[{"data":1,"prerenderedAt":398},["ShallowReactive",2],{"docs-navigation:en":3,"content-page:docs:FNrDlffP9PmMVepdDkVauNyCa-_EP4xvc9Dzt3AthJY":72,"content-page-surround:docs:FNrDlffP9PmMVepdDkVauNyCa-_EP4xvc9Dzt3AthJY":389,"i-lucide:file":392,"i-lucide:clipboard":396},[4,12,18,24,30,36,42,48,54,60,66],{"title":5,"id":6,"canonicalKey":7,"locale":8,"draft":9,"icon":10,"path":11},"Overview","content:docs:1.overview.md","1","en",false,"lucide:compass","\u002Fdocs\u002Foverview",{"title":13,"id":14,"canonicalKey":15,"locale":8,"draft":9,"icon":16,"path":17},"Checklist","content:docs:2.checklist.md","2","lucide:list-checks","\u002Fdocs\u002Fchecklist",{"title":19,"id":20,"canonicalKey":21,"locale":8,"draft":9,"icon":22,"path":23},"Set up a repository","content:docs:3.set-up-a-repository.md","3","lucide:folder-plus","\u002Fdocs\u002Fset-up-a-repository",{"title":25,"id":26,"canonicalKey":27,"locale":8,"draft":9,"icon":28,"path":29},"Migrate a repository","content:docs:4.migrate-a-repository.md","4","lucide:arrow-right-left","\u002Fdocs\u002Fmigrate-a-repository",{"title":31,"id":32,"canonicalKey":33,"locale":8,"draft":9,"icon":34,"path":35},"Releasing","content:docs:5.releasing.md","5","lucide:rocket","\u002Fdocs\u002Freleasing",{"title":37,"id":38,"canonicalKey":39,"locale":8,"draft":9,"icon":40,"path":41},"Write library docs","content:docs:6.writing-docs.md","6","lucide:book-open","\u002Fdocs\u002Fwriting-docs",{"title":43,"id":44,"canonicalKey":45,"locale":8,"draft":9,"icon":46,"path":47},"Dependencies","content:docs:7.dependencies.md","7","lucide:package-search","\u002Fdocs\u002Fdependencies",{"title":49,"id":50,"canonicalKey":51,"locale":8,"draft":9,"icon":52,"path":53},"Security reports and incidents","content:docs:8.security.md","8","lucide:shield-alert","\u002Fdocs\u002Fsecurity",{"title":55,"id":56,"canonicalKey":57,"locale":8,"draft":9,"icon":58,"path":59},"Adding tooling","content:docs:9.adding-tooling.md","9","lucide:hammer","\u002Fdocs\u002Fadding-tooling",{"title":61,"id":62,"canonicalKey":63,"locale":8,"draft":9,"icon":64,"path":65},"Maintain the fleet","content:docs:10.maintain-the-fleet.md","10","lucide:calendar-check","\u002Fdocs\u002Fmaintain-the-fleet",{"title":67,"id":68,"canonicalKey":69,"locale":8,"draft":9,"icon":70,"path":71},"Troubleshooting","content:docs:11.troubleshooting.md","11","lucide:wrench","\u002Fdocs\u002Ftroubleshooting",{"title":55,"description":73,"icon":58,"body":74,"type":378,"id":56,"canonicalKey":57,"draft":9,"partial":9,"locale":8,"collection":379,"navigationFile":9,"file":380,"route":384,"resolution":386},"The one rule for scripts, checks and workflows, with examples of what to add and what not to add.",{"type":75,"children":76,"toc":367},"root",[77,85,90,97,117,122,128,133,180,186,214,220,301,307,312,318,329],{"type":78,"tag":79,"props":80,"children":81},"element","p",{},[82],{"type":83,"value":84},"text","A check or script is allowed only if it guards behavior that a user relies on,\nor a real attack path.",{"type":78,"tag":79,"props":86,"children":87},{},[88],{"type":83,"value":89},"Process documentation is not security. A script that records that a process\nhappened does not make the release safer; the protected environment, trusted\npublishing and the ruleset do that.",{"type":78,"tag":91,"props":92,"children":94},"h2",{"id":93},"ask-before-adding-anything",[95],{"type":83,"value":96},"Ask before adding anything",{"type":78,"tag":98,"props":99,"children":100},"ol",{},[101,107,112],{"type":78,"tag":102,"props":103,"children":104},"li",{},[105],{"type":83,"value":106},"What breaks for a user, or which attack works, without it?",{"type":78,"tag":102,"props":108,"children":109},{},[110],{"type":83,"value":111},"Does an existing tool already do it (pnpm, Renovate, GitHub, npm, Changesets,\nTypeScript, the test runner)?",{"type":78,"tag":102,"props":113,"children":114},{},[115],{"type":83,"value":116},"Will someone maintain it when it breaks in a year?",{"type":78,"tag":79,"props":118,"children":119},{},[120],{"type":83,"value":121},"If the first answer is vague or the second is \"yes\", do not add it.",{"type":78,"tag":91,"props":123,"children":125},{"id":124},"budget",[126],{"type":83,"value":127},"Budget",{"type":78,"tag":79,"props":129,"children":130},{},[131],{"type":83,"value":132},"The audit warns when a repository grows past these. They are signals, not\nhard limits:",{"type":78,"tag":134,"props":135,"children":136},"ul",{},[137,142,155],{"type":78,"tag":102,"props":138,"children":139},{},[140],{"type":83,"value":141},"about 20 package scripts;",{"type":78,"tag":102,"props":143,"children":144},{},[145,147,153],{"type":83,"value":146},"about 1500 lines in ",{"type":78,"tag":148,"props":149,"children":150},"code",{},[151],{"type":83,"value":152},"scripts\u002F",{"type":83,"value":154},";",{"type":78,"tag":102,"props":156,"children":157},{},[158,160,165,167,172,173,178],{"type":83,"value":159},"three workflows: ",{"type":78,"tag":148,"props":161,"children":162},{},[163],{"type":83,"value":164},"ci.yml",{"type":83,"value":166},", ",{"type":78,"tag":148,"props":168,"children":169},{},[170],{"type":83,"value":171},"release.yml",{"type":83,"value":166},{"type":78,"tag":148,"props":174,"children":175},{},[176],{"type":83,"value":177},"preview.yml",{"type":83,"value":179},".",{"type":78,"tag":91,"props":181,"children":183},{"id":182},"worth-adding",[184],{"type":83,"value":185},"Worth adding",{"type":78,"tag":134,"props":187,"children":188},{},[189,194,199,204,209],{"type":78,"tag":102,"props":190,"children":191},{},[192],{"type":83,"value":193},"Tests of the public API, including type tests.",{"type":78,"tag":102,"props":195,"children":196},{},[197],{"type":83,"value":198},"A packed-consumer test: install the packed tarball in a temporary project and\nimport it. It proves the published package works, not just the source.",{"type":78,"tag":102,"props":200,"children":201},{},[202],{"type":83,"value":203},"The changeset linter, because the changelog is what users read.",{"type":78,"tag":102,"props":205,"children":206},{},[207],{"type":83,"value":208},"A docs build check that catches broken pages.",{"type":78,"tag":102,"props":210,"children":211},{},[212],{"type":83,"value":213},"A check that guards a specific past bug users hit.",{"type":78,"tag":91,"props":215,"children":217},{"id":216},"not-worth-adding",[218],{"type":83,"value":219},"Not worth adding",{"type":78,"tag":134,"props":221,"children":222},{},[223,235,240,245,250,255,273,291,296],{"type":78,"tag":102,"props":224,"children":225},{},[226,228,233],{"type":83,"value":227},"Release ledgers, state machines, evidence cards, certification manifests or\nreconciliation scripts. Changesets, the ",{"type":78,"tag":148,"props":229,"children":230},{},[231],{"type":83,"value":232},"npm",{"type":83,"value":234}," environment and npm provenance\nalready record what was released.",{"type":78,"tag":102,"props":236,"children":237},{},[238],{"type":83,"value":239},"Custom dependency-policy checkers. pnpm enforces the quarantine and the\nbuild allowlist itself.",{"type":78,"tag":102,"props":241,"children":242},{},[243],{"type":83,"value":244},"Scripts that verify action SHAs exist. Renovate maintains the pins, and\nGitHub fails the job on a bad SHA before any code runs.",{"type":78,"tag":102,"props":246,"children":247},{},[248],{"type":83,"value":249},"Checks of other checks, or tests that a policy file has a certain shape.",{"type":78,"tag":102,"props":251,"children":252},{},[253],{"type":83,"value":254},"Linting of documentation prose.",{"type":78,"tag":102,"props":256,"children":257},{},[258,260,265,266,271],{"type":83,"value":259},"Procedure handbooks inside a repository (",{"type":78,"tag":148,"props":261,"children":262},{},[263],{"type":83,"value":264},"MAINTAINING.md",{"type":83,"value":166},{"type":78,"tag":148,"props":267,"children":268},{},[269],{"type":83,"value":270},"RELEASING.md",{"type":83,"value":272},").\nLink to this handbook instead.",{"type":78,"tag":102,"props":274,"children":275},{},[276,278,282,284,289],{"type":83,"value":277},"A second CI workflow for one more check. Add a job to ",{"type":78,"tag":148,"props":279,"children":280},{},[281],{"type":83,"value":164},{"type":83,"value":283},". If a check\nreally must not block pull requests (a slow weekly smoke test, for example),\na separate workflow is fine; name it and say why in ",{"type":78,"tag":148,"props":285,"children":286},{},[287],{"type":83,"value":288},"internals\u002Fdecisions.md",{"type":83,"value":290},", and the\naudit accepts it.",{"type":78,"tag":102,"props":292,"children":293},{},[294],{"type":83,"value":295},"Wrapper scripts around one command.",{"type":78,"tag":102,"props":297,"children":298},{},[299],{"type":83,"value":300},"Custom Vercel preview workflows. Vercel's Git integration and the ignore\ncommand already do this.",{"type":78,"tag":91,"props":302,"children":304},{"id":303},"removing-tooling",[305],{"type":83,"value":306},"Removing tooling",{"type":78,"tag":79,"props":308,"children":309},{},[310],{"type":83,"value":311},"Removing a check that does not meet the rule needs no special approval. Say in\nthe pull request what it guarded and why that is covered elsewhere.",{"type":78,"tag":91,"props":313,"children":315},{"id":314},"record-the-decision",[316],{"type":83,"value":317},"Record the decision",{"type":78,"tag":79,"props":319,"children":320},{},[321,323,327],{"type":83,"value":322},"When you add or remove something notable, add a line to ",{"type":78,"tag":148,"props":324,"children":325},{},[326],{"type":83,"value":288},{"type":83,"value":328},":",{"type":78,"tag":330,"props":331,"children":334},"pre",{"language":332,"class":333},"md","shiki shiki-themes light-plus dark-plus dark:dark-plus",[335],{"type":78,"tag":148,"props":336,"children":338},{"class":337},"language-md",[339],{"type":78,"tag":340,"props":341,"children":344},"span",{"class":342,"style":343},"line","display: inline",[345,351,357,363],{"type":78,"tag":340,"props":346,"children":348},{"style":347},"color:#0451A5;--shiki-dark:#6796E6",[349],{"type":83,"value":350},"-",{"type":78,"tag":340,"props":352,"children":354},{"style":353},"color:#000000;--shiki-dark:#D4D4D4",[355],{"type":83,"value":356}," D7 (2026-09-27): Add a packed-consumer test — v2.3.0 shipped without ",{"type":78,"tag":340,"props":358,"children":360},{"style":359},"color:#800000;--shiki-dark:#CE9178",[361],{"type":83,"value":362},"`dist\u002Fruntime`",{"type":78,"tag":340,"props":364,"children":365},{"style":353},[366],{"type":83,"value":179},{"title":368,"searchDepth":369,"depth":369,"links":370},"",4,[371,373,374,375,376,377],{"id":93,"depth":372,"text":96},2,{"id":124,"depth":372,"text":127},{"id":182,"depth":372,"text":185},{"id":216,"depth":372,"text":219},{"id":303,"depth":372,"text":306},{"id":314,"depth":372,"text":317},"markdown","docs",{"source":381,"path":382,"stem":383,"dir":379,"extension":332},"content","docs\u002F9.adding-tooling.md","docs\u002F9.adding-tooling",{"requestedPath":59,"resolvedPath":59,"alternates":385},[],{"requested":387,"resolved":388,"usedFallback":9},{},{"locale":8},{"previous":390,"next":391},{"title":49,"id":50,"canonicalKey":51,"locale":8,"draft":9,"path":53},{"title":61,"id":62,"canonicalKey":63,"locale":8,"draft":9,"path":65},{"left":393,"top":393,"width":394,"height":394,"rotate":393,"vFlip":9,"hFlip":9,"body":395},0,24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z\"\u002F>\u003Cpath d=\"M14 2v5a1 1 0 0 0 1 1h5\"\u002F>\u003C\u002Fg>",{"left":393,"top":393,"width":394,"height":394,"rotate":393,"vFlip":9,"hFlip":9,"body":397},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Crect width=\"8\" height=\"4\" x=\"8\" y=\"2\" rx=\"1\" ry=\"1\"\u002F>\u003Cpath d=\"M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2\"\u002F>\u003C\u002Fg>",1791448771499]