Design Proposal: Move CLI to separate package.

[WAKayser]

Design Proposal: Move CLI to separate package.

Motivation

Currently dependencies for the CLI are always installed. Even when not intended to be used as a tool.

Proposed Change

Create a new package called style-spec-cli that handles the CLI aspect of the current package. And remove the bin folder from this currrent package. This means 3 dependencies can be removed.

API Modifications

No API changes probably except for CLI removal.

Migration Plan and Compatibility

Needs a major release of this package. maplibre gl could depend on the cli untill next major release. that way the commands will stay available.

Rejected Alternatives

create two new packages. core and cli. one containing most of the code the other the cli. the current package will be an umbrella package installing both. on next major update of maplibre-gl you can update to use core.

[HarelM]

In fail to see the motivation to do it... Can you elaborate on that?

[CommanderStorm]

@WAKayser could you go into details on why you would like to see this change?
The common bundlers should just tree-shake them out, or are the bundlers not smart enough for this?

[WAKayser]

You are right. Bundlers should be smart enough to remove it. For the end user there shouldn't be a difference.

But the benefit is in reducing the amount of installed dependencies on developer machines. If any of the three packages are ever contain malicious code it is better not to have it.

Furthermore this would also remove filesystem io from this package. The benefit of that is easier to show that the package is safe. If it was ever added back in, automated dependency checkers cam detect this and warn users.

My goal is mostly to secure the supply chain for the developers.

[CommanderStorm]

According to the OpenSSF scorecard, this is not our highest priority in terms of securing the supply chain.
I agree that we have much to do in this department and would love to have help in this department, the problem 😉

I am not sure how your automated dependency checkers work, they should just be able to verify that we are not actually doing network requests, so I consider this low priority.