diff --git a/.devcontainer/docker-compose.yaml b/.devcontainer/docker-compose.yaml index bb46f81..1558626 100644 --- a/.devcontainer/docker-compose.yaml +++ b/.devcontainer/docker-compose.yaml @@ -27,7 +27,7 @@ services: condition: service_healthy db: - image: postgres:17-alpine + image: postgres:17.9-alpine restart: unless-stopped environment: POSTGRES_USER: skeleton diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 0dd2e5a..9c1c0f2 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -38,6 +38,7 @@ jobs: echo "All zsh plugins verified" ' pnpm format:check + pnpm lint:pinning pnpm lint pnpm db:push pnpm test diff --git a/AGENTS.md b/AGENTS.md index b9ade3f..fb5aab6 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -4,3 +4,13 @@ - Shared types and schemas live in `packages/shared` — don't duplicate them. - Database access goes through `packages/db` — never import Prisma directly in apps. - Auth config is in `packages/auth` — apps consume it, not define it. + +## Pinning policy + +To prevent silent drift from upstream rebuilds and unreviewed minor bumps, all external references in this repo are pinned and enforced by `pnpm lint:pinning` (CI fails on violations): + +- **Docker images** (`Dockerfile`, `docker-compose*.yaml`): tag must be `major.minor[.patch]` — e.g. `postgres:17.9-alpine`, `node:26.0-slim`. A SHA digest (`@sha256:…`) is also accepted. Bare `postgres:17` or `latest` is rejected. +- **npm dependencies** (every workspace `package.json`, all four dep maps): range must be exact (`1.2.3`) or `~major.minor.patch` (`~1.2.3`). `^`, `*`, `latest`, bare-major (`~25`), and unbounded ranges are rejected. `workspace:*`, `link:`, `file:`, `npm:` aliases (whose version must also satisfy the rule), and git/http URLs are allowed. +- **GitHub Actions**: pinned to a full SHA, enforced at the repo level via the "Require actions pinned to SHA" setting (no extra lint needed). + +Dependabot still produces minor/patch PRs against these pinned ranges — bumps become reviewed events, not silent drift. When raising a pin, update the manifest and run `pnpm install` so the lockfile follows. diff --git a/apps/api/package.json b/apps/api/package.json index 525abcb..7da2db3 100644 --- a/apps/api/package.json +++ b/apps/api/package.json @@ -12,23 +12,23 @@ "test:integration": "vitest run --project api:integration" }, "dependencies": { - "@hono/node-server": "^2.0.2", - "@hono/swagger-ui": "^0.6.1", - "@hono/zod-openapi": "^1.3.0", - "@prisma/client": "^7.8.0", + "@hono/node-server": "~2.0.2", + "@hono/swagger-ui": "~0.6.1", + "@hono/zod-openapi": "~1.3.0", + "@prisma/client": "~7.8.0", "@skeleton/auth": "workspace:*", "@skeleton/db": "workspace:*", "@skeleton/shared": "workspace:*", - "hono": "^4.12.18", - "zod": "^4.4.3" + "hono": "~4.12.18", + "zod": "~4.4.3" }, "devDependencies": { - "@types/node": "^25", - "@vitest/ui": "^4.1.5", - "better-auth": "^1.6.9", - "tsup": "^8.4.0", - "tsx": "^4.19.0", - "typescript": "^6", - "vitest": "^4.1.5" + "@types/node": "~25.6.2", + "@vitest/ui": "~4.1.5", + "better-auth": "~1.6.9", + "tsup": "~8.5.1", + "tsx": "~4.21.0", + "typescript": "~6.0.3", + "vitest": "~4.1.5" } } diff --git a/apps/web/package.json b/apps/web/package.json index a9d0dee..3629f69 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -12,49 +12,49 @@ "test:e2e:ui": "playwright test --ui" }, "dependencies": { - "@base-ui/react": "^1.4.1", - "@dnd-kit/core": "^6.3.1", - "@dnd-kit/modifiers": "^9.0.0", - "@dnd-kit/sortable": "^10.0.0", - "@dnd-kit/utilities": "^3.2.2", + "@base-ui/react": "~1.4.1", + "@dnd-kit/core": "~6.3.1", + "@dnd-kit/modifiers": "~9.0.0", + "@dnd-kit/sortable": "~10.0.0", + "@dnd-kit/utilities": "~3.2.2", "@skeleton/api-client": "workspace:*", "@skeleton/auth": "workspace:*", "@skeleton/shared": "workspace:*", - "@tabler/icons-react": "^3.44.0", - "@tanstack/react-table": "^8.21.3", - "class-variance-authority": "^0.7.1", - "clsx": "^2.1.1", - "lucide-react": "^1.14.0", + "@tabler/icons-react": "~3.44.0", + "@tanstack/react-table": "~8.21.3", + "class-variance-authority": "~0.7.1", + "clsx": "~2.1.1", + "lucide-react": "~1.14.0", "next": "16.2.6", - "next-themes": "^0.4.6", + "next-themes": "~0.4.6", "react": "19.2.6", "react-dom": "19.2.6", - "recharts": "^3.8.0", - "server-only": "^0.0.1", - "shadcn": "^4.7.0", - "sonner": "^2.0.7", - "swr": "^2.4.1", - "tailwind-merge": "^3.5.0", - "tw-animate-css": "^1.4.0", - "vaul": "^1.1.2", - "zod": "^4.4.3" + "recharts": "~3.8.1", + "server-only": "~0.0.1", + "shadcn": "~4.7.0", + "sonner": "~2.0.7", + "swr": "~2.4.1", + "tailwind-merge": "~3.5.0", + "tw-animate-css": "~1.4.0", + "vaul": "~1.1.2", + "zod": "~4.4.3" }, "devDependencies": { - "@eslint-react/eslint-plugin": "^5.7.5", + "@eslint-react/eslint-plugin": "~5.7.5", "@next/eslint-plugin-next": "16.2.6", - "@playwright/test": "^1.59.1", - "@tailwindcss/postcss": "^4.3.0", - "@types/node": "^25", - "@types/react": "^19", - "@types/react-dom": "^19", - "eslint": "^10", - "eslint-config-prettier": "^10.1.8", - "eslint-import-resolver-typescript": "^4.4.4", - "eslint-plugin-better-tailwindcss": "^4.5.0", - "eslint-plugin-import-x": "^4.16.2", - "tailwindcss": "^4.3.0", - "typescript": "^6", - "typescript-eslint": "^8.59.2", - "vitest": "^4.1.5" + "@playwright/test": "~1.59.1", + "@tailwindcss/postcss": "~4.3.0", + "@types/node": "~25.6.2", + "@types/react": "~19.2.14", + "@types/react-dom": "~19.2.3", + "eslint": "~10.3.0", + "eslint-config-prettier": "~10.1.8", + "eslint-import-resolver-typescript": "~4.4.4", + "eslint-plugin-better-tailwindcss": "~4.5.0", + "eslint-plugin-import-x": "~4.16.2", + "tailwindcss": "~4.3.0", + "typescript": "~6.0.3", + "typescript-eslint": "~8.59.2", + "vitest": "~4.1.5" } } diff --git a/package.json b/package.json index 130b19b..bd5ad03 100644 --- a/package.json +++ b/package.json @@ -6,6 +6,7 @@ "dev": "bash .devcontainer/check-env.sh && turbo dev test:ui", "build": "turbo build", "lint": "turbo lint", + "lint:pinning": "node scripts/check-pinning.mjs", "format": "prettier --write .", "format:check": "prettier --check .", "codegen:openapi": "turbo codegen:openapi", @@ -19,14 +20,14 @@ "reset": "pnpm clean && pnpm install && pnpm build && pnpm dev" }, "devDependencies": { - "@types/node": "^25.6.2", - "@vitest/coverage-v8": "^4.1.5", - "@vitest/ui": "^4.1.5", - "prettier": "^3.8.3", - "prettier-plugin-tailwindcss": "^0.8.0", - "turbo": "^2.9.12", - "typescript": "^6.0.3", - "vitest": "^4.1.5" + "@types/node": "~25.6.2", + "@vitest/coverage-v8": "~4.1.5", + "@vitest/ui": "~4.1.5", + "prettier": "~3.8.3", + "prettier-plugin-tailwindcss": "~0.8.0", + "turbo": "~2.9.12", + "typescript": "~6.0.3", + "vitest": "~4.1.5" }, "packageManager": "pnpm@10.33.0", "pnpm": { diff --git a/packages/api-client/package.json b/packages/api-client/package.json index 4cec5a3..dfbeef3 100644 --- a/packages/api-client/package.json +++ b/packages/api-client/package.json @@ -12,10 +12,10 @@ "codegen": "openapi-typescript ../api-spec/openapi.yaml -o src/schema.d.ts" }, "dependencies": { - "openapi-fetch": "^0.17.0" + "openapi-fetch": "~0.17.0" }, "devDependencies": { - "openapi-typescript": "^7.8.0", - "typescript": "^6" + "openapi-typescript": "~7.13.0", + "typescript": "~6.0.3" } } diff --git a/packages/api-spec/package.json b/packages/api-spec/package.json index 5655da1..2307ae0 100644 --- a/packages/api-spec/package.json +++ b/packages/api-spec/package.json @@ -7,8 +7,8 @@ "codegen:openapi": "tsx scripts/generate-spec.ts" }, "devDependencies": { - "tsx": "^4.19.0", - "typescript": "^6", - "yaml": "^2.8.4" + "tsx": "~4.21.0", + "typescript": "~6.0.3", + "yaml": "~2.8.4" } } diff --git a/packages/auth/package.json b/packages/auth/package.json index d372cc0..494c055 100644 --- a/packages/auth/package.json +++ b/packages/auth/package.json @@ -15,12 +15,12 @@ }, "dependencies": { "@skeleton/db": "workspace:*", - "@prisma/client": "^7.8.0", - "better-auth": "^1.6.9", - "zod": "^4.4.3" + "@prisma/client": "~7.8.0", + "better-auth": "~1.6.9", + "zod": "~4.4.3" }, "devDependencies": { - "@types/node": "^25", - "typescript": "^6" + "@types/node": "~25.6.2", + "typescript": "~6.0.3" } } diff --git a/packages/db/package.json b/packages/db/package.json index 4833722..98024ec 100644 --- a/packages/db/package.json +++ b/packages/db/package.json @@ -15,11 +15,11 @@ "studio": "prisma studio" }, "dependencies": { - "@prisma/adapter-pg": "^7.8.0", - "@prisma/client": "^7.8.0" + "@prisma/adapter-pg": "~7.8.0", + "@prisma/client": "~7.8.0" }, "devDependencies": { - "prisma": "^7.8.0", - "typescript": "^6" + "prisma": "~7.8.0", + "typescript": "~6.0.3" } } diff --git a/packages/shared/package.json b/packages/shared/package.json index e41f0e0..675045c 100644 --- a/packages/shared/package.json +++ b/packages/shared/package.json @@ -14,10 +14,10 @@ "test": "vitest run --project shared" }, "dependencies": { - "zod": "^4.4.3" + "zod": "~4.4.3" }, "devDependencies": { - "typescript": "^6", - "vitest": "^4.1.5" + "typescript": "~6.0.3", + "vitest": "~4.1.5" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index feb942c..f5061dc 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -9,43 +9,43 @@ importers: .: devDependencies: '@types/node': - specifier: ^25.6.2 + specifier: ~25.6.2 version: 25.6.2 '@vitest/coverage-v8': - specifier: ^4.1.5 + specifier: ~4.1.5 version: 4.1.5(vitest@4.1.5) '@vitest/ui': - specifier: ^4.1.5 + specifier: ~4.1.5 version: 4.1.5(vitest@4.1.5) prettier: - specifier: ^3.8.3 + specifier: ~3.8.3 version: 3.8.3 prettier-plugin-tailwindcss: - specifier: ^0.8.0 + specifier: ~0.8.0 version: 0.8.0(prettier@3.8.3) turbo: - specifier: ^2.9.12 + specifier: ~2.9.12 version: 2.9.12 typescript: - specifier: ^6.0.3 + specifier: ~6.0.3 version: 6.0.3 vitest: - specifier: ^4.1.5 + specifier: ~4.1.5 version: 4.1.5(@opentelemetry/api@1.9.1)(@types/node@25.6.2)(@vitest/coverage-v8@4.1.5)(@vitest/ui@4.1.5)(msw@2.14.3(@types/node@25.6.2)(typescript@6.0.3))(vite@8.0.8(@types/node@25.6.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.47.1)(tsx@4.21.0)(yaml@2.8.4)) apps/api: dependencies: '@hono/node-server': - specifier: ^2.0.2 + specifier: ~2.0.2 version: 2.0.2(hono@4.12.18) '@hono/swagger-ui': - specifier: ^0.6.1 + specifier: ~0.6.1 version: 0.6.1(hono@4.12.18) '@hono/zod-openapi': - specifier: ^1.3.0 + specifier: ~1.3.0 version: 1.3.0(hono@4.12.18)(zod@4.4.3) '@prisma/client': - specifier: ^7.8.0 + specifier: ~7.8.0 version: 7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3) '@skeleton/auth': specifier: workspace:* @@ -57,50 +57,50 @@ importers: specifier: workspace:* version: link:../../packages/shared hono: - specifier: ^4.12.18 + specifier: ~4.12.18 version: 4.12.18 zod: - specifier: ^4.4.3 + specifier: ~4.4.3 version: 4.4.3 devDependencies: '@types/node': - specifier: ^25 + specifier: ~25.6.2 version: 25.6.2 '@vitest/ui': - specifier: ^4.1.5 + specifier: ~4.1.5 version: 4.1.5(vitest@4.1.5) better-auth: - specifier: ^1.6.9 + specifier: ~1.6.9 version: 1.6.9(@opentelemetry/api@1.9.1)(@prisma/client@7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3))(mysql2@3.15.3)(next@16.2.6(@opentelemetry/api@1.9.1)(@playwright/test@1.59.1)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(pg@8.20.0)(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(vitest@4.1.5) tsup: - specifier: ^8.4.0 + specifier: ~8.5.1 version: 8.5.1(jiti@2.7.0)(postcss@8.5.14)(tsx@4.21.0)(typescript@6.0.3)(yaml@2.8.4) tsx: - specifier: ^4.19.0 + specifier: ~4.21.0 version: 4.21.0 typescript: - specifier: ^6 + specifier: ~6.0.3 version: 6.0.3 vitest: - specifier: ^4.1.5 + specifier: ~4.1.5 version: 4.1.5(@opentelemetry/api@1.9.1)(@types/node@25.6.2)(@vitest/coverage-v8@4.1.5)(@vitest/ui@4.1.5)(msw@2.14.3(@types/node@25.6.2)(typescript@6.0.3))(vite@8.0.8(@types/node@25.6.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.47.1)(tsx@4.21.0)(yaml@2.8.4)) apps/web: dependencies: '@base-ui/react': - specifier: ^1.4.1 + specifier: ~1.4.1 version: 1.4.1(@date-fns/tz@1.4.1)(@types/react@19.2.14)(date-fns@4.1.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) '@dnd-kit/core': - specifier: ^6.3.1 + specifier: ~6.3.1 version: 6.3.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6) '@dnd-kit/modifiers': - specifier: ^9.0.0 + specifier: ~9.0.0 version: 9.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6) '@dnd-kit/sortable': - specifier: ^10.0.0 + specifier: ~10.0.0 version: 10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6) '@dnd-kit/utilities': - specifier: ^3.2.2 + specifier: ~3.2.2 version: 3.2.2(react@19.2.6) '@skeleton/api-client': specifier: workspace:* @@ -112,25 +112,25 @@ importers: specifier: workspace:* version: link:../../packages/shared '@tabler/icons-react': - specifier: ^3.44.0 + specifier: ~3.44.0 version: 3.44.0(react@19.2.6) '@tanstack/react-table': - specifier: ^8.21.3 + specifier: ~8.21.3 version: 8.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6) class-variance-authority: - specifier: ^0.7.1 + specifier: ~0.7.1 version: 0.7.1 clsx: - specifier: ^2.1.1 + specifier: ~2.1.1 version: 2.1.1 lucide-react: - specifier: ^1.14.0 + specifier: ~1.14.0 version: 1.14.0(react@19.2.6) next: specifier: 16.2.6 version: 16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.59.1)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) next-themes: - specifier: ^0.4.6 + specifier: ~0.4.6 version: 0.4.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6) react: specifier: 19.2.6 @@ -139,156 +139,156 @@ importers: specifier: 19.2.6 version: 19.2.6(react@19.2.6) recharts: - specifier: ^3.8.0 + specifier: ~3.8.1 version: 3.8.1(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react-is@18.3.1)(react@19.2.6)(redux@5.0.1) server-only: - specifier: ^0.0.1 + specifier: ~0.0.1 version: 0.0.1 shadcn: - specifier: ^4.7.0 + specifier: ~4.7.0 version: 4.7.0(@types/node@25.6.2)(typescript@6.0.3) sonner: - specifier: ^2.0.7 + specifier: ~2.0.7 version: 2.0.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6) swr: - specifier: ^2.4.1 + specifier: ~2.4.1 version: 2.4.1(react@19.2.6) tailwind-merge: - specifier: ^3.5.0 + specifier: ~3.5.0 version: 3.5.0 tw-animate-css: - specifier: ^1.4.0 + specifier: ~1.4.0 version: 1.4.0 vaul: - specifier: ^1.1.2 + specifier: ~1.1.2 version: 1.1.2(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) zod: - specifier: ^4.4.3 + specifier: ~4.4.3 version: 4.4.3 devDependencies: '@eslint-react/eslint-plugin': - specifier: ^5.7.5 + specifier: ~5.7.5 version: 5.7.5(eslint@10.3.0(jiti@2.7.0))(typescript@6.0.3) '@next/eslint-plugin-next': specifier: 16.2.6 version: 16.2.6 '@playwright/test': - specifier: ^1.59.1 + specifier: ~1.59.1 version: 1.59.1 '@tailwindcss/postcss': - specifier: ^4.3.0 + specifier: ~4.3.0 version: 4.3.0 '@types/node': - specifier: ^25 + specifier: ~25.6.2 version: 25.6.2 '@types/react': - specifier: ^19 + specifier: ~19.2.14 version: 19.2.14 '@types/react-dom': - specifier: ^19 + specifier: ~19.2.3 version: 19.2.3(@types/react@19.2.14) eslint: - specifier: ^10 + specifier: ~10.3.0 version: 10.3.0(jiti@2.7.0) eslint-config-prettier: - specifier: ^10.1.8 + specifier: ~10.1.8 version: 10.1.8(eslint@10.3.0(jiti@2.7.0)) eslint-import-resolver-typescript: - specifier: ^4.4.4 + specifier: ~4.4.4 version: 4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.59.2(eslint@10.3.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.3.0(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.3.0(jiti@2.7.0)) eslint-plugin-better-tailwindcss: - specifier: ^4.5.0 + specifier: ~4.5.0 version: 4.5.0(eslint@10.3.0(jiti@2.7.0))(tailwindcss@4.3.0)(typescript@6.0.3) eslint-plugin-import-x: - specifier: ^4.16.2 + specifier: ~4.16.2 version: 4.16.2(@typescript-eslint/utils@8.59.2(eslint@10.3.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.3.0(jiti@2.7.0)) tailwindcss: - specifier: ^4.3.0 + specifier: ~4.3.0 version: 4.3.0 typescript: - specifier: ^6 + specifier: ~6.0.3 version: 6.0.3 typescript-eslint: - specifier: ^8.59.2 + specifier: ~8.59.2 version: 8.59.2(eslint@10.3.0(jiti@2.7.0))(typescript@6.0.3) vitest: - specifier: ^4.1.5 + specifier: ~4.1.5 version: 4.1.5(@opentelemetry/api@1.9.1)(@types/node@25.6.2)(@vitest/coverage-v8@4.1.5)(@vitest/ui@4.1.5)(msw@2.14.3(@types/node@25.6.2)(typescript@6.0.3))(vite@8.0.8(@types/node@25.6.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.47.1)(tsx@4.21.0)(yaml@2.8.4)) packages/api-client: dependencies: openapi-fetch: - specifier: ^0.17.0 + specifier: ~0.17.0 version: 0.17.0 devDependencies: openapi-typescript: - specifier: ^7.8.0 + specifier: ~7.13.0 version: 7.13.0(typescript@6.0.3) typescript: - specifier: ^6 + specifier: ~6.0.3 version: 6.0.3 packages/api-spec: devDependencies: tsx: - specifier: ^4.19.0 + specifier: ~4.21.0 version: 4.21.0 typescript: - specifier: ^6 + specifier: ~6.0.3 version: 6.0.3 yaml: - specifier: ^2.8.4 + specifier: ~2.8.4 version: 2.8.4 packages/auth: dependencies: '@prisma/client': - specifier: ^7.8.0 + specifier: ~7.8.0 version: 7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3) '@skeleton/db': specifier: workspace:* version: link:../db better-auth: - specifier: ^1.6.9 + specifier: ~1.6.9 version: 1.6.9(@opentelemetry/api@1.9.1)(@prisma/client@7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3))(mysql2@3.15.3)(next@16.2.6(@opentelemetry/api@1.9.1)(@playwright/test@1.59.1)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(pg@8.20.0)(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(vitest@4.1.5) zod: - specifier: ^4.4.3 + specifier: ~4.4.3 version: 4.4.3 devDependencies: '@types/node': - specifier: ^25 + specifier: ~25.6.2 version: 25.6.2 typescript: - specifier: ^6 + specifier: ~6.0.3 version: 6.0.3 packages/db: dependencies: '@prisma/adapter-pg': - specifier: ^7.8.0 + specifier: ~7.8.0 version: 7.8.0 '@prisma/client': - specifier: ^7.8.0 + specifier: ~7.8.0 version: 7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3) devDependencies: prisma: - specifier: ^7.8.0 + specifier: ~7.8.0 version: 7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3) typescript: - specifier: ^6 + specifier: ~6.0.3 version: 6.0.3 packages/shared: dependencies: zod: - specifier: ^4.4.3 + specifier: ~4.4.3 version: 4.4.3 devDependencies: typescript: - specifier: ^6 + specifier: ~6.0.3 version: 6.0.3 vitest: - specifier: ^4.1.5 + specifier: ~4.1.5 version: 4.1.5(@opentelemetry/api@1.9.1)(@types/node@25.6.2)(@vitest/coverage-v8@4.1.5)(@vitest/ui@4.1.5)(msw@2.14.3(@types/node@25.6.2)(typescript@6.0.3))(vite@8.0.8(@types/node@25.6.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.47.1)(tsx@4.21.0)(yaml@2.8.4)) packages: @@ -1591,277 +1591,139 @@ packages: '@rolldown/pluginutils@1.0.0-rc.15': resolution: {integrity: sha512-UromN0peaE53IaBRe9W7CjrZgXl90fqGpK+mIZbA3qSTeYqg3pqpROBdIPvOG3F5ereDHNwoHBI2e50n1BDr1g==} - '@rollup/rollup-android-arm-eabi@4.60.1': - resolution: {integrity: sha512-d6FinEBLdIiK+1uACUttJKfgZREXrF0Qc2SmLII7W2AD8FfiZ9Wjd+rD/iRuf5s5dWrr1GgwXCvPqOuDquOowA==} - cpu: [arm] - os: [android] - '@rollup/rollup-android-arm-eabi@4.60.3': resolution: {integrity: sha512-x35CNW/ANXG3hE/EZpRU8MXX1JDN86hBb2wMGAtltkz7pc6cxgjpy1OMMfDosOQ+2hWqIkag/fGok1Yady9nGw==} cpu: [arm] os: [android] - '@rollup/rollup-android-arm64@4.60.1': - resolution: {integrity: sha512-YjG/EwIDvvYI1YvYbHvDz/BYHtkY4ygUIXHnTdLhG+hKIQFBiosfWiACWortsKPKU/+dUwQQCKQM3qrDe8c9BA==} - cpu: [arm64] - os: [android] - '@rollup/rollup-android-arm64@4.60.3': resolution: {integrity: sha512-xw3xtkDApIOGayehp2+Rz4zimfkaX65r4t47iy+ymQB2G4iJCBBfj0ogVg5jpvjpn8UWn/+q9tprxleYeNp3Hw==} cpu: [arm64] os: [android] - '@rollup/rollup-darwin-arm64@4.60.1': - resolution: {integrity: sha512-mjCpF7GmkRtSJwon+Rq1N8+pI+8l7w5g9Z3vWj4T7abguC4Czwi3Yu/pFaLvA3TTeMVjnu3ctigusqWUfjZzvw==} - cpu: [arm64] - os: [darwin] - '@rollup/rollup-darwin-arm64@4.60.3': resolution: {integrity: sha512-vo6Y5Qfpx7/5EaamIwi0WqW2+zfiusVihKatLvtN1VFVy3D13uERk/6gZLU1UiHRL6fDXqj/ELIeVRGnvcTE1g==} cpu: [arm64] os: [darwin] - '@rollup/rollup-darwin-x64@4.60.1': - resolution: {integrity: sha512-haZ7hJ1JT4e9hqkoT9R/19XW2QKqjfJVv+i5AGg57S+nLk9lQnJ1F/eZloRO3o9Scy9CM3wQ9l+dkXtcBgN5Ew==} - cpu: [x64] - os: [darwin] - '@rollup/rollup-darwin-x64@4.60.3': resolution: {integrity: sha512-D+0QGcZhBzTN82weOnsSlY7V7+RMmPuF1CkbxyMAGE8+ZHeUjyb76ZiWmBlCu//AQQONvxcqRbwZTajZKqjuOw==} cpu: [x64] os: [darwin] - '@rollup/rollup-freebsd-arm64@4.60.1': - resolution: {integrity: sha512-czw90wpQq3ZsAVBlinZjAYTKduOjTywlG7fEeWKUA7oCmpA8xdTkxZZlwNJKWqILlq0wehoZcJYfBvOyhPTQ6w==} - cpu: [arm64] - os: [freebsd] - '@rollup/rollup-freebsd-arm64@4.60.3': resolution: {integrity: sha512-6HnvHCT7fDyj6R0Ph7A6x8dQS/S38MClRWeDLqc0MdfWkxjiu1HSDYrdPhqSILzjTIC/pnXbbJbo+ft+gy/9hQ==} cpu: [arm64] os: [freebsd] - '@rollup/rollup-freebsd-x64@4.60.1': - resolution: {integrity: sha512-KVB2rqsxTHuBtfOeySEyzEOB7ltlB/ux38iu2rBQzkjbwRVlkhAGIEDiiYnO2kFOkJp+Z7pUXKyrRRFuFUKt+g==} - cpu: [x64] - os: [freebsd] - '@rollup/rollup-freebsd-x64@4.60.3': resolution: {integrity: sha512-KHLgC3WKlUYW3ShFKnnosZDOJ0xjg9zp7au3sIm2bs/tGBeC2ipmvRh/N7JKi0t9Ue20C0dpEshi8WUubg+cnA==} cpu: [x64] os: [freebsd] - '@rollup/rollup-linux-arm-gnueabihf@4.60.1': - resolution: {integrity: sha512-L+34Qqil+v5uC0zEubW7uByo78WOCIrBvci69E7sFASRl0X7b/MB6Cqd1lky/CtcSVTydWa2WZwFuWexjS5o6g==} - cpu: [arm] - os: [linux] - libc: [glibc] - '@rollup/rollup-linux-arm-gnueabihf@4.60.3': resolution: {integrity: sha512-DV6fJoxEYWJOvaZIsok7KrYl0tPvga5OZ2yvKHNNYyk/2roMLqQAbGhr78EQ5YhHpnhLKJD3S1WFusAkmUuV5g==} cpu: [arm] os: [linux] libc: [glibc] - '@rollup/rollup-linux-arm-musleabihf@4.60.1': - resolution: {integrity: sha512-n83O8rt4v34hgFzlkb1ycniJh7IR5RCIqt6mz1VRJD6pmhRi0CXdmfnLu9dIUS6buzh60IvACM842Ffb3xd6Gg==} - cpu: [arm] - os: [linux] - libc: [musl] - '@rollup/rollup-linux-arm-musleabihf@4.60.3': resolution: {integrity: sha512-mQKoJAzvuOs6F+TZybQO4GOTSMUu7v0WdxEk24krQ/uUxXoPTtHjuaUuPmFhtBcM4K0ons8nrE3JyhTuCFtT/w==} cpu: [arm] os: [linux] libc: [musl] - '@rollup/rollup-linux-arm64-gnu@4.60.1': - resolution: {integrity: sha512-Nql7sTeAzhTAja3QXeAI48+/+GjBJ+QmAH13snn0AJSNL50JsDqotyudHyMbO2RbJkskbMbFJfIJKWA6R1LCJQ==} - cpu: [arm64] - os: [linux] - libc: [glibc] - '@rollup/rollup-linux-arm64-gnu@4.60.3': resolution: {integrity: sha512-Whjj2qoiJ6+OOJMGptTYazaJvjOJm+iKHpXQM1P3LzGjt7Ff++Tp7nH4N8J/BUA7R9IHfDyx4DJIflifwnbmIA==} cpu: [arm64] os: [linux] libc: [glibc] - '@rollup/rollup-linux-arm64-musl@4.60.1': - resolution: {integrity: sha512-+pUymDhd0ys9GcKZPPWlFiZ67sTWV5UU6zOJat02M1+PiuSGDziyRuI/pPue3hoUwm2uGfxdL+trT6Z9rxnlMA==} - cpu: [arm64] - os: [linux] - libc: [musl] - '@rollup/rollup-linux-arm64-musl@4.60.3': resolution: {integrity: sha512-4YTNHKqGng5+yiZt3mg77nmyuCfmNfX4fPmyUapBcIk+BdwSwmCWGXOUxhXbBEkFHtoN5boLj/5NON+u5QC9tg==} cpu: [arm64] os: [linux] libc: [musl] - '@rollup/rollup-linux-loong64-gnu@4.60.1': - resolution: {integrity: sha512-VSvgvQeIcsEvY4bKDHEDWcpW4Yw7BtlKG1GUT4FzBUlEKQK0rWHYBqQt6Fm2taXS+1bXvJT6kICu5ZwqKCnvlQ==} - cpu: [loong64] - os: [linux] - libc: [glibc] - '@rollup/rollup-linux-loong64-gnu@4.60.3': resolution: {integrity: sha512-SU3kNlhkpI4UqlUc2VXPGK9o886ZsSeGfMAX2ba2b8DKmMXq4AL7KUrkSWVbb7koVqx41Yczx6dx5PNargIrEA==} cpu: [loong64] os: [linux] libc: [glibc] - '@rollup/rollup-linux-loong64-musl@4.60.1': - resolution: {integrity: sha512-4LqhUomJqwe641gsPp6xLfhqWMbQV04KtPp7/dIp0nzPxAkNY1AbwL5W0MQpcalLYk07vaW9Kp1PBhdpZYYcEw==} - cpu: [loong64] - os: [linux] - libc: [musl] - '@rollup/rollup-linux-loong64-musl@4.60.3': resolution: {integrity: sha512-6lDLl5h4TXpB1mTf2rQWnAk/LcXrx9vBfu/DT5TIPhvMhRWaZ5MxkIc8u4lJAmBo6klTe1ywXIUHFjylW505sg==} cpu: [loong64] os: [linux] libc: [musl] - '@rollup/rollup-linux-ppc64-gnu@4.60.1': - resolution: {integrity: sha512-tLQQ9aPvkBxOc/EUT6j3pyeMD6Hb8QF2BTBnCQWP/uu1lhc9AIrIjKnLYMEroIz/JvtGYgI9dF3AxHZNaEH0rw==} - cpu: [ppc64] - os: [linux] - libc: [glibc] - '@rollup/rollup-linux-ppc64-gnu@4.60.3': resolution: {integrity: sha512-BMo8bOw8evlup/8G+cj5xWtPyp93xPdyoSN16Zy90Q2QZ0ZYRhCt6ZJSwbrRzG9HApFabjwj2p25TUPDWrhzqQ==} cpu: [ppc64] os: [linux] libc: [glibc] - '@rollup/rollup-linux-ppc64-musl@4.60.1': - resolution: {integrity: sha512-RMxFhJwc9fSXP6PqmAz4cbv3kAyvD1etJFjTx4ONqFP9DkTkXsAMU4v3Vyc5BgzC+anz7nS/9tp4obsKfqkDHg==} - cpu: [ppc64] - os: [linux] - libc: [musl] - '@rollup/rollup-linux-ppc64-musl@4.60.3': resolution: {integrity: sha512-E0L8X1dZN1/Rph+5VPF6Xj2G7JJvMACVXtamTJIDrVI44Y3K+G8gQaMEAavbqCGTa16InptiVrX6eM6pmJ+7qA==} cpu: [ppc64] os: [linux] libc: [musl] - '@rollup/rollup-linux-riscv64-gnu@4.60.1': - resolution: {integrity: sha512-QKgFl+Yc1eEk6MmOBfRHYF6lTxiiiV3/z/BRrbSiW2I7AFTXoBFvdMEyglohPj//2mZS4hDOqeB0H1ACh3sBbg==} - cpu: [riscv64] - os: [linux] - libc: [glibc] - '@rollup/rollup-linux-riscv64-gnu@4.60.3': resolution: {integrity: sha512-oZJ/WHaVfHUiRAtmTAeo3DcevNsVvH8mbvodjZy7D5QKvCefO371SiKRpxoDcCxB3PTRTLayWBkvmDQKTcX/sw==} cpu: [riscv64] os: [linux] libc: [glibc] - '@rollup/rollup-linux-riscv64-musl@4.60.1': - resolution: {integrity: sha512-RAjXjP/8c6ZtzatZcA1RaQr6O1TRhzC+adn8YZDnChliZHviqIjmvFwHcxi4JKPSDAt6Uhf/7vqcBzQJy0PDJg==} - cpu: [riscv64] - os: [linux] - libc: [musl] - '@rollup/rollup-linux-riscv64-musl@4.60.3': resolution: {integrity: sha512-Dhbyh7j9FybM3YaTgaHmVALwA8AkUwTPccyCQ79TG9AJUsMQqgN1DDEZNr4+QUfwiWvLDumW5vdwzoeUF+TNxQ==} cpu: [riscv64] os: [linux] libc: [musl] - '@rollup/rollup-linux-s390x-gnu@4.60.1': - resolution: {integrity: sha512-wcuocpaOlaL1COBYiA89O6yfjlp3RwKDeTIA0hM7OpmhR1Bjo9j31G1uQVpDlTvwxGn2nQs65fBFL5UFd76FcQ==} - cpu: [s390x] - os: [linux] - libc: [glibc] - '@rollup/rollup-linux-s390x-gnu@4.60.3': resolution: {integrity: sha512-cJd1X5XhHHlltkaypz1UcWLA8AcoIi1aWhsvaWDskD1oz2eKCypnqvTQ8ykMNI0RSmm7NkTdSqSSD7zM0xa6Ig==} cpu: [s390x] os: [linux] libc: [glibc] - '@rollup/rollup-linux-x64-gnu@4.60.1': - resolution: {integrity: sha512-77PpsFQUCOiZR9+LQEFg9GClyfkNXj1MP6wRnzYs0EeWbPcHs02AXu4xuUbM1zhwn3wqaizle3AEYg5aeoohhg==} - cpu: [x64] - os: [linux] - libc: [glibc] - '@rollup/rollup-linux-x64-gnu@4.60.3': resolution: {integrity: sha512-DAZDBHQfG2oQuhY7mc6I3/qB4LU2fQCjRvxbDwd/Jdvb9fypP4IJ4qmtu6lNjes6B531AI8cg1aKC2di97bUxA==} cpu: [x64] os: [linux] libc: [glibc] - '@rollup/rollup-linux-x64-musl@4.60.1': - resolution: {integrity: sha512-5cIATbk5vynAjqqmyBjlciMJl1+R/CwX9oLk/EyiFXDWd95KpHdrOJT//rnUl4cUcskrd0jCCw3wpZnhIHdD9w==} - cpu: [x64] - os: [linux] - libc: [musl] - '@rollup/rollup-linux-x64-musl@4.60.3': resolution: {integrity: sha512-cRxsE8c13mZOh3vP+wLDxpQBRrOHDIGOWyDL93Sy0Ga8y515fBcC2pjUfFwUe5T7tqvTvWbCpg1URM/AXdWIXA==} cpu: [x64] os: [linux] libc: [musl] - '@rollup/rollup-openbsd-x64@4.60.1': - resolution: {integrity: sha512-cl0w09WsCi17mcmWqqglez9Gk8isgeWvoUZ3WiJFYSR3zjBQc2J5/ihSjpl+VLjPqjQ/1hJRcqBfLjssREQILw==} - cpu: [x64] - os: [openbsd] - '@rollup/rollup-openbsd-x64@4.60.3': resolution: {integrity: sha512-QaWcIgRxqEdQdhJqW4DJctsH6HCmo5vHxY0krHSX4jMtOqfzC+dqDGuHM87bu4H8JBeibWx7jFz+h6/4C8wA5Q==} cpu: [x64] os: [openbsd] - '@rollup/rollup-openharmony-arm64@4.60.1': - resolution: {integrity: sha512-4Cv23ZrONRbNtbZa37mLSueXUCtN7MXccChtKpUnQNgF010rjrjfHx3QxkS2PI7LqGT5xXyYs1a7LbzAwT0iCA==} - cpu: [arm64] - os: [openharmony] - '@rollup/rollup-openharmony-arm64@4.60.3': resolution: {integrity: sha512-AaXwSvUi3QIPtroAUw1t5yHGIyqKEXwH54WUocFolZhpGDruJcs8c+xPNDRn4XiQsS7MEwnYsHW2l0MBLDMkWg==} cpu: [arm64] os: [openharmony] - '@rollup/rollup-win32-arm64-msvc@4.60.1': - resolution: {integrity: sha512-i1okWYkA4FJICtr7KpYzFpRTHgy5jdDbZiWfvny21iIKky5YExiDXP+zbXzm3dUcFpkEeYNHgQ5fuG236JPq0g==} - cpu: [arm64] - os: [win32] - '@rollup/rollup-win32-arm64-msvc@4.60.3': resolution: {integrity: sha512-65LAKM/bAWDqKNEelHlcHvm2V+Vfb8C6INFxQXRHCvaVN1rJfwr4NvdP4FyzUaLqWfaCGaadf6UbTm8xJeYfEg==} cpu: [arm64] os: [win32] - '@rollup/rollup-win32-ia32-msvc@4.60.1': - resolution: {integrity: sha512-u09m3CuwLzShA0EYKMNiFgcjjzwqtUMLmuCJLeZWjjOYA3IT2Di09KaxGBTP9xVztWyIWjVdsB2E9goMjZvTQg==} - cpu: [ia32] - os: [win32] - '@rollup/rollup-win32-ia32-msvc@4.60.3': resolution: {integrity: sha512-EEM2gyhBF5MFnI6vMKdX1LAosE627RGBzIoGMdLloPZkXrUN0Ckqgr2Qi8+J3zip/8NVVro3/FjB+tjhZUgUHA==} cpu: [ia32] os: [win32] - '@rollup/rollup-win32-x64-gnu@4.60.1': - resolution: {integrity: sha512-k+600V9Zl1CM7eZxJgMyTUzmrmhB/0XZnF4pRypKAlAgxmedUA+1v9R+XOFv56W4SlHEzfeMtzujLJD22Uz5zg==} - cpu: [x64] - os: [win32] - '@rollup/rollup-win32-x64-gnu@4.60.3': resolution: {integrity: sha512-E5Eb5H/DpxaoXH++Qkv28RcUJboMopmdDUALBczvHMf7hNIxaDZqwY5lK12UK1BHacSmvupoEWGu+n993Z0y1A==} cpu: [x64] os: [win32] - '@rollup/rollup-win32-x64-msvc@4.60.1': - resolution: {integrity: sha512-lWMnixq/QzxyhTV6NjQJ4SFo1J6PvOX8vUx5Wb4bBPsEb+8xZ89Bz6kOXpfXj9ak9AHTQVQzlgzBEc1SyM27xQ==} - cpu: [x64] - os: [win32] - '@rollup/rollup-win32-x64-msvc@4.60.3': resolution: {integrity: sha512-hPt/bgL5cE+Qp+/TPHBqptcAgPzgj46mPcg/16zNUmbQk0j+mOEQV/+Lqu8QRtDV3Ek95Q6FeFITpuhl6OTsAA==} cpu: [x64] @@ -2030,9 +1892,6 @@ packages: cpu: [arm64] os: [win32] - '@tybys/wasm-util@0.10.1': - resolution: {integrity: sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==} - '@tybys/wasm-util@0.10.2': resolution: {integrity: sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==} @@ -2145,10 +2004,6 @@ packages: eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/types@8.58.0': - resolution: {integrity: sha512-O9CjxypDT89fbHxRfETNoAnHj/i6IpRK0CvbVN3qibxlLdo5p5hcLmUuCCrHMpxiWSwKyI8mCP7qRNYuOJ0Uww==} - engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@typescript-eslint/types@8.59.2': resolution: {integrity: sha512-e82GVOE8Ps3E++Egvb6Y3Dw0S10u8NkQ9KXmtRhCWJJ8kDhOJTvtMAWnFL16kB1583goCWXsr0NieKCZMs2/0Q==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} @@ -2924,10 +2779,6 @@ packages: resolution: {integrity: sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==} engines: {node: '>= 0.8'} - enhanced-resolve@5.21.0: - resolution: {integrity: sha512-otxSQPw4lkOZWkHpB3zaEQs6gWYEsmX4xQF68ElXC/TWvGxGMSGOvoNbaLXm6/cS/fSfHtsEdw90y20PCd+sCA==} - engines: {node: '>=10.13.0'} - enhanced-resolve@5.21.2: resolution: {integrity: sha512-xe9vQb5kReirPUxgQrXA3ihgbCqssmTiM7cOZ+Gzu+VeGWgpV98lLZvp0dl4yriyAePcewxGUs9UpKD8PET9KQ==} engines: {node: '>=10.13.0'} @@ -3724,17 +3575,10 @@ packages: resolution: {integrity: sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==} engines: {node: '>=8'} - jiti@2.6.1: - resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==} - hasBin: true - jiti@2.7.0: resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==} hasBin: true - jose@6.2.2: - resolution: {integrity: sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ==} - jose@6.2.3: resolution: {integrity: sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==} @@ -4632,11 +4476,6 @@ packages: engines: {node: ^20.19.0 || >=22.12.0} hasBin: true - rollup@4.60.1: - resolution: {integrity: sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w==} - engines: {node: '>=18.0.0', npm: '>=8.0.0'} - hasBin: true - rollup@4.60.3: resolution: {integrity: sha512-pAQK9HalE84QSm4Po3EmWIZPd3FnjkShVkiMlz1iligWYkWQ7wHYd1PF/T7QZ5TVSD6uSTon5gBVMSM4JfBV+A==} engines: {node: '>=18.0.0', npm: '>=8.0.0'} @@ -4955,10 +4794,6 @@ packages: resolution: {integrity: sha512-VKS/ZaQhhkKFMANmAOhhXVoIfBXblQxGX1myCQ2faQrfmobMftXeJPcZGp0gS07ocvGJWDLZGyOZDadDBqYIJg==} engines: {node: '>=18'} - tinyglobby@0.2.15: - resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==} - engines: {node: '>=12.0.0'} - tinyglobby@0.2.16: resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==} engines: {node: '>=12.0.0'} @@ -5622,53 +5457,53 @@ snapshots: '@bcoe/v8-coverage@1.0.2': {} - '@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0)': + '@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0)': dependencies: '@better-auth/utils': 0.4.0 '@better-fetch/fetch': 1.1.21 '@opentelemetry/semantic-conventions': 1.40.0 '@standard-schema/spec': 1.1.0 better-call: 1.3.5(zod@4.4.3) - jose: 6.2.2 + jose: 6.2.3 kysely: 0.28.16 nanostores: 1.3.0 zod: 4.4.3 optionalDependencies: '@opentelemetry/api': 1.9.1 - '@better-auth/drizzle-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)': + '@better-auth/drizzle-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)': dependencies: - '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0) + '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0) '@better-auth/utils': 0.4.0 - '@better-auth/kysely-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(kysely@0.28.16)': + '@better-auth/kysely-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(kysely@0.28.16)': dependencies: - '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0) + '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0) '@better-auth/utils': 0.4.0 optionalDependencies: kysely: 0.28.16 - '@better-auth/memory-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)': + '@better-auth/memory-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)': dependencies: - '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0) + '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0) '@better-auth/utils': 0.4.0 - '@better-auth/mongo-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)': + '@better-auth/mongo-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)': dependencies: - '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0) + '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0) '@better-auth/utils': 0.4.0 - '@better-auth/prisma-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(@prisma/client@7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3))(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))': + '@better-auth/prisma-adapter@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(@prisma/client@7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3))(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))': dependencies: - '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0) + '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0) '@better-auth/utils': 0.4.0 optionalDependencies: '@prisma/client': 7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3) prisma: 7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3) - '@better-auth/telemetry@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)': + '@better-auth/telemetry@1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)': dependencies: - '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0) + '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0) '@better-auth/utils': 0.4.0 '@better-fetch/fetch': 1.1.21 @@ -6159,7 +5994,7 @@ snapshots: dependencies: '@emnapi/core': 1.9.2 '@emnapi/runtime': 1.10.0 - '@tybys/wasm-util': 0.10.1 + '@tybys/wasm-util': 0.10.2 optional: true '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.9.2)(@emnapi/runtime@1.9.2)': @@ -6590,153 +6425,78 @@ snapshots: '@rolldown/pluginutils@1.0.0-rc.15': {} - '@rollup/rollup-android-arm-eabi@4.60.1': - optional: true - '@rollup/rollup-android-arm-eabi@4.60.3': optional: true - '@rollup/rollup-android-arm64@4.60.1': - optional: true - '@rollup/rollup-android-arm64@4.60.3': optional: true - '@rollup/rollup-darwin-arm64@4.60.1': - optional: true - '@rollup/rollup-darwin-arm64@4.60.3': optional: true - '@rollup/rollup-darwin-x64@4.60.1': - optional: true - '@rollup/rollup-darwin-x64@4.60.3': optional: true - '@rollup/rollup-freebsd-arm64@4.60.1': - optional: true - '@rollup/rollup-freebsd-arm64@4.60.3': optional: true - '@rollup/rollup-freebsd-x64@4.60.1': - optional: true - '@rollup/rollup-freebsd-x64@4.60.3': optional: true - '@rollup/rollup-linux-arm-gnueabihf@4.60.1': - optional: true - '@rollup/rollup-linux-arm-gnueabihf@4.60.3': optional: true - '@rollup/rollup-linux-arm-musleabihf@4.60.1': - optional: true - '@rollup/rollup-linux-arm-musleabihf@4.60.3': optional: true - '@rollup/rollup-linux-arm64-gnu@4.60.1': - optional: true - '@rollup/rollup-linux-arm64-gnu@4.60.3': optional: true - '@rollup/rollup-linux-arm64-musl@4.60.1': - optional: true - '@rollup/rollup-linux-arm64-musl@4.60.3': optional: true - '@rollup/rollup-linux-loong64-gnu@4.60.1': - optional: true - '@rollup/rollup-linux-loong64-gnu@4.60.3': optional: true - '@rollup/rollup-linux-loong64-musl@4.60.1': - optional: true - '@rollup/rollup-linux-loong64-musl@4.60.3': optional: true - '@rollup/rollup-linux-ppc64-gnu@4.60.1': - optional: true - '@rollup/rollup-linux-ppc64-gnu@4.60.3': optional: true - '@rollup/rollup-linux-ppc64-musl@4.60.1': - optional: true - '@rollup/rollup-linux-ppc64-musl@4.60.3': optional: true - '@rollup/rollup-linux-riscv64-gnu@4.60.1': - optional: true - '@rollup/rollup-linux-riscv64-gnu@4.60.3': optional: true - '@rollup/rollup-linux-riscv64-musl@4.60.1': - optional: true - '@rollup/rollup-linux-riscv64-musl@4.60.3': optional: true - '@rollup/rollup-linux-s390x-gnu@4.60.1': - optional: true - '@rollup/rollup-linux-s390x-gnu@4.60.3': optional: true - '@rollup/rollup-linux-x64-gnu@4.60.1': - optional: true - '@rollup/rollup-linux-x64-gnu@4.60.3': optional: true - '@rollup/rollup-linux-x64-musl@4.60.1': - optional: true - '@rollup/rollup-linux-x64-musl@4.60.3': optional: true - '@rollup/rollup-openbsd-x64@4.60.1': - optional: true - '@rollup/rollup-openbsd-x64@4.60.3': optional: true - '@rollup/rollup-openharmony-arm64@4.60.1': - optional: true - '@rollup/rollup-openharmony-arm64@4.60.3': optional: true - '@rollup/rollup-win32-arm64-msvc@4.60.1': - optional: true - '@rollup/rollup-win32-arm64-msvc@4.60.3': optional: true - '@rollup/rollup-win32-ia32-msvc@4.60.1': - optional: true - '@rollup/rollup-win32-ia32-msvc@4.60.3': optional: true - '@rollup/rollup-win32-x64-gnu@4.60.1': - optional: true - '@rollup/rollup-win32-x64-gnu@4.60.3': optional: true - '@rollup/rollup-win32-x64-msvc@4.60.1': - optional: true - '@rollup/rollup-win32-x64-msvc@4.60.3': optional: true @@ -6863,11 +6623,6 @@ snapshots: '@turbo/windows-arm64@2.9.12': optional: true - '@tybys/wasm-util@0.10.1': - dependencies: - tslib: 2.8.1 - optional: true - '@tybys/wasm-util@0.10.2': dependencies: tslib: 2.8.1 @@ -6999,8 +6754,6 @@ snapshots: transitivePeerDependencies: - supports-color - '@typescript-eslint/types@8.58.0': {} - '@typescript-eslint/types@8.59.2': {} '@typescript-eslint/typescript-estree@8.59.2(typescript@6.0.3)': @@ -7299,20 +7052,20 @@ snapshots: better-auth@1.6.9(@opentelemetry/api@1.9.1)(@prisma/client@7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3))(mysql2@3.15.3)(next@16.2.6(@opentelemetry/api@1.9.1)(@playwright/test@1.59.1)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(pg@8.20.0)(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(vitest@4.1.5): dependencies: - '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0) - '@better-auth/drizzle-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0) - '@better-auth/kysely-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(kysely@0.28.16) - '@better-auth/memory-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0) - '@better-auth/mongo-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0) - '@better-auth/prisma-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(@prisma/client@7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3))(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3)) - '@better-auth/telemetry': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.2)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21) + '@better-auth/core': 1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0) + '@better-auth/drizzle-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0) + '@better-auth/kysely-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(kysely@0.28.16) + '@better-auth/memory-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0) + '@better-auth/mongo-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0) + '@better-auth/prisma-adapter': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(@prisma/client@7.8.0(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3))(typescript@6.0.3))(prisma@7.8.0(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(magicast@0.5.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.3)) + '@better-auth/telemetry': 1.6.9(@better-auth/core@1.6.9(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.16)(nanostores@1.3.0))(@better-auth/utils@0.4.0)(@better-fetch/fetch@1.1.21) '@better-auth/utils': 0.4.0 '@better-fetch/fetch': 1.1.21 '@noble/ciphers': 2.2.0 '@noble/hashes': 2.2.0 better-call: 1.3.5(zod@4.4.3) defu: 6.1.7 - jose: 6.2.2 + jose: 6.2.3 kysely: 0.28.16 nanostores: 1.3.0 zod: 4.4.3 @@ -7711,11 +7464,6 @@ snapshots: encodeurl@2.0.0: {} - enhanced-resolve@5.21.0: - dependencies: - graceful-fs: 4.2.11 - tapable: 2.3.3 - enhanced-resolve@5.21.2: dependencies: graceful-fs: 4.2.11 @@ -7882,7 +7630,7 @@ snapshots: get-tsconfig: 4.13.7 is-bun-module: 2.0.0 stable-hash-x: 0.2.0 - tinyglobby: 0.2.15 + tinyglobby: 0.2.16 unrs-resolver: 1.11.1 optionalDependencies: eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.2(eslint@10.3.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.3.0(jiti@2.7.0)) @@ -7906,8 +7654,8 @@ snapshots: dependencies: '@eslint/css-tree': 4.0.2 '@valibot/to-json-schema': 1.6.0(valibot@1.3.1(typescript@6.0.3)) - enhanced-resolve: 5.21.0 - jiti: 2.6.1 + enhanced-resolve: 5.21.2 + jiti: 2.7.0 synckit: 0.11.12 tailwind-csstree: 0.3.1 tailwindcss: 4.3.0 @@ -7922,7 +7670,7 @@ snapshots: eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.59.2(eslint@10.3.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.3.0(jiti@2.7.0)): dependencies: '@package-json/types': 0.0.12 - '@typescript-eslint/types': 8.58.0 + '@typescript-eslint/types': 8.59.2 comment-parser: 1.4.6 debug: 4.4.3(supports-color@10.2.2) eslint: 10.3.0(jiti@2.7.0) @@ -8719,12 +8467,8 @@ snapshots: html-escaper: 2.0.2 istanbul-lib-report: 3.0.1 - jiti@2.6.1: {} - jiti@2.7.0: {} - jose@6.2.2: {} - jose@6.2.3: {} joycon@3.1.1: {} @@ -9560,37 +9304,6 @@ snapshots: '@rolldown/binding-win32-arm64-msvc': 1.0.0-rc.15 '@rolldown/binding-win32-x64-msvc': 1.0.0-rc.15 - rollup@4.60.1: - dependencies: - '@types/estree': 1.0.8 - optionalDependencies: - '@rollup/rollup-android-arm-eabi': 4.60.1 - '@rollup/rollup-android-arm64': 4.60.1 - '@rollup/rollup-darwin-arm64': 4.60.1 - '@rollup/rollup-darwin-x64': 4.60.1 - '@rollup/rollup-freebsd-arm64': 4.60.1 - '@rollup/rollup-freebsd-x64': 4.60.1 - '@rollup/rollup-linux-arm-gnueabihf': 4.60.1 - '@rollup/rollup-linux-arm-musleabihf': 4.60.1 - '@rollup/rollup-linux-arm64-gnu': 4.60.1 - '@rollup/rollup-linux-arm64-musl': 4.60.1 - '@rollup/rollup-linux-loong64-gnu': 4.60.1 - '@rollup/rollup-linux-loong64-musl': 4.60.1 - '@rollup/rollup-linux-ppc64-gnu': 4.60.1 - '@rollup/rollup-linux-ppc64-musl': 4.60.1 - '@rollup/rollup-linux-riscv64-gnu': 4.60.1 - '@rollup/rollup-linux-riscv64-musl': 4.60.1 - '@rollup/rollup-linux-s390x-gnu': 4.60.1 - '@rollup/rollup-linux-x64-gnu': 4.60.1 - '@rollup/rollup-linux-x64-musl': 4.60.1 - '@rollup/rollup-openbsd-x64': 4.60.1 - '@rollup/rollup-openharmony-arm64': 4.60.1 - '@rollup/rollup-win32-arm64-msvc': 4.60.1 - '@rollup/rollup-win32-ia32-msvc': 4.60.1 - '@rollup/rollup-win32-x64-gnu': 4.60.1 - '@rollup/rollup-win32-x64-msvc': 4.60.1 - fsevents: 2.3.3 - rollup@4.60.3: dependencies: '@types/estree': 1.0.8 @@ -9956,7 +9669,7 @@ snapshots: lines-and-columns: 1.2.4 mz: 2.7.0 pirates: 4.0.7 - tinyglobby: 0.2.15 + tinyglobby: 0.2.16 ts-interface-checker: 0.1.13 supports-color@10.2.2: {} @@ -10012,11 +9725,6 @@ snapshots: tinyexec@1.1.1: {} - tinyglobby@0.2.15: - dependencies: - fdir: 6.5.0(picomatch@4.0.4) - picomatch: 4.0.4 - tinyglobby@0.2.16: dependencies: fdir: 6.5.0(picomatch@4.0.4) @@ -10093,11 +9801,11 @@ snapshots: picocolors: 1.1.1 postcss-load-config: 6.0.1(jiti@2.7.0)(postcss@8.5.14)(tsx@4.21.0)(yaml@2.8.4) resolve-from: 5.0.0 - rollup: 4.60.1 + rollup: 4.60.3 source-map: 0.7.6 sucrase: 3.35.1 tinyexec: 0.3.2 - tinyglobby: 0.2.15 + tinyglobby: 0.2.16 tree-kill: 1.2.2 optionalDependencies: postcss: 8.5.14 diff --git a/scripts/check-pinning.mjs b/scripts/check-pinning.mjs new file mode 100644 index 0000000..40e181d --- /dev/null +++ b/scripts/check-pinning.mjs @@ -0,0 +1,183 @@ +#!/usr/bin/env node +// Enforce repo-wide pinning policy for Docker images and npm dependency ranges. +// See AGENTS.md > "Pinning policy" and issue #106. + +import fs from "node:fs"; +import path from "node:path"; + +const repoRoot = process.cwd(); +const violations = []; + +const record = (file, line, message) => { + violations.push({ + file: path.relative(repoRoot, file) || file, + line, + message, + }); +}; + +// ---- Docker --------------------------------------------------------------- + +// Tag must start with a numeric major.minor and may continue with .patch and +// a single suffix run like -alpine / -slim / -bookworm-slim. Rejects bare "17", +// "17-alpine", "latest", "x", etc. The suffix is one optional group (not a +// repetition) to avoid ambiguous backtracking. +const DOCKER_TAG_RE = /^[0-9]+\.[0-9]+(?:\.[0-9]+)?(?:[._-][A-Za-z0-9._-]*)?$/; +const DOCKER_DIGEST_RE = /@sha256:[a-f0-9]{64}$/; + +const checkDockerRef = (file, lineNo, ref) => { + if (ref === "scratch") return; + if (DOCKER_DIGEST_RE.test(ref)) return; + // For host:port/image:tag, the tag colon comes after the last slash. + const lastSlash = ref.lastIndexOf("/"); + const tagColonIdx = ref.indexOf(":", lastSlash + 1); + if (tagColonIdx === -1) { + record( + file, + lineNo, + `image has no tag (must be major.minor[.patch] or @sha256:digest): ${ref}`, + ); + return; + } + const tag = ref.slice(tagColonIdx + 1); + if (!DOCKER_TAG_RE.test(tag)) { + record( + file, + lineNo, + `image tag must be major.minor[.patch] or @sha256:digest: ${ref}`, + ); + } +}; + +const scanDockerfile = (file) => { + const lines = fs.readFileSync(file, "utf8").split("\n"); + lines.forEach((line, i) => { + const m = line.match(/^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)/i); + if (m) checkDockerRef(file, i + 1, m[1]); + }); +}; + +const scanComposeFile = (file) => { + const lines = fs.readFileSync(file, "utf8").split("\n"); + lines.forEach((line, i) => { + if (/^\s*#/.test(line)) return; + const m = line.match(/^\s*image:\s*["']?([^"'\s#]+)["']?/); + if (m) checkDockerRef(file, i + 1, m[1]); + }); +}; + +// ---- npm ------------------------------------------------------------------ + +// Allows tilde or exact pin: ~1.2.3, =1.2.3, 1.2.3, with optional prerelease/build. +const NPM_OK_RE = /^(~|=)?\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/; + +const checkNpmRange = (file, depName, range) => { + if (typeof range !== "string") { + record(file, 0, `${depName}: non-string range (${JSON.stringify(range)})`); + return; + } + if ( + range.startsWith("workspace:") || + range.startsWith("link:") || + range.startsWith("file:") || + range.startsWith("git+") || + range.startsWith("git://") || + range.startsWith("git@") || + range.startsWith("github:") || + range.startsWith("http://") || + range.startsWith("https://") + ) { + return; + } + if (range.startsWith("npm:")) { + const aliasSpec = range.slice(4); + const atIdx = aliasSpec.lastIndexOf("@"); + if (atIdx <= 0) { + record(file, 0, `${depName}: malformed npm: alias (${range})`); + return; + } + const aliasVersion = aliasSpec.slice(atIdx + 1); + if (!NPM_OK_RE.test(aliasVersion)) { + record( + file, + 0, + `${depName}: aliased version must be exact or ~major.minor.patch (${range})`, + ); + } + return; + } + if (!NPM_OK_RE.test(range)) { + record( + file, + 0, + `${depName}: must be exact or ~major.minor.patch (got "${range}")`, + ); + } +}; + +const scanPackageJson = (file) => { + let pkg; + try { + pkg = JSON.parse(fs.readFileSync(file, "utf8")); + } catch (err) { + record(file, 0, `failed to parse package.json: ${err.message}`); + return; + } + for (const key of [ + "dependencies", + "devDependencies", + "peerDependencies", + "optionalDependencies", + ]) { + const obj = pkg[key]; + if (!obj || typeof obj !== "object") continue; + for (const [name, range] of Object.entries(obj)) { + checkNpmRange(file, `${key}.${name}`, range); + } + } +}; + +// ---- Walk ----------------------------------------------------------------- + +const SKIP_DIRS = new Set([ + "node_modules", + ".next", + ".turbo", + ".pnpm-store", + "coverage", + "dist", + ".git", + "test-results", + "playwright-report", +]); + +const walk = (dir, onFile) => { + for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { + if (SKIP_DIRS.has(entry.name)) continue; + const full = path.join(dir, entry.name); + if (entry.isDirectory()) walk(full, onFile); + else onFile(full); + } +}; + +walk(repoRoot, (file) => { + const base = path.basename(file); + if (base === "package.json") scanPackageJson(file); + else if (/^docker-compose.*\.ya?ml$/.test(base)) scanComposeFile(file); + else if (base === "Dockerfile" || /^Dockerfile\..+/.test(base)) + scanDockerfile(file); +}); + +if (violations.length > 0) { + console.error("Pinning policy violations:"); + for (const v of violations) { + const loc = v.line ? `${v.file}:${v.line}` : v.file; + console.error(` ${loc} — ${v.message}`); + } + console.error( + `\n${violations.length} violation(s). Policy: AGENTS.md > Pinning policy.`, + ); + process.exit(1); +} + +console.log("Pinning policy: OK");