pnpm-workspace.yaml

packages:
  - apps/*
  - evals
  - infra/*
  - oxlint-plugin-t3code
  - packages/*
  - scripts

# Successor to onlyBuiltDependencies/ignoredBuiltDependencies (pnpm 11+).
# true = allowed to run build scripts; false mirrors the pnpm 10 behavior
# where anything outside onlyBuiltDependencies was silently not built.
allowBuilds:
  browser-tabs-lock: false
  bufferutil: false
  core-js: false
  # No install script since Electron 44; ensure:electron runs install.js.
  # Keep the key: pnpm fails installs that still record a removed `true`.
  electron: false
  electron-winstaller: false
  esbuild: true
  # Ships prebuilds; its host-architecture probe triggers source builds during cross-packaging.
  koffi: false
  node-pty: true
  # Ships N-API prebuilds; its install script only rebuilds from source.
  objc-js: false
  "react-native-enriched-markdown@file:apps/mobile/deps/react-native-enriched-markdown-1.2.0-t3.18-16db4c75.tgz": true
  sharp: true
  utf-8-validate: false
  workerd: false

catalog:
  "@alchemy.run/axiom": 2.0.0-beta.85
  "@alchemy.run/cloudflare": 2.0.0-beta.85
  "@effect/atom-react": 4.1.2
  "@effect/graphql-generator": 4.1.2
  "@effect/openapi-generator": 4.1.2
  "@effect/platform-bun": 4.1.2
  "@effect/platform-node": 4.1.2
  "@effect/platform-node-shared": 4.1.2
  "@effect/vitest": 4.1.2
  "@electron-webauthn/macos": 1.3.1
  "@legendapp/list": 3.7.2
  "@noble/curves": 1.9.1
  "@noble/hashes": 1.8.0
  "@pierre/diffs": 1.7.0-beta.3
  "@pierre/highlights": 0.5.0
  "@tailwindcss/node": 4.3.3
  "@tailwindcss/oxide": 4.3.3
  "@tailwindcss/vite": 4.3.3
  "@types/node": 24.12.4
  "@types/plist": 3.0.5
  "@types/react": ~19.3.0
  "@types/react-dom": ~19.3.0
  "@types/ws": 8.18.2
  alchemy: 2.0.0-beta.85
  effect: 4.1.3
  electron-webauthn: 1.3.1
  jose: 6.2.2
  lightningcss: 1.33.0
  objc-js: 1.5.0
  pele: ^1.8.0
  plist: 3.1.1
  react: 19.3.0
  react-dom: 19.3.0
  tailwindcss: 4.3.3
  tldts: 7.4.2
  undici: 8.12.4
  vite: npm:@voidzero-dev/vite-plus-core@1.4.0
  vite-plus: 1.4.0
  ws: 8.22.0
  yaml: ^2.9.0
  # Markdown pipeline: the server counts find matches with the same parser the
  # web renders with, so both must resolve to one version.
  mdast-util-directive: 3.1.0
  micromark-extension-directive: 4.0.0
  micromark-util-character: 2.1.1
  micromark-util-types: 2.0.2
  rehype-raw: 7.0.0
  rehype-sanitize: 6.0.0
  remark-breaks: 4.0.0
  remark-gfm: 4.0.1
  remark-parse: 11.0.0
  remark-rehype: 11.1.2
  unified: 11.0.5

overrides:
  # Pin every patched package, including transitive dependencies, so lockfile-free
  # release installs cannot drift past the patch. Update these with patchedDependencies.
  react-native-image-viewing: 0.2.2
  mdast-util-math: 3.0.0
  micromark-extension-llm-math: 3.1.0
  micromark: 4.0.2
  mdast-util-to-hast: 13.2.1
  alchemy: "catalog:"
  expo-audio: 58.0.11
  expo-network: 58.0.4
  "@cursor/sdk": 1.2.0
  expo-sharing: 58.0.22
  expo-widgets: 58.0.27
  "@ff-labs/fff-node": 0.11.0
  "@legendapp/list": 3.7.2
  "@pierre/diffs": 1.7.0-beta.3
  "@react-native-ai/apple": 0.12.0
  "@react-native-menu/menu": 2.0.0
  "@react-navigation/native-stack": 7.21.0
  dbus-next: 0.10.2
  node-pty: 1.2.0-beta.15
  react-native-gesture-handler: 3.5.0
  react-native-reanimated: 4.7.1
  react-native-keyboard-controller: 1.23.0
  # 6.1.1 cannot build Android: it downloads PDFium from a release asset that was never published.
  react-native-pdf-jsi: 6.1.0
  react-native-webview: 14.0.1
  react-native-svg: 15.16.1
  app-builder-lib: 26.16.1
  electron-updater: 6.8.9
  expo-modules-core: 58.0.30
  # Keep jsdom's optional peer consistent so Vite+ has one test-runner instance.
  "@exodus/bytes>@noble/hashes": "1.8.0"
  # Earlier React Navigation declarations create a circular type alias in TypeScript 7.
  # Move this with @react-navigation/native: an older core than it requires crashes
  # every native stack at launch.
  "@react-navigation/core": 7.24.0
  # The dbus-next patch drops usocket from the package, but pnpm resolves from the
  # registry manifest, so the edge has to be cut here as well.
  "dbus-next>usocket": "-"
  # The SDK always receives the user's Claude executable, so its bundled binaries are unused.
  "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-darwin-arm64": "-"
  "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-darwin-x64": "-"
  "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-linux-arm64": "-"
  "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "-"
  "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-linux-x64": "-"
  "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-linux-x64-musl": "-"
  "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-win32-arm64": "-"
  "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-win32-x64": "-"
  "@effect/atom-react": "catalog:"
  "@effect/platform-bun": "catalog:"
  "@effect/platform-node": "catalog:"
  "@effect/platform-node-shared": "catalog:"
  "@effect/vitest": "catalog:"
  "@effect/vitest>vitest": "-"
  "@expo/dom-webview": 58.0.2
  expo-constants: 58.0.15
  "expo-sharing>@expo/config-plugins": 58.0.12
  "expo-sharing>@expo/config-types": 58.0.3
  # @pierre/trees pins @pierre/theming 1.0.0, whose peer range predates @pierre/theme 2.
  "@pierre/trees>@pierre/theming": 1.0.2
  # Resolve below remark-math so Vite, Metro and Node use the same tokenizer.
  "remark-math>micromark-extension-math": npm:micromark-extension-llm-math@3.1.0
  micromark-extension-gfm-table: 2.1.1
  # Keep one copy of these native-binary packages. lightningcss ships 11 platform binaries per
  # version, and the workspaces' tailwindcss ^4 ranges drift into two 4.3.x copies of the family.
  "@tailwindcss/node": "catalog:"
  "@tailwindcss/oxide": "catalog:"
  "@tailwindcss/vite": "catalog:"
  "@types/node": "catalog:"
  effect: "catalog:"
  # OpenCode 2's protocol and schema packages hard-pin an exact Effect version as a
  # dependency, and their schemas fail to decode under a second Effect copy.
  # The `effect` override above already collapses them; these name the edge so it
  # stays pinned on its own.
  "@opencode/protocol>effect": "catalog:"
  "@opencode/schema>effect": "catalog:"
  node-abi: 4.33.0
  # react-native-worklets peers on any version, so a fresh resolve takes the newest
  # one; React Native's CLI plugin wants exactly its own. Move with react-native.
  "@react-native/metro-config": 0.88.1
  # The desktop app installs these without a lockfile when it packages them, so
  # pin the native passkey code that runs in its main process.
  "electron-webauthn>@electron-webauthn/macos": "catalog:"
  "@electron-webauthn/macos>objc-js": "catalog:"
  lightningcss: "catalog:"
  tailwindcss: "catalog:"
  # Ranges from @effect/platform-node, jsdom, unifont, Expo and libsql otherwise
  # settle on two patch releases of each major. Older majors stay as they are.
  "@types/ws@^8": "catalog:"
  "undici@^8": "catalog:"
  "ws@^8": "catalog:"
  vite: "catalog:"
  vite-plus: "catalog:"
  yaml: "catalog:"
  # @vercel/routing-utils pins exactly 6.1.0, which has a ReDoS advisory (GHSA-9wv6-86v2-598j).
  "@vercel/routing-utils>path-to-regexp": 6.3.0
  # zod 3 has a high advisory (GHSA-mrhx-c7xc-m3w5) fixed only in 4.6.6. @vercel/config only
  # builds a z.object of z.string().regex() and calls parse, which zod 4 keeps unchanged.
  "@vercel/config>zod": 4.6.7

packageExtensions:
  # Our patch makes @effect/vitest import vite-plus/test. A catalog: spec here
  # resolves through the vite-plus override above.
  "@effect/vitest@*":
    dependencies:
      vite-plus: "catalog:"

patchedDependencies:
  react-native-image-viewing@0.2.2: patches/react-native-image-viewing@0.2.2.patch
  mdast-util-math@3.0.0: patches/mdast-util-math@3.0.0.patch
  micromark-extension-llm-math@3.1.0: patches/micromark-extension-llm-math@3.1.0.patch
  micromark-extension-gfm-table@2.1.1: patches/micromark-extension-gfm-table@2.1.1.patch
  micromark@4.0.2: patches/micromark@4.0.2.patch
  mdast-util-to-hast@13.2.1: patches/mdast-util-to-hast@13.2.1.patch
  expo-audio@58.0.11: patches/expo-audio@58.0.11.patch
  expo-video@58.0.13: patches/expo-video@58.0.13.patch
  expo-network@58.0.4: patches/expo-network@58.0.4.patch
  "@effect/vitest@4.1.2": patches/@effect__vitest@4.1.2.patch
  expo-sharing@58.0.22: patches/expo-sharing@58.0.22.patch
  expo-widgets@58.0.27: patches/expo-widgets@58.0.27.patch
  # Android: an RNHostView without a scrolling descendant (an app bar's buttons) is no longer the
  # scroll target a Material bottom sheet picks, so sheet content can sit below its header.
  "@expo/ui@58.0.27": patches/@expo__ui@58.0.27.patch
  "@ff-labs/fff-node@0.11.0": patches/@ff-labs__fff-node@0.11.0.patch
  # Exports the dependency-light subpaths mobile and the web diff parser import, and makes find
  # cover folded files and collapsed context (onRevealSearchMatch).
  "@pierre/diffs@1.7.0-beta.3": patches/@pierre__diffs@1.7.0-beta.3.patch
  "@react-native-ai/apple@0.12.0": patches/@react-native-ai__apple@0.12.0.patch
  "@react-native-menu/menu@2.0.0": patches/@react-native-menu__menu@2.0.0.patch
  "@react-navigation/native-stack@7.21.0": patches/@react-navigation%2Fnative-stack@7.21.0.patch
  dbus-next@0.10.2: patches/dbus-next@0.10.2.patch
  node-pty@1.2.0-beta.15: patches/node-pty@1.2.0-beta.15.patch
  react-native-gesture-handler@3.5.0: patches/react-native-gesture-handler@3.5.0.patch
  # Screens v5 stack, split and tab screens leave at once, like legacy screens. Exiting animations
  # inside one otherwise hold its removal for a later mount, after its stack has moved on.
  react-native-reanimated@4.7.1: patches/react-native-reanimated@4.7.1.patch
  react-native-keyboard-controller@1.23.0: patches/react-native-keyboard-controller@1.23.0.patch
  # Android: a nested WebView hands a vertical drag to its scrolling parent at the page's edge.
  react-native-webview@14.0.1: patches/react-native-webview@14.0.1.patch
  # Android: a Compose host that requests layout in a mount (a new screen's app bar) is laid out
  # before that frame is drawn, instead of a frame later.
  expo-modules-core@58.0.30: patches/expo-modules-core@58.0.30.patch
  # Observe the owned host exit independently of descendants retaining its stdio.
  "@muse-code/sdk@1.4.6": patches/@muse-code__sdk@1.4.6.patch
  app-builder-lib@26.16.1: patches/app-builder-lib@26.16.1.patch
  # Electron net requests never emit "socket", so upstream's idle timeout never fires and a
  # stalled update download hangs forever.
  electron-updater@6.8.9: patches/electron-updater@6.8.9.patch
  # Local agents honor the attribution settings in the user's Cursor CLI cli-config.json.
  "@cursor/sdk@1.2.0": patches/@cursor__sdk@1.2.0.patch
  # A failed Artifacts.cached effect hangs every later caller: https://github.com/alchemy-run/alchemy/issues/2981
  alchemy@2.0.0-beta.85: patches/alchemy@2.0.0-beta.85.patch
  # Android: a marker orient other than "auto" or a number (auto-start-reverse) no longer throws.
  react-native-svg@15.16.1: patches/react-native-svg@15.16.1.patch
  # iOS: a feed following its end keeps the end through a size-only reflow in one pass.
  "@legendapp/list@3.7.2": patches/@legendapp__list@3.7.2.patch
  # Android: double-tap zoom no longer cancels itself, and taps near a link open it.
  react-native-pdf-jsi@6.1.0: patches/react-native-pdf-jsi@6.1.0.patch

# Unmet peers fail resolution, so a pin outside a dependency's peer range is
# caught when the lockfile changes instead of scrolling past as a warning.
strictPeerDependencies: true

peerDependencyRules:
  allowAny:
    - typescript
    - vite
  allowedVersions:
    vite: "*"
    # Our react-native-screens fork is a 5.x prerelease, which ">= 4.0.0" excludes.
    "@react-navigation/native-stack>react-native-screens": "*"
    # ws 7 (React Native dev tooling) only calls isValidUTF8, unchanged in v6.
    "ws@7>utf-8-validate": "6"

# pnpm 12 links agent skills that dependencies ship into .claude/skills once
# approved. We curate our own skills, so deny these to keep installs quiet.
permissions:
  "@tanstack/router-plugin":
    skills: false
  drizzle-kit:
    skills: false
  expo-sqlite:
    skills: false

# @cursor/sdk finds its platform package (sandbox helper, rg, tree-sitter) by
# walking up from the entry script for node_modules/@cursor/sdk-<platform>-<arch>.
# pnpm keeps optional deps inside the virtual store, so hoist it to the root.
publicHoistPattern:
  - "@cursor/sdk-*"

minimumReleaseAgeExclude:
  - "@legendapp/list@3.7.2"
  - "@effect/tsgo-darwin-arm64@0.67.1"
  - "@effect/tsgo-darwin-x64@0.67.1"
  - "@effect/tsgo-linux-arm64@0.67.1"
  - "@effect/tsgo-linux-arm@0.67.1"
  - "@effect/tsgo-linux-x64@0.67.1"
  - "@effect/tsgo-win32-arm64@0.67.1"
  - "@effect/tsgo-win32-x64@0.67.1"
  - "@effect/tsgo@0.67.1"
  - "@pierre/diffs@1.7.0-beta.3"
  - "@pierre/highlights@0.5.0"