pnpm-workspace.yaml

packages:
  - packages/*
  - apps/*
  - infra/*

catalog:
  # Exact pin (epic #7498): apps/tuval's Claude program is built against this SDK's `tool()` /
  # `createSdkMcpServer` surface, and its three peers below are pinned with it so one copy of each
  # lives in the tree. Dependabot bumps it; the CLI it spawns is the `claude` on PATH (#7580).
  '@anthropic-ai/claude-agent-sdk': 0.3.259
  '@anthropic-ai/sdk': 0.123.0
  '@alchemy.run/better-auth': 2.0.0-beta.59
  # Lockstep with better-auth 1.6.23 (the `^1.6.13` catalog pin resolves there):
  # api-key + core pinned to the EXACT version better-auth links transitively, so ONE
  # `@better-auth/core` lives in the tree. A stale `core: 1.6.10` left apps/web's direct
  # (type-anchor) core a version behind the transitive 1.6.23 the apiKey plugin's hook
  # types are built against — two `HookEndpointContext` types → TS2322 in the plugins
  # array (#108, the CLAUDE.md "don't introduce a second version" catalog invariant).
  '@better-auth/api-key': 1.6.23
  '@better-auth/core': 1.6.23
  '@biomejs/biome': ^2.4.15
  '@cloudflare/workers-types': ^4.20260629.1
  # Exact pin: the lane ledger's machines fold over this engine's dispatch semantics
  # (NoCellError refusal, Transitions-form cells), so the version is part of the contract (#5673).
  '@demlik/tea': 0.12.0
  '@distilled.cloud/cloudflare': 0.27.0
  '@effect/language-service': ^0.85.1
  # Pi 0.85.1, pinned exact: apps/tuval's loopback Pi host speaks protocol 8 end to end, and the
  # envelope is part of that contract (ADR 0366). The family's ninth entry, `@earendil-works/chord`,
  # is a runtime dependency of `pi-protocol` and `pi-client` rather than a direct one, so it is
  # pinned under `overrides:` below; all nine move in one commit.
  '@earendil-works/pi-ai': 0.85.1
  '@earendil-works/pi-client': 0.85.1
  '@earendil-works/pi-coding-agent': 0.85.1
  '@earendil-works/pi-protocol': 0.85.1
  '@effect/platform-bun': 4.0.0-beta.92
  '@effect/platform-node': 4.0.0-beta.92
  '@effect/sql-d1': 4.0.0-beta.92
  '@effect/sql-pg': 4.0.0-beta.92
  '@effect/tsgo': ^0.36.4
  '@effect/vitest': 4.0.0-beta.92
  '@fontsource/ibm-plex-sans': 5.2.8
  '@fontsource/jetbrains-mono': 5.2.8
  '@manti-ui/react': 0.9.0
  '@manti-ui/styles': 0.9.0
  '@modelcontextprotocol/sdk': 1.30.0
  '@nkzw/fate': 1.3.1
  '@pierre/diffs': 1.4.1
  '@playwright/test': ^1.62.1
  '@sentry/cloudflare': 10.62.0
  '@sentry/effect': 10.62.0
  '@sentry/react': 10.62.0
  # Exact pin (grill #7563 R2.1): apps/tuval's ChatWindow virtualizes its transcript on this
  # version, whose `peerDependencies.react` reads `^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0`.
  '@tanstack/react-virtual': 3.14.10
  '@testing-library/dom': ^10.4.1
  '@testing-library/react': ^16.3.0
  '@tiptap/core': 3.30.4
  '@tiptap/markdown': 3.27.3
  '@tiptap/pm': 3.27.3
  '@tiptap/react': 3.27.3
  '@tiptap/starter-kit': 3.27.3
  '@types/node': ^25.6.2
  '@types/ws': ^8.18.1
  '@types/react': ^19.2.14
  '@types/react-dom': ^19.2.3
  '@usirin/forge': ^0.2.0
  '@vitejs/plugin-react': ^6.0.2
  alchemy: 2.0.0-beta.59
  axe-core: ^4.10.3
  # better-auth's drizzle-adapter speaks RQB v1 (raw-SQL `eq()` where-shape); drizzle-orm 1.x
  # is RQB v2 (`defineRelations`). The two do NOT interoperate through RQB: routing a better-auth
  # read via `experimental.joins` 500s ("Unknown relational filter field"). These pins are coupled
  # by that incompatibility — don't assume a bump makes them join-compatible (no RQB-v2 adapter
  # release exists yet). See #2286 (guard) / #2291 (re-enable joins via pnpm patch).
  better-auth: ^1.6.13
  # better-call's EXACT-pinned peer of `@better-auth/core@1.6.23` (`better-call: 1.3.7`),
  # also what better-auth 1.6.23 links transitively. A stale 1.3.5 split core@1.6.23 into
  # two peer-hash instances (one per better-call), re-surfacing the two-`HookEndpointContext`
  # TS2322 — pinned to 1.3.7 so ONE core/better-call pair lives in the tree (#108).
  better-call: 1.3.7
  drizzle-kit: 1.0.0-rc.4
  drizzle-orm: 1.0.0-rc.4
  effect: 4.0.0-beta.92
  fast-check: ^3.23.2
  # Pinned to the exact 5.8.0 an existing lockfile parent already links (@distilled.cloud/aws +
  # alchemy) so no third version enters the tree — the PR #535 frozen-lockfile rule.
  fast-xml-parser: 5.8.0
  jsdom: ^26.1.0
  lefthook: ^2.1.9
  lucide-react: 1.23.0
  # Pinned to the exact 18.0.5 an existing lockfile parent already links (@earendil-works/pi-tui),
  # so no third `marked` enters the tree beside it and @tiptap/markdown's 17.0.6. @kampus/design's
  # `Markdown` uses the lexer only — the token stream, never `marked()`'s HTML string (#8012).
  marked: 18.0.5
  # Exact pin (#8128): `@kampus/design`'s `Markdown` renders a ```mermaid fence through this
  # version's `parse`/`render` pair and leans on its `securityLevel: "strict"` DOMPurify pass, so
  # the version is part of that block's safety argument. It links its own nested `marked@^16`,
  # which never crosses a type boundary with the 18.0.5 above — mermaid parses its own labels.
  mermaid: 11.17.2
  # Pi's subagent extension (#8555), pinned exact and loaded behind a default-off flag. It ships raw
  # TypeScript (`exports: {".": "./index.ts"}`), so Tuval never imports it — Pi's own jiti-backed
  # extension loader reads the package directory. Its four `@earendil-works/*` peers are optional and
  # resolve to the 0.85.1 copies the catalog and the overrides below already pin, but it also takes a
  # HARD `@earendil-works/pi-server@0.85.0` — a tenth family member, off the 0.85.1 the other nine
  # sit on. Nothing in the workspace declares `pi-server`, so that copy is alone in the tree and
  # catalog-guard never sees it; re-read the lockfile for it when this pin moves.
  'pi-subagents': 0.66.0
  react: 19.2.6
  react-dom: 19.2.6
  react-fate: 1.3.1
  # Exact pin: the shell surface binds the layout tree to this library one to one, and the
  # binding rests on v4 behaviour a range could move under it — `defaultLayout` read once, an
  # `onLayoutChanged` that fires on release, and `useGroupRef().setLayout` as the only write-back
  # (`.patterns/layout-tree-with-resizable-panels.md`).
  react-resizable-panels: 4.12.3
  react-router: ^7.18.0
  turbo: ^2.9.14
  typescript: ^7.0.2
  vite: ^8.0.16
  vitest: ^4.1.5
  ws: ^8.21.3
  yaml: 2.9.0
  zod: 4.4.3

# apps/tuval's own Effect pin. The kernel epic (#7496) runs on 4.0.0-rc.112 while everything else
# sits on beta.92. A named catalog declares one version per consumer set, and that is a claim about
# the manifests only: it does not reach what those declared packages pull in underneath. One such
# transitive edge did cross over, and the `overrides` block below is what holds it.
catalogs:
  tuval:
    '@effect/platform-node': 4.0.0-rc.112
    '@effect/vitest': 4.0.0-rc.112
    effect: 4.0.0-rc.112

# `@effect/platform-node@4.0.0-beta.92` asks for `@effect/platform-node-shared` by a caret range, and
# a caret over a prerelease picks the highest version present in the workspace. So the moment
# catalogs.tuval brought rc.112 into the tree, the beta parent started resolving its own internals to
# that rc copy, including on the apps/web deploy path (alchemy reaches it through
# @distilled.cloud/cloudflare-runtime). This entry names the beta parent, so beta.92 consumers keep
# the beta child while apps/tuval's rc `@effect/platform-node` still gets rc.112. Nothing checks this
# by machine: catalog-guard reads manifest values and never lockfile resolution, so the pin is the
# enforcement. The version is written out rather than as `catalog:` because a root catalog entry no
# package.json consumes is what `cleanupUnusedCatalogs` deletes on the next install.
overrides:
  '@effect/platform-node@4.0.0-beta.92>@effect/platform-node-shared': 4.0.0-beta.92
  # Pi 0.85.1 is pinned end to end (ADR 0366). The cataloged packages ask for their siblings by
  # `^0.85.1`, and a caret picks the highest published patch — which on 0.84.x put a SECOND
  # `@earendil-works/pi-ai` in the tree beside the cataloged one. The faux provider registered
  # itself into one copy and the agent loop read the other, so a duplicate reached by a caret is a
  # correctness hazard, not just weight. These entries are re-keyed with the catalog, never left
  # behind. `chord` is the family's ninth entry, new at 0.85.1: `pi-protocol` and `pi-client` both
  # take it at runtime by caret and nothing in the workspace depends on it directly.
  '@earendil-works/chord': 0.85.1
  '@earendil-works/pi-agent-core': 0.85.1
  '@earendil-works/pi-ai': 0.85.1
  '@earendil-works/pi-telemetry': 0.85.1
  '@earendil-works/pi-tui': 0.85.1

cleanupUnusedCatalogs: true

onlyBuiltDependencies:
  - '@parcel/watcher'
  - core-js-pure
  - esbuild
  - lefthook
  - workerd

# Local patches (policy: patch deps locally, don't depend on an upstream/fork
# release — ADR 0038). Re-key each on that dep's next version bump.
#
# alchemy — three patches on beta.59:
# 1. Cloudflare/Flagship/Flag.js — `FlagshipFlag.reconcile` UPDATE path reconciles
#    only the schema/metadata IaC owns ({variations, description}) and preserves the
#    live serving the dashboard owns ({defaultVariation, rules, enabled}); the no-op
#    skip compares only the schema. Implements ADR 0106; fixes the full-body PUT that
#    clobbered live serving on every deploy (#840). Still NOT upstreamed in beta.59.
# 2. Cloudflare/Workers/{Worker.d.ts, WorkerProvider.js} — expose per-Worker Workers
#    Caching: add the `cache?: {enabled?}` prop to `WorkerProps` (the .d.ts) and
#    thread it through the provider as the script-upload metadata's `cache_options`
#    field, sent only when set. Implements ADR 0170; beta.59 predates the native
#    knob. Retire both hunks when a future alchemy release ships the field natively.
# 3. Test/Vitest.js — `Test.make`'s `beforeAll`/`afterAll`/`afterAll.skipIf`/scope-close
#    hooks drop the `?? DEFAULT_TIMEOUT` (120s) fallback, passing `undefined` when no
#    `{timeout}` override is given so @vitest/runner resolves `config.hookTimeout`
#    instead of the hard-coded clamp. The clamp silently shadowed `vitest.config.ts`'s
#    `hookTimeout` and was the #3146 merge-queue eviction root cause (#3168). Regression
#    test: apps/web/tests/integration/alchemy-hook-timeout.unit.test.ts. Retire when a
#    future alchemy release honors the configured hook timeout natively.
#
# The prior beta.56 second hunk (DurableObjectNamespace.d.ts — adding
# `DurableObjectNamespaceScope` to the `DurableObjectServices` union) was DROPPED:
# beta.59 rewrote the DO authoring model (flat → namespaced), removing the
# `DurableObjectNamespaceScope` type the hunk targeted entirely — the hunk is moot,
# not upstreamed. Re-keyed beta.56 → beta.59.
#
# react-fate — ONE hunk on 1.3.1:
# 1. lib/index.mjs — `useView`'s `readViewSnapshot` caches the derived thenable for a
#    NON-fulfilled snapshot (keyed on viewRef + source snapshot + cacheKey, mirroring
#    the deferred branch's `pendingRef` cache). Unpatched it built a fresh
#    `Promise.resolve(snapshot).then(…)` per `getSnapshot` call, so
#    `useSyncExternalStore` looped into React #185 whenever a mounted `useLiveView`'s
#    record was deleted by an entity live frame (#1686 — the term-page crash on
#    definition.delete). Regression test:
#    apps/web/src/fate/useViewPendingSnapshot.test.tsx. Not upstreamed in 1.3.1.
#
# @nkzw/fate — ONE hunk on 1.3.1 (createHTTPTransport is defined here; react-fate only
# re-exports it):
# 1. lib/index.mjs — the native live client's `add` buffers same-tick subscribe ops and
#    flushes them as ONE `/fate/live` control POST (mirroring the reconnect path's
#    `control(resubscribe)`). Unpatched, each `add` fired its own `control([op])` after
#    `open`, so a feed load with N `useLiveView` mounts issued N single-op POSTs, each
#    re-validating the session (~22 on an authed /pano load — #2273). Regression test:
#    apps/web/src/fate/liveSubscribeBatch.test.ts. Not upstreamed in 1.3.1.
#
# effect — THREE hunks on 4.0.0-beta.92 (dist only; `effect/unstable/*` resolves to
# dist/*.js + dist/*.d.ts). Hunks 1–2 gave the MCP channel edge the two things the fixed
# public `McpServer`/`McpSchema` surface can't express (#3053, epic #3045). That edge was
# the v1 crew's MCP server, removed with it (ADR 0279), so both hunks have NO in-repo
# consumer today and nothing pins their behavior — retire them on the next effect bump
# unless a new MCP server needs them:
# 1. unstable/ai/McpServer.{js,d.ts} — an `experimental` capability passthrough in
#    `layerHandlers` (+ the `experimental?` option on run/layer/layerStdio/layerHttp),
#    so a server can advertise `experimental: { "claude/channel": {} }`. The
#    `ServerCapabilities` schema already carries the slot; only the server wiring was
#    missing.
# 2. unstable/ai/McpSchema.{js,d.ts} — a `ChannelNotification`
#    (`notifications/claude/channel`, `{ message, _meta }`) added to the fixed
#    `ServerNotificationRpcs` union, so the run-loop's encode union and the
#    `McpServer.notifications` client both gain the custom notification.
# Their `@patch-pin` test (#3040/#3051) went with that package, so the patch's only
# remaining pin is hunk 3's. Retire when effect ships these natively, or sooner —
# nothing in the repo depends on them.
# 3. unstable/cli/internal/command.js — `buildHelpDoc` skips a positional argument marked
#    hidden, the rule that file already applies to hidden flags and hidden subcommands.
#    `Param.withHidden` is public and documented as hiding, but upstream honours it for
#    flags only, so a hidden argument still rendered in USAGE and ARGUMENTS. fabrika's
#    excess-operand guard declares one hidden trailing catch-all per leaf verb (#4828);
#    without this hunk every verb's `--help` would advertise an operand it refuses, and
#    `--help` is fabrika's stated interface. Cosmetic and scoped to hidden arguments, of
#    which nothing else in the repo declares any. Behavior-pinned by
#    packages/fabrika-cli/src/excess-operand.cli.test.ts. Retire when effect honours it.
patchedDependencies:
  '@manti-ui/react@0.9.0': patches/@manti-ui__react@0.9.0.patch
  '@nkzw/fate@1.3.1': patches/@nkzw__fate@1.3.1.patch
  alchemy@2.0.0-beta.59: patches/alchemy@2.0.0-beta.59.patch
  effect@4.0.0-beta.92: patches/effect@4.0.0-beta.92.patch
  react-fate@1.3.1: patches/react-fate@1.3.1.patch