nx 23.2.0-beta.0 → 23.2.0-beta.10

package/dist/src/project-graph/project-graph.js

@@ -244,6 +244,7 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
                     track: true,
                     ...(analytics_1.customDimensions && {
                         [analytics_1.customDimensions.projectCount]: Object.keys(currentProjectGraph.nodes).length,
+                        [analytics_1.customDimensions.sampleRate]: analytics_1.PERF_SPAN_SAMPLE_RATE,
                     }),
                 },
             });
@@ -310,6 +311,7 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
                     ...(analytics_1.customDimensions && {
                         [analytics_1.customDimensions.projectCount]: Object.keys(res.projectGraph.nodes)
                             .length,
+                        [analytics_1.customDimensions.sampleRate]: analytics_1.PERF_SPAN_SAMPLE_RATE,
                     }),
                 },
             });
@@ -333,6 +335,7 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
                     track: true,
                     ...(analytics_1.customDimensions && {
                         [analytics_1.customDimensions.projectCount]: Object.keys(projectGraphAndSourceMaps.projectGraph.nodes).length,
+                        [analytics_1.customDimensions.sampleRate]: analytics_1.PERF_SPAN_SAMPLE_RATE,
                     }),
                 },
             });
@@ -351,6 +354,26 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
                 (0, tmp_dir_1.markDaemonAsDisabled)(e.message);
                 return buildProjectGraphAndSourceMapsWithoutDaemon();
             }
+            if (e.daemonPermissionError) {
+                // Deliberately not disabled: unlike the inotify limit above, a socket
+                // owned by someone else stops being there when it is removed or the
+                // machine reboots, and disabling until `nx reset` would outlive the
+                // cause and hide the fix from anyone who followed the advice.
+                // The first line carries the errno, and it is the one token that tells
+                // the two causes apart: EACCES is a socket owned by someone else (delete
+                // it), EPERM is a sandbox refusing the connect syscall (allow unix
+                // sockets under the Nx socket root). The message hedges between exactly
+                // those two because it cannot tell them apart, and this branch does not
+                // call writeDaemonLogs, so dropping the line loses the errno for good.
+                const [summary, ...details] = e.message.split('\n');
+                output_1.output.note({
+                    title: `${summary} Continuing without the daemon.`,
+                    // The blank line after the summary separates paragraphs when the
+                    // message is printed as one blob; as bodyLines it is a leading gap.
+                    bodyLines: details[0] === '' ? details.slice(1) : details,
+                });
+                return buildProjectGraphAndSourceMapsWithoutDaemon();
+            }
             if (e.internalDaemonError) {
                 const errorLogFile = (0, tmp_dir_1.writeDaemonLogs)(e.message);
                 output_1.output.warn({

package/dist/src/project-graph/utils/project-configuration/name-substitution-manager.d.ts

@@ -34,6 +34,7 @@ export declare function isUsageRef(value: unknown): value is UsageRef;
 export declare class ProjectNameInNodePropsManager {
     private getNameMap;
     private pendingByName;
+    private nameHistory;
     constructor(getNameMap?: () => Record<string, ProjectConfiguration>);
     registerNameRefs(pluginResultProjects?: Record<string, Omit<ProjectConfiguration, 'root'> & Partial<ProjectConfiguration>>): void;
     private processInputs;

package/dist/src/project-graph/utils/project-configuration/name-substitution-manager.js

@@ -51,6 +51,9 @@ function isUsageRef(value) {
 class ProjectNameInNodePropsManager {
     constructor(getNameMap) {
         this.pendingByName = new Map();
+        // name → root for every name a project has ever been identified by, so refs
+        // to a since-renamed name still bind to the right root (see createRef).
+        this.nameHistory = new Map();
         this.getNameMap = getNameMap ?? (() => ({}));
     }
     // Replaces each project-name ref in `inputs`/`dependsOn` with a sentinel.
@@ -148,9 +151,14 @@ class ProjectNameInNodePropsManager {
             projects[j] = this.createRef(name);
         }
     }
-    // Builds a sentinel and registers it.
+    // Builds a sentinel and registers it. When `referencedName` isn't in the
+    // current name map, fall back to the rename history: a batch may reference a
+    // project by a name that a project earlier in the same batch already renamed
+    // (refs register after the whole batch merges), and the old name still
+    // identifies the same root.
     createRef(referencedName, targetPart) {
-        const referencedRoot = this.getNameMap()[referencedName]?.root;
+        const referencedRoot = this.getNameMap()[referencedName]?.root ??
+            this.nameHistory.get(referencedName);
         const ref = referencedRoot !== undefined
             ? new RootRef(referencedRoot, targetPart)
             : new UsageRef(referencedName, targetPart);
@@ -168,6 +176,11 @@ class ProjectNameInNodePropsManager {
     // RootRef by prototype swap. Sentinel identity across spread copies means
     // one promotion updates every array the sentinel reached.
     identifyProjectWithRoot(root, name) {
+        // Every name a root has ever gone by, including pre-rename names. A later
+        // ref to a stale name resolves to the root it identified at the time.
+        // (If two roots use the same name over a graph construction, the later
+        // one wins — matching how the live name map would have resolved it.)
+        this.nameHistory.set(name, root);
         const pending = this.pendingByName.get(name);
         if (!pending)
             return;
@@ -207,6 +220,7 @@ class ProjectNameInNodePropsManager {
             }
         }
         this.pendingByName.clear();
+        this.nameHistory.clear();
     }
     substituteInArray(entries, nameByRoot) {
         for (let i = 0; i < entries.length; i++) {

package/dist/src/project-graph/utils/project-configuration/project-nodes-manager.d.ts

@@ -4,6 +4,13 @@ export { validateProject } from './target-normalization';
 export declare function mergeProjectConfigurationIntoRootMap(projectRootMap: Record<string, ProjectConfiguration>, project: ProjectConfiguration, configurationSourceMaps?: ConfigurationSourceMaps, sourceInformation?: SourceInformation, skipTargetNormalization?: boolean, deferSpreadsWithoutBase?: boolean): {
     nameChanged: boolean;
 };
+/**
+ * The existing target names a glob-pattern target key merges onto. This maps
+ * atomized targets to the glob pattern the same way targetDefaults does.
+ * Returns an empty array for a non-glob key or a pattern matching nothing;
+ * the merge treats those as literal target names.
+ */
+export declare function findMatchingTargetNames(pattern: string, targetNames: string[]): string[];
 export declare function readProjectConfigurationsFromRootMap(projectRootMap: Record<string, ProjectConfiguration>): Record<string, ProjectConfiguration>;
 export declare function createRootMap(projectRootMap: Record<string, ProjectConfiguration>): Record<string, string>;
 /**
@@ -28,15 +35,12 @@ export declare class ProjectNodesManager {
     mergeProjectNode(project: ProjectConfiguration, configurationSourceMaps?: ConfigurationSourceMaps, sourceInformation?: SourceInformation): void;
     /**
      * Inserts project-name sentinels into `inputs` and `dependsOn` on the
-     * merged objects from `mergedRootMap` (defaulting to this manager's
-     * rootMap). Walking the merged entries matters because a spread-produced
-     * array is a fresh instance.
-     *
-     * Pass a different `mergedRootMap` for the default-plugin intermediate
-     * pass, then call again with `this.rootMap` after it's applied so
-     * name refs introduced by that merge are sentinelized as well.
+     * merged objects in this manager's rootMap. Walking the merged entries —
+     * not the plugin results — matters because a spread-produced array is a
+     * fresh instance, and because sentinels written into plugin-result arrays
+     * would corrupt them for any later merge that re-reads the results.
      */
-    registerNameRefs(pluginResultProjects?: Record<string, Omit<ProjectConfiguration, 'root'> & Partial<ProjectConfiguration>>, mergedRootMap?: Record<string, ProjectConfiguration>): void;
+    registerNameRefs(pluginResultProjects?: Record<string, Omit<ProjectConfiguration, 'root'> & Partial<ProjectConfiguration>>): void;
     /**
      * Applies all pending name substitutions. Call once after all plugin
      * results have been merged.

package/dist/src/project-graph/utils/project-configuration/project-nodes-manager.js

@@ -2,11 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProjectNodesManager = exports.validateProject = void 0;
 exports.mergeProjectConfigurationIntoRootMap = mergeProjectConfigurationIntoRootMap;
+exports.findMatchingTargetNames = findMatchingTargetNames;
 exports.readProjectConfigurationsFromRootMap = readProjectConfigurationsFromRootMap;
 exports.createRootMap = createRootMap;
 const error_types_1 = require("../../error-types");
 const target_merging_1 = require("./target-merging");
 const target_normalization_1 = require("./target-normalization");
+const git_worktrees_1 = require("../../../utils/git-worktrees");
+const workspace_root_1 = require("../../../utils/workspace-root");
 const name_substitution_manager_1 = require("./name-substitution-manager");
 const source_maps_1 = require("./source-maps");
 const minimatch_1 = require("minimatch");
@@ -129,21 +132,16 @@ deferSpreadsWithoutBase = true) {
             // if augmenting an existing target.
             const target = project.targets?.[targetName];
             if (sourceMap) {
-                // A target default stamping fields onto an existing target must not
-                // steal provenance for the target's existence; real plugins still win
-                // last. Field-level attribution is handled inside
-                // `mergeTargetConfigurations`.
+                // Claims the node key for a newly-created target (or reclaims it from
+                // a weak target-defaults stamp). Whether an *existing* target changes
+                // owners is decided inside `mergeTargetConfigurations`, which knows
+                // whether this merge changed the target's identity.
                 (0, source_maps_1.recordTargetIdentitySourceMapInfo)(sourceMap, (0, source_maps_1.targetSourceMapKey)(targetName), sourceInformation);
             }
             const normalizedTarget = skipTargetNormalization
                 ? target
                 : (0, target_merging_1.resolveCommandSyntacticSugar)(target, project.root);
-            let matchingTargets = [];
-            if ((0, globs_1.isGlobPattern)(targetName)) {
-                // find all targets matching the glob pattern
-                // this will map atomized targets to the glob pattern same as it does for targetDefaults
-                matchingTargets = Object.keys(updatedProjectConfiguration.targets).filter((key) => (0, minimatch_1.minimatch)(key, targetName));
-            }
+            let matchingTargets = findMatchingTargetNames(targetName, Object.keys(updatedProjectConfiguration.targets));
             // If no matching targets were found, we can assume that the target name is not (meant to be) a glob pattern
             if (!matchingTargets.length) {
                 matchingTargets = [targetName];
@@ -160,6 +158,18 @@ deferSpreadsWithoutBase = true) {
         updatedProjectConfiguration.name !== matchingProject?.name;
     return { nameChanged };
 }
+/**
+ * The existing target names a glob-pattern target key merges onto. This maps
+ * atomized targets to the glob pattern the same way targetDefaults does.
+ * Returns an empty array for a non-glob key or a pattern matching nothing;
+ * the merge treats those as literal target names.
+ */
+function findMatchingTargetNames(pattern, targetNames) {
+    if (!(0, globs_1.isGlobPattern)(pattern)) {
+        return [];
+    }
+    return targetNames.filter((name) => (0, minimatch_1.minimatch)(name, pattern));
+}
 function readProjectConfigurationsFromRootMap(projectRootMap) {
     const projects = {};
     // If there are projects that have the same name, that is an error.
@@ -194,7 +204,9 @@ function readProjectConfigurationsFromRootMap(projectRootMap) {
         }
     }
     if (conflicts.size > 0) {
-        throw new error_types_1.MultipleProjectsWithSameNameError(conflicts, projects);
+        // Only on the way to throwing, so a workspace without duplicates never
+        // pays for reading git's worktree registry.
+        throw new error_types_1.MultipleProjectsWithSameNameError(conflicts, projects, (0, git_worktrees_1.analyzeWorktreeConflicts)(workspace_root_1.workspaceRoot, conflicts) ?? undefined);
     }
     if (projectRootsWithNoName.length > 0) {
         throw new error_types_1.ProjectsWithNoNameError(projectRootsWithNoName, projects);
@@ -257,21 +269,18 @@ class ProjectNodesManager {
     }
     /**
      * Inserts project-name sentinels into `inputs` and `dependsOn` on the
-     * merged objects from `mergedRootMap` (defaulting to this manager's
-     * rootMap). Walking the merged entries matters because a spread-produced
-     * array is a fresh instance.
-     *
-     * Pass a different `mergedRootMap` for the default-plugin intermediate
-     * pass, then call again with `this.rootMap` after it's applied so
-     * name refs introduced by that merge are sentinelized as well.
+     * merged objects in this manager's rootMap. Walking the merged entries —
+     * not the plugin results — matters because a spread-produced array is a
+     * fresh instance, and because sentinels written into plugin-result arrays
+     * would corrupt them for any later merge that re-reads the results.
      */
-    registerNameRefs(pluginResultProjects, mergedRootMap = this.rootMap) {
+    registerNameRefs(pluginResultProjects) {
         if (!pluginResultProjects)
             return;
         const scoped = {};
         for (const root in pluginResultProjects) {
-            if (mergedRootMap[root]) {
-                scoped[root] = mergedRootMap[root];
+            if (this.rootMap[root]) {
+                scoped[root] = this.rootMap[root];
             }
         }
         this.nameSubstitutionManager.registerNameRefs(scoped);

package/dist/src/project-graph/utils/project-configuration/source-maps.d.ts

@@ -9,12 +9,19 @@ export type SourceInformation = [file: string | null, plugin: string];
  */
 export declare const TARGET_DEFAULTS_PLUGIN_NAME = "nx/target-defaults";
 /**
- * Write the source for a target's "identity" key (the target node itself, or
- * its executor/command). Real plugins win last; a target-defaults stamp only
- * claims the key when no real plugin already recorded it — target defaults
- * never bring a target into existence, they only layer fields onto one.
+ * Write the source for the target node key (`targets.<name>`). Ownership of a
+ * target follows its identity, not the last writer:
+ *
+ *  - An unowned key goes to whoever writes it first (the creator).
+ *  - A target-defaults stamp is weak — it never authors a target's existence,
+ *    so any real plugin reclaims the key from it, and it can never take the
+ *    key from a real plugin.
+ *  - Between real plugins, the key only changes hands when the merge changed
+ *    the target's identity (executor/command) — a plugin that merely layers
+ *    fields (dependsOn, options, …) onto an existing target does not become
+ *    its owner.
  */
-export declare function recordTargetIdentitySourceMapInfo(sourceMap: Record<string, SourceInformation>, key: string, sourceInfo: SourceInformation): void;
+export declare function recordTargetIdentitySourceMapInfo(sourceMap: Record<string, SourceInformation>, key: string, sourceInfo: SourceInformation, identityChanged?: boolean): void;
 /** Source map per project root. */
 export type ConfigurationSourceMaps = Record<string, Record<string, SourceInformation>>;
 export declare function forEachSourceMapKeyForArray(prefixKey: string, array: unknown[], callback: (key: string, index: number) => void, startIndex?: number): void;

package/dist/src/project-graph/utils/project-configuration/source-maps.js

@@ -21,14 +21,28 @@ exports.targetConfigurationsSourceMapKey = targetConfigurationsSourceMapKey;
  */
 exports.TARGET_DEFAULTS_PLUGIN_NAME = 'nx/target-defaults';
 /**
- * Write the source for a target's "identity" key (the target node itself, or
- * its executor/command). Real plugins win last; a target-defaults stamp only
- * claims the key when no real plugin already recorded it — target defaults
- * never bring a target into existence, they only layer fields onto one.
+ * Write the source for the target node key (`targets.<name>`). Ownership of a
+ * target follows its identity, not the last writer:
+ *
+ *  - An unowned key goes to whoever writes it first (the creator).
+ *  - A target-defaults stamp is weak — it never authors a target's existence,
+ *    so any real plugin reclaims the key from it, and it can never take the
+ *    key from a real plugin.
+ *  - Between real plugins, the key only changes hands when the merge changed
+ *    the target's identity (executor/command) — a plugin that merely layers
+ *    fields (dependsOn, options, …) onto an existing target does not become
+ *    its owner.
  */
-function recordTargetIdentitySourceMapInfo(sourceMap, key, sourceInfo) {
-    if (sourceInfo[1] !== exports.TARGET_DEFAULTS_PLUGIN_NAME ||
-        sourceMap[key] === undefined) {
+function recordTargetIdentitySourceMapInfo(sourceMap, key, sourceInfo, identityChanged = false) {
+    const existing = sourceMap[key];
+    if (existing === undefined) {
+        sourceMap[key] = sourceInfo;
+        return;
+    }
+    if (sourceInfo[1] === exports.TARGET_DEFAULTS_PLUGIN_NAME) {
+        return;
+    }
+    if (existing[1] === exports.TARGET_DEFAULTS_PLUGIN_NAME || identityChanged) {
         sourceMap[key] = sourceInfo;
     }
 }

package/dist/src/project-graph/utils/project-configuration/target-defaults.d.ts

@@ -19,7 +19,7 @@ type CreateNodesResultEntry = readonly [
  * fly. That's all the matcher needs; the full target merge happens
  * downstream in the real merge.
  */
-export declare function createTargetDefaultsResults(specifiedPluginRootMap: Record<string, ProjectConfiguration>, defaultPluginRootMap: Record<string, ProjectConfiguration>, nxJsonConfiguration: NxJsonConfiguration, specifiedSourceMaps?: ConfigurationSourceMaps, defaultSourceMaps?: ConfigurationSourceMaps): CreateNodesResultEntry[];
+export declare function createTargetDefaultsResults(specifiedPluginRootMap: Record<string, ProjectConfiguration>, defaultPluginRootMap: Record<string, ProjectConfiguration>, nxJsonConfiguration: NxJsonConfiguration, specifiedSourceMaps?: ConfigurationSourceMaps): CreateNodesResultEntry[];
 /**
  * Public reader that resolves the target defaults applying to a given
  * target. Accepts the nested map shape (a value is either a plain config

package/dist/src/project-graph/utils/project-configuration/target-defaults.js

@@ -21,7 +21,7 @@ const utils_1 = require("./utils");
  * fly. That's all the matcher needs; the full target merge happens
  * downstream in the real merge.
  */
-function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMap, nxJsonConfiguration, specifiedSourceMaps, defaultSourceMaps) {
+function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMap, nxJsonConfiguration, specifiedSourceMaps) {
     const targetDefaultsConfig = nxJsonConfiguration.targetDefaults;
     if (!targetDefaultsConfig) {
         return [];
@@ -65,7 +65,7 @@ function createTargetDefaultsResults(specifiedPluginRootMap, defaultPluginRootMa
             if (!effective)
                 continue;
             const sourcePlugin = needsSourcePlugin
-                ? resolveSourcePlugin(root, targetName, specifiedSourceMaps, defaultSourceMaps)
+                ? resolveSourcePlugin(root, targetName, defaultTargets[targetName], specifiedSourceMaps)
                 : undefined;
             const syntheticTargets = buildSyntheticTargetsForRoot(targetName, root, effective, targetDefaults, projectName, projectNode, sourcePlugin);
             for (const { key, index, target } of syntheticTargets) {
@@ -372,34 +372,33 @@ function normalizeTargetDefaultValue(value) {
     // A bare config object is functionally a one-element array.
     return [value ?? {}];
 }
-function resolveSourcePlugin(root, targetName, specifiedSourceMaps, defaultSourceMaps) {
-    // Default-plugin attribution overrides specified-plugin attribution in the
-    // merge, so check it first. The executor/command keys carry the plugin that
-    // *created* the target, which is what `filter.plugin` ("targets originated by
-    // X") means. The top-level `targets.<name>` node key is deliberately NOT used
-    // as a fallback: it tracks the last writer, so a later plugin augmenting the
-    // target would mis-attribute it. The trade-off is that a target with neither
-    // an executor nor a command (a rare, non-runnable shape) resolves to no
-    // source plugin and won't match a `filter.plugin` default — accepted, since
-    // every runnable target carries one of these keys.
-    const executorKey = `${(0, source_maps_1.targetSourceMapKey)(targetName)}.executor`;
-    const commandKey = `${(0, source_maps_1.targetSourceMapKey)(targetName)}.command`;
-    const candidates = [
-        pluginFromSourceMap(defaultSourceMaps, root, executorKey),
-        pluginFromSourceMap(defaultSourceMaps, root, commandKey),
-        pluginFromSourceMap(specifiedSourceMaps, root, executorKey),
-        pluginFromSourceMap(specifiedSourceMaps, root, commandKey),
-    ];
-    for (const candidate of candidates) {
-        if (candidate && candidate !== source_maps_1.TARGET_DEFAULTS_PLUGIN_NAME)
-            return candidate;
+function resolveSourcePlugin(root, targetName, defaultTarget, specifiedSourceMaps) {
+    // `filter.plugin` ("targets originated by X") can only name a plugin from
+    // nx.json's `plugins` — the specified set. When the default layer authors
+    // the target's identity (its merged config carries an executor or command,
+    // which the merge lets win), the originator is a default plugin and the
+    // target has no matchable source plugin; no source maps are needed to see
+    // that. Otherwise the specified layer's executor/command attribution names
+    // the originator. The top-level `targets.<name>` node key is deliberately
+    // NOT used as a fallback: it tracks ownership, so a later plugin augmenting
+    // the target would mis-attribute it. The trade-off is that a target with
+    // neither an executor nor a command (a rare, non-runnable shape) resolves to
+    // no source plugin and won't match a `filter.plugin` default — accepted,
+    // since every runnable target carries one of these keys.
+    if (defaultTarget &&
+        (defaultTarget.executor !== undefined ||
+            defaultTarget.command !== undefined)) {
+        return undefined;
+    }
+    const sourceMap = specifiedSourceMaps?.[root];
+    for (const identityKey of ['executor', 'command']) {
+        const plugin = sourceMap?.[`${(0, source_maps_1.targetSourceMapKey)(targetName)}.${identityKey}`]?.[1];
+        if (plugin && plugin !== source_maps_1.TARGET_DEFAULTS_PLUGIN_NAME) {
+            return plugin;
+        }
     }
     return undefined;
 }
-function pluginFromSourceMap(maps, root, key) {
-    const entry = maps?.[root]?.[key];
-    return entry?.[1];
-}
 // Builds a name → MatcherProjectNode view for `findMatchingProjects` to
 // consult, across both layered rootMaps. Tags are unioned across layers. A
 // full `mergeProjectConfigurationIntoRootMap` would be overkill — the matcher

package/dist/src/project-graph/utils/project-configuration/target-merging.js

@@ -170,6 +170,11 @@ function mergeConfigurations(newConfigurations, baseConfigurations, projectConfi
             // Before '...': base wins for shared names. Keep base's source-map
             // entries when it owns the config.
             if (baseHasConfig) {
+                // Base wins, so the incoming config is dropped without reaching
+                // `mergeConfigurationValue`. Validate its nested spread here so an
+                // integer-like-key ambiguity throws regardless of which side owns
+                // the config name (mirrors the base-independent target-level check).
+                (0, utils_1.assertNoIntegerLikeSpreadKey)(newConfigurations?.[configName], configIdentifier ? `Object at "${configIdentifier}"` : 'Object');
                 mergedConfigurations[configName] = baseConfigurations[configName];
             }
             else {
@@ -282,8 +287,11 @@ function mergeTargetConfigurations(target, baseTarget, projectConfigSourceMap, s
         ? new Set(targetKeys.slice(0, spreadPosInTarget))
         : new Set();
     // Integer-like keys get hoisted to targetKeys[0], making their position
-    // relative to '...' unrecoverable.
-    if (hasSpread &&
+    // relative to '...' unrecoverable. This is a property of the authored
+    // config, not of the base, so it throws regardless of compatibility —
+    // which also keeps the error identical between the target-defaults staging
+    // merge and the real merge, whose bases differ.
+    if (spreadPosInTarget >= 0 &&
         targetKeys[0] &&
         utils_1.INTEGER_LIKE_KEY_PATTERN.test(targetKeys[0])) {
         throw new utils_1.IntegerLikeSpreadKeyError(targetKeys[0], targetIdentifier ? `Target at "${targetIdentifier}"` : 'Target');
@@ -304,6 +312,13 @@ function mergeTargetConfigurations(target, baseTarget, projectConfigSourceMap, s
             return;
         if (hasSpread && keysBeforeSpread.has(key)) {
             // Before '...': base wins; fall through to target only if base lacks it.
+            // When base wins, the incoming `target[key]` is dropped without ever
+            // reaching `getMergeValueResult`, so validate its nested spread here —
+            // the integer-like-key ambiguity is a property of the authored value,
+            // not of which side owns the key, and must throw either way.
+            (0, utils_1.assertNoIntegerLikeSpreadKey)(target[key], projectConfigSourceMap
+                ? `Object at "${targetIdentifier}.${key}"`
+                : 'Object');
             result[key] =
                 key in mergeBase
                     ? mergeBase[key]
@@ -381,13 +396,20 @@ function mergeTargetConfigurations(target, baseTarget, projectConfigSourceMap, s
             processKey(key);
         }
     }
-    // Update source map once after loop. Real plugins win last, but a target
-    // default — which only stamps fields onto an existing target and never
-    // authors its existence — must not steal the node key from the plugin that
-    // introduced the target. An incompatible replace clears these keys above, so
-    // a replacing real plugin still re-owns the node.
+    // Update the node key once after the loop. Ownership follows identity: this
+    // merge claims `targets.<name>` only when it changed the target's identity
+    // (a new/different executor or command, or an incompatible replace — whose
+    // key purge above empties the slot anyway). A plugin that only layers fields
+    // onto an existing target leaves the node with its creator; weak
+    // target-defaults stamps are always reclaimable.
     if (projectConfigSourceMap) {
-        (0, source_maps_1.recordTargetIdentitySourceMapInfo)(projectConfigSourceMap, targetIdentifier, sourceInformation);
+        const identityChanged = !isCompatible ||
+            (target.executor !== undefined &&
+                target.executor !== baseTarget?.executor) ||
+            (target.command !== undefined &&
+                target.command !== baseTarget?.command) ||
+            suppliesNewOptionsIdentity(baseTarget, target);
+        (0, source_maps_1.recordTargetIdentitySourceMapInfo)(projectConfigSourceMap, targetIdentifier, sourceInformation, identityChanged);
     }
     // merge options if there are any
     // if the targets aren't compatible, we simply discard the old options during the merge
@@ -443,6 +465,26 @@ function isCompatibleTarget(a, b) {
     }
     return true;
 }
+/**
+ * Run-commands and run-script targets carry their runnable identity in
+ * `options` (see {@link isCompatibleTarget}). A layer that supplies that
+ * identity where the base had none changed what the target runs — the same
+ * identity change as setting an executor on a target that had none.
+ */
+function suppliesNewOptionsIdentity(baseTarget, target) {
+    const executor = target.executor ?? baseTarget?.executor;
+    if (executor === 'nx:run-commands') {
+        const baseCommand = baseTarget?.options?.command ??
+            baseTarget?.options?.commands?.join(' && ');
+        const targetCommand = target.options?.command ?? target.options?.commands?.join(' && ');
+        return !!targetCommand && targetCommand !== baseCommand;
+    }
+    if (executor === 'nx:run-script') {
+        const targetScript = target.options?.script;
+        return !!targetScript && targetScript !== baseTarget?.options?.script;
+    }
+    return false;
+}
 function resolveNxTokensInOptions(object, project, key) {
     const result = Array.isArray(object) ? [...object] : { ...object };
     for (let [opt, value] of Object.entries(object ?? {})) {