How should dependency contracts handle SDK vs CLI package overlap in Next.js APIs?