@vzn/vx-lockfile 0.0.631 → 0.0.633

package/README.md

@@ -52,7 +52,7 @@ The claim, the per-project key, the memo and the `--affected` diff are core's `l
 Declaring any of the four plugins adds `vx prune` (the `commands` seam): the workspace cut to some projects and their transitive workspace dependencies, for a Docker build that installs and builds only what it ships — `turbo prune`.
 
 ```sh
-vx prune <project...> [--out-dir <dir>] [--docker]
+vx prune <project...> [--out-dir <dir>] [--docker] [--production]
 ```
 
 The out dir (default `out/`, relative to the cwd) gets the root `package.json` with `workspaces` rewritten to the subset's dirs (a glob character in a dir name bracketed, `a[1]` → `a[[]1]`, so the pattern matches that dir alone), `pnpm-workspace.yaml` with `packages` rewritten (every other key as written), each lockfile at the root **pruned** to what the subset installs, the install config (`.npmrc`, `.yarnrc.yml`, `.pnpmfile.cjs`, `bunfig.toml`, `.nvmrc`, `.node-version`, the patch files `patchedDependencies` names, Yarn's `yarnPath` and plugins), `vx.workspace.*`, the root `vx.config.*`, and each project directory less `node_modules`, `.git`, `.vx` and `.turbo`. A workspace package a copied vx config imports (a local plugin) comes along with its closure: the config loads before any task. A relative config import that leaves the subset is warned about. `--docker` writes `json/` — the root install files and each project's `package.json`, the cacheable install layer — and `full/`, everything:
@@ -66,6 +66,8 @@ RUN bunx vx run app#build
 
 The pruned lockfile is the source with whole entries cut, in the package manager's own layout, so it installs with a frozen lockfile (`bun install --frozen-lockfile`, `pnpm install --frozen-lockfile`, `npm ci`, `yarn install --immutable`) and a line only another project reaches no longer busts the install layer. Kept: the root's and each kept workspace's entries and every package they reach — through Bun's and npm's hoisted walk (a package stays at the path it held; nothing is re-hoisted), pnpm's snapshots, Yarn's descriptors. Workspace-wide fields (catalogs, overrides, patches, settings, `trustedDependencies`) stay whole: the root manifest still names them. pnpm's env document stays whole. Yarn classic records no workspaces, so its walk starts at each kept manifest's dependencies.
 
+`--production` follows no `devDependencies` edge between workspace packages: a package only a dev dependency reaches is left out (`turbo prune --production`). Each kept manifest, the root's too, loses the `devDependencies` entries naming one, its field gone when it empties, and every lockfile drops the same entries: bun's and npm's workspace records, pnpm's importer (`{}` when it empties), Yarn berry's `workspace:` link in the workspace entry; Yarn classic walks the stripped manifests. A name another field also holds is installed in production and stays. Third-party dev dependencies stay in the lockfile: an install with `--production` / `--omit=dev` / `--prod` skips them. For the stage that runs a built app, not the one that builds it.
+
 Refused, with the reason: an out dir that is or contains the root, one inside a copied project, one that already has content; a project name the workspace lacks (the root is always kept); `bun.lockb` without `bun.lock` (binary — `bun install --save-text-lockfile`). A `file:` or `link:` dependency outside every copied project is not copied. One plugin or four, there is one `prune`: it prunes every lockfile at the root.
 
 ## Testing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-lockfile",
-  "version": "0.0.631",
+  "version": "0.0.633",
   "license": "MIT",
   "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer; `vx prune` cuts the workspace and the lockfile to a Docker subset.",
   "keywords": [
@@ -37,7 +37,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.631"
+    "@vzn/vx": "^0.0.633"
   },
   "repository": {
     "type": "git",

package/src/bun.ts

@@ -11,7 +11,7 @@
 // Bun.JSONC is the parser: no dependency, and the file is Bun's own.
 
 import { reachDigests } from '@vzn/vx'
-import { depsOf, record, type Json } from './json.js'
+import { depsOf, devOnly, dropDev, record, type Json } from './json.js'
 import type { PruneScope } from './scope.js'
 
 export interface Lockfile {
@@ -243,7 +243,7 @@ export function importerDigests(
  * field as written — catalogs, overrides, patches and trusted
  * dependencies are the workspace's, and the root manifest still names them.
  */
-export function pruneLockfile(text: string, { dirs }: PruneScope): string {
+export function pruneLockfile(text: string, { dirs, dropped }: PruneScope): string {
   const lock = parseLockfile(text)
   const doc = Bun.JSONC.parse(text) as Json
   const reached = new Set<string>()
@@ -260,16 +260,26 @@ export function pruneLockfile(text: string, { dirs }: PruneScope): string {
     }
     for (const name of entry.deps.keys()) visit(resolve(lock, key, name))
   }
+  const workspaces = record(doc['workspaces']) ?? {}
+  const skip = new Map<string, Set<string>>()
+  for (const [dir, manifest] of Object.entries(workspaces)) {
+    const key = dir === '' ? '.' : dir
+    if (!dirs.has(key)) {
+      delete workspaces[dir]
+      continue
+    }
+    const names = devOnly(record(manifest), dropped)
+    skip.set(key, names)
+    dropDev(record(manifest), names)
+  }
   for (const [dir, deps] of lock.workspaces) {
     if (!dirs.has(dir)) continue
     let from = ''
     for (const [name, wsDir] of lock.workspaceDirs) if (wsDir === dir && dir !== '.') from = name
     if (from !== '') visit(from)
-    for (const name of deps.keys()) visit(resolve(lock, from, name))
+    const gone = skip.get(dir)
+    for (const name of deps.keys()) if (gone?.has(name) !== true) visit(resolve(lock, from, name))
   }
-  const workspaces = record(doc['workspaces']) ?? {}
-  for (const dir of Object.keys(workspaces))
-    if (!dirs.has(dir === '' ? '.' : dir)) delete workspaces[dir]
   const packages = record(doc['packages']) ?? {}
   for (const key of Object.keys(packages)) if (!reached.has(key)) delete packages[key]
   return writeLockfile(doc)

package/src/json.ts

@@ -23,3 +23,25 @@ export function depsOf(
 export function record(v: unknown): Json | undefined {
   return v !== null && typeof v === 'object' && !Array.isArray(v) ? (v as Json) : undefined
 }
+
+/**
+ * The `dropped` names a manifest (or a lockfile's record of one) names
+ * ONLY as devDependencies: an entry another field also holds is installed
+ * in production and stays.
+ */
+export function devOnly(manifest: Json | undefined, dropped: ReadonlySet<string>): Set<string> {
+  const out = new Set<string>()
+  const dev = record(manifest?.['devDependencies'])
+  if (dev === undefined || dropped.size === 0) return out
+  const elsewhere = depsOf(manifest!, ['dependencies', 'optionalDependencies', 'peerDependencies'])
+  for (const name of Object.keys(dev)) if (dropped.has(name) && !elsewhere.has(name)) out.add(name)
+  return out
+}
+
+/** `manifest`'s devDependencies without `names`; the field goes when nothing is left. */
+export function dropDev(manifest: Json | undefined, names: ReadonlySet<string>): void {
+  const dev = record(manifest?.['devDependencies'])
+  if (manifest === undefined || dev === undefined || names.size === 0) return
+  for (const name of names) delete dev[name]
+  if (Object.keys(dev).length === 0) delete manifest['devDependencies']
+}

package/src/npm.ts

@@ -8,7 +8,7 @@
 // ancestor directory's, else `node_modules/d` — Node's own walk.
 
 import { reachDigests } from '@vzn/vx'
-import { depsOf, record, type Json } from './json.js'
+import { depsOf, devOnly, dropDev, record, type Json } from './json.js'
 import type { PruneScope } from './scope.js'
 
 export interface Lockfile {
@@ -147,9 +147,18 @@ export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
  * same paths.
  */
 export function pruneLockfile(text: string, scope: PruneScope): string {
-  const { dirs, members, workspaces } = scope
+  const { dirs, members, workspaces, dropped } = scope
   const lock = parseLockfile(text)
   const doc = JSON.parse(text) as Json
+  const packages = record(doc['packages'])!
+  // What production struck from each kept workspace's manifest, struck from its entry too.
+  const skip = new Map<string, Set<string>>()
+  for (const p of Object.keys(packages)) {
+    if (!dirs.has(p === '' ? '.' : p)) continue
+    const names = devOnly(record(packages[p]), dropped)
+    skip.set(p, names)
+    dropDev(record(packages[p]), names)
+  }
   const reached = new Set<string>()
   const visit = (p: string | undefined): void => {
     if (p === undefined || reached.has(p)) return
@@ -159,13 +168,13 @@ export function pruneLockfile(text: string, scope: PruneScope): string {
     }
     reached.add(p)
     if (e.link !== undefined) return visit(lock.packages.has(e.link) ? e.link : undefined)
-    for (const name of e.deps.keys()) visit(resolve(lock, p, name))
+    const gone = skip.get(p)
+    for (const name of e.deps.keys()) if (gone?.has(name) !== true) visit(resolve(lock, p, name))
   }
   for (const [p, e] of lock.packages) {
     const linked = e.link !== undefined && dirs.has(e.link)
     if (linked || dirs.has(p === '' ? '.' : p)) visit(p)
   }
-  const packages = record(doc['packages'])!
   for (const p of Object.keys(packages)) if (!reached.has(p)) delete packages[p]
   const rootEntry = record(packages[''])
   if (rootEntry?.['workspaces'] !== undefined) rootEntry['workspaces'] = [...workspaces]

package/src/pnpm.ts

@@ -12,8 +12,8 @@
 // Bun.YAML is the parser: no dependency, and the file is plain YAML.
 
 import { reachDigests } from '@vzn/vx'
-import { pruneSections } from './blocks.js'
-import { record } from './json.js'
+import { pruneEntries, pruneSections, yamlKey } from './blocks.js'
+import { devOnly, record } from './json.js'
 import type { PruneScope } from './scope.js'
 
 export interface Lockfile {
@@ -283,13 +283,23 @@ function buildGraph(lock: Lockfile): Graph {
  * overrides and settings are the workspace's, and the subset's manifests
  * still name them. A multi-document lockfile keeps the env document whole.
  */
-export function pruneLockfile(text: string, { dirs }: PruneScope): string {
+export function pruneLockfile(text: string, { dirs, dropped }: PruneScope): string {
   const marker = [...text.matchAll(/^---[ \t]*$/gm)].at(-1)
   const cut = marker === undefined ? 0 : marker.index + marker[0].length
   const lock = parseLockfile(text)
+  // What production struck from each kept importer's manifest.
+  const skip = new Map<string, Set<string>>()
+  if (dropped.size > 0) {
+    const docs: unknown = Bun.YAML.parse(text)
+    const doc = record(Array.isArray(docs) ? docs.at(-1) : docs)
+    for (const [dir, entry] of Object.entries(record(doc?.['importers']) ?? {})) {
+      if (dirs.has(dir)) skip.set(dir, devOnly(record(entry), dropped))
+    }
+  }
   const reached = new Set<string>()
-  const visit = (dir: string, deps: ReadonlyMap<string, string>): void => {
+  const visit = (dir: string, deps: ReadonlyMap<string, string>, importer = false): void => {
     for (const [name, version] of deps) {
+      if (importer && skip.get(dir)?.has(name) === true) continue
       if (version.startsWith('link:')) {
         const target = joinPosix(dir, version.slice('link:'.length))
         if (lock.importers.has(target) && !dirs.has(target)) {
@@ -303,19 +313,71 @@ export function pruneLockfile(text: string, { dirs }: PruneScope): string {
       visit('.', lock.snapshots.get(key) ?? new Map())
     }
   }
-  for (const [dir, deps] of lock.importers) if (dirs.has(dir)) visit(dir, deps)
+  for (const [dir, deps] of lock.importers) if (dirs.has(dir)) visit(dir, deps, true)
   const v9 = Number.parseInt(lock.version, 10) >= 9
   const packages = new Set([...reached].map((key) => (v9 ? packageKey(key) : key)))
   return (
     text.slice(0, cut) +
-    pruneSections(text.slice(cut), {
-      importers: (dir) => dirs.has(dir),
-      packages: (key) => packages.has(key),
-      snapshots: (key) => reached.has(key),
-    })
+    dropImporterDev(
+      pruneSections(text.slice(cut), {
+        importers: (dir) => dirs.has(dir),
+        packages: (key) => packages.has(key),
+        snapshots: (key) => reached.has(key),
+      }),
+      skip,
+    )
   )
 }
 
+/**
+ * Each importer's `devDependencies` without the `dropped` names, cut as
+ * lines like every other prune: the subsection goes when it empties, and
+ * an importer left with nothing is `{}`, as pnpm writes one.
+ */
+function dropImporterDev(text: string, skip: ReadonlyMap<string, ReadonlySet<string>>): string {
+  if (![...skip.values()].some((s) => s.size > 0)) return text
+  const lines = text.split('\n')
+  const start = lines.findIndex((l) => /^importers:\s*$/.test(l))
+  if (start === -1) return text
+  let end = start + 1
+  while (end < lines.length && !/^\S/.test(lines[end]!)) end++
+  const indented = (l: string, n: number): boolean =>
+    l.startsWith(' '.repeat(n)) && /^[^\s#]/.test(l.slice(n))
+  const out = lines.slice(0, start + 1)
+  let i = start + 1
+  while (i < end) {
+    if (!indented(lines[i]!, 2)) {
+      out.push(lines[i++]!)
+      continue
+    }
+    const key = i
+    const dropped = skip.get(yamlKey(lines[key]!)) ?? new Set<string>()
+    let stop = i + 1
+    while (stop < end && !indented(lines[stop]!, 2)) stop++
+    const body: string[] = []
+    for (let j = key + 1; j < stop;) {
+      if (lines[j] !== '    devDependencies:') {
+        body.push(lines[j++]!)
+        continue
+      }
+      let sub = j + 1
+      while (sub < stop && (lines[sub]!.trim() === '' || /^ {5,}/.test(lines[sub]!))) sub++
+      const kept = pruneEntries(lines, j + 1, sub, 6, (l) => !dropped.has(yamlKey(l)))
+      if (kept.some((l) => indented(l, 6))) body.push(lines[j]!, ...kept)
+      else body.push(...kept.filter((l) => l.trim() === ''))
+      j = sub
+    }
+    const emptied = !body.some((l) => indented(l, 4)) && stop - key - 1 > body.length
+    const entry = !emptied
+      ? [lines[key]!, ...body]
+      : [`${lines[key]!.replace(/:\s*$/, '')}: {}`, ...body.filter((l) => l.trim() === '')]
+    out.push(...entry)
+    i = stop
+  }
+  out.push(...lines.slice(end))
+  return out.join('\n')
+}
+
 /** `packages/a` + `../b` → `packages/b`; `.` + `packages/a` → `packages/a`. POSIX, as the lockfile writes paths. */
 function joinPosix(base: string, rel: string): string {
   const parts: string[] = []

package/src/prune.ts

@@ -1,9 +1,12 @@
-// `vx prune <project...> [--out-dir <dir>] [--docker]`: the workspace cut to
+// `vx prune <project...> [--out-dir <dir>] [--docker] [--production]`: the workspace cut to
 // the named projects and their transitive workspace dependencies, for a
 // Docker build that installs and builds only what it ships (`turbo prune`).
 // Every lockfile here is cut to what the subset installs, so the copy
 // installs with a frozen lockfile and a lockfile line the subset cannot
-// reach does not bust the install layer.
+// reach does not bust the install layer. `--production` follows no
+// devDependencies edge between workspace packages: a package only a dev
+// dependency pulls in is left out, and the kept manifests and lockfile no
+// longer name it (`turbo prune --production`).
 //
 //   <out>/            the subset (with --docker: <out>/full/)
 //     package.json      `workspaces` rewritten to the subset's dirs
@@ -31,7 +34,7 @@ import * as pnpmLock from './pnpm.js'
 import * as yarnLock from './yarn.js'
 import type { PruneScope } from './scope.js'
 
-const USAGE = 'usage: vx prune <project...> [--out-dir <dir>] [--docker]'
+const USAGE = 'usage: vx prune <project...> [--out-dir <dir>] [--docker] [--production]'
 
 const LOCKFILES: Readonly<Record<string, (text: string, scope: PruneScope) => string>> = {
   'pnpm-lock.yaml': pnpmLock.pruneLockfile,
@@ -70,16 +73,19 @@ interface Args {
   readonly projects: readonly string[]
   readonly outDir: string
   readonly docker: boolean
+  readonly production: boolean
 }
 
 function parseArgs(argv: readonly string[]): Args | null {
   const projects: string[] = []
   let outDir = 'out'
   let docker = false
+  let production = false
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i]!
     if (a === '--help' || a === '-h') return null
     if (a === '--docker') docker = true
+    else if (a === '--production') production = true
     else if (a === '--out-dir' || a.startsWith('--out-dir=')) {
       const v = a === '--out-dir' ? argv[++i] : a.slice('--out-dir='.length)
       if (v === undefined || v === '')
@@ -93,7 +99,7 @@ function parseArgs(argv: readonly string[]): Args | null {
     else projects.push(a)
   }
   if (projects.length === 0) throw new UserError(`vx prune: name at least one project\n${USAGE}`)
-  return { projects, outDir, docker }
+  return { projects, outDir, docker, production }
 }
 
 async function exists(p: string): Promise<boolean> {
@@ -123,7 +129,14 @@ export async function prune(argv: readonly string[], ctx: CommandContext): Promi
       `vx prune: no project named ${unknown.map((n) => JSON.stringify(n)).join(', ')} (the root is always kept; name the projects under it)`,
     )
   }
-  const graph = buildPackageGraph(projects)
+  // Production: the graph without dev edges, so a package reached only
+  // through a devDependencies entry is never added. The linking rules are
+  // the graph's own either way.
+  const graph = buildPackageGraph(
+    args.production
+      ? projects.map((p) => ({ ...p, packageJson: { ...p.packageJson, devDependencies: {} } }))
+      : projects,
+  )
   const names = new Set<string>()
   const add = (name: string): void => {
     if (names.has(name) || !byName.has(name)) return
@@ -207,17 +220,43 @@ export async function prune(argv: readonly string[], ctx: CommandContext): Promi
       : { ...(field as object), packages: workspaces }
   }
 
+  // Production: each kept manifest (the root's too) without the
+  // devDependencies entries naming a workspace package the subset leaves
+  // out, written over the copy; the lockfiles drop the same entries.
+  const dropped = new Set<string>()
+  const rewritten = new Map<string, Record<string, unknown>>()
+  if (args.production) {
+    const strip = (rel: string, pkg: Record<string, unknown>): void => {
+      const dev = record(pkg['devDependencies'])
+      const gone = Object.keys(dev ?? {}).filter((n) => byName.has(n) && !names.has(n))
+      if (dev === undefined || gone.length === 0) return
+      for (const n of gone) dropped.add(n)
+      const { devDependencies: _, ...rest } = pkg
+      const kept = Object.entries(dev).filter(([n]) => !gone.includes(n))
+      rewritten.set(
+        rel,
+        kept.length === 0 ? rest : { ...pkg, devDependencies: Object.fromEntries(kept) },
+      )
+    }
+    strip('.', rootManifest)
+    for (const [i, p] of subset.entries()) {
+      strip(rels[i]!, JSON.parse(await Bun.file(path.join(p.dir, 'package.json')).text()))
+    }
+  }
   const manifests = new Map<string, ReadonlyMap<string, string>>()
   type Deps = Partial<Record<(typeof DEP_FIELDS)[number], Record<string, string>>>
   const depsOf = (pkg: Deps): ReadonlyMap<string, string> =>
     new Map(DEP_FIELDS.flatMap((f) => Object.entries(pkg[f] ?? {})))
-  manifests.set('.', depsOf(rootManifest as Deps))
-  for (const [i, p] of subset.entries()) manifests.set(rels[i]!, depsOf(p.packageJson))
+  manifests.set('.', depsOf((rewritten.get('.') ?? rootManifest) as Deps))
+  for (const [i, p] of subset.entries()) {
+    manifests.set(rels[i]!, depsOf((rewritten.get(rels[i]!) ?? p.packageJson) as Deps))
+  }
   const scope: PruneScope = {
     dirs: new Set(['.', ...rels]),
     members: new Set(projects.map((p) => posix(path.relative(root, p.dir)))),
     workspaces,
     manifests,
+    dropped,
   }
 
   if (
@@ -245,11 +284,12 @@ export async function prune(argv: readonly string[], ctx: CommandContext): Promi
       rewriteWorkspaceYaml(await Bun.file(workspaceYaml).text(), patterns),
     )
   }
-  // A manifest with no `workspaces` (pnpm's) is copied byte for byte.
-  if (listed !== undefined)
-    written.set('package.json', `${JSON.stringify(rootManifest, null, 2)}\n`)
+  // A manifest with no `workspaces` (pnpm's) is copied byte for byte
+  // unless production rewrote it.
+  const rootOut = rewritten.get('.') ?? (listed !== undefined ? rootManifest : undefined)
+  if (rootOut !== undefined) written.set('package.json', `${JSON.stringify(rootOut, null, 2)}\n`)
   const installFiles = [
-    ...(listed === undefined ? ['package.json'] : []),
+    ...(rootOut === undefined ? ['package.json'] : []),
     ...INSTALL_FILES,
     ...(await namedFiles(root, rootManifest)),
   ]
@@ -272,12 +312,22 @@ export async function prune(argv: readonly string[], ctx: CommandContext): Promi
       filter: (src) => !COPY_EXCLUDES.has(path.basename(src)),
     })
   }
+  const manifestText = (rel: string): string | undefined => {
+    const pkg = rel === '.' ? undefined : rewritten.get(rel)
+    return pkg === undefined ? undefined : `${JSON.stringify(pkg, null, 2)}\n`
+  }
+  for (const rel of rels) {
+    const text = manifestText(rel)
+    if (text !== undefined) await writeFile(path.join(full, rel, 'package.json'), text)
+  }
   if (args.docker) {
     const json = path.join(out, 'json')
     await emit(json, [])
     for (const rel of rels) {
       await mkdir(path.join(json, rel), { recursive: true })
-      await cp(path.join(root, rel, 'package.json'), path.join(json, rel, 'package.json'))
+      const text = manifestText(rel)
+      if (text !== undefined) await writeFile(path.join(json, rel, 'package.json'), text)
+      else await cp(path.join(root, rel, 'package.json'), path.join(json, rel, 'package.json'))
     }
   }
 
@@ -285,6 +335,7 @@ export async function prune(argv: readonly string[], ctx: CommandContext): Promi
   process.stdout.write(
     `vx prune: ${subset.length} project${subset.length === 1 ? '' : 's'} → ${args.outDir}` +
       `${args.docker ? ' (json/ + full/)' : ''}` +
+      `${args.production ? ' (production)' : ''}` +
       `${lockfiles.length > 0 ? `, ${lockfiles.join(', ')} pruned` : ''}\n` +
       subset.map((p, i) => `  ${p.name} (${rels[i]})\n`).join(''),
   )

package/src/scope.ts

@@ -8,4 +8,10 @@ export interface PruneScope {
   readonly workspaces: readonly string[]
   /** Each kept dir's manifest dependencies (every bucket): yarn classic records no workspaces, so its walk starts here. */
   readonly manifests: ReadonlyMap<string, ReadonlyMap<string, string>>
+  /**
+   * Workspace package names `--production` struck from the kept manifests'
+   * devDependencies: the lockfile's kept workspaces stop naming them too.
+   * Empty otherwise.
+   */
+  readonly dropped: ReadonlySet<string>
 }

package/src/yarn.ts

@@ -293,7 +293,12 @@ export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
  * skipped).
  */
 export function pruneLockfile(text: string, scope: PruneScope): string {
-  const { dirs, members, manifests } = scope
+  const { dirs, members, manifests, dropped } = scope
+  // Berry merges a workspace's dev dependencies into its entry's
+  // `dependencies`, so a struck name is told by its link: a dropped
+  // workspace package is reached through a `workspace:` range.
+  const isDropped = (name: string, range: string): boolean =>
+    dropped.has(name) && range.startsWith('workspace:')
   const lock = parseLockfile(text)
   const reached = new Set<string>()
   const visit = (id: string | undefined): void => {
@@ -304,13 +309,23 @@ export function pruneLockfile(text: string, scope: PruneScope): string {
       throw new Error(`yarn.lock: ${id} is a workspace the subset leaves out`)
     }
     reached.add(id)
+    const kept = dir !== undefined && dirs.has(dir)
     for (const [name, range] of lock.entries.get(id)!.installs) {
+      if (kept && isDropped(name, range)) continue
       for (const target of resolveDescriptor(lock, id, name, range)) visit(target)
     }
   }
   const berry = lock.generation === 'berry'
+  // Berry records a workspace's dev dependencies in its entry's
+  // `dependencies`; classic records no workspace, and its manifests are
+  // already stripped.
+  const keptWorkspaces = new Set<string>()
   if (berry) {
-    for (const [dir, id] of lock.workspaces) if (dirs.has(dir)) visit(id)
+    for (const [dir, id] of lock.workspaces) {
+      if (!dirs.has(dir)) continue
+      keptWorkspaces.add(id)
+      visit(id)
+    }
   } else {
     for (const [dir, deps] of manifests) {
       if (!dirs.has(dir)) continue
@@ -329,9 +344,28 @@ export function pruneLockfile(text: string, scope: PruneScope): string {
     berry
       ? yamlKey(line).split(',')[0]!.trimStart()
       : unquote(line.replace(/:\s*$/, '').split(',')[0]!.trim())
-  return pruneEntries(lines, 0, lines.length, 0, (line) => {
+  const pruned = pruneEntries(lines, 0, lines.length, 0, (line) => {
     if (line.startsWith('__metadata:')) return true
     const id = lock.descriptors.get(first(line))
     return id !== undefined && reached.has(id)
-  }).join('\n')
+  })
+  if (!berry || dropped.size === 0) return pruned.join('\n')
+  const out: string[] = []
+  let inKept = false
+  for (let i = 0; i < pruned.length; i++) {
+    const line = pruned[i]!
+    if (/^\S/.test(line)) inKept = keptWorkspaces.has(lock.descriptors.get(first(line)) ?? '')
+    if (!inKept || line !== '  dependencies:') {
+      out.push(line)
+      continue
+    }
+    const deps: string[] = []
+    while (i + 1 < pruned.length && pruned[i + 1]!.startsWith('    ')) deps.push(pruned[++i]!)
+    const kept = deps.filter((l) => {
+      const [name, range] = Object.entries(record(Bun.YAML.parse(l.trim())) ?? {})[0] ?? []
+      return name === undefined || !isDropped(name, String(range))
+    })
+    if (kept.length > 0) out.push(line, ...kept)
+  }
+  return out.join('\n')
 }