tangle-network · drewstone · Sep 28, 2026 · Sep 28, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -23,18 +23,16 @@ jobs:
       group: npm-release-tcloud
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.tag || github.ref }}
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with:
-          version: 9.15.9
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22.23.1
+          node-version: 22.23.3
           package-manager-cache: false
           registry-url: https://registry.npmjs.org
 
@@ -224,16 +222,18 @@ jobs:
           npx --yes pnpm@11.24.0 --dir "$CONSUMER_DIR" add "$TARBALL_PATH"
 
       - name: Install release npm
-        run: npm install --global npm@12.0.1 --registry=https://registry.npmjs.org
+        run: npm install --global npm@12.1.0 --registry=https://registry.npmjs.org
 
+      # Tokenless: npm trusted publishing mints a short-lived credential from this
+      # workflow's OIDC token (id-token: write). The NPM_TOKEN secret returned E404
+      # on PUT for 0.6.0 (run 36370799261) and npm is restricting token publishes.
       - name: Publish and verify npm artifact
         env:
           TARBALL_PATH: ${{ steps.package.outputs.path }}
           EXPECTED_NAME: ${{ steps.release.outputs.name }}
           EXPECTED_VERSION: ${{ steps.release.outputs.version }}
           EXPECTED_SHA1: ${{ steps.artifact.outputs.sha1 }}
           REGISTRY: https://registry.npmjs.org
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           set -euo pipefail
 

diff --git a/.github/workflows/sdk-frozen-check.yml b/.github/workflows/sdk-frozen-check.yml
@@ -8,9 +8,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
       - name: Frozen install of all workspace importers

diff --git a/.npmrc b/.npmrc
diff --git a/package.json b/package.json
@@ -2,30 +2,15 @@
   "name": "tcloud-monorepo",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@9.15.9",
+  "packageManager": "pnpm@12.6.0",
   "description": "TypeScript SDK, CLI, agent, and relayer for Tangle AI Cloud",
   "scripts": {
     "build": "pnpm -r build",
     "test:scripts": "node --test scripts/*.test.mjs",
     "dev": "pnpm --filter tcloud dev",
     "dev:relayer": "pnpm --filter tcloud-relayer dev"
   },
-  "pnpm": {
-    "overrides": {
-      "basic-ftp": "5.3.1",
-      "brace-expansion": "5.0.9",
-      "esbuild": "0.28.2",
-      "fast-xml-parser": "5.11.1",
-      "ip-address": "10.7.0",
-      "nanoid": "3.3.18",
-      "postcss": "8.5.26",
-      "protobufjs": "7.6.1",
-      "undici": "7.29.0",
-      "vite": "8.2.2",
-      "ws": "8.21.3"
-    }
-  },
   "devDependencies": {
-    "typescript": "^5.9.3"
+    "typescript": "^7.0.2"
   }
 }
diff --git a/packages/tcloud-agent/README.md b/packages/tcloud-agent/README.md
@@ -48,13 +48,13 @@ pnpm add @tangle-network/tcloud-agent @tangle-network/tcloud
 # npm install / yarn add also work
 ```
 
-Peer dependencies (only needed for the Pi-extension entry point — skip if you're driving the agent from a server / CLI):
+Peer dependency (only needed for the Pi-extension entry point — skip if you're driving the agent from a server / CLI):
 
 ```bash
-pnpm add -D @mariozechner/pi-coding-agent @mariozechner/pi-tui
+pnpm add -D @earendil-works/pi-coding-agent
 ```
 
-Requires Node 20+.
+Requires Node 22.12+.
 
 ---
 
@@ -367,7 +367,7 @@ Build a runnable agent. Identical surface — function form is just `new Agent(.
 
 ### Subpath: `@tangle-network/tcloud-agent/pi-extension`
 
-Drop-in [Pi](https://github.com/mariozechner/pi) extension that registers the agent runner + `TangleToolProvider` into a Pi config. Peer-installable; requires `@mariozechner/pi-coding-agent` and `@mariozechner/pi-tui`.
+Drop-in [Pi](https://github.com/earendil-works/pi) extension that registers the agent runner + `TangleToolProvider` into a Pi config. Peer-installable; requires `@earendil-works/pi-coding-agent`.
 
 ```ts
 import tcloudExtension from '@tangle-network/tcloud-agent/pi-extension'
@@ -418,7 +418,7 @@ The runner owns the loop, not the runtime. The runtime is an `AgentSessionTransp
 | Budget caps | ✅ first-class | manual | manual | manual |
 | Workspace policy | transport-scoped | manual | manual | implicit |
 | Verdict shape | typed enum | string | string | string |
-| Browser-runnable | partial (Node 20+ today) | yes | ✅ | ❌ subprocess |
+| Browser-runnable | partial (Node 22.12+ today) | yes | ✅ | ❌ subprocess |
 | Tangle routing / sandbox | ✅ native | adapter | adapter | n/a |
 
 **Use `tcloud-agent` when:** you want a small, opinionated run-loop primitive over Tangle infrastructure with built-in criterion + budget gates. **Skip it when:** you only need a single chat call (use the TCloud SDK directly) or you want a full agent framework with planners / memory / tool registries (LangChain or Mastra).

diff --git a/packages/tcloud-agent/package.json b/packages/tcloud-agent/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@tangle-network/tcloud-agent",
   "version": "0.5.0",
-  "description": "Agent run-loop primitive over Tangle sandbox transports \u2014 runs an AgentProfile against a brief with criterion gates, budget caps, and streaming events. Includes TangleToolProvider for Pi tool integration.",
+  "description": "Agent run-loop primitive over Tangle sandbox transports — runs an AgentProfile against a brief with criterion gates, budget caps, and streaming events. Includes TangleToolProvider for Pi tool integration.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -33,35 +33,32 @@
     ]
   },
   "scripts": {
-    "build": "tsup src/index.ts src/pi-extension.ts --format esm --dts --clean",
+    "build": "tsdown",
     "dev": "tsx src/index.ts",
     "test": "vitest run",
     "prepublishOnly": "node ../../scripts/check-cohort-ranges.mjs && pnpm build"
   },
   "dependencies": {
     "@sinclair/typebox": "^0.34.52",
-    "@tangle-network/sandbox": ">=0.54.2 <0.55.0",
+    "@tangle-network/sandbox": ">=0.55.3 <0.56.0",
     "@tangle-network/tcloud": "workspace:^",
-    "viem": "^2.56.0"
+    "viem": "^2.56.9"
   },
   "peerDependencies": {
-    "@mariozechner/pi-coding-agent": "^0.70.0",
-    "@mariozechner/pi-tui": "^0.70.0"
+    "@earendil-works/pi-coding-agent": "^0.87.1"
   },
   "peerDependenciesMeta": {
-    "@mariozechner/pi-coding-agent": {
-      "optional": true
-    },
-    "@mariozechner/pi-tui": {
+    "@earendil-works/pi-coding-agent": {
       "optional": true
     }
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsup": "^8.5.1",
-    "tsx": "^4.23.12",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@types/node": "^26.6.3",
+    "tsdown": "^0.23.0",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.2"
   },
   "files": [
     "dist",
@@ -86,6 +83,6 @@
     "registry": "https://registry.npmjs.org/"
   },
   "engines": {
-    "node": ">=20.19.0"
+    "node": ">=22.12.0"
   }
 }
diff --git a/packages/tcloud-agent/src/pi-extension.ts b/packages/tcloud-agent/src/pi-extension.ts
@@ -18,7 +18,7 @@
  * - Spending key: ephemeral, signs x402 SpendAuth per request, rotated
  */
 
-import type { ExtensionAPI, ExtensionContext } from '@mariozechner/pi-coding-agent'
+import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent'
 import { Type } from '@sinclair/typebox'
 import { TCloudClient } from '@tangle-network/tcloud'
 import { signSpendAuth, generateWallet, type ShieldedWallet } from '@tangle-network/tcloud/shielded'

diff --git a/packages/tcloud-agent/src/pi-types.d.ts b/packages/tcloud-agent/src/pi-types.d.ts
diff --git a/packages/tcloud-agent/tests/agent-runner.test.ts b/packages/tcloud-agent/tests/agent-runner.test.ts
@@ -454,7 +454,7 @@ describe('Agent.run', () => {
   it('Sandbox SDK transport swaps the cataloged id for a turn inline profile and keeps the model transport', async () => {
     const { prompts, sandbox } = makeRecordingSandbox()
     const turnProfile = { name: 'turn', prompt: 'be brief', model: { default: 'kimi-k2' } }
-    const session = sandboxSdkTransport({
+    const session = await sandboxSdkTransport({
       sandbox: sandbox as any,
       backend: { model: { provider: 'zai', apiKey: 'k', model: 'claude-x' } } as any,
     }).start({ profile: 'sf-proposer' })
@@ -474,7 +474,7 @@ describe('Agent.run', () => {
 
   it('Sandbox SDK transport leaves a turn without an inline profile on the cataloged id', async () => {
     const { prompts, sandbox } = makeRecordingSandbox()
-    const session = sandboxSdkTransport({ sandbox: sandbox as any }).start({
+    const session = await sandboxSdkTransport({ sandbox: sandbox as any }).start({
       profile: 'sf-proposer',
     })
 

diff --git a/packages/tcloud-agent/tsconfig.json b/packages/tcloud-agent/tsconfig.json
@@ -11,10 +11,7 @@
     "resolveJsonModule": true,
     "isolatedModules": true,
     "noEmit": true,
-    "baseUrl": ".",
-    "paths": {
-      "@mariozechner/pi-coding-agent": ["src/pi-types.d.ts"]
-    }
+    "types": ["node"]
   },
   "include": ["src"]
 }
diff --git a/packages/tcloud-agent/tsdown.config.ts b/packages/tcloud-agent/tsdown.config.ts
@@ -0,0 +1,10 @@
+import { defineConfig } from 'tsdown'
+
+export default defineConfig({
+  entry: ['src/index.ts', 'src/pi-extension.ts'],
+  format: ['esm'],
+  platform: 'node',
+  dts: true,
+  clean: true,
+  fixedExtension: false,
+})
diff --git a/packages/tcloud-attestation/package.json b/packages/tcloud-attestation/package.json
@@ -19,7 +19,7 @@
     }
   },
   "scripts": {
-    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
+    "build": "tsdown",
     "prepublishOnly": "node ../../scripts/check-cohort-ranges.mjs && pnpm build",
     "test": "vitest run",
     "check-types": "tsc --noEmit"
@@ -29,10 +29,10 @@
   ],
   "license": "Apache-2.0",
   "devDependencies": {
-    "@types/node": "^22.19.15",
-    "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "@types/node": "^26.6.3",
+    "tsdown": "^0.23.0",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.2"
   },
   "engines": {
     "node": ">=18"

diff --git a/packages/tcloud-attestation/tsdown.config.ts b/packages/tcloud-attestation/tsdown.config.ts
@@ -0,0 +1,10 @@
+import { defineConfig } from 'tsdown'
+
+export default defineConfig({
+  entry: ['src/index.ts'],
+  format: ['esm', 'cjs'],
+  platform: 'node',
+  dts: true,
+  clean: true,
+  fixedExtension: false,
+})
diff --git a/packages/tcloud-relayer/package.json b/packages/tcloud-relayer/package.json
@@ -15,20 +15,20 @@
     "dist"
   ],
   "scripts": {
-    "build": "tsup src/index.ts --format esm --dts --clean",
+    "build": "tsdown",
     "prepublishOnly": "node ../../scripts/check-cohort-ranges.mjs && pnpm build",
     "dev": "tsx src/index.ts",
     "start": "node dist/index.js"
   },
   "dependencies": {
     "ethers": "^6.17.0",
-    "hono": "^4.13.5"
+    "hono": "^4.13.9"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsup": "^8.5.1",
-    "tsx": "^4.23.12",
-    "typescript": "^5.9.3"
+    "@types/node": "^26.6.3",
+    "tsdown": "^0.23.0",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2"
   },
   "license": "MIT"
 }
diff --git a/packages/tcloud-relayer/tsdown.config.ts b/packages/tcloud-relayer/tsdown.config.ts
@@ -0,0 +1,10 @@
+import { defineConfig } from 'tsdown'
+
+export default defineConfig({
+  entry: ['src/index.ts'],
+  format: ['esm'],
+  platform: 'node',
+  dts: true,
+  clean: true,
+  fixedExtension: false,
+})
diff --git a/packages/tcloud/CHANGELOG.md b/packages/tcloud/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.7.0
+
+Requires Node 22.12 or later, because commander 15 does.
+
+- Move the SDK and the Pi package to the published Sandbox 0.55 line (`>=0.55.3 <0.56.0`).
+- Update commander to 15 and viem to 2.56.9.
+- The Pi extension (tcloud-agent) now names its optional peer `@earendil-works/pi-coding-agent` 0.87, the renamed Pi package, and checks against its real types.
+- Build with tsdown and TypeScript 7. Export paths, formats and entry file names are unchanged.
+
 ## 0.6.0
 
 Requires Node 20.19 or later. GTR proof uses Node 22.