From f966a4acb5f0d60fb6c30374962eb4c932918722 Mon Sep 17 00:00:00 2001 From: Ryan Dombrowski Date: Wed, 22 Jul 2026 20:38:07 -0400 Subject: [PATCH] fix(package): ajv/ajv-formats are runtime deps of the dspack-validate bin (0.4.1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clean-install verification of the published 0.4.0 caught the bin crashing with ERR_MODULE_NOT_FOUND: the validator's ajv/ajv-formats imports lived in devDependencies, so every checkout test passed (npm ci installs devDeps) while every end-user install failed. Moved to dependencies; repository/homepage/bugs metadata added; version 0.4.1. Both workflows gain a pack-and-install boundary step that installs the packed tarball into an empty project and runs the bin as an end user would — the guard this defect class needs. Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 7 +++++++ .github/workflows/validate.yml | 11 +++++++++++ package-lock.json | 16 +++++++--------- package.json | 21 +++++++++++++++------ 4 files changed, 40 insertions(+), 15 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0508669..5ee657a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -55,5 +55,12 @@ jobs: echo "file mode unexpectedly accepted a negative fixture" >&2 exit 1 fi + - name: Pack-and-install boundary (bin works without devDependencies) + run: | + tarball="$PWD/$(npm pack --silent | tail -1)" + dir="$(mktemp -d)" + cd "$dir" && npm init -y >/dev/null + npm install "$tarball" + npx dspack-validate --file node_modules/@aestheticfunction/dspack-spec/examples/shadcn-ui.dspack.json - name: Publish (public, with provenance) run: npm publish --access public diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 59ff389..d89346e 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -29,3 +29,14 @@ jobs: echo "file mode unexpectedly accepted a negative fixture" >&2 exit 1 fi + - name: Pack-and-install boundary (bin works without devDependencies) + # Guards the 0.4.0 defect: ajv/ajv-formats lived in devDependencies, + # so dspack-validate crashed on every clean install while passing in + # every checkout (npm ci installs devDeps). Install the packed + # tarball into an empty project and run the bin as an end user would. + run: | + tarball="$PWD/$(npm pack --silent | tail -1)" + dir="$(mktemp -d)" + cd "$dir" && npm init -y >/dev/null + npm install "$tarball" + npx dspack-validate --file node_modules/@aestheticfunction/dspack-spec/examples/shadcn-ui.dspack.json diff --git a/package-lock.json b/package-lock.json index 01a47fe..b2eb781 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,17 +1,21 @@ { "name": "@aestheticfunction/dspack-spec", - "version": "0.3.0", + "version": "0.4.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@aestheticfunction/dspack-spec", - "version": "0.3.0", + "version": "0.4.1", "license": "Apache-2.0", - "devDependencies": { + "dependencies": { "ajv": "^8.17.1", "ajv-formats": "^3.0.1" }, + "bin": { + "dspack-validate": "scripts/validate.mjs" + }, + "devDependencies": {}, "engines": { "node": ">=20.0.0" } @@ -20,7 +24,6 @@ "version": "8.20.0", "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz", "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==", - "dev": true, "license": "MIT", "dependencies": { "fast-deep-equal": "^3.1.3", @@ -37,7 +40,6 @@ "version": "3.0.1", "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz", "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==", - "dev": true, "license": "MIT", "dependencies": { "ajv": "^8.0.0" @@ -55,14 +57,12 @@ "version": "3.1.3", "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==", - "dev": true, "license": "MIT" }, "node_modules/fast-uri": { "version": "3.1.3", "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz", "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==", - "dev": true, "funding": [ { "type": "github", @@ -79,14 +79,12 @@ "version": "1.0.0", "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==", - "dev": true, "license": "MIT" }, "node_modules/require-from-string": { "version": "2.0.2", "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz", "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==", - "dev": true, "license": "MIT", "engines": { "node": ">=0.10.0" diff --git a/package.json b/package.json index cf252ec..dd6698d 100644 --- a/package.json +++ b/package.json @@ -1,16 +1,13 @@ { "name": "@aestheticfunction/dspack-spec", - "version": "0.4.0", + "version": "0.4.1", "description": "The dspack specification: spec documents, JSON Schemas, reference example contracts, and the validation harness (bin: dspack-validate).", "type": "module", "license": "Apache-2.0", "scripts": { "validate": "node scripts/validate.mjs" }, - "devDependencies": { - "ajv": "^8.17.1", - "ajv-formats": "^3.0.1" - }, + "devDependencies": {}, "engines": { "node": ">=20.0.0" }, @@ -25,5 +22,17 @@ "examples/shadcn-ui.dspack.json", "examples/astryx.dspack.json", "ADOPTING.md" - ] + ], + "dependencies": { + "ajv": "^8.17.1", + "ajv-formats": "^3.0.1" + }, + "repository": { + "type": "git", + "url": "git+https://github.com/aestheticfunction/dspack.git" + }, + "homepage": "https://github.com/aestheticfunction/dspack#readme", + "bugs": { + "url": "https://github.com/aestheticfunction/dspack/issues" + } }