Lockfile pruning, could you share some insights?

[0x80]

A little while ago I created isolate-package to make it possible to deploy to Firebase from a monorepo without resorting to hacks. On the surface, the approach seems similar to turbo prune.

The current lockfile pruning implementation in isolate-package is not great. Depending on the package manager different strategies are used:

• For NPM it uses Arborist which is part of the npmcli repository. The main issue here is that it can only work if we first move the contents from the monorepo root node_modules into the isolate directory before executing Arborist with the adapted manifest file. After the process completes (or fails) the node_modules folder is then moved back into the root.
• For Yarn it simply copies the original lockfile to the isolate directory and executes yarn install there to output a pruned lockfile.
• For PNPM it reads and strip the contents of the pnpm-lock.yaml file and writes it back to disk using a PNPM method.

Especially the NPM approach is dodgy. It will only work with one isolation process at a time, and it is likely to interfere with other processes that are reading from the node_modules directory. I'm hoping the NPM team can update their Arborist code to prevent having to move the directory, but I'm not counting on it.

I had a look at the Turbo code, but I couldn't figure out how it does the actual pruning. I got the impression it constructs a complete tree of dependencies and outputs a lockfile from the manipulated tree structure. Still, I could not find any code that seems responsible for converting a tree to the specific lockfile formats.

I'm not a Rust programmer (yet) but this could be a good excuse to get into it 😄 Any help or pointers are greatly appreciated.

@chris-olszewski I am tagging you here since it seems you worked most of the code that I read.