Missing dependency declaration for `@tableau/api-shared-js` in `@tableau/embedding-api` 3.12.1

[jarnaiz]

Describe the bug

Calling require('@tableau/embedding-api') (v 3.12.1) fails at runtime/build time with: Module not found: Can't resolve '@tableau/api-shared-js'

because @tableau/api-shared-js is not declared in package.json even though ToolbarServiceImpl.js does: const { … } = require('@tableau/api-shared-js');

To reproduce

https://stackblitz.com/edit/vitejs-vite-evyremew?file=src%2FApp.tsx

Note: npm ci works because the lock-file records the nested path, but a plain npm install (or a fresh clone without package-lock.json) removes the extraneous folder during the prune step.

Why it happens

• The tarball on npm contains node_modules/@tableau/api-shared-js, but it is not listed in "dependencies" nor "bundledDependencies".
• During npm install anything under a package’s private node_modules that is not declared is considered extraneous and is removed.

Expected behavior

The package should install and run with only: npm install @tableau/embedding-api

Proposed fix

Add the missing module to the published package.json, e.g.

"dependencies": {
  "@tableau/api-shared-js": "^1.254.0"
},
"bundledDependencies": [
  "@tableau/api-shared-js"
]

and relase a patch version (e.g. 3.12.2).

Thanks!

[romankaravia]

Another way to see the issue is to start with a very simple package.json in an empty folder and run npm install twice.

package.json content

{
  "dependencies": {
    "@tableau/embedding-api": "3.13.0"
  }
}

Log of calling npm install twice

$ npm install

added 1 package, and audited 2 packages in 795ms

found 0 vulnerabilities

$ npm install

removed 6 packages, and audited 2 packages in 495ms

found 0 vulnerabilities

Usually you would expect that calling npm install a second time has no effect, but note that here it says removed 6 packages on the second call. And indeed, the content of the nested node_modules folder inside @tableau/embedding-api has disappeared, and the package no longer works :-(