[gitsacha]

Summary

Fixes #109 — after a fresh npm i -g roughdraft, every command crashes with:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'yaml' imported from
.../roughdraft/packages/rfm/dist/index.js

Root cause

@roughdraft/rfm's published dist/index.js does a runtime import 'yaml' in Node. yaml is declared as a dependency of the private @roughdraft/rfm workspace package, but the root package.json (what users install) only lists @roughdraft/rfm (via file:packages/rfm) and express. The root files whitelist ships packages/rfm/dist as raw, unbundled code, so its runtime imports are resolved from the installed package's node_modules — but yaml is never there, because it isn't declared in the manifest npm installs. The CLI is unusable.

(packages/app also imports yaml, but that's bundled into its browser build, so it's unaffected — this only bites the Node-resolved rfm runtime import.)

Fix

Promote yaml to the root dependencies (matching rfm's ^2.9.0 range). npm then installs yaml into the package's node_modules, where Node resolves it by walking up from packages/rfm/dist. This makes the documented #109 workaround permanent. Lockfile updated to add yaml to the root importer (the yaml@2.9.0 snapshot was already present transitively).

Following the repo Bug Fix Workflow ("Prove It")

1. Reproduce first: packages/server/src/packaging.test.ts asserts every runtime dependency of @roughdraft/rfm is declared in the root package.json. It fails on the missing yaml before the promotion and passes after — a behavioral guard for the whole class of "transitive workspace runtime dep not promoted to the published manifest", not just yaml.
2. Fix: promote yaml to the root manifest.
3. Verify: test passes; full gate green (below).

Verification

Ran the full CI gate locally with pnpm 10 (matching ci.yml's pnpm/action-setup@v4 version: 10):

• ✅ pnpm install --frozen-lockfile — accepts the lockfile edit; installs yaml 2.9.0 at the root.
• ✅ pnpm check — exit 0 (biome lint + test:selectors + vitest across all 5 workspace projects + build).
• ✅ New packaging.test.ts passes; confirmed it fails without the dependency promotion.
• ✅ Reproduced the original crash on a real global install and confirmed the fix resolves it.

[vercel]

@gitsacha is attempting to deploy a commit to the Lex Team on Vercel.

A member of the Team first needs to authorize it.

[gitsacha]

Rebased onto current main (686919e) — still applies clean, no conflicts. Happy to address feedback if there's anything you'd like changed; otherwise this is ready whenever you get a chance to look.