Proposal: Move examples to a separate repository to avoid dependency-related vulnerabilities

Move examples to a separate repository to avoid dependency-related vulnerabilities

Description

Currently, the examples included in this repository introduce additional dependencies that are not strictly required for the core functionality of the TypeScript SDK. These example-specific dependencies can propagate into downstream projects, potentially triggering security vulnerability warnings in environments that consume this package.

This creates a situation where users of the SDK may be forced to address or suppress vulnerabilities that originate not from the SDK itself, but from illustrative example code bundled within the same repository.

Problem

• Example code often includes extra libraries (e.g., frameworks, utilities, or integrations) that are not essential to the SDK. This week alone, there were multiple issues with express-rate-limit, hono, etc.
• These dependencies can be picked up by dependency scanners (e.g., npm audit, Snyk, etc.).
• As a result, projects using the SDK may report vulnerabilities that are unrelated to the actual SDK implementation.
• This adds noise and can reduce confidence in the package's security posture.

Proposed Solution

Move all examples into a separate repository (e.g., typescript-sdk-examples), and keep the main SDK repository focused strictly on the core library.

This would:

• Isolate example-specific dependencies from the main package.
• Prevent unnecessary vulnerabilities from being propagated to consumers.
• Improve clarity between production code and demonstration code.
• Allow examples to evolve independently without affecting the SDK’s dependency tree.

Thanks for your work on this project!

Review how examples and their dependencies are currently included in the TypeScript SDK repository, including the dependency configuration. Define the separate examples repository boundary and verify that example-only dependencies no longer propagate into the core SDK; done means examples remain available while the SDK dependency tree excludes them.