pnpm-workspace.yaml

packages:
  - "apps/*"
  - "packages/*"

# Supply-chain release cooldown (pnpm >=10.16): refuse to *resolve* a package
# version until it has been on the registry this many minutes, so a compromised
# release has a detection window before it can enter the lockfile. 10080 = 7
# days — a wide margin that also covers slower-detected compromises, not just
# the same-day ones. Friction is near-zero here: the catalog pins versions and
# CI installs with --frozen-lockfile, which skips re-resolution and so ignores
# this, so only manual `pnpm add` / `pnpm update` are gated (and an urgent
# hotfix can be listed under minimumReleaseAgeExclude below).
# https://pnpm.io/settings#minimumreleaseage
minimumReleaseAge: 10080
minimumReleaseAgeExclude:
  # Tracks fresh dated dev builds (see catalog pin); a new build is younger than
  # the cooldown by design, so it would otherwise block bumping. Exact versions
  # still land in the lockfile, so this exclusion widens no other attack surface.
  - "@typescript/native-preview"
  # oxc-resolver (a storybook transitive) releases several times a month and
  # co-publishes ~20 platform-binding packages minutes after the parent, so a
  # matching mature set often doesn't exist inside any 7-day window — resolving
  # the storybook subtree then fails on whichever binding is youngest. Accepted
  # tradeoff: this family skips the cooldown (it's already in the lockfile;
  # bindings are only ever pulled at the parent's exact version).
  - oxc-resolver
  - "@oxc-resolver/*"
  # First-party package (github.com/leon0399/storyproof), extracted from this
  # repo's own Storybook visual-tests addon with history and published by the
  # same maintainer. 0.0.1-alpha.1 is the pre-extraction placeholder tarball,
  # already verified runtime-identical to the workspace copy it replaces — not
  # a third party whose release needs a detection window. Remove this
  # exclusion once a version has been on the registry past the cooldown.
  - storyproof

# One shared version per dependency used by 2+ workspaces — reference with
# "catalog:" in package.json. Single edit point, no cross-package drift.
catalog:
  "@hookform/resolvers": ^5.1.1
  # `@playwright/test` and `playwright` are separate packages that MUST move
  # together: they share a `playwright-core`, and `playwright install` only
  # fetches the browser build its own version pins. A split (root on one
  # version, apps/storybook on another) leaves the browser the other half
  # needs uninstalled — Storybook's browser-mode suite then launches nothing
  # and reports zero tests. Bump both entries in the same change.
  "@playwright/test": 1.55.1
  playwright: 1.55.1
  # Node floor is 22.12 (engines/.node-version) — types match the runtime.
  "@types/node": ^22
  "@types/react": ^19
  "@types/react-dom": ^19
  "@typescript/native-preview": 7.0.0-dev.20260703.1
  "@storybook/nextjs-vite": ^10.5.0
  "@tanstack/react-query": ^5.81.5
  ai: 6.0.217
  class-variance-authority: ^0.7.1
  lucide-react: ^1.22.0
  # apps/web and apps/storybook must run the same Next (storybook compiles ui
  # stories through Next's compiler via @storybook/nextjs-vite).
  next: 16.2.10
  next-themes: ^0.4.4
  oxlint: ^1.72.0
  prettier: ^3.5.1
  react: ^19.2.0
  react-dom: ^19.2.0
  react-hook-form: ^7.59.0
  shadcn: 4.13.0
  shiki: ^3.7.0
  storybook: ^10.5.0
  tsx: ^4.20.3
  typescript: 5.7.3
  vitest: ^4.1.10
  zod: ^3.25.76

# Successor to onlyBuiltDependencies (v10.26+; the only mechanism in pnpm 11).
# Packages not listed are blocked from running install scripts. Every entry
# below is a reviewed decision; false entries match the pre-migration blocks.
allowBuilds:
  esbuild: true
  "@nestjs/core": false # postinstall is scarf telemetry only
  "@scarf/scarf": false # telemetry
  # Downloads the sentry-cli binary; only needed when a build uploads
  # sourcemaps (SENTRY_AUTH_TOKEN set) — flip to true in the deploy pipeline.
  "@sentry/cli": false
  "@swc/core": false # native bindings ship via platform optionalDependencies
  # First-party (github.com/leon0399/storyproof), consumed as a git dependency
  # until a working version is on the registry. Git-hosted installs must run
  # its prepack (tsdown build) — the repo ships source, dist/ is gitignored.
  # Git-hosted packages are approved by repository URL, not name; this form
  # covers every commit from the repo, so branch updates don't need
  # re-approval.
  # Both manifests of the same fetched repo get gated, and which one pnpm
  # names depends on the install path: a cold --frozen-lockfile install (CI)
  # evaluates the repo ROOT manifest (storyproof-monorepo, whose prepare
  # builds the addon), a warm non-frozen install evaluates the subdirectory
  # package. Exact resolved specs are the only matcher pnpm accepts for
  # git-hosted packages, so both entries move on every storyproof commit.
  "storyproof@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319#path:packages/storyproof": true
  "storyproof-monorepo@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319": true
  core-js-pure: false # funding banner
  lefthook: false # binary ships via platform optionalDependencies; prepare script syncs hooks
  sharp: false # native bindings ship via platform optionalDependencies

# Evaluated for the multi-worktree agent workflow (https://pnpm.io/git-worktrees):
# symlink-only node_modules would make per-worktree installs near-instant.
# Deliberately OFF: with it enabled, tsgo resolves packages through global-store
# realpaths outside the project and @types identities split — apps/web typecheck
# fails (children missing on ThemeProviderProps, NextError not a JSX component)
# on the identical dependency versions. Revisit when tsgo/TS handle the layout.
enableGlobalVirtualStore: false