Files
zeekay 44a2799881 feat(brand): drop upstream's brand package, and take the react bindings from our own fork
The React bindings, the shim standing in for their peer, and four dead alias
lines all resolved to upstream packages. So did the illustrations, the logo and
the typeface, through `@hanzo/brand`.

`@hanzo/react` now resolves to `@hanzo/insights-react`, which we publish. Its
peer is `@hanzo/insights` by name, so `common/sdk-peer` -- a workspace package
named `posthog-js` purely to satisfy the old peer -- is gone, and with it the
last thing in the tree carrying that name. The fork exports `Insights*` where
upstream exported `PostHog*`, so eight files stop aliasing an upstream
identifier on import, and the eight allowlist entries excusing them are dropped.

`@hanzo/brand` is removed rather than forked. It is licensed PolyForm Strict
1.0.0: noncommercial use only, no derivative works, no redistribution, and the
illustrations are upstream trademarks. Forking it was never available to us, and
neither was the commercial use we were already making of it.

It carried three separate things, and each ends differently. The illustrations
were decoration beside real content, so the 106 call sites keep their component
and lose the artwork -- the shape `lib/components/mascots.tsx` already used. Two
had been repurposed as real icons; those take the house fallback icon. The logo
is real UI chrome, so it is rebuilt on Hanzo's own mark, the same glyph as the
favicon: monochrome and `currentColor`, so it inherits the surrounding text
colour instead of needing a variant per theme, and resolves inside the toolbar's
shadow DOM where the old gradient's `url(#...)` fills did not. The typeface
becomes Geist, already vendored here under SIL OFL and already the house face
everywhere else.

Four alias lines named packages nothing installs. pnpm echoes the override block
into the lockfile verbatim, so they put an upstream name there for nothing.

`bin/debrand --check` now refuses a manifest naming an upstream package unless it
is listed with a reason, keyed by package rather than by file so an exemption
cannot cover a whole manifest's future dependencies. Six remain, each with the
reason it is still upstream's. The check found two nobody had noticed: `cli` and
`rust` rename upstream crates with Cargo's `package =` key, the same aliasing on
a different registry.

The lockfile goes from 94 upstream references to 36.
2026-08-08 19:31:14 -07:00

38 lines
1.1 KiB
JSON

{
"name": "@hanzo/products-workflows",
"scripts": {
"backend:test": "pytest -c ../../pytest.ini --rootdir ../.. backend/ -v --tb=short"
},
"dependencies": {
"@hanzo/quill-charts": "workspace:*",
"@hanzo/quill-components": "workspace:*",
"@hanzo/quill-primitives": "workspace:*",
"insights-js": "catalog:",
"kea": "catalog:",
"kea-forms": "catalog:",
"kea-loaders": "catalog:",
"kea-router": "catalog:",
"kea-subscriptions": "catalog:",
"papaparse": "^5.4.1",
"use-debounce": "catalog:",
"zod": "^4.0.0"
},
"devDependencies": {
"@storybook/react": "catalog:",
"@testing-library/react": "*",
"@types/papaparse": "*",
"kea-test-utils": "catalog:"
},
"peerDependencies": {
"@hanzo/icons": "catalog:",
"@types/react": "*",
"@xyflow/react": "*",
"clsx": "*",
"elkjs": "*",
"fast-equals": "catalog:",
"fuse.js": "*",
"react": "*",
"rrule": "*"
}
}