1packages:
2 - apps/*
3 - evals
4 - infra/*
5 - oxlint-plugin-t3code
6 - packages/*
7 - scripts
8
9# Successor to onlyBuiltDependencies/ignoredBuiltDependencies (pnpm 11+).
10# true = allowed to run build scripts; false mirrors the pnpm 10 behavior
11# where anything outside onlyBuiltDependencies was silently not built.
12allowBuilds:
13 browser-tabs-lock: false
14 bufferutil: false
15 core-js: false
16 # No install script since Electron 44; ensure:electron runs install.js.
17 # Keep the key: pnpm fails installs that still record a removed `true`.
18 electron: false
19 electron-winstaller: false
20 esbuild: true
21 # Ships prebuilds; its host-architecture probe triggers source builds during cross-packaging.
22 koffi: false
23 node-pty: true
24 # Ships N-API prebuilds; its install script only rebuilds from source.
25 objc-js: false
26 "react-native-enriched-markdown@file:apps/mobile/deps/react-native-enriched-markdown-1.2.0-t3.18-0dc7ed81.tgz": true
27 sharp: true
28 utf-8-validate: false
29 workerd: false
30
31catalog:
32 "@alchemy.run/axiom": 2.0.0-beta.85
33 "@alchemy.run/cloudflare": 2.0.0-beta.85
34 "@alchemy.run/drizzle": 2.0.0-beta.85
35 "@alchemy.run/planetscale": 2.0.0-beta.85
36 "@alchemy.run/test": 2.0.0-beta.85
37 "@clerk/backend": 3.27.0
38 "@clerk/clerk-js": 6.42.3
39 "@clerk/electron": 0.1.10
40 "@clerk/electron-passkeys": 0.0.3
41 "@clerk/expo": 4.15.1
42 "@clerk/react": 6.18.6
43 "@clerk/shared": 4.44.1
44 # Must match the version alchemy depends on: the relay overrides its
45 # Cloudflare retry policy through this package's Retry service.
46 "@distilled.cloud/cloudflare": 1.0.0-rc.18
47 "@effect/atom-react": 4.1.2
48 "@effect/graphql-generator": 4.1.2
49 "@effect/openapi-generator": 4.1.2
50 "@effect/platform-bun": 4.1.2
51 "@effect/platform-node": 4.1.2
52 "@effect/platform-node-shared": 4.1.2
53 "@effect/sql-pg": 4.1.2
54 "@effect/sql-sqlite-do": 4.1.2
55 "@effect/vitest": 4.1.2
56 "@electron-webauthn/macos": 1.3.1
57 "@legendapp/list": 3.7.2
58 "@noble/curves": 1.9.1
59 "@noble/hashes": 1.8.0
60 "@pierre/diffs": 1.7.0-beta.3
61 "@pierre/highlights": 0.5.0
62 "@tailwindcss/node": 4.3.3
63 "@tailwindcss/oxide": 4.3.3
64 "@tailwindcss/vite": 4.3.3
65 "@types/node": 24.12.4
66 "@types/plist": 3.0.5
67 "@types/react": ~19.3.0
68 "@types/react-dom": ~19.3.0
69 "@types/ws": 8.18.2
70 alchemy: 2.0.0-beta.85
71 effect: 4.1.3
72 electron-webauthn: 1.3.1
73 jose: 6.2.2
74 lightningcss: 1.33.0
75 objc-js: 1.5.0
76 pele: ^1.8.0
77 plist: 3.1.1
78 react: 19.3.0
79 react-dom: 19.3.0
80 tailwindcss: 4.3.3
81 tldts: 7.4.2
82 undici: 8.12.4
83 vite: npm:@voidzero-dev/vite-plus-core@1.4.0
84 vite-plus: 1.4.0
85 ws: 8.22.0
86 yaml: ^2.9.0
87 # Markdown pipeline: the server counts find matches with the same parser the
88 # web renders with, so both must resolve to one version.
89 mdast-util-directive: 3.1.0
90 micromark-extension-directive: 4.0.0
91 micromark-util-character: 2.1.1
92 micromark-util-types: 2.0.2
93 rehype-raw: 7.0.0
94 rehype-sanitize: 6.0.0
95 remark-breaks: 4.0.0
96 remark-gfm: 4.0.1
97 remark-parse: 11.0.0
98 remark-rehype: 11.1.2
99 unified: 11.0.5
100
101overrides:
102 # Pin every patched package, including transitive dependencies, so lockfile-free
103 # release installs cannot drift past the patch. Update these with patchedDependencies.
104 react-native-image-viewing: 0.2.2
105 mdast-util-math: 3.0.0
106 micromark-extension-llm-math: 3.1.0
107 micromark: 4.0.2
108 mdast-util-to-hast: 13.2.1
109 alchemy: "catalog:"
110 expo-audio: 58.0.11
111 expo-network: 58.0.4
112 "@clerk/expo-native-components": 0.4.4
113 "@cursor/sdk": 1.2.0
114 expo-sharing: 58.0.22
115 expo-widgets: 58.0.27
116 "@ff-labs/fff-node": 0.11.0
117 "@legendapp/list": 3.7.2
118 "@pierre/diffs": 1.7.0-beta.3
119 "@react-native-ai/apple": 0.12.0
120 "@react-native-menu/menu": 2.0.0
121 "@react-navigation/native-stack": 7.21.0
122 dbus-next: 0.10.2
123 node-pty: 1.2.0-beta.15
124 react-native-gesture-handler: 3.5.0
125 react-native-reanimated: 4.7.1
126 react-native-keyboard-controller: 1.23.0
127 # 6.1.1 cannot build Android: it downloads PDFium from a release asset that was never published.
128 react-native-pdf-jsi: 6.1.0
129 react-native-webview: 14.0.1
130 react-native-svg: 15.16.1
131 app-builder-lib: 26.16.1
132 electron-updater: 6.8.9
133 expo-modules-core: 58.0.30
134 # Keep jsdom's optional peer consistent so Vite+ has one test-runner instance.
135 "@exodus/bytes>@noble/hashes": "1.8.0"
136 # Earlier React Navigation declarations create a circular type alias in TypeScript 7.
137 # Move this with @react-navigation/native: an older core than it requires crashes
138 # every native stack at launch.
139 "@react-navigation/core": 7.24.0
140 # The dbus-next patch drops usocket from the package, but pnpm resolves from the
141 # registry manifest, so the edge has to be cut here as well.
142 "dbus-next>usocket": "-"
143 # The SDK always receives the user's Claude executable, so its bundled binaries are unused.
144 "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-darwin-arm64": "-"
145 "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-darwin-x64": "-"
146 "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-linux-arm64": "-"
147 "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "-"
148 "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-linux-x64": "-"
149 "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-linux-x64-musl": "-"
150 "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-win32-arm64": "-"
151 "@anthropic-ai/claude-agent-sdk>@anthropic-ai/claude-agent-sdk-win32-x64": "-"
152 "@clerk/backend": "catalog:"
153 "@clerk/clerk-js": "catalog:"
154 "@clerk/clerk-js>@base-org/account": "-"
155 "@clerk/clerk-js>@coinbase/wallet-sdk": "-"
156 "@clerk/clerk-js>@wallet-standard/core": "-"
157 "@clerk/electron": "catalog:"
158 "@clerk/electron-passkeys": "catalog:"
159 "@clerk/expo": "catalog:"
160 "@clerk/react": "catalog:"
161 "@clerk/shared": "catalog:"
162 "@effect/atom-react": "catalog:"
163 "@effect/platform-bun": "catalog:"
164 "@effect/platform-node": "catalog:"
165 "@effect/platform-node-shared": "catalog:"
166 "@effect/sql-pg": "catalog:"
167 "@effect/vitest": "catalog:"
168 "@effect/vitest>vitest": "-"
169 "@expo/dom-webview": 58.0.2
170 expo-constants: 58.0.15
171 "expo-sharing>@expo/config-plugins": 58.0.12
172 "expo-sharing>@expo/config-types": 58.0.3
173 # @pierre/trees pins @pierre/theming 1.0.0, whose peer range predates @pierre/theme 2.
174 "@pierre/trees>@pierre/theming": 1.0.2
175 # Resolve below remark-math so Vite, Metro and Node use the same tokenizer.
176 "remark-math>micromark-extension-math": npm:micromark-extension-llm-math@3.1.0
177 micromark-extension-gfm-table: 2.1.1
178 # Keep one copy of these native-binary packages. lightningcss ships 11 platform binaries per
179 # version, and the workspaces' tailwindcss ^4 ranges drift into two 4.3.x copies of the family.
180 "@tailwindcss/node": "catalog:"
181 "@tailwindcss/oxide": "catalog:"
182 "@tailwindcss/vite": "catalog:"
183 "@types/node": "catalog:"
184 effect: "catalog:"
185 # OpenCode 2's protocol and schema packages hard-pin an exact Effect version as a
186 # dependency, and their schemas fail to decode under a second Effect copy.
187 # The `effect` override above already collapses them; these name the edge so it
188 # stays pinned on its own.
189 "@opencode/protocol>effect": "catalog:"
190 "@opencode/schema>effect": "catalog:"
191 node-abi: 4.33.0
192 # react-native-worklets peers on any version, so a fresh resolve takes the newest
193 # one; React Native's CLI plugin wants exactly its own. Move with react-native.
194 "@react-native/metro-config": 0.88.1
195 # The desktop app installs these without a lockfile when it packages them, so
196 # pin the native passkey code that runs in its main process.
197 "electron-webauthn>@electron-webauthn/macos": "catalog:"
198 "@electron-webauthn/macos>objc-js": "catalog:"
199 lightningcss: "catalog:"
200 tailwindcss: "catalog:"
201 # Ranges from @effect/platform-node, jsdom, unifont, Expo and libsql otherwise
202 # settle on two patch releases of each major. Older majors stay as they are.
203 "@types/ws@^8": "catalog:"
204 "undici@^8": "catalog:"
205 "ws@^8": "catalog:"
206 vite: "catalog:"
207 vite-plus: "catalog:"
208 yaml: "catalog:"
209 # @vercel/routing-utils pins exactly 6.1.0, which has a ReDoS advisory (GHSA-9wv6-86v2-598j).
210 "@vercel/routing-utils>path-to-regexp": 6.3.0
211 # zod 3 has a high advisory (GHSA-mrhx-c7xc-m3w5) fixed only in 4.6.6. @vercel/config only
212 # builds a z.object of z.string().regex() and calls parse, which zod 4 keeps unchanged.
213 "@vercel/config>zod": 4.6.7
214
215packageExtensions:
216 "@clerk/expo@*":
217 dependencies:
218 "@expo/config-plugins": 58.0.12
219 "@clerk/expo-native-components@*":
220 dependencies:
221 "@expo/config-plugins": 58.0.12
222 # Our patch makes @effect/vitest import vite-plus/test. A catalog: spec here
223 # resolves through the vite-plus override above.
224 "@effect/vitest@*":
225 dependencies:
226 vite-plus: "catalog:"
227
228patchedDependencies:
229 react-native-image-viewing@0.2.2: patches/react-native-image-viewing@0.2.2.patch
230 mdast-util-math@3.0.0: patches/mdast-util-math@3.0.0.patch
231 micromark-extension-llm-math@3.1.0: patches/micromark-extension-llm-math@3.1.0.patch
232 micromark-extension-gfm-table@2.1.1: patches/micromark-extension-gfm-table@2.1.1.patch
233 micromark@4.0.2: patches/micromark@4.0.2.patch
234 mdast-util-to-hast@13.2.1: patches/mdast-util-to-hast@13.2.1.patch
235 expo-audio@58.0.11: patches/expo-audio@58.0.11.patch
236 expo-video@58.0.13: patches/expo-video@58.0.13.patch
237 expo-network@58.0.4: patches/expo-network@58.0.4.patch
238 "@clerk/expo-native-components@0.4.4": patches/@clerk__expo-native-components@0.4.4.patch
239 "@alchemy.run/test@2.0.0-beta.85": patches/@alchemy.run__test@2.0.0-beta.85.patch
240 "@effect/vitest@4.1.2": patches/@effect__vitest@4.1.2.patch
241 expo-sharing@58.0.22: patches/expo-sharing@58.0.22.patch
242 expo-widgets@58.0.27: patches/expo-widgets@58.0.27.patch
243 # Android: an RNHostView without a scrolling descendant (an app bar's buttons) is no longer the
244 # scroll target a Material bottom sheet picks, so sheet content can sit below its header.
245 "@expo/ui@58.0.27": patches/@expo__ui@58.0.27.patch
246 "@ff-labs/fff-node@0.11.0": patches/@ff-labs__fff-node@0.11.0.patch
247 # Exports the dependency-light subpaths mobile and the web diff parser import, and makes find
248 # cover folded files and collapsed context (onRevealSearchMatch).
249 "@pierre/diffs@1.7.0-beta.3": patches/@pierre__diffs@1.7.0-beta.3.patch
250 "@react-native-ai/apple@0.12.0": patches/@react-native-ai__apple@0.12.0.patch
251 "@react-native-menu/menu@2.0.0": patches/@react-native-menu__menu@2.0.0.patch
252 "@react-navigation/native-stack@7.21.0": patches/@react-navigation%2Fnative-stack@7.21.0.patch
253 dbus-next@0.10.2: patches/dbus-next@0.10.2.patch
254 node-pty@1.2.0-beta.15: patches/node-pty@1.2.0-beta.15.patch
255 react-native-gesture-handler@3.5.0: patches/react-native-gesture-handler@3.5.0.patch
256 # Screens v5 stack, split and tab screens leave at once, like legacy screens. Exiting animations
257 # inside one otherwise hold its removal for a later mount, after its stack has moved on.
258 react-native-reanimated@4.7.1: patches/react-native-reanimated@4.7.1.patch
259 react-native-keyboard-controller@1.23.0: patches/react-native-keyboard-controller@1.23.0.patch
260 # Android: a nested WebView hands a vertical drag to its scrolling parent at the page's edge.
261 react-native-webview@14.0.1: patches/react-native-webview@14.0.1.patch
262 # Android: a Compose host that requests layout in a mount (a new screen's app bar) is laid out
263 # before that frame is drawn, instead of a frame later.
264 expo-modules-core@58.0.30: patches/expo-modules-core@58.0.30.patch
265 # Observe the owned host exit independently of descendants retaining its stdio.
266 "@muse-code/sdk@1.4.6": patches/@muse-code__sdk@1.4.6.patch
267 app-builder-lib@26.16.1: patches/app-builder-lib@26.16.1.patch
268 # Electron net requests never emit "socket", so upstream's idle timeout never fires and a
269 # stalled update download hangs forever.
270 electron-updater@6.8.9: patches/electron-updater@6.8.9.patch
271 # Local agents honor the attribution settings in the user's Cursor CLI cli-config.json.
272 "@cursor/sdk@1.2.0": patches/@cursor__sdk@1.2.0.patch
273 # A failed Artifacts.cached effect hangs every later caller: https://github.com/alchemy-run/alchemy/issues/2981
274 alchemy@2.0.0-beta.85: patches/alchemy@2.0.0-beta.85.patch
275 # Android: a marker orient other than "auto" or a number (auto-start-reverse) no longer throws.
276 react-native-svg@15.16.1: patches/react-native-svg@15.16.1.patch
277 # iOS: a feed following its end keeps the end through a size-only reflow in one pass.
278 "@legendapp/list@3.7.2": patches/@legendapp__list@3.7.2.patch
279 # Android: double-tap zoom no longer cancels itself, and taps near a link open it.
280 react-native-pdf-jsi@6.1.0: patches/react-native-pdf-jsi@6.1.0.patch
281
282# Unmet peers fail resolution, so a pin outside a dependency's peer range is
283# caught when the lockfile changes instead of scrolling past as a warning.
284strictPeerDependencies: true
285
286peerDependencyRules:
287 allowAny:
288 - typescript
289 - vite
290 allowedVersions:
291 vite: "*"
292 # Our react-native-screens fork is a 5.x prerelease, which ">= 4.0.0" excludes.
293 "@react-navigation/native-stack>react-native-screens": "*"
294 # ws 7 (React Native dev tooling) only calls isValidUTF8, unchanged in v6.
295 "ws@7>utf-8-validate": "6"
296
297# pnpm 12 links agent skills that dependencies ship into .claude/skills once
298# approved. We curate our own skills, so deny these to keep installs quiet.
299permissions:
300 "@tanstack/router-plugin":
301 skills: false
302 drizzle-kit:
303 skills: false
304 expo-sqlite:
305 skills: false
306
307# @cursor/sdk finds its platform package (sandbox helper, rg, tree-sitter) by
308# walking up from the entry script for node_modules/@cursor/sdk-<platform>-<arch>.
309# pnpm keeps optional deps inside the virtual store, so hoist it to the root.
310publicHoistPattern:
311 - "@cursor/sdk-*"
312
313minimumReleaseAgeExclude:
314 - "@legendapp/list@3.7.2"
315 - "@effect/tsgo-darwin-arm64@0.67.1"
316 - "@effect/tsgo-darwin-x64@0.67.1"
317 - "@effect/tsgo-linux-arm64@0.67.1"
318 - "@effect/tsgo-linux-arm@0.67.1"
319 - "@effect/tsgo-linux-x64@0.67.1"
320 - "@effect/tsgo-win32-arm64@0.67.1"
321 - "@effect/tsgo-win32-x64@0.67.1"
322 - "@effect/tsgo@0.67.1"
323 - "@anthropic-ai/claude-agent-sdk@0.3.321"
324 - "@pierre/diffs@1.7.0-beta.3"
325 - "@pierre/highlights@0.5.0"