@vzn/vx-migrate 0.0.643 → 0.0.644

package/README.md

@@ -75,7 +75,7 @@ Rules:
 - `interruptible` maps to nothing: `vx watch` keeps a persistent task up across cycles and restarts it only when its config changes or it dies.
 - A task's `tags` (Turbo main, after 2.11.5) map to nothing: Turbo keeps them out of the hash and the run.
 - `envMode: "loose"` (top-level or in `global`, or `TURBO_ENV_MODE=loose`, which wins) is a note: Turbo hands every task the whole environment, vx only the declared names.
-- The workspace keys vx has a home for, top level or in `global`, fill what `.vx/workspace.ts` leaves unset: `run.concurrency` (`"10"`, `"50%"` of the cores) → `run.concurrency`; `cacheMaxSize` / `cacheMaxAge` (`"0"` is off; weeks become days, a bare number days; a size in Turbo's grammar, `7.5GB` or bare bytes, restated whole: `7680MB`) → `cache.retention.maxSize` / `.olderThan`. `TURBO_CONCURRENCY`, `TURBO_CACHE_MAX_SIZE` and `TURBO_CACHE_MAX_AGE` win over turbo.json, as under Turbo; a set one decides, its `0` included.
+- The workspace keys vx has a home for, top level or in `global`, fill what `.vx/workspace.ts` leaves unset: `run.concurrency` (`"10"`, `"50%"` of the cores) → `run.concurrency`. `TURBO_CONCURRENCY` wins over turbo.json, as under Turbo; a set one decides, its `0` included. `cacheMaxSize` / `cacheMaxAge` map to nothing: no vx run evicts, `vx cache clean --max-size / --older-than` does.
 - `TURBO_SCM_BASE`, the base `turbo run --affected` compares with, is the run's base commit (`setBranch({ base })`): a bare `vx run build --affected` compares with the same ref. With it unset on GitHub Actions (`GITHUB_ACTIONS`), Turbo's own base applies: a pull request's `GITHUB_BASE_REF`, else the push event's `before` from `GITHUB_EVENT_PATH`.
 - Turbo hashes each package's `microfrontends.json` (or `.jsonc`) into every task, or the one file `VC_MICROFRONTENDS_CONFIG_FILE_NAME` names; so does `turbo()`.
 - Turbo 2.11's `global` block (`futureFlags.globalConfiguration`) is read as the `globalDependencies`, `globalEnv` and `globalPassThroughEnv` it replaces.
@@ -173,7 +173,7 @@ Two cached tasks on one workspace path cannot both keep their cache, and the fir
 
 ### nx.json `maxCacheSize`
 
-`maxCacheSize` (or `NX_MAX_CACHE_SIZE`, above it as in Nx) is the run's `cache.retention.maxSize` when `.vx/workspace.ts` sets no retention, in Nx's grammar (`10GB`, `1.5 GB`, bare bytes); `0` is no cap.
+`maxCacheSize` maps to nothing: no vx run evicts, `vx cache clean --max-size` does.
 
 ### Lerna
 
@@ -259,7 +259,7 @@ Reads the root pipeline (`tasks` in Turbo 2, `pipeline` in Turbo 1), per-package
 
 ### Nx
 
-Reads the **resolved** project graph only (`.nx/workspace-data/project-graph.json` when exported, else the one the workspace's own `nx graph` exports into a temp file, as `nx()` does; with no `node_modules/.bin/nx`, as in a fresh clone, it stops and names the repo manager's install), through the same mapper `nx()` runs live, executors aside (below). Targets Nx plugins infer at runtime are frozen as the snapshot saw them. `nx:run-commands` is the one shell line `nx()` runs (see [`nx:run-commands`](#nxrun-commands) above: where, parallel or in order, forwarded arguments, `env`, `readyWhen`) — storybook's `compile` is `cd ../../.. && node ./scripts/build/build-package.ts --cwd code/lib/cli`; a plain `command` is that shorthand; `nx:run-script` is the package's script body with its `pre<name>` / `post<name>` hooks folded in (or `yarn run <name>` when the body calls yarn's `run` builtin; an empty script is the placeholder with a todo), `nx:noop` is a group task; Nx 15–16's `@nrwl/workspace:run-commands` and `run-script` (and their `@nx/workspace:` names) are the `nx:` executors they re-exported; **an executor target is its `nx-exec` line**, as `nx()` runs it: the migrator translates no executor, so Nx and `@vzn/vx-migrate` stay installed until each such line is rewritten as the command it runs (a server executor Nx knows, `@nx/js:node` or a dev server, is still a persistent task). The report also says what `.vx/workspace.ts` still holds, as the Turbo migration does: the `nx()` a keep adoption declared, which keeps reading nx.json, and a lockfile with no `@vzn/vx-lockfile` plugin, where Nx keyed each project on the npm packages it depends on. A written command that still runs Nx itself (a run-commands `nx run b:build`, `npx nx test b`, a script's `nx exec -- tsc`) carries a TODO: it works only while Nx is installed. An Nx project no workspace glob lists (an integrated repo's `project.json` library) gets a `package.json` (`name`, `private`) where it has none, and a note names the directories to add to `workspaces` (or `pnpm-workspace.yaml`), so the package manager installs it and a lockfile plugin names it; the migrator never edits the root manifest. A repo with no `package.json` at all (Nx's `nx init` outside JS: Nx pinned in `.nx/installation`, projects as `project.json`) is migrated too, natively only: the root is the directory holding `nx.json`, the graph is exported by `.nx/installation`'s `nx`, each config writes the project's Nx `name`, every edge is the explicit `project#target` Nx's graph draws (a `^` edge needs a lockfile plugin, which has no lockfile to read), and `.vx/workspace.ts` declares no plugin, so nothing is installed and core runs the configs alone; `--keep` refuses, as `nx()` would have no `package.json` to install into, and an executor target's `nx-exec` line is a note to rewrite as a command. A target with `configurations` writes one task per configuration (`build`, `build:ci`). A project's Nx `tags` are written as its `tags`. Named inputs expand from `nx.json` when readable. An output path is kept as written, a `!` one too (`{projectRoot}/dist` → `dist`, `{projectRoot}/bin/tool` → `bin/tool`; one naming an unset `{options.x}` is dropped, as Nx drops it; a dotted `{options.outputPath.base}` walks the options, as Nx does; an extglob is put in vx's grammar: Next's inferred `.next/!(cache)/**/*` is `.next/*/**/*` with `!.next/cache/**/*`, `@(js|map)` is `{js,map}`, and a form with no vx spelling is dropped with a TODO): vx reads a bare path as the file or the whole tree under it, so a directory and an extensionless binary both save and restore. nx.json's `parallel`, `defaultBase` and `maxCacheSize`, which `nx()` applies live, are each a field of the `.vx/workspace.ts` it writes (`run.concurrency`, `baseBranch`, `cache.retention.maxSize`), read from nx.json alone, never the environment; beside a workspace file already there, or for a size vx cannot read (`1.5 GB`), each is a note naming the field to add. vx derives package edges from `package.json`; an Nx graph edge with no manifest path (`implicitDependencies`, a tsconfig path) becomes, for each `^target` of the dependant, an explicit `pkg#target` edge to what Nx's own walk reaches — each dependency that has the target, and through one that lacks it, its dependencies — so the order and the key are Nx's. The reverse too: where a project's manifest names a workspace package its Nx graph does not reach (an `implicitDependencies: ["!a"]` that breaks a manifest cycle), its `^target` becomes the explicit edges Nx draws, since vx's `^` would follow the manifest and bring the cycle back.
+Reads the **resolved** project graph only (`.nx/workspace-data/project-graph.json` when exported, else the one the workspace's own `nx graph` exports into a temp file, as `nx()` does; with no `node_modules/.bin/nx`, as in a fresh clone, it stops and names the repo manager's install), through the same mapper `nx()` runs live, executors aside (below). Targets Nx plugins infer at runtime are frozen as the snapshot saw them. `nx:run-commands` is the one shell line `nx()` runs (see [`nx:run-commands`](#nxrun-commands) above: where, parallel or in order, forwarded arguments, `env`, `readyWhen`) — storybook's `compile` is `cd ../../.. && node ./scripts/build/build-package.ts --cwd code/lib/cli`; a plain `command` is that shorthand; `nx:run-script` is the package's script body with its `pre<name>` / `post<name>` hooks folded in (or `yarn run <name>` when the body calls yarn's `run` builtin; an empty script is the placeholder with a todo), `nx:noop` is a group task; Nx 15–16's `@nrwl/workspace:run-commands` and `run-script` (and their `@nx/workspace:` names) are the `nx:` executors they re-exported; **an executor target is its `nx-exec` line**, as `nx()` runs it: the migrator translates no executor, so Nx and `@vzn/vx-migrate` stay installed until each such line is rewritten as the command it runs (a server executor Nx knows, `@nx/js:node` or a dev server, is still a persistent task). The report also says what `.vx/workspace.ts` still holds, as the Turbo migration does: the `nx()` a keep adoption declared, which keeps reading nx.json, and a lockfile with no `@vzn/vx-lockfile` plugin, where Nx keyed each project on the npm packages it depends on. A written command that still runs Nx itself (a run-commands `nx run b:build`, `npx nx test b`, a script's `nx exec -- tsc`) carries a TODO: it works only while Nx is installed. An Nx project no workspace glob lists (an integrated repo's `project.json` library) gets a `package.json` (`name`, `private`) where it has none, and a note names the directories to add to `workspaces` (or `pnpm-workspace.yaml`), so the package manager installs it and a lockfile plugin names it; the migrator never edits the root manifest. A repo with no `package.json` at all (Nx's `nx init` outside JS: Nx pinned in `.nx/installation`, projects as `project.json`) is migrated too, natively only: the root is the directory holding `nx.json`, the graph is exported by `.nx/installation`'s `nx`, each config writes the project's Nx `name`, every edge is the explicit `project#target` Nx's graph draws (a `^` edge needs a lockfile plugin, which has no lockfile to read), and `.vx/workspace.ts` declares no plugin, so nothing is installed and core runs the configs alone; `--keep` refuses, as `nx()` would have no `package.json` to install into, and an executor target's `nx-exec` line is a note to rewrite as a command. A target with `configurations` writes one task per configuration (`build`, `build:ci`). A project's Nx `tags` are written as its `tags`. Named inputs expand from `nx.json` when readable. An output path is kept as written, a `!` one too (`{projectRoot}/dist` → `dist`, `{projectRoot}/bin/tool` → `bin/tool`; one naming an unset `{options.x}` is dropped, as Nx drops it; a dotted `{options.outputPath.base}` walks the options, as Nx does; an extglob is put in vx's grammar: Next's inferred `.next/!(cache)/**/*` is `.next/*/**/*` with `!.next/cache/**/*`, `@(js|map)` is `{js,map}`, and a form with no vx spelling is dropped with a TODO): vx reads a bare path as the file or the whole tree under it, so a directory and an extensionless binary both save and restore. nx.json's `parallel` and `defaultBase`, which `nx()` applies live, are each a field of the `.vx/workspace.ts` it writes (`run.concurrency`, `baseBranch`), read from nx.json alone, never the environment; beside a workspace file already there, each is a note naming the field to add. vx derives package edges from `package.json`; an Nx graph edge with no manifest path (`implicitDependencies`, a tsconfig path) becomes, for each `^target` of the dependant, an explicit `pkg#target` edge to what Nx's own walk reaches — each dependency that has the target, and through one that lacks it, its dependencies — so the order and the key are Nx's. The reverse too: where a project's manifest names a workspace package its Nx graph does not reach (an `implicitDependencies: ["!a"]` that breaks a manifest cycle), its `^target` becomes the explicit edges Nx draws, since vx's `^` would follow the manifest and bring the cycle back.
 
 ### Vite Task
 
@@ -620,6 +620,7 @@ With no token from an option, a variable or a config file, both plugins read the
 
 ## Remote-cache behaviour (both)
 
+- Every request (`HEAD`, `GET`, `PUT`, the batch `POST`) carries `x-vx-cache-scope`: `trusted` for a task's own key, else the branch scope its key was derived in (`acme/app:feat-x`). The key is the same either way. A server that keeps one bucket per scope uses it to skip its own layering; whether a write to `trusted` is allowed stays the server's call, from the token (a CI ID token). A request without the header, from an older client, leaves the layering to the server. A batch that mixes scopes is one `POST` per scope.
 - A remote error degrades to a **miss** and a warning that names the request, the artifact and the server — `[vx] plugin '@vzn/vx-migrate': upload 32248a2a7c89e241 to https://cache.example.com/v8/artifacts failed: no answer within 60000 ms` — never the token. The run never fails because of the cache.
 - The same failure is said once per run: an unreachable server fails the probe, the download and the upload alike, and the run prints the first and, at its end, `[vx] plugin '@vzn/vx-migrate': 2 more requests failed the same way: Unable to connect. Is the computer able to access the url?` (core does the counting, for every cache plugin).
 - A request answered `5xx` (not `501`), or one that never connected (a refused port, an unresolved host), is sent again after 2 s, `retries` times. A `429` pauses every request to that remote for its `Retry-After` (capped at 10 s a wait, 2 s without one), and the request is sent again when the pause ends, for up to 20 s from its first `429`, as Turbo's client does. A spent deadline is not resent: it has already cost its wait.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-migrate",
-  "version": "0.0.643",
+  "version": "0.0.644",
   "license": "MIT",
   "description": "Adopt @vzn/vx from Turborepo, Nx or package.json scripts: run the repo unchanged, migrate it to vx.config.ts, and keep your Turbo or Nx remote cache",
   "keywords": [
@@ -40,7 +40,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.643"
+    "@vzn/vx": "^0.0.644"
   },
   "repository": {
     "type": "git",

package/src/adoption-plugin.ts

@@ -60,7 +60,7 @@ export function adoptionPlugin(
   mapRun: (ctx: ProjectHookContext) => Promise<AdoptionRun>,
   reads: readonly string[] = [],
   // `config`: a workspace-wide key of the adopted tool's (nx.json `parallel`,
-  // Turbo's `cacheMaxSize`) that the workspace itself leaves unset.
+  // Turbo's `concurrency`) that the workspace itself leaves unset.
   // `discover`: a project the tool has that no member glob lists.
   stages: Pick<VxPlugin, 'config' | 'discover'> = {},
 ): VxPlugin {

package/src/glob-grammar.ts

@@ -1,28 +1,22 @@
-// The glob grammar Nx and Turbo share and vx's own differ in brackets and
-// extglobs; both adapters translate through here (items 914, 1031).
+// The glob grammar Nx and Turbo share and vx's own differ in extglobs;
+// both adapters translate through here (items 914, 1031).
 
 const EXTGLOB = /([?@+*!])\(([^()]*)\)/g
 
 /**
  * A minimatch-family glob (Nx's minimatch, Turbo's wax) in vx's grammar,
- * or null when it has no safe form. vx has no character classes (a bracket is a literal, for route
- * dirs, item 667) and no extglobs, so `src/**\/*.[jt]s` matched nothing
- * and Nx's own default `production` negation,
- * `?(*.)+(spec|test).[jt]s?(x)`, excluded nothing (item 914):
- * - `[jt]` is the brace set `{j,t}`, plus the literal `[jt]` itself in a
- *   positive glob (a superset of inputs is safe; the route dir may be
- *   meant); a range within digits or one case of letters (`[a-c]`,
- *   `[0-9]`) is its members;
- * - a negated class (`[!a]`) is `?` in a positive glob, a superset;
+ * or null when it has no safe form. Character classes pass through (vx
+ * reads them the same way); vx has no extglobs, so Nx's own default
+ * `production` negation, `?(*.)+(spec|test).[jt]s?(x)`, excluded nothing
+ * (item 914):
  * - `?(a|b)` is `{a,b,}` and `@(a|b)` is `{a,b}`;
  * - `+(a|b)` and `*(a|b)` narrow to one repetition, which only a
  *   NEGATION may do — it then excludes fewer files, never more;
- * - any other range, a negated class in a negation, `!(…)`, or nesting is
- *   null.
+ * - `!(…)` or nesting is null.
  */
 export function minimatchToVx(glob: string, negated: boolean): string | null {
-  if (!/[[(]/.test(glob)) return glob
-  let out = glob.replace(EXTGLOB, (whole, kind: string, body: string) => {
+  if (!glob.includes('(')) return glob
+  const out = glob.replace(EXTGLOB, (_whole, kind: string, body: string) => {
     const alts = body.split('|')
     if (alts.some((a) => /[{},]/.test(a))) return '\0'
     if (kind === '?') return `{${alts.join(',')},}`
@@ -30,36 +24,7 @@ export function minimatchToVx(glob: string, negated: boolean): string | null {
     if (!negated || kind === '!') return '\0'
     return kind === '+' ? `{${alts.join(',')}}` : `{${alts.join(',')},}`
   })
-  if (out.includes('\0') || /[?@+*!]\(/.test(out)) return null
-  out = out.replace(/\[([^\]]*)\]/g, (whole, body: string) => {
-    if (body === '' || /[{},/]/.test(body)) return '\0'
-    if (/^[!^]/.test(body)) return negated || body.length === 1 ? '\0' : '?'
-    const chars = classMembers(body)
-    if (chars === null) return '\0'
-    return negated ? `{${chars.join(',')}}` : `{${whole},${chars.join(',')}}`
-  })
-  return out.includes('\0') ? null : out
-}
-
-const RANGES = ['0123456789', 'abcdefghijklmnopqrstuvwxyz', 'ABCDEFGHIJKLMNOPQRSTUVWXYZ']
-
-/** A class body's characters, ranges spelled out; null for a range across kinds or backwards. */
-function classMembers(body: string): string[] | null {
-  const out = new Set<string>()
-  for (let i = 0; i < body.length; i++) {
-    const c = body[i]!
-    // A `-` first or last is itself, as in minimatch.
-    if (body[i + 1] === '-' && i + 2 < body.length) {
-      const end = body[i + 2]!
-      const kind = RANGES.find((r) => r.includes(c))
-      const from = kind?.indexOf(c) ?? -1
-      const to = kind?.indexOf(end) ?? -1
-      if (kind === undefined || to < from) return null
-      for (const m of kind.slice(from, to + 1)) out.add(m)
-      i += 2
-    } else out.add(c)
-  }
-  return [...out]
+  return out.includes('\0') || /[?@+*!]\(/.test(out) ? null : out
 }
 
 /**
@@ -73,7 +38,7 @@ function classMembers(body: string): string[] | null {
  */
 export function withoutTakenBack<T>(entries: readonly T[]): T[] {
   const list = [...new Set(entries)]
-  const wild = /[*?{}]/
+  const wild = /[*?{}[\]\\]/
   const negative = list.flatMap((e) =>
     typeof e === 'string' && e.startsWith('!') ? [e.slice(1)] : [],
   )
@@ -90,10 +55,10 @@ export function withoutTakenBack<T>(entries: readonly T[]): T[] {
 
 /**
  * A path from the file system as a task glob that names only itself: a dir
- * named `my{app}` read as a brace matched `myapp` instead. `[` `]` are
- * literal in a task glob already; `*` and `?` stay, since the schema reads
- * `\*` as a Windows separator, and they match the name too (a superset).
+ * named `my{app}` read as a brace matched `myapp` instead, and `app/[id]` a
+ * class. `*` and `?` stay, since the schema reads `\*` as a Windows
+ * separator, and they match the name too (a superset).
  */
 export function literalGlob(p: string): string {
-  return p.replace(/^!|[{}]/g, '\\$&')
+  return p.replace(/^!|[{}[\]]/g, '\\$&')
 }

package/src/migrate-nx.ts

@@ -5,7 +5,7 @@ import { stat } from 'node:fs/promises'
 import path from 'node:path'
 import { type GeneratedProject, type MigrationFormat, type MigrationPlan } from '@vzn/vx'
 import type { PackageMeta } from './packages.js'
-import { mapNxWorkspace, nxSizeText, parseNxGraph, readNxJson } from './nx/nx-map.js'
+import { mapNxWorkspace, parseNxGraph, readNxJson } from './nx/nx-map.js'
 import { spareTrackedOutputs, trackedFiles, trackedKinds } from './tracked-outputs.js'
 import { adoptedToolNotes } from './workspace-notes.js'
 import { relPosix } from './paths.js'
@@ -165,7 +165,7 @@ async function unlistedProjects(
 /** A `.vx/workspace.ts` field nx.json's run settings call for. */
 export interface NxWorkspaceField {
   /** The setting's path: its group, then its field, or a top-level key. */
-  readonly field: 'run.concurrency' | 'baseBranch' | 'cache.retention'
+  readonly field: 'run.concurrency' | 'baseBranch'
   /** The value as TypeScript source; undefined when vx cannot read it. */
   readonly source: string | undefined
   /** What to tell a user whose workspace file this run does not write. */
@@ -187,7 +187,6 @@ export function nxWorkspaceFields(json: Record<string, unknown> | undefined): Nx
         tasksRunnerOptions?: { default?: { options?: { parallel?: unknown } } }
         defaultBase?: unknown
         affected?: { defaultBase?: unknown }
-        maxCacheSize?: unknown
       }
     | undefined
   const out: NxWorkspaceField[] = []
@@ -207,12 +206,5 @@ export function nxWorkspaceFields(json: Record<string, unknown> | undefined): Nx
       note: `nx.json \`defaultBase\` ${JSON.stringify(base.trim())}: add \`baseBranch: ${JSON.stringify(branch)}\` to .vx/workspace.ts`,
     })
   }
-  const size = nxSizeText(nx?.maxCacheSize)
-  if (size !== undefined)
-    out.push({
-      field: 'cache.retention',
-      source: /^\d+[KMG]?B$/.test(size) ? `{ maxSize: ${quoted(size)} }` : undefined,
-      note: `nx.json \`maxCacheSize\`: add \`cache: { retention: { maxSize: ${JSON.stringify(size)} } }\` to .vx/workspace.ts`,
-    })
   return out
 }

package/src/nx/index.ts

@@ -39,7 +39,6 @@ import {
   mapNxWorkspace,
   type NxExecutors,
   type NxGraph,
-  nxSizeText,
   parseNxGraph,
   readNxJson,
 } from './nx-map.js'
@@ -166,11 +165,6 @@ export function nx(options: NxPluginOptions = {}): VxPlugin {
               rules: { ...workspace.run?.rules, dependencies },
             }
         }
-        if (workspace.cache?.retention === undefined) {
-          const maxSize = await nxMaxCacheSize(root)
-          if (maxSize !== undefined)
-            workspace.cache = { ...workspace.cache, retention: { maxSize } }
-        }
       },
       // The package manager's members are projects, each with no vx.config
       // written. An integrated Nx repo keeps projects out of that list
@@ -294,24 +288,6 @@ async function nxDefaultBase(root: string): Promise<string | undefined> {
   return typeof b === 'string' && b.trim() !== '' ? b.trim().replace(/^origin\//, '') : undefined
 }
 
-/**
- * nx.json's `maxCacheSize`, or `NX_MAX_CACHE_SIZE` above it, as core's
- * size: Nx caps its local cache there (`resolveMaxCacheSize`), and read by
- * nothing a capped cache grew without bound under vx, as turbo.json's
- * `cacheMaxSize` once did (G-49). 1024-based, a fraction truncated to
- * bytes; `0` is no cap. A value Nx would refuse is left to core's
- * refusal, which names the field.
- */
-async function nxMaxCacheSize(root: string): Promise<string | undefined> {
-  const env = process.env['NX_MAX_CACHE_SIZE']
-  const raw =
-    env !== undefined
-      ? env
-      : ((await readNxJson(root).catch(() => null))?.json as { maxCacheSize?: unknown } | undefined)
-          ?.maxCacheSize
-  return nxSizeText(raw)
-}
-
 interface LoadedGraph {
   readonly text: string
   readonly graph: NxGraph

package/src/nx/nx-map.ts

@@ -1522,20 +1522,3 @@ function followNxGraph(
     }
   }
 }
-
-/** Nx's cache-size grammar (`10GB`, `1.5 GB`, bare bytes) as core's size; `0` is no cap. */
-export function nxSizeText(raw: unknown): string | undefined {
-  if (typeof raw !== 'string' && typeof raw !== 'number') return undefined
-  const text = String(raw).trim()
-  const m = /^(\d+\.?\d*|\.\d+)\s?([KMG]?B)?$/.exec(text)
-  if (m === null) return text
-  const units = ['B', 'KB', 'MB', 'GB']
-  let n = Math.floor(Number(m[1]) * 1024 ** units.indexOf(m[2] ?? 'B'))
-  if (n === 0) return undefined
-  let u = 0
-  while (u < units.length - 1 && n % 1024 === 0) {
-    n /= 1024
-    u++
-  }
-  return `${n}${units[u]}`
-}

package/src/nx-cache/index.ts

@@ -14,12 +14,14 @@
 import {
   definePlugin,
   type RemoteCacheLayer,
+  type RemoteKey,
   type RemoteOpenContext,
   type VxPlugin,
   refuseUnknownOptions,
   type PluginOptionKinds,
 } from '@vzn/vx'
 import { deadline } from '../remote-deadline.js'
+import { scopeHeader } from '../remote-scope.js'
 import { OutageBreaker } from '../remote-breaker.js'
 import { Cooldown, withRetry } from '../remote-retry.js'
 import {
@@ -153,10 +155,11 @@ export class NxRemoteCache implements RemoteCacheLayer {
   private async request(
     method: 'GET' | 'PUT',
     hash: string,
+    at: RemoteKey | undefined,
     body?: Blob,
   ): Promise<Response | undefined> {
     if (this.token === undefined) return undefined
-    const headers: Record<string, string> = {}
+    const headers: Record<string, string> = scopeHeader(at)
     if (this.token !== '') headers['Authorization'] = `Bearer ${this.token}`
     if (body !== undefined) {
       headers['Content-Type'] = 'application/octet-stream'
@@ -209,15 +212,18 @@ export class NxRemoteCache implements RemoteCacheLayer {
     return res
   }
 
-  async get(hash: string): Promise<{ body: Response; durationMs: number | undefined } | null> {
-    const res = await this.fetch(hash)
+  async get(
+    hash: string,
+    at?: RemoteKey,
+  ): Promise<{ body: Response; durationMs: number | undefined } | null> {
+    const res = await this.fetch(hash, at)
     // The Nx wire carries no producing-task duration.
     return res === null ? null : { body: res, durationMs: undefined }
   }
 
-  private async fetch(hash: string): Promise<Response | null> {
+  private async fetch(hash: string, at: RemoteKey | undefined): Promise<Response | null> {
     if (this.disabled) return null
-    const res = await this.request('GET', hash)
+    const res = await this.request('GET', hash, at)
     if (res === undefined) return null
     if (res.status !== 200) {
       await res.body?.cancel()
@@ -227,17 +233,17 @@ export class NxRemoteCache implements RemoteCacheLayer {
     return res
   }
 
-  async has(hash: string): Promise<boolean> {
-    const res = await this.fetch(hash)
+  async has(hash: string, at?: RemoteKey): Promise<boolean> {
+    const res = await this.fetch(hash, at)
     if (res === null) return false
     await res.body?.cancel()
     return true
   }
 
-  // Nx's record carries no duration; the seam's `meta` is accepted and unused.
-  async put(hash: string, body: Blob, _meta: { durationMs: number }): Promise<void> {
+  // Nx's record carries no duration; only `meta`'s scope is sent.
+  async put(hash: string, body: Blob, meta: { durationMs: number } & RemoteKey): Promise<void> {
     if (this.disabled || this.writesRefused) return
-    const res = await this.request('PUT', hash, body)
+    const res = await this.request('PUT', hash, meta, body)
     if (res === undefined) return
     if (res.status === 200 || res.status === 202 || res.status === 409) return
     throw new Error(`HTTP ${res.status}`)

package/src/remote-scope.ts

@@ -0,0 +1,12 @@
+import type { RemoteKey } from '@vzn/vx'
+
+/**
+ * The bucket a request means (owner, 2026-10-18): `trusted` for a task's
+ * own key, else the branch scope its key was derived in. It only states
+ * intent; a server checks it against the caller's identity (a CI ID
+ * token). A request without it, from an older client, leaves the layering
+ * to the server. Shared by `turboCache()` and `nxCache()`.
+ */
+export function scopeHeader(at: RemoteKey | undefined): Record<string, string> {
+  return { 'x-vx-cache-scope': at?.scope ?? 'trusted' }
+}

package/src/turbo/index.ts

@@ -11,7 +11,7 @@
 import { readFileSync } from 'node:fs'
 import { availableParallelism } from 'node:os'
 import path from 'node:path'
-import type { ProjectMeta, VxPlugin, WorkspaceConfig } from '@vzn/vx'
+import type { ProjectMeta, VxPlugin } from '@vzn/vx'
 import type { PackageMeta } from '../packages.js'
 import { memberProjects, withManifests } from '../manifests.js'
 import { refuseUnknownOptions, type PluginOptionKinds } from '@vzn/vx'
@@ -65,14 +65,6 @@ export function turbo(options: TurboPluginOptions = {}): VxPlugin {
         const keys = await workspaceKeys(options.root ?? ctx.workspaceRoot)
         if (workspace.run?.concurrency === undefined && keys.concurrency !== undefined)
           workspace.run = { ...workspace.run, concurrency: keys.concurrency }
-        if (workspace.cache?.retention === undefined && keys.cacheRetention !== undefined)
-          workspace.cache = {
-            ...workspace.cache,
-            // `olderThan` is built with its unit below.
-            retention: keys.cacheRetention as NonNullable<
-              NonNullable<WorkspaceConfig['cache']>['retention']
-            >,
-          }
         // `turbo run --affected` compares with TURBO_SCM_BASE when set, and
         // on GitHub Actions with what the event names.
         const base =
@@ -99,36 +91,6 @@ export function turbo(options: TurboPluginOptions = {}): VxPlugin {
   )
 }
 
-/**
- * turbo.json's workspace keys vx has a home for, top level or under
- * `global`: `concurrency` (`"10"`, `"50%"` of the cores) and the local
- * cache's `cacheMaxSize` / `cacheMaxAge` (`"0"` is off; weeks become days).
- * Read by nothing, a repo that capped its cache at 10GB (formbricks) grew
- * it without bound under vx. A value core cannot parse is left to core's
- * refusal, which names the field.
- */
-const SIZE_UNITS = ['B', 'KB', 'MB', 'GB', 'TB']
-
-/**
- * Turbo's size (turborepo-cache `parse_human_size`): 1024-based, a bare
- * number is bytes, a fraction is truncated to bytes. Core takes a whole
- * number with a unit, so `7.5GB` (langfuse) is restated as `7680MB` and
- * `1000000` as `1000000B`; core refused both. Undefined when Turbo reads
- * it as off (under one byte).
- */
-function turboSize(v: string): string | undefined {
-  const m = /^(\d+\.?\d*|\.\d+)([KMGT]?B)?$/i.exec(v)
-  if (!m) return v
-  let n = Math.floor(Number(m[1]) * 1024 ** SIZE_UNITS.indexOf((m[2] ?? 'B').toUpperCase()))
-  if (n === 0) return undefined
-  let u = 0
-  while (u < SIZE_UNITS.length - 1 && n % 1024 === 0) {
-    n /= 1024
-    u++
-  }
-  return `${n}${SIZE_UNITS[u]}`
-}
-
 const UNKNOWN_SHA = '0'.repeat(40)
 
 /**
@@ -173,9 +135,12 @@ function githubActionsBase(root: string, remoteFallback: boolean): string | unde
   return before === '' ? undefined : before
 }
 
+/**
+ * turbo.json's workspace keys vx has a home for, top level or under
+ * `global`: `concurrency` (`"10"`, `"50%"` of the cores).
+ */
 async function workspaceKeys(root: string): Promise<{
   concurrency?: number
-  cacheRetention?: { maxSize?: string; olderThan?: string }
   remoteBaseFallback?: boolean
 }> {
   const file = await turboConfigFile(root)
@@ -199,7 +164,6 @@ async function workspaceKeys(root: string): Promise<{
   }
   const out: {
     concurrency?: number
-    cacheRetention?: { maxSize?: string; olderThan?: string }
     remoteBaseFallback?: boolean
   } = {}
   const flags = raw['futureFlags'] as { githubActionsRemoteBaseRefFallback?: unknown } | undefined
@@ -212,19 +176,6 @@ async function workspaceKeys(root: string): Promise<{
       : Number(c)
     if (Number.isInteger(n) && n > 0) out.concurrency = n
   }
-  const size = read('cacheMaxSize', 'TURBO_CACHE_MAX_SIZE')
-  const maxSize = size === undefined ? undefined : turboSize(size)
-  const age = read('cacheMaxAge', 'TURBO_CACHE_MAX_AGE')
-  // Turbo reads a bare number as days (`parse_human_duration`).
-  const olderThan = age
-    ?.replace(/^(\d+)w$/i, (_, w: string) => `${Number(w) * 7}d`)
-    .replace(/^\d+$/, (d) => `${d}d`)
-  if (maxSize !== undefined || olderThan !== undefined) {
-    out.cacheRetention = {
-      ...(maxSize !== undefined ? { maxSize } : {}),
-      ...(olderThan !== undefined ? { olderThan } : {}),
-    }
-  }
   return out
 }
 

package/src/turbo/turbo-map.ts

@@ -2023,9 +2023,9 @@ function buildTask(
         continue
       }
       const neg = i.startsWith('!')
-      // Turbo's globs have character classes and extglobs; a vx bracket is
-      // a literal, so `src/**/*.[jt]s` keyed on nothing and an edit
-      // replayed the old build (item 1031). A positive glob with no safe
+      // Turbo's globs have extglobs and vx's do not, so
+      // `src/**/*.@(js|ts)` keyed on nothing and an edit replayed the old
+      // build (item 1031). A positive glob with no safe
       // form widens to every package file; a negation with none is dropped
       // (it would exclude fewer files, never more).
       const wax = minimatchToVx(neg ? i.slice(1) : i, neg)
@@ -2103,19 +2103,16 @@ function buildTask(
   const zeroed = new Set<string>()
   const wsOutFiles: string[] = []
   for (const raw of def.outputs ?? []) {
-    // The first segment stays a literal (a route directory, item 667);
-    // the rest is Turbo's grammar: `dist/**/*.[cm]js` matched nothing, so
-    // a hit restored nothing (item 1031).
-    const cut = raw.indexOf('/')
-    const rest = cut < 0 ? null : minimatchToVx(raw.slice(cut + 1), raw.startsWith('!'))
-    if (cut >= 0 && rest === null) {
+    // Turbo's grammar: an extglob in `dist/**/*.@(js|mjs)` matched
+    // nothing, so a hit restored nothing (item 1031).
+    const mapped = minimatchToVx(raw, raw.startsWith('!'))
+    if (mapped === null) {
       todos.push(
         `output ${JSON.stringify(raw)}: glob syntax vx cannot take — task runs uncached; ` +
           'declare the exact outputs in a vx.config to cache it',
       )
       return { name, todos, task, uses }
     }
-    const mapped = cut < 0 ? raw : `${raw.slice(0, cut + 1)}${rest}`
     // A `!` output takes a path back, as Turbo's does (A-44): Next's
     // `.next/**` minus `!.next/cache/**` saved the cache and cleaned it
     // before every run while vx outputs could not exclude.

package/src/turbo-cache/index.ts

@@ -18,12 +18,14 @@ import path from 'node:path'
 import {
   definePlugin,
   type RemoteCacheLayer,
+  type RemoteKey,
   type RemoteOpenContext,
   type VxPlugin,
   refuseUnknownOptions,
   type PluginOptionKinds,
 } from '@vzn/vx'
 import { deadline } from '../remote-deadline.js'
+import { scopeHeader } from '../remote-scope.js'
 import { OutageBreaker } from '../remote-breaker.js'
 import { Cooldown, withRetry } from '../remote-retry.js'
 import {
@@ -614,9 +616,9 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     await revokeOidc(this.config.oidc!, token, this.fetchImpl, this.wait)
   }
 
-  async has(hash: string): Promise<boolean> {
+  async has(hash: string, at?: RemoteKey): Promise<boolean> {
     if (this.disabled) return false
-    const res = await this.request('HEAD', `/${hash}`)
+    const res = await this.request('HEAD', `/${hash}`, { headers: scopeHeader(at) })
     if (res === undefined) return false
     if (res.status === 200) return true
     if (res.status === 404) {
@@ -626,11 +628,27 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     throw new Error(`HTTP ${res.status}`)
   }
 
-  async hasMany(hashes: readonly string[]): Promise<Set<string> | null> {
+  async hasMany(hashes: readonly string[], at?: readonly RemoteKey[]): Promise<Set<string> | null> {
     if (this.disabled || hashes.length === 0) return this.disabled ? new Set() : null
+    // One query names one scope, so a batch asks once per scope in it.
+    const byScope = new Map<string | undefined, string[]>()
+    hashes.forEach((h, i) => {
+      const scope = at?.[i]?.scope
+      byScope.set(scope, [...(byScope.get(scope) ?? []), h])
+    })
+    const held = new Set<string>()
+    for (const [scope, group] of byScope) {
+      const found = await this.queryHeld(group, scope === undefined ? {} : { scope })
+      if (found === null) return null
+      for (const h of found) held.add(h)
+    }
+    return held
+  }
+
+  private async queryHeld(hashes: readonly string[], at: RemoteKey): Promise<Set<string> | null> {
     const res = await this.request('POST', '', {
       body: JSON.stringify({ hashes }),
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', ...scopeHeader(at) },
     })
     if (res === undefined) return new Set()
     if (res.status !== 200) return null
@@ -653,12 +671,15 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     return held
   }
 
-  async get(hash: string): Promise<{ body: Response; durationMs: number | undefined } | null> {
+  async get(
+    hash: string,
+    at?: RemoteKey,
+  ): Promise<{ body: Response; durationMs: number | undefined } | null> {
     if (this.disabled) return null
     // A gateway that keys binary media on Accept base64-encodes a `*/*`
     // response, and every hit read as a corrupt artifact (nx#33092's class).
     const res = await this.request('GET', `/${hash}`, {
-      headers: { Accept: 'application/octet-stream' },
+      headers: { Accept: 'application/octet-stream', ...scopeHeader(at) },
     })
     if (res === undefined) return null
     if (res.status !== 200) {
@@ -716,13 +737,14 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     return new Response(unlinkingStream(temp))
   }
 
-  async put(hash: string, body: Blob, meta: { durationMs: number }): Promise<void> {
+  async put(hash: string, body: Blob, meta: { durationMs: number } & RemoteKey): Promise<void> {
     if (this.disabled || this.writesRefused) return
     if (!this.absent.has(hash)) {
       // Part of the upload, so under its deadline. Any answer but 200 or 404
       // uploads: a lost store costs more. A server the HEAD cannot reach
       // fails the put, as the PUT would.
       const head = await this.request('HEAD', `/${hash}`, {
+        headers: scopeHeader(meta),
         timeoutMs: this.config.uploadTimeoutMs,
       })
       if (head === undefined || head.status === 200) return
@@ -732,6 +754,7 @@ export class TurboRemoteCache implements RemoteCacheLayer {
       'Content-Type': 'application/octet-stream',
       'Content-Length': String(body.size),
       'x-artifact-duration': String(Math.max(0, Math.round(meta.durationMs))),
+      ...scopeHeader(meta),
     }
     if (this.key !== undefined) {
       headers['x-artifact-tag'] = await artifactTag(this.key, hash, this.config.teamId ?? '', body)