fix(npm): always require --unstable flag even for esm (#15583)

cli/npm/mod.rs

@@ -76,6 +76,7 @@ pub struct GlobalNpmPackageResolver {
   cache: NpmCache,
   resolution: Arc<NpmResolution>,
   registry_url: Url,
+  unstable: bool,
 }
 
 impl GlobalNpmPackageResolver {
@@ -83,11 +84,13 @@ impl GlobalNpmPackageResolver {
     dir: &DenoDir,
     reload: bool,
     cache_setting: CacheSetting,
+    unstable: bool,
   ) -> Result<Self, AnyError> {
     Ok(Self::from_cache(
       NpmCache::from_deno_dir(dir, cache_setting.clone())?,
       reload,
       cache_setting,
+      unstable,
     ))
   }
 
@@ -95,6 +98,7 @@ impl GlobalNpmPackageResolver {
     cache: NpmCache,
     reload: bool,
     cache_setting: CacheSetting,
+    unstable: bool,
   ) -> Self {
     let api = NpmRegistryApi::new(cache.clone(), reload, cache_setting);
     let registry_url = api.base_url().to_owned();
@@ -104,6 +108,7 @@ impl GlobalNpmPackageResolver {
       cache,
       resolution,
       registry_url,
+      unstable,
     }
   }
 
@@ -117,6 +122,11 @@ impl GlobalNpmPackageResolver {
     &self,
     packages: Vec<NpmPackageReq>,
   ) -> Result<(), AnyError> {
+    if !self.unstable && !packages.is_empty() {
+      bail!(
+        "Unstable use of npm specifiers. The --unstable flag must be provided."
+      )
+    }
     self.resolution.add_package_reqs(packages).await
   }
 

cli/proc_state.rs

@@ -226,6 +226,7 @@ impl ProcState {
       &dir,
       cli_options.reload_flag(),
       cli_options.cache_setting(),
+      cli_options.unstable(),
     )?;
 
     Ok(ProcState(Arc::new(Inner {

cli/tests/integration/npm_tests.rs

@@ -10,7 +10,7 @@ use util::http_server;
 // by setting the DENO_TEST_UTIL_UPDATE_NPM=1 environment variable.
 
 itest!(esm_module {
-  args: "run --allow-read npm/esm/main.js",
+  args: "run --allow-read --unstable npm/esm/main.js",
   output: "npm/esm/main.out",
   envs: env_vars(),
   http_server: true,
@@ -19,6 +19,7 @@ itest!(esm_module {
 itest!(esm_module_eval {
   args_vec: vec![
     "eval",
+    "--unstable",
     "import chalk from 'npm:chalk@5'; console.log(chalk.green('chalk esm loads'));",
   ],
   output: "npm/esm/main.out",
@@ -27,7 +28,7 @@ itest!(esm_module_eval {
 });
 
 itest!(esm_module_deno_test {
-  args: "test --allow-read npm/esm/test.js",
+  args: "test --allow-read --unstable npm/esm/test.js",
   output: "npm/esm/test.out",
   envs: env_vars(),
   http_server: true,
@@ -61,6 +62,13 @@ itest!(cached_only {
   exit_code: 1,
 });
 
+itest!(no_unstable {
+  args: "run npm/no_unstable/main.ts",
+  output: "npm/no_unstable/main.out",
+  envs: env_vars(),
+  exit_code: 1,
+});
+
 itest!(import_map {
   args: "run --allow-read --unstable --import-map npm/import_map/import_map.json npm/import_map/main.js",
   output: "npm/import_map/main.out",

cli/tests/testdata/npm/no_unstable/main.out

@@ -0,0 +1 @@
+error: Unstable use of npm specifiers. The --unstable flag must be provided.

cli/tests/testdata/npm/no_unstable/main.ts

@@ -0,0 +1,3 @@
+import chalk from "npm:chalk@5";
+
+console.log(chalk.green("hello"));