@vzn/vx-migrate 0.0.650 → 0.0.652

package/src/shared-outputs.ts

@@ -179,8 +179,8 @@ interface Cached {
 function cachedOutputs(t: GeneratedTask, index: number): Cached | null {
   const task = t.task
   if (task === null) return null
-  const cache = task['cache'] as { outputs?: { files?: unknown } } | undefined
-  const files = cache?.outputs?.files
+  const outputs = task['outputs'] as { files?: unknown } | undefined
+  const files = outputs?.files
   if (!Array.isArray(files)) return null
   // Where a task's outputs might land is its positive globs, as core reads
   // them: a `!` compiled as a glob is true of every other path.
@@ -267,9 +267,7 @@ export function resolveSharedOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
         for (const { k, gb } of pairs) {
           if (k.back.has(gb)) continue
           k.back.add(gb)
-          ;(tasks[k.index]!.task!['cache'] as { outputs: { files: string[] } }).outputs.files.push(
-            `!${gb}`,
-          )
+          ;(tasks[k.index]!.task!['outputs'] as { files: string[] }).files.push(`!${gb}`)
         }
         kept.push(c)
         continue
@@ -289,14 +287,14 @@ export function resolveSharedOutputs(tasks: GeneratedTask[]): GeneratedTask[] {
         sharedFiles.every((g) => isLiteralPattern(g) && TSBUILDINFO.test(g))
       ) {
         c.files = c.files.filter((g) => !sharedFiles.includes(g))
-        const outputs = (t.task!['cache'] as { outputs: { files: string[] } }).outputs
+        const outputs = t.task!['outputs'] as { files: string[] }
         outputs.files = outputs.files.filter((g) => !sharedFiles.includes(g))
         kept.push(c)
         continue
       }
       dropped.add(c.index)
       const shared = c.files.find((gb) => clash.files.some((ga) => hits(clash, ga, gb)))!
-      delete t.task!['cache']
+      uncache(t.task!)
       t.todos.push(
         `declares the output ${JSON.stringify(shared)} that ${JSON.stringify(clash.name)} also ` +
           "declares — vx cleans a task's outputs before it runs and before a restore, so two " +
@@ -369,10 +367,18 @@ export const isKeyedGroup = (t: { readonly task: Record<string, unknown> | null
  * alone, its incomplete key still let a dependant hit stale.
  */
 export function unkey(task: Record<string, unknown>): void {
-  delete task['cache']
+  uncache(task)
   delete task['inputs']
 }
 
+/** No cache: `outputs` and `inputs.stability` go with it, as they mean nothing without. */
+export function uncache(task: Record<string, unknown>): void {
+  delete task['cache']
+  delete task['outputs']
+  const inputs = task['inputs'] as Record<string, unknown> | undefined
+  if (inputs !== undefined) delete inputs['stability']
+}
+
 /** A task's `inputs` block, when it has one with a `files` list. */
 function inputsOf(t: GeneratedTask): { files: string[]; workspaceFiles?: unknown } | undefined {
   const inputs = t.task?.['inputs'] as { files?: unknown } | undefined
@@ -457,11 +463,11 @@ export function resolveSharedWorkspaceOutputs(
   for (const p of projects) {
     const rel = relPosix(root, p.dir)
     for (const t of p.tasks) {
-      const cache = t.task?.['cache'] as
-        | { outputs?: { files?: unknown; workspaceFiles?: unknown } }
+      const outputs = t.task?.['outputs'] as
+        | { files?: unknown; workspaceFiles?: unknown }
         | undefined
-      const ws = positive(cache?.outputs?.workspaceFiles)
-      const own = positive(cache?.outputs?.files).map((g) =>
+      const ws = positive(outputs?.workspaceFiles)
+      const own = positive(outputs?.files).map((g) =>
         rel === '' ? g.replace(/^(\.\/)+/, '') : `${rel}/${g.replace(/^(\.\/)+/, '')}`,
       )
       if (ws.length === 0 && own.length === 0) continue
@@ -485,7 +491,7 @@ export function resolveSharedWorkspaceOutputs(
         kept.push({ id: `${p.name}#${t.name}`, project: p.name, ws, own })
         continue
       }
-      delete t.task!['cache']
+      uncache(t.task!)
       t.todos.push(
         `declares the workspace output ${JSON.stringify(shared)} that ${clash.id} also declares — ` +
           "vx cleans a task's outputs before it runs and before a restore, so two cached tasks " +
@@ -525,9 +531,9 @@ export function excludeWorkspaceOutputs(
   for (const p of projects) {
     const rel = relPosix(root, p.dir)
     for (const t of p.tasks) {
-      const outputs = (
-        t.task?.['cache'] as { outputs?: { files?: unknown; workspaceFiles?: unknown } } | undefined
-      )?.outputs
+      const outputs = t.task?.['outputs'] as
+        | { files?: unknown; workspaceFiles?: unknown }
+        | undefined
       const globs = [
         ...positive(outputs?.workspaceFiles),
         ...positive(outputs?.files).map((g) =>

package/src/tracked-outputs.ts

@@ -266,7 +266,7 @@ export function spareTrackedOutputs(
     const rel = relPosix(root, p.dir)
     const own = rel === '' ? tracked : filesUnder(tracked, rel).map((f) => f.slice(rel.length + 1))
     for (const t of p.tasks) {
-      const outputs = (t.task?.['cache'] as { outputs?: Outputs } | undefined)?.outputs
+      const outputs = t.task?.['outputs'] as Outputs | undefined
       if (outputs === undefined) continue
       const hits: [key: 'files' | 'workspaceFiles', hit: string[]][] = []
       for (const [key, base] of [

package/src/turbo/index.ts

@@ -24,6 +24,7 @@ import { onceReader, type ReadText, tscBuildInfo } from '../tsc-buildinfo.js'
 import type * as TurboMap from './turbo-map.js'
 import type { TurboMappedProject } from './turbo-map.js'
 import {
+  ENV_CONDITION_KEYS,
   envNamesThatMap,
   microfrontendsConfigs,
   rootTaskProject,
@@ -71,12 +72,24 @@ export function turbo(options: TurboPluginOptions = {}): VxPlugin {
         const keys = await workspaceKeys(rootOf(ctx.workspaceRoot))
         if (workspace.run?.concurrency === undefined && keys.concurrency !== undefined)
           workspace.run = { ...workspace.run, concurrency: keys.concurrency }
+        // `TURBO_FORCE` (`true` or `1`, as Turbo reads it) is `turbo run --force`.
+        const force = Bun.env['TURBO_FORCE']?.trim()
+        if (force === 'true' || force === '1')
+          workspace.cache = { ...workspace.cache, policy: forcedPolicy(workspace.cache?.policy) }
         // `turbo run --affected` compares with TURBO_SCM_BASE when set, and
         // on GitHub Actions with what the event names.
         const base =
           Bun.env['TURBO_SCM_BASE']?.trim() ||
           githubActionsBase(rootOf(ctx.workspaceRoot), keys.remoteBaseFallback === true)
         if (base) ctx.setBranch({ base })
+        // ...up to TURBO_SCM_HEAD. vx's head is the checkout (HEAD and its
+        // working tree): a head at HEAD's commit is that, any other is said.
+        const head = Bun.env['TURBO_SCM_HEAD']?.trim()
+        if (head && !atHead(rootOf(ctx.workspaceRoot), head))
+          ctx.warn(
+            `TURBO_SCM_HEAD (${head}) is not the checked-out commit: --affected compares ` +
+              `the base with the checkout, so check out ${head} to compare with it.`,
+          )
       },
       // Turbo's packages are the package manager's members, each a project
       // with no vx.config written. `//#task` keys run on the root, as Turbo
@@ -99,6 +112,18 @@ export function turbo(options: TurboPluginOptions = {}): VxPlugin {
 
 const UNKNOWN_SHA = '0'.repeat(40)
 
+/** Whether `ref` names HEAD's commit. */
+function atHead(root: string, ref: string): boolean {
+  // An option is no ref; rev-parse prints `--end-of-options` back (git 2.43).
+  if (ref.startsWith('-')) return false
+  const proc = Bun.spawnSync(['git', 'rev-parse', 'HEAD', `${ref}^{commit}`], {
+    cwd: root,
+    stderr: 'ignore',
+  })
+  const [head, at] = proc.stdout.toString().split('\n')
+  return proc.exitCode === 0 && head === at
+}
+
 /**
  * Turbo's `--affected` base on GitHub Actions when `TURBO_SCM_BASE` is
  * unset (`get_github_base_ref`): a pull request's `GITHUB_BASE_REF`, else
@@ -185,6 +210,25 @@ async function workspaceKeys(root: string): Promise<{
   return out
 }
 
+/**
+ * A policy with every read off, as `--force` is: no hit is replayed. The
+ * remote is written only where the workspace's own policy names it, so a
+ * laptop's forced run never writes the cache CI reads.
+ */
+function forcedPolicy(spec = ''): string {
+  const flags = new Map([
+    ['local', 'w'],
+    ['remote', ''],
+  ])
+  for (const seg of spec.split(',')) {
+    if (seg.trim() === '') continue
+    const m = /^(local|remote):([rw]*)$/.exec(seg.trim())
+    if (m === null) return spec // core refuses it, naming `cache.policy`
+    flags.set(m[1]!, m[2]!.replace('r', ''))
+  }
+  return [...flags].map(([layer, f]) => `${layer}:${f}`).join(',')
+}
+
 const envNamesNow = (): string[] => Object.keys(process.env).sort()
 
 const textOf = (file: string): Promise<string> =>
@@ -223,6 +267,8 @@ async function run(root: string, projects: readonly ProjectMeta[]): Promise<Adop
       // An env wildcard expands over these; a new name it matches maps afresh.
       JSON.stringify(envNames),
       process.env['TURBO_CI_VENDOR_ENV_KEY'] ?? '',
+      // A framework conditional keys its names on these values (skew protection).
+      JSON.stringify(ENV_CONDITION_KEYS.map((k) => process.env[k] ?? null)),
       process.env['TURBO_ENV_MODE'] ?? '',
       ...configs,
       yarnrc,
@@ -265,6 +311,7 @@ async function mapAll(
     splice: (_kind, values) => values,
     persistentTodo: PERSISTENT_NOTE,
     envNames,
+    envValue: (name) => process.env[name],
     vendorEnvPrefix: process.env['TURBO_CI_VENDOR_ENV_KEY'] ?? '',
     envMode: process.env['TURBO_ENV_MODE'] ?? '',
     ...(tracked === null ? {} : { tracked: trackedKinds(tracked) }),

package/src/turbo/root-engines.ts

@@ -0,0 +1,19 @@
+/**
+ * The root manifest's `engines`, compacted, printed by one `awk` at the
+ * workspace root: Turbo folds that value into every task's global hash
+ * (crates/turborepo-task-hash/src/global_hash.rs), so raising
+ * `engines.node` re-ran every task under `turbo run` and replayed a hit
+ * under vx. A probe reads it live, so `turbo()` and the config the
+ * migration writes key it alike; it prints only the `engines` value, so
+ * no other root edit re-keys a task. A top-level JSON scanner, strings
+ * and escapes skipped, whitespace outside strings dropped: a reformat
+ * keys alike, a reorder misses (never a stale hit). One process, no Node.
+ */
+export const ROOT_ENGINES_PROBE =
+  'LC_ALL=C awk \'BEGIN{RS="\\001"}{n=length($0);d=0;q=0;c=0;o="";for(i=1;i<=n;i++){x=substr($0,i,1);if(c&&(q||x!~/[ \\t\\r\\n]/))o=o x;if(q){if(x=="\\\\"){i++;if(c)o=o substr($0,i,1)}else if(x=="\\""){q=0;if(d==1&&!c)k=substr($0,s,i-s)}continue}if(x=="\\""){q=1;s=i+1}else if(x=="{"||x=="[")d++;else if(x=="}"||x=="]"){d--;if(c&&d==1){print o;exit}}else if(x==":"&&d==1&&!c&&k=="engines")c=1}}\' package.json'
+
+/** Whether Turbo hashes the root's `engines`: a non-empty object, as it reads one. */
+export function keysRootEngines(rootPackageJson: unknown): boolean {
+  const engines = (rootPackageJson as { engines?: unknown } | null)?.engines
+  return typeof engines === 'object' && engines !== null && Object.keys(engines).length > 0
+}

package/src/turbo/turbo-map.ts

@@ -24,6 +24,7 @@ import {
   resolveSharedOutputs,
   resolveSharedWorkspaceOutputs,
   takingBack,
+  uncache,
   unkey,
   wildcardCleanTodo,
   wildcardOutput,
@@ -36,9 +37,12 @@ import {
   keyable,
   microfrontendsConfigs,
   ROOT,
+  TURBO_BUILTIN_PASS_THROUGH,
+  TURBO_DEFAULT_ENV,
   turboConfigFile,
 } from './turbo-reads.js'
 import type { TrackedKinds } from '../tracked-outputs.js'
+import { keysRootEngines, ROOT_ENGINES_PROBE } from './root-engines.js'
 import {
   DOTENV_PROBE,
   DOTENV_PROBE_TOP,
@@ -72,6 +76,8 @@ interface TurboJson {
   /** Turbo 2.11 `futureFlags.globalConfiguration`: the global lists live here. */
   global?: { inputs?: string[]; env?: string[]; passThroughEnv?: string[]; envMode?: unknown }
   envMode?: unknown
+  /** Turbo 2.11.6: the package's labels, which `--filter tag:` selects by. */
+  tags?: string[]
 }
 
 const SHELL_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/
@@ -133,6 +139,18 @@ function explicitEnv(
   return out.filter((n) => !excluded.some((re) => re.test(n)))
 }
 
+/**
+ * The literal names of Turbo's builtin pass-through list, the same under
+ * `turbo()` as in written configs: `exec.env.passThrough` is keyed by name,
+ * so a list matched against the live environment keyed each machine apart
+ * and missed the cache `turbo()` filled once the configs were written. A
+ * wildcard family is a note. A name that is no shell variable name
+ * (`ProgramFiles(x86)`) is left out: core refuses it there.
+ */
+const BUILTIN_PASS_THROUGH = TURBO_BUILTIN_PASS_THROUGH.filter((e) =>
+  /^[A-Za-z_][A-Za-z0-9_]*$/.test(e),
+)
+
 /** A gap's message: a wildcard, or a literal name core cannot key. */
 const envGap = (field: string, entry: string, literal: string | null, list: string): string =>
   literal === null
@@ -161,8 +179,11 @@ const KNOWN_TASK_KEYS = new Set([
   // watch` keeps it up and restarts it only when its config changes or it
   // dies, so either value maps to nothing.
   'interruptible',
-  // Labels: Turbo keeps them out of the hash and the behaviour.
+  // Turbo 2.11.6 selects a task by them (`--filter tag:`); a vx tag belongs
+  // to a project, so only the package-level `tags` map (`packageTags`).
   'tags',
+  // Turbo parses it for external CI tooling and acts on nothing.
+  'experimentalCI',
 ])
 
 // Turbo's per-task `outputLogs` against vx's per-run `--output-logs`.
@@ -191,6 +212,8 @@ export interface TurboMappedTask {
 export interface TurboMappedProject {
   name: string
   dir: string
+  /** The package's turbo.json `tags`, its vx project tags. */
+  tags?: string[]
   tasks: TurboMappedTask[]
 }
 
@@ -222,6 +245,12 @@ export interface MapTurboOptions {
    * Absent (`bunx @vzn/vx-migrate` writes files), a wildcard is a todo.
    */
   envNames?: readonly string[]
+  /**
+   * A variable's value where the tasks will run, read only for a framework
+   * conditional's key (Turbo's `envConditionals`). Absent (written configs),
+   * every conditional name is keyed: more misses, never a stale hit.
+   */
+  envValue?: (name: string) => string | undefined
   /**
    * Without `envNames` (written configs): the upper-case names the files
    * under `dirs` spell, which a framework's `*` prefix is matched against.
@@ -354,10 +383,12 @@ const TOP_LISTS = [
   'globalPassThroughEnv',
   'globalDotEnv',
   'extends',
+  'tags',
 ]
 const GLOBAL_LISTS = ['inputs', 'env', 'passThroughEnv']
 const TASK_LISTS = ['dependsOn', 'outputs', 'env', 'passThroughEnv', 'with', 'dotEnv']
 const TASK_FLAGS = ['cache', 'persistent', 'interactive', 'interruptible']
+const ENV_LISTS = new Set(['globalEnv', 'globalPassThroughEnv', 'env', 'passThroughEnv'])
 
 /**
  * The shape of every field the mapper reads, refused by name. A number
@@ -373,12 +404,47 @@ function checkTurboShape(cfg: unknown, label: string): void {
     if (v !== undefined && (!Array.isArray(v) || v.some((x) => typeof x !== 'string')))
       refuse(at, 'an array of strings')
   }
+  // Turbo refuses `$NAME` in an env list (`InvalidEnvPrefix`), its own
+  // `$TURBO_EXTENDS$` aside; mapped, core keyed a variable literally
+  // named `$NAME`, which is never set.
+  const envList = (v: unknown, at: string): void => {
+    list(v, at)
+    const bad = (v as string[] | undefined)?.find(
+      (x) => x.startsWith('$') && x !== '$TURBO_EXTENDS$',
+    )
+    if (bad !== undefined)
+      throw new UserError(
+        `${label}: ${at} holds ${JSON.stringify(bad)}: Turbo refuses a "$" before an env name — write ${JSON.stringify(bad.slice(1))}`,
+      )
+  }
+  // Turbo refuses an absolute glob (`AbsolutePathInConfig`), read past its
+  // `!` and `$TURBO_ROOT$/`; mapped, core refused it naming the project,
+  // as if its own config held it.
+  const paths = (v: unknown, at: string): void => {
+    for (const x of Array.isArray(v) ? v : []) {
+      const globs: unknown[] = isRecord(x) && Array.isArray(x['globs']) ? x['globs'] : [x]
+      for (const g of globs) {
+        if (typeof g !== 'string') continue
+        const bare = g.replace(/^!/, '').replace(/^\$TURBO_ROOT\$\//, '')
+        if (path.isAbsolute(bare))
+          throw new UserError(
+            `${label}: ${at} holds ${JSON.stringify(g)}: Turbo refuses an absolute path — name it relative to the package, or to the root with $TURBO_ROOT$/`,
+          )
+      }
+    }
+  }
   if (!isRecord(cfg)) refuse('the file', 'a JSON object')
   const c = cfg as Record<string, unknown>
-  for (const k of TOP_LISTS) list(c[k], k)
+  for (const k of TOP_LISTS) (ENV_LISTS.has(k) ? envList : list)(c[k], k)
+  paths(c['globalDependencies'], 'globalDependencies')
   if (c['global'] !== undefined) {
     if (!isRecord(c['global'])) refuse('global', 'an object')
-    for (const k of GLOBAL_LISTS) list((c['global'] as Record<string, unknown>)[k], `global.${k}`)
+    for (const k of GLOBAL_LISTS)
+      (ENV_LISTS.has(k) ? envList : list)(
+        (c['global'] as Record<string, unknown>)[k],
+        `global.${k}`,
+      )
+    paths((c['global'] as Record<string, unknown>)['inputs'], 'global.inputs')
   }
   for (const field of ['tasks', 'pipeline']) {
     const tasks = c[field]
@@ -388,7 +454,7 @@ function checkTurboShape(cfg: unknown, label: string): void {
       const at = `${field}.${JSON.stringify(name)}`
       if (!isRecord(def)) refuse(at, 'an object')
       const d = def as Record<string, unknown>
-      for (const k of TASK_LISTS) list(d[k], `${at}.${k}`)
+      for (const k of TASK_LISTS) (ENV_LISTS.has(k) ? envList : list)(d[k], `${at}.${k}`)
       // Turbo 2.11 adds `{ mode, globs, withDefaults }` entries (`flatInputs`).
       const inputs = d['inputs']
       if (
@@ -396,6 +462,8 @@ function checkTurboShape(cfg: unknown, label: string): void {
         (!Array.isArray(inputs) || inputs.some((x) => typeof x !== 'string' && !isRecord(x)))
       )
         refuse(`${at}.inputs`, 'an array of globs')
+      paths(inputs, `${at}.inputs`)
+      paths(d['outputs'], `${at}.outputs`)
       for (const k of TASK_FLAGS)
         if (d[k] !== undefined && typeof d[k] !== 'boolean') refuse(`${at}.${k}`, 'true or false')
       for (const k of ['outputLogs', 'outputMode'])
@@ -404,6 +472,16 @@ function checkTurboShape(cfg: unknown, label: string): void {
   }
 }
 
+/**
+ * A package's top-level turbo.json `tags`, which Turbo 2.11.6's `--filter
+ * tag:<label>` selects every task of the package by, as vx's `tag:` does a
+ * project's. Its own file only: Turbo inherits no package tag, and the
+ * root's label the root package. Blank ones dropped, as vx refuses them.
+ */
+function packageTags(cfg: TurboJson | undefined): string[] {
+  return [...new Set((cfg?.tags ?? []).filter((t) => t.trim() !== ''))]
+}
+
 function tasksOf(cfg: TurboJson): Record<string, TurboTask> {
   return cfg.tasks ?? cfg.pipeline ?? {}
 }
@@ -762,6 +840,22 @@ async function rootPackageJson(root: string): Promise<PackageMeta['packageJson']
   return (pkg !== null && typeof pkg === 'object' ? pkg : {}) as PackageMeta['packageJson']
 }
 
+/**
+ * `turboConfigFile`, refusing a directory that holds both files as Turbo
+ * does (vercel/turborepo#10083): `turbo.json` shadowed the `.jsonc` beside
+ * it in silence, so an edit there keyed and ran nothing.
+ */
+async function onlyConfigFile(dir: string, root: string): Promise<string | null> {
+  const file = await turboConfigFile(dir)
+  if (file?.endsWith('.json') === true && (await Bun.file(`${file}c`).exists())) {
+    const where = dir === root ? 'the workspace root' : relPosix(root, dir)
+    throw new UserError(
+      `${where} holds both turbo.json and turbo.jsonc: Turbo refuses this — remove one`,
+    )
+  }
+  return file
+}
+
 export async function mapTurboWorkspace(
   root: string,
   metas: readonly PackageMeta[],
@@ -769,7 +863,16 @@ export async function mapTurboWorkspace(
 ): Promise<TurboMapping> {
   // A workspace with no Turbo config answered with a bare ENOENT and a stack
   // (item 1043): turbo() declared in the wrong repo, or its file removed.
-  const rootFile = await turboConfigFile(root)
+  const rootFile = await onlyConfigFile(root, root)
+  // Turbo reads its root config from the file TURBO_ROOT_TURBO_JSON names,
+  // against the cwd (vercel/turborepo#9087); reading the root's in its
+  // place ran another task graph than `turbo run`.
+  const named = Bun.env['TURBO_ROOT_TURBO_JSON']
+  if (named && (rootFile === null || path.resolve(named) !== rootFile)) {
+    throw new UserError(
+      `TURBO_ROOT_TURBO_JSON names ${path.resolve(named)}: turbo() reads only the workspace root's turbo.json or turbo.jsonc — unset it, or move that config to the root`,
+    )
+  }
   if (rootFile === null) {
     throw new UserError(
       `no turbo.json or turbo.jsonc at the workspace root (${root}): turbo() maps a Turbo repo's config — add one, or remove turbo() from .vx/workspace.ts`,
@@ -829,6 +932,7 @@ export async function mapTurboWorkspace(
   // over git's files keyed nothing: the workspace probe keys them (item
   // 1032).
   const rootMeta = metas.find((m) => path.resolve(m.dir) === path.resolve(root))
+  const rootPkg = rootMeta?.packageJson ?? (await rootPackageJson(root))
   const globalFiles = [
     ...globalDeps.filter((d) => envDependency(d) === null).map(turboGlobstar),
     ...(rootCfg.globalDotEnv ?? []),
@@ -837,7 +941,7 @@ export async function mapTurboWorkspace(
     // packages that depend on the database package).
     ...(rootCfg.tasks === undefined && rootCfg.pipeline !== undefined
       ? []
-      : rootDependencyGlobs(root, rootMeta?.packageJson ?? (await rootPackageJson(root)), metas)),
+      : rootDependencyGlobs(root, rootPkg, metas)),
     ...microfrontendsConfigs(root, [root, ...metas.map((m) => m.dir)]).map((c) => c.rel),
   ]
   const rootDotenv = globalFiles.filter((f) => isDotenvGlob(f))
@@ -851,18 +955,31 @@ export async function mapTurboWorkspace(
   const globals = {
     inputs: globalFiles.filter((f) => !isDotenvGlob(f) && !globalIgnored.includes(f)),
     env: [
-      ...envNames('globalEnv', rootCfg.globalEnv ?? []),
+      // Turbo's defaults sit before the user's list, so its `!` takes them back.
+      ...envNames('globalEnv', [...TURBO_DEFAULT_ENV, ...(rootCfg.globalEnv ?? [])]),
       ...globalDeps.flatMap((d) => envDependency(d) ?? []),
     ],
-    pass: envNames('globalPassThroughEnv', rootCfg.globalPassThroughEnv ?? []),
+    pass: [
+      ...envNames('globalPassThroughEnv', rootCfg.globalPassThroughEnv ?? []),
+      ...BUILTIN_PASS_THROUGH,
+    ],
   }
 
+  // A written config names no variable by pattern: Turbo's builtin
+  // families are the user's to list, once, for the tasks that read them.
+  if (opts.envNames === undefined && opts.sourceNames !== undefined)
+    notes.push(
+      `Turbo passes every ${TURBO_BUILTIN_PASS_THROUGH.filter((e) => e.endsWith('*')).join(', ')} ` +
+        'variable to each task; the configs pass its literal names only — add the ones a task ' +
+        'reads to exec.env.passThrough',
+    )
+
   // The workspace root as a project (a `vx.config` there, D-39) holds
   // Turbo's `//#task`s (`rootMeta`, above); Turbo runs no plain task in the root package.
   const files = new Map<string, TurboJson>([[ROOT, rootCfg]])
   for (const meta of metas) {
     if (meta === rootMeta) continue
-    const file = await turboConfigFile(meta.dir)
+    const file = await onlyConfigFile(meta.dir, root)
     if (file !== null) files.set(meta.name, await readTurboJson(file, root))
   }
 
@@ -1113,6 +1230,8 @@ export async function mapTurboWorkspace(
         const head = e.slice(0, -1)
         return live.filter((n) => n.startsWith(head)).sort()
       })
+      for (const c of fw.conditionals ?? [])
+        if (opts.envValue?.(c.key) === c.value) names.push(...c.include)
       inferredOf.set(m.name, vendor ? names.filter((n) => !n.startsWith(vendor)) : names)
     } else if (opts.sourceNames !== undefined) {
       // A written config cannot ask the run's environment, and with the
@@ -1125,11 +1244,15 @@ export async function mapTurboWorkspace(
         m.name,
         // The bare prefix is no name: formbricks' web spells `NEXT_PUBLIC_`
         // in a `startsWith` test, and the configs keyed a variable of it.
-        fw.env.flatMap((e) => {
-          if (!e.endsWith('*')) return [e]
-          const head = e.slice(0, -1)
-          return spelled.filter((n) => n.startsWith(head) && n.length > head.length)
-        }),
+        [
+          ...fw.env.flatMap((e) => {
+            if (!e.endsWith('*')) return [e]
+            const head = e.slice(0, -1)
+            return spelled.filter((n) => n.startsWith(head) && n.length > head.length)
+          }),
+          // Written for another environment: keyed whatever the condition.
+          ...(fw.conditionals ?? []).flatMap((c) => c.include),
+        ],
       )
       sourcedOf.set(fw, [...(sourcedOf.get(fw) ?? []), m.name])
     } else usersOf.set(fw, [...(usersOf.get(fw) ?? []), m.name])
@@ -1323,7 +1446,8 @@ export async function mapTurboWorkspace(
       tasks.push(mapped)
     }
     excludeSiblingOutputs(resolveSharedOutputs(tasks))
-    projects.push({ name: meta.name, dir: meta.dir, tasks })
+    const tags = packageTags(meta === rootMeta ? rootCfg : files.get(meta.name))
+    projects.push({ name: meta.name, dir: meta.dir, ...(tags.length > 0 ? { tags } : {}), tasks })
   }
 
   // Turbo 2.11's `dependencyOutputs` input hashes the named files after
@@ -1426,6 +1550,14 @@ export async function mapTurboWorkspace(
     }
   }
 
+  if (keysRootEngines(rootPkg))
+    for (const p of projects)
+      for (const t of p.tasks) {
+        const inputs = t.task?.['inputs'] as Record<string, unknown> | undefined
+        if (inputs === undefined) continue
+        const probes = (inputs['workspaceRuntime'] as unknown[] | undefined) ?? []
+        inputs['workspaceRuntime'] = [...probes, ROOT_ENGINES_PROBE]
+      }
   nestedInputs(root, projects)
   for (const [entry, n] of wildcardUses)
     notes.push(
@@ -1446,9 +1578,42 @@ export async function mapTurboWorkspace(
   pruneUnreachedPersistentNotes(projects, metas, opts.persistentTodo)
   pruneOrphanPersistentNotes(projects, opts.persistentTodo)
   refuseTaskNames(projects, 'task')
+  sortOrderFree(projects)
   return { projects, notes, globals }
 }
 
+function byText(a: unknown, b: unknown): number {
+  const x = typeof a === 'string' ? a : JSON.stringify(a)
+  const y = typeof b === 'string' ? b : JSON.stringify(b)
+  return x < y ? -1 : x > y ? 1 : 0
+}
+
+function negationsLast(a: unknown, b: unknown): number {
+  const neg = (g: unknown) => Number(typeof g === 'string' && g.startsWith('!'))
+  return neg(a) - neg(b) || byText(a, b)
+}
+
+/**
+ * Turbo sorts a task's `outputs` and `dependsOn` before hashing, so
+ * reordering them in turbo.json keeps the hit (vercel/turborepo#2064).
+ * Core keys a config's lists as written, and gives neither list's order a
+ * meaning: an edge set, and a `!` output takes back from the positives
+ * wherever it stands (`outputMatcher`). Sorted here, negations last, so
+ * the reorder keys the same and a written config reads the same.
+ */
+function sortOrderFree(projects: readonly TurboMappedProject[]): void {
+  for (const p of projects)
+    for (const t of p.tasks) {
+      const task = t.task
+      if (task === null) continue
+      if (Array.isArray(task['dependsOn'])) task['dependsOn'] = [...task['dependsOn']].sort(byText)
+      const outputs = task['outputs'] as Record<string, unknown> | undefined
+      if (outputs === undefined) continue
+      for (const k of ['files', 'workspaceFiles'])
+        if (Array.isArray(outputs[k])) outputs[k] = [...outputs[k]].sort(negationsLast)
+    }
+}
+
 /**
  * Turbo hashes a package's files as git lists them, nested workspace
  * packages included (probed on 2.11.6: `a#build` keys `n/x.ts` of a
@@ -1658,16 +1823,12 @@ function keyOnlyGroup(t: TurboMappedTask): TurboMappedTask {
   if (task === null) return t
   const exec = task['exec'] as Record<string, unknown>
   if (exec['persistent'] !== undefined || exec['interactive'] !== undefined) return t
-  const cache = task['cache'] as
-    | { outputs: { files: unknown[]; workspaceFiles?: unknown[] } }
-    | undefined
+  const outputs = task['outputs'] as { files: unknown[]; workspaceFiles?: unknown[] } | undefined
   if (task['inputs'] === undefined && task['dependsOn'] === undefined) return t
-  if (
-    cache !== undefined &&
-    (cache.outputs.files.length > 0 || cache.outputs.workspaceFiles !== undefined)
-  )
+  if (outputs !== undefined && (outputs.files.length > 0 || outputs.workspaceFiles !== undefined))
     return t
-  const { exec: _exec, cache: _cache, ...group } = task
+  const { exec: _exec, ...group } = task
+  uncache(group)
   return { ...t, task: group }
 }
 
@@ -1800,6 +1961,12 @@ function buildTask(
           todos.push(
             `dependsOn ${JSON.stringify(d)}: no workspace package is named ${pkg} — edge dropped`,
           )
+        // Turbo runs a root task only when turbo.json names it `//#x`; the
+        // script alone is not enough (vercel/turborepo#3592).
+        else if (d.startsWith(`${ROOT}#`))
+          todos.push(
+            `dependsOn ${JSON.stringify(d)}: turbo.json defines no "${d}" task — edge dropped`,
+          )
         else
           todos.push(
             `dependsOn ${JSON.stringify(d)}: ${pkg} declares no ${task} script — edge dropped`,
@@ -1961,6 +2128,14 @@ function buildTask(
     if (files.length > 0 && files.every((f) => typeof f === 'string' && f.startsWith('!'))) {
       files.unshift('**/*')
     }
+    // Turbo keys the package's own package.json beside any explicit
+    // `inputs` (PACKAGE_CONFIG_INPUTS, turborepo#1832): without it, an edit
+    // to its `exports` or `type` replayed the old build. A glob naming it
+    // already, or an exclusion of it, is left as written.
+    const named = files.some(
+      (g) => typeof g === 'string' && new Bun.Glob(g.replace(/^!/, '')).match('package.json'),
+    )
+    if (!named) files.push('package.json')
   }
   // Turbo 1's task `dotEnv`: package-relative `.env` files it hashes,
   // gitignored as a rule, so read as files they keyed nothing (item 1032).
@@ -2038,7 +2213,7 @@ function buildTask(
     } else if (o.includes('$TURBO_ROOT$')) {
       todos.push(
         `output ${JSON.stringify(o)}: $TURBO_ROOT$ only maps as a '$TURBO_ROOT$/<path>' ` +
-          'prefix (→ cache.outputs.workspaceFiles) — map manually',
+          'prefix (→ outputs.workspaceFiles) — map manually',
       )
     } else outFiles.push(...signed(o))
   }
@@ -2072,12 +2247,18 @@ function buildTask(
   const rewritesManifest = takeBacks.includes('!package.json')
 
   if (atRoot) wsOutFiles.unshift(...outFiles.splice(0))
-  const outputs: Record<string, unknown> = { files: takingBack(outFiles) }
-  const ws = takingBack(wsOutFiles)
+  // Sorted here, before the passes that take them back from other tasks'
+  // inputs, so those `!` entries come in this order too (`sortOrderFree`).
+  const outputs: Record<string, unknown> = { files: takingBack(outFiles).sort(negationsLast) }
+  const ws = takingBack(wsOutFiles).sort(negationsLast)
   if (ws.length > 0) outputs.workspaceFiles = ws
-  task.cache = {
-    outputs,
-    ...(rewritesManifest ? { inputStability: { strategy: 'mutable' } } : {}),
+  task.outputs = outputs
+  task.cache = true
+  if (rewritesManifest) {
+    task.inputs = {
+      ...(task.inputs as Record<string, unknown>),
+      stability: { strategy: 'mutable' },
+    }
   }
 
   return { name, todos, task, uses }