package-json

# package.json Standards pnpm is the **only** package manager (`packageManager: pnpm@11.x`). Never `npm install` or `bun install`. These standards hold for a **single-package** repo and a **monorepo** alike; the workspace-only additions (`workspace:*` links, the root orchestrator, `requiredScripts`) are marked as such. In a monorepo the workspace globs live in the root `pnpm-workspace.yaml` (see the **pnpm** skill). ## Adding dependencies - **Ask first.** Never add a new package to `dependencies`/`devDependencies` (or run `pnpm add`) without the user's explicit consent — name the package, what it's for, and why the stdlib or an already-installed dependency can't cover it, then wait for a yes. This holds even for packages a skill or standard recommends (e.g. the `@/`-alias devDependencies below). ## Versions - Use `"latest"` for every dependency version — pinning is the lockfile's job (`pnpm-lock.yaml`). - After any `package.json` change, run `pnpm install` from the repo root. - Commit `pnpm-lock.yaml` changes separately: `ops: update pnpm lockfile`. - **Monorepo:** local workspace packages link via the workspace protocol: `"workspace:*"`. ## Module shape - `"type": "module"` — ESM everywhere. - `"private": true` on anything unpublished — a single-package app, and (in a monorepo) the root plus any unpublished workspace. - Publishable packages declare `"files"` (ship `./dist/` + `package.json`) and a multi-entry **exports map** that points each subpath at...