[dahlia]

Move @fedify/vocab and @js-temporal/polyfill from devDependencies to dependencies so isolated installs can load @fedify/testing without relying on hoisting. Keep the existing version ranges and public API unchanged.

Test real tarballs in an isolated pnpm consumer with hoisting disabled so workspace dependencies cannot hide missing declarations. ESM/CommonJS loads pass on Node.js and Bun. All 29 package tests pass on Deno, Node.js, and Bun; mise run check also passes.

Fixes #1305.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T15:28:02.601810Z	12adddf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e9824cd5-a761-48bd-acc3-7d417dc50433

📥 Commits

Reviewing files that changed from the base of the PR and between b27d9a5 and 12adddf.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 6

• CHANGES.md
• changes.d/testing/missing-runtime-dependencies.md
• mise.toml
• packages/testing/package.json
• packages/testing/src/package.test.ts
• scripts/test_testing_pack.mjs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

@fedify/testing now declares @fedify/vocab and @js-temporal/polyfill as runtime dependencies. The change adds package metadata checks and an isolated packed-package test that exercises ESM and CommonJS imports under Node.js and Bun.

Changes: Testing package runtime dependencies

Layer / File(s)	Summary
Declare runtime dependencies packages/testing/package.json, packages/testing/src/package.test.ts, CHANGES.md, changes.d/testing/missing-runtime-dependencies.md	The package manifest moves @fedify/vocab and @js-temporal/polyfill to runtime dependencies. Metadata tests check their placement and retain @fedify/fixture as a development dependency. The changelog records the dependency change.
Validate isolated package installs mise.toml, scripts/test_testing_pack.mjs	A new mise task builds the package and runs a test that checks packed metadata, installs tarballs in an isolated consumer without hoisting, and runs ESM and CommonJS smoke tests under Node.js and Bun.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: 2chanhaeng

Merge Risk: ⚪ Minimal · up to 12add

Installing @fedify/testing now pulls in the packages it imports at runtime, so imports work without dependency hoisting. No actionable merge risk remains.

Pre-merge checks: 3 · 1 · 1

Failed checks: 1 warning · 1 inconclusive

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (4 skipped: 4 …	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check		The changes satisfy the reviewable requirements in #1305: packages/testing/package.json moves @fedify/vocab and @js-temporal/polyfill to dependencies, keeps @fedify/fixture in `devDependenci…	Provide reviewable evidence for the required pnpm-lock.yaml update, or remove the exclusion so the lockfile change can be assessed.

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: declaring the runtime dependencies for @fedify/testing.
Description check		The description accurately explains the dependency changes, isolation testing, compatibility checks, and preserved public API. It is directly related to the changeset.
Out of Scope Changes check		The reviewed changes remain within #1305. The changelog entries document the runtime dependency fix. The mise.toml task, package metadata tests, and tarball consumer test validate the requested pack…

Full details: Out of Scope Changes check

Explanation

The reviewed changes remain within #1305. The changelog entries document the runtime dependency fix. The mise.toml task, package metadata tests, and tarball consumer test validate the requested packaging behavior. No unrelated implementation or public API change is identified.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (4 skipped: 4 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Full details: Linked Issues check

Explanation

The changes satisfy the reviewable requirements in #1305: packages/testing/package.json moves @fedify/vocab and @js-temporal/polyfill to dependencies, keeps @fedify/fixture in devDependencies, and adds metadata tests. scripts/test_testing_pack.mjs tests packed tarballs in an isolated, non-hoisted pnpm consumer under Node.js and Bun with ESM and CommonJS loads. The public API is unchanged. The issue also requires a lockfile update, but pnpm-lock.yaml is excluded from review, so that requirement cannot be verified.

Resolution

Provide reviewable evidence for the required pnpm-lock.yaml update, or remove the exclusion so the lockfile change can be assessed.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.