[imperative] unable to bundle an application because of the missing dependency

[roman-kupriyanov]

Describe the bug

An attempt to build an app dependent on the @zowe/[email protected] package causes this issue:

ERROR in ../../node_modules/@zowe/imperative/lib/config/src/ConvertV1Profiles.js 592:84-121
Module not found: Error: Can't resolve '@zowe/secrets-for-zowe-sdk' in '/projects/bridge-for-git-explorer/node_modules/@zowe/imperative/lib/config/src'
resolve '@zowe/secrets-for-zowe-sdk' in '/projects/bridge-for-git-explorer/node_modules/@zowe/imperative/lib/config/src'
  Parsed request is a module
  using description file: /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/package.json (relative path: ./lib/config/src)
    resolve as module
      /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/lib/config/src/node_modules doesn't exist or is not a directory
      /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/lib/config/node_modules doesn't exist or is not a directory
      /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/lib/node_modules doesn't exist or is not a directory
      looking for modules in /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/node_modules
        single file module
          using description file: /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/package.json (relative path: ./node_modules/@zowe/secrets-for-zowe-sdk)
            no extension
              /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/node_modules/@zowe/secrets-for-zowe-sdk doesn't exist
            .ts
              /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/node_modules/@zowe/secrets-for-zowe-sdk.ts doesn't exist
            .js
              /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/node_modules/@zowe/secrets-for-zowe-sdk.js doesn't exist
        /projects/bridge-for-git-explorer/node_modules/@zowe/imperative/node_modules/@zowe/secrets-for-zowe-sdk doesn't exist
      /projects/bridge-for-git-explorer/node_modules/@zowe/node_modules doesn't exist or is not a directory
      /projects/bridge-for-git-explorer/node_modules/node_modules doesn't exist or is not a directory
      looking for modules in /projects/bridge-for-git-explorer/node_modules
        single file module
          using description file: /projects/bridge-for-git-explorer/package.json (relative path: ./node_modules/@zowe/secrets-for-zowe-sdk)
            no extension
              /projects/bridge-for-git-explorer/node_modules/@zowe/secrets-for-zowe-sdk doesn't exist
            .ts
              /projects/bridge-for-git-explorer/node_modules/@zowe/secrets-for-zowe-sdk.ts doesn't exist
            .js
              /projects/bridge-for-git-explorer/node_modules/@zowe/secrets-for-zowe-sdk.js doesn't exist
        /projects/bridge-for-git-explorer/node_modules/@zowe/secrets-for-zowe-sdk doesn't exist
      /projects/node_modules doesn't exist or is not a directory
      /node_modules doesn't exist or is not a directory
 @ ../../node_modules/@zowe/imperative/lib/config/index.js 33:13-47
 @ ../../node_modules/@zowe/imperative/lib/index.js 29:13-32
 @ ../../node_modules/@broadcom/endevor-for-zowe-cli/lib/api/workspace/WorkspaceUtils.js 18:21-48
 @ ../../node_modules/@broadcom/endevor-for-zowe-cli/lib/api/workspace/CacheUtils.js 17:25-52
 @ ./src/view/cachedElementContentProvider.ts 4:21-91
 @ ./src/extension.ts 47:39-85

The profiles part of imperative is not even in use directly but still cases impossibility to build a bundle.

The @zowe/imperative package.json says that @zowe/secrets-for-zowe-sdk is the dev dependency and thus, it is never installed as a sub dependency with the published version of the library. If it is expected from the user to install such a dependency that is actually required to be imported in some of the library modules then it should be declared as a peerDependencies in the package.json.

  "devDependencies": {
    "@types/cross-spawn": "^6.0.6",
    "@types/diff": "^5.0.9",
    "@types/fs-extra": "^11.0.4",
    "@types/glob": "^8.1.0",
    "@types/jsonfile": "^6.1.4",
    "@types/lodash": "^4.17.6",
    "@types/lodash-deep": "^2.0.4",
    "@types/mustache": "^4.2.5",
    "@types/npm-package-arg": "^6.1.4",
    "@types/pacote": "^11.1.8",
    "@types/progress": "^2.0.7",
    "@types/stack-trace": "^0.0.33",
    "@zowe/secrets-for-zowe-sdk": "8.10.4", <-- should be a peer dependency?
    "concurrently": "^8.0.0",
    "cowsay": "^1.6.0",
    "deep-diff": "^1.0.0",
    "get-function-arguments": "^1.0.0",
    "http-server": "^14.1.1",
    "stream-to-string": "^1.2.0",
    "uuid": "^10.0.0",
    "web-help": "file:web-help",
    "yargs-parser": "^21.1.1"
  },

Expected and actual results

All the imperative dependencies are declared correctly to be used and bundled together in the projects that rely on the library.

[github-actions]

Thank you for creating a bug report.
We will investigate the bug and evaluate its impact on the product.
If you haven't already, please ensure you have provided steps to reproduce the bug and as much context as possible.

[t1m0thyj]

The @zowe/secrets-for-zowe-sdk package is an optional dependency of Imperative. It is dynamically/lazily loaded by the ConvertV1Profiles API at runtime if available:

zowe-cli/packages/imperative/src/config/src/ConvertV1Profiles.ts

Lines 674 to 685 in 160df9e

	private static async isZoweKeyRingAvailable(): Promise<boolean> {
	try {
	ConvertV1Profiles.zoweKeyRing = (await import("@zowe/secrets-for-zowe-sdk")).keyring;
	await ConvertV1Profiles.zoweKeyRing.findCredentials(CredentialManagerOverride.DEFAULT_CRED_MGR_NAME);
	} catch (error) {
	ConvertV1Profiles.addExceptionToConvertMsgs(
	"Zowe keyring or the credential vault are unavailable. Unable to delete old secure values.", error
	);
	return false;
	}
	return true;
	}

Declaring the Secrets SDK as a peer dep of Imperative would add native binaries that risk being flagged by AV and bloat the package size for folks who don't use it. Instead we opted to remove static imports of the Secrets SDK from Imperative in #2277.

See Webpacking/bundling alongside your project for ways to avoid the "Module not found" error when bundling your app. If your app loads credentials using the ProfileInfo API, you should declare the Secrets SDK as a dependency in your app's package.json so it will be bundled. Or if your app doesn't need the Secrets SDK, you can define it as an external package in your bundler config so it will be ignored.