# Approved Packages

Read by the PreToolUse install gate (`compliance.mjs`) — an off-table install is denied. Not model-loaded; the policy line lives in `.claude/rules/general.md`. The table changes only by explicit user decision.

| Package | Version | Use | Don't use |
| --- | --- | --- | --- |
| `react` | ^19.2.3 | UI components | — |
| `vite` | ^8.0.0 | Build tool, dev server | `webpack`, CRA |
| `tailwindcss` | ^4.3.3 | Styling | `styled-components` |
| `@nurix/components` | ^0.15.12 | The UI component library — import by subpath | `npx shadcn add`, a `components.json` scaffold |
| `@tailwindcss/vite` | ^4.3.3 | Tailwind v4 Vite plugin — 4.3.x is the vite-8 peer line; 4.1.x tops out at vite 7 | `postcss`, `tailwind.config.js` |
| `@vitejs/plugin-react-swc` | ^4.2.2 | JSX compilation | `@vitejs/plugin-react` |
| `react-router-dom` | ^7.11.0 | Routing | — |
| `@reduxjs/toolkit` | ^2.11.2 | State management | `zustand`, `jotai` |
| `react-redux` | ^9.2.0 | Redux React bindings | — |
| `axios` | ^1.13.2 | HTTP requests in browser/Node code | `fetch` in browser code — Workers and edge runtimes use native `fetch`, which is correct there |
| `@microsoft/fetch-event-source` | ^2.0.1 | SSE over POST — streaming agent output | hand-rolled `getReader()` loops, `EventSource` |
| `date-fns` | ^4.1.0 | Date formatting | `moment`, `dayjs` |
| `@dnd-kit/core` | ^6.3.1 | Drag and drop | `react-beautiful-dnd` |
| `@xyflow/react` | ^12.11.0 | Node-based flow charts | `reactflow`, `react-flow-renderer` |
| `motion` | ^12.23.26 | Animations | `react-spring` |
| `sonner` | ^2.0.7 | Toast notifications | `react-toastify` |
| `react-window` | ^2.2.3 | List virtualization | `react-virtualized` |
| `nanoid` | ^6.0.0 | ID generation | `uuid` — exempt: UUIDv5/v7 database ids per `database.md` |
| `express` | ^5.2.1 | HTTP server | `fastify`, `koa` |
| `drizzle-orm` | ^0.45.2 | Database ORM | `prisma`, `sequelize`, `typeorm` |
| `drizzle-kit` | ^0.31.10 | Schema tooling | — |
| `zod` | ^4.2.1 | Schema validation | `yup`, `joi` |
| `jose` | ^6.1.3 | JWT handling | `jsonwebtoken` |
| `microdiff` | ^1.5.0 | JSON object diffing | `deep-diff`, `just-diff` |
| `react18-json-view` | ^0.2.9 | JSON tree view | `react-json-view` |
| `@tiptap/react` | ^3.11.1 | Rich text editor | `slate`, `quill`, `draft-js` |
| `shiki` | ^4.3.1 | Syntax highlighting | `prism`, `highlight.js` |
| `lucide-react` | ^1.26.0 | Icons | `react-icons`, `heroicons` |
| `@pdfme/generator` | ^6.1.12 | PDF generation | `jspdf`, `pdfkit` |
| `cmdk` | ^1.1.1 | Command palette | `kbar`, `ninja-keys` |
| `@monaco-editor/react` | ^4.7.0 | Code editor | `codemirror`, `ace` |
| `localforage` | ^1.10.0 | Client-side storage | `idb`, `dexie` |
| `react-markdown` | ^10.1.0 | Markdown rendering | `marked`, `markdown-it` |
| `remark-gfm` | ^4.0.1 | GFM (tables, tasklists) | `remark-github`, custom |
| `fast-deep-equal` | ^3.1.3 | Deep equality checks | `lodash.isEqual` |
| `@ngneat/falso` | latest | Fake data generation | `@faker-js/faker`, `chance` |
| `pino` | ^10.1.0 | Logging | `winston` |
| `wrangler` | ^4.118.0 | Cloudflare Workers CLI — dev server, deploy | `@cloudflare/wrangler` (deprecated), `miniflare` standalone |
| `@cloudflare/containers` | ^0.3.7 | Container-backed Durable Objects — the `Container` class a DO extends, `getContainer`, `ContainerProxy` | driving a container's lifecycle by hand from a bare Durable Object |
| `mermaid` | ^11.16.0 | Diagram rendering in the browser | `mermaid` via CDN, `viz.js`, `flowchart.js` |