pnpm-workspace.yaml

packages:
  - "uneri"
  - "viewer"
  # Standalone consumer of the viewer's shadcn registry (dogfoods the registry
  # output): its own package so `shadcn add` can install the item's deps.
  - "viewer/examples/orbit-viewer"
  - "docs"
  - "tobari/examples/web"
  - "starlight-rustdoc"
  # wasm-pack output of the arika-wasm Rust crate, exposed as a package so it's
  # imported by name (import("arika-wasm")) instead of a relative path into
  # another package's source tree — required for the registry-distributed viewer.
  - "arika/wasm/pkg"

# Supply-chain hardening: refuse to resolve a version published less than
# 7 days ago (10080 minutes), so a compromised release has time to be
# detected and yanked before it can enter the lockfile. Applies to
# pnpm add/update, Renovate's lockfile regen, and — under pnpm 11 — the
# --frozen-lockfile install (CI), which now verifies every lockfile entry
# against this policy. Use minimumReleaseAgeExclude to fast-track a package
# when an urgent fix is needed. (pnpm 10.16+; pnpm 11 defaults this to 1 day.)
minimumReleaseAge: 10080

# pnpm 11 refuses to install unless every dependency build script is
# explicitly allowed (true) or skipped (false) — pnpm 10 only warned. These
# native deps ship prebuilt binaries and were never built under pnpm 10, so
# keep them skipped rather than start running their postinstall scripts.
allowBuilds:
  esbuild: false
  sharp: false
minimumReleaseAgeExclude:
  # Renovate security update: astro@7.1.0
  - astro@7.1.0
  # Renovate security update: mermaid@11.16.1
  - mermaid@11.16.1