@vzn/vx-migrate 0.0.595 → 0.0.597

package/src/migrate.ts

@@ -1,11 +1,12 @@
-// `vx-migrate [--from turbo|nx] [--native|--keep] [--no-install] [--dry]
+// `vx-migrate [--from turbo|nx|vite-task] [--native|--keep] [--no-install] [--dry]
 // [--force] [--mjs]` — one vx.config.ts per workspace package from an
 // existing Turbo or Nx setup (`--keep`: the workspace file that reads it
 // live instead, as `vx init` writes it), and vx installed with the repo's
 // manager.
 // Without either mode flag a terminal is asked; anything else is native. Source auto-detect: turbo.json → Turbo;
 // .nx/workspace-data/project-graph.json, nx.json or a Lerna-on-Nx lerna.json → Nx (the resolved
-// graph, exported by nx if absent);
+// graph, exported by nx if absent); `vite-plus` in the root package.json → Vite Task, last:
+// vite-plus is a whole toolchain, so beside turbo.json or Nx it is not the task runner.
 // The mappers return a plan; core's migration seam
 // (`applyMigration`) renders, guards, writes and reports, so what this
 // package writes reads exactly like what `vx init` writes.
@@ -33,9 +34,11 @@ import {
   missingPackages,
   MODE_QUESTION,
   ownVersion,
+  packageManagerOf,
   parseModeAnswer,
 } from './adopt.js'
 import { migrateTurbo } from './migrate-turbo.js'
+import { migrateViteTask } from './migrate-vite-task.js'
 import { turboConfigFile } from './turbo/turbo-map.js'
 import {
   extendWorkspaceFile,
@@ -51,7 +54,7 @@ export interface MigrateArgs {
   force: boolean
   /** `vx.config.mjs` (and `vx-preset.mjs`) instead of `.ts`. */
   mjs: boolean
-  from?: 'turbo' | 'nx'
+  from?: 'turbo' | 'nx' | 'vite-task'
   /** `--native` / `--keep`; unset asks a terminal and is native elsewhere. */
   mode?: AdoptionMode
   /** `--no-install`: leave package.json's dependencies alone. */
@@ -62,7 +65,7 @@ export interface MigrateArgs {
 }
 
 const USAGE =
-  'usage: vx-migrate [--from turbo|nx] [--native|--keep] [--no-install] [--dry] [--force] [--mjs]'
+  'usage: vx-migrate [--from turbo|nx|vite-task] [--native|--keep] [--no-install] [--dry] [--force] [--mjs]'
 
 export function parseMigrateArgs(args: readonly string[]): MigrateArgs {
   const out: MigrateArgs = { dry: false, force: false, mjs: false }
@@ -80,10 +83,10 @@ export function parseMigrateArgs(args: readonly string[]): MigrateArgs {
       out.mode = mode
     } else if (a === '--from' || a?.startsWith('--from=')) {
       const v = a === '--from' ? args[++i] : a.slice('--from='.length)
-      if (v !== 'turbo' && v !== 'nx') {
+      if (v !== 'turbo' && v !== 'nx' && v !== 'vite-task') {
         return {
           ...out,
-          error: `--from must be turbo or nx (package.json scripts: \`vx init\`)`,
+          error: `--from must be turbo, nx or vite-task (package.json scripts: \`vx init\`)`,
         }
       }
       out.from = v
@@ -152,16 +155,31 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
     throw new UserError('--from turbo, but no turbo.json at the workspace root')
   }
 
-  const runner: 'turbo' | 'nx' | undefined =
-    parsed.from ?? (hasTurbo ? 'turbo' : hasGraph || hasNxJson || lerna ? 'nx' : undefined)
+  const runner: 'turbo' | 'nx' | 'vite-task' | undefined =
+    parsed.from ??
+    (hasTurbo
+      ? 'turbo'
+      : hasGraph || hasNxJson || lerna
+        ? 'nx'
+        : (await hasVitePlus(root))
+          ? 'vite-task'
+          : undefined)
   if (runner === undefined) {
     throw new UserError(
-      'nothing to migrate: no turbo.json and no Nx workspace — ' +
+      'nothing to migrate: no turbo.json, no Nx workspace and no vite-plus — ' +
         'for package.json scripts, run `vx init`',
     )
   }
-  const mode = parsed.mode ?? (await askMode(runner, lerna ? 'lerna.json' : undefined, parsed.dry))
-  if (mode === 'keep') return keep(root, runner, hasTurbo, lerna, parsed)
+  if (runner === 'vite-task' && parsed.mode === 'keep') {
+    throw new UserError(
+      '--keep: no plugin runs a Vite Task config live; drop --keep to write vx.config files',
+    )
+  }
+  const mode =
+    runner === 'vite-task'
+      ? 'native'
+      : (parsed.mode ?? (await askMode(runner, lerna ? 'lerna.json' : undefined, parsed.dry)))
+  if (mode === 'keep' && runner !== 'vite-task') return keep(root, runner, hasTurbo, lerna, parsed)
 
   const format: MigrationFormat = parsed.mjs ? 'mjs' : 'ts'
   // No workspace file yet: this run writes one, declaring the plugins the
@@ -169,7 +187,10 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
   const writesWorkspace = workspaceFileAt(root) === undefined
   let source: string
   let plan: MigrationPlan
-  if (runner === 'nx') {
+  if (runner === 'vite-task') {
+    source = 'vite.config run.tasks'
+    plan = await migrateViteTask(root, metas, format)
+  } else if (runner === 'nx') {
     if (hasGraph) {
       source = NX_GRAPH_REL
       plan = await migrateNx(root, metas, format, undefined, writesWorkspace)
@@ -177,6 +198,14 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
       // Modern Nx stores the graph in SQLite, so the JSON snapshot exists only
       // when exported. The workspace's own nx exports it, as `nx()` does, into
       // a temp file; the user ran that step by hand until 2026-10-01.
+      // A fresh clone: the export's own reason names the plugin's `graph`
+      // option, which the CLI does not take.
+      if (!existsSync(path.join(root, 'node_modules', '.bin', 'nx'))) {
+        throw new UserError(
+          `nx is not installed here (no node_modules/.bin/nx), and vx-migrate reads the graph it exports — ` +
+            `run \`${packageManagerOf(root, process.env['npm_config_user_agent'])} install\`, then vx-migrate again`,
+        )
+      }
       const tmp = await mkdtemp(path.join(os.tmpdir(), 'vx-migrate-nx-'))
       try {
         const snapshot = path.join(tmp, 'project-graph.json')
@@ -230,9 +259,21 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
       ],
     }
   }
+  // An executor target is an `nx-exec` line and a `.env` one an `nx-env`
+  // line: both bins are this package's, and `bunx` leaves none behind.
+  const runsBins = plan.projects.some((p) =>
+    p.tasks.some((t) => {
+      const cmd = (t.task?.['exec'] as { command?: unknown } | undefined)?.command
+      return typeof cmd === 'string' && /^nx-(exec|env) /.test(cmd)
+    }),
+  )
   const headerNotes = refused
     ? []
-    : await prepareRepo(root, ['@vzn/vx', ...plugins.map((p) => p.pkg)], parsed)
+    : await prepareRepo(
+        root,
+        ['@vzn/vx', ...(runsBins ? ['@vzn/vx-migrate'] : []), ...plugins.map((p) => p.pkg)],
+        parsed,
+      )
   return applyMigration({
     root,
     metas,
@@ -246,6 +287,17 @@ export async function migrateCmd(args: readonly string[]): Promise<number> {
   })
 }
 
+/** vite-plus (`vp run`) in the root package.json's dependencies. */
+async function hasVitePlus(root: string): Promise<boolean> {
+  const pkg = (await Bun.file(path.join(root, 'package.json'))
+    .json()
+    .catch(() => ({}))) as Record<string, unknown>
+  return ['dependencies', 'devDependencies'].some((f) => {
+    const deps = pkg[f]
+    return typeof deps === 'object' && deps !== null && Object.hasOwn(deps, 'vite-plus')
+  })
+}
+
 /** A terminal is asked which adoption it wants; anything else gets native. */
 async function askMode(
   runner: 'turbo' | 'nx',
@@ -392,7 +444,10 @@ const LERNA_RUN = /(?:^|[\s;&|(])lerna\s+run\s/
 function lernaOnNx(root: string): boolean {
   const json = (file: string): Record<string, unknown> | undefined => {
     try {
-      return JSON.parse(readFileSync(file, 'utf8')) as Record<string, unknown>
+      return JSON.parse(readFileSync(file, 'utf8').replace(/^\uFEFF/, '')) as Record<
+        string,
+        unknown
+      >
     } catch {
       return undefined
     }

package/src/nx/export-graph.ts

@@ -1,6 +1,7 @@
 // The resolved Nx graph, exported by the workspace's own nx: `nx()` keys and
 // keeps it, `vx-migrate --from nx` maps it once.
 
+import { readFileSync, realpathSync } from 'node:fs'
 import { mkdir } from 'node:fs/promises'
 import path from 'node:path'
 
@@ -10,9 +11,10 @@ import path from 'node:path'
  * daemon up the export is served from memory, without it Nx computes.
  */
 export async function exportGraph(root: string, snapshot: string): Promise<string | null> {
-  const bin = path.join(root, 'node_modules', '.bin', 'nx')
-  if (!(await Bun.file(bin).exists())) {
-    return `no ${path.relative(root, bin)} — install nx, or export a graph with \`nx graph --file=<path>\` and pass it as graph: '<path>'`
+  const linked = path.join(root, 'node_modules', '.bin', 'nx')
+  const bin = (await Bun.file(linked).exists()) ? linked : lernasNx(root)
+  if (bin === undefined) {
+    return `no ${path.relative(root, linked)} — install nx, or export a graph with \`nx graph --file=<path>\` and pass it as graph: '<path>'`
   }
   // `discover` runs before the run opens (and makes) the cache dir.
   await mkdir(path.dirname(snapshot), { recursive: true })
@@ -27,3 +29,19 @@ export async function exportGraph(root: string, snapshot: string): Promise<strin
   const tail = err.trim().split('\n').slice(-3).join(' ')
   return `nx graph --file exited ${code}${tail ? `: ${tail}` : ''}`
 }
+
+/**
+ * The nx Lerna 6+ runs on, from Lerna's own dependencies: pnpm links only
+ * a root's direct dependencies into `node_modules/.bin`, so a Lerna repo
+ * on pnpm has no `nx` there, and `lerna run` uses this one.
+ */
+function lernasNx(root: string): string | undefined {
+  try {
+    const lerna = realpathSync(path.join(root, 'node_modules', 'lerna'))
+    const manifest = Bun.resolveSync('nx/package.json', lerna)
+    const bin = (JSON.parse(readFileSync(manifest, 'utf8')) as { bin?: { nx?: unknown } }).bin?.nx
+    return typeof bin === 'string' ? path.join(path.dirname(manifest), bin) : undefined
+  } catch {
+    return undefined
+  }
+}

package/src/nx/index.ts

@@ -42,6 +42,7 @@ import {
   readNxJson,
 } from './nx-map.js'
 import { exportGraph } from './export-graph.js'
+import { lernaJsonText } from './lerna.js'
 export type {
   NxExecutors,
   NxExecutorTarget,
@@ -295,7 +296,7 @@ const textOf = (file: string): Promise<string> =>
     .catch(() => '\0absent')
 
 /**
- * Everything the mapping reads: the graph, nx.json and its `extends` chain, every package manifest
+ * Everything the mapping reads: the graph, nx.json and its `extends` chain, lerna.json, every package manifest
  * and the package.json of each graph node no package matches (its
  * synthetic project's name), the `.env` names in every project dir,
  * NX_LOAD_DOT_ENV_FILES, whether the bins the tasks run are installed,
@@ -326,6 +327,8 @@ async function nxReads(
   return [
     graphText,
     ...(await Promise.all(chain.map(textOf))),
+    // Its presence orders each target after its dependencies' (`lerna run`).
+    String(await lernaJsonText(root)),
     // A config file added beside mapped tasks changes what an output may cover.
     JSON.stringify(metas.map((m) => [m.name, m.dir, m.packageJson, m.configPath])),
     ...(await Promise.all(unmatched.map((r) => textOf(path.join(root, r, 'package.json'))))),
@@ -521,7 +524,7 @@ async function graphInputKey(
   if (changed === null) return null
   // The cache dir holds the snapshot itself: a workspace that does not
   // ignore it would see the export move the key it was keyed on.
-  const cacheRel = path.relative(root, cacheDir).split(path.sep).join('/')
+  const cacheRel = relPosix(root, cacheDir)
   const inCache = (p: string): boolean =>
     cacheRel !== '' &&
     !cacheRel.startsWith('..') &&
@@ -537,7 +540,7 @@ async function graphInputKey(
   // stray write at the root (a report, a log) is not, and counting it
   // re-exported the graph on every run after it.
   // A `project.json` anywhere: a new one is a project no root lists yet.
-  const roots = dirs.map((d) => path.relative(root, d).split(path.sep).join('/'))
+  const roots = dirs.map((d) => relPosix(root, d))
   const graphFile = (p: string): boolean =>
     p === 'project.json' ||
     p.endsWith('/project.json') ||

package/src/nx/lerna.ts

@@ -0,0 +1,60 @@
+// `lerna run <x>` orders each package's <x> after its dependencies' <x>.
+// Lerna 6+ runs it on Nx's task runner and passes that order as the target
+// dependency `^<x>` — and drops every other one — unless the repo
+// configures Nx tasks itself: nx.json `targetDefaults` (or the legacy
+// `targetDependencies`), or an `nx` key in the package.json of a package
+// that has <x> (lerna's `prepNxOptions`, 9.0.7). The exported graph holds
+// none of this, so a Lerna repo mapped from it ran every build at once.
+
+import path from 'node:path'
+
+interface Target {
+  dependsOn?: unknown[]
+}
+interface Node {
+  data?: { root?: string; targets?: Record<string, Target> }
+}
+
+/** The text of `root/lerna.json`, or null when there is none. */
+export async function lernaJsonText(root: string): Promise<string | null> {
+  return Bun.file(path.join(root, 'lerna.json'))
+    .text()
+    .catch(() => null)
+}
+
+/**
+ * The graph's nodes with Lerna's order applied, or `nodes` itself when the
+ * repo has no lerna.json or configures Nx's task dependencies.
+ * `manifest(rel)`: the package.json a root-relative node root holds.
+ */
+export async function withLernaOrder<N extends Node>(
+  root: string,
+  nodes: Record<string, N>,
+  nxJson: Record<string, unknown> | undefined,
+  manifest: (rel: string) => Promise<Record<string, unknown> | undefined>,
+): Promise<Record<string, N>> {
+  if ((await lernaJsonText(root)) === null) return nodes
+  const keys = (v: unknown): number =>
+    v !== null && typeof v === 'object' ? Object.keys(v).length : 0
+  if (keys(nxJson?.['targetDependencies'] || nxJson?.['targetDefaults']) > 0) return nodes
+  const configured = new Set<string>()
+  for (const node of Object.values(nodes)) {
+    const targets = node.data?.targets
+    if (targets === undefined) continue
+    if ((await manifest(node.data?.root ?? '.'))?.['nx'] === undefined) continue
+    for (const name of Object.keys(targets)) configured.add(name)
+  }
+  const out: Record<string, N> = {}
+  for (const [id, node] of Object.entries(nodes)) {
+    const targets = node.data?.targets
+    if (targets === undefined) {
+      out[id] = node
+      continue
+    }
+    const ordered: Record<string, Target> = {}
+    for (const [name, t] of Object.entries(targets))
+      ordered[name] = configured.has(name) ? t : { ...t, dependsOn: [`^${name}`] }
+    out[id] = { ...node, data: { ...node.data, targets: ordered } }
+  }
+  return out
+}

package/src/nx/nx-inputs.ts

@@ -7,7 +7,7 @@
 // (`dependentTasksOutputFiles`) is nothing; `externalDependencies` is a todo saying
 // so. Extracted from `buildTask` in item 606.
 
-import { nxWorkspacePath, underProject } from './nx-outputs.js'
+import { nxWorkspacePath, underProject, withProjectDir } from './nx-outputs.js'
 import { minimatchToVx } from '../glob-grammar.js'
 import { shellQuote } from '../nx-command.js'
 
@@ -70,15 +70,23 @@ export function expandNxInputs(
         }
         // Nx's file map skips gitignored files, so it hashes nothing here
         // either: a changed `dist` file is a cache hit under Nx 23.3 (YL-1).
-        if (neg === '' && at.outputs?.some((o) => p === o || p.startsWith(`${o}/`))) return
+        const lit = withProjectDir(p, at.rel, false)
+        if (neg === '' && at.outputs?.some((o) => lit === o || lit.startsWith(`${o}/`))) return
         const g = minimatchToVx(p, neg !== '')
         if (g === null) {
           todos.push(`input ${JSON.stringify(entry)}: glob syntax vx cannot take — map manually`)
           return
         }
-        const own = underProject(g, at.rel)
-        if (own === null) into.wsFiles.push(neg + g)
-        else into.files.push(neg + own)
+        // Nx globs a `{workspaceRoot}` path over every file of the
+        // workspace, a vx project glob only over its project's own: on the
+        // root project TanStack Query's `{workspaceRoot}/**/package.json`
+        // (sherif's input) left every package's manifest out of the key.
+        const own =
+          (at.rel === '' || at.rel === '.') && s.startsWith('{workspaceRoot}')
+            ? null
+            : underProject(g, at.rel)
+        if (own === null) into.wsFiles.push(neg + withProjectDir(g, at.rel, true))
+        else into.files.push(neg + withProjectDir(own, at.rel, true))
         return
       }
       // Bare string = named-input reference.
@@ -193,7 +201,10 @@ export function expandNxInputs(
     }
     // A negation filters only other includeIgnored matches, and a literal
     // reads no others.
-    if (!neg) into.runtimeCmds.push(`cat -- ${shellQuote(p)} 2>/dev/null; echo "$?"`)
+    if (!neg)
+      into.runtimeCmds.push(
+        `cat -- ${shellQuote(withProjectDir(p, at.rel, false))} 2>/dev/null; echo "$?"`,
+      )
   }
   for (const entry of entries) expand(entry, new Set())
   // Nx matches a project fileset with no positive glob against every project

package/src/nx/nx-map.ts

@@ -36,7 +36,8 @@ import {
   wildcardTodo,
 } from '../shared-outputs.js'
 import type { TrackedKinds } from '../tracked-outputs.js'
-import { packageScripts, relPosix } from '../paths.js'
+import { isRecord, packageScripts, relPosix } from '../paths.js'
+import { withLernaOrder } from './lerna.js'
 import { mapNxDeps, matchNxProjects, type TaskNameFor } from './nx-deps.js'
 import {
   dotenvCandidates,
@@ -142,9 +143,6 @@ const LEGACY: Readonly<Record<string, string>> = {
   '@nx/workspace:run-script': 'nx:run-script',
 }
 
-const isRecord = (v: unknown): v is Record<string, unknown> =>
-  typeof v === 'object' && v !== null && !Array.isArray(v)
-
 /** Every dependency name the root package.json declares; none without one. */
 async function rootDependencies(root: string): Promise<ReadonlySet<string>> {
   const pkg = (await Bun.file(path.join(root, 'package.json'))
@@ -304,7 +302,17 @@ export async function mapNxWorkspace(
   graph: NxGraph,
   opts: MapNxOptions,
 ): Promise<NxMapping> {
-  const nodeMap = graph.nodes
+  const byRel = new Map(metas.map((m) => [normRel(relPosix(root, m.dir)), m.packageJson]))
+  const nodeMap = await withLernaOrder(
+    root,
+    graph.nodes,
+    (await readNxJson(root).catch(() => null))?.json,
+    async (rel) =>
+      (byRel.get(normRel(rel)) as Record<string, unknown> | undefined) ??
+      (await Bun.file(path.join(root, rel, 'package.json'))
+        .json()
+        .catch(() => undefined)),
+  )
   const g = graph
 
   const { namedInputs, cacheable, globalSync } = await readNxJsonFacts(root)
@@ -923,7 +931,10 @@ function buildTask(
   }
   const exec: Record<string, unknown> = { command: mapped.command }
   const env: Record<string, unknown> = {}
-  if (inputs.envNames.length > 0) env.passThrough = inputs.envNames
+  // A name that is no shell identifier never reached a task (`sh` drops it)
+  // and core refuses it in passThrough; the key still reads it.
+  const passThrough = inputs.envNames.filter((n) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(n))
+  if (passThrough.length > 0) env.passThrough = passThrough
   // Nx hands every task its target (`getNxEnvVariablesForTask`), and
   // `nx exec -- <cmd>`, a package script's way to run under Nx, reads it:
   // unset, it booted Nx's own task runner, which ran the target and its

package/src/nx/nx-outputs.ts

@@ -2,7 +2,8 @@
 // workspace-root globs. Extracted from `buildTask` in item 606.
 
 import path from 'node:path'
-import { minimatchToVx } from '../glob-grammar.js'
+import { isLiteralPattern } from '@vzn/vx'
+import { literalGlob, minimatchToVx } from '../glob-grammar.js'
 import { takingBack } from '../shared-outputs.js'
 
 interface NxOutputs {
@@ -18,12 +19,13 @@ interface NxOutputs {
  * became the literal glob `coverage/{projectRoot}/**`, saved nothing, and a
  * hit restored nothing. Null when a token is left or the path leaves the
  * workspace; a brace set is no token (item 914 — 912 read one as a gap).
+ * The project dir comes back masked: {@link withProjectDir} writes it in.
  */
 export function nxWorkspacePath(s: string, projectRel: string, projectName: string): string | null {
   const rel = projectRel === '.' ? '' : projectRel
   const p = s
     .replaceAll('{workspaceRoot}', '')
-    .replaceAll('{projectRoot}', rel)
+    .replaceAll('{projectRoot}', masked(rel))
     .replaceAll('{projectName}', projectName)
   // A token left over is a gap; a brace set (`*.{ts,tsx}`) is a glob.
   if (/\{[\w.]+\}/.test(p)) return null
@@ -31,10 +33,38 @@ export function nxWorkspacePath(s: string, projectRel: string, projectName: stri
   return n === '.' || n === '..' || n.startsWith('../') ? null : n
 }
 
+// A project dir is a path, never a glob: `packages/a{b}` read as a token
+// dropped every `{projectRoot}` path, and `packages/[x]` translated as a
+// class reached `packages/x`. Each dir segment stands in as `\uE000<i>\uE001`
+// until the glob is vx's, so `..` still pops one.
+const MASKED = /\uE000(\d+)\uE001/g
+
+function masked(rel: string): string {
+  return rel === ''
+    ? ''
+    : rel
+        .split('/')
+        .map((_, i) => `\uE000${i}\uE001`)
+        .join('/')
+}
+
+/** `p` with the masked project dir written back: as a path, or escaped for a glob. */
+export function withProjectDir(p: string, projectRel: string, asGlob: boolean): string {
+  const segs = projectRel.split('/')
+  return p.replace(MASKED, (_, i: string, at: number) => {
+    const seg = segs[Number(i)]!
+    if (!asGlob) return seg
+    // Only a glob's head reads `!` as a negation.
+    return at === 0 ? literalGlob(seg) : literalGlob(`/${seg}`).slice(1)
+  })
+}
+
 /** A workspace path relative to the project dir, or null when it lies outside. */
 export function underProject(p: string, projectRel: string): string | null {
   if (projectRel === '.' || projectRel === '') return p
-  return p.startsWith(`${projectRel}/`) ? p.slice(projectRel.length + 1) : null
+  for (const dir of [masked(projectRel), projectRel])
+    if (p.startsWith(`${dir}/`)) return p.slice(dir.length + 1)
+  return null
 }
 
 /**
@@ -64,15 +94,16 @@ export function nxDefaultOutputs(
   }
   if (targetName !== 'build' && targetName !== 'prepare') return []
   const root = projectRel === '.' ? '' : projectRel
-  const at = (p: string): string => path.posix.join(root, p)
+  // As tokens, so the dir stays a path whatever its name holds.
+  const at = (p: string): string => (root === '' ? p : `{projectRoot}/${p}`)
   const held = ['build', 'public'].filter((d) => tops === undefined || tops.has(d))
   if (held.length > 0)
     todos.push(
-      `no outputs declared: Nx also caches ${held.map(at).join(' and ')} for this target — vx cleans an output before the run, so add ${held.length === 1 ? 'it' : 'them'} to the outputs by hand only if ${held.length === 1 ? 'it holds' : 'they hold'} nothing committed`,
+      `no outputs declared: Nx also caches ${held.map((d) => path.posix.join(root, d)).join(' and ')} for this target — vx cleans an output before the run, so add ${held.length === 1 ? 'it' : 'them'} to the outputs by hand only if ${held.length === 1 ? 'it holds' : 'they hold'} nothing committed`,
     )
   // The root project's two are one path.
   return [
-    ...new Set([path.posix.join('dist', root), at('dist')]),
+    ...new Set([root === '' ? 'dist' : '{workspaceRoot}/dist/{projectRoot}', at('dist')]),
     ...['build', 'public'].filter((d) => !held.includes(d)).map(at),
   ]
 }
@@ -145,7 +176,7 @@ export function mapNxOutputs(
     const norm = path.posix.normalize(s.replace(/^\/+/, ''))
     if (norm === '..' || norm.startsWith('../')) {
       todos.push(
-        `output ${JSON.stringify(o)} resolves to ${JSON.stringify(norm)}, outside the workspace — ` +
+        `output ${JSON.stringify(o)} resolves to ${JSON.stringify(withProjectDir(norm, projectRel, false))}, outside the workspace — ` +
           'vx caches only inside it; dropped',
       )
       continue
@@ -158,9 +189,18 @@ export function mapNxOutputs(
     for (const g of globs) {
       const gn = g.startsWith('!') ? '!' : ''
       const gs = g.slice(gn.length)
-      if (projectRel === '.') outFiles.push(g)
-      else if (gs.startsWith(`${projectRel}/`)) outFiles.push(gn + gs.slice(projectRel.length + 1))
-      else wsOutFiles.push(gn + path.posix.normalize(gs).replace(/^\.\//, ''))
+      const own = underProject(gs, projectRel)
+      if (own !== null) {
+        outFiles.push(gn + withProjectDir(own, projectRel, true))
+        continue
+      }
+      const m = path.posix.normalize(gs).replace(/^\.\//, '')
+      const w = withProjectDir(m, projectRel, true)
+      wsOutFiles.push(gn + w)
+      // An escaped brace makes a literal a glob, which core matches as the
+      // path alone (`asTrees` adds the tree only to a literal).
+      if (w !== withProjectDir(m, projectRel, false) && isLiteralPattern(m.replace(MASKED, '')))
+        wsOutFiles.push(`${gn}${w}/**`)
     }
   }
   return { outFiles: takingBack(outFiles), wsOutFiles: takingBack(wsOutFiles) }
@@ -217,9 +257,19 @@ export function nxProjectOutputs(
       projectName,
       scratch,
     )
-    for (const f of [...outFiles.map((f) => path.posix.join(rel, f)), ...wsOutFiles]) {
+    const literal = (f: string): string | null => {
       const lit = f.replace(/\/\*\*(\/\*)?$/, '')
-      if (!lit.startsWith('!') && !/[*?[{]/.test(lit)) out.add(lit)
+      return lit.startsWith('!') || /[*?[]|(?<!\\)[{}]/.test(lit)
+        ? null
+        : lit.replace(/\\([{}!])/g, '$1')
+    }
+    for (const f of outFiles) {
+      const lit = literal(f)
+      if (lit !== null) out.add(path.posix.join(rel, lit))
+    }
+    for (const f of wsOutFiles) {
+      const lit = literal(f)
+      if (lit !== null) out.add(lit)
     }
   }
   const r = [...out]

package/src/nx/nx-upstream.ts

@@ -20,6 +20,7 @@ import type { GeneratedTask, ProjectMeta } from '@vzn/vx'
 import { emptyNxInputs, expandNxInputs, type NxInputs } from './nx-inputs.js'
 import { nxProjectOutputs } from './nx-outputs.js'
 import { matchNxProjects } from './nx-deps.js'
+import { literalGlob } from '../glob-grammar.js'
 
 interface GraphNode {
   name?: string
@@ -192,7 +193,9 @@ export function planNxUpstream(
     const inputs = emptyNxInputs()
     for (const g of own.files) {
       const neg = g.startsWith('!') ? '!' : ''
-      inputs.wsFiles.push(rel === '' ? g : `${neg}${rel}/${neg === '' ? g : g.slice(1)}`)
+      inputs.wsFiles.push(
+        rel === '' ? g : `${neg}${literalGlob(rel)}/${neg === '' ? g : g.slice(1)}`,
+      )
     }
     inputs.wsFiles.push(...own.wsFiles)
     inputs.envNames.push(...own.envNames)
@@ -336,7 +339,14 @@ export function planNxUpstream(
         if (u.of !== 'deps') foldProjects(u.name, u.of, inputs, todos, edges)
         else if (u.name !== name) fold(node, u.name, peers, inputs, todos, edges)
       }
-      const cacheInputs: Record<string, unknown> = { files: inputs.files }
+      // Nx hashes a fileset that matches nothing as nothing; core warns of
+      // an input set that resolves to no file. A project has a package.json
+      // or a project.json, and Nx keys each task on both (its manifest, its
+      // configuration), so listing them keeps the twin of an absent
+      // `tsconfig.spec.json` (or a dependency's unbuilt `*.d.ts`) quiet; the
+      // file appearing still re-keys it, and a missing literal is silent.
+      const files = [...new Set(['package.json', 'project.json', ...inputs.files])]
+      const cacheInputs: Record<string, unknown> = { files }
       if (inputs.wsFiles.length > 0) cacheInputs.workspaceFiles = inputs.wsFiles
       if (inputs.envNames.length > 0) cacheInputs.env = inputs.envNames
       if (inputs.runtimeCmds.length > 0) cacheInputs.workspaceRuntime = inputs.runtimeCmds

package/src/nx-cache/index.ts

@@ -20,7 +20,8 @@ import {
   refuseUnknownOptions,
   type PluginOptionKinds,
 } from '@vzn/vx'
-import { deadlineNamed } from '../remote-deadline.js'
+import { deadline } from '../remote-deadline.js'
+import { OutageBreaker } from '../remote-breaker.js'
 import { withRetry } from '../remote-retry.js'
 import { headerValueFault } from '../remote-token.js'
 
@@ -102,6 +103,7 @@ export function resolveNxCacheConfig(
  */
 export class NxRemoteCache implements RemoteCacheLayer {
   private disabled = false
+  private readonly breaker = new OutageBreaker()
   /**
    * A `403` on a write is the spec's read-only token (a CI's pull-request
    * token): uploads stop, reads go on. Read as a refused token, it turned
@@ -140,19 +142,19 @@ export class NxRemoteCache implements RemoteCacheLayer {
       // every hit read as a corrupt artifact (nx#33092).
       headers['Accept'] = 'application/octet-stream'
     }
-    const res = await withRetry(
-      () =>
-        this.fetchImpl(`${this.config.server}/v1/cache/${hash}`, {
-          method,
-          headers,
-          ...(body === undefined ? {} : { body }),
-          signal: AbortSignal.timeout(this.config.timeoutMs),
-        }),
-      this.config.retries,
-      this.wait,
-    ).catch((err: unknown) => {
-      throw deadlineNamed(err, this.config.timeoutMs)
-    })
+    const res = await this.breaker.send(() =>
+      withRetry(
+        () =>
+          this.fetchImpl(`${this.config.server}/v1/cache/${hash}`, {
+            method,
+            headers,
+            ...(body === undefined ? {} : { body }),
+            signal: deadline(this.config.timeoutMs),
+          }),
+        this.config.retries,
+        this.wait,
+      ),
+    )
     if (method === 'PUT' && res.status === 403) {
       const first = !this.writesRefused
       this.writesRefused = true
@@ -166,7 +168,7 @@ export class NxRemoteCache implements RemoteCacheLayer {
       this.disabled = true
       if (!first) return undefined
       throw new Error(
-        `HTTP ${res.status}: ${res.status === 401 ? 'missing or invalid token' : 'access forbidden (a read-only token cannot write)'}; remote cache off for this run`,
+        `HTTP ${res.status}: ${res.status === 401 ? 'missing or invalid token' : 'access forbidden (the token may not read)'}; remote cache off for this run`,
       )
     }
     return res