fix(compile): prune managed npm snapshot to graph-reachable packages (#34741)

## Summary

`deno compile` used to embed the full managed npm resolution snapshot
(everything in the lockfile / package.json). Packages that were
resolved (e.g. via `deno.json` `imports` or `package.json`
`dependencies`) but never imported by the entrypoint were still
bundled into the executable, inflating its size considerably.

This PR adds an opt-in flag, `--exclude-unused-npm`, that reduces the
resolution snapshot to the closure of packages reachable from npm
specifiers in the module graph. Because non-statically-analyzable
dynamic imports won't appear in the graph, the optimization is
opt-in so the default behavior keeps the full snapshot and continues
to work for those cases (as discussed in #29338). Users with such
dynamic imports can still pass `--include npm:<pkg>` alongside the
flag to force inclusion.

The same pruning path is still taken implicitly under
`--unstable-npm-lazy-caching` (no change there).

## Test plan

- [x] New spec test `tests/specs/compile/compile_exclude_unused_npm`
      mirrors the existing `unstable_npm_lazy_caching` test but uses
      the new flag, confirming the unused `@denotest/subtract` package
      is no longer embedded.
- [x] Existing `unstable_npm_lazy_caching` and
      `npm_pkgs_lockfile_unused` tests continue to express the
      intended behavior unchanged.

Closes #21504

Closes denoland/divybot#437

---------

Co-authored-by: divybot <divybot@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Divy Srivastava <me@littledivy.com>

Author: 3 people

cli/args/flags.rs

@@ -224,6 +224,11 @@ pub struct CompileFlags {
   pub bundle: bool,
   /// Minify the bundle. Only meaningful with `bundle: true`.
   pub minify: bool,
+  /// Prune the embedded managed npm snapshot to only those packages reachable
+  /// from npm specifiers in the module graph. Opt-in because non-statically
+  /// analyzable dynamic imports may not appear in the graph; pass
+  /// `--include npm:<pkg>` for any such packages.
+  pub exclude_unused_npm: bool,
 }
 
 impl CompileFlags {
@@ -3071,6 +3076,17 @@ On the first invocation of `deno compile`, Deno will download the relevant binar
           .requires("bundle")
           .help_heading(COMPILE_HEADING),
       )
+      .arg(
+        Arg::new("exclude-unused-npm")
+          .long("exclude-unused-npm")
+          .help(cstr!("Embed only the npm packages reachable from the module graph (managed npm; no <c>node_modules</> directory).
+  <p(245)>Without this flag the full managed npm snapshot from the lockfile / package.json is embedded.
+  Reduces binary size when the lockfile contains packages the entrypoint does not import.
+  Skips packages that are only reached through non-statically-analyzable dynamic imports;
+  pass those with <c>--include npm:<<pkg></> if needed.</>"))
+          .action(ArgAction::SetTrue)
+          .help_heading(COMPILE_HEADING),
+      )
       .arg(watch_arg(false))
       .arg(watch_exclude_arg())
       .arg(no_clear_screen_arg())
@@ -6970,6 +6986,7 @@ fn compile_parse(
   let self_extracting = matches.get_flag("self-extracting");
   let bundle = matches.get_flag("bundle");
   let minify = matches.get_flag("minify");
+  let exclude_unused_npm = matches.get_flag("exclude-unused-npm");
   let include = matches
     .remove_many::<String>("include")
     .map(|f| f.collect::<Vec<_>>())
@@ -6996,6 +7013,7 @@ fn compile_parse(
     self_extracting,
     bundle,
     minify,
+    exclude_unused_npm,
   });
 
   Ok(())
@@ -13700,6 +13718,7 @@ mod tests {
           self_extracting: false,
           bundle: false,
           minify: false,
+          exclude_unused_npm: false,
         }),
         type_check_mode: TypeCheckMode::Local,
         code_cache_enabled: true,
@@ -13738,6 +13757,7 @@ mod tests {
           self_extracting: false,
           bundle: false,
           minify: false,
+          exclude_unused_npm: false,
         }),
         type_check_mode: TypeCheckMode::Local,
         code_cache_enabled: true,
@@ -13768,6 +13788,7 @@ mod tests {
           self_extracting: false,
           bundle: false,
           minify: false,
+          exclude_unused_npm: false,
         }),
         import_map_path: Some("import_map.json".to_string()),
         no_remote: true,
@@ -16369,6 +16390,7 @@ Usage: deno lint [OPTIONS] [files]...\n"
           self_extracting: false,
           bundle: false,
           minify: false,
+          exclude_unused_npm: false,
         }),
         type_check_mode: TypeCheckMode::Local,
         preload: svec!["p1.js", "./p2.js"],

cli/standalone/binary.rs

@@ -434,7 +434,13 @@ impl<'a> DenoCompileBinaryWriter<'a> {
         CliNpmResolver::Managed(managed) => {
           if graph.modules().any(|m| m.npm().is_some()) {
             let snapshot = managed.resolution().snapshot();
-            let snapshot = if self.cli_options.unstable_npm_lazy_caching() {
+            // When the user opts in (or via the existing unstable lazy-caching
+            // path), prune the resolution snapshot to packages reachable from
+            // npm specifiers in the graph. Otherwise embed the full snapshot
+            // so non-statically-analyzable dynamic imports keep working.
+            let snapshot = if compile_flags.exclude_unused_npm
+              || self.cli_options.unstable_npm_lazy_caching()
+            {
               let reqs = graph
                 .specifiers()
                 .filter_map(|(s, _)| {

cli/tools/compile.rs

@@ -1269,6 +1269,7 @@ mod test {
         self_extracting: false,
         bundle: false,
         minify: false,
+        exclude_unused_npm: false,
       },
       &initial_cwd,
     );
@@ -1298,6 +1299,7 @@ mod test {
         self_extracting: false,
         bundle: false,
         minify: false,
+        exclude_unused_npm: false,
       },
       &resolve_cwd(None).unwrap(),
     )
@@ -1333,6 +1335,7 @@ mod test {
         self_extracting: false,
         bundle: false,
         minify: false,
+        exclude_unused_npm: false,
       },
       &resolve_cwd(None).unwrap(),
     )

cli/tools/installer/global.rs

@@ -375,6 +375,7 @@ async fn install_global_compiled(
     self_extracting: false,
     bundle: false,
     minify: false,
+    exclude_unused_npm: false,
   };
 
   let mut new_flags = flags.as_ref().clone();

tests/specs/compile/compile_exclude_unused_npm/__test__.jsonc

@@ -0,0 +1,13 @@
+{
+  "tempDir": true,
+  "steps": [
+    {
+      "args": "install",
+      "output": "[WILDCARD]"
+    },
+    {
+      "args": "compile -A --exclude-unused-npm --output out main.ts",
+      "output": "compile.out"
+    }
+  ]
+}

tests/specs/compile/compile_exclude_unused_npm/compile.out

@@ -0,0 +1,10 @@
+[WILDCARD]
+
+Embedded Files
+
+[# Note that this doesn't have @denotest/subtract — only @denotest/add is imported.]
+[WILDLINE]
+├── .deno_compile_node_modules/localhost/@denotest/add/* ([WILDLINE])
+└── main.ts ([WILDLINE])
+
+[WILDCARD]

tests/specs/compile/compile_exclude_unused_npm/deno.json

@@ -0,0 +1,6 @@
+{
+  "imports": {
+    "@denotest/add": "npm:@denotest/add",
+    "@denotest/subtract": "npm:@denotest/subtract"
+  }
+}

tests/specs/compile/compile_exclude_unused_npm/main.ts

@@ -0,0 +1,2 @@
+import { add } from "@denotest/add";
+console.log(add);