@vzn/vx 0.0.15 → 0.0.18

package/src/util/timing.ts

@@ -0,0 +1,63 @@
+// Stage timing for the run path, printed to stderr when `VX_TIMING` is set.
+//
+// The CPU profiler attributes a tight loop's cost unreliably and hides
+// where an `await` waited; a stage table answers "where did the warm run
+// go?" directly, and costs one boolean check per mark when off. Marks are
+// cumulative from process start; the table shows each stage's own share.
+
+const enabled = process.env.VX_TIMING !== undefined && process.env.VX_TIMING !== ''
+const t0 = Bun.nanoseconds()
+const marks: Array<[label: string, ns: number]> = []
+
+/** Record the end of a stage. No-op unless `VX_TIMING` is set. */
+export function mark(label: string): void {
+  if (!enabled) return
+  marks.push([label, Bun.nanoseconds() - t0])
+}
+
+const spans = new Map<string, [count: number, ns: number]>()
+const noop = (): void => {}
+
+/**
+ * Time one occurrence of a repeated operation (a per-task probe, a restore):
+ * `const end = span('probe'); …; end()`. Accumulated by label and printed
+ * under the stage table. Returns a shared no-op when off, so the hot path
+ * allocates nothing.
+ */
+export function span(label: string): () => void {
+  if (!enabled) return noop
+  const start = Bun.nanoseconds()
+  return () => {
+    const cur = spans.get(label)
+    const ns = Bun.nanoseconds() - start
+    if (cur === undefined) spans.set(label, [1, ns])
+    else {
+      cur[0]++
+      cur[1] += ns
+    }
+  }
+}
+
+/** Print the stage table (once, at the end of a run). No-op unless enabled. */
+export function printTimings(): void {
+  if (!enabled || marks.length === 0) return
+  const width = Math.max(...marks.map(([l]) => l.length))
+  let prev = 0
+  const lines = ['[vx timing]  stage'.padEnd(width + 14) + '    own   cumulative']
+  for (const [label, ns] of marks) {
+    const own = (ns - prev) / 1e6
+    lines.push(
+      `             ${label.padEnd(width)}  ${own.toFixed(1).padStart(6)}ms  ${(ns / 1e6).toFixed(1).padStart(8)}ms`,
+    )
+    prev = ns
+  }
+  if (spans.size > 0) {
+    lines.push('[vx timing]  accumulated                     total   count')
+    for (const [label, [count, ns]] of [...spans].sort((a, b) => b[1][1] - a[1][1])) {
+      lines.push(
+        `             ${label.padEnd(24)}  ${(ns / 1e6).toFixed(1).padStart(8)}ms  ${String(count).padStart(6)}`,
+      )
+    }
+  }
+  process.stderr.write(lines.join('\n') + '\n')
+}

package/src/workspace/affected.ts

@@ -12,6 +12,8 @@
 import path from 'node:path'
 import { UserError } from '../util/index.js'
 import { LOCKFILE_NAME } from './lockfile.js'
+import { configImportOwners } from './config-imports.js'
+import { WORKSPACE_FINGERPRINT_FILES } from './fingerprint.js'
 import type { ProjectMeta } from './workspace.js'
 
 export interface AffectedArgs {
@@ -19,6 +21,22 @@ export interface AffectedArgs {
   /** Git ref / commit / branch to compare against. Required. */
   since: string
   projects: readonly ProjectMeta[]
+  /**
+   * Which projects declare a `cache.inputs.workspaceFiles` glob matching one of
+   * these workspace-relative paths.
+   *
+   * A workspace-anchored glob is the documented escape hatch for shared files
+   * that belong to NO project, so mapping changed paths to project directories
+   * structurally cannot see it — the path resolves to no project and the run
+   * selects nothing for a change that re-keyed the task.
+   *
+   * Answering needs the RESOLVED configs, which selection runs before loading;
+   * that ordering is what left this open. It is resolved by asking only when
+   * the question can matter: this is called ONLY with paths that belong to no
+   * project, so a run whose every change is inside a project — the common case
+   * — never invokes it and pays nothing.
+   */
+  workspaceGlobOwners?: (orphanPaths: readonly string[]) => Promise<Iterable<string>>
 }
 
 /**
@@ -29,15 +47,113 @@ export interface AffectedArgs {
 export async function affectedProjects(args: AffectedArgs): Promise<Set<string>> {
   await verifyRef(args.workspaceRoot, args.since)
 
-  const proc = Bun.spawn({
+  const [diffed, untracked] = await Promise.all([
     // `--no-renames` is crucial for project-affected detection: with
     // git's auto rename-detection on (the default in modern git), a
     // cross-project `git mv` collapses to a single rename entry that
     // surfaces only the destination path. We'd then miss flagging the
     // source project as affected. Treating renames as delete+add gives
     // us both halves so both projects get correctly marked.
-    cmd: ['git', 'diff', '--no-renames', '--name-only', args.since],
-    cwd: args.workspaceRoot,
+    //
+    // `--relative` prints paths relative to the cwd (the workspace root), NOT
+    // the git repo root. Without it, when the workspace root is a SUBDIR of the
+    // git repo, `git diff` emits repo-root-relative paths (`code/pkg/x`) that
+    // `path.resolve(workspaceRoot, …)` mangles into `<root>/code/…`, matching no
+    // project → the project is silently NOT flagged affected. `--relative` also
+    // (correctly) drops changes ABOVE the workspace, which belong to no project.
+    // No-op when the workspace root IS the git root.
+    //
+    // `-z` because git otherwise C-quotes and octal-escapes any path with a
+    // non-ASCII / `"` / `\` character — the quoted string then resolves to no
+    // project, while the cache-input enumeration (which uses `-z`) sees the
+    // real name and re-keys the task. The two surfaces must agree.
+    gitPaths(args.workspaceRoot, [
+      'diff',
+      '--no-renames',
+      '--relative',
+      '--name-only',
+      '-z',
+      args.since,
+    ]),
+    // `git diff` never reports untracked-but-not-ignored files, but input
+    // enumeration does (`git ls-files --cached --others --exclude-standard`),
+    // so a brand-new source file changes a task's cache key. Union it in or
+    // `--affected` skips a package that genuinely has new work.
+    gitPaths(args.workspaceRoot, ['ls-files', '--others', '--exclude-standard', '-z']),
+  ])
+
+  // vx-lock.json (workspace-root metadata) is excluded like a gitignored
+  // file: re-running `vx lock` must not mark every project affected.
+  const changed = [...diffed, ...untracked].filter((s) => s !== LOCKFILE_NAME)
+
+  // A lockfile or workspace-definition change re-keys EVERY task, because the
+  // workspace fingerprint folds those files into every cache key. Mapping
+  // changed paths to project directories cannot see that — they sit at the
+  // root and belong to no project — so `--affected` selected ZERO projects for
+  // a change that invalidates the entire cache. `vx run test --affected` after
+  // a `pnpm update` exited 0 having run nothing, which is precisely the
+  // failure `docs/cli.md` warns against in the sentence it states as a
+  // principle: "input hashing sees it, so `--affected` must too."
+  //
+  // Selection is not hashed, so widening it here changes no cache key.
+  if (changed.some((p) => FINGERPRINT_SET.has(p))) {
+    return new Set(args.projects.map((p) => p.name))
+  }
+
+  const { owned, orphans } = projectsContaining(args.workspaceRoot, changed, args.projects)
+
+  // THIRD CHANNEL: a project whose `vx.config.*` IMPORTS a changed file.
+  // Resolved-config hashing folds those values into the key, so the same
+  // sentence above applies — input hashing sees it, so selection must. This
+  // runs on the FULL changed set, not just `orphans`: the common shape is a
+  // config reaching into ANOTHER project (`../../src/index.ts`), whose target
+  // is owned and therefore never an orphan at all.
+  for (const name of await configImportOwners({
+    workspaceRoot: args.workspaceRoot,
+    projects: args.projects,
+    changed,
+    skip: owned,
+  })) {
+    owned.add(name)
+  }
+
+  if (orphans.length === 0 || args.workspaceGlobOwners === undefined) return owned
+  for (const name of await args.workspaceGlobOwners(orphans)) owned.add(name)
+  return owned
+}
+
+/**
+ * Does any `cache.inputs.workspaceFiles` entry in `globs` match `rel`?
+ *
+ * Mirrors `resolveWorkspaceFiles`' partition: a leading `!` is an EXCLUDE, and
+ * with no positive glob nothing matches. Paths are workspace-root-relative and
+ * POSIX-separated, which is the form both git enumeration and the glob
+ * resolver already speak.
+ */
+export function workspaceGlobsMatch(globs: readonly string[], rel: string): boolean {
+  const positive: Bun.Glob[] = []
+  const negative: Bun.Glob[] = []
+  for (const entry of globs) {
+    if (entry.startsWith('!')) negative.push(new Bun.Glob(entry.slice(1)))
+    else positive.push(new Bun.Glob(entry))
+  }
+  if (positive.length === 0) return false
+  if (!positive.some((g) => g.match(rel))) return false
+  return !negative.some((g) => g.match(rel))
+}
+
+/**
+ * The fingerprint files as workspace-root-relative paths. Read from the same
+ * constant the fingerprint itself walks, so a new lockfile format cannot be
+ * taught to one surface and not the other.
+ */
+const FINGERPRINT_SET: ReadonlySet<string> = new Set(WORKSPACE_FINGERPRINT_FILES)
+
+/** Run a NUL-separated path-listing git command from the workspace root. */
+async function gitPaths(workspaceRoot: string, cmd: string[]): Promise<string[]> {
+  const proc = Bun.spawn({
+    cmd: ['git', ...cmd],
+    cwd: workspaceRoot,
     stdout: 'pipe',
     stderr: 'pipe',
   })
@@ -45,13 +161,9 @@ export async function affectedProjects(args: AffectedArgs): Promise<Set<string>>
   const stderr = await new Response(proc.stderr).text()
   const exit = await proc.exited
   if (exit !== 0) {
-    throw new UserError(`git diff failed (exit ${exit}): ${stderr.trim()}`)
+    throw new UserError(`git ${cmd[0]} failed (exit ${exit}): ${stderr.trim()}`)
   }
-
-  // vx-lock.json (workspace-root metadata) is excluded like a gitignored
-  // file: re-running `vx lock` must not mark every project affected.
-  const changed = stdout.split('\n').filter((s) => s.length > 0 && s !== LOCKFILE_NAME)
-  return projectsContaining(args.workspaceRoot, changed, args.projects)
+  return stdout.split('\0').filter((s) => s.length > 0)
 }
 
 /**
@@ -79,18 +191,27 @@ async function verifyRef(workspaceRoot: string, ref: string): Promise<void> {
     stdout: 'pipe',
     stderr: 'pipe',
   })
-  if (proc.exitCode !== 0) {
+  if (proc.exitCode === 0) return
+  // `--verify --quiet` exits 1 for "that ref does not exist" and 128 for
+  // "git could not run here at all" (not a repository, corrupt objects,
+  // permissions). Reporting the second as a ref problem sends you hunting
+  // for a branch name when the real fault is the repository — so only exit
+  // 1 gets the ref message; anything else surfaces what git actually said.
+  const stderr = new TextDecoder().decode(proc.stderr).trim()
+  if (proc.exitCode !== 1) {
     throw new UserError(
-      `git ref "${ref}" did not resolve. Pass a branch or commit you have locally.`,
+      `git rev-parse failed (exit ${proc.exitCode}) in ${workspaceRoot}` +
+        (stderr.length > 0 ? `: ${stderr}` : ''),
     )
   }
+  throw new UserError(`git ref "${ref}" did not resolve. Pass a branch or commit you have locally.`)
 }
 
 function projectsContaining(
   workspaceRoot: string,
   changedRelPaths: readonly string[],
   projects: readonly ProjectMeta[],
-): Set<string> {
+): { owned: Set<string>; orphans: string[] } {
   // Index projects by their (canonical) dir, then for each changed path walk
   // its ancestor dirs bottom-up until one is a project dir. The FIRST hit is
   // the DEEPEST containing project — so a nested project still wins over its
@@ -100,19 +221,25 @@ function projectsContaining(
   // pays for.
   const dirToName = new Map<string, string>()
   for (const p of projects) dirToName.set(p.dir, p.name)
-  const out = new Set<string>()
+  const owned = new Set<string>()
+  // Paths that belong to no project. Only these can reach a task through a
+  // workspace-anchored glob, so they are the exact set worth asking about.
+  const orphans: string[] = []
   for (const rel of changedRelPaths) {
     let dir = path.resolve(workspaceRoot, rel)
+    let hit = false
     for (;;) {
       const name = dirToName.get(dir)
       if (name !== undefined) {
-        out.add(name)
+        owned.add(name)
+        hit = true
         break
       }
       const parent = path.dirname(dir)
       if (parent === dir) break // reached the filesystem root
       dir = parent
     }
+    if (!hit) orphans.push(rel)
   }
-  return out
+  return { owned, orphans }
 }

package/src/workspace/config-cache.ts

@@ -0,0 +1,304 @@
+// Config evaluation cache — skip re-evaluating a `vx.config` that cannot
+// have changed.
+//
+// A config is a program, and evaluating a thousand of them is the largest
+// fixed cost of a warm run (measured 2026-09-02: ~80 ms to import 1000
+// synthetic configs, ~12 ms to read the same files as data). The cache
+// stores the VALIDATED, JSON-serialised result keyed by everything the
+// evaluation could have observed:
+//
+//   - the config's bytes and the bytes of every file it transitively imports
+//     by RELATIVE specifier (the closure), paths included;
+//   - the workspace fingerprint (lockfiles), which covers package imports;
+//   - Bun's version, vx's version and this module's own version. A stored
+//     evaluation is served WITHOUT re-validation, so it must never outlive
+//     the validator that accepted it — a vx upgrade that tightens a rule
+//     re-evaluates every config once.
+//
+// It applies only to configs that are PROVABLY pure by a conservative static
+// check: every import is relative or `@vzn/vx` (whose `defineProject` /
+// `defineWorkspace` are identity functions), and no file in the closure
+// mentions a global through which the environment can leak — `process`,
+// `Bun`, `Date`, `fetch`, `import.meta`, `require`, a dynamic `import()`,
+// `await`, … Anything else evaluates live, exactly as before. The check
+// fails SAFE, never fast: a false negative costs one evaluation, a false
+// positive would cost a stale key, so the deny-list is deliberately wide.
+//
+// JSON is already the contract for a config object — `hashTaskConfig` and
+// `vx lock` both go through `JSON.stringify` — so a cached config derives
+// the same cache key as a live evaluation of the same bytes.
+
+import { realpathSync } from 'node:fs'
+import path from 'node:path'
+import { xxh3 } from '../util/index.js'
+import { VERSION } from '../version.js'
+
+/** Bump when the key derivation or the stored shape changes. */
+export const CONFIG_EVAL_VERSION = 2
+
+/** Where cached evaluations live; `Cache` implements it over `cache.db`. */
+export interface ConfigEvalStore {
+  /**
+   * The warm fast path (all optional; a store without them keys by bytes).
+   * `hashFile` is the file's git blob id behind an mtime/size/ctime/inode
+   * memo — no read when unchanged; `getConfigClosures` / `putConfigClosure`
+   * keep each config's ORDERED closure (the config first, then every
+   * relative import in discovery order), so a warm load keys the config by
+   * stat-hashing that list instead of reading and scanning every file
+   * (1,000 configs: 5 ms against 15, measured 2026-09-03). Sound because
+   * closure membership can only change by editing a listed file, which
+   * changes that file's hash and so the key; the one exception, an
+   * extensionless relative import whose resolution a new file could
+   * shadow, is never indexed.
+   */
+  hashFile?(file: string): Promise<string>
+  getConfigClosures?(configPaths: readonly string[]): Map<string, string[]>
+  putConfigClosure?(configPath: string, files: readonly string[]): void
+  getConfigEval(key: string): string | null
+  /**
+   * Many keys in one round-trip (optional; a store without it is asked per
+   * key). A warm 1000-project run paid 3.6 ms for 1,000 point lookups where
+   * one `IN` query costs 0.7 (measured 2026-09-03).
+   */
+  getConfigEvals?(keys: readonly string[]): Map<string, string>
+  putConfigEval(key: string, json: string): void
+}
+
+/** What `configEvalKey` learned besides the key, for the store's closure index. */
+export interface ConfigEvalKeyResult {
+  key: string
+  /** The config first, then every relative import in discovery order. */
+  closure: string[]
+  /** False when a relative import is extensionless — a new file could change its resolution. */
+  indexable: boolean
+}
+
+export interface ConfigEvalKeyArgs {
+  configPath: string
+  /**
+   * Per-file identity, the same function the store's warm path uses. Absent
+   * (tests, a store without one), the git blob id is computed from the
+   * bytes in-process.
+   */
+  hashFile?: (file: string) => Promise<string>
+  bytes: Uint8Array
+  workspaceFingerprint: string
+}
+
+/** Closure files beyond this count evaluate live — a preset tree this deep is not the case this serves. */
+const MAX_CLOSURE_FILES = 32
+
+// Globals through which an evaluation can observe something the file bytes
+// do not capture. Tested against the source with string literals and
+// comments removed (`stripLiterals`), because `node -e "process.exit(0)"`
+// is an ordinary command, not an impure config.
+// `global` and `self` are live objects in Bun (aliases of `globalThis`), so
+// a computed `global['proc' + 'ess']` reaches process without ever
+// spelling it; `Temporal` is a clock. All three were CACHED AS PURE before
+// they were listed (2026-09-03).
+const IMPURE_RE =
+  /\b(?:process|Bun|globalThis|global|self|fetch|Date|Temporal|Intl|crypto|performance|navigator|require|eval|Function|await|toLocale\w*)\b|import\s*\.\s*meta|Math\s*\.\s*random|\bimport\s*\(/
+
+// Static `import … from '…'` / `export … from '…'` / `import '…'` forms.
+// `[^;'"]*?` spans newlines, so multi-line specifier lists match.
+const IMPORT_RE =
+  /(?:^|[\n;])\s*(?:import|export)\b[^;'"]*?\bfrom\s*['"]([^'"]+)['"]|(?:^|[\n;])\s*import\s*['"]([^'"]+)['"]/g
+
+/** The one bare specifier a pure config may import: core's identity helpers and types. */
+const PURE_PACKAGE = '@vzn/vx'
+
+const decoder = new TextDecoder()
+
+/**
+ * `source` with every string literal, template literal and comment removed
+ * (template `${…}` expressions are kept — they are code). Returns `null`
+ * when a `/` in code position is neither a comment nor a division the
+ * lexer can prove: a regex literal can contain a quote, and a lexer that
+ * misreads one would swallow real code as a string — a false SAFE, the one
+ * outcome this module must never produce. Configs do not need regexes;
+ * such a config evaluates live.
+ */
+export function stripLiterals(source: string): string | null {
+  let out = ''
+  let i = 0
+  const n = source.length
+  // Brace depth per open template expression, so a `}` closing the
+  // expression is told apart from one closing an object literal inside it.
+  const templateDepth: number[] = []
+  while (i < n) {
+    const c = source[i]!
+    const next = source[i + 1]
+    if (c === '/' && next === '/') {
+      while (i < n && source[i] !== '\n') i++
+      continue
+    }
+    if (c === '/' && next === '*') {
+      const end = source.indexOf('*/', i + 2)
+      if (end === -1) return null
+      i = end + 2
+      continue
+    }
+    if (c === '/') return null
+    if (c === "'" || c === '"') {
+      i++
+      while (i < n && source[i] !== c) {
+        if (source[i] === '\\') i++
+        if (source[i] === '\n') return null
+        i++
+      }
+      if (i >= n) return null
+      i++
+      out += ' '
+      continue
+    }
+    if (c === '`') {
+      i++
+      for (;;) {
+        if (i >= n) return null
+        const t = source[i]!
+        if (t === '\\') {
+          i += 2
+          continue
+        }
+        if (t === '`') {
+          i++
+          break
+        }
+        if (t === '$' && source[i + 1] === '{') {
+          templateDepth.push(0)
+          i += 2
+          out += ' '
+          break
+        }
+        i++
+      }
+      continue
+    }
+    if (templateDepth.length > 0) {
+      const top = templateDepth.length - 1
+      if (c === '{') templateDepth[top]!++
+      else if (c === '}') {
+        if (templateDepth[top] === 0) {
+          // Back into the template literal: resume scanning its text.
+          templateDepth.pop()
+          i++
+          for (;;) {
+            if (i >= n) return null
+            const t = source[i]!
+            if (t === '\\') {
+              i += 2
+              continue
+            }
+            if (t === '`') {
+              i++
+              break
+            }
+            if (t === '$' && source[i + 1] === '{') {
+              templateDepth.push(0)
+              i += 2
+              break
+            }
+            i++
+          }
+          out += ' '
+          continue
+        }
+        templateDepth[top]!--
+      }
+    }
+    out += c
+    i++
+  }
+  return out
+}
+
+/**
+ * The cache key for evaluating `configPath`, or `null` when the config is
+ * not provably pure (or its closure cannot be read), in which case the
+ * caller evaluates live and stores nothing.
+ */
+/** `git hash-object` of `bytes` (sha1 domain), the identity `Cache.hashFile` returns for a sha1 repo. */
+export function blobOidOf(bytes: Uint8Array): string {
+  const hasher = new Bun.CryptoHasher('sha1')
+  hasher.update(`blob ${bytes.byteLength}\0`)
+  hasher.update(bytes)
+  return hasher.digest('hex')
+}
+
+function keySeed(workspaceFingerprint: string): bigint {
+  return xxh3(
+    `vx-config-eval-v${CONFIG_EVAL_VERSION}\0${VERSION}\0${Bun.version}\0${workspaceFingerprint}\0`,
+  )
+}
+
+const EXPLICIT_EXT = /\.(?:m?[jt]s|cjs|cts)$/
+
+export async function configEvalKey(a: ConfigEvalKeyArgs): Promise<ConfigEvalKeyResult | null> {
+  let h = keySeed(a.workspaceFingerprint)
+  const hashOf = a.hashFile ?? (async (_file: string, bytes?: Uint8Array) => blobOidOf(bytes!))
+  const visited = new Set<string>([a.configPath])
+  const closure: string[] = []
+  let indexable = true
+  const queue: Array<{ file: string; bytes: Uint8Array }> = [{ file: a.configPath, bytes: a.bytes }]
+  while (queue.length > 0) {
+    const { file, bytes } = queue.shift()!
+    const source = decoder.decode(bytes)
+    const code = stripLiterals(source)
+    // A backslash in code position is an identifier escape (`\u0070rocess`
+    // IS `process`) — the one spelling the deny-list cannot see. Refuse it.
+    if (code === null || code.includes('\\') || IMPURE_RE.test(code)) return null
+    const identity = a.hashFile ? await a.hashFile(file) : await hashOf(file, bytes)
+    h = xxh3(`${file}\0${identity}`, h)
+    closure.push(file)
+    for (const m of source.matchAll(IMPORT_RE)) {
+      const spec = m[1] ?? m[2]!
+      if (spec === PURE_PACKAGE) continue
+      if (!spec.startsWith('./') && !spec.startsWith('../')) return null
+      if (!EXPLICIT_EXT.test(spec)) indexable = false
+      let resolved: string
+      try {
+        // Real-pathed: `Bun.resolveSync` answers with the symlinked spelling
+        // on one call and the real one on another (a tmp workspace under
+        // /var vs /private/var), and the key folds the path — a spelling
+        // that drifts between runs is a spurious miss and a duplicated
+        // memo row.
+        resolved = realpathSync(Bun.resolveSync(spec, path.dirname(file)))
+      } catch {
+        return null
+      }
+      if (visited.has(resolved)) continue
+      if (resolved.split(path.sep).includes('node_modules')) return null
+      visited.add(resolved)
+      if (visited.size > MAX_CLOSURE_FILES) return null
+      try {
+        queue.push({ file: resolved, bytes: await Bun.file(resolved).bytes() })
+      } catch {
+        return null
+      }
+    }
+  }
+  return { key: h.toString(16).padStart(16, '0'), closure, indexable }
+}
+
+/**
+ * The warm path: the key for a config whose ordered closure the store
+ * remembers, from per-file identities alone — no read, no scan. The fold is
+ * byte-identical to `configEvalKey`'s, so the two paths share entries. A
+ * changed or vanished file changes its identity and misses, and the slow
+ * path then re-indexes.
+ */
+export async function configEvalKeyFromClosure(a: {
+  closure: readonly string[]
+  hashFile: (file: string) => Promise<string>
+  workspaceFingerprint: string
+}): Promise<string | null> {
+  let h = keySeed(a.workspaceFingerprint)
+  let identities: string[]
+  try {
+    identities = await Promise.all(a.closure.map((f) => a.hashFile(f)))
+  } catch {
+    return null
+  }
+  for (let i = 0; i < a.closure.length; i++) h = xxh3(`${a.closure[i]}\0${identities[i]}`, h)
+  return h.toString(16).padStart(16, '0')
+}