@vltpkg/graph 1.4.0 → 1.6.0

package/dist/install.d.ts

@@ -3,19 +3,36 @@ import type { LoadOptions } from './actual/load.ts';
 import type { AddImportersDependenciesMap } from './dependencies.ts';
 import type { DepID } from '@vltpkg/dep-id';
 import type { Graph } from './index.ts';
+import type { Diff } from './diff.ts';
+import type { LinkSkillsResult } from './skills/index.ts';
 export type InstallOptions = LoadOptions & {
     packageInfo: PackageInfoClient;
     cleanInstall?: boolean;
     allowScripts: string;
     saveExact?: boolean;
     savePrefix?: string;
+    /**
+     * DSS query: packages whose agent skills get linked into the
+     * project's agent skill dirs after install. Selectors may end with
+     * `:skill()`. Unset or `:not(*)`: none.
+     */
+    allowSkills?: string;
+    /**
+     * agent skill dirs, relative to projectRoot. Unset: detect; `[]`:
+     * none
+     */
+    skillsDirs?: string[];
+    /** store dirs of these nodes are never removed, eg the running vlt */
+    keepNodes?: ReadonlySet<DepID>;
 };
-export declare const install: (options: InstallOptions, add?: AddImportersDependenciesMap) => Promise<{
+/**
+ * Result of {@link install}.
+ */
+export type InstallResult = {
+    buildQueue?: DepID[];
     graph: Graph;
-    diff: undefined;
-    buildQueue?: undefined;
-} | {
-    buildQueue: DepID[] | undefined;
-    graph: Graph;
-    diff: import("./diff.ts").Diff;
-}>;
+    diff?: Diff;
+    /** skill links added or removed, if any */
+    skills?: LinkSkillsResult;
+};
+export declare const install: (options: InstallOptions, add?: AddImportersDependenciesMap) => Promise<InstallResult>;

package/dist/install.js

@@ -16,11 +16,23 @@ import { getImporterSpecs } from "./ideal/get-importer-specs.js";
 import { lockfile } from "./index.js";
 import { updatePackageJson } from "./reify/update-importers-package-json.js";
 import { Monorepo } from '@vltpkg/workspaces';
+import { assertSkillsDirs } from "./skills/dirs.js";
+import { assertQuery } from "./filter-nodes-by-query.js";
 export const install = async (options, add) => {
     // Validate incompatible options
     if (options.lockfileOnly && options.cleanInstall) {
         throw error('Cannot use --lockfile-only with --clean-install (ci command). Clean install requires filesystem operations.');
     }
+    // unset or `:not(*)`: no skills work at all, the skills code never
+    // loads
+    const allowSkills = options.allowSkills === ':not(*)' ?
+        undefined
+        : options.allowSkills;
+    // fail before installing, not after
+    if (allowSkills) {
+        await assertQuery(allowSkills, 'allow-skills', ['skill']);
+        assertSkillsDirs(options.projectRoot, options.skillsDirs);
+    }
     if (options.expectLockfile || options.frozenLockfile) {
         const lockfilePath = resolve(options.projectRoot, 'vlt-lock.json');
         if (!existsSync(lockfilePath)) {
@@ -178,6 +190,7 @@ export const install = async (options, add) => {
             remover.confirm();
         }
     }
+    let result;
     try {
         const remove = Object.assign(new Map(), {
             modifiedDependencies: false,
@@ -226,6 +239,7 @@ export const install = async (options, add) => {
                     ...options,
                     add,
                     graph,
+                    modifiers,
                     remove,
                 })
                 : undefined;
@@ -247,7 +261,7 @@ export const install = async (options, add) => {
             remove,
             remover,
         });
-        return { buildQueue, graph, diff };
+        result = { buildQueue, graph, diff };
     }
     catch (err) {
         /* c8 ignore next */
@@ -262,4 +276,14 @@ export const install = async (options, add) => {
         catch { }
         throw err;
     }
+    // after the try: a link failure must not roll back the install
+    if (!allowSkills)
+        return result;
+    const { linkSkills } = await import("./skills/index.js");
+    result.skills = await linkSkills({
+        ...options,
+        graph: result.graph,
+        target: allowSkills,
+    });
+    return result;
 };

package/dist/lockfile/load-edges.js

@@ -3,7 +3,7 @@ import { error } from '@vltpkg/error-cause';
 import { fastSplit } from '@vltpkg/fast-split';
 import { Spec } from '@vltpkg/spec/browser';
 import { longDependencyTypes } from '@vltpkg/types';
-import { isDependencyTypeShort } from "../dependencies.js";
+import { asDependencySpecError, isDependencyTypeShort, } from "../dependencies.js";
 const retrieveNodeFromGraph = (key, value, graph, fromId, seenNodes) => {
     const foundNode = graph.nodes.get(asDepID(fromId));
     if (!foundNode) {
@@ -104,7 +104,15 @@ export const loadEdges = (graph, edges, options, cache) => {
         // loaded), so overriding here would always inject `undefined`
         // and silently revert to the default npm registry.
         // See vltpkg/vltpkg#1580.
-        const spec = parseEdgeSpec(specName, valRest.substring(0, vrSplit), options, cache);
+        let spec;
+        try {
+            spec = parseEdgeSpec(specName, valRest.substring(0, vrSplit), options, cache);
+        }
+        catch (er) {
+            // spec text is the lockfile's; hidden lockfile errors are
+            // swallowed, so only vlt-lock.json surfaces here
+            throw asDependencySpecError(er, fromNode, depType, 'vlt-lock.json');
+        }
         if (useOptimizations) {
             edgeProcessingQueue.push({
                 fromNode,

package/dist/modifiers.d.ts

@@ -101,6 +101,11 @@ export type ModifierActiveEntry = {
  * for (const entry of entries)
  *   modifier.updateActiveEntry(fromNode, entry)
  * ```
+ *
+ * A trailing `:workspace` right after an importer selector, e.g.
+ * `:project > :workspace`, is expanded into one `#<name>` entry per
+ * named workspace of the graph, on its first `tryImporter` or
+ * `importerEdgeModifier` call.
  */
 export declare class GraphModifier {
     #private;
@@ -126,6 +131,12 @@ export declare class GraphModifier {
      * root's own b edge is still the manifest's to validate and heal.
      */
     targetsImporterEdge(importer: Node, spec: Spec): boolean;
+    /**
+     * The modifier governing the direct `importer -> spec.name` edge, see
+     * {@link GraphModifier.targetsImporterEdge}. The most specific one
+     * wins, same as during the graph build.
+     */
+    importerEdgeModifier(importer: Node, spec: Spec): ModifierEntry | undefined;
     /**
      * Selector of the modifier that wins the direct `importer -> spec.name`
      * edge, if it removes it (value `-`). Same pick as tryNewDependency:

package/dist/modifiers.js

@@ -7,9 +7,20 @@ import { load } from '@vltpkg/vlt-json';
  * Does this breadcrumb item select the given importer?
  */
 const matchesImporter = (item, importer) => item.importer &&
+    importer.importer &&
     (item.value === ':project' ||
-        (item.value === ':root' && importer.mainImporter) ||
-        (item.value === ':workspace' && importer.importer));
+        item.value === ':workspace' ||
+        (item.value === ':root' && importer.mainImporter));
+/**
+ * Is this a trailing `:workspace` item right after a plain importer
+ * selector, e.g. `:project > :workspace`? It selects any direct
+ * dependency named after a workspace.
+ */
+const isWorkspaceTarget = (item) => item.importer &&
+    item.value === ':workspace' &&
+    !!item.prev?.importer &&
+    !item.prev.name &&
+    !item.prev.prev;
 /**
  * Does this item's qualifier (e.g. `:semver(^1)`, `:v(^1)`) accept the
  * given spec? Shared by traversal matching and by the frozen / healing
@@ -42,6 +53,11 @@ const matchesQualifier = (item, spec) => !!item?.comparator({ semver: spec.semve
  * for (const entry of entries)
  *   modifier.updateActiveEntry(fromNode, entry)
  * ```
+ *
+ * A trailing `:workspace` right after an importer selector, e.g.
+ * `:project > :workspace`, is expanded into one `#<name>` entry per
+ * named workspace of the graph, on its first `tryImporter` or
+ * `importerEdgeModifier` call.
  */
 export class GraphModifier {
     /** The loaded modifiers configuration */
@@ -73,6 +89,14 @@ export class GraphModifier {
     activeModifiers = new Set();
     /** A set of all modifier string values loaded from vlt.json */
     modifierNames = new Set();
+    /** Spec options used when expanding `:workspace` targets */
+    #options = {};
+    /** `<importer> > :workspace` modifiers, expanded once a graph is known */
+    #workspaceTargets = [];
+    /** Graphs whose workspaces were already expanded */
+    #expandedGraphs = new WeakSet();
+    /** Workspace names already expanded */
+    #expandedNames = new Set();
     constructor(options) {
         this.load(options);
     }
@@ -96,8 +120,18 @@ export class GraphModifier {
      * root's own b edge is still the manifest's to validate and heal.
      */
     targetsImporterEdge(importer, spec) {
-        for (const { breadcrumb } of this.#modifiers) {
-            const { last } = breadcrumb;
+        return !!this.importerEdgeModifier(importer, spec);
+    }
+    /**
+     * The modifier governing the direct `importer -> spec.name` edge, see
+     * {@link GraphModifier.targetsImporterEdge}. The most specific one
+     * wins, same as during the graph build.
+     */
+    importerEdgeModifier(importer, spec) {
+        this.#expandWorkspaceTargets(importer);
+        const found = [];
+        for (const mod of this.#modifiers) {
+            const { last } = mod.breadcrumb;
             if (last.name !== spec.name)
                 continue;
             // a qualifier that rejects the spec means the modifier never
@@ -106,14 +140,12 @@ export class GraphModifier {
                 continue;
             const { prev } = last;
             // a lone `#b` matches an edge to b anywhere, importers included
-            if (!prev)
-                return true;
-            if (prev.prev)
-                continue;
-            if (matchesImporter(prev, importer))
-                return true;
+            if (!prev || (!prev.prev && matchesImporter(prev, importer))) {
+                found.push(mod);
+            }
         }
-        return false;
+        const [best] = specificitySort(found.map(m => m.breadcrumb));
+        return found.find(m => m.breadcrumb === best);
     }
     /**
      * Selector of the modifier that wins the direct `importer -> spec.name`
@@ -143,16 +175,22 @@ export class GraphModifier {
      * Loads the modifiers defined in `vlt.json` into memory.
      */
     load(options) {
+        this.#options = options;
         for (const [key, value] of Object.entries(this.config)) {
             this.modifierNames.add(key);
             const breadcrumb = parseBreadcrumb(key);
-            /* c8 ignore start - should not be possible */
             if (!breadcrumb.last.name) {
-                throw error('Could not find name in breadcrumb', {
+                // `<importer> > :workspace` names no package up front, it is
+                // expanded into one entry per workspace once a graph is known
+                if (isWorkspaceTarget(breadcrumb.last)) {
+                    this.#workspaceTargets.push({ query: key, value });
+                    continue;
+                }
+                throw error('Invalid modifier selector', {
                     found: key,
+                    wanted: 'a selector ending in #<name>, or :root, :project or :workspace followed by > :workspace',
                 });
             }
-            /* c8 ignore stop */
             let mod;
             if (typeof value === 'string') {
                 mod = {
@@ -179,13 +217,58 @@ export class GraphModifier {
                 this.#nodeModifiers.add(mod);
             }
             /* c8 ignore end */
-            this.#modifiers.add(mod);
-            // if the breadcrumb starts with an id, then add it to the
-            // map of initial entries, so that we can use it to match
-            if (breadcrumb.first.name) {
-                const initialSet = this.#initialEntries.get(breadcrumb.first.name) ?? new Set();
-                initialSet.add(mod);
-                this.#initialEntries.set(breadcrumb.first.name, initialSet);
+            this.#register(mod);
+        }
+    }
+    /**
+     * Adds a modifier entry to the set of known modifiers.
+     */
+    #register(mod) {
+        this.#modifiers.add(mod);
+        // if the breadcrumb starts with an id, then add it to the
+        // map of initial entries, so that we can use it to match
+        const { name } = mod.breadcrumb.first;
+        if (name) {
+            const initialSet = this.#initialEntries.get(name) ?? new Set();
+            initialSet.add(mod);
+            this.#initialEntries.set(name, initialSet);
+        }
+    }
+    /**
+     * Expands `<importer> > :workspace` modifiers into one
+     * `<importer> > #<name>` entry per named workspace of the node's graph.
+     */
+    #expandWorkspaceTargets(node) {
+        if (!this.#workspaceTargets.length)
+            return;
+        const { graph } = node;
+        if (this.#expandedGraphs.has(graph))
+            return;
+        this.#expandedGraphs.add(graph);
+        for (const importer of graph.importers) {
+            // nameless workspaces are named after their folder, never link those
+            const name = importer.manifest?.name;
+            if (importer.mainImporter ||
+                !name ||
+                this.#expandedNames.has(name)) {
+                continue;
+            }
+            this.#expandedNames.add(name);
+            for (const { query, value } of this.#workspaceTargets) {
+                // fresh breadcrumb per name: items are a linked list and the
+                // active entry maps key on the last item's name
+                const breadcrumb = parseBreadcrumb(query);
+                breadcrumb.last.name = name;
+                const mod = {
+                    breadcrumb,
+                    query,
+                    refs: new Set(),
+                    spec: Spec.parse(name, value, this.#options),
+                    type: 'edge',
+                    value,
+                };
+                this.#edgeModifiers.add(mod);
+                this.#register(mod);
             }
         }
     }
@@ -195,6 +278,7 @@ export class GraphModifier {
      * update the active entry to the current importer node.
      */
     tryImporter(importer) {
+        this.#expandWorkspaceTargets(importer);
         for (const modifier of this.#modifiers) {
             // if the first item in the breadcrumb is an importer and it matches
             // any of the valid top-level selectors, then register the modifier

package/dist/reify/add-edge.d.ts

@@ -7,3 +7,7 @@ import type { Edge } from '../edge.ts';
  * until scripts are run, in the case of non-store deps like workspaces
  */
 export declare const addEdge: (edge: Edge, scurry: PathScurry, remover: RollbackRemove, bins?: Record<string, string>) => Promise<void>;
+/**
+ * link the `key` bin of the package at `path` into `binRoot`
+ */
+export declare const linkBin: (path: string, binRoot: string, key: string, val: string, remover: RollbackRemove) => Promise<void>;

package/dist/reify/add-edge.js

@@ -59,15 +59,21 @@ export const addEdge = async (edge, scurry, remover, bins) => {
         promises.push(p);
     if (bins) {
         for (const [key, val] of Object.entries(bins)) {
-            const link = resolve(binRoot, key);
-            const absTarget = resolve(path, val);
-            const target = relative(binRoot, absTarget);
-            // TODO: bash/cmd/ps1 shims on Windows
-            promises.push(process.platform === 'win32' ?
-                cmdShimIfExists(absTarget, link, remover)
-                : clobberSymlink(target, link, remover));
+            promises.push(linkBin(path, binRoot, key, val, remover));
         }
     }
     if (promises.length)
         await Promise.all(promises);
 };
+/**
+ * link the `key` bin of the package at `path` into `binRoot`
+ */
+export const linkBin = (path, binRoot, key, val, remover) => {
+    const link = resolve(binRoot, key);
+    const absTarget = resolve(path, val);
+    const target = relative(binRoot, absTarget);
+    // TODO: bash/cmd/ps1 shims on Windows
+    return process.platform === 'win32' ?
+        cmdShimIfExists(absTarget, link, remover)
+        : clobberSymlink(target, link, remover);
+};

package/dist/reify/build.d.ts

@@ -9,5 +9,12 @@ import type { Node } from '../node.ts';
 export type BuildResult = {
     success: Node[];
     failure: Node[];
+    /** needed builds skipped as they have no security data */
+    skipped?: Node[];
+    /**
+     * why `skipped` builds have no security data: the request timed
+     * out, or socket.dev has not scanned them yet
+     */
+    skippedReason?: 'timeout' | 'unscanned';
 };
 export declare const build: (diff: Diff, packageJson: PackageJson, scurry: PathScurry, allowScriptsNodes: Set<DepID>) => Promise<BuildResult>;

package/dist/reify/check-needed-build.d.ts

@@ -32,3 +32,8 @@ export type CheckNeededBuildOptions = {
  * @returns {BuildData} The BuildData object containing Node objects that need building
  */
 export declare const checkNeededBuild: (options: CheckNeededBuildOptions) => BuildData;
+/**
+ * Copy build state from the actual graph onto ideal nodes that are
+ * not re-extracted, since `vlt-lock.json` does not store it.
+ */
+export declare const carryBuildState: (diff: Diff) => void;

package/dist/reify/check-needed-build.js

@@ -70,3 +70,16 @@ export const checkNeededBuild = (options) => {
     };
     return buildData;
 };
+/**
+ * Copy build state from the actual graph onto ideal nodes that are
+ * not re-extracted, since `vlt-lock.json` does not store it.
+ */
+export const carryBuildState = (diff) => {
+    for (const [id, node] of diff.to.nodes) {
+        if (diff.nodes.add.has(node))
+            continue;
+        const prev = diff.from.nodes.get(id);
+        if (prev)
+            node.buildState = prev.buildState;
+    }
+};

package/dist/reify/delete-edge.js

@@ -1,15 +1,12 @@
+import { readCmdShimIfExists } from '@vltpkg/cmd-shim';
 import { resolve } from 'node:path';
-const rmBinPosix = (remover, bin) => {
-    return [remover.rm(bin)];
-};
-const rmBinWin32 = (remover, bin) => {
-    return [
-        remover.rm(bin),
-        remover.rm(bin + '.cmd'),
-        remover.rm(bin + '.ps1'),
-    ];
-};
-const rmBin = process.platform === 'win32' ? rmBinWin32 : rmBinPosix;
+const binPathsPosix = (bin) => [bin];
+const binPathsWin32 = (bin) => [
+    bin,
+    bin + '.cmd',
+    bin + '.ps1',
+];
+const binPaths = process.platform === 'win32' ? binPathsWin32 : binPathsPosix;
 export const deleteEdge = async (edge, scurry, remover) => {
     const { spec: { name }, to, } = edge;
     const { sep } = scurry.cwd;
@@ -20,9 +17,14 @@ export const deleteEdge = async (edge, scurry, remover) => {
     promises.push(remover.rm(path));
     const bins = to?.bins;
     if (bins) {
-        for (const key of Object.keys(bins)) {
-            const bin = resolve(binRoot, key);
-            promises.push(...rmBin(remover, bin));
+        for (const [key, value] of Object.entries(bins)) {
+            for (const bin of binPaths(resolve(binRoot, key))) {
+                const target = await readCmdShimIfExists(bin);
+                // another dependency may provide the same command.
+                if (target && target !== resolve(path, value))
+                    continue;
+                promises.push(remover.rm(bin));
+            }
         }
     }
     await Promise.all(promises);

package/dist/reify/delete-nodes.d.ts

@@ -1,4 +1,5 @@
+import type { DepID } from '@vltpkg/dep-id';
 import type { RollbackRemove } from '@vltpkg/rollback-remove';
 import type { PathScurry } from 'path-scurry';
 import type { Diff } from '../diff.ts';
-export declare const deleteNodes: (diff: Diff, remover: RollbackRemove, scurry: PathScurry) => Promise<unknown>[];
+export declare const deleteNodes: (diff: Diff, remover: RollbackRemove, scurry: PathScurry, keep?: ReadonlySet<DepID>) => Promise<unknown>[];

package/dist/reify/delete-nodes.js

@@ -1,5 +1,5 @@
 import { deleteEdge } from "./delete-edge.js";
-export const deleteNodes = (diff, remover, scurry) => {
+export const deleteNodes = (diff, remover, scurry, keep) => {
     const store = scurry.resolve('node_modules/.vlt');
     const { sep } = scurry.cwd;
     const rmActions = [];
@@ -7,7 +7,9 @@ export const deleteNodes = (diff, remover, scurry) => {
         // do not delete workspaces or link targets
         if (!node.inVltStore())
             continue;
-        rmActions.push(remover.rm(store + sep + node.id));
+        if (!keep?.has(node.id)) {
+            rmActions.push(remover.rm(store + sep + node.id));
+        }
         for (const edge of node.edgesIn) {
             rmActions.push(deleteEdge(edge, scurry, remover));
         }

package/dist/reify/index.d.ts

@@ -18,6 +18,8 @@ export type ReifyOptions = LoadOptions & {
     update?: boolean;
     saveExact?: boolean;
     savePrefix?: string;
+    /** store dirs of these nodes are never removed, eg the running vlt */
+    keepNodes?: ReadonlySet<DepID>;
 };
 export type ReifyResult = {
     /**

package/dist/reify/index.js

@@ -8,51 +8,17 @@ import { addEdges } from "./add-edges.js";
 import { addNodes } from "./add-nodes.js";
 import { build } from "./build.js";
 import { deleteEdges } from "./delete-edges.js";
-import { checkNeededBuild } from "./check-needed-build.js";
+import { relinkBins } from "./relink-bins.js";
+import { carryBuildState, checkNeededBuild, } from "./check-needed-build.js";
 import { deleteNodes } from "./delete-nodes.js";
 import { internalHoist } from "./internal-hoist.js";
 import { pruneUnsupportedOptional } from "./optional-fail.js";
 import { rollback } from "./rollback.js";
 import { updatePackageJson } from "./update-importers-package-json.js";
 import { copyFileSync } from 'node:fs';
-import { Query } from '@vltpkg/query';
-import { SecurityArchive } from '@vltpkg/security-archive';
 import { binChmodAll } from "./bin-chmod.js";
+import { filterNodesByQuery } from "../filter-nodes-by-query.js";
 const limit = Math.max(availableParallelism() - 1, 1) * 8;
-/**
- * Filter nodes using a DSS query string
- */
-const filterNodesByQuery = async (graph, allowScriptsQuery) => {
-    // shortcut no packages included
-    if (allowScriptsQuery === ':not(*)' /* c8 ignore next */ ||
-        !allowScriptsQuery) {
-        return new Set();
-    }
-    // shortcut all packages included
-    if (allowScriptsQuery === '*') {
-        return new Set(graph.nodes.keys());
-    }
-    /* c8 ignore start */
-    const securityArchive = Query.hasSecuritySelectors(allowScriptsQuery) ?
-        await SecurityArchive.start({
-            nodes: [...graph.nodes.values()],
-        })
-        : undefined;
-    /* c8 ignore stop */
-    const edges = graph.edges;
-    const nodes = new Set(graph.nodes.values());
-    const importers = graph.importers;
-    const query = new Query({
-        edges,
-        nodes,
-        importers,
-        securityArchive,
-    });
-    const { nodes: resultNodes } = await query.search(allowScriptsQuery, {
-        signal: new AbortController().signal,
-    });
-    return new Set(resultNodes.map(node => node.id));
-};
 /**
  * Make the current project match the supplied graph.
  */
@@ -65,6 +31,7 @@ export const reify = async (options) => {
             loadManifests: true,
         });
     const diff = new Diff(actual, graph);
+    carryBuildState(diff);
     // normalise importer edge specs and compute the package.json changes
     // before deciding whether anything needs reifying: an add whose target
     // is already in place has no node diff but still has a saved value to
@@ -81,6 +48,7 @@ export const reify = async (options) => {
             packageJson: options.packageJson,
             saveExact: options.saveExact,
             savePrefix: options.savePrefix,
+            modifiers: options.modifiers,
         })
         : undefined;
     const noModifiedDependencies = !options.add?.modifiedDependencies &&
@@ -161,6 +129,10 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
     const edgeActions = addEdges(diff, scurry, remover);
     if (edgeActions.length)
         await callLimit(edgeActions, { limit });
+    // link bins that deleted edges removed but other deps still declare
+    const binActions = relinkBins(diff, scurry, remover);
+    if (binActions.length)
+        await callLimit(binActions, { limit });
     await internalHoist(diff.to, options, remover);
     // looks up all nodes setting buildState = 'needed'
     // on nodes that require building
@@ -173,7 +145,7 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
     await build(diff, packageJson, scurry, allowScriptsNodes);
     // set the buildQueue on the result object containing
     // an array with all the ids of nodes that need building
-    res.buildQueue = [...diff.nodes.add]
+    res.buildQueue = [...diff.to.nodes.values()]
         .filter(node => node.buildState === 'needed')
         .map(node => node.id);
     // if we had to change the actual graph along the way,
@@ -189,7 +161,7 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
     /* c8 ignore stop */
     saveHidden(options);
     // delete garbage from the store.
-    const rmActions = deleteNodes(diff, remover, scurry);
+    const rmActions = deleteNodes(diff, remover, scurry, options.keepNodes);
     if (rmActions.length)
         await Promise.all(rmActions);
     // updates package.json files if anything was added / removed

package/dist/reify/relink-bins.d.ts

@@ -0,0 +1,9 @@
+import type { RollbackRemove } from '@vltpkg/rollback-remove';
+import type { PathScurry } from 'path-scurry';
+import type { Diff } from '../diff.ts';
+/**
+ * A deleted edge removes the bins it owns, but another dependency
+ * that did not change may declare the same bin name. Link the first
+ * one found if the bin is still missing once added edges are linked.
+ */
+export declare const relinkBins: (diff: Diff, scurry: PathScurry, remover: RollbackRemove) => (() => Promise<unknown>)[];

package/dist/reify/relink-bins.js

@@ -0,0 +1,39 @@
+import { resolve } from 'node:path';
+import { linkBin } from "./add-edge.js";
+/**
+ * A deleted edge removes the bins it owns, but another dependency
+ * that did not change may declare the same bin name. Link the first
+ * one found if the bin is still missing once added edges are linked.
+ */
+export const relinkBins = (diff, scurry, remover) => {
+    const actions = [];
+    const seen = new Set();
+    const { sep } = scurry.cwd;
+    for (const deleted of diff.edges.delete) {
+        const node = diff.to.nodes.get(deleted.from.id);
+        const bins = deleted.to?.bins;
+        if (!node || !bins)
+            continue;
+        const nm = node.nodeModules(scurry);
+        const binRoot = nm + sep + '.bin';
+        for (const key of Object.keys(bins)) {
+            const link = resolve(binRoot, key);
+            if (seen.has(link))
+                continue;
+            seen.add(link);
+            for (const edge of node.edgesOut.values()) {
+                const val = edge.to?.bins?.[key];
+                if (!val)
+                    continue;
+                const path = nm + sep + edge.spec.name.replace('/', sep);
+                actions.push(async () => {
+                    if (await scurry.lstat(link))
+                        return;
+                    await linkBin(path, binRoot, key, val, remover);
+                });
+                break;
+            }
+        }
+    }
+    return actions;
+};