Minimal runtime dependencies

Every dependency in dependencies is installed by every consumer, even in production. TypeScript, @types/*, test runners, and build tools in dependencies instead of devDependencies inflate the install footprint of every project that depends on yours. node-fetch as a runtime dependency in a package that declares engines: { node: '>=18' } installs a redundant polyfill of a built-in. CWE-1357 covers use of unnecessarily broad components; SLSA L1 and SSDF PO.3.2 both require that the published artifact's dependency tree is intentional and minimal.

Audit dependencies and move build tools, type packages, and test frameworks to devDependencies. Replace convenience packages with built-in equivalents.

// Before — misplaced deps:
{
  "dependencies": {
    "typescript": "^5.0.0",
    "@types/node": "^20.0.0",
    "node-fetch": "^3.0.0",
    "vitest": "^1.0.0"
  }
}

// After — clean runtime deps:
{
  "dependencies": {},
  "devDependencies": {
    "typescript": "^5.0.0",
    "@types/node": "^20.0.0",
    "vitest": "^1.0.0"
  }
}

Run npx depcheck to surface unused dependencies. Replace node-fetch with built-in fetch (Node 18+) and uuid with crypto.randomUUID(). Target: no more than 10 runtime dependencies for a typical SDK.