@vzn/vx-migrate 0.0.645 → 0.0.648

package/src/turbo/index.ts

@@ -14,21 +14,21 @@ import path from 'node:path'
 import type { ProjectMeta, VxPlugin } from '@vzn/vx'
 import type { PackageMeta } from '../packages.js'
 import { memberProjects, withManifests } from '../manifests.js'
-import { refuseUnknownOptions, type PluginOptionKinds } from '@vzn/vx'
+import { refuseUnknownOptions, UserError, type PluginOptionKinds } from '@vzn/vx'
 import { type AdoptionRun, adoptionPlugin } from '../adoption-plugin.js'
 import type { AdoptionMapping } from '../mapping-cache.js'
 import { collectGaps } from '../plugin-gaps.js'
 import { gitIgnored, trackedKinds } from '../tracked-outputs.js'
 import { packageScripts, relPosix } from '../paths.js'
 import { onceReader, type ReadText, tscBuildInfo } from '../tsc-buildinfo.js'
+import type * as TurboMap from './turbo-map.js'
+import type { TurboMappedProject } from './turbo-map.js'
 import {
   envNamesThatMap,
-  mapTurboWorkspace,
   microfrontendsConfigs,
   rootTaskProject,
   turboConfigFile,
-  type TurboMappedProject,
-} from './turbo-map.js'
+} from './turbo-reads.js'
 
 /** The note every persistent task carries; like every gap, reported once per run for all its tasks. */
 const PERSISTENT_NOTE =
@@ -38,7 +38,8 @@ const PERSISTENT_NOTE =
 export interface TurboPluginOptions {
   /**
    * Where turbo.json lives. Defaults to the workspace root; a repo whose
-   * turbo.json sits elsewhere names the directory here.
+   * turbo.json sits elsewhere names the directory here, relative to the workspace
+   * root or absolute.
    */
   readonly root?: string
 }
@@ -54,22 +55,27 @@ const TURBO_PLUGIN_KEYS: PluginOptionKinds<TurboPluginOptions> = {
  */
 export function turbo(options: TurboPluginOptions = {}): VxPlugin {
   refuseUnknownOptions('turbo()', options, TURBO_PLUGIN_KEYS)
+  if (options.root === '') throw new UserError('turbo() option "root" is a directory, not empty')
+  // Against the workspace root, as vx reads every path: against the cwd,
+  // `vx run` from a package dir read another directory.
+  const rootOf = (workspaceRoot: string): string =>
+    options.root === undefined ? workspaceRoot : path.resolve(workspaceRoot, options.root)
   return adoptionPlugin(
     import.meta,
-    (ctx) => run(options.root ?? ctx.workspaceRoot, ctx.projects),
+    (ctx) => run(rootOf(ctx.workspaceRoot), ctx.projects),
     // At the workspace root only: a claim is a root name (a `root` elsewhere
     // is not claimed; its edits select as any unowned file does).
     options.root === undefined ? ['turbo.json', 'turbo.jsonc'] : [],
     {
       async config(workspace, ctx) {
-        const keys = await workspaceKeys(options.root ?? ctx.workspaceRoot)
+        const keys = await workspaceKeys(rootOf(ctx.workspaceRoot))
         if (workspace.run?.concurrency === undefined && keys.concurrency !== undefined)
           workspace.run = { ...workspace.run, concurrency: keys.concurrency }
         // `turbo run --affected` compares with TURBO_SCM_BASE when set, and
         // on GitHub Actions with what the event names.
         const base =
           Bun.env['TURBO_SCM_BASE']?.trim() ||
-          githubActionsBase(options.root ?? ctx.workspaceRoot, keys.remoteBaseFallback === true)
+          githubActionsBase(rootOf(ctx.workspaceRoot), keys.remoteBaseFallback === true)
         if (base) ctx.setBranch({ base })
       },
       // Turbo's packages are the package manager's members, each a project
@@ -189,14 +195,20 @@ const textOf = (file: string): Promise<string> =>
 /**
  * Everything the mapping reads: the root's and each package's
  * `turbo.json` / `turbo.jsonc`, every package manifest, the root's,
- * `.yarnrc.yml` and the microfrontends configs.
+ * `.yarnrc.yml`, `.npmrc`, `pnpm-workspace.yaml` and the microfrontends configs.
  */
 async function run(root: string, projects: readonly ProjectMeta[]): Promise<AdoptionRun> {
-  const metas = await withManifests(projects)
-  const dirs = [root, ...metas.map((m) => m.dir)]
-  const configs = await Promise.all(
-    dirs.flatMap((d) => ['turbo.json', 'turbo.jsonc'].map((f) => textOf(path.join(d, f)))),
-  )
+  const dirs = [root, ...projects.map((m) => m.dir)]
+  const [metas, configs, yarnrc, rootManifest, hookConfigs] = await Promise.all([
+    withManifests(projects),
+    Promise.all(
+      dirs.flatMap((d) => ['turbo.json', 'turbo.jsonc'].map((f) => textOf(path.join(d, f)))),
+    ),
+    textOf(path.join(root, '.yarnrc.yml')),
+    textOf(path.join(root, 'package.json')),
+    // Whether the manager runs `pre` / `post` hooks, so whether they fold.
+    Promise.all(['.npmrc', 'pnpm-workspace.yaml'].map((f) => textOf(path.join(root, f)))),
+  ])
   const envNames = envNamesThatMap(configs, envNamesNow())
   // The tsconfigs a `tsc` script reads are the mapping's inputs too.
   const tsc = onceReader()
@@ -213,9 +225,11 @@ async function run(root: string, projects: readonly ProjectMeta[]): Promise<Adop
       process.env['TURBO_CI_VENDOR_ENV_KEY'] ?? '',
       process.env['TURBO_ENV_MODE'] ?? '',
       ...configs,
-      await textOf(path.join(root, '.yarnrc.yml')),
-      // Its dependencies are global inputs, a member or not.
-      await textOf(path.join(root, 'package.json')),
+      yarnrc,
+      // Whether pnpm or npm runs a script's `pre` / `post` hooks (`runsScriptHooks`).
+      ...hookConfigs,
+      // Its dependencies are global inputs, a member or not; its `packageManager` names who runs hooks.
+      rootManifest,
       JSON.stringify(microfrontendsConfigs(root, dirs)),
       // A config file added beside mapped tasks changes what an output may cover.
       JSON.stringify(metas.map((m) => [m.name, m.dir, m.packageJson, m.configPath])),
@@ -244,6 +258,8 @@ async function mapAll(
       m.configPath === null ? [] : [[relPosix(root, m.dir), path.basename(m.configPath)] as const],
     ),
   )
+  // Only a mapping the kept one no longer holds loads the mapper.
+  const { mapTurboWorkspace } = require('./turbo-map.js') as typeof TurboMap
   const mapped = await mapTurboWorkspace(root, metas, {
     // Inline: the values themselves, where `bunx @vzn/vx-migrate` splices a preset import.
     splice: (_kind, values) => values,

package/src/turbo/turbo-map.ts

@@ -10,13 +10,13 @@
 //     written.
 // The consumer decides what a global becomes through `splice`.
 
-import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { isLiteralPattern, pruneOrphanPersistentNotes, UserError } from '@vzn/vx'
 import type { PackageMeta } from '../packages.js'
-import { literalGlob, minimatchToVx, withoutTakenBack } from '../glob-grammar.js'
+import { refuseTaskNames } from '../plugin-gaps.js'
+import { apartTakeBacks, literalGlob, minimatchToVx, withoutTakenBack } from '../glob-grammar.js'
 import { shellQuote } from '../nx-command.js'
-import { scriptCommand, yarnPnp } from '../script-command.js'
+import { type Owner, runsScriptHooks, scriptCommand, yarnPnp } from '../script-command.js'
 import {
   ownFileTakeBacks,
   excludeSiblingOutputs,
@@ -31,6 +31,13 @@ import {
 } from '../shared-outputs.js'
 import { manifestGraph, type ManifestGraph } from '../manifest-graph.js'
 import { isRecord, packageScripts, relPosix } from '../paths.js'
+import {
+  FRAMEWORK_ENV,
+  keyable,
+  microfrontendsConfigs,
+  ROOT,
+  turboConfigFile,
+} from './turbo-reads.js'
 import type { TrackedKinds } from '../tracked-outputs.js'
 import {
   DOTENV_PROBE,
@@ -69,34 +76,6 @@ interface TurboJson {
 
 const SHELL_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/
 
-/** A name core takes in `inputs.env` and `exec.env.passThrough`. */
-const keyable = (name: string): boolean =>
-  name.length > 0 && !name.startsWith('!') && !/[*?[\]{}=\0]/.test(name)
-
-/**
- * The names of `names` a live mapping can read differently: each a `*` in
- * one of `configs` (turbo.json texts, any string, a superset) or in Turbo's
- * framework table matches, and each core cannot key (a literal one is
- * dropped only when no variable has it). The kept mapping keyed on every
- * name, so any variable that came or went (a CI step's, `VX_DEBUG_TIMING`)
- * remapped the workspace: ~330 ms a run on vercel/ai.
- */
-export function envNamesThatMap(configs: readonly string[], names: readonly string[]): string[] {
-  const patterns = new Set(FRAMEWORK_ENV.flatMap((f) => f.env).filter((e) => e.includes('*')))
-  for (const text of configs)
-    for (const m of text.matchAll(/"((?:[^"\\]|\\.)*)"/g))
-      if (m[1]!.includes('*')) patterns.add(m[1]!)
-  // Backslashes and a leading `!` dropped, every `*` a wildcard: wider
-  // than Turbo's reading, never narrower.
-  const res = [...patterns].map(
-    (p) =>
-      new RegExp(
-        `^${p.replaceAll('\\', '').replace(/^!/, '').split('*').map(RegExp.escape).join('.*')}$`,
-      ),
-  )
-  return names.filter((n) => !keyable(n) || res.some((re) => re.test(n)))
-}
-
 /**
  * A Turbo env list's explicit names, read as Turbo reads them
  * (`wildcard_to_regex_pattern`): `*` is the one wildcard, `\*` a
@@ -195,83 +174,6 @@ const KNOWN_TASK_KEYS = new Set([
 const OUTPUT_LOGS_DEFAULT = 'new-only'
 const OUTPUT_LOGS_RUN_FLAG = new Set(['full', 'hash-only', 'errors-only', 'none'])
 
-// Turbo 2's framework inference: a package that depends on a framework
-// has its variables hashed into its tasks and passed to them, with
-// nothing in turbo.json saying so. vx env names are explicit, so the
-// variables were stripped in silence and a build that inlines them
-// (Next's `NEXT_PUBLIC_*`) read empty values (item 940). A live mapping
-// (`envNames`) infers them as Turbo does; the migrate CLI lists the names
-// the package's own files spell (`sourceNames`) and says so in a note.
-// Turbo's own table (`packages/turbo-types/src/json/frameworks.json`),
-// in its order: a package takes the FIRST framework it matches, `all`
-// needing every dependency and `some` any one.
-const NITRO_ENV = [
-  'NITRO_*',
-  'SERVER_*',
-  'AWS_APP_ID',
-  'INPUT_AZURE_STATIC_WEB_APPS_API_TOKEN',
-  'CLEAVR',
-  'CF_PAGES',
-  'FIREBASE_APP_HOSTING',
-  'NETLIFY',
-  'STORMKIT',
-  'NOW_BUILDER',
-  'ZEABUR',
-  'RENDER',
-]
-const FRAMEWORK_ENV: ReadonlyArray<{
-  slug: string
-  env: readonly string[]
-  all: boolean
-  dependencies: readonly string[]
-}> = [
-  { slug: 'astro', env: ['PUBLIC_*'], all: true, dependencies: ['astro'] },
-  { slug: 'blitzjs', env: ['NEXT_PUBLIC_*'], all: true, dependencies: ['blitz'] },
-  {
-    slug: 'create-react-app',
-    env: ['REACT_APP_*'],
-    all: false,
-    dependencies: ['react-scripts', 'react-dev-utils'],
-  },
-  { slug: 'expo', env: ['EXPO_PUBLIC_*'], all: true, dependencies: ['expo'] },
-  { slug: 'gatsby', env: ['GATSBY_*'], all: true, dependencies: ['gatsby'] },
-  {
-    slug: 'nextjs',
-    env: ['NEXT_PUBLIC_*', 'NEXT_DEPLOYMENT_ID'],
-    all: true,
-    dependencies: ['next'],
-  },
-  {
-    slug: 'nitro',
-    env: NITRO_ENV,
-    all: false,
-    dependencies: ['nitropack', 'nitropack-nightly', 'nitro', 'nitro-nightly'],
-  },
-  {
-    slug: 'nuxtjs',
-    env: ['NUXT_*', 'NUXT_ENV_*', ...NITRO_ENV, 'LAUNCH_EDITOR'],
-    all: false,
-    dependencies: ['nuxt', 'nuxt-edge', 'nuxt3', 'nuxt3-edge'],
-  },
-  { slug: 'redwoodjs', env: ['REDWOOD_ENV_*'], all: true, dependencies: ['@redwoodjs/core'] },
-  {
-    slug: 'remix',
-    env: ['REMIX_*'],
-    all: false,
-    dependencies: ['@remix-run/dev', '@remix-run/react', '@remix-run/serve', '@react-router/dev'],
-  },
-  { slug: 'sanity', env: ['SANITY_STUDIO_*'], all: true, dependencies: ['@sanity/cli'] },
-  { slug: 'solidstart', env: ['VITE_*'], all: true, dependencies: ['solid-js', 'solid-start'] },
-  { slug: 'sveltekit', env: ['VITE_*', 'PUBLIC_*'], all: true, dependencies: ['@sveltejs/kit'] },
-  { slug: 'vite', env: ['VITE_*'], all: true, dependencies: ['vite'] },
-  {
-    slug: 'vue',
-    env: ['VUE_APP_*', 'LAUNCH_EDITOR'],
-    all: true,
-    dependencies: ['@vue/cli-service'],
-  },
-]
-
 /** The three global fields of turbo.json a task may draw on. */
 export type TurboGlobal = 'inputs' | 'env' | 'pass'
 
@@ -398,6 +300,14 @@ function covers(globs: readonly string[], rel: string): boolean {
   )
 }
 
+/**
+ * Turbo reads `**` glued to text as the deep glob: `**x` as `**\/*x`, `x**`
+ * as `x*\/**` (vercel/turborepo#5431). Core refuses the glued spelling, so
+ * copied verbatim it failed the load.
+ */
+const turboGlobstar = (glob: string): string =>
+  glob.replace(/\*\*([^*/]+)/g, '**/*$1').replace(/(?!^!)([^*/]+)\*\*/g, '$1*/**')
+
 /** No glob syntax: one path, which git may ignore. */
 const isLiteral = (glob: string): boolean => !/[*?[\]{}()!]/.test(glob)
 
@@ -424,45 +334,6 @@ function keyIgnored(
   inputs.workspaceRuntime = [...probes, ignoredFilesProbe(hits.map(([rel]) => rel))]
 }
 
-/**
- * A directory's Turbo config: `turbo.json`, else `turbo.jsonc` (Turbo 2.5+
- * reads either). Only `turbo.json` was looked for, so a `turbo.jsonc` root
- * failed the run with ENOENT and a package's `turbo.jsonc` overlay was
- * skipped in silence — its `inputs` then keyed nothing (item 938).
- */
-export async function turboConfigFile(dir: string): Promise<string | null> {
-  for (const name of ['turbo.json', 'turbo.jsonc']) {
-    const file = path.join(dir, name)
-    if (await Bun.file(file).exists()) return file
-  }
-  return null
-}
-
-/**
- * The workspace root as a project to name when turbo.json declares `//#`
- * tasks: its package name and directory. Null with no such task, a
- * nameless root, or a file the mapping refuses (it names the file).
- */
-export async function rootTaskProject(root: string): Promise<{ name: string; dir: string } | null> {
-  const file = await turboConfigFile(root)
-  if (file === null) return null
-  let turbo: { tasks?: unknown; pipeline?: unknown } | null
-  let pkg: { name?: unknown } | null
-  try {
-    turbo = Bun.JSONC.parse(await Bun.file(file).text()) as typeof turbo
-    pkg = (await Bun.file(path.join(root, 'package.json')).json()) as typeof pkg
-  } catch {
-    return null
-  }
-  const tasks = turbo?.tasks ?? turbo?.pipeline
-  const hasRootTask =
-    typeof tasks === 'object' &&
-    tasks !== null &&
-    Object.keys(tasks).some((k) => k.startsWith(`${ROOT}#`))
-  if (!hasRootTask || typeof pkg?.name !== 'string' || pkg.name === '') return null
-  return { name: pkg.name, dir: root }
-}
-
 async function readTurboJson(file: string, root: string): Promise<TurboJson> {
   const text = await Bun.file(file).text()
   let parsed: unknown
@@ -606,7 +477,6 @@ function badCommand(def: TurboTask): boolean {
 
 /** Declared task names for a package: plain root keys, `pkg#name` keys
  * for this package, and per-package turbo.json keys — in that order. */
-const ROOT = '//'
 
 /**
  * A package's turbo.json files, root first and its own last, as Turbo's
@@ -892,36 +762,6 @@ async function rootPackageJson(root: string): Promise<PackageMeta['packageJson']
   return (pkg !== null && typeof pkg === 'object' ? pkg : {}) as PackageMeta['packageJson']
 }
 
-/**
- * The microfrontends configs Turbo hashes into every task: each package's
- * (the root's too) `microfrontends.json`, else `microfrontends.jsonc`, or
- * the one name `VC_MICROFRONTENDS_CONFIG_FILE_NAME` gives, unless it is a
- * child's `{ "partOf": … }` (Turbo's `update_turbo_json` appends them to
- * the root's global deps). Unread, an edit to `web`'s routes replayed every
- * sibling app's build (with-microfrontends, Turbo 2.11's dry run moves all
- * 18 tasks). Paths are root-relative; `text` is what the mapping read.
- */
-export function microfrontendsConfigs(
-  root: string,
-  dirs: readonly string[],
-  custom = process.env['VC_MICROFRONTENDS_CONFIG_FILE_NAME'] ?? '',
-): { rel: string; text: string }[] {
-  const names = custom === '' ? ['microfrontends.json', 'microfrontends.jsonc'] : [custom]
-  const out: { rel: string; text: string }[] = []
-  for (const dir of new Set(dirs.map((d) => path.resolve(d)))) {
-    const file = names.map((n) => path.join(dir, n)).find((f) => existsSync(f))
-    if (file === undefined) continue
-    const text = readFileSync(file, 'utf8')
-    let child = false
-    try {
-      const parsed = Bun.JSONC.parse(text) as { partOf?: unknown } | null
-      child = typeof parsed?.partOf === 'string'
-    } catch {}
-    if (!child) out.push({ rel: relPosix(root, file), text })
-  }
-  return out.sort((a, b) => (a.rel < b.rel ? -1 : 1))
-}
-
 export async function mapTurboWorkspace(
   root: string,
   metas: readonly PackageMeta[],
@@ -937,6 +777,7 @@ export async function mapTurboWorkspace(
   }
   const rootCfg = withGlobal(await readTurboJson(rootFile, root))
   const pnp = yarnPnp(root)
+  const hookMemo = new Map<string, Owner>()
   const rootTasks = tasksOf(rootCfg)
 
   // Turbo 1 lists an env var as `$NAME` among `globalDependencies` (and a
@@ -989,7 +830,7 @@ export async function mapTurboWorkspace(
   // 1032).
   const rootMeta = metas.find((m) => path.resolve(m.dir) === path.resolve(root))
   const globalFiles = [
-    ...globalDeps.filter((d) => envDependency(d) === null),
+    ...globalDeps.filter((d) => envDependency(d) === null).map(turboGlobstar),
     ...(rootCfg.globalDotEnv ?? []),
     // Turbo 2 added the root's dependencies to its global hash; 1.13.4's
     // leaves them out (trigger.dev: a Prisma migration re-keyed only the
@@ -1177,7 +1018,7 @@ export async function mapTurboWorkspace(
   // over its files, so `test` keys on its dependencies' sources. Dropped,
   // vx keyed `test` on its own files alone: a dependency's edit was a hit.
   // Each package has it as a key-only task, a keyed group, as nx()'s
-  // `nx-input:*` twins are.
+  // `inputs:*` twins are.
   const withScript = new Set<string>()
   for (const set of runnable.values()) for (const name of set) withScript.add(name)
   const sameRefs = new Set<string>()
@@ -1334,7 +1175,10 @@ export async function mapTurboWorkspace(
     }
 
   const projects: TurboMappedProject[] = []
-  const literals = { tasks: [] as Literals[], globalIgnored }
+  // Turbo 2.11's `global.inputs` joins each task's own inputs, where its
+  // `!` entries reach them; `globalDependencies` is hashed apart.
+  const globalPrepended = new Set(rootCfg.global?.inputs ?? [])
+  const literals = { tasks: [] as Literals[], globalIgnored, globalPrepended }
   for (const meta of metas) {
     const scripts = packageScripts(meta)
     const own = runnable.get(meta.name)!
@@ -1446,7 +1290,16 @@ export async function mapTurboWorkspace(
         }
         continue
       }
-      const command = override ?? scriptCommand(name, script as string, scripts, pnp)
+      // Turbo runs `<pm> run <name>`: the hooks fold only where the manager runs them.
+      const command =
+        override ??
+        scriptCommand(
+          name,
+          script as string,
+          scripts,
+          pnp,
+          runsScriptHooks(meta.dir, hookMemo) !== null,
+        )
       const mapped = buildTask(
         literals,
         name,
@@ -1480,6 +1333,35 @@ export async function mapTurboWorkspace(
   // not, and a test cached on one platform hit on another. The reader
   // keys those files by a probe at the workspace root.
   const metaNamed = new Map(metas.map((m) => [m.name, m]))
+
+  // An entry group's `//#task` edge is the root's, and the root has no
+  // group of that name (it runs only `//#` tasks): left to `entryEdges`,
+  // `deploy → //#format` ran no format, where `turbo run deploy` runs it.
+  // The root gets the group, edges to its own tasks only, unless it
+  // declares the name itself.
+  const rootProject =
+    rootMeta === undefined || singlePackage
+      ? undefined
+      : projects.find((p) => p.name === rootMeta.name)
+  if (rootProject !== undefined) {
+    const rootRuns = emitted.get(rootProject.name)!
+    const groups = new Map<string, string[]>()
+    for (const id of entry) {
+      const at = id.indexOf('#')
+      const pkg = metaNamed.get(id.slice(0, at))
+      const name = id.slice(at + 1)
+      if (pkg === undefined || pkg === rootMeta || rootRuns.has(name)) continue
+      for (const d of definitions(pkg).defFor(name)?.dependsOn ?? []) {
+        const task = d.slice(ROOT.length + 1)
+        if (!d.startsWith(`${ROOT}#`) || !rootRuns.has(task)) continue
+        const edges = groups.get(name) ?? []
+        if (!edges.includes(task)) edges.push(task)
+        groups.set(name, edges)
+      }
+    }
+    for (const [name, dependsOn] of groups)
+      rootProject.tasks.push({ name, todos: [], task: { dependsOn }, uses: new Set() })
+  }
   for (const meta of metas) {
     const { defFor } = definitions(meta)
     for (const t of projects.find((p) => p.name === meta.name)?.tasks ?? []) {
@@ -1563,6 +1445,7 @@ export async function mapTurboWorkspace(
   excludeWorkspaceOutputs(root, projects, (e) => opaque.get(JSON.stringify(e)) ?? [])
   pruneUnreachedPersistentNotes(projects, metas, opts.persistentTodo)
   pruneOrphanPersistentNotes(projects, opts.persistentTodo)
+  refuseTaskNames(projects, 'task')
   return { projects, notes, globals }
 }
 
@@ -1789,7 +1672,11 @@ function keyOnlyGroup(t: TurboMappedTask): TurboMappedTask {
 }
 
 function buildTask(
-  literals: { readonly tasks: Literals[]; readonly globalIgnored: readonly string[] },
+  literals: {
+    readonly tasks: Literals[]
+    readonly globalIgnored: readonly string[]
+    readonly globalPrepended: ReadonlySet<string>
+  },
   name: string,
   def: TurboTask,
   command: string,
@@ -2005,9 +1892,9 @@ function buildTask(
   let pkgDotenvDeep = false
   // The root-relative `.env` globs, probed at the workspace root.
   const wsDotenv = [...rootDotenv]
-  // globalDependencies are workspace-root-relative by definition —
-  // they map to inputs.workspaceFiles, not project-relative files.
-  const wsFiles: unknown[] = [...global('inputs')]
+  // The task's own root-relative inputs; globalDependencies, root-relative
+  // by definition, join them in inputs.workspaceFiles.
+  const wsFiles: string[] = []
   // Root-relative path → the entry naming it.
   const rels = new Map<string, Named>(literals.globalIgnored.map((f) => [f, [null, f]]))
   const atRoot = pkgDir === '' || pkgDir === '.'
@@ -2017,7 +1904,7 @@ function buildTask(
     // in the package and an edit replayed a stale build (item 936).
     files.push('**/*')
   } else {
-    for (const i of def.inputs) {
+    for (const i of def.inputs.map(turboGlobstar)) {
       if (i === '$TURBO_DEFAULT$') {
         files.push('**/*')
         continue
@@ -2086,9 +1973,27 @@ function buildTask(
   // project's own globs at every member (D-39), so as `files` a root
   // `oxlint` over the repo replayed green after a member file broke.
   // A root task's globs are the workspace's, outputs too.
-  if (atRoot) wsFiles.unshift(...files.splice(0))
+  const head = atRoot ? files.splice(0) : []
+  const joined = (g: string) => literals.globalPrepended.has(g)
+  const [apartKept, ownKept] = apartTakeBacks<unknown>(
+    globals.inputs.filter((g) => !joined(g)),
+    [...globals.inputs.filter(joined), ...head, ...wsFiles],
+  )
+  const kept = new Set([...apartKept, ...ownKept])
+  const globalKept = globals.inputs.filter((g) => kept.has(g))
+  // A global exclusion dropped for this task cannot leave an opaque
+  // preset spread: the task lists the global values itself.
+  const inline = globalKept.length !== globals.inputs.length
+  const allWs = uniq(
+    [
+      ...head.filter((e) => typeof e !== 'string' || kept.has(e)),
+      ...(inline ? globalKept : global('inputs')),
+      ...wsFiles.filter((e) => kept.has(e)),
+    ],
+    inline ? [] : hidden('inputs'),
+  )
   const inputs: Record<string, unknown> = { files: withoutTakenBack(files) }
-  if (wsFiles.length > 0) inputs.workspaceFiles = withoutTakenBack(uniq(wsFiles, hidden('inputs')))
+  if (allWs.length > 0) inputs.workspaceFiles = withoutTakenBack(allWs)
   if (keyEnv.length > 0) inputs.env = keyEnv
   if (pkgDotenv) inputs.runtime = [pkgDotenvDeep ? DOTENV_PROBE : DOTENV_PROBE_TOP]
   if (wsDotenv.length > 0) inputs.workspaceRuntime = [dotenvGlobsProbe(wsDotenv) ?? DOTENV_PROBE]
@@ -2105,7 +2010,7 @@ function buildTask(
   for (const raw of def.outputs ?? []) {
     // Turbo's grammar: an extglob in `dist/**/*.@(js|mjs)` matched
     // nothing, so a hit restored nothing (item 1031).
-    const mapped = minimatchToVx(raw, raw.startsWith('!'))
+    const mapped = minimatchToVx(turboGlobstar(raw), raw.startsWith('!'))
     if (mapped === null) {
       todos.push(
         `output ${JSON.stringify(raw)}: glob syntax vx cannot take — task runs uncached; ` +
@@ -2139,7 +2044,7 @@ function buildTask(
   }
 
   // With git's file list known, a wildcard-first output stays cached as
-  // nx() keeps it (owner, 2026-10-03; turbo() 2026-10-14): core never
+  // nx() keeps it (2026-10-03; turbo() 2026-10-14): core never
   // cleans a committed file. Turbo never cleans, so the untracked files
   // it reaches are named. An X added for `X/**` is judged with it.
   const wild = wildcardOutput(
@@ -2160,7 +2065,7 @@ function buildTask(
       if (!covers(outFiles, rel)) outFiles.push(literalGlob(rel))
   // An output over the project's own package.json (trpc's builds list
   // it: tsdown rewrites `exports`) is taken back and keeps the cache, as
-  // nx() does (owner, 2026-10-03). The build rewrites an input the key
+  // nx() does (2026-10-03). The build rewrites an input the key
   // folds, so its identical rewrite counts as unchanged ('mutable').
   const takeBacks = ownFileTakeBacks(outFiles, opts.ownConfig?.(pkgDir))
   outFiles.push(...takeBacks)