Configuration via constructor, not global state
Why it matters
Global init() or configure() functions that mutate module-level state break every scenario with multiple concurrent consumers: test suites that need different API keys per test, monorepo apps using the same package with different configurations, and multi-tenant servers handling requests with per-user credentials. ISO 25010 testability and modifiability both require that configuration be isolatable per instance. Module-level state also prevents the garbage collector from cleaning up instances and leaks across test runs.
Severity rationale
Low because the limitation only surfaces when multiple configurations are required in one process — a constraint many simple consumer apps never hit — but the fix is cheap and the pattern is easily corrected.
Remediation
Replace global configuration state with a constructor or factory function that captures config in closure.
// Before — global state:
let globalConfig: Config
export function init(config: Config) { globalConfig = config }
export function doSomething() { /* uses globalConfig */ }
// After — per-instance via factory:
export function createClient(config: Config) {
return {
doSomething() { /* uses config from closure */ }
}
}
This pattern allows test suites to create isolated instances (const clientA = createClient({ apiKey: 'test-key-a' })) and monorepo apps to configure multiple instances independently. All configuration options should have TypeScript types and documented defaults.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the SDK / Package Quality Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.modifiability — Modifiability — per-instance config avoids global mutable state
- iso-25010:2011 · maintainability.testability — Testability — per-instance config allows isolated test setups
Taxons
History
- 2026-04-18·v1.0.0·Initial import from sdk-package-quality·automated