Implement equivalent of Python's PIP's REQUESTED

[paololazzari]

When working with Python, it's possible to determine which package was originally installed by the user by checking for the presence of the REQUESTED file.

For instance:

$ pip install -t package requests
$ ls package/charset_normalizer-3.1.0.dist-info/REQUESTED
ls: package/charset_normalizer-3.1.0.dist-info/REQUESTED: No such file or directory
$ ls package/requests-2.30.0.dist-info/REQUESTED
package/requests-2.30.0.dist-info/REQUESTED

so then one can determine that the requests was installed explicitly, whereas charset_normalizer wasn't.

---

How can one do the same with npm ?

[ljharb]

Typically that's not something one interrogates; you just run npm ci (or delete node_modules and run npm install) and end up with only stuff due to what's listed in package.json.

What's your use case?

[paololazzari]

I have a node_modules folder and from it I would like to be able to determine the minimal set of libraries one would have to install to replicate it

[ljharb]

npm install --package-lock-only will create a lockfile from package.json, but npm installs simply aren't deterministic enough to be able to do what you want reliably.

[paololazzari]

I don't have a package.json file, I only have a node_modules folder.

Would this be difficult to add? It would be helpful for the same reasons outlined here pypa/pip#7811

[ljharb]

Yes, I suspect that the nondeterminism - especially based on install time and available versions - of node_modules means that it is an impossible thing to do correctly, which means it's better not attempted.

[ljharb]

Does node_modules/.package.json exist? if so that's a form of lockfile you could use. Otherwise you may be SOL.

[paololazzari]

How hard is it to parse the command line the user provides and use that to later create a REQUESTED file?

[ljharb]

I suppose that's something it could do moving forward - but it'd then only work for a node_modules that was fully installed using an npm version that had that feature.

In that case, I'd suggest filing an RRFC issue on https://github.com/npm/rfcs, since the CLI repo doesn't take feature requests.

[paololazzari]

RRFC link: npm/rfcs#693