Skip to content

fix(proxyabl): declare jose as a runtime dependency#35

Open
davidcrowe wants to merge 1 commit into
mainfrom
fix/proxyabl-missing-jose-dep
Open

fix(proxyabl): declare jose as a runtime dependency#35
davidcrowe wants to merge 1 commit into
mainfrom
fix/proxyabl-missing-jose-dep

Conversation

@davidcrowe

Copy link
Copy Markdown
Collaborator

Problem

@gatewaystack/[email protected] imports jose (src/auth.ts:2, src/oidc.ts:7) but declares no dependencies at all, so the published package is broken on fresh install:

npm install @gatewaystack/proxyabl-core
node -e "import('@gatewaystack/proxyabl-core')"
# ERR_MODULE_NOT_FOUND: Cannot find package 'jose'

It only works inside this monorepo because jose is hoisted from identifiabl-core. @gatewaystack/proxyabl inherits the breakage through its dependency on core.

Fix

  • proxyabl-core: add jose@^6.1.0 to dependencies (matches identifiabl-core), bump to 0.1.1
  • proxyabl: bump core constraint to ^0.1.1, add jose to devDependencies (its import is type-only — erased at runtime, needed for standalone typechecking), bump to 0.0.13

Verification

  • Full repo test suite: 17 files / 159 tests pass
  • Clean-room check: npm pack the fixed core, install the tarball in an empty directory, import — succeeds with 17 exports (jose pulled from the registry as a declared dep)

Both packages need a republish after merge (prepublishOnly handles the build).

@gatewaystack/proxyabl-core imports jose in auth.ts and oidc.ts but never
declared it, so a fresh npm install of the published package failed on
first import with ERR_MODULE_NOT_FOUND — it only worked inside this
monorepo, where jose is hoisted from identifiabl-core. Pin ^6.1.0 to
match identifiabl-core, bump core to 0.1.1 and middleware to 0.0.13, and
give the middleware a jose devDependency for its type-only import so it
typechecks outside the workspace.
@davidcrowe

Copy link
Copy Markdown
Collaborator Author

Reviewed + confirmed green (build + test SUCCESS, MERGEABLE/CLEAN). Verified the jose classification is correct: proxyabl-core is the real runtime consumer (jose as a dependency ✅); the proxyabl facade's published entry (dist/index.js) never reaches jose at runtime — only the dead tool-gateway.ts and a type-only import in auth.ts reference it — so jose as a devDependency on the facade is right.

@davidcrowe — needs your merge + republish (OTP): [email protected] and [email protected].

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant