# Supply-chain guard (2026-09): never run dependency install scripts inside this repo.
# Rebuild the few packages that legitimately need them with `npm run setup`.
# This file is never published (npm always excludes .npmrc from tarballs), so
# end users installing `vskill` still get the package's own lifecycle hooks.
#
# CAVEAT — ignore-scripts is NOT scoped to dependencies. It also suppresses this
# package's OWN lifecycle hooks, so a bare `npm publish` here skips
# prepublishOnly entirely: no build, no eval-ui bundle, no badge sync, and
# (because dist/ is gitignored) a tarball with zero dist/ entries that npm
# uploads without a warning. PUBLISH WITH `npm run release`, which passes
# --ignore-scripts=false so prepublishOnly — and scripts/release/preflight-publish.mjs
# behind it — actually run. Anton's global ~/.npmrc carries ignore-scripts=true
# too, so deleting this file would not restore the hooks.
ignore-scripts=true
fund=false
audit=false
