# Pin this project to the public npm registry.
#
# AUDIT 2026-07-26: a global ~/.npmrc may point npm at a private company
# mirror. Pinning here keeps any such host (and its resolved URLs) out of
# this repo's package-lock.json and out of CI builds. The comment used to
# name the specific internal mirror, in a file that ships to the public
# repo -- the leak filter never covered .npmrc.
registry=https://registry.npmjs.org/
# No `omit=optional` here: the esbuild/rollup platform binaries ship as
# transitive optionalDependencies. Omitting them breaks `npm run build` in
# every clean environment -- including the community review bot's build
# verification. The lockfile's only optional packages are platform binaries
# plus fsevents; CI keeps `--ignore-scripts` as the lifecycle guard.
