Tianyi Cui
630bbddf9a
dumble (0.2.x, ~530 dl/wk, single-maintainer) was a bus-factor risk as the load-bearing bundler. tsdown (rolldown-based, ~2.5M dl/wk, actively maintained) replaces it while output stays list-identical, verified by snapshot diff: 17 JS bundles, externals preserved, schemastery dual .mjs/.cjs and logger-console node+browser entries intact. Root tsdown.config.ts uses workspace globs ['vendor/*', 'packages/*'] (explicit, so examples/* stays excluded); two per-package overrides in vendor/ cover the special shapes and are logged in vendor/README.md as ours (not upstream sync surface). scripts/build.ts (dumble orchestration) is deleted; yarn build = tsc -b && tsdown. tsc -b keeps owning declarations (dts: false, clean: false). Rationale recorded in ADR 0008 (also covers the direct-esbuild and pkgroll alternatives). Gates: lint, typecheck, 134 tests, hygiene (knip/publint/constraints), demo smoke all green.
Vendored Packages
This directory contains source-vendored copies of the Cordis framework and its foundation libraries. They are copied into this monorepo instead of being depended on via npm, so that the harness fully owns its framework layer (auditable, patchable, pinned).
All vendored packages keep their original npm names (they are resolved
through Yarn workspaces) and are marked private: true — they are never
published from this repo. Upstream MIT LICENSE files are preserved in each
package directory.
Manifest
Upstream workspace: cordis-workspace (local checkout: ~/repos/cordis-workspace).
| Directory | npm name | Version | Upstream repo | Commit |
|---|---|---|---|---|
cosmokit/ |
cosmokit |
1.8.1 | https://github.com/deepseek-harness/cosmokit | 16f6fc058ade66e8ac5da0033d35a8d0f279f544 |
schemastery/ |
schemastery |
3.18.0 | https://github.com/deepseek-harness/schemastery (packages/core) |
e67cee00ad725bd1534aee930a979ea3eec6f698 |
cordis/ |
cordis |
4.0.0-rc.6 | https://github.com/deepseek-harness/cordis (packages/core) |
abb0a307cb1d3b0947f455d590cf5ba922d4caa4 |
loader/ |
@cordisjs/plugin-loader |
1.0.0-rc.4 | https://github.com/deepseek-harness/cordis (packages/loader) |
abb0a307cb1d3b0947f455d590cf5ba922d4caa4 |
include/ |
@cordisjs/plugin-include |
1.0.4 | https://github.com/deepseek-harness/cordis (packages/include) |
abb0a307cb1d3b0947f455d590cf5ba922d4caa4 |
group/ |
@cordisjs/plugin-group |
1.0.0 | https://github.com/deepseek-harness/cordis (packages/group) |
abb0a307cb1d3b0947f455d590cf5ba922d4caa4 |
timer/ |
@cordisjs/plugin-timer |
1.1.2 | https://github.com/deepseek-harness/cordis (packages/timer) |
abb0a307cb1d3b0947f455d590cf5ba922d4caa4 |
hmr/ |
@cordisjs/plugin-hmr |
1.0.15 | https://github.com/deepseek-harness/cordis (packages/hmr) |
abb0a307cb1d3b0947f455d590cf5ba922d4caa4 |
logger-console/ |
@cordisjs/plugin-logger-console |
1.0.0 | https://github.com/deepseek-harness/cordis (packages/logger-console) |
abb0a307cb1d3b0947f455d590cf5ba922d4caa4 |
Third-party dependencies of the vendored packages stay on npm:
@standard-schema/spec, js-yaml, chokidar, picomatch,
@babel/code-frame, supports-color.
Intentionally not vendored (verified unused by this set): reggol,
@cordisjs/utils, @cordisjs/element, @cordisjs/unyaml (dev-time YAML
import hook only).
Local modifications
Keep this log exhaustive — every divergence from upstream must be listed.
hmr/src/index.ts: removed the./locales/en-US.yml/./locales/zh-CN.ymlimports, the.i18n({...})call on theConfigschema, and thesrc/locales/directory. Rationale: those imports require a runtime YAML loader hook (@cordisjs/unyaml) that we do not vendor; the i18n texts only localize config descriptions.- All
package.jsonfiles: regenerated — addedprivate: true, addedsrctofilesand a./src/*export where missing, removed upstreamdevDependencies/scripts/repositoryfields. Dependency and peer-dependency ranges preserved. - All
tsconfig.jsonfiles: regenerated to extend the repo-roottsconfig.base.jsonand declare project references. schemastery/tsdown.config.tsandlogger-console/tsdown.config.ts: ours, not upstream files — per-package build-shape overrides (dual ESM+CJS output; separate node/browser entries) for the repo-root tsdown build. Like the regenerated tsconfigs, they are not part of the upstream sync surface.
Sync procedure
To update a vendored package from upstream:
- In the upstream workspace, note
git rev-parse HEADof the relevant submodule. - Copy the package's
src/(andbin.js,README.md,LICENSEif changed) over the vendored directory. - Re-apply the local modifications listed above (or drop them if upstream made them unnecessary — update the log either way).
- Update the version and commit hash in the manifest table.
- Run
yarn install && yarn test && yarn buildat the repo root.