chore(sdk/js)!: make solana/viem/curves peers truly opt-in

move @solana/web3.js, viem, and @noble/curves out of
optionalDependencies into peerDependencies (with optional meta). they
were auto-installed by npm despite the "optional" label, dragging ~70
transitive packages into every downstream install. now a bare
`npm install @phala/dstack-sdk` pulls only @noble/hashes.

consumers that import /solana, /viem, /encrypt-env-vars, or
/verify-env-encrypt-public-key submodules must now install the matching
peer explicitly. documented in README and CHANGELOG.

Author: Leechael

CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed (JS SDK)
+- **Breaking:** `@solana/web3.js`, `viem`, and `@noble/curves` moved from `optionalDependencies` to `peerDependencies` (with `peerDependenciesMeta.optional = true`). They are no longer auto-installed; consumers that import the matching submodule (`/solana`, `/viem`, `/encrypt-env-vars`, `/verify-env-encrypt-public-key`) must install them explicitly. A bare `import { DstackClient } from '@phala/dstack-sdk'` install now pulls only `@noble/hashes` as a transitive requirement.
+
 ## [0.5.5] - 2025-10-20
 
 ### Added

sdk/js/README.md

@@ -5,9 +5,26 @@ Access TEE features from your JavaScript/TypeScript application running inside d
 ## Installation
 
 ```bash
-npm install @phala/dstack-sdk
+npm install @phala/dstack-sdk @noble/hashes
 ```
 
+`@noble/hashes` is a required peer dependency used by the core client (sha256/sha384). The following peer dependencies are optional and only needed when you import the matching submodule:
+
+| Submodule | Optional peer dependency |
+| --- | --- |
+| `@phala/dstack-sdk/viem` | `viem` |
+| `@phala/dstack-sdk/solana` | `@solana/web3.js` |
+| `@phala/dstack-sdk/encrypt-env-vars` | `@noble/curves` |
+| `@phala/dstack-sdk/verify-env-encrypt-public-key` | `@noble/curves` |
+
+Install only what you import. For example, to use the Ethereum helpers:
+
+```bash
+npm install @phala/dstack-sdk @noble/hashes viem
+```
+
+> **Breaking change in 0.5.8:** prior versions auto-installed `@solana/web3.js`, `viem`, and `@noble/curves` through `optionalDependencies`. They are now opt-in peer dependencies—install them explicitly when you import the corresponding submodule.
+
 ## Quick Start
 
 ```typescript

sdk/js/bun.lock

@@ -97,28 +97,29 @@
   "author": "Leechael Yim",
   "license": "Apache-2.0",
   "devDependencies": {
+    "@noble/curves": "^1.8.1",
+    "@noble/hashes": "^1.6.1",
+    "@solana/web3.js": "^1.98.4",
     "@types/node": "latest",
     "typescript": "^5.7.0",
+    "viem": "^2.43.3",
     "vitest": "^3.2.4"
   },
-  "optionalDependencies": {
+  "peerDependencies": {
     "@noble/curves": "^1.8.1",
+    "@noble/hashes": "^1.6.1",
     "@solana/web3.js": "^1.98.4",
     "viem": "^2.43.3"
   },
-  "peerDependencies": {
-    "@noble/curves": "^1.8.1",
-    "@noble/hashes": "^1.6.1"
-  },
   "peerDependenciesMeta": {
-    "viem": {
-      "optional": true
-    },
     "@noble/curves": {
       "optional": true
     },
     "@solana/web3.js": {
       "optional": true
+    },
+    "viem": {
+      "optional": true
     }
   }
 }