@adobedjangir/commerce-admin-management 0.0.16 → 0.0.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobedjangir/commerce-admin-management",
-  "version": "0.0.16",
+  "version": "0.0.17",
   "description": "Schema-driven system configuration for Adobe Commerce App Builder sync apps. Magento-style scoped config in Adobe App Builder Database (ABDB) with encryption, Commerce REST helpers, and React Admin UI.",
   "license": "Apache-2.0",
   "author": "Adobe Inc.",

package/scripts/setup.js

@@ -591,24 +591,55 @@ function ensureHostDeps (projectRoot) {
   try { pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8')) } catch (_) {
     return { changed: false, reason: 'unreadable-package-json' }
   }
-  pkg.dependencies = pkg.dependencies || {}
 
+  // Decide which deps need bumping by reading the current package.json.
   const bumped = []
   for (const [name, floor] of Object.entries(REQUIRED_HOST_DEPS)) {
-    const declared = pkg.dependencies[name] || (pkg.devDependencies && pkg.devDependencies[name])
+    const declared = (pkg.dependencies && pkg.dependencies[name]) ||
+                     (pkg.devDependencies && pkg.devDependencies[name])
     if (declared && satisfiesFloor(declared, floor)) continue
-    // Move it to dependencies (out of devDependencies if it was there) and
-    // set to the floor.
-    pkg.dependencies[name] = floor
-    if (pkg.devDependencies && pkg.devDependencies[name]) {
-      delete pkg.devDependencies[name]
-    }
     bumped.push({ name, was: declared || '(missing)', now: floor })
   }
 
   if (bumped.length === 0) return { changed: false, reason: 'already-satisfies' }
 
-  fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf8')
+  // Persist via `npm pkg set` rather than fs.writeFileSync. The outer
+  // `npm install <pkg>` keeps a buffered copy of package.json that it
+  // writes at the very end of the install (to add the package itself
+  // as a dependency) — that write clobbers anything we'd done via
+  // fs.writeFileSync. `npm pkg set` goes through npm's own metadata
+  // layer and persists across that final write.
+  const { execSync } = require('child_process')
+  const args = bumped
+    .map((b) => `dependencies.${b.name}=${b.now}`)
+    // Some keys contain "@" which `npm pkg set` accepts unquoted; we
+    // shell-quote the whole assignment to be safe.
+    .map((a) => `'${a.replace(/'/g, "'\\''")}'`)
+    .join(' ')
+  try {
+    execSync(`npm pkg set ${args}`, {
+      cwd: projectRoot,
+      stdio: 'pipe',
+      env: { ...process.env, COMMERCE_ADMIN_MANAGEMENT_SKIP_SETUP: '1' }
+    })
+  } catch (e) {
+    return { changed: false, reason: `npm-pkg-set-failed: ${e.message}` }
+  }
+
+  // Also remove from devDependencies so the bumped value in dependencies
+  // is the only spec npm will see on the next resolution.
+  const inDev = bumped.filter((b) => pkg.devDependencies && pkg.devDependencies[b.name])
+  if (inDev.length) {
+    const delArgs = inDev.map((b) => `'devDependencies.${b.name}'`).join(' ')
+    try {
+      execSync(`npm pkg delete ${delArgs}`, {
+        cwd: projectRoot,
+        stdio: 'pipe',
+        env: { ...process.env, COMMERCE_ADMIN_MANAGEMENT_SKIP_SETUP: '1' }
+      })
+    } catch (_) { /* non-fatal */ }
+  }
+
   return { changed: true, bumped }
 }