installing a package from a monorepo

Reproduce the failure with apps/app1/package.json and the npx build-layer command using the npm runner. Start by tracing dependency installation and the checkForUnsafeStrings/isValidOutput path; done should include local monorepo packages being usable through the proposed npm pack flow and clearer output/dir help.

Hello! Thank you for this amazing package!

It works great, but there is a tiny problem with packages inside a monorepo.

Let's say I have one big project - monorepo1, and there are packages/pkg1 and apps/app1, and my app1 has in its package.json these deps:

{
  "name": "@my-org/app1",
  ...
  "dependencies": {
    "@my-org/pkg1": "^0.0.1",
    "debug": "^4.4.0"
  },
  ...
}

The package pkg1 is private, it is a part of the monorepo, and it is not published to NPM (neither to any other custom registries), so when I run npx build-layer SharedLayer --files=apps/app1/package.json --debug --runner=npm --output=./ I see this error:

🕹 lambda-layer:installDeps:debug: Error: Command failed: npm install --prefix ././SharedLayer/nodejs debug@^4.4.0 @my-org/pkg1@^0.0.1 -S
npm ERR! code E404
npm ERR! 404 Not Found - GET https://registry.npmjs.org/@my-org/pkg1 - Not found
npm ERR! 404 
npm ERR! 404  '@my-org/pkg1@^0.0.1' is not in this registry.

I know it should happen because npm in fact does not handle well this situation, the best thing npm can do here - is create a symlink (since we are in a monorepo).

The reason I'm writing all this: the description of build-lambda-layer says: "+ Monorepo support", but I still can use it out of the box for my monorepo.

After some investigation, I got this solution: npm pack and then - install the tgz of the package. The only non trivial thing: detect "local" monorepo's packages in the list of dependencies, pack then and replace the "name of package" with "name of tgz of the package" before running the package-manager.

What do you think about adding this functionality to build-lambda-layer? With your guidance, I could try to push a PR for this

PS: also, --output is a weird option. Without output it fails in checkForUnsafeStrings when it makes assertion for isValidOutput, but output-option (or variable out) works almost just like dir. So maybe i can clarify the "help", to explain why and how "output" and "dir" works?