Bower and npm Registry Interoperability: Scoped Packages and Transitive Dependencies

Answer

1. Scoped npm packages cannot be referenced by name in bower.json. The Bower core resolver rejects names that start with @. To use a scoped npm package you must provide the exact tarball URL (or an unscoped alias) that the bower-npm-resolver can download.

2. Bower installs only the top‑level packages you list. It does not traverse the npm dependency tree. Any transitive dependencies must be declared explicitly or bundled inside the tarball you reference.

3. Version range mapping is mostly one‑to‑one. Bower understands ~ and ^ the same way npm does, but it does not honor npm’s lifecycle scripts or postinstall hooks. If you need those scripts you must run them manually after installation.

Confirmed Facts

• Bower’s core resolver does not support npm scoped names; @scope/pkg will be rejected.
• The bower-npm-resolver plugin can fetch an npm tarball via URL, but it treats the package as unscoped.
• Bower’s flat dependency model means only the dependencies listed in bower.json are installed.
• Transitive npm dependencies are not automatically pulled in; they must be declared or bundled.

Practical Steps

1. Configure .bowerrc to use the resolver:

   {
     "resolvers": ["bower-npm-resolver"]
   }
   

2. Find the tarball URL for the desired npm version. For example:

   https://registry.npmjs.org/@scope/pkg/-/pkg-1.2.3.tgz
   

3. Reference the tarball in bower.json:

   {
     "name": "legacy-project",
     "dependencies": {
       "pkg": "https://registry.npmjs.org/@scope/pkg/-/pkg-1.2.3.tgz"
     }
   }
   

   If you prefer an unscoped alias, add a bower.json to the tarball that contains a name field without the @ prefix.

4. If the npm package has transitive dependencies, bundle them into the tarball yourself or add each as a separate dependency in bower.json.

Version Range Translation

• Both Bower and npm understand ~1.0.0 (patch updates) and ^1.0.0 (minor updates). The resolver simply passes the range string to Bower, which then resolves it against the npm registry.
• Because Bower ignores npm lifecycle scripts, any postinstall logic will not run automatically. If the npm package requires such hooks for proper operation, you must execute them manually after the tarball is extracted.
• When using a tarball URL, you bypass range resolution entirely; you must specify the exact version in the URL.

Missing Diagnostic Detail

To fine‑tune these recommendations, could you share the Bower version you have installed (e.g., bower --version) and whether you already have a .bowerrc configured with the bower-npm-resolver?