AC-858: Align the TypeScript SDK dependency model (#1222)

* chore(ac-858): make the TS SDK dependency model intentional and single-sourced

openai and @anthropic-ai/sdk were declared as both hard dependencies and
optional peers. The integrations load them guardedly (dynamic require /
absence-tolerant), and the repo's sdk-import-discipline gate enforces no
required static imports, so the hard-dependency entries were accidental
duplication. Drop both from dependencies; keep them as optional
peerDependencies (with devDependencies for tests/scripts). Align the
@anthropic-ai/sdk peer range to the documented >=0.18 <2 contract (^0.32
only permitted 0.32.x). npm run lint, sdk-import-discipline, side-effects,
bundle-size, license, no-postinstall, no-telemetry, and the integration
tests all pass.

* fix(ac-858): regenerate npm lockfile, document optional-peer install, extend guards to Anthropic (PR #1222 review)

F1: regenerate ts/package-lock.json so both SDKs are dev-only and the
Anthropic peer range is >=0.18 <2 (the repo tracks package-lock.json
alongside bun.lock; the prior commit updated only bun.lock).

F2: README documents installing the now-optional provider SDKs
(npm/bun install autoctx @anthropic-ai/sdk, and openai), with a reminder
above the Anthropic example that imports the peer.

F3: extend the SDK guards to the Anthropic half. check-sdk-import-discipline
now covers integrations/anthropic + detectors/anthropic-{python,ts} (a static
@anthropic-ai/sdk import there now fails, verified), and check-no-telemetry
scans the Anthropic source dirs. The license/postinstall/telemetry transitive
roots stay openai-only by design: no shipped source imports or requires
@anthropic-ai/sdk, so its tree is outside our runtime closure (documented).

Author: jayscambler

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [Unreleased]
+
+### Changed
+
+- The TypeScript package no longer declares `openai` and `@anthropic-ai/sdk` as both hard `dependencies` and optional peers. They are now optional `peerDependencies` (with `devDependencies` for tests and scripts), matching how the integrations load them (guarded, absence-tolerant). The `@anthropic-ai/sdk` peer range is aligned to the documented `>=0.18 <2` compatibility contract (the prior `^0.32` only permitted `0.32.x`). Consumers that do not use the OpenAI or Anthropic integrations no longer pull the SDKs transitively (AC-858).
+
 ## [0.12.0] - 2026-07-19
 
 ### Added

ts/README.md

@@ -14,6 +14,19 @@ npm install -g autoctx
 
 Important: use `autoctx`, not `autocontext`. `autocontext` on npm is a different package and not this project.
 
+### Optional provider SDKs
+
+The OpenAI and Anthropic integrations (`autoctx/integrations/openai`, `autoctx/integrations/anthropic`) and their detectors treat the provider SDKs as optional peer dependencies, so installing `autoctx` does not pull them in. Install the one you use alongside `autoctx`:
+
+```bash
+# Anthropic integration and the Anthropic examples below
+npm install autoctx @anthropic-ai/sdk
+# OpenAI integration
+npm install autoctx openai
+```
+
+(Bun: `bun add autoctx @anthropic-ai/sdk` or `bun add autoctx openai`.) The integrations degrade gracefully when the SDK is absent, but any example that imports a provider SDK requires it to be installed.
+
 From a checkout:
 
 ```bash
@@ -180,6 +193,8 @@ import { connectMcpRuntimeTools } from "autoctx/runtimes/mcp";
 
 ## Production traces
 
+Requires the optional `@anthropic-ai/sdk` peer (`npm install @anthropic-ai/sdk`, or `openai` for the OpenAI integration). See [Optional provider SDKs](#optional-provider-sdks).
+
 ```ts
 import Anthropic from "@anthropic-ai/sdk";
 import { FileSink, instrumentClient } from "autoctx/integrations/anthropic";

ts/bun.lock

@@ -190,7 +190,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@anthropic-ai/sdk": "^0.32",
+    "@anthropic-ai/sdk": ">=0.18 <2",
     "openai": "^4"
   },
   "peerDependenciesMeta": {
@@ -202,17 +202,18 @@
     }
   },
   "devDependencies": {
+    "@anthropic-ai/sdk": "^0.91.1",
     "@apidevtools/json-schema-ref-parser": "^15.3.5",
     "@types/better-sqlite3": "^7.6.0",
     "@types/react": "^18.3.0",
     "@types/ws": "^8.5.13",
     "fast-check": "^4.7.0",
     "json-schema-to-typescript": "^15.0.4",
+    "openai": "^4",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.91.1",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "ajv": "^8.18.0",
     "ajv-formats": "^3.0.1",
@@ -221,7 +222,6 @@
     "ignore": "5.3.2",
     "ink": "^5.1.0",
     "ink-text-input": "^6.0.0",
-    "openai": "^4",
     "react": "^18.3.1",
     "secure-exec": "^0.1.0",
     "tree-sitter": "0.21.1",

ts/package-lock.json

@@ -38,7 +38,9 @@ const ALLOWLIST = new Set([
   "(BSD-3-Clause OR MIT)",
 ]);
 
-// Roots: production-traces/sdk direct deps + openai peer dep used by integrations/openai
+// Roots: production-traces/sdk direct deps + openai peer dep used by integrations/openai.
+// @anthropic-ai/sdk is intentionally absent: no shipped source imports or requires it,
+// so its transitive tree is not part of our runtime closure to audit.
 const SDK_RUNTIME_ROOTS = ["ajv", "ajv-formats", "ulid", "openai"];
 
 if (!existsSync(PKG_LOCK)) {

ts/package.json

@@ -31,7 +31,9 @@ const SELF_PKG = join(ROOT, "package.json");
 const STRICT_HOOKS = ["preinstall", "install", "postinstall"];
 const SELF_ONLY_HOOKS = ["prepublish", "prepare"];
 
-// Roots: production-traces/sdk direct deps + openai peer dep used by integrations/openai
+// Roots: production-traces/sdk direct deps + openai peer dep used by integrations/openai.
+// @anthropic-ai/sdk is intentionally absent: no shipped source imports or requires it,
+// so its transitive tree is not part of our runtime closure to audit.
 const SDK_RUNTIME_ROOTS = ["ajv", "ajv-formats", "ulid", "openai"];
 
 function loadPkg(path) {

ts/scripts/check-license-compatibility.mjs

@@ -28,11 +28,17 @@ const PKG_LOCK = join(ROOT, "package-lock.json");
 const SUBPATH_SRC_DIRS = [
   join(ROOT, "src", "production-traces", "sdk"),
   join(ROOT, "src", "integrations", "openai"),
+  join(ROOT, "src", "integrations", "anthropic"),
   join(ROOT, "src", "control-plane", "instrument", "detectors", "openai-python"),
   join(ROOT, "src", "control-plane", "instrument", "detectors", "openai-ts"),
+  join(ROOT, "src", "control-plane", "instrument", "detectors", "anthropic-python"),
+  join(ROOT, "src", "control-plane", "instrument", "detectors", "anthropic-ts"),
 ];
 
-// Roots: production-traces/sdk direct deps + openai peer dep used by integrations/openai
+// Roots: production-traces/sdk direct deps + openai peer dep used by integrations/openai.
+// @anthropic-ai/sdk is intentionally absent: no shipped source imports or requires
+// it (the Anthropic integration processes provider data shapes), so its transitive
+// tree is not part of our runtime closure to audit.
 const SDK_RUNTIME_ROOTS = ["ajv", "ajv-formats", "ulid", "openai"];
 
 const TELEMETRY_IMPORT_RES = [