@vzn/vx-migrate 0.0.652 → 0.0.653

package/src/turbo-cache/index.ts

@@ -29,7 +29,7 @@ import {
 } from '@vzn/vx'
 import { deadline, MAX_TIMER_MS } from '../remote-deadline.js'
 import { checkRemoteUrl } from '../remote-url.js'
-import { refusal } from '../remote-refusal.js'
+import { hideTokens, hidingErrors, refusal } from '../remote-refusal.js'
 import { keyedByRef, readScopes, remoteScope, type RemoteScope } from './scope.js'
 import { OutageBreaker } from '../remote-breaker.js'
 import { Cooldown, withRetry } from '../remote-retry.js'
@@ -588,8 +588,14 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     }
   }
 
+  /** Every bearer a request carried: a refusal that quotes one says `***`. */
+  private readonly sent = new Set<string>()
+  private readonly hidden = (text: string): string => hideTokens(text, this.sent)
+
   private bearer(): string | undefined {
-    return this.borrowed?.() ?? this.token
+    const token = this.borrowed?.() ?? this.token
+    if (token !== undefined) this.sent.add(token)
+    return token
   }
 
   private url(pathname: string): string {
@@ -619,7 +625,9 @@ export class TurboRemoteCache implements RemoteCacheLayer {
    * never reaches a third-party store. The answer's status is not read, as
    * in Turbo. A redirect is not followed: its `Location` is the answer, and
    * the token's verdict stays the API's. Following one let the redirected
-   * host's `Access-Control-Allow-Headers` admit the token to itself.
+   * host's `Access-Control-Allow-Headers` admit the token to itself. A
+   * `Location` that is not http(s), or plain http the token would go to
+   * from an https API, is a request error.
    */
   private async preflight(
     url: string,
@@ -641,12 +649,21 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     await res.body?.cancel()
     const location = res.headers.get('location')
     const allowed = res.headers.get('access-control-allow-headers') ?? ''
-    return {
-      url: location === null ? url : new URL(location, this.config.url).toString(),
-      auth:
-        allowed.trim() === '*' ||
-        allowed.split(',').some((h) => h.trim().toLowerCase() === 'authorization'),
-    }
+    const auth =
+      allowed.trim() === '*' ||
+      allowed.split(',').some((h) => h.trim().toLowerCase() === 'authorization')
+    if (location === null) return { url, auth }
+    const to = new URL(location, this.config.url)
+    // `checkRemoteUrl` saw only the configured URL. A `file:` Location read
+    // a local file as the artifact, and a PUT to it "succeeded" storing
+    // nothing.
+    if (to.protocol !== 'http:' && to.protocol !== 'https:')
+      throw new Error(`the preflight pointed at ${to.protocol}, not an http(s) URL`)
+    if (auth && to.protocol === 'http:' && new URL(this.config.url).protocol === 'https:')
+      throw new Error(
+        `the preflight pointed an https API at ${to.origin}, which would send the token in the clear`,
+      )
+    return { url: to.toString(), auth }
   }
 
   /**
@@ -666,27 +683,30 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     const signal = () => (timeoutMs === 0 ? undefined : deadline(timeoutMs))
     // The batch query is never preflighted, as in Turbo.
     const preflight = this.config.preflight && method !== 'POST'
-    const res = await this.breaker.send(
-      () =>
-        withRetry(
-          async () => {
-            const extra = init.headers ?? {}
-            const to = preflight
-              ? await this.preflight(this.url(pathname), method, extra, signal)
-              : { url: this.url(pathname), auth: true }
-            const s = signal()
-            return this.fetchImpl(to.url, {
-              method,
-              headers: this.headers(extra, to.auth),
-              ...(init.body === undefined ? {} : { body: init.body }),
-              ...(s === undefined ? {} : { signal: s }),
-            })
-          },
-          this.config.retries,
-          this.wait,
-          this.cooldown,
-        ),
-      method === 'GET',
+    const res = await hidingErrors(
+      this.breaker.send(
+        () =>
+          withRetry(
+            async () => {
+              const extra = init.headers ?? {}
+              const to = preflight
+                ? await this.preflight(this.url(pathname), method, extra, signal)
+                : { url: this.url(pathname), auth: true }
+              const s = signal()
+              return this.fetchImpl(to.url, {
+                method,
+                headers: this.headers(extra, to.auth),
+                ...(init.body === undefined ? {} : { body: init.body }),
+                ...(s === undefined ? {} : { signal: s }),
+              })
+            },
+            this.config.retries,
+            this.wait,
+            this.cooldown,
+          ),
+        method === 'GET',
+      ),
+      this.hidden,
     )
     if (method === 'PUT' && res.status === 403) {
       const first = !this.writesRefused
@@ -695,14 +715,14 @@ export class TurboRemoteCache implements RemoteCacheLayer {
       // The status and the server's own words (`refusal`): a scope it
       // refuses and a token it no longer takes read alike.
       throw new Error(
-        `${(await refusal(res)).message}: the upload was refused (a read-only token or server); uploads off for this run, reads go on`,
+        `${(await refusal(res, this.hidden)).message}: the upload was refused (a read-only token or server); uploads off for this run, reads go on`,
       )
     }
     if (res.status === 401 || res.status === 403) {
       const first = !this.disabled
       this.disabled = true
       if (!first) return undefined
-      const said = (await refusal(res)).message
+      const said = (await refusal(res, this.hidden)).message
       if (this.forget === undefined)
         throw new Error(`${said}: the token was refused; remote cache off for this run`)
       await this.forget()
@@ -764,7 +784,7 @@ export class TurboRemoteCache implements RemoteCacheLayer {
         await res.body?.cancel()
         return null
       }
-      throw await refusal(res, 'batch query answered ')
+      throw await refusal(res, this.hidden, 'batch query answered ')
     }
     // An answer per hash is a few hundred bytes of ArtifactInfo; a reply
     // past this bound is no answer, read no further than the bound (L-9).
@@ -802,21 +822,25 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     return held
   }
 
-  async get(hash: string): Promise<{ body: Response; durationMs: number | undefined } | null> {
-    if (this.disabled) return null
+  async get(
+    hash: string,
+  ): Promise<{ body: Response; durationMs: number | undefined } | null | undefined> {
+    // Off, or refused: no answer, which core keeps apart from a miss (a
+    // null forgot each hit the index kept, the remote never asked).
+    if (this.disabled) return undefined
     // A gateway that keys binary media on Accept base64-encodes a `*/*`
     // response, and every hit read as a corrupt artifact (nx#33092's class).
     const res = await this.request('GET', `/${hash}`, {
       headers: { Accept: 'application/octet-stream', ...this.reads },
     })
-    if (res === undefined) return null
+    if (res === undefined) return undefined
     if (res.status !== 200) {
       if (res.status === 404) {
         await res.body?.cancel()
         this.absent.add(hash)
         return null
       }
-      throw await refusal(res)
+      throw await refusal(res, this.hidden)
     }
     this.served.add(hash)
     const duration = Number(res.headers.get('x-artifact-duration'))
@@ -870,10 +894,17 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     this.absent.add(hash)
   }
 
-  async put(hash: string, body: Blob, meta: { durationMs: number }): Promise<void | false> {
+  async put(
+    hash: string,
+    body: Blob,
+    meta: { durationMs: number; replace?: true },
+  ): Promise<void | false> {
     // Nothing sent, so no upload is counted.
     if (this.disabled || this.writesRefused) return false
-    if (!this.absent.has(hash) && !this.served.has(hash)) {
+    // `replace`: the copy there did not read back, maybe on another machine
+    // of the run (a vx-dte worker), so a HEAD's 200 is the bad copy. Turbo's
+    // PUT writes over a held key.
+    if (meta.replace !== true && !this.absent.has(hash) && !this.served.has(hash)) {
       // Part of the upload, so under its deadline. Any answer but 200 or 404
       // uploads: a lost store costs more. A server the HEAD cannot reach
       // fails the put, as the PUT would.
@@ -901,7 +932,7 @@ export class TurboRemoteCache implements RemoteCacheLayer {
     if (res === undefined) return false
     // Turbo's client takes any 2xx (`error_for_status`); a server's 201 or
     // 204 stored the artifact and was counted a failed upload.
-    if (!res.ok) throw await refusal(res)
+    if (!res.ok) throw await refusal(res, this.hidden)
     this.absent.delete(hash)
     this.served.delete(hash)
   }

package/src/turbo-cache/oidc.ts

@@ -5,6 +5,7 @@
 // 2026-10-17); any other server names its token URL.
 
 import { deadline } from '../remote-deadline.js'
+import { hideTokens } from '../remote-refusal.js'
 
 /** `turboCache({ oidc })`: `true` is Vercel's hosted cache with its defaults. */
 export interface TurboOidcOptions {
@@ -103,14 +104,15 @@ const where = (url: string) => (URL.canParse(url) ? new URL(url).host : 'the end
  * A refusal's own words: RFC 6749's `error` and `error_description`, or
  * GitHub's `message`. Only those fields, which name a fault and never
  * carry a token; any other body is left unread. "answered HTTP 400" alone
- * did not say the audience or the grant was wrong.
+ * did not say the audience or the grant was wrong. A server may still
+ * quote what it was `sent`: each token is written `***` before the cut.
  */
-async function refused(res: Response, what: string): Promise<Error> {
+async function refused(res: Response, what: string, sent: readonly string[]): Promise<Error> {
   // quiet: a body that is not JSON says nothing; the status still names the refusal
   const body = (await res.json().catch(() => null)) as Record<string, unknown> | null
   const text = (v: unknown): string | undefined =>
     typeof v === 'string' && v.trim() !== ''
-      ? v.replace(/\s+/g, ' ').trim().slice(0, 200)
+      ? hideTokens(v, sent).replace(/\s+/g, ' ').trim().slice(0, 200)
       : undefined
   const said = [text(body?.['error']), text(body?.['error_description']) ?? text(body?.['message'])]
     .filter((s) => s !== undefined)
@@ -118,8 +120,13 @@ async function refused(res: Response, what: string): Promise<Error> {
   return new Error(`${what} answered HTTP ${res.status}${said === '' ? '' : `: ${said}`}`)
 }
 
-async function field(res: Response, name: string, what: string): Promise<string> {
-  if (!res.ok) throw await refused(res, what)
+async function field(
+  res: Response,
+  name: string,
+  what: string,
+  sent: readonly string[],
+): Promise<string> {
+  if (!res.ok) throw await refused(res, what, sent)
   const value = ((await res.json().catch(() => null)) as Record<string, unknown> | null)?.[name]
   if (typeof value !== 'string' || value === '') throw new Error(`${what} sent no ${name}`)
   return value
@@ -148,6 +155,7 @@ export async function exchangeOidc(
     ),
     'value',
     `GitHub's OIDC endpoint (${where(cfg.idTokenUrl)})`,
+    [cfg.idTokenBearer],
   )
   const res = await send(
     fetchImpl,
@@ -162,7 +170,7 @@ export async function exchangeOidc(
     wait,
   )
   const what = `the token exchange (${where(cfg.tokenUrl)})`
-  if (!res.ok) throw await refused(res, what)
+  if (!res.ok) throw await refused(res, what, [idToken])
   const body = (await res.json().catch(() => null)) as Record<string, unknown> | null
   const token = body?.['access_token']
   if (typeof token !== 'string' || token === '') throw new Error(`${what} sent no access_token`)
@@ -192,6 +200,6 @@ export async function revokeOidc(
     }),
     wait,
   )
-  if (!res.ok) throw await refused(res, `revoking at ${where(cfg.revokeUrl)}`)
+  if (!res.ok) throw await refused(res, `revoking at ${where(cfg.revokeUrl)}`, [token])
   await res.body?.cancel()
 }

package/src/workspace-notes.ts

@@ -1,12 +1,13 @@
 // What the written configs leave to .vx/workspace.ts, said once by both
 // migrators: the adoption plugin `vx init` declared still reads the old
 // tool's file every run, and the old tool keyed each package on its own
-// lockfile entries where core keys every task on the whole lockfile.
-// Without a lockfile plugin a dependency bump re-ran every task (hey-api:
-// a `pnpm-lock.yaml` edit re-keyed all 42 builds, none with `pnpm()`).
+// lockfile entries where core keys no lockfile (#3562): without a
+// lockfile plugin a dependency bump re-runs nothing, and a cached task
+// replays output built on the old versions.
 
 import { existsSync } from 'node:fs'
 import path from 'node:path'
+import type { PackageManager } from './adopt.js'
 
 /** Each lockfile and the `@vzn/vx-lockfile` plugin that claims it. */
 const LOCKFILES: ReadonlyArray<readonly [file: string, plugin: string]> = [
@@ -18,9 +19,18 @@ const LOCKFILES: ReadonlyArray<readonly [file: string, plugin: string]> = [
   ['yarn.lock', 'yarn'],
 ]
 
-/** The lockfile at `root` and the `@vzn/vx-lockfile` factory that claims it. */
-export function lockfilePlugin(root: string): { file: string; factory: string } | undefined {
-  const lock = LOCKFILES.find(([file]) => existsSync(path.join(root, file)))
+/**
+ * The lockfile at `root` and the `@vzn/vx-lockfile` factory that claims it.
+ * With none there, `installer`'s: the manager this run installs with
+ * writes it, and the lock that follows needs its plugin for `^` edges.
+ */
+export function lockfilePlugin(
+  root: string,
+  installer?: PackageManager,
+): { file: string; factory: string } | undefined {
+  const lock =
+    LOCKFILES.find(([file]) => existsSync(path.join(root, file))) ??
+    LOCKFILES.find(([, factory]) => factory === installer)
   return lock === undefined ? undefined : { file: lock[0], factory: lock[1] }
 }
 
@@ -58,8 +68,9 @@ export async function adoptedToolNotes(root: string, tool: AdoptedTool): Promise
   const lock = lockfilePlugin(root)
   if (lock !== undefined && !new RegExp(`\\b${lock.factory}\\s*\\(`).test(declared))
     notes.push(
-      `${tool.keys(lock.file)}; vx keys every task on the whole ` +
-        `file, so a dependency bump re-runs them all. Declare ${lock.factory}() from @vzn/vx-lockfile ` +
+      `${tool.keys(lock.file)}; vx keys no lockfile by itself, so a dependency bump re-runs ` +
+        'nothing and a cached task replays output built on the old versions. ' +
+        `Declare ${lock.factory}() from @vzn/vx-lockfile ` +
         "in .vx/workspace.ts to key each task on its package's dependency closure",
     )
   return notes

package/src/workspace-plugins.ts

@@ -6,6 +6,7 @@
 
 import { existsSync } from 'node:fs'
 import path from 'node:path'
+import type { PackageManager } from './adopt.js'
 import { REMOTE_CACHE, remoteCacheSignal } from './remote-cache.js'
 import { lockfilePlugin } from './workspace-notes.js'
 
@@ -16,12 +17,19 @@ export interface WorkspacePlugin {
   readonly factory: string
 }
 
-/** `runner`: the Turbo or Nx repo's own remote cache, where the repo shows one. */
-export function workspacePlugins(root: string, runner?: 'turbo' | 'nx'): WorkspacePlugin[] {
+/**
+ * `runner`: the Turbo or Nx repo's own remote cache, where the repo shows
+ * one. `installer`: the manager this run installs with (`lockfilePlugin`).
+ */
+export function workspacePlugins(
+  root: string,
+  runner?: 'turbo' | 'nx',
+  installer?: PackageManager,
+): WorkspacePlugin[] {
   const out: WorkspacePlugin[] = []
   if (runner !== undefined && remoteCacheSignal(root, runner) !== undefined)
     out.push({ pkg: '@vzn/vx-migrate', factory: REMOTE_CACHE[runner] })
-  const lock = lockfilePlugin(root)
+  const lock = lockfilePlugin(root, installer)
   if (lock !== undefined) out.push({ pkg: '@vzn/vx-lockfile', factory: lock.factory })
   out.push({ pkg: '@vzn/vx-history', factory: 'vxHistory' })
   if (existsSync(path.join(root, '.github', 'workflows')))