Rewrite publishing @typeberry/lib to NPM #853
Conversation
📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughThis PR restructures the library build for bin/lib: adds tsconfig.lib.json, replaces the old builder with a tsc-based compile plus two new scripts (bin/lib/scripts/build-lib.ts and bin/lib/scripts/extract-examples.ts), moves JS export entrypoints to ./exports/*.js and updates bin/lib/package.json (exports, scripts, runtime deps), updates bin/lib/index.ts to remove deprecated type aliases and expose many namespace re-exports, moves build output to dist/lib, and removes the packages/misc/builder workspace and its build files. Ancillary docs and ignore files were adjusted. Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI agents
In @bin/lib/package.json:
- Around line 42-45: The dependency entry for "@noble/ed25519" pinned at "2.2.3"
should be updated to "3.0.0" in package.json; change the version string for the
"@noble/ed25519" dependency to "3.0.0", install/update the lockfile (npm/yarn)
and run the test suite, and then search code that imports/uses "@noble/ed25519"
for any breaking API changes introduced in v3 (adjust call sites accordingly)
before committing the updated package.json and lockfile.
In @bin/lib/scripts/build-lib.ts:
- Around line 299-302: The code directly accesses sourcePackageJson.dependencies
without checking if the field exists, which will cause Object.entries() to throw
an error if the dependencies property is undefined. Guard against this by
checking if sourcePackageJson.dependencies is defined before calling
Object.entries() on it, and provide a fallback such as an empty object or empty
array when the dependencies field is missing.
- Around line 240-255: Update the JSDoc examples to match the actual
implementation in buildImportsField: the wildcard mapping target uses
"./<packagePath>/*" (no ".js" suffix) as produced by
imports[`${internalName}/*`] rather than "./<packagePath>/*.js"; revise any
example lines that show "./packages/.../*.js" to "./packages/.../*" so the docs
reflect imports[internalName] = `./${packagePath}/index.js` and
imports[`${internalName}/*`] = `./${packagePath}/*`.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (13)
bin/lib/.npmignorebin/lib/index.tsbin/lib/package.jsonbin/lib/scripts/build-lib.tsbin/lib/scripts/extract-examples.tspackage.jsonpackages/README.mdpackages/misc/builder/.gitignorepackages/misc/builder/package.jsonpackages/misc/builder/rollup.config.jspackages/misc/builder/setup.cjspackages/misc/builder/tsconfig.jsontsconfig.lib.json
💤 Files with no reviewable changes (7)
- package.json
- packages/misc/builder/.gitignore
- packages/README.md
- packages/misc/builder/tsconfig.json
- packages/misc/builder/rollup.config.js
- packages/misc/builder/setup.cjs
- packages/misc/builder/package.json
🧰 Additional context used
📓 Path-based instructions (2)
**/*.ts
⚙️ CodeRabbit configuration file
**/*.ts: rules from./CODESTYLE.mdshould be adhered to.
**/*.ts: Any function whose documentation mention it must not be used in production code,
can be safely used in*.test.tsfiles. Other usage should be carefuly reviewed
and the comment must explain why it's safe to use there.
**/*.ts:asconversions must not be used. Suggest usingtryAsconversion methods.
**/*.ts: Classes withstatic Codecfield must have private constructor and staticcreatemethod.
**/*.ts: Casting abigint(orU64) usingNumber(x)must have an explanation comment why
it is safe.
**/*.ts: When making changes to code with comments containing links (in classes, constants, methods, etc.)
to graypaper.fluffylabs.dev, ensure those links point to the current version for this update.
Files:
bin/lib/scripts/extract-examples.tsbin/lib/scripts/build-lib.tsbin/lib/index.ts
bin/lib/index.ts
⚙️ CodeRabbit configuration file
bin/lib/index.ts: Every newexport * as <name>statement must have a corresponding entry point file
atbin/lib/exports/<name>.tsthat re-exports the package (e.g.,export * from "@typeberry/<package>").
The builder will automatically detect these files and generate the appropriate exports.
Files:
bin/lib/index.ts
🧠 Learnings (4)
📓 Common learnings
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 625
File: benchmarks/package.json:8-15
Timestamp: 2025-09-15T14:37:04.214Z
Learning: In the FluffyLabs/typeberry monorepo, the workspace:* protocol does not work for internal typeberry dependencies. The working approach is to use "*" as the version specifier for internal monorepo packages instead of "workspace:*".
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 442
File: packages/core/pvm-debugger-adapter/index.ts:22-40
Timestamp: 2025-06-18T20:35:13.536Z
Learning: The `typeberry/utils` package has browser compatibility issues due to Node.js-specific code like `measure` function using `process.hrtime()` and `testUtils` importing `node:assert`, causing white screens in browser environments.
📚 Learning: 2025-05-26T21:31:58.688Z
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 399
File: .github/workflows/vectors-jamduna.yml:78-78
Timestamp: 2025-05-26T21:31:58.688Z
Learning: In the typeberry project, the npm start script in the test-runner workspace is designed to accept test suite names as arguments (e.g., "jamduna", "w3f"). The command `npm start -w typeberry/test-runner jamduna` is the correct way to run the jamduna test suite, not `npm run jamduna`. This is an architectural design choice where the start script acts as a unified entry point for different test suites.
Applied to files:
bin/lib/package.json
📚 Learning: 2025-09-15T14:37:04.214Z
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 625
File: benchmarks/package.json:8-15
Timestamp: 2025-09-15T14:37:04.214Z
Learning: In the FluffyLabs/typeberry monorepo, the workspace:* protocol does not work for internal typeberry dependencies. The working approach is to use "*" as the version specifier for internal monorepo packages instead of "workspace:*".
Applied to files:
bin/lib/package.jsonbin/lib/index.ts
📚 Learning: 2025-06-18T20:35:13.536Z
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 442
File: packages/core/pvm-debugger-adapter/index.ts:22-40
Timestamp: 2025-06-18T20:35:13.536Z
Learning: The `typeberry/utils` package has browser compatibility issues due to Node.js-specific code like `measure` function using `process.hrtime()` and `testUtils` importing `node:assert`, causing white screens in browser environments.
Applied to files:
bin/lib/index.ts
🪛 ast-grep (0.40.3)
bin/lib/scripts/extract-examples.ts
[warning] 24-24: Regular expression constructed from variable input detected. This can lead to Regular Expression Denial of Service (ReDoS) attacks if the variable contains malicious patterns. Use libraries like 'recheck' to validate regex safety or use static patterns.
Context: new RegExp(dynamicImportRegex)
Note: [CWE-1333] Inefficient Regular Expression Complexity [REFERENCES]
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
- https://cwe.mitre.org/data/definitions/1333.html
(regexp-from-variable)
⏰ Context from checks skipped due to timeout of 120000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: Setup test vectors cache
- GitHub Check: benchmarks (22.x)
- GitHub Check: test (22.x)
- GitHub Check: jam-e2e (22.x)
- GitHub Check: e2e (22.x)
🔇 Additional comments (14)
bin/lib/.npmignore (1)
1-10: LGTM!The ignore rules correctly exclude build artifacts and development-only packages from npm publishing. The
bin/lib/*paths are appropriate since this file gets copied todist/lib/during build, where these relative paths correctly target the compiled subdirectories.tsconfig.lib.json (1)
1-9: LGTM!Clean configuration extension for library builds. The settings appropriately enable declaration generation with source maps while outputting to
dist/lib.bin/lib/scripts/extract-examples.ts (4)
1-1: LGTM!The shebang change to
tsxaligns with the TSX-based tooling updates across the project.
16-49: Type annotations improve maintainability.The added type annotations and nullish handling make the code more robust.
Regarding the static analysis warning about ReDoS on line 24: this is a false positive since
dynamicImportRegexis a compile-time constant defined within the same function, not derived from external input.
79-120: LGTM!Good type annotations on the function signature and local variables. The nullish coalescing on line 106 properly handles potential undefined values from regex matches.
125-148: LGTM!Return type annotations added consistently to the remaining functions.
bin/lib/scripts/build-lib.ts (4)
96-123: LGTM!Solid implementation of workspace package discovery with appropriate error handling for missing package.json files.
137-146: LGTM!Correct handling of both scoped and non-scoped package name extraction.
164-197: LGTM!Import rewriting logic is sound - correctly skips relative imports, checks package membership, and only writes when modifications occur.
388-428: LGTM!Clear main execution flow with helpful logging and proper error handling for missing dist directory.
bin/lib/package.json (2)
82-83: LGTM!Build scripts correctly chain TypeScript compilation with the post-processing script.
8-39: Export mappings correctly reference build output.The exports reference
.jsfiles, which TypeScript resolves to.tsduring development and exist as compiled output after build. All export entry points have corresponding source files inbin/lib/exports/.bin/lib/index.ts (2)
1-2: Type exports are still present in the code.The AI summary indicates these type exports were removed, but they remain in the source. Please clarify if these should be retained or removed.
4-34: LGTM - Namespace exports properly updated.The reorganized namespace exports (
importer,pvm_interface,workers_api) follow consistent naming conventions. Per coding guidelines, eachexport * as <name>requires a corresponding entry point atbin/lib/exports/<name>.ts- this was verified in the package.json review.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @bin/lib/.npmignore:
- Around line 3-10: The .npmignore in bin/lib lists paths (benchmarks, bin/jam,
bin/convert, bin/ipc2rpc, bin/pvm, bin/rpc, bin/tci, bin/test-runner) that do
not exist under the bin/lib package and therefore won’t be excluded on publish;
either update the build to emit those files into bin/lib (copy/create dist
artifacts) or remove/replace those entries in bin/lib/.npmignore so it only
references actual files/dirs in this package; search for the .npmignore file in
this package and adjust the entries accordingly to point to real build outputs
or delete the stale sibling-level paths.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
bin/lib/.npmignore
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 625
File: benchmarks/package.json:8-15
Timestamp: 2025-09-15T14:37:04.214Z
Learning: In the FluffyLabs/typeberry monorepo, the workspace:* protocol does not work for internal typeberry dependencies. The working approach is to use "*" as the version specifier for internal monorepo packages instead of "workspace:*".
⏰ Context from checks skipped due to timeout of 120000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: benchmarks (22.x)
- GitHub Check: Setup test vectors cache
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @bin/lib/scripts/build-lib.ts:
- Around line 332-351: The loop assumes sourcePackageJson.exports exists and
will throw if it's undefined; before iterating over
Object.entries(sourcePackageJson.exports) in the function that builds
distPackageJson.exports, guard by using a fallback empty object or an early
return when sourcePackageJson.exports is falsy (e.g. const exportsSrc =
sourcePackageJson.exports || {}; then iterate Object.entries(exportsSrc)),
ensuring distPackageJson.exports is only populated when exports exist and
avoiding runtime errors referencing sourcePackageJson.exports.
🧹 Nitpick comments (1)
bin/lib/scripts/build-lib.ts (1)
295-329: Consider adding runtime validation for npm-required fields.The function directly accesses properties from the source package.json (name, version, description, author, license, type) without validation. While bin/lib/package.json contains all required fields, adding a guard check would make the build more resilient and fail fast with a clear error message if fields are unexpectedly missing.
Example:
const requiredFields = ['name', 'version']; for (const field of requiredFields) { if (!sourcePackageJson[field]) { throw new Error(`Missing required field in bin/lib/package.json: ${field}`); } }
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
bin/lib/.npmignorebin/lib/scripts/build-lib.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- bin/lib/.npmignore
🧰 Additional context used
📓 Path-based instructions (1)
**/*.ts
⚙️ CodeRabbit configuration file
**/*.ts: rules from./CODESTYLE.mdshould be adhered to.
**/*.ts: Any function whose documentation mention it must not be used in production code,
can be safely used in*.test.tsfiles. Other usage should be carefuly reviewed
and the comment must explain why it's safe to use there.
**/*.ts:asconversions must not be used. Suggest usingtryAsconversion methods.
**/*.ts: Classes withstatic Codecfield must have private constructor and staticcreatemethod.
**/*.ts: Casting abigint(orU64) usingNumber(x)must have an explanation comment why
it is safe.
**/*.ts: When making changes to code with comments containing links (in classes, constants, methods, etc.)
to graypaper.fluffylabs.dev, ensure those links point to the current version for this update.
Files:
bin/lib/scripts/build-lib.ts
🧠 Learnings (3)
📓 Common learnings
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 625
File: benchmarks/package.json:8-15
Timestamp: 2025-09-15T14:37:04.214Z
Learning: In the FluffyLabs/typeberry monorepo, the workspace:* protocol does not work for internal typeberry dependencies. The working approach is to use "*" as the version specifier for internal monorepo packages instead of "workspace:*".
📚 Learning: 2025-09-15T14:37:04.214Z
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 625
File: benchmarks/package.json:8-15
Timestamp: 2025-09-15T14:37:04.214Z
Learning: In the FluffyLabs/typeberry monorepo, the workspace:* protocol does not work for internal typeberry dependencies. The working approach is to use "*" as the version specifier for internal monorepo packages instead of "workspace:*".
Applied to files:
bin/lib/scripts/build-lib.ts
📚 Learning: 2025-06-18T20:35:13.536Z
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 442
File: packages/core/pvm-debugger-adapter/index.ts:22-40
Timestamp: 2025-06-18T20:35:13.536Z
Learning: The `measure` function in `typeberry/utils/debug.ts` attempts environment detection by checking `process === undefined` but still causes bundling issues because bundlers see the `process.hrtime` reference in the Node.js branch.
Applied to files:
bin/lib/scripts/build-lib.ts
⏰ Context from checks skipped due to timeout of 120000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: benchmarks (22.x)
- GitHub Check: Setup test vectors cache
- GitHub Check: e2e (22.x)
- GitHub Check: jam-e2e (22.x)
- GitHub Check: test (22.x)
🔇 Additional comments (6)
bin/lib/scripts/build-lib.ts (6)
96-123: LGTM!The package map building logic correctly handles workspace discovery, includes appropriate error handling for missing files, and validates package names before adding them to the map.
137-146: LGTM!The package name extraction logic correctly handles both scoped and non-scoped packages with appropriate regex patterns and safe fallbacks.
164-197: LGTM!The import rewriting logic correctly identifies workspace package imports, preserves relative imports, and safely transforms workspace references to internal # prefixed imports. The regex pattern appropriately handles both import and export statements.
207-219: LGTM!The directory processing logic correctly traverses the file tree and filters for JavaScript and TypeScript declaration files.
368-386: LGTM!The distribution file copying logic includes appropriate existence checks and gracefully handles missing optional files.
405-428: LGTM!The main execution flow includes appropriate error handling for missing prerequisites, clear progress logging, and a logical sequence of build steps.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.coderabbit.yaml (1)
36-44: Consider consolidating duplicate path entries.Two separate
path_instructionsentries targetpackages/**/package.json. While this is valid YAML and per the schema, consolidating them into a single entry would improve maintainability and make it clearer what rules apply to package.json files.♻️ Proposed consolidation
- - path: 'packages/**/package.json' - instructions: | - Dependencies coming from the workspace (typically the ones starting with `@typeberry/`) - must use `*` as version. - External dependencies must be added sparingly. If package is re-exported by `@typeberry/lib`, - the dependency must be browser-compatible and added directly to `./bin/lib/package.json` as well. - - path: 'packages/**/package.json' - instructions: | - Whenever a new package is added, the `packages/README.md` should be updated accordingly. + - path: 'packages/**/package.json' + instructions: | + Dependencies coming from the workspace (typically the ones starting with `@typeberry/`) + must use `*` as version. + External dependencies must be added sparingly. If package is re-exported by `@typeberry/lib`, + the dependency must be browser-compatible and added directly to `./bin/lib/package.json` as well. + + Whenever a new package is added, the `packages/README.md` should be updated accordingly.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.coderabbit.yaml
🧰 Additional context used
🧠 Learnings (3)
📓 Common learnings
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 625
File: benchmarks/package.json:8-15
Timestamp: 2025-09-15T14:37:04.214Z
Learning: In the FluffyLabs/typeberry monorepo, the workspace:* protocol does not work for internal typeberry dependencies. The working approach is to use "*" as the version specifier for internal monorepo packages instead of "workspace:*".
📚 Learning: 2025-09-15T14:37:04.214Z
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 625
File: benchmarks/package.json:8-15
Timestamp: 2025-09-15T14:37:04.214Z
Learning: In the FluffyLabs/typeberry monorepo, the workspace:* protocol does not work for internal typeberry dependencies. The working approach is to use "*" as the version specifier for internal monorepo packages instead of "workspace:*".
Applied to files:
.coderabbit.yaml
📚 Learning: 2025-05-26T21:31:58.688Z
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 399
File: .github/workflows/vectors-jamduna.yml:78-78
Timestamp: 2025-05-26T21:31:58.688Z
Learning: In the typeberry project, the npm start script in the test-runner workspace is designed to accept test suite names as arguments (e.g., "jamduna", "w3f"). The command `npm start -w typeberry/test-runner jamduna` is the correct way to run the jamduna test suite, not `npm run jamduna`. This is an architectural design choice where the start script acts as a unified entry point for different test suites.
Applied to files:
.coderabbit.yaml
⏰ Context from checks skipped due to timeout of 120000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Setup test vectors cache
- GitHub Check: e2e (22.x)
- GitHub Check: test (22.x)
- GitHub Check: jam-e2e (22.x)
🔇 Additional comments (1)
.coderabbit.yaml (1)
35-35: LGTM! Clear dependency management guidance.The added instructions appropriately document the new external dependency management approach introduced in this PR. Requiring browser-compatible external dependencies in
bin/lib/package.jsonfor re-exported packages is a good practice for library publishing.Also applies to: 40-41
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.coderabbit.yaml (2)
40-41: Consider minor wording clarification.The instruction is clear and correctly emphasizes browser compatibility for re-exported packages. The phrase "as well" at the end of line 41 could be simplified to just "added directly to
./bin/lib/package.json" since it's understood the dependency will also be in the package's own package.json.✨ Suggested wording improvement
- the dependency must be browser-compatible and added directly to `./bin/lib/package.json` as well. + the dependency must be browser-compatible and added directly to `./bin/lib/package.json`.
36-44: Consider consolidating duplicate path entries.Two separate
path_instructionsentries exist for the same path patternpackages/**/package.json(lines 36-41 and 42-44). While the schema permits this, consolidating them into a single entry improves maintainability and removes ambiguity about whether both instructions will be applied.♻️ Consolidate into a single entry
- path: 'packages/**/package.json' instructions: | Dependencies coming from the workspace (typically the ones starting with `@typeberry/`) must use `*` as version. External dependencies must be added sparingly. If package is re-exported by `@typeberry/lib`, the dependency must be browser-compatible and added directly to `./bin/lib/package.json` as well. - - path: 'packages/**/package.json' - instructions: | + Whenever a new package is added, the `packages/README.md` should be updated accordingly.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.coderabbit.yaml
🧰 Additional context used
🧠 Learnings (3)
📓 Common learnings
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 625
File: benchmarks/package.json:8-15
Timestamp: 2025-09-15T14:37:04.214Z
Learning: In the FluffyLabs/typeberry monorepo, the workspace:* protocol does not work for internal typeberry dependencies. The working approach is to use "*" as the version specifier for internal monorepo packages instead of "workspace:*".
📚 Learning: 2025-09-15T14:37:04.214Z
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 625
File: benchmarks/package.json:8-15
Timestamp: 2025-09-15T14:37:04.214Z
Learning: In the FluffyLabs/typeberry monorepo, the workspace:* protocol does not work for internal typeberry dependencies. The working approach is to use "*" as the version specifier for internal monorepo packages instead of "workspace:*".
Applied to files:
.coderabbit.yaml
📚 Learning: 2025-05-26T21:31:58.688Z
Learnt from: tomusdrw
Repo: FluffyLabs/typeberry PR: 399
File: .github/workflows/vectors-jamduna.yml:78-78
Timestamp: 2025-05-26T21:31:58.688Z
Learning: In the typeberry project, the npm start script in the test-runner workspace is designed to accept test suite names as arguments (e.g., "jamduna", "w3f"). The command `npm start -w typeberry/test-runner jamduna` is the correct way to run the jamduna test suite, not `npm run jamduna`. This is an architectural design choice where the start script acts as a unified entry point for different test suites.
Applied to files:
.coderabbit.yaml
⏰ Context from checks skipped due to timeout of 120000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: test (22.x)
- GitHub Check: Setup test vectors cache
- GitHub Check: e2e (22.x)
- GitHub Check: jam-e2e (22.x)
🔇 Additional comments (1)
.coderabbit.yaml (1)
35-35: LGTM! Dependency tracking instruction aligns with PR objectives.The requirement to add transitive external dependencies to
./bin/lib/package.jsonmatches the caveat mentioned in the PR description and supports the new publishing approach.
View all
Benchmarks summary: 83/83 OK ✅ |
After #852 the lib became completely broken (apologies!). The idea is okay, but I didn't test it properly and the overall execution using our
misc/builderwas also not a good idea.Problem with previous approach
@typeberry/libnow.Current approach
tsconfig.lib.json.importsinpackage.json).This new approach allows me to remove the builder completely (since
@typeberry/jamand@typeberry/convertare using different build scripts) and I feel that the process is a bit more lightweight now.Caveats
@typeberry/libnow needs to list external dependencies of any potential sub-packages explicitly - for now we only have@typeberry/native,hash-wasm,@noble/ed25519and@fluffylabs/anan-as, but we have to be careful when exposing any new packages.