# Repository-level npm configuration. It applies to every workspace and to
# contributors and CI alike.

# Save an exact version rather than a caret range when `npm install <pkg>`
# adds or upgrades a dependency, so an upgrade is always a reviewable diff
# instead of something a later install resolves on its own.
#
# The line this draws is what ships. Anything that stays inside the repository
# is pinned: every `devDependencies` entry, and the dependencies of the
# private release bot. Anything a consumer installs keeps a range, because an
# exact version there overrides their resolution and stops their own
# `npm audit fix` from reaching a patched build without waiting for a release:
#
#   - `dependencies` in packages/core/package.json, the only published
#     runtime block in the repository
#   - every `peerDependencies` entry, which states what a consumer may bring
#   - `@open-multi-agent/core` in packages/otel/package.json, which expresses
#     core compatibility
#
# save-exact does not rewrite manifests that already carry a range, but it
# will pin a NEW dependency added to one of those blocks, so widen it by hand.
# The `package` job in ci.yml asserts both published blocks and fails if
# either is ever saved exactly.
save-exact=true

# `min-release-age` is deliberately absent. It first shipped in npm 11.10.0,
# and the CI matrix runs Node 20 and 22, which bundle npm 10.8.2 and 10.9.8.
# Those two would ignore the key without a word, so the quarantine window
# would hold on one leg of the matrix and not the other two. It also has no
# effect on `npm ci`, which installs the lockfile verbatim.
