pnpm-workspace.yaml

packages:
  - contracts/**
  - contract-integrity-verifier/**
  - e2e/**
  - postman/**
  - operations/**
  - ts-libs/**
  - '!contracts/lib/**'

allowBuilds:
  '@arbitrum/nitro-contracts': false
  '@parcel/watcher': false
  '@prisma/engines': false
  better-sqlite3: false
  bigint-buffer: false
  bufferutil: false
  c-kzg: true
  es5-ext: false
  esbuild: false
  keccak: false
  koffi: false
  prisma: false
  secp256k1: false
  sharp: false
  tiny-secp256k1: false
  unrs-resolver: false
  utf-8-validate: false
  web3: false
  web3-bzz: false
  web3-shh: false
  yarn: false

catalog:
  '@jest/globals': 30.4.1
  '@typechain/ethers-v6': 0.5.1
  '@types/jest': 30.0.0
  '@types/yargs': 17.0.35
  axios: 1.18.1
  dotenv: 17.4.2
  eslint: 9.39.4
  ethers: 6.17.0
  express: 5.2.1
  jest: 30.4.2
  jest-environment-node: 30.4.1
  jest-mock-extended: 4.0.1
  neverthrow: 8.2.0
  prettier: 3.8.4
  prom-client: 15.1.3
  ts-jest: 29.4.11
  tsup: 8.5.1
  tsx: 4.22.4
  typechain: 8.3.2
  typescript: 5.9.3
  viem: 2.53.1
  winston: 3.19.0
  yargs: 18.0.0
  zod: 4.4.3

ignoredBuiltDependencies:
  - '@arbitrum/nitro-contracts'
  - '@parcel/watcher'
  - '@prisma/engines'
  - better-sqlite3
  - bigint-buffer
  - bufferutil
  - es5-ext
  - esbuild
  - keccak
  - koffi
  - prisma
  - secp256k1
  - sharp
  - tiny-secp256k1
  - unrs-resolver
  - utf-8-validate
  - web3
  - web3-bzz
  - web3-shh
  - yarn

minimumReleaseAge: 4320

onlyBuiltDependencies:
  # Required by contracts/ blob tests; additions to this allowlist need security review.
  - c-kzg

overrides:
  '@babel/core@7.29.0': '7.29.7'
  '@babel/plugin-transform-modules-systemjs@>=7.12.0 <=7.29.3': '7.29.4'
  '@hono/node-server@<1.19.13': '1.19.13'
  '@istanbuljs/load-nyc-config>js-yaml': '4.2.0'
  '@openzeppelin/contracts-upgradeable@<4.9.6': '4.9.6'
  '@openzeppelin/contracts@<4.9.6': '4.9.6'
  axios@<0.30.0: ">=0.30.0"
  axios@<=0.30.2: ">=0.30.3"
  axios@>=0.8.1 <0.28.0: ">=0.28.0"
  axios@>=1.0.0 <1.16.0: '1.16.0'
  bn.js@<4.12.3: ">=4.12.3"
  brace-expansion@<1.1.13: '1.1.13'
  brace-expansion@>=2.0.0 <2.0.3: '2.0.3'
  brace-expansion@>=4.0.0 <5.0.6: '5.0.6'
  cookie@<0.7.0: ">=0.7.0"
  cosmiconfig@5.2.1>js-yaml: '4.2.0'
  effect@<3.20.0: ">=3.20.0"
  elliptic@<6.5.6: ">=6.5.6"
  elliptic@<6.6.0: ">=6.6.0"
  elliptic@<=6.6.0: ">=6.6.1"
  elliptic@>=2.0.0 <=6.5.6: ">=6.5.7"
  elliptic@>=4.0.0 <=6.5.6: ">=6.5.7"
  elliptic@>=5.2.1 <=6.5.6: ">=6.5.7"
  esbuild@<=0.24.2: ">=0.25.0"
  esbuild@>=0.17.0 <0.28.1: '0.28.1'
  eslint: "9.39.4"
  expect@>=30.0.0 <30.4.1: '30.4.1'
  fast-uri@<3.1.2: '3.1.2'
  fast-xml-parser@>=4.0.0-beta.3 <5.7.0: ">=5.7.0"
  follow-redirects@<=1.15.11: '1.16.0'
  form-data@>=4.0.0 <4.0.6: '4.0.6'
  glob@>=10.2.0 <10.5.0: ">=10.5.0"
  handlebars@>=4.0.0 <4.7.9: '4.7.9'
  hono@<4.12.25: '4.12.25'
  joi@<17.13.4: '17.13.4'
  js-cookie@<3.0.7: '3.0.7'
  js-yaml@4.1.1: '4.2.0'
  lodash@<=4.17.23: '4.18.1'
  lodash@>=4.0.0 <=4.17.22: ">=4.17.23"
  lodash@>=4.0.0 <=4.17.23: '4.18.1'
  path-to-regexp@>=8.0.0 <8.4.0: '8.4.2'
  picomatch@<2.3.2: '2.3.2'
  picomatch@>=4.0.0 <4.0.4: '4.0.4'
  postcss@<8.5.14: '8.5.14'
  qs@>=6.11.1 <=6.15.1: '6.15.2'
  read-yaml-file@1.1.0>js-yaml: '4.2.0'
  sc-istanbul>js-yaml: '4.2.0'
  serialize-javascript@<7.0.5: '7.0.5'
  shell-quote@>=1.1.0 <=1.8.3: '1.8.4'
  tar@<7.5.16: '7.5.16'
  tmp@<0.2.7: '0.2.7'
  typescript-eslint: "8.62.0"
  undici: "6.27.0"
  uuid@<11.1.1: '11.1.1'
  valibot@>=0.31.0 <1.2.0: ">=1.2.0"
  ws@>=6.0.0 <6.2.4: '6.2.4'
  ws@>=7.0.0 <7.5.11: '7.5.11'
  ws@>=8.0.0 <8.21.0: '8.21.0'
  xml2js@<0.5.0: ">=0.5.0"
  yaml@>=1.0.0 <1.10.3: '1.10.3'
  zod: "4.4.3"
patchedDependencies:
  cosmiconfig@5.2.1: patches/cosmiconfig@5.2.1.patch
  read-yaml-file@1.1.0: patches/read-yaml-file@1.1.0.patch
  sc-istanbul@0.4.6: patches/sc-istanbul@0.4.6.patch

strictDepBuilds: true
trustPolicy: no-downgrade
trustPolicyExclude:
  # Required by eslint-plugin-import and other legacy tooling pulled during Docker deploy.
  # These semver releases predate npm provenance, so pnpm flags them as trust downgrades.
  - semver@6.3.1 || 5.7.2
  # Required by eslint-plugin-import's TypeScript resolver in the operations Docker deploy path.
  # The package version has no provenance evidence, but is pinned by the existing lockfile.
  - eslint-import-resolver-typescript@3.10.1
  # Pulled via ethers -> @types/node@22.7.5 during legacy deploy resolution.
  # Excluded to keep deploy working while trustPolicy remains enabled for all other packages.
  - undici-types@6.19.8
  # Already present in the lockfile via @lidofinance/lsv-cli -> WalletConnect; lacks provenance evidence.
  - "@noble/curves@1.8.0"
  # Already present in the lockfile via @lidofinance/lsv-cli -> WalletConnect; lacks provenance evidence.
  - "@noble/hashes@1.7.0"
  # Already present in the lockfile via Hardhat/Sass tooling; lacks provenance evidence.
  - "chokidar@4.0.3"
  # Already present in the lockfile via WalletConnect logging; lacks provenance evidence.
  - "slow-redact@0.3.2"
  # Already present in the lockfile via OpenZeppelin Defender tooling; pnpm 11 flags these as trust downgrades.
  - "@openzeppelin/defender-admin-client@1.54.6"
  - "@openzeppelin/defender-base-client@1.54.6"