@regardio/dev 2.0.1 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -1,25 +1,25 @@
1
1
  # @regardio/dev
2
2
 
3
- A unified developer toolchain for consistent, high-quality TypeScript projects.
3
+ A shared developer toolchain for TypeScript projects that want consistent quality without wrestling with configuration.
4
4
 
5
- ## Purpose
5
+ ## What it's for
6
6
 
7
- `@regardio/dev` provides a complete, opinionated development environment that can be adopted by any JavaScript/TypeScript project. It bundles best-in-class tools with sensible defaults, enabling teams to focus on building features rather than configuring tooling.
7
+ `@regardio/dev` is an opinionated, complete development environment that any JavaScript or TypeScript project can pull in. It bundles well-tested tools with defaults that work out of the box, so a team can reach for features instead of assembling tooling.
8
8
 
9
- **One dependency. Zero configuration conflicts. Consistent quality across all projects.**
9
+ **One dependency. No configuration tug-of-war. Steady quality across projects.**
10
10
 
11
- ## Philosophy
11
+ ## The idea
12
12
 
13
- We believe in **balanced strictness**: rigorous enough to catch bugs early and maintain consistency, yet practical enough to not impede development velocity.
13
+ Balanced strictness: rigorous enough to catch trouble early and keep things consistent, loose enough to stay out of the way.
14
14
 
15
- - **Strict by default** - TypeScript strict mode, comprehensive linting, conventional commits
16
- - **Sensible defaults** - Shared configs that work out of the box
17
- - **Minimal boilerplate** - Extend presets, override only what's necessary
18
- - **Fast feedback** - Quick linting and type checking during development
15
+ - **Strict by default** TypeScript strict mode, thorough linting, conventional commits
16
+ - **Sensible defaults** shared configs that work on first install
17
+ - **Minimal boilerplate** extend a preset, override only the odd line
18
+ - **Fast feedback** quick linting and type-checking during development
19
19
 
20
- The goal is code that's correct, consistent, and a pleasure to work with.
20
+ The aim is code that's correct, consistent, and pleasant to work with — three things the industry likes to pretend are in tension.
21
21
 
22
- ## What's Inside
22
+ ## What's inside
23
23
 
24
24
  | Category | Tools |
25
25
  |----------|-------|
@@ -29,13 +29,13 @@ The goal is code that's correct, consistent, and a pleasure to work with.
29
29
  | **Workflow** | Husky, GitLab Flow |
30
30
  | **CLI utilities** | `ship-staging`, `ship-production`, `ship-hotfix` |
31
31
 
32
- ## Quick Start
32
+ ## Quick start
33
33
 
34
34
  ```bash
35
35
  pnpm add -D @regardio/dev
36
36
  ```
37
37
 
38
- Extend the shared configs in your project:
38
+ Extend the shared configs:
39
39
 
40
40
  ```jsonc
41
41
  // biome.jsonc
@@ -47,47 +47,39 @@ Extend the shared configs in your project:
47
47
 
48
48
  ## Documentation
49
49
 
50
- Detailed documentation is organized by topic:
50
+ Documentation sits alongside the code, organised by topic. Cross-project standards — principles, writing voice, documentation shape — live outside this package at [`commons/docs/en/`](../../docs/en/README.md), since they apply well beyond TypeScript.
51
51
 
52
- ### Concepts
52
+ ### Code standards
53
53
 
54
- - [AI Agents](./docs/en/agents.md) - Instructions for AI coding assistants
55
- - [API](./docs/en/standards/api.md) - API design and implementation guidelines
56
- - [Coding](./docs/en/standards/coding.md) - TypeScript, React, and general patterns
57
- - [Commits](./docs/en/standards/commits.md) - Conventional commits and changelog generation
58
- - [Documentation](./docs/en/standards/documentation.md) - Documentation structure and conventions
59
- - [Naming](./docs/en/standards/naming.md) - Consistent naming across languages
60
- - [Principles](./docs/en/standards/principles.md) - Code quality, architecture, maintainability
61
- - [React](./docs/en/standards/react.md) - React and TypeScript development patterns
62
- - [SQL](./docs/en/standards/sql.md) - PostgreSQL schema styling, structure, and access control
63
- - [Testing](./docs/en/standards/testing.md) - Testing philosophy and patterns
64
- - [Writing](./docs/en/standards/writing.md) - Voice, tone, and language for content
54
+ - [API](./docs/en/standards/api.md) API design and implementation
55
+ - [Coding](./docs/en/standards/coding.md) TypeScript, React, and general patterns
56
+ - [Commits](./docs/en/standards/commits.md) conventional commits and changelog generation
57
+ - [Naming](./docs/en/standards/naming.md) consistent naming across languages
58
+ - [React](./docs/en/standards/react.md) React and TypeScript patterns
59
+ - [SQL](./docs/en/standards/sql.md) PostgreSQL schema, structure, access control
60
+ - [Testing](./docs/en/standards/testing.md) testing philosophy and patterns
65
61
 
66
62
  ### Toolchain
67
63
 
68
- - [Biome](./docs/en/tools/biome.md) - Linting and formatting
69
- - [Commitlint](./docs/en/tools/commitlint.md) - Commit message validation
70
- - [Dependencies](./docs/en/tools/dependencies.md) - Safe dependency updates and supply-chain controls
71
- - [Husky](./docs/en/tools/husky.md) - Git hooks
72
- - [Markdownlint](./docs/en/tools/markdownlint.md) - Markdown quality
73
- - [Playwright](./docs/en/tools/playwright.md) - End-to-end testing
74
- - [Releases](./docs/en/tools/releases.md) - GitLab-flow-based versioning and releases
75
- - [TypeScript](./docs/en/tools/typescript.md) - Strict TypeScript configuration
76
- - [Vitest](./docs/en/tools/vitest.md) - Unit and integration testing
64
+ - [Biome](./docs/en/tools/biome.md) linting and formatting
65
+ - [Commitlint](./docs/en/tools/commitlint.md) — commit-message validation
66
+ - [Dependencies](./docs/en/tools/dependencies.md) safe dependency updates and supply-chain controls
67
+ - [Husky](./docs/en/tools/husky.md) git hooks
68
+ - [Markdownlint](./docs/en/tools/markdownlint.md) markdown quality
69
+ - [Playwright](./docs/en/tools/playwright.md) end-to-end testing
70
+ - [Releases](./docs/en/tools/releases.md) branch-based release flow with Changesets
71
+ - [TypeScript](./docs/en/tools/typescript.md) strict TypeScript configuration
72
+ - [Vitest](./docs/en/tools/vitest.md) unit and integration testing
77
73
 
78
74
  ## Portability
79
75
 
80
- While designed for Regardio projects, this toolchain follows well-established standards and can be adopted by any TypeScript project:
76
+ The toolchain is designed for Regardio projects, but nothing about it ties it to Regardio. Any TypeScript project can adopt it:
81
77
 
82
- - All configs extend official tool presets
83
- - No proprietary conventions or lock-in
84
- - Standard npm package distribution
85
- - MIT licensed
78
+ - Configs extend official tool presets
79
+ - No proprietary conventions, no lock-in
80
+ - Distributed as a standard npm package
81
+ - MIT-licensed
86
82
 
87
83
  ## License
88
84
 
89
85
  MIT © [Regardio](https://regard.io)
90
-
91
- ## Acknowledgments
92
-
93
- Built on the shoulders of giants: [Biome](https://biomejs.dev/), [TypeScript](https://www.typescriptlang.org/), [Vitest](https://vitest.dev/), [Playwright](https://playwright.dev/), [Vite](https://vitejs.dev/), and the entire open source ecosystem.
package/docs/en/README.md CHANGED
@@ -1,34 +1,29 @@
1
1
  ---
2
2
 
3
- title: @regardio/dev Documentation
4
- type: guide
5
- status: published
6
- summary: Complete documentation for the @regardio/dev toolchain
7
- related: [coding-standards, development-principles]
8
- locale: en-US
3
+ title: "@regardio/dev Documentation"
4
+ description: "Index for the @regardio/dev toolchain — code-level standards and the tools that enforce them."
5
+ publishedAt: 2026-04-17
6
+ language: "en"
7
+ status: "published"
9
8
  ---
10
9
 
11
10
  # Documentation
12
11
 
13
- Documentation index and quick reference for the `@regardio/dev` toolchain.
12
+ Index for the `@regardio/dev` toolchain.
14
13
 
15
- ## Concepts
14
+ Cross-project standards — voice, documentation shape, principles — live at the commons root in [`docs/en/`](../../../../docs/en/README.md). The documents below are the code-level standards and the tools that enforce them.
16
15
 
17
- Foundational principles and standards that guide development:
16
+ ## Code standards
18
17
 
19
18
  | Document | Description |
20
19
  |----------|-------------|
21
- | [AI Agents](./agents.md) | Instructions for AI coding assistants |
22
- | [API](./standards/api.md) | API design and implementation guidelines |
20
+ | [API](./standards/api.md) | API design and implementation |
23
21
  | [Coding](./standards/coding.md) | TypeScript, React, and general patterns |
24
22
  | [Commits](./standards/commits.md) | Conventional commits and changelog generation |
25
- | [Documentation](./standards/documentation.md) | Documentation structure and conventions |
26
23
  | [Naming](./standards/naming.md) | Consistent naming across languages |
27
- | [Principles](./standards/principles.md) | Code quality, architecture, maintainability |
28
- | [React](./standards/react.md) | React and TypeScript development patterns |
29
- | [SQL](./standards/sql.md) | PostgreSQL schema styling, structure, and access control |
24
+ | [React](./standards/react.md) | React and TypeScript patterns |
25
+ | [SQL](./standards/sql.md) | PostgreSQL schema, structure, access control |
30
26
  | [Testing](./standards/testing.md) | Testing philosophy and patterns |
31
- | [Writing](./standards/writing.md) | Voice, tone, and language |
32
27
 
33
28
  ## Toolchain
34
29
 
@@ -76,7 +71,7 @@ pnpm typecheck # TypeScript type checking
76
71
  | `pnpm-workspace.yaml` | Workspace dependency and supply-chain policy |
77
72
  | `tsconfig.json` | TypeScript configuration |
78
73
  | `vitest.config.ts` | Unit test configuration |
79
- | `.sqlfluff` | SQL linting (copy from `@regardio/dev/sqlfluff/setup.cfg`) |
74
+ | `.sqlfluff` | SQL linting (copy from `node_modules/@regardio/dev/templates/sqlfluff/setup.cfg`) |
80
75
 
81
76
  ### Extending Presets
82
77
 
@@ -317,7 +317,7 @@ describe('User API', () => {
317
317
  - [React](./react.md) — Patterns for the clients that consume the API
318
318
  - [SQL](./sql.md) — Naming, structure, and access on the database side
319
319
  - [Testing](./testing.md) — Testing philosophy and layers
320
- - [Principles](./principles.md) — Shared principles
320
+ - [Principles](../../../../../docs/en/principles.md) — Shared principles
321
321
 
322
322
  ---
323
323
 
@@ -134,7 +134,7 @@ An unjustified suppression is a regression.
134
134
 
135
135
  ## Related
136
136
 
137
- - [Principles](./principles.md) — Shared principles the patterns build on
137
+ - [Principles](../../../../../docs/en/principles.md) — Shared principles the patterns build on
138
138
  - [React](./react.md) — Component, hook, and state patterns
139
139
  - [Naming](./naming.md) — Names across languages
140
140
  - [Testing](./testing.md) — Testing philosophy
@@ -173,7 +173,7 @@ NODE_ENV=production
173
173
  - [Coding](./coding.md) — TypeScript and general patterns
174
174
  - [SQL](./sql.md) — PostgreSQL naming, structure, and access
175
175
  - [Commits](./commits.md) — Branch and commit naming
176
- - [Writing](./writing.md) — Voice, tone, language
176
+ - [Writing](../../../../../docs/en/writing.md) — Voice, tone, language
177
177
 
178
178
  ---
179
179
 
@@ -238,7 +238,7 @@ describe('SearchForm', () => {
238
238
 
239
239
  - [Coding](./coding.md) — TypeScript patterns React code builds on
240
240
  - [Testing](./testing.md) — Testing philosophy and layers
241
- - [Principles](./principles.md) — Shared principles across the stack
241
+ - [Principles](../../../../../docs/en/principles.md) — Shared principles across the stack
242
242
  - [Naming](./naming.md) — Names across languages
243
243
 
244
244
  ---
@@ -250,8 +250,8 @@ create policy pol_task_update on public.task
250
250
 
251
251
  - [Naming](./naming.md) — Names across languages
252
252
  - [API](./api.md) — How the schema is consumed
253
- - [Principles](./principles.md) — Shared principles
254
- - [Writing](./writing.md) — Voice, tone, language
253
+ - [Principles](../../../../../docs/en/principles.md) — Shared principles
254
+ - [Writing](../../../../../docs/en/writing.md) — Voice, tone, language
255
255
 
256
256
  ---
257
257
 
@@ -128,7 +128,7 @@ Before a package publishes:
128
128
 
129
129
  ## Related
130
130
 
131
- - [Principles](./principles.md) — Shared principles, including specification-led workflow
131
+ - [Principles](../../../../../docs/en/principles.md) — Shared principles, including specification-led workflow
132
132
  - [React](./react.md) — How components are shaped to be testable
133
133
  - [API](./api.md) — Testing API endpoints and contracts
134
134
  - [Vitest](../tools/vitest.md) — Unit and integration testing
@@ -1,20 +1,21 @@
1
1
  ---
2
2
 
3
- title: Biome
4
- type: guide
5
- status: published
6
- summary: Fast, unified linting and formatting for JavaScript and TypeScript
7
- related: [typescript, markdownlint]
8
- locale: en-US
3
+ title: "Biome"
4
+ description: "Linting and formatting for JavaScript and TypeScript, configured centrally through @regardio/dev."
5
+ publishedAt: 2026-04-17
6
+ language: "en"
7
+ status: "published"
8
+ kind: "guide"
9
+ area: "dev"
9
10
  ---
10
11
 
11
12
  # Biome
12
13
 
13
- Fast, unified linting and formatting for JavaScript and TypeScript. Single tool replacing ESLint + Prettier. Configuration is centralized through `@regardio/dev`; use wrapper commands so all packages behave consistently.
14
+ [Biome](https://biomejs.dev/) is the linter and formatter every Regardio package reaches for. Configuration is centralised through `@regardio/dev`, and wrapper commands keep every package behaving the same way.
14
15
 
15
16
  ## Configuration
16
17
 
17
- Create `biome.jsonc` in your package root:
18
+ A `biome.jsonc` at the package root is all it takes:
18
19
 
19
20
  ```jsonc
20
21
  {
@@ -36,54 +37,56 @@ Create `biome.jsonc` in your package root:
36
37
  }
37
38
  ```
38
39
 
39
- ## CLI Wrapper
40
+ ## CLI wrapper
40
41
 
41
- Use `lint-biome` instead of `biome` directly. This wrapper ensures consistent behavior across the monorepo.
42
+ Use `lint-biome` rather than `biome` directly the wrapper keeps behaviour consistent across the monorepo.
42
43
 
43
44
  ```bash
44
45
  lint-biome check . # Check for issues
45
- lint-biome check --write . # Fix auto-fixable issues
46
+ lint-biome check --write . # Fix the auto-fixable
46
47
  lint-biome format . # Format only
47
48
  ```
48
49
 
49
- ## Package.json Handling
50
+ ## `package.json` handling
50
51
 
51
- The Biome preset excludes `package.json` files from processing. Instead, use `lint-package` which:
52
+ The Biome preset leaves `package.json` alone. For those files, `lint-package` does the work:
52
53
 
53
- 1. Sorts package.json using the well-known field order
54
- 2. Fixes exports condition order (`types` before `default` for TypeScript)
54
+ 1. Sorts `package.json` using the well-known field order
55
+ 2. Fixes export-condition order (`types` before `default` for TypeScript)
55
56
 
56
57
  ```bash
57
58
  lint-package # Sort package.json in current directory
58
- lint-package path/to/pkg # Sort specific package.json
59
+ lint-package path/to/pkg # Sort a specific package.json
59
60
  ```
60
61
 
61
- This is automatically run as part of `pnpm fix`.
62
+ It runs automatically as part of `pnpm fix`.
62
63
 
63
- ## Rule Categories
64
+ ## Rule categories
64
65
 
65
- The preset enables rules across categories:
66
+ The preset enables rules across:
66
67
 
67
- - **Correctness** - Catch bugs and incorrect code
68
- - **Style** - Consistent code formatting
69
- - **Complexity** - Prevent overly complex code
70
- - **Performance** - Identify performance issues
71
- - **Security** - Flag potential security vulnerabilities
68
+ - **Correctness** catch bugs and incorrect code
69
+ - **Style** consistent code formatting
70
+ - **Complexity** prevent overly complex code
71
+ - **Performance** flag performance issues
72
+ - **Security** flag possible vulnerabilities
72
73
 
73
- ## Ignoring Rules
74
+ ## Ignoring rules
74
75
 
75
- When a rule genuinely doesn't apply, use inline comments:
76
+ When a rule genuinely doesn't apply, an inline comment names the exception:
76
77
 
77
78
  ```typescript
78
79
  // biome-ignore lint/complexity/noForEach: forEach is clearer here for side effects
79
80
  items.forEach(item => process(item));
80
81
  ```
81
82
 
82
- Always include a reason explaining why the exception is necessary.
83
+ Always include a reason an unjustified suppression is a regression waiting to spread.
83
84
 
84
- ## Editor Setup
85
+ ## Editor integration
85
86
 
86
- - **VS Code**: [Biome extension](https://marketplace.visualstudio.com/items?itemName=biomejs.biome)
87
- - **JetBrains**: Built-in support via settings
87
+ Most editors pick up `biome.jsonc` automatically through a Biome plugin or built-in support. If the editor formats on save, point it at Biome rather than another formatter so the two don't fight over the same file.
88
88
 
89
- Resources: [Biome Documentation](https://biomejs.dev/) · [Rules Reference](https://biomejs.dev/linter/rules/)
89
+ ## Related
90
+
91
+ - [TypeScript](./typescript.md) — strict TypeScript configuration
92
+ - [Markdownlint](./markdownlint.md) — linting and formatting for Markdown
@@ -1,20 +1,21 @@
1
1
  ---
2
2
 
3
- title: Commitlint
4
- type: guide
5
- status: published
6
- summary: Enforce conventional commit messages
7
- related: [husky]
8
- locale: en-US
3
+ title: "Commitlint"
4
+ description: "Validates commit messages against the conventional format through git hooks."
5
+ publishedAt: 2026-04-17
6
+ language: "en"
7
+ status: "published"
8
+ kind: "guide"
9
+ area: "dev"
9
10
  ---
10
11
 
11
12
  # Commitlint
12
13
 
13
- Validates commit messages against the conventional format via Git hooks. Rules are centralized in `@regardio/dev`.
14
+ Commitlint checks commit messages against the conventional-commits format through git hooks. The rules live in `@regardio/dev`; projects extend them without restating them.
14
15
 
15
16
  ## Configuration
16
17
 
17
- At the workspace root, create `.commitlintrc.json`:
18
+ At the workspace root, a `.commitlintrc.json`:
18
19
 
19
20
  ```json
20
21
  {
@@ -22,14 +23,14 @@ At the workspace root, create `.commitlintrc.json`:
22
23
  }
23
24
  ```
24
25
 
25
- Or use a JavaScript config:
26
+ Or, for projects that prefer JavaScript config:
26
27
 
27
28
  ```javascript
28
29
  // commitlint.config.cjs
29
30
  module.exports = require('@regardio/dev/commitlint');
30
31
  ```
31
32
 
32
- ## Commit Format
33
+ ## Commit format
33
34
 
34
35
  ```text
35
36
  <type>(<scope>): <subject>
@@ -52,7 +53,7 @@ module.exports = require('@regardio/dev/commitlint');
52
53
  | `test` | Adding or updating tests |
53
54
  | `build` | Build system or dependencies |
54
55
  | `ci` | CI configuration |
55
- | `chore` | Other changes (tooling, etc.) |
56
+ | `chore` | Other changes (tooling, and so on) |
56
57
  | `revert` | Revert a previous commit |
57
58
 
58
59
  ### Examples
@@ -68,25 +69,20 @@ feat(auth): implement OAuth2 flow
68
69
  fix(api): handle null response gracefully
69
70
  ```
70
71
 
71
- ## Rules
72
+ ## Rules the preset enforces
72
73
 
73
- The preset enforces:
74
+ - **Header max length** — 100 characters
75
+ - **Body leading blank** — blank line before the body
76
+ - **Footer leading blank** — blank line before the footer
77
+ - **Type enum** — one of the allowed types, nothing exotic
74
78
 
75
- - **Header max length**: 100 characters
76
- - **Body leading blank**: Blank line before body
77
- - **Footer leading blank**: Blank line before footer
78
- - **Type enum**: Must be one of the allowed types
79
+ ## Git hooks
79
80
 
80
- ## Git Hooks
81
+ Commitlint runs automatically through Husky on commit. See [Husky](./husky.md) for setup.
81
82
 
82
- Commitlint runs automatically via Husky on commit. See [Husky](./husky.md) for setup.
83
+ ## Related
83
84
 
84
- Related documents:
85
-
86
- - [Commit Conventions](../standards/commits.md) — Conventional commits and changelog generation
87
- - [Husky](./husky.md) — Git hooks for quality gates
88
-
89
- ### Resources
90
-
91
- - [Conventional Commits](https://www.conventionalcommits.org/)
85
+ - [Commits](../standards/commits.md) — conventional commits and changelog generation
86
+ - [Husky](./husky.md) — git hooks for quality gates
87
+ - [Conventional Commits](https://www.conventionalcommits.org/) — the specification behind all this
92
88
  - [Commitlint Documentation](https://commitlint.js.org/)
@@ -1,24 +1,25 @@
1
1
  ---
2
2
 
3
- title: Dependency Handling
4
- type: guide
5
- status: published
6
- summary: Safe dependency updates and supply-chain controls for Regardio workspaces
7
- related: [releases, typescript, vitest]
8
- locale: en-US
3
+ title: "Dependency Handling"
4
+ description: "How Regardio workspaces keep dependencies up to date without letting the supply chain surprise them."
5
+ publishedAt: 2026-04-17
6
+ language: "en"
7
+ status: "published"
8
+ kind: "guide"
9
+ area: "dev"
9
10
  ---
10
11
 
11
12
  # Dependency Handling
12
13
 
13
- Dependency update workflow and supply-chain controls for Regardio workspaces. Automated updates are combined with pnpm guardrails; the lockfile is authoritative.
14
+ Dependency updates in a Regardio workspace walk a narrow path: automated update tooling on one side, pnpm guardrails on the other, and the lockfile as the final word.
14
15
 
15
16
  ## Update workflow
16
17
 
17
- - Use `pnpm ncu` to prepare workspace dependency upgrades
18
- - Install through `pnpm` so workspace-level safety settings are applied
19
- - Run the normal verification flow after updates:
18
+ - `pnpm ncu` prepares the upgrade proposals
19
+ - Installs go through `pnpm` so workspace-level safety settings apply
20
+ - The normal verification flow runs after an update
20
21
 
21
- The root `ncu` script uses a 1-day cooldown so it does not propose versions that are newer than the workspace release-age policy.
22
+ The root `ncu` script uses a 1-day cooldown, so it won't propose versions newer than the workspace's release-age policy allows anyway.
22
23
 
23
24
  ```bash
24
25
  pnpm audit
@@ -28,7 +29,7 @@ pnpm test
28
29
  pnpm typecheck
29
30
  ```
30
31
 
31
- For larger automated upgrade passes, use the existing safety wrapper:
32
+ For larger upgrade passes, the safety wrapper pulls everything together:
32
33
 
33
34
  ```bash
34
35
  pnpm safe-upgrade
@@ -36,15 +37,13 @@ pnpm safe-upgrade
36
37
 
37
38
  ## Workspace safety settings
38
39
 
39
- The root `pnpm-workspace.yaml` defines the main supply-chain controls.
40
+ The root `pnpm-workspace.yaml` carries the main supply-chain controls.
40
41
 
41
42
  ### Allow-listed dependency builds
42
43
 
43
- Regardio keeps dependency build scripts restricted through `onlyBuiltDependencies`.
44
+ Build scripts stay restricted through `onlyBuiltDependencies`. A dependency cannot run `build` or `postinstall` unless it's already trusted and listed explicitly. If a package that never needed a build step adds one in a compromised release, pnpm doesn't run it — the workspace notices before the damage does.
44
45
 
45
- This means dependencies cannot start running build or postinstall steps unless they are already trusted and listed explicitly. If a package that previously needed no build step suddenly adds one in a compromised release, pnpm will not execute it automatically.
46
-
47
- When a legitimate dependency genuinely needs a build step, add it deliberately to the allow-list and review why it is required.
46
+ When a legitimate dependency genuinely needs a build step, add it deliberately to the allow-list and leave a note on why.
48
47
 
49
48
  ### Block exotic transitive dependencies
50
49
 
@@ -52,7 +51,7 @@ When a legitimate dependency genuinely needs a build step, add it deliberately t
52
51
  blockExoticSubdeps: true
53
52
  ```
54
53
 
55
- This prevents transitive dependencies from resolving through git URLs, tarballs, or other non-registry sources.
54
+ Transitive dependencies can't resolve through git URLs, tarballs, or other non-registry sources. The registry remains the only door in.
56
55
 
57
56
  ### Delay newly published versions
58
57
 
@@ -60,9 +59,9 @@ This prevents transitive dependencies from resolving through git URLs, tarballs,
60
59
  minimumReleaseAge: 1440
61
60
  ```
62
61
 
63
- We wait 24 hours before pnpm may install a newly published version. This gives time for compromised packages to be detected and removed before they reach the workspace.
62
+ pnpm waits 24 hours before installing a newly published version. That window is long enough for most compromised packages to be detected and pulled before they land in a workspace.
64
63
 
65
- The root `ncu` script mirrors this with `--cooldown 1`, which helps align version selection with the install policy. pnpm still remains the authoritative enforcement point during installation.
64
+ The root `ncu` script mirrors this with `--cooldown 1`, which lines version selection up with the install policy. pnpm is still the authoritative enforcement point at install time.
66
65
 
67
66
  ### Prevent trust downgrades
68
67
 
@@ -70,47 +69,45 @@ The root `ncu` script mirrors this with `--cooldown 1`, which helps align versio
70
69
  trustPolicy: no-downgrade
71
70
  ```
72
71
 
73
- If a package release becomes less trustworthy than earlier releases, pnpm rejects the installation instead of silently accepting the downgrade.
72
+ If a package release becomes less trustworthy than earlier releases, pnpm refuses to install it rather than silently accepting the downgrade.
74
73
 
75
- `npm-check-updates` does not enforce trust policy, build-script allow-lists, or exotic transitive source restrictions. Those safeguards only take effect when `pnpm install` resolves and installs dependencies.
74
+ `npm-check-updates` does not enforce trust policy, build-script allow-lists, or exotic-source restrictions. Those safeguards take effect when `pnpm install` resolves and installs — not before.
76
75
 
77
76
  ## Lockfile discipline
78
77
 
79
- - Commit `pnpm-lock.yaml`
80
- - Review lockfile changes together with manifest changes
81
- - Prefer normal installs over ad hoc per-package package manager commands so the workspace lock remains authoritative
78
+ - `pnpm-lock.yaml` is committed
79
+ - Lockfile changes are reviewed alongside manifest changes
80
+ - Prefer regular installs over ad-hoc per-package commands so the workspace lock stays authoritative
82
81
 
83
82
  ## Reviewing dependency updates
84
83
 
85
- When an automated update lands, review:
84
+ When an automated update lands, a few questions are worth asking:
86
85
 
87
- - whether the package is direct or transitive
88
- - whether the update adds or changes a build requirement
89
- - whether the package affects runtime, build tooling, or release tooling
90
- - whether overrides should be added for newly disclosed vulnerabilities
86
+ - Is the package direct or transitive?
87
+ - Does the update add or change a build requirement?
88
+ - Does the package affect runtime, build tooling, or release tooling?
89
+ - Do any newly disclosed vulnerabilities want a workspace override?
91
90
 
92
91
  ## Shipping dependency changes
93
92
 
94
- Dependency updates follow the same release gates as any other change.
95
-
96
- - verify locally before shipping
97
- - keep changelog subjects clear when a release is primarily dependency maintenance
98
- - use provenance when publishing public packages
93
+ Dependency updates go through the same release gates as any other change.
99
94
 
100
- ## When to make an exception
95
+ - Verify locally before shipping
96
+ - Keep changelog subjects clear when the release is primarily dependency maintenance
97
+ - Use provenance when publishing public packages
101
98
 
102
- Exceptions should stay explicit and rare.
99
+ ## When an exception is warranted
103
100
 
104
- Examples:
101
+ Exceptions stay explicit and rare. A few examples of what qualifies:
105
102
 
106
- - adding a package to `onlyBuiltDependencies`
107
- - introducing a workspace override for a vulnerable transitive dependency
108
- - reducing the release-age delay for a security-critical emergency update
103
+ - Adding a package to `onlyBuiltDependencies`
104
+ - Introducing a workspace override for a vulnerable transitive dependency
105
+ - Reducing the release-age delay for a security-critical emergency update
109
106
 
110
- When an exception is necessary, document the reason in the change itself so later readers can understand why the safer default was not enough.
107
+ When an exception is needed, record the reason in the change itself later readers will thank whoever left the note.
111
108
 
112
- Related documents:
109
+ ## Related
113
110
 
114
- - [Release Workflow](./releases.md) — Automated release process for Regardio packages
115
- - [Testing Approach](../standards/testing.md) — Testing philosophy and patterns for Regardio projects
116
- - [TypeScript Configuration](./typescript.md) — TypeScript setup and configuration for Regardio projects
111
+ - [Releases](./releases.md) — the release process dependency changes pass through
112
+ - [Testing](../standards/testing.md) — the layer that catches what slips past the update review
113
+ - [TypeScript](./typescript.md) — TypeScript configuration for Regardio projects