@vzn/vx-migrate 0.0.609 → 0.0.611

package/README.md

@@ -335,7 +335,7 @@ The Nx spec has no existence probe, so `has` (the `--dry` prediction; the prefet
 - A remote error degrades to a **miss** and a warning that names the request, the artifact and the server — `vx/turbo-cache: upload 32248a2a7c89e241 to https://cache.example.com/v8/artifacts failed: no answer within 60000 ms` — never the token. The run never fails because of the cache.
 - The same failure is said once per run: an unreachable server fails the probe, the download and the upload alike, and the run prints the first and, at its end, `vx/turbo-cache: 2 more requests failed the same way: Unable to connect. Is the computer able to access the url?` (core's `LayeredCache` does the counting, for every cache plugin).
 - A request answered `429` or `5xx` (not `501`), or one that never connected (a refused port, an unresolved host), is sent again after 2 s — a `429` after its `Retry-After`, capped at 10 s — as Turbo's client does. A spent deadline is not: it has already cost its wait.
-- Three outages in a row (no connection, no answer within the deadline, or a `5xx` once the resends are spent) open Turbo's outage breaker: no request is sent for 30 s, each lookup is a miss at once, then one request probes and its answer closes or reopens it. A hung server costs three deadlines, not one per task.
+- Three outages in a row (no connection, no answer within the deadline, or a `5xx` once the resends are spent) open Turbo's outage breaker: no request is sent for 30 s, each lookup is a miss at once, then one request probes and its answer closes or reopens it. A hit is judged when its body ends, so a server that sends headers and then stalls the body counts the same way. A hung server costs three deadlines, not one per task.
 - A refused token (`401`/`403`) warns **once** and turns the layer off for the rest of the process (a `403` on an upload is a read-only token — Nx's spec, or turborepo-remote-cache's `READ_ONLY` and write-less JWTs: it turns off uploads alone, and reads go on) — including the requests already in flight when the refusal lands, which degrade in silence rather than repeating it (a six-project run printed five identical lines before 2026-09-20).
 - Policy (`--cache=remote:r`, …) is enforced by core's `LayeredCache`, which the plugins wrap — a read-only token pairs naturally with `remote:r`.
 - Each tool's own switches narrow that policy, never widen it, as they do for the tool: `TURBO_CACHE` (`--cache`'s syntax, an omitted source off) and `TURBO_REMOTE_CACHE_READ_ONLY` for `turboCache()`, `NX_SKIP_REMOTE_CACHE` / `NX_DISABLE_REMOTE_CACHE` (`true`) for `nxCache()`. A CI that keeps untrusted pull requests off the shared cache that way keeps vx off it too.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-migrate",
-  "version": "0.0.609",
+  "version": "0.0.611",
   "license": "MIT",
   "description": "Adopt @vzn/vx from Turborepo or Nx: run the repo unchanged, migrate it to vx.config.ts, and keep your Turbo or Nx remote cache",
   "keywords": [
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.609"
+    "@vzn/vx": "^0.0.611"
   },
   "repository": {
     "type": "git",

package/src/nx-cache/index.ts

@@ -142,18 +142,20 @@ export class NxRemoteCache implements RemoteCacheLayer {
       // every hit read as a corrupt artifact (nx#33092).
       headers['Accept'] = 'application/octet-stream'
     }
-    const res = await this.breaker.send(() =>
-      withRetry(
-        () =>
-          this.fetchImpl(`${this.config.server}/v1/cache/${hash}`, {
-            method,
-            headers,
-            ...(body === undefined ? {} : { body }),
-            signal: deadline(this.config.timeoutMs),
-          }),
-        this.config.retries,
-        this.wait,
-      ),
+    const res = await this.breaker.send(
+      () =>
+        withRetry(
+          () =>
+            this.fetchImpl(`${this.config.server}/v1/cache/${hash}`, {
+              method,
+              headers,
+              ...(body === undefined ? {} : { body }),
+              signal: deadline(this.config.timeoutMs),
+            }),
+          this.config.retries,
+          this.wait,
+        ),
+      method === 'GET',
     )
     if (method === 'PUT' && res.status === 403) {
       const first = !this.writesRefused
@@ -184,8 +186,11 @@ export class NxRemoteCache implements RemoteCacheLayer {
     if (this.disabled) return null
     const res = await this.request('GET', hash)
     if (res === undefined) return null
-    if (res.status === 404) return null
-    if (res.status !== 200) throw new Error(`HTTP ${res.status}`)
+    if (res.status !== 200) {
+      await res.body?.cancel()
+      if (res.status === 404) return null
+      throw new Error(`HTTP ${res.status}`)
+    }
     return res
   }
 

package/src/remote-breaker.ts

@@ -7,6 +7,13 @@
  * task its full deadline. A result that lands after the breaker moved on
  * (a request already in flight when it opened) changes nothing. Shared by
  * `turboCache()` and `nxCache()`.
+ *
+ * A hit's body (`settleOnBody`, a 200 with a body) is judged when the
+ * body ends, not when its headers land: a server that sent headers in
+ * time and then stalled the body was judged a success, reset the count,
+ * and cost every task its full deadline. The body's error is the outage;
+ * its end or a cancel is the success. A body nobody reads or cancels
+ * leaves its verdict open.
  */
 export class OutageBreaker {
   private failures = 0
@@ -15,7 +22,7 @@ export class OutageBreaker {
   private generation = 0
   constructor(private readonly now: () => number = Date.now) {}
 
-  async send(request: () => Promise<Response>): Promise<Response> {
+  async send(request: () => Promise<Response>, settleOnBody = false): Promise<Response> {
     let probe = false
     if (this.openUntil !== undefined) {
       if (this.now() < this.openUntil || this.probing)
@@ -32,8 +39,32 @@ export class OutageBreaker {
       this.finish(generation, probe, true)
       throw err
     }
-    this.finish(generation, probe, res.status >= 500)
-    return res
+    if (!settleOnBody || res.status !== 200 || res.body === null) {
+      this.finish(generation, probe, res.status >= 500)
+      return res
+    }
+    const reader = res.body.getReader()
+    const settle = (outage: boolean) => this.finish(generation, probe, outage)
+    return new Response(
+      new ReadableStream<Uint8Array>({
+        async pull(controller) {
+          const chunk = await reader.read().catch((err: unknown) => {
+            settle(true)
+            controller.error(err)
+          })
+          if (chunk === undefined) return
+          if (chunk.done) {
+            settle(false)
+            controller.close()
+          } else controller.enqueue(chunk.value)
+        },
+        async cancel(reason) {
+          settle(false)
+          await reader.cancel(reason)
+        },
+      }),
+      { status: res.status, statusText: res.statusText, headers: res.headers },
+    )
   }
 
   private finish(generation: number, probe: boolean, outage: boolean): void {

package/src/turbo-cache/index.ts

@@ -471,24 +471,26 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     const signal = () => (timeoutMs === 0 ? undefined : deadline(timeoutMs))
     // The batch query is never preflighted, as in Turbo.
     const preflight = this.config.preflight && method !== 'POST'
-    const res = await this.breaker.send(() =>
-      withRetry(
-        async () => {
-          const extra = init.headers ?? {}
-          const to = preflight
-            ? await this.preflight(this.url(pathname), method, extra, signal)
-            : { url: this.url(pathname), auth: true }
-          const s = signal()
-          return this.fetchImpl(to.url, {
-            method,
-            headers: this.headers(extra, to.auth),
-            ...(init.body === undefined ? {} : { body: init.body }),
-            ...(s === undefined ? {} : { signal: s }),
-          })
-        },
-        this.config.retries,
-        this.wait,
-      ),
+    const res = await this.breaker.send(
+      () =>
+        withRetry(
+          async () => {
+            const extra = init.headers ?? {}
+            const to = preflight
+              ? await this.preflight(this.url(pathname), method, extra, signal)
+              : { url: this.url(pathname), auth: true }
+            const s = signal()
+            return this.fetchImpl(to.url, {
+              method,
+              headers: this.headers(extra, to.auth),
+              ...(init.body === undefined ? {} : { body: init.body }),
+              ...(s === undefined ? {} : { signal: s }),
+            })
+          },
+          this.config.retries,
+          this.wait,
+        ),
+      method === 'GET',
     )
     if (method === 'PUT' && res.status === 403) {
       const first = !this.writesRefused
@@ -549,8 +551,11 @@ export class TurboRemoteCache implements RemoteCacheLayer {
       headers: { Accept: 'application/octet-stream' },
     })
     if (res === undefined) return null
-    if (res.status === 404) return null
-    if (res.status !== 200) throw new Error(`HTTP ${res.status}`)
+    if (res.status !== 200) {
+      await res.body?.cancel()
+      if (res.status === 404) return null
+      throw new Error(`HTTP ${res.status}`)
+    }
     const duration = Number(res.headers.get('x-artifact-duration'))
     const durationMs = Number.isFinite(duration) && duration > 0 ? duration : undefined
     if (this.key === undefined) return { body: res, durationMs }
@@ -574,7 +579,10 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     try {
       const max = this.maxSignedBody
       const past = () => new Error(`the signed artifact runs past ${max} bytes — treated as a miss`)
-      if (Number(res.headers.get('content-length') ?? 0) > max) throw past()
+      if (Number(res.headers.get('content-length') ?? 0) > max) {
+        await res.body?.cancel()
+        throw past()
+      }
       let n = 0
       const counted = res.body?.pipeThrough(
         new TransformStream<Uint8Array, Uint8Array>({