@vzn/vx-migrate 0.0.594 → 0.0.595

package/README.md

@@ -55,7 +55,7 @@ Rules:
 - **Definition order**: root `pkg#name` if there is one, else root `name` (the first replaces the second whole, as Turbo looks it up), then each package config its own `turbo.json` extends (`"extends": ["//", "shared"]`, read by Turbo 2.11, refused by 2.5; nearest last, a parent missing or a cycle refused as Turbo refuses it) and its own, each winning field by field, except an overlay array holding `$TURBO_EXTENDS$` (Turbo 2.5+), which is the inherited list plus the overlay's other entries (`inputs: ["$TURBO_EXTENDS$", "config.json"]`).
 - **The command is the script body** with its `pre<name>` / `post<name>` hooks folded in, in that order, through core's `foldScriptHooks`: each part in its own subshell, the chain stopping at the first that fails, forwarded `--` args reaching the body alone (npm and pnpm run them around `<name>` without being asked; novu's `prebuild` copies the CSS its `build` inlines), one process less per task than `pnpm run <name>` — except a body that calls yarn's `run` builtin (`run -T rollup -c`, `run clean && run build`; yarn ≥ 2 runs scripts in its own shell), which is `run: command not found` in sh: it runs as `yarn run <name>`, as Turbo and Nx run it, and yarn ≥ 2 runs no hooks, so none are folded there. A Yarn Plug'n'Play workspace (`.yarnrc.yml` with no `nodeLinker`, or `pnp`) has no `node_modules`: a dependency resolves only through `.pnp.cjs` and a bin only through yarn's shims, so there every script runs as `yarn run <name>`, and a `nodeLinker` change maps afresh. Same rules for `nx:run-script` below (strapi and novu, 2026-09-11).
 - **Turbo 2.11's task `command`** (`futureFlags.experimentalTaskCommand`) wins over the script, as Turbo holds it: an argv is the command — each word quoted, run from the package dir, no `pre`/`post` hooks — and gives the package the task even with no script (turborepo's `@turbo/types#build`, `docs#schema`); `null` or `[]` is Turbo's no-op node, no task even where the script exists, its edges passed through; a per-toolchain map applies its `javascript` entry (or `typescript`, Turbo's alias), and without one the script runs. A shape Turbo would refuse keeps the script, with a todo.
-- `dependsOn`: `^x` passes through when some package runs `x`, and is dropped when none does (Turbo gives it no edges; core refuses a `^x` no project declares as a typo); `pkg#task` is kept only when `pkg` emits `task` (else a todo: edge dropped); a same-package task Turbo defines but the package has no script for is Turbo's no-op node, so its own edges pass through in its place (`test → codegen → ^build` with no `codegen` script is `test → ^build`); another package's `^x` or `pkg#x` reaches such a node through a group task when its edges name a task of its own package or another (with-tailwind's `ui` has no `build` script; its `build` builds `build:styles` and `build:components`, and `web#build` waits on them), and so does one whose `^` edge names another task (rallly's script-less `build` holds `^db:generate`), while one whose only edge is `^` to its own name needs none, since core's `^x` walks past a package without `x`; a no-op node nothing else reaches runs nothing, its own edges included, where Turbo still runs them (kitchen-sink's `turbo run test` builds `@repo/ui` for `admin`, which has no `test` script; `vx run test --all` does not, and `vx run build test --all` does both); a name Turbo does not define has no edge; `$TURBO_ROOT$` deps are a todo. Root `//#task`s run in the workspace root, as under Turbo: `turbo()` names the root a project through core's `discover` stage when turbo.json declares one (no `vx.config` needed; a root no member glob lists), and `//#x` in `dependsOn` is an edge to it, named by the root `package.json` `name`; a root task's globs are the workspace's (`workspaceFiles`), since Turbo hashes a root task over the whole repo; with no root project (a root `package.json` with no `name`, or one a package holds) they are a note and such an edge a todo. Turbo runs no plain task in the root package of a monorepo, and neither does `turbo()`; in a single-package repo (no workspaces, Turbo's `non-monorepo` example) turbo.json's plain tasks run on the root package, as under Turbo.
+- `dependsOn`: `^x` passes through when some package runs `x` or turbo.json defines it, and is dropped otherwise (core refuses a `^x` no project declares as a typo); `pkg#task` is kept only when `pkg` emits `task` (else a todo: edge dropped); a same-package task Turbo defines but the package has no script for is Turbo's no-op node, so its own edges pass through in its place (`test → codegen → ^build` with no `codegen` script is `test → ^build`); another package's `^x` or `pkg#x` reaches such a node through a group task when its edges name a task of its own package or another (with-tailwind's `ui` has no `build` script; its `build` builds `build:styles` and `build:components`, and `web#build` waits on them), and so does one whose `^` edge names another task (rallly's script-less `build` holds `^db:generate`), while one whose only edge is `^` to its own name needs none, since core's `^x` walks past a package without `x`; a no-op node nothing else reaches runs nothing, its own edges included, where Turbo still runs them (kitchen-sink's `turbo run test` builds `@repo/ui` for `admin`, which has no `test` script; `vx run test --all` does not, and `vx run build test --all` does both); a name Turbo does not define has no edge; `$TURBO_ROOT$` deps are a todo. A task turbo.json defines and no package has a script for (documenso's `lint`, shadcn-ui's `check`) is a group task in each package that defines it, its edges kept (a `pkg#task` edge only in `pkg`), so `vx run lint` runs Turbo's no-op nodes and exits 0 as `turbo run lint` does. Root `//#task`s run in the workspace root, as under Turbo: `turbo()` names the root a project through core's `discover` stage when turbo.json declares one (no `vx.config` needed; a root no member glob lists), and `//#x` in `dependsOn` is an edge to it, named by the root `package.json` `name`; a root task's globs are the workspace's (`workspaceFiles`), since Turbo hashes a root task over the whole repo; with no root project (a root `package.json` with no `name`, or one a package holds) they are a note and such an edge a todo. Turbo runs no plain task in the root package of a monorepo, and neither does `turbo()`; in a single-package repo (no workspaces, Turbo's `non-monorepo` example) turbo.json's plain tasks run on the root package, as under Turbo.
 - A transit node (Turbo's documented pattern, its with-vitest example: `transit: { dependsOn: ["^transit"] }` with no script anywhere, and `test: { dependsOn: ["transit"] }`) is a key-only task in each package that defines it: it runs `true`, cached and keyed on its inputs, with its `^transit` edge, so a dependant's `test` re-keys on its dependencies' sources as Turbo re-hashes it. A `^` task that some package has a script for, or that nothing depends on, is no transit node. A package without the script of a `^` task others run gets the same key-only task, as Turbo hashes a no-op node there: an edit to it re-keys its dependants. A `build` whose only edge is `^build` is not written: core gives every project with no `build` that node (solid's three script-less packages each got a `build` running `true`).
 - `with` (tasks Turbo runs alongside, `web#dev` with `api#dev`): an edge to each sidecar that is persistent, so vx starts the task once the sidecar has spawned and runs the sidecar only when the task runs; a sidecar that ends would be waited for, so it is a todo instead, and a pair that names each other keeps one edge (two would be a cycle). A task with no script whose `with` names persistent sidecars (Turbo's with-tailwind example: `ui` has no `dev` script, its `dev` starts `dev:styles` and `dev:components`) is a group task that depends on them.
 - `inputs`: a structured entry (Turbo 2.11) is its `globs`, plus `**/*` with `withDefaults`, for `startup` and `jit` alike; `dependencyOutputs` adds none where the producer is cached (vx folds each dependency's key); from a `cache: false` producer (vercel/vercel's `//#generate:cache-keys`, which records the host) the named files, or its outputs, are a `cache.inputs.workspaceRuntime` probe, and `cache.inputs.tasks` leaves the producer out, so core answers the probe after it ran. Then: absent or `[]` → `**/*` (Turbo's default); `$TURBO_DEFAULT$` → `**/*`; exclusions alone narrow `**/*`; `$TURBO_ROOT$/<path>` → `cache.inputs.workspaceFiles` (negation kept); any other `$TURBO_ROOT$` use is a todo. `globalDependencies` and Turbo 1's `globalDotEnv` land in `workspaceFiles` too, and a task's Turbo 1 `dotEnv` in its `files`. Turbo 1's `$NAME` entries, in `globalDependencies` or a task's `dependsOn`, are env vars: they join `cache.inputs.env` and `exec.env.passThrough`. A package nested in the task's package (cal.com's apps inside `@calcom/app-store`) is hashed by Turbo with its parent, and core's globs stop at a project: each glob that reaches one is also listed in `cache.inputs.workspaceFiles`. Turbo's glob grammar is translated as Nx's is (`*.[jt]s` is `*.{[jt],j,t}s`); an input with no safe form widens to `**/*` with a todo. A `.env`-shaped input (`.env*`, `.env.local`, a task's Turbo 1 `dotEnv`, create-turbo's `globalDependencies: ["**/.env.*local"]`) is gitignored as a rule, so it is keyed by a probe that hashes the `.env` files it can name (`cache.inputs.runtime`) or, for a root entry, the files its root-relative globs name, hidden ones too, as Turbo's `*` matches them (`workspaceRuntime`; `**/<name>` is a `find -name` that skips `node_modules`, and another `**` walks the workspace), rather than as a file glob git never reports. A package whose `.env` globs all sit at its root gets a one-shell probe of that directory; one below the root walks the package.
@@ -64,7 +64,7 @@ Rules:
 - Framework inference (Turbo hashes and passes Next's `NEXT_PUBLIC_*`, Vite's `VITE_*`, … for a package that depends on the framework): `turbo()` expands the prefix over the run's environment; the CLI writes the names the tracked source and `.env.example` of the package and its workspace dependencies spell (the bare prefix, as a `startsWith` test spells it, is none) (Next bundles theirs: cal.com's web, 23 alone, 58 with them), and a note asks for any only an installed dependency reads.
 
 - **Two tasks of one package on one output path** (strapi's `build`, `build:code` and `build:types`, all on `dist/**`): vx cleans a task's outputs before it runs and before a restore, so the loader refuses two cached tasks whose outputs provably overlap. Under vx's default `rules.exclusiveOutputs` an edge between the two changes nothing (twenty's `build:individual` writing into `build`'s `dist`). The mapping resolves it before the file is written — the task with a `^` edge keeps its cache (the first declared when none has one); the rest run uncached with a todo naming the keeper and the fix, their own output path. Same rule for Nx targets.
-- **A task whose inputs read another task's outputs** (a `test` keyed on `**/*` beside a `build` writing `dist/**`): vx's default `rules.upfrontKeys` refuses it, since such a key cannot be known before the producer ran. Each overlapping output is taken back from the reader's inputs with `!` (`['**/*', '!dist/**']`), in package and workspace inputs alike; Turbo and Nx hash what git tracks, and a build's outputs are not, so the key reads what the adopted tool read. A literal input another task writes cannot be taken back: that task runs uncached with a todo. A committed file under such an output is still a source: a reader the `!` would hide it from runs uncached with a todo. Same for Nx targets.
+- **A task whose inputs read another task's outputs** (a `test` keyed on `**/*` beside a `build` writing `dist/**`): vx's default `rules.upfrontKeys` refuses it, since such a key cannot be known before the producer ran. Each overlapping output is taken back from the reader's inputs with `!` (`['**/*', '!dist/**']`), in package and workspace inputs alike; Turbo and Nx hash what git tracks, and a build's outputs are not, so the key reads what the adopted tool read. A literal input another task writes cannot be taken back: that task runs uncached with a todo. A committed file under such an output is still a source: a reader the `!` would hide it from runs uncached with a todo. An output that names one committed file (eslint's `eslint-suppressions.json` in a `lint` task's outputs) is dropped, and so is the `!` each reader got for it: the file stays in every key, as Turbo and Nx hash it, and the readers stay cached. Same for Nx targets.
 - **Two packages' tasks on one workspace output** (cal.com's shared `post-install` writes `../../node_modules/@prisma/client/**` from every package with the script): core refuses two cached tasks on one path with no edge between them, so `turbo()` (and `nx()`) keeps the first (in package and task order) cached and runs the rest uncached, each with a todo naming the keeper. A package's own outputs count at their workspace path: typescript-eslint's root project caches `dist` and each package's typecheck `dist/packages/<name>`, one path twice. Edges across packages are not read, so an ordered pair loses its cache too.
 - `cache: false` or `persistent: true` → no `cache` block; a persistent task gets `exec.persistent: {}` and, when some task depends on it, the consumer's `persistentTodo`.
 - A task's `description` (Turbo 2.11.5's schema) is the vx task's `description`.
@@ -88,7 +88,7 @@ import { nx } from '@vzn/vx-migrate'
 export default defineWorkspace({ plugins: [nx()] })
 ```
 
-Until `bunx @vzn/vx-migrate` writes native config, `vx run build --all` maps every project's `build` target the way `nx run-many -t build` would. The plugin reads Nx's **resolved** project graph — where Nx has already applied `targetDefaults`, expanded `namedInputs`, inferred targets through its plugins and interpolated `{projectRoot}` and friends — so nothing is re-derived here. Per target: `nx:run-commands` and a plain `command` run as one shell line that does what Nx's run-commands does (below); `nx:run-script` is the package script, with the `$npm_package_name`, `$npm_package_version` and `$npm_lifecycle_event` it reads defined as `<pm> run` sets them (a migration reads the name and version from the manifest it imports, so a bump reaches them; any other `$npm_*` is a todo); `nx:noop` is a group task, and so is a target with neither an executor nor a command that has dependencies, as Nx normalizes it (one with none is dropped, as Nx drops it); **every other executor runs through `nx-exec`** with the executor and its options on the command line. A target Nx caches (`cache: true`, or the legacy `cacheableOperations` list in `nx.json`) gets its `inputs` / `outputs` as the cache block, with no `inputs` meaning Nx's `default` and `^default`, named inputs resolved per project (nx.json's under the project's own; one neither defines, such as an `extends` preset not installed, keys the whole project with a todo, never an empty list that keys the task on its config alone), `{workspaceRoot}` / `{projectRoot}` / `{projectName}` interpolated anywhere in a path as Nx does (`{workspaceRoot}/coverage/{projectRoot}`), Nx's glob grammar translated (`*.[jt]s` is `*.{j,t}s`; the default `production` negation `?(*.)+(spec|test).[jt]s?(x)` becomes brace sets, a narrowing only a negation may take; what has no safe form is a todo), a project fileset of negations alone (nx-recipes' `noMarkdown`) starting from every project file, as Nx reads it, and an output outside the project dir (`dist/<project>` at the workspace root, Nx's default layout) a `workspaceFiles` output, an output outside the workspace (an old generator's `reportsDirectory: "../../coverage/<lib>"`) a todo and dropped, as vx caches only inside it, an output whose first segment is a wildcard (`{projectRoot}/**/*.d.ts`) cached, with each committed file it reaches taken back by `!` and the rest cleaned before the run (typescript-eslint's `**/*.shot`, 3,656 committed snapshots, is past sixteen and runs uncached with a todo), and an output that covers the project's own `package.json` or vx.config cached with the file taken back by `!`; `dependsOn` becomes the edges (`^build` — dropped when no project has the target, as Nx gives it no edges and core refuses a `^name` nothing declares — `build`, `project:target` → `project#target`, everything past `project:` one target name, as Nx joins it (`ui:build:esm` is ui's `build:esm`; `ui:build:ci` names target `build:ci`, never `build`'s `ci` configuration, and is no edge where ui lacks it), this project's own target winning over a project name, `{ target, projects }` → each matched project's task, `projects` read as Nx's `findMatchingProjects` reads it: a name or a list of names, globs over names and over project directories (`libs/*`), `name:` / `tag:` / `directory:` labels, a bare word as a word in a name, and `!` exclusions; an edge to a target its project lacks is dropped without a word, as Nx drops it — `targetDefaults` that give every `typecheck` a `codegen` one project has; `^name` is every dependency's `name` whatever it holds, `^rsbuild:typecheck` included; a target glob — `test:e2e--*`, `^build-*`, `ui:build-{esm,cjs}`, a `{ target }` object's — expands over every target name in the workspace, as Nx 19.5+ does, before those rules; a same-project glob keeps its own project's matches), `{ env }` inputs pass through, `{ runtime }` inputs run at the workspace root as Nx runs them (`cache.inputs.workspaceRuntime`), a `{ fileset, includeIgnored: true }` literal (Nx 23 hashes it from disk, gitignored or missing) is read by such a probe, since vx's globs see only what git lists, and a glob of one is a todo, a target that says `continuous` — or, in a graph from an Nx older than that field, runs a server executor (`@nx/vite:dev-server`, `@nx/next:server`, …) — is a persistent task and never cached, ready on spawn as Nx has it (Nx starts the dependents once it has started; a run-commands `readyWhen` gates them, below). The target's name never decides: a cached `dev` caches like any other target (nx#32610). `parallelism: false` (Nx runs the target alone) has no vx form and is a todo naming `--concurrency 1`; `syncGenerators` (Nx runs them first) is one workspace note per generator list, counting its tasks and naming `nx sync`; nx.json's `sync.globalGenerators` is one note per run naming `nx sync`. A target with `configurations` is one task per configuration (one whose name another target holds, `vite`'s `build` beside an inferred `vite:build`, is not written, with a todo, as Nx resolves `a:vite:build` to the target): `build` carries the default configuration's options, `build:ci` the `ci` one, and an edge of `build:ci` (own, named or `^`) reaches each target's `ci` task where it declares one, else its default, as Nx's `resolveConfiguration` does; a `^build` there becomes one edge per dependency Nx links. A `^name` input (`^production`, `{ input, dependencies: true }`, the pre-17 `{ input, projects: "dependencies" }`; `projects: "self"` is the own input, as Nx 23 still reads both) is what Nx hashes: each dependency's `name`, over the project graph, whether or not a task edge exists. A `{ input, projects }` list is read as `dependsOn`'s `projects` is. Each project some reader reaches gets an `nx-input:<name>` task — `true`, cached, keyed on its own `name` input, depending on its Nx dependencies' twins (a project nothing reaches gets none) — and a task that reads `^name` depends on its direct dependencies' twins, so the whole closure folds into its key with each project hashed once. A dependency FILESET (`^{projectRoot}/tsconfig.lib.json`, `{ fileset, dependencies: true }`, which Nx's own inferred `typecheck` writes) folds the same way: its twin, `nx-input:fileset-<hash>` (a glob's `*` is no task name; the task's description names the fileset), keys on that fileset in each project. The twins show in a run's output; each costs about 0.16 ms of a warm run. A path input inside an output one of the project's own targets declares (TanStack/table's `public` input lists `{projectRoot}/dist`) is generated: git does not list it, so vx cannot key on it, and it is dropped with a todo; the task that writes it keys its dependants through `dependsOn`.
+Until `bunx @vzn/vx-migrate` writes native config, `vx run build --all` maps every project's `build` target the way `nx run-many -t build` would. The plugin reads Nx's **resolved** project graph — where Nx has already applied `targetDefaults`, expanded `namedInputs`, inferred targets through its plugins and interpolated `{projectRoot}` and friends — so nothing is re-derived here. Per target: `nx:run-commands` and a plain `command` run as one shell line that does what Nx's run-commands does (below); `nx:run-script` is the package script, with the `$npm_package_name`, `$npm_package_version` and `$npm_lifecycle_event` it reads defined as `<pm> run` sets them (a migration reads the name and version from the manifest it imports, so a bump reaches them; any other `$npm_*` is a todo); `nx:noop` is a group task, and so is a target with neither an executor nor a command that has dependencies, as Nx normalizes it (one with none is dropped, as Nx drops it); **every other executor runs through `nx-exec`** with the executor and its options on the command line. A target Nx caches (`cache: true`, or the legacy `cacheableOperations` list in `nx.json`) gets its `inputs` / `outputs` as the cache block, with no `inputs` meaning Nx's `default` and `^default`, named inputs resolved per project (nx.json's under the project's own; one neither defines, such as an `extends` preset not installed, keys the whole project with a todo, never an empty list that keys the task on its config alone), `{workspaceRoot}` / `{projectRoot}` / `{projectName}` interpolated anywhere in a path as Nx does (`{workspaceRoot}/coverage/{projectRoot}`), Nx's glob grammar translated (`*.[jt]s` is `*.{j,t}s`; the default `production` negation `?(*.)+(spec|test).[jt]s?(x)` becomes brace sets, a narrowing only a negation may take; what has no safe form is a todo), a project fileset of negations alone (nx-recipes' `noMarkdown`) starting from every project file, as Nx reads it, and an output outside the project dir (`dist/<project>` at the workspace root, Nx's default layout) a `workspaceFiles` output, an output outside the workspace (an old generator's `reportsDirectory: "../../coverage/<lib>"`) a todo and dropped, as vx caches only inside it, an output whose first segment is a wildcard (`{projectRoot}/**/*.d.ts`) cached, with each committed file it reaches taken back by `!` and the rest cleaned before the run (typescript-eslint's `**/*.shot`, 3,656 committed snapshots, is past sixteen and runs uncached with a todo), and an output that covers the project's own `package.json` or vx.config cached with the file taken back by `!`; `dependsOn` becomes the edges (`^build` — dropped when no project has the target, as Nx gives it no edges and core refuses a `^name` nothing declares — `build`, `project:target` → `project#target`, everything past `project:` one target name, as Nx joins it (`ui:build:esm` is ui's `build:esm`; `ui:build:ci` names target `build:ci`, never `build`'s `ci` configuration, and is no edge where ui lacks it), this project's own target winning over a project name, `{ target, projects }` → each matched project's task, `projects` read as Nx's `findMatchingProjects` reads it: a name or a list of names, globs over names and over project directories (`libs/*`), `name:` / `tag:` / `directory:` labels, a bare word as a word in a name, and `!` exclusions; an edge to a target its project lacks is dropped without a word, as Nx drops it — `targetDefaults` that give every `typecheck` a `codegen` one project has; `^name` is every dependency's `name` whatever it holds, `^rsbuild:typecheck` included; a target glob — `test:e2e--*`, `^build-*`, `ui:build-{esm,cjs}`, a `{ target }` object's — expands over every target name in the workspace, as Nx 19.5+ does, before those rules; a same-project glob keeps its own project's matches), `{ env }` inputs pass through, `{ runtime }` inputs run at the workspace root as Nx runs them (`cache.inputs.workspaceRuntime`), a `{ fileset, includeIgnored: true }` literal (Nx 23 hashes it from disk, gitignored or missing) is read by such a probe, since vx's globs see only what git lists, and a glob of one is a todo, a target that says `continuous` — or, in a graph from an Nx older than that field, runs a server executor (`@nx/vite:dev-server`, `@nx/next:server`, …) — is a persistent task and never cached, ready on spawn as Nx has it (Nx starts the dependents once it has started; a run-commands `readyWhen` gates them, below). The target's name never decides: a cached `dev` caches like any other target (nx#32610). `parallelism: false` (Nx runs the target alone) has no vx form and is a todo naming `--concurrency 1`; `syncGenerators` (Nx runs them first) is one workspace note per generator list, counting its tasks and naming `nx sync`; nx.json's `sync.globalGenerators` is one note per run naming `nx sync`. A target with `configurations` is one task per configuration (one whose name another target holds, `vite`'s `build` beside an inferred `vite:build`, is not written, with a todo, as Nx resolves `a:vite:build` to the target): `build` carries the default configuration's options, `build:ci` the `ci` one, and an edge of `build:ci` (own, named or `^`) reaches each target's `ci` task where it declares one, else its default, as Nx's `resolveConfiguration` does; a `^build` there becomes one edge per dependency Nx links. A `^name` input (`^production`, `{ input, dependencies: true }`, the pre-17 `{ input, projects: "dependencies" }`; `projects: "self"` is the own input, as Nx 23 still reads both) is what Nx hashes: each dependency's `name`, over the project graph, whether or not a task edge exists. A `{ input, projects }` list is read as `dependsOn`'s `projects` is. Each project some reader reaches gets an `nx-input:<name>` task — `true`, cached, keyed on its own `name` input, depending on its Nx dependencies' twins (a project nothing reaches gets none) — and a task that reads `^name` depends on its direct dependencies' twins, so the whole closure folds into its key with each project hashed once. A dependency FILESET (`^{projectRoot}/tsconfig.lib.json`, `{ fileset, dependencies: true }`, which Nx's own inferred `typecheck` writes) folds the same way: its twin, `nx-input:fileset-<hash>` (a glob's `*` is no task name; the task's description names the fileset), keys on that fileset in each project. The twins show in a run's output; each costs about 0.16 ms of a warm run. A path input inside an output one of the project's own targets declares (TanStack/table's `public` input lists `{projectRoot}/dist`) is generated, and gitignored where Nx caches it: Nx's file map skips gitignored files, so Nx hashes nothing there (a changed `dist` file is a cache hit under Nx 23.3), and it is dropped without a todo, and the task that writes it keys its dependants through `dependsOn`.
 
 | Option  | Meaning                                                                                                                                                      |
 | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -202,7 +202,7 @@ Why the command carries the options: vx's key sees them (resolved-config hashing
 ## `bunx @vzn/vx-migrate` — write the configs
 
 ```bash
-bunx @vzn/vx-migrate           # auto-detect: turbo.json, .nx/workspace-data/project-graph.json or nx.json
+bunx @vzn/vx-migrate           # auto-detect: turbo.json, .nx/workspace-data/project-graph.json, nx.json or lerna.json
 bunx @vzn/vx-migrate --dry     # print the generated files + the report instead of writing
 bunx @vzn/vx-migrate --force   # overwrite existing vx.config.* / vx-preset.ts
 bunx @vzn/vx-migrate --from nx # disambiguate when both runners are checked in
@@ -217,6 +217,8 @@ It is the one command a repo needs (`pnpx @vzn/vx-migrate` in a pnpm repo works
 - With no `vx.workspace.*` yet, it writes one declaring the plugins the repo calls for (`src/workspace-plugins.ts`): the `@vzn/vx-lockfile` factory for the lockfile (`pnpm()`, `bun()`, `npm()`, `yarn()`), `scheduleHistoryPlugin()`, and `github()` when `.github/workflows` exists, from `@vzn/vx-ci`, each installed beside `@vzn/vx` at vx-migrate's own version. Keep adds them to the file `vx init` writes, or to one already in that shape; any other workspace file is the user's and left alone.
 - It installs what the written files import with the repo's own manager (`packageManager`, else the lockfile): `@vzn/vx`, plus `@vzn/vx-migrate` for keep (the declared plugins are built into the vx binary, so none is installed) (`pnpm add -D -w`, `yarn add -D -W` on Yarn 1 and without `-W` on Yarn 2+, `bun add -d`, `npm install -D`). A package the root both lists and has installed at vx-migrate's own version is left alone; any other is installed at that version. `--no-install` skips it.
 
+A Lerna repo is an Nx one: Lerna 6+ runs `lerna run` on Nx's task runner over the graph `nx graph` exports, nx.json or not, so a `lerna.json` with no nx.json and no turbo.json is mapped from that graph, and keep writes the workspace file declaring `nx()` (`vx init` adopts by nx.json, and would map the scripts). Lerna is the installed one, else the root manifest's range; with neither, the lerna.json is another tool's (lerna-lite reads it too, and runs no Nx). A root whose scripts never `lerna run` runs its tasks another way and publishes with Lerna (webdriverio: `run-s`, `pnpm -r`), so its scripts stay the source. Not where Lerna runs its own runner: `useNx: false`, or Lerna 5 without `useNx: true`; those are `vx init`'s scripts mapping. Beside turbo.json, Turbo runs the tasks and Lerna only publishes: turbo.json is the source.
+
 Your `package.json` scripts are never edited. `--dry` installs nothing and says what it would install.
 
 `--dry` prints the files instead of writing them; `--force` overwrites existing ones; `--mjs` writes `vx.config.mjs` (and `vx-preset.mjs`) instead of `.ts` — the same objects with no type import and no `satisfies`, for a package whose own `tsconfig` includes every `.ts` under it and would compile the config into its dist (TanStack/query, 2026-09-11).
@@ -238,7 +240,7 @@ Reads the root pipeline (`tasks` in Turbo 2, `pipeline` in Turbo 1), per-package
 
 ### Nx
 
-Reads the **resolved** project graph only (`.nx/workspace-data/project-graph.json` when exported, else the one the workspace's own `nx graph` exports into a temp file, as `nx()` does), through the same mapper `nx()` runs live, executors aside (below). Targets Nx plugins infer at runtime are frozen as the snapshot saw them. `nx:run-commands` is the one shell line `nx()` runs (see [`nx:run-commands`](#nxrun-commands) above: where, parallel or in order, forwarded arguments, `env`, `readyWhen`) — storybook's `compile` is `cd ../../.. && node ./scripts/build/build-package.ts --cwd code/lib/cli`; a plain `command` is that shorthand; `nx:run-script` is the package's script body with its `pre<name>` / `post<name>` hooks folded in (or `yarn run <name>` when the body calls yarn's `run` builtin; an empty script is the placeholder with a todo), `nx:noop` is a group task; Nx 15–16's `@nrwl/workspace:run-commands` and `run-script` (and their `@nx/workspace:` names) are the `nx:` executors they re-exported; **an executor target is its `nx-exec` line**, as `nx()` runs it: the migrator translates no executor, so Nx and `@vzn/vx-migrate` stay installed until each such line is rewritten as the command it runs (a server executor Nx knows, `@nx/js:node` or a dev server, is still a persistent task). The report also says what `vx.workspace.ts` still holds, as the Turbo migration does: the `nx()` `vx init` declared, which keeps reading nx.json, and a lockfile with no `@vzn/vx-lockfile` plugin, where Nx keyed each project on the npm packages it depends on. A written command that still runs Nx itself (a run-commands `nx run b:build`, `npx nx test b`, a script's `nx exec -- tsc`) carries a TODO: it works only while Nx is installed. An Nx project no workspace glob lists (an integrated repo's `project.json` library) gets a `package.json` (`name`, `private`) where it has none, and a note names the directories to add to `workspaces` (or `pnpm-workspace.yaml`): core finds a project only through those globs, and the migrator never edits the root manifest. A target with `configurations` writes one task per configuration (`build`, `build:ci`). A project's Nx `tags` are written as its `tags`. Named inputs expand from `nx.json` when readable. An output path is kept as written, a `!` one too (`{projectRoot}/dist` → `dist`, `{projectRoot}/bin/tool` → `bin/tool`; one naming an unset `{options.x}` is dropped, as Nx drops it; a dotted `{options.outputPath.base}` walks the options, as Nx does; an extglob is put in vx's grammar: Next's inferred `.next/!(cache)/**/*` is `.next/*/**/*` with `!.next/cache/**/*`, `@(js|map)` is `{js,map}`, and a form with no vx spelling is dropped with a TODO): vx reads a bare path as the file or the whole tree under it, so a directory and an extensionless binary both save and restore. nx.json's `parallel`, `defaultBase` and `maxCacheSize`, which `nx()` applies live, are each a note naming the `vx.workspace.ts` field to add (`concurrency`, `affectedBase`, `cacheRetention.maxSize`): the workspace file is written without them, and from nx.json alone, never the environment. vx derives package edges from `package.json`; an Nx graph edge with no manifest path (`implicitDependencies`, a tsconfig path) becomes, for each `^target` of the dependant, an explicit `pkg#target` edge to what Nx's own walk reaches — each dependency that has the target, and through one that lacks it, its dependencies — so the order and the key are Nx's. The reverse too: where a project's manifest names a workspace package its Nx graph does not reach (an `implicitDependencies: ["!a"]` that breaks a manifest cycle), its `^target` becomes the explicit edges Nx draws, since vx's `^` would follow the manifest and bring the cycle back.
+Reads the **resolved** project graph only (`.nx/workspace-data/project-graph.json` when exported, else the one the workspace's own `nx graph` exports into a temp file, as `nx()` does), through the same mapper `nx()` runs live, executors aside (below). Targets Nx plugins infer at runtime are frozen as the snapshot saw them. `nx:run-commands` is the one shell line `nx()` runs (see [`nx:run-commands`](#nxrun-commands) above: where, parallel or in order, forwarded arguments, `env`, `readyWhen`) — storybook's `compile` is `cd ../../.. && node ./scripts/build/build-package.ts --cwd code/lib/cli`; a plain `command` is that shorthand; `nx:run-script` is the package's script body with its `pre<name>` / `post<name>` hooks folded in (or `yarn run <name>` when the body calls yarn's `run` builtin; an empty script is the placeholder with a todo), `nx:noop` is a group task; Nx 15–16's `@nrwl/workspace:run-commands` and `run-script` (and their `@nx/workspace:` names) are the `nx:` executors they re-exported; **an executor target is its `nx-exec` line**, as `nx()` runs it: the migrator translates no executor, so Nx and `@vzn/vx-migrate` stay installed until each such line is rewritten as the command it runs (a server executor Nx knows, `@nx/js:node` or a dev server, is still a persistent task). The report also says what `vx.workspace.ts` still holds, as the Turbo migration does: the `nx()` `vx init` declared, which keeps reading nx.json, and a lockfile with no `@vzn/vx-lockfile` plugin, where Nx keyed each project on the npm packages it depends on. A written command that still runs Nx itself (a run-commands `nx run b:build`, `npx nx test b`, a script's `nx exec -- tsc`) carries a TODO: it works only while Nx is installed. An Nx project no workspace glob lists (an integrated repo's `project.json` library) gets a `package.json` (`name`, `private`) where it has none, and a note names the directories to add to `workspaces` (or `pnpm-workspace.yaml`): core finds a project only through those globs, and the migrator never edits the root manifest. A target with `configurations` writes one task per configuration (`build`, `build:ci`). A project's Nx `tags` are written as its `tags`. Named inputs expand from `nx.json` when readable. An output path is kept as written, a `!` one too (`{projectRoot}/dist` → `dist`, `{projectRoot}/bin/tool` → `bin/tool`; one naming an unset `{options.x}` is dropped, as Nx drops it; a dotted `{options.outputPath.base}` walks the options, as Nx does; an extglob is put in vx's grammar: Next's inferred `.next/!(cache)/**/*` is `.next/*/**/*` with `!.next/cache/**/*`, `@(js|map)` is `{js,map}`, and a form with no vx spelling is dropped with a TODO): vx reads a bare path as the file or the whole tree under it, so a directory and an extensionless binary both save and restore. nx.json's `parallel`, `defaultBase` and `maxCacheSize`, which `nx()` applies live, are each a field of the `vx.workspace.ts` it writes (`concurrency`, `affectedBase`, `cacheRetention.maxSize`), read from nx.json alone, never the environment; beside a workspace file already there, or for a size vx cannot read (`1.5 GB`), each is a note naming the field to add. vx derives package edges from `package.json`; an Nx graph edge with no manifest path (`implicitDependencies`, a tsconfig path) becomes, for each `^target` of the dependant, an explicit `pkg#target` edge to what Nx's own walk reaches — each dependency that has the target, and through one that lacks it, its dependencies — so the order and the key are Nx's. The reverse too: where a project's manifest names a workspace package its Nx graph does not reach (an `implicitDependencies: ["!a"]` that breaks a manifest cycle), its `^target` becomes the explicit edges Nx draws, since vx's `^` would follow the manifest and bring the cycle back.
 
 ## `turboCache()` — a Turbo remote cache
 
@@ -309,7 +311,7 @@ The Nx spec has no existence probe, so `has` (the `--dry` prediction; the prefet
 - A remote error degrades to a **miss** and a warning that names the request, the artifact and the server — `vx/turbo-cache: upload 32248a2a7c89e241 to https://cache.example.com/v8/artifacts failed: no answer within 60000 ms` — never the token. The run never fails because of the cache.
 - The same failure is said once per run: an unreachable server fails the probe, the download and the upload alike, and the run prints the first and, at its end, `vx/turbo-cache: 2 more requests failed the same way: Unable to connect. Is the computer able to access the url?` (core's `LayeredCache` does the counting, for every cache plugin).
 - A request answered `429` or `5xx` (not `501`), or one that never connected (a refused port, an unresolved host), is sent again after 2 s — a `429` after its `Retry-After`, capped at 10 s — as Turbo's client does. A spent deadline is not: it has already cost its wait.
-- A refused token (`401`/`403`) warns **once** and turns the layer off for the rest of the process (for `nxCache()`, a `403` on an upload is the spec's read-only token: it turns off uploads alone, and reads go on) — including the requests already in flight when the refusal lands, which degrade in silence rather than repeating it (a six-project run printed five identical lines before 2026-09-20).
+- A refused token (`401`/`403`) warns **once** and turns the layer off for the rest of the process (a `403` on an upload is a read-only token — Nx's spec, or turborepo-remote-cache's `READ_ONLY` and write-less JWTs: it turns off uploads alone, and reads go on) — including the requests already in flight when the refusal lands, which degrade in silence rather than repeating it (a six-project run printed five identical lines before 2026-09-20).
 - Policy (`--cache=remote:r`, …) is enforced by core's `LayeredCache`, which the plugins wrap — a read-only token pairs naturally with `remote:r`.
 - Each tool's own switches narrow that policy, never widen it, as they do for the tool: `TURBO_CACHE` (`--cache`'s syntax, an omitted source off) and `TURBO_REMOTE_CACHE_READ_ONLY` for `turboCache()`, `NX_SKIP_REMOTE_CACHE` / `NX_DISABLE_REMOTE_CACHE` (`true`) for `nxCache()`. A CI that keeps untrusted pull requests off the shared cache that way keeps vx off it too.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-migrate",
-  "version": "0.0.594",
+  "version": "0.0.595",
   "license": "MIT",
   "description": "Adopt @vzn/vx from Turborepo or Nx: run the repo unchanged, migrate it to vx.config.ts, and keep your Turbo or Nx remote cache",
   "keywords": [
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.594"
+    "@vzn/vx": "^0.0.595"
   },
   "repository": {
     "type": "git",

package/src/glob-grammar.ts

@@ -63,17 +63,21 @@ function classMembers(body: string): string[] | null {
 }
 
 /**
- * `list` without a literal that one of its `!` entries takes back. Turbo,
- * Nx and vx all subtract an exclusion wherever it sits, so such a file was
- * never an input there either; vx refuses it at load, which would stop an
- * unchanged repo's run, so the adapters drop it.
+ * `list` without a literal that one of its `!` entries takes back, and
+ * without a repeat. Turbo, Nx and vx all subtract an exclusion wherever it
+ * sits, so such a file was never an input there either; vx refuses it at
+ * load, which would stop an unchanged repo's run, so the adapters drop it.
+ * A repeat adds nothing in any order: TanStack Query's `test:eslint` named
+ * `eslint.config.js` twice (`sharedGlobals` and its own), and the written
+ * config listed it twice.
  */
-export function withoutTakenBack<T>(list: readonly T[]): T[] {
+export function withoutTakenBack<T>(entries: readonly T[]): T[] {
+  const list = [...new Set(entries)]
   const wild = /[*?{}]/
   const negative = list.flatMap((e) =>
     typeof e === 'string' && e.startsWith('!') ? [e.slice(1)] : [],
   )
-  if (negative.length === 0) return [...list]
+  if (negative.length === 0) return list
   const globs = negative
     .flatMap((n) => (wild.test(n) ? [n] : [n, `${n.replace(/\/+$/, '')}/**`]))
     .map((g) => new Bun.Glob(g.replace(/^\.\//, '')))
@@ -83,3 +87,13 @@ export function withoutTakenBack<T>(list: readonly T[]): T[] {
     return !globs.some((g) => g.match(lit))
   })
 }
+
+/**
+ * A path from the file system as a task glob that names only itself: a dir
+ * named `my{app}` read as a brace matched `myapp` instead. `[` `]` are
+ * literal in a task glob already; `*` and `?` stay, since the schema reads
+ * `\*` as a Windows separator, and they match the name too (a superset).
+ */
+export function literalGlob(p: string): string {
+  return p.replace(/^!|[{}]/g, '\\$&')
+}

package/src/migrate-nx.ts

@@ -19,6 +19,8 @@ export async function migrateNx(
   metas: readonly ProjectMeta[],
   format: MigrationFormat = 'ts',
   snapshot = path.join(root, NX_GRAPH_REL),
+  /** This run writes `vx.workspace.ts`, with nx.json's run settings as fields. */
+  writesWorkspace = false,
 ): Promise<MigrationPlan> {
   const graph = parseNxGraph(await Bun.file(snapshot).text(), path.relative(root, snapshot))
   const tracked = await trackedFiles(root)
@@ -64,7 +66,9 @@ export async function migrateNx(
     notes: [
       ...mapped.notes,
       ...unlisted.notes,
-      ...workspaceNotes((await readNxJson(root).catch(() => null))?.json),
+      ...nxWorkspaceFields((await readNxJson(root).catch(() => null))?.json)
+        .filter((f) => !writesWorkspace || f.source === undefined)
+        .map((f) => f.note),
     ],
   }
 }
@@ -117,14 +121,24 @@ async function unlistedProjects(
   }
 }
 
+/** A `vx.workspace.ts` field nx.json's run settings call for. */
+export interface NxWorkspaceField {
+  readonly field: 'concurrency' | 'affectedBase' | 'cacheRetention'
+  /** The value as TypeScript source; undefined when vx cannot read it. */
+  readonly source: string | undefined
+  /** What to tell a user whose workspace file this run does not write. */
+  readonly note: string
+}
+
+const quoted = (s: string) => `'${s.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`
+
 /**
- * nx.json's run-wide settings `nx()` applies live and the written
- * `vx.workspace.ts` cannot hold (core writes it): each is a line naming
- * the field to add, or a migrated repo that ran one task at a time for a
- * shared database ran on every core. nx.json only: the files are written
- * for every machine, so `NX_PARALLEL` and friends are not read.
+ * nx.json's run-wide settings `nx()` applies live: each a field of the
+ * written `vx.workspace.ts`, or a migrated repo that ran one task at a time
+ * for a shared database ran on every core. nx.json only: the files are
+ * written for every machine, so `NX_PARALLEL` and friends are not read.
  */
-function workspaceNotes(json: Record<string, unknown> | undefined): string[] {
+export function nxWorkspaceFields(json: Record<string, unknown> | undefined): NxWorkspaceField[] {
   const nx = json as
     | {
         parallel?: unknown
@@ -134,21 +148,27 @@ function workspaceNotes(json: Record<string, unknown> | undefined): string[] {
         maxCacheSize?: unknown
       }
     | undefined
-  const out: string[] = []
+  const out: NxWorkspaceField[] = []
   const parallel = nx?.parallel ?? nx?.tasksRunnerOptions?.default?.options?.parallel
   if (typeof parallel === 'number' && Number.isInteger(parallel) && parallel > 0)
-    out.push(
-      `nx.json \`parallel: ${parallel}\`: add \`concurrency: ${parallel}\` to vx.workspace.ts`,
-    )
+    out.push({
+      field: 'concurrency',
+      source: String(parallel),
+      note: `nx.json \`parallel: ${parallel}\`: add \`concurrency: ${parallel}\` to vx.workspace.ts`,
+    })
   const base = nx?.defaultBase ?? nx?.affected?.defaultBase
   if (typeof base === 'string' && base.trim() !== '')
-    out.push(
-      `nx.json \`defaultBase\` ${JSON.stringify(base.trim())}: add \`affectedBase: ${JSON.stringify(base.trim())}\` to vx.workspace.ts`,
-    )
+    out.push({
+      field: 'affectedBase',
+      source: quoted(base.trim()),
+      note: `nx.json \`defaultBase\` ${JSON.stringify(base.trim())}: add \`affectedBase: ${JSON.stringify(base.trim())}\` to vx.workspace.ts`,
+    })
   const size = nxSizeText(nx?.maxCacheSize)
   if (size !== undefined)
-    out.push(
-      `nx.json \`maxCacheSize\`: add \`cacheRetention: { maxSize: ${JSON.stringify(size)} }\` to vx.workspace.ts`,
-    )
+    out.push({
+      field: 'cacheRetention',
+      source: /^\d+[KMG]?B$/.test(size) ? `{ maxSize: ${quoted(size)} }` : undefined,
+      note: `nx.json \`maxCacheSize\`: add \`cacheRetention: { maxSize: ${JSON.stringify(size)} }\` to vx.workspace.ts`,
+    })
   return out
 }

package/src/migrate.ts

@@ -4,7 +4,8 @@
 // live instead, as `vx init` writes it), and vx installed with the repo's
 // manager.
 // Without either mode flag a terminal is asked; anything else is native. Source auto-detect: turbo.json → Turbo;
-// .nx/workspace-data/project-graph.json or nx.json → Nx (the resolved graph, exported by nx if absent);
+// .nx/workspace-data/project-graph.json, nx.json or a Lerna-on-Nx lerna.json → Nx (the resolved
+// graph, exported by nx if absent);
 // The mappers return a plan; core's migration seam
 // (`applyMigration`) renders, guards, writes and reports, so what this
 // package writes reads exactly like what `vx init` writes.
@@ -23,8 +24,9 @@ import {
   type MigrationPlan,
   UserError,
 } from '@vzn/vx'
-import { migrateNx, NX_GRAPH_REL } from './migrate-nx.js'
+import { migrateNx, NX_GRAPH_REL, nxWorkspaceFields } from './migrate-nx.js'
 import { exportGraph } from './nx/export-graph.js'
+import { readNxJson } from './nx/nx-map.js'
 import {
   type AdoptionMode,
   install,
@@ -41,6 +43,7 @@ import {
   renderWorkspaceFile,
   workspaceFileAt,
   workspacePlugins,
+  type WorkspacePlugin,
 } from './workspace-plugins.js'
 
 export interface MigrateArgs {
@@ -124,13 +127,15 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
   const hasTurbo = turboFile !== null
   const hasGraph = await Bun.file(path.join(root, NX_GRAPH_REL)).exists()
   const hasNxJson = await Bun.file(path.join(root, 'nx.json')).exists()
+  // A Turbo repo's lerna.json publishes; Turbo runs its tasks.
+  const lerna = !hasTurbo && !hasGraph && !hasNxJson && lernaOnNx(root)
 
   // Evaluating teams routinely have two runners checked in — never
   // ask anyone to delete anything; --from disambiguates.
   const found = (
     [
       ['turbo', hasTurbo, 'turbo.json'],
-      ['nx', hasGraph || hasNxJson, 'an nx workspace'],
+      ['nx', hasGraph || hasNxJson || lerna, 'an nx workspace'],
     ] as const
   ).filter(([, present]) => present)
   if (parsed.from === undefined && found.length > 1) {
@@ -148,23 +153,26 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
   }
 
   const runner: 'turbo' | 'nx' | undefined =
-    parsed.from ?? (hasTurbo ? 'turbo' : hasGraph || hasNxJson ? 'nx' : undefined)
+    parsed.from ?? (hasTurbo ? 'turbo' : hasGraph || hasNxJson || lerna ? 'nx' : undefined)
   if (runner === undefined) {
     throw new UserError(
       'nothing to migrate: no turbo.json and no Nx workspace — ' +
         'for package.json scripts, run `vx init`',
     )
   }
-  const mode = parsed.mode ?? (await askMode(runner, parsed.dry))
-  if (mode === 'keep') return keep(root, runner, hasTurbo, parsed)
+  const mode = parsed.mode ?? (await askMode(runner, lerna ? 'lerna.json' : undefined, parsed.dry))
+  if (mode === 'keep') return keep(root, runner, hasTurbo, lerna, parsed)
 
   const format: MigrationFormat = parsed.mjs ? 'mjs' : 'ts'
+  // No workspace file yet: this run writes one, declaring the plugins the
+  // repo calls for and the run settings nx.json holds.
+  const writesWorkspace = workspaceFileAt(root) === undefined
   let source: string
   let plan: MigrationPlan
   if (runner === 'nx') {
     if (hasGraph) {
       source = NX_GRAPH_REL
-      plan = await migrateNx(root, metas, format)
+      plan = await migrateNx(root, metas, format, undefined, writesWorkspace)
     } else {
       // Modern Nx stores the graph in SQLite, so the JSON snapshot exists only
       // when exported. The workspace's own nx exports it, as `nx()` does, into
@@ -180,7 +188,7 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
           )
         }
         source = 'nx graph'
-        plan = await migrateNx(root, metas, format, snapshot)
+        plan = await migrateNx(root, metas, format, snapshot, writesWorkspace)
       } finally {
         await rm(tmp, { recursive: true, force: true })
       }
@@ -201,16 +209,24 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
           existsSync(path.join(p.dir, configName))),
     ) ||
       plan.extraFiles.some((f) => existsSync(path.join(root, f.relPath))))
-  // No workspace file yet: write one declaring the plugins the repo calls
-  // for, and drop the note that told the user to declare the lockfile one.
-  const plugins = workspaceFileAt(root) === undefined ? workspacePlugins(root) : []
-  if (plugins.length > 0) {
+  // Drop the note that told the user to declare the lockfile plugin.
+  const plugins = writesWorkspace ? workspacePlugins(root) : []
+  if (writesWorkspace) {
+    const fields =
+      runner === 'nx'
+        ? nxWorkspaceFields((await readNxJson(root).catch(() => null))?.json).flatMap((f) =>
+            f.source === undefined ? [] : [{ field: f.field, source: f.source }],
+          )
+        : []
     plan = {
       ...plan,
       headerNotes: plan.headerNotes.filter((n) => !n.includes('from @vzn/vx-lockfile')),
       extraFiles: [
         ...plan.extraFiles,
-        { relPath: `vx.workspace.${format}`, contents: renderWorkspaceFile(plugins, format) },
+        {
+          relPath: `vx.workspace.${format}`,
+          contents: renderWorkspaceFile(plugins, format, fields),
+        },
       ],
     }
   }
@@ -231,9 +247,13 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
 }
 
 /** A terminal is asked which adoption it wants; anything else gets native. */
-async function askMode(runner: 'turbo' | 'nx', dry: boolean): Promise<AdoptionMode> {
+async function askMode(
+  runner: 'turbo' | 'nx',
+  file: string | undefined,
+  dry: boolean,
+): Promise<AdoptionMode> {
   if (dry || !process.stdin.isTTY || !process.stdout.isTTY) return 'native'
-  const source = runner === 'turbo' ? 'turbo.json' : 'nx.json'
+  const source = file ?? (runner === 'turbo' ? 'turbo.json' : 'nx.json')
   for (;;) {
     const mode = parseModeAnswer(prompt(MODE_QUESTION(runner, source)))
     if (mode !== undefined) return mode
@@ -268,6 +288,7 @@ async function keep(
   root: string,
   runner: 'turbo' | 'nx',
   hasTurbo: boolean,
+  lerna: boolean,
   args: MigrateArgs,
 ): Promise<number> {
   // `vx init` reads turbo.json first.
@@ -291,6 +312,9 @@ async function keep(
   )) {
     process.stdout.write(`vx-migrate: ${note}\n`)
   }
+  // `vx init` adopts nx() by nx.json, and a Lerna repo may have none: it
+  // would map the scripts instead, so the file is written here.
+  if (lerna) return keepLerna(root, plugins, args)
   // A resolve that misses from a directory with no node_modules is an
   // auto-install under Bun: ask the root only where it has the package.
   const installed = path.join(root, 'node_modules', '@vzn', 'vx')
@@ -316,3 +340,79 @@ async function keep(
   }
   return code
 }
+
+/** `--keep` in a Lerna repo with no nx.json: the workspace file declaring `nx()`. */
+async function keepLerna(
+  root: string,
+  plugins: readonly WorkspacePlugin[],
+  args: MigrateArgs,
+): Promise<number> {
+  const format = args.mjs ? 'mjs' : 'ts'
+  const name = `vx.workspace.${format}`
+  const existing = workspaceFileAt(root)
+  const all = [{ pkg: '@vzn/vx-migrate', factory: 'nx' }, ...plugins]
+  if (existing !== undefined && !args.force) {
+    const text = readFileSync(path.join(root, existing), 'utf8')
+    const extended = extendWorkspaceFile(text, all)
+    if (extended === null) {
+      throw new UserError(
+        `${existing} exists; add nx() from @vzn/vx-migrate to its plugins, or --force replaces it`,
+      )
+    }
+    if (!args.dry && extended !== text) await Bun.write(path.join(root, existing), extended)
+    const names = undeclared(text, all).map((p) => `${p.factory}()`)
+    if (names.length > 0)
+      process.stdout.write(
+        `vx-migrate: ${args.dry ? 'would declare' : 'declared'} ${names.join(', ')} in ${existing}\n`,
+      )
+    return 0
+  }
+  const text = renderWorkspaceFile(all, format)
+  if (args.dry) {
+    process.stdout.write(`── ${name} ──\n${text}\nvx-migrate: would write ${name} (dry run)\n`)
+    return 0
+  }
+  if (existing !== undefined && existing !== name) await rm(path.join(root, existing))
+  await Bun.write(path.join(root, name), text)
+  process.stdout.write(`vx-migrate: lerna.json found — wrote ${name} declaring nx()\n`)
+  return 0
+}
+
+/**
+ * Lerna 6+ runs `lerna run` on Nx's task runner over the graph `nx graph`
+ * exports, nx.json or not, unless lerna.json says `useNx: false`; Lerna 5
+ * ran its own unless it said `useNx: true`. Lerna is the installed one,
+ * else the root manifest's range; with neither, the lerna.json is another
+ * tool's (lerna-lite reads it too, and runs no Nx). A repo whose root
+ * scripts never `lerna run` runs its tasks some other way and publishes
+ * with Lerna (webdriverio: `run-s`, `pnpm -r`): its scripts are the source.
+ */
+const LERNA_RUN = /(?:^|[\s;&|(])lerna\s+run\s/
+
+function lernaOnNx(root: string): boolean {
+  const json = (file: string): Record<string, unknown> | undefined => {
+    try {
+      return JSON.parse(readFileSync(file, 'utf8')) as Record<string, unknown>
+    } catch {
+      return undefined
+    }
+  }
+  const config = json(path.join(root, 'lerna.json'))
+  if (config === undefined) return false
+  const installed = json(path.join(root, 'node_modules', 'lerna', 'package.json'))?.['version']
+  const manifest = json(path.join(root, 'package.json'))
+  const declared = ['devDependencies', 'dependencies']
+    .map((k) => (manifest?.[k] as Record<string, unknown> | undefined)?.['lerna'])
+    .find((v): v is string => typeof v === 'string')
+  const version = typeof installed === 'string' ? installed : declared
+  if (version === undefined) return false
+  const scripts = manifest?.['scripts']
+  const runs =
+    scripts !== null &&
+    typeof scripts === 'object' &&
+    Object.values(scripts).some((v) => typeof v === 'string' && LERNA_RUN.test(v))
+  if (!runs) return false
+  if (typeof config['useNx'] === 'boolean') return config['useNx']
+  const major = /\d+/.exec(version)?.[0]
+  return major === undefined || Number(major) >= 6
+}

package/src/nx/nx-inputs.ts

@@ -68,13 +68,9 @@ export function expandNxInputs(
           todos.push(`input ${JSON.stringify(entry)} uses a token vx does not support`)
           return
         }
-        if (neg === '' && at.outputs?.some((o) => p === o || p.startsWith(`${o}/`))) {
-          todos.push(
-            `input ${JSON.stringify(entry)} is an output of the project's own targets: git does not ` +
-              'list it, so vx cannot key on it — dropped; the task that writes it keys its dependants through dependsOn',
-          )
-          return
-        }
+        // Nx's file map skips gitignored files, so it hashes nothing here
+        // either: a changed `dist` file is a cache hit under Nx 23.3 (YL-1).
+        if (neg === '' && at.outputs?.some((o) => p === o || p.startsWith(`${o}/`))) return
         const g = minimatchToVx(p, neg !== '')
         if (g === null) {
           todos.push(`input ${JSON.stringify(entry)}: glob syntax vx cannot take — map manually`)

package/src/nx-env.cjs

@@ -25,7 +25,10 @@
 const { spawn, spawnSync } = require('node:child_process')
 const { createRequire } = require('node:module')
 const path = require('node:path')
-const { loadTaskEnv } = require('./nx-dotenv.cjs')
+const { realpathSync } = require('node:fs')
+// Through npm's `.bin` symlink under `--preserve-symlinks-main`, Node keeps
+// the link as the main module, so a relative require would look in `.bin`.
+const { loadTaskEnv } = require(path.join(path.dirname(realpathSync(__filename)), 'nx-dotenv.cjs'))
 
 // `--envFile`, Nx's own option name, and not `--env-file`: Node 22 takes
 // `--env-file` from anywhere on its command line, the script's arguments

package/src/nx-exec.cjs

@@ -21,7 +21,10 @@
 
 const { createRequire, enableCompileCache } = require('node:module')
 const path = require('node:path')
-const { loadTaskEnv } = require('./nx-dotenv.cjs')
+const { realpathSync } = require('node:fs')
+// Through npm's `.bin` symlink under `--preserve-symlinks-main`, Node keeps
+// the link as the main module, so a relative require would look in `.bin`.
+const { loadTaskEnv } = require(path.join(path.dirname(realpathSync(__filename)), 'nx-dotenv.cjs'))
 
 // Nx's module graph is ~150 ms of every executed task; Node's on-disk
 // compile cache (22.1+, a no-op below) takes ~30 of them back on the

package/src/tracked-outputs.ts

@@ -9,7 +9,7 @@
 
 import { lstat, readFile } from 'node:fs/promises'
 import path from 'node:path'
-import { outputsOverlap } from '@vzn/vx'
+import { isLiteralPattern, outputsOverlap } from '@vzn/vx'
 
 /** The files git tracks under `root`, root-relative; null outside a repo or without git. */
 export async function trackedFiles(root: string): Promise<string[] | null> {
@@ -216,6 +216,27 @@ export function spareTrackedOutputs(
   tracked: readonly string[],
 ): [string, string][] {
   const todos: [string, string][] = []
+  const trackedSet = new Set(tracked)
+  /** Drop the `!` entries readers carry for a committed file no output names any more. */
+  const unhide = (owner: (typeof projects)[number] | null, rooted: string) => {
+    for (const q of projects) {
+      const qrel = path.relative(root, q.dir).split(path.sep).join('/')
+      for (const r of q.tasks) {
+        const inputs = (r.task?.['cache'] as { inputs?: Outputs } | undefined)?.inputs
+        if (inputs === undefined) continue
+        const own =
+          q === owner &&
+          Array.isArray(inputs.files) &&
+          (qrel === '' || rooted.startsWith(`${qrel}/`))
+            ? rooted.slice(qrel === '' ? 0 : qrel.length + 1)
+            : undefined
+        if (own !== undefined)
+          inputs.files = (inputs.files as unknown[]).filter((g) => g !== `!${own}`)
+        if (Array.isArray(inputs.workspaceFiles))
+          inputs.workspaceFiles = inputs.workspaceFiles.filter((g) => g !== `!${rooted}`)
+      }
+    }
+  }
   for (const p of projects) {
     const rel = path.relative(root, p.dir).split(path.sep).join('/')
     const own = rel === '' ? tracked : filesUnder(tracked, rel).map((f) => f.slice(rel.length + 1))
@@ -229,7 +250,20 @@ export function spareTrackedOutputs(
       ] as const) {
         const globs = outputs[key]
         if (!Array.isArray(globs) || globs.length === 0) continue
-        const strings = globs.filter((g): g is string => typeof g === 'string')
+        let strings = globs.filter((g): g is string => typeof g === 'string')
+        // An output naming one committed file (eslint's
+        // `eslint-suppressions.json`) is a source: its `!` would take the
+        // whole entry back, so the entry goes, and so does the `!` a
+        // reader's inputs got for it, or every reader ran uncached (hono).
+        const rootedOf = (g: string) => (key === 'files' && rel !== '' ? `${rel}/${g}` : g)
+        const sources = new Set(
+          strings.filter((g) => isLiteralPattern(g) && trackedSet.has(rootedOf(g))),
+        )
+        if (sources.size > 0) {
+          strings = strings.filter((g) => !sources.has(g.startsWith('!') ? g.slice(1) : g))
+          outputs[key] = strings
+          for (const g of sources) unhide(key === 'files' ? p : null, rootedOf(g))
+        }
         const hit = coveredTracked(strings, base)
         if (hit.length > 0) hits.push([key, strings, hit])
       }

package/src/turbo/turbo-map.ts

@@ -13,7 +13,7 @@
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { pruneOrphanPersistentNotes, type ProjectMeta, UserError } from '@vzn/vx'
-import { minimatchToVx, withoutTakenBack } from '../glob-grammar.js'
+import { literalGlob, minimatchToVx, withoutTakenBack } from '../glob-grammar.js'
 import { shellQuote } from '../nx-command.js'
 import { scriptCommand, yarnPnp } from '../script-command.js'
 import {
@@ -842,7 +842,7 @@ function rootDependencyGlobs(
   const out: string[] = []
   for (const name of seen) {
     const rel = relPosix(root, byName.get(name)!.dir)
-    if (rel !== '' && rel !== '.') out.push(`${rel}/**`)
+    if (rel !== '' && rel !== '.') out.push(`${literalGlob(rel)}/**`)
   }
   return out.sort()
 }
@@ -1110,22 +1110,15 @@ export async function mapTurboWorkspace(
       // A name no package has a script for is an entry point of its own:
       // `turbo run ci` over `ci: { dependsOn: ["lint", "build"] }`, or
       // cal.com's `deploy` → `@calcom/web#build`, runs its edges, and vx
-      // said no project declares it. Its `pkg#task` edges stay in that
-      // package alone: core's `--filter`/`--affected` reach follows a task
-      // edge across packages, and cal.com's `deploy` in all 116 would have
-      // made every package a dependent of web.
+      // said no project declares it. With no edge left (documenso's `lint`,
+      // shadcn-ui's `check`) Turbo still runs a no-op node per package and
+      // exits 0, so a CI step `vx run lint` must too. Its `pkg#task` edges
+      // stay in that package alone: core's `--filter`/`--affected` reach
+      // follows a task edge across packages, and cal.com's `deploy` in all
+      // 116 would have made every package a dependent of web.
       else if (!scripted.has(name)) {
-        const kept = entryEdges(def?.dependsOn ?? [], meta.name, rootMeta?.name)
-        const keeps = kept.some((d) => {
-          if (envDependency(d) !== null || d.includes('$TURBO_ROOT$')) return false
-          if (d.startsWith('^'))
-            return d !== `^${name}` && [...runnable.values()].some((r) => r.has(d.slice(1)))
-          return d !== name && (own.has(d) || defined.has(d))
-        })
-        if (keeps) {
-          emitted.get(meta.name)!.add(name)
-          entry.add(`${meta.name}#${name}`)
-        }
+        emitted.get(meta.name)!.add(name)
+        entry.add(`${meta.name}#${name}`)
       }
     }
   }
@@ -1730,7 +1723,7 @@ function buildTask(
   const climbed = (glob: string): string | null => {
     const body = glob.startsWith('!') ? glob.slice(1) : glob
     if (!body.startsWith('../')) return null
-    const anchored = path.posix.normalize(path.posix.join(pkgDir, body))
+    const anchored = path.posix.normalize(path.posix.join(literalGlob(pkgDir), body))
     if (anchored.startsWith('../')) return null
     return (glob.startsWith('!') ? '!' : '') + anchored
   }

package/src/turbo-cache/index.ts

@@ -353,7 +353,8 @@ const MAX_SIGNED_BODY = 2 * 1024 ** 3 + ((2 * 1024 ** 3) >> 8) + 64 * 1024
  * The seam implementation: `has` is HEAD, `hasMany` is the batch query,
  * `get`/`put` carry `x-artifact-duration` (and the tag when signing). An
  * auth failure (401/403) throws ONCE — LayeredCache reports it — and then
- * turns the layer off for the rest of the process, so a bad token costs one
+ * turns the layer off for the rest of the process (an upload's 403 turns off
+ * uploads alone: the read-only token), so a bad token costs one
  * line, not one per task — the requests already in flight when it lands
  * degrade in silence rather than repeating it.
  *
@@ -364,6 +365,13 @@ const MAX_SIGNED_BODY = 2 * 1024 ** 3 + ((2 * 1024 ** 3) >> 8) + 64 * 1024
  */
 export class TurboRemoteCache implements RemoteCacheLayer {
   private disabled = false
+  /**
+   * A `403` on an upload is a read-only token or server
+   * (turborepo-remote-cache's `READ_ONLY` and its JWTs without the write
+   * scope): uploads stop, reads go on. Read as a refused token, it turned
+   * the reads off too, and every task after the first upload missed.
+   */
+  private writesRefused = false
   private readonly key: Uint8Array | undefined
   readonly endpoint: string
   constructor(
@@ -422,6 +430,14 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     ).catch((err: unknown) => {
       throw deadlineNamed(err, timeoutMs)
     })
+    if (method === 'PUT' && res.status === 403) {
+      const first = !this.writesRefused
+      this.writesRefused = true
+      if (!first) return undefined
+      throw new Error(
+        'HTTP 403: the upload was refused (a read-only token or server); uploads off for this run, reads go on',
+      )
+    }
     if (res.status === 401 || res.status === 403) {
       const first = !this.disabled
       this.disabled = true
@@ -520,7 +536,7 @@ export class TurboRemoteCache implements RemoteCacheLayer {
   }
 
   async put(hash: string, body: Blob, meta: { durationMs: number }): Promise<void> {
-    if (this.disabled) return
+    if (this.disabled || this.writesRefused) return
     const headers: Record<string, string> = {
       'Content-Type': 'application/octet-stream',
       'Content-Length': String(body.size),

package/src/workspace-plugins.ts

@@ -45,6 +45,7 @@ function entries(plugins: readonly WorkspacePlugin[], indent: string): string[]
 export function renderWorkspaceFile(
   plugins: readonly WorkspacePlugin[],
   format: 'ts' | 'mjs',
+  fields: readonly { readonly field: string; readonly source: string }[] = [],
 ): string {
   return [
     ...(format === 'ts' ? ["import type { WorkspaceConfig } from '@vzn/vx/config'"] : []),
@@ -54,6 +55,7 @@ export function renderWorkspaceFile(
     '  plugins: [',
     ...entries(plugins, '    '),
     '  ],',
+    ...fields.map((f) => `  ${f.field}: ${f.source},`),
     `}${format === 'ts' ? ' satisfies WorkspaceConfig' : ''}`,
     '',
   ].join('\n')