It now occurs to me that devDependencies include things like unit test libraries that it is useful to include as an "actual dependency." I think this was the original motivation behind including them in the list of deps. Is their presence causing major issues?

I think that's rare especially for code you depend on -- you might have a point for code in your own environment. But w/ deps at least you're not going to be distributing tests or using them in actual code.

I think the npm convention is deps are for distribution and devDeps aren't, and you should only receive production-ready releases. Note the NPM install --production flag: https://docs.npmjs.com/cli/install, it seems like if people are using devDependencies to include "actual dependencies", they're not using devDependencies correctly.

So if you're depending on a package, you don't care about their dev-deps, only their production-ready release. Maybe there's a way we can provide a flag to srclib-javascript, so that if it's a local root project, we care about devDeps, but otherwise we ignore?

Also: what are your thoughts on peerdeps?

Default npm install behavior:

By default, npm install will install all modules listed as dependencies. With the --production flag (or when the NODE_ENV environment variable is set to production), npm will not install modules listed in devDependencies.