ * silently stopped being cacheable.
+ *
+ * Write the intent into the executor key so it no longer depends on the
+ * deprecated fallback that restores the old behavior at run time.
+ */
+async function update(tree) {
+    const nxJson = (0, project_configuration_1.readNxJson)(tree);
+    const targetDefaults = nxJson?.targetDefaults;
+    if (!targetDefaults) {
+        return;
+    }
+    const projects = (0, project_configuration_1.getProjects)(tree);
+    const projectsMap = {};
+    // `cache` on an executor key reaches every target that resolves through it,
+    // not just the one whose target name key enables caching. Collect them all
+    // per key so the decision below can be made for the key as a whole. The
+    // collection is a list rather than a map keyed by target name: two projects
+    // routinely declare the same target name through the same executor, and only
+    // one of them may be continuous.
+    const targetsByExecutorKey = new Map();
+    const collect = (targetName, target) => {
+        // `hasOwnProperty` rather than a lookup: an executor named `__proto__` or
+        // `constructor` resolves through the prototype chain to a truthy object, so
+        // a plain lookup would collect the target and stamp `Object.prototype`.
+        if (!target?.executor ||
+            !Object.prototype.hasOwnProperty.call(targetDefaults, target.executor)) {
+            return;
+        }
+        const targets = targetsByExecutorKey.get(target.executor) ?? [];
+        targets.push([targetName, target]);
+        targetsByExecutorKey.set(target.executor, targets);
+    };
+    for (const [projectName, project] of projects) {
+        projectsMap[projectName] = project;
+        for (const [targetName, target] of Object.entries(project.targets ?? {})) {
+            collect(targetName, target);
+        }
+        for (const [targetName, target] of Object.entries(packageJsonTargets(tree, project.root))) {
+            collect(targetName, target);
+        }
+    }
+    let changed = false;
+    for (const [key, targets] of targetsByExecutorKey) {
+        if (!canEnableCache(targetDefaults, key, targets, tree.root, projectsMap)) {
+            continue;
+        }
+        catchAllConfig(targetDefaults[key]).cache = true;
+        changed = true;
+    }
+    if (!changed) {
+        return;
+    }
+    (0, project_configuration_1.updateNxJson)(tree, nxJson);
+    await (0, format_changed_files_with_prettier_if_available_1.formatChangedFilesWithPrettierIfAvailable)(tree);
+}
+/**
+ * Whether `cache: true` can be written onto `key` without changing behavior for
+ * any target that resolves through it.
+ *
+ * The executor key outranks every target name key, so stamping it caches all of
+ * `targets` — including any that is continuous, which makes `nx.json` fail graph
+ * construction outright. The key is only safe when every target through it
+ * independently wants caching and none of them can be continuous. Anything else
+ * is left to the runtime fallback, which decides per target after normalization
+ * and can therefore see continuity this migration cannot.
+ */
+function canEnableCache(targetDefaults, key, targets, workspaceRoot, projectsMap) {
+    // Targets written with `command` are rewritten to `nx:run-commands` and
+    // `package.json` scripts to `nx:run-script` before key selection, so neither
+    // names the key it resolves through. Plugins also infer continuous targets
+    // (`watch-deps`, dev servers) into projects whose config never mentions them.
+    // The target list here can never be trusted to be complete for these keys.
+    if (key === 'nx:run-commands' || key === 'nx:run-script') {
+        return false;
+    }
+    // Already decided; never override the user's value. A filtered entry counts
+    // as decided because its value can't be evaluated without project context.
+    if (declaresAnyCache(targetDefaults[key])) {
+        return false;
+    }
+    // `continuous` is a valid field on a target default, and this key applies it
+    // to every target that resolves through it. Adding `cache` would make each of
+    // them both cacheable and continuous, which fails graph construction — so no
+    // target list can make this key safe.
+    if (declaresAnyContinuous(targetDefaults[key])) {
+        return false;
+    }
+    // Only an unfiltered entry can be amended. Appending a catch-all to an
+    // all-filtered key would make it match targets that previously fell through
+    // to the target name key, silently dropping that key's `dependsOn`/`inputs`.
+    if (!catchAllConfig(targetDefaults[key])) {
+        return false;
+    }
+    // Continuity declared by the executor's schema is resolved at graph
+    // construction for every target through this key, so one lookup covers them
+    // all. For what an executor that cannot be resolved here costs, see
+    // {@link executorDeclaresContinuous}.
+    if (executorDeclaresContinuous(key, workspaceRoot, projectsMap)) {
+        return false;
+    }
+    for (const [targetName, target] of targets) {
+        if (!declaresCacheTrue(targetDefaults[targetName])) {
+            return false;
+        }
+        if (target.continuous || isLongRunningTargetName(targetName)) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Whether the target name key declares `cache: true` on an entry that always
+ * applies. Mirrors `declaresCacheTrue` in `target-normalization.ts`: a filtered
+ * entry declaring `cache` makes the value unknowable without project context,
+ * so nothing is claimed. Among unfiltered entries the last wins.
+ */
+function declaresCacheTrue(value) {
+    if (!value) {
+        return false;
+    }
+    let declared;
+    for (const entry of configEntries(value)) {
+        if (entry.cache === undefined)
+            continue;
+        if (entry.filter)
+            return false;
+        declared = entry.cache;
+    }
+    return declared === true;
+}
+/**
+ * Whether any entry declares `cache`, filtered or not — i.e. whether the value
+ * is already decided and must be left alone. Deliberately broader than
+ * {@link declaresCacheTrue}: a filtered `cache` blocks here rather than being
+ * read past, so the two never disagree about a filtered entry.
+ */
+function declaresAnyCache(value) {
+    if (!value) {
+        return false;
+    }
+    return configEntries(value).some((entry) => entry.cache !== undefined);
+}
+/**
+ * Whether any entry declares `continuous: true`. Filtered entries count: which
+ * projects the filter matches is unknowable here, and the only case that
+ * matters is the one where it matches.
+ */
+function declaresAnyContinuous(value) {
+    if (!value) {
+        return false;
+    }
+    return configEntries(value).some((entry) => entry.continuous === true);
+}
+/**
+ * The config blocks of a `targetDefaults` value. Entries that are not config
+ * objects are dropped rather than inspected: `nx.json` is hand-edited, and a
+ * `null` or scalar entry would otherwise throw while reading `.cache` off it.
+ */
+function configEntries(value) {
+    const entries = Array.isArray(value) ? value : [value];
+    return entries.filter((entry) => !!entry && typeof entry === 'object');
+}
+/**
+ * The targets a project's `package.json` contributes to the graph.
+ *
+ * {@link getProjects} builds a root's configuration from its `project.json`
+ * alone whenever one exists, but the package.json plugin still creates the
+ * sibling `package.json`'s targets — it accepts any `package.json` that is
+ * either in the package manager workspaces or next to a `project.json`
+ * (`plugins/package-json/create-nodes.ts`). Those targets resolve through the
+ * same executor keys, so they belong in this decision.
+ *
+ * Targets derived from `scripts` are still not covered; they resolve through
+ * `nx:run-script`, which is never stamped for exactly that reason.
+ */
+function packageJsonTargets(tree, projectRoot) {
+    const packageJsonPath = (0, path_1.joinPathFragments)(projectRoot, 'package.json');
+    if (!tree.exists(packageJsonPath)) {
+        return {};
+    }
+    // A parse failure is left to throw: `readJson` names the offending file,
+    // which is the one thing a user can act on. Shapes that parse but aren't the
+    // one this reads contribute no targets rather than crashing the run.
+    const targets = (0, json_1.readJson)(tree, packageJsonPath)?.nx?.targets;
+    if (!targets || typeof targets !== 'object' || Array.isArray(targets)) {
+        return {};
+    }
+    return targets;
+}
+/**
+ * The unfiltered config block of a `targetDefaults` value, or undefined when the
+ * array form carries only filtered entries and when the value is not a config
+ * object at all. Never creates one — see {@link canEnableCache}.
+ */
+function catchAllConfig(value) {
+    // The filter check applies to both spellings: the object and single-element
+    // array forms of the same config have to reach the same verdict.
+    return configEntries(value).find((entry) => entry.filter === undefined);
+}
+/**
+ * Whether the executor's schema marks its targets continuous, resolved through
+ * the same `getExecutorInformation` call `normalizeTarget` makes at graph
+ * construction, so the two cannot drift on what continuous means.
+ *
+ * An executor that cannot be resolved is read as not continuous. That is the
+ * same answer `normalizeTarget` gives, but not the same trade: its lookup is
+ * repeated on every graph construction, so a failure there corrects itself,
+ * whereas this one decides a permanent edit to `nx.json`. An executor that is
+ * unresolvable while the migration runs and resolvable afterwards therefore
+ * keeps its stamped `cache` while the runtime starts marking its targets
+ * continuous — which `normalizeTargets` rejects with a `WorkspaceValidityError`,
+ * failing graph construction until `nx.json` is edited by hand.
+ */
+function executorDeclaresContinuous(executor, workspaceRoot, projectsMap) {
+    try {
+        const [nodeModule, name] = (0, executor_utils_1.parseExecutor)(executor);
+        const { schema } = (0, executor_utils_1.getExecutorInformation)(nodeModule, name, workspaceRoot, projectsMap);
+        return !!schema.continuous;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Target names the pre-23 `longRunningTask` guard excluded from caching.
+ * Mirrors `isLongRunningTarget` in `target-normalization.ts`.
+ */
+function isLongRunningTargetName(targetName) {
+    return (targetName.endsWith(':watch') ||
+        targetName.endsWith('-watch') ||
+        targetName === 'serve' ||
+        targetName === 'dev' ||
+        targetName === 'start');
+}