feat: add auto-install-peers to opt out of auto-installing peer dependencies

lib/commands/ci.js

@@ -6,7 +6,11 @@ const fs = require('node:fs/promises')
 const path = require('node:path')
 const { log, time } = require('proc-log')
 const validateLockfile = require('../utils/validate-lockfile.js')
-const { validatePackageExtensions, validateNpmExtension } = require('../utils/validate-lockfile.js')
+const {
+  validateAutoInstalledPeers,
+  validatePackageExtensions,
+  validateNpmExtension,
+} = require('../utils/validate-lockfile.js')
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 const getWorkspaces = require('../utils/get-workspaces.js')
 
@@ -22,6 +26,7 @@ class CI extends ArboristWorkspaceCmd {
     'omit',
     'include',
     'strict-peer-deps',
+    'auto-install-peers',
     'foreground-scripts',
     'ignore-scripts',
     'allow-directory',
@@ -105,6 +110,9 @@ class CI extends ArboristWorkspaceCmd {
       errors.push(`Invalid: ${err.message}`)
     }
     errors.push(...validateNpmExtension(virtualArb.virtualTree, fileHash))
+    if (opts.autoInstallPeers === false) {
+      errors.push(...validateAutoInstalledPeers(virtualArb.virtualTree))
+    }
     if (errors.length) {
       throw this.usageError(
         '`npm ci` can only install packages when your package.json and package-lock.json are in sync. ' +

lib/commands/dedupe.js

@@ -12,6 +12,7 @@ class Dedupe extends ArboristWorkspaceCmd {
     'legacy-bundling',
     'global-style',
     'strict-peer-deps',
+    'auto-install-peers',
     'package-lock',
     'omit',
     'include',

lib/commands/find-dupes.js

@@ -8,6 +8,7 @@ class FindDupes extends ArboristWorkspaceCmd {
     'legacy-bundling',
     'global-style',
     'strict-peer-deps',
+    'auto-install-peers',
     'package-lock',
     'omit',
     'include',

lib/commands/install.js

@@ -25,6 +25,7 @@ class Install extends ArboristWorkspaceCmd {
     'omit',
     'include',
     'strict-peer-deps',
+    'auto-install-peers',
     'prefer-dedupe',
     'package-lock',
     'package-lock-only',

lib/commands/link.js

@@ -24,6 +24,7 @@ class Link extends ArboristWorkspaceCmd {
     'legacy-bundling',
     'global-style',
     'strict-peer-deps',
+    'auto-install-peers',
     'package-lock',
     'omit',
     'include',

lib/commands/update.js

@@ -19,6 +19,7 @@ class Update extends ArboristWorkspaceCmd {
     'omit',
     'include',
     'strict-peer-deps',
+    'auto-install-peers',
     'package-lock',
     'foreground-scripts',
     'ignore-scripts',

lib/utils/validate-lockfile.js

@@ -125,6 +125,14 @@ function validateNpmExtension (virtualTree, fileHash) {
   return []
 }
 
+// with `auto-install-peers=false`, a lockfile must not keep packages that were only added to satisfy a dependency's peer
+function validateAutoInstalledPeers (virtualTree) {
+  const { autoInstalledPeerNodes } = require('@npmcli/arborist')
+  return autoInstalledPeerNodes(virtualTree).map(node =>
+    `Invalid: lock file's ${node.name}@${node.version} is only an auto-installed peer dependency`)
+}
+
 module.exports = validateLockfile
 module.exports.validatePackageExtensions = validatePackageExtensions
 module.exports.validateNpmExtension = validateNpmExtension
+module.exports.validateAutoInstalledPeers = validateAutoInstalledPeers

smoke-tests/tap-snapshots/test/index.js.test.cjs

@@ -58,9 +58,10 @@ npm error Options:
 npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
 npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
 npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
-npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts]
-npm error [--allow-directory <all|none|root>] [--allow-file <all|none|root>]
-npm error [--allow-git <all|none|root>] [--allow-remote <all|none|root>]
+npm error [--strict-peer-deps] [--no-auto-install-peers] [--foreground-scripts]
+npm error [--ignore-scripts] [--allow-directory <all|none|root>]
+npm error [--allow-file <all|none|root>] [--allow-git <all|none|root>]
+npm error [--allow-remote <all|none|root>]
 npm error [--allow-scripts <package-list> [--allow-scripts <package-list> ...]]
 npm error [--strict-allow-scripts] [--dangerously-allow-all-scripts] [--no-audit]
 npm error [--no-bin-links] [--no-fund] [--dry-run]
@@ -85,6 +86,9 @@ npm error
 npm error   --strict-peer-deps
 npm error     If set to \`true\`, and \`--legacy-peer-deps\` is not set, then _any_
 npm error
+npm error   --auto-install-peers
+npm error     When set to \`false\`, npm does not add packages to the tree only to
+npm error
 npm error   --foreground-scripts
 npm error     Run all build scripts (ie, \`preinstall\`, \`install\`, and
 npm error

tap-snapshots/test/lib/commands/config.js.test.cjs

@@ -26,6 +26,7 @@ exports[`test/lib/commands/config.js TAP config list --json > output matches sna
   "also": null,
   "audit": true,
   "audit-level": null,
+  "auto-install-peers": true,
   "auth-type": "web",
   "before": null,
   "bin-links": true,
@@ -223,6 +224,7 @@ also = null
 audit = true
 audit-level = null
 auth-type = "web"
+auto-install-peers = true
 before = null
 bin-links = true
 browser = null