packages:
  - apps/*
  - packages/*

injectWorkspacePackages: true
syncInjectedDepsAfterScripts:
  - build
  - db:generate

# False positives: pnpm audit matches workspace dir "sandbox" against the
# abandoned npm package "sandbox". Our package is @coda/sandbox (isolated-vm).
#
# GHSA-c2c7-rcm5-vvqj: picomatch ReDoS via extglob quantifiers. Affects
# tinyglobby@^4.0.3 (typescript-eslint dep) — both devDeps only, not shipped.
# The 2.x path (jest-util) is fixed via pnpm override in package.json.
auditConfig:
  ignoreGhsas:
    - GHSA-gc25-3vc5-2jf9
    - GHSA-fm4j-4xhm-xpwx
    - GHSA-c2c7-rcm5-vvqj

# Canonical list. package.json pnpm.onlyBuiltDependencies adds protobufjs + sharp.
onlyBuiltDependencies:
  - "@datadog/native-appsec"
  - "@datadog/native-iast-taint-tracking"
  - "@datadog/native-metrics"
  - "@datadog/pprof"
  - "@prisma/engines"
  - "@sentry/cli"
  - browser-tabs-lock
  - dd-trace
  - esbuild
  - isolated-vm
  - msw
  - onnxruntime-node
  - prisma