aws-xray-sdk-fetch: move tsd from dependencies to devDependencies

[DmitryMarkov]

Summary

sdk_contrib/fetch/package.json declares tsd as a runtime dependency, but tsd is only used to run TypeScript declaration tests via the test and test-d scripts. It is never require()d by any file in lib/.

Impact

tsd@0.28.x transitively pulls in @tsd/typescript (~52 MB) plus a top-level hoisted typescript (~24 MB). Every consumer who runs npm install --production or yarn install --production ships ~80 MB of unused TypeScript compiler binaries with their application.

For AWS Lambda users specifically, this is more than an inconvenience — it can push deployments past Lambda's 250 MB unzipped layer/function limit. We hit this directly.

After installing only aws-xray-sdk-fetch@3.12.0 and its declared dependencies:

node_modules/tsd          1.3 MB
node_modules/@tsd        55   MB   (← @tsd/typescript)
node_modules/typescript  24   MB   (← hoisted via tsd → typescript)

Verification that tsd is unused at runtime

lib/fetch_p.js only requires:

const AWSXRay = require('aws-xray-sdk-core');
require('./subsegment_fetch');

grep -r "tsd" lib/ returns nothing.

Proposed fix

Move tsd from dependencies to devDependencies in sdk_contrib/fetch/package.json:

-  "dependencies": {
-    "tsd": "^0.28.1"
-  }
+  "devDependencies": {
+    ...,
+    "tsd": "^0.28.1"
+  }

tsd is invoked only via npm test and npm run test-d, both of which run in dev contexts where devDependencies are present.

Happy to open a PR if useful.

[liustve]

Hi please feel free to open a PR, however note that the X-Ray SDKs are currently in maintenance mode so we are only doing releases if there are critical security issues we need to address.

Though this changes seems relatively small, let me sync with the team to see if we can help look into it

[liustve]

Hi @DmitryMarkov we're okay with what's proposed though note that change will not go out until the next security patch.