pnpm workspace

The only lockfile is pnpm-lock.yaml. Do not use npm or yarn — except for npm version, which is the release trigger (.context/ops/runbooks/release.md).

Two settings in pnpm-workspace.yaml are load-bearing.

nodeLinker stays at the default (isolated). Do not set hoisted.

Hoisting was tried and it broke the Firestore rules suite: the flat layout shadowed express 4's send: ~0.19.0 with send@1.2.1 from elsewhere in the firebase-tools tree, send 1.x dropped the .mime export express 4 reads, and every request to the Emulator Hub 500'd. All 31 rules tests failed on initializeTestEnvironment. Isolated linking gives each package the versions it declares.

minimumReleaseAge: 1440

A version published in the last 24h will not install. pnpm install --frozen-lockfile validates the committed lockfile against it, so a lockfile written with the policy off fails in CI.

A workspace must declare what it imports

Isolated linking requires this. yarn's flat node_modules hid three real gaps, all since fixed: apps/website imported zod and eslint-plugin-react-hooks without declaring either, and apps/mobile needed @types/node for its rules tests.

If you get Cannot find module X, the fix is pnpm --filter <workspace> add X, not a hoist setting.