pnpm-workspace.yaml

# pnpm 11's supply-chain policy defaults to a 24-hour minimumReleaseAge,
# which blocks legitimate routine dep bumps when CI runs within a day of
# an upstream patch release (e.g. cloudflare/wrangler, cloudflare/miniflare).
# 60 minutes still prevents publish-and-pivot attacks but unblocks normal flow.
minimumReleaseAge: 60

# pnpm 11 blocks all package build scripts by default. The allowBuilds
# map below is security-sensitive — true = postinstall runs; false = skipped.
# Warning: pnpm auto-manages this block. Edits made while pnpm install is
# running may be clobbered. If you see an autogenerated duplicate allowBuilds
# block, remove the duplicate and keep THIS one as source of truth.
#   - better-sqlite3: native SQLite binding used by @nuxt/content
#   - esbuild: Vite/Nuxt bundler, verifies prebuilt binary matches platform
#   - sharp: image processing for @nuxt/fonts OG image generation
#   - unrs-resolver: Nuxt 4 module resolver, rust-native platform-specific
#   - workerd: Cloudflare Workers runtime used by wrangler
#   - @parcel/watcher: falls back to polling; safe to skip native build
#   - vue-demi: alias/symlink script; not required at runtime
# Force the entire workspace onto Vite 8 even though @nuxt/vite-builder
# (Nuxt 4.4.6) declares a "vite": "^7.3.2" peer dependency.
overrides:
  vite: ^8.1.4

allowBuilds:
  '@parcel/watcher': false
  better-sqlite3: true
  esbuild: true
  sharp: true
  unrs-resolver: true
  vue-demi: false
  workerd: true