Dependency policy

A new runtime dependency in packages/ requires an issue, explicit sign-off, and an entry in the pull request explaining:

• what it does that we cannot reasonably do ourselves
• its full transitive tree and the total added byte count
• who audits it and when it was last audited
• whether it has install scripts (if yes, it is rejected or vendored)
• what happens if it is abandoned

.npmrc sets ignore-scripts=true globally and save-exact=true. Any package that needs an install script to function does not go on this device. That rule has already cost us convenient options and it will cost us more.

Any lockfile change requires human sign-off in review. A pull request that touches package-lock.json without saying why in the description will be sent back. Dependency confusion and typosquatting attacks look exactly like an innocuous lockfile diff, and the only defence that works is someone actually reading it.

Development dependencies are held to a lower but still real bar: they run on your machine and in CI, which means they can tamper with a build.

The pinned stack

Cryptography and Bitcoin logic come from Paul Miller's audited stack, chosen for a minimal transitive tree:

@noble/curves, @noble/hashes, @scure/bip32, @scure/bip39, @scure/base, @scure/btc-signer.

bitcoinjs-lib is a development dependency only. It is the independent second implementation that the differential test suite checks us against. It never ships.

---