@vltpkg/graph 1.5.0 → 1.6.1

package/dist/reify/relink-bins.js

@@ -0,0 +1,39 @@
+import { resolve } from 'node:path';
+import { linkBin } from "./add-edge.js";
+/**
+ * A deleted edge removes the bins it owns, but another dependency
+ * that did not change may declare the same bin name. Link the first
+ * one found if the bin is still missing once added edges are linked.
+ */
+export const relinkBins = (diff, scurry, remover) => {
+    const actions = [];
+    const seen = new Set();
+    const { sep } = scurry.cwd;
+    for (const deleted of diff.edges.delete) {
+        const node = diff.to.nodes.get(deleted.from.id);
+        const bins = deleted.to?.bins;
+        if (!node || !bins)
+            continue;
+        const nm = node.nodeModules(scurry);
+        const binRoot = nm + sep + '.bin';
+        for (const key of Object.keys(bins)) {
+            const link = resolve(binRoot, key);
+            if (seen.has(link))
+                continue;
+            seen.add(link);
+            for (const edge of node.edgesOut.values()) {
+                const val = edge.to?.bins?.[key];
+                if (!val)
+                    continue;
+                const path = nm + sep + edge.spec.name.replace('/', sep);
+                actions.push(async () => {
+                    if (await scurry.lstat(link))
+                        return;
+                    await linkBin(path, binRoot, key, val, remover);
+                });
+                break;
+            }
+        }
+    }
+    return actions;
+};

package/dist/reify/update-importers-package-json.d.ts

@@ -1,6 +1,7 @@
 import type { PackageJson } from '@vltpkg/package-json';
 import type { AddImportersDependenciesMap, RemoveImportersDependenciesMap } from '../dependencies.ts';
 import type { Graph } from '../graph.ts';
+import type { GraphModifier } from '../modifiers.ts';
 export type UpdatePackageJsonOptions = {
     /**
      * A `Map` in which keys are {@link DepID} linking to another `Map` in which
@@ -37,9 +38,13 @@ export type UpdatePackageJsonOptions = {
      * Defaults to `^` if not specified. Ignored when `saveExact` is true.
      */
     savePrefix?: string;
+    /**
+     * Graph modifiers, importer edges they govern keep the modifier value.
+     */
+    modifiers?: GraphModifier;
 };
 /**
  * Updates nodes of a provided {@link Graph} accordingly to the
  * provided add or remove arguments.
  */
-export declare const updatePackageJson: ({ add, graph, packageJson, remove, saveExact, savePrefix, }: UpdatePackageJsonOptions) => () => void;
+export declare const updatePackageJson: ({ add, graph, packageJson, remove, saveExact, savePrefix, modifiers, }: UpdatePackageJsonOptions) => () => void;

package/dist/reify/update-importers-package-json.js

@@ -5,7 +5,7 @@ import { longDependencyTypes } from '@vltpkg/types';
 import { longDependencyTypeNames } from "../dependencies.js";
 import { resolveSaveType } from "../resolve-save-type.js";
 import { calculateSaveValue } from "./calculate-save-value.js";
-const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
+const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix, modifiers) => {
     const node = graph.nodes.get(nodeId);
     if (!node) {
         throw error('Failed to retrieve node', {
@@ -56,7 +56,10 @@ const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
             }
             const edge = node.edgesOut.get(name);
             if (!edge?.to) {
-                throw error('Dependency node could not be found');
+                throw error(`Dependency node could not be found: ${name}`, {
+                    spec: dep.spec,
+                    from: node.location,
+                });
             }
             const n = edge.to;
             const [nodeType] = splitDepID(n.id);
@@ -90,8 +93,10 @@ const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
             // the lockfile has to carry the value package.json carries, or a
             // later install reads back `latest` where the manifest says
             // `^1.2.3`. anything keyed by the old spec from here on must be
-            // invalidated at this point.
-            if (saveValue !== edge.spec.bareSpec) {
+            // invalidated at this point. governed edges keep the modifier
+            // value instead.
+            if (saveValue !== edge.spec.bareSpec &&
+                !modifiers?.targetsImporterEdge(node, dep.spec)) {
                 edge.spec = Spec.parse(name, saveValue, dep.spec.options);
                 graph.lockfileStale = true;
             }
@@ -103,7 +108,7 @@ const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
  * Updates nodes of a provided {@link Graph} accordingly to the
  * provided add or remove arguments.
  */
-export const updatePackageJson = ({ add, graph, packageJson, remove, saveExact, savePrefix, }) => {
+export const updatePackageJson = ({ add, graph, packageJson, remove, saveExact, savePrefix, modifiers, }) => {
     const manifestsToUpdate = new Set();
     const operations = new Set([add, remove]);
     for (const operation of operations) {
@@ -112,7 +117,7 @@ export const updatePackageJson = ({ add, graph, packageJson, remove, saveExact,
             // that are nested folders from which the user can also add new
             // dependencies to
             for (const nodeId of operation.keys()) {
-                const manifest = addOrRemoveDeps(nodeId, graph, operation, saveExact, savePrefix);
+                const manifest = addOrRemoveDeps(nodeId, graph, operation, saveExact, savePrefix, modifiers);
                 if (manifest) {
                     manifestsToUpdate.add(manifest);
                 }

package/dist/skills/discover.d.ts

@@ -61,13 +61,13 @@ export declare const shipsSkills: (node: Node) => boolean;
 /**
  * Find the agent skills shipped by the given installed packages.
  *
- * Only packages in the vlt store are scanned, for a root `SKILL.md`,
- * then `<dir>/SKILL.md` in `skills/`, `dist/skills/` and
- * `.agents/skills/`: the first skill of a name wins. One version per
- * package is picked, even if it ships none: a dep of the main
- * importer, else of any importer, else the highest version, then
- * DepID. Same-name skills of different packages are all returned,
- * sorted by rank then DepID (`linkSkills` resolves them). `mounts`
- * set each skill's `linked` dirs.
+ * Only packages in the vlt store and the project's workspaces (not its
+ * root) are scanned, for a root `SKILL.md`, then `<dir>/SKILL.md` in
+ * `skills/`, `dist/skills/` and `.agents/skills/`: the first skill of a
+ * name wins. One version per package is picked, even if it ships none:
+ * a workspace or dep of the main importer, else a dep of any importer,
+ * else the highest version, then DepID. Same-name skills of different
+ * packages are all returned, sorted by rank then DepID (`linkSkills`
+ * resolves them). `mounts` set each skill's `linked` dirs.
  */
 export declare const discoverSkills: (nodes: Iterable<Node>, scurry: PathScurry, mounts?: SkillMount[]) => DiscoveredSkills;

package/dist/skills/discover.js

@@ -134,8 +134,11 @@ const scan = (dir, pkgName) => {
     }
     return found;
 };
-// 0: dep of the main importer, 1: of any importer, 2: transitive
+// 0: a workspace or dep of the main importer, 1: dep of any
+// importer, 2: transitive
 const rank = (node) => {
+    if (node.importer)
+        return 0;
     let r = 2;
     for (const { from } of node.edgesIn) {
         if (from.mainImporter)
@@ -162,10 +165,11 @@ const aliasOf = (node) => {
         edges.find(e => e.from.importer))?.name;
     return n === node.name ? undefined : n;
 };
-// store pkgs only: lockfile keeps a tarball's path as its location
-const scannable = (node) => !node.importer &&
-    node.inVltStore() &&
-    splitDepID(node.id)[0] !== 'file';
+// store pkgs and workspaces, not the project root; lockfile keeps a
+// tarball's path as its location
+const scannable = (node) => node.importer ?
+    !node.mainImporter
+    : node.inVltStore() && splitDepID(node.id)[0] !== 'file';
 /** Ships agent skills, as `discoverSkills` finds them. */
 export const shipsSkills = (node) => scannable(node) &&
     scan(realOr(resolve(node.projectRoot, node.location)), node.name)
@@ -173,14 +177,14 @@ export const shipsSkills = (node) => scannable(node) &&
 /**
  * Find the agent skills shipped by the given installed packages.
  *
- * Only packages in the vlt store are scanned, for a root `SKILL.md`,
- * then `<dir>/SKILL.md` in `skills/`, `dist/skills/` and
- * `.agents/skills/`: the first skill of a name wins. One version per
- * package is picked, even if it ships none: a dep of the main
- * importer, else of any importer, else the highest version, then
- * DepID. Same-name skills of different packages are all returned,
- * sorted by rank then DepID (`linkSkills` resolves them). `mounts`
- * set each skill's `linked` dirs.
+ * Only packages in the vlt store and the project's workspaces (not its
+ * root) are scanned, for a root `SKILL.md`, then `<dir>/SKILL.md` in
+ * `skills/`, `dist/skills/` and `.agents/skills/`: the first skill of a
+ * name wins. One version per package is picked, even if it ships none:
+ * a workspace or dep of the main importer, else a dep of any importer,
+ * else the highest version, then DepID. Same-name skills of different
+ * packages are all returned, sorted by rank then DepID (`linkSkills`
+ * resolves them). `mounts` set each skill's `linked` dirs.
  */
 export const discoverSkills = (nodes, scurry, mounts = []) => {
     const key = (name, path) => `${lc(name)}\0${norm(path)}`;

package/dist/skills/gitignore.d.ts

@@ -11,3 +11,8 @@ export declare const editGitignore: (dir: string, edit: {
     add: string[];
     remove: string[];
 }) => "ok" | "refused";
+/**
+ * Names in vlt's block of `<dir>/.gitignore`: vlt's record of its links
+ * in `dir`. Empty if none or unreadable.
+ */
+export declare const gitignoreNames: (dir: string) => Set<string>;

package/dist/skills/gitignore.js

@@ -5,6 +5,12 @@ export const GITIGNORE_END = '# <<< vlt agent skills';
 const sorted = (names) => [...names]
     .sort((a, b) => a.localeCompare(b, 'en'))
     .map(n => `/${n}`);
+// vlt's block: `end` is -1 if none
+const findBlock = (lines) => {
+    const begin = lines.findIndex(l => l.trim() === GITIGNORE_BEGIN);
+    const end = lines.findIndex((l, i) => begin !== -1 && i > begin && l.trim() === GITIGNORE_END);
+    return { begin, end };
+};
 const update = (file, { add, remove }) => {
     const st = lstatSync(file, { throwIfNoEntry: false });
     if (st && !st.isFile())
@@ -12,8 +18,7 @@ const update = (file, { add, remove }) => {
     const text = st ? readFileSync(file, 'utf8') : '';
     const eol = text.includes('\r\n') ? '\r\n' : '\n';
     const lines = text.split(eol);
-    const begin = lines.findIndex(l => l.trim() === GITIGNORE_BEGIN);
-    const end = lines.findIndex((l, i) => begin !== -1 && i > begin && l.trim() === GITIGNORE_END);
+    const { begin, end } = findBlock(lines);
     let out;
     if (end === -1) {
         if (!add.length)
@@ -51,3 +56,27 @@ export const editGitignore = (dir, edit) => {
         return 'refused';
     }
 };
+/**
+ * Names in vlt's block of `<dir>/.gitignore`: vlt's record of its links
+ * in `dir`. Empty if none or unreadable.
+ */
+export const gitignoreNames = (dir) => {
+    try {
+        const file = join(dir, '.gitignore');
+        if (!lstatSync(file, { throwIfNoEntry: false })?.isFile()) {
+            return new Set();
+        }
+        const lines = readFileSync(file, 'utf8').split(/\r?\n/);
+        const { begin, end } = findBlock(lines);
+        if (end === -1)
+            return new Set();
+        return new Set(lines
+            .slice(begin + 1, end)
+            .map(l => l.trim())
+            .filter(l => l.startsWith('/'))
+            .map(l => l.slice(1)));
+    }
+    catch {
+        return new Set();
+    }
+};

package/dist/skills/index.d.ts

@@ -109,15 +109,16 @@ export declare const listSkills: (o: SkillsOptions) => Promise<ListSkillsResult>
  * project's agent skill dirs (see `skillsDirs`), created only when a
  * skill is picked. `target` selectors may end with `:skill()`. One
  * package per name, among picked skills, in every dir: the package of
- * the first existing link (in dir order), else rank (main importer
- * dep, importer dep, transitive), then DepID; the others are
+ * the first existing link (in dir order), else rank (workspace or main
+ * importer dep, importer dep, transitive), then DepID; the others are
  * reported. Installs keep a dir's link to another installed skill.
  * A link follows its package to the picked version, in every scanned
  * dir. Then remove vlt links whose skill is no longer installed (with
  * `apply`: every vlt link not made here), and keep each dir's
- * `.gitignore` block in sync. Linked packages get private copies of
- * files hardlinked from the global store. Security queries fail
- * closed: skills of packages with no security data are not linked,
- * and reported in `unscanned` unless still linked.
+ * `.gitignore` block in sync (also vlt's record of workspace links).
+ * Linked packages get private copies of files hardlinked from the
+ * global store. Security queries fail closed: skills of packages with
+ * no security data are not linked, and reported in `unscanned` unless
+ * still linked.
  */
 export declare const linkSkills: (o: LinkSkillsOptions) => Promise<LinkSkillsResult>;

package/dist/skills/index.js

@@ -1,4 +1,5 @@
 import { existsSync } from 'node:fs';
+import { Monorepo } from '@vltpkg/workspaces';
 import { load as loadActual } from "../actual/load.js";
 import { filterNodesByQueryParts } from "../filter-nodes-by-query.js";
 import { unshare } from "../reify/unshare.js";
@@ -6,7 +7,7 @@ import { skillsDirs } from "./dirs.js";
 import { discoverSkills } from "./discover.js";
 import { editGitignore } from "./gitignore.js";
 import { maskSkills } from "./mask.js";
-import { mountSkill, packageKey, readMounts, samePath, unmountSkill, } from "./mounts.js";
+import { mountSkill, packageKey, readMounts, realOr, samePath, unmountSkill, } from "./mounts.js";
 export * from "./discover.js";
 const lc = (s) => s.toLowerCase();
 const selectNodes = async (o) => {
@@ -21,6 +22,23 @@ const dirsOf = (o, create = false) => skillsDirs({
     env: o.env,
     create,
 });
+// every workspace, selected or not: owners of vlt links
+const workspaceDirs = (graph, scurry) => [...graph.importers]
+    .filter(n => !n.mainImporter)
+    .map(n => ({
+    id: n.id,
+    path: realOr(n.resolvedLocation(scurry)),
+}));
+// every workspace, loaded or not (`-w`)
+const allWorkspaces = (m) => m ?
+    [
+        ...Monorepo.load(m.projectRoot, {
+            config: m.config,
+            scurry: m.scurry,
+            packageJson: m.packageJson,
+        }).values(),
+    ].map(ws => ({ id: ws.id, path: realOr(ws.fullpath) }))
+    : [];
 // packages behind live vlt links
 const liveOwners = (mounts) => mounts.flatMap(m => m.owner && existsSync(m.target) ? [m.owner] : []);
 // private copies of store-hardlinked files: edits via skill links
@@ -61,7 +79,7 @@ const report = (dropped, unscanned) => unscanned && dropped.length ?
 export const listSkills = async (o) => {
     const { graph, nodes, parts, unscanned } = await selectNodes(o);
     const { targets, scan, skipped } = dirsOf(o);
-    const { skills } = discoverSkills(nodes, o.scurry, readMounts(scan));
+    const { skills } = discoverSkills(nodes, o.scurry, readMounts(scan, { workspaces: workspaceDirs(graph, o.scurry) }));
     const { picked, dropped } = pick(skills, parts, unscanned);
     return {
         project: graph.mainImporter.name,
@@ -77,16 +95,17 @@ export const listSkills = async (o) => {
  * project's agent skill dirs (see `skillsDirs`), created only when a
  * skill is picked. `target` selectors may end with `:skill()`. One
  * package per name, among picked skills, in every dir: the package of
- * the first existing link (in dir order), else rank (main importer
- * dep, importer dep, transitive), then DepID; the others are
+ * the first existing link (in dir order), else rank (workspace or main
+ * importer dep, importer dep, transitive), then DepID; the others are
  * reported. Installs keep a dir's link to another installed skill.
  * A link follows its package to the picked version, in every scanned
  * dir. Then remove vlt links whose skill is no longer installed (with
  * `apply`: every vlt link not made here), and keep each dir's
- * `.gitignore` block in sync. Linked packages get private copies of
- * files hardlinked from the global store. Security queries fail
- * closed: skills of packages with no security data are not linked,
- * and reported in `unscanned` unless still linked.
+ * `.gitignore` block in sync (also vlt's record of workspace links).
+ * Linked packages get private copies of files hardlinked from the
+ * global store. Security queries fail closed: skills of packages with
+ * no security data are not linked, and reported in `unscanned` unless
+ * still linked.
  */
 export const linkSkills = async (o) => {
     const { graph, nodes, parts, unscanned } = await selectNodes(o);
@@ -101,7 +120,8 @@ export const linkSkills = async (o) => {
         conflicts: [],
         dirs: targets.map(d => d.dir),
     };
-    const mounts = readMounts(scan);
+    const workspaces = workspaceDirs(graph, o.scurry);
+    const mounts = readMounts(scan, { workspaces });
     const byName = new Map(mounts.map(m => [`${m.dir.dir}\0${lc(m.name)}`, m]));
     // the link's skill is no longer installed: dangling, orphan owner,
     // or a scanned owner that no longer ships it
@@ -163,7 +183,10 @@ export const linkSkills = async (o) => {
     // names taken over by entries not vlt's
     const foreign = [];
     const kept = new Set();
+    // links made here, recorded even if not yet in `.gitignore`
+    const made = new Set();
     const where = new Map();
+    let every;
     for (const { dir, winner, losers, m } of picks) {
         if (winner) {
             // replaced link named in another case (case-sensitive fs)
@@ -172,10 +195,16 @@ export const linkSkills = async (o) => {
                 gone.push(m);
             }
             const mount = `${dir.dir}/${winner.skill}`;
-            const r = mountSkill(winner, dir);
+            const r = mountSkill(winner, dir, m?.name === winner.skill);
+            if (r === 'linked')
+                made.add(mount);
             if (r === 'conflict') {
                 res.conflicts.push(mount);
-                foreign.push({ dir, name: winner.skill });
+                // vlt's link into a workspace not loaded (`-w`) keeps its line
+                every ??= allWorkspaces(o.monorepo);
+                if (!readMounts([dir], { workspaces: every }).some(l => l.name === winner.skill)) {
+                    foreign.push({ dir, name: winner.skill });
+                }
             }
             else {
                 const k = `${winner.id}\0${winner.skill}`;
@@ -189,7 +218,7 @@ export const linkSkills = async (o) => {
         for (const s of losers)
             res.conflicts.push(`${dir.dir}/${s.skill} (${label(s)})`);
     }
-    const after = readMounts(scan);
+    const after = readMounts(scan, { workspaces, made });
     const present = [];
     for (const m of after) {
         if (o.apply ? kept.has(m.mount) : !stale(m)) {

package/dist/skills/mounts.d.ts

@@ -16,9 +16,17 @@ export type SkillMount = {
     link: string;
     /** absolute resolved link target */
     target: string;
-    /** DepID of the store dir the link points into */
+    /** DepID of the store dir or workspace the link points into */
     owner?: DepID;
 };
+/**
+ * A workspace of the project.
+ */
+export type WorkspaceDir = {
+    id: DepID;
+    /** realpath */
+    path: string;
+};
 /**
  * Outcome of mounting a single skill.
  */
@@ -50,14 +58,20 @@ export declare const ownerOf: (target: string) => DepID | undefined;
  */
 export declare const packageKey: (id: DepID) => string;
 /**
- * All vlt links in the given dirs. Anything else is ignored.
+ * All vlt links in the given dirs: links into a `node_modules/.vlt`
+ * store, and links listed in the dir's `.gitignore` block (or `made`)
+ * into a workspace or dangling. Anything else is ignored.
  */
-export declare const readMounts: (scan: SkillsDir[]) => SkillMount[];
+export declare const readMounts: (scan: SkillsDir[], { workspaces, made, }?: {
+    workspaces?: WorkspaceDir[];
+    made?: Set<string>;
+}) => SkillMount[];
 /**
- * Link a skill at `<dir>/<skill>`. Never touches anything not managed by
- * vlt: returns `'conflict'` instead.
+ * Link a skill at `<dir>/<skill>`. `'unchanged'` if the entry already
+ * is the skill. Never touches anything not managed by vlt (a store
+ * link, or `owned`): returns `'conflict'` instead.
  */
-export declare const mountSkill: (skill: Pick<Skill, "skill" | "path">, dir: SkillsDir) => MountResult;
+export declare const mountSkill: (skill: Pick<Skill, "skill" | "path">, dir: SkillsDir, owned?: boolean) => MountResult;
 /**
  * Remove a vlt link. Its dir is kept.
  */

package/dist/skills/mounts.js

@@ -1,7 +1,8 @@
-import { lstatSync, readdirSync, readlinkSync, realpathSync, unlinkSync, } from 'node:fs';
+import { existsSync, lstatSync, readdirSync, readlinkSync, realpathSync, unlinkSync, } from 'node:fs';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { baseDepID, isDepID, joinDepIDTuple, splitDepID, } from '@vltpkg/dep-id';
 import { symlinkSyncMkdirp } from "../reify/symlink-sync.js";
+import { gitignoreNames } from "./gitignore.js";
 /** `lstat`, undefined when missing or unreadable (eg, ENOTDIR) */
 export const lstat = (path) => {
     try {
@@ -30,6 +31,15 @@ export const realOr = (p) => {
  */
 export const samePath = (a, b) => norm(realOr(a)) === norm(realOr(b));
 const storeSeg = `${sep}node_modules${sep}.vlt${sep}`;
+// resolved target of a symlink (or junction)
+const linkTarget = (link) => {
+    if (!lstat(link)?.isSymbolicLink())
+        return undefined;
+    let raw = readlinkSync(link);
+    if (raw.startsWith('\\\\?\\'))
+        raw = raw.slice(4);
+    return resolve(dirname(link), raw);
+};
 /**
  * The target of `link` if it is a symlink (or junction) pointing into
  * a `node_modules/.vlt` store, otherwise undefined. Any store, not just
@@ -37,13 +47,20 @@ const storeSeg = `${sep}node_modules${sep}.vlt${sep}`;
  * store after the project is moved or copied.
  */
 export const mountTarget = (link) => {
-    if (!lstat(link)?.isSymbolicLink())
-        return undefined;
-    let raw = readlinkSync(link);
-    if (raw.startsWith('\\\\?\\'))
-        raw = raw.slice(4);
-    const target = resolve(dirname(link), raw);
-    return norm(target).includes(storeSeg) ? target : undefined;
+    const target = linkTarget(link);
+    return target && norm(target).includes(storeSeg) ?
+        target
+        : undefined;
+};
+// the deepest workspace holding `target`
+const workspaceOf = (target, workspaces) => {
+    const t = norm(realOr(target));
+    return workspaces
+        .filter(({ path }) => {
+        const p = norm(path);
+        return t === p || t.startsWith(p + sep);
+    })
+        .sort((a, b) => b.path.length - a.path.length)[0];
 };
 /**
  * The DepID of the last `node_modules/.vlt/<DepID>` segment of a raw
@@ -76,9 +93,11 @@ export const packageKey = (id) => {
     ]);
 };
 /**
- * All vlt links in the given dirs. Anything else is ignored.
+ * All vlt links in the given dirs: links into a `node_modules/.vlt`
+ * store, and links listed in the dir's `.gitignore` block (or `made`)
+ * into a workspace or dangling. Anything else is ignored.
  */
-export const readMounts = (scan) => {
+export const readMounts = (scan, { workspaces = [], made, } = {}) => {
     const mounts = [];
     for (const dir of scan) {
         let entries;
@@ -88,35 +107,42 @@ export const readMounts = (scan) => {
         catch {
             continue;
         }
+        const listed = gitignoreNames(dir.real);
         for (const name of entries) {
             const link = join(dir.real, name);
+            const mount = `${dir.dir}/${name}`;
+            const m = { dir, name, mount, link };
             const target = mountTarget(link);
             if (target) {
-                mounts.push({
-                    dir,
-                    name,
-                    mount: `${dir.dir}/${name}`,
-                    link,
-                    target,
-                    owner: ownerOf(target),
-                });
+                mounts.push({ ...m, target, owner: ownerOf(target) });
+                continue;
             }
+            const wsTarget = (listed.has(name) || made?.has(mount)) && linkTarget(link);
+            if (!wsTarget)
+                continue;
+            if (!existsSync(wsTarget)) {
+                mounts.push({ ...m, target: wsTarget });
+                continue;
+            }
+            const ws = workspaceOf(wsTarget, workspaces);
+            if (ws)
+                mounts.push({ ...m, target: wsTarget, owner: ws.id });
         }
     }
     return mounts.sort((a, b) => a.mount.localeCompare(b.mount, 'en'));
 };
 /**
- * Link a skill at `<dir>/<skill>`. Never touches anything not managed by
- * vlt: returns `'conflict'` instead.
+ * Link a skill at `<dir>/<skill>`. `'unchanged'` if the entry already
+ * is the skill. Never touches anything not managed by vlt (a store
+ * link, or `owned`): returns `'conflict'` instead.
  */
-export const mountSkill = (skill, dir) => {
+export const mountSkill = (skill, dir, owned = false) => {
     const link = join(dir.real, skill.skill);
     if (lstat(link)) {
-        const target = mountTarget(link);
-        if (!target)
-            return 'conflict';
-        if (samePath(target, skill.path))
+        if (samePath(link, skill.path))
             return 'unchanged';
+        if (!owned && !mountTarget(link))
+            return 'conflict';
         unlinkSync(link);
     }
     // junctions need no admin rights, but want an absolute target

package/dist/uninstall.d.ts

@@ -1,3 +1,4 @@
+import type { DepID } from '@vltpkg/dep-id';
 import type { PackageInfoClient } from '@vltpkg/package-info';
 import type { LoadOptions } from './actual/load.ts';
 import type { RemoveImportersDependenciesMap } from './dependencies.ts';
@@ -18,6 +19,8 @@ export type UninstallOptions = LoadOptions & {
      * none
      */
     skillsDirs?: string[];
+    /** store dirs of these nodes are never removed, eg the running vlt */
+    keepNodes?: ReadonlySet<DepID>;
 };
 /**
  * Result of {@link uninstall}.

package/dist/uninstall.js

@@ -68,6 +68,7 @@ export const uninstall = async (options, remove) => {
                     ...options,
                     remove,
                     graph,
+                    modifiers,
                 })
                 : undefined;
             saveImportersPackageJson?.();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.5.0",
-    "@vltpkg/dep-id": "1.5.0",
-    "@vltpkg/dss-breadcrumb": "1.5.0",
-    "@vltpkg/error-cause": "1.5.0",
-    "@vltpkg/fast-split": "1.5.0",
-    "@vltpkg/graph-run": "1.5.0",
-    "@vltpkg/init": "1.5.0",
-    "@vltpkg/output": "1.5.0",
-    "@vltpkg/package-info": "1.5.0",
-    "@vltpkg/package-json": "1.5.0",
-    "@vltpkg/pick-manifest": "1.5.0",
-    "@vltpkg/query": "1.5.0",
-    "@vltpkg/rollback-remove": "1.5.0",
-    "@vltpkg/run": "1.5.0",
-    "@vltpkg/satisfies": "1.5.0",
-    "@vltpkg/security-archive": "1.5.0",
-    "@vltpkg/spec": "1.5.0",
-    "@vltpkg/types": "1.5.0",
-    "@vltpkg/vlt-json": "1.5.0",
-    "@vltpkg/workspaces": "1.5.0",
+    "@vltpkg/cmd-shim": "1.6.1",
+    "@vltpkg/dep-id": "1.6.1",
+    "@vltpkg/dss-breadcrumb": "1.6.1",
+    "@vltpkg/error-cause": "1.6.1",
+    "@vltpkg/fast-split": "1.6.1",
+    "@vltpkg/graph-run": "1.6.1",
+    "@vltpkg/init": "1.6.1",
+    "@vltpkg/output": "1.6.1",
+    "@vltpkg/package-info": "1.6.1",
+    "@vltpkg/package-json": "1.6.1",
+    "@vltpkg/pick-manifest": "1.6.1",
+    "@vltpkg/query": "1.6.1",
+    "@vltpkg/rollback-remove": "1.6.1",
+    "@vltpkg/run": "1.6.1",
+    "@vltpkg/satisfies": "1.6.1",
+    "@vltpkg/security-archive": "1.6.1",
+    "@vltpkg/spec": "1.6.1",
+    "@vltpkg/types": "1.6.1",
+    "@vltpkg/vlt-json": "1.6.1",
+    "@vltpkg/workspaces": "1.6.1",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },