Using pnpm, Rush, and private package causes an error during install

[gscottolson]

I have a package being served privately via VSTS and being referenced via .npmrc. My project .npmrc file looks like:

@[[ namespace ]]:registry=https://[[ vstsTeamName ]].pkgs.visualstudio.com/_packaging/[[ repoName ]]/npm/registry/
@[[ namespace ]]:always-auth=true

Note: the [[ brackets ]] are substituted here and don’t appear in the code or error messages.

I am using pnpm (as to avoid the request race condition I ran into previously). I can successfully gerenate and rebuild. But when I try to install I run into an error:

ERROR: Invalid Version: [[ vstsTeamName ]].pkgs.visualstudio.com/@[[ namespace ]]/[[ package ]]/0.3.0

When I examine the shrinkwrap file, I see my private npm pacakge from VSTS being referenced like:

...
'@[[ namespace ]]/[[ package ]]': [[ vstsTeamName ]].pkgs.visualstudio.com/@[[ namespace ]]/[[ package ]]/0.3.0/7d14051973b708e1b2175dec0c58c6f1
...

This is the only package in the shrinkwrap file that is being prepended with the domain of the package.

Do you know if there is an issue with private packages and shrinkwrapping? Or am I missing something else?

[nickpape]

Hi @gscottolson ,

There should not be an issue with private packages & pnpm, we are using them (and VSTS feeds) internally in the repository which ships modern SharePoint pages and SPFx.

This does seem like an issue with shrinkwrapping. Would you mind sharing your shrinkwrap file and/or link to your repo (you can send it to my @microsoft.com address).

[nickpape]

@zkochan what do you think of this? The error is not coming from Rush.

[zkochan]

I can look into it but you can make my investigation a lot easier by providing steps to repro with plain pnpm. Also, in what part of the shrinkwrap file is this?

...
'@[[ namespace ]]/[[ package ]]': [[ vstsTeamName ]].pkgs.visualstudio.com/@[[ namespace ]]/[[ package ]]/0.3.0/7d14051973b708e1b2175dec0c58c6f1
...

Is there a key like this "[[ vstsTeamName ]].pkgs.visualstudio.com/@[[ namespace ]]/[[ package ]]/0.3.0/7d14051973b708e1b2175dec0c58c6f1" in the packages field of shrinkwrap.yaml?

What was the stack trace of the error?

[nickpape]

Hi Zoltan,

It may not be easy to repro since it appears to be happening behind a private feed.

It looks like there are 2 keys in the packages section of the shrinkwrap. I anonymized the names.

  team.pkgs.visualstudio.com/@somescope/a-package/0.3.0:
    dev: false
    engines:
      node: '>=8.9.2'
      npm: '>=5.6.0'
    name: '@somescope/a-package'
    peerDependencies: &ref_3
      office-ui-fabric-core: ^9.4.0
      office-ui-fabric-react: ^5.45.0
      react: ^16.0.0
      react-dom: ^16.0.0
      styled-components: ^3.1.0
    resolution: &ref_2
      integrity: sha1-GUd+Y3K1mKnWwJGFE233Ab1145g=
      registry: 'https://team.pkgs.visualstudio.com/_packaging/someteam/npm/registry/'
      tarball: 'https://team.pkgs.visualstudio.com/_packaging/someteam/npm/registry/@somescope/a-package/-/a-package-0.3.0.tgz'
    version: 0.3.0
  team.pkgs.visualstudio.com/@somescope/a-package/0.3.0/4bf1695e2a45af450d981e5eee9b7320:
    dependencies:
      office-ui-fabric-core: 9.4.0
      office-ui-fabric-react: /office-ui-fabric-react/5.55.1/react-dom@16.2.0+react@16.2.0
      react: 16.2.0
      react-dom: /react-dom/16.2.0/react@16.2.0
      styled-components: /styled-components/3.1.6/react@16.2.0
    dev: false
    engines:
      node: '>=8.9.2'
      npm: '>=5.6.0'
    id: team.pkgs.visualstudio.com/@somescope/a-package/0.3.0
    name: '@somescope/a-package'
    peerDependencies: *ref_3
    resolution: *ref_2
    version: 0.3.0

In dependencies it is listed like:

dependencies:
  '@somescope/a-package': team.pkgs.visualstudio.com/@somescope/a-package/0.3.0

And it is referenced by other packages like:

  'file:projects/smb-biz-center.tgz':
    dependencies:
      '@somescope/a-package': team.pkgs.visualstudio.com/@somescope/a-package/0.3.0/4bf1695e2a45af450d981e5eee9b7320

It looks like the .npmrc is only overriding a single scope though... @zkochan , could there be an issue with trying to install from multiple registries?

@somescope:registry=https://team.pkgs.visualstudio.com/_packaging/someteam/npm/registry/
@somescope:always-auth=true

@gscottolson, we override both in our .nprmc:

@ms:registry=https://onedrive.pkgs.visualstudio.com/_packaging/odsp-npm/npm/registry
registry=https://onedrive.pkgs.visualstudio.com/_packaging/odsp-npm/npm/registry
//onedrive.pkgs.visualstudio.com/_packaging/odsp-npm/npm/registry/:always-auth=true

And we ensure the registry is allowed to use upstream dependencies:

[nickpape]

@zkochan I was able to get this working by redirecting everything (including default scope) to the VSTS feed. Is there a problem with using multiple registries?

[zkochan]

@nickpape-msft I am not aware of such issues but I only use pnpm with one registry, so I'll have to check

[nickpape]

It's probably a bad idea for people to be using multiple registries anyway...

[gscottolson]

Thanks for the help on this.

[Jabher]

@nickpape I accidentially encountered this issue and have to share my experience.

We're using single repo, but depending on namespace we're using different auth to provide access granularity.