Skip to content

Take #21 and #22 together, through three breaking migrations - #24

Merged
pedalion-ci[bot] merged 3 commits into
devfrom
fix/dep-bumps-and-port-drift
Oct 25, 2026
Merged

pedalion-ci[bot] merged 3 commits into
devfrom
fix/dep-bumps-and-port-drift

Conversation

@pablo-tech

Copy link
Copy Markdown
Contributor

Closes #21. Closes #22.

Dependabot opened the SDK major and the minor-and-patch batch as two pull requests, and neither could land on its own: #22 failed npm ci at install, because its lockfile predates the overrides entry this change removes, and #21 passed test while failing the app's type-check in twenty places. They are the same work seen twice, so they are taken as one.

The three migrations inside them

Each established from the installed packages, not inferred.

@anthropic-ai/sdk 0.127.0 → 1.3.0 MessageParam admitted a system-role turn; Usage's counts became optional; temperature and top_p were removed outright
@pablotech/akesi 0.1.58 → 0.1.70 ModelUsage counts went nullable, StreamEvent narrowed to { type: string }, and the domain-free half of the benchmark harness moved out to @promontory-studio/dokimasia
16 minor/patch bumps mechanical

The shape of the fix

The app already named akesi's port in three files, so it names it in nine now. apps/lexitar/src/lib/model-port.ts is the one home for the two statements this app makes beyond what the port itself states:

  • A request's turns are user and assistant only. That is narrowing to what is actually sent rather than widening the port to a shape it would have to handle — validateMessages refuses a system-role turn from the browser, and the system prompt rides in the request's own system field. One change to Corpus.turns is the root fix for four of the call sites.
  • A stream event's text delta, read in one place by both the streaming route and the adapter test, so the test exercises the read the route performs.

The nullable token counts collapse to tokenUsage in apps/lexitar/functions/_lib/log.ts, placed beside the non-nullable type it feeds and following that file's own stated rule about latencyMs: an omitted count is honest, a 0 is a measurement that never happened. leaf-regen-anthropic.ts is the one genuine exception and says why — an accumulator cannot omit, so a provider reporting nothing adds nothing.

temperature and top_p are deleted from the OpenAI adapter rather than preserved: they were translating fields the source API no longer has.

Three dependency decisions, none of them a bump

AGENTS.md says not to add or remove a dependency without asking, so each is stated rather than buried in the diff.

  • The root overrides pin on @anthropic-ai/sdk is removed. tsconfig.app.json recorded why it existed — to satisfy akesi's optional SDK peer range — which made npm lay down a second copy that TypeScript treats as a distinct nominal type, and the paths mapping existed to undo that. akesi 0.1.70 declares no SDK peer at all, so the accommodation has no subject. Measured after removal: exactly one copy, resolving 1.3.0. Both tsconfigs' paths entries go with it.
  • @promontory-studio/dokimasia ^0.3.4 is added as a devDependency of apps/lexitar, because akesi moved the probe loop, the budget, the scoring and the statistics there and now consumes it as an optional peer.
  • svelte-check is held at ^4.4.8, not bumped to 4.7.7. No published version accepts this repo's TypeScript: 4.4.8 declares typescript >=5.0.0, 4.7.7 declares ^5.0.0 || ^6.0.0, and the repo pins ~7.0.2. The caret resolves to 4.7.6.

Gates, run locally before CI

  • npm run check — 0 errors on both halves (svelte-check over tsconfig.app.json, then tsc -p tsconfig.node.json), down from 45 errors in 25 files
  • npm test — 348 files, 4310 tests green under Miniflare
  • TEST_BACKEND=node npm test — the same 4310 green against the filesystem backend
  • npm run lint — clean
  • packages/frame — typecheck 0 errors, 87 tests green

CI is the authority; a worktree's node_modules was verified to resolve inside this tree before any of the above was trusted.

🤖 Generated with Claude Code

Dependabot opened the SDK major and the minor-and-patch batch as two pull
requests, and neither could land on its own: #22 failed `npm ci` at install
because its lockfile predates the override this change removes, and #21 passed
`test` while failing the app's type-check in twenty places. Both are the same
work seen twice, so they are taken as one.

Three migrations are bundled inside them, each established from the installed
packages rather than inferred:

@anthropic-ai/sdk 0.127.0 -> 1.3.0 admitted a system-role turn into
`MessageParam`, made `Usage`'s counts optional, and removed `temperature` and
`top_p` outright. akesi 0.1.70 moved the domain-free half of its benchmark
harness out to @promontory-studio/dokimasia and declares no SDK peer at all.

So the app names akesi's port where it talks to the port, which it already did
in three files and now does in nine. `src/lib/model-port.ts` is the one home
for the two statements this app makes beyond what the port states: a request's
turns are user and assistant only, which is narrowing to what is actually sent
rather than widening the port — `validateMessages` refuses a system turn from
the browser and the system prompt rides in the request's own `system` field —
and a stream event's text delta, read in one place by both the streaming route
and the adapter test.

The nullable token counts collapse to `tokenUsage` in `functions/_lib/log.ts`,
beside the non-nullable type it feeds and following that file's own rule about
`latencyMs`: an omitted count is honest, a 0 is a measurement that never
happened. `leaf-regen-anthropic.ts` is the one exception and says why — an
accumulator cannot omit, so it adds nothing and that is what the provider
reported.

Three dependency decisions, none of them a bump:

- The root `overrides` pin on @anthropic-ai/sdk is removed. `tsconfig.app.json`
  recorded why it existed — to satisfy akesi's optional SDK peer range, which
  made npm lay down a second copy that TS treats as a distinct nominal type —
  and akesi 0.1.70 declares no such peer, so the accommodation has no subject.
  Measured after removal: one copy, at 1.3.0. Both tsconfigs' `paths` entries
  existed only to undo it and go with it.
- @promontory-studio/dokimasia ^0.3.4 is added as a devDependency of
  apps/lexitar, because akesi moved the probe loop, the budget, the scoring and
  the statistics there and consumes it as an optional peer.
- svelte-check is held at ^4.4.8 rather than bumped to 4.7.7. No published
  version accepts this repo's TypeScript: 4.4.8 declares `typescript >=5.0.0`,
  4.7.7 declares `^5.0.0 || ^6.0.0`, and the repo pins ~7.0.2.

Gates: `check` clean on both halves, 4310 tests green under Miniflare and again
under the filesystem backend, `lint` clean, and packages/frame's own typecheck
and 87 tests green.

Signed-off-by: Pablo Rodriguez <contact@promontory.studio>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 25, 2026 •

Copy link
Copy Markdown

Deploying health-dash-main with  Cloudflare Pages  Cloudflare Pages

Latest commit: 5b9527e
Status: ✅  Deploy successful!
Preview URL: https://e699f56e.health-dash-prod.pages.dev
Branch Preview URL: https://fix-dep-bumps-and-port-drift.health-dash-prod.pages.dev

View logs

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 25, 2026 •

Copy link
Copy Markdown

Deploying health-dash-dev with  Cloudflare Pages  Cloudflare Pages

Latest commit: 5b9527e
Status: ✅  Deploy successful!
Preview URL: https://24f37a4e.health-dash-aex.pages.dev
Branch Preview URL: https://fix-dep-bumps-and-port-drift.health-dash-aex.pages.dev

View logs

Pablo Rodriguez and others added 2 commits October 25, 2026 11:23
The lexitar job failed on `npm run coverage` with

  Cannot find package '@vitest/coverage-v8' imported from
  node_modules/vitest/dist/chunks/coverage.cTDc4uSS.js

and the cause is a placement, not a version. vitest loads the provider by a
dynamic import from its own installed location, so Node walks up from
node_modules/vitest/ — and a copy at apps/lexitar/node_modules/ is not on that
path however the command is invoked. Running it from the workspace directory
makes no difference, which is why this reproduced locally with the same message.

coverage-v8 5.0.1 happened to hoist because its obug range matched what
@sveltejs/vite-plugin-svelte already pulled to the root; 5.0.5 needs obug 3 and
so takes a private copy, which drags the provider down with it. Declaring the
provider where its consumer lives decides the placement outright instead of
leaving it to a transitive range — the app still has no direct import of it, and
`vitest run --coverage` in the workspace resolves it from the root as designed.

Measured on a clean install: 348 files / 4310 tests pass under coverage, and the
same suite passes on both backends; svelte-check reads 0 errors over 1719 files
and packages/frame 0 over 436.

Signed-off-by: Pablo Rodriguez <contact@promontory.studio>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…xe 4.14's new rule

The dependency bumps moved axe-core 4.13.0 -> 4.14.0, and the markers view went
from 1 violation to 2 on markup this branch does not touch. An A/B on one
unchanged tree settles that: 4.13.0 reads color-contrast x48 and nothing else,
4.14.0 reads color-contrast x41 plus label-content-name-mismatch x7.

The seven nodes are the .mc-figure-toggle buttons, and chasing the rule found a
real defect underneath it that no engine reported. The button's bare aria-label
REPLACED the inner <svg role="img">'s own for name computation, so the marker's
latest value, status and date were announced nowhere: a screen-reader user on
the Markers page heard "Expand details for ApoB, button" and no reading.
chartLabel is now part of the button's name, which is the fix worth having.

It does not clear the rule, and nothing written there could. A live DOM read of
the first toggle returns the plot's axis ticks - "Jan", "Apr", "60.0", "90.0" -
as the button's visible text, with axe still reporting the mismatch even under
role="presentation" aria-hidden="true", so WCAG 2.5.3 as 4.14 implements it
asks a chart-inside-a-button's accessible name to contain its tick marks.
Marking the svg presentational was measured (still 7) and reverted, having
bought nothing. So the markers notch goes 1 -> 2 with that measurement written
beside it, which is the escape the spec's own docblock provides and the same
posture it already takes toward color-contrast x41.

Signed-off-by: Pablo Rodriguez <contact@promontory.studio>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checked the SDK 1.x/akesi 0.1.70 migration end to end: ModelTurns/textDelta narrowing matches chat.ts's user|assistant validation, tokenUsage omits rather than zeroes partial counts while the three accumulators keep their ?? 0, dokimasia's stats/probe/budget split is wired consistently across scripts+tests, the tsconfig paths removal is justified by the single hoisted SDK copy in the lock, and the axe 4.14 baseline raise is documented as an engine move with the chart-toggle name fix kept on its own merits. Non-blocking nits: ModelTurn (model-port.ts:17) is an unused export, ranges-anthropic.ts:22/24 import twice from model-client, and a11y.spec.ts:44 still says color-contrast ×30 next to the new ×41 measurement.

@pedalion-ci
pedalion-ci Bot merged commit dd43056 into dev Oct 25, 2026
17 checks passed
@pedalion-ci
pedalion-ci Bot deleted the fix/dep-bumps-and-port-drift branch October 25, 2026 19:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant