packages:
  - "mcps/*"
  - "web"

# pnpm 11 default `strictDepBuilds: true` blocks install scripts for any
# dependency with a build script (esbuild's native binary fetch, sharp,
# etc.) unless individually allowlisted, and fails the whole `install`
# with ERR_PNPM_IGNORED_BUILDS otherwise. Scaffolded apps pull in build-
# script deps transitively (tsup/vite -> esbuild, mcp/ui deps, etc.) that
# we can't enumerate up front, so match pnpm 9/10 behavior here.
strictDepBuilds: false

# pnpm 11 default `verifyDepsBeforeRun: 'install'` re-verifies the
# lockfile against supply-chain policies (including minimumReleaseAge)
# before every `pnpm run <script>`, hitting the registry even for
# already-installed deps. That check 404s for any dependency that only
# exists as a local tarball (not yet published), which is expected
# during local/dev/CI installs. Restore pnpm 9/10 behavior: only verify
# on an explicit `pnpm install`.
verifyDepsBeforeRun: false

# See above — same registry-lookback problem hits a plain `pnpm install`
# too when minimumReleaseAge is nonzero; disable it for scaffolded apps.
minimumReleaseAge: 0

# The build-script allow/deny lists live HERE, never in package.json's `pnpm`
# field (pnpm ≥10 ignores that and warns on every first install, guuey#978).
# esbuild's postinstall is allowed (the binary fetch). The transitive
# build-script deps a scaffold pulls, none run by the worker's own code, are
# ignored EXPLICITLY, which keeps a customer's first install free of the
# "Ignored build scripts … run pnpm approve-builds" box without changing what
# gets built. pnpm 11 reads `allowBuilds` (true = run, false = ignore); pnpm 10
# reads `onlyBuiltDependencies` / `ignoredBuiltDependencies`. Both are kept so
# either major installs quietly; keep the two lists in step.
allowBuilds:
  esbuild: true
  "@google/genai": false
  onnxruntime-node: false
  protobufjs: false
  sharp: false
onlyBuiltDependencies:
  - esbuild
ignoredBuiltDependencies:
  - "@google/genai"
  - onnxruntime-node
  - protobufjs
  - sharp