@lemoncode/lemony 0.1.1 → 0.2.0

package/catalog/schemas/tier2-events.md

@@ -149,14 +149,14 @@ Emitted by the Orchestrator when it transitions `spec-in-progress → spec-ready
 Emitted by the Orchestrator at closeout (after `gh pr view` confirms `MERGED`,
 before `git rm` of the task state).
 
-| Field               | Type   | Required | Axis            | Notes                                                                                                                                               |
-| ------------------- | ------ | -------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `task_id`           | string | yes      | `identity`      | Required for this type.                                                                                                                             |
-| `level`             | string | yes      | `internal-enum` | `L1` \| `L2` \| `L3` — the task-fit dial value used.                                                                                                |
-| `cycle_time_h`      | number | yes      | `metric`        | Wall-clock hours from issue creation to merge. ≥ 0, finite.                                                                                         |
-| `review_rejections` | number | yes      | `metric`        | Count of `review_rejected` events for this `task_id` (≥ 0, int).                                                                                    |
-| `mode`              | string | no       | `internal-enum` | `all_at_once` \| `step_by_step` — the mode chosen at the L1 approval gate. **Absent on L2** (the question only exists where `tasks.md` does).       |
-| `steps`             | number | no       | `metric`        | Count of `step_completed` events for this task (≥ 1, int). Only meaningful when `mode` is `step_by_step`; < total tasks after a mid-task downgrade. |
+| Field               | Type   | Required | Axis            | Notes                                                                                                                                                |
+| ------------------- | ------ | -------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `task_id`           | string | yes      | `identity`      | Required for this type.                                                                                                                              |
+| `level`             | string | yes      | `internal-enum` | `L1` \| `L2` \| `L3` — the task-fit dial value used.                                                                                                 |
+| `cycle_time_h`      | number | yes      | `metric`        | Wall-clock hours from issue creation to merge. ≥ 0, finite.                                                                                          |
+| `review_rejections` | number | yes      | `metric`        | Count of `review_rejected` events for this `task_id` (≥ 0, int).                                                                                     |
+| `mode`              | string | no       | `internal-enum` | `all_at_once` \| `step_by_step` — the mode chosen at the L1 approval gate. **Absent on L2** (the question only exists where `tasks.md` does).        |
+| `steps`             | number | no       | `metric`        | Count of `step_completed` events for this task (≥ 1, int). Only meaningful when `mode` is `step_by_step`; < total groups after a mid-task downgrade. |
 
 ### 5. `review_rejected` _(P5)_
 
@@ -168,7 +168,7 @@ dedicated label).
 | `task_id`         | string | yes      | `identity`      | Required for this type.                                                                                                                                                                                                                              |
 | `reason`          | string | yes      | `free-text`     | Short human-readable reason (one line; never the full review comment). 1-500 chars.                                                                                                                                                                  |
 | `iteration`       | number | yes      | `metric`        | 1-based: the Nth rejection of this task (≥ 1, int).                                                                                                                                                                                                  |
-| `step`            | number | no       | `metric`        | The step (1-based `tasks.md` task number) whose per-step review rejected. **Absent** on full-pass and all-at-once rejections.                                                                                                                        |
+| `step`            | number | no       | `metric`        | The step (1-based; one step = one `tasks.md` group) whose per-step review rejected. **Absent** on full-pass and all-at-once rejections.                                                                                                              |
 | `attributed_kind` | string | no       | `internal-enum` | `agent` \| `skill` \| `playbook` — the kind of component the friction is attributed to. **Omitted when the emitter can't attribute.**                                                                                                                |
 | `attributed_name` | string | no       | `internal-enum` | The component's name (free string, 1-200 chars), e.g. `implementer`. Independently optional in the schema; emitters pair it with `attributed_kind` and omit both when they can't attribute. Free-string by design — see [Attribution](#attribution). |
 
@@ -218,7 +218,7 @@ humans bail out (`ok_downgrade`).
 | Field               | Type   | Required | Axis            | Notes                                                                                                                                                                                                                            |
 | ------------------- | ------ | -------- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `task_id`           | string | yes      | `identity`      | Required for this type.                                                                                                                                                                                                          |
-| `step`              | number | yes      | `metric`        | 1-based `tasks.md` task number the checkpoint belongs to (≥ 1, int).                                                                                                                                                             |
+| `step`              | number | yes      | `metric`        | 1-based step number the checkpoint belongs to (one step = one `tasks.md` group; ≥ 1, int).                                                                                                                                       |
 | `review_iterations` | number | yes      | `metric`        | Reviewer invocations that preceded this checkpoint (≥ 1, int — every step is reviewed before the human; resets after a "changes").                                                                                               |
 | `checkpoint_result` | string | yes      | `internal-enum` | `ok` \| `changes` \| `ok_downgrade` (OK and switch the remaining tasks to all-at-once).                                                                                                                                          |
 | `attributed_kind`   | string | no       | `internal-enum` | `agent` \| `skill` \| `playbook` — the kind of component the friction is attributed to. **Omitted when the emitter can't attribute.**                                                                                            |

package/catalog/skills/mutation-testing/SKILL.md

@@ -63,8 +63,12 @@ the verdict is cheaper than mis-routing a real gap to a dismissable offer.
 ### 3. Report
 
 - **In-scope surviving mutants** → list them in your review verdict as an **advisory**
-  block: file:line, the mutation that survived, and the assertion that would have caught
-  it. This is **not** a REJECT on its own (decision: advisory). The Implementer may
+  block: file:line, the mutation that survived, and the assertion that would have
+  caught it — all of them when few (over-reporting here is cheaper than mis-routing,
+  per step 2). On a noisy run, carry the highest-value ones in the verdict and route
+  the full list to the full-pass issue comment; on a per-step review — which posts no
+  comment — anything worth keeping goes in the verdict bullets (the Orchestrator
+  records those in `progress.md`); what you leave out dies with your context. This is **not** a REJECT on its own (decision: advisory). The Implementer may
   strengthen the tests; the Reviewer may still REJECT by _judgment_ if a survivor exposes
   a genuinely dangerous untested path — but the mutation result alone never auto-blocks.
 - **Pre-existing surviving mutants** → run **`note-side-finding`**: one `## Side-findings`

package/catalog/skills/prd-to-spec/SKILL.md

@@ -29,7 +29,7 @@ the gap by guessing — surface it (see "When the PRD is insufficient").
   real from the start — there is no `draft-<slug>` holder:
   - `requirements.md` — EARS requirements with acceptance criteria
   - `design.md` — files, functions, approach, edge cases, testing
-  - `tasks.md` — atomic, ordered, checkbox tasks
+  - `tasks.md` — atomic, ordered checkbox tasks, grouped under risk-sized step headers
 
 ## Process
 
@@ -126,16 +126,40 @@ Atomic, ordered checkboxes. Each task is a **vertical slice** (a behavior, not a
 layer) so the Implementer can run TDD red→green per task. Reference the requirements
 each task satisfies.
 
+Group the tasks under **risk-sized step headers**. In step-by-step mode the loop runs
+one implement→review→human-checkpoint cycle **per group**, so the grouping decides how
+often the human is interrupted; the human approves it at the spec gate with the rest
+of the spec. Grouping criterion:
+
+1. **Risk isolates — hard rule.** A task gets its own group iff it concentrates risk:
+   a new seam, a hard-to-reverse decision, a data-loss or security surface.
+2. **Runnable surface closes — soft rule.** Among trivial stretches, prefer group
+   boundaries that leave something the human can run at the checkpoint. Never invent
+   a group to fabricate a demo.
+3. **Soft cap: 4 tasks per group**, exceedable only with explicit justification in
+   the group's rationale (e.g. "5 identical mechanical renames").
+4. **Every group header carries a one-line boundary rationale** so the grouping is
+   auditable at the spec gate.
+
 ```markdown
 # Tasks — <topic>
 
+## Group 1 — <name> _(<one-line boundary rationale>)_
+
 - [ ] T1 — <smallest behavior that proves the path end-to-end> (R1)
 - [ ] T2 — <next behavior> (R2)
+
+## Group 2 — <name> _(<one-line boundary rationale>)_
+
 - [ ] T3 — <error path> (R2, R3)
 ```
 
 Rules: order so the first task is a tracer bullet; never "write all tests" then
-"write all code"; keep each task small enough to verify on its own.
+"write all code"; keep each task small enough to verify on its own. Grouping never
+changes task granularity — checkboxes stay atomic and TDD runs per task; only review
+and checkpoint frequency follow the groups (all-at-once mode ignores the headers).
+Tasks added mid-implementation (from a discovery) default to **their own group** —
+they are risk by definition.
 
 ### 5. Self-check before handing off
 
@@ -143,6 +167,8 @@ Rules: order so the first task is a tracer bullet; never "write all tests" then
 - [ ] Every requirement is EARS-formatted and testable.
 - [ ] At least one unwanted-behavior (`If … then …`) requirement exists.
 - [ ] Every requirement is covered by at least one task.
+- [ ] Every task sits in a group, and every group header carries a one-line
+      boundary rationale.
 - [ ] No closed PRD decision is contradicted.
 
 ### 6. Emit `spec_created`

package/catalog/skills/resolve-discovery/SKILL.md

@@ -64,7 +64,9 @@ is a second discovery — append it, don't fold it in.
 
 The agent that **created** an artifact is the one that updates it. Map the decision to
 the artifact it changes, then invoke that owner (fresh context, Task tool) with the
-decision + the entry as context:
+decision **stated in full** — at this moment it exists nowhere on disk; the entry's
+`**Resolution**` block is only written at step 4 — plus the `discoveries.md` entry
+**by path** for the surrounding context (it reads the entry itself):
 
 | Artifact changed by the decision                                     | Owner to invoke                                                                                                                                             |
 | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -104,7 +106,9 @@ do not edit the raise fields):
    Same fail-loud contract: a non-zero exit means the flag/status did not flip back.
 
 2. Re-invoke the paused sub-agent (fresh context) with: the issue, the task-state
-   paths, the decision, and the updated artifact. It picks up from where it stopped.
+   paths, a one-line gist of the decision (the full `**Resolution**` block now
+   lives in the `discoveries.md` entry — reference it), and the updated artifact's
+   **path**. It reads the files itself and picks up from where it stopped.
 
 ## Closeout invariant
 

package/catalog/skills/spec-compliance-check/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: spec-compliance-check
-description: Walk an L1 spec point by point against the implementation and emit a per-requirement pass/fail verdict. Use during review of an SDD task to prove every EARS requirement (including unwanted-behavior paths) is satisfied and tested — a committable audit trail. Complements `senior-review` (quality) with traceability (coverage of intent).
+description: Walk an L1 spec point by point against the implementation and emit a per-requirement pass/fail verdict. Use during review of an SDD task to prove every EARS requirement (including unwanted-behavior paths) is satisfied and tested — a durable audit trail. Complements `senior-review` (quality) with traceability (coverage of intent).
 origin: vendor
 vendor_version: '{{vendor_version}}'
 phase: post-implementation
@@ -11,7 +11,7 @@ invoked-by: [reviewer]
 
 `senior-review` judges whether the code is _good_; this skill proves it does what the
 **spec said** — every requirement, point by point. It produces a traceability matrix:
-a committable audit trail mapping each requirement to its implementation and its test.
+a durable audit trail mapping each requirement to its implementation and its test.
 Only meaningful for **L1 (SDD) tasks** that have a spec under
 `.claude/state/tasks/<id>/spec/`; skip it for L2.
 
@@ -25,8 +25,8 @@ Read all three spec artifacts for the task:
   state-driven / optional-feature / **unwanted-behavior**), each numbered with
   acceptance criteria.
 - `design.md` — the intended files, interfaces, approach, edge cases.
-- `tasks.md` — the atomic checklist, each item referencing the requirements it
-  satisfies.
+- `tasks.md` — the atomic checklist grouped under risk-sized step headers, each
+  item referencing the requirements it satisfies.
 
 ### 2. Trace each requirement to the implementation
 
@@ -55,6 +55,10 @@ and asserts the rejection/guard.
 
 ### 4. Emit the matrix
 
+Destination: the full-pass **issue comment**. In your return summary — and always on
+a per-step review, which posts no comment — carry only the counts + the failing
+rows, per the Reviewer's verdict-size rule.
+
 ```
 ## Spec Compliance — task #<id>
 

package/catalog/skills/task-closeout/SKILL.md

@@ -87,8 +87,9 @@ The three differ in **who decides** — and the asymmetry is deliberate:
 
 - **`update-architecture` — automatic dispatch, no pre-offer.** Only when
   `docs/architecture.md` exists (the skill installs solely then). Dispatch the
-  **Architect** (`update-architecture`, fresh context) with the task's **merged diff**
-  (`gh pr diff <pr>`) plus the task's `spec/design.md` (still live here — archival is
+  **Architect** (`update-architecture`, fresh context) with the task's **PR number**
+  (it runs `gh pr diff <pr>` itself) plus the **path** of the task's `spec/design.md`
+  (still live here — archival is
   step 4 below). The Architect reads the change, makes
   the smallest true edit if the system's **shape** moved (referencing any ADR just
   written — `see ADR-NNNN`), or reports **no-op** when nothing architectural changed.

package/catalog/skills/test-gap-report/SKILL.md

@@ -52,6 +52,10 @@ For each file in the "always" set:
 
 ### 3. Report
 
+Destination: the full-pass **issue comment**. In your return summary — and always on
+a per-step review, which posts no comment — carry only the counts + the gaps, per
+the Reviewer's verdict-size rule (a REJECT lifts the cap entirely).
+
 ```
 ## Test Gap Report — <task name>
 

package/catalog/skills/verify/SKILL.md

@@ -84,6 +84,9 @@ and the error output (unexpected warnings/errors even when the happy path worked
 **Verdict**: works / does not work — <one-line reason>
 ```
 
+This block is your working record; a capped return summary condenses it to the
+verdict line (plus any ❌ detail — failures are signal, never trimmed).
+
 On a failure, read the **full** error, find the origin (not where it surfaced), fix
 the root cause, and re-run from the failed gate. If a failure reveals the spec itself
 is wrong or silent, that's a **discovery** — run `raise-discovery`, don't paper over

package/catalog/templates/claude-code/agents.md.tpl

@@ -57,7 +57,8 @@ A task deserves the harness if it is **specifiable**, **verifiable**, or
    `harness:sdd` + `harness:status:spec-in-progress`) and the branch
    `harness/<id>-<slug>`. `<id>` is the GitHub issue number in this build; spec and code
    both live on that branch — nothing touches the default branch until the merge gate.
-3. **UI design (if it touches UI)** — **UI design gate** (§UI design in `orchestrator.md`):
+3. **UI design (if it touches UI)** — **UI design gate** (canonical: the orchestrator's
+   L1 step 3, evaluated core-only — read `.claude/agents/ui-design.md` only when it fires):
    if the repo has a frontend AND the task touches UI, put `harness:needs-design`, offer the
    design-stop, and on "continue" **run `grill-ui` yourself** (the interactive design
    interview) to author `ui-handoff.md` under `tasks/<id>/spec/`, then dispatch the **UI
@@ -67,7 +68,7 @@ A task deserves the harness if it is **specifiable**, **verifiable**, or
    under `tasks/<id>/spec/`) then `spec-to-issue` (fills the issue body — it creates nothing
    and moves no labels).
 5. **Spec-ready + handoff** — remove `harness:needs-design` once `ui-handoff.md` is
-   complete (a spec-ready task never carries it), flip to `harness:status:spec-ready`,
+   complete (a spec-ready task never carries the label), flip to `harness:status:spec-ready`,
    commit and push the task state to the branch. DEFINE can stop here: the spec-ready
    queue (`gh issue list -l harness:status:spec-ready`) is the handoff. Ask: implement
    now or hand off?
@@ -83,8 +84,10 @@ A task deserves the harness if it is **specifiable**, **verifiable**, or
    — either lens rejecting routes back to the Implementer.
 9. **Merge gate** — never auto-merge. Surface the approved PR; the human merges (or
    authorizes you to). The task stays at `in-review` until merged.
-10. **Closeout** — `task-closeout`: confirm the merge via `gh`, offer durable discoveries
-   to the Architect (`write-adr`, HITL), archive the spec + discoveries to `_archive/<id>/` (drop
+10. **Closeout** — `task-closeout`: confirm the merge via `gh`, run the three Architect
+   activations (`write-adr` — HITL offer per resolved discovery; `update-architecture` —
+   automatic when `docs/architecture.md` exists; `playbook-iterate` — HITL offer once
+   per task), archive the spec + discoveries to `_archive/<id>/` (drop
    `progress.md`), and land `history.md` + the archival via a dedicated
    `harness/closeout-<id>` PR (`gh pr merge --auto`) — never a direct push to the base.
    If protection needs approval the PR waits: park at `closeout-pending`, `/resume`
@@ -92,6 +95,8 @@ A task deserves the harness if it is **specifiable**, **verifiable**, or
 
 ## L2 round-trip (TRIAGE)
 
+Authority for the steps: `.claude/agents/triage.md` (the Orchestrator's lazy companion).
+
 1. **Triage** — `triage-issue`: investigate, find root cause, draft a TDD-based fix
    plan, and create the issue with `harness:managed` (no `harness:sdd` — its absence
    marks the lightweight path).

package/dist/cli.mjs

@@ -45,7 +45,8 @@ const formatIssue = (schema, issue) => {
 		const valid = validKeysAt(schema, issue.path);
 		return issue.keys.map((key) => {
 			const guess = valid ? nearestKey(key, valid) : null;
-			return `Unknown key "${key}" in ${where}.${guess ? ` Did you mean "${guess}"?` : ""}`;
+			const hint = guess ? ` Did you mean "${guess}"?` : "";
+			return `Unknown key "${key}" in ${where}.${hint}`;
 		});
 	}
 	if (issue.code === "invalid_format" && issue.format === "regex") {
@@ -206,7 +207,8 @@ const setConfigValues = (rawYaml, updates) => {
 };
 const writeConfigValues = async (repoRoot, updates) => {
 	const configPath = join(repoRoot, HARNESS_CONFIG_FILENAME);
-	await writeFile(configPath, setConfigValues(await readFile(configPath, "utf8"), updates));
+	const raw = await readFile(configPath, "utf8");
+	await writeFile(configPath, setConfigValues(raw, updates));
 };
 //#endregion
 //#region src/config/pointer.schema.ts
@@ -1079,7 +1081,8 @@ const runValidate = async (inputs) => {
 		filesScanned: 0,
 		violations: []
 	};
-	const fileCheck = validateTokenFile(await readFile(tokenPath, "utf8"));
+	const raw = await readFile(tokenPath, "utf8");
+	const fileCheck = validateTokenFile(raw);
 	if (!fileCheck.ok) return {
 		ok: false,
 		tokensFound: true,
@@ -1410,7 +1413,8 @@ const linearizeChannel = (channel) => {
 const relativeLuminance = ({ r, g, b }) => .2126 * linearizeChannel(r) + .7152 * linearizeChannel(g) + .0722 * linearizeChannel(b);
 const contrastRatio = (foreground, background) => {
 	const bg = background.a < 1 ? flatten(background, WHITE) : background;
-	const l1 = relativeLuminance(foreground.a < 1 ? flatten(foreground, bg) : foreground);
+	const fg = foreground.a < 1 ? flatten(foreground, bg) : foreground;
+	const l1 = relativeLuminance(fg);
 	const l2 = relativeLuminance(bg);
 	const light = Math.max(l1, l2);
 	const dark = Math.min(l1, l2);
@@ -1457,7 +1461,9 @@ const runContrast = async (inputs) => {
 	};
 	const tokens = collectTokens(parsed);
 	const problems = [];
-	const pairs = measurePairs(discoverPairs(tokens, problems), declaredModes(tokens), tokens);
+	const specs = discoverPairs(tokens, problems);
+	const modes = declaredModes(tokens);
+	const pairs = measurePairs(specs, modes, tokens);
 	return {
 		ok: problems.length === 0 && pairs.every((pair) => pair.passes),
 		tokensFound: true,
@@ -3303,7 +3309,8 @@ const runStatus = async (deps) => {
 	const config = await readHarnessConfig(repoRoot);
 	const pointer = await readPointer(repoRoot, deps.readGitUserEmail);
 	const { branch, behind } = await deps.gitBehind(repoRoot);
-	const openDiscoveries = await countOpenDiscoveries(createTaskTrackerProvider(config.task_storage.type, deps.runCommand), config.task_storage.repo);
+	const provider = createTaskTrackerProvider(config.task_storage.type, deps.runCommand);
+	const openDiscoveries = await countOpenDiscoveries(provider, config.task_storage.repo);
 	return {
 		vendorVersion: config.vendor_version,
 		taskStorageRepo: config.task_storage.repo,
@@ -3659,7 +3666,10 @@ const hasConflictMarkers = (content) => CONFLICT_FENCE.test(content);
 //#endregion
 //#region src/merge/three-way-merge.ts
 const threeWayMerge = (base, client, vendor) => {
-	const regions = diff3Regions(base.split("\n"), client.split("\n"), vendor.split("\n"));
+	const baseLines = base.split("\n");
+	const clientLines = client.split("\n");
+	const vendorLines = vendor.split("\n");
+	const regions = diff3Regions(baseLines, clientLines, vendorLines);
 	const out = [];
 	let conflicted = false;
 	for (const region of regions) {
@@ -3920,6 +3930,12 @@ const CORE_AGENTS = [
 	"architect",
 	"ui-designer"
 ];
+const COMPANION_DOCS = [
+	"fit-assessment",
+	"triage",
+	"spinoff",
+	"ui-design"
+];
 const renderFile = async (templatePath, relPath, vars) => {
 	return {
 		relPath,
@@ -3945,7 +3961,7 @@ const materializeVendorFiles = async (ctx) => {
 		SKILLS: renderRoleSkills(skills, role),
 		vendor_version: vendorVersion
 	}), vendorVersion)));
-	const fitAssessment = await copyFileEntry(join(vendorRoot, "agents", "fit-assessment.md"), join(AGENTS_DIR, "fit-assessment.md"));
+	const companionFiles = await Promise.all(COMPANION_DOCS.map((doc) => copyFileEntry(join(vendorRoot, "agents", `${doc}.md`), join(AGENTS_DIR, `${doc}.md`))));
 	const skillFiles = (await Promise.all(skills.map(async (skill) => {
 		const skillDir = join(vendorRoot, "skills", skill.name);
 		const rels = await listFiles(skillDir);
@@ -3962,7 +3978,7 @@ const materializeVendorFiles = async (ctx) => {
 	return [
 		entryProtocol,
 		...agentFiles,
-		fitAssessment,
+		...companionFiles,
 		...skillFiles,
 		playbooksReadme,
 		...hookFiles,
@@ -4824,12 +4840,13 @@ const update = async (args) => {
 	const repoRoot = cwd();
 	const onConflict = parseOnConflict(args);
 	const dryRun = args.includes("--dry-run");
+	const allowDowngrade = args.includes("--allow-downgrade");
 	const result = await runUpdate({
 		repoRoot,
 		vendorRoot: VENDOR_ROOT,
 		onConflict,
 		dryRun,
-		allowDowngrade: args.includes("--allow-downgrade"),
+		allowDowngrade,
 		runCommand: makeRunCommand()
 	});
 	const verb = (applied, preview) => dryRun ? preview : applied;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lemoncode/lemony",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Lemony — a Harness for AI Coding. Vendor package: installer, agent role catalog, generic skill catalog, hooks, and templates for a Spec-Driven Development workflow.",
   "type": "module",
   "private": false,
@@ -28,7 +28,7 @@
   ],
   "engines": {
     "node": ">=24",
-    "npm": ">=11"
+    "pnpm": ">=11.5.1"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -43,6 +43,24 @@
     "agents",
     "scaffolding"
   ],
+  "devDependencies": {
+    "@changesets/cli": "2.31.1",
+    "@stryker-mutator/core": "9.6.1",
+    "@stryker-mutator/vitest-runner": "9.6.1",
+    "@types/node": "24.13.3",
+    "husky": "9.1.7",
+    "lint-staged": "17.2.0",
+    "oxlint": "1.75.0",
+    "prettier": "3.9.6",
+    "tsdown": "0.22.14",
+    "tsx": "4.23.1",
+    "typescript": "7.0.2",
+    "vitest": "4.1.10"
+  },
+  "dependencies": {
+    "yaml": "2.9.0",
+    "zod": "4.4.3"
+  },
   "scripts": {
     "build": "tsdown",
     "check-types": "tsc --noEmit",
@@ -60,30 +78,7 @@
     "notice:check": "tsx scripts/generate-notice.ts --check",
     "telemetry:aggregate": "tsx scripts/aggregate-telemetry.ts",
     "changeset": "changeset",
-    "changeset:version": "changeset version && tsx scripts/sync-catalog-version.ts",
+    "changeset:version": "changeset version && pnpm install --lockfile-only && tsx scripts/sync-catalog-version.ts",
     "changeset:publish": "node --run build && changeset publish"
-  },
-  "devDependencies": {
-    "@changesets/cli": "2.31.0",
-    "@stryker-mutator/core": "9.6.1",
-    "@stryker-mutator/vitest-runner": "9.6.1",
-    "@types/node": "24.13.2",
-    "oxlint": "1.71.0",
-    "prettier": "3.9.1",
-    "tsdown": "0.22.3",
-    "tsx": "4.22.4",
-    "typescript": "6.0.3",
-    "vitest": "4.1.9"
-  },
-  "dependencies": {
-    "yaml": "2.9.0",
-    "zod": "4.4.3"
-  },
-  "overrides": {
-    "typed-rest-client": {
-      "qs": "6.15.2"
-    },
-    "js-yaml": "4.2.0",
-    "vite": "8.0.16"
   }
-}
+}