packages:
  - packages/core/design-system
  - packages/apps/terminal
  - packages/apps/site
  - packages/apps/desktop

# This file is the ONLY place pnpm settings live. From pnpm 10 onwards .npmrc is
# read for auth and registry keys alone, so the six settings below were moved
# here out of a .npmrc that was deleted in the 9.15.0 -> 10.34.5 migration.
strictPeerDependencies: true
autoInstallPeers: false
saveExact: true
auditLevel: high
verifyStoreIntegrity: true
# fund: false — removed setting in pnpm 12; no funding behaviour is enabled here.

# pnpm self-management, disabled deliberately.
#
# pnpm 10 defaults `managePackageManagerVersions` to true. Under pnpm 9 that
# behaviour was masked by an internal `!isExecutedByCorepack()` guard, and this
# repo no longer routes pnpm through Corepack, so the guard no longer applies:
# left at its default, a pinned pnpm would silently re-exec whichever version it
# decided the checkout wanted. The bootstrap scripts and installers already
# resolve the pinned release themselves and verify `pnpm --version` against the
# pin, so pnpm managing itself on top of that can only fight them.
#
# packageManagerStrictVersion turns a version mismatch against the
# "packageManager" field in package.json into an error rather than a warning,
# which is what makes the integrity pin load-bearing instead of advisory.
# managePackageManagerVersions: false (removed since pnpm 11)
# packageManagerStrictVersion: true (removed since pnpm 11)
# Primary pnpm migration table maps strict version refusal to pmOnFail: error.
# This also prevents automatic manager download/switching on mismatch.
pmOnFail: error

# Dependency build scripts.
#
# pnpm 9 ran every dependency lifecycle script. pnpm 10 does not, unless the
# package is allowlisted here, and pnpm 11 turns an un-allowlisted build script
# into a hard ERR_PNPM_IGNORED_BUILDS failure.
#
# NOTE: this block needs pnpm >= 10.26.0. Earlier 10.x releases ignore it
# SILENTLY - the install still exits 0 while building nothing - so any pnpm 10
# pin below 10.26.0 would look green while enforcing nothing. That is the hard
# floor for the "packageManager" pin; do not lower it.
allowBuilds:
  # esbuild ships its platform binary as an optional dependency; the postinstall
  # re-validates it. Required by the terminal's vite build.
  esbuild: true
  # Copies vendor/7z-<arch>.{exe,dll} to vendor/7z.{exe,dll} for Squirrel.Windows.
  # The tarball ships only the per-arch names, so this script is the only thing
  # that produces the ones the packager opens. Required by desktop-package.
  electron-winstaller: true
  # A donation notice that already swallows its own failure. Denied explicitly
  # so pnpm 11 does not fail the install over it.
  es5-ext: false

peerDependencyRules:
  allowedVersions:
    '@glideapps/glide-data-grid>marked': '18'
    '@napi-rs/wasm-runtime>@emnapi/core': '1'
    '@napi-rs/wasm-runtime>@emnapi/runtime': '1'

# These entries are now the only copy: the duplicate "pnpm.overrides"
# block in package.json was removed in the pnpm 10 migration, so this block is
# what pnpm actually resolves against. Nothing cross-checks it any more - the
# lockfile's own `overrides:` header is the audit trail, and an entry deleted
# here disappears from that header on the next install. An earlier revision of
# this file had drifted while package.json was still authoritative - it pinned
# hono 4.12.25, js-yaml 4.2.0 and postcss 8.5.15, and omitted eight entries
# including every brace-expansion selector. Re-check the lockfile header after
# touching anything below.
#
# brace-expansion overrides. The selectors below cover EVERY vulnerable range,
# not just the ones the tree happens to resolve today, so a future transitive
# copy cannot silently reintroduce a flaw.
# Patched releases per major line: 1.1.21 (dist-tag 1.x), 2.1.7 (2.x),
# 3.0.9 (3.x), 5.0.12 (latest).
#
# GHSA-mh99-v99m-4gvg / CVE-2026-14257 was republished on 2026-07-31 with
# per-line ranges (patched at 1.1.17 / 2.1.3 / 3.0.3 / 5.0.8). Two later HIGH
# advisories, GHSA-6j4f-fj2g-mc7p and GHSA-qhr7-859c-m2p7, patched the recursion
# depth at 1.1.19 / 2.1.5 / 3.0.7 / 5.0.10 and 1.1.20 / 2.1.6 / 3.0.8 / 5.0.11.
# Do not pin back to the first round (2.1.3 / 3.0.5 / 5.0.8) or the second
# (2.1.4 / 3.0.6 / 5.0.9): the first bounded only the `combine` accumulator,
# and the second is still inside both recursion advisories. 2.1.7 keeps
# `module.exports = expandTop`, so minimatch's `require('brace-expansion')(pattern)`
# still works.
#
# 1.x is pulled onto 2.1.7 rather than onto its own 1.x backport: 2.x keeps
# the same callable CommonJS default export that minimatch 3.x/5.x/9.x require,
# and collapsing both lines onto one release keeps a single copy in the store.
# The 4.x line has no patched release of its own - npm publishes only 4.0.0 and
# 4.0.1, both inside the advisory ranges, and there is no maintenance-v4 dist-tag.
# It is therefore mapped to 3.0.9, the newest patched release that keeps 4.x's
# API: 3.x and 4.x are both ESM-only with the same `export default expandTop`
# shape (3.x additionally accepts an options argument), and the only
# 3.0.4 -> 4.0.1 change is an internal split/join -> regex refactor.
#
# Nothing on 3.x or newer can serve minimatch 3.x/5.x/9.x, which `require()` the
# package and call the result directly: 3.x and 4.x are ESM-only, and 5.x
# replaced the callable default export with a named `expand`. That is why those
# paths stay on the 2.x line. 2.1.7 is outside every current advisory range,
# so this pin is a fix, not an allowlist.
# Verify a target exists before pinning to it: npm view brace-expansion@<version> version
overrides:
  '@hono/node-server': 2.1.4
  'body-parser@>=2.0.0 <2.3.0': 2.3.0
  'brace-expansion@<2.0.0': 2.1.7
  'brace-expansion@>=2.0.0 <2.1.7': 2.1.7
  'brace-expansion@>=3.0.0 <3.0.9': 3.0.9
  'brace-expansion@>=4.0.0 <5.0.0': 3.0.9
  'brace-expansion@>=5.0.0 <5.0.12': 5.0.12
  # GHSA-c83g-rgw3-j3cx / GHSA-73wf-gq98-2v4g (CVE-2026-73089 / CVE-2026-73088):
  # unbounded query-cache growth and normalizeStats prototype writes, patched in 4.28.7.
  # Pin the latest 4.x so Babel's helper-compilation-targets cannot keep 4.28.2.
  browserslist: 4.29.3
  esbuild: 0.28.2
  # GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf /
  # GHSA-jqff-g426-hqxp, plus the 4.1.5 host-normalization and mailto-header
  # fixes. Pin the latest 4.x so ajv cannot keep 4.1.4.
  fast-uri: 4.2.2
  hono: 4.13.13
  # isInSubnet family confusion, unbounded Address6 diagnostics, fe80::/10,
  # and NAT64 64:ff9b:1::/48. Latest 10.x, not the 10.7.1 floor.
  ip-address: 10.7.3
  # GHSA-2883-xcg3-v3hh / CVE-2026-84375: empty merge-source CPU bypass,
  # patched in 4.3.2 (and 3.15.2). The tree is already on the 4.x line.
  # Preserve the security pin for 4.x consumers; permit resolver-owned 5.x.
  'js-yaml@>=4.0.0 <5.0.0': 4.3.2
  # GHSA-jrc7-96c5-q579 / CVE-2026-85061: XSS sanitizer bypass, patched in
  # 6.4.1. Keep the source dependency on the latest 6.x line. The terminal
  # renders through the matching plotly.js-dist-min bundle, whose embedded
  # dependencies must be checked separately when upgrading Plotly.
  maplibre-gl: 6.13.0
  postcss: 8.5.29
  # GHSA-rgj7-g3m4-5g8c: inherited libheif RCEs, patched in 0.35.4.
  # Stay on the latest 0.35.x.
  sharp: 0.35.5
  # GHSA-rfgv-xxqx-mfg5 (unrequested WebSocket subprotocol DoS) and
  # GHSA-w293-vg96-wgc3 (BalancedPool TLS validation bypass) were patched in
  # 7.29.1. GHSA-xjj6-f33q-929c, GHSA-4w7w-5xrc-9h26, GHSA-2m5v-pch6-74hx and
  # GHSA-qrxm-fqhp-jwvm are patched in 6.29.1 and 7.30.1. @electron/get
  # requests ^7.24.4; node-gyp (via electron-builder) requests ^6.25.0.
  # 8.x is resolved from its parent range. jsdom requires ^8.11.2.
  'undici@>=6.0.0 <7.0.0': 6.29.1
  'undici@>=7.0.0 <8.0.0': 7.30.1
  # GHSA-mrwp-f3q8-3g9p: cross-realm sensitiveHeaders dropped on redirect,
  # patched in 1.16.2. http-proxy (via Perspective's http-server) still
  # resolves 1.16.1.
  'follow-redirects@<1.16.2': 1.16.2
  # GHSA-mrhx-c7xc-m3w5: oversized collection validation can exhaust memory,
  # patched in zod >=4.6.6. There is no patched 3.x release. Reticle's range
  # is ^3.25.0 || ^4.0.0, so the 3.25.76 copy moves onto the 4.6.7 line the
  # terminal and the site already depend on.
  'zod@<4.6.6': 4.6.7
  # Eight HIGH name-injection / ReDoS advisories on the 0.8 line that
  # electron-builder's plist@3.1.0 still requests. 0.8.15 is the patched
  # release for that line (0.9.12 is the 0.9 equivalent).
  '@xmldom/xmldom': 0.8.15
  # GHSA-4mjr-xmp4-gh2g / CVE-2026-82417 (attacker-controlled isBuffer DoS)
  # and GHSA-px8p / CVE-2026-82562 (arrayLimit bypass on []= comma groups):
  # both patched in 6.16.0. union@0.5.0 (via http-server) still requests 6.15.2.
  qs: 6.16.0
  # GHSA-x5fp / CVE-2026-45820: ZIP64 unzipSync infinite loop. Affected
  # 0.6.0-0.6.10; 0.6.11 is the 0.6-line backport (0.8.3 is already in the
  # tree via @types/three). three-stdlib still requests 0.6.10.
  'fflate@<0.6.11': 0.6.11
  # 4.3.0 fixes Vary matching, not the disputed GHSA-ch52-4w7c-c8xp report.
  # The local patch below enforces mandatory validation on every stale route;
  # being outside an advisory's version range is not evidence of a fix.
  http-cache-semantics: 4.3.0
  # GHSA-gjj5-9665-rwrc / CVE-2026-104861: quadratic SVG parse DoS, patched
  # in 7.4.0. plotly.js still requests 7.3.0.
  probe-image-size: 7.4.0
  # GHSA-p6vx-979v-rg4c (CVE-2026-104846) and GHSA-jp82-f5mq-hwhp
  # (CVE-2026-104845): promise thenable invocation and unbounded TypedArray
  # allocation. solid-js 1.9.15 still requests seroval 1.5.6. Stay on the
  # latest 1.6.x, not the minimum patched release.
  seroval: 1.6.9

# Keep the upstream tarball/integrity and BSD-2-Clause licence. Fail installation
# if this exact-version patch no longer applies. See patches/README.md.
patchedDependencies:
  http-cache-semantics@4.3.0: patches/http-cache-semantics@4.3.0.patch

# Next.js 16.4.5 is the November 2026 security release. It was published inside
# pnpm's built-in 24-hour release-age window, so a non-strict install records
# these exact versions here. Remove the list once the release is older than
# that window.
minimumReleaseAgeExclude:
  - '@next/env@16.4.5'
  - '@next/swc-darwin-arm64@16.4.5'
  - '@next/swc-darwin-x64@16.4.5'
  - '@next/swc-linux-arm64-gnu@16.4.5'
  - '@next/swc-linux-arm64-musl@16.4.5'
  - '@next/swc-linux-x64-gnu@16.4.5'
  - '@next/swc-linux-x64-musl@16.4.5'
  - '@next/swc-win32-arm64-msvc@16.4.5'
  - '@next/swc-win32-x64-msvc@16.4.5'
  - next@16.4.5