refactor(deps): @bsv/sdk as peerDependency across published libraries#216
Merged
Conversation
…ries
@bsv/sdk re-exposes classes with private/protected fields, so TypeScript
types them nominally. Two copies from two node_modules trees become
incompatible types downstream (e.g. "separate declarations of a private
property 'facilitator'"). Hard-depending on @bsv/sdk with narrow ranges
guarantees that fan-out the moment two libs pin different versions.
Move @bsv/sdk from `dependencies` to `peerDependencies: { "@bsv/sdk": "^2" }`
(+ `peerDependenciesMeta` optional:false, + `devDependencies: workspace:^`
for each lib's own build/tests) across all 28 published packages/** libraries.
Apps/servers (infra/**, private packages) keep it as a regular dependency —
they provide the single copy. All affected libraries minor-bumped for a
lockstep release.
Add scripts/check-sdk-peer.mjs + a blocking CI step: fail if any published
packages/** lib declares @bsv/sdk as a regular dependency, or exact-pins the
peer range.
Verified: full workspace build green; @bsv/templates (8/32) and
@bsv/overlay-topics (26 suites/247) tests green; pnpm install --frozen-lockfile
clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
sirdeggen
requested review from
BraydenLangley,
tonesnotes and
ty-everett
as code owners
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Sonar flagged the execSync('find ...') in check-sdk-peer.mjs (running a
binary resolved via PATH). Replace it with a Node fs directory walk — no
child_process, no PATH dependency — matching scripts/validate-frontmatter.mjs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
@bsv/sdkre-exposes classes with private/protected fields, so TypeScript types them nominally. Two byte-identical copies from two differentnode_modules/@bsv/sdktrees are treated as incompatible types downstream:Hard-depending on
@bsv/sdkwith narrow ranges guarantees this fan-out the moment two libs resolve different versions. The durable fix (the React-style singleton pattern): make@bsv/sdka peer dependency of every library that exchanges SDK types across its API boundary.What
Across 28 published
packages/**libraries, moved@bsv/sdk:dependencies→peerDependencies: { "@bsv/sdk": "^2" }(wide range, never exact) +peerDependenciesMeta: { "@bsv/sdk": { optional: false } }devDependencies: { "@bsv/sdk": "workspace:^" }so each lib still builds/tests against the workspace SDKApps/servers (
infra/**, private packages likebtms-backend,wallet-toolbox-examples,example-paymail,conformance-runner-ts) keep@bsv/sdkas a regular dependency — they provide the single copy. All 28 affected libs minor-bumped for a lockstep release.Guard
New
scripts/check-sdk-peer.mjs+ a blocking CI step: fails if any non-privatepackages/**lib declares@bsv/sdkas a regulardependency, or exact-pins the peer range. Stops the regression at PR time instead of in a downstreamtsc.Verified
pnpm -r build(whole workspace) — green@bsv/templates8 suites/32 tests,@bsv/overlay-topics26 suites/247 tests — greenpnpm install --frozen-lockfile— cleanRelease
These libs must be published in lockstep (the version bumps in this PR). Hold the line going forward: never exact-pin
@bsv/sdk; coordinate any future@bsv/sdk@3as a breaking event.🤖 Generated with Claude Code