packages:
  - "packages/*" # published @platform-modules/* modules (built to dist, semver, GitHub Packages)
  - "tooling/*" # private @tooling/* shared build/test config (workspace-only, never published)
  - "apps/*" # private @app/* consumers + the consumer-harness (never published)

# Transitive-dependency security pins (CVE floor). pnpm 9 reads overrides ONLY here —
# the old package.json "pnpm.overrides" field is silently ignored, so the pins must live in this file.
overrides:
  undici: ^8.10.0
  ws: ^8.21.3
  form-data: ^4.0.6
  "@types/node": 22.20.1

# Single source of truth for shared dependency versions.
# Referenced as "catalog:" in each package.json. pnpm replaces catalog:/workspace:
# with the concrete range on publish/pack, so external consumers never see the literal.
catalog:
  "@types/node": ^22.20.1
  # Transitional split: TS7 supplies the CLI (`tsc`), while the module name
  # `typescript` stays on the TS6 compatibility API for Astro/tsdown and other
  # tooling that still needs programmatic compiler access. Remove this split
  # once the embedded-language ecosystem supports the TS7 API.
  "@typescript/native": npm:typescript@^7.0.2
  typescript: npm:@typescript/typescript6@^6.0.2
  tsdown: ^0.22.14
  vitest: ^4.1.11
  esbuild: ^0.28.2
  turbo: ^2.10.11
  "@turbo/gen": ^2.10.11
  react: ^19.0.8
  react-dom: ^19.0.8
  "@types/react": ^19.2.18
  "@types/react-dom": ^19.2.4
  "@testing-library/react": ^16.3.2
  jsdom: ^30.0.1
  zod: ^4.4.3
  zustand: ^5.0.15
  astro: ^7.2.4
  "@astrojs/react": ^6.0.4
  "@playwright/test": 1.62.1
  drizzle-orm: ^0.45.2
  "@neondatabase/serverless": ^1.1.0
  postgres: ^3.4.9
  "@electric-sql/pglite": ^0.5.5
  "@standard-schema/spec": ^1.1.0
  "@cloudflare/workers-types": ^5.20260820.1
  ioredis: ^6.0.0
  resend: ^6.20.0
  postmark: ^5.1.0
  "@aws-sdk/client-sesv2": ^3.1114.0
  "better-auth": ^1.7.1
  "@radix-ui/react-avatar": ^1.2.6
  "@radix-ui/react-checkbox": ^1.3.11
  "@radix-ui/react-dialog": ^1.1.23
  "@radix-ui/react-dropdown-menu": ^2.1.24
  "@radix-ui/react-radio-group": ^1.4.7
  "@radix-ui/react-select": ^2.3.7
  "@radix-ui/react-slot": ^1.3.3
  "@radix-ui/react-switch": ^1.3.7
  "@radix-ui/react-tabs": ^1.1.21
  "@radix-ui/react-toast": ^1.2.23
  "@radix-ui/react-tooltip": ^1.2.16
  react-day-picker: ^10.0.1
  "@tanstack/react-query": ^5.101.4
  "@tanstack/react-query-persist-client": ^5.101.4
  "@tanstack/query-sync-storage-persister": ^5.101.4
  "@tanstack/react-virtual": ^3.14.10
  web-vitals: ^6.1.1
  class-variance-authority: ^0.7.1
  tailwindcss: ^4.3.3
  "@testing-library/jest-dom": ^7.0.1
  "@stripe/stripe-js": ^9.13.0
  "@stripe/react-stripe-js": ^6.8.1
  "@cloudflare/vitest-pool-workers": ^0.22.0

allowBuilds:
  "@ast-grep/cli": true
  "@embedded-postgres/linux-x64": true
  "@google/genai": true
  esbuild: true
  lefthook: true
  protobufjs: true
  sharp: true
  workerd: true

minimumReleaseAgeExclude:
  - '@astrojs/cloudflare@14.2.3'
  - '@astrojs/internal-helpers@0.10.4'
  - '@astrojs/markdown-satteri@0.3.7'
  - '@astrojs/react@6.0.4'
  - '@aws-sdk/client-sesv2@3.1114.0'
  - '@cloudflare/workers-types@5.20260820.1'
  - '@google/genai@2.18.0'
  - astro@7.2.4
