@vzn/vx-lockfile 0.0.636 → 0.0.638

package/src/index.ts

@@ -1,89 +1,133 @@
 // @vzn/vx-lockfile — one plugin per package manager, each keying every
 // task on its project's own resolved dependency closure from the
-// lockfile instead of the whole file.
+// lockfile instead of the whole file, and giving core the project edges
+// the lockfile records (`discover`).
 //
-// Core folds every lockfile at the root into the workspace fingerprint
-// that every task key sees, so one install re-keys the workspace and
-// `--affected` selects every project. Each plugin here CLAIMS its file
-// (`VxPlugin.fingerprint`) through core's `lockfileClaim`: the file leaves
-// the key digest, each task folds one digest per project — what that
-// project can reach through its dependencies, by resolved identity — and
-// `--affected` names the projects whose digest moved. This package is the
+// Core keys no package file: without a plugin here, no lockfile, install
+// setting or `package.json` reaches any key. Each plugin CLAIMS its
+// lockfile (`VxPlugin.fingerprint`) through core's `lockfileClaim`: each
+// task folds one digest per project — what that project can reach through
+// its dependencies, by resolved identity — and `--affected` names the
+// projects whose digest moved. This package is the
 // parsers; the claim, the per-project key (which folds the root
 // importer's digest into every project: the root's tools are on every
-// task's PATH), the memo (one parse per file content), the per-run read
-// and the diff are core's.
+// task's PATH), the memo (one parse per file content, edges included),
+// the per-run read and the diff are core's. The plugin also claims the
+// manager's install settings, folded whole into every task, and adds
+// each importer's `package.json` to its tasks' inputs.
 //
 // Imports core only through the public `@vzn/vx` specifier.
 import { createRequire } from 'node:module'
+import path from 'node:path'
 import {
   refuseUnknownOptions,
   UserError,
-  type PluginCommand,
+  type DiscoveredProject,
+  type LockfileClaimHooks,
+  type LockfileImporter,
   type PluginOptionKinds,
+  type ProjectMeta,
   definePlugin,
   lockfileClaim,
   type VxPlugin,
 } from '@vzn/vx'
 
-// Each parser and `prune` load when first used: every run evaluates
-// `vx.workspace.ts`, and the four parsers and the verb were ~2.5 ms of it
-// for a workspace that declares one manager and runs no `prune`. The
-// digest seam is synchronous, so a parser loads by `require`.
+// Each parser loads when first used: every run evaluates
+// `.vx/workspace.ts`, and the four parsers were ~2.5 ms of it for a
+// workspace that declares one manager. The digest seam is synchronous,
+// so a parser loads by `require`.
 const load = createRequire(import.meta.url)
 const pnpmLock = (): typeof import('./pnpm.js') => load('./pnpm.js')
 const bunLock = (): typeof import('./bun.js') => load('./bun.js')
 const npmLock = (): typeof import('./npm.js') => load('./npm.js')
 const yarnLock = (): typeof import('./yarn.js') => load('./yarn.js')
 
-/** One object for all four plugins, so a workspace declaring two still has one `prune`. */
-const pruneCommand: PluginCommand = {
-  description: 'copy projects and their workspace deps, lockfile pruned, for a Docker build',
-  run: async (argv, ctx) => (await import('./prune.js')).prune(argv, ctx),
-}
-
 export interface LockfileOptions {
   /**
    * `'project'` (default): each task folds its own project's dependency
    * closure — a lockfile change re-keys only the projects it reaches.
-   * `'workspace'`: the whole file, as core folds it — the coarse key,
-   * through the plugin, for a workspace that wants the claim but not yet
-   * the precision (`vx why` names it either way).
+   * `'workspace'`: the whole file into every task — the coarse key, for a
+   * workspace that wants the claim but not yet the precision (`vx why`
+   * names it either way).
    */
   readonly scope?: 'project' | 'workspace'
 }
 
-/** Bumps when a digest folds differently (the memo's identity). */
-const DIGEST_VERSION = 14
+/** Bumps when a digest folds differently or the memo holds more (its identity). */
+const DIGEST_VERSION = 15
 
 interface Manager {
   readonly name: string
-  readonly file: string
+  /** The lockfiles the manager reads, the one it prefers first: it reads the first present. */
+  readonly files: readonly [string, ...string[]]
+  /** A lockfile vx cannot parse, refused when none of `files` is present beside it. */
+  readonly unreadable?: { readonly file: string; readonly fix: string }
   readonly digest: (text: string, files: ReadonlyMap<string, string>) => ReadonlyMap<string, string>
+  readonly importers: (text: string) => ReadonlyMap<string, LockfileImporter>
   readonly extraFiles?: (text: string) => readonly string[]
+  /** Root files no lockfile records that lay the install out: folded whole into every task. */
+  readonly settings: readonly string[]
+  /** The lockfile files a peer under `dependencies`: the manifest says which entries are peers. */
+  readonly peersInManifest?: true
+  /** Warned when the file records no importer at all, which only this format can. */
+  readonly noImporters?: () => string
+}
+
+/**
+ * The last parse, so `digest` and `importers` on one content parse once.
+ * Per manager: the parsers are lazy, and so is this.
+ */
+function lastParse<T>(parse: (text: string) => T): (text: string) => T {
+  let last: { text: string; parsed: T } | undefined
+  return (text) => {
+    if (last?.text !== text) last = { text, parsed: parse(text) }
+    return last.parsed
+  }
 }
 
+const pnpmParse = lastParse((t: string) => pnpmLock().parseLockfile(t))
+const bunParse = lastParse((t: string) => bunLock().parseLockfile(t))
+const npmParse = lastParse((t: string) => npmLock().parseLockfile(t))
+const yarnParse = lastParse((t: string) => yarnLock().parseLockfile(t))
+
 const MANAGERS = {
   pnpm: {
     name: 'pnpm',
-    file: 'pnpm-lock.yaml',
-    digest: (t) => pnpmLock().importerDigests(pnpmLock().parseLockfile(t)),
+    files: ['pnpm-lock.yaml'],
+    digest: (t) => pnpmLock().importerDigests(pnpmParse(t)),
+    importers: (t) => pnpmLock().importerLinks(pnpmParse(t)),
+    settings: ['pnpm-workspace.yaml', '.npmrc'],
+    peersInManifest: true,
   },
   bun: {
     name: 'bun',
-    file: 'bun.lock',
-    digest: (t, files) => bunLock().importerDigests(bunLock().parseLockfile(t), files),
+    files: ['bun.lock'],
+    // Bun's binary lockfile: core folded it whole until it keyed no
+    // package file, and nothing here parses it.
+    unreadable: {
+      file: 'bun.lockb',
+      fix: 'run `bun install --save-text-lockfile` to write bun.lock',
+    },
+    digest: (t, files) => bunLock().importerDigests(bunParse(t), files),
+    importers: (t) => bunLock().importerLinks(bunParse(t)),
     extraFiles: (t) => bunLock().patchFiles(t),
+    settings: ['bunfig.toml', '.npmrc'],
   },
   npm: {
     name: 'npm',
-    file: 'package-lock.json',
-    digest: (t) => npmLock().importerDigests(npmLock().parseLockfile(t)),
+    // npm reads npm-shrinkwrap.json over package-lock.json when both exist.
+    files: ['npm-shrinkwrap.json', 'package-lock.json'],
+    digest: (t) => npmLock().importerDigests(npmParse(t)),
+    importers: (t) => npmLock().importerLinks(npmParse(t)),
+    settings: ['.npmrc'],
   },
   yarn: {
     name: 'yarn',
-    file: 'yarn.lock',
-    digest: (t) => yarnLock().importerDigests(yarnLock().parseLockfile(t)),
+    files: ['yarn.lock'],
+    digest: (t) => yarnLock().importerDigests(yarnParse(t)),
+    importers: (t) => yarnLock().importerLinks(yarnParse(t)),
+    settings: ['.yarnrc.yml'],
+    noImporters: () => `yarn.lock${yarnLock().CLASSIC_EDGES}`,
   },
 } satisfies Record<string, Manager>
 
@@ -96,54 +140,286 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
       `${manager.name}() scope must be 'project' or 'workspace', not ${JSON.stringify(scope)}`,
     )
   }
-  // The parsers name their own file, so prefixing unconditionally said it
-  // twice — "bun.lock: bun.lock: Failed to parse JSONC" (2026-09-20).
-  // Prefix only what does not already name it, and say what fixes it: a
-  // lockfile vx cannot read is an install away from readable, and the
-  // alternative to reading it is a WRONG key, so the run refuses rather
-  // than guessing.
-  const refused = (err: unknown): Error => {
-    const message = err instanceof Error ? err.message : String(err)
-    const named = message.startsWith(`${manager.file}:`) ? message : `${manager.file}: ${message}`
-    return new Error(`${named} — regenerate it with \`${manager.name} install\``)
-  }
   const extraFiles = manager.extraFiles
-  return definePlugin(import.meta, {
-    commands: { prune: pruneCommand },
-    ...lockfileClaim({
-      file: manager.file,
+  const claimOf = (file: string): LockfileClaimHooks => {
+    // The parsers name their own file, so prefixing unconditionally said it
+    // twice — "bun.lock: bun.lock: Failed to parse JSONC" (2026-09-20).
+    // Prefix only what does not already name it, and say what fixes it: a
+    // lockfile vx cannot read is an install away from readable, and the
+    // alternative to reading it is a WRONG key, so the run refuses rather
+    // than guessing.
+    const refused = (err: unknown): Error => {
+      const message = err instanceof Error ? err.message : String(err)
+      const named = message.startsWith(`${file}:`) ? message : `${file}: ${message}`
+      return new Error(`${named} — regenerate it with \`${manager.name} install\``)
+    }
+    const guarded =
+      <A extends unknown[], R>(f: (...args: A) => R) =>
+      (...args: A): R => {
+        try {
+          return f(...args)
+        } catch (err) {
+          throw refused(err)
+        }
+      }
+    return lockfileClaim({
+      file,
       part: manager.name,
       version: DIGEST_VERSION,
       scope,
+      importers: guarded((text: string) => {
+        if (CONFLICT.test(text)) throw new Error(`${file}: holds git merge conflict markers`)
+        return manager.importers(text)
+      }),
       // Read before `digest` on the key path: a malformed bun.lock refused
       // there as a bare "JSONC Parse error", no file named (fuzzed, L-16).
-      ...(extraFiles !== undefined
-        ? {
-            extraFiles: (text: string) => {
-              try {
-                return extraFiles(text)
-              } catch (err) {
-                throw refused(err)
-              }
-            },
-          }
-        : {}),
-      digest: (text, files) => {
-        try {
-          // A conflicted lockfile names two installs at once. Yarn
-          // classic's line parser took the second side without a word, so
-          // the key named an install that may not be the one on disk.
-          if (CONFLICT.test(text))
-            throw new Error(`${manager.file}: holds git merge conflict markers`)
-          return manager.digest(text, files)
-        } catch (err) {
-          throw refused(err)
+      ...(extraFiles !== undefined ? { extraFiles: guarded(extraFiles) } : {}),
+      digest: guarded((text: string, files: ReadonlyMap<string, string>) => {
+        // A conflicted lockfile names two installs at once. Yarn classic's
+        // line parser took the second side without a word, so the key named
+        // an install that may not be the one on disk.
+        if (CONFLICT.test(text)) throw new Error(`${file}: holds git merge conflict markers`)
+        return manager.digest(text, files)
+      }),
+    })
+  }
+  // One part name for every file: `npm shrinkwrap` renames the lockfile,
+  // and the same install keys the same.
+  const claims = manager.files.map((file) => ({ file, claim: claimOf(file) }))
+  const unreadable = manager.unreadable
+  // With no lockfile it reads, a lockfile it cannot: the key would name no
+  // install at all, so the run refuses rather than guessing.
+  const refuseUnreadable = async (workspaceRoot: string): Promise<void> => {
+    if (unreadable === undefined) return
+    if (!(await Bun.file(path.join(workspaceRoot, unreadable.file)).exists())) return
+    throw new UserError(
+      `${unreadable.file}: ${manager.name}() reads ${manager.files.join(' or ')} and finds none — ${unreadable.fix}`,
+    )
+  }
+  const importersOf = async (ctx: {
+    readonly workspaceRoot: string
+    readonly cacheDir: string
+  }): Promise<ReadonlyMap<string, LockfileImporter> | undefined> => {
+    for (const { claim } of claims) {
+      const importers = await claim.importers(ctx)
+      if (importers !== undefined) return importers
+    }
+    await refuseUnreadable(ctx.workspaceRoot)
+    return undefined
+  }
+  // Per run: core hands every `project` visit of one run the same array.
+  const perRun = new WeakMap<
+    readonly ProjectMeta[],
+    Promise<ReadonlyMap<string, LockfileImporter> | undefined>
+  >()
+  const settingsPerRun = new WeakMap<object, Promise<Record<string, string>>>()
+  const refusedPerRun = new WeakMap<object, Promise<void>>()
+  return definePlugin(import.meta, {
+    fingerprint: {
+      files: [...manager.files, ...manager.settings],
+      // A settings file lays out every project's install: every project.
+      affected: (change, ctx) =>
+        claims.find((c) => c.file === change.file)?.claim.fingerprint.affected(change, ctx),
+    },
+    async key(task, ctx) {
+      let settings = settingsPerRun.get(ctx)
+      if (settings === undefined) {
+        settings = readSettings(ctx.workspaceRoot, manager.settings)
+        settingsPerRun.set(ctx, settings)
+      }
+      let deps: Readonly<Record<string, string>> | undefined
+      for (const { claim } of claims) {
+        deps = await claim.key(task, ctx)
+        if (deps !== undefined) break
+      }
+      if (deps === undefined) {
+        let refused = refusedPerRun.get(ctx)
+        if (refused === undefined) {
+          refused = refuseUnreadable(ctx.workspaceRoot)
+          refusedPerRun.set(ctx, refused)
         }
-      },
-    }),
+        await refused
+      }
+      const folded = await settings
+      return deps === undefined && Object.keys(folded).length === 0
+        ? undefined
+        : { ...deps, ...folded }
+    },
+    async discover(ctx) {
+      const importers = await importersOf(ctx)
+      if (importers === undefined) return []
+      if (importers.size === 0 && manager.noImporters !== undefined) ctx.warn(manager.noImporters())
+      const rootIsProject = ctx.projects.some((p) => importerOf(ctx.workspaceRoot, p.dir) === '.')
+      return await discovered(
+        ctx.workspaceRoot,
+        importers,
+        manager.peersInManifest === true,
+        rootIsProject,
+      )
+    },
+    async project(config, ctx) {
+      let importers = perRun.get(ctx.projects)
+      if (importers === undefined) {
+        importers = importersOf(ctx)
+        perRun.set(ctx.projects, importers)
+      }
+      if ((await importers)?.has(importerOf(ctx.workspaceRoot, ctx.dir)) !== true) return
+      const tasks = config.tasks ?? {}
+      for (const [name, task] of Object.entries(tasks)) {
+        const inputs = task.cache?.inputs
+        if (inputs === undefined || inputs.files.includes('package.json')) continue
+        // A copy: a loaded config may be shared or frozen.
+        tasks[name] = {
+          ...task,
+          cache: {
+            ...task.cache!,
+            inputs: { ...inputs, files: [...inputs.files, 'package.json'] },
+          },
+        }
+      }
+    },
   })
 }
 
+/** Each present settings file's content hash, by name. */
+async function readSettings(
+  workspaceRoot: string,
+  files: readonly string[],
+): Promise<Record<string, string>> {
+  const out: Record<string, string> = {}
+  for (const file of files) {
+    let bytes: Uint8Array
+    try {
+      bytes = await Bun.file(path.join(workspaceRoot, file)).bytes()
+    } catch {
+      continue
+    }
+    out[file] = Bun.hash.xxHash3(bytes).toString(16).padStart(16, '0')
+  }
+  return out
+}
+
+/** The lockfile's importer path for a project directory: `.` for the root, POSIX otherwise. */
+function importerOf(workspaceRoot: string, dir: string): string {
+  return path.relative(workspaceRoot, dir).split(path.sep).join('/') || '.'
+}
+
+/** An importer's `package.json`, or null where it has none or it does not parse. */
+async function manifestOf(dir: string): Promise<Record<string, unknown> | null> {
+  try {
+    const pkg: unknown = await Bun.file(path.join(dir, 'package.json')).json()
+    return pkg !== null && typeof pkg === 'object' && !Array.isArray(pkg)
+      ? (pkg as Record<string, unknown>)
+      : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * One entry per importer with a `package.json` (core reads none): a
+ * directory that is no project yet becomes one, the root aside, which is
+ * a project only by its own vx config, as it was a member only by one
+ * (D-39). Its name is the
+ * manifest's `name` when no other importer shares it (core refuses two
+ * projects of one name, so a shared one names neither); its `deps` the
+ * importers it installs, and its peers on importers. A peer orders a build
+ * unless it would close a cycle through the order edges, then it is
+ * `reach` only, in name order so the edge kept is stable.
+ */
+async function discovered(
+  root: string,
+  importers: ReadonlyMap<string, LockfileImporter>,
+  peersInManifest: boolean,
+  rootIsProject: boolean,
+): Promise<DiscoveredProject[]> {
+  const dirOf = (importer: string): string => (importer === '.' ? root : path.join(root, importer))
+  const read = await Promise.all(
+    [...importers.keys()]
+      .filter((i) => i !== '.' || rootIsProject)
+      .map(async (i) => [i, await manifestOf(dirOf(i))] as const),
+  )
+  const manifests = new Map<string, Record<string, unknown>>()
+  for (const [i, pkg] of read) if (pkg !== null) manifests.set(i, pkg)
+  const names = new Map<string, number>()
+  for (const pkg of manifests.values()) {
+    const n = pkg['name']
+    if (typeof n === 'string') names.set(n, (names.get(n) ?? 0) + 1)
+  }
+  const nameOf = (i: string): string | undefined => {
+    const n = manifests.get(i)?.['name']
+    return typeof n === 'string' && n !== '' && names.get(n) === 1 ? n : undefined
+  }
+  // Ordered by the name it will carry, path where it has none.
+  const label = (i: string): string => nameOf(i) ?? i
+  const byLabel = (a: string, b: string): number => {
+    const [x, y] = [label(a), label(b)]
+    return x < y ? -1 : x > y ? 1 : 0
+  }
+  const order = new Map<string, Set<string>>()
+  const peers = new Map<string, Set<string>>()
+  for (const [i, links] of importers) {
+    if (!manifests.has(i)) continue
+    const own = new Set<string>()
+    const peer = new Set<string>()
+    const manifestPeers = peersInManifest ? manifestPeerNames(manifests.get(i)!) : undefined
+    for (const [name, target] of Object.entries(links.deps)) {
+      if (manifests.has(target)) (manifestPeers?.has(name) === true ? peer : own).add(target)
+    }
+    for (const target of Object.values(links.peers)) if (manifests.has(target)) peer.add(target)
+    order.set(i, own)
+    peers.set(i, peer)
+  }
+  const reaches = (start: string, goal: string): boolean => {
+    const seen = new Set([start])
+    const stack = [start]
+    while (stack.length > 0) {
+      for (const next of order.get(stack.pop()!) ?? []) {
+        if (next === goal) return true
+        if (!seen.has(next)) {
+          seen.add(next)
+          stack.push(next)
+        }
+      }
+    }
+    return false
+  }
+  const sorted = [...order.keys()].sort(byLabel)
+  const reach = new Map<string, string[]>()
+  for (const i of sorted) {
+    const own = order.get(i)!
+    const kept: string[] = []
+    for (const peer of [...peers.get(i)!].sort(byLabel)) {
+      if (own.has(peer)) continue
+      if (reaches(peer, i)) kept.push(peer)
+      else own.add(peer)
+    }
+    reach.set(i, kept)
+  }
+  return sorted.map((i) => {
+    const name = nameOf(i)
+    return {
+      dir: dirOf(i),
+      ...(name === undefined ? {} : { name }),
+      deps: [...order.get(i)!].sort(byLabel).map(dirOf),
+      reach: reach.get(i)!.map(dirOf),
+    }
+  })
+}
+
+/** A manifest's peers it installs under no other field. */
+function manifestPeerNames(pkg: Record<string, unknown>): ReadonlySet<string> {
+  const field = (v: unknown): object => (v !== null && typeof v === 'object' ? v : {})
+  const installed = ['dependencies', 'devDependencies', 'optionalDependencies'].map((f) =>
+    field(pkg[f]),
+  )
+  return new Set(
+    Object.keys(field(pkg['peerDependencies'])).filter(
+      (n) => !installed.some((f) => Object.hasOwn(f, n)),
+    ),
+  )
+}
+
 /** Each option `LockfileOptions` names, with its kind: derived from the type, so the two cannot drift. */
 const LOCKFILE_KEYS: PluginOptionKinds<LockfileOptions> = {
   scope: 'string',

package/src/json.ts

@@ -20,28 +20,12 @@ export function depsOf(
   return out
 }
 
-export function record(v: unknown): Json | undefined {
-  return v !== null && typeof v === 'object' && !Array.isArray(v) ? (v as Json) : undefined
+/** The `peerDependencies` names an entry installs under no other field. */
+export function peerOnly(e: Json): ReadonlySet<string> {
+  const installed = depsOf(e, DEP_FIELDS.slice(0, 3))
+  return new Set(Object.keys(record(e['peerDependencies']) ?? {}).filter((n) => !installed.has(n)))
 }
 
-/**
- * The `dropped` names a manifest (or a lockfile's record of one) names
- * ONLY as devDependencies: an entry another field also holds is installed
- * in production and stays.
- */
-export function devOnly(manifest: Json | undefined, dropped: ReadonlySet<string>): Set<string> {
-  const out = new Set<string>()
-  const dev = record(manifest?.['devDependencies'])
-  if (dev === undefined || dropped.size === 0) return out
-  const elsewhere = depsOf(manifest!, ['dependencies', 'optionalDependencies', 'peerDependencies'])
-  for (const name of Object.keys(dev)) if (dropped.has(name) && !elsewhere.has(name)) out.add(name)
-  return out
-}
-
-/** `manifest`'s devDependencies without `names`; the field goes when nothing is left. */
-export function dropDev(manifest: Json | undefined, names: ReadonlySet<string>): void {
-  const dev = record(manifest?.['devDependencies'])
-  if (manifest === undefined || dev === undefined || names.size === 0) return
-  for (const name of names) delete dev[name]
-  if (Object.keys(dev).length === 0) delete manifest['devDependencies']
+export function record(v: unknown): Json | undefined {
+  return v !== null && typeof v === 'object' && !Array.isArray(v) ? (v as Json) : undefined
 }

package/src/npm.ts

@@ -7,9 +7,8 @@
 // at path `p` is `p/node_modules/d` when that key exists, else the nearest
 // ancestor directory's, else `node_modules/d` — Node's own walk.
 
-import { reachDigests } from '@vzn/vx'
-import { depsOf, devOnly, dropDev, record, type Json } from './json.js'
-import type { PruneScope } from './scope.js'
+import { reachDigests, type LockfileImporter } from '@vzn/vx'
+import { depsOf, peerOnly, record } from './json.js'
 
 export interface Lockfile {
   readonly version: number
@@ -26,6 +25,8 @@ export interface Entry {
   /** the path a `link: true` entry points at */
   readonly link: string | undefined
   readonly isWorkspace: boolean
+  /** the peers it installs no entry for */
+  readonly peers: ReadonlySet<string>
 }
 
 export function parseLockfile(text: string): Lockfile {
@@ -59,6 +60,7 @@ export function parseLockfile(text: string): Lockfile {
           : '',
       link,
       isWorkspace: p !== '' && !p.startsWith('node_modules/') && !p.includes('/node_modules/'),
+      peers: peerOnly(e),
     })
   }
   // Root `overrides` are not folded: what an override forced is the entry a
@@ -140,55 +142,28 @@ export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
 }
 
 /**
- * The lockfile cut to the workspaces at `dirs` (`.` the root) and what
- * they reach through Node's walk, each at the path it held; the root
- * entry's `workspaces` becomes `workspaces`, the list the pruned root
- * manifest carries. Version 2's legacy `dependencies` tree is cut to the
- * same paths.
+ * The root's and each workspace's dependencies that resolve, by Node's
+ * walk, to a `link: true` entry pointing at the root or a workspace: an
+ * installed entry is a dep, a peer with none of the same name a peer.
  */
-export function pruneLockfile(text: string, scope: PruneScope): string {
-  const { dirs, members, workspaces, dropped } = scope
-  const lock = parseLockfile(text)
-  const doc = JSON.parse(text) as Json
-  const packages = record(doc['packages'])!
-  // What production struck from each kept workspace's manifest, struck from its entry too.
-  const skip = new Map<string, Set<string>>()
-  for (const p of Object.keys(packages)) {
-    if (!dirs.has(p === '' ? '.' : p)) continue
-    const names = devOnly(record(packages[p]), dropped)
-    skip.set(p, names)
-    dropDev(record(packages[p]), names)
-  }
-  const reached = new Set<string>()
-  const visit = (p: string | undefined): void => {
-    if (p === undefined || reached.has(p)) return
-    const e = lock.packages.get(p)!
-    if (members.has(p) && !dirs.has(p)) {
-      throw new Error(`package-lock.json: ${p} is a workspace the subset leaves out`)
-    }
-    reached.add(p)
-    if (e.link !== undefined) return visit(lock.packages.has(e.link) ? e.link : undefined)
-    const gone = skip.get(p)
-    for (const name of e.deps.keys()) if (gone?.has(name) !== true) visit(resolve(lock, p, name))
-  }
+export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImporter> {
+  const out = new Map<string, LockfileImporter>()
   for (const [p, e] of lock.packages) {
-    const linked = e.link !== undefined && dirs.has(e.link)
-    if (linked || dirs.has(p === '' ? '.' : p)) visit(p)
-  }
-  for (const p of Object.keys(packages)) if (!reached.has(p)) delete packages[p]
-  const rootEntry = record(packages[''])
-  if (rootEntry?.['workspaces'] !== undefined) rootEntry['workspaces'] = [...workspaces]
-  const prune = (tree: unknown, base: string): void => {
-    const deps = record(tree)
-    if (deps === undefined) return
-    for (const [name, sub] of Object.entries(deps)) {
-      const p = `${base}node_modules/${name}`
-      if (!reached.has(p)) delete deps[name]
-      else prune(record(sub)?.['dependencies'], `${p}/`)
+    if (p !== '' && !e.isWorkspace) continue
+    const dir = p === '' ? '.' : p
+    const links = { deps: {} as Record<string, string>, peers: {} as Record<string, string> }
+    for (const name of e.deps.keys()) {
+      const key = resolve(lock, p, name)
+      const link = key === undefined ? undefined : lock.packages.get(key)!.link
+      if (link === undefined) continue
+      const target = lock.packages.get(link)
+      if (target === undefined || (link !== '' && !target.isWorkspace)) continue
+      const targetDir = link === '' ? '.' : link
+      if (targetDir !== dir) links[e.peers.has(name) ? 'peers' : 'deps'][name] = targetDir
     }
+    out.set(dir, links)
   }
-  prune(doc['dependencies'], '')
-  return `${JSON.stringify(doc, null, 2)}\n`
+  return out
 }
 
 /** `node_modules/a/node_modules/@s/b` → `@s/b`. */