@vzn/vx-lockfile 0.0.640 → 0.0.642

package/README.md

@@ -32,10 +32,10 @@ That is the whole setup. The plugin **claims** its lockfile and its manager's in
 
 Every package the project can reach, by resolved identity (name, version, integrity), and under bun and npm by the name it installs under, not where it sits, so a re-hoist of one version re-keys nothing, plus the install-wide material every project folds — and **the root package's own closure**. The root's `dependencies` and `devDependencies` reach every task: their bins run from the root `node_modules/.bin`, which vx puts on every task's PATH, and Node's resolution walks up to the root `node_modules` (`@types/*`, a plugin a root tool's config names). So a root devDependency bump (`pnpm add -Dw oxlint@next`) re-keys every project and `--affected` selects every project; a package only project A reaches still moves only A. A root `workspace:` dependency folds that package's closure into every project too. Per manager:
 
-- **pnpm** (`pnpm-lock.yaml`, lockfile v5, v6, v9): importers → snapshots, transitively; each package by name, version **and resolved peers** (`foo@1(react@18)` is not `foo@1(react@19)`), resolution and any `patchedDependencies` entry; `link:` folds the linked importer's reach, and a `file:` directory dependency folds its own closure (v9 keys it `name@file:…`, v5/v6 by the bare `file:…`); every other top-level field but `overrides` and the catalogs, whose effect is the snapshot an importer reaches (`settings`, `packageExtensionsChecksum`, `pnpmfileChecksum`, `ignoredOptionalDependencies`, v6's `onlyBuiltDependencies`, and any field pnpm adds later) and the lockfile version into every project. A multi-document lockfile (pnpm 10.x and 11 write the env lockfile — `configDependencies`, the package manager's own install — ahead of the project's) reads its last document as the lockfile and folds the ones before it into every project.
-- **bun** (`bun.lock`; a `bun.lockb` alone is refused — it is binary — naming `bun install --save-text-lockfile`, which writes `bun.lock`): Bun's hoisted layout — a dependency `d` of the package at path `p` is `p/d` when that key exists, else the nearest ancestor's, else the root's, so a nested version counts for the package it is nested under and no other; `workspace:` entries fold the linked package's reach; each `patchedDependencies` entry and the CONTENT of its patch file (bun.lock records only its path) with the package it patches, so a patch edit re-keys only the projects reaching it; every top-level field but `workspaces`, `packages`, the catalogs, `overrides` and `patchedDependencies` (`trustedDependencies`, and any field Bun adds later), and any patch naming no entry, into every project — a catalog bump reaches only the projects whose `catalog:` dependency resolves anew, through the `packages` entry it installs.
-- **npm** (`npm-shrinkwrap.json` when present, as npm reads it, else `package-lock.json`; lockfileVersion 2 and 3): the `packages` map — `p/node_modules/d`, then each ancestor directory's (a workspace nested in another's directory resolves through the outer one's `node_modules`, as Node does), then `node_modules/d`; a `link: true` entry folds its target workspace's reach; root `overrides` reach a project through the entries they force (npm 10 does not write them to the lockfile). Version 1 (npm 6) has no `packages` map and is refused.
-- **yarn** (`yarn.lock`): berry (yarn 2+) resolves `name@npm:range` descriptors to entries, workspaces included, each entry folding every field but its dependency lists (so the root workspace's `dependenciesMeta` reaches every project), `__metadata`'s `version` and `cacheKey` into every project. A Yarn 4 catalog dependency (`catalog:`, `catalog:<name>`) is recorded as that literal and its range lives in `.yarnrc.yml`, so it reaches every entry of its package: a bump of any of them re-keys the workspace. So does a descriptor the file does not key: a root `resolutions` override (to a `patch:`, or another range) leaves the original descriptor out of `yarn.lock`, and the entry installed in its place is reached through the package's name, so a patch edit re-keys the workspaces that depend on it. A path range (`portal:`, `file:`, `link:`) reaches the entry keyed bound to the package naming it (`::locator=…`), not another workspace's of the same name. Yarn's builtin compat patches (`resolve`, `typescript`, `fsevents`) are reached too: the workspace asks for the plain descriptor, and the patched entry is the one Yarn installs. `yarn()` claims `.yarnrc.yml` and folds it into every task, so a catalog edit re-keys every project, as a `pnpm-workspace.yaml` edit does under `pnpm()`. Classic (yarn 1) records no workspaces, so it yields one digest for the root that every project folds — coarse, and honest about what the file records — and no project edges (below).
+- **pnpm** (`pnpm-lock.yaml`, lockfile v5, v6, v9): importers → snapshots, transitively; each package by name, version **and resolved peers** (`foo@1(react@18)` is not `foo@1(react@19)`), resolution and any `patchedDependencies` entry; `link:` folds the linked importer's reach, or the CONTENT of a linked directory that is no importer, and a `file:` directory dependency folds its own closure (v9 keys it `name@file:…`, v5/v6 by the bare `file:…`) and the CONTENT of the directory (pnpm copies it at install and records only its path; its `node_modules` and `.git` aside), so an edit in it re-keys the projects reaching it; every other top-level field but `overrides` and the catalogs, whose effect is the snapshot an importer reaches (`settings`, `packageExtensionsChecksum`, `pnpmfileChecksum`, `ignoredOptionalDependencies`, v6's `onlyBuiltDependencies`, and any field pnpm adds later) and the lockfile version into every project. A multi-document lockfile (pnpm 10.x and 11 write the env lockfile — `configDependencies`, the package manager's own install — ahead of the project's) reads its last document as the lockfile and folds the ones before it into every project.
+- **bun** (`bun.lock`; a `bun.lockb` alone is refused — it is binary — naming `bun install --save-text-lockfile`, which writes `bun.lock`): Bun's hoisted layout — a dependency `d` of the package at path `p` is `p/d` when that key exists, else the nearest ancestor's, else the root's, so a nested version counts for the package it is nested under and no other; `workspace:` entries fold the linked package's reach; each `patchedDependencies` entry and the CONTENT of its patch file (bun.lock records only its path) with the package it patches, so a patch edit re-keys only the projects reaching it; a `file:` directory dependency with the CONTENT of the directory, as under pnpm; every top-level field but `workspaces`, `packages`, the catalogs, `overrides` and `patchedDependencies` (`trustedDependencies`, and any field Bun adds later), and any patch naming no entry, into every project — a catalog bump reaches only the projects whose `catalog:` dependency resolves anew, through the `packages` entry it installs.
+- **npm** (`npm-shrinkwrap.json` when present, as npm reads it, else `package-lock.json`; lockfileVersion 2 and 3): the `packages` map — `p/node_modules/d`, then each ancestor directory's (a workspace nested in another's directory resolves through the outer one's `node_modules`, as Node does), then `node_modules/d`; a `link: true` entry folds its target workspace's reach, and one to a `file:` directory (an entry outside the root's `workspaces` globs) the CONTENT of the directory, as under pnpm, since npm links it; root `overrides` reach a project through the entries they force (npm 10 does not write them to the lockfile). Version 1 (npm 6) has no `packages` map and is refused.
+- **yarn** (`yarn.lock`): berry (yarn 2+) resolves `name@npm:range` descriptors to entries, workspaces included, each entry folding every field but its dependency lists (so the root workspace's `dependenciesMeta` reaches every project), `__metadata`'s `version` and `cacheKey` into every project. A Yarn 4 catalog dependency (`catalog:`, `catalog:<name>`) is recorded as that literal and its range lives in `.yarnrc.yml`, so it reaches every entry of its package: a bump of any of them re-keys the workspace. So does a descriptor the file does not key, as when a root `resolutions` override rewrote it to another range: the entry installed in its place is reached through the package's name, so changing it re-keys the workspaces that depend on it. A path range (`portal:`, `file:`, `link:`) reaches the entry keyed bound to the package naming it (`::locator=…`), not another workspace's of the same name; a `portal:` or `link:` to a directory that is no workspace also folds the CONTENT of the directory (Yarn symlinks it and records no hash; berry's `file:` carries its own `::hash=`). Every `patch:` entry is reached by the plain descriptor it patches: Yarn's builtin compat patches (`resolve`, `typescript`, `fsevents`) and a root `resolutions` patch over a descriptor the file still keys (what `yarn patch-commit -s` writes). The workspace asks for the plain descriptor, and the patched entry is the one Yarn installs, so adding or editing the patch re-keys it. `yarn()` claims `.yarnrc.yml` and folds it into every task, so a catalog edit re-keys every project, as a `pnpm-workspace.yaml` edit does under `pnpm()`. Classic (yarn 1) records no workspaces, so it yields one digest for the root that every project folds — coarse, and honest about what the file records — and no project edges (below); a `file:` directory, which classic copies with no hash, and a `link:` one, which it symlinks, fold their CONTENT into that digest.
 
 A project the lockfile has no entry for folds the root's digest alone — the only `node_modules` it can resolve from. A phantom dependency (imported, never declared by the project or the root — a sibling's package hoisted to the root) is not in any closure; declare it.
 
@@ -52,6 +52,8 @@ Files no lockfile records lay `node_modules` out anew under a byte-identical loc
 | `npm()`  | `.npmrc`                        |
 | `yarn()` | `.yarnrc.yml`                   |
 
+`pnpm()` folds `pnpm-workspace.yaml` without `patchedDependencies` and `overrides`, which pnpm 10+ keeps there: the lockfile records what each one did, per project, so a patch or an override re-keys only the projects that reach the package it changes, and `--affected` selects them through the lockfile. Any other setting in the file re-keys every project, and a file that does not parse folds whole.
+
 A file has one claimant, so two of these plugins that share a settings file (`pnpm()` and `bun()` both claim `.npmrc`) cannot be declared together.
 
 ## `package.json` as an input
@@ -66,7 +68,9 @@ Every task with `inputs` of a project the lockfile lists, cached or not, gets it
 - **peers**: a peer with no installed entry of the same name that resolves to a workspace package orders the build too, unless it would close a cycle through the order edges; then it is reach only (in project-name order, so the edge kept is stable). pnpm records an auto-installed peer under `dependencies`, so `pnpm()` asks the project's `package.json` which of those entries are peers; yarn berry resolves a peer to the workspace of its name, which Yarn hoists.
 - Each importer with a `package.json` is a project: one with no vx config joins as a project a plugin added (its tasks come from the `project` stage, else the default `build`). The root importer is the exception: it is a project only by its own vx config. An importer with no `package.json`, and an edge to one, is skipped. A project is named by its `package.json` `name` unless its config names it, or another importer's `package.json` shares the name; then its path names it.
 - A yarn classic (v1) lockfile records no workspaces, so `yarn()` reads them as Yarn 1 does: the directories the root `package.json` `workspaces` globs (an array or `{ packages }`) name. A dependency on a workspace's name is a link unless the lockfile keys its descriptor, which Yarn 1 writes only for the registry copy it fetched because the workspace's version missed the range.
-- A workspace the root `package.json` `workspaces` names that `bun()`, `npm()` or berry `yarn()` finds no importer for (added after the last install) is a warning at `vx lock` naming the install that adds it: until then core names it by its path, so a `dependsOn` naming it finds no project.
+- A lockfile older than the manifests **refuses `vx lock`**, naming the install that refreshes it: a workspace the globs name (the root `package.json` `workspaces`, or `pnpm-workspace.yaml` under `pnpm()`, `!` exclusions honoured) that the file lists no importer for, such as a renamed folder, or a `dependencies`, `devDependencies` or `optionalDependencies` entry naming a workspace package that the file does not record for that importer. Either would lose edges: the package would build beside what it depends on and hit with old content. Yarn classic is exempt: its edges come from the manifests.
+
+A workspace `package.json` that does not parse (git merge conflict markers, a syntax error, or JSON that is not an object) **refuses `vx lock`**, naming it, under every manager: read as no manifest, it lost its dependencies and its dependents hit with old bytes. Turbo and Nx refuse it too.
 
 These edges are what was installed, so they differ from a guess over manifest ranges where the manager decided otherwise: pnpm installs a plain range (`^2.0.0`, `*`, `catalog:`) from the registry unless it is `workspace:`, yarn packs a `file:` directory as a copy, bun installs `dependencies` over a devDependency of the same key. They are the only package edges vx has: core reads none from a `package.json`, so a workspace whose tasks use `^build` declares one of these plugins (or another that returns `deps`), and without one vx refuses the `^` naming the fix. A dependency an install adds or removes reaches `--affected` as this lockfile's change.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-lockfile",
-  "version": "0.0.640",
+  "version": "0.0.642",
   "license": "MIT",
   "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer.",
   "keywords": [
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.640"
+    "@vzn/vx": "^0.0.642"
   },
   "repository": {
     "type": "git",

package/src/bun.ts

@@ -231,6 +231,27 @@ export function patchFiles(text: string): string[] {
   )
 }
 
+/**
+ * The root-relative paths of `file:` dependencies (`dep@file:vendor/dep`).
+ * Bun copies the directory at install and records only its path, so an
+ * edit in it moved no key (Growth, file-dir-dep-stale.sh): the claim hashes
+ * its content like a patch's.
+ */
+export function fileDeps(lock: Lockfile): string[] {
+  const out = new Set<string>()
+  for (const e of lock.packages.values()) {
+    const dir = fileDir(e.id)
+    if (dir !== undefined) out.add(dir)
+  }
+  return [...out].sort()
+}
+
+/** `dep@file:vendor/dep` → `vendor/dep`. */
+function fileDir(id: string): string | undefined {
+  const at = id.indexOf('@file:', 1)
+  return at === -1 ? undefined : id.slice(at + '@file:'.length)
+}
+
 /**
  * Every workspace package's digest (by dir): the lockfile as one graph —
  * a node per node_modules path, its material the id + resolution, an edge
@@ -260,6 +281,10 @@ export function importerDigests(
   // every project reaching it with the same bytes installed (D-140). Where
   // it sits still decides what it resolves; that is the edges.
   for (const [p, e] of lock.packages) node(p, `${installName(p)}\0${e.id}\0${e.resolution}`)
+  for (const [p, e] of lock.packages) {
+    const dir = fileDir(e.id)
+    if (dir !== undefined) material[index.get(p)!] += `\nfile\0${files.get(dir) ?? ''}`
+  }
   // A patch is part of the package it patches: an edit to one only `b`
   // reaches re-keyed every workspace while it was install-wide (D-143).
   // One that names no entry stays install-wide, so it still moves a key.

package/src/index.ts

@@ -54,7 +54,7 @@ export interface LockfileOptions {
 }
 
 /** Bumps when a digest folds differently or the memo holds more (its identity). */
-const DIGEST_VERSION = 15
+const DIGEST_VERSION = 18
 
 interface Manager {
   readonly name: string
@@ -64,9 +64,16 @@ interface Manager {
   readonly unreadable?: { readonly file: string; readonly fix: string }
   readonly digest: (text: string, files: ReadonlyMap<string, string>) => ReadonlyMap<string, string>
   readonly importers: (text: string) => ReadonlyMap<string, LockfileImporter>
+  /** Each importer's dependency names the file records, whatever they resolve to. */
+  readonly recorded: (text: string) => ReadonlyMap<string, ReadonlyMap<string, unknown>>
   readonly extraFiles?: (text: string) => readonly string[]
   /** Root files no lockfile records that lay the install out: folded whole into every task. */
   readonly settings: readonly string[]
+  /**
+   * A settings file's bytes as the key folds them, where the lockfile
+   * records part of what it says per project; undefined folds them whole.
+   */
+  readonly settingsText?: (file: string, text: string) => string | undefined
   /** The lockfile files a peer under `dependencies`: the manifest says which entries are peers. */
   readonly peersInManifest?: true
   /**
@@ -102,9 +109,13 @@ const MANAGERS = {
   pnpm: {
     name: 'pnpm',
     files: ['pnpm-lock.yaml'],
-    digest: (t) => pnpmLock().importerDigests(pnpmParse(t)),
+    digest: (t, files) => pnpmLock().importerDigests(pnpmParse(t), files),
     importers: (t) => pnpmLock().importerLinks(pnpmParse(t)),
+    extraFiles: (t) => pnpmLock().fileDeps(pnpmParse(t)),
+    recorded: (t) => pnpmParse(t).importers,
     settings: ['pnpm-workspace.yaml', '.npmrc'],
+    settingsText: (file, text) =>
+      file === 'pnpm-workspace.yaml' ? pnpmLock().workspaceSettings(text) : undefined,
     peersInManifest: true,
   },
   bun: {
@@ -118,22 +129,38 @@ const MANAGERS = {
     },
     digest: (t, files) => bunLock().importerDigests(bunParse(t), files),
     importers: (t) => bunLock().importerLinks(bunParse(t)),
-    extraFiles: (t) => bunLock().patchFiles(t),
+    recorded: (t) => bunParse(t).workspaces,
+    extraFiles: (t) => [...bunLock().patchFiles(t), ...bunLock().fileDeps(bunParse(t))],
     settings: ['bunfig.toml', '.npmrc'],
   },
   npm: {
     name: 'npm',
     // npm reads npm-shrinkwrap.json over package-lock.json when both exist.
     files: ['npm-shrinkwrap.json', 'package-lock.json'],
-    digest: (t) => npmLock().importerDigests(npmParse(t)),
+    digest: (t, files) => npmLock().importerDigests(npmParse(t), files),
     importers: (t) => npmLock().importerLinks(npmParse(t)),
+    extraFiles: (t) => npmParse(t).fileDirs,
+    recorded: (t) => {
+      const out = new Map<string, ReadonlyMap<string, unknown>>()
+      for (const [p, e] of npmParse(t).packages) {
+        if (p === '' || e.isWorkspace) out.set(p === '' ? '.' : p, e.deps)
+      }
+      return out
+    },
     settings: ['.npmrc'],
   },
   yarn: {
     name: 'yarn',
     files: ['yarn.lock'],
-    digest: (t) => yarnLock().importerDigests(yarnParse(t)),
+    digest: (t, files) => yarnLock().importerDigests(yarnParse(t), files),
     importers: (t) => yarnLock().importerLinks(yarnParse(t)),
+    extraFiles: (t) => yarnLock().fileDeps(yarnParse(t)),
+    recorded: (t) => {
+      const lock = yarnParse(t)
+      const out = new Map<string, ReadonlyMap<string, unknown>>()
+      for (const [dir, id] of lock.workspaces) out.set(dir, lock.entries.get(id)!.deps)
+      return out
+    },
     settings: ['.yarnrc.yml'],
     async manifestImporters(t, root, manifest) {
       const lock = yarnParse(t)
@@ -141,7 +168,7 @@ const MANAGERS = {
       const pkg = await manifest(root)
       const manifests = new Map<string, Record<string, unknown>>()
       if (pkg !== null) manifests.set('.', pkg)
-      for (const dir of await workspaceDirs(root, pkg)) {
+      for (const dir of await workspaceDirs(root, globsOf(pkg))) {
         const m = await manifest(path.join(root, dir))
         if (m !== null) manifests.set(dir, m)
       }
@@ -215,20 +242,29 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
       `${unreadable.file}: ${manager.name}() reads ${manager.files.join(' or ')} and finds none — ${unreadable.fix}`,
     )
   }
-  const importersOf = async (
+  /** The importers, and the lockfile they came from unless the manifests named them. */
+  const readImporters = async (
     ctx: { readonly workspaceRoot: string; readonly cacheDir: string },
     manifest: (dir: string) => Promise<Record<string, unknown> | null>,
-  ): Promise<ReadonlyMap<string, LockfileImporter> | undefined> => {
+  ): Promise<
+    { importers: ReadonlyMap<string, LockfileImporter>; file: string | undefined } | undefined
+  > => {
     for (const { file, claim } of claims) {
       const importers = await claim.importers(ctx)
       if (importers === undefined) continue
-      if (importers.size > 0 || manager.manifestImporters === undefined) return importers
+      if (importers.size > 0 || manager.manifestImporters === undefined) return { importers, file }
       const text = await Bun.file(path.join(ctx.workspaceRoot, file)).text()
-      return (await manager.manifestImporters(text, ctx.workspaceRoot, manifest)) ?? importers
+      const named = await manager.manifestImporters(text, ctx.workspaceRoot, manifest)
+      return named === undefined ? { importers, file } : { importers: named, file: undefined }
     }
     await refuseUnreadable(ctx.workspaceRoot)
     return undefined
   }
+  const importersOf = async (
+    ctx: { readonly workspaceRoot: string; readonly cacheDir: string },
+    manifest: (dir: string) => Promise<Record<string, unknown> | null>,
+  ): Promise<ReadonlyMap<string, LockfileImporter> | undefined> =>
+    (await readImporters(ctx, manifest))?.importers
   // Per run: core hands every `project` visit of one run the same array.
   const perRun = new WeakMap<
     readonly ProjectMeta[],
@@ -239,14 +275,26 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
   return definePlugin(import.meta, {
     fingerprint: {
       files: [...manager.files, ...manager.settings],
-      // A settings file lays out every project's install: every project.
-      affected: (change, ctx) =>
-        claims.find((c) => c.file === change.file)?.claim.fingerprint.affected(change, ctx),
+      // A settings file lays out every project's install: every project,
+      // unless all that moved is what the lockfile records per project.
+      affected: (change, ctx) => {
+        const claim = claims.find((c) => c.file === change.file)?.claim
+        if (claim !== undefined) return claim.fingerprint.affected(change, ctx)
+        // An added or removed file moves every install.
+        const folded = (bytes: Uint8Array | null): string | undefined =>
+          bytes === null
+            ? undefined
+            : manager.settingsText?.(change.file, new TextDecoder().decode(bytes))
+        const before = folded(change.before)
+        return before !== undefined && before === folded(change.after) ? [] : undefined
+      },
+      extraFiles: (file, bytes) =>
+        claims.find((c) => c.file === file)?.claim.fingerprint.extraFiles?.(file, bytes) ?? [],
     },
     async key(task, ctx) {
       let settings = settingsPerRun.get(ctx)
       if (settings === undefined) {
-        settings = readSettings(ctx.workspaceRoot, manager.settings)
+        settings = readSettings(ctx.workspaceRoot, manager.settings, manager.settingsText)
         settingsPerRun.set(ctx, settings)
       }
       let deps: Readonly<Record<string, string>> | undefined
@@ -268,26 +316,32 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
         : { ...deps, ...folded }
     },
     async discover(ctx) {
-      const manifest = manifestReader()
-      const importers = await importersOf(ctx, manifest)
-      if (importers === undefined) return []
-      // A workspace the root manifest names and the lockfile lacks is no
-      // project until an install adds it: lerna's 31 added Nx projects
-      // failed \`vx lock\` as "no such project" and nothing said why
-      // (Growth, 2026-10-16). pnpm reads pnpm-workspace.yaml instead.
-      if (manager.name !== 'pnpm') {
-        const missing = (
-          await workspaceDirs(ctx.workspaceRoot, await manifest(ctx.workspaceRoot))
-        ).filter((d) => !importers.has(d))
+      const manifest = manifestReader(ctx.workspaceRoot)
+      const read = await readImporters(ctx, manifest)
+      if (read === undefined) return []
+      const { importers, file } = read
+      // A lockfile older than the manifests drops edges: a workspace it does
+      // not list yet (a renamed folder, lerna's 31 added Nx projects) is
+      // named by its path with none, and a dependency added to package.json
+      // before the install orders nothing. Either ran a package beside what
+      // it builds on and hit with old content (Growth, 2026-10-16), so the
+      // lock refuses until the install, as a key from a stale lockfile names
+      // an install that is not on disk.
+      if (file !== undefined) {
+        const text = await Bun.file(path.join(ctx.workspaceRoot, file)).text()
+        const missing = await staleness(
+          ctx.workspaceRoot,
+          importers,
+          manager.recorded(text),
+          await workspaceDirs(
+            ctx.workspaceRoot,
+            await workspaceGlobs(ctx.workspaceRoot, manager.name, manifest),
+          ),
+          manifest,
+        )
         if (missing.length > 0) {
-          let file = manager.files[0]!
-          for (const f of manager.files)
-            if (await Bun.file(path.join(ctx.workspaceRoot, f)).exists()) {
-              file = f
-              break
-            }
-          ctx.warn(
-            `${file} does not list the workspace${missing.length > 1 ? 's' : ''} ${listed(missing)} that package.json names — run \`${manager.name} install\` to add ${missing.length > 1 ? 'them; until then each is' : 'it; until then it is'} named by its path, and a dependsOn naming it finds no project`,
+          throw new UserError(
+            `${file} is out of date: it does not list ${listed(missing)} — run \`${manager.name} install\``,
           )
         }
       }
@@ -303,7 +357,7 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
     async project(config, ctx) {
       let importers = perRun.get(ctx.projects)
       if (importers === undefined) {
-        importers = importersOf(ctx, manifestReader())
+        importers = importersOf(ctx, manifestReader(ctx.workspaceRoot))
         perRun.set(ctx.projects, importers)
       }
       if ((await importers)?.has(importerOf(ctx.workspaceRoot, ctx.dir)) !== true) return
@@ -332,6 +386,7 @@ function listed(names: readonly string[]): string {
 async function readSettings(
   workspaceRoot: string,
   files: readonly string[],
+  settingsText?: (file: string, text: string) => string | undefined,
 ): Promise<Record<string, string>> {
   const out: Record<string, string> = {}
   for (const file of files) {
@@ -341,7 +396,11 @@ async function readSettings(
     } catch {
       continue
     }
-    out[file] = Bun.hash.xxHash3(bytes).toString(16).padStart(16, '0')
+    const text = settingsText?.(file, new TextDecoder().decode(bytes))
+    out[file] = Bun.hash
+      .xxHash3(text ?? bytes)
+      .toString(16)
+      .padStart(16, '0')
   }
   return out
 }
@@ -351,56 +410,137 @@ function importerOf(workspaceRoot: string, dir: string): string {
   return path.relative(workspaceRoot, dir).split(path.sep).join('/') || '.'
 }
 
-/** An importer's `package.json`, or null where it has none or it does not parse. */
-async function manifestOf(dir: string): Promise<Record<string, unknown> | null> {
+/**
+ * An importer's `package.json`, or null where it has none. One that does
+ * not parse refuses, named: read as none, a conflicted manifest lost its
+ * dependencies and its dependents hit with old bytes (Turbo and Nx refuse).
+ */
+async function manifestOf(root: string, dir: string): Promise<Record<string, unknown> | null> {
+  const file = path.join(dir, 'package.json')
+  let text: string
   try {
-    const pkg: unknown = await Bun.file(path.join(dir, 'package.json')).json()
-    return pkg !== null && typeof pkg === 'object' && !Array.isArray(pkg)
-      ? (pkg as Record<string, unknown>)
-      : null
+    text = await Bun.file(file).text()
   } catch {
     return null
   }
+  const name = path.relative(root, file).split(path.sep).join('/')
+  if (CONFLICT.test(text))
+    throw new UserError(`${name}: holds git merge conflict markers — resolve them`)
+  let pkg: unknown
+  try {
+    pkg = JSON.parse(text)
+  } catch (err) {
+    throw new UserError(`${name}: not JSON (${err instanceof Error ? err.message : String(err)})`)
+  }
+  if (pkg === null || typeof pkg !== 'object' || Array.isArray(pkg)) {
+    throw new UserError(`${name}: not a JSON object`)
+  }
+  return pkg as Record<string, unknown>
 }
 
 /** `manifestOf`, each directory read once. */
-function manifestReader(): (dir: string) => Promise<Record<string, unknown> | null> {
+function manifestReader(root: string): (dir: string) => Promise<Record<string, unknown> | null> {
   const read = new Map<string, Promise<Record<string, unknown> | null>>()
   return (dir) => {
     let pkg = read.get(dir)
     if (pkg === undefined) {
-      pkg = manifestOf(dir)
+      pkg = manifestOf(root, dir)
       read.set(dir, pkg)
     }
     return pkg
   }
 }
 
-/**
- * The directories a root manifest's `workspaces` globs (an array, or
- * Yarn 1's `{ packages }`) name that hold a `package.json`, root-relative
- * POSIX, sorted; none under `node_modules`.
- */
-async function workspaceDirs(root: string, pkg: Record<string, unknown> | null): Promise<string[]> {
+/** A root manifest's `workspaces` globs: an array, or Yarn 1's `{ packages }`. */
+function globsOf(pkg: Record<string, unknown> | null): readonly unknown[] {
   const field = pkg?.['workspaces']
   const list = Array.isArray(field)
     ? field
     : field !== null && typeof field === 'object'
       ? (field as Record<string, unknown>)['packages']
       : undefined
-  if (!Array.isArray(list)) return []
+  return Array.isArray(list) ? list : []
+}
+
+/** The workspace globs the manager reads: pnpm's from pnpm-workspace.yaml, the others' from package.json. */
+async function workspaceGlobs(
+  root: string,
+  manager: string,
+  manifest: (dir: string) => Promise<Record<string, unknown> | null>,
+): Promise<readonly unknown[]> {
+  if (manager !== 'pnpm') return globsOf(await manifest(root))
+  let doc: unknown
+  try {
+    doc = Bun.YAML.parse(await Bun.file(path.join(root, 'pnpm-workspace.yaml')).text())
+  } catch {
+    return []
+  }
+  const list =
+    doc !== null && typeof doc === 'object'
+      ? (doc as Record<string, unknown>)['packages']
+      : undefined
+  return Array.isArray(list) ? list : []
+}
+
+/**
+ * The directories the globs name that hold a `package.json`, root-relative
+ * POSIX, sorted; none a `!` glob excludes, none under `node_modules`.
+ */
+async function workspaceDirs(root: string, globs: readonly unknown[]): Promise<string[]> {
+  const strip = (p: string): string => p.replace(/^\.\//, '').replace(/\/+$/, '')
+  const excluded = globs
+    .filter((p): p is string => typeof p === 'string' && p.startsWith('!'))
+    .map((p) => new Bun.Glob(strip(p.slice(1))))
   const dirs = new Set<string>()
-  for (const pattern of list) {
+  for (const pattern of globs) {
     if (typeof pattern !== 'string' || pattern.startsWith('!')) continue
-    const glob = new Bun.Glob(`${pattern.replace(/^\.\//, '').replace(/\/+$/, '')}/package.json`)
+    const glob = new Bun.Glob(`${strip(pattern)}/package.json`)
     for await (const file of glob.scan({ cwd: root, onlyFiles: true })) {
       const dir = path.dirname(file).split(path.sep).join('/')
-      if (dir !== '.' && !dir.split('/').includes('node_modules')) dirs.add(dir)
+      if (dir === '.' || dir.split('/').includes('node_modules')) continue
+      if (!excluded.some((g) => g.match(dir))) dirs.add(dir)
     }
   }
   return [...dirs].sort()
 }
 
+/**
+ * What the manifests name that the lockfile does not: each workspace it
+ * lists no importer for, and each importer's dependency (any field but
+ * peers, which a manager may leave out) on a workspace package's name that
+ * it records no entry for.
+ */
+async function staleness(
+  root: string,
+  importers: ReadonlyMap<string, LockfileImporter>,
+  recorded: ReadonlyMap<string, ReadonlyMap<string, unknown>>,
+  dirs: readonly string[],
+  manifest: (dir: string) => Promise<Record<string, unknown> | null>,
+): Promise<string[]> {
+  const dirOf = (importer: string): string => (importer === '.' ? root : path.join(root, importer))
+  const missing = dirs.filter((d) => !importers.has(d)).map((d) => `the workspace ${d}`)
+  const names = new Set<string>()
+  for (const d of new Set([...importers.keys(), ...dirs])) {
+    const n = (await manifest(dirOf(d)))?.['name']
+    if (typeof n === 'string') names.add(n)
+  }
+  for (const [importer, deps] of recorded) {
+    const pkg = await manifest(dirOf(importer))
+    if (pkg === null) continue
+    const own = pkg['name']
+    for (const field of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+      const declared = pkg[field]
+      if (declared === null || typeof declared !== 'object') continue
+      for (const name of Object.keys(declared)) {
+        if (name !== own && names.has(name) && !deps.has(name)) {
+          missing.push(`${importer}'s dependency on ${name}`)
+        }
+      }
+    }
+  }
+  return [...new Set(missing)]
+}
+
 /**
  * One entry per importer with a `package.json` (core reads none): a
  * directory that is no project yet becomes one, the root aside, which is

package/src/npm.ts

@@ -16,6 +16,8 @@ export interface Lockfile {
   readonly packages: ReadonlyMap<string, Entry>
   /** Material every workspace folds. */
   readonly global: string
+  /** Directories `file:` dependencies link to: not the root, not a workspace. */
+  readonly fileDirs: readonly string[]
 }
 
 export interface Entry {
@@ -46,8 +48,10 @@ export function parseLockfile(text: string): Lockfile {
       `package-lock.json: lockfileVersion ${version} has no \`packages\` map — npm 7+ writes version 2 or 3`,
     )
   }
+  const raws = record(d!['packages']) ?? {}
+  const globs = workspaceGlobs(raws[''])
   const packages = new Map<string, Entry>()
-  for (const [p, raw] of Object.entries(record(d!['packages']) ?? {})) {
+  for (const [p, raw] of Object.entries(raws)) {
     const e = record(raw) ?? {}
     const link = e['link'] === true && typeof e['resolved'] === 'string' ? e['resolved'] : undefined
     packages.set(p, {
@@ -59,14 +63,39 @@ export function parseLockfile(text: string): Lockfile {
               .join('\0')
           : '',
       link,
-      isWorkspace: p !== '' && !p.startsWith('node_modules/') && !p.includes('/node_modules/'),
+      isWorkspace:
+        p !== '' &&
+        !p.startsWith('node_modules/') &&
+        !p.includes('/node_modules/') &&
+        (globs === undefined || globs.some((g) => g.match(p))),
       peers: peerOnly(e),
     })
   }
   // Root `overrides` are not folded: what an override forced is the entry a
   // workspace reaches, and npm 10 does not write them here at all (D-142).
   const global = JSON.stringify({ lockfileVersion: version })
-  return { version, packages, global }
+  const fileDirs = new Set<string>()
+  for (const e of packages.values()) {
+    if (e.link !== undefined && e.link !== '' && packages.get(e.link)?.isWorkspace !== true) {
+      fileDirs.add(e.link)
+    }
+  }
+  return { version, packages, global, fileDirs: [...fileDirs].sort() }
+}
+
+/**
+ * The root's `workspaces` globs: what tells a workspace from a `file:`
+ * directory, both entries outside node_modules that a link resolves to.
+ * Taking every such entry for a workspace made `vendor/dep` a project, so
+ * an edit under it selected nothing. `undefined` when the root names none.
+ */
+function workspaceGlobs(root: unknown): Bun.Glob[] | undefined {
+  const ws = record(root)?.['workspaces']
+  const list = Array.isArray(ws) ? ws : record(ws)?.['packages']
+  if (!Array.isArray(list)) return undefined
+  return list
+    .filter((g): g is string => typeof g === 'string')
+    .map((g) => new Bun.Glob(g.replace(/^\.\//, '').replace(/\/+$/, '')))
 }
 
 /**
@@ -96,7 +125,10 @@ function resolve(lock: Lockfile, from: string, name: string): string | undefined
  * an edge per resolved dependency, a link's edge to its target — folded
  * by core's `reachDigests`.
  */
-export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
+export function importerDigests(
+  lock: Lockfile,
+  files: ReadonlyMap<string, string> = new Map(),
+): ReadonlyMap<string, string> {
   const index = new Map<string, number>()
   const material: string[] = []
   const edges: number[][] = []
@@ -109,6 +141,14 @@ export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
     material.push(`${p === '' || e.isWorkspace ? p : installName(p)}\0${e.resolution}`)
     edges.push([])
   }
+  // npm links a `file:` directory, so what a task reads is its content now,
+  // which the lockfile does not record: an edit to it replayed a stale hit.
+  for (const dir of lock.fileDirs) {
+    const own = `\nfile\0${files.get(dir) ?? ''}`
+    const i = index.get(dir)
+    if (i !== undefined) material[i] += own
+    else for (const [p, e] of lock.packages) if (e.link === dir) material[index.get(p)!] += own
+  }
   for (const [p, e] of lock.packages) {
     const from = index.get(p)!
     if (e.link !== undefined) {

package/src/pnpm.ts

@@ -25,6 +25,8 @@ export interface Lockfile {
   readonly resolutions: ReadonlyMap<string, string>
   /** `name` or `name@version` → patch hash */
   readonly patches: ReadonlyMap<string, string>
+  /** package key → the root-relative directory a `file:` dependency installs from */
+  readonly directories: ReadonlyMap<string, string>
   /** Material every importer folds: the lockfile version and the install-wide knobs. */
   readonly global: string
 }
@@ -79,10 +81,15 @@ export function parseLockfile(text: string): Lockfile {
 
   const snapshots = new Map<string, ReadonlyMap<string, string>>()
   const resolutions = new Map<string, string>()
+  const directories = new Map<string, string>()
   const packages = record(doc['packages']) ?? {}
   for (const [key, entry] of Object.entries(packages)) {
     const e = record(entry) ?? {}
     resolutions.set(key, resolutionOf(e))
+    const r = record(e['resolution'])
+    if (r?.['type'] === 'directory' && typeof r['directory'] === 'string') {
+      directories.set(key, r['directory'])
+    }
     if (major < 9) snapshots.set(key, depsOf(e))
   }
   if (major >= 9) {
@@ -112,7 +119,7 @@ export function parseLockfile(text: string): Lockfile {
       ? { lockfileVersion: version, rest }
       : { lockfileVersion: version, rest, leading },
   )
-  return { version, importers, snapshots, resolutions, patches, global }
+  return { version, importers, snapshots, resolutions, patches, directories, global }
 }
 
 /** `dependencies` + `devDependencies` + `optionalDependencies` of an entry, as name → version. */
@@ -146,6 +153,28 @@ function scalar(v: unknown): string {
       : ''
 }
 
+/**
+ * pnpm-workspace.yaml as every task folds it: without `patchedDependencies`
+ * and `overrides`, whose effect the lockfile records per project (pnpm 10+
+ * keeps them here). Undefined for a file that does not parse to a mapping,
+ * folded whole.
+ */
+export function workspaceSettings(text: string): string | undefined {
+  let doc: unknown
+  try {
+    doc = Bun.YAML.parse(text)
+  } catch {
+    return undefined
+  }
+  const map = record(doc)
+  if (map === undefined) return undefined
+  const rest: Yaml = {}
+  for (const [k, v] of Object.entries(map)) {
+    if (k !== 'patchedDependencies' && k !== 'overrides') rest[k] = v
+  }
+  return `pnpm-workspace\0${stable(rest)}`
+}
+
 /** JSON with sorted keys, so YAML key order cannot move a digest. */
 export function stable(v: unknown): string {
   return JSON.stringify(v, (_k, val: unknown) =>
@@ -201,8 +230,11 @@ function packageName(lock: Lockfile, snapshot: string): string {
  * importer's node, so what project A can import through workspace
  * package B is B's whole reach.
  */
-export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
-  const g = buildGraph(lock)
+export function importerDigests(
+  lock: Lockfile,
+  files: ReadonlyMap<string, string> = new Map(),
+): ReadonlyMap<string, string> {
+  const g = buildGraph(lock, files)
   const hashes = reachDigests(g)
   const out = new Map<string, string>()
   // The global digest rides as DATA: Bun's xxHash3 reads only the low 32
@@ -228,7 +260,28 @@ function importerNode(dir: string): string {
   return `importer\0${dir}`
 }
 
-function buildGraph(lock: Lockfile): Graph {
+/**
+ * The directories `file:` dependencies install from, and those a `link:`
+ * names that is no importer. pnpm copies the first at install and links
+ * the second, and records only their path, so an edit in one moved no key
+ * (Growth, file-dir-dep-stale.sh): the claim hashes its content.
+ */
+export function fileDeps(lock: Lockfile): string[] {
+  const out = new Set(lock.directories.values())
+  for (const [dir, deps] of lock.importers) {
+    for (const version of deps.values()) {
+      const target = linkTarget(lock, dir, version)
+      if (target !== undefined && !lock.importers.has(target)) out.add(target)
+    }
+  }
+  return [...out].sort()
+}
+
+function linkTarget(lock: Lockfile, dir: string, version: string): string | undefined {
+  return version.startsWith('link:') ? joinPosix(dir, version.slice('link:'.length)) : undefined
+}
+
+function buildGraph(lock: Lockfile, files: ReadonlyMap<string, string>): Graph {
   const index = new Map<string, number>()
   const material: string[] = []
   const edges: number[][] = []
@@ -246,7 +299,9 @@ function buildGraph(lock: Lockfile): Graph {
     const resolution = lock.resolutions.get(key) ?? lock.resolutions.get(packageKey(key)) ?? ''
     const patch =
       lock.patches.get(packageKey(key)) ?? lock.patches.get(packageName(lock, key)) ?? ''
-    node(key, `${key}\0${resolution}\0${patch}`)
+    const dir = lock.directories.get(key) ?? lock.directories.get(packageKey(key))
+    const content = dir === undefined ? '' : `\0file\0${files.get(dir) ?? ''}`
+    node(key, `${key}\0${resolution}\0${patch}${content}`)
   }
   // Each importer folds its own dir: with one material for all, two
   // importers that link each other were told apart by their edges alone,
@@ -255,10 +310,13 @@ function buildGraph(lock: Lockfile): Graph {
   for (const dir of lock.importers.keys()) node(importerNode(dir), importerNode(dir))
   const link = (from: number, dir: string, name: string, version: string): void => {
     if (version.startsWith('link:')) {
-      const target = joinPosix(dir, version.slice('link:'.length))
+      const target = linkTarget(lock, dir, version)
       if (target !== undefined && lock.importers.has(target))
         edges[from]!.push(index.get(importerNode(target))!)
-      else material[from] += `\nlink\0${name}\0${version}`
+      else {
+        const content = target === undefined ? '' : `\0file\0${files.get(target) ?? ''}`
+        material[from] += `\nlink\0${name}\0${version}${content}`
+      }
       return
     }
     const key = snapshotKey(lock, name, version)

package/src/yarn.ts

@@ -27,12 +27,16 @@ export interface Lockfile {
   /** package name → every entry a descriptor of that name resolves to (berry only) */
   readonly names: ReadonlyMap<string, readonly string[]>
   /**
-   * `name@npm:range` → the entry of Yarn's builtin compat patch of it
-   * (`resolve`, `typescript`, `fsevents`; berry only). The workspace keeps
-   * asking for the plain descriptor, which keys the unpatched entry, while
-   * the patched one is what Yarn installs (item 1074).
+   * `name@npm:range` → the entries of every `patch:` over it (berry only):
+   * Yarn's builtin compat patches (`resolve`, `typescript`, `fsevents`,
+   * item 1074) and a root `resolutions` patch (`yarn patch-commit -s`).
+   * The workspace keeps asking for the plain descriptor, which keys the
+   * unpatched entry, while a patched one is what Yarn installs. A
+   * workspace asking for the plain descriptor beside one that names the
+   * patch itself reaches it too: a patch edit re-keys it once too often,
+   * never too seldom.
    */
-  readonly builtinPatches: ReadonlyMap<string, string>
+  readonly patches: ReadonlyMap<string, readonly string[]>
   readonly global: string
 }
 
@@ -66,7 +70,7 @@ function parseBerry(text: string): Lockfile {
   const descriptors = new Map<string, string>()
   const workspaces = new Map<string, string>()
   const names = new Map<string, string[]>()
-  const builtinPatches = new Map<string, string>()
+  const patches = new Map<string, string[]>()
   for (const [keys, raw] of Object.entries(d)) {
     if (keys === '__metadata') continue
     const e = record(raw) ?? {}
@@ -90,15 +94,17 @@ function parseBerry(text: string): Lockfile {
     for (const k of keys.split(',')) {
       const descriptor = k.trimStart()
       descriptors.set(descriptor, resolution)
-      const builtin = /@patch:(.+)#optional!builtin<[^>]*>$/.exec(descriptor)
-      if (builtin !== null) {
+      const patch = /@patch:(.+?)#/.exec(descriptor)
+      if (patch !== null) {
         let inner: string
         try {
-          inner = decodeURIComponent(builtin[1]!)
+          inner = decodeURIComponent(patch[1]!)
         } catch {
-          inner = builtin[1]!
+          inner = patch[1]!
         }
-        builtinPatches.set(inner, resolution)
+        const ids = patches.get(inner)
+        if (ids === undefined) patches.set(inner, [resolution])
+        else if (!ids.includes(resolution)) ids.push(resolution)
       }
       const name = descriptor.slice(0, descriptor.indexOf('@', 1))
       const ids = names.get(name)
@@ -115,7 +121,7 @@ function parseBerry(text: string): Lockfile {
     descriptors,
     workspaces,
     names,
-    builtinPatches,
+    patches,
     global: JSON.stringify({ version: meta['version'], cacheKey: meta['cacheKey'] }),
   }
 }
@@ -184,7 +190,7 @@ function parseClassic(text: string): Lockfile {
     descriptors,
     workspaces: new Map(),
     names: new Map(),
-    builtinPatches: new Map(),
+    patches: new Map(),
     global: 'classic',
   }
 }
@@ -257,11 +263,11 @@ function resolveDescriptor(
   name: string,
   range: string,
 ): readonly string[] {
-  // A descriptor Yarn compat-patches reaches the patched entry it installs
-  // as well as the plain one it keys (item 1074).
+  // A patched descriptor reaches the patched entries Yarn installs as well
+  // as the plain one it keys (item 1074).
   const withPatch = (descriptor: string, id: string): readonly string[] => {
-    const patched = lock.builtinPatches.get(descriptor)
-    return patched === undefined || patched === id ? [id] : [id, patched]
+    const patched = lock.patches.get(descriptor)
+    return patched === undefined ? [id] : [id, ...patched.filter((p) => p !== id)]
   }
   const direct = lock.descriptors.get(`${name}@${range}`)
   if (direct !== undefined) return withPatch(`${name}@${range}`, direct)
@@ -343,6 +349,12 @@ function linkedDir(
   dirOf: ReadonlyMap<string, string>,
   id: string,
 ): string | undefined {
+  const target = linkPath(dirOf, id)
+  return target !== undefined && lock.workspaces.has(target) ? target : undefined
+}
+
+/** The root-relative directory a berry `link:` or `portal:` entry symlinks. */
+function linkPath(dirOf: ReadonlyMap<string, string>, id: string): string | undefined {
   const m = /^(?:@[^@/]+\/)?[^@]+@(?:link|portal):([^:]*)::locator=([^&]+)/.exec(id)
   if (m === null) return undefined
   let locator: string
@@ -352,9 +364,37 @@ function linkedDir(
     return undefined
   }
   const from = dirOf.get(locator)
-  if (from === undefined) return undefined
-  const target = joinPosix(from, m[1]!)
-  return target !== undefined && lock.workspaces.has(target) ? target : undefined
+  return from === undefined ? undefined : joinPosix(from, m[1]!)
+}
+
+/**
+ * Each entry's directory whose content is what a task reads and the file
+ * pins nowhere: berry's `link:` / `portal:` to a directory that is no
+ * workspace (a symlink), and classic's `file:` (a copy, no hash) and
+ * `link:` (a symlink). Berry's
+ * `file:` carries its own `::hash=`.
+ */
+function contentDirs(lock: Lockfile): Map<string, string> {
+  const out = new Map<string, string>()
+  if (lock.generation === 'classic') {
+    for (const id of lock.entries.keys()) {
+      const m = /^.[^@]*@(?:file|link):(.+)$/.exec(id)
+      if (m !== null) out.set(id, m[1]!)
+    }
+    return out
+  }
+  const dirOf = new Map<string, string>()
+  for (const [dir, id] of lock.workspaces) dirOf.set(id, dir)
+  for (const id of lock.entries.keys()) {
+    const target = linkPath(dirOf, id)
+    if (target !== undefined && target !== '.' && !lock.workspaces.has(target)) out.set(id, target)
+  }
+  return out
+}
+
+/** The directories `contentDirs` names, for the claim to hash. */
+export function fileDeps(lock: Lockfile): string[] {
+  return [...new Set(contentDirs(lock).values())].sort()
 }
 
 /** The entry a descriptor the file keys resolves to: as written, bound to `from`, or with berry's `npm:` prefix. */
@@ -377,13 +417,20 @@ function keyedDescriptor(
  * one digest is the root's (`.`) over every entry the file resolves —
  * coarse, and honest about what classic records.
  */
-export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
+export function importerDigests(
+  lock: Lockfile,
+  files: ReadonlyMap<string, string> = new Map(),
+): ReadonlyMap<string, string> {
   const index = new Map<string, number>()
   const material: string[] = []
   const edges: number[][] = []
+  const dirs = contentDirs(lock)
   for (const [id, e] of lock.entries) {
     index.set(id, material.length)
-    material.push(e.resolution)
+    const dir = dirs.get(id)
+    material.push(
+      dir === undefined ? e.resolution : `${e.resolution}\nfile\0${files.get(dir) ?? ''}`,
+    )
     edges.push([])
   }
   for (const [id, e] of lock.entries) {