@vzn/vx-lockfile 0.0.651 → 0.0.653

package/README.md

@@ -2,7 +2,7 @@
 
 Website: <https://vznjs.github.io/vx/> · this plugin: <https://vznjs.github.io/vx/plugins/vx-lockfile/> · source: <https://github.com/vznjs/vx>
 
-Lockfile plugins for [`@vzn/vx`](https://vznjs.github.io/vx/): `bun()`, `pnpm()`, `npm()` and `yarn()`. Each keys every task on its **own project's resolved dependency closure** from the package manager's lockfile, not on the whole file. `pnpm update foo` (or `bun add`, `npm install`, `yarn up`) re-keys exactly the projects that reach `foo` — through their dependencies, transitively, and through workspace links — and `vx run … --affected` selects the same projects. Each also gives vx the **projects, names and edges the lockfile records** (`discover`), adds each package's `package.json` to its cached tasks' inputs, and hashes the manager's install settings into every task. Zero dependencies: Bun's own YAML and JSONC parsers, and yarn's own readers (classic, and berry's, which reads every value as its text: an unquoted range `0.10` is not the number `0.1`).
+Lockfile plugins for [`@vzn/vx`](https://vznjs.github.io/vx/): `bun()`, `pnpm()`, `npm()` and `yarn()`. Each keys every task on its **own project's resolved dependency closure** from the package manager's lockfile, not on the whole file. `pnpm update foo` (or `bun add`, `npm install`, `yarn up`) re-keys exactly the projects that reach `foo` — through their dependencies, transitively, and through workspace links — and `vx run … --affected` selects the same projects. Each also gives vx the **projects, names and edges the lockfile records** (`discover`), adds each package's manifest (`package.json`; under `pnpm()` a `package.json5` or `package.yaml` where it has none, as pnpm reads them) to its cached tasks' inputs, and hashes the manager's install settings into every task. Zero dependencies: Bun's own YAML and JSONC parsers, and yarn's own readers (classic, and berry's, which reads every value as its text: an unquoted range `0.10` is not the number `0.1`).
 
 Core keys no package file: without a plugin no lockfile, install setting or `package.json` reaches any cache key, so an install re-keys nothing and a build made against the old `node_modules` replays. A JS workspace declares one.
 
@@ -32,9 +32,9 @@ With no lockfile at the workspace root (before the first install), it warns and
 
 ## What a project's digest covers
 
-Every package the project can reach, by resolved identity (name, version, integrity), and under bun and npm by the name it installs under, not where it sits, so a re-hoist of one version re-keys nothing, plus the install-wide material every project hashes — and **the root package's own closure**. The root's `dependencies` and `devDependencies` reach every task: their bins run from the root `node_modules/.bin`, which vx puts on every task's PATH, and Node's resolution walks up to the root `node_modules` (`@types/*`, a plugin a root tool's config names). So a root devDependency bump (`pnpm add -Dw oxlint@next`) re-keys every project and `--affected` selects every project; a package only project A reaches still moves only A. A root `workspace:` dependency hashes that package's closure into every project too. Per manager:
+Every package the project can reach, by resolved identity (name, version, integrity), and under bun and npm by the name it installs under, not where it sits, so a re-hoist of one version re-keys nothing, plus the install-wide material every project hashes — and **the root package's own closure**. The root's `dependencies` and `devDependencies` reach every task: their bins run from the root `node_modules/.bin`, which vx puts on every task's PATH, and Node's resolution walks up to the root `node_modules` (`@types/*`, a plugin a root tool's config names). So a root devDependency bump (`pnpm add -Dw oxlint@next`) re-keys every project and `--affected` selects every project; a package only project A reaches still moves only A. A root `workspace:` dependency hashes that package's closure into every project too. Which field the root's and each workspace's dependency sits in (`dependencies`, `devDependencies`, `optionalDependencies`) is in its digest as well: an install that leaves dev or optional packages out (npm `omit=dev`, `pnpm install --prod`, `bun install --production`) lays `node_modules` out by it, so moving a root dependency to `devDependencies` re-keys every project and `--affected` selects them: a build that would now fail "Cannot find module" does not replay its old success. yarn.lock records no field, so `yarn()` reads the root `package.json`'s (below). Per manager:
 
-- **pnpm** (`pnpm-lock.yaml`, lockfile v5, v6, v9): importers → snapshots, transitively, each dependency by the name it is installed under as well as what it resolves to (two aliases swapping targets re-key); each package by name, version **and resolved peers** (`foo@1(react@18)` is not `foo@1(react@19)`), resolution and the `patchedDependencies` entry pnpm applies to it (keyed `name@version`, a version range such as `name@<=7.0.0`, or `name`, in that precedence); `link:` hashes the linked importer's reach, or the CONTENT of a linked directory that is no importer (an importer's or, under an override, a package's), and a `file:` directory dependency hashes its own closure (v9 keys it `name@file:…`, v5/v6 by the bare `file:…`) and the CONTENT of the directory (pnpm copies it at install and records only its path; its `node_modules` and `.git` aside), so an edit in it re-keys the projects reaching it; every other top-level field but `overrides` and the catalogs, whose effect is the snapshot an importer reaches (`settings`, `packageExtensionsChecksum`, `pnpmfileChecksum`, `ignoredOptionalDependencies`, v6's `onlyBuiltDependencies`, and any field pnpm adds later) and the lockfile version into every project. A multi-document lockfile (pnpm 10.x and 11 write the env lockfile — `configDependencies`, the package manager's own install — ahead of the project's) reads its last document as the lockfile and hashes the ones before it into every project. A CRLF file (a Windows checkout) reads as its LF form, `settings` and `ignoredOptionalDependencies` included.
+- **pnpm** (`pnpm-lock.yaml`, lockfile v5, v6, v9): importers → snapshots, transitively, each dependency by the name it is installed under as well as what it resolves to (two aliases swapping targets re-key); each package by name, version **and resolved peers** (`foo@1(react@18)` is not `foo@1(react@19)`), resolution and the `patchedDependencies` entry pnpm applies to it (keyed `name@version`, a version range such as `name@<=7.0.0`, or `name`, in that precedence); `link:` hashes the linked importer's reach, or the CONTENT of a linked directory that is no importer (an importer's or, under an override, a package's), and a `file:` directory dependency hashes its own closure (v9 keys it `name@file:…`, v5/v6 by the bare `file:…`) and the CONTENT of the directory (pnpm copies it at install and records only its path; its `node_modules` and `.git` aside), so an edit in it re-keys the projects reaching it, unless the directory is an importer's (an injected workspace package is an edge, below, so its build output re-keys nothing); every other top-level field but `overrides` and the catalogs, whose effect is the snapshot an importer reaches (`settings`, `packageExtensionsChecksum`, `pnpmfileChecksum`, `ignoredOptionalDependencies`, v6's `onlyBuiltDependencies`, and any field pnpm adds later) and the lockfile version into every project. A multi-document lockfile (pnpm 10.x and 11 write the env lockfile — `configDependencies`, the package manager's own install — ahead of the project's) reads its last document as the lockfile and hashes the ones before it into every project. A CRLF file (a Windows checkout) reads as its LF form, `settings` and `ignoredOptionalDependencies` included.
 - **bun** (`bun.lock`; a `bun.lockb` alone is refused — it is binary — naming `bun install --save-text-lockfile`, which writes `bun.lock`): Bun's hoisted layout — a dependency `d` of the package at path `p` is `p/d` when that key exists, else the nearest ancestor's, else the root's, so a nested version counts for the package it is nested under and no other, and a workspace resolves from its own name, or from `./<name>` when a root package holds that name (Bun nests that workspace's own dependencies there); `workspace:` entries, the root package's `name@root:` and a `link:` to a workspace's directory (`b@link:./packages/b`, which symlinks the workspace) hash the linked package's reach and are its project edge; each `patchedDependencies` entry and the CONTENT of its patch file (bun.lock records only its path) with the package it patches, so a patch edit re-keys only the projects reaching it; a `file:` directory dependency, and a `link:` to a directory that is no workspace, with the CONTENT of the directory (Bun copies the first and links the second, recording only the path), as under pnpm; every top-level field but `workspaces`, `packages`, the catalogs, `overrides` and `patchedDependencies` (`trustedDependencies`, and any field Bun adds later, keys sorted so the order Bun writes them in moves nothing), and any patch naming no entry, into every project — a catalog bump reaches only the projects whose `catalog:` dependency resolves anew, through the `packages` entry it installs.
 - **npm** (`npm-shrinkwrap.json` when present, as npm reads it, else `package-lock.json`; lockfileVersion 2 and 3): the `packages` map — `p/node_modules/d`, then each ancestor directory's (a workspace nested in another's directory resolves through the outer one's `node_modules`, as Node does), then `node_modules/d`; a `link: true` entry hashes its target workspace's reach, and one to a `file:` directory (an entry outside the root's `workspaces` globs, `!` exclusions honoured, or any entry outside `node_modules` when the root names none) the CONTENT of the directory, as under pnpm, since npm links it, and so does an entry npm copied from one (`install-links=true`: `resolved: "file:…"` with no integrity); root `overrides` reach a project through the entries they force (npm 10 does not write them to the lockfile); the root's and a workspace's own `version` is its package.json's, not an install, and is not in the key. Version 1 (npm 6) has no `packages` map and is refused, as is a later version whose packages are only in the legacy `dependencies` tree.
 - **yarn** (`yarn.lock`): berry (yarn 2+) resolves `name@npm:range` descriptors to entries, workspaces included, each entry hashing every field, its dependency lists included (so the root workspace's `dependenciesMeta` reaches every project, and two aliases swapping targets re-key), `__metadata`'s `version` and `cacheKey` into every project. A Yarn 4 catalog dependency (`catalog:`, `catalog:<name>`) is recorded as that literal and its range lives in `.yarnrc.yml`, so it reaches every entry of its package: a bump of any of them re-keys the workspace. So does a descriptor the file does not key, as when a root `resolutions` override rewrote it to another range: the entry installed in its place is reached through the package's name, so changing it re-keys the workspaces that depend on it. A path range (`portal:`, `file:`, `link:`) reaches the entry keyed bound to the package naming it (`::locator=…`), not another workspace's of the same name; a `portal:` or `link:` to a workspace reaches that workspace's closure, as `workspace:` does (Yarn symlinks the workspace itself, and its entry lists no dependencies); a `portal:` or `link:` to a directory that is no workspace also hashes the CONTENT of the directory (Yarn symlinks it and records no hash; berry's `file:` carries its own `::hash=`). Every `patch:` entry is reached by the plain descriptor it patches: Yarn's builtin compat patches (`resolve`, `typescript`, `fsevents`), in Yarn 2/3's spelling (`resolve@^1.22.0`) as in Yarn 4's (`resolve@npm%3A^1.22.0`), and a root `resolutions` patch over a descriptor the file still keys (what `yarn patch-commit -s` writes). The workspace asks for the plain descriptor, and the patched entry is the one Yarn installs, so adding or editing the patch re-keys it. A `packageExtensions` dependency (`.yarnrc.yml`'s, and Yarn's builtin `@babel/parser` → `@babel/types`) is installed for each matching package that does not declare it, yet its lockfile entry lists none: `yarn()` adds the edge, so a lockfile-only bump of the added package re-keys the packages that reach the extended one, and an entry no workspace reaches (an extension it cannot read) re-keys every project. `yarn()` owns `.yarnrc.yml` and hashes it into every task, so a catalog edit re-keys every project (pnpm-lock.yaml records a catalog's resolution, so under `pnpm()` it re-keys only the projects naming it). Classic (yarn 1) records no workspaces, so it yields one digest for the root that every project hashes — coarse, and honest about what the file records — and no project edges (below); a `file:` directory, which classic copies with no hash, and a `link:` one, which it symlinks, hash their CONTENT into that digest, but a `link:` to a workspace the root `workspaces` globs name (a `!` glob aside: Yarn 1 takes none and links the directory anyway): Yarn 1 links that workspace as it does by its name.
@@ -43,28 +43,30 @@ A `file:` or `link:` directory outside the repository (`"dep": "link:../../../ve
 
 A project the lockfile has no entry for hashes the digest of the nearest package that encloses it, with the root's (`packages/a/e2e` resolves from `packages/a/node_modules` first), or the root's alone outside every package — the only `node_modules` it can resolve from. A phantom dependency (imported, never declared by the project or the root — a sibling's package hoisted to the root) is not in any closure; declare it.
 
-A lockfile the parser cannot read **refuses the run**, naming the file, the reason and the install that regenerates it. That is deliberate: the alternative to reading the lockfile is keying on nothing, and a key that is missing material is a stale hit waiting to happen. Under `--affected` the refusal also says which side could not be read — the working tree's copy, or the one at the base ref (a lockfile-migration commit hits the second). A lockfile holding git merge conflict markers is refused the same way: it names two installs at once, and yarn classic's format parsed one side of it without a word.
+A lockfile the parser cannot read **refuses the run**, naming the file, the reason and the install that regenerates it. That is deliberate: the alternative to reading the lockfile is keying on nothing, and a key that is missing material is a stale hit waiting to happen. Under `--affected` the refusal also says which side could not be read — the working tree's copy, or the one at the base ref (a lockfile-migration commit hits the second). A lockfile holding git merge conflict markers is refused the same way: it names two installs at once, and yarn classic's format parsed one side of it without a word. So is a `pnpm-lock.yaml` whose importer or package names a dependency it has no entry for (`snapshots` in v9, `packages` in v5/v6; a `link:` needs none), as pnpm refuses it ("Broken lockfile"): read as a leaf, that package's own dependencies were in no key.
 
 ## Install settings
 
 Files no lockfile records lay `node_modules` out anew under a byte-identical lockfile (pnpm's `node-linker`, bun's `linker = "isolated"`, a registry in `.npmrc`, Yarn 4's catalogs). Each plugin owns its manager's and hashes each present file whole into every task; a change to one selects every project under `--affected`:
 
-| Plugin   | Settings                                                                                                                          |
-| -------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| `pnpm()` | `pnpm-workspace.yaml`, `.npmrc`, the root `package.json`'s `pnpm` field                                                           |
-| `bun()`  | `bunfig.toml`, `.npmrc`                                                                                                           |
-| `npm()`  | `.npmrc`                                                                                                                          |
-| `yarn()` | `.yarnrc.yml`, `.yarnrc` and `.npmrc` (yarn 1), the root `package.json`'s `workspaces.nohoist`, `installConfig` and `resolutions` |
+| Plugin   | Settings                                                                                                                                                                                     |
+| -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pnpm()` | `pnpm-workspace.yaml`, `.npmrc`, the root manifest's `pnpm` field (`package.json`, `package.json5` or `package.yaml`)                                                                        |
+| `bun()`  | `bunfig.toml`, `.npmrc`                                                                                                                                                                      |
+| `npm()`  | `.npmrc`                                                                                                                                                                                     |
+| `yarn()` | `.yarnrc.yml`, `.yarnrc` and `.npmrc` (yarn 1), the root `package.json`'s `workspaces.nohoist`, `installConfig`, `resolutions`, `dependencies`, `devDependencies` and `optionalDependencies` |
 
-`pnpm()` hashes `pnpm-workspace.yaml` without `patchedDependencies`, `overrides`, `catalog` and `catalogs`, which pnpm 10+ keeps there: the lockfile records what each one did, per project, so a patch, an override or a catalog bump re-keys only the projects that reach the package it changes, and `--affected` selects them through the lockfile. Any other setting in the file re-keys every project, and a file that does not parse is hashed whole. The root `package.json` adds only its `pnpm` field (`onlyBuiltDependencies` and the rest pnpm reads there and the lockfile does not record), its `overrides` and `patchedDependencies` aside: a root dependency edit is the lockfile's.
+`pnpm()` hashes `pnpm-workspace.yaml` without `patchedDependencies`, `overrides`, `catalog` and `catalogs`, which pnpm 10+ keeps there: the lockfile records what each one did, per project, so a patch, an override or a catalog bump re-keys only the projects that reach the package it changes, and `--affected` selects them through the lockfile. Any other setting in the file re-keys every project, and a file that does not parse is hashed whole. The root manifest (`package.json`, `package.json5` or `package.yaml`) adds only its `pnpm` field (`onlyBuiltDependencies` and the rest pnpm reads there and the lockfile does not record), its `overrides` and `patchedDependencies` aside: a root dependency edit is the lockfile's.
 
 `yarn()` reads the root `package.json`'s `resolutions` because yarn.lock does not record where one applies: a parent-scoped one (`"is-odd/is-number"`) leaves the parent's entry on the range it declares, so adding one whose range another package already keys changes the install under a byte-identical yarn.lock. Berry's overrides also become edges: each entry a `resolutions` key reaches (any entry depending on the name, or only the named parent's for a scoped one; a parent's range or a `**` counts as any parent) gets an edge to the entry the override's range names, so a lockfile-only bump of that entry (`yarn up -R is-number`) re-keys the parent's workspaces too, not only the package that keys the range itself. An unreadable scope over-keys, never under-keys.
 
+It reads the root's `dependencies`, `devDependencies` and `optionalDependencies` because yarn 1's lockfile records no importer, only the ranges asked: moving a range between the root and a workspace (root `is-number` `^6` → `^7`, `packages/a` `^7` → `^6`) leaves yarn.lock byte-identical and moves the root `node_modules` copy every project without its own resolves. Any change to them re-keys every project and selects every project under `--affected`; berry records them on the root workspace's entry, which every project's digest already includes.
+
 A file has one owner, so two of these plugins that share a settings file (`pnpm()` and `bun()` both own `.npmrc`) cannot be declared together.
 
-## `package.json` as an input
+## The manifest as an input
 
-Every task with `inputs` of a project the lockfile lists, cached or not, gets its literal `package.json` appended to `inputs.files` (the `project` stage), so an edit to a manifest re-keys that project's tasks and, through `^` keys, its dependants. A task with no `inputs` stays keyless; one whose inputs already name `package.json` is left alone. A task that rewrites its own `package.json` with the same bytes (tsdown) keeps its hits under `inputStability: { strategy: 'mutable' }`.
+Every task with `inputs` of a project the lockfile lists, cached or not, gets its literal manifest appended to `inputs.files` (the `project` stage), so an edit to a manifest re-keys that project's tasks and, through `^` keys, its dependants. The manifest is `package.json`; under `pnpm()` it is `package.json5` or `package.yaml` where the package has no `package.json`, as pnpm reads them (one stat per project a run). A task with no `inputs` stays keyless; one whose inputs already name its manifest is left alone. A task that rewrites its own `package.json` with the same bytes (tsdown) keeps its hits under `inputs.stability: { strategy: 'mutable' }`.
 
 ## Project edges
 
@@ -72,13 +74,14 @@ Every task with `inputs` of a project the lockfile lists, cached or not, gets it
 
 - **deps** (order `^task`, reach `--filter …` and `--affected`): a dependency the lockfile resolves to a workspace package — pnpm `link:` (under `excludeLinksFromLockfile`, which leaves every `link:` dependency out of the file, a `package.json` `link:` to a workspace package; the file then no longer says who links whom, so every project's key holds every importer's reach, and a `link:` it leaves out is no stale lockfile), and `file:` to a workspace package's directory (an injected one: `dependenciesMeta.<name>.injected`, or `injectWorkspacePackages` with `dedupeInjectedDeps: false`; pnpm hard-links that copy and re-syncs it after the package's scripts, so it waits for the package's build), bun's `workspace:` entries (a `workspace:` path or alias, and an `npm:` alias Bun links to the workspace package, by the spec it records) and `link:` entries to a workspace's directory, npm's `link: true` entries, yarn berry's workspace entries and `link:` / `portal:` paths.
 - **peers**: a peer with no installed entry of the same name that resolves to a workspace package orders the build too, unless it would close a cycle through the order edges; then it is reach only (in project-name order, so the edge kept is stable). pnpm records an auto-installed peer under `dependencies`, so `pnpm()` asks the project's `package.json` which of those entries are peers; yarn berry resolves a peer to the workspace of its name, which Yarn hoists.
+- **workspace packages installed through a package**: a registry package's dependency the install resolved to a workspace package (npm and bun link `node_modules/is-number` to `packages/b` when the workspace satisfies `is-odd`'s range, Yarn's transparent workspaces do the same, a pnpm `overrides` to `workspace:*` writes `link:` into the package's snapshot). The project loads that workspace package as surely as its own dependency, so it builds after it and its key holds that package's, as a peer's would: unless that would close a cycle through the order edges, then it is reach only. Read from each project's own dependencies alone, an edit to such a package re-keyed only that package, `--affected` left out the projects reaching it, and they hit with its old build. Under yarn, only descriptors the file keys count, as for a direct link.
 - **the root's workspace packages**: a workspace package the root depends on is installed at the root `node_modules`, so every project resolves it whatever its own `package.json` declares. Every other project builds after it and its key holds that package's, as a peer's would: unless that would close a cycle through the order edges (the package's own dependencies reaching it), then it is reach only. Without it, an edit to such a package re-keyed only that package, `--affected` left out the projects that load it through the root, and they hit with its old build. Turbo makes these dependencies of every package too (#8364, #8465).
-- Each importer with a `package.json` is a project: one with no vx config joins as a project a plugin added (its tasks come from the `project` stage, else the default `build`). The root importer is the exception: it is a project only by its own vx config. An importer with no `package.json`, and an edge to one, is skipped. A project is named by its `package.json` `name` unless its config names it, or another importer's `package.json` shares the name; then its path names it.
+- Each importer with a manifest (`package.json`, or under `pnpm()` a `package.json5` or `package.yaml`, which pnpm reads and records like any other) is a project: one with no vx config joins as a project a plugin added (its tasks come from the `project` stage, else the default `build`). The root importer is the exception: it is a project only by its own vx config. An importer with no manifest, and an edge to one, is skipped. A project is named by its manifest's `name` unless its config names it, or another importer's manifest shares the name; then its path names it. The workspace globs match a directory holding any of the manifests the manager reads.
 - A yarn classic (v1) lockfile records no workspaces, so `yarn()` reads them as Yarn 1 does: the directories the root `package.json` `workspaces` globs (an array or `{ packages }`) name. A dependency on a workspace's name is a link unless the lockfile keys its descriptor, which Yarn 1 writes only for the registry copy it fetched because the workspace's version missed the range. A `link:` to a workspace's directory is a link whatever name it is under. A root `resolutions` entry that names the package everywhere (`ms`, `**/ms`) replaces the range first, as Yarn 1 does.
 - A lockfile older than the manifests **refuses `vx lock`**, naming the install that refreshes it: a workspace the globs name (the root `package.json` `workspaces`, or `pnpm-workspace.yaml` under `pnpm()`, `!` exclusions honoured as the manager reads them, a trailing `**` matching zero directories: `!**/fixtures/**` leaves out `packages/fixtures`) that the file lists no importer for, such as a renamed folder, or a `dependencies`, `devDependencies` or `optionalDependencies` entry naming a workspace package that the file does not record for that importer (not one pnpm leaves out by design: an optional dependency its `ignoredOptionalDependencies` names). Either would lose edges: the package would build beside what it depends on and hit with old content. Yarn classic is exempt: its edges come from the manifests. Under `bun()` a `package.json` with no `name` (build output's `{"type":"module"}`) is no workspace, as Bun leaves it out of `bun.lock`.
 - `pnpm()` reads the root `pnpm-lock.yaml` only. With `shared-workspace-lockfile` false (`sharedWorkspaceLockfile: false` in `pnpm-workspace.yaml`, which pnpm 10.8+ reads first, or `.npmrc`), pnpm writes a lockfile per package and the root's lists none of them, so `vx lock` refuses naming the setting: an install would not fix it.
 
-A workspace `package.json` that does not parse (git merge conflict markers, a syntax error, or JSON that is not an object) **refuses `vx lock`**, naming it, under every manager: read as no manifest, it lost its dependencies and its dependents hit with old bytes. Turbo and Nx refuse it too. `bun()` reads a manifest as Bun does, so a trailing comma or a comment is no syntax error there; npm, pnpm and yarn refuse both, and so do their plugins.
+A workspace manifest that does not parse (git merge conflict markers, a syntax error, or JSON, JSON5 or YAML that is not an object) **refuses `vx lock`**, naming it, under every manager, and so does a directory holding two (a `package.json` and a `package.yaml`: pnpm 10.28 lists the package by one and installs the other's dependencies): read as no manifest, it lost its dependencies and its dependents hit with old bytes. Turbo and Nx refuse it too. `bun()` reads a manifest as Bun does, so a trailing comma or a comment is no syntax error there; npm, pnpm and yarn refuse both, and so do their plugins.
 
 These edges are what was installed, so they differ from a guess over manifest ranges where the manager decided otherwise: pnpm installs a plain range (`^2.0.0`, `*`, `catalog:`) from the registry unless it is `workspace:`, yarn packs a `file:` directory as a copy (no edge: Yarn neither links nor re-syncs it), bun installs `dependencies` over a devDependency of the same key. They are the only package edges vx has: core reads none from a `package.json`, so a workspace whose tasks use `^build` declares one of these plugins (or another that returns `deps`), and without one vx refuses the `^` naming the fix. A dependency an install adds or removes reaches `--affected` as this lockfile's change.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-lockfile",
-  "version": "0.0.651",
+  "version": "0.0.653",
   "license": "MIT",
   "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer.",
   "keywords": [
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.651"
+    "@vzn/vx": "^0.0.653"
   },
   "repository": {
     "type": "git",

package/src/bun.ts

@@ -11,13 +11,20 @@
 // Bun.JSONC is the parser: no dependency, and the file is Bun's own.
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
-import { depsOf, peerOnly, record, stable, type Json } from './json.js'
+import { reachedImporters, withTransitive } from './graph.js'
+import { depsOf, peerOnly, record, sectionsOf, stable, type Json } from './json.js'
 import { joinPosix, resolvePosix } from './posix.js'
 
+// The graph the digest built from this parse, for `importerLinks`: `vx
+// lock` asks for both, and the edges do not depend on `files`.
+const built = new WeakMap<Lockfile, ReturnType<typeof buildGraph>>()
+
 export interface Lockfile {
   readonly version: string
   /** root-relative dir (`.` for the root) → dependency name → specifier */
   readonly workspaces: ReadonlyMap<string, ReadonlyMap<string, string>>
+  /** root-relative dir → which field each dependency sits in (`sectionsOf`) */
+  readonly workspaceSections: ReadonlyMap<string, string>
   /** workspace package name → its dir */
   readonly workspaceDirs: ReadonlyMap<string, string>
   /** root-relative dir → its installed dependencies (`dependencies` win, as Bun 1.4 installs them) */
@@ -67,6 +74,7 @@ export function parseLockfile(text: string): Lockfile {
     throw new Error('bun.lock: not a Bun text lockfile (no lockfileVersion)')
   }
   const workspaces = new Map<string, ReadonlyMap<string, string>>()
+  const workspaceSections = new Map<string, string>()
   const workspaceDirs = new Map<string, string>()
   const workspaceInstalled = new Map<string, ReadonlyMap<string, string>>()
   const workspacePeers = new Map<string, ReadonlySet<string>>()
@@ -74,6 +82,7 @@ export function parseLockfile(text: string): Lockfile {
     const m = record(manifest) ?? {}
     const key = dir === '' ? '.' : dir
     workspaces.set(key, depsOf(m))
+    workspaceSections.set(key, sectionsOf(m))
     workspaceInstalled.set(
       key,
       depsOf(m, ['devDependencies', 'optionalDependencies', 'dependencies']),
@@ -108,6 +117,7 @@ export function parseLockfile(text: string): Lockfile {
   return {
     version: String(d['lockfileVersion']),
     workspaces,
+    workspaceSections,
     workspaceDirs,
     workspaceInstalled,
     workspacePeers,
@@ -155,10 +165,19 @@ function packageLevels(path: string): string[] {
  * its target, which Bun links though `packages` holds no nested entry for
  * it, and so does an `npm:` alias no entry installs under its own name (a
  * satisfied one: Bun links the workspace package); anything else resolves
- * through Bun's layout.
+ * through Bun's layout. A workspace a package it installs resolves to is
+ * `transitive`.
  */
 export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImporter> {
   const out = new Map<string, LockfileImporter>()
+  const g = built.get(lock) ?? buildGraph(lock, new Map())
+  const nodes = new Map<number, string>()
+  for (const [dir, i] of g.importers) nodes.set(i, dir)
+  for (const [p, e] of lock.packages) {
+    const dir = workspaceOf(lock, e.id)
+    if (dir !== undefined && g.importers.has(dir)) nodes.set(g.index.get(p)!, dir)
+  }
+  const reached = reachedImporters(g.edges, nodes)
   const viaLayout = (from: string, name: string): string | undefined => {
     const key = resolve(lock, from, name)
     return key === undefined ? undefined : workspaceOf(lock, lock.packages.get(key)!.id)
@@ -175,7 +194,7 @@ export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImpor
       add('deps', name, workspaceSpecTarget(lock, dir, from, name, spec) ?? viaLayout(from, name))
     }
     for (const name of lock.workspacePeers.get(dir)!) add('peers', name, viaLayout(from, name))
-    out.set(dir, links)
+    out.set(dir, withTransitive(links, reached.get(dir)))
   }
   return out
 }
@@ -293,6 +312,33 @@ export function importerDigests(
   lock: Lockfile,
   files: ReadonlyMap<string, string> = new Map(),
 ): ReadonlyMap<string, string> {
+  const g = buildGraph(lock, files)
+  built.set(lock, g)
+  const { material, edges, importers, loose } = g
+  const digests = reachDigests({ material, edges })
+  const out = new Map<string, string>()
+  // The global digest rides as DATA: Bun's xxHash3 reads only the low 32
+  // bits of a seed, so two lockfiles' globals could share one (item 682).
+  const globalMaterial =
+    loose.length === 0 ? lock.global : `${lock.global}\0${JSON.stringify(loose)}`
+  const global = Bun.hash.xxHash3(globalMaterial).toString(16).padStart(16, '0')
+  for (const [dir, i] of importers) {
+    out.set(dir, Bun.hash.xxHash3(`${global}\0${digests[i]!}`).toString(16).padStart(16, '0'))
+  }
+  return out
+}
+
+/** The lockfile as one graph, each importer's node by dir, and the patches naming no entry. */
+function buildGraph(
+  lock: Lockfile,
+  files: ReadonlyMap<string, string>,
+): {
+  index: Map<string, number>
+  material: string[]
+  edges: number[][]
+  importers: Map<string, number>
+  loose: [string, string, string][]
+} {
   const index = new Map<string, number>()
   const material: string[] = []
   const edges: number[][] = []
@@ -342,7 +388,10 @@ export function importerDigests(
   const importers = new Map<string, number>()
   for (const [dir, deps] of lock.workspaces) {
     // Its dir, as pnpm's importers fold theirs (item 1073).
-    const own = node(`workspace\0${dir}`, `workspace\0${dir}`)
+    const own = node(
+      `workspace\0${dir}`,
+      `workspace\0${dir}\nsections\0${lock.workspaceSections.get(dir)}`,
+    )
     importers.set(dir, own)
     const from = importerFrom(lock, dir)
     for (const [name, spec] of deps) {
@@ -359,17 +408,7 @@ export function importerDigests(
     const target = dir === undefined ? undefined : importers.get(dir)
     if (target !== undefined) edges[index.get(p)!]!.push(target)
   }
-  const digests = reachDigests({ material, edges })
-  const out = new Map<string, string>()
-  // The global digest rides as DATA: Bun's xxHash3 reads only the low 32
-  // bits of a seed, so two lockfiles' globals could share one (item 682).
-  const globalMaterial =
-    loose.length === 0 ? lock.global : `${lock.global}\0${JSON.stringify(loose)}`
-  const global = Bun.hash.xxHash3(globalMaterial).toString(16).padStart(16, '0')
-  for (const [dir, i] of importers) {
-    out.set(dir, Bun.hash.xxHash3(`${global}\0${digests[i]!}`).toString(16).padStart(16, '0'))
-  }
-  return out
+  return { index, material, edges, importers, loose }
 }
 
 /** The name a package key installs under: its last segment, scope included. */

package/src/graph.ts

@@ -0,0 +1,73 @@
+// The importers each importer reaches through installed packages, from the
+// graph its digest folds: a registry package's dependency the install
+// resolved to a workspace package (npm and bun link it when the workspace
+// satisfies the range, Yarn's transparent workspaces, a pnpm override to
+// `workspace:`). Read from each importer's own dependencies alone, such a
+// workspace was no edge, so the dependent's key folded none of its task's
+// key, and an edit to it replayed the dependent's old output.
+
+/**
+ * Each importer's other importers it reaches by a path through one or more
+ * package nodes, sorted; one with none is left out. `nodes` maps each node
+ * that stands for an importer to its dir: the importer's own, and an entry
+ * that only links it (npm's `link: true`, bun's `workspace:` package, a
+ * yarn `link:`), so a direct link is no path through a package. Walked
+ * backwards from each package node with an edge into an importer, through
+ * package nodes alone: a lockfile with no such path costs a pass over the
+ * edges.
+ */
+export function reachedImporters(
+  edges: readonly (readonly number[])[],
+  nodes: ReadonlyMap<number, string>,
+): Map<string, string[]> {
+  const into: number[][] = Array.from({ length: edges.length }, () => [])
+  for (let v = 0; v < edges.length; v++) for (const w of edges[v]!) into[w]!.push(v)
+  const targets = new Map<string, number[]>()
+  for (const [i, dir] of nodes) {
+    const list = targets.get(dir)
+    if (list === undefined) targets.set(dir, [i])
+    else list.push(i)
+  }
+  const found = new Map<string, Set<string>>()
+  // Which target last visited a node: no set to clear per target.
+  const seen = new Int32Array(edges.length)
+  let stamp = 0
+  for (const [target, own] of targets) {
+    stamp++
+    const stack: number[] = []
+    const visit = (u: number): void => {
+      const dir = nodes.get(u)
+      if (dir === undefined) {
+        if (seen[u] !== stamp) {
+          seen[u] = stamp
+          stack.push(u)
+        }
+      } else if (dir !== target) {
+        let set = found.get(dir)
+        if (set === undefined) found.set(dir, (set = new Set()))
+        set.add(target)
+      }
+    }
+    for (const t of own) for (const u of into[t]!) if (!nodes.has(u)) visit(u)
+    while (stack.length > 0) for (const v of into[stack.pop()!]!) visit(v)
+  }
+  return new Map([...found].map(([dir, set]) => [dir, [...set].sort()]))
+}
+
+/**
+ * `links` with `transitive` set to what `reached` names beyond its deps and
+ * peers; unchanged when that is nothing, so a lockfile with no such path
+ * memoises what it did.
+ */
+export function withTransitive<T extends { deps: object; peers: object }>(
+  links: T,
+  reached: readonly string[] | undefined,
+): T & { transitive?: readonly string[] } {
+  if (reached === undefined) return links
+  const direct = new Set<string>([
+    ...(Object.values(links.deps) as string[]),
+    ...(Object.values(links.peers) as string[]),
+  ])
+  const transitive = reached.filter((d) => !direct.has(d))
+  return transitive.length === 0 ? links : { ...links, transitive }
+}

package/src/index.ts

@@ -17,7 +17,7 @@
 // each importer's `package.json` to its tasks' inputs.
 //
 // Imports core only through the public `@vzn/vx` specifier.
-import { readdirSync, readFileSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import path from 'node:path'
 import {
@@ -58,7 +58,7 @@ export interface LockfileOptions {
 }
 
 /** Bumps when a digest folds differently or the memo holds more (its identity). */
-const DIGEST_VERSION = 23
+const DIGEST_VERSION = 24
 
 let memoVersion: number | undefined
 /**
@@ -133,6 +133,8 @@ interface Manager {
   readonly unrecorded?: (text: string) => (name: string, pkg: Record<string, unknown>) => boolean
   /** The manager reads package.json as JSONC (trailing commas, comments): bun does. */
   readonly jsoncManifests?: true
+  /** The file names a manifest may have (default `package.json` alone). */
+  readonly manifests?: readonly [string, ...string[]]
   /**
    * Importers a format leaves out of the lockfile (yarn classic), from the
    * workspace's manifests through `manifest`; undefined where the file
@@ -172,15 +174,18 @@ const MANAGERS = {
     recorded: (t) => pnpmLock().recordedImporters(t),
     // pnpm's walk skips bower_components as it does node_modules (pnpm 10).
     skippedDirs: ['node_modules', 'bower_components'],
-    // The root package.json for its `pnpm` field: pnpm reads install
+    // The root manifest for its `pnpm` field: pnpm reads install
     // settings there that the lockfile does not record.
-    settings: ['pnpm-workspace.yaml', '.npmrc', 'package.json'],
+    settings: ['pnpm-workspace.yaml', '.npmrc', 'package.json', 'package.json5', 'package.yaml'],
     settingsText: (file, text) =>
       file === 'pnpm-workspace.yaml'
         ? pnpmSettings().workspaceSettings(text)
-        : file === 'package.json'
-          ? pnpmSettings().packageSettings(text)
+        : file.startsWith('package.')
+          ? pnpmSettings().packageSettings(text, file)
           : undefined,
+    // pnpm reads a package.json5 or package.yaml where there is no
+    // package.json, and records its dependencies like any other's.
+    manifests: ['package.json', 'package.json5', 'package.yaml'],
     peersInManifest: true,
     // Read from their blocks alone: a whole parse here was on every warm run.
     linksUnrecorded: (t) => pnpmLock().excludesLinks(t),
@@ -263,8 +268,9 @@ const MANAGERS = {
     // under an unchanged yarn.lock (probed, yarn 1.22). Yarn 1 reads an
     // option `.yarnrc` leaves unset from `.npmrc`: `production=true` there
     // dropped every devDependency (probed, yarn 1.22).
-    // The root package.json for `workspaces.nohoist` and `installConfig`,
-    // which lay the install out and the lockfile does not record.
+    // The root package.json for `workspaces.nohoist`, `installConfig`,
+    // `resolutions` and its dependency ranges, which lay the install out
+    // and the lockfile does not record (yarn-settings.ts).
     settings: ['.yarnrc.yml', '.yarnrc', '.npmrc', 'package.json'],
     settingsText: (file, text) =>
       file === 'package.json' ? yarnSettings().packageSettings(text) : undefined,
@@ -295,6 +301,7 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
     )
   }
   const extraFiles = manager.extraFiles
+  const manifests = manager.manifests ?? ['package.json']
   const guardedFor = (file: string) => {
     // The parsers name their own file, so prefixing unconditionally said it
     // twice — "bun.lock: bun.lock: Failed to parse JSONC" (2026-09-20).
@@ -458,10 +465,10 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
         : { ...deps, ...folded }
     },
     async discover(ctx) {
-      const manifest = manifestReader(ctx.workspaceRoot, manager.jsoncManifests === true)
+      const manifest = manifestReader(ctx.workspaceRoot, manifests, manager.jsoncManifests === true)
       // The staleness check's walk overlaps the lockfile read.
       const dirs = workspaceGlobs(ctx.workspaceRoot, manager.name, manifest).then((globs) =>
-        workspaceDirs(ctx.workspaceRoot, globs, manager.skippedDirs),
+        workspaceDirs(ctx.workspaceRoot, globs, manager.skippedDirs, manifests),
       )
       dirs.catch(() => {})
       const read = await readImporters(ctx, manifest)
@@ -535,19 +542,24 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
       if (importers === undefined) {
         importers = importersOf(
           ctx,
-          manifestReader(ctx.workspaceRoot, manager.jsoncManifests === true),
+          manifestReader(ctx.workspaceRoot, manifests, manager.jsoncManifests === true),
         )
         perRun.set(ctx.projects, importers)
       }
       if ((await importers)?.has(importerOf(ctx.workspaceRoot, ctx.dir)) !== true) return
+      // A stat per project, and only where a manifest may have another name.
+      const file =
+        manifests.length === 1
+          ? manifests[0]
+          : (manifests.find((f) => existsSync(path.join(ctx.dir, f))) ?? manifests[0])
       const tasks = config.tasks ?? {}
       for (const [name, task] of Object.entries(tasks)) {
         const inputs = task.inputs
-        if (inputs === undefined || inputs.files.includes('package.json')) continue
+        if (inputs === undefined || inputs.files.includes(file)) continue
         // A copy: a loaded config may be shared or frozen.
         tasks[name] = {
           ...task,
-          inputs: { ...inputs, files: [...inputs.files, 'package.json'] },
+          inputs: { ...inputs, files: [...inputs.files, file] },
         }
       }
     },
@@ -603,40 +615,62 @@ function importerOf(workspaceRoot: string, dir: string): string {
 }
 
 /**
- * An importer's `package.json`, or null where it has none. One that does
- * not parse refuses, named: read as none, a conflicted manifest lost its
- * dependencies and its dependents hit with old bytes (Turbo and Nx refuse).
+ * An importer's manifest (the one of `names` present), or null where it
+ * has none. One that does not parse refuses, named: read as none, a
+ * conflicted manifest lost its dependencies and its dependents hit with
+ * old bytes (Turbo and Nx refuse). So do two in one directory: pnpm 10.28
+ * lists such a package by its package.json and installs the package.yaml's
+ * dependencies.
  */
 async function manifestOf(
   root: string,
   dir: string,
+  names: readonly string[],
   jsonc: boolean,
 ): Promise<Record<string, unknown> | null> {
-  const file = path.join(dir, 'package.json')
-  const name = path.relative(root, file).split(path.sep).join('/')
-  let text: string
-  try {
-    text = await Bun.file(file).text()
-  } catch (err) {
-    // As readSettings: one there but unreadable read as none, and its
-    // workspace globs and names dropped out of the staleness check. A
-    // lockfile importer whose directory is now a file has none either.
-    const code = (err as NodeJS.ErrnoException).code
-    if (code === 'ENOENT' || code === 'ENOTDIR') return null
+  const found: { name: string; text: string }[] = []
+  for (const base of names) {
+    const file = path.join(dir, base)
+    const name = path.relative(root, file).split(path.sep).join('/')
+    try {
+      found.push({ name, text: await Bun.file(file).text() })
+    } catch (err) {
+      // As readSettings: one there but unreadable read as none, and its
+      // workspace globs and names dropped out of the staleness check. A
+      // lockfile importer whose directory is now a file has none either.
+      const code = (err as NodeJS.ErrnoException).code
+      if (code === 'ENOENT' || code === 'ENOTDIR') continue
+      throw new UserError(
+        `${name}: cannot be read (${err instanceof Error ? err.message : String(err)})`,
+      )
+    }
+  }
+  if (found.length === 0) return null
+  if (found.length > 1) {
+    const rel = path.relative(root, dir).split(path.sep).join('/') || '.'
+    const bases = found.map((f) => path.posix.basename(f.name))
     throw new UserError(
-      `${name}: cannot be read (${err instanceof Error ? err.message : String(err)})`,
+      `${rel}: holds ${bases.slice(0, -1).join(', ')} and ${bases.at(-1)}, two manifests — keep one`,
     )
   }
+  const { name, text } = found[0]!
   if (CONFLICT.test(text))
     throw new UserError(`${name}: holds git merge conflict markers — resolve them`)
+  const [kind, parse]: [string, (t: string) => unknown] = name.endsWith('.yaml')
+    ? ['YAML', (t) => Bun.YAML.parse(t)]
+    : name.endsWith('.json5')
+      ? ['JSON5', (t) => Bun.JSON5.parse(t)]
+      : ['JSON', (t) => (jsonc ? Bun.JSONC.parse(t) : JSON.parse(t))]
   let pkg: unknown
   try {
-    pkg = jsonc ? Bun.JSONC.parse(text) : JSON.parse(text)
+    pkg = parse(text)
   } catch (err) {
-    throw new UserError(`${name}: not JSON (${err instanceof Error ? err.message : String(err)})`)
+    throw new UserError(
+      `${name}: not ${kind} (${err instanceof Error ? err.message : String(err)})`,
+    )
   }
   if (pkg === null || typeof pkg !== 'object' || Array.isArray(pkg)) {
-    throw new UserError(`${name}: not a JSON object`)
+    throw new UserError(`${name}: not a ${kind === 'YAML' ? 'YAML mapping' : `${kind} object`}`)
   }
   return pkg as Record<string, unknown>
 }
@@ -644,13 +678,14 @@ async function manifestOf(
 /** `manifestOf`, each directory read once. */
 function manifestReader(
   root: string,
+  names: readonly string[],
   jsonc: boolean,
 ): (dir: string) => Promise<Record<string, unknown> | null> {
   const read = new Map<string, Promise<Record<string, unknown> | null>>()
   return (dir) => {
     let pkg = read.get(dir)
     if (pkg === undefined) {
-      pkg = manifestOf(root, dir, jsonc)
+      pkg = manifestOf(root, dir, names, jsonc)
       read.set(dir, pkg)
     }
     return pkg
@@ -725,14 +760,17 @@ async function workspaceGlobs(
 }
 
 /**
- * The directories the globs name that hold a `package.json`, root-relative
- * POSIX, sorted; none a `!` glob excludes, none under a `skipped` dir.
+ * The directories the globs name that hold a manifest (one of `names`),
+ * root-relative POSIX, sorted; none a `!` glob excludes, none under a
+ * `skipped` dir.
  */
 async function workspaceDirs(
   root: string,
   globs: readonly unknown[],
   skipped: readonly string[] = ['node_modules'],
+  names: readonly string[] = ['package.json'],
 ): Promise<string[]> {
+  const manifest = names.length === 1 ? names[0] : `{${names.join(',')}}`
   const strip = (p: string): string => p.replace(/^\.\//, '').replace(/\/+$/, '')
   const excluded = globs
     .filter((p): p is string => typeof p === 'string' && p.startsWith('!'))
@@ -743,7 +781,7 @@ async function workspaceDirs(
   const dirs = new Set<string>()
   for (const pattern of globs) {
     if (typeof pattern !== 'string' || pattern.startsWith('!')) continue
-    const glob = new Bun.Glob(`${strip(pattern)}/package.json`)
+    const glob = new Bun.Glob(`${strip(pattern)}/${manifest}`)
     for await (const file of glob.scan({ cwd: root, onlyFiles: true })) {
       const dir = path.dirname(file).split(path.sep).join('/')
       if (dir === '.' || dir.split('/').some((seg) => skipped.includes(seg))) continue
@@ -841,10 +879,11 @@ async function withManifestLinks(
  * (D-39). Its name is the
  * manifest's `name` when no other importer shares it (core refuses two
  * projects of one name, so a shared one names neither); its `deps` the
- * importers it installs, its peers on importers, and the importers the root
- * installs. A peer or root-installed importer orders a build unless it
- * would close a cycle through the order edges, then it is `reach` only, in
- * name order so the edge kept is stable.
+ * importers it installs, its peers on importers, the importers its packages
+ * install, and the importers the root installs. A peer, package-installed
+ * or root-installed importer orders a build unless it would close a cycle
+ * through the order edges, then it is `reach` only, in name order so the
+ * edge kept is stable.
  */
 async function discovered(
   root: string,
@@ -892,6 +931,10 @@ async function discovered(
       if (manifests.has(target)) (manifestPeers?.has(name) === true ? peer : own).add(target)
     }
     for (const target of Object.values(links.peers)) if (manifests.has(target)) peer.add(target)
+    // Installed only through a package (a registry package's dependency on
+    // a workspace): it orders like a peer, as nothing the importer's own
+    // manifest declares puts the edge there.
+    for (const target of links.transitive ?? []) if (manifests.has(target)) peer.add(target)
     order.set(i, own)
     peers.set(i, peer)
   }

package/src/json.ts

@@ -20,6 +20,20 @@ export function depsOf(
   return out
 }
 
+/**
+ * Which field each dependency sits in, as `field\0name` lines sorted: an
+ * install that omits dev or optional packages (npm `omit=dev`, pnpm
+ * `--prod`, bun `--production`) lays out what it says, and a merged
+ * name → version map does not.
+ */
+export function sectionsOf(e: Json, fields: readonly string[] = DEP_FIELDS): string {
+  const out: string[] = []
+  for (const field of fields) {
+    for (const name of Object.keys(record(e[field]) ?? {})) out.push(`${field}\0${name}`)
+  }
+  return out.sort().join('\n')
+}
+
 /** The `peerDependencies` names an entry installs under no other field. */
 export function peerOnly(e: Json): ReadonlySet<string> {
   const installed = depsOf(e, DEP_FIELDS.slice(0, 3))

package/src/npm.ts

@@ -8,7 +8,12 @@
 // ancestor directory's, else `node_modules/d` — Node's own walk.
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
-import { depsOf, peerOnly, record } from './json.js'
+import { reachedImporters, withTransitive } from './graph.js'
+import { depsOf, peerOnly, record, sectionsOf } from './json.js'
+
+// The graph the digest built from this parse, for `importerLinks`: `vx
+// lock` asks for both, and the edges do not depend on `files`.
+const built = new WeakMap<Lockfile, ReturnType<typeof buildGraph>>()
 
 export interface Lockfile {
   readonly version: number
@@ -22,6 +27,8 @@ export interface Lockfile {
 
 export interface Entry {
   readonly deps: ReadonlyMap<string, string>
+  /** the root's and a workspace's `sectionsOf`; '' for any other entry */
+  readonly sections: string
   /** version + resolved + integrity — whatever pins the bytes; '' for a link, the root, a workspace */
   readonly resolution: string
   /** the path a `link: true` entry points at */
@@ -72,6 +79,7 @@ export function parseLockfile(text: string): Lockfile {
       p !== '' && !p.startsWith('node_modules/') && !p.includes('/node_modules/') && isMember(p)
     packages.set(p, {
       deps: depsOf(e),
+      sections: p === '' || isWorkspace ? sectionsOf(e) : '',
       // The root's and a workspace's `version` is their own package.json's,
       // not what npm installed: a release bump of the root re-keyed every
       // task with node_modules unchanged.
@@ -156,6 +164,32 @@ export function importerDigests(
   lock: Lockfile,
   files: ReadonlyMap<string, string> = new Map(),
 ): ReadonlyMap<string, string> {
+  const g = buildGraph(lock, files)
+  built.set(lock, g)
+  const { index, material, edges } = g
+  const digests = reachDigests({ material, edges })
+  const out = new Map<string, string>()
+  // The global digest rides as DATA: Bun's xxHash3 reads only the low 32
+  // bits of a seed, so two lockfiles' globals could share one (item 682).
+  const global = Bun.hash.xxHash3(lock.global).toString(16).padStart(16, '0')
+  for (const [p, e] of lock.packages) {
+    if (p !== '' && !e.isWorkspace) continue
+    out.set(
+      p === '' ? '.' : p,
+      Bun.hash
+        .xxHash3(`${global}\0${digests[index.get(p)!]!}`)
+        .toString(16)
+        .padStart(16, '0'),
+    )
+  }
+  return out
+}
+
+/** The lockfile as one graph: a node per path, by path. */
+function buildGraph(
+  lock: Lockfile,
+  files: ReadonlyMap<string, string>,
+): { index: Map<string, number>; material: string[]; edges: number[][] } {
   const index = new Map<string, number>()
   const material: string[] = []
   const edges: number[][] = []
@@ -165,7 +199,11 @@ export function importerDigests(
     // it sits: a re-hoist of one version re-keyed every project reaching it
     // (D-140). Where it sits decides what it resolves; that is the edges.
     // The root and a workspace keep their path, which is who they are.
-    material.push(`${p === '' || e.isWorkspace ? p : installName(p)}\0${e.resolution}`)
+    material.push(
+      p === '' || e.isWorkspace
+        ? `${p}\0${e.resolution}\nsections\0${e.sections}`
+        : `${installName(p)}\0${e.resolution}`,
+    )
     edges.push([])
   }
   // npm links a `file:` directory, or with `install-links=true` copies it,
@@ -193,31 +231,25 @@ export function importerDigests(
       else material[from] += `\nunresolved\0${name}\0${spec}`
     }
   }
-  const digests = reachDigests({ material, edges })
-  const out = new Map<string, string>()
-  // The global digest rides as DATA: Bun's xxHash3 reads only the low 32
-  // bits of a seed, so two lockfiles' globals could share one (item 682).
-  const global = Bun.hash.xxHash3(lock.global).toString(16).padStart(16, '0')
-  for (const [p, e] of lock.packages) {
-    if (p !== '' && !e.isWorkspace) continue
-    out.set(
-      p === '' ? '.' : p,
-      Bun.hash
-        .xxHash3(`${global}\0${digests[index.get(p)!]!}`)
-        .toString(16)
-        .padStart(16, '0'),
-    )
-  }
-  return out
+  return { index, material, edges }
 }
 
 /**
  * The root's and each workspace's dependencies that resolve, by Node's
  * walk, to a `link: true` entry pointing at the root or a workspace: an
- * installed entry is a dep, a peer with none of the same name a peer.
+ * installed entry is a dep, a peer with none of the same name a peer;
+ * and the ones a package it installs resolves to (`transitive`).
  */
 export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImporter> {
   const out = new Map<string, LockfileImporter>()
+  const g = built.get(lock) ?? buildGraph(lock, new Map())
+  const nodes = new Map<number, string>()
+  for (const [p, e] of lock.packages) {
+    const at = p === '' || e.isWorkspace ? p : e.link
+    if (at === undefined || (at !== '' && lock.packages.get(at)?.isWorkspace !== true)) continue
+    nodes.set(g.index.get(p)!, at === '' ? '.' : at)
+  }
+  const reached = reachedImporters(g.edges, nodes)
   for (const [p, e] of lock.packages) {
     if (p !== '' && !e.isWorkspace) continue
     const dir = p === '' ? '.' : p
@@ -231,7 +263,7 @@ export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImpor
       const targetDir = link === '' ? '.' : link
       if (targetDir !== dir) links[e.peers.has(name) ? 'peers' : 'deps'][name] = targetDir
     }
-    out.set(dir, links)
+    out.set(dir, withTransitive(links, reached.get(dir)))
   }
   return out
 }

package/src/pnpm-settings.ts

@@ -47,17 +47,22 @@ export function sharedWorkspaceLockfile(
 }
 
 /**
- * The root package.json as every task folds it: only its `pnpm` field,
+ * The root manifest (`file`: package.json, package.json5 or package.yaml)
+ * as every task folds it: only its `pnpm` field,
  * which pnpm reads install settings from (`onlyBuiltDependencies`,
  * `supportedArchitectures`, …) and the lockfile records none of, without
  * the patches and overrides it does record. Its dependencies are the
  * lockfile's to record. Undefined for a file that does not parse to a
  * mapping, folded whole.
  */
-export function packageSettings(text: string): string | undefined {
+export function packageSettings(text: string, file: string): string | undefined {
   let doc: unknown
   try {
-    doc = JSON.parse(text)
+    doc = file.endsWith('.yaml')
+      ? Bun.YAML.parse(text)
+      : file.endsWith('.json5')
+        ? Bun.JSON5.parse(text)
+        : JSON.parse(text)
   } catch {
     return undefined
   }

package/src/pnpm.ts

@@ -12,13 +12,20 @@
 // Bun.YAML is the parser: no dependency, and the file is plain YAML.
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
-import { record, stable } from './json.js'
+import { reachedImporters, withTransitive } from './graph.js'
+import { record, sectionsOf, stable } from './json.js'
 import { joinPosix, resolvePosix } from './posix.js'
 
+// The graph the digest built from this parse, for `importerLinks`: `vx
+// lock` asks for both, and the edges do not depend on `files`.
+const built = new WeakMap<Lockfile, ReturnType<typeof buildGraph>>()
+
 export interface Lockfile {
   readonly version: string
   /** importer path (`.`, `packages/a`) → dependency name → version or `link:…` */
   readonly importers: ReadonlyMap<string, ReadonlyMap<string, string>>
+  /** importer path → which field each dependency sits in (`sectionsOf`) */
+  readonly sections: ReadonlyMap<string, string>
   /** snapshot key → dependency name → version (v9 `snapshots`; v5/v6 `packages`) */
   readonly snapshots: ReadonlyMap<string, ReadonlyMap<string, string>>
   /** package key (v9: `name@version`; v5/v6: the snapshot key) → resolution digest */
@@ -73,12 +80,17 @@ export function parseLockfile(text: string): Lockfile {
   }
 
   const importers = new Map<string, ReadonlyMap<string, string>>()
+  const sections = new Map<string, string>()
   const rawImporters = record(doc['importers'])
   if (rawImporters !== undefined) {
-    for (const [dir, entry] of Object.entries(rawImporters)) importers.set(dir, depsOf(entry))
+    for (const [dir, entry] of Object.entries(rawImporters)) {
+      importers.set(dir, depsOf(entry))
+      sections.set(dir, sectionsOf(record(entry) ?? {}, DEP_FIELDS))
+    }
   } else if (DEP_FIELDS.some((f) => doc[f] !== undefined)) {
     // A single-package lockfile keeps its dependencies at the top level.
     importers.set('.', depsOf(doc))
+    sections.set('.', sectionsOf(doc, DEP_FIELDS))
   }
 
   const snapshots = new Map<string, ReadonlyMap<string, string>>()
@@ -122,7 +134,17 @@ export function parseLockfile(text: string): Lockfile {
       : { lockfileVersion: version, rest, leading },
   )
   const excludesLinks = record(doc['settings'])?.['excludeLinksFromLockfile'] === true
-  return { version, importers, snapshots, resolutions, patches, directories, global, excludesLinks }
+  return {
+    version,
+    importers,
+    sections,
+    snapshots,
+    resolutions,
+    patches,
+    directories,
+    global,
+    excludesLinks,
+  }
 }
 
 /**
@@ -304,6 +326,7 @@ export function importerDigests(
   files: ReadonlyMap<string, string> = new Map(),
 ): ReadonlyMap<string, string> {
   const g = buildGraph(lock, files)
+  built.set(lock, g)
   const hashes = reachDigests(g)
   const out = new Map<string, string>()
   // The global digest rides as DATA: Bun's xxHash3 reads only the low 32
@@ -340,10 +363,12 @@ function importerNode(dir: string): string {
  * The directories `file:` dependencies install from, and those a `link:`
  * names that is no importer. pnpm copies the first at install and links
  * the second, and records only their path, so an edit in one moved no key
- * (Growth, file-dir-dep-stale.sh): the claim hashes its content.
+ * (Growth, file-dir-dep-stale.sh): the claim hashes its content. A
+ * `file:` to an importer (an injected workspace package) is an edge
+ * (`importerLinks`), not content: its build output re-keyed its dependants.
  */
 export function fileDeps(lock: Lockfile): string[] {
-  const out = new Set(lock.directories.values())
+  const out = new Set([...lock.directories.values()].filter((dir) => !lock.importers.has(dir)))
   const add = (dir: string, deps: ReadonlyMap<string, string>): void => {
     for (const version of deps.values()) {
       const target = linkTarget(lock, dir, version)
@@ -387,8 +412,10 @@ function buildGraph(lock: Lockfile, files: ReadonlyMap<string, string>): Graph {
   // importers that link each other were told apart by their edges alone,
   // and swapping which reaches which version gave the same lines, so a
   // lockfile that moved both installs keyed neither (item 1073).
-  for (const dir of lock.importers.keys()) node(importerNode(dir), importerNode(dir))
-  const link = (from: number, dir: string, name: string, version: string): void => {
+  for (const dir of lock.importers.keys()) {
+    node(importerNode(dir), `${importerNode(dir)}\nsections\0${lock.sections.get(dir)}`)
+  }
+  const link = (from: number, by: string, dir: string, name: string, version: string): void => {
     if (version.startsWith('link:')) {
       const target = linkTarget(lock, dir, version)
       if (target !== undefined && lock.importers.has(target))
@@ -400,9 +427,12 @@ function buildGraph(lock: Lockfile, files: ReadonlyMap<string, string>): Graph {
       return
     }
     const key = snapshotKey(lock, name, version)
-    // A dependency with no snapshot (a leaf the file lists only by version)
-    // is a node of its own, so its version still counts.
-    edges[from]!.push(node(key, `${key}\0${lock.resolutions.get(packageKey(key)) ?? ''}\0`))
+    // pnpm refuses a dependency with no entry ("Broken lockfile",
+    // ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY); made a leaf, a file cut after
+    // `snapshots:` keyed every project on versions alone.
+    const i = index.get(key)
+    if (i === undefined) throw new Error(`pnpm-lock.yaml: no entry for ${key}, which ${by} names`)
+    edges[from]!.push(i)
   }
   // A node folds the names it asks for as well as where they land: by
   // its edges alone, two aliases swapping targets (`foo: npm:x`, `bar:
@@ -417,12 +447,12 @@ function buildGraph(lock: Lockfile, files: ReadonlyMap<string, string>): Graph {
   for (const [dir, deps] of lock.importers) {
     const from = index.get(importerNode(dir))!
     named(from, deps)
-    for (const [name, version] of deps) link(from, dir, name, version)
+    for (const [name, version] of deps) link(from, `importer ${dir}`, dir, name, version)
   }
   for (const [key, deps] of lock.snapshots) {
     const from = index.get(key)!
     named(from, deps)
-    for (const [name, version] of deps) link(from, '.', name, version)
+    for (const [name, version] of deps) link(from, key, '.', name, version)
   }
   return { index, material, edges }
 }
@@ -452,10 +482,16 @@ function fileTarget(lock: Lockfile, version: string): string | undefined {
  * packed `file:` copy is not. pnpm records
  * an auto-installed peer (`autoInstallPeers`, the default) under
  * `dependencies` like any other, so `peers` is empty here: the plugin
- * asks the importer's manifest which of these are peers.
+ * asks the importer's manifest which of these are peers. An importer a
+ * snapshot it reaches links (an override to `workspace:`) is `transitive`.
  */
 export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImporter> {
   const out = new Map<string, LockfileImporter>()
+  const g = built.get(lock) ?? buildGraph(lock, new Map())
+  const reached = reachedImporters(
+    g.edges,
+    new Map([...lock.importers.keys()].map((dir) => [g.index.get(importerNode(dir))!, dir])),
+  )
   for (const [dir, deps] of lock.importers) {
     const links: Record<string, string> = {}
     for (const [name, version] of deps) {
@@ -468,7 +504,7 @@ export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImpor
         links[name] = target
       }
     }
-    out.set(dir, { deps: links, peers: {} })
+    out.set(dir, withTransitive({ deps: links, peers: {} }, reached.get(dir)))
   }
   return out
 }

package/src/yarn-settings.ts

@@ -9,8 +9,14 @@ import { record, stable, type Json } from './json.js'
  * (`"is-odd/is-number"`) leaves the parent's entry on the range it
  * declares, so adding one whose range another package already keys
  * changes the install with yarn.lock byte for byte (turborepo#14499).
- * Its dependencies are the lockfile's to record. Undefined for a file that does not parse to a mapping, folded
- * whole.
+ * Its `dependencies`, `devDependencies` and `optionalDependencies` too:
+ * Yarn 1 records no importer, only the ranges asked, so moving a range
+ * between the root and a workspace (root is-number ^6 → ^7, a's ^7 → ^6)
+ * leaves yarn.lock byte for byte and moves the root node_modules copy
+ * every project without its own resolves (probed, yarn 1.22). Berry
+ * records them on the root workspace's entry, whose digest reaches every
+ * task already, so folding them there costs no extra re-key. Undefined
+ * for a file that does not parse to a mapping, folded whole.
  */
 export function packageSettings(text: string): string | undefined {
   let doc: unknown
@@ -25,6 +31,8 @@ export function packageSettings(text: string): string | undefined {
   const nohoist = record(map['workspaces'])?.['nohoist']
   if (nohoist !== undefined) kept['nohoist'] = nohoist
   if (map['installConfig'] !== undefined) kept['installConfig'] = map['installConfig']
-  if (map['resolutions'] !== undefined) kept['resolutions'] = map['resolutions']
+  for (const field of ['resolutions', 'dependencies', 'devDependencies', 'optionalDependencies']) {
+    if (map[field] !== undefined) kept[field] = map[field]
+  }
   return `yarn-package\0${stable(kept)}`
 }

package/src/yarn.ts

@@ -12,6 +12,7 @@
 // one digest is the root's reach through every entry the file resolves.
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
+import { reachedImporters, withTransitive } from './graph.js'
 import { depsOf, record, stable } from './json.js'
 import { joinPosix, resolvePosix } from './posix.js'
 import { parseSyml } from './syml.js'
@@ -349,8 +350,10 @@ function resolveDescriptor(
  * transparent workspaces satisfied with one), and its peers on a
  * workspace of that name, which Yarn hoists whatever the range. Only a
  * descriptor the file keys counts: the name fallbacks the digest takes
- * (a catalog, an override) name no link. Classic records no workspaces,
- * so it has none here (`classicLinks`).
+ * (a catalog, an override) name no link. A workspace an entry it reaches
+ * so resolves to (transparent workspaces satisfying a registry package's
+ * range) is `transitive`. Classic records no workspaces, so it has none
+ * here (`classicLinks`).
  */
 export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImporter> {
   const out = new Map<string, LockfileImporter>()
@@ -360,6 +363,23 @@ export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImpor
     dirOf.set(id, dir)
     byName.set(id.slice(0, id.indexOf('@workspace:')), dir)
   }
+  // The digest's graph by the descriptors the file keys alone, as above.
+  const index = new Map<string, number>()
+  for (const id of lock.entries.keys()) index.set(id, index.size)
+  // A `link:` entry to a workspace stands for it: no package between.
+  const edges: number[][] = []
+  const nodes = new Map<number, string>()
+  for (const [id, e] of lock.entries) {
+    const own: number[] = []
+    for (const [name, range] of e.deps) {
+      const keyed = keyedDescriptor(lock, id, name, range)
+      if (keyed !== undefined) own.push(index.get(keyed)!)
+    }
+    const at = dirOf.get(id) ?? linkedDir(lock, dirOf, id)
+    if (at !== undefined) nodes.set(index.get(id)!, at)
+    edges.push(own)
+  }
+  const reached = reachedImporters(edges, nodes)
   for (const [dir, id] of lock.workspaces) {
     const entry = lock.entries.get(id)!
     const links = { deps: {} as Record<string, string>, peers: {} as Record<string, string> }
@@ -381,7 +401,7 @@ export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImpor
     for (const name of entry.deps.keys()) {
       if (!entry.installed.has(name)) add('peers', name, byName.get(name))
     }
-    out.set(dir, links)
+    out.set(dir, withTransitive(links, reached.get(dir)))
   }
   return out
 }