@mondaydotcomorg/z2h-cli 0.11.4 → 0.11.5

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAKzD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAKzD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/constants.js

@@ -12,13 +12,10 @@ const SHADOW_SCRIPTS = {
     build: 'trident build',
 };
 // ─────────── Shadow dev deps ───────
-// Yarn berry only wires a workspace member's `node_modules/.bin/` PATH
-// for packages that member explicitly declares. The shadow's scripts
-// invoke `trident`, so trident-toolkit must be declared here for the
-// bin to resolve. `*` is fine — yarn workspaces resolve the actual
-// version from the workspace root's pinned entry.
+// Fallback versions used when the workspace root's package.json cannot be
+// read. syncShadow prefers the workspace root's pinned ranges at runtime.
 const SHADOW_DEV_DEPS = {
-    '@mondaydotcomorg/trident-toolkit': '*',
+    '@mondaydotcomorg/trident-toolkit': '^2.9.25',
 };
 // ─────────── Auto-allocated dev port range ────
 // High enough to dodge common dev defaults (3000 Next, 5173 Vite, 8080).

package/dist/esm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAKzD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAKzD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/esm/constants.mjs

@@ -10,13 +10,10 @@ const SHADOW_SCRIPTS = {
     build: 'trident build',
 };
 // ─────────── Shadow dev deps ───────
-// Yarn berry only wires a workspace member's `node_modules/.bin/` PATH
-// for packages that member explicitly declares. The shadow's scripts
-// invoke `trident`, so trident-toolkit must be declared here for the
-// bin to resolve. `*` is fine — yarn workspaces resolve the actual
-// version from the workspace root's pinned entry.
+// Fallback versions used when the workspace root's package.json cannot be
+// read. syncShadow prefers the workspace root's pinned ranges at runtime.
 const SHADOW_DEV_DEPS = {
-    '@mondaydotcomorg/trident-toolkit': '*',
+    '@mondaydotcomorg/trident-toolkit': '^2.9.25',
 };
 // ─────────── Auto-allocated dev port range ────
 // High enough to dodge common dev defaults (3000 Next, 5173 Vite, 8080).

package/dist/esm/migrations/005-fix-shadow-toolkit-wildcard.d.ts

@@ -0,0 +1,3 @@
+import type { Tree } from '@nx/devkit';
+export default function fixShadowToolkitWildcard(tree: Tree): void;
+//# sourceMappingURL=005-fix-shadow-toolkit-wildcard.d.ts.map

package/dist/esm/migrations/005-fix-shadow-toolkit-wildcard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"005-fix-shadow-toolkit-wildcard.d.ts","sourceRoot":"","sources":["../../../src/migrations/005-fix-shadow-toolkit-wildcard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAKvC,MAAM,CAAC,OAAO,UAAU,wBAAwB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CA+BjE"}

package/dist/esm/migrations/005-fix-shadow-toolkit-wildcard.mjs

@@ -0,0 +1,35 @@
+const TOOLKIT = '@mondaydotcomorg/trident-toolkit';
+const FALLBACK_VERSION = '^2.9.25';
+function fixShadowToolkitWildcard(tree) {
+    let targetVersion = FALLBACK_VERSION;
+    if (tree.exists('package.json')) {
+        try {
+            const pkg = JSON.parse(tree.read('package.json', 'utf-8'));
+            targetVersion = pkg.devDependencies?.[TOOLKIT] ?? pkg.dependencies?.[TOOLKIT] ?? FALLBACK_VERSION;
+        }
+        catch {
+            // fall through to FALLBACK_VERSION
+        }
+    }
+    for (const entry of tree.children('.')) {
+        if (entry.startsWith('.')) {
+            continue;
+        }
+        const shadowPkgPath = `${entry}/.zth/package.json`;
+        if (!tree.exists(shadowPkgPath)) {
+            continue;
+        }
+        try {
+            const pkg = JSON.parse(tree.read(shadowPkgPath, 'utf-8'));
+            if (pkg.devDependencies?.[TOOLKIT] === '*') {
+                pkg.devDependencies[TOOLKIT] = targetVersion;
+                tree.write(shadowPkgPath, JSON.stringify(pkg, null, 2) + '\n');
+            }
+        }
+        catch {
+            // skip unparseable shadow packages
+        }
+    }
+}
+
+export { fixShadowToolkitWildcard as default };

package/dist/esm/shadow/merge-package-json.d.ts

@@ -1,17 +1,5 @@
 import type { ConsumerPkg, ShadowPkg } from '../types';
-/**
- * Build the shadow package.json.
- *
- * Runtime deps live at the workspace root (`~/zth-projects/`) and are
- * hoisted in via yarn workspaces — no need to mirror them here. The shadow
- * only declares the toolchain it directly executes (`trident-toolkit`) so
- * yarn berry wires the `trident` bin into the shadow's script PATH.
- *
- * The `@trident/` scope is preserved so trident-toolkit strips it and the
- * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
- * routes to.
- */
-export declare function buildShadowPkg(consumerPkg: ConsumerPkg): ShadowPkg;
+export declare function buildShadowPkg(consumerPkg: ConsumerPkg, pinnedVersions?: Record<string, string>): ShadowPkg;
 /**
  * Hash the consumer's declared deps. This is the sole input that decides
  * whether `yarn install` needs to run — the shadow package.json is

package/dist/esm/shadow/merge-package-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAQlE;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}
+{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,SAAS,CAQ/G;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}

package/dist/esm/shadow/merge-package-json.mjs

@@ -3,25 +3,13 @@ import { writeJson } from 'fs-extra';
 import { SHADOW_SCRIPTS, SHADOW_DEV_DEPS } from '../constants.mjs';
 import { mfAppName } from '../util/app-name.mjs';
 
-/**
- * Build the shadow package.json.
- *
- * Runtime deps live at the workspace root (`~/zth-projects/`) and are
- * hoisted in via yarn workspaces — no need to mirror them here. The shadow
- * only declares the toolchain it directly executes (`trident-toolkit`) so
- * yarn berry wires the `trident` bin into the shadow's script PATH.
- *
- * The `@trident/` scope is preserved so trident-toolkit strips it and the
- * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
- * routes to.
- */
-function buildShadowPkg(consumerPkg) {
+function buildShadowPkg(consumerPkg, pinnedVersions = {}) {
     return {
         name: `@trident/${mfAppName(consumerPkg.name)}`,
         version: '0.0.1',
         private: true,
         scripts: SHADOW_SCRIPTS,
-        devDependencies: { ...SHADOW_DEV_DEPS },
+        devDependencies: { ...SHADOW_DEV_DEPS, ...pinnedVersions },
     };
 }
 /**

package/dist/esm/shadow/sync.d.ts

@@ -1,9 +1,3 @@
 import type { ConsumerPaths, ConsumerPkg } from '../types';
-/**
- * Regenerate the shadow package.json from the current CLI template and
- * run `yarn install` at the consumer dir iff the consumer's declared deps
- * have changed since the last install. Idempotent — safe to call on every
- * build, dev start, or consumer package.json edit.
- */
 export declare function syncShadow(paths: ConsumerPaths, consumerPkg: ConsumerPkg): Promise<void>;
 //# sourceMappingURL=sync.d.ts.map

package/dist/esm/shadow/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/shadow/sync.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9F"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/shadow/sync.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAa,MAAM,UAAU,CAAC;AA6CtE,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9F"}

package/dist/esm/shadow/sync.mjs

@@ -1,24 +1,62 @@
-import { pathExists, readFile, writeFile } from 'fs-extra';
+import path from 'node:path';
+import { remove, pathExists, readFile, writeFile, readJson } from 'fs-extra';
 import { info } from '../util/logger.mjs';
+import { SHADOW_DEV_DEPS } from '../constants.mjs';
 import { runYarnInstall } from '../util/npm/install.mjs';
 import { buildShadowPkg, writeShadowPkg, hashConsumerDeps } from './merge-package-json.mjs';
 
-/**
- * Regenerate the shadow package.json from the current CLI template and
- * run `yarn install` at the consumer dir iff the consumer's declared deps
- * have changed since the last install. Idempotent — safe to call on every
- * build, dev start, or consumer package.json edit.
- */
+// Reads the workspace root's pinned versions for each package in SHADOW_DEV_DEPS.
+// The workspace root is always one directory above the consumer app.
+// Returns an empty map if the root package.json is missing or unreadable.
+async function readWorkspacePinnedVersions(consumerDir) {
+    const wsPkgPath = path.join(path.dirname(consumerDir), 'package.json');
+    if (!(await pathExists(wsPkgPath))) {
+        return {};
+    }
+    try {
+        const wsPkg = (await readJson(wsPkgPath));
+        const overrides = {};
+        for (const name of Object.keys(SHADOW_DEV_DEPS)) {
+            const version = wsPkg.devDependencies?.[name] ?? wsPkg.dependencies?.[name];
+            if (version) {
+                overrides[name] = version;
+            }
+        }
+        return overrides;
+    }
+    catch {
+        return {};
+    }
+}
+async function shadowDevDepsChanged(shadowPkgPath, newDevDeps) {
+    if (!(await pathExists(shadowPkgPath))) {
+        return false;
+    }
+    try {
+        const existing = (await readJson(shadowPkgPath));
+        for (const [name, version] of Object.entries(newDevDeps)) {
+            if (existing.devDependencies?.[name] !== version) {
+                return true;
+            }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
 async function syncShadow(paths, consumerPkg) {
-    const shadow = buildShadowPkg(consumerPkg);
+    const pinnedVersions = await readWorkspacePinnedVersions(paths.consumerDir);
+    const shadow = buildShadowPkg(consumerPkg, pinnedVersions);
+    if (await shadowDevDepsChanged(paths.shadowPkg, shadow.devDependencies)) {
+        info('shadow devDependencies changed — forcing yarn install');
+        await remove(paths.shadowDepsHash);
+    }
     await writeShadowPkg(paths.shadowPkg, shadow);
     const newHash = hashConsumerDeps(consumerPkg);
     const oldHash = (await pathExists(paths.shadowDepsHash)) ? await readFile(paths.shadowDepsHash, 'utf8') : null;
     if (oldHash !== newHash) {
         info(oldHash ? 'consumer deps changed — yarn install' : 'first run — yarn install');
-        // Yarn 4 is cache-first and non-interactive by default in non-TTY
-        // contexts, so plain `yarn install` is all we need. runYarnInstall injects
-        // the npm-broker token, preflights auth, and re-auths on a broker 401.
         await runYarnInstall({ cwd: paths.consumerDir });
         await writeFile(paths.shadowDepsHash, newHash);
     }

package/dist/migrations/005-fix-shadow-toolkit-wildcard.d.ts

@@ -0,0 +1,3 @@
+import type { Tree } from '@nx/devkit';
+export default function fixShadowToolkitWildcard(tree: Tree): void;
+//# sourceMappingURL=005-fix-shadow-toolkit-wildcard.d.ts.map

package/dist/migrations/005-fix-shadow-toolkit-wildcard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"005-fix-shadow-toolkit-wildcard.d.ts","sourceRoot":"","sources":["../../src/migrations/005-fix-shadow-toolkit-wildcard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAKvC,MAAM,CAAC,OAAO,UAAU,wBAAwB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CA+BjE"}

package/dist/migrations/005-fix-shadow-toolkit-wildcard.js

@@ -0,0 +1,37 @@
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: 'Module' } });
+
+const TOOLKIT = '@mondaydotcomorg/trident-toolkit';
+const FALLBACK_VERSION = '^2.9.25';
+function fixShadowToolkitWildcard(tree) {
+    let targetVersion = FALLBACK_VERSION;
+    if (tree.exists('package.json')) {
+        try {
+            const pkg = JSON.parse(tree.read('package.json', 'utf-8'));
+            targetVersion = pkg.devDependencies?.[TOOLKIT] ?? pkg.dependencies?.[TOOLKIT] ?? FALLBACK_VERSION;
+        }
+        catch {
+            // fall through to FALLBACK_VERSION
+        }
+    }
+    for (const entry of tree.children('.')) {
+        if (entry.startsWith('.')) {
+            continue;
+        }
+        const shadowPkgPath = `${entry}/.zth/package.json`;
+        if (!tree.exists(shadowPkgPath)) {
+            continue;
+        }
+        try {
+            const pkg = JSON.parse(tree.read(shadowPkgPath, 'utf-8'));
+            if (pkg.devDependencies?.[TOOLKIT] === '*') {
+                pkg.devDependencies[TOOLKIT] = targetVersion;
+                tree.write(shadowPkgPath, JSON.stringify(pkg, null, 2) + '\n');
+            }
+        }
+        catch {
+            // skip unparseable shadow packages
+        }
+    }
+}
+
+exports.default = fixShadowToolkitWildcard;

package/dist/shadow/merge-package-json.d.ts

@@ -1,17 +1,5 @@
 import type { ConsumerPkg, ShadowPkg } from '../types';
-/**
- * Build the shadow package.json.
- *
- * Runtime deps live at the workspace root (`~/zth-projects/`) and are
- * hoisted in via yarn workspaces — no need to mirror them here. The shadow
- * only declares the toolchain it directly executes (`trident-toolkit`) so
- * yarn berry wires the `trident` bin into the shadow's script PATH.
- *
- * The `@trident/` scope is preserved so trident-toolkit strips it and the
- * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
- * routes to.
- */
-export declare function buildShadowPkg(consumerPkg: ConsumerPkg): ShadowPkg;
+export declare function buildShadowPkg(consumerPkg: ConsumerPkg, pinnedVersions?: Record<string, string>): ShadowPkg;
 /**
  * Hash the consumer's declared deps. This is the sole input that decides
  * whether `yarn install` needs to run — the shadow package.json is

package/dist/shadow/merge-package-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAQlE;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}
+{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,SAAS,CAQ/G;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}

package/dist/shadow/merge-package-json.js

@@ -9,25 +9,13 @@ const _interopDefault = e => e && e.__esModule ? e : { default: e };
 
 const crypto__default = /*#__PURE__*/_interopDefault(crypto);
 
-/**
- * Build the shadow package.json.
- *
- * Runtime deps live at the workspace root (`~/zth-projects/`) and are
- * hoisted in via yarn workspaces — no need to mirror them here. The shadow
- * only declares the toolchain it directly executes (`trident-toolkit`) so
- * yarn berry wires the `trident` bin into the shadow's script PATH.
- *
- * The `@trident/` scope is preserved so trident-toolkit strips it and the
- * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
- * routes to.
- */
-function buildShadowPkg(consumerPkg) {
+function buildShadowPkg(consumerPkg, pinnedVersions = {}) {
     return {
         name: `@trident/${util_appName.mfAppName(consumerPkg.name)}`,
         version: '0.0.1',
         private: true,
         scripts: constants.SHADOW_SCRIPTS,
-        devDependencies: { ...constants.SHADOW_DEV_DEPS },
+        devDependencies: { ...constants.SHADOW_DEV_DEPS, ...pinnedVersions },
     };
 }
 /**

package/dist/shadow/sync.d.ts

@@ -1,9 +1,3 @@
 import type { ConsumerPaths, ConsumerPkg } from '../types';
-/**
- * Regenerate the shadow package.json from the current CLI template and
- * run `yarn install` at the consumer dir iff the consumer's declared deps
- * have changed since the last install. Idempotent — safe to call on every
- * build, dev start, or consumer package.json edit.
- */
 export declare function syncShadow(paths: ConsumerPaths, consumerPkg: ConsumerPkg): Promise<void>;
 //# sourceMappingURL=sync.d.ts.map

package/dist/shadow/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/shadow/sync.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9F"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/shadow/sync.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAa,MAAM,UAAU,CAAC;AA6CtE,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9F"}

package/dist/shadow/sync.js

@@ -1,26 +1,68 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
+const path = require('node:path');
 const fs = require('fs-extra');
 const util_logger = require('../util/logger.js');
+const constants = require('../constants.js');
 const util_npm_install = require('../util/npm/install.js');
 const shadow_mergePackageJson = require('./merge-package-json.js');
 
-/**
- * Regenerate the shadow package.json from the current CLI template and
- * run `yarn install` at the consumer dir iff the consumer's declared deps
- * have changed since the last install. Idempotent — safe to call on every
- * build, dev start, or consumer package.json edit.
- */
+const _interopDefault = e => e && e.__esModule ? e : { default: e };
+
+const path__default = /*#__PURE__*/_interopDefault(path);
+
+// Reads the workspace root's pinned versions for each package in SHADOW_DEV_DEPS.
+// The workspace root is always one directory above the consumer app.
+// Returns an empty map if the root package.json is missing or unreadable.
+async function readWorkspacePinnedVersions(consumerDir) {
+    const wsPkgPath = path__default.default.join(path__default.default.dirname(consumerDir), 'package.json');
+    if (!(await fs.pathExists(wsPkgPath))) {
+        return {};
+    }
+    try {
+        const wsPkg = (await fs.readJson(wsPkgPath));
+        const overrides = {};
+        for (const name of Object.keys(constants.SHADOW_DEV_DEPS)) {
+            const version = wsPkg.devDependencies?.[name] ?? wsPkg.dependencies?.[name];
+            if (version) {
+                overrides[name] = version;
+            }
+        }
+        return overrides;
+    }
+    catch {
+        return {};
+    }
+}
+async function shadowDevDepsChanged(shadowPkgPath, newDevDeps) {
+    if (!(await fs.pathExists(shadowPkgPath))) {
+        return false;
+    }
+    try {
+        const existing = (await fs.readJson(shadowPkgPath));
+        for (const [name, version] of Object.entries(newDevDeps)) {
+            if (existing.devDependencies?.[name] !== version) {
+                return true;
+            }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
 async function syncShadow(paths, consumerPkg) {
-    const shadow = shadow_mergePackageJson.buildShadowPkg(consumerPkg);
+    const pinnedVersions = await readWorkspacePinnedVersions(paths.consumerDir);
+    const shadow = shadow_mergePackageJson.buildShadowPkg(consumerPkg, pinnedVersions);
+    if (await shadowDevDepsChanged(paths.shadowPkg, shadow.devDependencies)) {
+        util_logger.info('shadow devDependencies changed — forcing yarn install');
+        await fs.remove(paths.shadowDepsHash);
+    }
     await shadow_mergePackageJson.writeShadowPkg(paths.shadowPkg, shadow);
     const newHash = shadow_mergePackageJson.hashConsumerDeps(consumerPkg);
     const oldHash = (await fs.pathExists(paths.shadowDepsHash)) ? await fs.readFile(paths.shadowDepsHash, 'utf8') : null;
     if (oldHash !== newHash) {
         util_logger.info(oldHash ? 'consumer deps changed — yarn install' : 'first run — yarn install');
-        // Yarn 4 is cache-first and non-interactive by default in non-TTY
-        // contexts, so plain `yarn install` is all we need. runYarnInstall injects
-        // the npm-broker token, preflights auth, and re-auths on a broker 401.
         await util_npm_install.runYarnInstall({ cwd: paths.consumerDir });
         await fs.writeFile(paths.shadowDepsHash, newHash);
     }

package/migrations.json

@@ -19,6 +19,11 @@
       "version": "0.11.4",
       "description": "Remove @mondaydotcomorg/z2h-cli from workspace deps (globally installed, must not be a local dep)",
       "migrate": "./dist/migrations/004-remove-z2h-cli-workspace-dep"
+    },
+    "fix-shadow-toolkit-wildcard": {
+      "version": "0.11.5",
+      "description": "Fix shadow .zth/package.json trident-toolkit \"*\" → workspace-root pinned range to prevent react version conflict",
+      "migrate": "./dist/migrations/005-fix-shadow-toolkit-wildcard"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/z2h-cli",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "bin": "./bin/z2h-cli.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/src/constants.ts

@@ -13,13 +13,10 @@ export const SHADOW_SCRIPTS: Record<string, string> = {
 };
 
 // ─────────── Shadow dev deps ───────
-// Yarn berry only wires a workspace member's `node_modules/.bin/` PATH
-// for packages that member explicitly declares. The shadow's scripts
-// invoke `trident`, so trident-toolkit must be declared here for the
-// bin to resolve. `*` is fine — yarn workspaces resolve the actual
-// version from the workspace root's pinned entry.
+// Fallback versions used when the workspace root's package.json cannot be
+// read. syncShadow prefers the workspace root's pinned ranges at runtime.
 export const SHADOW_DEV_DEPS: Record<string, string> = {
-  '@mondaydotcomorg/trident-toolkit': '*',
+  '@mondaydotcomorg/trident-toolkit': '^2.9.25',
 };
 
 // ─────────── Auto-allocated dev port range ────

package/src/migrations/005-fix-shadow-toolkit-wildcard.ts

@@ -0,0 +1,37 @@
+import type { Tree } from '@nx/devkit';
+
+const TOOLKIT = '@mondaydotcomorg/trident-toolkit';
+const FALLBACK_VERSION = '^2.9.25';
+
+export default function fixShadowToolkitWildcard(tree: Tree): void {
+  let targetVersion = FALLBACK_VERSION;
+  if (tree.exists('package.json')) {
+    try {
+      const pkg = JSON.parse(tree.read('package.json', 'utf-8')!);
+      targetVersion = pkg.devDependencies?.[TOOLKIT] ?? pkg.dependencies?.[TOOLKIT] ?? FALLBACK_VERSION;
+    } catch {
+      // fall through to FALLBACK_VERSION
+    }
+  }
+
+  for (const entry of tree.children('.')) {
+    if (entry.startsWith('.')) {
+      continue;
+    }
+
+    const shadowPkgPath = `${entry}/.zth/package.json`;
+    if (!tree.exists(shadowPkgPath)) {
+      continue;
+    }
+
+    try {
+      const pkg = JSON.parse(tree.read(shadowPkgPath, 'utf-8')!);
+      if (pkg.devDependencies?.[TOOLKIT] === '*') {
+        pkg.devDependencies[TOOLKIT] = targetVersion;
+        tree.write(shadowPkgPath, JSON.stringify(pkg, null, 2) + '\n');
+      }
+    } catch {
+      // skip unparseable shadow packages
+    }
+  }
+}

package/src/shadow/__tests__/merge-package-json.test.ts

@@ -14,12 +14,24 @@ describe('buildShadowPkg', () => {
 
   it('declares only trident-toolkit so the trident bin is on the shadow PATH', () => {
     const shadow = buildShadowPkg({ name: 'demo' });
-    expect(shadow.devDependencies).toEqual({ '@mondaydotcomorg/trident-toolkit': '*' });
+    expect(shadow.devDependencies).toHaveProperty('@mondaydotcomorg/trident-toolkit');
+    expect(shadow.devDependencies['@mondaydotcomorg/trident-toolkit']).not.toBe('*');
     const asAny = shadow as unknown as Record<string, unknown>;
     expect(asAny.dependencies).toBeUndefined();
     expect(asAny.peerDependencies).toBeUndefined();
   });
 
+  it('overrides SHADOW_DEV_DEPS fallbacks with supplied pinnedVersions', () => {
+    const shadow = buildShadowPkg({ name: 'demo' }, { '@mondaydotcomorg/trident-toolkit': '^3.0.0' });
+    expect(shadow.devDependencies['@mondaydotcomorg/trident-toolkit']).toBe('^3.0.0');
+  });
+
+  it('falls back to SHADOW_DEV_DEPS when no pinnedVersions supplied', () => {
+    const shadow = buildShadowPkg({ name: 'demo' });
+    // Fallback must be a constrained range — never a bare wildcard
+    expect(shadow.devDependencies['@mondaydotcomorg/trident-toolkit']).toMatch(/^\^/);
+  });
+
   it('uses plain trident scripts (no `-T`); bin resolves via the local devDep', () => {
     const shadow = buildShadowPkg({ name: 'demo' });
     expect(shadow.scripts).toEqual({

package/src/shadow/merge-package-json.ts

@@ -4,25 +4,13 @@ import { SHADOW_SCRIPTS, SHADOW_DEV_DEPS } from '../constants';
 import { mfAppName } from '../util/app-name';
 import type { ConsumerPkg, ShadowPkg } from '../types';
 
-/**
- * Build the shadow package.json.
- *
- * Runtime deps live at the workspace root (`~/zth-projects/`) and are
- * hoisted in via yarn workspaces — no need to mirror them here. The shadow
- * only declares the toolchain it directly executes (`trident-toolkit`) so
- * yarn berry wires the `trident` bin into the shadow's script PATH.
- *
- * The `@trident/` scope is preserved so trident-toolkit strips it and the
- * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
- * routes to.
- */
-export function buildShadowPkg(consumerPkg: ConsumerPkg): ShadowPkg {
+export function buildShadowPkg(consumerPkg: ConsumerPkg, pinnedVersions: Record<string, string> = {}): ShadowPkg {
   return {
     name: `@trident/${mfAppName(consumerPkg.name)}`,
     version: '0.0.1',
     private: true,
     scripts: SHADOW_SCRIPTS,
-    devDependencies: { ...SHADOW_DEV_DEPS },
+    devDependencies: { ...SHADOW_DEV_DEPS, ...pinnedVersions },
   };
 }
 

package/src/shadow/sync.ts

@@ -1,17 +1,63 @@
-import { pathExists, readFile, writeFile } from 'fs-extra';
+import path from 'node:path';
+import { pathExists, readFile, readJson, remove, writeFile } from 'fs-extra';
 import { info } from '../util/logger';
+import { SHADOW_DEV_DEPS } from '../constants';
 import { runYarnInstall } from '../util/npm/install';
 import { buildShadowPkg, hashConsumerDeps, writeShadowPkg } from './merge-package-json';
-import type { ConsumerPaths, ConsumerPkg } from '../types';
+import type { ConsumerPaths, ConsumerPkg, ShadowPkg } from '../types';
+
+// Reads the workspace root's pinned versions for each package in SHADOW_DEV_DEPS.
+// The workspace root is always one directory above the consumer app.
+// Returns an empty map if the root package.json is missing or unreadable.
+async function readWorkspacePinnedVersions(consumerDir: string): Promise<Record<string, string>> {
+  const wsPkgPath = path.join(path.dirname(consumerDir), 'package.json');
+  if (!(await pathExists(wsPkgPath))) {
+    return {};
+  }
+  try {
+    const wsPkg = (await readJson(wsPkgPath)) as {
+      devDependencies?: Record<string, string>;
+      dependencies?: Record<string, string>;
+    };
+    const overrides: Record<string, string> = {};
+    for (const name of Object.keys(SHADOW_DEV_DEPS)) {
+      const version = wsPkg.devDependencies?.[name] ?? wsPkg.dependencies?.[name];
+      if (version) {
+        overrides[name] = version;
+      }
+    }
+    return overrides;
+  } catch {
+    return {};
+  }
+}
+
+async function shadowDevDepsChanged(shadowPkgPath: string, newDevDeps: Record<string, string>): Promise<boolean> {
+  if (!(await pathExists(shadowPkgPath))) {
+    return false;
+  }
+  try {
+    const existing = (await readJson(shadowPkgPath)) as ShadowPkg;
+    for (const [name, version] of Object.entries(newDevDeps)) {
+      if (existing.devDependencies?.[name] !== version) {
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
 
-/**
- * Regenerate the shadow package.json from the current CLI template and
- * run `yarn install` at the consumer dir iff the consumer's declared deps
- * have changed since the last install. Idempotent — safe to call on every
- * build, dev start, or consumer package.json edit.
- */
 export async function syncShadow(paths: ConsumerPaths, consumerPkg: ConsumerPkg): Promise<void> {
-  const shadow = buildShadowPkg(consumerPkg);
+  const pinnedVersions = await readWorkspacePinnedVersions(paths.consumerDir);
+  const shadow = buildShadowPkg(consumerPkg, pinnedVersions);
+
+  if (await shadowDevDepsChanged(paths.shadowPkg, shadow.devDependencies)) {
+    info('shadow devDependencies changed — forcing yarn install');
+    await remove(paths.shadowDepsHash);
+  }
+
   await writeShadowPkg(paths.shadowPkg, shadow);
 
   const newHash = hashConsumerDeps(consumerPkg);
@@ -19,9 +65,6 @@ export async function syncShadow(paths: ConsumerPaths, consumerPkg: ConsumerPkg)
 
   if (oldHash !== newHash) {
     info(oldHash ? 'consumer deps changed — yarn install' : 'first run — yarn install');
-    // Yarn 4 is cache-first and non-interactive by default in non-TTY
-    // contexts, so plain `yarn install` is all we need. runYarnInstall injects
-    // the npm-broker token, preflights auth, and re-auths on a broker 401.
     await runYarnInstall({ cwd: paths.consumerDir });
     await writeFile(paths.shadowDepsHash, newHash);
   }