Lockfile pruning, what can we learn from Turborepo or Nx?

[0x80]

The current lockfile pruning implementation in isolate-package is not great. Depending on the package manager different strategies are used:

• For NPM we use Arborist which is part of the npmcli repository. The main issue here is that it can only work if we first move the contents from the monorepo root node_modules into the isolate directory before executing Arborist with the adapted manifest file. After the process completes (or fails) the node_modules folder is then moved back into the root.
• For Yarn we simply copy the original lockfile to the isolate directory and execute yarn install there. That seems to work.
• For PNPM we manually read and strip the contents of the pnpm-lock.yaml file and write it back to disk using a PNPM internal utility method.

Especially the NPM approach feels dodgy. It will only work with one isolation process at a time, and it could interfere with other processes that are reading from the node_modules directory.

The Turbo prune method seems fast no matter what package manager. I had a look at the code, but I couldn't figure out how it does the actual pruning. I suspect Turbo constructs a complete tree of dependencies and outputs a lockfile from a manipulated tree structure, but I could not find any code that is responsible for converting a tree to specific lockfile formats.

I'm not a Rust programmer (yet) but this could be a good excuse to learn it 😄 Any help is greatly appreciated.

[ih84ds]

I'm using NX and couldn't, for the life of me, figure out how to get their lockfile generation to work for @nx/js:tsc. Seems like the docs are out of date or something. But for now, isolate-package has saved my bacon!