packages:
  - "apps/*"

patchedDependencies:
  "@platform-modules/affiliate@0.1.2": "patches/@platform-modules__affiliate@0.1.2.patch"
  "@platform-modules/commerce-orders@0.1.0": "patches/@platform-modules__commerce-orders.patch"

# Moved from package.json "pnpm.overrides" — pnpm >=10 reads dependency overrides
# only from here (the package.json "pnpm" field is ignored). See https://pnpm.io/settings
overrides:
  "@tiptap/core": "3.22.5"
  "@tiptap/pm": "3.22.5"
  "@platform-modules/commerce-cart>@platform-modules/db": "0.1.0"
  "@platform-modules/commerce-catalog>@platform-modules/db": "0.1.0"
  "@platform-modules/commerce-inventory>@platform-modules/db": "0.1.0"
  "@platform-modules/commerce-orders>@platform-modules/db": "0.1.0"
  "@platform-modules/commerce-orders>@platform-modules/billing": "0.0.3"
  "@platform-modules/billing>@platform-modules/db": "0.1.0"
  "@platform-modules/billing>@platform-modules/ledger": "0.1.0"
  "@platform-modules/billing>@platform-modules/jobs": "0.0.2"
  "@platform-modules/billing>@platform-modules/tax": "0.0.2"
  "@platform-modules/commerce-promotions>@platform-modules/db": "0.1.0"
  "@platform-modules/commerce-reviews>@platform-modules/db": "0.1.0"

# Dependency build scripts (preinstall/install/postinstall) are BLOCKED by pnpm 10's
# default supply-chain guard, which prints an "Ignored build scripts: …" notice each install.
# We DELIBERATELY keep them blocked — verified secure-default, zero functional cost:
#   • Full toolchain (build, deploy, typecheck, e2e) is green with every one of these scripts
#     blocked. Confirmed root cause: the native packages (sharp, esbuild, workerd, @swc/core)
#     load their platform binaries from OPTIONAL deps (@img/sharp-*, @esbuild/*, @swc/core-*,
#     @cloudflare/workerd-*) that pnpm links normally — NOT from a postinstall. So the blocked
#     scripts are inert here. (See node_modules/.modules.yaml `skipped`: only the OTHER-platform
#     binaries are skipped; this platform's are linked.)
#   • The ONLY settings that silence the notice — onlyBuiltDependencies / dangerouslyAllowAllBuilds
#     — would RE-ENABLE arbitrary install-time code execution for no functional gain. Rejected:
#     that trades the secure default for cosmetic quiet (pnpm.io/supply-chain-security).
# This list records the explicit "reviewed → do-not-build" decision. NOTE: pnpm 10.33 reads it
# (`pnpm config list` shows it) but does NOT suppress the cosmetic notice from it — the notice is
# the secure-default state, knowingly accepted, not an ignored signal. pnpm 11 replaces these keys
# with `allowBuilds: <pkg>: false` (run `pnpx codemod pnpm-v10-to-v11`), which DOES suppress it
# from a recorded false. Until then the notice is expected. To ever allow a build, move that one
# entry to a new `onlyBuiltDependencies:` list — never blanket-approve.
# Reviewed single allow (per policy above): @ast-grep/cli postinstall only symlinks the
# platform binary already shipped via optionalDependencies; without it every invocation
# does runtime binary resolution and prints a [warn].
onlyBuiltDependencies:
  - "@ast-grep/cli"

ignoredBuiltDependencies:
  - "@embedded-postgres/linux-x64"
  - "@firebase/util"
  - "@google/genai"
  - "@sentry/cli"
  - "@swc/core"
  - esbuild
  - protobufjs
  - sharp
  - simple-git-hooks
  - workerd
