pnpm-workspace.yaml

# pnpm workspace members, so a single repo-root pnpm-lock.yaml covers every JS package.
# One lockfile at the root is what osv-scanner scans for npm advisories, which means a dependency added to any
# member lands in the scanned set automatically instead of needing its own --lockfile argument.
#
# The generated `pkg/` directories under services/ws-modules/ each carry a package.json, but their `dependencies`
# name modules the ws-server serves (et-ws, et-model-face1, ...) rather than published npm packages.
# Some of their deps are loaded via mise installed tools, which are checked separately.
packages:
  - services/ws-server/static
  # js-data1 is a real workspace member, not a served pkg/ dir.
  # It declares published npm deps (@aws-sdk/client-s3, esbuild) that must land in the root lockfile for
  # osv-scanner; its bundled output under pkg/ is generated, not a member.
  - services/ws-modules/js-data1
# esbuild ships its platform binary via a postinstall build script; allow it so the js-data1 bundle can build.
# Everything else stays blocked by pnpm's default supply-chain policy.
#
# A blocked script still has to be named here with `false`. pnpm aborts an install that silently ignored one
# (`[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: protobufjs@7.6.5`, telling you to run
# `pnpm approve-builds`), so an undeclared entry fails every cold tree while a warm one passes on recorded
# state -- which is how build-ws-js-data1-module broke on a fresh linux-arm64 clone but nowhere else.
# protobufjs (transitive, via the aws-sdk graph) only uses its postinstall to pick a native codec, and the
# bundle runs the pure-JS path, so blocking it is the outcome we want -- just declared rather than implied.
allowBuilds:
  esbuild: true
  protobufjs: false