unthrown/pnpm-workspace.yaml at main · btravstack/unthrown · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
autoInstallPeers: false
dedupePeerDependents: true
engineStrict: true
saveExact: true
strictPeerDependencies: true

packages:
  - packages/*
  - tools/*
  - docs

catalog:
  "@changesets/cli": 2.31.0
  "@commitlint/cli": 21.2.0
  "@bloodyowl/boxed": 3.4.0
  "@btravstack/theme": 1.6.1
  "@prisma/adapter-better-sqlite3": 7.8.0
  "@prisma/client": 7.8.0
  "@standard-schema/spec": 1.1.0
  "@commitlint/config-conventional": 21.2.0
  "@orpc/client": 2.0.0-beta.14
  "@orpc/contract": 2.0.0-beta.14
  "@orpc/server": 2.0.0-beta.14
  "@types/node": 24.13.2
  "@vitest/coverage-v8": 4.1.9
  better-sqlite3: 12.11.1
  effect: 3.21.4
  prisma: 7.8.0
  knip: 6.23.0
  lefthook: 2.1.9
  neverthrow: 8.2.0
  oxfmt: 0.57.0
  oxlint: 1.72.0
  ts-pattern: 5.9.0
  tsdown: 0.22.3
  tsx: 4.22.4
  turbo: 2.10.2
  typedoc: 0.28.19
  typedoc-plugin-markdown: 4.12.0
  typescript: 6.0.3
  vitepress: 1.6.4
  vitest: 4.1.9

peerDependencyRules:
  ignoreMissing:
    # Optional analytics peer of VitePress's bundled Algolia DocSearch.
    - search-insights
    # React peers of `@prisma/studio-core`, pulled in transitively by the `prisma`
    # CLI (v7 bundles Prisma Studio). We never run `prisma studio`; the CLI is a
    # dev-only dependency of `@unthrown/prisma` (its test-client generation).
    - react
    - react-dom

allowBuilds:
  # Prisma 7 is engine-less (WASM query compiler); nothing to build or download.
  "@prisma/engines": false
  # Native SQLite bindings for `@unthrown/prisma`'s tests (prebuilt binaries).
  better-sqlite3: true
  esbuild: true
  lefthook: true
  prisma: true

# Supply-chain maturity delay: don't adopt a freshly published version until it
# has been on the registry for 7 days (10080 minutes). Strict mode also validates
# the committed lockfile against this cutoff, so a same-day-published transitive
# dep fails the check instead of slipping in silently.
minimumReleaseAge: 10080
minimumReleaseAgeStrict: true

auditConfig:
  ignoreGhsas:
    # vite `server.fs.deny` bypass on Windows alternate paths. Reaches us only
    # through the docs site's dev tooling (docs > vitepress > vite) — a build-time,
    # docs-only transitive dep. It affects the Vite dev server on Windows, which we
    # never run in CI or production (the docs site ships as static HTML), and it is
    # in no published package's runtime dependencies.
    - GHSA-fx2h-pf6j-xcff

minimumReleaseAgeExclude:
  - "@btravstack/theme"