1 files changed, 39 insertions, 11 deletions
diff --git a/deps/npm/lib/install/update-package-json.js b/deps/npm/lib/install/update-package-json.js
index 97b2f05bb0f..eee530c3cd8 100644
--- a/deps/npm/lib/install/update-package-json.js
+++ b/deps/npm/lib/install/update-package-json.js
@@ -1,18 +1,46 @@
 'use strict'
 var path = require('path')
 var writeFileAtomic = require('write-file-atomic')
+var moduleName = require('../utils/module-name.js')
 var deepSortObject = require('../utils/deep-sort-object.js')
+var sortedObject = require('sorted-object')
+
+var sortKeys = [
+  'dependencies', 'devDependencies', 'bundleDependencies',
+  'optionalDependencies', 'keywords', 'engines', 'scripts',
+  'files'
+]
+
+module.exports = function (mod, buildpath, next) {
+  var pkg = sortedObject(mod.package)
+  var name = moduleName(mod)
+  // Add our diagnostic keys to the package.json.
+  // Note that there are folks relying on these, for ex, the Visual Studio
+  // Node.js addon.
+  pkg._requiredBy =
+    mod.requiredBy
+      .map(function (req) {
+        if (req.package.devDependencies[name] && !req.package.dependencies[name]) {
+          return '#DEV:' + req.location
+        } else {
+          return req.location
+        }
+      })
+      .concat(mod.userRequired ? ['#USER'] : [])
+      .concat(mod.existing ? ['#EXISTING'] : [])
+      .sort()
+  pkg._location = mod.location
+  pkg._phantomChildren = {}
+  Object.keys(mod.phantomChildren).sort().forEach(function (name) {
+    pkg._phantomChildren[name] = mod.phantomChildren[name].package.version
+  })
+
+  // sort keys that are known safe to sort to produce more consistent output
+  sortKeys.forEach(function (key) {
+    if (pkg[key] != null) pkg[key] = deepSortObject(pkg[key])
+  })
+
+  var data = JSON.stringify(sortedObject(pkg), null, 2) + '\n'
 
-module.exports = function (pkg, buildpath, next) {
-  // FIXME: This bundled dance is because we're sticking a big tree of bundled
-  // deps into the parsed package.json– it probably doesn't belong there =/
-  // But the real reason we don't just dump it out is that it's the result
-  // of npm-read-tree, which produces circular data structures, due to the
-  // parent and children keys.
-  var bundled = pkg.package._bundled
-  delete pkg.package._bundled // FIXME
-  var packagejson = deepSortObject(pkg.package)
-  var data = JSON.stringify(packagejson, null, 2) + '\n'
-  pkg.package._bundled = bundled
   writeFileAtomic(path.resolve(buildpath, 'package.json'), data, next)
 }