Skip to content

fix: declare @nrfcloud/validate-with-typebox as a runtime dependency - #73

Merged
coderbyheart merged 1 commit into
mainfrom
fix/validate-with-typebox-runtime-dependency
Aug 5, 2026
Merged

fix: declare @nrfcloud/validate-with-typebox as a runtime dependency#73
coderbyheart merged 1 commit into
mainfrom
fix/validate-with-typebox-runtime-dependency

Conversation

@coderbyheart

Copy link
Copy Markdown
Member

Moves @nrfcloud/validate-with-typebox from devDependencies to
dependencies.

The bug

problemResponse.ts, validateInput.ts and validateResponse.ts all import
@nrfcloud/validate-with-typebox, but it is declared as a devDependency, so
the published package does not pull it in. Consumers that do not independently
have it in their tree fail at import time.

Reproduced against the currently published @nrfcloud/lambda-helpers@1.0.30,
installing it the way a Lambda layer does — only the listed dependencies, no dev
dependencies:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@nrfcloud/validate-with-typebox'
  imported from …/node_modules/@nrfcloud/lambda-helpers/npm/problemResponse.js

With this change the same install pulls in problem-detail and
validate-with-typebox, and the import succeeds.

Why it only appeared now

While this package was published to JSR, JSR's NPM compatibility build derived
the dependency list from the actual imports, so it shipped
@jsr/nrfcloud__validate-with-typebox as a runtime dependency no matter how it
was declared here — it is still visible in the published
@jsr/nrfcloud__lambda-helpers@1.0.28
metadata. Publishing to NPM uses the declared dependencies verbatim, which
exposed the long-standing mis-declaration.

How it was found

account-service-next builds its Lambda layers from an explicit subset of
dependencies. Its cognitoAuthLayer lists @nrfcloud/lambda-helpers but not
@nrfcloud/validate-with-typebox, so the authorizer Lambdas could not resolve
it, failed to initialise, and API Gateway answered every authorized request with
AuthorizerConfigurationException.

All six of the migrated libraries were audited for the same class of problem;
this is the only one affected.

Verified locally

The type check, tests and build pass, and npm ci reinstalls from the
regenerated lock file.

`problemResponse.ts`, `validateInput.ts` and `validateResponse.ts` import
`@nrfcloud/validate-with-typebox`, but it was declared as a devDependency, so it
is missing from the published package's dependency tree.

This did not surface while the package was published to JSR: JSR's NPM
compatibility build derives the dependency list from the actual imports, so it
published `@jsr/nrfcloud__validate-with-typebox` as a runtime dependency
regardless of how it was declared here. The NPM build publishes the declared
dependencies verbatim, so the mis-declaration became a real defect.

Consumers that do not happen to have `@nrfcloud/validate-with-typebox` in their
own dependency tree fail at import time with ERR_MODULE_NOT_FOUND.
@coderbyheart
coderbyheart requested a review from a team as a code owner August 5, 2026 14:02
@coderbyheart coderbyheart added the non-significant Non-significant changes that do not need a PR review label Aug 5, 2026
@coderbyheart

Copy link
Copy Markdown
Member Author

Non-significant change, no PR review required.

@coderbyheart
coderbyheart merged commit 25f10cb into main Aug 5, 2026
2 checks passed
@coderbyheart
coderbyheart deleted the fix/validate-with-typebox-runtime-dependency branch August 5, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

non-significant Non-significant changes that do not need a PR review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant