build(schematics): keep only architect declared, bundle jsonc-parser (#3808)

* build(schematics): keep only architect declared, bundle jsonc-parser

The published manifest declared five build-time packages that only the
schematics and the ng deploy builder use. The Angular CLI runs schematics
installed under node_modules/@angular/ through its own loader, which
supplies @angular-devkit/* and @schematics/* from the CLI's copy, so
declaring @angular-devkit/schematics, @angular-devkit/core and
@schematics/angular never changed which copy ran. They leave the
manifest, and jsonc-parser, the one package the schematics had to
resolve on their own, is bundled.

@angular-devkit/architect stays: the architect host loads the deploy
builder with a plain require, outside that loader. The deploy bundles
stop importing the schematic packages (the .firebaserc helper moves out
of utils.ts, SchematicsException becomes Error), and the build now fails
if a deploy bundle requires a package the manifest does not declare.

On a build of this commit, ng add and the deploy builder load under Yarn
Plug'n'Play and pnpm hoist=false, and the full ng add command works
through a registry on npm. The same change built before #3803 merged ran
the wider set of yarn and pnpm layouts and the ng update migration. A
production install of a CLI app lists 112 packages instead of 136.

Fixes #3694
Refs #3746

* docs: note the build-time packages @angular/fire no longer installs

Author: armando-navarro

docs/version-22-upgrade.md

@@ -56,3 +56,9 @@ An older version installs anyway with a warning (`has incorrect peer dependency
 pnpm 8 and later install a missing `firebase` automatically. An older version installs anyway with a warning (`unmet peer firebase@^12.18.0: found 11.x` on pnpm 9 and 10, `Issues with peer dependencies found. Run "pnpm peers check" to list them.` on pnpm 11 and 12), and pnpm prints that warning only once, when it first resolves the tree, never on a later install from the committed lockfile.
 
 Set `strict-peer-dependencies=true` in `.npmrc` to make pnpm refuse the mismatch outright.
+
+## Fewer build-time packages
+
+`@angular/fire` no longer installs `@angular-devkit/schematics`, `@angular-devkit/core` or `@schematics/angular`. The Angular CLI supplies them when it runs `ng add` and `ng update`, so nothing changes for an Angular CLI or Nx workspace.
+
+If you run AngularFire's schematics with the standalone `schematics` command on pnpm with `hoist=false`, add those three packages to your own `package.json`.

src/ng-package.json

@@ -5,8 +5,6 @@
   },
   "dest": "../dist/packages-dist",
   "allowedNonPeerDependencies": [
-    "@angular-devkit/architect", "@angular-devkit/core",
-    "@angular-devkit/schematics", "@schematics/angular",
-    "jsonc-parser", "rxfire"
+    "@angular-devkit/architect", "rxfire"
   ]
 }

src/package.json

@@ -43,10 +43,6 @@
   "dependencies": {
     "rxfire": "^6.2.0",
     "@angular-devkit/architect": ">= 0.2200.0 < 0.2300.0",
-    "@angular-devkit/core": "^22.0.0",
-    "@angular-devkit/schematics": "^22.0.0",
-    "@schematics/angular": "^22.0.0",
-    "jsonc-parser": "^3.0.0",
     "tslib": "^2.3.0"
   },
   "ng-update": {

src/schematics/deploy/actions.ts

@@ -3,7 +3,6 @@ import { existsSync, readFileSync, renameSync, writeFileSync } from 'fs';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 import { BuilderContext, targetFromTargetString } from '@angular-devkit/architect';
-import { SchematicsException } from '@angular-devkit/schematics';
 import crossSpawn from 'cross-spawn';
 import fsExtra from 'fs-extra';
 import * as inquirer from 'inquirer';
@@ -82,7 +81,7 @@ const escapeRegExp = (str: string) => str.replace(/[-[\]/{}()*+?.\\^$|]/g, '\\$&
 // being read as a flag rather than a path.
 export const assertSafeOutputPath = (outputPath: string, targetName: string): void => {
   if (/['"`\\$\n\r]/.test(outputPath) || outputPath.startsWith('-')) {
-    throw new SchematicsException(
+    throw new Error(
       `Unsafe outputPath ${JSON.stringify(outputPath)} for target '${targetName}' in angular.json.`
     );
   }
@@ -95,7 +94,7 @@ export const assertSafeOutputPath = (outputPath: string, targetName: string): vo
 // example one containing a dash) into an explicit error.
 export const assertSafeFunctionName = (functionName: string | undefined): void => {
   if (functionName !== undefined && !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(functionName)) {
-    throw new SchematicsException(
+    throw new Error(
       `Unsafe functionName ${JSON.stringify(functionName)} in angular.json; expected a plain identifier.`
     );
   }
@@ -113,7 +112,7 @@ const NODE_IMAGE_TAG = /^(?!latest$)[\w][\w.-]{0,127}$/;
 
 export const assertSafeNodeVersion = (version: string | number | undefined): void => {
   if (version !== undefined && !NODE_IMAGE_TAG.test(String(version))) {
-    throw new SchematicsException(
+    throw new Error(
       `Unsafe functionsNodeVersion ${JSON.stringify(version)} in angular.json; expected a node image tag, such as 22 or lts.`
     );
   }
@@ -185,7 +184,7 @@ export const SUPPORTED_PACKAGE_MANAGERS = ['npm', 'yarn', 'pnpm', 'cnpm', 'bun']
 
 export const assertSupportedPackageManager = (packageManager: string): string => {
   if (!SUPPORTED_PACKAGE_MANAGERS.includes(packageManager)) {
-    throw new SchematicsException(
+    throw new Error(
       `Unsupported package manager "${packageManager}" in angular.json (cli.packageManager). ` +
       `Expected one of: ${SUPPORTED_PACKAGE_MANAGERS.join(', ')}.`
     );
@@ -217,7 +216,7 @@ export const processHost = {
     const result = crossSpawn.sync(command, args, options);
     if (result.error) { throw result.error; }
     if (result.status !== 0) {
-      throw new SchematicsException(
+      throw new Error(
         `Command "${command}" exited with ${result.signal ? `signal ${result.signal}` : `code ${result.status}`}.`
       );
     }
@@ -510,7 +509,7 @@ export const deployToCloudRun = async (
   }
 
   if (options.preview) {
-    throw new SchematicsException('Cloud Run preview not supported.');
+    throw new Error('Cloud Run preview not supported.');
   }
 
   const deployArguments: string[] = [];

src/schematics/deploy/builder.ts

@@ -1,7 +1,7 @@
 import { BuilderContext, BuilderOutput, createBuilder } from '@angular-devkit/architect';
 import { getFirebaseTools } from '../firebaseTools';
+import { getFirebaseProjectNameFromFs } from '../firebaserc';
 import { BuildTarget } from '../interfaces';
-import { getFirebaseProjectNameFromFs } from '../utils';
 import deploy, { DeployBuilderOptions } from './actions';
 
 // Call the createBuilder() function to create a builder. This mirrors

src/schematics/firebaserc.ts

@@ -0,0 +1,29 @@
+import { readFileSync } from "fs";
+import { join } from "path";
+import { FirebaseRc } from "./interfaces";
+
+export const projectFromRc = (
+  rc: FirebaseRc,
+  target: string
+): [string | undefined, string | undefined] => {
+  const defaultProject = rc.projects?.default;
+  const project = Object.keys(rc.targets || {}).find(
+    (project) => !!rc.targets?.[project]?.hosting?.[target]
+  );
+  const site = project && rc.targets?.[project]?.hosting?.[target]?.[0];
+  return [project || defaultProject, site];
+};
+
+export function getFirebaseProjectNameFromFs(
+  root: string,
+  target: string
+): [string | undefined, string | undefined] {
+  const path = join(root, ".firebaserc");
+  try {
+    const buffer = readFileSync(path);
+    const rc: FirebaseRc = JSON.parse(buffer.toString());
+    return projectFromRc(rc, target);
+  } catch {
+    return [undefined, undefined];
+  }
+}

src/schematics/utils.ts

@@ -11,6 +11,7 @@ import { NodePackageInstallTask } from "@angular-devkit/schematics/tasks/index.j
 import { addRootProvider } from "@schematics/angular/utility";
 import { parse } from "yaml";
 import { overwriteIfExists, safeReadJSON, stringifyFormatted } from "./common.js";
+import { projectFromRc } from "./firebaserc.js";
 import {
   ConnectorConfig,
   ConnectorYaml,
@@ -90,32 +91,6 @@ export function getFirebaseProjectNameFromHost(
   return projectFromRc(rc, target);
 }
 
-export function getFirebaseProjectNameFromFs(
-  root: string,
-  target: string
-): [string | undefined, string | undefined] {
-  const path = join(root, ".firebaserc");
-  try {
-    const buffer = readFileSync(path);
-    const rc: FirebaseRc = JSON.parse(buffer.toString());
-    return projectFromRc(rc, target);
-  } catch (_) {
-    return [undefined, undefined];
-  }
-}
-
-const projectFromRc = (
-  rc: FirebaseRc,
-  target: string
-): [string | undefined, string | undefined] => {
-  const defaultProject = rc.projects?.default;
-  const project = Object.keys(rc.targets || {}).find(
-    (project) => !!rc.targets?.[project]?.hosting?.[target]
-  );
-  const site = project && rc.targets?.[project]?.hosting?.[target]?.[0];
-  return [project || defaultProject, site];
-};
-
 // TODO rewrite using typescript
 export function addFixesToServer(host: Tree) {
   const serverPath = `/server.ts`;

src/schematics/workspace.ts

@@ -13,7 +13,6 @@
 
 import { existsSync, readFileSync } from 'fs';
 import { dirname, join } from 'path';
-import { SchematicsException } from '@angular-devkit/schematics';
 import { parse as parseJsonWithComments } from 'jsonc-parser';
 
 /**
@@ -102,7 +101,7 @@ export const workspaceRootFor = (startDirectory: string): string => {
 export const assertSafeDependencyName = (name: string, source: string): string => {
   if (typeof name !== 'string' || name.length === 0 || name.startsWith('-') ||
       /[\s;&|$`(){}<>!\\'"]/.test(name)) {
-    throw new SchematicsException(`Invalid dependency name ${JSON.stringify(name)} ${source}.`);
+    throw new Error(`Invalid dependency name ${JSON.stringify(name)} ${source}.`);
   }
   return name;
 };

tools/build.ts

@@ -1,6 +1,6 @@
 import { spawn } from 'cross-spawn';
-import { copy, writeFile } from 'fs-extra';
-import { join, sep } from 'path';
+import { copy, readJson, writeFile } from 'fs-extra';
+import { join, resolve, sep } from 'path';
 import { keys as tsKeys } from 'ts-transformer-keys';
 import * as esbuild from "esbuild";
 import type { ReplaceResult } from 'replace-in-file';
@@ -394,7 +394,6 @@ const externalPackages = [
   "@angular-devkit/core",
   "rxjs",
   "@schematics/angular",
-  "jsonc-parser",
   "firebase-tools",
   "typescript"
 ];
@@ -404,6 +403,17 @@ const externalPackages = [
 const exportedSubpaths = ['@angular-devkit/schematics/tasks', '@schematics/angular/utility', 'rxjs/operators'];
 const isPackageSubpath = (path: string) => externalPackages.some(name => path.startsWith(`${name}/`));
 
+/* The Angular CLI runs schematics through a loader that supplies @angular-devkit/* and
+ * @schematics/* from its own copy, so the published manifest does not declare them. The deploy
+ * builder is loaded by @angular-devkit/architect without that loader, so every package its bundles
+ * require must be declared in src/package.json. */
+const builderEntryPoints = schematicEntryPoints.filter(([first]) => first === 'deploy');
+// The installed @types/node predates module.isBuiltin, so the list is read untyped.
+const nodeModule: { builtinModules: string[] } = require('module');
+const isNodeBuiltin = (importPath: string) => nodeModule.builtinModules.includes(importPath.replace(/^node:/, ''));
+const packageNameOf = (importPath: string) =>
+  importPath.split('/').slice(0, importPath.startsWith('@') ? 2 : 1).join('/');
+
 async function compileSchematics() {
   const { metafile } = await esbuild.build({
     entryPoints: schematicEntryPoints.map(segments => `${src('schematics', ...segments)}.ts`),
@@ -417,7 +427,10 @@ async function compileSchematics() {
     platform: "node",
     target: "es2016",
     external: externalPackages,
-    alias: { "@angular-devkit/schematics/tasks/index.js": "@angular-devkit/schematics/tasks" },
+    alias: {
+      "@angular-devkit/schematics/tasks/index.js": "@angular-devkit/schematics/tasks",
+      "jsonc-parser": "jsonc-parser/lib/esm/main.js",
+    },
     outdir: dest('schematics'),
     metafile: true,
   });
@@ -432,6 +445,35 @@ async function compileSchematics() {
     const required = unlistedSubpaths.map(subpath => `\n  ${subpath}, imported by ${importersBySubpath.get(subpath)?.join(', ')}`);
     throw new Error(`The schematics require package paths that exportedSubpaths does not list:${required.join('')}\nAdd an alias in compileSchematics to a path the package exports, or, if the exports map in the newest published version lists the path (npm view <package>@next exports), add it to exportedSubpaths.`);
   }
+  /* Every package the deploy builder bundles require at run time must be a dependency or peer of
+   * the published package (src/package.json), because nothing else resolves them for the builder. */
+  const publishedManifest = await readJson(src('package.json'));
+  const declaredPackages = new Set([
+    ...Object.keys(publishedManifest.dependencies ?? {}),
+    ...Object.keys(publishedManifest.peerDependencies ?? {}),
+  ]);
+  const undeclaredInBuilder: string[] = [];
+  for (const segments of builderEntryPoints) {
+    /* Find the bundle esbuild wrote for this entry point. The metafile records entry points
+     * relative to the working directory, so compare absolute paths. */
+    const entryFile = `${src('schematics', ...segments)}.ts`;
+    const outputs = Object.entries(metafile.outputs)
+      .filter(([, output]) => output.entryPoint && resolve(output.entryPoint) === entryFile);
+    if (outputs.length !== 1) {
+      throw new Error(`Expected exactly one bundle for ${join(...segments)}, found ${outputs.length}. The builder dependency check cannot run.`);
+    }
+    /* The bundle's `imports` are the requires esbuild left in place (the externals). Each one must
+     * be a Node builtin or belong to a declared package. */
+    const [file, output] = outputs[0];
+    for (const entry of output.imports) {
+      if (entry.external && !isNodeBuiltin(entry.path) && !declaredPackages.has(packageNameOf(entry.path))) {
+        undeclaredInBuilder.push(`\n  ${file} requires ${entry.path}`);
+      }
+    }
+  }
+  if (undeclaredInBuilder.length) {
+    throw new Error(`The deploy builder bundles require packages that src/package.json does not declare:${undeclaredInBuilder.join('')}\n@angular-devkit/architect loads the builder outside the Angular CLI's schematic loader, which supplies @angular-devkit/* and @schematics/* to schematics only. Declare the package in src/package.json, or remove the import from the builder's import graph (a module-level import in a shared file is enough to pull it in).`);
+  }
   await Promise.all([
     copy(src('schematics', 'versions.json'), dest('schematics', 'versions.json')),
     copy(src('schematics', 'builders.json'), dest('schematics', 'builders.json')),