pnpm-workspace.yaml

# Rocketride Engine Monorepo Workspace Configuration
# This file defines which directories contain packages in the monorepo

# Suppress cyclic-dependency warning caused by apps/vscode and
# packages/client-typescript both being named "rocketride".
# The cycle is via a peer dependency and is harmless.
ignoreWorkspaceCycles: true

# Only allow postinstall/install scripts for known, trusted packages that
# require native compilation or binary downloads.
# See: https://pnpm.io/npmrc#onlybuiltdependencies
onlyBuiltDependencies:
  - '@homebridge/node-pty-prebuilt-multiarch'
  - '@vscode/vsce-sign'
  - 'core-js'
  - 'cpu-features'
  - 'esbuild'
  - 'keytar'
  - 'lefthook'
  - 'protobufjs'
  - 'ssh2'
  - 'unrs-resolver'

packages:
  # Frozen shell API contract (types-only, generated by builder shell:freeze)
  - 'packages/shell'

  # Client libraries
  - 'packages/client-typescript'

  # Documentation site
  - 'packages/docs'

  # MCP Apps widgets (vite workspace embedded in the ai MCP module)
  - 'packages/ai/src/ai/modules/mcp/apps'

  # Applications
  - 'apps/*'

  # Examples
  - 'examples/*'

# Workspace-wide dependency overrides — the SINGLE source of overrides (never
# add a pnpm.overrides section to package.json: it silently supersedes this
# whole block). shell resolves IN-TREE to the workspace package: app manifests
# keep the portable "file:../../.rocketride/shell/shell.tgz" spec (exactly
# right when an app is lifted into its own repo, where the tgz is downloaded
# and vendored), and this override supersedes it inside the monorepo — a
# workspace link carries no tarball integrity pin, so fresh clones and
# frozen-lockfile CI install without the gitignored artifact existing.
# Enforcement is unchanged: the exports map (the barrel and the theme
# stylesheet) governs linked packages the same as installed ones.
# The rest are security floors that still BIND: floors the natural resolution
# already satisfies are pruned (re-audit by stripping pins and re-resolving
# with --lockfile-only), and the scoped react-router entries are compat
# downgrades for Docusaurus-era parents.
overrides:
  shell: 'workspace:*'
  '@remix-run/router': '>=1.23.3 <2'
  adm-zip: '>=0.6.0 <1'
  body-parser: '>=1.20.6 <2'
  brace-expansion: '>=5.0.7 <6'
  # minimatch 3.x (eslint's config-array, glob@7) does a CJS default-import of
  # brace-expansion; v5's commonjs build exports named {expand} only, so the
  # global floor crashes every minimatch@3 consumer ("expand is not a
  # function"). Scope those parents to the v1 line — 1.1.12 carries the same
  # ReDoS fix the floor exists for.
  'minimatch@3>brace-expansion': '>=1.1.12 <2'
  'diff@7': '>=8.0.3 <9'
  dompurify: '>=3.4.13 <3.5.0'
  fast-uri: '>=3.1.5 <4'
  glob: '>=11.1.0'
  immutable: '>=5.1.8 <6'
  joi: '>=18.2.1 <19'
  js-yaml: '>=4.3.1 <5'
  lodash: '>=4.18.1 <5'
  prismjs: '>=1.30.0 <2'
  '@docusaurus/core>react-router': '5.3.4'
  'react-router-config>react-router': '5.3.4'
  'react-router-dom@5>react-router': '5.3.4'
  serialize-javascript: '>=7.0.5 <8'
  shell-quote: '>=1.9.0 <2'
  undici: '>=7.29.0 <8'
  uuid: '>=11.1.1 <12'
  webpack-dev-server: '>=5.2.6 <6'
  ws: '>=8.21.0 <9'

# Patch gray-matter's frontmatter handling for the docs site (see patches/).
patchedDependencies:
  'gray-matter@4.0.3': patches/gray-matter@4.0.3.patch

# Peer-conflict allowances for parents that declare older peer majors than
# the workspace actually ships.
peerDependencyRules:
  allowedVersions:
    '@rjsf/mui>@mui/material': '6'
    '@rjsf/mui>@mui/icons-material': '6'
    '@mui/icons-material>@mui/material': '6'
    'react-json-view>react': '18'
    'react-json-view>react-dom': '18'
    'flux>react': '18'
    '@typescript-eslint/utils>eslint': '9'

# Install only the current platform's native binaries.
supportedArchitectures:
  os:
    - current
  cpu:
    - current