@livestore/devtools-web-common is an npm-scope orphan (absorbed into adapter-web, never deprecated)

[schickling-assistant]

@livestore/devtools-web-common is published on npm, is named as a runtime dependency by every published @livestore/adapter-web, and no longer exists in this repository.

What happened

It was a core workspace package (packages/@livestore/devtools-web-common/) and was absorbed, not relocated. Commit e4f3b42d2 ("Add LiveStore repo topology contract", 2026-06-07) deleted the package directory and in the same commit added packages/@livestore/adapter-web/src/web-worker/client-session/devtools-web-channel.ts plus a ./devtools-web-channel export subpath on adapter-web. The code moved into adapter-web.

It was never deprecated on npm.

Current state

git grep devtools-web-common -- ':!pnpm-lock.yaml' returns nothing in source. The lockfile resolves it at three versions, each nested under a different published adapter-web:

published adapter-web	→ devtools-web-common
0.3.1	0.3.1
0.4.0	0.4.0
0.4.0-dev.25	0.4.0-dev.27

pnpm isolates each, so there is no runtime hazard in this repo's own builds — it is install weight in the docs sample workspace.

Why it matters beyond hygiene

Two @livestore packages from the same release line are live on npm at different version numbers (adapter-web@0.4.0-dev.25 shipping devtools-web-common@0.4.0-dev.27). That drift happened underneath the changesets fixed group, because the package fell out of the group when it left the workspace.

So version-consistency enforcement that checks only the current workspace (assertFixedVersions → publicLivestorePackages()) cannot see a package that has already escaped. That is a gap worth closing independently of this package.

There is also a maintenance exposure: a published @livestore/* package that cannot be rebuilt, patched, or security-fixed from source, still named as a dependency by a current package.

Suggested actions

• npm deprecate @livestore/devtools-web-common pointing at @livestore/adapter-web/devtools-web-channel
• Confirm the next adapter-web publish drops the dependency (the source change already landed)
• Add a consistency check against packages published under the @livestore scope, not only against what the workspace builds
• Once deprecated, remove the defensive forbidden = ['devtools-web-common', '@livestore/devtools-web-common'] guard in livestore-contrib's devenv.nix — it exists to catch this name leaking into the composed workspace

Found while auditing version-coupling mechanisms for #1497. Unrelated to that epic.

Posted on behalf of @schickling

field	value
agent_name	cl1-reef
agent_session_id	f54dccb2-7cbf-4ab6-af33-c23c984cc1a3
agent_tool	Claude Code
agent_tool_version	2.1.220
agent_runtime	Claude Code 2.1.220
agent_model	claude-opus-5
runtime_profile	/nix/store/g65ryv9zcr8acxxjlpgcrynh8d7s7qwn-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/hiw5ggfjp9mr78vbrq30i77ypfyixv32-agent-skills-corpus/share/agent-skills/manifest.json
worktree	livestore-contrib/schickling/2026-07-27-devtools
machine	dev3
tooling_profile	dotfiles@unknown-dirty