chore: replace .npmrc with pnpm-workspace.yaml

.npmrc

@@ -1,25 +0,0 @@
-# Package Manager Configuration
-# Force pnpm usage - breaks npm/yarn intentionally
-node-linker=pnpm
-
-# Security: Disable all lifecycle scripts
-ignore-scripts=true
-enable-pre-post-scripts=false
-
-# Security: Require packages to be 10+ days old before installation
-minimum-release-age=14400
-
-# Security: Verify package integrity hashes
-verify-store-integrity=true
-
-# Security: Enforce strict trust policies
-trust-policy=strict
-
-# Security: Strict peer dependency resolution
-strict-peer-dependencies=true
-
-# Performance: Use symlinks for node_modules
-symlink=true
-
-# Lockfile: Ensure lockfile is not modified during install
-frozen-lockfile=false

package.json

@@ -21,6 +21,6 @@
     "eslint": "9.24.0",
     "tsx": "4.19.3",
     "vitest": "3.1.1",
-    "yaml": "2.8.2"
+    "yaml": "2.7.1"
   }
 }

pnpm-lock.yaml

@@ -10,7 +10,7 @@ importers:
     devDependencies:
       '@nhcarrigan/eslint-config':
         specifier: 5.2.0
-        version: 5.2.0(@typescript-eslint/utils@8.29.1(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)(playwright@1.51.1)(react@19.1.0)(typescript@5.7.3)(vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2))
+        version: 5.2.0(@typescript-eslint/utils@8.29.1(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)(playwright@1.51.1)(react@19.1.0)(typescript@5.7.3)(vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1))
       '@types/node':
         specifier: 22.14.0
         version: 22.14.0
@@ -25,10 +25,10 @@ importers:
         version: 4.19.3
       vitest:
         specifier: 3.1.1
-        version: 3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2)
+        version: 3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1)
       yaml:
-        specifier: 2.8.2
+        specifier: 2.7.1
-        version: 2.8.2
+        version: 2.7.1
 
 packages:
 
@@ -2274,9 +2274,9 @@ packages:
     resolution: {integrity: sha512-GCPAHLvrIH13+c0SuacwvRYj2SxJXQ4kaVTT5xgL3kPrz56XxkF21IGhjSE1+W0aw7gpBWRGXLCPnPby6lSpmQ==}
     engines: {node: '>=12'}
 
-  yaml@2.8.2:
+  yaml@2.7.1:
-    resolution: {integrity: sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==}
+    resolution: {integrity: sha512-10ULxpnOCQXxJvBgxsn9ptjq6uviG/htZKk9veJGhlqn3w/DxQ631zFF+nlQXLwmImeS5amR2dl2U8sg6U9jsQ==}
-    engines: {node: '>= 14.6'}
+    engines: {node: '>= 14'}
     hasBin: true
 
   yocto-queue@0.1.0:
@@ -2674,7 +2674,7 @@ snapshots:
 
   '@jridgewell/sourcemap-codec@1.5.0': {}
 
-  '@nhcarrigan/eslint-config@5.2.0(@typescript-eslint/utils@8.29.1(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)(playwright@1.51.1)(react@19.1.0)(typescript@5.7.3)(vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2))':
+  '@nhcarrigan/eslint-config@5.2.0(@typescript-eslint/utils@8.29.1(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)(playwright@1.51.1)(react@19.1.0)(typescript@5.7.3)(vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1))':
     dependencies:
       '@eslint-community/eslint-plugin-eslint-comments': 4.4.1(eslint@9.24.0)
       '@eslint/compat': 1.2.4(eslint@9.24.0)
@@ -2683,7 +2683,7 @@ snapshots:
       '@stylistic/eslint-plugin': 2.12.1(eslint@9.24.0)(typescript@5.7.3)
       '@typescript-eslint/eslint-plugin': 8.19.0(@typescript-eslint/parser@8.19.0(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)(typescript@5.7.3)
       '@typescript-eslint/parser': 8.19.0(eslint@9.24.0)(typescript@5.7.3)
-      '@vitest/eslint-plugin': 1.1.24(@typescript-eslint/utils@8.29.1(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)(typescript@5.7.3)(vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2))
+      '@vitest/eslint-plugin': 1.1.24(@typescript-eslint/utils@8.29.1(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)(typescript@5.7.3)(vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1))
       eslint: 9.24.0
       eslint-plugin-deprecation: 3.0.0(eslint@9.24.0)(typescript@5.7.3)
       eslint-plugin-import: 2.31.0(@typescript-eslint/parser@8.19.0(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)
@@ -2696,7 +2696,7 @@ snapshots:
       playwright: 1.51.1
       react: 19.1.0
       typescript: 5.7.3
-      vitest: 3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2)
+      vitest: 3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1)
     transitivePeerDependencies:
       - '@typescript-eslint/utils'
       - eslint-import-resolver-typescript
@@ -2955,13 +2955,13 @@ snapshots:
       '@typescript-eslint/types': 8.29.1
       eslint-visitor-keys: 4.2.0
 
-  '@vitest/eslint-plugin@1.1.24(@typescript-eslint/utils@8.29.1(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)(typescript@5.7.3)(vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2))':
+  '@vitest/eslint-plugin@1.1.24(@typescript-eslint/utils@8.29.1(eslint@9.24.0)(typescript@5.7.3))(eslint@9.24.0)(typescript@5.7.3)(vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1))':
     dependencies:
       '@typescript-eslint/utils': 8.29.1(eslint@9.24.0)(typescript@5.7.3)
       eslint: 9.24.0
     optionalDependencies:
       typescript: 5.7.3
-      vitest: 3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2)
+      vitest: 3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1)
 
   '@vitest/expect@3.1.1':
     dependencies:
@@ -2970,13 +2970,13 @@ snapshots:
       chai: 5.2.0
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@3.1.1(vite@6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2))':
+  '@vitest/mocker@3.1.1(vite@6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1))':
     dependencies:
       '@vitest/spy': 3.1.1
       estree-walker: 3.0.3
       magic-string: 0.30.17
     optionalDependencies:
-      vite: 6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2)
+      vite: 6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1)
 
   '@vitest/pretty-format@3.1.1':
     dependencies:
@@ -3222,7 +3222,7 @@ snapshots:
     dependencies:
       '@cspell/cspell-types': 8.18.1
       comment-json: 4.2.5
-      yaml: 2.8.2
+      yaml: 2.7.1
 
   cspell-dictionary@8.18.1:
     dependencies:
@@ -4662,13 +4662,13 @@ snapshots:
       spdx-correct: 3.2.0
       spdx-expression-parse: 3.0.1
 
-  vite-node@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2):
+  vite-node@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1):
     dependencies:
       cac: 6.7.14
       debug: 4.4.0
       es-module-lexer: 1.6.0
       pathe: 2.0.3
-      vite: 6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2)
+      vite: 6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1)
     transitivePeerDependencies:
       - '@types/node'
       - jiti
@@ -4683,7 +4683,7 @@ snapshots:
       - tsx
       - yaml
 
-  vite@6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2):
+  vite@6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1):
     dependencies:
       esbuild: 0.25.2
       postcss: 8.5.3
@@ -4692,12 +4692,12 @@ snapshots:
       '@types/node': 22.14.0
       fsevents: 2.3.3
       tsx: 4.19.3
-      yaml: 2.8.2
+      yaml: 2.7.1
 
-  vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2):
+  vitest@3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1):
     dependencies:
       '@vitest/expect': 3.1.1
-      '@vitest/mocker': 3.1.1(vite@6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2))
+      '@vitest/mocker': 3.1.1(vite@6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1))
       '@vitest/pretty-format': 3.1.1
       '@vitest/runner': 3.1.1
       '@vitest/snapshot': 3.1.1
@@ -4713,8 +4713,8 @@ snapshots:
       tinyexec: 0.3.2
       tinypool: 1.0.2
       tinyrainbow: 2.0.0
-      vite: 6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2)
+      vite: 6.2.5(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1)
-      vite-node: 3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.8.2)
+      vite-node: 3.1.1(@types/node@22.14.0)(tsx@4.19.3)(yaml@2.7.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/node': 22.14.0
@@ -4790,6 +4790,6 @@ snapshots:
 
   xdg-basedir@5.1.0: {}
 
-  yaml@2.8.2: {}
+  yaml@2.7.1: {}
 
   yocto-queue@0.1.0: {}

pnpm-workspace.yaml

@@ -0,0 +1,21 @@
+# Security
+
+# Do not execute any scripts of installed packages (project scripts still run)
+ignoreDepScripts: true
+# Do not automatically run pre/post scripts (e.g. preinstall, postbuild)
+enablePrePostScripts: false
+# Only allow packages published at least 10 days ago (reduces risk of compromised packages)
+minimumReleaseAge: 14400
+# Fail if a package's trust level has decreased compared to previous releases
+trustPolicy: no-downgrade
+# Ignore trust policy for packages published more than 1 year ago (predates provenance signing)
+trustPolicyIgnoreAfter: 525960
+# Fail if there are missing or invalid peer dependencies
+strictPeerDependencies: true
+# Prevent transitive dependencies from using exotic sources (git repos, direct tarball URLs)
+blockExoticSubdeps: true
+
+# Lockfile
+
+# Allow the lockfile to be updated during install (set to true in CI for stricter reproducibility)
+preferFrozenLockfile: false