pnpm-workspace.yaml

allowBuilds:
  "@sentry/cli": true
  esbuild: true
  lefthook: true
  msw: true
  sharp: true

# Strict peer-dep resolution off; the dep graph has known mismatches that don't
# affect runtime.
strictPeerDependencies: false

# Pin rolldown's transitive @oxc-project/types to the mature version already in
# the lockfile. A full re-resolve floats it to 0.134.0 (published 2026-06-01,
# inside the 7-day quarantine). No-op functionally. Remove once 0.134.0 ages out.
overrides:
  "@oxc-project/types": "0.132.0"
  # react-table-devtools beta.3 pulls @tanstack/devtools 0.12 (solid-js 1.9.13)
  # while the other devtools sit on 0.11 (solid-js 1.9.12). Two Solid instances
  # crash the shared devtools shell ("multiple instances of Solid"). Pin to one.
  "solid-js": "1.9.13"
  # Security: force patched versions for transitive advisories (pnpm audit, plan 009).
  # All patch/minor bumps of transitive deps — no direct-dep majors.
  "shell-quote@<1.8.4": "^1.8.4"
  "undici@<6.27.0": "^6.27.0"
  "undici@>=7.0.0 <7.28.0": "^7.28.0"
  "hono@<4.12.25": "^4.12.25"
  "ws@<8.21.0": "^8.21.0"
  "@opentelemetry/core@<2.8.0": "^2.8.0"
  "qs@<6.15.2": "^6.15.2"
  "launch-editor@<2.14.1": "^2.14.1"
  # js-video-url-parser ReDoS (GHSA, transitive via @platejs/media): patched 0.5.2
  # is NOT published (latest is 0.5.1) — no fix available; deferred.
  "js-yaml@<4.1.2": "^4.1.2"

# Quarantine bypass:
#  - @tanstack/react-table & table-core: alpha.42 has a broken-on-arrival
#    infinite render loop (setOptions inside useEffect with an inline-object
#    dep). alpha.45 fixes it by calling setOptions during render instead. Once
#    v9 ships a stable release we can remove these entries.
#  - @tanstack/react-start: bumped to 1.168.x for the Hydrate + interaction/
#    never selective-hydration API used by `public-form-page.tsx` (deferred
#    branding footer + theme toggle). Removable once the version ages past
#    the 7-day window.
minimumReleaseAgeExclude:
  # glimm WebGL page-transition lib (added 2026-06-24): 0.1.4 published 2 days
  # ago, inside the 7-day window. Removable once it ages past 2026-06-29.
  - "glimm"
  - "@tanstack/react-table"
  - "@tanstack/react-table-devtools"
  - "@tanstack/table-core"
  - "@tanstack/table-devtools"
  - "@tanstack/react-start"
  - "@tanstack/react-router"
  # AI SDK 6 migration (2026-05-22) off v5.0.28 — evlog 2.17 imports
  # `gateway` from `ai`, which only exists in newer releases. Removable
  # once the published versions age past the 7-day window.
  - "ai"
  - "@ai-sdk/react"
  - "@ai-sdk/openai"
  - "@ai-sdk/google"
  - "@ai-sdk/gateway@3.0.119"
  # Re-enabling minimumReleaseAge (2026-05-27): the lockfile currently pins
  # these packages to versions published within the last 7 days (publish dates
  # 2026-05-20 .. 2026-05-22). Without excluding them, `pnpm install
  # --frozen-lockfile` fails the quarantine. Remove individual entries once
  # their pinned version ages past the 7-day window.
  #  - TanStack Start / Router 1.168.x–1.171.x bump
  - "@tanstack/react-start-client"
  - "@tanstack/react-start-rsc"
  - "@tanstack/react-start-server"
  - "@tanstack/router-core"
  - "@tanstack/router-generator"
  - "@tanstack/router-plugin"
  - "@tanstack/router-utils"
  - "@tanstack/start-client-core"
  - "@tanstack/start-plugin-core"
  - "@tanstack/start-server-core"
  - "@tanstack/start-storage-context"
  #  - Rolldown 1.0.2 + per-platform bindings (transitive via Vite/Start)
  - "rolldown"
  - "@rolldown/binding-android-arm64"
  - "@rolldown/binding-darwin-arm64"
  - "@rolldown/binding-darwin-x64"
  - "@rolldown/binding-freebsd-x64"
  - "@rolldown/binding-linux-arm-gnueabihf"
  - "@rolldown/binding-linux-arm64-gnu"
  - "@rolldown/binding-linux-arm64-musl"
  - "@rolldown/binding-linux-ppc64-gnu"
  - "@rolldown/binding-linux-s390x-gnu"
  - "@rolldown/binding-linux-x64-gnu"
  - "@rolldown/binding-linux-x64-musl"
  - "@rolldown/binding-openharmony-arm64"
  - "@rolldown/binding-wasm32-wasi"
  - "@rolldown/binding-win32-arm64-msvc"
  - "@rolldown/binding-win32-x64-msvc"
  #  - Nitro 3 beta + transitive server deps
  - "nitro"
  - "env-runner"
  - "httpxy"
  #  - cnfast (2026-06-22) replaces clsx+tailwind-merge cn impl; package is
  #    days old so every version is inside the window. Remove once it ages out.
  - "cnfast"
  #  - undici security patches (6.27.0 / 7.28.0, published 2026-06-15) needed by the
  #    plan-009 overrides; both age out 2026-06-22. Mature Node core dep — safe to
  #    pull the security fix early. Remove once aged out.
  - "undici"
  - "@ai-sdk/provider-utils@4.0.37"
  - crossws@0.4.8
  - srvx@0.11.19
  - '@typescript/typescript-aix-ppc64@7.0.2'
  - '@typescript/typescript-darwin-arm64@7.0.2'
  - '@typescript/typescript-darwin-x64@7.0.2'
  - '@typescript/typescript-freebsd-arm64@7.0.2'
  - '@typescript/typescript-freebsd-x64@7.0.2'
  - '@typescript/typescript-linux-arm64@7.0.2'
  - '@typescript/typescript-linux-arm@7.0.2'
  - '@typescript/typescript-linux-loong64@7.0.2'
  - '@typescript/typescript-linux-mips64el@7.0.2'
  - '@typescript/typescript-linux-ppc64@7.0.2'
  - '@typescript/typescript-linux-riscv64@7.0.2'
  - '@typescript/typescript-linux-s390x@7.0.2'
  - '@typescript/typescript-linux-x64@7.0.2'
  - '@typescript/typescript-netbsd-arm64@7.0.2'
  - '@typescript/typescript-netbsd-x64@7.0.2'
  - '@typescript/typescript-openbsd-arm64@7.0.2'
  - '@typescript/typescript-openbsd-x64@7.0.2'
  - '@typescript/typescript-sunos-x64@7.0.2'
  - '@typescript/typescript-win32-arm64@7.0.2'
  - '@typescript/typescript-win32-x64@7.0.2'
  - typescript@7.0.2

# 7-day supply-chain quarantine (see CLAUDE.md). Freshly published registry
# versions are held back for 10080 minutes; the explicit exclude list above
# carries the deliberate exceptions.
minimumReleaseAge: 10080

# Hoist these transitive deps to the node_modules root so direct imports keep
# resolving:
#  - @tanstack/*: the codebase imports `@tanstack/query-core` through
#    transitive resolution.
#  - use-sync-external-store: Vite's optimizeDeps.include needs the bare
#    specifier to resolve from the root (it's only a transitive dep via
#    zustand-x / @platejs/core).
publicHoistPattern:
  - "@tanstack/*"
  - "use-sync-external-store"
  # @base-ui/utils: transitively imported by @base-ui/react but not hoisted
  # by pnpm by default. Rolldown's resolver can't follow the pnpm symlink chain
  # from @vitejs/plugin-rsc's virtual client-references modules, so the bare
  # specifier must resolve from the root.
  - "@base-ui/utils"
  # @platejs/core: Vite's `resolve.dedupe` (vite.config.ts) looks at the
  # project root, so the package needs to be hoisted out of pnpm's per-pkg
  # scoped node_modules. Without this, the RSC server's vite-node module
  # graph fails to resolve "platejs"'s internal `require('@platejs/core')`
  # and the whole `public-form-view-rsc.impl.tsx` module evaluates with
  # `undefined` exports, surfacing as
  #   "runPublicFormViewRSC is not a function".
  - "@platejs/core"
  # jotai: deduped from the project root by vite.config.ts. Without root
  # hoisting, Rollup's production build can't resolve `jotai` from
  # @platejs/core's nested node_modules and fails with
  #   [vite]: Rollup failed to resolve import "jotai" from "@platejs/core".
  - "jotai"
  # @vercel/oidc: externalised in vite.config.ts `ssr.external` because Vite
  # 7's module runner can't evaluate its CJS files in dev. Externalising a
  # transitive dep only works if it's resolvable from the project root —
  # which pnpm normally hides under `.pnpm/`. Hoist it so Rollup's prod
  # build can find it as `import "@vercel/oidc"`.
  - "@vercel/oidc"