Import npm dependencies of packages from Bower with a package.json

[kl0tl]

Here’s my stab at purescript/registry#20. I wasn’t able to test this because of #4 but the logic should already be reviewable.

PacchettiBotti.Registry.Bower.writeMissingBowerManifests now downloads releases tarballs and parse foreign modules to infer their npm dependencies. We can‘t trust package.json files because not all packages mention their npm dependencies (react-basic for instance doesn’t mention react nor react-dom) and some packages saved their development dependencies as runtime ones (mysql for instance).

Two rules are enforced:

• Packages required from foreign modules of the src target must be saved under the "dependencies" field of a package.json.
• Packages required from foreign modules of the test target only (and not of the src target) must be saved under the "devDependencies" field of a package.json.

Do they seem sensible to you? What should we do when they‘re broken? Should the release be rejected or should registry trustees update the manifest afterwards?

[f-f]

Thanks a lot for this @kl0tl, and sorry for the delay in looking at it!
Looks amazing, I really like the approach. Left some small comments, mostly about having some docstrings, but otherwise we're basically good to go 🙂

[f-f]

@kl0tl this looks good to me, so I'll merge sometime in the next days. Thank you! 👏