@vltpkg/graph 1.5.0 → 1.6.1

package/README.md

@@ -93,13 +93,14 @@ code is not loaded. `update` and `uninstall` take `allowSkills` too.
 
 Lists the agent skills (dirs with a `SKILL.md`, see
 https://agentskills.io/specification) shipped by installed packages in
-the vlt store (a root `SKILL.md`, then `<dir>/SKILL.md` in `skills/`,
-`dist/skills/` and `.agents/skills/`; the first skill of a name wins),
-from one version per package (a direct dep, else the highest), with
-the agent skill dirs each is linked in, `project`: the main importer
-name, and the `graph`. `options.target` is a DSS query selecting
-packages (default `*`); a selector ending with `:skill(<name>, …)`
-keeps only those skills of its packages. Creates nothing.
+the vlt store and the project's workspaces (a root `SKILL.md`, then
+`<dir>/SKILL.md` in `skills/`, `dist/skills/` and `.agents/skills/`;
+the first skill of a name wins), from one version per package (a
+direct dep or workspace, else the highest), with the agent skill dirs
+each is linked in, `project`: the main importer name, and the `graph`.
+`options.target` is a DSS query selecting packages (default `*`); a
+selector ending with `:skill(<name>, …)` keeps only those skills of
+its packages. Creates nothing.
 
 ### `linkSkills(options): Promise<LinkSkillsResult>`
 
@@ -112,21 +113,23 @@ must resolve inside the project, not in `node_modules` (else
 `skipped`, as are fs errors) and are created only when a skill is
 picked. One package per name, among picked skills, in every dir: the
 one the first existing link points to while its skill is installed,
-else a direct dep, then DepID; the others are reported in `conflicts`
-as `<mount> (<package>)`. Installs keep a dir's link to another
-installed skill. A link follows its package to the picked version.
-Then removes links whose skill is no longer installed: dangling,
-package not in the graph, or no longer shipped. With `options.apply`,
-also removes every other vlt link in the scanned dirs. Only links
-pointing into a `node_modules/.vlt` store are ever replaced or
-removed; anything else in the way is reported in `conflicts`. Keeps a
-marked block of link names in each dir's `.gitignore` (`gitignore`
-lists the ones it could not edit). Linked packages get private copies
-of files hardlinked from the global store. `:skill()` patterns that
-match no skill of their packages are returned in `unmatched`. Security
-queries fail closed: skills of npm registry packages with no security
-data are left out (in `listSkills` too) and returned in `unscanned`
-with `unscannedReason` (by `linkSkills`: unless still linked).
+else a direct dep or workspace, then DepID; the others are reported in
+`conflicts` as `<mount> (<package>)`. Installs keep a dir's link to
+another installed skill. A link follows its package to the picked
+version. Then removes links whose skill is no longer installed:
+dangling, package not in the graph, or no longer shipped. With
+`options.apply`, also removes every other vlt link in the scanned
+dirs. Only vlt links (into a `node_modules/.vlt` store, or listed in
+the dir's `.gitignore` block and pointing to a workspace or dangling)
+are ever replaced or removed; anything else in the way is reported in
+`conflicts`. Keeps a marked block of link names in each dir's
+`.gitignore` (`gitignore` lists the ones it could not edit). Linked
+packages get private copies of files hardlinked from the global store.
+`:skill()` patterns that match no skill of their packages are returned
+in `unmatched`. Security queries fail closed: skills of npm registry
+packages with no security data are left out (in `listSkills` too) and
+returned in `unscanned` with `unscannedReason` (by `linkSkills`:
+unless still linked).
 
 ### `assertQuery(selector, flag, partSelectors?): Promise<void>`
 

package/dist/graph.js

@@ -347,6 +347,9 @@ export class Graph {
                 }
                 return edge;
             }
+            // a stale edgesIn ref would let removing the old target drop
+            // the new edge from `from.edgesOut`
+            edge.to?.edgesIn.delete(edge);
             this.edges.delete(edge);
         }
         this.mutations++;

package/dist/ideal/append-nodes.js

@@ -419,7 +419,7 @@ const fetchManifestsForDeps = async (packageInfo, graph, fromNode, deps, scurry,
  * vlt store are extracted immediately (in parallel) instead of waiting for
  * the full ideal graph to be built. This significantly improves install time.
  */
-const processPlacementTasks = async (graph, options, placementTasks, add, modifiers, scurry, packageInfo, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove) => {
+const processPlacementTasks = async (graph, options, placementTasks, add, modifiers, scurry, packageInfo, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove, explicit) => {
     const childDepsToProcess = [];
     // Note: placementTasks are already sorted by fetchManifestsForDeps
     // using compareByHasPeerDeps to ensure non-peer deps are processed first.
@@ -431,18 +431,31 @@ const processPlacementTasks = async (graph, options, placementTasks, add, modifi
         // reify step to properly update the package.json file dependencies
         // using the correct names retrieved from the manifest data
         const additiveMap = fromNode.importer ? add : transientAdd?.get(fromNode.id);
+        // a nameless explicit add is known by its fixed up name from here on
+        const explicitKeys = explicit?.get(fromNode.id);
+        const wasExplicit = explicitKeys?.has(addKey(spec));
         spec = fixupAddedNames(additiveMap, manifest, options, spec);
+        if (wasExplicit)
+            explicitKeys?.add(spec.name);
         // handles missing manifest resolution
         if (!manifest) {
             if (!edgeOptional && fromNode.isOptional()) {
                 // failed resolution of a non-optional dep of an optional node
                 // have to clean up the dependents
-                removeOptionalSubgraph(graph, fromNode);
+                for (const n of removeOptionalSubgraph(graph, fromNode)) {
+                    // pruned importer deps: nothing to save, unless requested
+                    for (const { from, name } of n.edgesIn) {
+                        if (from.importer && !explicit?.get(from.id)?.has(name)) {
+                            add?.delete(name);
+                        }
+                    }
+                }
                 continue;
             }
             else if (edgeOptional) {
-                // failed resolution of an optional dep, just ignore it,
-                // nothing to prune because we never added it in the first place.
+                // failed resolution of an optional dep: skip it and drop it
+                // from the add map, nothing to prune or save
+                additiveMap?.delete(addKey(spec));
                 continue;
             }
             else {
@@ -738,7 +751,7 @@ export const appendNodes = async (packageInfo, graph, fromNode, deps, scurry, op
                 graph.addEdge(type, spec, fromNode, toNode);
             }
             // Place nodes and collect child deps
-            const placed = await processPlacementTasks(graph, options, result.placementTasks, add, modifiers, scurry, packageInfo, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove);
+            const placed = await processPlacementTasks(graph, options, result.placementTasks, add, modifiers, scurry, packageInfo, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove, explicit);
             levelResults.push(placed);
         }
         // ============================================================

package/dist/ideal/remove-satisfied-specs.js

@@ -31,18 +31,26 @@ export const removeSatisfiedSpecs = ({ add, graph, modifiers, }) => {
             const depIsCatalog = dependency.spec.type === 'catalog';
             if (edgeIsCatalog !== depIsCatalog)
                 continue;
+            // a governed edge is checked against the modifier value (e.g.
+            // `workspace:*` to a versionless workspace), not its own spec: one
+            // built before the modifier applied must be rebuilt
+            const mod = modifiers?.importerEdgeModifier(importer, dependency.spec);
             // If the current graph edge is already valid, then we remove that
             // dependency item from the list of items to be added to the graph
-            if (satisfies(edge.to?.id, dependency.spec, edge.from.location, graph.projectRoot, graph.monorepo)) {
-                // a governed edge carries the modifier value by construction:
-                // healing it to the manifest text would only be undone by the
-                // rebuild that re-applies the override. `implicit` is not a real
-                // edge type, it means "keep what the edge already is", so it
-                // never makes an edge stale
-                if ((edge.spec.bareSpec !== dependency.spec.bareSpec ||
-                    (dependency.type !== 'implicit' &&
-                        edge.type !== dependency.type)) &&
-                    !modifiers?.targetsImporterEdge(importer, dependency.spec)) {
+            if (satisfies(edge.to?.id, mod?.type === 'edge' ? mod.spec : dependency.spec, edge.from.location, graph.projectRoot, graph.monorepo)) {
+                // `implicit` is not a real edge type, it means "keep what the
+                // edge already is", so it never makes an edge stale
+                const typeChanged = dependency.type !== 'implicit' &&
+                    edge.type !== dependency.type;
+                if (mod) {
+                    // keeps the modifier value, the rebuild would re-apply it
+                    // anyway; only the type follows the manifest
+                    if (typeChanged) {
+                        staleSpecs.set(edge, { ...dependency, spec: edge.spec });
+                    }
+                }
+                else if (edge.spec.bareSpec !== dependency.spec.bareSpec ||
+                    typeChanged) {
                     staleSpecs.set(edge, dependency);
                 }
                 dependencies.delete(name);

package/dist/install.d.ts

@@ -22,6 +22,8 @@ export type InstallOptions = LoadOptions & {
      * none
      */
     skillsDirs?: string[];
+    /** store dirs of these nodes are never removed, eg the running vlt */
+    keepNodes?: ReadonlySet<DepID>;
 };
 /**
  * Result of {@link install}.

package/dist/install.js

@@ -47,7 +47,10 @@ export const install = async (options, add) => {
     }
     catch (err) {
         if (asError(err).message === 'Could not read package.json file') {
-            await init({ cwd: options.projectRoot });
+            await init({
+                cwd: options.projectRoot,
+                packageJson: options.packageJson,
+            });
             mainManifest = options.packageJson.read(options.projectRoot, {
                 reload: true,
             });
@@ -239,6 +242,7 @@ export const install = async (options, add) => {
                     ...options,
                     add,
                     graph,
+                    modifiers,
                     remove,
                 })
                 : undefined;

package/dist/lockfile/load-nodes.js

@@ -1,7 +1,6 @@
 import { error } from '@vltpkg/error-cause';
 import { asDepID, splitDepID, splitExtra, } from '@vltpkg/dep-id/browser';
 import { getBooleanFlagsFromNum, getBuildStateFromNum, } from "./types.js";
-import { tarballFormat } from '@vltpkg/types';
 export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest) => {
     const entries = Object.entries(nodes);
     const nodeCount = entries.length;
@@ -76,16 +75,12 @@ export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest)
         // before setResolved(), which needs it to pick the extension for a
         // node whose `resolved` the lockfile left out
         node.brotli = brotli;
-        node.integrity = integrity ?? referenceNode?.integrity;
         // `integrity` is the hash of the artifact `resolved` points at, so a
-        // reference url only stands in for an elided one when it names the
-        // kind of tarball the flag bit says the lockfile's own hash is for
-        const refResolved = referenceNode?.resolved;
-        const refResolvedUsable = !integrity ||
-            !refResolved ||
-            (tarballFormat(refResolved) === 'brotli') === brotli;
+        // reference node only fills in for the kind the flag bit names
+        const ref = !!referenceNode?.brotli === brotli ? referenceNode : undefined;
+        node.integrity = integrity ?? ref?.integrity;
         node.resolved =
-            type === 'remote' ? filepath : ((resolved ?? (refResolvedUsable ? refResolved : undefined)));
+            type === 'remote' ? filepath : (resolved ?? ref?.resolved);
         node.resolvedFromLockfile = !!(node.integrity && node.resolved);
         node.projectRoot = graph.projectRoot;
         if (!node.resolved)

package/dist/modifiers.d.ts

@@ -101,6 +101,11 @@ export type ModifierActiveEntry = {
  * for (const entry of entries)
  *   modifier.updateActiveEntry(fromNode, entry)
  * ```
+ *
+ * A trailing `:workspace` right after an importer selector, e.g.
+ * `:project > :workspace`, is expanded into one `#<name>` entry per
+ * named workspace of the graph, on its first `tryImporter` or
+ * `importerEdgeModifier` call.
  */
 export declare class GraphModifier {
     #private;
@@ -126,6 +131,12 @@ export declare class GraphModifier {
      * root's own b edge is still the manifest's to validate and heal.
      */
     targetsImporterEdge(importer: Node, spec: Spec): boolean;
+    /**
+     * The modifier governing the direct `importer -> spec.name` edge, see
+     * {@link GraphModifier.targetsImporterEdge}. The most specific one
+     * wins, same as during the graph build.
+     */
+    importerEdgeModifier(importer: Node, spec: Spec): ModifierEntry | undefined;
     /**
      * Selector of the modifier that wins the direct `importer -> spec.name`
      * edge, if it removes it (value `-`). Same pick as tryNewDependency:

package/dist/modifiers.js

@@ -7,9 +7,20 @@ import { load } from '@vltpkg/vlt-json';
  * Does this breadcrumb item select the given importer?
  */
 const matchesImporter = (item, importer) => item.importer &&
+    importer.importer &&
     (item.value === ':project' ||
-        (item.value === ':root' && importer.mainImporter) ||
-        (item.value === ':workspace' && importer.importer));
+        item.value === ':workspace' ||
+        (item.value === ':root' && importer.mainImporter));
+/**
+ * Is this a trailing `:workspace` item right after a plain importer
+ * selector, e.g. `:project > :workspace`? It selects any direct
+ * dependency named after a workspace.
+ */
+const isWorkspaceTarget = (item) => item.importer &&
+    item.value === ':workspace' &&
+    !!item.prev?.importer &&
+    !item.prev.name &&
+    !item.prev.prev;
 /**
  * Does this item's qualifier (e.g. `:semver(^1)`, `:v(^1)`) accept the
  * given spec? Shared by traversal matching and by the frozen / healing
@@ -42,6 +53,11 @@ const matchesQualifier = (item, spec) => !!item?.comparator({ semver: spec.semve
  * for (const entry of entries)
  *   modifier.updateActiveEntry(fromNode, entry)
  * ```
+ *
+ * A trailing `:workspace` right after an importer selector, e.g.
+ * `:project > :workspace`, is expanded into one `#<name>` entry per
+ * named workspace of the graph, on its first `tryImporter` or
+ * `importerEdgeModifier` call.
  */
 export class GraphModifier {
     /** The loaded modifiers configuration */
@@ -73,6 +89,14 @@ export class GraphModifier {
     activeModifiers = new Set();
     /** A set of all modifier string values loaded from vlt.json */
     modifierNames = new Set();
+    /** Spec options used when expanding `:workspace` targets */
+    #options = {};
+    /** `<importer> > :workspace` modifiers, expanded once a graph is known */
+    #workspaceTargets = [];
+    /** Graphs whose workspaces were already expanded */
+    #expandedGraphs = new WeakSet();
+    /** Workspace names already expanded */
+    #expandedNames = new Set();
     constructor(options) {
         this.load(options);
     }
@@ -96,8 +120,18 @@ export class GraphModifier {
      * root's own b edge is still the manifest's to validate and heal.
      */
     targetsImporterEdge(importer, spec) {
-        for (const { breadcrumb } of this.#modifiers) {
-            const { last } = breadcrumb;
+        return !!this.importerEdgeModifier(importer, spec);
+    }
+    /**
+     * The modifier governing the direct `importer -> spec.name` edge, see
+     * {@link GraphModifier.targetsImporterEdge}. The most specific one
+     * wins, same as during the graph build.
+     */
+    importerEdgeModifier(importer, spec) {
+        this.#expandWorkspaceTargets(importer);
+        const found = [];
+        for (const mod of this.#modifiers) {
+            const { last } = mod.breadcrumb;
             if (last.name !== spec.name)
                 continue;
             // a qualifier that rejects the spec means the modifier never
@@ -106,14 +140,12 @@ export class GraphModifier {
                 continue;
             const { prev } = last;
             // a lone `#b` matches an edge to b anywhere, importers included
-            if (!prev)
-                return true;
-            if (prev.prev)
-                continue;
-            if (matchesImporter(prev, importer))
-                return true;
+            if (!prev || (!prev.prev && matchesImporter(prev, importer))) {
+                found.push(mod);
+            }
         }
-        return false;
+        const [best] = specificitySort(found.map(m => m.breadcrumb));
+        return found.find(m => m.breadcrumb === best);
     }
     /**
      * Selector of the modifier that wins the direct `importer -> spec.name`
@@ -143,16 +175,22 @@ export class GraphModifier {
      * Loads the modifiers defined in `vlt.json` into memory.
      */
     load(options) {
+        this.#options = options;
         for (const [key, value] of Object.entries(this.config)) {
             this.modifierNames.add(key);
             const breadcrumb = parseBreadcrumb(key);
-            /* c8 ignore start - should not be possible */
             if (!breadcrumb.last.name) {
-                throw error('Could not find name in breadcrumb', {
+                // `<importer> > :workspace` names no package up front, it is
+                // expanded into one entry per workspace once a graph is known
+                if (isWorkspaceTarget(breadcrumb.last)) {
+                    this.#workspaceTargets.push({ query: key, value });
+                    continue;
+                }
+                throw error('Invalid modifier selector', {
                     found: key,
+                    wanted: 'a selector ending in #<name>, or :root, :project or :workspace followed by > :workspace',
                 });
             }
-            /* c8 ignore stop */
             let mod;
             if (typeof value === 'string') {
                 mod = {
@@ -179,13 +217,58 @@ export class GraphModifier {
                 this.#nodeModifiers.add(mod);
             }
             /* c8 ignore end */
-            this.#modifiers.add(mod);
-            // if the breadcrumb starts with an id, then add it to the
-            // map of initial entries, so that we can use it to match
-            if (breadcrumb.first.name) {
-                const initialSet = this.#initialEntries.get(breadcrumb.first.name) ?? new Set();
-                initialSet.add(mod);
-                this.#initialEntries.set(breadcrumb.first.name, initialSet);
+            this.#register(mod);
+        }
+    }
+    /**
+     * Adds a modifier entry to the set of known modifiers.
+     */
+    #register(mod) {
+        this.#modifiers.add(mod);
+        // if the breadcrumb starts with an id, then add it to the
+        // map of initial entries, so that we can use it to match
+        const { name } = mod.breadcrumb.first;
+        if (name) {
+            const initialSet = this.#initialEntries.get(name) ?? new Set();
+            initialSet.add(mod);
+            this.#initialEntries.set(name, initialSet);
+        }
+    }
+    /**
+     * Expands `<importer> > :workspace` modifiers into one
+     * `<importer> > #<name>` entry per named workspace of the node's graph.
+     */
+    #expandWorkspaceTargets(node) {
+        if (!this.#workspaceTargets.length)
+            return;
+        const { graph } = node;
+        if (this.#expandedGraphs.has(graph))
+            return;
+        this.#expandedGraphs.add(graph);
+        for (const importer of graph.importers) {
+            // nameless workspaces are named after their folder, never link those
+            const name = importer.manifest?.name;
+            if (importer.mainImporter ||
+                !name ||
+                this.#expandedNames.has(name)) {
+                continue;
+            }
+            this.#expandedNames.add(name);
+            for (const { query, value } of this.#workspaceTargets) {
+                // fresh breadcrumb per name: items are a linked list and the
+                // active entry maps key on the last item's name
+                const breadcrumb = parseBreadcrumb(query);
+                breadcrumb.last.name = name;
+                const mod = {
+                    breadcrumb,
+                    query,
+                    refs: new Set(),
+                    spec: Spec.parse(name, value, this.#options),
+                    type: 'edge',
+                    value,
+                };
+                this.#edgeModifiers.add(mod);
+                this.#register(mod);
             }
         }
     }
@@ -195,6 +278,7 @@ export class GraphModifier {
      * update the active entry to the current importer node.
      */
     tryImporter(importer) {
+        this.#expandWorkspaceTargets(importer);
         for (const modifier of this.#modifiers) {
             // if the first item in the breadcrumb is an importer and it matches
             // any of the valid top-level selectors, then register the modifier

package/dist/node.js

@@ -371,6 +371,12 @@ export class Node {
             case 'registry':
                 this.#registryNodeResolved(tuple);
                 break;
+            case 'git':
+                // a hosted git committish is fetched as the host's tarball
+                this.resolved =
+                    hydrateTuple(tuple, this.#name, this.#options).final
+                        .remoteURL ?? resolved;
+                break;
             default:
                 this.resolved = resolved;
                 break;

package/dist/reify/add-edge.d.ts

@@ -7,3 +7,7 @@ import type { Edge } from '../edge.ts';
  * until scripts are run, in the case of non-store deps like workspaces
  */
 export declare const addEdge: (edge: Edge, scurry: PathScurry, remover: RollbackRemove, bins?: Record<string, string>) => Promise<void>;
+/**
+ * link the `key` bin of the package at `path` into `binRoot`
+ */
+export declare const linkBin: (path: string, binRoot: string, key: string, val: string, remover: RollbackRemove) => Promise<void>;

package/dist/reify/add-edge.js

@@ -59,15 +59,21 @@ export const addEdge = async (edge, scurry, remover, bins) => {
         promises.push(p);
     if (bins) {
         for (const [key, val] of Object.entries(bins)) {
-            const link = resolve(binRoot, key);
-            const absTarget = resolve(path, val);
-            const target = relative(binRoot, absTarget);
-            // TODO: bash/cmd/ps1 shims on Windows
-            promises.push(process.platform === 'win32' ?
-                cmdShimIfExists(absTarget, link, remover)
-                : clobberSymlink(target, link, remover));
+            promises.push(linkBin(path, binRoot, key, val, remover));
         }
     }
     if (promises.length)
         await Promise.all(promises);
 };
+/**
+ * link the `key` bin of the package at `path` into `binRoot`
+ */
+export const linkBin = (path, binRoot, key, val, remover) => {
+    const link = resolve(binRoot, key);
+    const absTarget = resolve(path, val);
+    const target = relative(binRoot, absTarget);
+    // TODO: bash/cmd/ps1 shims on Windows
+    return process.platform === 'win32' ?
+        cmdShimIfExists(absTarget, link, remover)
+        : clobberSymlink(target, link, remover);
+};

package/dist/reify/delete-edge.js

@@ -1,15 +1,12 @@
+import { readCmdShimIfExists } from '@vltpkg/cmd-shim';
 import { resolve } from 'node:path';
-const rmBinPosix = (remover, bin) => {
-    return [remover.rm(bin)];
-};
-const rmBinWin32 = (remover, bin) => {
-    return [
-        remover.rm(bin),
-        remover.rm(bin + '.cmd'),
-        remover.rm(bin + '.ps1'),
-    ];
-};
-const rmBin = process.platform === 'win32' ? rmBinWin32 : rmBinPosix;
+const binPathsPosix = (bin) => [bin];
+const binPathsWin32 = (bin) => [
+    bin,
+    bin + '.cmd',
+    bin + '.ps1',
+];
+const binPaths = process.platform === 'win32' ? binPathsWin32 : binPathsPosix;
 export const deleteEdge = async (edge, scurry, remover) => {
     const { spec: { name }, to, } = edge;
     const { sep } = scurry.cwd;
@@ -20,9 +17,14 @@ export const deleteEdge = async (edge, scurry, remover) => {
     promises.push(remover.rm(path));
     const bins = to?.bins;
     if (bins) {
-        for (const key of Object.keys(bins)) {
-            const bin = resolve(binRoot, key);
-            promises.push(...rmBin(remover, bin));
+        for (const [key, value] of Object.entries(bins)) {
+            for (const bin of binPaths(resolve(binRoot, key))) {
+                const target = await readCmdShimIfExists(bin);
+                // another dependency may provide the same command.
+                if (target && target !== resolve(path, value))
+                    continue;
+                promises.push(remover.rm(bin));
+            }
         }
     }
     await Promise.all(promises);

package/dist/reify/delete-nodes.d.ts

@@ -1,4 +1,5 @@
+import type { DepID } from '@vltpkg/dep-id';
 import type { RollbackRemove } from '@vltpkg/rollback-remove';
 import type { PathScurry } from 'path-scurry';
 import type { Diff } from '../diff.ts';
-export declare const deleteNodes: (diff: Diff, remover: RollbackRemove, scurry: PathScurry) => Promise<unknown>[];
+export declare const deleteNodes: (diff: Diff, remover: RollbackRemove, scurry: PathScurry, keep?: ReadonlySet<DepID>) => Promise<unknown>[];

package/dist/reify/delete-nodes.js

@@ -1,5 +1,5 @@
 import { deleteEdge } from "./delete-edge.js";
-export const deleteNodes = (diff, remover, scurry) => {
+export const deleteNodes = (diff, remover, scurry, keep) => {
     const store = scurry.resolve('node_modules/.vlt');
     const { sep } = scurry.cwd;
     const rmActions = [];
@@ -7,7 +7,9 @@ export const deleteNodes = (diff, remover, scurry) => {
         // do not delete workspaces or link targets
         if (!node.inVltStore())
             continue;
-        rmActions.push(remover.rm(store + sep + node.id));
+        if (!keep?.has(node.id)) {
+            rmActions.push(remover.rm(store + sep + node.id));
+        }
         for (const edge of node.edgesIn) {
             rmActions.push(deleteEdge(edge, scurry, remover));
         }

package/dist/reify/index.d.ts

@@ -18,6 +18,8 @@ export type ReifyOptions = LoadOptions & {
     update?: boolean;
     saveExact?: boolean;
     savePrefix?: string;
+    /** store dirs of these nodes are never removed, eg the running vlt */
+    keepNodes?: ReadonlySet<DepID>;
 };
 export type ReifyResult = {
     /**

package/dist/reify/index.js

@@ -8,6 +8,7 @@ import { addEdges } from "./add-edges.js";
 import { addNodes } from "./add-nodes.js";
 import { build } from "./build.js";
 import { deleteEdges } from "./delete-edges.js";
+import { relinkBins } from "./relink-bins.js";
 import { carryBuildState, checkNeededBuild, } from "./check-needed-build.js";
 import { deleteNodes } from "./delete-nodes.js";
 import { internalHoist } from "./internal-hoist.js";
@@ -47,6 +48,7 @@ export const reify = async (options) => {
             packageJson: options.packageJson,
             saveExact: options.saveExact,
             savePrefix: options.savePrefix,
+            modifiers: options.modifiers,
         })
         : undefined;
     const noModifiedDependencies = !options.add?.modifiedDependencies &&
@@ -127,6 +129,10 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
     const edgeActions = addEdges(diff, scurry, remover);
     if (edgeActions.length)
         await callLimit(edgeActions, { limit });
+    // link bins that deleted edges removed but other deps still declare
+    const binActions = relinkBins(diff, scurry, remover);
+    if (binActions.length)
+        await callLimit(binActions, { limit });
     await internalHoist(diff.to, options, remover);
     // looks up all nodes setting buildState = 'needed'
     // on nodes that require building
@@ -155,7 +161,7 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
     /* c8 ignore stop */
     saveHidden(options);
     // delete garbage from the store.
-    const rmActions = deleteNodes(diff, remover, scurry);
+    const rmActions = deleteNodes(diff, remover, scurry, options.keepNodes);
     if (rmActions.length)
         await Promise.all(rmActions);
     // updates package.json files if anything was added / removed

package/dist/reify/relink-bins.d.ts

@@ -0,0 +1,9 @@
+import type { RollbackRemove } from '@vltpkg/rollback-remove';
+import type { PathScurry } from 'path-scurry';
+import type { Diff } from '../diff.ts';
+/**
+ * A deleted edge removes the bins it owns, but another dependency
+ * that did not change may declare the same bin name. Link the first
+ * one found if the bin is still missing once added edges are linked.
+ */
+export declare const relinkBins: (diff: Diff, scurry: PathScurry, remover: RollbackRemove) => (() => Promise<unknown>)[];