@akanjs/devkit 3.0.0-beta.15 → 3.0.0-beta.16

package/executors.ts

@@ -1832,6 +1832,11 @@ export class PkgExecutor extends Executor {
     };
     const rootVersion = rootDeps[dep];
     if (rootVersion) return rootVersion;
+    // A transitive dependency the workspace pins rather than imports is only ever written as an override, and
+    // that pin has to reach the published package: neither an override nor a dependency's own shrinkwrap is
+    // applied to a consumer's install, so the version has to be a dependency of what we publish.
+    const overrideVersion = rootPackageJson.overrides?.[dep];
+    if (typeof overrideVersion === "string") return overrideVersion;
 
     try {
       const packageJsonPath = `pkgs/${dep}/package.json`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/devkit",
-  "version": "3.0.0-beta.15",
+  "version": "3.0.0-beta.16",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -39,11 +39,14 @@
     "./*": "./*.ts"
   },
   "dependencies": {
+    "@earendil-works/pi-agent-core": "0.80.6",
+    "@earendil-works/pi-ai": "0.80.6",
     "@earendil-works/pi-coding-agent": "0.80.6",
+    "@earendil-works/pi-tui": "0.80.6",
     "@inquirer/prompts": "^8.4.3",
     "@tailwindcss/node": "^4.3.0",
     "@trapezedev/project": "^7.1.4",
-    "akanjs": "3.0.0-beta.15",
+    "akanjs": "3.0.0-beta.16",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "dayjs": "^1.11.20",

package/piDependencyPins.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import type { PackageJson } from "@akanjs/devkit/types";
+
+// Guards the published dependency closure of the code agent, which the monorepo cannot exercise on its own.
+//
+// `@earendil-works/pi-coding-agent` asks for `^0.80.6` of its three sibling packages and ships an
+// `npm-shrinkwrap.json` pinning them to the exact version it was built against. Bun reads neither that file nor
+// this workspace's `overrides` when somebody installs the published CLI, so `^0.80.6` resolved to the newest
+// 0.80.x — 0.80.10, which dropped `getOAuthApiKey` from `pi-ai/oauth` while the pinned coding agent still
+// imports it. A global install died on its first import:
+//
+//   Export named 'getOAuthApiKey' not found in module '.../@earendil-works/pi-ai/dist/oauth.js'.
+//
+// `PackageRunner` therefore re-declares pi's own pins as dependencies of what we publish; this keeps the two
+// equal, so bumping the coding agent without moving the pins fails here rather than at a user's first run.
+
+const repoRoot = path.resolve(import.meta.dir, "../../..");
+const piName = "@earendil-works/pi-coding-agent";
+const piDir = `${repoRoot}/node_modules/${piName}`;
+const publishedPackages = ["pkgs/@akanjs/devkit/package.json", "pkgs/@akanjs/cli/package.json"];
+
+interface Shrinkwrap {
+  packages: Record<string, { version?: string }>;
+}
+
+const readJson = async <T>(file: string) => (await Bun.file(file).json()) as T;
+
+const shrinkwrappedPins = async () => {
+  const { packages } = await readJson<Shrinkwrap>(`${piDir}/npm-shrinkwrap.json`);
+  const entries = Object.entries(packages)
+    .map(([key, entry]) => [key.replace(/^node_modules\//, ""), entry.version ?? ""] as const)
+    .filter(([name]) => name.startsWith("@earendil-works/"));
+  return Object.fromEntries(entries);
+};
+
+describe("pi dependency pins", () => {
+  test("the shrinkwrap read here belongs to the coding agent we publish", async () => {
+    const installed = await readJson<PackageJson>(`${piDir}/package.json`);
+    for (const file of publishedPackages) {
+      const { dependencies = {} } = await readJson<PackageJson>(`${repoRoot}/${file}`);
+      expect({ file, [piName]: dependencies[piName] }).toEqual({ file, [piName]: installed.version });
+    }
+  });
+
+  test("every sibling pi package is published at the version the coding agent shrinkwrapped", async () => {
+    const pins = await shrinkwrappedPins();
+    expect(Object.keys(pins).length).toBeGreaterThan(0);
+    for (const file of publishedPackages) {
+      const { dependencies = {} } = await readJson<PackageJson>(`${repoRoot}/${file}`);
+      const declared = Object.fromEntries(Object.keys(pins).map((name) => [name, dependencies[name]]));
+      expect({ file, ...declared }).toEqual({ file, ...pins });
+    }
+  });
+});

package/types.ts

@@ -10,6 +10,7 @@ export interface PackageJson {
   peerDependencies?: Record<string, string>;
   peerDependenciesMeta?: Record<string, { optional?: boolean }>;
   optionalDependencies?: Record<string, string>;
+  overrides?: Record<string, string>;
   engines?: Record<string, string>;
   exports?: Record<string, string | Record<string, string>>;
   bun?: {