nx 23.1.0 → 23.1.2

package/dist/src/project-graph/utils/project-configuration/target-defaults.js

@@ -21,7 +21,7 @@ const utils_1 = require("./utils");
  * fly. That's all the matcher needs; the full target merge happens
  * downstream in the real merge.
  */
-function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMap, nxJsonConfiguration, specifiedSourceMaps, defaultSourceMaps) {
+function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMap, nxJsonConfiguration, specifiedSourceMaps) {
     const targetDefaultsConfig = nxJsonConfiguration.targetDefaults;
     if (!targetDefaultsConfig) {
         return [];
@@ -65,7 +65,7 @@ function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMa
             if (!effective)
                 continue;
             const sourcePlugin = needsSourcePlugin
-                ? resolveSourcePlugin(root, targetName, specifiedSourceMaps, defaultSourceMaps)
+                ? resolveSourcePlugin(root, targetName, defaultTargets[targetName], specifiedSourceMaps)
                 : undefined;
             const syntheticTargets = buildSyntheticTargetsForRoot(targetName, root, effective, targetDefaults, projectName, projectNode, sourcePlugin);
             for (const { key, index, target } of syntheticTargets) {
@@ -372,34 +372,33 @@ function normalizeTargetDefaultValue(value) {
     // A bare config object is functionally a one-element array.
     return [value ?? {}];
 }
-function resolveSourcePlugin(root, targetName, specifiedSourceMaps, defaultSourceMaps) {
-    // Default-plugin attribution overrides specified-plugin attribution in the
-    // merge, so check it first. The executor/command keys carry the plugin that
-    // *created* the target, which is what `filter.plugin` ("targets originated by
-    // X") means. The top-level `targets.<name>` node key is deliberately NOT used
-    // as a fallback: it tracks the last writer, so a later plugin augmenting the
-    // target would mis-attribute it. The trade-off is that a target with neither
-    // an executor nor a command (a rare, non-runnable shape) resolves to no
-    // source plugin and won't match a `filter.plugin` default — accepted, since
-    // every runnable target carries one of these keys.
-    const executorKey = `${(0, source_maps_1.targetSourceMapKey)(targetName)}.executor`;
-    const commandKey = `${(0, source_maps_1.targetSourceMapKey)(targetName)}.command`;
-    const candidates = [
-        pluginFromSourceMap(defaultSourceMaps, root, executorKey),
-        pluginFromSourceMap(defaultSourceMaps, root, commandKey),
-        pluginFromSourceMap(specifiedSourceMaps, root, executorKey),
-        pluginFromSourceMap(specifiedSourceMaps, root, commandKey),
-    ];
-    for (const candidate of candidates) {
-        if (candidate && candidate !== source_maps_1.TARGET_DEFAULTS_PLUGIN_NAME)
-            return candidate;
+function resolveSourcePlugin(root, targetName, defaultTarget, specifiedSourceMaps) {
+    // `filter.plugin` ("targets originated by X") can only name a plugin from
+    // nx.json's `plugins` — the specified set. When the default layer authors
+    // the target's identity (its merged config carries an executor or command,
+    // which the merge lets win), the originator is a default plugin and the
+    // target has no matchable source plugin; no source maps are needed to see
+    // that. Otherwise the specified layer's executor/command attribution names
+    // the originator. The top-level `targets.<name>` node key is deliberately
+    // NOT used as a fallback: it tracks ownership, so a later plugin augmenting
+    // the target would mis-attribute it. The trade-off is that a target with
+    // neither an executor nor a command (a rare, non-runnable shape) resolves to
+    // no source plugin and won't match a `filter.plugin` default — accepted,
+    // since every runnable target carries one of these keys.
+    if (defaultTarget &&
+        (defaultTarget.executor !== undefined ||
+            defaultTarget.command !== undefined)) {
+        return undefined;
+    }
+    const sourceMap = specifiedSourceMaps?.[root];
+    for (const identityKey of ['executor', 'command']) {
+        const plugin = sourceMap?.[`${(0, source_maps_1.targetSourceMapKey)(targetName)}.${identityKey}`]?.[1];
+        if (plugin && plugin !== source_maps_1.TARGET_DEFAULTS_PLUGIN_NAME) {
+            return plugin;
+        }
     }
     return undefined;
 }
-function pluginFromSourceMap(maps, root, key) {
-    const entry = maps?.[root]?.[key];
-    return entry?.[1];
-}
 // Builds a name → MatcherProjectNode view for `findMatchingProjects` to
 // consult, across both layered rootMaps. Tags are unioned across layers. A
 // full `mergeProjectConfigurationIntoRootMap` would be overkill — the matcher

package/dist/src/project-graph/utils/project-configuration/target-merging.js

@@ -170,6 +170,11 @@ function mergeConfigurations(newConfigurations, baseConfigurations, projectConfi
             // Before '...': base wins for shared names. Keep base's source-map
             // entries when it owns the config.
             if (baseHasConfig) {
+                // Base wins, so the incoming config is dropped without reaching
+                // `mergeConfigurationValue`. Validate its nested spread here so an
+                // integer-like-key ambiguity throws regardless of which side owns
+                // the config name (mirrors the base-independent target-level check).
+                (0, utils_1.assertNoIntegerLikeSpreadKey)(newConfigurations?.[configName], configIdentifier ? `Object at "${configIdentifier}"` : 'Object');
                 mergedConfigurations[configName] = baseConfigurations[configName];
             }
             else {
@@ -282,8 +287,11 @@ function mergeTargetConfigurations(target, baseTarget, projectConfigSourceMap, s
         ? new Set(targetKeys.slice(0, spreadPosInTarget))
         : new Set();
     // Integer-like keys get hoisted to targetKeys[0], making their position
-    // relative to '...' unrecoverable.
-    if (hasSpread &&
+    // relative to '...' unrecoverable. This is a property of the authored
+    // config, not of the base, so it throws regardless of compatibility —
+    // which also keeps the error identical between the target-defaults staging
+    // merge and the real merge, whose bases differ.
+    if (spreadPosInTarget >= 0 &&
         targetKeys[0] &&
         utils_1.INTEGER_LIKE_KEY_PATTERN.test(targetKeys[0])) {
         throw new utils_1.IntegerLikeSpreadKeyError(targetKeys[0], targetIdentifier ? `Target at "${targetIdentifier}"` : 'Target');
@@ -304,6 +312,13 @@ function mergeTargetConfigurations(target, baseTarget, projectConfigSourceMap, s
             return;
         if (hasSpread && keysBeforeSpread.has(key)) {
             // Before '...': base wins; fall through to target only if base lacks it.
+            // When base wins, the incoming `target[key]` is dropped without ever
+            // reaching `getMergeValueResult`, so validate its nested spread here —
+            // the integer-like-key ambiguity is a property of the authored value,
+            // not of which side owns the key, and must throw either way.
+            (0, utils_1.assertNoIntegerLikeSpreadKey)(target[key], projectConfigSourceMap
+                ? `Object at "${targetIdentifier}.${key}"`
+                : 'Object');
             result[key] =
                 key in mergeBase
                     ? mergeBase[key]
@@ -381,13 +396,20 @@ function mergeTargetConfigurations(target, baseTarget, projectConfigSourceMap, s
             processKey(key);
         }
     }
-    // Update source map once after loop. Real plugins win last, but a target
-    // default — which only stamps fields onto an existing target and never
-    // authors its existence — must not steal the node key from the plugin that
-    // introduced the target. An incompatible replace clears these keys above, so
-    // a replacing real plugin still re-owns the node.
+    // Update the node key once after the loop. Ownership follows identity: this
+    // merge claims `targets.<name>` only when it changed the target's identity
+    // (a new/different executor or command, or an incompatible replace — whose
+    // key purge above empties the slot anyway). A plugin that only layers fields
+    // onto an existing target leaves the node with its creator; weak
+    // target-defaults stamps are always reclaimable.
     if (projectConfigSourceMap) {
-        (0, source_maps_1.recordTargetIdentitySourceMapInfo)(projectConfigSourceMap, targetIdentifier, sourceInformation);
+        const identityChanged = !isCompatible ||
+            (target.executor !== undefined &&
+                target.executor !== baseTarget?.executor) ||
+            (target.command !== undefined &&
+                target.command !== baseTarget?.command) ||
+            suppliesNewOptionsIdentity(baseTarget, target);
+        (0, source_maps_1.recordTargetIdentitySourceMapInfo)(projectConfigSourceMap, targetIdentifier, sourceInformation, identityChanged);
     }
     // merge options if there are any
     // if the targets aren't compatible, we simply discard the old options during the merge
@@ -443,6 +465,26 @@ function isCompatibleTarget(a, b) {
     }
     return true;
 }
+/**
+ * Run-commands and run-script targets carry their runnable identity in
+ * `options` (see {@link isCompatibleTarget}). A layer that supplies that
+ * identity where the base had none changed what the target runs — the same
+ * identity change as setting an executor on a target that had none.
+ */
+function suppliesNewOptionsIdentity(baseTarget, target) {
+    const executor = target.executor ?? baseTarget?.executor;
+    if (executor === 'nx:run-commands') {
+        const baseCommand = baseTarget?.options?.command ??
+            baseTarget?.options?.commands?.join(' && ');
+        const targetCommand = target.options?.command ?? target.options?.commands?.join(' && ');
+        return !!targetCommand && targetCommand !== baseCommand;
+    }
+    if (executor === 'nx:run-script') {
+        const targetScript = target.options?.script;
+        return !!targetScript && targetScript !== baseTarget?.options?.script;
+    }
+    return false;
+}
 function resolveNxTokensInOptions(object, project, key) {
     const result = Array.isArray(object) ? [...object] : { ...object };
     for (let [opt, value] of Object.entries(object ?? {})) {

package/dist/src/project-graph/utils/project-configuration/target-normalization.js

@@ -5,10 +5,13 @@ exports.normalizeTarget = normalizeTarget;
 exports.validateAndNormalizeProjectRootMap = validateAndNormalizeProjectRootMap;
 const executor_utils_1 = require("../../../command-line/run/executor-utils");
 const fileutils_1 = require("../../../utils/fileutils");
+const long_running_target_1 = require("../../../utils/long-running-target");
+const output_1 = require("../../../utils/output");
 const to_project_name_1 = require("../../../config/to-project-name");
 const error_types_1 = require("../../error-types");
 const target_merging_1 = require("./target-merging");
 const node_fs_1 = require("node:fs");
+const git_worktrees_1 = require("../../../utils/git-worktrees");
 const path_1 = require("path");
 function validateProject(project, 
 // name -> project
@@ -65,15 +68,137 @@ function normalizeTarget(target, project, workspaceRoot, projectsMap, errorMsgKe
     }
     return target;
 }
+// TODO(v24): remove the legacy target-name cache fallback and its warning.
+// Removal needs a second mechanism for plugin-inferred targets, which the
+// accompanying migration cannot reach.
+/**
+ * Whether `target` is cacheable only by way of the legacy name-based fallback:
+ * the exact target-name key of `targetDefaults` declares `cache: true`, but an
+ * executor key won target-default resolution instead, so the merged target never
+ * received it.
+ *
+ * A `true` result means the user's `cache: true` silently lost, so this doubles
+ * as the condition for warning them that the name key is being shadowed.
+ */
+function isLegacyCachedTarget(targetName, targetDefaults, target) {
+    // Resolution already decided `cache`, so the name key isn't shadowed.
+    if (target.cache !== undefined) {
+        return false;
+    }
+    if (isLongRunningTarget(targetName, target)) {
+        return false;
+    }
+    // Restricted to shadowing, which is narrower than what pre-23 restored: that
+    // derivation matched on target name alone, so a name key dropped as
+    // incompatible (its entry declared a foreign executor) was cacheable too.
+    // Restoring that as well would mean writing `cache` with no key to name in
+    // the warning, and no migration able to retire it. Deliberately not covered.
+    if (!findShadowingTargetDefaultKey(targetDefaults, target)) {
+        return false;
+    }
+    return declaresCacheTrue(targetDefaults?.[targetName]);
+}
+/**
+ * Whether the name key declares `cache: true` on an entry that always applies.
+ *
+ * Filters are deliberately not evaluated. They cannot express a pre-23 config
+ * (the filtered array shape postdates the behavior being restored), and a
+ * filtered entry declaring `cache` may or may not apply to this project — so
+ * rather than guess, a filtered `cache` declares the value unknowable and
+ * nothing is restored. Among unfiltered entries the last wins, matching the
+ * in-key merge order.
+ */
+function declaresCacheTrue(value) {
+    if (!value) {
+        return false;
+    }
+    const entries = Array.isArray(value) ? value : [value];
+    let declared;
+    for (const entry of entries) {
+        // `nx.json` is hand-edited; a null or scalar entry would throw here.
+        if (!entry || typeof entry !== 'object')
+            continue;
+        if (entry.cache === undefined)
+            continue;
+        if (entry.filter)
+            return false;
+        declared = entry.cache;
+    }
+    return declared === true;
+}
+/**
+ * The normalization-time half of the pre-23 `longRunningTask` guard, which kept
+ * `cacheableOperations` from ever making these cacheable. Its remaining clause
+ * — `task.overrides['watch']` — is a runtime invocation override with no target
+ * equivalent, so it has no counterpart here.
+ */
+function isLongRunningTarget(targetName, target) {
+    return !!target.continuous || (0, long_running_target_1.isLongRunningTargetName)(targetName);
+}
+/**
+ * The `targetDefaults` key that beat the target-name key for `target`. Only an
+ * executor key can: key precedence puts the exact target name ahead of every
+ * glob, so nothing else outranks it. Undefined when the name key lost for
+ * another reason (e.g. its entry declared a foreign executor and was dropped as
+ * incompatible) — see {@link isLegacyCachedTarget} for why that case is left
+ * alone even though pre-23 restored it.
+ *
+ * `hasOwnProperty` rather than a lookup: an executor named `__proto__` resolves
+ * through the prototype chain to a truthy object, which would report a key the
+ * user never wrote.
+ */
+function findShadowingTargetDefaultKey(targetDefaults, target) {
+    return target.executor &&
+        targetDefaults &&
+        Object.prototype.hasOwnProperty.call(targetDefaults, target.executor)
+        ? target.executor
+        : undefined;
+}
+/**
+ * Emits a single grouped warning for every (shadowing key, target-name key)
+ * pair that relied on the deprecated fallback. Grouping matters because the
+ * same pair recurs in every affected project — a per-target warning would
+ * print hundreds of identical lines in a large workspace.
+ */
+function warnAboutLegacyCachedTargets(legacyCacheReads) {
+    if (legacyCacheReads.size === 0) {
+        return;
+    }
+    const bodyLines = [];
+    for (const [shadowingKey, targetKeys] of legacyCacheReads) {
+        for (const targetKey of targetKeys) {
+            bodyLines.push(`  - "${shadowingKey}" does not set "cache", so it was read from "${targetKey}"`);
+        }
+    }
+    bodyLines.push('', 'An executor key applies to every target that resolves through it, so exclude any continuous target before setting "cache" on one — a target that is both cacheable and continuous is rejected.', 'Target defaults resolve to a single key rather than merging, so an executor key hides the target name key entirely.', 'Set "cache" on the executor key to keep these targets cacheable — reading it from the target name key is deprecated and will be removed in Nx 24.');
+    output_1.output.warn({
+        title: 'Some targets are only cacheable through a deprecated fallback.',
+        bodyLines,
+    });
+}
 function normalizeTargets(project, sourceMaps, nxJsonConfiguration, workspaceRoot, 
 /**
  * Project configurations keyed by project name
  */
-projects) {
+projects, 
+/**
+ * Shadowing `targetDefaults` key -> target name keys its `cache` was read
+ * from. Accumulated across projects so the deprecation warns once per pair.
+ */
+legacyCacheReads) {
     const targetErrorMessage = [];
     for (const targetName in project.targets) {
         project.targets[targetName] = normalizeTarget(project.targets[targetName], project, workspaceRoot, projects, [project.root, targetName].join(':'));
         const target = project.targets[targetName];
+        const targetDefaults = nxJsonConfiguration.targetDefaults;
+        if (isLegacyCachedTarget(targetName, targetDefaults, target)) {
+            target.cache = true;
+            // Always defined: `isLegacyCachedTarget` returns false without it.
+            const shadowingKey = findShadowingTargetDefaultKey(targetDefaults, target);
+            const targetKeys = legacyCacheReads.get(shadowingKey) ?? new Set();
+            targetKeys.add(targetName);
+            legacyCacheReads.set(shadowingKey, targetKeys);
+        }
         if (
         // If the target has no executor or command, it doesn't do anything
         !target.executor &&
@@ -106,6 +231,7 @@ function validateAndNormalizeProjectRootMap(workspaceRoot, projectRootMap, nxJso
     const conflicts = new Map();
     const projectRootsWithNoName = [];
     const validityErrors = [];
+    const legacyCacheReads = new Map();
     for (const root in projectRootMap) {
         const project = projectRootMap[root];
         // We're setting `// targets` as a comment `targets` is empty due to Project Crystal.
@@ -115,9 +241,22 @@ function validateAndNormalizeProjectRootMap(workspaceRoot, projectRootMap, nxJso
         // We initially did this in the project.json plugin, but
         // that resulted in project.json files without names causing
         // the resulting project to change names from earlier plugins...
-        if (!project.name &&
-            (0, node_fs_1.existsSync)((0, path_1.join)(workspaceRoot, project.root, 'project.json'))) {
-            project.name = (0, to_project_name_1.toProjectName)((0, path_1.join)(root, 'project.json'));
+        if (!project.name) {
+            const projectJsonPath = (0, path_1.join)(workspaceRoot, project.root, 'project.json');
+            if ((0, node_fs_1.existsSync)(projectJsonPath)) {
+                // The project.json plugin may not have run (e.g. when a single
+                // plugin is run in isolation via `addPlugin` from a generator), so
+                // prefer the name declared in project.json before deriving one from
+                // the directory name.
+                let nameFromProjectJson;
+                try {
+                    nameFromProjectJson =
+                        (0, fileutils_1.readJsonFile)(projectJsonPath).name;
+                }
+                catch { }
+                project.name =
+                    nameFromProjectJson ?? (0, to_project_name_1.toProjectName)((0, path_1.join)(root, 'project.json'));
+            }
         }
         try {
             validateProject(project, projects);
@@ -142,7 +281,7 @@ function validateAndNormalizeProjectRootMap(workspaceRoot, projectRootMap, nxJso
     for (const root in projectRootMap) {
         const project = projectRootMap[root];
         try {
-            normalizeTargets(project, sourceMaps, nxJsonConfiguration, workspaceRoot, projects);
+            normalizeTargets(project, sourceMaps, nxJsonConfiguration, workspaceRoot, projects, legacyCacheReads);
         }
         catch (e) {
             if (e instanceof error_types_1.WorkspaceValidityError) {
@@ -153,9 +292,13 @@ function validateAndNormalizeProjectRootMap(workspaceRoot, projectRootMap, nxJso
             }
         }
     }
+    warnAboutLegacyCachedTargets(legacyCacheReads);
     const errors = [];
     if (conflicts.size > 0) {
-        errors.push(new error_types_1.MultipleProjectsWithSameNameError(conflicts, projects));
+        // Only on the way to throwing, so a workspace without duplicates never
+        // pays for reading git's worktree registry.
+        const worktreeAdvice = (0, git_worktrees_1.analyzeWorktreeConflicts)(workspaceRoot, conflicts);
+        errors.push(new error_types_1.MultipleProjectsWithSameNameError(conflicts, projects, worktreeAdvice ?? undefined));
     }
     if (projectRootsWithNoName.length > 0) {
         errors.push(new error_types_1.ProjectsWithNoNameError(projectRootsWithNoName, projects));

package/dist/src/project-graph/utils/project-configuration/utils.d.ts

@@ -8,6 +8,21 @@ export declare const INTEGER_LIKE_KEY_PATTERN: RegExp;
 export declare class IntegerLikeSpreadKeyError extends Error {
     constructor(key: string, context: string);
 }
+/**
+ * Throws `IntegerLikeSpreadKeyError` when `value` is a `'...'` spread object
+ * whose enumeration hoists an integer-like key ahead of the spread, making its
+ * authored position ambiguous.
+ *
+ * The ambiguity is a property of the authored value alone, not of any merge
+ * base. `mergeObjectWithSpread` runs this the moment it merges such a value —
+ * but a merge layer that lets the base win a key drops the incoming value
+ * without merging it, so the check must also be run eagerly at those
+ * base-owns-key shortcuts. Otherwise the error would surface or vanish
+ * depending on which side owns the key (e.g. it fires in the target-defaults
+ * staging merge but not the real merge), which is exactly the divergence that
+ * makes discarding staging errors unsafe.
+ */
+export declare function assertNoIntegerLikeSpreadKey(value: unknown, errorContext: string): void;
 type SourceMapContext = {
     sourceMap: Record<string, SourceInformation>;
     key: string;

package/dist/src/project-graph/utils/project-configuration/utils.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IntegerLikeSpreadKeyError = exports.INTEGER_LIKE_KEY_PATTERN = exports.NX_SPREAD_TOKEN = void 0;
 exports.uniqueKeysInObjects = uniqueKeysInObjects;
+exports.assertNoIntegerLikeSpreadKey = assertNoIntegerLikeSpreadKey;
 exports.getMergeValueResult = getMergeValueResult;
 const source_maps_1 = require("./source-maps");
 exports.NX_SPREAD_TOKEN = '...';
@@ -30,6 +31,29 @@ class IntegerLikeSpreadKeyError extends Error {
     }
 }
 exports.IntegerLikeSpreadKeyError = IntegerLikeSpreadKeyError;
+/**
+ * Throws `IntegerLikeSpreadKeyError` when `value` is a `'...'` spread object
+ * whose enumeration hoists an integer-like key ahead of the spread, making its
+ * authored position ambiguous.
+ *
+ * The ambiguity is a property of the authored value alone, not of any merge
+ * base. `mergeObjectWithSpread` runs this the moment it merges such a value —
+ * but a merge layer that lets the base win a key drops the incoming value
+ * without merging it, so the check must also be run eagerly at those
+ * base-owns-key shortcuts. Otherwise the error would surface or vanish
+ * depending on which side owns the key (e.g. it fires in the target-defaults
+ * staging merge but not the real merge), which is exactly the divergence that
+ * makes discarding staging errors unsafe.
+ */
+function assertNoIntegerLikeSpreadKey(value, errorContext) {
+    if (!isObject(value) || value[exports.NX_SPREAD_TOKEN] !== true) {
+        return;
+    }
+    const keys = Object.keys(value);
+    if (keys[0] && exports.INTEGER_LIKE_KEY_PATTERN.test(keys[0])) {
+        throw new IntegerLikeSpreadKeyError(keys[0], errorContext);
+    }
+}
 /**
  * `"..."` in `newValue` (as an array element or a key set to `true`)
  * expands the base at that position; otherwise `newValue` replaces
@@ -52,11 +76,25 @@ function getMergeValueResult(baseValue, newValue, sourceMapContext, deferSpreads
     // plugin already set, purely as a merge guard — must not steal provenance
     // from the layer that introduced the value. A genuinely new value (no base,
     // or a different one) still attributes to the new layer.
-    if (!isUnchangedPrimitive(newValue, baseValue)) {
+    //
+    // The exception cuts the other way too: when the *existing* attribution is a
+    // target-defaults stamp (TD merges before the plugin whose value it
+    // predicted, so its stamp lands first), a real plugin re-stating that value
+    // is the genuine author and reclaims the key.
+    if (!isUnchangedPrimitive(newValue, baseValue) ||
+        isReclaimableTargetDefaultsStamp(sourceMapContext)) {
         writeTopLevelSourceMap(sourceMapContext);
     }
     return newValue;
 }
+// Whether the key's current attribution is a weak target-defaults stamp that
+// the (non-target-defaults) writer should reclaim despite the value being
+// unchanged.
+function isReclaimableTargetDefaultsStamp(ctx) {
+    return (!!ctx &&
+        ctx.sourceMap[ctx.key]?.[1] === source_maps_1.TARGET_DEFAULTS_PLUGIN_NAME &&
+        ctx.sourceInformation[1] !== source_maps_1.TARGET_DEFAULTS_PLUGIN_NAME);
+}
 // Whether `newValue` leaves a defined primitive base untouched. Objects fall
 // through (always re-attributed) to preserve the existing replace semantics —
 // the regression this guards is scalar executor/command re-stamping.
@@ -120,12 +158,10 @@ function mergeObjectWithSpread(baseValue, newValue, sourceMapContext, deferSprea
     const errorContext = sourceMapContext?.key
         ? `Object at "${sourceMapContext.key}"`
         : 'Object';
+    // Integer-like keys are hoisted to the front of enumeration, so one
+    // alongside `'...'` makes its authored position ambiguous.
+    assertNoIntegerLikeSpreadKey(newValue, errorContext);
     const newKeys = Object.keys(newValue);
-    // Integer-like keys are hoisted to the front of enumeration, so if one
-    // exists alongside `'...'` it must be newKeys[0].
-    if (newKeys[0] && exports.INTEGER_LIKE_KEY_PATTERN.test(newKeys[0])) {
-        throw new IntegerLikeSpreadKeyError(newKeys[0], errorContext);
-    }
     // Base per-key sources captured lazily — only for shared keys the new
     // object overwrites before `'...'`, since writing their new source
     // clobbers the base entry the spread will need to restore.

package/dist/src/project-graph/utils/project-configuration-utils.d.ts

@@ -60,19 +60,22 @@ export type MergeError = AggregateCreateNodesError | MergeNodesError | ProjectsW
 /**
  * Merges create nodes results into a single rootMap.
  *
- * Specified plugin results are merged once into the manager. Default
- * plugin results are first staged into an intermediate rootMap (with
- * `'...'` spreads deferred) so that synthesis can read each layer's
- * contribution without re-running the merge. The synthetic result from
- * `createTargetDefaultsResults` is then merged into the manager, and
- * the staged intermediate is replayed on top — that replay is where
- * deferred spreads expand against the final (specified + synth) base.
+ * Every layer merges into the manager through the same source-map-aware
+ * merge, in precedence order:
  *
- * Synthesis itself doesn't materialize a second rootMap. Per
- * (root, target) it does an on-the-fly merge of the two layered
- * contributions to learn the eventual executor/command, then matches
- * defaults against that merged shape. This keeps specified-plugin
- * merge work to a single pass.
+ *   specified plugins → synthetic target defaults → default plugins
+ *
+ * so field-level provenance is decided by the merge itself for all three
+ * layers — whichever layer a field's final value came from owns its
+ * attribution, and `'...'` spreads in default-plugin configs resolve against
+ * the accumulated specified + target-defaults base.
+ *
+ * Target-default synthesis needs the *merged* shape of the default layer
+ * (to predict each target's eventual executor/command) before that layer
+ * merges into the manager. To get it, default results are first staged into
+ * a throwaway intermediate rootMap with unresolvable `'...'` spreads
+ * deferred. The staging output feeds only `createTargetDefaultsResults`; the
+ * default plugins then merge into the manager from their original results.
  */
 export declare function mergeCreateNodesResults(specifiedResults: CreateNodesResultEntry[][], defaultResults: CreateNodesResultEntry[][], nxJsonConfiguration: NxJsonConfiguration, workspaceRoot: string, errors: MergeError[]): {
     projectRootMap: Record<string, ProjectConfiguration>;