Share kysely, hono, stripe and pgstencil with applications as peers

[nedtwigg]

Apps that import kysely directly got a second copy whenever Renovate bumped theirs, because every pgstencil package pinned its own kysely: 0.29.5. Kysely classes have #private fields, so the two copies are incompatible types. That is why diffplug/type-the-rhythm#355 fails typecheck.

Dependency policy (documented in PACKAGES.md → Dependencies)

• Peers, owned by the app: kysely (all packages), hono (auth), stripe (stripe, since Billing takes the app's Stripe client), and pgstencil (auth and stripe, because pgstencil/diagnostics keeps request scope in AsyncLocalStorage). Each is also a devDependency, so this workspace still installs and tests it.
• Private, owned by pgstencil: better-auth (~1.7.3, patch releases only), jose, openid-client, pg, node-pg-migrate, testcontainers, cheerio, turndown. These now use version ranges instead of exact pins. A new login provider or Better Auth plugin belongs in @pgstencil/auth, not in an app.

Renovate

.github/renovate.json follows the other repos' conventions: Monday schedule, release-age cooldowns, majors held for dashboard approval, and a vulnerabilityAlerts block that keeps its cooldown. Library-specific rules:

• Peers use widen. An in-range release only updates the devDependency copy that CI tests; an out-of-range release widens the peer range.
• Published packages' private dependencies use bump, which raises the minimum to the version CI tested.
• kysely is grouped with kysely-codegen, and hono with @hono/**. @types/node is capped to Node 24.

A local renovate --platform=local --dry-run=lookup showed peers getting no range updates for in-range releases, kysely 0.29.6 arriving as a lockfile-only change, and better-auth ~1.7.3 → ~1.7.5. The config validates with renovate-config-validator --strict.

pnpm-workspace.yaml also gets minimumReleaseAge: 1440, matching the apps.

packages:verify

The packed consumer now declares each peer at the version the workspace tests, with auto-install-peers=false and strict-peer-dependencies=true. I checked locally that an out-of-range kysely (0.28.11) and a missing hono both fail its install. A missing kysely does not fail, because pnpm fills it from better-auth's own kysely dependency, so there is still only one copy.

Testing

• pnpm check: format, typecheck, and all 160 tests
• pnpm db:verify
• the example-workers build
• pnpm packages:verify

Apps

type-the-rhythm and dormouse vendor this commit (297edf6) in their own PRs. Please merge with a merge commit, as before, so that commit stays in main's history.

🤖 Generated with Claude Code