@vzn/vx-lockfile 0.0.492 → 0.0.494

package/README.md

@@ -47,6 +47,27 @@ The claim, the per-project key, the memo and the `--affected` diff are core's `l
 
 `vx run test --affected=origin/main` after a lockfile change used to select every project. With a plugin declared at `scope: 'project'`, core hands it the lockfile at the base ref and in the working tree; it digests both and names the projects whose digest moved. At `scope: 'workspace'` a change still selects every project. A lockfile that appeared or was deleted still selects everything — every project's `node_modules` is in question.
 
+## `vx prune`
+
+Declaring any of the four plugins adds `vx prune` (the `commands` seam): the workspace cut to some projects and their transitive workspace dependencies, for a Docker build that installs and builds only what it ships — `turbo prune`.
+
+```sh
+vx prune <project...> [--out-dir <dir>] [--docker]
+```
+
+The out dir (default `out/`, relative to the cwd) gets the root `package.json` with `workspaces` rewritten to the subset's dirs, `pnpm-workspace.yaml` with `packages` rewritten (every other key as written), each lockfile at the root **pruned** to what the subset installs, the install config (`.npmrc`, `.yarnrc.yml`, `.pnpmfile.cjs`, `bunfig.toml`, `.nvmrc`, `.node-version`, the patch files `patchedDependencies` names, Yarn's `yarnPath` and plugins), `vx.workspace.*`, the root `vx.config.*`, and each project directory less `node_modules`, `.git`, `.vx` and `.turbo`. A workspace package a copied vx config imports (a local plugin) comes along with its closure: the config loads before any task. A relative config import that leaves the subset is warned about. `--docker` writes `json/` — the root install files and each project's `package.json`, the cacheable install layer — and `full/`, everything:
+
+```dockerfile
+COPY out/json/ .
+RUN bun install --frozen-lockfile
+COPY out/full/ .
+RUN bunx vx run app#build
+```
+
+The pruned lockfile is the source with whole entries cut, in the package manager's own layout, so it installs with a frozen lockfile (`bun install --frozen-lockfile`, `pnpm install --frozen-lockfile`, `npm ci`, `yarn install --immutable`) and a line only another project reaches no longer busts the install layer. Kept: the root's and each kept workspace's entries and every package they reach — through Bun's and npm's hoisted walk (a package stays at the path it held; nothing is re-hoisted), pnpm's snapshots, Yarn's descriptors. Workspace-wide fields (catalogs, overrides, patches, settings, `trustedDependencies`) stay whole: the root manifest still names them. pnpm's env document stays whole. Yarn classic records no workspaces, so its walk starts at each kept manifest's dependencies.
+
+Refused, with the reason: an out dir that is or contains the root, one inside a copied project, one that already has content; a project name the workspace lacks (the root is always kept); `bun.lockb` without `bun.lock` (binary — `bun install --save-text-lockfile`). A `file:` or `link:` dependency outside every copied project is not copied. One plugin or four, there is one `prune`: it prunes every lockfile at the root.
+
 ## Testing
 
-`bun test` covers each parser's digests (transitive bumps, nested versions, workspace links, peer suffixes, patches, install-wide knobs, cycles, key order, aliases, refusals) and `vx run` / `vx why` / `--affected` end to end. vx's own repository declares `bun()`.
+`bun test` covers each parser's digests (transitive bumps, nested versions, workspace links, peer suffixes, patches, install-wide knobs, cycles, key order, aliases, refusals) and `vx run` / `vx why` / `--affected` end to end. `vx prune` is pinned on lockfiles each package manager wrote (bun 1.4, pnpm 10, npm 10, yarn 1 and 4) and end to end: the pruned lockfile is installed frozen and offline by bun always, and by pnpm, npm and yarn 1 where they are on PATH (yarn 1's `--frozen-lockfile` passes a lockfile missing entries, so its check is an install that leaves the file byte-identical). vx's own repository declares `bun()`.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@vzn/vx-lockfile",
-  "version": "0.0.492",
+  "version": "0.0.494",
   "license": "MIT",
-  "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer.",
+  "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer; `vx prune` cuts the workspace and the lockfile to a Docker subset.",
   "keywords": [
     "vx",
     "vx-plugin",
@@ -11,7 +11,9 @@
     "pnpm",
     "bun",
     "npm",
-    "yarn"
+    "yarn",
+    "prune",
+    "docker"
   ],
   "type": "module",
   "main": "./src/index.ts",
@@ -35,7 +37,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.492"
+    "@vzn/vx": "^0.0.494"
   },
   "repository": {
     "type": "git",

package/src/blocks.ts

@@ -0,0 +1,84 @@
+// Line-level pruning for the YAML-shaped lockfiles (pnpm-lock.yaml, yarn.lock
+// berry and classic). Rewriting the parsed document would drop the package
+// manager's own layout — its quoting, its blank lines, its key order — so a
+// pruned file is the original with whole entries cut out, and a pruned
+// lockfile diffs against the source as removals only.
+
+/**
+ * `lines` with every entry at `indent` spaces between `from` and `to` that
+ * `keep` refuses cut out. An entry is its key line and every line after it
+ * up to the next key line at that indent; the blank lines separating
+ * entries are kept as they were between the survivors, and those after
+ * the last entry stay after the last survivor.
+ */
+export function pruneEntries(
+  lines: readonly string[],
+  from: number,
+  to: number,
+  indent: number,
+  keep: (keyLine: string) => boolean,
+): string[] {
+  const pad = ' '.repeat(indent)
+  const isKey = (l: string): boolean =>
+    l.startsWith(pad) && l.length > indent && l[indent] !== ' ' && l[indent] !== '#'
+  const head: string[] = []
+  let i = from
+  while (i < to && !isKey(lines[i]!)) head.push(lines[i++]!)
+  const entries: string[][] = []
+  let separator: string[] | undefined
+  while (i < to) {
+    const entry = [lines[i++]!]
+    while (i < to && !isKey(lines[i]!)) entry.push(lines[i++]!)
+    entries.push(entry)
+  }
+  const blanks = (e: string[]): string[] => {
+    let n = e.length
+    while (n > 1 && e[n - 1]!.trim() === '') n--
+    return e.splice(n)
+  }
+  const tail = entries.length === 0 ? [] : blanks(entries.at(-1)!)
+  for (const e of entries.slice(0, -1)) {
+    const gap = blanks(e)
+    separator ??= gap
+  }
+  const kept = entries.filter((e) => keep(e[0]!))
+  const out = [...head]
+  for (const [n, e] of kept.entries()) {
+    if (n > 0) out.push(...(separator ?? []))
+    out.push(...e)
+  }
+  out.push(...tail)
+  return out
+}
+
+/** The key a YAML mapping line opens: `  'a@1': {}` → `a@1`, `  .:` → `.`. */
+export function yamlKey(line: string): string {
+  const parsed: unknown = Bun.YAML.parse(line.trim())
+  return parsed !== null && typeof parsed === 'object' ? (Object.keys(parsed)[0] ?? '') : ''
+}
+
+/**
+ * `text` with each top-level section named in `sections` pruned to the
+ * entries its predicate keeps; every other line as it was.
+ */
+export function pruneSections(
+  text: string,
+  sections: Readonly<Record<string, (key: string) => boolean>>,
+): string {
+  const lines = text.split('\n')
+  const out: string[] = []
+  let i = 0
+  while (i < lines.length) {
+    const line = lines[i]!
+    out.push(line)
+    i++
+    const name = /^([A-Za-z]+):\s*$/.exec(line)?.[1]
+    const keep = name === undefined ? undefined : sections[name]
+    if (keep === undefined) continue
+    let end = i
+    while (end < lines.length && !/^\S/.test(lines[end]!)) end++
+    out.push(...pruneEntries(lines, i, end, 2, (l) => keep(yamlKey(l))))
+    i = end
+  }
+  return out.join('\n')
+}

package/src/bun.ts

@@ -11,6 +11,7 @@
 // Bun.JSONC is the parser: no dependency, and the file is Bun's own.
 
 import { reachDigests } from '@vzn/vx'
+import type { PruneScope } from './scope.js'
 
 export interface Lockfile {
   readonly version: string
@@ -255,6 +256,83 @@ export function importerDigests(
   return out
 }
 
+/**
+ * The lockfile cut to the workspaces at `dirs` (`.` the root) and the
+ * packages they reach through Bun's hoisted walk, each where it sat: Bun
+ * installs a nested key whose root counterpart is gone as written
+ * (`--frozen-lockfile` passes), so nothing is re-hoisted. Every other
+ * field as written — catalogs, overrides, patches and trusted
+ * dependencies are the workspace's, and the root manifest still names them.
+ */
+export function pruneLockfile(text: string, { dirs }: PruneScope): string {
+  const lock = parseLockfile(text)
+  const doc = Bun.JSONC.parse(text) as Json
+  const reached = new Set<string>()
+  const visit = (key: string | undefined): void => {
+    if (key === undefined || reached.has(key)) return
+    reached.add(key)
+    const entry = lock.packages.get(key)!
+    const at = entry.id.indexOf('@workspace:')
+    if (at !== -1) {
+      const dir = entry.id.slice(at + '@workspace:'.length) || '.'
+      if (!dirs.has(dir))
+        throw new Error(`bun.lock: ${key} is workspace ${dir}, which the subset leaves out`)
+      return
+    }
+    for (const name of entry.deps.keys()) visit(resolve(lock, key, name))
+  }
+  for (const [dir, deps] of lock.workspaces) {
+    if (!dirs.has(dir)) continue
+    let from = ''
+    for (const [name, wsDir] of lock.workspaceDirs) if (wsDir === dir && dir !== '.') from = name
+    if (from !== '') visit(from)
+    for (const name of deps.keys()) visit(resolve(lock, from, name))
+  }
+  const workspaces = record(doc['workspaces']) ?? {}
+  for (const dir of Object.keys(workspaces))
+    if (!dirs.has(dir === '' ? '.' : dir)) delete workspaces[dir]
+  const packages = record(doc['packages']) ?? {}
+  for (const key of Object.keys(packages)) if (!reached.has(key)) delete packages[key]
+  return writeLockfile(doc)
+}
+
+/**
+ * Bun's own text layout, so a pruned file diffs against the source as
+ * removals: two-space indent, a trailing comma after every member but the
+ * document's last, each `packages` entry on one line with a blank line
+ * between entries.
+ */
+function writeLockfile(doc: Json): string {
+  const inline = (v: unknown): string => {
+    if (Array.isArray(v)) return `[${v.map(inline).join(', ')}]`
+    const r = record(v)
+    if (r === undefined) return JSON.stringify(v)
+    const members = Object.entries(r).map(([k, x]) => `${JSON.stringify(k)}: ${inline(x)}`)
+    return members.length === 0 ? '{}' : `{ ${members.join(', ')} }`
+  }
+  const block = (v: unknown, depth: number): string => {
+    const pad = '  '.repeat(depth + 1)
+    const end = '  '.repeat(depth)
+    if (Array.isArray(v)) {
+      return v.length === 0
+        ? '[]'
+        : `[\n${v.map((x) => `${pad}${block(x, depth + 1)},\n`).join('')}${end}]`
+    }
+    const r = record(v)
+    if (r === undefined) return JSON.stringify(v)
+    const members = Object.entries(r)
+    if (members.length === 0) return '{}'
+    return `{\n${members.map(([k, x]) => `${pad}${JSON.stringify(k)}: ${block(x, depth + 1)},\n`).join('')}${end}}`
+  }
+  const members = Object.entries(doc).map(([k, v]) => {
+    if (k !== 'packages') return `  ${JSON.stringify(k)}: ${block(v, 1)}`
+    const entries = Object.entries(record(v) ?? {})
+    if (entries.length === 0) return `  "packages": {}`
+    return `  "packages": {\n${entries.map(([p, t]) => `    ${JSON.stringify(p)}: ${inline(t)},\n`).join('\n')}  }`
+  })
+  return `{\n${members.join(',\n')}\n}\n`
+}
+
 /** The name a package key installs under: its last segment, scope included. */
 function installName(key: string): string {
   const parts = key.split('/')

package/src/index.ts

@@ -26,6 +26,7 @@ import * as pnpmLock from './pnpm.js'
 import * as bunLock from './bun.js'
 import * as npmLock from './npm.js'
 import * as yarnLock from './yarn.js'
+import { pruneCommand } from './prune.js'
 
 export interface LockfileOptions {
   /**
@@ -93,9 +94,9 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
     return new Error(`${named} — regenerate it with \`${manager.name} install\``)
   }
   const extraFiles = manager.extraFiles
-  return definePlugin(
-    import.meta,
-    lockfileClaim({
+  return definePlugin(import.meta, {
+    commands: { prune: pruneCommand },
+    ...lockfileClaim({
       file: manager.file,
       part: manager.name,
       version: DIGEST_VERSION,
@@ -126,7 +127,7 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
         }
       },
     }),
-  )
+  })
 }
 
 /** Each option `LockfileOptions` names, with its kind: derived from the type, so the two cannot drift. */

package/src/npm.ts

@@ -8,6 +8,7 @@
 // ancestor directory's, else `node_modules/d` — Node's own walk.
 
 import { reachDigests } from '@vzn/vx'
+import type { PruneScope } from './scope.js'
 
 export interface Lockfile {
   readonly version: number
@@ -159,6 +160,49 @@ export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
   return out
 }
 
+/**
+ * The lockfile cut to the workspaces at `dirs` (`.` the root) and what
+ * they reach through Node's walk, each at the path it held; the root
+ * entry's `workspaces` becomes `workspaces`, the list the pruned root
+ * manifest carries. Version 2's legacy `dependencies` tree is cut to the
+ * same paths.
+ */
+export function pruneLockfile(text: string, scope: PruneScope): string {
+  const { dirs, members, workspaces } = scope
+  const lock = parseLockfile(text)
+  const doc = JSON.parse(text) as Json
+  const reached = new Set<string>()
+  const visit = (p: string | undefined): void => {
+    if (p === undefined || reached.has(p)) return
+    const e = lock.packages.get(p)!
+    if (members.has(p) && !dirs.has(p)) {
+      throw new Error(`package-lock.json: ${p} is a workspace the subset leaves out`)
+    }
+    reached.add(p)
+    if (e.link !== undefined) return visit(lock.packages.has(e.link) ? e.link : undefined)
+    for (const name of e.deps.keys()) visit(resolve(lock, p, name))
+  }
+  for (const [p, e] of lock.packages) {
+    const linked = e.link !== undefined && dirs.has(e.link)
+    if (linked || dirs.has(p === '' ? '.' : p)) visit(p)
+  }
+  const packages = record(doc['packages'])!
+  for (const p of Object.keys(packages)) if (!reached.has(p)) delete packages[p]
+  const rootEntry = record(packages[''])
+  if (rootEntry?.['workspaces'] !== undefined) rootEntry['workspaces'] = [...workspaces]
+  const prune = (tree: unknown, base: string): void => {
+    const deps = record(tree)
+    if (deps === undefined) return
+    for (const [name, sub] of Object.entries(deps)) {
+      const p = `${base}node_modules/${name}`
+      if (!reached.has(p)) delete deps[name]
+      else prune(record(sub)?.['dependencies'], `${p}/`)
+    }
+  }
+  prune(doc['dependencies'], '')
+  return `${JSON.stringify(doc, null, 2)}\n`
+}
+
 /** `node_modules/a/node_modules/@s/b` → `@s/b`. */
 function installName(p: string): string {
   const i = p.lastIndexOf('node_modules/')

package/src/pnpm.ts

@@ -12,6 +12,8 @@
 // Bun.YAML is the parser: no dependency, and the file is plain YAML.
 
 import { reachDigests } from '@vzn/vx'
+import { pruneSections } from './blocks.js'
+import type { PruneScope } from './scope.js'
 
 export interface Lockfile {
   readonly version: string
@@ -280,6 +282,45 @@ function buildGraph(lock: Lockfile): Graph {
   return { index, material, edges }
 }
 
+/**
+ * The lockfile cut to the importers at `dirs` (`.` the root) and the
+ * packages they reach; every other section as written — catalogs, patches,
+ * overrides and settings are the workspace's, and the subset's manifests
+ * still name them. A multi-document lockfile keeps the env document whole.
+ */
+export function pruneLockfile(text: string, { dirs }: PruneScope): string {
+  const marker = [...text.matchAll(/^---[ \t]*$/gm)].at(-1)
+  const cut = marker === undefined ? 0 : marker.index + marker[0].length
+  const lock = parseLockfile(text)
+  const reached = new Set<string>()
+  const visit = (dir: string, deps: ReadonlyMap<string, string>): void => {
+    for (const [name, version] of deps) {
+      if (version.startsWith('link:')) {
+        const target = joinPosix(dir, version.slice('link:'.length))
+        if (lock.importers.has(target) && !dirs.has(target)) {
+          throw new Error(`pnpm-lock.yaml: ${dir} links ${target}, which the subset leaves out`)
+        }
+        continue
+      }
+      const key = snapshotKey(lock, name, version)
+      if (reached.has(key)) continue
+      reached.add(key)
+      visit('.', lock.snapshots.get(key) ?? new Map())
+    }
+  }
+  for (const [dir, deps] of lock.importers) if (dirs.has(dir)) visit(dir, deps)
+  const v9 = Number.parseInt(lock.version, 10) >= 9
+  const packages = new Set([...reached].map((key) => (v9 ? packageKey(key) : key)))
+  return (
+    text.slice(0, cut) +
+    pruneSections(text.slice(cut), {
+      importers: (dir) => dirs.has(dir),
+      packages: (key) => packages.has(key),
+      snapshots: (key) => reached.has(key),
+    })
+  )
+}
+
 /** `packages/a` + `../b` → `packages/b`; `.` + `packages/a` → `packages/a`. POSIX, as the lockfile writes paths. */
 function joinPosix(base: string, rel: string): string {
   const parts: string[] = []

package/src/prune.ts

@@ -0,0 +1,341 @@
+// `vx prune <project...> [--out-dir <dir>] [--docker]`: the workspace cut to
+// the named projects and their transitive workspace dependencies, for a
+// Docker build that installs and builds only what it ships (`turbo prune`).
+// Every lockfile here is cut to what the subset installs, so the copy
+// installs with a frozen lockfile and a lockfile line the subset cannot
+// reach does not bust the install layer.
+//
+//   <out>/            the subset (with --docker: <out>/full/)
+//     package.json      `workspaces` rewritten to the subset's dirs
+//     pnpm-workspace.yaml  `packages` rewritten the same way, the rest as written
+//     <lockfile>        pruned
+//     vx.workspace.*, the root vx.config.*, install config, patch files
+//     <project dirs>    whole, less node_modules / .git / .vx / .turbo
+//   <out>/json/       (--docker) the install layer: root install files and
+//                     each project's package.json, nothing else
+
+import { cp, mkdir, readdir, stat, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import {
+  buildPackageGraph,
+  listProjectMetas,
+  loadWorkspace,
+  UserError,
+  type CommandContext,
+  type PluginCommand,
+  type ProjectMeta,
+} from '@vzn/vx'
+import * as bunLock from './bun.js'
+import * as npmLock from './npm.js'
+import * as pnpmLock from './pnpm.js'
+import * as yarnLock from './yarn.js'
+import type { PruneScope } from './scope.js'
+
+const USAGE = 'usage: vx prune <project...> [--out-dir <dir>] [--docker]'
+
+const LOCKFILES: Readonly<Record<string, (text: string, scope: PruneScope) => string>> = {
+  'pnpm-lock.yaml': pnpmLock.pruneLockfile,
+  'bun.lock': bunLock.pruneLockfile,
+  'package-lock.json': npmLock.pruneLockfile,
+  'yarn.lock': yarnLock.pruneLockfile,
+}
+
+/** Root files an install reads, copied when present (the manifest and workspace file are rewritten). */
+const INSTALL_FILES = [
+  '.npmrc',
+  '.yarnrc.yml',
+  '.pnpmfile.cjs',
+  'bunfig.toml',
+  '.nvmrc',
+  '.node-version',
+]
+const VX_FILES = [
+  'vx.workspace.ts',
+  'vx.workspace.mts',
+  'vx.workspace.js',
+  'vx.workspace.mjs',
+  'vx.config.ts',
+  'vx.config.mts',
+  'vx.config.js',
+  'vx.config.mjs',
+  'vx.config.cts',
+  'vx.config.cjs',
+]
+const COPY_EXCLUDES = new Set(['node_modules', '.git', '.vx', '.turbo'])
+const DEP_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies'] as const
+/** `from '…'`, `import '…'`, `import('…')`: static specifiers only. */
+const SPECIFIER_RE = /(?:from|import)\s*\(?\s*['"]([^'"]+)['"]/g
+
+/** One object for all four plugins, so a workspace declaring two still has one `prune`. */
+export const pruneCommand: PluginCommand = {
+  description: 'copy projects and their workspace deps, lockfile pruned, for a Docker build',
+  run: (argv, ctx) => prune(argv, ctx),
+}
+
+interface Args {
+  readonly projects: readonly string[]
+  readonly outDir: string
+  readonly docker: boolean
+}
+
+function parseArgs(argv: readonly string[]): Args | null {
+  const projects: string[] = []
+  let outDir = 'out'
+  let docker = false
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]!
+    if (a === '--help' || a === '-h') return null
+    if (a === '--docker') docker = true
+    else if (a === '--out-dir' || a.startsWith('--out-dir=')) {
+      const v = a === '--out-dir' ? argv[++i] : a.slice('--out-dir='.length)
+      if (v === undefined || v === '')
+        throw new UserError(`vx prune: --out-dir needs a path\n${USAGE}`)
+      outDir = v
+    } else if (a.startsWith('-')) throw new UserError(`vx prune: unknown flag ${a}\n${USAGE}`)
+    else projects.push(a)
+  }
+  if (projects.length === 0) throw new UserError(`vx prune: name at least one project\n${USAGE}`)
+  return { projects, outDir, docker }
+}
+
+async function exists(p: string): Promise<boolean> {
+  return stat(p).then(
+    () => true,
+    () => false,
+  )
+}
+
+const posix = (p: string): string => p.split(path.sep).join('/')
+
+/** `a` within `dir`, or `dir` itself. */
+const within = (a: string, dir: string): boolean => a === dir || a.startsWith(dir + path.sep)
+
+async function prune(argv: readonly string[], ctx: CommandContext): Promise<number> {
+  const args = parseArgs(argv)
+  if (args === null) {
+    process.stdout.write(`${USAGE}\n`)
+    return 0
+  }
+  const root = ctx.workspaceRoot
+  const projects = (await listProjectMetas(await loadWorkspace(root))).filter((p) => p.dir !== root)
+  const byName = new Map(projects.map((p) => [p.name, p]))
+  const unknown = args.projects.filter((n) => !byName.has(n))
+  if (unknown.length > 0) {
+    throw new UserError(
+      `vx prune: no project named ${unknown.map((n) => JSON.stringify(n)).join(', ')} (the root is always kept; name the projects under it)`,
+    )
+  }
+  const graph = buildPackageGraph(projects)
+  const names = new Set<string>()
+  const add = (name: string): void => {
+    if (names.has(name) || !byName.has(name)) return
+    names.add(name)
+    for (const d of graph.transitiveDeps(name)) add(d)
+  }
+  for (const n of args.projects) add(n)
+  // A vx config runs before any task, so a workspace package it imports (a
+  // local plugin) is as load-bearing as a dependency: without it `vx run`
+  // in the image cannot load the config. Pulled in with its closure, until
+  // no config names another.
+  const owner = (spec: string): ProjectMeta | undefined =>
+    projects.find((p) => spec === p.name || spec.startsWith(`${p.name}/`))
+  const escapes: string[] = []
+  const scanned = new Set<string>()
+  const scan = async (dir: string, label: string): Promise<void> => {
+    for (const f of VX_FILES) {
+      const file = path.join(dir, f)
+      if (!(await exists(file))) continue
+      for (const [, spec] of (await Bun.file(file).text()).matchAll(SPECIFIER_RE)) {
+        if (spec!.startsWith('.')) {
+          const target = path.resolve(dir, spec!)
+          const kept =
+            [...names].some((n) => within(target, byName.get(n)!.dir)) ||
+            path.dirname(target) === root
+          if (!kept) escapes.push(`${label}: ${spec} resolves outside the subset`)
+        } else {
+          const p = owner(spec!)
+          if (p !== undefined) add(p.name)
+        }
+      }
+    }
+  }
+  await scan(root, 'the workspace root')
+  for (let grew = true; grew;) {
+    grew = false
+    for (const n of [...names]) {
+      if (scanned.has(n)) continue
+      scanned.add(n)
+      grew = true
+      await scan(byName.get(n)!.dir, n)
+    }
+  }
+  const subset = [...names].map((n) => byName.get(n)!).sort((a, b) => a.name.localeCompare(b.name))
+  const rels = subset.map((p) => posix(path.relative(root, p.dir)))
+
+  const out = path.resolve(process.cwd(), args.outDir)
+  if (within(root, out)) {
+    throw new UserError(`vx prune: --out-dir ${args.outDir} is or contains the workspace root`)
+  }
+  for (const p of subset) {
+    if (within(out, p.dir)) {
+      throw new UserError(
+        `vx prune: --out-dir ${args.outDir} is inside ${p.name}, which the subset copies — pick a path outside it`,
+      )
+    }
+  }
+  const held = await readdir(out).then(
+    (entries) => entries.length > 0,
+    (err: NodeJS.ErrnoException) => err.code !== 'ENOENT',
+  )
+  if (held) {
+    throw new UserError(
+      `vx prune: --out-dir ${args.outDir} already has content — remove it or name an empty directory`,
+    )
+  }
+
+  const rootManifest = JSON.parse(await Bun.file(path.join(root, 'package.json')).text()) as Record<
+    string,
+    unknown
+  >
+  const field = rootManifest['workspaces']
+  const listed = Array.isArray(field)
+    ? (field as string[])
+    : ((field as { packages?: string[] } | undefined)?.packages ?? undefined)
+  const workspaces = listed?.includes('.') ? ['.', ...rels] : rels
+  if (listed !== undefined) {
+    rootManifest['workspaces'] = Array.isArray(field)
+      ? workspaces
+      : { ...(field as object), packages: workspaces }
+  }
+
+  const manifests = new Map<string, ReadonlyMap<string, string>>()
+  type Deps = Partial<Record<(typeof DEP_FIELDS)[number], Record<string, string>>>
+  const depsOf = (pkg: Deps): ReadonlyMap<string, string> =>
+    new Map(DEP_FIELDS.flatMap((f) => Object.entries(pkg[f] ?? {})))
+  manifests.set('.', depsOf(rootManifest as Deps))
+  for (const [i, p] of subset.entries()) manifests.set(rels[i]!, depsOf(p.packageJson))
+  const scope: PruneScope = {
+    dirs: new Set(['.', ...rels]),
+    members: new Set(projects.map((p) => posix(path.relative(root, p.dir)))),
+    workspaces,
+    manifests,
+  }
+
+  if (
+    (await exists(path.join(root, 'bun.lockb'))) &&
+    !(await exists(path.join(root, 'bun.lock')))
+  ) {
+    throw new UserError(
+      'vx prune: bun.lockb is binary and cannot be pruned — `bun install --save-text-lockfile` writes bun.lock',
+    )
+  }
+  const written = new Map<string, string>()
+  for (const [file, pruneLock] of Object.entries(LOCKFILES)) {
+    const src = path.join(root, file)
+    if (!(await exists(src))) continue
+    try {
+      written.set(file, pruneLock(await Bun.file(src).text(), scope))
+    } catch (err) {
+      throw new UserError(`vx prune: ${err instanceof Error ? err.message : String(err)}`)
+    }
+  }
+  const workspaceYaml = path.join(root, 'pnpm-workspace.yaml')
+  if (await exists(workspaceYaml)) {
+    written.set(
+      'pnpm-workspace.yaml',
+      rewriteWorkspaceYaml(await Bun.file(workspaceYaml).text(), rels),
+    )
+  }
+  // A manifest with no `workspaces` (pnpm's) is copied byte for byte.
+  if (listed !== undefined)
+    written.set('package.json', `${JSON.stringify(rootManifest, null, 2)}\n`)
+  const installFiles = [
+    ...(listed === undefined ? ['package.json'] : []),
+    ...INSTALL_FILES,
+    ...(await namedFiles(root, rootManifest)),
+  ]
+
+  const emit = async (dest: string, extra: readonly string[]): Promise<void> => {
+    await mkdir(dest, { recursive: true })
+    for (const [file, text] of written) await writeFile(path.join(dest, file), text)
+    for (const f of [...installFiles, ...extra]) {
+      const src = path.join(root, f)
+      if (!(await exists(src))) continue
+      await mkdir(path.dirname(path.join(dest, f)), { recursive: true })
+      await cp(src, path.join(dest, f), { recursive: true })
+    }
+  }
+  const full = args.docker ? path.join(out, 'full') : out
+  await emit(full, VX_FILES)
+  for (const [i, p] of subset.entries()) {
+    await cp(p.dir, path.join(full, rels[i]!), {
+      recursive: true,
+      filter: (src) => !COPY_EXCLUDES.has(path.basename(src)),
+    })
+  }
+  if (args.docker) {
+    const json = path.join(out, 'json')
+    await emit(json, [])
+    for (const rel of rels) {
+      await mkdir(path.join(json, rel), { recursive: true })
+      await cp(path.join(root, rel, 'package.json'), path.join(json, rel, 'package.json'))
+    }
+  }
+
+  const lockfiles = Object.keys(LOCKFILES).filter((f) => written.has(f))
+  process.stdout.write(
+    `vx prune: ${subset.length} project${subset.length === 1 ? '' : 's'} → ${args.outDir}` +
+      `${args.docker ? ' (json/ + full/)' : ''}` +
+      `${lockfiles.length > 0 ? `, ${lockfiles.join(', ')} pruned` : ''}\n` +
+      subset.map((p, i) => `  ${p.name} (${rels[i]})\n`).join(''),
+  )
+  for (const e of escapes) process.stderr.write(`vx prune: warning: ${e}\n`)
+  return 0
+}
+
+/** `packages:` cut to the subset's dirs; every other key as written. */
+function rewriteWorkspaceYaml(text: string, rels: readonly string[]): string {
+  const lines = text.split('\n')
+  const list = ['packages:', ...rels.map((r) => `  - ${JSON.stringify(r)}`)]
+  const at = lines.findIndex((l) => /^packages\s*:/.test(l))
+  if (at === -1) return [...list, ...lines].join('\n')
+  let end = at + 1
+  if (/^packages\s*:\s*$/.test(lines[at]!)) {
+    while (end < lines.length && (lines[end] === '' || /^[\s-]/.test(lines[end]!))) end++
+    while (end > at + 1 && lines[end - 1]!.trim() === '') end--
+  }
+  return [...lines.slice(0, at), ...list, ...lines.slice(end)].join('\n')
+}
+
+/**
+ * Root files the install config names: patch files (bun's and pnpm's
+ * `patchedDependencies`, in the manifest or pnpm-workspace.yaml) and
+ * Yarn's `yarnPath` and plugins. A path outside the root is not the
+ * workspace's to copy.
+ */
+async function namedFiles(root: string, manifest: Record<string, unknown>): Promise<string[]> {
+  const values = (v: unknown): unknown[] =>
+    v !== null && typeof v === 'object' ? Object.values(v as Record<string, unknown>) : []
+  const named: unknown[] = [
+    ...values(manifest['patchedDependencies']),
+    ...values((manifest['pnpm'] as Record<string, unknown> | undefined)?.['patchedDependencies']),
+  ]
+  const yaml = async (file: string): Promise<Record<string, unknown>> => {
+    const p = path.join(root, file)
+    if (!(await exists(p))) return {}
+    const doc: unknown = Bun.YAML.parse(await Bun.file(p).text())
+    return doc !== null && typeof doc === 'object' && !Array.isArray(doc)
+      ? (doc as Record<string, unknown>)
+      : {}
+  }
+  named.push(...values((await yaml('pnpm-workspace.yaml'))['patchedDependencies']))
+  const yarnrc = await yaml('.yarnrc.yml')
+  named.push(yarnrc['yarnPath'])
+  for (const p of Array.isArray(yarnrc['plugins']) ? yarnrc['plugins'] : []) {
+    named.push(typeof p === 'string' ? p : (p as Record<string, unknown> | null)?.['path'])
+  }
+  return named.filter(
+    (f): f is string =>
+      typeof f === 'string' && !path.isAbsolute(f) && !path.normalize(f).startsWith('..'),
+  )
+}

package/src/scope.ts

@@ -0,0 +1,11 @@
+/** What a lockfile is pruned to. Dirs are workspace-relative, POSIX, `.` the root. */
+export interface PruneScope {
+  /** The workspaces kept: the root and every pruned project. */
+  readonly dirs: ReadonlySet<string>
+  /** Every workspace project, kept or not: a path the lockfile reaches that is one of these and not kept is a broken subset. */
+  readonly members: ReadonlySet<string>
+  /** The root manifest's rewritten `workspaces` list. */
+  readonly workspaces: readonly string[]
+  /** Each kept dir's manifest dependencies (every bucket): yarn classic records no workspaces, so its walk starts here. */
+  readonly manifests: ReadonlyMap<string, ReadonlyMap<string, string>>
+}

package/src/yarn.ts

@@ -11,8 +11,11 @@
 // lockfile's root descriptors only, so a workspace's digest is the root's
 // reach through the descriptors the file resolves.
 
+import path from 'node:path'
 import { reachDigests } from '@vzn/vx'
 import { stable } from './pnpm.js'
+import { pruneEntries, yamlKey } from './blocks.js'
+import type { PruneScope } from './scope.js'
 
 export interface Lockfile {
   readonly generation: 'berry' | 'classic'
@@ -36,6 +39,8 @@ export interface Lockfile {
 
 export interface Entry {
   readonly deps: ReadonlyMap<string, string>
+  /** What the entry installs: `deps` less berry's peers, which its parent provides. */
+  readonly installs: ReadonlyMap<string, string>
   /** resolution + checksum / version + resolved + integrity */
   readonly resolution: string
 }
@@ -79,6 +84,7 @@ function parseBerry(text: string): Lockfile {
     )
     entries.set(resolution, {
       deps: depsOf(e, ['dependencies', 'peerDependencies']),
+      installs: depsOf(e, ['dependencies']),
       resolution: `${resolution}\0${stable(material)}`,
     })
     // Yarn joins a key's descriptors with ', '; a range's own trailing
@@ -136,6 +142,7 @@ function parseClassic(text: string): Lockfile {
     // to carry that edge, so each entry carries its own descriptors.
     entries.set(id, {
       deps,
+      installs: deps,
       resolution: `${fields['version'] ?? ''}\0${fields['resolved'] ?? ''}\0${fields['integrity'] ?? ''}\0${[...keys].sort().join(',')}`,
     })
     for (const k of keys) descriptors.set(k, id)
@@ -292,3 +299,54 @@ export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
   for (const [dir, id] of lock.workspaces) out.set(dir, fold(digests[index.get(id)!]!))
   return out
 }
+
+/**
+ * The lockfile cut to the entries the workspaces at `dirs` install, each
+ * entry's text as written. Berry walks from the kept workspace entries;
+ * classic records no workspaces, so its walk starts at each kept
+ * manifest's dependencies (a workspace sibling has no entry and is
+ * skipped).
+ */
+export function pruneLockfile(text: string, scope: PruneScope): string {
+  const { dirs, members, manifests } = scope
+  const lock = parseLockfile(text)
+  const reached = new Set<string>()
+  const visit = (id: string | undefined): void => {
+    if (id === undefined || reached.has(id)) return
+    const ws = id.indexOf('@workspace:')
+    const dir = ws === -1 ? undefined : id.slice(ws + '@workspace:'.length)
+    if (dir !== undefined && members.has(dir) && !dirs.has(dir)) {
+      throw new Error(`yarn.lock: ${id} is a workspace the subset leaves out`)
+    }
+    reached.add(id)
+    for (const [name, range] of lock.entries.get(id)!.installs) {
+      for (const target of resolveDescriptor(lock, id, name, range)) visit(target)
+    }
+  }
+  const berry = lock.generation === 'berry'
+  if (berry) {
+    for (const [dir, id] of lock.workspaces) if (dirs.has(dir)) visit(id)
+  } else {
+    for (const [dir, deps] of manifests) {
+      if (!dirs.has(dir)) continue
+      for (const [name, range] of deps) {
+        // Classic keys a workspace's `file:` / `link:` path from the root:
+        // `file:./vendor/x` in packages/a is `file:./packages/a/vendor/x`.
+        const local = /^(file|link):(?!\/)(.*)$/.exec(range)
+        const keyed =
+          local === null || dir === '.' ? range : `${local[1]}:./${path.posix.join(dir, local[2]!)}`
+        visit(lock.descriptors.get(`${name}@${keyed}`))
+      }
+    }
+  }
+  const lines = text.split('\n')
+  const first = (line: string): string =>
+    berry
+      ? yamlKey(line).split(',')[0]!.trimStart()
+      : unquote(line.replace(/:\s*$/, '').split(',')[0]!.trim())
+  return pruneEntries(lines, 0, lines.length, 0, (line) => {
+    if (line.startsWith('__metadata:')) return true
+    const id = lock.descriptors.get(first(line))
+    return id !== undefined && reached.has(id)
+  }).join('\n')
+}