js-package-managers

Playbook for the hardened npm / pnpm / Yarn Berry / Bun policy. Load this BEFORE editing a `package.json` dependency, unblocking a package's install-time lifecycle script, correcting a version range to an exact pin, or handling a "version too fresh" cooldown failure. It covers the per-manager lifecycle-script override mechanics (the narrowest-scope opt-in for each manager), the exact-version-pinning correction rule, and the 1-week cooldown gate handling. Do NOT load it for ordinary `import`/usage of an already-installed package, for non-JS dependency systems, or for running scripts that don't touch dependency resolution. The binding one-liners (preserve the three switches; pin exact; never lower the cooldown) are in core AGENTS.md and apply regardless.

By hyperlapse122 schedule Updated 6/4/2026