fix(create): preserve pnpm build approvals across add-ons

Keep base esbuild/lightningcss approvals and merge pnpm.onlyBuiltDependencies from add-ons so generated apps remain installable under pnpm's build-script policy.

Author: tannerlinsley

.changeset/rude-tips-ski.md

@@ -0,0 +1,5 @@
+---
+'@tanstack/create': patch
+---
+
+Add pnpm build approvals for `esbuild` and `lightningcss` in base app templates and preserve `pnpm.onlyBuiltDependencies` when add-ons add their own entries.

packages/create/src/frameworks/react/project/base/package.json

@@ -40,5 +40,8 @@
     "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^3.0.5",
     "zod": "^4.3.5"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": ["esbuild", "lightningcss"]
   }
 }

packages/create/src/frameworks/solid/project/base/package.json

@@ -24,5 +24,8 @@
     "vite-plugin-solid": "^2.11.10",
     "typescript": "^5.7.2",
     "vite": "^7.1.7"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": ["esbuild", "lightningcss"]
   }
 }

packages/create/src/package-json.ts

@@ -7,7 +7,7 @@ export function mergePackageJSON(
   packageJSON: Record<string, any>,
   overlayPackageJSON?: Record<string, any>,
 ) {
-  return {
+  const mergedPackageJSON: Record<string, any> = {
     ...packageJSON,
     ...(overlayPackageJSON || {}),
     dependencies: {
@@ -23,6 +23,37 @@ export function mergePackageJSON(
       ...(overlayPackageJSON?.scripts || {}),
     },
   }
+
+  const baseOnlyBuiltDependencies = Array.isArray(
+    packageJSON.pnpm?.onlyBuiltDependencies,
+  )
+    ? packageJSON.pnpm.onlyBuiltDependencies
+    : []
+  const overlayOnlyBuiltDependencies = Array.isArray(
+    overlayPackageJSON?.pnpm?.onlyBuiltDependencies,
+  )
+    ? overlayPackageJSON.pnpm.onlyBuiltDependencies
+    : []
+
+  const onlyBuiltDependencies = [
+    ...new Set([
+      ...baseOnlyBuiltDependencies,
+      ...overlayOnlyBuiltDependencies,
+    ]),
+  ]
+
+  if (packageJSON.pnpm || overlayPackageJSON?.pnpm) {
+    mergedPackageJSON.pnpm = {
+      ...packageJSON.pnpm,
+      ...overlayPackageJSON?.pnpm,
+    }
+
+    if (onlyBuiltDependencies.length) {
+      mergedPackageJSON.pnpm.onlyBuiltDependencies = onlyBuiltDependencies
+    }
+  }
+
+  return mergedPackageJSON
 }
 
 export function createPackageJSON(options: Options) {

packages/create/tests/package-json.test.ts

@@ -92,6 +92,38 @@ describe('createPackageJSON', () => {
     })
   })
 
+  it('should merge pnpm onlyBuiltDependencies from base and add-ons', () => {
+    const packageJSON = createPackageJSON({
+      chosenAddOns: [
+        {
+          packageTemplate:
+            '{"pnpm": {"onlyBuiltDependencies": ["better-sqlite3"]}}',
+        },
+      ],
+      addOnOptions: {},
+      mode: 'file-router',
+      typescript: true,
+      tailwind: true,
+      projectName: 'test',
+      framework: {
+        basePackageJSON: {
+          pnpm: {
+            onlyBuiltDependencies: ['esbuild', 'lightningcss'],
+          },
+        },
+        optionalPackages: {
+          typescript: {},
+          tailwindcss: {},
+          'file-router': {},
+        },
+      } as unknown as Framework,
+    } as unknown as Options)
+
+    expect(packageJSON.pnpm).toEqual({
+      onlyBuiltDependencies: ['esbuild', 'lightningcss', 'better-sqlite3'],
+    })
+  })
+
   it('should provide execute command helper in package templates', () => {
     const packageJSON = createPackageJSON({
       chosenAddOns: [