module: allow running .ts in node_modules if private

[marco-ippolito]

Refs: nodejs/typescript#14

This PR checks when attempting to run .ts files under node_modules if the package.json contains the property private: true.

This should make possible to use strip-types in monorepos, without allowing package maintainer to publish their packages on npm without compiling first.

Also not very performant since is checking/parsing the package.json every time a file under node_modules is encountered, it requires some sort of caching

[nodejs-github-bot]

Review requested:

• @nodejs/loaders
• @nodejs/typescript

[mcollina]

This solution works for me.

[marco-ippolito]

Suggested change

	where package.json is missing or does not contain the property `"private": true`.
	where package.json is missing or does not contain the property `"private": true`.

Is there any chance it can be missing?

[marco-ippolito]

should we cache already analized paths?
Like everything under node_modules/foo once we have already read read node_modules/foo/package.json

[jakebailey]

I said this on nodejs/typescript#14 (comment), but I don't understand the use case here; if you have a package like this, you can't have published it because it's marked private. How did you get the package, then? For monorepos, I would really expect that you'd get it via a symlink, in which case the realpath of the files will not prevent the transform from happening.

[marco-ippolito]

I said this on nodejs/typescript#14 (comment), but I don't understand the use case here; if you have a package like this, you can't have published it because it's marked private. How did you get the package, then? For monorepos, I would really expect that you'd get it via a symlink, in which case the realpath of the files will not prevent the transform from happening.

Probably easier to use since it doesnt require additional tooling.
We could also document that possibility

[jakebailey]

That doesn't really answer my question... I understand that using this flag prevents needing another tool like tsx. But how would someone end up in the situation where their node_modules directory contains a private package, but that package is not symlinked?

[marco-ippolito]

I thought that private: true would still allow publishing privately on the registry, which is not the case 😐
In that case yes it doesnt make sense.

[bmeck]

@marco-ippolito were you thinking about bundledDependencies?