missing types for node and fs-extra since 8.4.0

[ivancuric]

Ever since 8.4.0, types for node and fs-extra aren't automatically installed.

Tested using pnpm 8.6.1:

pnpm-lock.yaml comparison:

  zx@8.3.2:
    optionalDependencies:
      '@types/fs-extra': 11.0.3
      '@types/node': 20.8.8

  /zx@8.4.1:
    resolution: {integrity: sha512-1Cb+Tfwt/daKV6wckBeDbB6h3IMauqj9KWp+EcbYzi9doeJeIHCktxp/yWspXOXRdoUzBCQSKoUgm3g8r9fz5A==}
    engines: {node: '>= 12.17.0'}
    hasBin: true
    dev: false

[antongolub]

Hey @ivancuric,

Correct, we've moved @types/node to devDeps. There're several points than led us to this decision.

1. Size does matter. The whole full-featured non minified zx bundle with 3rd party deps and assets is about 850 Kb, but @types/fs-extra + @types/node require ~2.5 Mb extra.
   https://packagephobia.com/result?p=zx@8.3.2

2. How do I decide whether @types/* goes into dependencies or devDependencies? is a long discussion. We share this view:
   Dependencies are what you absolutely need in a production build (e.g. axios, redux), other packages are devDependencies (e.g. types, testing, typescript).
   zx does not require TypeScript to work, so we should not force @types/node to be installed. Especially if zx is used via npx zx script.js

3. Seems like a generic lib dev practice: fast-glob or execa do the same, runtime-specific types should be installed on user's side only when needed.

4. Unpredictable side effects in corner cases.
   https://github.com/web-infra-dev/rslib/pull/289/files/bf87a72c45b624082aee0f7641f773cb0e852700#diff-294bd10db07c43b10b4271610c9181fa32e67317ac9a373f495793f0ce8441f2

[ivancuric]

Hey @antongolub ! Thanks for the extremely detailed response.

First of all, I had no idea that the types were 2.5mb. That's insane.

However, as far as I see zx does have actual dependencies exposed in the API, even though they are bundled, and these are listed in https://google.github.io/zx/api. These are node-fetch-native, readline, glob, which, ps, envapi, minimist, chalk, @webpod/ps fs-extra, os and yaml.

These are imported in the src/vendor*.ts files and exported in the API, and as such should be listed as dependencies, as they are part of the runtime code, or at least as peerDependencies. Some of the dependencies like globby are licenced under the MIT licence which require attribution and including the copyright notice.

As it currently stands, zx is published as a package with zero dependencies of any kind which is misleading. fast-glob and execa, which you listed, correctly list and install their deps and peer deps, including @types/node in the dev dependencies.

Additionally, every other bundled npm package has bundled types except fs-extra.

[antongolub]

As it currently stands, zx is published as a package with zero dependencies of any kind which is misleading
That's correct statement, imo — all the necessary code is in the package. Previously I've published a short note on the zx bundling approach:

• esbuild produces mjs & cjs assets and preserves licence info.
• dts-bundle-generator extracts nested libdefs and persists them as zx package's own.

[ivancuric]

Yeah I get it. These two type bundles are huge. Would be nice if there was a method in package managers to optionally install these.

As for attribution, the licencing information is not preserved for most 3rd party deps, only those by jonschlinkert.

[antongolub]

License comments... To be honest, we've never checked how this esbuild feature works. Perhaps we should verify it somehow or/and add own license digest generation.

[antongolub]

#1140