Package hygiene batch (pre-star-push)
Class-level packaging defects found in the 2026-07-23 sweep. Fix across all published packages.
- LICENSE listed in
files but shipped in ZERO tarballs. Every package.json lists "LICENSE" in files, but the file only exists at repo root — npm only auto-includes LICENSE from the package dir. So every published tarball claims MIT and ships no license file. Fix: add a per-package LICENSE (copy or a prepublish copy step). This silently no-ops on every future publish otherwise.
transformabl facade range ^0.3.0 can never resolve the 0.4.x ReDoS fix. Bump to ^0.4.1 when transformabl-core 0.4.1 ships (tracked in the 0.4.1 release issue).- Four declared-but-unused deps read as badge-padding.
identifiabl-core (declared, never imported by prod), and the transformabl/validatabl/limitabl middleware facades are declared in gatewaystack-connect but never imported — an evaluator running npm ls vs imports finds them. Decide: use them or drop them.
identifiabl declares unused jose@^5 — dist never imports jose; causes a dual-jose install (5.x hoisted + 6.x under core). Drop it.tsconfig.tsbuildinfo shipped in dist of 10/12 packages. Dead dev file in the tarball (same class as proxyabl's tool-gateway.js). Exclude it or set tsBuildInfoFile outside dist.- No
engines field in any package despite ESM-only + (post-fix) global-fetch reliance. Add "node": ">=18".
request-context has no prepublishOnly build — stale-dist publish risk. Add it.proxyabl pins request-context exactly (0.0.6) while identifiabl uses ^ — future patches force a proxyabl republish. Loosen to ^.
Note
The two fresh-install-break fixes (jose in proxyabl-core, node-fetch in explicabl) and the identifiabl README export fix are already in PRs #35, #37, #38. The LICENSE-at-root was added in #34. This issue covers the remaining class-level items.
Package hygiene batch (pre-star-push)
Class-level packaging defects found in the 2026-07-23 sweep. Fix across all published packages.
filesbut shipped in ZERO tarballs. Every package.json lists"LICENSE"infiles, but the file only exists at repo root — npm only auto-includes LICENSE from the package dir. So every published tarball claims MIT and ships no license file. Fix: add a per-package LICENSE (copy or a prepublish copy step). This silently no-ops on every future publish otherwise.transformablfacade range^0.3.0can never resolve the 0.4.x ReDoS fix. Bump to^0.4.1when transformabl-core 0.4.1 ships (tracked in the 0.4.1 release issue).identifiabl-core(declared, never imported by prod), and thetransformabl/validatabl/limitablmiddleware facades are declared in gatewaystack-connect but never imported — an evaluator runningnpm lsvs imports finds them. Decide: use them or drop them.identifiabldeclares unusedjose@^5— dist never imports jose; causes a dual-jose install (5.x hoisted + 6.x under core). Drop it.tsconfig.tsbuildinfoshipped in dist of 10/12 packages. Dead dev file in the tarball (same class as proxyabl'stool-gateway.js). Exclude it or settsBuildInfoFileoutside dist.enginesfield in any package despite ESM-only + (post-fix) global-fetch reliance. Add"node": ">=18".request-contexthas noprepublishOnlybuild — stale-dist publish risk. Add it.proxyablpinsrequest-contextexactly (0.0.6) while identifiabl uses^— future patches force a proxyabl republish. Loosen to^.Note
The two fresh-install-break fixes (jose in proxyabl-core, node-fetch in explicabl) and the identifiabl README export fix are already in PRs #35, #37, #38. The LICENSE-at-root was added in #34. This issue covers the remaining class-level items.