package.json

{
  "name": "pull-fm",
  "version": "0.0.0",
  "private": true,
  "description": "Pull.fm - music discovery that respects ownership. Backend monorepo.",
  "license": "Apache-2.0",
  "author": "312.dev LLC",
  "repository": {
    "type": "git",
    "url": "git+https://github.com/312-dev/pull-fm.git"
  },
  "engines": {
    "node": ">=22",
    "pnpm": ">=9"
  },
  "packageManager": "pnpm@9.12.0",
  "type": "module",
  "scripts": {
    "build": "pnpm -r build",
    "dev": "pnpm -r --parallel dev",
    "test": "pnpm -r test",
    "typecheck": "pnpm -r typecheck",
    "lint": "eslint . --max-warnings=0",
    "lint:fix": "eslint . --fix",
    "format": "prettier --write .",
    "format:check": "prettier --check .",
    "scan:secrets": "gitleaks git --config .gitleaks.toml --redact --verbose",
    "scan:sast": "semgrep scan --config=p/default --config=p/typescript --config=p/owasp-top-ten --config=.semgrep/ --severity=ERROR --metrics=off",
    "scan:deps": "trivy fs . --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --ignore-unfixed --include-dev-deps --ignorefile .trivyignore.yaml",
    "scan:all": "pnpm scan:secrets && pnpm scan:sast && pnpm scan:deps",
    "stack:up": "docker compose -f docker-compose.dev.yml up -d",
    "stack:down": "docker compose -f docker-compose.dev.yml down",
    "stack:reset": "docker compose -f docker-compose.dev.yml down -v && pnpm stack:up",
    "mb:load": "infra/mb-loader/mb-canonical-load.sh",
    "mb:load:dry": "infra/mb-loader/mb-canonical-load.sh --dry-run",
    "mb:load:selftest": "infra/mb-loader/selftest.sh",
    "prepare": "husky"
  },
  "//scripts.mb": [
    "mb:load runs the MusicBrainz canonical loader. It is HERE, at the root, and not in apps/bff, because it is not a workspace's job: it is a shell pipeline of curl -> zstd -> tar -> psql COPY that needs psql, zstd, tar, curl and awk on the machine running it, and none of those are in the BFF runtime image (node:22-alpine plus dumb-init). apps/bff has refresh:mb-canonical, which is the SCHEDULED wrapper - advisory lock, exit-code classification - and it spawns this same script rather than reimplementing it.",
    "It takes its connection from DATABASE_URL_DIRECT and nothing else, so there is no --env plumbing to get wrong: DATABASE_URL_DIRECT=... pnpm mb:load. The DIRECT endpoint, never the pooled one - the swap holds ACCESS EXCLUSIVE and an advisory lock across statements, and Neon's pooled endpoint is PgBouncer in transaction mode, which breaks both silently.",
    "mb:load:dry discovers the newest published dump and verifies its licence, and changes nothing. Safe to run from anywhere.",
    "mb:load:selftest needs the docker Postgres from stack:up and exits 77 if it cannot get one."
  ],
  "devDependencies": {
    "@eslint/js": "^9.17.0",
    "@types/node": "^22.10.2",
    "eslint": "^9.17.0",
    "husky": "^9.1.7",
    "lint-staged": "^15.3.0",
    "prettier": "^3.4.2",
    "typescript": "^5.7.2",
    "typescript-eslint": "^8.19.0"
  },
  "lint-staged": {
    "*.{ts,tsx,js,mjs}": [
      "eslint --fix --max-warnings=0",
      "prettier --write"
    ],
    "*.{json,md,yml,yaml}": [
      "prettier --write"
    ]
  },
  "//pnpm.overrides": [
    "minimatch@3 -> ^10.2.6 closes CVE-2026-14257 (HIGH, ReDoS in brace-expansion below 5.0.8).",
    "The only path to the vulnerable brace-expansion in this repository is minimatch@3.1.5, pulled by eslint 9, @eslint/eslintrc and @eslint/config-array. Nothing here asks for it directly.",
    "Overriding brace-expansion itself does NOT work, and was tried rather than assumed: its 5.x CommonJS build exports { expand } instead of the bare function that minimatch@3 requires, so eslint dies with 'expand is not a function' on the first glob it matches.",
    "Overriding the minimatch layer is what eslint 10 does anyway - @eslint/config-array 0.23.5 depends on minimatch ^10.2.4 for this exact matching - and all three consumers here already use the named minimatch.Minimatch export that 10.x still provides.",
    "Verified equivalent rather than asserted: `eslint . -f json` lints the same 214 files before and after the override, so no files/ignores pattern changed meaning.",
    "Delete this override when eslint moves to 10.x, which drops @eslint/eslintrc and the minimatch 3 chain with it. See security/AUDIT-2026-07-29.md F1."
  ],
  "pnpm": {
    "overrides": {
      "minimatch@3": "^10.2.6"
    }
  }
}