{
  "$schema": "https://json.schemastore.org/package.json",
  "name": "ows-coda",
  "version": "1.0.0",
  "packageManager": "pnpm@10.33.0",
  "description": "Standalone AI chatbot service for Abacus royalties platform",
  "repository": "git@github.com:theorchard/ows-coda.git",
  "author": "theorchard",
  "private": true,
  "engines": {
    "node": ">=24.0.0"
  },
  "scripts": {
    "dev:libs": "concurrently -k -n async,data-structures,search,api-common,admin-api,common,core-api,db,sandbox,search-api,runner-api -c gray,gray,gray,gray,gray,cyan,magenta,yellow,green,gray,gray \"pnpm --filter @coda/async dev\" \"pnpm --filter @coda/data-structures dev\" \"pnpm --filter @coda/search dev\" \"pnpm --filter @coda/api-common dev\" \"pnpm --filter @coda/admin-api dev\" \"pnpm --filter @coda/common dev\" \"pnpm --filter @coda/core-api dev\" \"pnpm --filter @coda/db dev\" \"pnpm --filter @coda/sandbox dev\" \"pnpm --filter @coda/search-api dev\" \"pnpm --filter @coda/runner-api dev\"",
    "dev": "concurrently -k -n libs,server -c cyan,blue \"pnpm dev:libs\" \"pnpm --filter @coda/server-app dev\"",
    "dev:client": "pnpm --filter @coda/client-app dev",
    "dev:all": "concurrently -k -n server,client -c blue,green \"pnpm dev\" \"pnpm dev:client\"",
    "dev:light": "pnpm build:libs && pnpm --filter @coda/server-app dev",
    "dev:light:all": "pnpm build:libs && concurrently -k -n server,client -c blue,green \"pnpm --filter @coda/server-app dev\" \"pnpm dev:client\"",
    "dev:runner": "pnpm --filter @coda/runner-service dev",
    "dev:stop": "lsof -ti :8080,:6005 | xargs kill -9 2>/dev/null; echo 'Stopped all dev processes'",
    "preview:client": "pnpm build:client && pnpm --filter @coda/client-app preview --port 8080",
    "preview:all": "concurrently -k -n server,client -c blue,green \"pnpm dev\" \"pnpm preview:client\"",
    "preview:stop": "lsof -ti :3000,:8080 | xargs kill -9 2>/dev/null; echo 'Stopped all preview processes'",
    "start": "pnpm --filter @coda/server-app start",
    "build": "pnpm db:generate && pnpm --filter @coda/server-app build",
    "build:libs": "pnpm -r --filter './packages/**' build",
    "build:api": "pnpm --filter @coda/core-api build",
    "build:client": "pnpm --filter @coda/client-app build",
    "build:common": "pnpm --filter @coda/common build",
    "build:extensions": "pnpm --filter @coda/extensions build",
    "build:runner": "pnpm --filter @coda/runner-service build",
    "build:runner-api": "pnpm --filter @coda/runner-api build",
    "build:search": "pnpm --filter @coda/search build",
    "build:admin-api": "pnpm --filter @coda/admin-api build",
    "build:search-api": "pnpm --filter @coda/search-api build",
    "build:server": "pnpm --filter @coda/server-app build",
    "db:generate": "pnpm --filter @coda/db db:generate",
    "db:migrate": "pnpm --filter @coda/db db:migrate",
    "db:seed": "pnpm --filter @coda/db db:seed",
    "lint": "pnpm -r lint",
    "lint:api": "pnpm --filter @coda/core-api lint",
    "lint:client": "pnpm --filter @coda/client-app lint",
    "lint:common": "pnpm --filter @coda/common lint",
    "lint:db": "pnpm --filter @coda/db lint",
    "lint:runner": "pnpm --filter @coda/runner-service lint",
    "lint:runner-api": "pnpm --filter @coda/runner-api lint",
    "lint:search": "pnpm --filter @coda/search lint",
    "lint:search-api": "pnpm --filter @coda/search-api lint",
    "lint:server": "pnpm --filter @coda/server-app lint",
    "typecheck": "pnpm -r typecheck",
    "typecheck:api": "pnpm --filter @coda/core-api typecheck",
    "typecheck:client": "pnpm --filter @coda/client-app typecheck",
    "typecheck:common": "pnpm --filter @coda/common typecheck",
    "typecheck:db": "pnpm --filter @coda/db typecheck",
    "typecheck:runner": "pnpm --filter @coda/runner-service typecheck",
    "typecheck:runner-api": "pnpm --filter @coda/runner-api typecheck",
    "typecheck:search": "pnpm --filter @coda/search typecheck",
    "typecheck:search-api": "pnpm --filter @coda/search-api typecheck",
    "typecheck:server": "pnpm --filter @coda/server-app typecheck",
    "format": "pnpm -r format",
    "format:check": "pnpm -r format:check",
    "validate:sync": "bash scripts/validate-workspace-sync.sh",
    "knip": "knip",
    "test": "pnpm -r test",
    "test:unit": "pnpm -r test:unit",
    "test:functional": "pnpm -r test:functional",
    "test:integration": "pnpm -r test:integration",
    "clean": "pnpm -r clean",
    "clean:all": "pnpm clean && rm -rf node_modules apps/server/node_modules packages/core-api/node_modules apps/client/node_modules packages/db/node_modules",
    "docker:login": "bash scripts/docker-login.sh",
    "docker:up": "docker compose --project-name coda --profile dev up --build",
    "docker:up:preview": "docker compose --project-name coda down --remove-orphans 2>/dev/null; docker compose --project-name coda --profile preview up --build",
    "docker:down": "docker compose --project-name coda --profile dev --profile preview down",
    "docker:logs": "docker compose --project-name coda logs -f",
    "docker:clean": "docker compose --project-name coda down --rmi local --volumes --remove-orphans",
    "docker:test:unit": "docker compose --project-name coda-test-unit --profile test-unit run --build --rm lint-and-test",
    "docker:test:functional": "docker compose --env-file .env.docker.test --project-name coda-test-functional --profile test-functional run --build --rm test-functional",
    "docker:test:integration": "docker compose --env-file .env.docker.test --project-name coda-test-integration --profile test-integration run --build --rm test-integration",
    "docker:test:e2e": "echo 'E2E Docker target not yet implemented — see docs/docker.md' && exit 1",
    "docker:test:down": "docker compose --project-name coda-test-unit down; docker compose --project-name coda-test-functional down; docker compose --project-name coda-test-integration down",
    "docker:test:clean": "docker compose --project-name coda-test-unit down --rmi local --volumes --remove-orphans; docker compose --project-name coda-test-functional down --rmi local --volumes --remove-orphans; docker compose --project-name coda-test-integration down --rmi local --volumes --remove-orphans",
    "prepare": "husky",
    "eval:contract-extraction": "pnpm --filter @coda/server-app eval:contract-extraction"
  },
  "dependencies": {
    "dd-trace": "^5.93.0"
  },
  "devDependencies": {
    "@eslint/js": "^10.0.1",
    "@vitest/coverage-v8": "^4.1.0",
    "concurrently": "^9.2.1",
    "eslint": "^10.1.0",
    "eslint-config-prettier": "^10.1.8",
    "husky": "^9.1.7",
    "knip": "^6.15.0",
    "lint-staged": "^16.4.0",
    "prettier": "^3.8.1",
    "typescript-eslint": "^8.57.2",
    "vitest": "^4.1.0"
  },
  "//pnpm-overrides": "serialize-javascript: GHSA-5c6j-r48x-rmvq — RCE via vite-plugin-pwa>workbox-build. hono/node-server: GHSA-xf4j-xp2r-rqqx + GHSA-wmmm-f939-6g9c + GHSA-92pp-h63x-v22m — path traversal + middleware bypass via prisma>@prisma/dev and shadcn>@modelcontextprotocol/sdk. fast-xml-parser: GHSA-8gc5-j5rx-235r — entity expansion via AWS SDK. effect: GHSA-38f7-945m-qr2g — AsyncLocalStorage context via prisma>@prisma/config. http-proxy-agent: @tootallnate/once vuln via snowflake-sdk>teeny-request — v7 drops the dep entirely. defu: GHSA-737v-mqg7-c878 — prototype pollution via tsdown>defu. picomatch: GHSA-c2c7-rcm5-vvqj — ReDoS via tinyglobby/lint-staged (devDeps). lodash/lodash-es: GHSA-r5fr-rjxr-66jc — code injection via prisma>chevrotain and mermaid>chevrotain. handlebars: GHSA-2w6w-674q-4c4q + 4 more — JS injection via ts-jest (devDep). brace-expansion: GHSA-f886-m6hf-6m8v — zero-step hang via eslint>minimatch (devDep); bumped to >=5.0.6 for GHSA-jxxr-4gwj-5jf2 (ReDoS) via @sentry/node>@fastify/otel>minimatch. tmp: GHSA-ph9p-34f9-6g65 — path traversal via apps/server>exceljs>tmp. path-to-regexp@>=8: GHSA-j3q9-mxjg-w52f — DoS via shadcn>MCP SDK>express>router. axios: GHSA-3p68-rc4w-qgx5 + GHSA-pmwg-cvhr-8vh7 + GHSA-q8qp-cvcw-x6jj + GHSA-pf86-5x62-jrwf + GHSA-6chq-wfr3-2hj9 — SSRF, prototype pollution, header injection via snowflake-sdk>axios. fast-xml-builder: GHSA-5wm8-gmm8-39j9 — attribute bypass via AWS SDK. fast-uri: GHSA-q3j6-qgpj-74h6 + GHSA-v39h-62p7-jpjc — path traversal + host confusion via shadcn>MCP SDK>ajv. @babel/plugin-transform-modules-systemjs: GHSA-fv7c-fp4j-7gwp — arbitrary code via vite-plugin-pwa>workbox-build. dompurify: transitive XSS via i18next. i18next-http-backend: transitive SSRF via i18next. postcss: transitive ReDoS via vite/tailwind. ip-address: transitive SSRF via socksjs. uuid: transitive weak randomness via snowflake-sdk. shell-quote: GHSA-g4rg-993r-mgx7 — command injection (critical) — transitive via execa/shell-exec. qs: GHSA-ckg5-jvgh-v4x4 — prototype pollution — transitive via express and body-parser. undici: header injection + request smuggling — transitive via Node.js http internals. @opentelemetry/core: GHSA-gwvq-rgqf-4fwx — prototype pollution — transitive via @sentry/node. esbuild: GHSA-67mh-4wv8-2f99 — arbitrary file read via dev server network access — transitive via vite. form-data: GHSA-jchw-25xp-jwwc — CRLF injection via @types/request>form-data (used by runner>snowflake-sdk>@google-cloud/storage). All are transitive — review when parent packages upgrade.",
  "pnpm": {
    "peerDependencyRules": {
      "//": "protoc-gen-connect-es tops out at v1.7.0 — no v2 exists. The generator is a devDep used only for buf:generate; generated files are committed. The runtime (@connectrpc/connect@2.x, @bufbuild/protoc-gen-es@2.x) is fully compatible with the generated output.",
      "allowedVersions": {
        "@connectrpc/protoc-gen-connect-es>@connectrpc/connect": ">=2",
        "@connectrpc/protoc-gen-connect-es>@bufbuild/protoc-gen-es": ">=2"
      }
    },
    "overrides": {
      "serialize-javascript": ">=7.0.3",
      "fast-xml-parser": ">=5.7.0",
      "fast-xml-builder": ">=1.1.7",
      "fast-uri": ">=3.1.2",
      "@babel/plugin-transform-modules-systemjs": ">=7.29.4",
      "hono": ">=4.12.25",
      "@hono/node-server": ">=1.19.13",
      "effect": ">=3.20.0",
      "http-proxy-agent": ">=7.0.0",
      "defu": ">=6.1.5",
      "picomatch": ">=4.0.4",
      "lodash": ">=4.18.0",
      "lodash-es": ">=4.18.0",
      "handlebars": ">=4.7.9",
      "router>path-to-regexp": ">=8.4.0",
      "minimatch@>=10>brace-expansion": ">=5.0.6",
      "tmp": ">=0.2.6",
      "axios": ">=1.15.2",
      "protobufjs": ">=8.6.0",
      "dompurify": ">=3.4.11",
      "i18next-http-backend": ">=3.0.5",
      "postcss": ">=8.5.10",
      "ip-address": ">=10.1.1",
      "uuid": ">=11.1.1",
      "mermaid": ">=11.15.0",
      "shell-quote": ">=1.8.4",
      "qs": ">=6.15.2",
      "undici": ">=7.28.0 <8",
      "@opentelemetry/core": ">=2.8.0",
      "esbuild": ">=0.28.1",
      "@types/request>form-data": ">=4.0.6"
    },
    "onlyBuiltDependencies": [
      "@datadog/native-appsec",
      "@datadog/native-iast-taint-tracking",
      "@datadog/native-metrics",
      "@datadog/pprof",
      "@prisma/engines",
      "@sentry/cli",
      "browser-tabs-lock",
      "dd-trace",
      "esbuild",
      "isolated-vm",
      "msw",
      "onnxruntime-node",
      "prisma",
      "protobufjs",
      "sharp"
    ]
  }
}