insights/pnpm-workspace.yaml

packages:
    - '.'
    - common/esbuilder
    - common/scriptvm/typescript
    - common/plugin_transpiler
    - common/storybook
    - common/replay-shared
    - common/replay-headless
    - common/tailwind
    - packages/quill
    - packages/quill/apps/*
    - packages/quill/packages/*
    - frontend
    # The design system lives under frontend/ but is its own package, and
    # products depend on it by name ("@hanzo/elements": "*"). Without this
    # entry pnpm does not know it is local, resolves that "*" against the npm
    # registry, and every install fails.
    - frontend/@hanzo/*
    - playwright
    - nodejs
    - nodejs/src/scripts
    - products/*
    # products/desktop is a nested standalone workspace (own lockfile, catalog,
    # overrides, Node version); the root install must not absorb it.
    - '!products/desktop'
    - docs/onboarding
    - services/agent-proxy
    - services/oauth-proxy
    - services/mcp
    - services/stripe-app
    - tools/*
    - '!tools/hedgebox-dummy'
    - rust/cyclotron-node
    - rust/common/scriptvm/node
    - rust/replay-anonymizer-node

blockExoticSubdeps: true

# Our workspace packages are not published, so a plain range like "*" has to
# resolve locally. pnpm 10 defaults this off, which sends every such range to
# the registry and 404s on the design system.
linkWorkspacePackages: true
trustPolicy: no-downgrade

# no-downgrade refuses a version published after a version that carried stronger
# trust evidence, on the reading that a package which used to sign and suddenly
# does not may have been taken over. Two semver versions trip it for a reason
# that is not a takeover, and neither can be pinned forward out of trouble:
#
#   7.5.1 shipped 2023-05-12 with provenance. The terminal security backports on
#   the legacy lines -- 5.7.2 and 6.3.1 -- shipped 2023-07-10 without it, because
#   those release paths predate the maintainer wiring provenance in. The policy
#   compares across the whole package rather than per major, so it reads the
#   older lines as a regression from the newer one.
#
# 5.7.2 and 6.3.1 are the LAST releases of 5.x and 6.x and no 5.x or 6.x release
# is attested at all, so there is no trusted version on either line to move to.
# The only pin available would be a major bump of a transitive dependency, which
# trades a real compatibility risk for a metadata gap.
#
# Excluded by exact version, never by name alone, so a future semver release is
# checked like anything else and this stays one reviewable line rather than a
# blanket switch-off. Everything else in the tree is still checked.
#
# Both versions belong to ONE entry joined by `||`. The matcher returns on the
# first rule whose NAME matches and hands back only that rule's version list, so
# a second `semver@...` line below is dead -- listing them separately excludes
# 5.7.2 and lets 6.3.1 fail, which is exactly how this first went wrong.
# The @typescript-eslint family is the same shape, checked package by package:
# 5.62.0 is the last stable 5.x of each (2023-07-10), NOT ONE 5.x release of any
# of them is attested, and the first attested version of each is 8.42.0, from
# 2025-09-02. So the comparison is a 2025 release against a 2023 one across the
# whole package, and there is no attested version on the line to move to.
#
# @stripe/ui-extension-tools pins them, so the alternative is a major bump inside
# somebody else's dependency. Until that lands, no dependency anywhere in this
# workspace can be added: the resolver reaches services/stripe-app on every
# install that is not served entirely from the lockfile.
#
# One entry per package NAME, per the matcher note above.
trustPolicyExclude:
    - [email protected] || 6.3.1
    - '@typescript-eslint/[email protected]'
    - '@typescript-eslint/[email protected]'
    - '@typescript-eslint/[email protected]'
    - '@typescript-eslint/[email protected]'
    - '@typescript-eslint/[email protected]'
    - '@typescript-eslint/[email protected]'
    - '@typescript-eslint/[email protected]'
    - '@typescript-eslint/[email protected]'

catalog:
    # Kea ecosystem - state management
    kea: ^4.0.0-pre.6
    kea-forms: ^3.2.0
    kea-loaders: ^3.1.1
    kea-localstorage: ^3.1.0
    kea-router: ^3.4.1
    kea-subscriptions: ^3.0.1
    kea-test-utils: ^0.2.4
    kea-waitfor: ^0.2.1
    kea-window-values: ^3.0.1
    # Insights packages
    #
    # Our icons are a published fork, so the specifier has to name it. The
    # rename turns the import into `@hanzo/icons`, but the package that backs
    # it is `@hanzo/insights-icons` -- a different package from the
    # `@hanzo/icons` that also exists on npm, and the only one that renders an
    # icon with `className="Icon"`. That class is the whole contract: the
    # package draws its SVGs at width 100% with no height, so an icon is sized
    # entirely by the `.Icon` rules in the design system, and one that arrives
    # under any other class paints at its container's width.
    #
    # Version lines are not shared with upstream -- upstream's ^0.38.0 is their
    # package's line; the fork's is 0.36.x -- so this does not track theirs.
    '@hanzo/icons': npm:@hanzo/[email protected]
    '@hanzo/react': ^1.9.0
    insights-js: ^1.410.1
    # Build tools
    '@parcel/packager-ts': 2.16.4
    '@parcel/transformer-typescript-types': 2.16.4
    typescript: 6.0.3
    oxfmt: ^0.57.0
    vite: ^8.1.0
    '@vitejs/plugin-react': ^5.2.0
    # Testing
    jest: ^29.7.0
    jest-junit: ^16.0.0
    '@types/jest': ^29.5.12
    '@types/node': ^22.13.14
    '@playwright/test': 1.60.0
    # Storybook
    '@storybook/react': ^10.4.3
    '@storybook/react-vite': ^10.4.3
    storybook: ^10.4.3
    # Common utilities
    fast-equals: ^6.0.0
    fuse.js: ^7.1.0
    query-selector-shadow-dom: ^1.0.0
    '@types/query-selector-shadow-dom': ^1.0.0
    ts-pattern: '4.3'
    use-debounce: ^9.0.3
    # React types
    '@types/react': ^18.3.27
    '@types/react-dom': ^18.3.7
    '@base-ui/react': 1.6.0
    # Other shared
    husky: ^7.0.4
    lint-staged: ~15.4.3
    concurrently: ^5.3.0
    yaml: ^2.8.2

    # Everything below resolves to exactly one version across the
    # workspace already; the catalog is where that version is written.
    # A name with more than one spec in use is not here -- hoisting it
    # would pick a winner and change what installs.
    '@amplitude/ua-parser-js': '^0.7.33'
    '@aws-sdk/client-dynamodb': '^3.952.0'
    '@aws-sdk/client-kms': '^3.952.0'
    '@aws-sdk/client-s3': '^3.723.0'
    '@aws-sdk/client-sesv2': '^3.980.0'
    '@aws-sdk/client-sts': '^3.975.0'
    '@aws-sdk/credential-provider-node': '^3.972.1'
    '@aws-sdk/lib-storage': '^3.723.0'
    '@babel/cli': '^7.22.5'
    '@babel/core': '^7.26.10'
    '@babel/parser': '^7.24.0'
    '@babel/plugin-transform-react-jsx': '^7.22.5'
    '@babel/preset-env': '^7.22.10'
    '@babel/preset-typescript': '^7.18.6'
    '@babel/runtime': '^7.26.10'
    '@babel/standalone': '^7.23.2'
    '@babel/traverse': '^7.24.0'
    '@babel/types': '^7.20.2'
    '@bufbuild/protobuf': '^2.11.0'
    '@bufbuild/protoc-gen-es': '^2.11.0'
    '@cloudflare/vitest-pool-workers': '^0.16.13'
    '@connectrpc/connect': '^2.1.1'
    '@connectrpc/connect-node': '^2.1.1'
    '@dagrejs/dagre': '^1.1.5'
    '@dsnp/parquetjs': '^1.8.7'
    '@eslint-community/eslint-plugin-eslint-comments': '^4.4.1'
    '@floating-ui/react': '^0.27.19'
    '@google-cloud/pubsub': 4.11.0
    '@google-cloud/storage': '^5.8.5'
    '@hanzo/appearance': '^0.1.4'
    '@hanzo/elements': '*'
    '@hanzo/insights': 1.358.1
    '@hanzo/insights-rrweb': 0.0.26
    '@hanzo/insights-rrweb-types': 0.0.26
    '@hono/node-server': '^2.0.2'
    '@jest/globals': '^30.0.5'
    '@jest/test-sequencer': '^30.0.5'
    '@marsidev/react-turnstile': '^1.4.2'
    '@mathjax/src': '^4.1.2'
    '@maxmind/geoip2-node': '^3.4.0'
    '@memlab/lens': 2.0.0
    '@microlink/react-json-view': '^1.31.18'
    '@microsoft/fetch-event-source': '^2.0.1'
    '@modelcontextprotocol/client': 2.0.0-beta.4
    '@modelcontextprotocol/ext-apps': '^1.5.0'
    '@monaco-editor/react': 4.7.0
    '@mongodb-js/zstd': '^7.0.0'
    '@opentelemetry/api': '^1.9.0'
    '@opentelemetry/auto-instrumentations-node': '^0.76.0'
    '@opentelemetry/exporter-metrics-otlp-http': '^0.218.0'
    '@opentelemetry/exporter-trace-otlp-grpc': '^0.218.0'
    '@opentelemetry/exporter-trace-otlp-http': '^0.218.0'
    '@opentelemetry/instrumentation-pg': '^0.70.0'
    '@opentelemetry/resources': '^2.0.1'
    '@opentelemetry/sdk-metrics': '^2.7.1'
    '@opentelemetry/sdk-node': '^0.218.0'
    '@opentelemetry/sdk-trace-node': '^2.0.1'
    '@opentelemetry/semantic-conventions': '^1.36.0'
    '@parcel/config-default': 2.16.4
    '@parcel/transformer-js': 2.16.4
    '@parcel/transformer-react-refresh-wrap': 2.16.4
    '@pierre/diffs': 1.2.11
    '@protomaps/basemaps': '^5.7.2'
    '@pyroscope/nodejs': '^0.4.8'
    '@radix-ui/react-accordion': '^1.2.12'
    '@radix-ui/react-context-menu': '^2.2.16'
    '@radix-ui/react-dismissable-layer': '^1.1.11'
    '@radix-ui/react-dropdown-menu': '^2.1.16'
    '@radix-ui/react-hover-card': '^1.1.15'
    '@radix-ui/react-popover': '^1.1.15'
    '@radix-ui/react-select': '^2.2.6'
    '@radix-ui/react-slot': '^1.2.4'
    '@radix-ui/react-tabs': '^1.1.13'
    '@radix-ui/react-toggle-group': '^1.1.11'
    '@react-hook/size': '^2.1.2'
    '@segment/action-destinations': 3.387.0
    '@segment/actions-core': '^3.151.0'
    '@shadcn/react': '^0.1.0'
    '@simplewebauthn/browser': '^13.2.2'
    '@storybook/addon-a11y': '^10.4.3'
    '@storybook/addon-docs': '^10.4.3'
    '@storybook/addon-links': '^10.4.3'
    '@storybook/csf': '^0.1.12'
    '@storybook/test-runner': '^0.24.4'
    '@stripe/react-stripe-js': '^2.8.0'
    '@stripe/stripe-js': '^4.5.0'
    '@stripe/ui-extension-sdk': 9.2.0-alpha.6
    '@stripe/ui-extension-tools': '^0.0.1'
    '@sucrase/jest-plugin': '^3.0.0'
    '@swc-node/register': '^1.11.1'
    '@tailwindcss/container-queries': 0.1.1
    '@tanstack/react-table': '^8.21.3'
    '@temporalio/activity': 1.15.0
    '@temporalio/client': 1.15.0
    '@temporalio/common': 1.15.0
    '@temporalio/proto': 1.15.0
    '@temporalio/worker': 1.15.0
    '@temporalio/workflow': 1.15.0
    '@toon-format/toon': '^2.1.0'
    '@trivago/prettier-plugin-sort-imports': '^5.2.2'
    '@types/adm-zip': '^0.4.34'
    '@types/babel__core': '^7.1.19'
    '@types/chance': '^1.1.7'
    '@types/chartjs-plugin-crosshair': '^1.1.1'
    '@types/chartjs-plugin-trendline': '^1.0.4'
    '@types/clone': '^2.1.1'
    '@types/cors': '^2.8.19'
    '@types/d3-array': '^3.2.1'
    '@types/d3-color': '^3.1.3'
    '@types/d3-scale': '^4.0.8'
    '@types/d3-selection': 3.0.3
    '@types/d3-shape': '^3.1.6'
    '@types/dompurify': '^3.0.3'
    '@types/dotenv': '^6.1.1'
    '@types/faker': '^5.5.7'
    '@types/he': '^1.2.3'
    '@types/heatmap.js': '^2.0.41'
    '@types/image-blob-reduce': '^4.1.1'
    '@types/ioredis': '^4.26.4'
    '@types/jsonwebtoken': '^9.0.10'
    '@types/libsodium-wrappers': '^0.7.14'
    '@types/lodash': '^4.17.16'
    '@types/lodash.difference': '^4.5.9'
    '@types/lodash.merge': '^4.6.9'
    '@types/lodash.sortby': '^4.7.9'
    '@types/lodash.throttle': '^4.1.1'
    '@types/lodash.uniqby': '^4.7.9'
    '@types/long': 4.x.x
    '@types/luxon': '^3.4.2'
    '@types/md5': '^2.3.0'
    '@types/node-fetch': '^2.5.10'
    '@types/node-schedule': '^2.1.0'
    '@types/nodemailer': '^8.0.0'
    '@types/pg': '~8.6.6'
    '@types/react-modal': '^3.13.1'
    '@types/react-simple-maps': '^3.0.6'
    '@types/redlock': '^4.0.1'
    '@types/snowflake-sdk': '^1.5.1'
    '@types/supertest': '^6.0.2'
    '@types/tail': '^2.2.1'
    '@types/testing-library__jest-dom': '^5.14.5'
    '@types/zxcvbn': '^4.4.0'
    '@typescript-eslint/eslint-plugin': '^8.58.2'
    '@typescript-eslint/parser': '^8.58.2'
    '@typescript/native-preview': 7.0.0-dev.20260707.2
    '@vapi-ai/web': 2.5.2
    ai: '^6.0.0'
    ajv: '^8.20.0'
    ajv-formats: '^3.0.1'
    ansi-colors: '*'
    avsc: '^5.7.9'
    aws-sdk: '^2.927.0'
    bloommx: '^1.0.3'
    buffer: '^6.0.3'
    caniuse-lite: '^1.0.30001689'
    chance: '^1.1.13'
    chart.js: '^4.5.1'
    chartjs-adapter-dayjs-3: '^1.2.3'
    chartjs-plugin-crosshair: 2.0.0
    chartjs-plugin-datalabels: '^2.2.0'
    chartjs-plugin-stacked100: 1.7.1
    chartjs-plugin-trendline: '^3.2.0'
    chartjs-plugin-zoom: '^2.2.0'
    class-variance-authority: '^0.7.1'
    core-js: '^3.40.0'
    cors: '^2.8.5'
    country-flag-emoji-polyfill: '^0.1.8'
    cron-parser: '^5.5.0'
    cronstrue: '^3.14.0'
    cssnano: '^7.0.6'
    cva: 1.0.0-beta.3
    d3-array: '^3.2.4'
    d3-color: '^3.1.0'
    d3-flame-graph: '^5.0.0'
    d3-scale: '^4.0.2'
    d3-shape: '^3.2.0'
    date-fns: '^4.0.0'
    dayjs: 1.11.11
    detect-browser: '^5.3.0'
    dompurify: '^3.4.0'
    dotenv: '^16.4.7'
    emoji-regex: '^10.4.0'
    esbuild: '^0.25.11'
    esbuild-plugin-less: '^1.3.17'
    esbuild-plugin-polyfill-node: 0.3.0
    esbuild-sass-plugin: 3.0.0
    esbuild-visualizer: '^0.6.0'
    escape-string-regexp: '^4.0.0'
    eslint-config-prettier: '^9.1.0'
    eslint-plugin-no-only-tests: '^3.1.0'
    express: '^4.22.2'
    fake-indexeddb: '^6.0.1'
    fastpriorityqueue: '^0.7.5'
    fernet-nodejs: '^1.0.6'
    fflate: '^0.8.2'
    frimousse: '^0.3.0'
    fs-extra: '^10.0.0'
    fzstd: '^0.1.1'
    generic-pool: '^3.7.1'
    happy-dom: '^20.9.0'
    hast-util-to-html: '^9.0.5'
    he: '^1.2.0'
    heatmap.js: '^2.0.5'
    highlight.js: '~11.11.0'
    history: '^5.0.1'
    html-to-image: '^1.11.13'
    http-server: '^14.1.1'
    https-proxy-agent: '^7.0.6'
    image-blob-reduce: '^4.1.0'
    ipaddr.js: '^2.1.0'
    jest-canvas-mock: '^2.4.0'
    jest-environment-jsdom: '^29.3.1'
    jest-environment-node: '^30.0.0'
    js-big-decimal: '^2.2.0'
    jsonwebtoken: '^9.0.2'
    kea-typegen: 3.8.3
    less: '^3.12.2'
    libsodium-wrappers: '^0.7.15'
    liquidjs: '^10.27.0'
    lodash: '^4.18.1'
    lodash.difference: '^4.5.0'
    lodash.merge: '^4.6.2'
    lodash.sortby: '^4.7.0'
    lodash.throttle: '^4.1.1'
    lodash.uniqby: '^4.7.0'
    lru-cache: '^11.0.0'
    lucide-react: '^0.577.0'
    lz4: '^0.6.5'
    maplibre-gl: '^3.5.1'
    markdownlint-cli2: '^0.18.1'
    md5: '^2.3.0'
    mdast-util-find-and-replace: '^3.0.2'
    mdast-util-from-markdown: '^2.0.3'
    mdast-util-gfm-table: '^2.0.0'
    mermaid: '^11.15.0'
    micromark-extension-gfm-table: '^2.1.1'
    mockdate: '^3.0.5'
    monaco-editor: '^0.55.1'
    monaco-vim: '^0.4.4'
    motion: '^12.26.1'
    natural-orderby: '^3.0.2'
    node-fetch: '^2.6.1'
    node-rdkafka: '^3.6.1'
    node-schedule: '^2.1.0'
    nodemailer: '^8.0.8'
    orval: 8.14.0
    oxlint: '^1.72.0'
    p-limit: 3.1.0
    parcel: '^2.16.4'
    partial-json: '^0.1.7'
    pg: '^8.6.0'
    pino: '^8.6.0'
    pino-pretty: '^9.1.0'
    playwright: 1.60.0
    pmtiles: '^2.11.0'
    postcss: '^8.5.15'
    postcss-preset-env: '^10.1.4'
    prettier: '~3.6.2'
    pretty-bytes: '^5.6.0'
    prom-client: '^14.2.0'
    prosemirror-collab: '^1.3.1'
    prosemirror-model: '^1.25.2'
    prosemirror-transform: '^1.10.4'
    puppeteer-capture: '^1.43.0'
    qrcode.react: '^4.2.0'
    re2js: '^0.4.1'
    react-data-grid: 7.0.0-beta.47
    react-draggable: '^4.5.0'
    react-email-editor: '^1.7.11'
    react-grid-layout: '^2.2.4'
    react-intersection-observer: '^9.5.3'
    react-markdown: '^9.0.0'
    react-modal: '^3.15.1'
    react-resizable-panels: '^4.7.1'
    react-shadow: '^20.3.0'
    react-simple-maps: '^3.0.0'
    react-textarea-autosize: '^8.3.3'
    react-toastify: '^10.0.0'
    react-virtualized-auto-sizer: '^2.0.2'
    remark-breaks: '^4.0.0'
    remark-gfm: '^4.0.0'
    safe-stable-stringify: '^2.4.3'
    sass: '^1.26.2'
    snappy: '^7.2.2'
    snappy-wasm: '^0.3.0'
    snappyjs: '^0.7.0'
    storybook-addon-pseudo-states: '^10.4.3'
    storybook-dark-mode: '^5.0.0'
    stream-browserify: '^3.0.0'
    stripe: '^20.4.1'
    stylelint-config-recess-order: '^4.6.0'
    stylelint-config-standard-scss: '^11.1.0'
    stylelint-order: '^6.0.4'
    sucrase: '^3.29.0'
    supertest: '^7.2.2'
    syncpack: '^15.3.1'
    tail: '^2.2.6'
    tailwindcss-scroll-mask: '^0.0.3'
    timekeeper: '^2.2.0'
    tldts: '^6.1.57'
    torph: '^0.0.9'
    ts-clone-node: '^4.0.0'
    ts-jest: '^29.4.9'
    ts-json-schema-generator: v2.4.0-next.6
    ts-node: '^10.9.1'
    tsc-alias: '^1.8.16'
    tsconfig-paths: '^4.2.0'
    tsup: '^5.12.8'
    turbo: '^2.9.14'
    ultimate-express: 2.0.9
    uuid: '^11.1.1'
    vite-plugin-dts: '^4.5.4'
    vite-tsconfig-paths: '^5.1.4'
    wait-on: '^7.2.0'
    wrangler: '^4.98.0'
    xml-js: '^1.6.11'
    zxcvbn: '^4.4.2'

# Insights packages are released by our own workflows. insights-js is also
# uploaded to the browser SDK CDN from the insights-js release workflow, so
# dependency automation should not delay these package updates.
minimumReleaseAge: 10080
minimumReleaseAgeExclude:
    - insights-js
    - insights-js-lite
    - insights-node
    - '@hanzo/*'
    - [email protected]
    - [email protected]
    - '@earendil-works/*'
    - typebox
    - [email protected]
    - [email protected]
    - [email protected]
    - '@oxfmt/*'
    - [email protected]
    - '@shadcn/react'
    - [email protected]
    - kea-typegen
    - '@typescript/native-preview'
    - '@typescript/native-preview-darwin-arm64'
    - '@typescript/native-preview-darwin-x64'
    - '@typescript/native-preview-linux-arm'
    - '@typescript/native-preview-linux-arm64'
    - '@typescript/native-preview-linux-x64'
    - '@typescript/native-preview-win32-arm64'
    - '@typescript/native-preview-win32-x64'
    - shiki
    - shadcn
    - '@shikijs/*'

# pnpm 10 reads these here; the `pnpm` field in package.json is ignored,
# which had left every pin below inert — including the security bumps.
overrides:
    axios: '^1.15.0'
    '@modelcontextprotocol/sdk': '^1.29.0'
    '@types/react': '18.3.27'
    '@types/react-dom': '18.3.7'
    cipher-base: '>=1.0.5'
    d3-geo: '>=3.1.0'
    d3-selection: '>=3.0.0'
    d3-zoom: '>=3.0.0'
    form-data: '>=4.0.4'
    node-forge: '>=1.4.0'
    pbkdf2: '>=3.1.3'
    react: '18.3.1'
    react-dom: '18.3.1'
    sha.js: '>=2.4.12'
    typescript: '6.0.3'
    'ultimate-express>uWebSockets.js': '-'
    # rollup 2.x ended at 2.79.2 (Sept 2024); 2.80.0 appeared 17 months later on
    # that dead line with no trust evidence, and trustPolicy: no-downgrade refuses
    # it. Pin the last trusted 2.x on this path rather than relax the policy.
    'tsup>rollup': '2.79.2'
    # Same policy, same shape, one dependency deeper. @types/[email protected] asks for
    # undici-types ~6.21.0, and that tilde lands inside the one unattested stretch
    # of the 6.x line: 6.17.0-6.19.2 carry provenance, 6.19.3-6.21.0 carry none,
    # and 6.23.0 onward carry it again. no-downgrade reads a version with no
    # evidence published after versions that had it as a possible takeover and
    # stops the install, which is what took the frontend stage down.
    #
    # 6.23.0 is the nearest version that satisfies the policy: same major, the
    # first attested release above the gap, and types-only, so nothing it carries
    # reaches runtime. Pinning it keeps the check doing its job -- the alternative,
    # relaxing trustPolicy, would switch the check off for every package here to
    # settle one of them.
    '@types/node>undici-types': '6.23.0'
    'fast-xml-parser@^4': '>=4.5.4'
    'fast-xml-parser@^5': '>=5.3.5'
    'jest-playwright-preset>playwright-core': '1.60.0'
    '@smithy/node-http-handler': '4.4.9'
    '@smithy/core': '3.24.6'
    rolldown: '1.1.4'
    '@tiptap/core': '3.20.6'
    '@tiptap/extensions': '3.20.6'
    '@tiptap/html': '3.20.6'
    '@tiptap/markdown': '3.20.6'
    '@tiptap/pm': '3.20.6'
    '@tiptap/react': '3.20.6'
    '@tiptap/starter-kit': '3.20.6'
    '@tiptap/suggestion': '3.20.6'
    '@tiptap/extension-blockquote': '3.20.6'
    '@tiptap/extension-bold': '3.20.6'
    '@tiptap/extension-bubble-menu': '3.20.6'
    '@tiptap/extension-bullet-list': '3.20.6'
    '@tiptap/extension-code': '3.20.6'
    '@tiptap/extension-code-block': '3.20.6'
    '@tiptap/extension-code-block-lowlight': '3.20.6'
    '@tiptap/extension-collaboration': '3.20.6'
    '@tiptap/extension-color': '3.20.6'
    '@tiptap/extension-document': '3.20.6'
    '@tiptap/extension-drag-handle': '3.20.6'
    '@tiptap/extension-drag-handle-react': '3.20.6'
    '@tiptap/extension-dropcursor': '3.20.6'
    '@tiptap/extension-floating-menu': '3.20.6'
    '@tiptap/extension-gapcursor': '3.20.6'
    '@tiptap/extension-hard-break': '3.20.6'
    '@tiptap/extension-heading': '3.20.6'
    '@tiptap/extension-horizontal-rule': '3.20.6'
    '@tiptap/extension-image': '3.20.6'
    '@tiptap/extension-italic': '3.20.6'
    '@tiptap/extension-link': '3.20.6'
    '@tiptap/extension-list': '3.20.6'
    '@tiptap/extension-list-item': '3.20.6'
    '@tiptap/extension-list-keymap': '3.20.6'
    '@tiptap/extension-node-range': '3.20.6'
    '@tiptap/extension-ordered-list': '3.20.6'
    '@tiptap/extension-paragraph': '3.20.6'
    '@tiptap/extension-placeholder': '3.20.6'
    '@tiptap/extension-strike': '3.20.6'
    '@tiptap/extension-table': '3.20.6'
    '@tiptap/extension-table-of-contents': '3.20.6'
    '@tiptap/extension-text': '3.20.6'
    '@tiptap/extension-text-align': '3.20.6'
    '@tiptap/extension-text-style': '3.20.6'
    '@tiptap/extension-underline': '3.20.6'
    '@hanzo/icons': 'npm:@hanzo/[email protected]'
    '@hanzo/insightsql-parser': 'npm:@posthog/[email protected]'
    insights-js: 'npm:@hanzo/[email protected]'
    insights-js-lite: 'npm:@hanzo/[email protected]'
    # The React bindings are our own fork, and its peer is @hanzo/insights by name,
    # so nothing has to be aliased into place to satisfy it.
    '@hanzo/react': 'npm:@hanzo/[email protected]'
    '@datastore/client': 'npm:@clickhouse/client@^1.12.0'
    '@hanzo/mcp-analytics': 'npm:@posthog/[email protected]'
    '@hanzo/siphash': 'npm:@posthog/[email protected]'
    insights-node: 'npm:[email protected]'

patchedDependencies:
    [email protected]: patches/[email protected]
    [email protected]: patches/[email protected]
    [email protected]: patches/[email protected]
    [email protected]: patches/[email protected]

onlyBuiltDependencies:
    - '@modelcontextprotocol/ext-apps'
    - '@mongodb-js/zstd'
    - '@parcel/watcher'
    - chartjs-plugin-stacked100
    - '@swc/core'
    - core-js
    - core-js-pure
    - cpu-features
    - esbuild
    - lmdb
    - lz4
    - msgpackr-extract
    - msw
    - node-gyp
    - node-rdkafka
    - protobufjs
    - re2
    - sharp
    - ssh2
    - unrs-resolver
    - workerd