[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-grafana-audit-and-reduce-dependencies":3,"mdc--sdjom-key":35,"related-org-grafana-audit-and-reduce-dependencies":2105,"related-repo-grafana-audit-and-reduce-dependencies":2299},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"audit-and-reduce-dependencies","reduce JavaScript dependency footprint","Reduces JavaScript dependency footprint with pnpm while preserving lockfile, workspace layout, and dependency range style. Runs \u002Fcheck-npm first, then removes unused deps, dedupes versions, ranks transitive closure, and reports Keep\u002FReplace\u002FRemove triage. Use when cleaning up pnpm dependencies, reducing lockfile size, or shrinking node_modules in Grafana plugins; not for Go modules or full GitHub Actions workflow audits.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"grafana","Grafana","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fgrafana.jpg",[12,16,18,21],{"name":13,"slug":14,"type":15},"Performance","performance","tag",{"name":17,"slug":17,"type":15},"npm",{"name":19,"slug":20,"type":15},"Engineering","engineering",{"name":22,"slug":23,"type":15},"Code Analysis","code-analysis",189,"https:\u002F\u002Fgithub.com\u002Fgrafana\u002Fskills","2026-07-12T07:44:59.939525","Apache-2.0",16,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],null,"https:\u002F\u002Fgithub.com\u002Fgrafana\u002Fskills\u002Ftree\u002FHEAD\u002Fskills\u002Fgrafana-plugins\u002Faudit-and-reduce-dependencies","---\nname: audit-and-reduce-dependencies\nlicense: Apache-2.0\ndescription: >-\n  Reduces JavaScript dependency footprint with pnpm while preserving lockfile,\n  workspace layout, and dependency range style. Runs \u002Fcheck-npm first, then\n  removes unused deps, dedupes versions, ranks transitive closure, and reports\n  Keep\u002FReplace\u002FRemove triage. Use when cleaning up pnpm dependencies, reducing\n  lockfile size, or shrinking node_modules in Grafana plugins; not for Go\n  modules or full GitHub Actions workflow audits.\n---\n\n# Audit and reduce dependencies\n\nReduce JavaScript dependency footprint. Use **pnpm only**. Preserve the lockfile, workspace layout, and dependency range style unless there is a concrete reason to change them.\n\nFor GitHub Actions workflow triage (action choice, permissions, pinning), use a dedicated workflow audit — not the reporting format below (workflow file + step only when the finding is **pnpm install policy**).\n\n## Workflow\n\n0. Hardening gate: run `\u002Fcheck-npm` (read-only). See [check-npm](..\u002Fcheck-npm\u002FSKILL.md).\n1. Establish the baseline.\n2. Remove unused direct dependencies.\n3. Deduplicate direct dependency versions in monorepos.\n4. Rank direct dependencies by transitive lockfile closure.\n5. Use closure data to find low-risk minor\u002Fpatch upgrades.\n6. Use closure data to find trivial dependencies worth inlining.\n7. Check e18e recommendations for replacements\u002Fremovals.\n8. Reinstall, verify, and report measured impact.\n\n## Step 0: Hardening gate (`\u002Fcheck-npm`)\n\nRun **`\u002Fcheck-npm`** before mutating manifests or lockfiles.\n\n- If any check **FAIL**s: report the table and fix snippets; **do not weaken** `pnpm-workspace.yaml`, `.npmrc`, CI install flags, or Renovate age gates during cleanup.\n- Do not paste full hardening config into this workflow — `\u002Fcheck-npm` owns version thresholds, script policy, git-dep protocols, and min release age.\n- If the user only asked for hardening (not reduction), stop after `\u002Fcheck-npm` unless they also want cleanup.\n\n**pnpm 11+:** script and release-age policy live in `pnpm-workspace.yaml`, not `.npmrc` or `package.json#pnpm` (pnpm 11 no longer reads the `package.json#pnpm` field). Verify each key against the installed pnpm major before suggesting config. Never add unsupported keys. Do not lower an existing `minimumReleaseAge` (or org equivalent) during cleanup.\n\n## Dependency triage\n\nFor each non-trivial direct dependency (especially after Steps 4–7), assign one label:\n\n| Label | Meaning |\n|-------|---------|\n| **Keep** | Required; worthwhile transitive cost; well maintained. |\n| **Replace-with-Better** | Required; better-maintained or safer alternative exists. |\n| **Replace-with-Internal** | Required; external risk warrants internal implementation. |\n| **Remove** | Can drop or inline (Step 6). |\n| **Needs-user-review** | Ambiguous usage, policy tradeoff, or change needing human verification. |\n\n**Replacements and new direct deps**\n\n- **No new direct dependencies** (including swaps) without explicit user approval.\n- Prefer **Remove** (inline\u002Fnative APIs) over **Replace-with-Better** when equivalent.\n- For **Replace-with-Better**: state why (maintenance, security, smaller tree); prefer actively maintained, widely adopted packages from trusted maintainers.\n- Respect repo `minimumReleaseAge` \u002F Renovate gates; command-level 72h freshness is a floor, not permission to bypass stricter config.\n\n## pnpm & supply-chain\n\nConfirm the repo uses pnpm: `pnpm-lock.yaml`, `pnpm-workspace.yaml`, and\u002For `packageManager` \u002F `devEngines.packageManager.name` set to `pnpm` in root `package.json`. If not on pnpm, stop — do not migrate package managers as part of cleanup.\n\nRespect repo install policy when present (e.g. `pnpm install --frozen-lockfile --ignore-scripts`).\n\n| Action | Command |\n|--------|---------|\n| Install\u002Fupdate lockfile | `pnpm install --ignore-scripts` (+ repo flags, e.g. `--frozen-lockfile`) |\n| Remove direct dependency | `pnpm remove \u003Cpkg> --ignore-scripts` |\n| Add\u002Fupdate direct dependency | `pnpm add \u003Cpkg>@\u003Cversion> --ignore-scripts` |\n| Explain dependency | `pnpm why \u003Cpkg>` |\n| Dedupe lockfile | `pnpm dedupe` (then `pnpm install --ignore-scripts` if lockfile changed) |\n| Outdated \u002F version info | `pnpm outdated \u003Cpkg>` |\n| One-off tools | `pnpm --config.ignore-scripts=true dlx \u003Cpkg>@\u003Cversion> \u003Cargs...>` (pin version; prefer `pnpm exec` when in lockfile) |\n\n**Lifecycle scripts:** Always `--ignore-scripts` on `pnpm install`, `pnpm add`, and `pnpm remove` unless the user explicitly writes **allow scripts** in the same message (state which scripts would run and the risk). For `pnpm dlx`, `dlx` does not accept `--ignore-scripts` directly — use `pnpm --config.ignore-scripts=true dlx` (flags after `dlx` are forwarded to the executed binary). If a dependency legitimately needs a build script (native modules, etc.), finish without scripts, then ask whether to run a **specific** manual rebuild (e.g. `pnpm rebuild \u003Cpkg>`).\n\n**Freshness check (≥ 72 hours)** — required before any command that adds or upgrades a **named package version** (`pnpm add`, `pnpm dlx` with new\u002Fupgraded direct version). **Not required** for plain `pnpm install` \u002F `pnpm remove` with no new package argument.\n\nFor each directly named package:\n\n1. `curl -s https:\u002F\u002Fregistry.npmjs.org\u002F\u003Cpackage-name>`\n2. Resolve version: pinned `pkg@1.2.3` → that version; range\u002F`latest`\u002Funspecified → `dist-tags.latest`\n3. Read `time[\"\u003Cversion>\"]`\n4. If published **less than 72 hours ago** → **stop**. Tell the user package, version, and exact age. Suggest an older known-good pin unless they write **override freshness check**.\n5. **`@grafana\u002F*`** scoped packages are **exempt** from the freshness check; `--ignore-scripts` still applies.\n\nAfter a failed freshness check, do not substitute a different version without user approval.\n\n## Safety rules\n\n- Work in small batches so lockfile diffs remain reviewable.\n- Never trust unused-dependency tools blindly; verify imports, config files, scripts, generated code hooks, framework conventions, plugin names, CLIs, and dynamic imports.\n- You may write scripting and parsing to verify `package.json` and lockfile dependency accounts.\n- Treat `peerDependencies`, `optionalDependencies`, package bin usage, test fixtures, and published package manifests as higher risk.\n- Do not remove or inline dependencies used for security, parsing, crypto, Unicode, URL handling, date\u002Ftime, i18n, or platform compatibility unless the replacement is proven equivalent.\n- Do not switch package managers, delete `pnpm-lock.yaml`, or rewrite workspace structure as part of cleanup.\n- Treat `pnpm dedupe` as potentially behavior-changing; inspect lockfile diffs and run focused verification before keeping the result.\n- Measure before and after: direct dependency count, lockfile line count or entry count, package count, and estimated `node_modules` size when available.\n\n## Step 1: Baseline\n\nCollect:\n\n- All `package.json` files and workspace boundaries (`pnpm-workspace.yaml`).\n- `pnpm-lock.yaml`, `pnpm-workspace.yaml` security settings (`minimumReleaseAge`, `strictDepBuilds`, `blockExoticSubdeps`, `allowBuilds`), and install policy in `.npmrc` \u002F CI flags (e.g. `--frozen-lockfile`, `--ignore-scripts`).\n- Direct dependency names by manifest section: `dependencies`, `devDependencies`, `peerDependencies`, `optionalDependencies`.\n- Existing verification commands from scripts, CI, or repo docs.\n- **CI spot-check** (`.github\u002Fworkflows` or equivalent): installs should use `pnpm install --frozen-lockfile` and script blocking consistent with workspace config. Flag workflows that regenerate lockfiles on every run.\n- **Renovate \u002F Dependabot** (if present): note `minimumReleaseAge` for npm packages; do not reduce it during cleanup.\n\nRecord baseline metrics: `git status --short`, `wc -l pnpm-lock.yaml`. If `node_modules` is installed, estimate footprint with platform-appropriate tools. Lockfile reductions are the primary metric — do not depend on `node_modules` being present.\n\n## Step 2: Remove unused direct dependencies\n\n**Unsafe direct dependency protocols** — scan all workspace `package.json` dependency sections. Flag values that are not: semver range, `workspace:`, `patch:`, or `npm:` alias to semver. Flag `git:` \u002F `github:` \u002F tarball URLs \u002F `user\u002Frepo` shorthand \u002F `file:` \u002F `link:` \u002F `exec:` \u002F etc. (same allow-list as `\u002Fcheck-npm`). Do not remove flagged entries silently; report for a separate hardening PR unless the user asked to fix them.\n\nUse a static analyzer as a starting point, not as proof (knip, depcheck, or repo-native tooling). Run with pinned `pnpm --config.ignore-scripts=true dlx \u003Ctool>@\u003Cversion> \u003Cargs...>` when not installed (freshness-check the pin first).\n\nFor each candidate:\n\n- Search code, configs, package scripts, build tooling, tests, and docs for the package name and known import paths.\n- Check whether required by a published package manifest, peer contract, plugin loader, CLI command, or dynamic `require`\u002F`import`.\n- Remove only when no real usage remains.\n- Run `pnpm install --ignore-scripts` (+ repo flags) and focused verification.\n\nIf usage is only in a script or config, consider moving between `dependencies` and `devDependencies` instead of removing.\n\n## Step 3: Deduplicate monorepo direct versions\n\nLook for the same direct dependency declared with multiple versions\u002Franges across package manifests. Use existing policy first: exact pins, caret ranges, catalog\u002Fprotocol usage, workspace protocol, or central constraints.\n\n- Use `syncpack list-mismatches` or equivalent for discovery.\n- Standardize direct ranges when packages can share the same compatible version.\n- Prefer manifest-level consistency before adding `pnpm.overrides`.\n- Use `pnpm.overrides` only for transitive convergence or security fixes, and document why.\n\nAfter deduping, run `pnpm install --ignore-scripts` (+ repo flags) and inspect manifest and lockfile diffs. Then consider `pnpm dedupe` — apply carefully; may change transitive resolution.\n\n## Step 4: Rank transitive lockfile closure\n\nFor each important direct dependency, estimate closure: transitive lockfile entries reachable from that dependency.\n\nReport both:\n\n- **Total closure**: all packages reachable from the dependency.\n- **Exclusive closure**: packages that disappear if this dependency is removed and are not retained by other direct dependencies.\n\nPrefer deterministic measurement:\n\n1. Save baseline lockfile metrics.\n2. Temporarily remove one direct dependency from the owning manifest.\n3. Run `pnpm install --ignore-scripts` (+ repo flags).\n4. Measure lockfile line\u002Fentry reduction and package count reduction.\n5. Revert the manifest *and* `pnpm-lock.yaml` (e.g., `git checkout -- \u003Cmanifest> pnpm-lock.yaml`) before measuring the next dependency.\n\nUse `pnpm why \u003Cpkg>` for large transitive packages. Rank by impact and risk, not just raw size.\n\n## Step 5: Find low-risk high-impact upgrades\n\nUse closure rankings to target direct dependencies whose newer minor\u002Fpatch versions reduce transitive dependencies.\n\nFor each candidate:\n\n- Check available non-major versions with `pnpm outdated`.\n- Review changelog\u002Frelease notes for dependency tree changes.\n- Freshness-check the target version, then upgrade one dependency or tight cluster at a time (`pnpm add \u003Cpkg>@\u003Cversion> --ignore-scripts`).\n- Run `pnpm install --ignore-scripts` (+ repo flags) and compare closure metrics.\n- Run focused tests and relevant build\u002Ftypecheck commands.\n\nAvoid major upgrades unless the user explicitly accepts the migration risk.\n\n## Step 6: Inline trivial usage\n\nUse closure rankings to find direct dependencies with small, obvious usage but large transitive cost.\n\nInline only when all are true:\n\n- Usage is tiny and easy to fully characterize.\n- Equivalent code is shorter or clearer than retaining the dependency.\n- Behavior is covered by tests or can be covered with small characterization tests.\n- The dependency is not solving cross-platform, security, parsing, Unicode, locale, or spec-compliance edge cases.\n\nPrefer native APIs over new replacement dependencies when the required behavior is simple.\n\n## Step 7: Apply e18e guidance\n\n```bash\n# Pin @e18e\u002Fcli@\u003Cversion> after freshness check; disable scripts on the dlx install\npnpm --config.ignore-scripts=true dlx @e18e\u002Fcli@\u003Cversion> analyze\npnpm --config.ignore-scripts=true dlx @e18e\u002Fcli@\u003Cversion> migrate --dry-run\n```\n\nAlso check https:\u002F\u002Fe18e.dev\u002Fdocs\u002Freplacements\u002F. Treat recommendations as candidates, not mandates; verify bundle\u002Fruntime behavior and run tests. Map e18e swaps to **Replace-with-Better** only after user approval.\n\n## Reporting\n\nSummarize outcomes with measured impact:\n\n- `\u002Fcheck-npm` result (PASS\u002FFAIL summary; link fixes if FAIL).\n- Direct dependencies removed or moved.\n- Direct versions deduplicated.\n- Lockfile line\u002Fentry reduction.\n- Estimated package or `node_modules` reduction when available.\n- High-impact candidates deferred and why (including replacements awaiting approval).\n- Unsafe protocol \u002F CI \u002F Renovate findings from baseline (if any).\n- Verification commands run and results.\n- Supply-chain: versions freshness-checked (or exempted), `--ignore-scripts` on all installs\u002Fadds, `--config.ignore-scripts=true` on `pnpm dlx`.\n\nCall out risk explicitly when a removal depends on static analysis rather than runtime coverage.\n\n### Reporting format\n\nUse for **dependency cleanup findings only** — not GitHub Actions workflow triage.\n\nFor each finding:\n\n- **Evidence**: package name and version\u002Frange; manifest path and section; supporting signal (import site, `pnpm why`, knip\u002Fdepcheck hit, closure measurement, `\u002Fcheck-npm` row, or workflow file + step only for **pnpm install policy**).\n- **Decision**: one of **Dependency triage** labels.\n- **Proposed change**: exact manifest\u002Flockfile command or edit. If not applied yet, state that explicitly.\n- **Rationale**: footprint (exclusive\u002Ftotal closure), supply-chain, maintenance, or verification risk.\n- **User review required**: tests\u002Fbuild\u002Ftypecheck to run; peer\u002Fplugin\u002FCLI consumers; published-package or dynamic-import risk; approval before **Replace-with-Better** or any new direct dependency.\n\nUse one block per package (or per protocol\u002FCI finding), not a single-line summary, when the finding is non-trivial.\n",{"data":36,"body":37},{"name":4,"license":27,"description":6},{"type":38,"children":39},"root",[40,48,62,74,81,150,163,178,241,288,294,299,407,415,468,474,525,537,706,805,855,860,963,968,974,1060,1066,1071,1233,1267,1273,1365,1378,1383,1427,1446,1452,1457,1501,1520,1526,1531,1536,1559,1564,1620,1631,1637,1642,1646,1693,1698,1704,1709,1714,1737,1742,1748,1869,1889,1895,1900,1980,1985,1992,2004,2009,2094,2099],{"type":41,"tag":42,"props":43,"children":44},"element","h1",{"id":4},[45],{"type":46,"value":47},"text","Audit and reduce dependencies",{"type":41,"tag":49,"props":50,"children":51},"p",{},[52,54,60],{"type":46,"value":53},"Reduce JavaScript dependency footprint. Use ",{"type":41,"tag":55,"props":56,"children":57},"strong",{},[58],{"type":46,"value":59},"pnpm only",{"type":46,"value":61},". Preserve the lockfile, workspace layout, and dependency range style unless there is a concrete reason to change them.",{"type":41,"tag":49,"props":63,"children":64},{},[65,67,72],{"type":46,"value":66},"For GitHub Actions workflow triage (action choice, permissions, pinning), use a dedicated workflow audit — not the reporting format below (workflow file + step only when the finding is ",{"type":41,"tag":55,"props":68,"children":69},{},[70],{"type":46,"value":71},"pnpm install policy",{"type":46,"value":73},").",{"type":41,"tag":75,"props":76,"children":78},"h2",{"id":77},"workflow",[79],{"type":46,"value":80},"Workflow",{"type":41,"tag":82,"props":83,"children":85},"ol",{"start":84},0,[86,110,115,120,125,130,135,140,145],{"type":41,"tag":87,"props":88,"children":89},"li",{},[90,92,99,101,108],{"type":46,"value":91},"Hardening gate: run ",{"type":41,"tag":93,"props":94,"children":96},"code",{"className":95},[],[97],{"type":46,"value":98},"\u002Fcheck-npm",{"type":46,"value":100}," (read-only). See ",{"type":41,"tag":102,"props":103,"children":105},"a",{"href":104},"..\u002Fcheck-npm\u002FSKILL.md",[106],{"type":46,"value":107},"check-npm",{"type":46,"value":109},".",{"type":41,"tag":87,"props":111,"children":112},{},[113],{"type":46,"value":114},"Establish the baseline.",{"type":41,"tag":87,"props":116,"children":117},{},[118],{"type":46,"value":119},"Remove unused direct dependencies.",{"type":41,"tag":87,"props":121,"children":122},{},[123],{"type":46,"value":124},"Deduplicate direct dependency versions in monorepos.",{"type":41,"tag":87,"props":126,"children":127},{},[128],{"type":46,"value":129},"Rank direct dependencies by transitive lockfile closure.",{"type":41,"tag":87,"props":131,"children":132},{},[133],{"type":46,"value":134},"Use closure data to find low-risk minor\u002Fpatch upgrades.",{"type":41,"tag":87,"props":136,"children":137},{},[138],{"type":46,"value":139},"Use closure data to find trivial dependencies worth inlining.",{"type":41,"tag":87,"props":141,"children":142},{},[143],{"type":46,"value":144},"Check e18e recommendations for replacements\u002Fremovals.",{"type":41,"tag":87,"props":146,"children":147},{},[148],{"type":46,"value":149},"Reinstall, verify, and report measured impact.",{"type":41,"tag":75,"props":151,"children":153},{"id":152},"step-0-hardening-gate-check-npm",[154,156,161],{"type":46,"value":155},"Step 0: Hardening gate (",{"type":41,"tag":93,"props":157,"children":159},{"className":158},[],[160],{"type":46,"value":98},{"type":46,"value":162},")",{"type":41,"tag":49,"props":164,"children":165},{},[166,168,176],{"type":46,"value":167},"Run ",{"type":41,"tag":55,"props":169,"children":170},{},[171],{"type":41,"tag":93,"props":172,"children":174},{"className":173},[],[175],{"type":46,"value":98},{"type":46,"value":177}," before mutating manifests or lockfiles.",{"type":41,"tag":179,"props":180,"children":181},"ul",{},[182,217,229],{"type":41,"tag":87,"props":183,"children":184},{},[185,187,192,194,199,201,207,209,215],{"type":46,"value":186},"If any check ",{"type":41,"tag":55,"props":188,"children":189},{},[190],{"type":46,"value":191},"FAIL",{"type":46,"value":193},"s: report the table and fix snippets; ",{"type":41,"tag":55,"props":195,"children":196},{},[197],{"type":46,"value":198},"do not weaken",{"type":46,"value":200}," ",{"type":41,"tag":93,"props":202,"children":204},{"className":203},[],[205],{"type":46,"value":206},"pnpm-workspace.yaml",{"type":46,"value":208},", ",{"type":41,"tag":93,"props":210,"children":212},{"className":211},[],[213],{"type":46,"value":214},".npmrc",{"type":46,"value":216},", CI install flags, or Renovate age gates during cleanup.",{"type":41,"tag":87,"props":218,"children":219},{},[220,222,227],{"type":46,"value":221},"Do not paste full hardening config into this workflow — ",{"type":41,"tag":93,"props":223,"children":225},{"className":224},[],[226],{"type":46,"value":98},{"type":46,"value":228}," owns version thresholds, script policy, git-dep protocols, and min release age.",{"type":41,"tag":87,"props":230,"children":231},{},[232,234,239],{"type":46,"value":233},"If the user only asked for hardening (not reduction), stop after ",{"type":41,"tag":93,"props":235,"children":237},{"className":236},[],[238],{"type":46,"value":98},{"type":46,"value":240}," unless they also want cleanup.",{"type":41,"tag":49,"props":242,"children":243},{},[244,249,251,256,258,263,265,271,273,278,280,286],{"type":41,"tag":55,"props":245,"children":246},{},[247],{"type":46,"value":248},"pnpm 11+:",{"type":46,"value":250}," script and release-age policy live in ",{"type":41,"tag":93,"props":252,"children":254},{"className":253},[],[255],{"type":46,"value":206},{"type":46,"value":257},", not ",{"type":41,"tag":93,"props":259,"children":261},{"className":260},[],[262],{"type":46,"value":214},{"type":46,"value":264}," or ",{"type":41,"tag":93,"props":266,"children":268},{"className":267},[],[269],{"type":46,"value":270},"package.json#pnpm",{"type":46,"value":272}," (pnpm 11 no longer reads the ",{"type":41,"tag":93,"props":274,"children":276},{"className":275},[],[277],{"type":46,"value":270},{"type":46,"value":279}," field). Verify each key against the installed pnpm major before suggesting config. Never add unsupported keys. Do not lower an existing ",{"type":41,"tag":93,"props":281,"children":283},{"className":282},[],[284],{"type":46,"value":285},"minimumReleaseAge",{"type":46,"value":287}," (or org equivalent) during cleanup.",{"type":41,"tag":75,"props":289,"children":291},{"id":290},"dependency-triage",[292],{"type":46,"value":293},"Dependency triage",{"type":41,"tag":49,"props":295,"children":296},{},[297],{"type":46,"value":298},"For each non-trivial direct dependency (especially after Steps 4–7), assign one label:",{"type":41,"tag":300,"props":301,"children":302},"table",{},[303,322],{"type":41,"tag":304,"props":305,"children":306},"thead",{},[307],{"type":41,"tag":308,"props":309,"children":310},"tr",{},[311,317],{"type":41,"tag":312,"props":313,"children":314},"th",{},[315],{"type":46,"value":316},"Label",{"type":41,"tag":312,"props":318,"children":319},{},[320],{"type":46,"value":321},"Meaning",{"type":41,"tag":323,"props":324,"children":325},"tbody",{},[326,343,359,375,391],{"type":41,"tag":308,"props":327,"children":328},{},[329,338],{"type":41,"tag":330,"props":331,"children":332},"td",{},[333],{"type":41,"tag":55,"props":334,"children":335},{},[336],{"type":46,"value":337},"Keep",{"type":41,"tag":330,"props":339,"children":340},{},[341],{"type":46,"value":342},"Required; worthwhile transitive cost; well maintained.",{"type":41,"tag":308,"props":344,"children":345},{},[346,354],{"type":41,"tag":330,"props":347,"children":348},{},[349],{"type":41,"tag":55,"props":350,"children":351},{},[352],{"type":46,"value":353},"Replace-with-Better",{"type":41,"tag":330,"props":355,"children":356},{},[357],{"type":46,"value":358},"Required; better-maintained or safer alternative exists.",{"type":41,"tag":308,"props":360,"children":361},{},[362,370],{"type":41,"tag":330,"props":363,"children":364},{},[365],{"type":41,"tag":55,"props":366,"children":367},{},[368],{"type":46,"value":369},"Replace-with-Internal",{"type":41,"tag":330,"props":371,"children":372},{},[373],{"type":46,"value":374},"Required; external risk warrants internal implementation.",{"type":41,"tag":308,"props":376,"children":377},{},[378,386],{"type":41,"tag":330,"props":379,"children":380},{},[381],{"type":41,"tag":55,"props":382,"children":383},{},[384],{"type":46,"value":385},"Remove",{"type":41,"tag":330,"props":387,"children":388},{},[389],{"type":46,"value":390},"Can drop or inline (Step 6).",{"type":41,"tag":308,"props":392,"children":393},{},[394,402],{"type":41,"tag":330,"props":395,"children":396},{},[397],{"type":41,"tag":55,"props":398,"children":399},{},[400],{"type":46,"value":401},"Needs-user-review",{"type":41,"tag":330,"props":403,"children":404},{},[405],{"type":46,"value":406},"Ambiguous usage, policy tradeoff, or change needing human verification.",{"type":41,"tag":49,"props":408,"children":409},{},[410],{"type":41,"tag":55,"props":411,"children":412},{},[413],{"type":46,"value":414},"Replacements and new direct deps",{"type":41,"tag":179,"props":416,"children":417},{},[418,428,445,456],{"type":41,"tag":87,"props":419,"children":420},{},[421,426],{"type":41,"tag":55,"props":422,"children":423},{},[424],{"type":46,"value":425},"No new direct dependencies",{"type":46,"value":427}," (including swaps) without explicit user approval.",{"type":41,"tag":87,"props":429,"children":430},{},[431,433,437,439,443],{"type":46,"value":432},"Prefer ",{"type":41,"tag":55,"props":434,"children":435},{},[436],{"type":46,"value":385},{"type":46,"value":438}," (inline\u002Fnative APIs) over ",{"type":41,"tag":55,"props":440,"children":441},{},[442],{"type":46,"value":353},{"type":46,"value":444}," when equivalent.",{"type":41,"tag":87,"props":446,"children":447},{},[448,450,454],{"type":46,"value":449},"For ",{"type":41,"tag":55,"props":451,"children":452},{},[453],{"type":46,"value":353},{"type":46,"value":455},": state why (maintenance, security, smaller tree); prefer actively maintained, widely adopted packages from trusted maintainers.",{"type":41,"tag":87,"props":457,"children":458},{},[459,461,466],{"type":46,"value":460},"Respect repo ",{"type":41,"tag":93,"props":462,"children":464},{"className":463},[],[465],{"type":46,"value":285},{"type":46,"value":467}," \u002F Renovate gates; command-level 72h freshness is a floor, not permission to bypass stricter config.",{"type":41,"tag":75,"props":469,"children":471},{"id":470},"pnpm-supply-chain",[472],{"type":46,"value":473},"pnpm & supply-chain",{"type":41,"tag":49,"props":475,"children":476},{},[477,479,485,486,491,493,499,501,507,509,515,517,523],{"type":46,"value":478},"Confirm the repo uses pnpm: ",{"type":41,"tag":93,"props":480,"children":482},{"className":481},[],[483],{"type":46,"value":484},"pnpm-lock.yaml",{"type":46,"value":208},{"type":41,"tag":93,"props":487,"children":489},{"className":488},[],[490],{"type":46,"value":206},{"type":46,"value":492},", and\u002For ",{"type":41,"tag":93,"props":494,"children":496},{"className":495},[],[497],{"type":46,"value":498},"packageManager",{"type":46,"value":500}," \u002F ",{"type":41,"tag":93,"props":502,"children":504},{"className":503},[],[505],{"type":46,"value":506},"devEngines.packageManager.name",{"type":46,"value":508}," set to ",{"type":41,"tag":93,"props":510,"children":512},{"className":511},[],[513],{"type":46,"value":514},"pnpm",{"type":46,"value":516}," in root ",{"type":41,"tag":93,"props":518,"children":520},{"className":519},[],[521],{"type":46,"value":522},"package.json",{"type":46,"value":524},". If not on pnpm, stop — do not migrate package managers as part of cleanup.",{"type":41,"tag":49,"props":526,"children":527},{},[528,530,536],{"type":46,"value":529},"Respect repo install policy when present (e.g. ",{"type":41,"tag":93,"props":531,"children":533},{"className":532},[],[534],{"type":46,"value":535},"pnpm install --frozen-lockfile --ignore-scripts",{"type":46,"value":73},{"type":41,"tag":300,"props":538,"children":539},{},[540,556],{"type":41,"tag":304,"props":541,"children":542},{},[543],{"type":41,"tag":308,"props":544,"children":545},{},[546,551],{"type":41,"tag":312,"props":547,"children":548},{},[549],{"type":46,"value":550},"Action",{"type":41,"tag":312,"props":552,"children":553},{},[554],{"type":46,"value":555},"Command",{"type":41,"tag":323,"props":557,"children":558},{},[559,585,602,619,636,662,679],{"type":41,"tag":308,"props":560,"children":561},{},[562,567],{"type":41,"tag":330,"props":563,"children":564},{},[565],{"type":46,"value":566},"Install\u002Fupdate lockfile",{"type":41,"tag":330,"props":568,"children":569},{},[570,576,578,584],{"type":41,"tag":93,"props":571,"children":573},{"className":572},[],[574],{"type":46,"value":575},"pnpm install --ignore-scripts",{"type":46,"value":577}," (+ repo flags, e.g. ",{"type":41,"tag":93,"props":579,"children":581},{"className":580},[],[582],{"type":46,"value":583},"--frozen-lockfile",{"type":46,"value":162},{"type":41,"tag":308,"props":586,"children":587},{},[588,593],{"type":41,"tag":330,"props":589,"children":590},{},[591],{"type":46,"value":592},"Remove direct dependency",{"type":41,"tag":330,"props":594,"children":595},{},[596],{"type":41,"tag":93,"props":597,"children":599},{"className":598},[],[600],{"type":46,"value":601},"pnpm remove \u003Cpkg> --ignore-scripts",{"type":41,"tag":308,"props":603,"children":604},{},[605,610],{"type":41,"tag":330,"props":606,"children":607},{},[608],{"type":46,"value":609},"Add\u002Fupdate direct dependency",{"type":41,"tag":330,"props":611,"children":612},{},[613],{"type":41,"tag":93,"props":614,"children":616},{"className":615},[],[617],{"type":46,"value":618},"pnpm add \u003Cpkg>@\u003Cversion> --ignore-scripts",{"type":41,"tag":308,"props":620,"children":621},{},[622,627],{"type":41,"tag":330,"props":623,"children":624},{},[625],{"type":46,"value":626},"Explain dependency",{"type":41,"tag":330,"props":628,"children":629},{},[630],{"type":41,"tag":93,"props":631,"children":633},{"className":632},[],[634],{"type":46,"value":635},"pnpm why \u003Cpkg>",{"type":41,"tag":308,"props":637,"children":638},{},[639,644],{"type":41,"tag":330,"props":640,"children":641},{},[642],{"type":46,"value":643},"Dedupe lockfile",{"type":41,"tag":330,"props":645,"children":646},{},[647,653,655,660],{"type":41,"tag":93,"props":648,"children":650},{"className":649},[],[651],{"type":46,"value":652},"pnpm dedupe",{"type":46,"value":654}," (then ",{"type":41,"tag":93,"props":656,"children":658},{"className":657},[],[659],{"type":46,"value":575},{"type":46,"value":661}," if lockfile changed)",{"type":41,"tag":308,"props":663,"children":664},{},[665,670],{"type":41,"tag":330,"props":666,"children":667},{},[668],{"type":46,"value":669},"Outdated \u002F version info",{"type":41,"tag":330,"props":671,"children":672},{},[673],{"type":41,"tag":93,"props":674,"children":676},{"className":675},[],[677],{"type":46,"value":678},"pnpm outdated \u003Cpkg>",{"type":41,"tag":308,"props":680,"children":681},{},[682,687],{"type":41,"tag":330,"props":683,"children":684},{},[685],{"type":46,"value":686},"One-off tools",{"type":41,"tag":330,"props":688,"children":689},{},[690,696,698,704],{"type":41,"tag":93,"props":691,"children":693},{"className":692},[],[694],{"type":46,"value":695},"pnpm --config.ignore-scripts=true dlx \u003Cpkg>@\u003Cversion> \u003Cargs...>",{"type":46,"value":697}," (pin version; prefer ",{"type":41,"tag":93,"props":699,"children":701},{"className":700},[],[702],{"type":46,"value":703},"pnpm exec",{"type":46,"value":705}," when in lockfile)",{"type":41,"tag":49,"props":707,"children":708},{},[709,714,716,722,724,730,731,737,739,745,747,752,754,760,761,767,769,774,776,782,784,789,791,796,798,804],{"type":41,"tag":55,"props":710,"children":711},{},[712],{"type":46,"value":713},"Lifecycle scripts:",{"type":46,"value":715}," Always ",{"type":41,"tag":93,"props":717,"children":719},{"className":718},[],[720],{"type":46,"value":721},"--ignore-scripts",{"type":46,"value":723}," on ",{"type":41,"tag":93,"props":725,"children":727},{"className":726},[],[728],{"type":46,"value":729},"pnpm install",{"type":46,"value":208},{"type":41,"tag":93,"props":732,"children":734},{"className":733},[],[735],{"type":46,"value":736},"pnpm add",{"type":46,"value":738},", and ",{"type":41,"tag":93,"props":740,"children":742},{"className":741},[],[743],{"type":46,"value":744},"pnpm remove",{"type":46,"value":746}," unless the user explicitly writes ",{"type":41,"tag":55,"props":748,"children":749},{},[750],{"type":46,"value":751},"allow scripts",{"type":46,"value":753}," in the same message (state which scripts would run and the risk). For ",{"type":41,"tag":93,"props":755,"children":757},{"className":756},[],[758],{"type":46,"value":759},"pnpm dlx",{"type":46,"value":208},{"type":41,"tag":93,"props":762,"children":764},{"className":763},[],[765],{"type":46,"value":766},"dlx",{"type":46,"value":768}," does not accept ",{"type":41,"tag":93,"props":770,"children":772},{"className":771},[],[773],{"type":46,"value":721},{"type":46,"value":775}," directly — use ",{"type":41,"tag":93,"props":777,"children":779},{"className":778},[],[780],{"type":46,"value":781},"pnpm --config.ignore-scripts=true dlx",{"type":46,"value":783}," (flags after ",{"type":41,"tag":93,"props":785,"children":787},{"className":786},[],[788],{"type":46,"value":766},{"type":46,"value":790}," are forwarded to the executed binary). If a dependency legitimately needs a build script (native modules, etc.), finish without scripts, then ask whether to run a ",{"type":41,"tag":55,"props":792,"children":793},{},[794],{"type":46,"value":795},"specific",{"type":46,"value":797}," manual rebuild (e.g. ",{"type":41,"tag":93,"props":799,"children":801},{"className":800},[],[802],{"type":46,"value":803},"pnpm rebuild \u003Cpkg>",{"type":46,"value":73},{"type":41,"tag":49,"props":806,"children":807},{},[808,813,815,820,822,827,828,833,835,840,842,847,848,853],{"type":41,"tag":55,"props":809,"children":810},{},[811],{"type":46,"value":812},"Freshness check (≥ 72 hours)",{"type":46,"value":814}," — required before any command that adds or upgrades a ",{"type":41,"tag":55,"props":816,"children":817},{},[818],{"type":46,"value":819},"named package version",{"type":46,"value":821}," (",{"type":41,"tag":93,"props":823,"children":825},{"className":824},[],[826],{"type":46,"value":736},{"type":46,"value":208},{"type":41,"tag":93,"props":829,"children":831},{"className":830},[],[832],{"type":46,"value":759},{"type":46,"value":834}," with new\u002Fupgraded direct version). ",{"type":41,"tag":55,"props":836,"children":837},{},[838],{"type":46,"value":839},"Not required",{"type":46,"value":841}," for plain ",{"type":41,"tag":93,"props":843,"children":845},{"className":844},[],[846],{"type":46,"value":729},{"type":46,"value":500},{"type":41,"tag":93,"props":849,"children":851},{"className":850},[],[852],{"type":46,"value":744},{"type":46,"value":854}," with no new package argument.",{"type":41,"tag":49,"props":856,"children":857},{},[858],{"type":46,"value":859},"For each directly named package:",{"type":41,"tag":82,"props":861,"children":862},{},[863,872,899,910,935],{"type":41,"tag":87,"props":864,"children":865},{},[866],{"type":41,"tag":93,"props":867,"children":869},{"className":868},[],[870],{"type":46,"value":871},"curl -s https:\u002F\u002Fregistry.npmjs.org\u002F\u003Cpackage-name>",{"type":41,"tag":87,"props":873,"children":874},{},[875,877,883,885,891,893],{"type":46,"value":876},"Resolve version: pinned ",{"type":41,"tag":93,"props":878,"children":880},{"className":879},[],[881],{"type":46,"value":882},"pkg@1.2.3",{"type":46,"value":884}," → that version; range\u002F",{"type":41,"tag":93,"props":886,"children":888},{"className":887},[],[889],{"type":46,"value":890},"latest",{"type":46,"value":892},"\u002Funspecified → ",{"type":41,"tag":93,"props":894,"children":896},{"className":895},[],[897],{"type":46,"value":898},"dist-tags.latest",{"type":41,"tag":87,"props":900,"children":901},{},[902,904],{"type":46,"value":903},"Read ",{"type":41,"tag":93,"props":905,"children":907},{"className":906},[],[908],{"type":46,"value":909},"time[\"\u003Cversion>\"]",{"type":41,"tag":87,"props":911,"children":912},{},[913,915,920,922,927,929,934],{"type":46,"value":914},"If published ",{"type":41,"tag":55,"props":916,"children":917},{},[918],{"type":46,"value":919},"less than 72 hours ago",{"type":46,"value":921}," → ",{"type":41,"tag":55,"props":923,"children":924},{},[925],{"type":46,"value":926},"stop",{"type":46,"value":928},". Tell the user package, version, and exact age. Suggest an older known-good pin unless they write ",{"type":41,"tag":55,"props":930,"children":931},{},[932],{"type":46,"value":933},"override freshness check",{"type":46,"value":109},{"type":41,"tag":87,"props":936,"children":937},{},[938,947,949,954,956,961],{"type":41,"tag":55,"props":939,"children":940},{},[941],{"type":41,"tag":93,"props":942,"children":944},{"className":943},[],[945],{"type":46,"value":946},"@grafana\u002F*",{"type":46,"value":948}," scoped packages are ",{"type":41,"tag":55,"props":950,"children":951},{},[952],{"type":46,"value":953},"exempt",{"type":46,"value":955}," from the freshness check; ",{"type":41,"tag":93,"props":957,"children":959},{"className":958},[],[960],{"type":46,"value":721},{"type":46,"value":962}," still applies.",{"type":41,"tag":49,"props":964,"children":965},{},[966],{"type":46,"value":967},"After a failed freshness check, do not substitute a different version without user approval.",{"type":41,"tag":75,"props":969,"children":971},{"id":970},"safety-rules",[972],{"type":46,"value":973},"Safety rules",{"type":41,"tag":179,"props":975,"children":976},{},[977,982,987,999,1019,1024,1036,1047],{"type":41,"tag":87,"props":978,"children":979},{},[980],{"type":46,"value":981},"Work in small batches so lockfile diffs remain reviewable.",{"type":41,"tag":87,"props":983,"children":984},{},[985],{"type":46,"value":986},"Never trust unused-dependency tools blindly; verify imports, config files, scripts, generated code hooks, framework conventions, plugin names, CLIs, and dynamic imports.",{"type":41,"tag":87,"props":988,"children":989},{},[990,992,997],{"type":46,"value":991},"You may write scripting and parsing to verify ",{"type":41,"tag":93,"props":993,"children":995},{"className":994},[],[996],{"type":46,"value":522},{"type":46,"value":998}," and lockfile dependency accounts.",{"type":41,"tag":87,"props":1000,"children":1001},{},[1002,1004,1010,1011,1017],{"type":46,"value":1003},"Treat ",{"type":41,"tag":93,"props":1005,"children":1007},{"className":1006},[],[1008],{"type":46,"value":1009},"peerDependencies",{"type":46,"value":208},{"type":41,"tag":93,"props":1012,"children":1014},{"className":1013},[],[1015],{"type":46,"value":1016},"optionalDependencies",{"type":46,"value":1018},", package bin usage, test fixtures, and published package manifests as higher risk.",{"type":41,"tag":87,"props":1020,"children":1021},{},[1022],{"type":46,"value":1023},"Do not remove or inline dependencies used for security, parsing, crypto, Unicode, URL handling, date\u002Ftime, i18n, or platform compatibility unless the replacement is proven equivalent.",{"type":41,"tag":87,"props":1025,"children":1026},{},[1027,1029,1034],{"type":46,"value":1028},"Do not switch package managers, delete ",{"type":41,"tag":93,"props":1030,"children":1032},{"className":1031},[],[1033],{"type":46,"value":484},{"type":46,"value":1035},", or rewrite workspace structure as part of cleanup.",{"type":41,"tag":87,"props":1037,"children":1038},{},[1039,1040,1045],{"type":46,"value":1003},{"type":41,"tag":93,"props":1041,"children":1043},{"className":1042},[],[1044],{"type":46,"value":652},{"type":46,"value":1046}," as potentially behavior-changing; inspect lockfile diffs and run focused verification before keeping the result.",{"type":41,"tag":87,"props":1048,"children":1049},{},[1050,1052,1058],{"type":46,"value":1051},"Measure before and after: direct dependency count, lockfile line count or entry count, package count, and estimated ",{"type":41,"tag":93,"props":1053,"children":1055},{"className":1054},[],[1056],{"type":46,"value":1057},"node_modules",{"type":46,"value":1059}," size when available.",{"type":41,"tag":75,"props":1061,"children":1063},{"id":1062},"step-1-baseline",[1064],{"type":46,"value":1065},"Step 1: Baseline",{"type":41,"tag":49,"props":1067,"children":1068},{},[1069],{"type":46,"value":1070},"Collect:",{"type":41,"tag":179,"props":1072,"children":1073},{},[1074,1092,1155,1186,1191,1216],{"type":41,"tag":87,"props":1075,"children":1076},{},[1077,1079,1084,1086,1091],{"type":46,"value":1078},"All ",{"type":41,"tag":93,"props":1080,"children":1082},{"className":1081},[],[1083],{"type":46,"value":522},{"type":46,"value":1085}," files and workspace boundaries (",{"type":41,"tag":93,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":46,"value":206},{"type":46,"value":73},{"type":41,"tag":87,"props":1093,"children":1094},{},[1095,1100,1101,1106,1108,1113,1114,1120,1121,1127,1128,1134,1136,1141,1143,1148,1149,1154],{"type":41,"tag":93,"props":1096,"children":1098},{"className":1097},[],[1099],{"type":46,"value":484},{"type":46,"value":208},{"type":41,"tag":93,"props":1102,"children":1104},{"className":1103},[],[1105],{"type":46,"value":206},{"type":46,"value":1107}," security settings (",{"type":41,"tag":93,"props":1109,"children":1111},{"className":1110},[],[1112],{"type":46,"value":285},{"type":46,"value":208},{"type":41,"tag":93,"props":1115,"children":1117},{"className":1116},[],[1118],{"type":46,"value":1119},"strictDepBuilds",{"type":46,"value":208},{"type":41,"tag":93,"props":1122,"children":1124},{"className":1123},[],[1125],{"type":46,"value":1126},"blockExoticSubdeps",{"type":46,"value":208},{"type":41,"tag":93,"props":1129,"children":1131},{"className":1130},[],[1132],{"type":46,"value":1133},"allowBuilds",{"type":46,"value":1135},"), and install policy in ",{"type":41,"tag":93,"props":1137,"children":1139},{"className":1138},[],[1140],{"type":46,"value":214},{"type":46,"value":1142}," \u002F CI flags (e.g. ",{"type":41,"tag":93,"props":1144,"children":1146},{"className":1145},[],[1147],{"type":46,"value":583},{"type":46,"value":208},{"type":41,"tag":93,"props":1150,"children":1152},{"className":1151},[],[1153],{"type":46,"value":721},{"type":46,"value":73},{"type":41,"tag":87,"props":1156,"children":1157},{},[1158,1160,1166,1167,1173,1174,1179,1180,1185],{"type":46,"value":1159},"Direct dependency names by manifest section: ",{"type":41,"tag":93,"props":1161,"children":1163},{"className":1162},[],[1164],{"type":46,"value":1165},"dependencies",{"type":46,"value":208},{"type":41,"tag":93,"props":1168,"children":1170},{"className":1169},[],[1171],{"type":46,"value":1172},"devDependencies",{"type":46,"value":208},{"type":41,"tag":93,"props":1175,"children":1177},{"className":1176},[],[1178],{"type":46,"value":1009},{"type":46,"value":208},{"type":41,"tag":93,"props":1181,"children":1183},{"className":1182},[],[1184],{"type":46,"value":1016},{"type":46,"value":109},{"type":41,"tag":87,"props":1187,"children":1188},{},[1189],{"type":46,"value":1190},"Existing verification commands from scripts, CI, or repo docs.",{"type":41,"tag":87,"props":1192,"children":1193},{},[1194,1199,1200,1206,1208,1214],{"type":41,"tag":55,"props":1195,"children":1196},{},[1197],{"type":46,"value":1198},"CI spot-check",{"type":46,"value":821},{"type":41,"tag":93,"props":1201,"children":1203},{"className":1202},[],[1204],{"type":46,"value":1205},".github\u002Fworkflows",{"type":46,"value":1207}," or equivalent): installs should use ",{"type":41,"tag":93,"props":1209,"children":1211},{"className":1210},[],[1212],{"type":46,"value":1213},"pnpm install --frozen-lockfile",{"type":46,"value":1215}," and script blocking consistent with workspace config. Flag workflows that regenerate lockfiles on every run.",{"type":41,"tag":87,"props":1217,"children":1218},{},[1219,1224,1226,1231],{"type":41,"tag":55,"props":1220,"children":1221},{},[1222],{"type":46,"value":1223},"Renovate \u002F Dependabot",{"type":46,"value":1225}," (if present): note ",{"type":41,"tag":93,"props":1227,"children":1229},{"className":1228},[],[1230],{"type":46,"value":285},{"type":46,"value":1232}," for npm packages; do not reduce it during cleanup.",{"type":41,"tag":49,"props":1234,"children":1235},{},[1236,1238,1244,1245,1251,1253,1258,1260,1265],{"type":46,"value":1237},"Record baseline metrics: ",{"type":41,"tag":93,"props":1239,"children":1241},{"className":1240},[],[1242],{"type":46,"value":1243},"git status --short",{"type":46,"value":208},{"type":41,"tag":93,"props":1246,"children":1248},{"className":1247},[],[1249],{"type":46,"value":1250},"wc -l pnpm-lock.yaml",{"type":46,"value":1252},". If ",{"type":41,"tag":93,"props":1254,"children":1256},{"className":1255},[],[1257],{"type":46,"value":1057},{"type":46,"value":1259}," is installed, estimate footprint with platform-appropriate tools. Lockfile reductions are the primary metric — do not depend on ",{"type":41,"tag":93,"props":1261,"children":1263},{"className":1262},[],[1264],{"type":46,"value":1057},{"type":46,"value":1266}," being present.",{"type":41,"tag":75,"props":1268,"children":1270},{"id":1269},"step-2-remove-unused-direct-dependencies",[1271],{"type":46,"value":1272},"Step 2: Remove unused direct dependencies",{"type":41,"tag":49,"props":1274,"children":1275},{},[1276,1281,1283,1288,1290,1296,1297,1303,1305,1311,1313,1319,1320,1326,1328,1334,1336,1342,1343,1349,1350,1356,1358,1363],{"type":41,"tag":55,"props":1277,"children":1278},{},[1279],{"type":46,"value":1280},"Unsafe direct dependency protocols",{"type":46,"value":1282}," — scan all workspace ",{"type":41,"tag":93,"props":1284,"children":1286},{"className":1285},[],[1287],{"type":46,"value":522},{"type":46,"value":1289}," dependency sections. Flag values that are not: semver range, ",{"type":41,"tag":93,"props":1291,"children":1293},{"className":1292},[],[1294],{"type":46,"value":1295},"workspace:",{"type":46,"value":208},{"type":41,"tag":93,"props":1298,"children":1300},{"className":1299},[],[1301],{"type":46,"value":1302},"patch:",{"type":46,"value":1304},", or ",{"type":41,"tag":93,"props":1306,"children":1308},{"className":1307},[],[1309],{"type":46,"value":1310},"npm:",{"type":46,"value":1312}," alias to semver. Flag ",{"type":41,"tag":93,"props":1314,"children":1316},{"className":1315},[],[1317],{"type":46,"value":1318},"git:",{"type":46,"value":500},{"type":41,"tag":93,"props":1321,"children":1323},{"className":1322},[],[1324],{"type":46,"value":1325},"github:",{"type":46,"value":1327}," \u002F tarball URLs \u002F ",{"type":41,"tag":93,"props":1329,"children":1331},{"className":1330},[],[1332],{"type":46,"value":1333},"user\u002Frepo",{"type":46,"value":1335}," shorthand \u002F ",{"type":41,"tag":93,"props":1337,"children":1339},{"className":1338},[],[1340],{"type":46,"value":1341},"file:",{"type":46,"value":500},{"type":41,"tag":93,"props":1344,"children":1346},{"className":1345},[],[1347],{"type":46,"value":1348},"link:",{"type":46,"value":500},{"type":41,"tag":93,"props":1351,"children":1353},{"className":1352},[],[1354],{"type":46,"value":1355},"exec:",{"type":46,"value":1357}," \u002F etc. (same allow-list as ",{"type":41,"tag":93,"props":1359,"children":1361},{"className":1360},[],[1362],{"type":46,"value":98},{"type":46,"value":1364},"). Do not remove flagged entries silently; report for a separate hardening PR unless the user asked to fix them.",{"type":41,"tag":49,"props":1366,"children":1367},{},[1368,1370,1376],{"type":46,"value":1369},"Use a static analyzer as a starting point, not as proof (knip, depcheck, or repo-native tooling). Run with pinned ",{"type":41,"tag":93,"props":1371,"children":1373},{"className":1372},[],[1374],{"type":46,"value":1375},"pnpm --config.ignore-scripts=true dlx \u003Ctool>@\u003Cversion> \u003Cargs...>",{"type":46,"value":1377}," when not installed (freshness-check the pin first).",{"type":41,"tag":49,"props":1379,"children":1380},{},[1381],{"type":46,"value":1382},"For each candidate:",{"type":41,"tag":179,"props":1384,"children":1385},{},[1386,1391,1411,1416],{"type":41,"tag":87,"props":1387,"children":1388},{},[1389],{"type":46,"value":1390},"Search code, configs, package scripts, build tooling, tests, and docs for the package name and known import paths.",{"type":41,"tag":87,"props":1392,"children":1393},{},[1394,1396,1402,1404,1410],{"type":46,"value":1395},"Check whether required by a published package manifest, peer contract, plugin loader, CLI command, or dynamic ",{"type":41,"tag":93,"props":1397,"children":1399},{"className":1398},[],[1400],{"type":46,"value":1401},"require",{"type":46,"value":1403},"\u002F",{"type":41,"tag":93,"props":1405,"children":1407},{"className":1406},[],[1408],{"type":46,"value":1409},"import",{"type":46,"value":109},{"type":41,"tag":87,"props":1412,"children":1413},{},[1414],{"type":46,"value":1415},"Remove only when no real usage remains.",{"type":41,"tag":87,"props":1417,"children":1418},{},[1419,1420,1425],{"type":46,"value":167},{"type":41,"tag":93,"props":1421,"children":1423},{"className":1422},[],[1424],{"type":46,"value":575},{"type":46,"value":1426}," (+ repo flags) and focused verification.",{"type":41,"tag":49,"props":1428,"children":1429},{},[1430,1432,1437,1439,1444],{"type":46,"value":1431},"If usage is only in a script or config, consider moving between ",{"type":41,"tag":93,"props":1433,"children":1435},{"className":1434},[],[1436],{"type":46,"value":1165},{"type":46,"value":1438}," and ",{"type":41,"tag":93,"props":1440,"children":1442},{"className":1441},[],[1443],{"type":46,"value":1172},{"type":46,"value":1445}," instead of removing.",{"type":41,"tag":75,"props":1447,"children":1449},{"id":1448},"step-3-deduplicate-monorepo-direct-versions",[1450],{"type":46,"value":1451},"Step 3: Deduplicate monorepo direct versions",{"type":41,"tag":49,"props":1453,"children":1454},{},[1455],{"type":46,"value":1456},"Look for the same direct dependency declared with multiple versions\u002Franges across package manifests. Use existing policy first: exact pins, caret ranges, catalog\u002Fprotocol usage, workspace protocol, or central constraints.",{"type":41,"tag":179,"props":1458,"children":1459},{},[1460,1473,1478,1490],{"type":41,"tag":87,"props":1461,"children":1462},{},[1463,1465,1471],{"type":46,"value":1464},"Use ",{"type":41,"tag":93,"props":1466,"children":1468},{"className":1467},[],[1469],{"type":46,"value":1470},"syncpack list-mismatches",{"type":46,"value":1472}," or equivalent for discovery.",{"type":41,"tag":87,"props":1474,"children":1475},{},[1476],{"type":46,"value":1477},"Standardize direct ranges when packages can share the same compatible version.",{"type":41,"tag":87,"props":1479,"children":1480},{},[1481,1483,1489],{"type":46,"value":1482},"Prefer manifest-level consistency before adding ",{"type":41,"tag":93,"props":1484,"children":1486},{"className":1485},[],[1487],{"type":46,"value":1488},"pnpm.overrides",{"type":46,"value":109},{"type":41,"tag":87,"props":1491,"children":1492},{},[1493,1494,1499],{"type":46,"value":1464},{"type":41,"tag":93,"props":1495,"children":1497},{"className":1496},[],[1498],{"type":46,"value":1488},{"type":46,"value":1500}," only for transitive convergence or security fixes, and document why.",{"type":41,"tag":49,"props":1502,"children":1503},{},[1504,1506,1511,1513,1518],{"type":46,"value":1505},"After deduping, run ",{"type":41,"tag":93,"props":1507,"children":1509},{"className":1508},[],[1510],{"type":46,"value":575},{"type":46,"value":1512}," (+ repo flags) and inspect manifest and lockfile diffs. Then consider ",{"type":41,"tag":93,"props":1514,"children":1516},{"className":1515},[],[1517],{"type":46,"value":652},{"type":46,"value":1519}," — apply carefully; may change transitive resolution.",{"type":41,"tag":75,"props":1521,"children":1523},{"id":1522},"step-4-rank-transitive-lockfile-closure",[1524],{"type":46,"value":1525},"Step 4: Rank transitive lockfile closure",{"type":41,"tag":49,"props":1527,"children":1528},{},[1529],{"type":46,"value":1530},"For each important direct dependency, estimate closure: transitive lockfile entries reachable from that dependency.",{"type":41,"tag":49,"props":1532,"children":1533},{},[1534],{"type":46,"value":1535},"Report both:",{"type":41,"tag":179,"props":1537,"children":1538},{},[1539,1549],{"type":41,"tag":87,"props":1540,"children":1541},{},[1542,1547],{"type":41,"tag":55,"props":1543,"children":1544},{},[1545],{"type":46,"value":1546},"Total closure",{"type":46,"value":1548},": all packages reachable from the dependency.",{"type":41,"tag":87,"props":1550,"children":1551},{},[1552,1557],{"type":41,"tag":55,"props":1553,"children":1554},{},[1555],{"type":46,"value":1556},"Exclusive closure",{"type":46,"value":1558},": packages that disappear if this dependency is removed and are not retained by other direct dependencies.",{"type":41,"tag":49,"props":1560,"children":1561},{},[1562],{"type":46,"value":1563},"Prefer deterministic measurement:",{"type":41,"tag":82,"props":1565,"children":1566},{},[1567,1572,1577,1588,1593],{"type":41,"tag":87,"props":1568,"children":1569},{},[1570],{"type":46,"value":1571},"Save baseline lockfile metrics.",{"type":41,"tag":87,"props":1573,"children":1574},{},[1575],{"type":46,"value":1576},"Temporarily remove one direct dependency from the owning manifest.",{"type":41,"tag":87,"props":1578,"children":1579},{},[1580,1581,1586],{"type":46,"value":167},{"type":41,"tag":93,"props":1582,"children":1584},{"className":1583},[],[1585],{"type":46,"value":575},{"type":46,"value":1587}," (+ repo flags).",{"type":41,"tag":87,"props":1589,"children":1590},{},[1591],{"type":46,"value":1592},"Measure lockfile line\u002Fentry reduction and package count reduction.",{"type":41,"tag":87,"props":1594,"children":1595},{},[1596,1598,1604,1605,1610,1612,1618],{"type":46,"value":1597},"Revert the manifest ",{"type":41,"tag":1599,"props":1600,"children":1601},"em",{},[1602],{"type":46,"value":1603},"and",{"type":46,"value":200},{"type":41,"tag":93,"props":1606,"children":1608},{"className":1607},[],[1609],{"type":46,"value":484},{"type":46,"value":1611}," (e.g., ",{"type":41,"tag":93,"props":1613,"children":1615},{"className":1614},[],[1616],{"type":46,"value":1617},"git checkout -- \u003Cmanifest> pnpm-lock.yaml",{"type":46,"value":1619},") before measuring the next dependency.",{"type":41,"tag":49,"props":1621,"children":1622},{},[1623,1624,1629],{"type":46,"value":1464},{"type":41,"tag":93,"props":1625,"children":1627},{"className":1626},[],[1628],{"type":46,"value":635},{"type":46,"value":1630}," for large transitive packages. Rank by impact and risk, not just raw size.",{"type":41,"tag":75,"props":1632,"children":1634},{"id":1633},"step-5-find-low-risk-high-impact-upgrades",[1635],{"type":46,"value":1636},"Step 5: Find low-risk high-impact upgrades",{"type":41,"tag":49,"props":1638,"children":1639},{},[1640],{"type":46,"value":1641},"Use closure rankings to target direct dependencies whose newer minor\u002Fpatch versions reduce transitive dependencies.",{"type":41,"tag":49,"props":1643,"children":1644},{},[1645],{"type":46,"value":1382},{"type":41,"tag":179,"props":1647,"children":1648},{},[1649,1661,1666,1677,1688],{"type":41,"tag":87,"props":1650,"children":1651},{},[1652,1654,1660],{"type":46,"value":1653},"Check available non-major versions with ",{"type":41,"tag":93,"props":1655,"children":1657},{"className":1656},[],[1658],{"type":46,"value":1659},"pnpm outdated",{"type":46,"value":109},{"type":41,"tag":87,"props":1662,"children":1663},{},[1664],{"type":46,"value":1665},"Review changelog\u002Frelease notes for dependency tree changes.",{"type":41,"tag":87,"props":1667,"children":1668},{},[1669,1671,1676],{"type":46,"value":1670},"Freshness-check the target version, then upgrade one dependency or tight cluster at a time (",{"type":41,"tag":93,"props":1672,"children":1674},{"className":1673},[],[1675],{"type":46,"value":618},{"type":46,"value":73},{"type":41,"tag":87,"props":1678,"children":1679},{},[1680,1681,1686],{"type":46,"value":167},{"type":41,"tag":93,"props":1682,"children":1684},{"className":1683},[],[1685],{"type":46,"value":575},{"type":46,"value":1687}," (+ repo flags) and compare closure metrics.",{"type":41,"tag":87,"props":1689,"children":1690},{},[1691],{"type":46,"value":1692},"Run focused tests and relevant build\u002Ftypecheck commands.",{"type":41,"tag":49,"props":1694,"children":1695},{},[1696],{"type":46,"value":1697},"Avoid major upgrades unless the user explicitly accepts the migration risk.",{"type":41,"tag":75,"props":1699,"children":1701},{"id":1700},"step-6-inline-trivial-usage",[1702],{"type":46,"value":1703},"Step 6: Inline trivial usage",{"type":41,"tag":49,"props":1705,"children":1706},{},[1707],{"type":46,"value":1708},"Use closure rankings to find direct dependencies with small, obvious usage but large transitive cost.",{"type":41,"tag":49,"props":1710,"children":1711},{},[1712],{"type":46,"value":1713},"Inline only when all are true:",{"type":41,"tag":179,"props":1715,"children":1716},{},[1717,1722,1727,1732],{"type":41,"tag":87,"props":1718,"children":1719},{},[1720],{"type":46,"value":1721},"Usage is tiny and easy to fully characterize.",{"type":41,"tag":87,"props":1723,"children":1724},{},[1725],{"type":46,"value":1726},"Equivalent code is shorter or clearer than retaining the dependency.",{"type":41,"tag":87,"props":1728,"children":1729},{},[1730],{"type":46,"value":1731},"Behavior is covered by tests or can be covered with small characterization tests.",{"type":41,"tag":87,"props":1733,"children":1734},{},[1735],{"type":46,"value":1736},"The dependency is not solving cross-platform, security, parsing, Unicode, locale, or spec-compliance edge cases.",{"type":41,"tag":49,"props":1738,"children":1739},{},[1740],{"type":46,"value":1741},"Prefer native APIs over new replacement dependencies when the required behavior is simple.",{"type":41,"tag":75,"props":1743,"children":1745},{"id":1744},"step-7-apply-e18e-guidance",[1746],{"type":46,"value":1747},"Step 7: Apply e18e guidance",{"type":41,"tag":1749,"props":1750,"children":1755},"pre",{"className":1751,"code":1752,"language":1753,"meta":1754,"style":1754},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Pin @e18e\u002Fcli@\u003Cversion> after freshness check; disable scripts on the dlx install\npnpm --config.ignore-scripts=true dlx @e18e\u002Fcli@\u003Cversion> analyze\npnpm --config.ignore-scripts=true dlx @e18e\u002Fcli@\u003Cversion> migrate --dry-run\n","bash","",[1756],{"type":41,"tag":93,"props":1757,"children":1758},{"__ignoreMap":1754},[1759,1771,1823],{"type":41,"tag":1760,"props":1761,"children":1764},"span",{"class":1762,"line":1763},"line",1,[1765],{"type":41,"tag":1760,"props":1766,"children":1768},{"style":1767},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1769],{"type":46,"value":1770},"# Pin @e18e\u002Fcli@\u003Cversion> after freshness check; disable scripts on the dlx install\n",{"type":41,"tag":1760,"props":1772,"children":1774},{"class":1762,"line":1773},2,[1775,1780,1786,1791,1796,1802,1807,1813,1818],{"type":41,"tag":1760,"props":1776,"children":1778},{"style":1777},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1779],{"type":46,"value":514},{"type":41,"tag":1760,"props":1781,"children":1783},{"style":1782},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1784],{"type":46,"value":1785}," --config.ignore-scripts=true",{"type":41,"tag":1760,"props":1787,"children":1788},{"style":1782},[1789],{"type":46,"value":1790}," dlx",{"type":41,"tag":1760,"props":1792,"children":1793},{"style":1782},[1794],{"type":46,"value":1795}," @e18e\u002Fcli@",{"type":41,"tag":1760,"props":1797,"children":1799},{"style":1798},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1800],{"type":46,"value":1801},"\u003C",{"type":41,"tag":1760,"props":1803,"children":1804},{"style":1782},[1805],{"type":46,"value":1806},"versio",{"type":41,"tag":1760,"props":1808,"children":1810},{"style":1809},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1811],{"type":46,"value":1812},"n",{"type":41,"tag":1760,"props":1814,"children":1815},{"style":1798},[1816],{"type":46,"value":1817},">",{"type":41,"tag":1760,"props":1819,"children":1820},{"style":1782},[1821],{"type":46,"value":1822}," analyze\n",{"type":41,"tag":1760,"props":1824,"children":1826},{"class":1762,"line":1825},3,[1827,1831,1835,1839,1843,1847,1851,1855,1859,1864],{"type":41,"tag":1760,"props":1828,"children":1829},{"style":1777},[1830],{"type":46,"value":514},{"type":41,"tag":1760,"props":1832,"children":1833},{"style":1782},[1834],{"type":46,"value":1785},{"type":41,"tag":1760,"props":1836,"children":1837},{"style":1782},[1838],{"type":46,"value":1790},{"type":41,"tag":1760,"props":1840,"children":1841},{"style":1782},[1842],{"type":46,"value":1795},{"type":41,"tag":1760,"props":1844,"children":1845},{"style":1798},[1846],{"type":46,"value":1801},{"type":41,"tag":1760,"props":1848,"children":1849},{"style":1782},[1850],{"type":46,"value":1806},{"type":41,"tag":1760,"props":1852,"children":1853},{"style":1809},[1854],{"type":46,"value":1812},{"type":41,"tag":1760,"props":1856,"children":1857},{"style":1798},[1858],{"type":46,"value":1817},{"type":41,"tag":1760,"props":1860,"children":1861},{"style":1782},[1862],{"type":46,"value":1863}," migrate",{"type":41,"tag":1760,"props":1865,"children":1866},{"style":1782},[1867],{"type":46,"value":1868}," --dry-run\n",{"type":41,"tag":49,"props":1870,"children":1871},{},[1872,1874,1881,1883,1887],{"type":46,"value":1873},"Also check ",{"type":41,"tag":102,"props":1875,"children":1879},{"href":1876,"rel":1877},"https:\u002F\u002Fe18e.dev\u002Fdocs\u002Freplacements\u002F",[1878],"nofollow",[1880],{"type":46,"value":1876},{"type":46,"value":1882},". Treat recommendations as candidates, not mandates; verify bundle\u002Fruntime behavior and run tests. Map e18e swaps to ",{"type":41,"tag":55,"props":1884,"children":1885},{},[1886],{"type":46,"value":353},{"type":46,"value":1888}," only after user approval.",{"type":41,"tag":75,"props":1890,"children":1892},{"id":1891},"reporting",[1893],{"type":46,"value":1894},"Reporting",{"type":41,"tag":49,"props":1896,"children":1897},{},[1898],{"type":46,"value":1899},"Summarize outcomes with measured impact:",{"type":41,"tag":179,"props":1901,"children":1902},{},[1903,1913,1918,1923,1928,1940,1945,1950,1955],{"type":41,"tag":87,"props":1904,"children":1905},{},[1906,1911],{"type":41,"tag":93,"props":1907,"children":1909},{"className":1908},[],[1910],{"type":46,"value":98},{"type":46,"value":1912}," result (PASS\u002FFAIL summary; link fixes if FAIL).",{"type":41,"tag":87,"props":1914,"children":1915},{},[1916],{"type":46,"value":1917},"Direct dependencies removed or moved.",{"type":41,"tag":87,"props":1919,"children":1920},{},[1921],{"type":46,"value":1922},"Direct versions deduplicated.",{"type":41,"tag":87,"props":1924,"children":1925},{},[1926],{"type":46,"value":1927},"Lockfile line\u002Fentry reduction.",{"type":41,"tag":87,"props":1929,"children":1930},{},[1931,1933,1938],{"type":46,"value":1932},"Estimated package or ",{"type":41,"tag":93,"props":1934,"children":1936},{"className":1935},[],[1937],{"type":46,"value":1057},{"type":46,"value":1939}," reduction when available.",{"type":41,"tag":87,"props":1941,"children":1942},{},[1943],{"type":46,"value":1944},"High-impact candidates deferred and why (including replacements awaiting approval).",{"type":41,"tag":87,"props":1946,"children":1947},{},[1948],{"type":46,"value":1949},"Unsafe protocol \u002F CI \u002F Renovate findings from baseline (if any).",{"type":41,"tag":87,"props":1951,"children":1952},{},[1953],{"type":46,"value":1954},"Verification commands run and results.",{"type":41,"tag":87,"props":1956,"children":1957},{},[1958,1960,1965,1967,1973,1974,1979],{"type":46,"value":1959},"Supply-chain: versions freshness-checked (or exempted), ",{"type":41,"tag":93,"props":1961,"children":1963},{"className":1962},[],[1964],{"type":46,"value":721},{"type":46,"value":1966}," on all installs\u002Fadds, ",{"type":41,"tag":93,"props":1968,"children":1970},{"className":1969},[],[1971],{"type":46,"value":1972},"--config.ignore-scripts=true",{"type":46,"value":723},{"type":41,"tag":93,"props":1975,"children":1977},{"className":1976},[],[1978],{"type":46,"value":759},{"type":46,"value":109},{"type":41,"tag":49,"props":1981,"children":1982},{},[1983],{"type":46,"value":1984},"Call out risk explicitly when a removal depends on static analysis rather than runtime coverage.",{"type":41,"tag":1986,"props":1987,"children":1989},"h3",{"id":1988},"reporting-format",[1990],{"type":46,"value":1991},"Reporting format",{"type":41,"tag":49,"props":1993,"children":1994},{},[1995,1997,2002],{"type":46,"value":1996},"Use for ",{"type":41,"tag":55,"props":1998,"children":1999},{},[2000],{"type":46,"value":2001},"dependency cleanup findings only",{"type":46,"value":2003}," — not GitHub Actions workflow triage.",{"type":41,"tag":49,"props":2005,"children":2006},{},[2007],{"type":46,"value":2008},"For each finding:",{"type":41,"tag":179,"props":2010,"children":2011},{},[2012,2042,2058,2068,2078],{"type":41,"tag":87,"props":2013,"children":2014},{},[2015,2020,2022,2028,2030,2035,2037,2041],{"type":41,"tag":55,"props":2016,"children":2017},{},[2018],{"type":46,"value":2019},"Evidence",{"type":46,"value":2021},": package name and version\u002Frange; manifest path and section; supporting signal (import site, ",{"type":41,"tag":93,"props":2023,"children":2025},{"className":2024},[],[2026],{"type":46,"value":2027},"pnpm why",{"type":46,"value":2029},", knip\u002Fdepcheck hit, closure measurement, ",{"type":41,"tag":93,"props":2031,"children":2033},{"className":2032},[],[2034],{"type":46,"value":98},{"type":46,"value":2036}," row, or workflow file + step only for ",{"type":41,"tag":55,"props":2038,"children":2039},{},[2040],{"type":46,"value":71},{"type":46,"value":73},{"type":41,"tag":87,"props":2043,"children":2044},{},[2045,2050,2052,2056],{"type":41,"tag":55,"props":2046,"children":2047},{},[2048],{"type":46,"value":2049},"Decision",{"type":46,"value":2051},": one of ",{"type":41,"tag":55,"props":2053,"children":2054},{},[2055],{"type":46,"value":293},{"type":46,"value":2057}," labels.",{"type":41,"tag":87,"props":2059,"children":2060},{},[2061,2066],{"type":41,"tag":55,"props":2062,"children":2063},{},[2064],{"type":46,"value":2065},"Proposed change",{"type":46,"value":2067},": exact manifest\u002Flockfile command or edit. If not applied yet, state that explicitly.",{"type":41,"tag":87,"props":2069,"children":2070},{},[2071,2076],{"type":41,"tag":55,"props":2072,"children":2073},{},[2074],{"type":46,"value":2075},"Rationale",{"type":46,"value":2077},": footprint (exclusive\u002Ftotal closure), supply-chain, maintenance, or verification risk.",{"type":41,"tag":87,"props":2079,"children":2080},{},[2081,2086,2088,2092],{"type":41,"tag":55,"props":2082,"children":2083},{},[2084],{"type":46,"value":2085},"User review required",{"type":46,"value":2087},": tests\u002Fbuild\u002Ftypecheck to run; peer\u002Fplugin\u002FCLI consumers; published-package or dynamic-import risk; approval before ",{"type":41,"tag":55,"props":2089,"children":2090},{},[2091],{"type":46,"value":353},{"type":46,"value":2093}," or any new direct dependency.",{"type":41,"tag":49,"props":2095,"children":2096},{},[2097],{"type":46,"value":2098},"Use one block per package (or per protocol\u002FCI finding), not a single-line summary, when the finding is non-trivial.",{"type":41,"tag":2100,"props":2101,"children":2102},"style",{},[2103],{"type":46,"value":2104},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2106,"total":2298},[2107,2128,2147,2167,2182,2198,2211,2226,2243,2258,2271,2286],{"slug":2108,"name":2108,"fn":2109,"description":2110,"org":2111,"tags":2112,"stars":2125,"repoUrl":2126,"updatedAt":2127},"faro-setup-web","instrument web apps with Grafana Faro","Instruments a web app with Grafana Faro Web SDK for frontend observability. Use when setting up error tracking, Web Vitals, session monitoring, or distributed tracing in a browser app.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2113,2116,2119,2122],{"name":2114,"slug":2115,"type":15},"Distributed Tracing","distributed-tracing",{"name":2117,"slug":2118,"type":15},"Frontend","frontend",{"name":2120,"slug":2121,"type":15},"Monitoring","monitoring",{"name":2123,"slug":2124,"type":15},"Observability","observability",1103,"https:\u002F\u002Fgithub.com\u002Fgrafana\u002Ffaro-web-sdk","2026-07-12T07:43:24.63314",{"slug":2129,"name":2129,"fn":2130,"description":2131,"org":2132,"tags":2133,"stars":2144,"repoUrl":2145,"updatedAt":2146},"configuring-yesoreyeram-infinity-datasource","configure Grafana Infinity data source","Configure the Infinity data source — base URL and allowed hosts, the authentication methods (basic, bearer token, API key, digest, OAuth passthrough, OAuth 2.0 client credentials\u002FJWT, Azure, Azure Blob, AWS), TLS, custom HTTP headers, network and security settings, the custom health check, and provisioning with a config file. Use when a user asks how to set up, configure, or change settings for the Infinity data source; how to authenticate to an API; how to allow hosts; how to provision it as YAML; or how to troubleshoot connection, authentication, or health-check issues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2134,2137,2140,2143],{"name":2135,"slug":2136,"type":15},"API Development","api-development",{"name":2138,"slug":2139,"type":15},"Authentication","authentication",{"name":2141,"slug":2142,"type":15},"Configuration","configuration",{"name":9,"slug":8,"type":15},1056,"https:\u002F\u002Fgithub.com\u002Fgrafana\u002Fgrafana-infinity-datasource","2026-07-12T07:43:25.939136",{"slug":2148,"name":2148,"fn":2149,"description":2150,"org":2151,"tags":2152,"stars":2144,"repoUrl":2145,"updatedAt":2166},"querying-yesoreyeram-infinity-datasource","query data with Infinity datasource","Build queries with the Infinity data source — the query types (JSON, CSV, TSV, XML, GraphQL, HTML, UQL, GROQ, Google Sheets, Series, Transformations), the parsers (Frontend\u002Fsimple, Backend JSONata, JQ, UQL, GROQ) and which support alerting, the sources (URL, Inline, Reference, Azure Blob, Random walk), output formats (table, timeseries, logs, trace, node graph, dataframe), root selector and columns, computed columns\u002Ffilters\u002Fsummarize, pagination, and template variables. Use when a user asks how to query Infinity; how to fetch JSON\u002FCSV\u002FXML\u002FGraphQL\u002FHTML from a URL or inline; how to select rows and columns; how to transform data with UQL\u002FGROQ\u002FJSONata\u002FJQ; how to make a query work with alerting; how to paginate; or how to use variables in a query.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2153,2156,2159,2160,2163],{"name":2154,"slug":2155,"type":15},"CSV","csv",{"name":2157,"slug":2158,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":2161,"slug":2162,"type":15},"GraphQL","graphql",{"name":2164,"slug":2165,"type":15},"JSON","json","2026-07-15T05:34:05.773947",{"slug":2168,"name":2168,"fn":2169,"description":2170,"org":2171,"tags":2172,"stars":2179,"repoUrl":2180,"updatedAt":2181},"agento11y","manage Grafana Agent Observability resources","Inspects and manages Grafana Agent Observability resources via gcx: conversations, generations, evaluators, rules, scores, and templates. Use when the user wants to list or search conversations, inspect generations, manage evaluators (upsert, test, delete), set up evaluation rules, check scores, or browse evaluator templates. Trigger on phrases like \"list conversations\", \"search generations\", \"what did the agent do\", \"debug LLM conversation\", \"create evaluator\", \"set up evaluation rule\", \"test evaluator\", \"check scores\", \"evaluate generation quality\", or \"set up online evaluation\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2173,2176,2177,2178],{"name":2174,"slug":2175,"type":15},"Agents","agents",{"name":9,"slug":8,"type":15},{"name":2120,"slug":2121,"type":15},{"name":2123,"slug":2124,"type":15},430,"https:\u002F\u002Fgithub.com\u002Fgrafana\u002Fgcx","2026-07-25T05:30:40.29622",{"slug":2183,"name":2183,"fn":2184,"description":2185,"org":2186,"tags":2187,"stars":2179,"repoUrl":2180,"updatedAt":2197},"agento11y-instrument","instrument LLM apps for agent observability","Sets up and instruments a developer's own LLM app or agent to send generations and agentic workflow to Grafana Agent Observability (the Agent Observability SDKs) — greenfield setup, fixing broken instrumentation, or filling gaps in existing instrumentation. Uses gcx for the parts a static prompt can't do: `gcx login` \u002F `gcx cloud stacks` to find the stack, and `gcx agento11y agents|conversations|generations` to VERIFY that data actually lands — so it iterates (instrument → run → verify → fix) until generations arrive, not blindly. Reads the app's code, detects language\u002Fframework, classifies instrumentation state (none \u002F partial \u002F broken), then runs a fixed gap checklist whose #1 item is the silent failure no other prompt catches: the SDK emits OTel spans\u002Fmetrics but never creates a TracerProvider\u002FMeterProvider, so without them all metrics go to a no-op and are lost. Also checks agent_version (required for per-version Performance charts), set_result completeness, SYNC vs STREAM, parent_generation_ids DAG links, and workflow-step coverage. Recommends changes citing file:line and, only with explicit confirmation, applies minimal diffs that don't change app behavior. Pulls SDK reference from agento11y's llms.txt rather than restating it, and hands off to `agento11y-test-starter` once data flows. It does NOT write test suites or set up tenant evaluations, rules, or guards — offline test suites are `agento11y-test-starter`, tenant eval rules + guards are `agento11y-prod-setup`; does NOT install coding-agent telemetry plugins (that is llms.txt \"Path A\"); does NOT mint or store credentials or invent endpoints. Trigger on phrases like \"instrument my app\", \"send my agent's traces to Grafana\", \"set up AI observability for my app\", \"my generations aren't showing up\", \"why is Performance empty\", \"add Agent Observability to my code\", \"fix my instrumentation\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2188,2189,2190,2193,2196],{"name":2174,"slug":2175,"type":15},{"name":9,"slug":8,"type":15},{"name":2191,"slug":2192,"type":15},"Instrumentation","instrumentation",{"name":2194,"slug":2195,"type":15},"LLM","llm",{"name":2123,"slug":2124,"type":15},"2026-07-31T05:53:52.580237",{"slug":2199,"name":2199,"fn":2200,"description":2201,"org":2202,"tags":2203,"stars":2179,"repoUrl":2180,"updatedAt":2210},"agento11y-prod-setup","setup production evaluation for AI agents","Sets up production evaluation and guardrails for a DEPLOYED AI agent in Grafana Agent Observability, grounded in the agent's own code and its real ingested traffic. The judgment layer on top of the `agento11y` skill: it reads the agent's source (system prompt, tools, entrypoint) AND samples its live traffic via gcx, checks what evaluators\u002Frules\u002Fguards already exist, then recommends only what's missing — online eval rules (score live conversations for regressions) and guards (warn-first request-path policies that redact \u002F tool-filter and may later be promoted to deny). It drafts reviewable YAML and, only with explicit confirmation, applies via `gcx agento11y`. New guards are drafted in warn mode (safe on live traffic — warn records but never blocks). It DOES create stack-level objects — that is the point — but every write is confirmed. It never rewrites or redeploys the agent. Trigger on phrases like \"set up production evaluation\", \"my agent is in prod what should I evaluate\", \"catch quality regressions\", \"add guardrails to my agent\", \"redact PII from my agent\", \"block dangerous tools\", \"set up online evals and guards\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2204,2205,2208,2209],{"name":2174,"slug":2175,"type":15},{"name":2206,"slug":2207,"type":15},"Evals","evals",{"name":9,"slug":8,"type":15},{"name":2123,"slug":2124,"type":15},"2026-07-31T05:53:53.576347",{"slug":2212,"name":2212,"fn":2213,"description":2214,"org":2215,"tags":2216,"stars":2179,"repoUrl":2180,"updatedAt":2225},"agento11y-test-starter","build and run agent test suites","Use early in an AI-agent project — before ship, before real traffic — to build a starter test suite for the agent and run it offline. Reads the agent's own code (system prompt, tools, task), writes a labeled draft suite of test cases (happy\u002Fedge\u002Fadversarial) grounded in real lines, and recommends how to score each case (the evaluators\u002Fjudges the offline runner uses). Assesses how runnable the agent is: for an easily-invoked agent it generates a runner stub (run_experiment.py) with two holes to fill and can optionally run it (only with permission, only against the endpoint the developer configured); for agents needing a harness or full runtime it points to the existing eval infra. It runs OFFLINE and never creates tenant-level evaluators, rules, or guards — that is `agento11y-prod-setup`, for a deployed agent with real traffic. Trigger on phrases like \"how do I test my agent before shipping\", \"write test cases for my agent\", \"set up tests for my agent\", \"check my agent before prod\", \"I have no traffic yet, how do I evaluate it\", \"test my agent offline\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2217,2218,2219,2222],{"name":2174,"slug":2175,"type":15},{"name":9,"slug":8,"type":15},{"name":2220,"slug":2221,"type":15},"QA","qa",{"name":2223,"slug":2224,"type":15},"Testing","testing","2026-07-31T05:53:51.62785",{"slug":2227,"name":2227,"fn":2228,"description":2229,"org":2230,"tags":2231,"stars":2179,"repoUrl":2180,"updatedAt":2242},"create-dashboard","create Grafana dashboards with gcx","Designs and creates Grafana dashboards with gcx, using `gcx dashboards snapshot` as a visual feedback loop. Use when the user wants to create a new Grafana dashboard, add panels, variables, or annotations to an existing dashboard, design dashboard panels, variables, queries, or layout, or make a material visual redesign. Triggers on \"create dashboard\", \"new dashboard\", \"build dashboard\", \"dashboard for \u003Cservice>\", \"add panels\", \"add variable\", \"add annotation\", \"improve this dashboard\", or \"iterate on a dashboard\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2232,2235,2238,2241],{"name":2233,"slug":2234,"type":15},"Dashboards","dashboards",{"name":2236,"slug":2237,"type":15},"Data Visualization","data-visualization",{"name":2239,"slug":2240,"type":15},"Design","design",{"name":9,"slug":8,"type":15},"2026-07-25T05:30:46.289717",{"slug":2244,"name":2244,"fn":2245,"description":2246,"org":2247,"tags":2248,"stars":2179,"repoUrl":2180,"updatedAt":2257},"debug-with-grafana","investigate application issues with Grafana","Structured workflow for investigating application problems with Grafana observability data (metrics, logs, traces) via gcx. Covers live firefighting AND retrospective incident analysis: incident triage, root-cause analysis, blast-radius checks (did an incident spill into other services), verifying whether a deployment or rollout triggered an incident, finding which service, endpoint, or path owns the most errors or slow requests, checking whether retries or queue backlogs piled up, and quantifying error or latency shares over a time window. Trigger on: \"my API is returning 500 errors\", \"latency is spiking\", \"investigate why requests are failing\", \"triage the incident\", \"blast radius\", \"root cause\", \"did the rollout cause it\", \"which endpoint owns the most 5xx\", \"did retries pile up\", or any request to analyse an earlier incident window using telemetry. For authoring dashboards use create-dashboard; for dashboard inventory use manage-dashboards.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2249,2252,2253,2256],{"name":2250,"slug":2251,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":2254,"slug":2255,"type":15},"Incident Response","incident-response",{"name":2123,"slug":2124,"type":15},"2026-07-18T05:11:10.445428",{"slug":2259,"name":2259,"fn":2260,"description":2261,"org":2262,"tags":2263,"stars":2179,"repoUrl":2180,"updatedAt":2270},"diagnose-entity-graph","diagnose Grafana Entity Graph issues","Diagnose Entity Graph problems: missing entities, missing edges, disconnected clusters, or filtering issues. Use when the user reports that Entity Graph doesn't look right, services are missing, edges aren't appearing, or environments can't be filtered. Triggers for: \"entity graph is empty\", \"services missing from entity graph\", \"no edges in entity graph\", \"disconnected services\", \"can't filter entity graph\", \"entity graph not working\", \"diagnose entity graph\", \"debug knowledge graph\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2264,2265,2266,2269],{"name":2250,"slug":2251,"type":15},{"name":9,"slug":8,"type":15},{"name":2267,"slug":2268,"type":15},"Graph Analysis","graph-analysis",{"name":2123,"slug":2124,"type":15},"2026-07-25T05:30:39.380934",{"slug":2272,"name":2272,"fn":2273,"description":2274,"org":2275,"tags":2276,"stars":2179,"repoUrl":2180,"updatedAt":2285},"gcx","manage Grafana Cloud resources via gcx","Manages Grafana Cloud resources via the gcx CLI. Trigger when the user wants to inspect, create, update, delete, query, or automate any Grafana resource - dashboards, datasources, alerts, SLOs, synthetic checks, oncall, incidents, fleet, k6, knowledge graph, or adaptive telemetry.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2277,2280,2281,2282],{"name":2278,"slug":2279,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":2120,"slug":2121,"type":15},{"name":2283,"slug":2284,"type":15},"Operations","operations","2026-07-31T05:53:50.587304",{"slug":2287,"name":2287,"fn":2288,"description":2289,"org":2290,"tags":2291,"stars":2179,"repoUrl":2180,"updatedAt":2297},"gcx-demo","present gcx demo tours","Run a narrated, read-only demo tour of gcx for customer or colleague presentations. Showcases the breadth of gcx across every Grafana Cloud product area — resources, datasources, metrics, logs, traces, SLOs, alerts, synthetic monitoring, IRM, k6, fleet, and more. All commands are strictly read-only. Trigger when the user says \"demo gcx\", \"show off gcx\", \"customer demo\", \"gcx tour\", or \"\u002Fgcx-demo\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2292,2293,2294],{"name":2278,"slug":2279,"type":15},{"name":9,"slug":8,"type":15},{"name":2295,"slug":2296,"type":15},"Presentations","presentations","2026-07-25T05:30:45.282458",80,{"items":2300,"total":2403},[2301,2316,2331,2347,2360,2376,2390],{"slug":2302,"name":2302,"fn":2303,"description":2304,"org":2305,"tags":2306,"stars":24,"repoUrl":25,"updatedAt":2315},"adaptive-metrics","optimize Grafana Cloud metrics costs","Cut Grafana Cloud Metrics cost by shrinking active-series count with Adaptive Metrics aggregation rules — auto-recommendations from query history, custom exact\u002Fregex rules, label-drop config, unused-metric detection, and Alloy remote_write fallback. Use when investigating a high Mimir\u002FGrafana Cloud bill, hunting high-cardinality labels (`pod_uid`, `service_instance_id`, `version`), pre-aggregating counters\u002Fgauges, dropping unused metrics, or measuring `grafanacloud_instance_active_series` before\u002Fafter — even when the user says \"reduce cardinality\", \"too many series\", \"metrics spend\", \"active series count is exploding\", or \"drop the version label\" without naming Adaptive Metrics.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2307,2310,2311,2314],{"name":2308,"slug":2309,"type":15},"Cost Optimization","cost-optimization",{"name":9,"slug":8,"type":15},{"name":2312,"slug":2313,"type":15},"Metrics","metrics",{"name":2123,"slug":2124,"type":15},"2026-07-12T07:44:27.451068",{"slug":2317,"name":2317,"fn":2318,"description":2319,"org":2320,"tags":2321,"stars":24,"repoUrl":25,"updatedAt":2330},"admin","manage Grafana Cloud accounts and RBAC","Manage Grafana Cloud accounts — organizations, stacks, RBAC roles and assignments, SSO\u002FSAML\u002FOAuth\u002FGitHub auth, service accounts for CI\u002FCD, user invites, team membership, and API-driven provisioning. Creates stacks via the Cloud API, mints service-account tokens, applies role assignments, configures SSO providers, and provisions teams\u002Ffolders\u002Fdashboards via Terraform. Use when managing Grafana Cloud access, configuring SSO\u002FSAML\u002FOAuth, setting up service accounts for Terraform\u002FCI\u002FCD, assigning RBAC roles, inviting users, managing multiple stacks or organizations, provisioning cloud resources via API or Terraform, or auditing admin actions — even when the user says \"set up SSO\", \"create a stack\", \"make a service account\", or \"onboard a team\" without explicitly saying \"admin\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2322,2325,2328,2329],{"name":2323,"slug":2324,"type":15},"Access Control","access-control",{"name":2326,"slug":2327,"type":15},"Auth","auth",{"name":9,"slug":8,"type":15},{"name":2283,"slug":2284,"type":15},"2026-07-12T07:44:12.078436",{"slug":2332,"name":2332,"fn":2333,"description":2334,"org":2335,"tags":2336,"stars":24,"repoUrl":25,"updatedAt":2346},"admission-control","implement admission control webhooks","Use when the user asks to \"write a validator\", \"add validation\", \"implement admission control\", \"write a mutating webhook\", \"add a mutation handler\", \"validate incoming resources\", \"implement admission logic\", \"add admission webhooks\", \"write ingress validation\", or asks how to validate or mutate resources before they are persisted in a grafana-app-sdk app. Provides guidance on implementing validation and mutation admission handlers for grafana-app-sdk apps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2337,2340,2343],{"name":2338,"slug":2339,"type":15},"Architecture","architecture",{"name":2341,"slug":2342,"type":15},"Security","security",{"name":2344,"slug":2345,"type":15},"Validation","validation","2026-07-12T07:45:06.148973",{"slug":2348,"name":2348,"fn":2349,"description":2350,"org":2351,"tags":2352,"stars":24,"repoUrl":25,"updatedAt":2359},"alerting-irm","configure Grafana Alerting and Incident Management","Configure Grafana Alerting, Incident Response Management (IRM), and SLOs end-to-end — provisions Grafana-managed and data-source-managed alert rules, contact points (Slack\u002FPagerDuty\u002Femail\u002Fwebhook), notification policies with hierarchical matchers, silences, mute timings, on-call schedules and escalation chains, incident-management integrations, and SLOs with multi-window burn-rate alerts. Use when configuring alerts, debugging notification routing, setting up on-call rotations, declaring or managing incidents, defining SLOs, provisioning alerting via YAML or API, picking matchers for a notification policy, building a PagerDuty\u002FSlack webhook receiver, or troubleshooting why an alert isn't firing — even when the user says \"page me on errors\", \"alert me when X happens\", \"route this to the platform team\", or \"set up an SLO\" without naming Alerting or IRM.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2353,2356,2357,2358],{"name":2354,"slug":2355,"type":15},"Alerting","alerting",{"name":9,"slug":8,"type":15},{"name":2254,"slug":2255,"type":15},{"name":2120,"slug":2121,"type":15},"2026-07-12T07:44:02.393397",{"slug":2361,"name":2361,"fn":2362,"description":2363,"org":2364,"tags":2365,"stars":24,"repoUrl":25,"updatedAt":2375},"alloy","build unified telemetry pipelines with Grafana Alloy","Build a unified telemetry pipeline with Grafana Alloy — one OpenTelemetry-compatible binary that collects metrics, logs, traces, and profiles and ships to Grafana Cloud \u002F Prometheus \u002F Loki \u002F Tempo \u002F Pyroscope. Covers the Alloy config language (blocks, `sys.env`, component refs), `prometheus.scrape` → `remote_write`, `loki.source.file` + `loki.process` → `loki.write`, `otelcol.receiver.otlp` → `otelcol.exporter.otlp`, `pyroscope.scrape`, K8s \u002F Docker \u002F EC2 discovery, relabeling, modules (`import.file\u002Fgit\u002Fhttp`), clustering, Fleet Management `remotecfg`, the Alloy UI at `:12345`, and `alloy fmt` \u002F `alloy validate`. Use when writing a `config.alloy`, replacing Grafana Agent \u002F OTel Collector, scraping K8s pods, parsing logs, ingesting OTLP, or debugging \"Alloy isn't sending anything\" — even when the user says \"set up the agent\", \"write me a scrape config\", \"drop these logs before sending\", or \"OTel collector config\" without naming Alloy.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2366,2367,2370,2371,2372],{"name":9,"slug":8,"type":15},{"name":2368,"slug":2369,"type":15},"Logs","logs",{"name":2312,"slug":2313,"type":15},{"name":2123,"slug":2124,"type":15},{"name":2373,"slug":2374,"type":15},"OpenTelemetry","opentelemetry","2026-07-12T07:43:54.817139",{"slug":2377,"name":2377,"fn":2378,"description":2379,"org":2380,"tags":2381,"stars":24,"repoUrl":25,"updatedAt":2389},"app-observability","monitor application performance in Grafana Cloud","Get RED metrics + service maps + frontend RUM + AI\u002FLLM monitoring out of Grafana Cloud — Application Observability (`traces_spanmetrics_*` from OTel traces, p50\u002Fp95\u002Fp99 latency, exemplar-to-trace, traces-to-logs \u002F profiles), Frontend Observability with the Faro Web SDK (Core Web Vitals, session replay, `pushError`, React + router integration, `TracingInstrumentation` for browser → backend trace correlation), and AI Observability via OpenLIT (token \u002F cost \u002F latency, GPU, hallucination + toxicity evals). Use when standing up APM for a service, wiring an Alloy OTLP receiver + forwarding to Cloud, instrumenting a React frontend for RUM, debugging why service-map edges are missing, monitoring LLM cost drift, or correlating a frontend error to its backend trace — even when the user says \"set up APM\", \"show service map\", \"monitor browser perf\", \"session replay\", \"RUM SDK\", or \"watch our OpenAI bill\" without naming App \u002F Frontend \u002F AI Observability.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2382,2385,2386,2387,2388],{"name":2383,"slug":2384,"type":15},"APM","apm",{"name":2114,"slug":2115,"type":15},{"name":9,"slug":8,"type":15},{"name":2194,"slug":2195,"type":15},{"name":2123,"slug":2124,"type":15},"2026-07-12T07:44:34.500406",{"slug":2391,"name":2391,"fn":2392,"description":2393,"org":2394,"tags":2395,"stars":24,"repoUrl":25,"updatedAt":2402},"app-sdk-concepts","scaffold and configure Grafana apps","Use when starting any grafana-app-sdk work — scaffolding a Grafana app, initializing a Grafana App Platform app, picking a deployment mode (standalone operator \u002F grafana\u002Fapps \u002F frontend-only), wiring app-specific config, or onboarding to the SDK. Covers `grafana-app-sdk` CLI install, `project init` per deployment mode, project layout, the schema-centric workflow (CUE kinds → generated code → reconciler\u002Fadmission logic), and `SpecificConfig` for env-driven app configuration. Use even if the user just says \"make a new app\", \"Grafana app platform\", \"kinds and watchers\", \"operator scaffold\", or asks about `apps\u002F` inside the Grafana repo, without naming the SDK explicitly.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2396,2397,2400,2401],{"name":2338,"slug":2339,"type":15},{"name":2398,"slug":2399,"type":15},"Deployment","deployment",{"name":19,"slug":20,"type":15},{"name":9,"slug":8,"type":15},"2026-07-12T07:45:08.595757",48]