2026-06-16 14:55:37 +08:00
|
|
|
packages:
|
|
|
|
|
- vendor/*
|
|
|
|
|
- packages/*
|
|
|
|
|
|
|
|
|
|
peerDependencyRules:
|
|
|
|
|
allowedVersions:
|
|
|
|
|
typescript: '>=5 <7'
|
|
|
|
|
|
2026-06-16 16:17:03 +08:00
|
|
|
# pnpm 10+ blocks any dependency shipping an install/build script until it is
|
|
|
|
|
# explicitly reviewed here (strictDepBuilds defaults to true: an unlisted script
|
|
|
|
|
# is a hard install error). Every such package MUST be listed; we deny by
|
|
|
|
|
# default and only allow scripts we need. esbuild (native binary) and lefthook
|
|
|
|
|
# (git hooks) genuinely need theirs.
|
2026-06-16 14:55:37 +08:00
|
|
|
allowBuilds:
|
|
|
|
|
esbuild: true
|
|
|
|
|
lefthook: true
|
2026-06-16 16:17:03 +08:00
|
|
|
# Transitive deps of @earendil-works/pi-ai (the dsh-llm-pi-ai design-twin
|
|
|
|
|
# adapter, ADR 0010), consumed prebuilt — surprising to see here, but pnpm
|
|
|
|
|
# lists them only because they ship lifecycle scripts. Those scripts are
|
|
|
|
|
# no-ops we don't need (@google/genai's preinstall is an `echo`; protobufjs's
|
|
|
|
|
# postinstall only warns about version schemes and returns early when unset),
|
|
|
|
|
# so we deny them: install still succeeds, no needless code runs.
|
|
|
|
|
'@google/genai': false
|
|
|
|
|
protobufjs: false
|
