@simple-module-py/ui imports 14+ npm packages but declares only @simple-module-py/i18n in dependencies

[antosubash]

Summary

@simple-module-py/ui@0.0.3 ships a full set of shadcn-derived components in src/components/ui/*.tsx plus layouts and helpers, but its package.json only declares @simple-module-py/i18n as a runtime dependency. None of the third-party packages those components actually import are listed. Result: any host that depends on @simple-module-py/ui and uses any of those components fails at vite's resolve step with "could not be resolved" against whichever upstream package vite traverses to next.

Reproduction

Fresh sm new host on 0.0.7 (so #105/#106/#107/#108/#109 are out of the way):

uvx --from simple_module_cli sm new my-app --db sqlite --preset standard -y --no-install
cd my-app && cp .env.example .env && make install && make migrate && make gen-pages
cd client_app && npm run dev

Vite output (truncated to the bare-package failures):

Error: The following dependencies are imported but could not be resolved:
 lucide-react (imported by .../users/components/RolesTab.tsx)
 sonner (imported by .../users/pages/Users/Edit.tsx)
 @simple-module-py/ui/components/ui/button (imported by .../users/components/RolesTab.tsx)
 ... [more @simple-module-py/ui subpaths — see #110]

lucide-react and sonner are also imported transitively by @simple-module-py/ui itself (e.g. @simple-module-py/ui/src/components/ui/sonner.tsx imports lucide-react, next-themes, and sonner), so even if the modules didn't import them directly, vite would still hit the missing-dep wall as soon as anything pulled in those @simple-module-py/ui files.

Root cause

client_app/node_modules/@simple-module-py/ui/package.json (v0.0.3):

{
 "name": "@simple-module-py/ui",
 ...
 "peerDependencies": {
 "react": "^19.0.0"
 },
 "dependencies": {
 "@simple-module-py/i18n": "0.0.3"
 }
}

But scanning src/**/*.tsx for non-relative, non-react, non-@simple-module-py/* imports turns up:

$ grep -rh "from ['\\\"]" .../node_modules/@simple-module-py/ui/src/ \\
 | sed -E "s/.*from ['\\\"]([^'\\\"]+)['\\\"].*/\\1/" \\
 | grep -v "^\\.\\|^@simple-module\\|^react\\(\$\\|/\\)\\|^react-dom" | sort -u
@base-ui/react
@inertiajs/react # peer (host singleton) — should be peerDependencies
@testing-library/react # test only — devDependencies
class-variance-authority
clsx
cmdk
embla-carousel-react
input-otp
lucide-react
next-themes
radix-ui
react-day-picker
react-hook-form
react-resizable-panels
recharts
sonner
tailwind-merge
vaul
vitest # test only — devDependencies

That's 14 missing runtime deps, plus @inertiajs/react which should be a peer (so the host's single copy wins), plus vitest and @testing-library/react which belong in devDependencies. (react-dom should also be added to peers — @simple-module-py/ui uses it via the components implicitly even if it isn't imported by name everywhere.)

Proposed fix

Update packages/ui/package.json to:

{
 "peerDependencies": {
 "react": "^19.0.0",
 "react-dom": "^19.0.0",
 "@inertiajs/react": "^2.0.0"
 },
 "dependencies": {
 "@simple-module-py/i18n": "0.0.3",
 "@base-ui/react": "<latest>",
 "class-variance-authority": "<latest>",
 "clsx": "<latest>",
 "cmdk": "<latest>",
 "embla-carousel-react": "<latest>",
 "input-otp": "<latest>",
 "lucide-react": "<latest>",
 "next-themes": "<latest>",
 "radix-ui": "<latest>",
 "react-day-picker": "<latest>",
 "react-hook-form": "<latest>",
 "react-resizable-panels": "<latest>",
 "recharts": "<latest>",
 "sonner": "<latest>",
 "tailwind-merge": "<latest>",
 "vaul": "<latest>"
 },
 "devDependencies": {
 "@simple-module-py/tsconfig": "0.0.3",
 "@testing-library/react": "<latest>",
 "vitest": "<latest>"
 }
}

The exact version ranges should match whatever the source actually targets — likely the same as the framework's internal packages/ui/package.json already has during local dev. The published wheel just lost them somewhere (perhaps the publish flow strips deps that aren't in the source-tree workspace, or a hand-trimmed package.json got published).

Scope of the fix

This is the dominant unblock. Once @simple-module-py/ui declares its own deps:

• npm install in the host's client_app/ pulls them in transitively.
• The lucide-react/sonner errors from inside @simple-module-py/ui's own files go away.
• The remaining failures are then the exports-map issue (filed separately) and the users module importing lucide-react/sonner directly (also filed separately — that one becomes optional once @simple-module-py/ui re-exports them).

Workaround

Add the missing deps to the host scaffold's client_app/package.json and re-run npm install. Tedious because every consumer has to do it.

Environment

• @simple-module-py/ui 0.0.3 (current latest on npm)
• simple_module_cli 0.0.7

[antosubash]

Verified fixed in @simple-module-py/ui@0.0.8. The published package.json now declares all 14+ runtime deps:

"dependencies": {
 "@base-ui/react": "^1.0.0",
 "@simple-module-py/i18n": "0.0.8",
 "class-variance-authority": "^0.7.0",
 "clsx": "^2.0.0",
 "cmdk": "^1.0.0",
 "embla-carousel-react": "^8.0.0",
 "input-otp": "^1.0.0",
 "lucide-react": "^1.8.0",
 "next-themes": "^0.4.0",
 "radix-ui": "^1.4.0",
 "react-day-picker": "^9.0.0",
 "react-resizable-panels": "^4.0.0",
 "recharts": "^3.0.0",
 "sonner": "^2.0.0",
 "tailwind-merge": "^3.0.0",
 "vaul": "^1.0.0"
},
"peerDependencies": {
 "@inertiajs/react": "...",
 "react": "^19.0.0",
 "react-dom": "^19.0.0"
}

⚠️ One catch: a fresh sm new scaffold still pins \"@simple-module-py/ui\": \"^0.0.3\", and npm caret semantics for 0.0.x lock to the exact patch — so npm install keeps pulling 0.0.3 (without these fixes). Filing a separate issue for the scaffold pins.