From 12ef5307960721da4fcbf99fcf6ff82dee0d103e Mon Sep 17 00:00:00 2001
From: Alexander Khrushkov <a.khrushkov@gmail.com>
Date: Wed, 5 Aug 2026 14:48:36 +0300
Subject: [PATCH] fix(packaging): mark entry-specific peers optional so
 consumers are not forced to install them

npm 7+ auto-installs non-optional peerDependencies, so every package listed
there ends up in each consumer's lockfile whether or not the consumer imports
the entry point that needs it. A consumer that only uses the ./announcements
subpath (react + lucide-react + react-markdown + remark-gfm) was still being
handed the data-table and drag-and-drop stack, and its `npm ci` failed in CI
with "Missing: @dnd-kit/core@6.3.1 from lock file" (and five more) whenever the
lockfile had been generated on a machine with legacy-peer-deps=true, which
skips peer auto-install.

Move @dnd-kit/core, @dnd-kit/sortable, @dnd-kit/utilities, @tanstack/react-table
and @tanstack/react-query into peerDependenciesMeta as optional, following the
precedent already set for recharts (./analytics only). The peerDependencies
entries stay, so the supported version ranges are still declared; only the
auto-install obligation is dropped. react and react-dom remain required.

@tanstack/react-query is included because no entry point imports it at all --
it is not reachable from any bundle, yet it was being installed into every
consumer.

The root-barrel consumers (sphere, sphere-dev-portal, sphere-backoffice) each
already declare all four as their own direct dependencies, so nothing changes
for them.
---
 README.md    | 29 ++++++++++++++++++++++++-----
 package.json | 15 +++++++++++++++
 2 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 113ebf9..c9a03f8 100644
--- a/README.md
+++ b/README.md
@@ -198,13 +198,32 @@ src/
 
 ## Peer Dependencies
 
+Required — every entry point needs them:
+
 - `react` ^19.0.0
 - `react-dom` ^19.0.0
-- `@tanstack/react-query` ^5.0.0
-- `@tanstack/react-table` ^8.0.0
-- `@dnd-kit/core` ^6.0.0
-- `@dnd-kit/sortable` ^8.0.0
-- `lucide-react` ^0.400.0
+
+Optional (`peerDependenciesMeta.optional`) — only some entry points need them:
+
+- `@tanstack/react-table` ^8.0.0 — root barrel only (`DataTable`)
+- `@dnd-kit/core` ^6.0.0 — root barrel and `./hooks` only
+- `@dnd-kit/sortable` ^8.0.0 || ^10.0.0 — root barrel and `./hooks` only
+- `@dnd-kit/utilities` ^3.0.0 — root barrel only (`MediaGallery`)
+- `recharts` ^3.0.0 — `./analytics` only
+- `@tanstack/react-query` ^5.0.0 — no entry point imports it today; kept as a
+  version hint for apps that pair it with these components
+
+**Do not make these required again.** npm 7+ auto-installs non-optional peers,
+so a non-optional entry here forces every consumer's lockfile to contain it,
+even one that imports a narrow subpath like `./announcements` (react +
+lucide-react + react-markdown + remark-gfm and nothing else). Consumers whose
+lockfile was generated with `legacy-peer-deps=true` then fail `npm ci` in CI
+with "Missing: <pkg> from lock file". Marking them optional lets each app
+declare only what it actually uses; the root-barrel consumers (`sphere`,
+`sphere-dev-portal`, `sphere-backoffice`) already list all of them as their own
+direct dependencies, so nothing changes for them.
+
+`lucide-react` is a regular dependency, not a peer.
 
 ## License
 
diff --git a/package.json b/package.json
index 750d7e4..c65440e 100644
--- a/package.json
+++ b/package.json
@@ -66,6 +66,21 @@
     "recharts": "^3.0.0"
   },
   "peerDependenciesMeta": {
+    "@dnd-kit/core": {
+      "optional": true
+    },
+    "@dnd-kit/sortable": {
+      "optional": true
+    },
+    "@dnd-kit/utilities": {
+      "optional": true
+    },
+    "@tanstack/react-query": {
+      "optional": true
+    },
+    "@tanstack/react-table": {
+      "optional": true
+    },
     "recharts": {
       "optional": true
     }