feat: add Devnet frontend package foundations

CHANGELOG.md

@@ -491,10 +491,19 @@ character after JSON`, failing every build against such a lockfile.
   `@pnpm/exe.<target>` hashes, and the version is synced through
   `DEFAULT_AGGREGATE_PACKAGE_MANAGER` (hence the generated root `package.json`
   and `pnpm-install-contract.json`), the lock-mutator evaluation allowlist, and
-  the pnpm fixture manifests. Verified on the built package: `pnpm --version`
-  reports 12.4.1, the store layout stays `v11`, and `pnpm install
---frozen-lockfile --ignore-scripts` over all 39 workspace projects succeeds
-  with the lockfile unchanged.
+  the pnpm fixture manifests. The wrapper disables pnpm's package-manager
+  bootstrap because the derivation already provides the exact authoritative
+  version; this keeps sandboxed runtime invocations from trying to download a
+  second pnpm. Verified on the built package: `pnpm --version` reports 12.4.1,
+  the store layout stays `v11`, and `pnpm install --frozen-lockfile
+  --ignore-scripts` over all 39 workspace projects succeeds with the lockfile
+  unchanged.
+
+- **@overeng/utils / Storybook**: distribute the Storybook 10.6 builder-vite
+  patch that maps Storybook's `options.port` to Vite's HTTP `server.port`
+  while preserving `server.hmr.server`. This lets Devnet supply an exact
+  listener port without changing Storybook's WebSocket server authority.
+
 - **Buck2 / TypeScript authority**: transfer all 39 TypeScript projects to
   package-local Buck targets, including the independent React Inspector strict
   consumer and the five bootstrap-critical packages. Delete the root

buck2-test-authority.json

@@ -1669,6 +1669,7 @@
         "src/node/otel.unit.test.ts",
         "src/node/playwright/config/config.unit.test.ts",
         "src/node/playwright/otel.unit.test.ts",
+        "src/node/storybook/builder-vite-patch.unit.test.ts",
         "src/node/storybook/config/mod.unit.test.ts",
         "src/node/storybook/gate/portable-stories.unit.test.ts",
         "src/node/storybook/gate/project-annotations.unit.test.ts",
@@ -1706,6 +1707,7 @@
         "src/node/otel.unit.test.ts",
         "src/node/playwright/config/config.unit.test.ts",
         "src/node/playwright/otel.unit.test.ts",
+        "src/node/storybook/builder-vite-patch.unit.test.ts",
         "src/node/storybook/config/mod.unit.test.ts",
         "src/node/storybook/gate/portable-stories.unit.test.ts",
         "src/node/storybook/gate/project-annotations.unit.test.ts",

buck2/dependencies/pnpm-lock.sha256.json

@@ -1,6 +1,6 @@
 {
   "schema": "effect-utils/buck2-pnpm-sha256/v1",
-  "lockfileFingerprint": "sha256:d6853a397fee4b057d56b09ac2c33b248ef8e53741ed8b0495ce241b6dc411d8",
+  "lockfileFingerprint": "sha256:2397b2e7524ca34c5a16f64055958950c518ecaff53a897461d5fdea3d5d069c",
   "source": "pnpm-lock.yaml",
   "generator": "buck2/dependencies/pnpm-lock.sha256.json.genie.ts",
   "regenerate": "devenv tasks run genie:run",
@@ -3447,5 +3447,5 @@
       "sha256": "2c162e000f5fb5a816987d6f8ad7aad295203f777a5992d514ae4660778a51a4"
     }
   },
-  "fingerprint": "sha256:d5d8ca7d8565eab147b809f8aacf0af3015904c7cbd1f134ae375f505081a534"
+  "fingerprint": "sha256:9e0956f6d1348758b5b644d9e17f0dd7d3445d70251d5d314b55835d279e9066"
 }

buck2/dependencies/pnpm-store-buck.ts

@@ -2,7 +2,6 @@ import {
   nativeDependencyPolicy,
   nixGraftedStoreOverridePackages,
 } from '../../genie/native-dependency-policy.ts'
-
 import type { PnpmLockMetadata, PnpmSha256Sidecar } from './pnpm-lock.ts'
 import type {
   PnpmStoreEdgeSet,
@@ -219,6 +218,13 @@ export const renderPnpmPackageTargets = ({
   metadata: PnpmLockMetadata
   sidecar: PnpmSha256Sidecar
 }): string => {
+  const buckPatchTarget = (patchPath: string): string => {
+    const marker = '/patches/'
+    const markerIndex = patchPath.indexOf(marker)
+    return markerIndex < 0
+      ? `//:${patchPath}`
+      : `//${patchPath.slice(0, markerIndex)}:patches/${patchPath.slice(markerIndex + marker.length)}`
+  }
   const lines: string[] = []
   for (const [packageKey, packageMetadata] of sortedEntries(metadata.packages)) {
     if (packageMetadata.resolution !== 'registry') continue
@@ -234,7 +240,7 @@ export const renderPnpmPackageTargets = ({
       `    bins = ${renderDict({ indent: 4, record: hash.bins })},`,
       ...(packageMetadata.patch === undefined
         ? []
-        : [`    patches = [${starlarkString(`//:${packageMetadata.patch.path}`)}],`]),
+        : [`    patches = [${starlarkString(buckPatchTarget(packageMetadata.patch.path))}],`]),
       ')',
       '',
     )
@@ -267,9 +273,7 @@ export const renderPnpmPlatformGatedPackages = ({
     if (members === undefined) byFamily.set(family, [name])
     else members.push(name)
   }
-  const families = [...byFamily.keys()].toSorted((left, right) =>
-    compareStrings({ left, right }),
-  )
+  const families = [...byFamily.keys()].toSorted((left, right) => compareStrings({ left, right }))
   const capabilities: Record<string, string> = {}
   for (const family of families) {
     const policy = nativeDependencyPolicy[family as keyof typeof nativeDependencyPolicy]

genie/buck2/typescript-package-projection.ts

@@ -1127,6 +1127,16 @@ export const buck2TypeScriptPackageProjection = ({
       renderBuck2Visibility({ visibility }),
       ')',
       '',
+      ...testDataFiles
+        .filter((file) => file.endsWith('.patch'))
+        .flatMap((file) => [
+          'export_file(',
+          `    name = ${starlarkString(file)},`,
+          `    src = ${starlarkString(file)},`,
+          renderBuck2Visibility({ visibility }),
+          ')',
+          '',
+        ]),
       'export_materialization_inputs([',
       ...packageSources.map((source) => `    ${starlarkString(source)},`),
       '])',

genie/external.ts

@@ -632,6 +632,14 @@ export const createEffectUtilsRefs = (basePath: string) =>
 // Patch Postinstall Helpers
 // =============================================================================
 
+// Remove both registry entries with the first verified upstream release that
+// puts the dev port on `server.port` while retaining caller-owned `hmr.server`.
+
+const storybookBuilderVitePatch = {
+  '@storybook/builder-vite@10.6.0':
+    'packages/@overeng/utils/patches/@storybook__builder-vite@10.6.0.patch',
+} satisfies PatchesRegistry
+
 /** Repo-local patches that should not be projected into downstream consumers. */
 export const effectUtilsWorkspacePatches = definePatchedDependencies({
   location: '.',
@@ -643,15 +651,15 @@ export const effectUtilsWorkspacePatches = definePatchedDependencies({
        CJS-interop default that 0.13.x provided is gone. Rewrite the import to
        a namespace import so `xtermSerialize.SerializeAddon` resolves. */
     '@myobie/pty@0.10.0': 'patches/@myobie__pty@0.10.0.patch',
+    ...storybookBuilderVitePatch,
   },
 })
 
 /**
  * Repo-root-relative registry used by downstream projection helpers
  * (patchPostinstall / pnpmPatchedDependencies / createPnpmPatchedDependencies).
- * Empty since the Effect 4 cohort flip: projected patches would be listed here.
  */
-const patches: PatchesRegistry = {}
+const patches: PatchesRegistry = storybookBuilderVitePatch
 
 /**
  * Parse a patch specifier into package name and version.

nix/pnpm.nix

@@ -127,10 +127,19 @@ pkgs.stdenvNoCC.mkDerivation {
 
     chmod +x "$wrapper/bin/pnpm.mjs" "$wrapper/bin/pnpx.mjs"
 
-    makeWrapper "$wrapper/pnpm" $out/bin/pnpm
-    makeWrapper "$wrapper/pnpm" $out/bin/pn
-    makeWrapper "$wrapper/pnpm" $out/bin/pnpx --add-flags dlx
-    makeWrapper "$wrapper/pnpm" $out/bin/pnx --add-flags dlx
+    # This derivation already provides the exact workspace-authoritative pnpm.
+    # Disable pnpm's package-manager bootstrap so sandboxed invocations do not
+    # try to download a second copy of the same version.
+    makeWrapper "$wrapper/pnpm" $out/bin/pnpm \
+      --set pnpm_config_pm_on_fail ignore
+    makeWrapper "$wrapper/pnpm" $out/bin/pn \
+      --set pnpm_config_pm_on_fail ignore
+    makeWrapper "$wrapper/pnpm" $out/bin/pnpx \
+      --set pnpm_config_pm_on_fail ignore \
+      --add-flags dlx
+    makeWrapper "$wrapper/pnpm" $out/bin/pnx \
+      --set pnpm_config_pm_on_fail ignore \
+      --add-flags dlx
 
     runHook postInstall
   '';

packages/@overeng/gh-ci-utils/nix/build.nix

@@ -20,7 +20,7 @@ let
     workspaceRoot = src;
     # Managed by the repo FOD refresh workflow — do not edit manually.
     depsBuilds = {
-      "." = mkSharedHash "sha256-Q3UincMJT2KhQCLAyt8Rgk97k3epBVJFrFKOlFgj14g=";
+      "." = mkSharedHash "sha256-1qzNQ/SjGrZ5woZvIbOQUwY3JA7jYeNWUk964FWwSfk=";
     };
     nativeNodePackages = opentuiCoreNative.packages;
     smokeTestArgs = [ "--version" ];

packages/@overeng/otel-contract/src/mod.unit.test.ts

@@ -521,49 +521,47 @@ describe('OtelAttrs', () => {
       ),
     )
 
-    expect(attrs.fields).toMatchInlineSnapshot(`
-      [
-        {
-          "astTag": "String",
-          "attrKey": "span.label",
-          "encodePolicy": "auto",
-          "optional": false,
-          "role": "span.label",
-          "sourceKey": "label",
-        },
-        {
-          "astTag": "Union",
-          "attrKey": "op.outcome",
-          "cardinality": "bounded",
-          "encodePolicy": "auto",
-          "optional": false,
-          "sourceKey": "outcome",
-        },
-        {
-          "astTag": "Boolean",
-          "attrKey": "op.cache_hit",
-          "cardinality": "low",
-          "encodePolicy": "auto",
-          "optional": false,
-          "sourceKey": "cacheHit",
-        },
-        {
-          "astTag": "String",
-          "attrKey": "request.id",
-          "cardinality": "high",
-          "encodePolicy": "auto",
-          "optional": false,
-          "sourceKey": "requestId",
-        },
-        {
-          "astTag": "Objects",
-          "attrKey": "op.payload",
-          "encodePolicy": "json",
-          "optional": false,
-          "sourceKey": "payload",
-        },
-      ]
-    `)
+    expect(attrs.fields).toStrictEqual([
+      {
+        astTag: 'String',
+        attrKey: 'span.label',
+        encodePolicy: 'auto',
+        optional: false,
+        role: 'span.label',
+        sourceKey: 'label',
+      },
+      {
+        astTag: 'Union',
+        attrKey: 'op.outcome',
+        cardinality: 'bounded',
+        encodePolicy: 'auto',
+        optional: false,
+        sourceKey: 'outcome',
+      },
+      {
+        astTag: 'Boolean',
+        attrKey: 'op.cache_hit',
+        cardinality: 'low',
+        encodePolicy: 'auto',
+        optional: false,
+        sourceKey: 'cacheHit',
+      },
+      {
+        astTag: 'String',
+        attrKey: 'request.id',
+        cardinality: 'high',
+        encodePolicy: 'auto',
+        optional: false,
+        sourceKey: 'requestId',
+      },
+      {
+        astTag: 'Objects',
+        attrKey: 'op.payload',
+        encodePolicy: 'json',
+        optional: false,
+        sourceKey: 'payload',
+      },
+    ])
   })
 })
 
@@ -817,55 +815,48 @@ describe('OtelMetric', () => {
       'restate.cache_hit': true,
     })
 
-    expect(Invocations.metadata).toMatchInlineSnapshot(`
-      {
-        "description": "Restate invocations by service, handler, and outcome.",
-        "instrument": "counter",
-        "kind": "metric",
-        "labelKeys": [
-          "restate.service",
-          "restate.handler",
-          "restate.outcome",
-          "restate.cache_hit",
-        ],
-        "labels": [
-          {
-            "astTag": "String",
-            "attrKey": "restate.service",
-            "cardinality": "bounded",
-            "encodePolicy": "auto",
-            "optional": false,
-            "sourceKey": "service",
-          },
-          {
-            "astTag": "String",
-            "attrKey": "restate.handler",
-            "cardinality": "bounded",
-            "encodePolicy": "auto",
-            "optional": false,
-            "sourceKey": "handler",
-          },
-          {
-            "astTag": "Union",
-            "attrKey": "restate.outcome",
-            "cardinality": "bounded",
-            "encodePolicy": "auto",
-            "optional": false,
-            "sourceKey": "outcome",
-          },
-          {
-            "astTag": "Boolean",
-            "attrKey": "restate.cache_hit",
-            "cardinality": "low",
-            "encodePolicy": "auto",
-            "optional": false,
-            "sourceKey": "cacheHit",
-          },
-        ],
-        "name": "restate_invocations_total",
-        "unit": "1",
-      }
-    `)
+    expect(Invocations.metadata).toStrictEqual({
+      description: 'Restate invocations by service, handler, and outcome.',
+      instrument: 'counter',
+      kind: 'metric',
+      labelKeys: ['restate.service', 'restate.handler', 'restate.outcome', 'restate.cache_hit'],
+      labels: [
+        {
+          astTag: 'String',
+          attrKey: 'restate.service',
+          cardinality: 'bounded',
+          encodePolicy: 'auto',
+          optional: false,
+          sourceKey: 'service',
+        },
+        {
+          astTag: 'String',
+          attrKey: 'restate.handler',
+          cardinality: 'bounded',
+          encodePolicy: 'auto',
+          optional: false,
+          sourceKey: 'handler',
+        },
+        {
+          astTag: 'Union',
+          attrKey: 'restate.outcome',
+          cardinality: 'bounded',
+          encodePolicy: 'auto',
+          optional: false,
+          sourceKey: 'outcome',
+        },
+        {
+          astTag: 'Boolean',
+          attrKey: 'restate.cache_hit',
+          cardinality: 'low',
+          encodePolicy: 'auto',
+          optional: false,
+          sourceKey: 'cacheHit',
+        },
+      ],
+      name: 'restate_invocations_total',
+      unit: '1',
+    })
 
     await expect(
       Effect.runPromise(