# pnpm workspace definition.
#
# Replaces npm's `workspaces` field, which has been removed from package.json —
# pnpm ignores that field, and keeping both would leave two sources of truth
# that can silently disagree.
packages:
  - 'packages/*'
  - 'apps/*'

# Dependency install scripts.
#
# pnpm refuses to run them unless a package is named here, and treats anything
# undeclared as a hard error on *every* command until it is resolved. That is a
# real supply-chain protection: a transitive dependency cannot execute code at
# install time simply by being pulled in.
#
# `esbuild` asks to run one, and does not need to. Its platform binary arrives
# through an optional dependency (`@esbuild/linux-x64`); the postinstall only
# verifies what is already present. Checked rather than assumed — after a
# scriptless install the binary reported 0.25.12 and both the Vite build and
# tsx work normally.
#
# So it is denied rather than approved: same result, one fewer package allowed
# to execute code on every machine that installs. If a build ever genuinely
# fails for want of a script, flip it to `true` here and record why.
allowBuilds:
  esbuild: false