pnpm-workspace.yaml

# Copyright 2026 Element Creations Ltd.
#
# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
# Please see LICENSE files in the repository root for full details.
# $schema: https://www.schemastore.org/pnpm-workspace.json

packages:
  - "frontend"
  - ".github/scripts"

# Enforce the package.json `engines` field.
engineStrict: true

# Refuse to install dependencies whose trust level has dropped compared to an
# earlier release (e.g. a previously-provenanced package now publishing without
# provenance). Add specific selectors to `trustPolicyExclude` to override.
trustPolicy: no-downgrade
trustPolicyExclude:
  # @babel/core@7.29.0 still pulls in semver@6.3.1, whose earlier versions
  # had provenance attestation but this one does not.
  - "semver@6.3.1"
  # @actions/github-script bundles @actions/http-client which pulls in
  # undici@5.29.0 — older 5.x releases were published with provenance.
  - "undici@5.29.0"
  # They switched to npm staged publishing, which for some reason npm flags
  # from being a release with a trusted publisher (GH actions) and provenance
  # to one with only provenance.
  - "tinyexec@1.2.2"

# Force a single copy of @radix-ui/react-dialog across the tree: vaul resolves
# its own (older) copy otherwise, and mixing two copies breaks React context
# between the app's Dialog.Trigger and vaul's Drawer.Root ("DialogTrigger must
# be used within Dialog" on mobile). Keep in sync with frontend/package.json.
overrides:
  "@radix-ui/react-dialog": ^1.1.18

# Fail the install if any dependency has a build script that isn't explicitly
# allowed. Add entries to `allowBuilds` (package name pattern -> bool) to
# permit specific packages to run their install/build scripts.
strictDepBuilds: true
allowBuilds:
  # Native binary toolchains
  "@swc/core": true
  esbuild: true
  # MSW writes a service worker file into .storybook/public during install
  msw: true
  # Telemetry collector — opt out
  "@scarf/scarf": false
  # The @actions/github-script repo only ships sources; it has a "prepare"
  # script that runs tsc to produce dist/ when fetched directly from git.
  "@actions/github-script": true

# Fail the install if peer dependencies are missing or unsatisfied. Add
# entries under `peerDependencyRules.allowedVersions` to whitelist specific
# version mismatches.
strictPeerDependencies: true
peerDependencyRules:
  allowedVersions: {}