Lint / repair use of dependencies that are available as capabilities

[jonathanj]

Firstly, dep-check has been extremely helpful for our React Native monorepo, thank you so much! ❤️

I have read through the documentation, and source code, and didn't see the use case I'm looking for: If a dependency is added via yarn add (perhaps out of habit, or not knowing that a capability exists), that version will not be managed by dep-check since the capability is missing.

I'm not sure I have considered enough concrete cases to suggest that this be fixed automatically, but having a command that will fail if a dependency—that also exists as a capability—exists in the manifest without the capability. I tried to build this myself using capabilitiesFor, but this gives an exhaustive list of capabilities and transient capabilities, whereas what I'm looking for are the minimal set of capabilities that satisfy all the dependencies.

I hope that explanation makes sense. I understand if this is not something you want to add to dep-check, but some discussion how I might be able to implement this would be greatly appreciated (hopefully without reimplementing all of the capability-walking code myself), or what pathological cases I haven't considered.

[tido64]

Hi @jonathanj, I'm glad you find it useful ❤️

This sounds similar to #933. Let me know if I've misunderstood your request.

I think we want this to show up in "vigilant" mode. If you have a configured package, running in "vigilant" mode will also check unmanaged dependencies, e.g.:

error Found 1 violation(s) in 'package.json':
	react-native-webview "^11.0.0" -> "^11.22.6" (devDependencies)

But we probably want to change the messaging to something like:

error Found 1 violation(s) in 'package.json':
	react-native-webview "^11.0.0" -> "^11.22.6" (unmanaged capability: 'webview')

That would at least give you the capability name to add. I think we can fix this automatically in "vigilant" mode without breaking any usage scenarios I can think of. cc @kelset in case I'm missing something.

We're in the middle of a mini-rewrite at the moment (progress: #1890) so things are changing very quickly. If you're interested in contributing, I would wait until we are closer to publishing 2.0.

If you're interested in looking ahead, you can now find the code under packages/align-deps. My initial idea is to look for a way to add metadata to the profile we are building in buildManifestProfile:

rnx-kit/packages/align-deps/src/commands/vigilant.ts

Lines 50 to 58 in 1430592

	/**
	* Builds a package manifest containing _all_ capabilities from profiles that
	* satisfy the specified requirements.
	* @returns A package manifest containing all capabilities
	*/
	export function buildManifestProfile(
	manifestPath: string,
	{ kitType, alignDeps }: AlignDepsConfig
	): ManifestProfile {

If a dependency is misaligned, we want to know which capability is missing:

rnx-kit/packages/align-deps/src/commands/vigilant.ts

Lines 152 to 157 in 1430592

	if (isMisaligned(from, to)) {
	changes.push({ name, from, to, section });
	if (write) {
	dependencies[name] = to;
	}
	}

[jonathanj]

@tido64 Thank you so much for such a detailed reply! That sounds like it would cover my case even better than I'd hoped, and that 2.0 is shaping up to be quite an exciting release. Excellent news. 👏

[tido64]

FYI: #2204

[jonathanj]

That's a fantastic new feature, thanks for remembering to loop me in!