chore(deps): update dependency @wave-av/sdk to v2.1.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@wave-av/sdk (source)	2.0.14 → 2.1.3

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

wave-av/sdk (@​wave-av/sdk)

v2.1.3

Compare Source

Added

• Standalone functions for the agent-auth device authorization ceremony: startAgentCeremony, pollAgentCeremony, refreshAgentCeremony, plus the isCeremonyPending and isCeremonyTerminal classifiers (#​110). These take no client and no API key, so an SDK consumer can run the full bootstrap and hand a human an approval URL before any credential exists.

Fixed

• P0: fresh installs of @wave-av/sdk@2.1.x crashed every ESM consumer at import time.
  src/cli.ts carried a top-level bin-entry guard, if (require.main === module) { ... },
  a CJS-only idiom. Because src/cli.ts is also re-exported from src/index.ts (for
  runWaveCli), tsup/esbuild's ESM code-splitting placed it in a chunk shared by every ESM
  entry point (dist/index.mjs, dist/cli.mjs, ...). module has no meaning in ES module
  scope, so evaluating that shared chunk threw
  ReferenceError: module is not defined in ES module scope for any ESM import of the
  package — not just when the wave bin was executed. This broke @wave-av/cli@1.0.8
  (which resolves @wave-av/sdk via ^2.0.11 → 2.1.2, and is itself an ESM package, so it
  always takes the "import" condition) on every fresh install.
  Reproduced with: node --input-type=module -e "import('@wave-av/sdk')" (throws on 2.1.0
  through 2.1.2; works from 2.0.14 backward because the guard was added by the CLI-bin work
  landing in 2.1.0).
• The bin-entry side effect now lives in src/bin.ts, a file with no exports consumed
  elsewhere in the package. It is never re-exported, so tsup/esbuild never folds it into a
  shared chunk, and because it only ever runs as the process entry point it needs no
  entry-point guard at all (ESM-safe or otherwise) — it just runs.
• src/cli.ts is now a pure library module: runWaveCli with zero top-level side effects.

Changed

• BREAKING (bin rename): the package's bin field changed from "wave": "./dist/cli.js"
  to "wave-sdk": "./dist/bin.js". @wave-av/sdk and @wave-av/cli both declared a bin
  named wave, so which package's wave binary actually landed in node_modules/.bin was
  install-order luck — and the SDK's version was a 4-verb stub (wave <models|complete| stream|products>), not the full 34-command-group CLI that @​wave-av/cli ships. If you
  depended on the SDK's own wave bin directly (not via @wave-av/cli), invoke it as
  wave-sdk after upgrading, or run it via npx @wave-av/sdk command name wave-sdk.

Release note

Publishing @wave-av/sdk@2.1.3 to npm is a separate, manual operator step. This change does
not run npm publish.

v2.1.2

Compare Source

Fixed

• P0: fresh installs of @wave-av/sdk@2.1.x crashed every ESM consumer at import time.
  src/cli.ts carried a top-level bin-entry guard, if (require.main === module) { ... },
  a CJS-only idiom. Because src/cli.ts is also re-exported from src/index.ts (for
  runWaveCli), tsup/esbuild's ESM code-splitting placed it in a chunk shared by every ESM
  entry point (dist/index.mjs, dist/cli.mjs, ...). module has no meaning in ES module
  scope, so evaluating that shared chunk threw
  ReferenceError: module is not defined in ES module scope for any ESM import of the
  package — not just when the wave bin was executed. This broke @wave-av/cli@1.0.8
  (which resolves @wave-av/sdk via ^2.0.11 → 2.1.2, and is itself an ESM package, so it
  always takes the "import" condition) on every fresh install.
  Reproduced with: node --input-type=module -e "import('@wave-av/sdk')" (throws on 2.1.0
  through 2.1.2; works from 2.0.14 backward because the guard was added by the CLI-bin work
  landing in 2.1.0).
• The bin-entry side effect now lives in src/bin.ts, a file with no exports consumed
  elsewhere in the package. It is never re-exported, so tsup/esbuild never folds it into a
  shared chunk, and because it only ever runs as the process entry point it needs no
  entry-point guard at all (ESM-safe or otherwise) — it just runs.
• src/cli.ts is now a pure library module: runWaveCli with zero top-level side effects.

Changed

• BREAKING (bin rename): the package's bin field changed from "wave": "./dist/cli.js"
  to "wave-sdk": "./dist/bin.js". @wave-av/sdk and @wave-av/cli both declared a bin
  named wave, so which package's wave binary actually landed in node_modules/.bin was
  install-order luck — and the SDK's version was a 4-verb stub (wave <models|complete| stream|products>), not the full 34-command-group CLI that @​wave-av/cli ships. If you
  depended on the SDK's own wave bin directly (not via @wave-av/cli), invoke it as
  wave-sdk after upgrading, or run it via npx @wave-av/sdk command name wave-sdk.

Release note

Publishing @wave-av/sdk@2.1.3 to npm is a separate, manual operator step. This change does
not run npm publish.

v2.1.1

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[greptile-apps]

PR author is in the excluded authors list.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​wave-av/​sdk@​2.0.14 ⏵ 2.1.3	-1			+1

View full report

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR only updates ignored dependency-resolution metadata, but that metadata changes the SDK version used at runtime. Since the dependency diff is unavailable and the lockfile is owned by another team, the SDK impact cannot be verified from the available changes.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.