v3.10.0 — Solana packages become optional peers

@solana/web3.js and @solana/spl-token move from optionalDependencies to peerDependencies + peerDependenciesMeta.optional. npm installs optional dependencies automatically; it does not install optional peers. That difference is the entire fix.

Why

@solana/spl-token pulls @solana/buffer-layout-utils → bigint-buffer, whose native toBigIntLE() carries an unpatched buffer overflow (GHSA-3gc7-fjrx-p6mg).

There is no fixed release anywhere. 1.1.5 is the last publish, from 2019, and @trufflesuite/bigint-buffer@1.1.10 ships a byte-identical src/bigint-buffer.c — diffed, it is a prebuild fork, not a security fork. Overriding onto it would launder the advisory without fixing anything.

As an optional dependency it landed in the lockfile of every consumer, including projects that only ever pay on Base and never reach a Solana code path. As an optional peer it reaches only the projects that ask for it.

Verified against real installs of the packed tarball:

@blockrun/llm@3.9.0   →  node_modules/bigint-buffer present
@blockrun/llm@3.10.0  →  neither bigint-buffer nor @solana/spl-token

Migration

Base / EVM-only consumers: do nothing, and get a smaller tree.

Making Solana payments? Install the two packages explicitly:

npm install @solana/web3.js @solana/spl-token

Failure mode is now actionable

New src/solana-deps.ts wraps the three lazy await import() sites. A missing peer throws an error naming the package, the exact install command, and why it is not automatic, instead of a bare ERR_MODULE_NOT_FOUND surfacing from inside a payment call. Confirmed against the packed artifact.

Notes

@anthropic-ai/sdk deliberately stays an optionalDependency. anthropic-compat.ts uses it in type positions (import('@anthropic-ai/sdk').default), so consumers without it installed would fail to typecheck the shipped .d.ts. The Solana packages have no such type exposure, which is why only they can move.

Precedent: 3.6.0 did exactly this to @blockrun/clawrouter, for the same reason — hence a minor bump.

Verified: typecheck, lint, build clean. 241 tests pass, 0 fail, no type errors. CI green on Node 20 / 22 / 24.