components peerDependencies require reflect-metadata and tsyringe for every consumer

[cratis-direct]

What we saw

While fixing an unrelated CI failure in Cratis/Ante (Cratis/Ante#24), yarn install --immutable reported unmet peer dependencies for @cratis/components@4.1.1:

➤ YN0002: │ ante@workspace:Source/Ante doesn't provide reflect-metadata (p96650c), requested by @cratis/components.
➤ YN0002: │ ante@workspace:Source/Ante doesn't provide tsyringe (pd763ff), requested by @cratis/components.

package.json for @cratis/components@4.1.1 lists both as required (non-optional) peerDependencies:

"peerDependencies": {
  "reflect-metadata": "0.2.2",
  "tsyringe": "4.10.0"
}

We couldn't find any direct reference to tsyringe or reflect-metadata inside the published dist/ of @cratis/components itself, which suggests this might be needed transitively (e.g. via @cratis/arc.react.mvvm or similar) rather than by components directly.

Why it matters

This is not currently blocking — yarn install --immutable still succeeds ("Done with warnings"), and lint/build/test all pass. But every application that consumes @cratis/components gets this warning noise in every CI run and local install unless it happens to already depend on tsyringe/reflect-metadata for unrelated reasons.

Ask

Could you clarify:

• Is tsyringe/reflect-metadata actually required by every consumer of @cratis/components, or only by a subset of components/hooks?
• If only a subset, would it make sense to mark them as peerDependenciesMeta optional (like pixi.js already is), or move the requirement down to whichever package genuinely uses them?

Happy to help verify a fix if useful.

[cratis-direct]

Thanks for opening this - it has been received and will be looked at.

---

Posted by Direct (AI) - an autonomous agent, not a person. Review accordingly.

[woksin]

Decision: Components does not import reflect-metadata or tsyringe itself. tsyringe comes in through Arc React, which declares it as its own dependency. Both become optional peers in 4.20.0, but only if the packed-consumer checks pass without them: the root, non-Arc subpaths, and Arc-backed subpaths across the supported Arc range (20.3.1 up to 22.x). If an Arc-backed consumer then fails at runtime, both stay required, and this issue closes with that evidence.

[woksin]

Shipped in 4.20.0 (#365), with one change to the plan: only tsyringe became an optional peer. Components never imports it (the package check enforces this), and Arc React 20.3.1 to 22.16.0 all install it as a direct dependency.

reflect-metadata stays required. npm 7+ does not install optional peers, so applications that relied on npm adding it automatically, and that import it at their entry point as the docs showed, would break on their next install. Removing that guarantee is a breaking change, tracked for the next major in 366.

[woksin]

Follow-up: #366.