pnpm-workspace.yaml

packages:
  - apps/*
  - packages/*
  - tooling/*

allowBuilds:
  '@parcel/watcher': true
  # Transitive optional deps pulled in by @better-auth/cli (its setup wizard supports
  # several ORMs/databases); apps/app only uses Postgres + Drizzle, so these native
  # builds are never needed at runtime — explicitly denied rather than left ignored.
  '@prisma/client': false
  better-sqlite3: false
  core-js: false
  esbuild: true
  sharp: false
  unrs-resolver: false

# Single source of truth for shared dependency versions.
# Packages reference these with `"dep": "catalog:"` instead of pinning.
catalog:
  # language + build
  # Pinned exact: TS 7 (native compiler) must stay in lockstep with
  # oxlint-tsgolint's paired version (see root package.json).
  typescript: 7.0.2
  vitest: ^5.0.3
  tsup: ^8.5.1

  # env validation (Standard Schema based — see each package's keys.ts)
  '@t3-oss/env-core': ^0.13.8
  zod: ^4.6.5

  # tRPC (in-app router — see ADR-0002)
  '@trpc/server': ^11.19.0
  '@trpc/client': ^11.19.0
  '@tanstack/react-query': ^5.104.1

  # react (shared major across web React-DOM islands + React Native)
  react: ^19.2.1
  react-dom: ^19.2.1
  '@types/react': ^19.3.0
  '@types/react-dom': ^19.3.0
  '@types/node': ^24.10.2

# react-native-css 3 (NativeWind v5) resolves lightningcss through
# @expo/metro-config rather than through its own peer dependency, and
# lightningcss >= 1.32 regressed the napi visitor bridge: with a JS `visitor`
# installed, any unresolved `var()` makes `transform()` throw
# `failed to deserialize; expected an object-like struct named Specifier`.
# Tailwind v4's preflight and `@property` rules both emit such vars, so every
# Metro build (and the jest globalSetup that mirrors it) would fail. 1.30.1 is
# the version NativeWind's v5 migration guide pins. Scoped to @expo/metro-config
# so @tailwindcss/node keeps its own exact 1.32.0 for the website build.
#
# Removable once a lightningcss release deserializes visitor specifiers again,
# or once react-native-css stops routing through @expo/metro-config's copy. The
# check is cheap and local: delete this entry, reinstall, and run
# `pnpm --filter mobile test` — jest's globalSetup drives the same
# PostCSS/Tailwind → lightningcss path Metro does, so it throws the same
# deserialize error if the bug is still there. Unpin it together with the
# matching `lightningcss` devDependency in apps/mobile/package.json (see the
# `//lightningcss` note there) — that one satisfies react-native-css's peer
# range, and the two versions have to stay identical.
overrides:
  '@expo/metro-config>lightningcss': 1.30.1
  # One pg keeps a single drizzle-orm copy, so the @whocards/game tables type-check in every host.
  pg: ^8.23.0

# Supply-chain guard: quarantine newly published versions for 2 days (2880 min)
# before they're installable.
minimumReleaseAge: 2880