|
| 1 | +/** |
| 2 | + * Checks that the published package has no runtime dependencies. |
| 3 | + * |
| 4 | + * "Zero dependencies" is a claim a stranger can verify in ten seconds on |
| 5 | + * Bundlephobia, so it has to be exactly true. It was not: ng-packagr's default |
| 6 | + * template declares `tslib`, and version 0.0.2 shipped declaring it even though |
| 7 | + * the built code never imported it. Bundlephobia reported "1 dependency" beside |
| 8 | + * a README that said none. |
| 9 | + * |
| 10 | + * Two things can make the claim false, so this checks both: |
| 11 | + * |
| 12 | + * 1. package.json declares something under `dependencies`. |
| 13 | + * 2. The built code imports a module that is not a declared peer — which is |
| 14 | + * how a dependency sneaks in without anyone adding it on purpose, for |
| 15 | + * instance a TypeScript helper imported from tslib. |
| 16 | + * |
| 17 | + * Run it after `npm run build:lib`: |
| 18 | + * |
| 19 | + * npm run verify:deps |
| 20 | + */ |
| 21 | +import { readFileSync, readdirSync } from 'node:fs'; |
| 22 | +import { dirname, join, resolve } from 'node:path'; |
| 23 | +import { fileURLToPath } from 'node:url'; |
| 24 | + |
| 25 | +const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..'); |
| 26 | +const DIST = join(ROOT, 'dist/masonry-angular'); |
| 27 | + |
| 28 | +const pkg = JSON.parse(readFileSync(join(DIST, 'package.json'), 'utf8')); |
| 29 | +const peers = Object.keys(pkg.peerDependencies ?? {}); |
| 30 | +const problems = []; |
| 31 | + |
| 32 | +// 1. Declared dependencies. |
| 33 | +const declared = Object.keys(pkg.dependencies ?? {}); |
| 34 | +if (declared.length > 0) { |
| 35 | + problems.push(`package.json declares dependencies: ${declared.join(', ')}`); |
| 36 | +} |
| 37 | + |
| 38 | +// 2. What the shipped code actually imports. |
| 39 | +const fesm = join(DIST, 'fesm2022'); |
| 40 | +const imported = new Map(); |
| 41 | +for (const file of readdirSync(fesm).filter((f) => f.endsWith('.mjs'))) { |
| 42 | + const code = readFileSync(join(fesm, file), 'utf8'); |
| 43 | + for (const [, spec] of code.matchAll(/(?:from|import)\s*\(?\s*['"]([^'"]+)['"]/g)) { |
| 44 | + if (spec.startsWith('.')) continue; // internal |
| 45 | + // `@scope/name/sub` and `name/sub` both belong to their package. |
| 46 | + const name = spec.startsWith('@') ? spec.split('/').slice(0, 2).join('/') : spec.split('/')[0]; |
| 47 | + if (name === pkg.name) continue; // a secondary entry point importing the primary |
| 48 | + if (!imported.has(name)) imported.set(name, new Set()); |
| 49 | + imported.get(name).add(file); |
| 50 | + } |
| 51 | +} |
| 52 | + |
| 53 | +for (const [name, files] of imported) { |
| 54 | + if (!peers.includes(name)) { |
| 55 | + problems.push(`${[...files].join(', ')} imports '${name}', which is not a declared peer`); |
| 56 | + } |
| 57 | +} |
| 58 | + |
| 59 | +console.log('verify:deps — the published package must have no runtime dependencies.\n'); |
| 60 | +console.log(` declared dependencies ${declared.length ? declared.join(', ') : 'none'}`); |
| 61 | +console.log(` modules imported ${[...imported.keys()].join(', ') || 'none'}`); |
| 62 | +console.log(` declared peers ${peers.join(', ')}`); |
| 63 | + |
| 64 | +if (problems.length > 0) { |
| 65 | + console.log('\nFAIL'); |
| 66 | + for (const p of problems) console.log(` - ${p}`); |
| 67 | + process.exit(1); |
| 68 | +} |
| 69 | +console.log('\nOK — every import is a declared peer, and nothing else is required.'); |
0 commit comments