# Vendored packages

> For agents: start with the [agent guide](https://parol6.build/llms.txt). Every page is Markdown by default; add `Accept: text/html` for HTML.

Keep pinned dependencies here until npm publishes them. Each entry records its build source and removal condition. Nothing is vendored or patched right now.

The current `xstate@6.0.0-beta.1` and `@xstate/effect@1.0.0-beta.0` pins come from npm. Their exact `minimumReleaseAgeExclude` entries move together. The bridge accepts Effect `^4.0.0`, XState `^6.0.0-beta.0`, and optional `@oxlint/plugins` `^1.76.0`. Its compiled `@xstate/effect/oxlint` export supplies `xstate-effect/no-inline-effect` at error severity.

- **Vendored packages**: none.
- **Patched packages**: none. The last patch was `@foldkit/vite-plugin@0.28.0`. Its DevTools [MCP](https://github.com/joelhooks/rat-stack/blob/main/.brain/resources/lore/mcp-is-another-surface.svx) relay id called the removed `Crypto.randomUUIDv4` as a value, and the `peerDependencyRules.allowedVersions` entries for Foldkit's exact Effect `4.0.0` peers travelled with it. `@foldkit/vite-plugin@0.29.0` draws the id from `SecureRandom.uuidV4()` in `effect/crypto`, and Foldkit `0.170.0` peers on `effect ~4.1.0`. The patch, the allowances, and the `@foldkit/vite-plugin>@effect/platform-node*` overrides went away with the Effect `4.1.2` bump on 2026-11-02.

The last vendored package was `xstate-effect-0.1.0-alpha.2.tgz`, built from the `statelyai/xstate` tag `xstate@6.0.0-alpha.58` with `pnpm exec preconstruct build && pnpm pack` after the first npm publish failed on 2026-09-17. npm published the same bytes on 2026-09-19 and `packages/core` moved to the registry version on 2026-09-20.

## Rules for the next one

- Add a `file:` spec in the consuming package, the tarball here, and a list entry above with the exact tag or commit it was built from. Build from a pinned tag to keep lockfile integrity reproducible. A moving branch cannot provide that guarantee.
- A `file:` tarball still goes through pnpm's release-age check, which looks the version up on the registry. An unpublished version 404s and fails `pnpm install --frozen-lockfile` in CI; a warm local metadata cache hides this. Every vendored tarball needs a matching version-scoped `minimumReleaseAgeExclude` entry in `pnpm-workspace.yaml`.
- When the version publishes, confirm the tarballs match (`npm pack <name>@<version>` and compare file lists and `dist`), replace the `file:` spec with the exact version, delete the tarball and its list entry, run `pnpm install`, and watch CI. Keep the `minimumReleaseAgeExclude` entry if the package is a prerelease pin like the others in that list.

## What links here

- Agent rules for the PAROL6 wiki (AGENTS.md) → What you may change, which commands to run, and which changes need approval. → [Read page](https://parol6.build/AGENTS.md)