packages:
  - "packages/oxlint-config"
  - "packages/oxfmt-config"
  - "packages/client-ts"
  - "packages/docusaurus-config"
  - "packages/esbuild-plugin-live-reload"
  - "packages/fonts"
  - "packages/geo"
  - "packages/logger-js"
  - "packages/theme"
  - "packages/tsconfig"
  - "lifecycle/aws"

# Shared version references for the `catalog:` protocol. Workspace members reference
# these via `catalog:`.
# `scripts/node/lint-catalogs.ts` keeps them in sync with the other workspace roots.
catalog:
  "@playwright/test": "^1.62.1"
  "@types/node": "^26.1.2"
  "@vitest/browser": "^4.1.10"
  "@vitest/browser-playwright": "^4.1.10"
  esbuild: "^0.28.1"
  oxfmt: "0.70.0"
  oxlint: "^1.85.0"
  playwright: "^1.62.1"
  typescript: "^6.0.3"
  vite: "^8.2.0"
  vitest: "^4.1.10"

# Allow-list of dependencies whose install/postinstall scripts may run.
# Everything else is blocked, replacing the prior `ignore-scripts=true` +
# `npm rebuild --foreground-scripts <pkg>` pattern from #20400. Each entry is
# audited at review time — adding a package here grants it arbitrary code
# execution at install.
onlyBuiltDependencies:
  - esbuild

# Explicit approval map for pnpm 11+. `true` = allowed (mirror onlyBuiltDependencies);
# `false` = explicitly declined (silences the "pending approval" prompt
# without running the script).
allowBuilds:
  core-js: false
  esbuild: true

minimumReleaseAgeExclude:
  - playwright-core@1.62.1
  - playwright@1.62.1