Tianyi Cui
630bbddf9a
dumble (0.2.x, ~530 dl/wk, single-maintainer) was a bus-factor risk as the load-bearing bundler. tsdown (rolldown-based, ~2.5M dl/wk, actively maintained) replaces it while output stays list-identical, verified by snapshot diff: 17 JS bundles, externals preserved, schemastery dual .mjs/.cjs and logger-console node+browser entries intact. Root tsdown.config.ts uses workspace globs ['vendor/*', 'packages/*'] (explicit, so examples/* stays excluded); two per-package overrides in vendor/ cover the special shapes and are logged in vendor/README.md as ours (not upstream sync surface). scripts/build.ts (dumble orchestration) is deleted; yarn build = tsc -b && tsdown. tsc -b keeps owning declarations (dts: false, clean: false). Rationale recorded in ADR 0008 (also covers the direct-esbuild and pkgroll alternatives). Gates: lint, typecheck, 134 tests, hygiene (knip/publint/constraints), demo smoke all green.
70 lines
4.0 KiB
Markdown
70 lines
4.0 KiB
Markdown
# Vendored Packages
|
|
|
|
This directory contains source-vendored copies of the Cordis framework and its
|
|
foundation libraries. They are copied into this monorepo instead of being
|
|
depended on via npm, so that the harness fully owns its framework layer
|
|
(auditable, patchable, pinned).
|
|
|
|
All vendored packages keep their **original npm names** (they are resolved
|
|
through Yarn workspaces) and are marked `private: true` — they are never
|
|
published from this repo. Upstream MIT `LICENSE` files are preserved in each
|
|
package directory.
|
|
|
|
## Manifest
|
|
|
|
Upstream workspace: `cordis-workspace` (local checkout: `~/repos/cordis-workspace`).
|
|
|
|
| Directory | npm name | Version | Upstream repo | Commit |
|
|
|---|---|---|---|---|
|
|
| `cosmokit/` | `cosmokit` | 1.8.1 | https://github.com/deepseek-harness/cosmokit | `16f6fc058ade66e8ac5da0033d35a8d0f279f544` |
|
|
| `schemastery/` | `schemastery` | 3.18.0 | https://github.com/deepseek-harness/schemastery (`packages/core`) | `e67cee00ad725bd1534aee930a979ea3eec6f698` |
|
|
| `cordis/` | `cordis` | 4.0.0-rc.6 | https://github.com/deepseek-harness/cordis (`packages/core`) | `abb0a307cb1d3b0947f455d590cf5ba922d4caa4` |
|
|
| `loader/` | `@cordisjs/plugin-loader` | 1.0.0-rc.4 | https://github.com/deepseek-harness/cordis (`packages/loader`) | `abb0a307cb1d3b0947f455d590cf5ba922d4caa4` |
|
|
| `include/` | `@cordisjs/plugin-include` | 1.0.4 | https://github.com/deepseek-harness/cordis (`packages/include`) | `abb0a307cb1d3b0947f455d590cf5ba922d4caa4` |
|
|
| `group/` | `@cordisjs/plugin-group` | 1.0.0 | https://github.com/deepseek-harness/cordis (`packages/group`) | `abb0a307cb1d3b0947f455d590cf5ba922d4caa4` |
|
|
| `timer/` | `@cordisjs/plugin-timer` | 1.1.2 | https://github.com/deepseek-harness/cordis (`packages/timer`) | `abb0a307cb1d3b0947f455d590cf5ba922d4caa4` |
|
|
| `hmr/` | `@cordisjs/plugin-hmr` | 1.0.15 | https://github.com/deepseek-harness/cordis (`packages/hmr`) | `abb0a307cb1d3b0947f455d590cf5ba922d4caa4` |
|
|
| `logger-console/` | `@cordisjs/plugin-logger-console` | 1.0.0 | https://github.com/deepseek-harness/cordis (`packages/logger-console`) | `abb0a307cb1d3b0947f455d590cf5ba922d4caa4` |
|
|
|
|
Third-party dependencies of the vendored packages stay on npm:
|
|
`@standard-schema/spec`, `js-yaml`, `chokidar`, `picomatch`,
|
|
`@babel/code-frame`, `supports-color`.
|
|
|
|
Intentionally **not** vendored (verified unused by this set): `reggol`,
|
|
`@cordisjs/utils`, `@cordisjs/element`, `@cordisjs/unyaml` (dev-time YAML
|
|
import hook only).
|
|
|
|
## Local modifications
|
|
|
|
Keep this log exhaustive — every divergence from upstream must be listed.
|
|
|
|
1. **`hmr/src/index.ts`**: removed the `./locales/en-US.yml` /
|
|
`./locales/zh-CN.yml` imports, the `.i18n({...})` call on the `Config`
|
|
schema, and the `src/locales/` directory. Rationale: those imports require
|
|
a runtime YAML loader hook (`@cordisjs/unyaml`) that we do not vendor;
|
|
the i18n texts only localize config descriptions.
|
|
2. **All `package.json` files**: regenerated — added `private: true`, added
|
|
`src` to `files` and a `./src/*` export where missing, removed upstream
|
|
`devDependencies`/`scripts`/`repository` fields. Dependency and
|
|
peer-dependency ranges preserved.
|
|
3. **All `tsconfig.json` files**: regenerated to extend the repo-root
|
|
`tsconfig.base.json` and declare project references.
|
|
4. **`schemastery/tsdown.config.ts` and `logger-console/tsdown.config.ts`**:
|
|
ours, not upstream files — per-package build-shape overrides (dual
|
|
ESM+CJS output; separate node/browser entries) for the repo-root tsdown
|
|
build. Like the regenerated tsconfigs, they are not part of the upstream
|
|
sync surface.
|
|
|
|
## Sync procedure
|
|
|
|
To update a vendored package from upstream:
|
|
|
|
1. In the upstream workspace, note `git rev-parse HEAD` of the relevant
|
|
submodule.
|
|
2. Copy the package's `src/` (and `bin.js`, `README.md`, `LICENSE` if changed)
|
|
over the vendored directory.
|
|
3. Re-apply the local modifications listed above (or drop them if upstream
|
|
made them unnecessary — update the log either way).
|
|
4. Update the version and commit hash in the manifest table.
|
|
5. Run `yarn install && yarn test && yarn build` at the repo root.
|