@vreko/cli 3.2.0 → 3.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vreko/cli",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "Vreko CLI — AI-aware developer intelligence for the command line",
   "homepage": "https://vreko.dev",
   "repository": {
@@ -41,11 +41,10 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@asteasolutions/zod-to-openapi": "7.3.4",
     "@babel/parser": "7.28.5",
     "@babel/traverse": "7.28.5",
-    "@better-auth/passkey": "1.6.18",
-    "@better-auth/sso": "1.6.18",
+    "@better-auth/passkey": "1.6.19",
+    "@better-auth/sso": "1.6.19",
     "@clack/prompts": "^1.1.0",
     "@electric-sql/pglite": "0.2.0",
     "@hubspot/api-client": "13.0.0",
@@ -62,7 +61,7 @@
     "@sentry/node": "10.32.1",
     "@sindresorhus/slugify": "3.0.0",
     "@typescript-eslint/parser": "8.46.2",
-    "better-auth": "1.6.18",
+    "better-auth": "1.6.19",
     "boxen": "8.0.1",
     "chalk": "4.1.2",
     "chokidar": "4.0.3",
@@ -110,6 +109,7 @@
     "keytar": "7.9.0"
   },
   "bundledDependencies": [
+    "@asteasolutions/zod-to-openapi",
     "@vreko/auth",
     "@vreko/claims-ledger",
     "@vreko/intelligence",

package/scripts/publish-clean.mjs

@@ -61,55 +61,52 @@ try {
 	mkdirSync(tmpDir, { recursive: true });
 	execFileSync("tar", ["-xzf", tgzPath, "-C", tmpDir]);
 
-	// Step 3: Strip unresolvable dep fields from bundled @vreko/* package.jsons.
+	// Step 3: Strip unresolvable dep fields from ALL bundled packages' package.jsons.
 	// Their code is already inlined into dist/index.js via tsup noExternal, or the
 	// daemon bundles its own deps. npm doesn't need to resolve their transitive deps
-	// and the catalog:/workspace:* specs cause empty stub directories that shadow
-	// real packages.
-	const vrekoModDir = join(tmpDir, "package", "node_modules", "@vreko");
-	if (existsSync(vrekoModDir)) {
-		const pkgs = readdirSync(vrekoModDir);
-		console.log(`🔧 Stripping catalog: deps from ${pkgs.length} bundled @vreko packages...`);
-		for (const pkg of pkgs) {
-			const pkgJsonPath = join(vrekoModDir, pkg, "package.json");
-			if (!existsSync(pkgJsonPath)) continue;
-			const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
-			const stripped =
-				"dependencies" in pkgJson ||
-				"devDependencies" in pkgJson ||
-				"peerDependencies" in pkgJson ||
-				"optionalDependencies" in pkgJson;
-			if (stripped) {
-				delete pkgJson.dependencies;
-				delete pkgJson.devDependencies;
-				delete pkgJson.peerDependencies;
-				delete pkgJson.optionalDependencies;
-				delete pkgJson.peerDependenciesMeta;
-				writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
-				console.log(`   cleaned: @vreko/${pkg}`);
-			}
+	// and the catalog:/workspace:* specs (or peer dep conflicts) cause install failures.
+	const extractedRootPkg = JSON.parse(readFileSync(join(tmpDir, "package", "package.json"), "utf8"));
+	const allBundled = extractedRootPkg.bundledDependencies || [];
+	const nodeModulesDir = join(tmpDir, "package", "node_modules");
+	console.log(`🔧 Stripping dep fields from ${allBundled.length} bundled packages...`);
+	for (const bundledPkg of allBundled) {
+		const pkgJsonPath = join(nodeModulesDir, bundledPkg, "package.json");
+		if (!existsSync(pkgJsonPath)) continue;
+		const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+		const hasDeps =
+			"dependencies" in pkgJson ||
+			"devDependencies" in pkgJson ||
+			"peerDependencies" in pkgJson ||
+			"optionalDependencies" in pkgJson;
+		if (hasDeps) {
+			delete pkgJson.dependencies;
+			delete pkgJson.devDependencies;
+			delete pkgJson.peerDependencies;
+			delete pkgJson.optionalDependencies;
+			delete pkgJson.peerDependenciesMeta;
+			writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
+			console.log(`   cleaned: ${bundledPkg}`);
 		}
 	}
 
-	// Step 3b: Fix root package.json — strip bundled @vreko/* from dependencies.
-	// pnpm rewrites workspace:* to local semvers; those semvers don't exist on npm.
-	// npm will 404 trying to resolve them even when the package is in bundledDependencies.
-	// Rule: a bundled @vreko/* package ships via bundledDependencies; it must not appear
-	// in dependencies at all. External (published) @vreko/* like @vreko/contracts are NOT
-	// in bundledDependencies and must remain in dependencies at their real semver.
+	// Step 3b: Fix root package.json — strip ALL bundled packages from dependencies.
+	// pnpm rewrites workspace:* to local semvers (don't exist on npm) and some bundled
+	// third-party packages carry peer dep conflicts. A bundled package ships via
+	// bundledDependencies; it must not appear in dependencies so npm never tries to
+	// resolve it from the registry.
 	const rootPkgPath = join(tmpDir, "package", "package.json");
 	const rootPkg = JSON.parse(readFileSync(rootPkgPath, "utf8"));
 	const bundledSet = new Set(rootPkg.bundledDependencies || []);
 	const removedFromDeps = [];
 	for (const key of Object.keys(rootPkg.dependencies || {})) {
-		if (key.startsWith("@vreko/") && bundledSet.has(key)) {
+		if (bundledSet.has(key)) {
 			delete rootPkg.dependencies[key];
 			removedFromDeps.push(key);
 		}
 	}
 	if (removedFromDeps.length > 0) {
 		writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2) + "\n");
-		console.log(`🔧 Removed ${removedFromDeps.length} bundled @vreko/* from root dependencies:`);
+		console.log(`🔧 Removed ${removedFromDeps.length} bundled packages from root dependencies:`);
 		for (const k of removedFromDeps) console.log(`   stripped: ${k}`);
 	}
 
@@ -143,9 +140,9 @@ try {
 		if (v.startsWith("workspace:")) failures.push(`3a FAIL: ${k} still has workspace:${v.slice(10)}`);
 	}
 
-	// 3b: no bundled @vreko/* appears in dependencies (local semvers don't exist on npm)
+	// 3b: no bundled package appears in dependencies (avoids registry resolution conflicts)
 	for (const key of Object.keys(verifyDeps)) {
-		if (key.startsWith("@vreko/") && verifyBundled.has(key)) {
+		if (verifyBundled.has(key)) {
 			failures.push(`3b FAIL: bundled ${key} still in dependencies as ${verifyDeps[key]}`);
 		}
 	}