# This repository's own pnpm settings. Signage is a single standalone package, not part of any other
# workspace; pnpm reads its settings from this file.

# esbuild, which the module UI build and the module packager run, has an install script. pnpm runs
# none it was not told to.
allowBuilds:
  esbuild: true

# pnpm holds back any package younger than its minimum release age, and refuses a lockfile that names
# one. A new Ekklesia package train is that young on its release day. These exact versions, and only
# these, are the train this lockfile pins (published by Ekklesia's release workflow, ADR 0053), so
# they are exempt by version; a train bump replaces them, and everything else keeps the policy.
minimumReleaseAgeExclude:
  - '@ekklesia/contracts@0.2.0'
  - '@ekklesia/design-tokens@0.2.0'
  - '@ekklesia/module-database@0.2.0'
  - '@ekklesia/module-pack@0.2.0'
  - '@ekklesia/module-sdk@0.2.0'
  - '@ekklesia/module-ui-build@0.2.0'
  - '@ekklesia/module-ui-sdk@0.2.0'
  - '@ekklesia/typescript-config@0.2.0'
  - '@ekklesia/ui@0.2.0'

# The narrowly scoped advisory remediation Signage had while it was built inside Ekklesia's workspace,
# kept now that it is not. GHSA-67mh-4wv8-2f99 (moderate): the vulnerable esbuild 0.18.20 is reached
# only through the deprecated @esbuild-kit/core-utils (drizzle-kit -> @esbuild-kit/esm-loader), whose
# pinned range predates the fix. Scoped to that one edge, exactly as Ekklesia's own workspace does,
# so drizzle-kit's direct esbuild and Vite's are not dragged to another version.
overrides:
  "@esbuild-kit/core-utils>esbuild": "0.25.12"