For agents: start with the agent guide. Every page is Markdown by default; add Accept: text/html for HTML.

Vendored packages

Keep pinned dependencies here until npm publishes them. Each entry records its build source and removal condition. Nothing is vendored or patched right now.

The current xstate@6.0.0-beta.1 and @xstate/effect@1.0.0-beta.0 pins come from npm. Their exact minimumReleaseAgeExclude entries move together. The bridge accepts Effect ^4.0.0, XState ^6.0.0-beta.0, and optional @oxlint/plugins ^1.76.0. Its compiled @xstate/effect/oxlint export supplies xstate-effect/no-inline-effect at error severity.

• Vendored packages: none.
• Patched packages: none. The last patch was @foldkit/vite-plugin@0.28.0. Its DevTools MCP³¹ relay id called the removed Crypto.randomUUIDv4 as a value, and the peerDependencyRules.allowedVersions entries for Foldkit²⁷’s exact Effect 4.0.0 peers travelled with it. @foldkit/vite-plugin@0.29.0 draws the id from SecureRandom.uuidV4() in effect/crypto, and Foldkit 0.170.0 peers on effect ~4.1.0. The patch, the allowances, and the @foldkit/vite-plugin>@effect/platform-node* overrides went away with the Effect 4.1.2 bump on 2026-11-02.

The last vendored package was xstate-effect-0.1.0-alpha.2.tgz, built from the statelyai/xstate tag xstate@6.0.0-alpha.58 with pnpm exec preconstruct build && pnpm pack after the first npm publish failed on 2026-09-17. npm published the same bytes on 2026-09-19 and packages/core moved to the registry version on 2026-09-20.

Rules for the next one

• Add a file: spec in the consuming package, the tarball here, and a list entry above with the exact tag or commit it was built from. Build from a pinned tag to keep lockfile integrity reproducible. A moving branch cannot provide that guarantee.
• A file: tarball still goes through pnpm’s release-age check, which looks the version up on the registry. An unpublished version 404s and fails pnpm install --frozen-lockfile in CI; a warm local metadata cache hides this. Every vendored tarball needs a matching version-scoped minimumReleaseAgeExclude entry in pnpm-workspace.yaml.
• When the version publishes, confirm the tarballs match (npm pack <name>@<version> and compare file lists and dist), replace the file: spec with the exact version, delete the tarball and its list entry, run pnpm install, and watch CI. Keep the minimumReleaseAgeExclude entry if the package is a prerelease pin like the others in that list.

Last changed 2026-11-06 in 1f3d591. Source on GitHub. Change log.