update: re-enable updating local packages

.npmignore

@@ -4,7 +4,7 @@ npm-debug.log
 /.github
 /test
 node_modules/marked
-node_modules/ronn
+node_modules/marked-man
 node_modules/tap
 node_modules/.bin
 node_modules/npm-registry-mock

AUTHORS

@@ -619,3 +619,6 @@ Beni von Cheni <benjaminlchen@gmail.com>
 Frédéric Harper <fharper@npmjs.com>
 Johannes Würbach <johannes.wuerbach@googlemail.com>
 ƇʘƁ̆ąƇ́ <anchnk@users.noreply.github.com>
+Eli Doran <eli@elidoran.com>
+Tobias Koppers <tobias.koppers@googlemail.com>
+Grey Baker <greysteil@gmail.com>

CHANGELOG.md

@@ -1,3 +1,66 @@
+## v6.8.0 (2019-01-31):
+
+This release includes an implementation of [RFC #10](https://github.com/npm/rfcs/blob/latest/accepted/0010-monorepo-subdirectory-declaration.md), documenting an optional field that can be used to specify
+the directory path for a package within a monorepo.
+
+### NEW FEATURES
+
+* [`3663cdef2`](https://github.com/npm/cli/commit/3663cdef205fa9ba2c2830e5ef7ceeb31c30298c)
+  [#140](https://github.com/npm/cli/pull/140)
+  Update package.json docs to include repository.directory details.
+  ([@greysteil](https://github.com/greysteil))
+
+### BUGFIXES
+
+* [`550bf703a`](https://github.com/npm/cli/commit/550bf703ae3e31ba6a300658ae95b6937f67b68f)
+  Add @types to ignore list to fix git clean -fd.
+  ([@zkat](https://github.com/zkat))
+* [`cdb059293`](https://github.com/npm/cli/commit/cdb0592939d6256c80f7ec5a2b6251131a512a2a)
+  [#144](https://github.com/npm/cli/pull/144)
+  Fix common.npm callback arguments. 
+  ([@larsgw](https://github.com/larsgw))
+* [`91314e77b`](https://github.com/npm/cli/commit/91314e77be09a50a275f59ccda314f7cfe269069)
+  [npm.community#4794](https://npm.community/t/packages-with-peerdependencies-are-incorrectly-hoisted/4794)
+  Fix hoisting of packages with peerDeps.
+  ([@sokra](https://github.com/sokra))
+* [`25573e9b9`](https://github.com/npm/cli/commit/25573e9b9d5d26261c68d453f06db5b3b1cd6789)
+  [npm.community#4770](https://npm.community/t/https://npm.community/t/4770)
+  Show installed but unmet peer deps.
+  ([@larsgw](https://github.com/larsgw))
+* [`ce2c4bd1a`](https://github.com/npm/cli/commit/ce2c4bd1a2ce7ac1727a4ca9a350b743a2e27b2a)
+  [#149](https://github.com/npm/cli/pull/149)
+  Use figgy-config to make sure extra opts are there.
+  ([@zkat](https://github.com/zkat))
+
+### DEPENDENCY BUMPS
+
+* [`d72141080`](https://github.com/npm/cli/commit/d72141080ec8fcf35bcc5650245efbe649de053e)
+  `npm-registry-couchapp@2.7.1`
+  ([@zkat](https://github.com/zkat))
+* [`671cad1b1`](https://github.com/npm/cli/commit/671cad1b18239d540da246d6f78de45d9f784396)
+  `npm-registry-fetch@3.9.0`:
+  Make sure publishing with legacy username:password `_auth` works again.
+  ([@zkat](https://github.com/zkat))
+* [`95ca1aef4`](https://github.com/npm/cli/commit/95ca1aef4077c8e68d9f4dce37f6ba49b591c4ca)
+  `pacote@9.4.1`
+  ([@aeschright](https://github.com/aeschright))
+
+### MISC
+
+* [`89b23a5f7`](https://github.com/npm/cli/commit/89b23a5f7b0ccdcdda1d7d4d3eafb6903156d186)
+  [#120](https://github.com/npm/cli/pull/120)
+  Use `const` in lib/fetch-package-metadata.md.
+  ([@watilde](https://github.com/watilde))
+* [`4970d553c`](https://github.com/npm/cli/commit/4970d553c0ea66128931d118469fd31c87cc7986)
+  [#126](https://github.com/npm/cli/pull/126)
+  Replace ronn with marked-man in `.npmignore`.
+  ([@watilde](https://github.com/watilde))
+* [`d9b6090dc`](https://github.com/npm/cli/commit/d9b6090dc26cd0fded18b4f80248cff3e51bb185)
+  [#138](https://github.com/npm/cli/pull/138)
+  Reduce work to test if executable ends with a 'g'.
+  ([@elidoran](https://github.com/elidoran))
+  ([@larsgw](https://github.com/larsgw))
+
 ## v6.7.0 (2019-01-23):
 
 Hey y'all! This is a quick hotfix release that includes some important fixes to

bin/npm-cli.js

@@ -25,7 +25,6 @@
 
   unsupported.checkForUnsupportedNode()
 
-  var path = require('path')
   var npm = require('../lib/npm.js')
   var npmconf = require('../lib/config/core.js')
   var errorHandler = require('../lib/utils/error-handler.js')
@@ -37,7 +36,7 @@
 
   // if npm is called as "npmg" or "npm_g", then
   // run in global mode.
-  if (path.basename(process.argv[1]).slice(-1) === 'g') {
+  if (process.argv[1][process.argv[1].length - 1] === 'g') {
     process.argv.splice(1, 1, 'npm', '-g')
   }
 

doc/files/package.json.md

@@ -393,6 +393,15 @@ shortcut syntax you use for `npm install`:
 
     "repository": "gitlab:user/repo"
 
+If the `package.json` for your package is not in the root directory (for example
+if it is part of a monorepo), you can specify the directory in which it lives:
+
+    "repository": {
+      "type" : "git",
+      "url" : "https://github.com/facebook/react.git",
+      "directory": "packages/react-dom"
+    }
+
 ## scripts
 
 The "scripts" property is a dictionary containing script commands that are run

lib/access.js

@@ -154,7 +154,7 @@ access['ls-packages'] = access.lsPackages = ([owner], opts) => {
 }
 
 access['ls-collaborators'] = access.lsCollaborators = ([pkg, usr], opts) => {
-  return getPackage(pkg).then(pkgName =>
+  return getPackage(pkg, false).then(pkgName =>
     libaccess.lsCollaborators(pkgName, usr, opts)
   ).then(collabs => {
     // TODO - print these out nicely (breaking change)

lib/dedupe.js

@@ -142,8 +142,9 @@ function hoistChildren_ (tree, diff, seen, next) {
         [andComputeMetadata(tree)]
       ], done)
     }
-    var hoistTo = earliestInstallable(tree, tree.parent, child.package, log)
-    if (hoistTo) {
+    // find a location where it's installable
+    var hoistTo = earliestInstallable(tree, tree, child.package, log, child)
+    if (hoistTo && hoistTo !== tree) {
       move(child, hoistTo, diff)
       chain([
         [andComputeMetadata(hoistTo)],

lib/fetch-package-metadata.md

@@ -1,7 +1,7 @@
 fetch-package-metadata
 ----------------------
 
-    var fetchPackageMetadata = require("npm/lib/fetch-package-metadata")
+    const fetchPackageMetadata = require("npm/lib/fetch-package-metadata")
     fetchPackageMetadata(spec, contextdir, callback)
 
 This will get package metadata (and if possible, ONLY package metadata) for

lib/install/deps.js

@@ -650,7 +650,7 @@ function resolveWithNewModule (pkg, tree, log, next) {
   return isInstallable(pkg, (err) => {
     let installable = !err
     addBundled(pkg, (bundleErr) => {
-      var parent = earliestInstallable(tree, tree, pkg, log) || tree
+      var parent = earliestInstallable(tree, tree, pkg, log, null) || tree
       var isLink = pkg._requested.type === 'directory'
       var child = createChild({
         package: pkg,
@@ -755,11 +755,11 @@ function preserveSymlinks () {
 // Find the highest level in the tree that we can install this module in.
 // If the module isn't installed above us yet, that'd be the very top.
 // If it is, then it's the level below where its installed.
-var earliestInstallable = exports.earliestInstallable = function (requiredBy, tree, pkg, log) {
-  validate('OOOO', arguments)
+var earliestInstallable = exports.earliestInstallable = function (requiredBy, tree, pkg, log, ignoreChild) {
+  validate('OOOOZ|OOOOO', arguments)
 
   function undeletedModuleMatches (child) {
-    return !child.removed && moduleName(child) === pkg.name
+    return child !== ignoreChild && !child.removed && moduleName(child) === pkg.name
   }
   const undeletedMatches = tree.children.filter(undeletedModuleMatches)
   if (undeletedMatches.length) {
@@ -778,7 +778,7 @@ var earliestInstallable = exports.earliestInstallable = function (requiredBy, tr
   // If any of the children of this tree have conflicting
   // binaries then we need to decline to install this package here.
   var binaryMatches = pkg.bin && tree.children.some(function (child) {
-    if (child.removed || !child.package.bin) return false
+    if (child === ignoreChild || child.removed || !child.package.bin) return false
     return Object.keys(child.package.bin).some(function (bin) {
       return pkg.bin[bin]
     })
@@ -804,6 +804,23 @@ var earliestInstallable = exports.earliestInstallable = function (requiredBy, tr
 
   if (tree.phantomChildren && tree.phantomChildren[pkg.name]) return null
 
+  // if any of the peer dependencies is a dependency of the current
+  // tree locations, we place the package here. This is a safe location
+  // where we don't violate the peer dependencies contract.
+  // It may not be the perfect location in some cases, but we don't know
+  // if dependencies are hoisted to another location yet, as they
+  // may not be loaded into the tree yet.
+  // We can ignore dev deps here as they are only installed on top-level
+  // and we can't hoist further than that anyway.
+  var peerDeps = pkg.peerDependencies
+  if (peerDeps) {
+    if (Object.keys(peerDeps).some(function (name) {
+      return deps[name]
+    })) {
+      return tree
+    }
+  }
+
   if (tree.isTop) return tree
   if (tree.isGlobal) return tree
 
@@ -812,5 +829,5 @@ var earliestInstallable = exports.earliestInstallable = function (requiredBy, tr
 
   if (!preserveSymlinks() && /^[.][.][\\/]/.test(path.relative(tree.parent.realpath, tree.realpath))) return tree
 
-  return (earliestInstallable(requiredBy, tree.parent, pkg, log) || tree)
+  return (earliestInstallable(requiredBy, tree.parent, pkg, log, ignoreChild) || tree)
 }

lib/ls.js

@@ -305,7 +305,7 @@ function filterFound (root, args) {
     if (!markDeps) continue
     Object.keys(markDeps).forEach(function (depName) {
       var dep = markDeps[depName]
-      if (dep.peerMissing) return
+      if (dep.peerMissing && !dep._from) return
       dep._parent = markPkg
       for (var ii = 0; ii < args.length; ii++) {
         var argName = args[ii][0]

lib/outdated.js

@@ -157,7 +157,7 @@ function makePretty (p, opts) {
   }
 
   if (opts.color) {
-    columns[0] = color[has === want || want === 'linked' ? 'yellow' : 'red'](columns[0]) // dep
+    columns[0] = color[has === want ? 'yellow' : 'red'](columns[0]) // dep
     columns[2] = color.green(columns[2]) // want
     columns[3] = color.magenta(columns[3]) // latest
   }

lib/token.js

@@ -1,6 +1,9 @@
 'use strict'
+
 const profile = require('libnpm/profile')
 const npm = require('./npm.js')
+const figgyPudding = require('figgy-pudding')
+const npmConfig = require('./config/figgy-config.js')
 const output = require('./utils/output.js')
 const Table = require('cli-table3')
 const Bluebird = require('bluebird')
@@ -76,22 +79,43 @@ function generateTokenIds (tokens, minLength) {
   return byId
 }
 
+const TokenConfig = figgyPudding({
+  registry: {},
+  otp: {},
+  cidr: {},
+  'read-only': {},
+  json: {},
+  parseable: {}
+})
+
 function config () {
-  const conf = {
-    json: npm.config.get('json'),
-    parseable: npm.config.get('parseable'),
-    registry: npm.config.get('registry'),
-    otp: npm.config.get('otp')
-  }
+  let conf = TokenConfig(npmConfig())
   const creds = npm.config.getCredentialsByURI(conf.registry)
   if (creds.token) {
-    conf.auth = {token: creds.token}
+    conf = conf.concat({
+      auth: { token: creds.token }
+    })
   } else if (creds.username) {
-    conf.auth = {basic: {username: creds.username, password: creds.password}}
+    conf = conf.concat({
+      auth: {
+        basic: {
+          username: creds.username,
+          password: creds.password
+        }
+      }
+    })
   } else if (creds.auth) {
     const auth = Buffer.from(creds.auth, 'base64').toString().split(':', 2)
-    conf.auth = {basic: {username: auth[0], password: auth[1]}}
+    conf = conf.concat({
+      auth: {
+        basic: {
+          username: auth[0],
+          password: auth[1]
+        }
+      }
+    })
   } else {
+    conf = conf.concat({ auth: {} })
     conf.auth = {}
   }
   if (conf.otp) conf.auth.otp = conf.otp
@@ -183,8 +207,8 @@ function rm (args) {
 
 function create (args) {
   const conf = config()
-  const cidr = npm.config.get('cidr')
-  const readonly = npm.config.get('read-only')
+  const cidr = conf.cidr
+  const readonly = conf['read-only']
 
   const validCIDR = validateCIDRList(cidr)
   return readUserInfo.password().then((password) => {

lib/update.js

@@ -46,7 +46,7 @@ function update_ (args) {
           "because it's currently at the maximum version that matches its specified semver range"
         )
       }
-      return ww.current !== ww.wanted && ww.latest !== 'linked'
+      return ww.current !== ww.wanted
     })
     if (wanted.length === 0) return