@vzn/vx-migrate 0.0.650 → 0.0.652

package/src/turbo/turbo-reads.ts

@@ -37,6 +37,8 @@ export const FRAMEWORK_ENV: ReadonlyArray<{
   env: readonly string[]
   all: boolean
   dependencies: readonly string[]
+  /** Turbo's `envConditionals`: `include` is keyed while `key` holds `value`. */
+  conditionals?: ReadonlyArray<{ key: string; value: string; include: readonly string[] }>
 }> = [
   { slug: 'astro', env: ['PUBLIC_*'], all: true, dependencies: ['astro'] },
   { slug: 'blitzjs', env: ['NEXT_PUBLIC_*'], all: true, dependencies: ['blitz'] },
@@ -53,6 +55,10 @@ export const FRAMEWORK_ENV: ReadonlyArray<{
     env: ['NEXT_PUBLIC_*', 'NEXT_DEPLOYMENT_ID'],
     all: true,
     dependencies: ['next'],
+    // Skew protection builds the deployment id into the app (vercel/turborepo#9853).
+    conditionals: [
+      { key: 'VERCEL_SKEW_PROTECTION_ENABLED', value: '1', include: ['VERCEL_DEPLOYMENT_ID'] },
+    ],
   },
   {
     slug: 'nitro',
@@ -85,20 +91,105 @@ export const FRAMEWORK_ENV: ReadonlyArray<{
   },
 ]
 
+/** The variables each framework conditional reads; a live mapping is keyed on their values. */
+export const ENV_CONDITION_KEYS: readonly string[] = FRAMEWORK_ENV.flatMap((f) =>
+  (f.conditionals ?? []).map((c) => c.key),
+)
+
+// Turbo's own env, from crates/turborepo-env (2026-10-27, edace4621): the
+// promise is a Turbo repo run unchanged, so these mirror it exactly.
+/** `DEFAULT_ENV_VARS`: hashed into every task as if listed in `globalEnv` (a `!` there takes them back). */
+export const TURBO_DEFAULT_ENV: readonly string[] = ['VERCEL_ANALYTICS_ID', 'VERCEL_TARGET_ENV']
+/** `BUILTIN_PASS_THROUGH_ENV`: passed to every task, never hashed. */
+export const TURBO_BUILTIN_PASS_THROUGH: readonly string[] = [
+  'HOME',
+  'USER',
+  'TZ',
+  'LANG',
+  'SHELL',
+  'PWD',
+  'XDG_DATA_*',
+  'XDG_RUNTIME_DIR',
+  'XAUTHORITY',
+  'DBUS_SESSION_BUS_ADDRESS',
+  'CI',
+  'NODE_OPTIONS',
+  'COREPACK_*',
+  'LD_LIBRARY_PATH',
+  'DYLD_FALLBACK_LIBRARY_PATH',
+  'LIBPATH',
+  'LD_PRELOAD',
+  'DYLD_INSERT_LIBRARIES',
+  'COLORTERM',
+  'FORCE_COLOR',
+  'NO_COLOR',
+  'TERM',
+  'TERM_PROGRAM',
+  'DISPLAY',
+  'TMP',
+  'TEMP',
+  'WINDIR',
+  'ProgramFiles',
+  'ProgramFiles(x86)',
+  'VSCODE_*',
+  'ELECTRON_RUN_AS_NODE',
+  'DOCKER_*',
+  'BUILDKIT_*',
+  'COMPOSE_*',
+  'JB_IDE_*',
+  'JB_INTERPRETER',
+  '_JETBRAINS_TEST_RUNNER_RUN_SCOPE_TYPE',
+  'TURBO_*',
+  'VERCEL',
+  'VERCEL_*',
+  'NEXT_*',
+  'USE_OUTPUT_FOR_EDGE_FUNCTIONS',
+  'NOW_BUILDER',
+  'VC_MICROFRONTENDS_CONFIG_FILE_NAME',
+  'GITHUB_*',
+  'RUNNER_*',
+  '__NIXOS_*',
+  'NIX_*',
+  'APPDATA',
+  'LOCALAPPDATA',
+  'PATH',
+  'PROGRAMDATA',
+  'SYSTEMROOT',
+  'SYSTEMDRIVE',
+  'USERPROFILE',
+  'HOMEDRIVE',
+  'HOMEPATH',
+  'PNPM_HOME',
+  'pnpm_config_verify_deps_before_run',
+  'NPM_CONFIG_STORE_DIR',
+  'COMSPEC',
+  'PATHEXT',
+]
+
 /** A name core takes in `inputs.env` and `exec.env.passThrough`. */
 export const keyable = (name: string): boolean =>
   name.length > 0 && !name.startsWith('!') && !/[*?[\]{}=\0]/.test(name)
 
 /**
  * The names of `names` a live mapping can read differently: each a `*` in
- * one of `configs` (turbo.json texts, any string, a superset) or in Turbo's
- * framework table matches, and each core cannot key (a literal one is
+ * one of `configs` (turbo.json texts, any string, a superset), in Turbo's
+ * framework table or in its builtin env matches, each of those tables'
+ * literals, and each core cannot key (a literal one is
  * dropped only when no variable has it). The kept mapping keyed on every
  * name, so any variable that came or went (a CI step's, `VX_DEBUG_TIMING`)
  * remapped the workspace: ~330 ms a run on vercel/ai.
  */
 export function envNamesThatMap(configs: readonly string[], names: readonly string[]): string[] {
-  const patterns = new Set(FRAMEWORK_ENV.flatMap((f) => f.env).filter((e) => e.includes('*')))
+  const patterns = new Set(
+    [...FRAMEWORK_ENV.flatMap((f) => f.env), ...TURBO_BUILTIN_PASS_THROUGH].filter((e) =>
+      e.includes('*'),
+    ),
+  )
+  // A builtin or conditional literal is passed or keyed only when set.
+  const literals = new Set([
+    ...TURBO_BUILTIN_PASS_THROUGH.filter((e) => !e.includes('*')),
+    ...FRAMEWORK_ENV.flatMap((f) => (f.conditionals ?? []).flatMap((c) => c.include)),
+  ])
   for (const text of configs)
     for (const m of text.matchAll(/"((?:[^"\\]|\\.)*)"/g))
       if (m[1]!.includes('*')) patterns.add(m[1]!)
@@ -110,7 +201,7 @@ export function envNamesThatMap(configs: readonly string[], names: readonly stri
         `^${p.replaceAll('\\', '').replace(/^!/, '').split('*').map(RegExp.escape).join('.*')}$`,
       ),
   )
-  return names.filter((n) => !keyable(n) || res.some((re) => re.test(n)))
+  return names.filter((n) => !keyable(n) || literals.has(n) || res.some((re) => re.test(n)))
 }
 
 /**

package/src/turbo-cache/index.ts

@@ -23,6 +23,7 @@ import {
   type RemoteOpenContext,
   type VxPlugin,
   refuseUnknownOptions,
+  ui,
   UserError,
   type PluginOptionKinds,
 } from '@vzn/vx'
@@ -265,7 +266,7 @@ export function resolveTurboCacheConfig(
   file: TurboJsonRemoteCache = {},
   /** The repo's `.turbo/config.json` (`turbo link` writes it): below the environment, above turbo.json. */
   local: TurboLocalConfig = {},
-  warn: (message: string) => void = (m) => console.error(`[vx] plugin '@vzn/vx-migrate': ${m}`),
+  warn: (message: string) => void = (m) => ui.say('warn', `[vx] plugin '@vzn/vx-migrate': ${m}`),
 ): TurboCacheConfig | undefined {
   // `enabled: false` turns Turbo's remote cache off whatever the env says;
   // options name a cache for vx alone, and win.
@@ -301,10 +302,20 @@ export function resolveTurboCacheConfig(
     fromFile(file.teamId)
   const teamSlug =
     options.teamSlug ?? set('TURBO_TEAM') ?? fromFile(local.teamSlug) ?? fromFile(file.teamSlug)
-  // Turbo's own default when a token or a team is set and no URL is:
-  // Vercel's hosted Remote Cache. A token alone is a configured cache, as it
-  // is for `turbo`; a URL or a team without one asks the OS keychain at
-  // `open`; none of them is the declined, local run.
+  // Turbo uses its remote only when linked, a team set (`is_linked`): a
+  // token without one ran remote here, team-less, where `turbo` runs local.
+  // An option naming the cache is vx's own, and stands.
+  const named =
+    options.url !== undefined || options.token !== undefined || options.oidc !== undefined
+  if (!named && teamId === undefined && teamSlug === undefined) {
+    if (token !== undefined)
+      warn(
+        'a Turbo token is set but no team (TURBO_TEAM, TURBO_TEAMID or .turbo/config.json): remote cache off for this run, as for turbo',
+      )
+    return undefined
+  }
+  // Turbo's own default when no URL is set: Vercel's hosted Remote Cache.
+  // A team without a token asks the OS keychain at `open`.
   // Each source with its name: TURBO_API was refused as a `url`
   // option the workspace never set.
   const [rawUrl, urlFrom] =
@@ -899,16 +910,31 @@ export class TurboRemoteCache implements RemoteCacheLayer {
 /**
  * The repo's `.turbo/config.json`, by Turbo's field names and their
  * aliases (`apiurl`, `ApiUrl`, `APIURL`, …); `{}` when absent or unreadable.
+ * One that does not parse is named: Turbo refuses it, and read as absent
+ * in silence a linked repo lost its remote with no word.
  */
-function localConfigOf(root: string): TurboLocalConfig {
-  let raw: unknown
+function localConfigOf(root: string, warn: (message: string) => void): TurboLocalConfig {
+  let text: string
   try {
-    raw = JSON.parse(readFileSync(path.join(root, '.turbo', 'config.json'), 'utf8'))
+    text = readFileSync(path.join(root, '.turbo', 'config.json'), 'utf8')
     // quiet: a local config file: none read is none linked
   } catch {
     return {}
   }
-  if (typeof raw !== 'object' || raw === null) return {}
+  let raw: unknown
+  try {
+    raw = JSON.parse(text)
+  } catch (err) {
+    warn(
+      `.turbo/config.json does not parse as a JSON object (${(err as Error).message}): read as absent`,
+    )
+    return {}
+  }
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+    const kind = Array.isArray(raw) ? 'an array' : raw === null ? 'null' : `a ${typeof raw}`
+    warn(`.turbo/config.json does not parse as a JSON object (${kind}): read as absent`)
+    return {}
+  }
   const byLower = new Map(Object.entries(raw).map(([k, v]) => [k.toLowerCase(), v]))
   return {
     apiUrl: byLower.get('apiurl'),
@@ -1004,12 +1030,13 @@ export function turboCache(options: TurboCacheOptions = {}): VxPlugin {
   let opened: { layer: TurboRemoteCache; warn: (m: string) => void } | undefined
   return definePlugin(import.meta, {
     cache(ctx): RemoteCacheLayer | undefined {
+      const warn = (m: string) => ctx.warn(`[vx] plugin '@vzn/vx-migrate': ${m}`)
       const config = resolveTurboCacheConfig(
         options,
         Bun.env,
         remoteCacheOf(ctx.workspaceRoot),
-        localConfigOf(ctx.workspaceRoot),
-        (m) => ctx.warn(`[vx] plugin '@vzn/vx-migrate': ${m}`),
+        localConfigOf(ctx.workspaceRoot, warn),
+        warn,
       )
       if (config === undefined) return undefined
       // A signed download waits in a temp until its tag checks: in vx's

package/src/vite-task/vite-task-map.ts

@@ -396,7 +396,7 @@ function autoTodo(what: string, known?: Record<string, unknown>): string {
   const have = known === undefined ? '' : ` (declared so far: \`${JSON.stringify(known)}\`)`
   return (
     `cache: Vite Task traced this task's ${what} and vx infers none — add ` +
-    `\`inputs: { files: [...] }, cache: { outputs: { files: [...] } }\` with the real ones${have}; ` +
+    `\`inputs: { files: [...] }, outputs: { files: [...] }, cache: true\` with the real ones${have}; ` +
     'without it the task always runs'
   )
 }
@@ -481,7 +481,8 @@ function mapTask(name: string, def: TaskDef, ctx: TaskCtx): GeneratedTask {
     todos.push(ownFileTodo(ownFile))
     return { name, todos, task }
   }
-  task['cache'] = { outputs: outputs.lists }
+  task['outputs'] = outputs.lists
+  task['cache'] = true
   return { name, todos, task }
 }