pnpm-workspace.yaml

packages:
  - dev/*
  - e2e
  - packages/*
  - packages/@repo/*
  - packages/@sanity/*
  - plugins/*
  - plugins/@sanity/*
  - scripts/*
  - turbo/generators

# Gated off because AILF runs remote (--remote); flip a value to true if you need one at build time locally.
allowBuilds:
  '@playwright/browser-chromium': false
  '@swc/core': false
  better-sqlite3: false
  esbuild: false
  # Its install script installs the git hooks from lefthook.yml
  lefthook: true
  onnxruntime-node: false
  protobufjs: false
  sharp: false

catalog:
  '@date-fns/tz': ^1.5.0
  '@hello-pangea/dnd': ^18.0.1
  '@hookform/resolvers': ^4.1.3
  '@portabletext/block-tools': ^5.2.0
  '@portabletext/to-html': ^5.0.3
  '@portabletext/types': ^4.0.2
  '@sanity/asset-utils': ^2.3.0
  '@sanity/client': ^8.9.0
  '@sanity/color': ^3.0.9
  '@sanity/icons': ^5.2.3
  '@sanity/image-url': ^2.1.1
  '@sanity/mutator': ^6.19.0
  '@sanity/pkg-utils': ^13.0.12
  '@sanity/preview-url-secret': ^4.1.5
  '@sanity/schema': ^6.19.0
  '@sanity/telemetry': '^1.1.0'
  '@sanity/tsconfig': ^2.2.1
  '@sanity/tsdown-config': ^0.31.2
  '@sanity/types': ^6.19.0
  '@sanity/ui': ^4.4.10
  '@sanity/util': ^6.19.0
  '@sanity/uuid': ^3.0.3
  '@sanity/vanilla-extract-vite-plugin': ^0.3.0
  '@sanity/vision': ^6.19.0
  '@testing-library/jest-dom': ^7.0.1
  '@testing-library/react': ^16.3.3
  # Pins its `tsdown` peer to the exact release it ships with, so bump it together with `tsdown`
  '@tsdown/css': ^0.23.1
  '@types/lodash-es': ^4.17.12
  '@types/node': ^24.19.2
  '@types/react': ^19.3.0
  '@types/react-dom': ^19.3.0
  '@types/react-is': ^19.3.0
  '@types/video.js': ^7.3.58
  '@vanilla-extract/css': ^1.21.3
  '@vanilla-extract/dynamic': ^2.1.5
  '@vis.gl/react-google-maps': ^1.10.1
  '@vitest/coverage-v8': ^5.0.5
  '@xstate/react': ^6.1.0
  date-fns: ^4.4.0
  dequal: ^2.0.3
  groq: ^6.19.0
  jsdom: ^29.1.1
  lexorank: ^1.0.5
  lodash-es: ^4.18.1
  motion: ^14.3.0
  nanoid: ^6.0.2
  oxc-transform-react: ^0.154.0
  oxfmt: ^0.73.0
  oxlint: ^1.83.0
  oxlint-tsgolint: ^7.0.2003
  react: ^19.3.1
  react-dom: ^19.3.1
  react-hook-form: ^7.90.0
  react-icons: ^5.7.0
  react-is: ^19.3.1
  react-photo-album: ^3.6.0
  react-rx: ^7.1.0
  rxjs: ^7.8.2
  sanity: ^6.19.0
  scroll-into-view-if-needed: ^3.1.0
  styled-components: ^6.6.0
  stylelint: ^17.16.0
  suspend-react: ^0.1.3
  tsdown: ^0.23.1
  tsx: ^4.23.15
  typescript: 7.0.2
  valibot: ^1.5.0
  validate-npm-package-name: ^8.0.0
  video.js: ^7.21.7
  vitest: ^5.0.5
  xstate: ^5.33.2

catalogs:
  # Ranges used in `peerDependencies` (referenced as `catalog:peer`).
  # Only the shared studio peers live here; niche one-off peers (e.g. `easymde`)
  # keep explicit ranges, and peers on other workspace packages keep `workspace:^`
  # (or an explicit range) so changesets can track dependents.
  peer:
    react: ^19.2
    react-dom: ^19.2
    sanity: ^5 || ^6.0.0-0
    styled-components: ^6.1
  # `sanity-plugin-media` validates its forms with zod v4, which `zodResolver`
  # only supports from @hookform/resolvers 5.1. The default catalog stays on v4
  # for `sanity-plugin-dashboard-widget-vercel`, whose yup 0.32 schemas predate
  # the `yup@^1` peer of newer resolvers.
  media:
    '@hookform/resolvers': ^6.0.2

# Collapse compatible versions of the same dependency on every install, so the
# lockfile stays deduped without waiting for the `Dedupe lockfile` workflow to
# open a follow-up PR. Frozen installs leave the lockfile untouched.
autoDedupe: true

# When running `pnpm add`, reuse a dependency's catalog version automatically if
# it already exists in a catalog, so shared deps stay aligned on a single version.
catalogMode: prefer
dedupeDirectDeps: true

dedupePeers: true
linkWorkspacePackages: deep
strictPeerDependencies: false

# minimumReleaseAge defaults to 1440 (1 day) since pnpm v11 — do not set it
# explicitly unless overriding the default.
#
# Keep this list to first-party packages and closely tracked tooling that may
# need immediate installs. For one-off upgrades still inside the maturity
# window, add exact `name@version` entries (do not bypass with
# `--config.minimumReleaseAge=0` — that is not allowed). Avoid permanent
# third-party package-name excludes solely to land a fresh release.
#
# The motion packages, the oxc transform packages, the TanStack virtual packages
# and `styled-components` are the exception. Renovate forces their bumps from
# the Dependency Dashboard while the release is still inside the window, and the
# `name@version` entries pnpm writes for them never survive: Renovate only
# commits `pnpm-lock.yaml`, so CI's frozen install then rejects the lockfile
# with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION. Each release also pins its
# siblings and platform bindings to exact versions, so the whole family has to
# be listed, not just the package Renovate names.
minimumReleaseAgeExcludePrune: true
minimumReleaseAgeExclude:
  - '@changesets/cli'
  - '@devframes/*'
  - '@oxc-transform/*'
  - '@oxc-transform-react/*'
  - '@oxfmt/*'
  - '@oxlint/*'
  - '@oxlint-tsgolint/*'
  - '@portabletext/*'
  - '@publint/*'
  - '@rollup/*'
  - '@rolldown/*'
  - '@sanity/*'
  - '@sanity-labs/*'
  - '@tanstack/react-virtual'
  - '@tanstack/virtual-core'
  - '@types/*'
  - '@types/react@19.3.0'
  - '@types/react-dom@19.3.0'
  - '@types/react-is@19.3.0'
  - '@typescript/*'
  - '@vite/*'
  - '@vitejs/devtools'
  - '@vitejs/devtools-kit'
  - '@vitejs/devtools-oxc'
  - '@vitejs/devtools-rolldown'
  - '@vitejs/devtools-vite'
  - '@vitejs/plugin-react'
  - '@vitest/*'
  - '@yuku-codegen/*'
  # 2026-10-09: @yuku-core/binding-*@0.18.1 (platform binaries of yuku-core@0.18.1, see below)
  - '@yuku-core/*'
  - '@yuku-parser/*'
  - '@yuku-toolchain/*'
  - devframe
  - framer-motion
  - get-it
  - groq
  - groq-js
  - motion
  - motion-dom
  - motion-utils
  - oxc-transform
  - oxc-transform-react
  - oxfmt
  - oxlint
  - oxlint-tsgolint
  - publint
  - react
  - react-dom
  - react-is
  - rolldown
  - react-rx
  - rolldown-plugin-dts
  - sanity
  - styled-components
  - tsdown
  - verkit
  - vite
  - vitest
  - yuku-ast
  - yuku-codegen
  - yuku-parser
  - cac@7.1.0
  - i18next@26.4.4

overrides:
  '@types/node': 'catalog:'
  # Type errors happen if there are duplicates of `@sanity/client` in node_modules
  '@sanity/client@8': 'catalog:'
  # Pin the Sanity Studio monorepo to the `next` dist-tag for compatibility testing.
  # Keep mutator/schema/types/util/groq in lockstep with sanity so dts emit and
  # transitive deps (cli/migrate/portabletext) cannot leave a second major.minor
  # of those packages in the lockfile.
  '@sanity/mutator': next
  '@sanity/schema': next
  '@sanity/types': next
  '@sanity/util': next
  '@sanity/vision': next
  groq: next
  sanity: next
  # Keep a single tsx (and thus a single vite types instance) so sanity.cli vite
  # config callbacks type-check cleanly after the catalog tsx bump.
  tsx: 'catalog:'

publicHoistPattern:
  # Allows setting vite/client in dev/test-studio/tsconfig.json without installing vite
  - 'vite'
  # `@sanity/vanilla-extract-vite-plugin` matches every `*.css.{js,ts,…}` module, including ones
  # inside node_modules, and compiles them in a vanilla-extract runtime context. `@bynder/compact-view`
  # ships a plain `Styles.css.js` (a CSS string it injects into a shadow root, not a vanilla-extract
  # module) and declares no dependencies, so the compile only resolves `@vanilla-extract/css/adapter`
  # when pnpm happens to hoist it into the hidden `.pnpm/node_modules` directory. Public-hoisting makes
  # that resolution deterministic instead of relying on the implicit hoist layout.
  - '@vanilla-extract/css'

trustPolicy: no-downgrade
trustPolicyExcludePrune: true

trustPolicyExclude:
  # The vercel CLI (root devDependency) only parses pnpm 12's two-document pnpm-lock.yaml
  # from 58.9.5 on. From 58.7.0 on, vercel and some of its @vercel/* dependencies are still
  # published from GitHub Actions, but without the npm provenance attestations earlier
  # releases had. These are the exact versions `pnpm install` reports as
  # ERR_PNPM_TRUST_DOWNGRADE; drop them once Vercel publishes with provenance again.
  - '@vercel/backends@11.0.1'
  - '@vercel/build-utils@14.13.1'
  - '@vercel/cervel@0.1.70'
  - '@vercel/cli-auth@0.3.9'
  - '@vercel/cli-config@0.3.0'
  - '@vercel/cli-exec@1.0.1'
  - '@vercel/container@11.0.1'
  - '@vercel/detect-agent@1.2.5'
  - '@vercel/elysia@11.0.1'
  - '@vercel/error-utils@2.2.1'
  - '@vercel/express@11.0.1'
  - '@vercel/fastify@11.0.1'
  - '@vercel/gatsby-plugin-vercel-analytics@1.0.12'
  - '@vercel/gatsby-plugin-vercel-builder@2.2.62'
  - '@vercel/go@14.0.1'
  - '@vercel/h3@11.0.1'
  - '@vercel/hono@11.0.1'
  - '@vercel/hydrogen@12.0.1'
  - '@vercel/koa@11.0.1'
  - '@vercel/nestjs@11.0.1'
  - '@vercel/next@15.0.1'
  - '@vercel/node@16.0.1'
  - '@vercel/oidc@3.8.9'
  - '@vercel/python-analysis@0.14.0'
  - '@vercel/python@17.0.1'
  - '@vercel/redwood@13.0.1'
  - '@vercel/remix-builder@16.0.1'
  - '@vercel/ruby@13.0.1'
  - '@vercel/rust@12.0.1'
  - '@vercel/static-build@13.0.1'
  - '@vercel/static-config@3.4.3'
  # `@css-modules-kit/codegen` needs chokidar ^4.0.3; 4.0.2 and 4.0.3 were published without the
  # provenance attestations 4.0.0 and 4.0.1 had
  - chokidar@4.0.3
  - rxjs@7.8.2
  - semver@5.7.2 || 6.3.1
  - undici@5.29.0
  - vercel@60.1.3
  # @sanity/vision's result diff (@pierre/diffs) depends on it. 1.0.0 was published with
  # provenance; 1.1.0 and 2.0.0 without it, by a listed maintainer who also publishes
  # @pierre/diffs (which has never shipped provenance)
  - '@pierre/theme@2.0.0'