@vzn/vx 0.0.650 → 0.0.651

package/src/ui/version-line.ts

@@ -0,0 +1,28 @@
+// `vx --version`'s one line, imported alone: the answer that loads nothing
+// else (the ui barrel costs ~20 ms, `node:tty` 17 ms). Painted as the
+// `status` component's verb and the info hue; piped, the same words a
+// script reads.
+
+import { fstatSync } from 'node:fs'
+
+function versionLine(version: string, where: string, on: boolean): string {
+  const sgr = (code: string, text: string): string => (on ? `\x1b[${code}m${text}\x1b[0m` : text)
+  return `${sgr('1', 'vx')} ${sgr('38;2;6;182;212', version)}${where === '' ? '' : sgr('2', where)}\n`
+}
+
+/**
+ * Write the line to stdout. Colour is decided here, not by `detectColors`:
+ * fd 1 as a character device is the TTY answer, and a CI's log is not
+ * painted for this one line. `Bun.stdout`, not `process.stdout`: the Node
+ * stream's first touch is ~7 ms, half of this verb (2026-10-02). A reader
+ * gone (EPIPE) is no failure of the line.
+ */
+export async function printVersion(version: string, where: string): Promise<void> {
+  const env = process.env
+  const on = env['NO_COLOR']
+    ? false
+    : env['FORCE_COLOR'] !== undefined
+      ? env['FORCE_COLOR'] !== '0' && env['FORCE_COLOR'] !== 'false'
+      : env['TERM'] !== 'dumb' && fstatSync(1).isCharacterDevice()
+  await Bun.write(Bun.stdout, versionLine(version, where, on)).catch(() => {})
+}

package/src/util/config-frame.ts

@@ -7,9 +7,11 @@
 import { readFileSync } from 'node:fs'
 import path from 'node:path'
 
-// `<file>: tasks.<path>[:] …`, or a top-level `<file> has unknown field …`,
-// from a project's vx.config or the workspace's .vx/workspace.ts.
-const HEAD = /^(\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s)(?:: (tasks\.[^\s:]+)(:?))? /
+// `<file>: tasks.<path>[:] …`, `<file>: \`<setting>\` …`, `<file>: task name "<name>" …`,
+// or a top-level `<file> has unknown field …`, from a project's vx.config
+// or the workspace's .vx/workspace.ts.
+const HEAD =
+  /^(\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s)(?:: (?:(tasks\.[^\s:]+)(:?)|`([^`\n]+)`|task name ("(?:[^"\\\n]|\\.)*")))? /
 
 /**
  * The message with its file named at `line:col`, relative to `cwd`, and a
@@ -19,13 +21,22 @@ const HEAD = /^(\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s)(?:: (task
 export function configErrorFrame(message: string, cwd: string): string | undefined {
   const head = HEAD.exec(message)
   if (head === null) return positionFrame(message, cwd)
-  const [, file, fieldPath, colon] = head as unknown as [string, string, string?, string?]
+  const [, file, tasksPath, colon, setting, taskName] = head as unknown as [
+    string,
+    string,
+    string?,
+    string?,
+    string?,
+    string?,
+  ]
   const rest = message.slice(head[0].length)
   // The field the refusal is about, past the path that leads to it:
   // `has unknown field "comand"`, or `tasks.build: \`cache\` is not allowed`.
   const named =
     colon === ':' ? /^`([^`]+)`/.exec(rest) : /^has (?:unknown )?field "([^"]+)"/.exec(rest)
-  const segments = [...(fieldPath?.split('.') ?? []), ...(named === null ? [] : [named[1]!])]
+  const fieldPath =
+    taskName === undefined ? (tasksPath ?? setting)?.split('.') : ['tasks', JSON.parse(taskName)]
+  const segments = [...(fieldPath ?? []), ...(named === null ? [] : [named[1]!])]
   if (segments.length === 0) return undefined
   let source: string
   try {
@@ -86,29 +97,43 @@ function framed(
 
 /**
  * Where the last of `segments` is declared as a key, each one searched
- * after the one before. A task name holds dots (`lint.oxfmt`), so the
- * longest run of segments that names a key wins.
+ * inside the object literal the one before holds. A task name holds dots
+ * (`lint.oxfmt`), so the longest run of segments that names a key wins.
+ * A last segment the object leaves out (`outputs is required`) is placed
+ * at its parent: searched past it, the next task's `outputs` was framed.
  */
 function locate(
   source: string,
   segments: readonly string[],
 ): { line: number; col: number } | undefined {
   let pos = 0
+  let end = source.length
   let found = -1
   let i = 0
   while (i < segments.length) {
     let next = -1
     for (let j = segments.length; j > i && next < 0; j--) {
       const name = segments.slice(i, j).join('.')
-      const re = new RegExp(`(?<![\\w$.])(['"\`]?)${escapeRe(name)}\\1\\s*:`, 'g')
+      // An empty key is quoted, or every `:` matched; a control character
+      // is in the source as its escape (`'\u001b'`).
+      const spelled = JSON.stringify(name).slice(1, -1)
+      const names = spelled === name ? escapeRe(name) : `${escapeRe(name)}|${escapeRe(spelled)}`
+      const re = new RegExp(
+        `(?<![\\w$.])(['"\`]${name === '' ? '' : '?'})(?:${names})\\1\\s*:`,
+        'g',
+      )
       re.lastIndex = pos
       const m = re.exec(source)
-      if (m === null) continue
+      if (m === null || m.index >= end) continue
       found = m.index + m[1]!.length
       pos = m.index + m[0].length
+      end = literalEnd(source, pos)
       next = j
     }
-    if (next < 0) return undefined
+    if (next < 0) {
+      if (found < 0 || i !== segments.length - 1) return undefined
+      break
+    }
     i = next
   }
   if (found < 0) return undefined
@@ -117,6 +142,36 @@ function locate(
   return { line, col: found - before.lastIndexOf('\n') }
 }
 
+/**
+ * Where the object or array literal starting at `from` (past blanks) ends;
+ * `from` itself when the value is no literal (`exec: 'x'`, `cache: shared`),
+ * so no key is searched inside it.
+ */
+function literalEnd(source: string, from: number): number {
+  let i = from
+  while (i < source.length && /\s/.test(source[i]!)) i++
+  if (source[i] !== '{' && source[i] !== '[') return from
+  let depth = 0
+  for (; i < source.length; i++) {
+    const c = source[i]!
+    if (c === '"' || c === "'" || c === '`') {
+      for (i++; i < source.length && source[i] !== c; i++) if (source[i] === '\\') i++
+    } else if (c === '/' && source[i + 1] === '/') {
+      i = source.indexOf('\n', i)
+      if (i < 0) return source.length
+    } else if (c === '/' && source[i + 1] === '*') {
+      i = source.indexOf('*/', i + 2)
+      if (i < 0) return source.length
+      i++
+    } else if (c === '{' || c === '[') depth++
+    else if (c === '}' || c === ']') {
+      depth--
+      if (depth === 0) return i
+    }
+  }
+  return source.length
+}
+
 function escapeRe(s: string): string {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 }

package/src/util/edit-distance.ts

@@ -37,9 +37,14 @@ export function nearest(
   // Two edits rewrite half of a word of four letters or fewer (`--poll`
   // read as `--all`, `vx test` as `last`), unless they swap two letters.
   const short = maxEdits === 2 && name.replace(/^-+/, '').length <= 4
+  // The same word in another case is the nearest whatever its length:
+  // `--ALL` is three edits from `--all`, `BUILD` five from `build`.
+  const lower = name.toLowerCase()
+  const list = [...candidates]
+  for (const c of list) if (c !== name && c.toLowerCase() === lower) return c
   let best: string | undefined
   let bestD = maxEdits + 1
-  for (const c of candidates) {
+  for (const c of list) {
     // Capped one past the budget, so "past it" never reads as within it:
     // `--continue-on-error` was nine edits from `--concurrency`, capped to
     // the three `vx run`'s same-prefix hint allows, and offered.

package/src/util/index.ts

@@ -27,25 +27,11 @@ export {
 } from './errors.js'
 export { configErrorFrame, configRefusal } from './config-frame.js'
 export { envFlagOn } from './env-flag.js'
-export {
-  detectColors,
-  dumbTerminal,
-  ERROR,
-  identityColor,
-  paint,
-  SUCCESS,
-  WARN,
-  type ColorSupport,
-} from './colors.js'
-export { barWidth, gradientRule, ruleWidth } from './report.js'
-import * as ui from './ui.js'
-export { refusalNotice, sayLine, sayNotice } from './refusal-notice.js'
-export { ui }
 export { keysSorted, xxh3, xxh3hex } from './hash.js'
 export {
   beginRun,
   mark,
-  printTimings,
+  timingLines,
   restartTimings,
   span,
   stageTimes,
@@ -86,6 +72,7 @@ export {
 } from './paths.js'
 export {
   claimExitForSignal,
+  dieOf,
   exitClaimedBySignal,
   killGraceMs,
   settleWithin,

package/src/util/paths.ts

@@ -523,15 +523,33 @@ export function braceAlternatives(pattern: string): string[] {
   return expandBraces(pattern, false)
 }
 
+/**
+ * Where the `[`…`]` class opening at `i` ends, as `bracket-literal.ts`
+ * reads one (a `]` right after the `[` is a member); `i` for a `[` with no
+ * `]`, which `Bun.Glob` takes literally. A `,` `{` or `}` inside a class
+ * is a member: split there, `src/{a[,]b,x}.ts` became `src/a[.ts` and
+ * `src/]b.ts`, so an edit to `src/a,b.ts` kept the key (turborepo#13763).
+ */
+function classEnd(pattern: string, i: number): number {
+  const end = pattern.indexOf(']', i + 2)
+  return end === -1 ? i : end
+}
+
 function expandBraces(pattern: string, slashOnly: boolean): string[] {
   if (pattern.includes('\\')) return [pattern]
-  for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
+  for (let open = 0; open < pattern.length; open++) {
+    if (pattern[open] === '[') {
+      open = classEnd(pattern, open)
+      continue
+    }
+    if (pattern[open] !== '{') continue
     let depth = 0
     const cuts: number[] = []
     let close = -1
     for (let i = open; i < pattern.length && close === -1; i++) {
       const c = pattern[i]
-      if (c === '{') depth++
+      if (c === '[') i = classEnd(pattern, i)
+      else if (c === '{') depth++
       else if (c === '}' && --depth === 0) close = i
       else if (c === ',' && depth === 1) cuts.push(i)
     }

package/src/util/secret-mask.ts

@@ -115,15 +115,51 @@ export function secretMask(
     for (const name in source) {
       const value = source[name]
       if (secretNamed(name)) add(value)
-      if (value?.includes('://') === true && value.includes('@')) {
-        for (const m of value.matchAll(URL_PASSWORD)) add(m[1])
-      }
+      if (value?.includes('://') === true && value.includes('@'))
+        for (const pw of urlPasswords(value)) add(pw)
     }
     for (const name of named) add(source[name])
   }
   // This process's secrets: the environment's and the held ones.
   if (sources.includes(process.env)) for (const value of held) add(value)
   if (values.size === 0) return null
+  const found = [...values]
+  for (const m of masks) if (sameValues(m.values, found)) return m.mask
+  if (masks.length >= MASKS_KEPT) masks.shift()
+  const mask = maskOf(values)
+  masks.push({ values: found, mask })
+  return mask
+}
+
+/**
+ * Masks built, with the values each masks: every task of a run asks for
+ * the same one, and building it (a sort, a RegExp the engine compiles
+ * again) took 30 ms of a cold run's main thread at 500 tasks. The values
+ * are read fresh on every call; only the same values reuse a mask.
+ */
+const masks: Array<{ values: readonly string[]; mask: SecretMask }> = []
+const MASKS_KEPT = 8
+
+function sameValues(a: readonly string[], b: readonly string[]): boolean {
+  if (a.length !== b.length) return false
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false
+  return true
+}
+
+/** Each URL value's passwords, found once: the value decides them. */
+const urlPasswordsOf = new Map<string, string[]>()
+
+function urlPasswords(value: string): string[] {
+  let found = urlPasswordsOf.get(value)
+  if (found === undefined) {
+    found = []
+    for (const m of value.matchAll(URL_PASSWORD)) if (m[1] !== undefined) found.push(m[1])
+    urlPasswordsOf.set(value, found)
+  }
+  return found
+}
+
+function maskOf(values: ReadonlySet<string>): SecretMask {
   // Longest first, so a value holding another is replaced whole.
   const sorted = [...values].sort((a, b) => b.length - a.length)
   const pattern = new RegExp(

package/src/util/settle.ts

@@ -69,6 +69,37 @@ export async function settleWithin(p: Promise<unknown>, ms: number): Promise<boo
 // with the run's verdict (1), so bin.ts asks before it exits.
 let signalOwnsExit = false
 
+/** How long `dieOf` waits for its own signal to land before the caller exits anyway. */
+const SELF_SIGNAL_WAIT_MS = 1000
+
+/**
+ * Die of `signal`: its listeners off, so Bun restores the default action,
+ * the signal sent to this process, and the caller held until it lands. A
+ * kill is not always delivered before it returns: a signal another thread
+ * takes, or one a tracer holds (the sandbox's `strace -f` sees every
+ * signal before the tracee does), lands later, and the `process.exit`
+ * after it won: vx exited with the signal's code (130), not of the
+ * signal, and a script running it
+ * went on (CI, PR #4867). Bounded: the caller's exit code is the fallback
+ * should the signal never land. `testTimerMs('SELF_SIGNAL_DELAY')` sends
+ * it from a helper that late instead, the window a test widens.
+ */
+export function dieOf(signal: 'SIGINT' | 'SIGTERM' | 'SIGHUP'): void {
+  process.removeAllListeners(signal)
+  const lateMs = testTimerMs('SELF_SIGNAL_DELAY', 0)
+  if (lateMs > 0) {
+    Bun.spawn(['sh', '-c', `sleep ${lateMs / 1000}; kill -${signal.slice(3)} ${process.pid}`], {
+      stdio: ['ignore', 'ignore', 'ignore'],
+    })
+  } else {
+    process.kill(process.pid, signal)
+  }
+  // Synchronous: an `exit` listener's loop never turns again. A signal
+  // that lands ends the process here; the wait costs nothing then.
+  const until = performance.now() + lateMs + SELF_SIGNAL_WAIT_MS
+  while (performance.now() < until) Bun.sleepSync(5)
+}
+
 /** A signal's handler will end the process: bin.ts leaves the exit to it. */
 export function claimExitForSignal(): void {
   signalOwnsExit = true

package/src/util/timing.ts

@@ -9,7 +9,6 @@
 // prints (a push per stage, ~15 a run): a telemetry sink draws them as
 // spans (`stageTimes`). The per-call `span`s stay off unless enabled.
 
-import { detectColors, paint } from './colors.js'
 const enabled = process.env.VX_DEBUG_TIMING === 'true' || process.env.VX_DEBUG_TIMING === '1'
 let t0 = Bun.nanoseconds()
 // The wall clock at t0, read then: `performance.timeOrigin` plus the
@@ -88,9 +87,9 @@ export function span(label: string): () => void {
   }
 }
 
-/** Print the stage table (once, at the end of a run). No-op unless enabled. */
-export function printTimings(): void {
-  if (!enabled || marks.length === 0) return
+/** The stage table's lines (once, at the end of a run); none unless enabled. */
+export function timingLines(): string[] | undefined {
+  if (!enabled || marks.length === 0) return undefined
   const width = Math.max(...marks.map(([l]) => l.length))
   let prev = 0
   const lines = ['[vx timing]  stage'.padEnd(width + 14) + '    own   cumulative']
@@ -118,16 +117,5 @@ export function printTimings(): void {
       '             (wall per call, summed; concurrent calls overlap — compare spans, not totals)',
     )
   }
-  const c = detectColors(process.stderr)
-  process.stderr.write(
-    `${lines
-      .map((l) =>
-        l.startsWith('[vx timing]')
-          ? `${paint('#06b6d4', '[vx timing]', c, { bold: true })}${paint('', l.slice(11), c, { dim: true })}`
-          : l.startsWith('             (')
-            ? paint('', l, c, { dim: true })
-            : l,
-      )
-      .join('\n')}\n`,
-  )
+  return lines
 }

package/src/workspace/affected.ts

@@ -18,8 +18,16 @@ import {
   notAWorkTree,
   relPosix,
   UserError,
+  xxh3hex,
 } from '../util/index.js'
-import { LOCKFILE_NAME, lockKey } from './lockfile.js'
+import { LOCKFILE_NAME, lockEntries, lockKey } from './lockfile.js'
+import {
+  DEPENDENCIES_LOCK_NAME,
+  type DependenciesLock,
+  dependantsOf,
+  recordedDigests,
+  parseDependenciesLock,
+} from './dependencies-lock.js'
 import { configImportOwners, realpathOr } from './config-imports.js'
 import { WORKSPACE_CONFIG_FILENAMES } from './project-loader.js'
 import { bunPatchFiles } from './fingerprint.js'
@@ -143,6 +151,10 @@ export interface FingerprintClaims {
   }): Promise<ReadonlySet<string> | undefined>
   /** The files a claimed file names that its claimant keys too; absent = it reads none. */
   extraFiles?(file: string, bytes: Uint8Array): Promise<readonly string[] | undefined>
+  /** Each project's digest of a claimed file now (`FingerprintClaim.digests`); absent or undefined = none. */
+  digests?(
+    file: string,
+  ): Promise<{ hash: string; projects: Readonly<Record<string, string>> } | undefined>
 }
 
 /**
@@ -388,6 +400,12 @@ export async function affectedChanges(
   if (wsConfig !== undefined) return everything(wsConfig)
   // The workspace file is loaded once, for the extra files below and the
   // changed root names after them.
+  // The base commit's `vx lock` record, read once and only when asked.
+  let baseDeps: Promise<DependenciesLock | null> | undefined
+  const baseDependencies = (): Promise<DependenciesLock | null> =>
+    (baseDeps ??= gitBytesAt(args.workspaceRoot, base, DEPENDENCIES_LOCK_NAME).then(
+      parseDependenciesLock,
+    ))
   let claims: FingerprintClaims | undefined
   const loadClaims = async (): Promise<FingerprintClaims | undefined> =>
     (claims ??= await args.fingerprintClaims?.())
@@ -446,6 +464,32 @@ export async function affectedChanges(
       if (patch !== undefined) return everything(patch)
     }
   }
+  // The projects whose digest of `file` moved, from the base's recorded
+  // digests and the claimant's now: the base side is never parsed. Null
+  // when the base recorded none for these bytes (no lock, or another
+  // hash) or the claimant gives none now: `affected` answers then.
+  const recordedMoves = async (
+    asked: FingerprintClaims,
+    file: string,
+    before: Uint8Array | null,
+    after: Uint8Array | null,
+  ): Promise<ReadonlySet<string> | null> => {
+    if (before === null || after === null || asked.digests === undefined) return null
+    const base = await baseDependencies()
+    const was = base === null ? undefined : recordedDigests(base, file)
+    // Base digests that read another file are that file's at the base,
+    // which the record does not prove.
+    if (was === undefined || was.hash !== xxh3hex(before) || Object.keys(was.extras).length > 0)
+      return null
+    const now = await asked.digests(file)
+    if (now === undefined) return null
+    const moved = new Set<string>()
+    for (const p of projects) {
+      const d = was.of(lockKey(rootDir, p.dir))
+      if (d === undefined || d !== now.projects[p.name]) moved.add(p.name)
+    }
+    return moved
+  }
   const claimedOwned = new Map<string, string>()
   const rootNamesChanged = changed.filter((p) => !p.includes('/'))
   for (const file of extrasBy.keys()) {
@@ -455,12 +499,11 @@ export async function affectedChanges(
   for (const file of rootNamesChanged) {
     if (claimed === undefined || !claimed.files.has(file)) continue
     const extras = extrasBy.get(file)
-    const answer = await claimed.affected({
-      file,
-      before: await gitBytesAt(args.workspaceRoot, base, file),
-      after: await bytesOrNull(path.join(args.workspaceRoot, file)),
-      ...(extras !== undefined ? { extras } : {}),
-    })
+    const before = await gitBytesAt(args.workspaceRoot, base, file)
+    const after = await bytesOrNull(path.join(args.workspaceRoot, file))
+    const answer =
+      (extras === undefined ? await recordedMoves(claimed, file, before, after) : undefined) ??
+      (await claimed.affected({ file, before, after, ...(extras !== undefined ? { extras } : {}) }))
     const why =
       extras === undefined || changed.includes(file)
         ? file
@@ -505,20 +548,8 @@ export async function affectedChanges(
   if (diffed.paths.includes(LOCKFILE_NAME) || untracked.includes(LOCKFILE_NAME)) {
     // A side with no lock (or one that will not parse) ran nothing from
     // it: the paths of the configs say what changed, as before the lock.
-    const entries = (bytes: Uint8Array | null): Record<string, unknown> | null => {
-      if (bytes === null) return null
-      try {
-        const locked = (JSON.parse(new TextDecoder().decode(bytes)) as { projects?: unknown })
-          .projects
-        return typeof locked === 'object' && locked !== null
-          ? (locked as Record<string, unknown>)
-          : null
-      } catch {
-        return null
-      }
-    }
-    const before = entries(await gitBytesAt(args.workspaceRoot, base, LOCKFILE_NAME))
-    const after = entries(await bytesOrNull(path.join(args.workspaceRoot, LOCKFILE_NAME)))
+    const before = lockEntries(await gitBytesAt(args.workspaceRoot, base, LOCKFILE_NAME))
+    const after = lockEntries(await bytesOrNull(path.join(args.workspaceRoot, LOCKFILE_NAME)))
     const same = (dir: string): boolean =>
       before === null ||
       after === null ||
@@ -538,9 +569,23 @@ export async function affectedChanges(
     const atBase = await gitBlobsAt(args.workspaceRoot, base, markers)
     // A config the base had in a directory that is no project now: the
     // project is gone, and with it the edge naming who depended on it,
-    // while their keys lost an upstream. Today's graph cannot say who.
-    const gone = await removedProjectConfig(args.workspaceRoot, atBase, projects)
-    if (gone !== undefined) return everything(gone)
+    // while their keys lost an upstream. Today's graph cannot say who; the
+    // base's dependencies lock can. Without one, every project.
+    // A config that moved, the same bytes under a new project, is no
+    // loss: its files select it where it lives.
+    const nameAt = new Map(projects.map((p) => [lockKey(rootDir, p.dir), p.name]))
+    for (const gone of await removedProjectConfigs(args.workspaceRoot, atBase, projects)) {
+      const recorded = await baseDependencies()
+      if (recorded === null) return everything(gone)
+      const held = dependantsOf(recorded, path.posix.dirname(gone)).flatMap(
+        (d) => nameAt.get(d) ?? [],
+      )
+      for (const name of held) {
+        owned.add(name)
+        whole.add(name)
+        if (!claimedOwned.has(name)) claimedOwned.set(name, gone)
+      }
+    }
     for (const name of parentsOfNewNested(args.workspaceRoot, atBase, projects)) {
       owned.add(name)
       whole.add(name)
@@ -587,7 +632,12 @@ export async function affectedChanges(
 }
 
 /** What vx writes under `.vx`, which no key reads (cache/inputs.ts `ALWAYS_IGNORE`). */
-const VX_OWN: ReadonlySet<string> = new Set([LOCKFILE_NAME, '.vx/.gitattributes', '.vx/.gitignore'])
+const VX_OWN: ReadonlySet<string> = new Set([
+  LOCKFILE_NAME,
+  DEPENDENCIES_LOCK_NAME,
+  '.vx/.gitattributes',
+  '.vx/.gitignore',
+])
 
 const CONFIG_NAMES: ReadonlySet<string> = new Set(PROJECT_CONFIG_FILENAMES)
 /**
@@ -632,22 +682,31 @@ function parentsOfNewNested(
   return out
 }
 
-/** The first config in `atBase` the base had whose file and project are both gone now. */
-async function removedProjectConfig(
+/** Each config in `atBase` the base had whose file and project are both gone now. */
+async function removedProjectConfigs(
   workspaceRoot: string,
   atBase: ReadonlyMap<string, Uint8Array | null>,
   projects: readonly ProjectMeta[],
-): Promise<string | undefined> {
+): Promise<string[]> {
   const dirs = new Set(projects.map((p) => p.dir.normalize('NFC')))
+  const gone: string[] = []
+  let added: Uint8Array[] | undefined
   for (const [rel, bytes] of atBase) {
     // A manifest's directory may never have been a project; a config's was.
     if (bytes === null || !CONFIG_NAMES.has(path.posix.basename(rel))) continue
     const dir = path.resolve(workspaceRoot, path.posix.dirname(rel)).normalize('NFC')
     if (dirs.has(dir)) continue
     if (await Bun.file(path.join(workspaceRoot, rel)).exists()) continue
-    return rel
+    // Each config the base lacked, read once, only when one went.
+    added ??= await Promise.all(
+      [...atBase]
+        .filter(([r, b]) => b === null && CONFIG_NAMES.has(path.posix.basename(r)))
+        .map(([r]) => bytesOrNull(path.join(workspaceRoot, r))),
+    ).then((all) => all.filter((b): b is Uint8Array => b !== null))
+    if (added!.some((b) => Buffer.from(b).equals(bytes))) continue
+    gone.push(rel)
   }
-  return undefined
+  return gone
 }
 
 /**

package/src/workspace/config-schema.ts

@@ -440,6 +440,7 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
           files?: unknown
           affected?: unknown
           extraFiles?: unknown
+          digests?: unknown
         } | null
         if (
           claim === null ||
@@ -447,10 +448,11 @@ export function validateWorkspace(config: WorkspaceConfig, configPath: string):
           !Array.isArray(claim.files) ||
           claim.files.length === 0 ||
           typeof claim.affected !== 'function' ||
-          (claim.extraFiles !== undefined && typeof claim.extraFiles !== 'function')
+          (claim.extraFiles !== undefined && typeof claim.extraFiles !== 'function') ||
+          (claim.digests !== undefined && typeof claim.digests !== 'function')
         ) {
           throw new UserError(
-            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function, extraFiles?: function }`,
+            `${configPath}: \`plugins[${i}].fingerprint\` of plugin '${pkg}' must be { files: [name, …], affected: function, extraFiles?: function, digests?: function }`,
           )
         }
         for (const file of claim.files as unknown[]) {