.npmrc

# npm v11+ settings (not pnpm — pnpm v11 only reads auth/registry from .npmrc).
ignore-scripts=true
# The single fleet registry — npm AND pnpm read it here (installs + lookups).
# LOCKSTEP with scripts/fleet/constants/npm-registry.mts NPM_REGISTRY; a test
# asserts the two match (code is law), and the soak-exclude publish-date
# verification fetches packuments from this same registry.
registry=https://registry.npmjs.org/
min-release-age=7
# min-release-age-exclude (npm >= 11.17.0): packages exempt from the soak.
# LOCKSTEP with pnpm-workspace.yaml `minimumReleaseAgeExclude` — keep the two
# in sync (code is law). npm matches by package NAME or minimatch glob only (no
# `@version` pinning, unlike pnpm's exact-tag entries), so the per-platform
# binding families are covered by a name glob here; the pnpm side pins the exact
# version. Socket-owned scopes ship through Socket's own provenance pipeline.
# BEGIN socket-soak-excludes (derived from SOCKET_PACKAGE_PATTERNS; do not edit)
min-release-age-exclude[]=@sdxgen/*
min-release-age-exclude[]=@socketaddon/*
min-release-age-exclude[]=@socketbin/*
min-release-age-exclude[]=@socketoverride/*
min-release-age-exclude[]=@socketregistry/*
min-release-age-exclude[]=@socketsecurity/*
min-release-age-exclude[]=@stuie/*
min-release-age-exclude[]=@ultrathink/*
min-release-age-exclude[]=sdxgen
min-release-age-exclude[]=sfw
min-release-age-exclude[]=socket
min-release-age-exclude[]=stuie
# END socket-soak-excludes
# Per-platform native binding families currently inside their 7-day soak
# (pnpm pins the exact versions; see pnpm-workspace.yaml for publish/removable
# dates). The name glob exempts every binding in the family.
min-release-age-exclude[]=oxfmt
min-release-age-exclude[]=@oxfmt/binding-*
min-release-age-exclude[]=oxlint
min-release-age-exclude[]=@oxlint/binding-*