pnpm-workspace.yaml

packages:
  - app/elohim-app
  - app/lamad
  - app/imagodei-portal
  - doorway/doorway-app
  - app/elohim-library
  - app/elohim-library/projects/elohim-service
  - app/elohim-library/projects/elohim-identity
  - app/elohim-library/projects/elohim-rea-runtime
  - app/elohim-elements/elohim-core
  - app/elohim-elements/elohim-shell
  - app/elohim-elements/elohim-imagodei
  - app/elohim-elements/elohim-lamad
  - app/elohim-elements/elohim-shefa
  - app/elohim-elements/elohim-qahal
  - app/elohim-elements/elohim-doorway
  - app/elohim-elements/elohim-avodah
  - steward/device
  - genesis/seeder
  - genesis/a2o
  - genesis/orchestrator
  - elohim/sdk/storage-client-ts
  - elohim/sdk/epr-ts
  - elohim/eprfs/eprfs-ts
  - elohim/elohim-agent/mcp-servers/elohim-content
  - elohim/elohim-agent/elohim-agent-sdk

# pnpm settings home (pnpm >=10 ignores the package.json "pnpm" field).
# overrides MUST stay in lockstep with the recorded set in pnpm-lock.yaml.
overrides:
  # Holochain 0.7 line: ONE copy of the JS client (a second copy breaks instanceof checks —
  # upstream's documented trap). Lane I of the 0.7 guide.
  '@holochain/client': ^0.21.0
  libsodium-wrappers: ^0.8.2
  libsodium: ^0.8.2
  playwright: 1.59.1
  playwright-core: 1.59.1
  '@vue/compiler-sfc': 3.5.34
  '@vue/compiler-core': 3.5.34
  '@vue/compiler-dom': 3.5.34
  '@vue/compiler-ssr': 3.5.34
  '@vue/reactivity': 3.5.34
  '@vue/shared': 3.5.34
  # GHSA-3ppc-4f35-3m26 / GHSA-23c5-xmqv-rm74 (Dependabot #551/#553/#552): eslint-plugin-sonarjs
  # pins an exact vulnerable minimatch@10.1.2; force the dedupe to an already-resolved, already
  # patched instance (10.2.4) already present in the graph — no new tarball fetch required.
  'eslint-plugin-sonarjs>minimatch': ^10.2.4
  # GHSA-c2c7-rcm5-vvqj / GHSA-3v7f-55p6-f55p (Dependabot #578/#579): @angular-devkit/core pins
  # an exact vulnerable picomatch@4.0.2; force the dedupe to an already-resolved, already patched
  # instance (4.0.4) already present in the graph — no new tarball fetch required.
  '@angular-devkit/core>picomatch': ^4.0.4
  '@angular-devkit/build-angular>picomatch': ^4.0.4
  '@angular/build>picomatch': ^4.0.4
  # GHSA-q8mj-m7cp-5q26 (Dependabot #642): qs is resolved at 6.14.2/6.15.0 (dev-only, via
  # webpack-dev-server's express chain); 6.15.2 is confirmed fetchable on the mirror right now
  # (unlike almost everything else checked in this pass) and fixes the CVE with no API change.
  qs: ^6.15.2
  # GHSA-23hp-3jrh-7fpw (Dependabot #715, critical): tar <=7.5.18 has an unbounded-input
  # decompression DoS; it arrives transitively (build/install tooling), so force the patched line.
  tar: ^7.5.19

onlyBuiltDependencies:
  - '@parcel/watcher'
  - esbuild
  - less
  - lmdb
  - msgpackr-extract
  - sharp
  - unrs-resolver

packageExtensions:
  # Analog imports TypeScript's named ESM exports but omits its dependency.
  # Bind the existing app compiler instead of inheriting hoisted TypeScript 5.4,
  # whose CJS namespace has no createPrinter export (Vitest dies at startup).
  '@analogjs/vite-plugin-angular@2.6.4':
    dependencies:
      typescript: 6.0.3

# Vitest-JIT resource-transformer workaround (re-cut for Angular 22, 2026-07-30).
# @angular/build's createJitResourceTransformer relies on ts.visitEachChild, which
# no-ops on the synthetic source files Vitest's JIT pipeline hands it, so component
# styles/templates never get rewritten to imports. The patch adds a manual
# statement-iteration fallback. Defect confirmed still present at 22.1.0 (identical
# visitEachChild logic at the same anchor). Re-cut this patch on every @angular/build
# bump; verify node_modules/@angular/build/src/tools/angular/transformers/
# jit-resource-transformer.js carries the fallback after install.
patchedDependencies:
  '@angular/build@22.1.0': patches/@angular__build@22.1.0.patch