fix: external cross package dependencies - #43
Merged
Conversation
The root README promises "changelog individual" (individual changelog) per package, but none existed. Backfilled CHANGELOG.md for all 13 packages covering the two releases actually shipped so far: the v2 rewrite (major version bumps) and the ESM-bundling patch fix. Earlier, undocumented version history is intentionally left out rather than guessed at. Also added "CHANGELOG.md" to each package's `files` array -- npm only auto-includes README/LICENSE/package.json in a published tarball, so without this the changelog would exist in the repo but never actually ship in what `npm install` pulls down. Verified via `npm pack --dry-run`. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EqaJ2TCZoyMCFjK4WcKxBR
bun build inlines every reachable import by default, including workspace dependencies. sdk, adapters, and the 5 framework packages were fully inlining @abacatepay/rest, @abacatepay/types, @abacatepay/zod, and @abacatepay/adapters into their own dist -- despite each already declaring those as real `dependencies`. Framework packages ended up shipping ~480KB- 1MB each, almost entirely a duplicated copy of zod's runtime pulled in transitively through adapters. elysia was worse (~1MB): it also inlined the entire `elysia` framework itself, which is a peerDependency, not something that should ever be bundled into a package meant to run inside a host app that provides its own elysia instance. Fix: mark each package's own @abacatepay/* (and, for elysia, the elysia peer) dependencies as --external in its `bun build` invocation, so they stay real `import` statements resolved via node_modules instead of being duplicated into every consumer. No behavior change -- everything marked external was already a declared dependency, so npm/bun already installs it correctly for any real consumer. adapters 500KB -> 2.6KB (zod externalized) sdk 14KB -> 5.4KB (rest, types externalized) express/fastify/hono/supabase 480KB -> ~1.5KB (adapters externalized) elysia 1MB -> 1.1KB (adapters + elysia externalized) This surfaced one real bug: sdk/v1 imported `Routes` from the deep subpath `@abacatepay/types/v1/routes`, which types' bundled build never actually produces (only `index`, `v1/index`, `v2/index` exist as complete bundles). It worked before only because types was being inlined wholesale, so the import resolved against source, not the published subpath. types/v2 already re-exports `Routes` from its barrel for exactly this reason; types/v1 didn't. Added the same re-export to types/v1 and pointed sdk/v1 at the barrel instead of the deep subpath. Verified with `npm pack` + a fresh isolated install of all 11 tarballs together (plus elysia as a real peer dependency), running the full verify.mjs script end-to-end -- 20/20 checks pass, including a functional call through sdk/v1's fixed Routes usage against the live API. Patch-bumped every package whose build output changed: types 3.0.2, sdk 2.0.2, adapters 2.0.2, express/fastify/hono/elysia/supabase 2.0.2. No public API changed. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EqaJ2TCZoyMCFjK4WcKxBR
viniciusbastos-dev
approved these changes
Jul 27, 2026
6 tasks
ChristoPy
added a commit
that referenced
this pull request
Jul 27, 2026
) The changelog-backfill PR (#43) updated package.json's `files` array for zod, typebox, rest, eslint-plugin, and better-auth to include CHANGELOG.md, but only bumped the version on the 8 packages actually touched by the externalization fix in the same PR. These 5 got the files-array change without a version bump, which means their published tarballs still won't contain CHANGELOG.md -- npm won't even accept republishing the same version with different content. Verified via `npm pack --dry-run` before and after. zod 2.0.1 -> 2.0.2, typebox 2.0.1 -> 2.0.2, rest 1.0.0 -> 1.0.1, eslint-plugin 0.1.3 -> 0.1.4, better-auth 1.0.1 -> 1.0.2 No code changed, only the files array + changelog. Verified with `npm pack --dry-run` that CHANGELOG.md is now included in all 5. Claude-Session: https://claude.ai/code/session_01EqaJ2TCZoyMCFjK4WcKxBR Co-authored-by: Claude Sonnet 5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
stop inlining cross-package dependencies into published bundle + make
Related Issue
Closes (N/A)
Why
What problem does this solve?
What changed
Breaking changes
Checklist
Additional context
Add any other context or screenshots here.