# npm-compatible project policy.
#
# pnpm 11 reads non-registry settings from pnpm-workspace.yaml, not this
# file. These duplicate only the npm controls that keep an accidental npm
# install fail-closed; the public registry pin is authoritative for both.
ignore-scripts=true
strict-ssl=true
package-lock=true
fund=false
audit=true
audit-level=moderate
registry=https://registry.npmjs.org/
