Cleanup list from an internal review (2026-08-16). The -core seam is principled (validatabl/limitabl/transformabl-core: zero-dep, 600-780 LOC each, well-tested, consumed directly). The rest:
Dead / ghost:
explicabl-core: 0-byte sources, package.json names it @gatewaystack/observability-core, absent from root build. Delete.compat, integrations: no package.json (npm workspaces ignores them), 16 LOC combined, yet docs/packages.md:53-57 advertises compat as shipped. Delete or fold into fixtures.- ~12 empty pre-monorepo leftover files at package roots (identifiabl-core/verifyJwt.ts etc.).
proxyabl/src/tool-gateway.ts — 1,339 lines (44% of the package), NOT exported from the index, no consumer. Delete.
Wrapper drift: every consumed -core stays in semver range with downstream; the middleware wrappers (validatabl, limitabl, transformabl) have drifted out of range because nothing imports them. Consolidate the six wrappers into one @gatewaystack/express package or retire them.
Boundary leaks: identifiabl-core redefines GatewayIdentity locally (src/index.ts:15-33) and has drifted from request-context/src/types.ts:7-14; bridged by an unchecked cast at identifiabl/src/index.ts:69. proxyabl's router doesn't route through proxyabl-core's assertUrlSafe (docs/packages.md:37-39 notes this).
Docs vs reality: CLAUDE.md claims all wrappers have vitest suites; four of six have zero tests. Root build script omits limitabl-core, proxyabl-core, explicabl-core.
Proposed end state: ~7 packages — the four cores, request-context, one consolidated express middleware package, explicabl.
Cleanup list from an internal review (2026-08-16). The -core seam is principled (validatabl/limitabl/transformabl-core: zero-dep, 600-780 LOC each, well-tested, consumed directly). The rest:
Dead / ghost:
explicabl-core: 0-byte sources, package.json names it@gatewaystack/observability-core, absent from root build. Delete.compat,integrations: no package.json (npm workspaces ignores them), 16 LOC combined, yet docs/packages.md:53-57 advertises compat as shipped. Delete or fold into fixtures.proxyabl/src/tool-gateway.ts— 1,339 lines (44% of the package), NOT exported from the index, no consumer. Delete.Wrapper drift: every consumed -core stays in semver range with downstream; the middleware wrappers (validatabl, limitabl, transformabl) have drifted out of range because nothing imports them. Consolidate the six wrappers into one
@gatewaystack/expresspackage or retire them.Boundary leaks: identifiabl-core redefines GatewayIdentity locally (src/index.ts:15-33) and has drifted from request-context/src/types.ts:7-14; bridged by an unchecked cast at identifiabl/src/index.ts:69. proxyabl's router doesn't route through proxyabl-core's assertUrlSafe (docs/packages.md:37-39 notes this).
Docs vs reality: CLAUDE.md claims all wrappers have vitest suites; four of six have zero tests. Root build script omits limitabl-core, proxyabl-core, explicabl-core.
Proposed end state: ~7 packages — the four cores, request-context, one consolidated express middleware package, explicabl.