| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556 |
- packages:
- - vendor/*
- - packages/*/*
- # Product assemblies over the package tier; apps/cli owns the `dsh` bin.
- - apps/*
- - website
- # The runnable demo leaves join as ONE workspace member: examples/package.json
- # declares the union of every leaf's cordis.yml plugins as workspace:*, so a
- # plain-node (`:lib`) boot of any leaf (examples/<leaf>/cordis.yml) resolves its
- # plugins through real package `exports`→lib by walking up to examples/node_modules.
- # Members for DEPENDENCY RESOLUTION only — NOT build targets: tsdown's explicit
- # globs (vendor/*, packages/*/*) exclude them. See the example-execute-over-tsx Agent Note.
- - examples
- # Deploy root of the single-exe build: a pure dependency manifest whose
- # closure is what the exe bundles and what the Python runtime distributes.
- - python/sdk-runtime
- peerDependencyRules:
- allowedVersions:
- typescript: '>=5 <7'
- # pnpm 10+ blocks any dependency shipping an install/build script until it is
- # explicitly reviewed here (strictDepBuilds defaults to true: an unlisted script
- # is a hard install error). Every such package MUST be listed; we deny by
- # default and only allow scripts we need. esbuild (native binary) and lefthook
- # (git hooks) genuinely need theirs.
- allowBuilds:
- esbuild: true
- lefthook: true
- # Cross-platform PTY boundary for the TUI process smoke and persistent PTY backend,
- # including ConPTY on Windows.
- node-pty: true
- # Pulled in by @earendil-works/pi-ai (optional LLM API backend). pnpm lists
- # them only because they ship lifecycle scripts, but those are no-ops we don't
- # need, so we deny them — install still succeeds.
- '@google/genai': false
- protobufjs: false
- node-addon-require-builtin: false
- # JSONL durability calls MoveFileExW with write-through publication on Windows.
- koffi: true
- # The Landlock launcher family is our own sibling-repo release, consumed
- # fresh (hours old at each coordinated bump) — the release-age quarantine
- # would block every such bump, so the family is exempted BY NAME, not by
- # pinned version.
- minimumReleaseAgeExclude:
- - node-addon-landlock-run
- - node-addon-landlock-run-linux-arm64
- - node-addon-landlock-run-linux-x64
- # Cordis release candidates are source-vendored and pinned in vendor/README.md
- # during the same-day sync that updates package manifests and the lockfile.
- - '@cordisjs/plugin-loader@1.0.0-rc.5'
- - cordis@4.0.0-rc.7
- # Fresh pi-ai releases carry the model catalog updates that are the whole
- # point of bumping it; waiting out the release age would defeat that.
- - '@earendil-works/pi-ai@0.81.1'
|
