# pnpm workspace definition.
#
# Replaces npm's `workspaces` field, which has been removed from package.json —
# pnpm ignores that field, and keeping both would leave two sources of truth
# that can silently disagree.
packages:
  - 'packages/*'
  - 'apps/*'

# Dependency install scripts.
#
# pnpm refuses to run them unless a package is named here, and treats anything
# undeclared as a hard error on *every* command until it is resolved. That is a
# real supply-chain protection: a transitive dependency cannot execute code at
# install time simply by being pulled in.
#
# `esbuild` asks to run one, and does not need to. Its platform binary arrives
# through an optional dependency (`@esbuild/linux-x64`); the postinstall only
# verifies what is already present. Checked rather than assumed — after a
# scriptless install the binary reported 0.25.12 and both the Vite build and
# tsx work normally.
#
# So it is denied rather than approved: same result, one fewer package allowed
# to execute code on every machine that installs. If a build ever genuinely
# fails for want of a script, flip it to `true` here and record why.
# `@google/genai` and `protobufjs` arrive transitively under the Prime Agent SDK,
# which carries a client for every provider it supports whether or not we use it.
# Piggy talks to exactly one — Prime Inference, over the OpenAI-compatible API —
# so neither package is on any path we execute, and their install scripts are
# denied on the same reasoning as esbuild's. Verified after a scriptless install:
# the agent session starts, resolves the model and completes a tool round trip.
allowBuilds:
  '@google/genai': false
  esbuild: false
  protobufjs: false