`npm i esbuild --no-optional` is missing `node_modules/.bin/esbuild`

[evanw]

It looks like npm's .bin folder is broken by design: npm/cli#3905. Nested dependencies with executables can clobber executables with the same name in parent dependencies, and no attempt is made by npm to avoid this. Whatever the executable ends up being is non-deterministic and random. It doesn't sound like this bug will ever be fixed.

In esbuild's case, I was trying to reuse the esbuild-wasm package in some of esbuild's optional dependencies. So esbuild optionally depends on @esbuild/android-arm which depends on esbuild-wasm. But if you specify --no-optional when you install esbuild (so the nested esbuild-wasm dependency could not possibly be installed on any platform), the esbuild executable from esbuild-wasm causes the node_modules/.bin/esbuild symlink to be erased.

This is due to npm's _addOmitsToTrashList function here. The esbuild-wasm package and the esbuild package deliberately both have an executable named esbuild (specifically in the "bin" field of their package.json files) so that you can substitute the esbuild-wasm package for the esbuild package and your install scripts will still work.

One workaround could be to go back to sticking a full copy of the WASM blob into every shim package. Another workaround could be to publish a second WASM package that's identical to the first but that doesn't have a "bin" field in its package.json file.