@vzn/vx-migrate 0.0.645 → 0.0.648

package/src/turbo-cache/oidc.ts

@@ -48,13 +48,11 @@ export function oidcSettings(
 ): Omit<OidcConfig, 'idTokenUrl' | 'idTokenBearer'> {
   const o = oidc === true ? {} : oidc
   if (typeof o !== 'object' || o === null)
-    throw new Error(
-      'vx/turbo-cache: oidc must be true or { tokenUrl, revokeUrl, audience, params }',
-    )
+    throw new Error('turboCache(): oidc must be true or { tokenUrl, revokeUrl, audience, params }')
   if (!vercel && o.tokenUrl === undefined)
-    throw new Error("vx/turbo-cache: oidc needs tokenUrl for a cache that is not Vercel's")
+    throw new Error("turboCache(): oidc needs tokenUrl for a cache that is not Vercel's")
   if (vercel && team === undefined)
-    throw new Error('vx/turbo-cache: oidc on Vercel needs teamId or teamSlug (TURBO_TEAM)')
+    throw new Error('turboCache(): oidc on Vercel needs teamId or teamSlug (TURBO_TEAM)')
   const revokeUrl = o.revokeUrl ?? (vercel ? VERCEL_REVOKE_URL : undefined)
   return {
     tokenUrl: o.tokenUrl ?? VERCEL_TOKEN_URL,
@@ -101,22 +99,44 @@ const form = (fields: Record<string, string>) => ({
 /** Where a URL points, never its query: GitHub's carries a runtime id. */
 const where = (url: string) => (URL.canParse(url) ? new URL(url).host : 'the endpoint')
 
+/**
+ * A refusal's own words: RFC 6749's `error` and `error_description`, or
+ * GitHub's `message`. Only those fields, which name a fault and never
+ * carry a token; any other body is left unread. "answered HTTP 400" alone
+ * did not say the audience or the grant was wrong.
+ */
+async function refused(res: Response, what: string): Promise<Error> {
+  // quiet: a body that is not JSON says nothing; the status still names the refusal
+  const body = (await res.json().catch(() => null)) as Record<string, unknown> | null
+  const text = (v: unknown): string | undefined =>
+    typeof v === 'string' && v.trim() !== ''
+      ? v.replace(/\s+/g, ' ').trim().slice(0, 200)
+      : undefined
+  const said = [text(body?.['error']), text(body?.['error_description']) ?? text(body?.['message'])]
+    .filter((s) => s !== undefined)
+    .join(': ')
+  return new Error(`${what} answered HTTP ${res.status}${said === '' ? '' : `: ${said}`}`)
+}
+
 async function field(res: Response, name: string, what: string): Promise<string> {
-  if (!res.ok) {
-    await res.body?.cancel()
-    throw new Error(`${what} answered HTTP ${res.status}`)
-  }
+  if (!res.ok) throw await refused(res, what)
   const value = ((await res.json().catch(() => null)) as Record<string, unknown> | null)?.[name]
   if (typeof value !== 'string' || value === '') throw new Error(`${what} sent no ${name}`)
   return value
 }
 
+/** An exchanged token, and when it ends (epoch ms) when the server says. */
+export interface Exchanged {
+  readonly token: string
+  readonly expiresAt?: number
+}
+
 /** The job's OIDC token, exchanged for the cache's access token. Errors never quote a token. */
 export async function exchangeOidc(
   cfg: OidcConfig,
   fetchImpl: typeof fetch = fetch,
   wait: (ms: number) => Promise<void> = Bun.sleep,
-): Promise<string> {
+): Promise<Exchanged> {
   const idUrl = new URL(cfg.idTokenUrl)
   if (cfg.audience !== undefined) idUrl.searchParams.set('audience', cfg.audience)
   const idToken = await field(
@@ -129,22 +149,28 @@ export async function exchangeOidc(
     'value',
     `GitHub's OIDC endpoint (${where(cfg.idTokenUrl)})`,
   )
-  return field(
-    await send(
-      fetchImpl,
-      cfg.tokenUrl,
-      form({
-        grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
-        subject_token: idToken,
-        subject_token_type: 'urn:ietf:params:oauth:token-type:id_token',
-        requested_token_type: 'urn:ietf:params:oauth:token-type:access_token',
-        ...cfg.params,
-      }),
-      wait,
-    ),
-    'access_token',
-    `the token exchange (${where(cfg.tokenUrl)})`,
+  const res = await send(
+    fetchImpl,
+    cfg.tokenUrl,
+    form({
+      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+      subject_token: idToken,
+      subject_token_type: 'urn:ietf:params:oauth:token-type:id_token',
+      requested_token_type: 'urn:ietf:params:oauth:token-type:access_token',
+      ...cfg.params,
+    }),
+    wait,
   )
+  const what = `the token exchange (${where(cfg.tokenUrl)})`
+  if (!res.ok) throw await refused(res, what)
+  const body = (await res.json().catch(() => null)) as Record<string, unknown> | null
+  const token = body?.['access_token']
+  if (typeof token !== 'string' || token === '') throw new Error(`${what} sent no access_token`)
+  const ttl = body?.['expires_in']
+  return {
+    token,
+    ...(typeof ttl === 'number' && ttl > 0 ? { expiresAt: Date.now() + ttl * 1000 } : {}),
+  }
 }
 
 /** Revoke the exchanged token; a throw is the caller's warning. */
@@ -166,6 +192,6 @@ export async function revokeOidc(
     }),
     wait,
   )
+  if (!res.ok) throw await refused(res, `revoking at ${where(cfg.revokeUrl)}`)
   await res.body?.cancel()
-  if (!res.ok) throw new Error(`revoking at ${where(cfg.revokeUrl)} answered HTTP ${res.status}`)
 }

package/src/turbo-cache/scope.ts

@@ -1,4 +1,4 @@
-import type { ArtifactInfo, RemoteCacheLayer } from '@vzn/vx'
+import { type ArtifactInfo, type RemoteCacheLayer, UserError } from '@vzn/vx'
 
 /**
  * How a remote keeps branches apart (2026-10-20). `'header'`: plain keys,
@@ -10,9 +10,10 @@ import type { ArtifactInfo, RemoteCacheLayer } from '@vzn/vx'
  */
 export type RemoteScope = 'header' | 'key'
 
-export function remoteScope(name: string, scope: unknown): RemoteScope {
+/** `factory`: the option's owner as a workspace calls it, `turboCache`. */
+export function remoteScope(factory: string, scope: unknown): RemoteScope {
   if (scope === undefined || scope === 'header' || scope === 'key') return scope ?? 'header'
-  throw new Error(`vx/${name}: scope must be 'header' or 'key', got ${JSON.stringify(scope)}`)
+  throw new UserError(`${factory}(): scope must be 'header' or 'key', got ${JSON.stringify(scope)}`)
 }
 
 /** A server caps the read header at this many refs (the server rules), so vx never sends more. */
@@ -57,6 +58,7 @@ export function keyedByRef(inner: RemoteCacheLayer, allRefs: readonly string[]):
   return {
     ...(inner.endpoint !== undefined ? { endpoint: inner.endpoint } : {}),
     ...(inner.open !== undefined ? { open: (ctx) => inner.open!(ctx) } : {}),
+    ...(inner.lend !== undefined ? { lend: () => inner.lend!() } : {}),
     has: firstHeld,
     ...(hasMany !== undefined
       ? {

package/src/vite-task/vite-task-map.ts

@@ -9,7 +9,8 @@ import { existsSync } from 'node:fs'
 import path from 'node:path'
 import { type GeneratedProject, type GeneratedTask, UserError } from '@vzn/vx'
 import type { PackageMeta } from '../packages.js'
-import { minimatchToVx, withoutTakenBack } from '../glob-grammar.js'
+import { refuseTaskNames } from '../plugin-gaps.js'
+import { hasGluedGlobstar, minimatchToVx, withoutTakenBack } from '../glob-grammar.js'
 import { packageScripts, relPosix } from '../paths.js'
 import { scriptCommand, yarnPnp } from '../script-command.js'
 import {
@@ -70,9 +71,11 @@ function viteConfigFile(dir: string): string | null {
 
 // Bun's resolver reads `\` as a separator, even in a file: URL, so a config
 // under `a\b` was looked for under `a/b`. Resolved here, the path stays as
-// written; the file is read from it.
-const LITERAL_QUERY = /\?vx-literal$/
+// written; the file is read from it, found by its number: Bun 1.4.4 hands
+// onLoad the path with `\` made `/`.
+const LITERAL_QUERY = /\?vx-literal=(\d+)$/
 let servingLiteral = false
+const literals: string[] = []
 
 function importAsWritten(file: string): Promise<{ default?: unknown }> {
   if (!file.includes('\\')) return import(file)
@@ -86,7 +89,7 @@ function importAsWritten(file: string): Promise<{ default?: unknown }> {
           namespace: 'file',
         }))
         build.onLoad({ filter: LITERAL_QUERY }, async (args) => {
-          const at = args.path.replace(LITERAL_QUERY, '')
+          const at = literals[Number(LITERAL_QUERY.exec(args.path)![1])]!
           return {
             contents: await Bun.file(at).text(),
             loader: /\.[cm]?ts$/.test(at) ? 'ts' : 'js',
@@ -95,7 +98,7 @@ function importAsWritten(file: string): Promise<{ default?: unknown }> {
       },
     })
   }
-  return import(`${file}?vx-literal`)
+  return import(`${file}?vx-literal=${literals.push(file) - 1}`)
 }
 
 /**
@@ -384,6 +387,7 @@ export async function mapViteTaskWorkspace(
       `workspace dependencies spell (${n} task${n === 1 ? '' : 's'}) — add any other a task reads to ` +
       'inputs.env and exec.env.passThrough',
   )
+  refuseTaskNames(projects, 'task')
   return { projects, notes }
 }
 
@@ -551,7 +555,8 @@ function globs(
     } else continue
     const neg = pattern.startsWith('!')
     const raw = neg ? pattern.slice(1) : pattern
-    const wax = minimatchToVx(raw, neg)
+    // wax refuses a glued `**` (`src/**.ts`), and so does core.
+    const wax = hasGluedGlobstar(raw) ? null : minimatchToVx(raw, neg)
     if (wax === null) {
       todos.push(
         `${kind} ${JSON.stringify(pattern)}: glob syntax vx cannot take — ` +

package/src/workspace-plugins.ts

@@ -1,5 +1,5 @@
 // The plugins a migrated workspace declares, from what the repo shows
-// (owner, 2026-10-06: "install and migrate fully … use the plugins"). Each
+// (2026-10-06: "install and migrate fully … use the plugins"). Each
 // is inert where it does not apply, so declaring one costs a run nothing,
 // and each is installed beside vx at vx-migrate's own version (plugins
 // pin their core peer to the release they shipped with).
@@ -23,9 +23,12 @@ export function workspacePlugins(root: string, runner?: 'turbo' | 'nx'): Workspa
     out.push({ pkg: '@vzn/vx-migrate', factory: REMOTE_CACHE[runner] })
   const lock = lockfilePlugin(root)
   if (lock !== undefined) out.push({ pkg: '@vzn/vx-lockfile', factory: lock.factory })
-  out.push({ pkg: '@vzn/vx-schedule-history', factory: 'scheduleHistoryPlugin' })
+  out.push({ pkg: '@vzn/vx-history', factory: 'vxHistory' })
   if (existsSync(path.join(root, '.github', 'workflows')))
     out.push({ pkg: '@vzn/vx-ci', factory: 'github' })
+  // A remote cache on CI reads the refs only these name (2026-10-25).
+  if (existsSync(path.join(root, '.gitlab-ci.yml')))
+    out.push({ pkg: '@vzn/vx-ci', factory: 'gitlab' })
   return out
 }