pnpm-workspace.yaml

packages:
  - "packages/*"
  - "apps/*"
  # apps/extension joins at M2; apps/backend at M3.
  # apps/cdp-spike (no package.json) is a buildless vanilla-JS harness — NOT a member.

  # Supply-chain guard: quarantine freshly published versions for 7 days (minutes).
minimumReleaseAge: 10080

# First-party org packages are exempt from the quarantine: we consume our own
# releases immediately (every published @proofoftech/breakwater version is
# younger than the 7-day window, so packages/connector could not resolve it
# at all otherwise).
minimumReleaseAgeExclude:
  - "@proofoftech/breakwater"

# Dependency build-script approvals (pnpm 11 `allowBuilds` map). esbuild is a
# trusted vitest/vite/WXT dependency that links its platform binary via an
# install script.
allowBuilds:
  # core-js-pure's postinstall is a wrapped, error-swallowed require of a
  # donation-nag script (no build, no native step); it arrives via
  # agents -> mimetext -> @babel/runtime-corejs3 (agents' unused email
  # feature) and has no functional effect if skipped.
  core-js-pure: false
  esbuild: true
  # sharp is miniflare's (wrangler / @cloudflare/vitest-pool-workers) native
  # image binding, pulled in transitively for local asset/image-resizing
  # emulation; its install script performs a real native build/link, not a
  # no-op, so denying it risks breaking wrangler dev at runtime.
  sharp: true
  # spawn-sync is a vestigial sync-spawn polyfill for Node <0.11; it no-ops on
  # Node 22+ and nothing in the WXT/Vite toolchain needs its native build.
  # Explicitly denied so pnpm 11 does not hard-fail on an undecided build script.
  spawn-sync: false
  # workerd is the actual Cloudflare Workers runtime binary that wrangler dev
  # and @cloudflare/vitest-pool-workers (apps/backend, added at M3) execute
  # Workers code inside; its postinstall fetches the platform binary and is
  # required for either tool to run at all.
  workerd: true

# WXT 0.20.27 uses the Vite 6+ hook-filter plugin API, but `vitest` (^2.1, in
# both packages/protocol and apps/extension) anchors vite 5.4.21 into the
# workspace and pnpm dedupes WXT's vite onto it -> `wxt prepare` breaks. Pin
# WXT's vite to 8.1.3 (already vetted by the quarantine for @wxt-dev/module-react).
overrides:
  wxt>vite: 8.1.3
  # @mastra/core 1.50.x aliases these legacy AI SDK packages while accepting
  # Zod 4; widen only the resolved versions' stale Zod 3-only peer ranges.
  "@ai-sdk/provider-utils@2.2.8>zod": "^3.23.8 || ^4"
  "@ai-sdk/ui-utils@1.2.11>zod": "^3.23.8 || ^4"

# Declared peer compatibility for upstream ranges that lag what we install;
# each is verified working by this repo's own suites, so the install-time
# warnings were noise. Drop an entry when the upstream range catches up.
peerDependencyRules:
  allowedVersions:
    # agents' partyserver (and wrangler's optional peer) still declare
    # workers-types ^4; v5 is the same auto-generated surface, newer date.
    "partyserver>@cloudflare/workers-types": "5"
    "wrangler>@cloudflare/workers-types": "5"