Gathering detailed insights and metrics for @alcalzone/pak
Gathering detailed insights and metrics for @alcalzone/pak
Gathering detailed insights and metrics for @alcalzone/pak
Gathering detailed insights and metrics for @alcalzone/pak
npm install @alcalzone/pak
Module System
Min. Node Version
Typescript Support
Node Version
NPM Version
4 Stars
50 Commits
3 Forks
2 Watching
1 Branches
2 Contributors
Updated on 21 Jun 2024
Minified
Minified + Gzipped
TypeScript (96.56%)
JavaScript (3.44%)
Cumulative downloads
Total Downloads
Last day
-27.7%
1,972
Compared to previous day
Last week
7%
19,508
Compared to previous week
Last month
-5.7%
107,484
Compared to previous month
Last year
24.2%
1,094,962
Compared to previous year
23
Programmatic wrapper around popular Node.js package managers
Supports:
npm
Yarn Classic
Yarn Berry
(not all features are available for all package managers)
1import { detectPackageManager } from "pak"; 2 3async function main() { 4 // Use the current working directory 5 const pak = await detectPackageManager(); 6 7 // Or use a different directory. The package manager will default to that dir 8 const pak = await detectPackageManager({ cwd: "/path/to/dir" }); 9}
detectPackageManager
takes an options object with the following properties:
1{ 2 /** The working directory for the package manager. Detection will start from here upwards. */ 3 cwd?: string; 4 /** Whether to change the `cwd` to operate in the package's root directory instead of the current one. */ 5 setCwdToPackageRoot?: boolean; 6 /** If this is `false` and no package manager with a matching lockfile was found, another pass is done without requiring one */ 7 requireLockfile?: boolean; 8}
1import { packageManagers } from "pak"; 2const pak = new packageManagers.npm();
All package managers share the following properties:
Property | Type | Description |
---|---|---|
cwd | string | The directory to run the package manager commands in. Defaults to process.cwd() |
loglevel | "info" | "verbose" | "warn" | "error" | "silent" | Which loglevel to pass to the package manager. Note: Not every package manager supports every loglevel. |
stdout | WritableStream | A stream to pipe the command's stdout into. |
stderr | WritableStream | A stream to pipe the command's stderr into. |
stdall | WritableStream | A stream to pipe the command's stdout and stderr into in the order the output comes. |
environment | `"production" | "development"` |
1const result = await pak.install(packages, options);
packages
is an array of package specifiers, like ["pak", "fs-extra"]
or ["semver@1.2.3"]
options
: See common options for details.If packages
is empty or undefined
, this will install the packages that are defined in package.json
in the cwd
.
1const result = await pak.uninstall(packages, options);
packages
is an array of package specifiers, like ["pak", "fs-extra"]
or ["semver@1.2.3"]
options
: See common options for details.1const result = await pak.update(packages, options);
packages
is an array of package names, like ["pak", "fs-extra"]
. If no packages are given, all packages in the current workspace are updated.options
: See common options for details.1const result = await pak.rebuild(packages, options);
packages
is an array of package names, like ["pak", "fs-extra"]
. If no packages are given, all packages in the current workspace are rebuilt.options
: See common options for details.1const result = await pak.overrideDependencies(overrides);
overrides
is an object of packages and exact versions, like {"pak": "1.2.3"}
Sometimes it is necessary to update transitive dependencies, meaning dependencies of dependencies. This command changes all occurences of the given overridden dependencies in the current node_modules
tree so that the packages have the specified versions. How it works depends on the package manager:
yarn
uses the built-in "resolutions"
property for package.json
npm
patches the root package-lock.json
and package.json
for all dependents of the overridden packagesNote: This command does not support version ranges and it does not check whether the overrides are compatible with the version specified in package.json
.
The returned value is an object with the following properties:
1interface CommandResult { 2 /** Whether the command execution was successful */ 3 success: boolean; 4 /** The exit code of the command execution */ 5 exitCode: number; 6 /** The captured stdout */ 7 stdout: string; 8 /** The captured stderr */ 9 stderr: string; 10}
These options are used to influence the commands' behavior. All options are optional:
Option | Type | Description | Default | Commands |
---|---|---|---|---|
dependencyType | "prod" | "dev" | Whether to install a production or dev dependency. | "prod" | all |
global | boolean | Whether to install the package globally. | false | all |
exact | boolean | Whether exact versions should be used instead of "^ver.si.on" . | false | install |
ignoreScripts | boolean | Prevent execution of pre/post/install scripts. | false | install |
force | boolean | Pass the --force flag to the package manager where applicable. The specific behavior depends on the package manager. | false | install |
additionalArgs | string[] | Additional command line args to pass to the underlying package manager. | none | install , uninstall |
package.json
1await pak.findRoot(); 2await pak.findRoot("lockfile.json");
Returns a string with a path to the nearest parent directory (including cwd
) that contains a package.json
(and a lockfile if one was specified). Throws if none was found.
You can stream the command output (stdout
, stderr
or both) during the command execution, as opposed to getting the entire output at the end. To do so,
set the stdout
, stderr
and/or stdall
properties of the package manager instance to a writable stream. Example:
1import { PassThrough } from "stream"; 2import { packageManagers } from "../../src/index"; 3 4const pak = new packageManagers.npm(); // or the automatically detected one 5pak.stdall = new PassThrough().on("data", (data) => { 6 // For example, log to console - or do something else with the data 7 console.log(data.toString("utf8")); 8}); 9 10// execute commands
1const version = await pak.version();
Returns a string with the package manager's version.
1const workspaces = await pak.workspaces();
Returns an array of strings including the paths of all workspaces in the current monorepo. This will return an empty array if the current directory is not part of a monorepo.
A folder will be considered a workspace if it contains a file package.json
and it is referenced in the workspaces
property of the root package.json
.
1const result = await pak.pack(options);
options
are optional and control what gets packed where and has the following shape:
1interface PackOptions { 2 /** 3 * In monorepos, this determines which workspace to pack. Defaults to the current working directory. 4 * This must be a path relative to the repo root. 5 */ 6 workspace?: string; 7 /** Where to save the packed tarball. Defaults to the current working directory */ 8 targetDir?: string; 9}
result
is a CommandResult
(see above) where the stdout
contains the absolute path of the packed tarball.
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
Reason
Found 1/30 approved changesets -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
Reason
security policy file not detected
Details
Reason
project is not fuzzed
Details
Reason
branch protection not enabled on development/release branches
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Reason
19 existing vulnerabilities detected
Details
Score
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More