# SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
# The workspace and its supply-chain policy (app-template AT-D6). One version per
# dependency lives in the catalogs below, so two packages of this repository can
# never disagree about React, zod or the kit.
packages:
  - apps/*
  - config
  - modules

# A version published less than seven days ago is not installed: the window in which
# a compromised release of a popular package is found and yanked.
minimumReleaseAge: 10080
# A package the kit depends on at an exact version is reviewed at the kit's own gate,
# and the kit is installed from the ConusAI vendor registry, not from a public one.
# The two vendor scopes are excluded as a whole: every dev bundle publishes them minutes
# before a deployment installs them, so the cooldown would reject each one (stage,
# deployment 5, 2026-10-20: ERR_PNPM_NO_MATURE_MATCHING_VERSION).
minimumReleaseAgeExclude:
  # convex and convex-helpers are pinned at the versions the kit's convex profile is tested
  # against; both publish more often than the seven-day window.
  - convex
  - convex-helpers
  - kysely
  - pg
  - pg-boss
  - jose
  - openid-client
  - "@conusai-sdk/*"
  - "@conusai-kit/*"
  # The kit's live collections (@conusai-kit/ui/data) pin the TanStack DB release candidate the
  # platform client is tested against; RC builds publish more often than the seven-day window.
  - "@tanstack/db"
  - "@tanstack/db-ivm"
  - "@tanstack/react-db"
  # kit:convex-better-auth:begin
  # Reviewed 2026-11-12 security patch family, validated against the actual Convex
  # runtime; exact versions only. Remove once the seven-day cooldown has elapsed.
  - "better-auth@1.7.22"
  - "@better-auth/core@1.7.22"
  - "@better-auth/drizzle-adapter@1.7.22"
  - "@better-auth/kysely-adapter@1.7.22"
  - "@better-auth/memory-adapter@1.7.22"
  - "@better-auth/mongo-adapter@1.7.22"
  - "@better-auth/prisma-adapter@1.7.22"
  - "@better-auth/telemetry@1.7.22"
  # kit:convex-better-auth:end
# A resolution never moves backwards when the lockfile is refreshed.
trustPolicy: no-downgrade
# One exact version, and the policy stays on for everything else. semver@6.3.1 reaches this app through
# @tanstack/react-start > @tanstack/start-plugin-core > @babel/core. It is an old, widely used 6.x backport,
# published three days after 7.5.4 and, unlike it, with no provenance, which the policy reads as a downgrade.
trustPolicyExclude:
  - semver@6.3.1
# Install scripts run for nothing that is not named here. pnpm 11+ fails an install on any
# unreviewed build script, so each one is denied by name (esbuild ships its
# platform binary as an optional dependency and needs no postinstall).
allowBuilds:
  esbuild: false
  # msgpackr (bullmq's encoder) falls back to its JavaScript implementation without the native addon.
  msgpackr-extract: false
# A dependency may not be pulled from a git URL, a tarball URL or a local path.
blockExoticSubdeps: true
catalogs:
  # The kernel. Every version is the one the template was generated from; `kit upgrade`
  # moves them together with the codemods for that step.
  kit:
    "@conusai-kit/notifications": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/agent": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/account": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/auth": 0.1.1-rel.0.1.0-beta.114
    "@conusai-kit/auth-convex-better-auth": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/brand": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/business": 0.2.0-rel.0.1.0-beta.114
    "@conusai-kit/cli": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/core": 0.1.1-rel.0.1.0-beta.114
    "@conusai-kit/data": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/data-convex": 0.1.2-rel.0.1.0-beta.114
    "@conusai-kit/data-kysely": 0.1.1-rel.0.1.0-beta.114
    "@conusai-kit/data-mongo": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/files": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/guides": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/host": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/i18n": 0.2.0-rel.0.1.0-beta.114
    "@conusai-kit/jobs-bullmq": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/jobs-pgboss": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/live-server": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/money": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/platform": 0.1.2-rel.0.1.0-beta.114
    "@conusai-kit/proposals": 0.1.1-rel.0.1.0-beta.114
    "@conusai-kit/support": 0.1.1-rel.0.1.0-beta.114
    "@conusai-kit/tenancy": 0.1.0-rel.0.1.0-beta.114
    "@conusai-kit/testing": 0.1.1-rel.0.1.0-beta.114
    "@conusai-kit/ui": 0.1.0-rel.0.1.0-beta.114
  default:
    "@jsquash/webp": 1.5.0
    "@resvg/resvg-wasm": 2.6.2
    "@playwright/test": 1.63.0
    axe-core: 4.14.0
    "@conusai-sdk/convex-audit": 0.1.4-rel.0.1.0-beta.114
    "@conusai-sdk/blob": 0.0.7-rel.0.1.0-beta.114
    "@conusai-sdk/guides": 0.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/guides-widget": 0.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/support": 0.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/support-widget": 0.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/ai": 0.3.0-rel.0.1.0-beta.114
    "@conusai-sdk/usage": 0.1.1-rel.0.1.0-beta.114
    "@conusai-sdk/node-sdk": 0.2.6-rel.0.1.0-beta.114
    "@conusai-sdk/observe": 0.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/observe-start": 0.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/observe-node": 0.1.1-rel.0.1.0-beta.114
    "@conusai-sdk/observe-testing": 0.1.0-rel.0.1.0-beta.114
    "@modelcontextprotocol/client": 2.3.1
    "@conusai-sdk/ocr": 0.6.0-rel.0.1.0-beta.114
    # Generated business-service clients: pin each SDK's source version; the bundle adds its release suffix.
    "@conusai-sdk/activities": 1.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/inventory": 1.2.0-rel.0.1.0-beta.114
    "@conusai-sdk/crm": 1.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/catalog": 1.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/archive": 1.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/invoicing": 1.1.0-rel.0.1.0-beta.114
    "@conusai-sdk/ledger": 1.1.0-rel.0.1.0-beta.114
    "@types/pg": 8.23.1
    # 19.3.0 omits JSX.ElementType from jsx-runtime and rejects ReactNode components.
    # Keep the verified JSX contract until the upstream definitions are repaired.
    "@types/react": 19.2.3
    "@types/react-dom": 19.3.0
    # The web shell's host (F10, docs/reference/app-kit.md): TanStack Start on Vite, served by Hono's Node
    # server in production. The versions are the ones the kit's Start host proof was built with (M5).
    "@hono/node-server": 2.1.5
    "@tanstack/react-router": 1.170.46
    "@tanstack/react-start": 1.169.4
    "@vitejs/plugin-react": 6.1.2
    hono: 4.13.14
    vite: 8.3.5
    # The Convex runtime, helpers and the audit component are the convex profile's deploy surface
    # (spec 5.4); pinned like every other dependency.
    convex: 1.45.0
    convex-helpers: 0.1.124
    # kit:convex-better-auth:begin -- the Convex Better Auth adapter's set (AUTH_PROVIDER=convex-better-auth;
    # @conusai-kit/auth-convex-better-auth pins and tests it on the platform's self-hosted Convex image).
    "@convex-dev/better-auth": 0.13.0
    "better-auth": 1.7.22
    # kit:convex-better-auth:end
    ioredis: 5.11.1
    kysely: 0.29.7
    mongodb: 6.22.0
    pg: 8.23.1
    pg-boss: 12.37.1
    react: 19.3.1
    react-dom: 19.3.1
    # The kit validates a module manifest with `instanceof z.ZodType`, so the app and the
    # kit must resolve one copy of zod: this is the kit's own pin.
    zod: 4.6.7
    wawoff2: 2.0.1