@vltpkg/graph 1.5.0 → 1.6.0

package/README.md

@@ -93,13 +93,14 @@ code is not loaded. `update` and `uninstall` take `allowSkills` too.
 
 Lists the agent skills (dirs with a `SKILL.md`, see
 https://agentskills.io/specification) shipped by installed packages in
-the vlt store (a root `SKILL.md`, then `<dir>/SKILL.md` in `skills/`,
-`dist/skills/` and `.agents/skills/`; the first skill of a name wins),
-from one version per package (a direct dep, else the highest), with
-the agent skill dirs each is linked in, `project`: the main importer
-name, and the `graph`. `options.target` is a DSS query selecting
-packages (default `*`); a selector ending with `:skill(<name>, …)`
-keeps only those skills of its packages. Creates nothing.
+the vlt store and the project's workspaces (a root `SKILL.md`, then
+`<dir>/SKILL.md` in `skills/`, `dist/skills/` and `.agents/skills/`;
+the first skill of a name wins), from one version per package (a
+direct dep or workspace, else the highest), with the agent skill dirs
+each is linked in, `project`: the main importer name, and the `graph`.
+`options.target` is a DSS query selecting packages (default `*`); a
+selector ending with `:skill(<name>, …)` keeps only those skills of
+its packages. Creates nothing.
 
 ### `linkSkills(options): Promise<LinkSkillsResult>`
 
@@ -112,21 +113,23 @@ must resolve inside the project, not in `node_modules` (else
 `skipped`, as are fs errors) and are created only when a skill is
 picked. One package per name, among picked skills, in every dir: the
 one the first existing link points to while its skill is installed,
-else a direct dep, then DepID; the others are reported in `conflicts`
-as `<mount> (<package>)`. Installs keep a dir's link to another
-installed skill. A link follows its package to the picked version.
-Then removes links whose skill is no longer installed: dangling,
-package not in the graph, or no longer shipped. With `options.apply`,
-also removes every other vlt link in the scanned dirs. Only links
-pointing into a `node_modules/.vlt` store are ever replaced or
-removed; anything else in the way is reported in `conflicts`. Keeps a
-marked block of link names in each dir's `.gitignore` (`gitignore`
-lists the ones it could not edit). Linked packages get private copies
-of files hardlinked from the global store. `:skill()` patterns that
-match no skill of their packages are returned in `unmatched`. Security
-queries fail closed: skills of npm registry packages with no security
-data are left out (in `listSkills` too) and returned in `unscanned`
-with `unscannedReason` (by `linkSkills`: unless still linked).
+else a direct dep or workspace, then DepID; the others are reported in
+`conflicts` as `<mount> (<package>)`. Installs keep a dir's link to
+another installed skill. A link follows its package to the picked
+version. Then removes links whose skill is no longer installed:
+dangling, package not in the graph, or no longer shipped. With
+`options.apply`, also removes every other vlt link in the scanned
+dirs. Only vlt links (into a `node_modules/.vlt` store, or listed in
+the dir's `.gitignore` block and pointing to a workspace or dangling)
+are ever replaced or removed; anything else in the way is reported in
+`conflicts`. Keeps a marked block of link names in each dir's
+`.gitignore` (`gitignore` lists the ones it could not edit). Linked
+packages get private copies of files hardlinked from the global store.
+`:skill()` patterns that match no skill of their packages are returned
+in `unmatched`. Security queries fail closed: skills of npm registry
+packages with no security data are left out (in `listSkills` too) and
+returned in `unscanned` with `unscannedReason` (by `linkSkills`:
+unless still linked).
 
 ### `assertQuery(selector, flag, partSelectors?): Promise<void>`
 

package/dist/graph.js

@@ -347,6 +347,9 @@ export class Graph {
                 }
                 return edge;
             }
+            // a stale edgesIn ref would let removing the old target drop
+            // the new edge from `from.edgesOut`
+            edge.to?.edgesIn.delete(edge);
             this.edges.delete(edge);
         }
         this.mutations++;

package/dist/ideal/append-nodes.js

@@ -419,7 +419,7 @@ const fetchManifestsForDeps = async (packageInfo, graph, fromNode, deps, scurry,
  * vlt store are extracted immediately (in parallel) instead of waiting for
  * the full ideal graph to be built. This significantly improves install time.
  */
-const processPlacementTasks = async (graph, options, placementTasks, add, modifiers, scurry, packageInfo, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove) => {
+const processPlacementTasks = async (graph, options, placementTasks, add, modifiers, scurry, packageInfo, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove, explicit) => {
     const childDepsToProcess = [];
     // Note: placementTasks are already sorted by fetchManifestsForDeps
     // using compareByHasPeerDeps to ensure non-peer deps are processed first.
@@ -431,18 +431,31 @@ const processPlacementTasks = async (graph, options, placementTasks, add, modifi
         // reify step to properly update the package.json file dependencies
         // using the correct names retrieved from the manifest data
         const additiveMap = fromNode.importer ? add : transientAdd?.get(fromNode.id);
+        // a nameless explicit add is known by its fixed up name from here on
+        const explicitKeys = explicit?.get(fromNode.id);
+        const wasExplicit = explicitKeys?.has(addKey(spec));
         spec = fixupAddedNames(additiveMap, manifest, options, spec);
+        if (wasExplicit)
+            explicitKeys?.add(spec.name);
         // handles missing manifest resolution
         if (!manifest) {
             if (!edgeOptional && fromNode.isOptional()) {
                 // failed resolution of a non-optional dep of an optional node
                 // have to clean up the dependents
-                removeOptionalSubgraph(graph, fromNode);
+                for (const n of removeOptionalSubgraph(graph, fromNode)) {
+                    // pruned importer deps: nothing to save, unless requested
+                    for (const { from, name } of n.edgesIn) {
+                        if (from.importer && !explicit?.get(from.id)?.has(name)) {
+                            add?.delete(name);
+                        }
+                    }
+                }
                 continue;
             }
             else if (edgeOptional) {
-                // failed resolution of an optional dep, just ignore it,
-                // nothing to prune because we never added it in the first place.
+                // failed resolution of an optional dep: skip it and drop it
+                // from the add map, nothing to prune or save
+                additiveMap?.delete(addKey(spec));
                 continue;
             }
             else {
@@ -738,7 +751,7 @@ export const appendNodes = async (packageInfo, graph, fromNode, deps, scurry, op
                 graph.addEdge(type, spec, fromNode, toNode);
             }
             // Place nodes and collect child deps
-            const placed = await processPlacementTasks(graph, options, result.placementTasks, add, modifiers, scurry, packageInfo, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove);
+            const placed = await processPlacementTasks(graph, options, result.placementTasks, add, modifiers, scurry, packageInfo, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove, explicit);
             levelResults.push(placed);
         }
         // ============================================================

package/dist/ideal/remove-satisfied-specs.js

@@ -31,18 +31,26 @@ export const removeSatisfiedSpecs = ({ add, graph, modifiers, }) => {
             const depIsCatalog = dependency.spec.type === 'catalog';
             if (edgeIsCatalog !== depIsCatalog)
                 continue;
+            // a governed edge is checked against the modifier value (e.g.
+            // `workspace:*` to a versionless workspace), not its own spec: one
+            // built before the modifier applied must be rebuilt
+            const mod = modifiers?.importerEdgeModifier(importer, dependency.spec);
             // If the current graph edge is already valid, then we remove that
             // dependency item from the list of items to be added to the graph
-            if (satisfies(edge.to?.id, dependency.spec, edge.from.location, graph.projectRoot, graph.monorepo)) {
-                // a governed edge carries the modifier value by construction:
-                // healing it to the manifest text would only be undone by the
-                // rebuild that re-applies the override. `implicit` is not a real
-                // edge type, it means "keep what the edge already is", so it
-                // never makes an edge stale
-                if ((edge.spec.bareSpec !== dependency.spec.bareSpec ||
-                    (dependency.type !== 'implicit' &&
-                        edge.type !== dependency.type)) &&
-                    !modifiers?.targetsImporterEdge(importer, dependency.spec)) {
+            if (satisfies(edge.to?.id, mod?.type === 'edge' ? mod.spec : dependency.spec, edge.from.location, graph.projectRoot, graph.monorepo)) {
+                // `implicit` is not a real edge type, it means "keep what the
+                // edge already is", so it never makes an edge stale
+                const typeChanged = dependency.type !== 'implicit' &&
+                    edge.type !== dependency.type;
+                if (mod) {
+                    // keeps the modifier value, the rebuild would re-apply it
+                    // anyway; only the type follows the manifest
+                    if (typeChanged) {
+                        staleSpecs.set(edge, { ...dependency, spec: edge.spec });
+                    }
+                }
+                else if (edge.spec.bareSpec !== dependency.spec.bareSpec ||
+                    typeChanged) {
                     staleSpecs.set(edge, dependency);
                 }
                 dependencies.delete(name);

package/dist/install.d.ts

@@ -22,6 +22,8 @@ export type InstallOptions = LoadOptions & {
      * none
      */
     skillsDirs?: string[];
+    /** store dirs of these nodes are never removed, eg the running vlt */
+    keepNodes?: ReadonlySet<DepID>;
 };
 /**
  * Result of {@link install}.

package/dist/install.js

@@ -239,6 +239,7 @@ export const install = async (options, add) => {
                     ...options,
                     add,
                     graph,
+                    modifiers,
                     remove,
                 })
                 : undefined;

package/dist/modifiers.d.ts

@@ -101,6 +101,11 @@ export type ModifierActiveEntry = {
  * for (const entry of entries)
  *   modifier.updateActiveEntry(fromNode, entry)
  * ```
+ *
+ * A trailing `:workspace` right after an importer selector, e.g.
+ * `:project > :workspace`, is expanded into one `#<name>` entry per
+ * named workspace of the graph, on its first `tryImporter` or
+ * `importerEdgeModifier` call.
  */
 export declare class GraphModifier {
     #private;
@@ -126,6 +131,12 @@ export declare class GraphModifier {
      * root's own b edge is still the manifest's to validate and heal.
      */
     targetsImporterEdge(importer: Node, spec: Spec): boolean;
+    /**
+     * The modifier governing the direct `importer -> spec.name` edge, see
+     * {@link GraphModifier.targetsImporterEdge}. The most specific one
+     * wins, same as during the graph build.
+     */
+    importerEdgeModifier(importer: Node, spec: Spec): ModifierEntry | undefined;
     /**
      * Selector of the modifier that wins the direct `importer -> spec.name`
      * edge, if it removes it (value `-`). Same pick as tryNewDependency:

package/dist/modifiers.js

@@ -7,9 +7,20 @@ import { load } from '@vltpkg/vlt-json';
  * Does this breadcrumb item select the given importer?
  */
 const matchesImporter = (item, importer) => item.importer &&
+    importer.importer &&
     (item.value === ':project' ||
-        (item.value === ':root' && importer.mainImporter) ||
-        (item.value === ':workspace' && importer.importer));
+        item.value === ':workspace' ||
+        (item.value === ':root' && importer.mainImporter));
+/**
+ * Is this a trailing `:workspace` item right after a plain importer
+ * selector, e.g. `:project > :workspace`? It selects any direct
+ * dependency named after a workspace.
+ */
+const isWorkspaceTarget = (item) => item.importer &&
+    item.value === ':workspace' &&
+    !!item.prev?.importer &&
+    !item.prev.name &&
+    !item.prev.prev;
 /**
  * Does this item's qualifier (e.g. `:semver(^1)`, `:v(^1)`) accept the
  * given spec? Shared by traversal matching and by the frozen / healing
@@ -42,6 +53,11 @@ const matchesQualifier = (item, spec) => !!item?.comparator({ semver: spec.semve
  * for (const entry of entries)
  *   modifier.updateActiveEntry(fromNode, entry)
  * ```
+ *
+ * A trailing `:workspace` right after an importer selector, e.g.
+ * `:project > :workspace`, is expanded into one `#<name>` entry per
+ * named workspace of the graph, on its first `tryImporter` or
+ * `importerEdgeModifier` call.
  */
 export class GraphModifier {
     /** The loaded modifiers configuration */
@@ -73,6 +89,14 @@ export class GraphModifier {
     activeModifiers = new Set();
     /** A set of all modifier string values loaded from vlt.json */
     modifierNames = new Set();
+    /** Spec options used when expanding `:workspace` targets */
+    #options = {};
+    /** `<importer> > :workspace` modifiers, expanded once a graph is known */
+    #workspaceTargets = [];
+    /** Graphs whose workspaces were already expanded */
+    #expandedGraphs = new WeakSet();
+    /** Workspace names already expanded */
+    #expandedNames = new Set();
     constructor(options) {
         this.load(options);
     }
@@ -96,8 +120,18 @@ export class GraphModifier {
      * root's own b edge is still the manifest's to validate and heal.
      */
     targetsImporterEdge(importer, spec) {
-        for (const { breadcrumb } of this.#modifiers) {
-            const { last } = breadcrumb;
+        return !!this.importerEdgeModifier(importer, spec);
+    }
+    /**
+     * The modifier governing the direct `importer -> spec.name` edge, see
+     * {@link GraphModifier.targetsImporterEdge}. The most specific one
+     * wins, same as during the graph build.
+     */
+    importerEdgeModifier(importer, spec) {
+        this.#expandWorkspaceTargets(importer);
+        const found = [];
+        for (const mod of this.#modifiers) {
+            const { last } = mod.breadcrumb;
             if (last.name !== spec.name)
                 continue;
             // a qualifier that rejects the spec means the modifier never
@@ -106,14 +140,12 @@ export class GraphModifier {
                 continue;
             const { prev } = last;
             // a lone `#b` matches an edge to b anywhere, importers included
-            if (!prev)
-                return true;
-            if (prev.prev)
-                continue;
-            if (matchesImporter(prev, importer))
-                return true;
+            if (!prev || (!prev.prev && matchesImporter(prev, importer))) {
+                found.push(mod);
+            }
         }
-        return false;
+        const [best] = specificitySort(found.map(m => m.breadcrumb));
+        return found.find(m => m.breadcrumb === best);
     }
     /**
      * Selector of the modifier that wins the direct `importer -> spec.name`
@@ -143,16 +175,22 @@ export class GraphModifier {
      * Loads the modifiers defined in `vlt.json` into memory.
      */
     load(options) {
+        this.#options = options;
         for (const [key, value] of Object.entries(this.config)) {
             this.modifierNames.add(key);
             const breadcrumb = parseBreadcrumb(key);
-            /* c8 ignore start - should not be possible */
             if (!breadcrumb.last.name) {
-                throw error('Could not find name in breadcrumb', {
+                // `<importer> > :workspace` names no package up front, it is
+                // expanded into one entry per workspace once a graph is known
+                if (isWorkspaceTarget(breadcrumb.last)) {
+                    this.#workspaceTargets.push({ query: key, value });
+                    continue;
+                }
+                throw error('Invalid modifier selector', {
                     found: key,
+                    wanted: 'a selector ending in #<name>, or :root, :project or :workspace followed by > :workspace',
                 });
             }
-            /* c8 ignore stop */
             let mod;
             if (typeof value === 'string') {
                 mod = {
@@ -179,13 +217,58 @@ export class GraphModifier {
                 this.#nodeModifiers.add(mod);
             }
             /* c8 ignore end */
-            this.#modifiers.add(mod);
-            // if the breadcrumb starts with an id, then add it to the
-            // map of initial entries, so that we can use it to match
-            if (breadcrumb.first.name) {
-                const initialSet = this.#initialEntries.get(breadcrumb.first.name) ?? new Set();
-                initialSet.add(mod);
-                this.#initialEntries.set(breadcrumb.first.name, initialSet);
+            this.#register(mod);
+        }
+    }
+    /**
+     * Adds a modifier entry to the set of known modifiers.
+     */
+    #register(mod) {
+        this.#modifiers.add(mod);
+        // if the breadcrumb starts with an id, then add it to the
+        // map of initial entries, so that we can use it to match
+        const { name } = mod.breadcrumb.first;
+        if (name) {
+            const initialSet = this.#initialEntries.get(name) ?? new Set();
+            initialSet.add(mod);
+            this.#initialEntries.set(name, initialSet);
+        }
+    }
+    /**
+     * Expands `<importer> > :workspace` modifiers into one
+     * `<importer> > #<name>` entry per named workspace of the node's graph.
+     */
+    #expandWorkspaceTargets(node) {
+        if (!this.#workspaceTargets.length)
+            return;
+        const { graph } = node;
+        if (this.#expandedGraphs.has(graph))
+            return;
+        this.#expandedGraphs.add(graph);
+        for (const importer of graph.importers) {
+            // nameless workspaces are named after their folder, never link those
+            const name = importer.manifest?.name;
+            if (importer.mainImporter ||
+                !name ||
+                this.#expandedNames.has(name)) {
+                continue;
+            }
+            this.#expandedNames.add(name);
+            for (const { query, value } of this.#workspaceTargets) {
+                // fresh breadcrumb per name: items are a linked list and the
+                // active entry maps key on the last item's name
+                const breadcrumb = parseBreadcrumb(query);
+                breadcrumb.last.name = name;
+                const mod = {
+                    breadcrumb,
+                    query,
+                    refs: new Set(),
+                    spec: Spec.parse(name, value, this.#options),
+                    type: 'edge',
+                    value,
+                };
+                this.#edgeModifiers.add(mod);
+                this.#register(mod);
             }
         }
     }
@@ -195,6 +278,7 @@ export class GraphModifier {
      * update the active entry to the current importer node.
      */
     tryImporter(importer) {
+        this.#expandWorkspaceTargets(importer);
         for (const modifier of this.#modifiers) {
             // if the first item in the breadcrumb is an importer and it matches
             // any of the valid top-level selectors, then register the modifier

package/dist/reify/add-edge.d.ts

@@ -7,3 +7,7 @@ import type { Edge } from '../edge.ts';
  * until scripts are run, in the case of non-store deps like workspaces
  */
 export declare const addEdge: (edge: Edge, scurry: PathScurry, remover: RollbackRemove, bins?: Record<string, string>) => Promise<void>;
+/**
+ * link the `key` bin of the package at `path` into `binRoot`
+ */
+export declare const linkBin: (path: string, binRoot: string, key: string, val: string, remover: RollbackRemove) => Promise<void>;

package/dist/reify/add-edge.js

@@ -59,15 +59,21 @@ export const addEdge = async (edge, scurry, remover, bins) => {
         promises.push(p);
     if (bins) {
         for (const [key, val] of Object.entries(bins)) {
-            const link = resolve(binRoot, key);
-            const absTarget = resolve(path, val);
-            const target = relative(binRoot, absTarget);
-            // TODO: bash/cmd/ps1 shims on Windows
-            promises.push(process.platform === 'win32' ?
-                cmdShimIfExists(absTarget, link, remover)
-                : clobberSymlink(target, link, remover));
+            promises.push(linkBin(path, binRoot, key, val, remover));
         }
     }
     if (promises.length)
         await Promise.all(promises);
 };
+/**
+ * link the `key` bin of the package at `path` into `binRoot`
+ */
+export const linkBin = (path, binRoot, key, val, remover) => {
+    const link = resolve(binRoot, key);
+    const absTarget = resolve(path, val);
+    const target = relative(binRoot, absTarget);
+    // TODO: bash/cmd/ps1 shims on Windows
+    return process.platform === 'win32' ?
+        cmdShimIfExists(absTarget, link, remover)
+        : clobberSymlink(target, link, remover);
+};

package/dist/reify/delete-edge.js

@@ -1,15 +1,12 @@
+import { readCmdShimIfExists } from '@vltpkg/cmd-shim';
 import { resolve } from 'node:path';
-const rmBinPosix = (remover, bin) => {
-    return [remover.rm(bin)];
-};
-const rmBinWin32 = (remover, bin) => {
-    return [
-        remover.rm(bin),
-        remover.rm(bin + '.cmd'),
-        remover.rm(bin + '.ps1'),
-    ];
-};
-const rmBin = process.platform === 'win32' ? rmBinWin32 : rmBinPosix;
+const binPathsPosix = (bin) => [bin];
+const binPathsWin32 = (bin) => [
+    bin,
+    bin + '.cmd',
+    bin + '.ps1',
+];
+const binPaths = process.platform === 'win32' ? binPathsWin32 : binPathsPosix;
 export const deleteEdge = async (edge, scurry, remover) => {
     const { spec: { name }, to, } = edge;
     const { sep } = scurry.cwd;
@@ -20,9 +17,14 @@ export const deleteEdge = async (edge, scurry, remover) => {
     promises.push(remover.rm(path));
     const bins = to?.bins;
     if (bins) {
-        for (const key of Object.keys(bins)) {
-            const bin = resolve(binRoot, key);
-            promises.push(...rmBin(remover, bin));
+        for (const [key, value] of Object.entries(bins)) {
+            for (const bin of binPaths(resolve(binRoot, key))) {
+                const target = await readCmdShimIfExists(bin);
+                // another dependency may provide the same command.
+                if (target && target !== resolve(path, value))
+                    continue;
+                promises.push(remover.rm(bin));
+            }
         }
     }
     await Promise.all(promises);

package/dist/reify/delete-nodes.d.ts

@@ -1,4 +1,5 @@
+import type { DepID } from '@vltpkg/dep-id';
 import type { RollbackRemove } from '@vltpkg/rollback-remove';
 import type { PathScurry } from 'path-scurry';
 import type { Diff } from '../diff.ts';
-export declare const deleteNodes: (diff: Diff, remover: RollbackRemove, scurry: PathScurry) => Promise<unknown>[];
+export declare const deleteNodes: (diff: Diff, remover: RollbackRemove, scurry: PathScurry, keep?: ReadonlySet<DepID>) => Promise<unknown>[];

package/dist/reify/delete-nodes.js

@@ -1,5 +1,5 @@
 import { deleteEdge } from "./delete-edge.js";
-export const deleteNodes = (diff, remover, scurry) => {
+export const deleteNodes = (diff, remover, scurry, keep) => {
     const store = scurry.resolve('node_modules/.vlt');
     const { sep } = scurry.cwd;
     const rmActions = [];
@@ -7,7 +7,9 @@ export const deleteNodes = (diff, remover, scurry) => {
         // do not delete workspaces or link targets
         if (!node.inVltStore())
             continue;
-        rmActions.push(remover.rm(store + sep + node.id));
+        if (!keep?.has(node.id)) {
+            rmActions.push(remover.rm(store + sep + node.id));
+        }
         for (const edge of node.edgesIn) {
             rmActions.push(deleteEdge(edge, scurry, remover));
         }

package/dist/reify/index.d.ts

@@ -18,6 +18,8 @@ export type ReifyOptions = LoadOptions & {
     update?: boolean;
     saveExact?: boolean;
     savePrefix?: string;
+    /** store dirs of these nodes are never removed, eg the running vlt */
+    keepNodes?: ReadonlySet<DepID>;
 };
 export type ReifyResult = {
     /**

package/dist/reify/index.js

@@ -8,6 +8,7 @@ import { addEdges } from "./add-edges.js";
 import { addNodes } from "./add-nodes.js";
 import { build } from "./build.js";
 import { deleteEdges } from "./delete-edges.js";
+import { relinkBins } from "./relink-bins.js";
 import { carryBuildState, checkNeededBuild, } from "./check-needed-build.js";
 import { deleteNodes } from "./delete-nodes.js";
 import { internalHoist } from "./internal-hoist.js";
@@ -47,6 +48,7 @@ export const reify = async (options) => {
             packageJson: options.packageJson,
             saveExact: options.saveExact,
             savePrefix: options.savePrefix,
+            modifiers: options.modifiers,
         })
         : undefined;
     const noModifiedDependencies = !options.add?.modifiedDependencies &&
@@ -127,6 +129,10 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
     const edgeActions = addEdges(diff, scurry, remover);
     if (edgeActions.length)
         await callLimit(edgeActions, { limit });
+    // link bins that deleted edges removed but other deps still declare
+    const binActions = relinkBins(diff, scurry, remover);
+    if (binActions.length)
+        await callLimit(binActions, { limit });
     await internalHoist(diff.to, options, remover);
     // looks up all nodes setting buildState = 'needed'
     // on nodes that require building
@@ -155,7 +161,7 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
     /* c8 ignore stop */
     saveHidden(options);
     // delete garbage from the store.
-    const rmActions = deleteNodes(diff, remover, scurry);
+    const rmActions = deleteNodes(diff, remover, scurry, options.keepNodes);
     if (rmActions.length)
         await Promise.all(rmActions);
     // updates package.json files if anything was added / removed

package/dist/reify/relink-bins.d.ts

@@ -0,0 +1,9 @@
+import type { RollbackRemove } from '@vltpkg/rollback-remove';
+import type { PathScurry } from 'path-scurry';
+import type { Diff } from '../diff.ts';
+/**
+ * A deleted edge removes the bins it owns, but another dependency
+ * that did not change may declare the same bin name. Link the first
+ * one found if the bin is still missing once added edges are linked.
+ */
+export declare const relinkBins: (diff: Diff, scurry: PathScurry, remover: RollbackRemove) => (() => Promise<unknown>)[];

package/dist/reify/relink-bins.js

@@ -0,0 +1,39 @@
+import { resolve } from 'node:path';
+import { linkBin } from "./add-edge.js";
+/**
+ * A deleted edge removes the bins it owns, but another dependency
+ * that did not change may declare the same bin name. Link the first
+ * one found if the bin is still missing once added edges are linked.
+ */
+export const relinkBins = (diff, scurry, remover) => {
+    const actions = [];
+    const seen = new Set();
+    const { sep } = scurry.cwd;
+    for (const deleted of diff.edges.delete) {
+        const node = diff.to.nodes.get(deleted.from.id);
+        const bins = deleted.to?.bins;
+        if (!node || !bins)
+            continue;
+        const nm = node.nodeModules(scurry);
+        const binRoot = nm + sep + '.bin';
+        for (const key of Object.keys(bins)) {
+            const link = resolve(binRoot, key);
+            if (seen.has(link))
+                continue;
+            seen.add(link);
+            for (const edge of node.edgesOut.values()) {
+                const val = edge.to?.bins?.[key];
+                if (!val)
+                    continue;
+                const path = nm + sep + edge.spec.name.replace('/', sep);
+                actions.push(async () => {
+                    if (await scurry.lstat(link))
+                        return;
+                    await linkBin(path, binRoot, key, val, remover);
+                });
+                break;
+            }
+        }
+    }
+    return actions;
+};

package/dist/reify/update-importers-package-json.d.ts

@@ -1,6 +1,7 @@
 import type { PackageJson } from '@vltpkg/package-json';
 import type { AddImportersDependenciesMap, RemoveImportersDependenciesMap } from '../dependencies.ts';
 import type { Graph } from '../graph.ts';
+import type { GraphModifier } from '../modifiers.ts';
 export type UpdatePackageJsonOptions = {
     /**
      * A `Map` in which keys are {@link DepID} linking to another `Map` in which
@@ -37,9 +38,13 @@ export type UpdatePackageJsonOptions = {
      * Defaults to `^` if not specified. Ignored when `saveExact` is true.
      */
     savePrefix?: string;
+    /**
+     * Graph modifiers, importer edges they govern keep the modifier value.
+     */
+    modifiers?: GraphModifier;
 };
 /**
  * Updates nodes of a provided {@link Graph} accordingly to the
  * provided add or remove arguments.
  */
-export declare const updatePackageJson: ({ add, graph, packageJson, remove, saveExact, savePrefix, }: UpdatePackageJsonOptions) => () => void;
+export declare const updatePackageJson: ({ add, graph, packageJson, remove, saveExact, savePrefix, modifiers, }: UpdatePackageJsonOptions) => () => void;

package/dist/reify/update-importers-package-json.js

@@ -5,7 +5,7 @@ import { longDependencyTypes } from '@vltpkg/types';
 import { longDependencyTypeNames } from "../dependencies.js";
 import { resolveSaveType } from "../resolve-save-type.js";
 import { calculateSaveValue } from "./calculate-save-value.js";
-const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
+const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix, modifiers) => {
     const node = graph.nodes.get(nodeId);
     if (!node) {
         throw error('Failed to retrieve node', {
@@ -56,7 +56,10 @@ const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
             }
             const edge = node.edgesOut.get(name);
             if (!edge?.to) {
-                throw error('Dependency node could not be found');
+                throw error(`Dependency node could not be found: ${name}`, {
+                    spec: dep.spec,
+                    from: node.location,
+                });
             }
             const n = edge.to;
             const [nodeType] = splitDepID(n.id);
@@ -90,8 +93,10 @@ const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
             // the lockfile has to carry the value package.json carries, or a
             // later install reads back `latest` where the manifest says
             // `^1.2.3`. anything keyed by the old spec from here on must be
-            // invalidated at this point.
-            if (saveValue !== edge.spec.bareSpec) {
+            // invalidated at this point. governed edges keep the modifier
+            // value instead.
+            if (saveValue !== edge.spec.bareSpec &&
+                !modifiers?.targetsImporterEdge(node, dep.spec)) {
                 edge.spec = Spec.parse(name, saveValue, dep.spec.options);
                 graph.lockfileStale = true;
             }
@@ -103,7 +108,7 @@ const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
  * Updates nodes of a provided {@link Graph} accordingly to the
  * provided add or remove arguments.
  */
-export const updatePackageJson = ({ add, graph, packageJson, remove, saveExact, savePrefix, }) => {
+export const updatePackageJson = ({ add, graph, packageJson, remove, saveExact, savePrefix, modifiers, }) => {
     const manifestsToUpdate = new Set();
     const operations = new Set([add, remove]);
     for (const operation of operations) {
@@ -112,7 +117,7 @@ export const updatePackageJson = ({ add, graph, packageJson, remove, saveExact,
             // that are nested folders from which the user can also add new
             // dependencies to
             for (const nodeId of operation.keys()) {
-                const manifest = addOrRemoveDeps(nodeId, graph, operation, saveExact, savePrefix);
+                const manifest = addOrRemoveDeps(nodeId, graph, operation, saveExact, savePrefix, modifiers);
                 if (manifest) {
                     manifestsToUpdate.add(manifest);
                 }

package/dist/skills/discover.d.ts

@@ -61,13 +61,13 @@ export declare const shipsSkills: (node: Node) => boolean;
 /**
  * Find the agent skills shipped by the given installed packages.
  *
- * Only packages in the vlt store are scanned, for a root `SKILL.md`,
- * then `<dir>/SKILL.md` in `skills/`, `dist/skills/` and
- * `.agents/skills/`: the first skill of a name wins. One version per
- * package is picked, even if it ships none: a dep of the main
- * importer, else of any importer, else the highest version, then
- * DepID. Same-name skills of different packages are all returned,
- * sorted by rank then DepID (`linkSkills` resolves them). `mounts`
- * set each skill's `linked` dirs.
+ * Only packages in the vlt store and the project's workspaces (not its
+ * root) are scanned, for a root `SKILL.md`, then `<dir>/SKILL.md` in
+ * `skills/`, `dist/skills/` and `.agents/skills/`: the first skill of a
+ * name wins. One version per package is picked, even if it ships none:
+ * a workspace or dep of the main importer, else a dep of any importer,
+ * else the highest version, then DepID. Same-name skills of different
+ * packages are all returned, sorted by rank then DepID (`linkSkills`
+ * resolves them). `mounts` set each skill's `linked` dirs.
  */
 export declare const discoverSkills: (nodes: Iterable<Node>, scurry: PathScurry, mounts?: SkillMount[]) => DiscoveredSkills;

package/dist/skills/discover.js

@@ -134,8 +134,11 @@ const scan = (dir, pkgName) => {
     }
     return found;
 };
-// 0: dep of the main importer, 1: of any importer, 2: transitive
+// 0: a workspace or dep of the main importer, 1: dep of any
+// importer, 2: transitive
 const rank = (node) => {
+    if (node.importer)
+        return 0;
     let r = 2;
     for (const { from } of node.edgesIn) {
         if (from.mainImporter)
@@ -162,10 +165,11 @@ const aliasOf = (node) => {
         edges.find(e => e.from.importer))?.name;
     return n === node.name ? undefined : n;
 };
-// store pkgs only: lockfile keeps a tarball's path as its location
-const scannable = (node) => !node.importer &&
-    node.inVltStore() &&
-    splitDepID(node.id)[0] !== 'file';
+// store pkgs and workspaces, not the project root; lockfile keeps a
+// tarball's path as its location
+const scannable = (node) => node.importer ?
+    !node.mainImporter
+    : node.inVltStore() && splitDepID(node.id)[0] !== 'file';
 /** Ships agent skills, as `discoverSkills` finds them. */
 export const shipsSkills = (node) => scannable(node) &&
     scan(realOr(resolve(node.projectRoot, node.location)), node.name)
@@ -173,14 +177,14 @@ export const shipsSkills = (node) => scannable(node) &&
 /**
  * Find the agent skills shipped by the given installed packages.
  *
- * Only packages in the vlt store are scanned, for a root `SKILL.md`,
- * then `<dir>/SKILL.md` in `skills/`, `dist/skills/` and
- * `.agents/skills/`: the first skill of a name wins. One version per
- * package is picked, even if it ships none: a dep of the main
- * importer, else of any importer, else the highest version, then
- * DepID. Same-name skills of different packages are all returned,
- * sorted by rank then DepID (`linkSkills` resolves them). `mounts`
- * set each skill's `linked` dirs.
+ * Only packages in the vlt store and the project's workspaces (not its
+ * root) are scanned, for a root `SKILL.md`, then `<dir>/SKILL.md` in
+ * `skills/`, `dist/skills/` and `.agents/skills/`: the first skill of a
+ * name wins. One version per package is picked, even if it ships none:
+ * a workspace or dep of the main importer, else a dep of any importer,
+ * else the highest version, then DepID. Same-name skills of different
+ * packages are all returned, sorted by rank then DepID (`linkSkills`
+ * resolves them). `mounts` set each skill's `linked` dirs.
  */
 export const discoverSkills = (nodes, scurry, mounts = []) => {
     const key = (name, path) => `${lc(name)}\0${norm(path)}`;

package/dist/skills/gitignore.d.ts

@@ -11,3 +11,8 @@ export declare const editGitignore: (dir: string, edit: {
     add: string[];
     remove: string[];
 }) => "ok" | "refused";
+/**
+ * Names in vlt's block of `<dir>/.gitignore`: vlt's record of its links
+ * in `dir`. Empty if none or unreadable.
+ */
+export declare const gitignoreNames: (dir: string) => Set<string>;

package/dist/skills/gitignore.js

@@ -5,6 +5,12 @@ export const GITIGNORE_END = '# <<< vlt agent skills';
 const sorted = (names) => [...names]
     .sort((a, b) => a.localeCompare(b, 'en'))
     .map(n => `/${n}`);
+// vlt's block: `end` is -1 if none
+const findBlock = (lines) => {
+    const begin = lines.findIndex(l => l.trim() === GITIGNORE_BEGIN);
+    const end = lines.findIndex((l, i) => begin !== -1 && i > begin && l.trim() === GITIGNORE_END);
+    return { begin, end };
+};
 const update = (file, { add, remove }) => {
     const st = lstatSync(file, { throwIfNoEntry: false });
     if (st && !st.isFile())
@@ -12,8 +18,7 @@ const update = (file, { add, remove }) => {
     const text = st ? readFileSync(file, 'utf8') : '';
     const eol = text.includes('\r\n') ? '\r\n' : '\n';
     const lines = text.split(eol);
-    const begin = lines.findIndex(l => l.trim() === GITIGNORE_BEGIN);
-    const end = lines.findIndex((l, i) => begin !== -1 && i > begin && l.trim() === GITIGNORE_END);
+    const { begin, end } = findBlock(lines);
     let out;
     if (end === -1) {
         if (!add.length)
@@ -51,3 +56,27 @@ export const editGitignore = (dir, edit) => {
         return 'refused';
     }
 };
+/**
+ * Names in vlt's block of `<dir>/.gitignore`: vlt's record of its links
+ * in `dir`. Empty if none or unreadable.
+ */
+export const gitignoreNames = (dir) => {
+    try {
+        const file = join(dir, '.gitignore');
+        if (!lstatSync(file, { throwIfNoEntry: false })?.isFile()) {
+            return new Set();
+        }
+        const lines = readFileSync(file, 'utf8').split(/\r?\n/);
+        const { begin, end } = findBlock(lines);
+        if (end === -1)
+            return new Set();
+        return new Set(lines
+            .slice(begin + 1, end)
+            .map(l => l.trim())
+            .filter(l => l.startsWith('/'))
+            .map(l => l.slice(1)));
+    }
+    catch {
+        return new Set();
+    }
+};

package/dist/skills/index.d.ts

@@ -109,15 +109,16 @@ export declare const listSkills: (o: SkillsOptions) => Promise<ListSkillsResult>
  * project's agent skill dirs (see `skillsDirs`), created only when a
  * skill is picked. `target` selectors may end with `:skill()`. One
  * package per name, among picked skills, in every dir: the package of
- * the first existing link (in dir order), else rank (main importer
- * dep, importer dep, transitive), then DepID; the others are
+ * the first existing link (in dir order), else rank (workspace or main
+ * importer dep, importer dep, transitive), then DepID; the others are
  * reported. Installs keep a dir's link to another installed skill.
  * A link follows its package to the picked version, in every scanned
  * dir. Then remove vlt links whose skill is no longer installed (with
  * `apply`: every vlt link not made here), and keep each dir's
- * `.gitignore` block in sync. Linked packages get private copies of
- * files hardlinked from the global store. Security queries fail
- * closed: skills of packages with no security data are not linked,
- * and reported in `unscanned` unless still linked.
+ * `.gitignore` block in sync (also vlt's record of workspace links).
+ * Linked packages get private copies of files hardlinked from the
+ * global store. Security queries fail closed: skills of packages with
+ * no security data are not linked, and reported in `unscanned` unless
+ * still linked.
  */
 export declare const linkSkills: (o: LinkSkillsOptions) => Promise<LinkSkillsResult>;

package/dist/skills/index.js

@@ -1,4 +1,5 @@
 import { existsSync } from 'node:fs';
+import { Monorepo } from '@vltpkg/workspaces';
 import { load as loadActual } from "../actual/load.js";
 import { filterNodesByQueryParts } from "../filter-nodes-by-query.js";
 import { unshare } from "../reify/unshare.js";
@@ -6,7 +7,7 @@ import { skillsDirs } from "./dirs.js";
 import { discoverSkills } from "./discover.js";
 import { editGitignore } from "./gitignore.js";
 import { maskSkills } from "./mask.js";
-import { mountSkill, packageKey, readMounts, samePath, unmountSkill, } from "./mounts.js";
+import { mountSkill, packageKey, readMounts, realOr, samePath, unmountSkill, } from "./mounts.js";
 export * from "./discover.js";
 const lc = (s) => s.toLowerCase();
 const selectNodes = async (o) => {
@@ -21,6 +22,23 @@ const dirsOf = (o, create = false) => skillsDirs({
     env: o.env,
     create,
 });
+// every workspace, selected or not: owners of vlt links
+const workspaceDirs = (graph, scurry) => [...graph.importers]
+    .filter(n => !n.mainImporter)
+    .map(n => ({
+    id: n.id,
+    path: realOr(n.resolvedLocation(scurry)),
+}));
+// every workspace, loaded or not (`-w`)
+const allWorkspaces = (m) => m ?
+    [
+        ...Monorepo.load(m.projectRoot, {
+            config: m.config,
+            scurry: m.scurry,
+            packageJson: m.packageJson,
+        }).values(),
+    ].map(ws => ({ id: ws.id, path: realOr(ws.fullpath) }))
+    : [];
 // packages behind live vlt links
 const liveOwners = (mounts) => mounts.flatMap(m => m.owner && existsSync(m.target) ? [m.owner] : []);
 // private copies of store-hardlinked files: edits via skill links
@@ -61,7 +79,7 @@ const report = (dropped, unscanned) => unscanned && dropped.length ?
 export const listSkills = async (o) => {
     const { graph, nodes, parts, unscanned } = await selectNodes(o);
     const { targets, scan, skipped } = dirsOf(o);
-    const { skills } = discoverSkills(nodes, o.scurry, readMounts(scan));
+    const { skills } = discoverSkills(nodes, o.scurry, readMounts(scan, { workspaces: workspaceDirs(graph, o.scurry) }));
     const { picked, dropped } = pick(skills, parts, unscanned);
     return {
         project: graph.mainImporter.name,
@@ -77,16 +95,17 @@ export const listSkills = async (o) => {
  * project's agent skill dirs (see `skillsDirs`), created only when a
  * skill is picked. `target` selectors may end with `:skill()`. One
  * package per name, among picked skills, in every dir: the package of
- * the first existing link (in dir order), else rank (main importer
- * dep, importer dep, transitive), then DepID; the others are
+ * the first existing link (in dir order), else rank (workspace or main
+ * importer dep, importer dep, transitive), then DepID; the others are
  * reported. Installs keep a dir's link to another installed skill.
  * A link follows its package to the picked version, in every scanned
  * dir. Then remove vlt links whose skill is no longer installed (with
  * `apply`: every vlt link not made here), and keep each dir's
- * `.gitignore` block in sync. Linked packages get private copies of
- * files hardlinked from the global store. Security queries fail
- * closed: skills of packages with no security data are not linked,
- * and reported in `unscanned` unless still linked.
+ * `.gitignore` block in sync (also vlt's record of workspace links).
+ * Linked packages get private copies of files hardlinked from the
+ * global store. Security queries fail closed: skills of packages with
+ * no security data are not linked, and reported in `unscanned` unless
+ * still linked.
  */
 export const linkSkills = async (o) => {
     const { graph, nodes, parts, unscanned } = await selectNodes(o);
@@ -101,7 +120,8 @@ export const linkSkills = async (o) => {
         conflicts: [],
         dirs: targets.map(d => d.dir),
     };
-    const mounts = readMounts(scan);
+    const workspaces = workspaceDirs(graph, o.scurry);
+    const mounts = readMounts(scan, { workspaces });
     const byName = new Map(mounts.map(m => [`${m.dir.dir}\0${lc(m.name)}`, m]));
     // the link's skill is no longer installed: dangling, orphan owner,
     // or a scanned owner that no longer ships it
@@ -163,7 +183,10 @@ export const linkSkills = async (o) => {
     // names taken over by entries not vlt's
     const foreign = [];
     const kept = new Set();
+    // links made here, recorded even if not yet in `.gitignore`
+    const made = new Set();
     const where = new Map();
+    let every;
     for (const { dir, winner, losers, m } of picks) {
         if (winner) {
             // replaced link named in another case (case-sensitive fs)
@@ -172,10 +195,16 @@ export const linkSkills = async (o) => {
                 gone.push(m);
             }
             const mount = `${dir.dir}/${winner.skill}`;
-            const r = mountSkill(winner, dir);
+            const r = mountSkill(winner, dir, m?.name === winner.skill);
+            if (r === 'linked')
+                made.add(mount);
             if (r === 'conflict') {
                 res.conflicts.push(mount);
-                foreign.push({ dir, name: winner.skill });
+                // vlt's link into a workspace not loaded (`-w`) keeps its line
+                every ??= allWorkspaces(o.monorepo);
+                if (!readMounts([dir], { workspaces: every }).some(l => l.name === winner.skill)) {
+                    foreign.push({ dir, name: winner.skill });
+                }
             }
             else {
                 const k = `${winner.id}\0${winner.skill}`;
@@ -189,7 +218,7 @@ export const linkSkills = async (o) => {
         for (const s of losers)
             res.conflicts.push(`${dir.dir}/${s.skill} (${label(s)})`);
     }
-    const after = readMounts(scan);
+    const after = readMounts(scan, { workspaces, made });
     const present = [];
     for (const m of after) {
         if (o.apply ? kept.has(m.mount) : !stale(m)) {

package/dist/skills/mounts.d.ts

@@ -16,9 +16,17 @@ export type SkillMount = {
     link: string;
     /** absolute resolved link target */
     target: string;
-    /** DepID of the store dir the link points into */
+    /** DepID of the store dir or workspace the link points into */
     owner?: DepID;
 };
+/**
+ * A workspace of the project.
+ */
+export type WorkspaceDir = {
+    id: DepID;
+    /** realpath */
+    path: string;
+};
 /**
  * Outcome of mounting a single skill.
  */
@@ -50,14 +58,20 @@ export declare const ownerOf: (target: string) => DepID | undefined;
  */
 export declare const packageKey: (id: DepID) => string;
 /**
- * All vlt links in the given dirs. Anything else is ignored.
+ * All vlt links in the given dirs: links into a `node_modules/.vlt`
+ * store, and links listed in the dir's `.gitignore` block (or `made`)
+ * into a workspace or dangling. Anything else is ignored.
  */
-export declare const readMounts: (scan: SkillsDir[]) => SkillMount[];
+export declare const readMounts: (scan: SkillsDir[], { workspaces, made, }?: {
+    workspaces?: WorkspaceDir[];
+    made?: Set<string>;
+}) => SkillMount[];
 /**
- * Link a skill at `<dir>/<skill>`. Never touches anything not managed by
- * vlt: returns `'conflict'` instead.
+ * Link a skill at `<dir>/<skill>`. `'unchanged'` if the entry already
+ * is the skill. Never touches anything not managed by vlt (a store
+ * link, or `owned`): returns `'conflict'` instead.
  */
-export declare const mountSkill: (skill: Pick<Skill, "skill" | "path">, dir: SkillsDir) => MountResult;
+export declare const mountSkill: (skill: Pick<Skill, "skill" | "path">, dir: SkillsDir, owned?: boolean) => MountResult;
 /**
  * Remove a vlt link. Its dir is kept.
  */

package/dist/skills/mounts.js

@@ -1,7 +1,8 @@
-import { lstatSync, readdirSync, readlinkSync, realpathSync, unlinkSync, } from 'node:fs';
+import { existsSync, lstatSync, readdirSync, readlinkSync, realpathSync, unlinkSync, } from 'node:fs';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { baseDepID, isDepID, joinDepIDTuple, splitDepID, } from '@vltpkg/dep-id';
 import { symlinkSyncMkdirp } from "../reify/symlink-sync.js";
+import { gitignoreNames } from "./gitignore.js";
 /** `lstat`, undefined when missing or unreadable (eg, ENOTDIR) */
 export const lstat = (path) => {
     try {
@@ -30,6 +31,15 @@ export const realOr = (p) => {
  */
 export const samePath = (a, b) => norm(realOr(a)) === norm(realOr(b));
 const storeSeg = `${sep}node_modules${sep}.vlt${sep}`;
+// resolved target of a symlink (or junction)
+const linkTarget = (link) => {
+    if (!lstat(link)?.isSymbolicLink())
+        return undefined;
+    let raw = readlinkSync(link);
+    if (raw.startsWith('\\\\?\\'))
+        raw = raw.slice(4);
+    return resolve(dirname(link), raw);
+};
 /**
  * The target of `link` if it is a symlink (or junction) pointing into
  * a `node_modules/.vlt` store, otherwise undefined. Any store, not just
@@ -37,13 +47,20 @@ const storeSeg = `${sep}node_modules${sep}.vlt${sep}`;
  * store after the project is moved or copied.
  */
 export const mountTarget = (link) => {
-    if (!lstat(link)?.isSymbolicLink())
-        return undefined;
-    let raw = readlinkSync(link);
-    if (raw.startsWith('\\\\?\\'))
-        raw = raw.slice(4);
-    const target = resolve(dirname(link), raw);
-    return norm(target).includes(storeSeg) ? target : undefined;
+    const target = linkTarget(link);
+    return target && norm(target).includes(storeSeg) ?
+        target
+        : undefined;
+};
+// the deepest workspace holding `target`
+const workspaceOf = (target, workspaces) => {
+    const t = norm(realOr(target));
+    return workspaces
+        .filter(({ path }) => {
+        const p = norm(path);
+        return t === p || t.startsWith(p + sep);
+    })
+        .sort((a, b) => b.path.length - a.path.length)[0];
 };
 /**
  * The DepID of the last `node_modules/.vlt/<DepID>` segment of a raw
@@ -76,9 +93,11 @@ export const packageKey = (id) => {
     ]);
 };
 /**
- * All vlt links in the given dirs. Anything else is ignored.
+ * All vlt links in the given dirs: links into a `node_modules/.vlt`
+ * store, and links listed in the dir's `.gitignore` block (or `made`)
+ * into a workspace or dangling. Anything else is ignored.
  */
-export const readMounts = (scan) => {
+export const readMounts = (scan, { workspaces = [], made, } = {}) => {
     const mounts = [];
     for (const dir of scan) {
         let entries;
@@ -88,35 +107,42 @@ export const readMounts = (scan) => {
         catch {
             continue;
         }
+        const listed = gitignoreNames(dir.real);
         for (const name of entries) {
             const link = join(dir.real, name);
+            const mount = `${dir.dir}/${name}`;
+            const m = { dir, name, mount, link };
             const target = mountTarget(link);
             if (target) {
-                mounts.push({
-                    dir,
-                    name,
-                    mount: `${dir.dir}/${name}`,
-                    link,
-                    target,
-                    owner: ownerOf(target),
-                });
+                mounts.push({ ...m, target, owner: ownerOf(target) });
+                continue;
             }
+            const wsTarget = (listed.has(name) || made?.has(mount)) && linkTarget(link);
+            if (!wsTarget)
+                continue;
+            if (!existsSync(wsTarget)) {
+                mounts.push({ ...m, target: wsTarget });
+                continue;
+            }
+            const ws = workspaceOf(wsTarget, workspaces);
+            if (ws)
+                mounts.push({ ...m, target: wsTarget, owner: ws.id });
         }
     }
     return mounts.sort((a, b) => a.mount.localeCompare(b.mount, 'en'));
 };
 /**
- * Link a skill at `<dir>/<skill>`. Never touches anything not managed by
- * vlt: returns `'conflict'` instead.
+ * Link a skill at `<dir>/<skill>`. `'unchanged'` if the entry already
+ * is the skill. Never touches anything not managed by vlt (a store
+ * link, or `owned`): returns `'conflict'` instead.
  */
-export const mountSkill = (skill, dir) => {
+export const mountSkill = (skill, dir, owned = false) => {
     const link = join(dir.real, skill.skill);
     if (lstat(link)) {
-        const target = mountTarget(link);
-        if (!target)
-            return 'conflict';
-        if (samePath(target, skill.path))
+        if (samePath(link, skill.path))
             return 'unchanged';
+        if (!owned && !mountTarget(link))
+            return 'conflict';
         unlinkSync(link);
     }
     // junctions need no admin rights, but want an absolute target

package/dist/uninstall.d.ts

@@ -1,3 +1,4 @@
+import type { DepID } from '@vltpkg/dep-id';
 import type { PackageInfoClient } from '@vltpkg/package-info';
 import type { LoadOptions } from './actual/load.ts';
 import type { RemoveImportersDependenciesMap } from './dependencies.ts';
@@ -18,6 +19,8 @@ export type UninstallOptions = LoadOptions & {
      * none
      */
     skillsDirs?: string[];
+    /** store dirs of these nodes are never removed, eg the running vlt */
+    keepNodes?: ReadonlySet<DepID>;
 };
 /**
  * Result of {@link uninstall}.

package/dist/uninstall.js

@@ -68,6 +68,7 @@ export const uninstall = async (options, remove) => {
                     ...options,
                     remove,
                     graph,
+                    modifiers,
                 })
                 : undefined;
             saveImportersPackageJson?.();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.5.0",
-    "@vltpkg/dep-id": "1.5.0",
-    "@vltpkg/dss-breadcrumb": "1.5.0",
-    "@vltpkg/error-cause": "1.5.0",
-    "@vltpkg/fast-split": "1.5.0",
-    "@vltpkg/graph-run": "1.5.0",
-    "@vltpkg/init": "1.5.0",
-    "@vltpkg/output": "1.5.0",
-    "@vltpkg/package-info": "1.5.0",
-    "@vltpkg/package-json": "1.5.0",
-    "@vltpkg/pick-manifest": "1.5.0",
-    "@vltpkg/query": "1.5.0",
-    "@vltpkg/rollback-remove": "1.5.0",
-    "@vltpkg/run": "1.5.0",
-    "@vltpkg/satisfies": "1.5.0",
-    "@vltpkg/security-archive": "1.5.0",
-    "@vltpkg/spec": "1.5.0",
-    "@vltpkg/types": "1.5.0",
-    "@vltpkg/vlt-json": "1.5.0",
-    "@vltpkg/workspaces": "1.5.0",
+    "@vltpkg/cmd-shim": "1.6.0",
+    "@vltpkg/dep-id": "1.6.0",
+    "@vltpkg/dss-breadcrumb": "1.6.0",
+    "@vltpkg/error-cause": "1.6.0",
+    "@vltpkg/fast-split": "1.6.0",
+    "@vltpkg/graph-run": "1.6.0",
+    "@vltpkg/init": "1.6.0",
+    "@vltpkg/output": "1.6.0",
+    "@vltpkg/package-info": "1.6.0",
+    "@vltpkg/package-json": "1.6.0",
+    "@vltpkg/pick-manifest": "1.6.0",
+    "@vltpkg/query": "1.6.0",
+    "@vltpkg/rollback-remove": "1.6.0",
+    "@vltpkg/run": "1.6.0",
+    "@vltpkg/satisfies": "1.6.0",
+    "@vltpkg/security-archive": "1.6.0",
+    "@vltpkg/spec": "1.6.0",
+    "@vltpkg/types": "1.6.0",
+    "@vltpkg/vlt-json": "1.6.0",
+    "@vltpkg/workspaces": "1.6.0",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },