save yarn output to DB with fully resolved dependency versions

[g-k]

When yarn.lock is present it doesn't require a full install to list deps. That's good!
However, yarn --list --json outputs jsonlines with the child constraint and not the fully resolved package version (e.g. ["babel-messages@6.23.0",[{"name":"babel-runtime@^6.22.0","color":"dim","shadow":true}]] from .data | .trees[] | [.name,.children] jq filter) . That's not so good! It complicates things for us.

We've taken the approach of storing fully resolved versions for edges between the package nodes, so we don't have to replicate how each language and package manager resolves dependencies (in code or the DB), and would like to continue doing so.

A few options:

• replicate semver and other version matching in the DB or postprocessing code (if yarn uses a subset of full semver and it's fairly stable and not ambiguous that might not be too bad e.g. we can link

["glogg@1.0.2",[{"name":"sparkles@^1.0.0","color":"dim","shadow":true}],0]
["sparkles@1.0.1",[],0]

without a problem)

• possibly reuse the depth field from the children
• run a full install and examine things on disk