refactor(connectors): make @lobu/connectors private#1028
Conversation
@lobu/connectors (BUSL-1.1 connector implementations) was published but is never installed or resolved as a package: nothing depends on it, and the CLI ships its source via build.cjs (`../connectors/src` → dist/connectors + the build-time catalog manifest), not via npm. Mark it private and drop it from the publish set — same pattern as the already-private @lobu/pgvector-embedded. - private: true on packages/connectors/package.json - removed from publish-packages.mjs, release-please-config.json extra-files, bump-version.mjs worker + embeddings intentionally stay public: unlike the pure-bundle @lobu/server, they're npm-delivered runtime closures (pi-coding-agent / @xenova/transformers) resolved at runtime via require/import.meta.resolve; privatizing them would break `npx @lobu/cli`. Part 2 of the 9.3.0 re-tier.
📝 WalkthroughWalkthroughThe PR redirects automated release and publishing infrastructure from the ChangesPackage Publishing Pipeline Migration
🎯 2 (Simple) | ⏱️ ~8 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/connectors/package.json (1)
21-23: 💤 Low valueConsider removing the
publishConfigblock.The package is now marked
private: true, so npm will never publish it regardless ofpublishConfig. Removing this block would eliminate the apparent contradiction and clarify intent for future maintainers.♻️ Proposed cleanup
- "publishConfig": { - "access": "public" - }, "repository": {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/connectors/package.json` around lines 21 - 23, Remove the unnecessary "publishConfig" block from the package.json (the "publishConfig" object) since the package is already marked "private": true; delete the entire publishConfig entry to avoid contradiction and clarify intent for maintainers.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/connectors/package.json`:
- Line 4: The package.json in packages/connectors was modified (the "private":
true change) but bun.lock was not regenerated; run the required steps: update
the submodule and regenerate the lockfile with git submodule update --init
packages/owletto && bun install --frozen-lockfile, then stage and commit the
updated bun.lock alongside the package.json change so the lockfile matches the
change to packages/connectors.
---
Nitpick comments:
In `@packages/connectors/package.json`:
- Around line 21-23: Remove the unnecessary "publishConfig" block from the
package.json (the "publishConfig" object) since the package is already marked
"private": true; delete the entire publishConfig entry to avoid contradiction
and clarify intent for maintainers.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b4153555-a3c0-49e8-8149-86832cd3c833
📒 Files selected for processing (4)
packages/connectors/package.jsonrelease-please-config.jsonscripts/bump-version.mjsscripts/publish-packages.mjs
💤 Files with no reviewable changes (3)
- release-please-config.json
- scripts/bump-version.mjs
- scripts/publish-packages.mjs
| { | ||
| "name": "@lobu/connectors", | ||
| "version": "9.2.0", | ||
| "private": true, |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check if bun.lock was modified in the same commit as package.json changes
# Get the commit SHA for this PR branch
COMMIT=$(git rev-parse HEAD)
# List files changed in the current commit
echo "Files changed in commit $COMMIT:"
git diff-tree --no-commit-id --name-only -r "$COMMIT" | grep -E '(bun\.lock|package\.json)'
# Check if bun.lock was modified
if git diff-tree --no-commit-id --name-only -r "$COMMIT" | grep -q "bun.lock"; then
echo "✓ bun.lock was modified in this commit"
else
echo "✗ WARNING: bun.lock was NOT modified in this commit"
echo " Coding guidelines require regenerating the lockfile alongside package.json changes"
fiRepository: lobu-ai/lobu
Length of output: 259
Regenerate and commit bun.lock with the package.json change
packages/connectors/package.json was changed, but bun.lock was not modified in the same commit, so the required git submodule update --init packages/owletto && bun install --frozen-lockfile + lockfile commit step is missing.
Run git submodule update --init packages/owletto && bun install --frozen-lockfile and commit the regenerated bun.lock in the same change.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/connectors/package.json` at line 4, The package.json in
packages/connectors was modified (the "private": true change) but bun.lock was
not regenerated; run the required steps: update the submodule and regenerate the
lockfile with git submodule update --init packages/owletto && bun install
--frozen-lockfile, then stage and commit the updated bun.lock alongside the
package.json change so the lockfile matches the change to packages/connectors.
2 participants
What
Marks
@lobu/connectorsprivate and stops publishing it. Part 2 (final) of the 9.3.0 package re-tiering.@lobu/connectors(BUSL-1.1 connector implementations) was published to npm but never installed or resolved as a package: nothingdependson it, and it's neverrequire.resolve/import.meta.resolve'd at runtime. The CLI ships its source viabuild.cjs(../connectors/src→dist/connectors, plus the build-time catalog manifest), entirely from the monorepo — not via npm. So publishing it added a registry entry + trusted-publisher surface for nothing.Same pattern as the already-private
@lobu/pgvector-embedded.Changes
private: trueonpackages/connectors/package.jsonpublish-packages.mjs,release-please-config.jsonextra-files,bump-version.mjsWhy worker + embeddings stay public (revised from the original plan)
Investigation showed both are npm-delivered runtime closures, not bundleable like the pure-TS
@lobu/server:@lobu/embeddingscarries@xenova/transformers(ML runtime); statically imported byconnector-workerAND resolved at runtime viaimport.meta.resolve("@lobu/embeddings/server")(spawned local service).@lobu/workercarriespi-coding-agent(+bunpeerDep); spawned viarequire.resolve("@lobu/worker"), not vendored.Privatizing either would break
npx @lobu/cliin ways CI (running in-monorepo) wouldn't catch. Keeping them public is the correct call.Validation
make build-packagesgreen (incl. server catalog-manifest + CLIbuild.cjs) with connectors private.tsc --noEmit+ biome clean (pre-commit).sdk-e2eexercises a local connector end-to-end.Net for 9.3.0
11 published → 9:
@lobu/sdkfolded into@lobu/cli/config(#1026) +@lobu/connectorsprivatized.Summary by CodeRabbit