REPL zip with external import omits sirv-cli dependency

[trbrc]

Describe the bug
If you download a REPL with an external dependency, that dependency is conveniently added to the project. Unfortunately, the required dependency sirv-cli is also overwritten, causing npm run dev to fail.

Logs

$ npm run dev

> svelte-app@1.0.0 dev /svelte-app-1
> rollup -c -w

rollup v1.25.2
bundles src/main.js → public/bundle.js...
LiveReload enabled
created public/bundle.js in 349ms

[2019-10-26 00:00:00] waiting for changes...

> svelte-app@1.0.0 start:dev /svelte-app-1
> sirv public --single --dev

sh: sirv: command not found
npm ERR! file sh
npm ERR! code ELIFECYCLE
npm ERR! errno ENOENT
npm ERR! syscall spawn
npm ERR! svelte-app@1.0.0 start:dev: `sirv public --single --dev`
npm ERR! spawn ENOENT
npm ERR!
npm ERR! Failed at the svelte-app@1.0.0 start:dev script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

To Reproduce

1. Go to https://svelte.dev/repl/
2. Add a line like import 'leftpad'; to the default <script> tag
3. Click the icon for "download zip file"

Expected behavior
Dependencies in package.json in the downloaded zip should look like this:

"dependencies": {
  "sirv-cli": "^0.4.4",
  "leftpad": "latest"
}

but actually looks like this:

"dependencies": {
  "leftpad": "latest"
}

[Conduitry]

diff --git a/site/src/routes/repl/[id]/_components/AppControls/index.svelte b/site/src/routes/repl/[id]/_components/AppControls/index.svelte
index 4cfd5d43..007dba34 100644
--- a/site/src/routes/repl/[id]/_components/AppControls/index.svelte
+++ b/site/src/routes/repl/[id]/_components/AppControls/index.svelte
@@ -140,12 +140,12 @@
 		if (imports.length > 0) {
 			const idx = files.findIndex(({ path }) => path === 'package.json');
 			const pkg = JSON.parse(files[idx].data);
-			const deps = {};
+			const { devDependencies } = pkg;
 			imports.forEach(mod => {
 				const match = /^(@[^/]+\/)?[^@/]+/.exec(mod);
-				deps[match[0]] = 'latest';
+				devDependencies[match[0]] = 'latest';
 			});
-			pkg.dependencies = deps;
+			pkg.devDependencies = devDependencies;
 			files[idx].data = JSON.stringify(pkg, null, '  ');
 		}
 

This change would cause the zip file's package.json to have the additional npm dependencies added to devDependencies, which seems more correct anyway.

Before sirv-cli was moved from a devdep to a dep, overwriting the dependencies worked, because there were no dependencies previously. The way the template's rollup.config.js is written, dependencies and devdependencies alike are bundled - which isn't standard and isn't what the Sapper template does. Even if the Svelte template never switches to only bundling devdeps, we should still probably add these imported dependencies to devdeps for consistency.

[Conduitry]

Fixed and redeployed, thanks for the report!