feat(lockfile): add package-lock.json support

zkat · iarna · commit ba50bdb0f0bb · 2017-05-25T16:13:47.000-07:00
This implements #16441 as well as the auto-save behavior it needs in order to be kept up to date.
diff --git a/lib/install.js b/lib/install.js
@@ -279,11 +279,9 @@ Installer.prototype.run = function (_cb) {
       [this, this.commit, staging, this.todo],
 
       [this, this.runPostinstallTopLevelLifecycles],
-      [this, this.finishTracker, 'runTopLevelLifecycles'])
-    if (getSaveType(this.args)) {
-      postInstallSteps.push(
-        [this, this.saveToDependencies])
-    }
+      [this, this.finishTracker, 'runTopLevelLifecycles'],
+      [this, this.saveToDependencies]
+    )
   }
   postInstallSteps.push(
     [this, this.printWarnings],
diff --git a/lib/install/read-shrinkwrap.js b/lib/install/read-shrinkwrap.js
@@ -1,25 +1,45 @@
 'use strict'
-var path = require('path')
-var fs = require('graceful-fs')
-var iferr = require('iferr')
-var inflateShrinkwrap = require('./inflate-shrinkwrap.js')
-var parseJSON = require('../utils/parse-json.js')
 
-var readShrinkwrap = module.exports = function (child, next) {
+const BB = require('bluebird')
+
+const fs = require('graceful-fs')
+const iferr = require('iferr')
+const inflateShrinkwrap = require('./inflate-shrinkwrap.js')
+const log = require('npmlog')
+const parseJSON = require('../utils/parse-json.js')
+const path = require('path')
+
+const readFileAsync = BB.promisify(fs.readFile)
+
+module.exports = readShrinkwrap
+function readShrinkwrap (child, next) {
   if (child.package._shrinkwrap) return process.nextTick(next)
-  fs.readFile(path.join(child.path, 'npm-shrinkwrap.json'), function (er, data) {
-    if (er) {
-      child.package._shrinkwrap = null
-      return next()
+  BB.join(
+    readLockfile('npm-shrinkwrap.json', child),
+    // Don't read non-root lockfiles
+    !child.parent && readLockfile('package-lock.json', child),
+    (shrinkwrap, lockfile) => {
+      if (shrinkwrap && lockfile) {
+        log.warn('read-shrinkwrap', 'Ignoring package-lock.json because there is already an npm-shrinkwrap.json. Please use only one of the two.')
+      }
+      if (shrinkwrap || lockfile) {
+        try {
+          child.package._shrinkwrap = parseJSON(shrinkwrap || lockfile)
+        } catch (ex) {
+          child.package._shrinkwrap = null
+          throw ex
+        }
+      } else {
+        child.package._shrinkwrap = null
+      }
     }
-    try {
-      child.package._shrinkwrap = parseJSON(data)
-    } catch (ex) {
-      child.package._shrinkwrap = null
-      return next(ex)
-    }
-    return next()
-  })
+  ).then(() => next(), next)
+}
+
+function readLockfile (name, child) {
+  return readFileAsync(
+    path.join(child.path, name)
+  ).catch({code: 'ENOENT'}, () => null)
 }
 
 module.exports.andInflate = function (child, next) {
diff --git a/lib/install/save.js b/lib/install/save.js
@@ -1,17 +1,20 @@
 'use strict'
-var fs = require('graceful-fs')
-var path = require('path')
-var writeFileAtomic = require('write-file-atomic')
-var log = require('npmlog')
-var iferr = require('iferr')
-var validate = require('aproba')
-var without = require('lodash.without')
-var npm = require('../npm.js')
-var deepSortObject = require('../utils/deep-sort-object.js')
-var parseJSON = require('../utils/parse-json.js')
-var moduleName = require('../utils/module-name.js')
-var isDevDep = require('./is-dev-dep.js')
-var createShrinkwrap = require('../shrinkwrap.js').createShrinkwrap
+
+const BB = require('bluebird')
+
+const createShrinkwrap = require('../shrinkwrap.js').createShrinkwrap
+const deepSortObject = require('../utils/deep-sort-object.js')
+const fs = BB.promisifyAll(require('graceful-fs'))
+const iferr = require('iferr')
+const isDevDep = require('./is-dev-dep.js')
+const log = require('npmlog')
+const moduleName = require('../utils/module-name.js')
+const npm = require('../npm.js')
+const parseJSON = require('../utils/parse-json.js')
+const path = require('path')
+const validate = require('aproba')
+const without = require('lodash.without')
+const writeFileAtomic = require('write-file-atomic')
 
 // if the -S|--save option is specified, then write installed packages
 // as dependencies to a package.json file.
@@ -40,30 +43,28 @@ function andWarnErrors (cb) {
 
 function saveShrinkwrap (tree, next) {
   validate('OF', arguments)
-  var saveTarget = path.resolve(tree.path, 'npm-shrinkwrap.json')
-  fs.stat(saveTarget, function (er, stat) {
-    if (er) return next()
-    var save = npm.config.get('save')
-    var saveDev = npm.config.get('save-dev')
-    var saveOptional = npm.config.get('save-optional')
-
-    var shrinkwrap = tree.package._shrinkwrap || {dependencies: {}}
-    var shrinkwrapHasAnyDevOnlyDeps = tree.requires.some(function (dep) {
-      var name = moduleName(dep)
-      return isDevDep(tree, name) &&
-             shrinkwrap.dependencies[name] != null
-    })
+  var save = npm.config.get('save')
+  var saveDev = npm.config.get('save-dev')
+  var saveOptional = npm.config.get('save-optional')
+
+  var shrinkwrap = tree.package._shrinkwrap || {dependencies: {}}
+  var shrinkwrapHasAnyDevOnlyDeps = tree.requires.some(function (dep) {
+    var name = moduleName(dep)
+    return isDevDep(tree, name) &&
+    shrinkwrap.dependencies[name] != null
+  })
 
-    if (!saveOptional && saveDev && !shrinkwrapHasAnyDevOnlyDeps) return next()
-    if (saveOptional || !(save || saveDev)) return next()
+  if (!saveOptional && saveDev && !shrinkwrapHasAnyDevOnlyDeps) return next()
+  if (saveOptional || !(save || saveDev)) return next()
 
-    var silent = false
-    createShrinkwrap(tree.path, tree.package, shrinkwrapHasAnyDevOnlyDeps, silent, next)
-  })
+  var silent = false
+  createShrinkwrap(tree.path, tree.package, shrinkwrapHasAnyDevOnlyDeps, silent, next)
 }
 
 function savePackageJson (args, tree, next) {
   validate('AOF', arguments)
+  if (!args || !args.length) { return next() }
+
   var saveBundle = npm.config.get('save-bundle')
 
   // each item in the tree is a top-level thing that should be saved
diff --git a/lib/shrinkwrap.js b/lib/shrinkwrap.js
@@ -1,31 +1,37 @@
-// emit JSON describing versions of all packages currently installed (for later
-// use with shrinkwrap install)
-
-module.exports = exports = shrinkwrap
-
-var path = require('path')
-var log = require('npmlog')
-var writeFileAtomic = require('write-file-atomic')
-var iferr = require('iferr')
-var readPackageJson = require('read-package-json')
-var readPackageTree = require('read-package-tree')
-var validate = require('aproba')
-var chain = require('slide').chain
-var npm = require('./npm.js')
-var recalculateMetadata = require('./install/deps.js').recalculateMetadata
-var validatePeerDeps = require('./install/deps.js').validatePeerDeps
-var isExtraneous = require('./install/is-extraneous.js')
-var packageId = require('./utils/package-id.js')
-var moduleName = require('./utils/module-name.js')
-var output = require('./utils/output.js')
-var lifecycle = require('./utils/lifecycle.js')
-var isDevDep = require('./install/is-dev-dep.js')
-var isProdDep = require('./install/is-prod-dep.js')
-var isOptDep = require('./install/is-opt-dep.js')
+'use strict'
+
+const BB = require('bluebird')
+
+const chain = require('slide').chain
+const iferr = require('iferr')
+const isDevDep = require('./install/is-dev-dep.js')
+const isExtraneous = require('./install/is-extraneous.js')
+const isOptDep = require('./install/is-opt-dep.js')
+const isProdDep = require('./install/is-prod-dep.js')
+const fs = BB.promisifyAll(require('graceful-fs'))
+const lifecycle = require('./utils/lifecycle.js')
+const log = require('npmlog')
+const moduleName = require('./utils/module-name.js')
+const move = require('move-concurrently')
+const npm = require('./npm.js')
+const packageId = require('./utils/package-id.js')
+const path = require('path')
+const readPackageJson = require('read-package-json')
+const readPackageTree = require('read-package-tree')
+const recalculateMetadata = require('./install/deps.js').recalculateMetadata
 const ssri = require('ssri')
+const validate = require('aproba')
+const validatePeerDeps = require('./install/deps.js').validatePeerDeps
+const writeFileAtomic = require('write-file-atomic')
+
+const SHRINKWRAP = 'npm-shrinkwrap.json'
+const PKGLOCK = 'package-lock.json'
 
+// emit JSON describing versions of all packages currently installed (for later
+// use with shrinkwrap install)
 shrinkwrap.usage = 'npm shrinkwrap'
 
+module.exports = exports = shrinkwrap
 function shrinkwrap (args, silent, cb) {
   if (typeof cb !== 'function') {
     cb = silent
@@ -39,9 +45,18 @@ function shrinkwrap (args, silent, cb) {
   var packagePath = path.join(npm.localPrefix, 'package.json')
   var prod = npm.config.get('production') || /^prod/.test(npm.config.get('only'))
 
-  readPackageJson(packagePath, iferr(cb, function (pkg) {
-    createShrinkwrap(npm.localPrefix, pkg, !prod, silent, cb)
-  }))
+  move(
+    path.resolve(npm.prefix, PKGLOCK),
+    path.resolve(npm.prefix, SHRINKWRAP),
+    { Promise: BB }
+  ).then(() => {
+    log.notice('', `${PKGLOCK} has been renamed to ${SHRINKWRAP}. ${SHRINKWRAP} will be used for future installations.`)
+    cb()
+  }).catch({code: 'ENOENT'}, () => {
+    readPackageJson(packagePath, iferr(cb, function (pkg) {
+      createShrinkwrap(npm.localPrefix, pkg, !prod, silent, cb)
+    }))
+  })
 }
 
 module.exports.createShrinkwrap = createShrinkwrap
@@ -101,10 +116,6 @@ function shrinkwrapDeps (dev, problems, deps, tree, seen) {
   })
   tree.children.sort(function (aa, bb) { return moduleName(aa).localeCompare(moduleName(bb)) }).forEach(function (child) {
     var childIsOnlyDev = isOnlyDev(child)
-    if (!dev && childIsOnlyDev) {
-      log.warn('shrinkwrap', 'Excluding devDependency: %s', child.location)
-      return
-    }
     var pkginfo = deps[moduleName(child)] = {}
     pkginfo.version = child.package.version
     if (child.package._inBundle) {
@@ -153,14 +164,33 @@ function save (pkginfo, silent, cb) {
     return cb(er)
   }
 
-  var file = path.resolve(npm.prefix, 'npm-shrinkwrap.json')
+  BB.join(
+    checkShrinkwrap(SHRINKWRAP),
+    checkShrinkwrap(PKGLOCK),
+    (shrinkwrap, lockfile) => {
+      const file = (
+        shrinkwrap ||
+        lockfile ||
+        path.resolve(npm.prefix, PKGLOCK)
+      )
+      writeFileAtomic(file, swdata, (err) => {
+        if (err) return cb(err)
+        if (silent) return cb(null, pkginfo)
+        if (!shrinkwrap && !lockfile) {
+          log.notice('', `created a lockfile as ${path.basename(file)}. You should commit this file.`)
+        }
+        cb(null, pkginfo)
+      })
+    }
+  ).then((file) => {
+  }, cb)
+}
 
-  writeFileAtomic(file, swdata, function (er) {
-    if (er) return cb(er)
-    if (silent) return cb(null, pkginfo)
-    output('wrote npm-shrinkwrap.json')
-    cb(null, pkginfo)
-  })
+function checkShrinkwrap (name) {
+  const file = path.resolve(npm.prefix, name)
+  return fs.lstatAsync(
+    file
+  ).then(() => file).catch({code: 'ENOENT'}, () => {})
 }
 
 // Returns true if the module `node` is only required direcctly as a dev
diff --git a/lib/utils/tar.js b/lib/utils/tar.js
@@ -124,7 +124,9 @@ BundledPacker.prototype.applyIgnores = function (entry, partial, entryObj) {
       entry.match(/^\..*\.swp$/) ||
       entry === '.DS_Store' ||
       entry.match(/^\._/) ||
-      entry.match(/^.*\.orig$/)
+      entry.match(/^.*\.orig$/) ||
+      // Package locks are never allowed in tarballs -- use shrinkwrap instead
+      entry === 'package-lock.json'
     ) {
     return false
   }
diff --git a/lib/version.js b/lib/version.js
