From 0ecbbecfb35373e01825da8901c0e7a26eeec3c9 Mon Sep 17 00:00:00 2001
From: Dan Lynch <pyramation@gmail.com>
Date: Thu, 6 Aug 2026 02:48:51 -0700
Subject: [PATCH] chore: consume published inventories, and stop exempting
 graphql
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This workspace listed an upstream npm account under `maintainers` to
exempt the graphile v5 stack. That account also co-maintains `graphql`,
so the exemption reached further than intended — `pnpm-workspace.yaml`
carried:

    minimumReleaseAgeExclude:
      - graphql

along with graphiql, monaco-graphql, graphql-language-service and the
four @graphiql/* packages. `graphql` has six maintainers, so a compromise
of any one of those accounts published a release this workspace installed
immediately, with no wait. `maintainers` is a delegation as wide as
everything an account will ever publish; that is fine for accounts we
control and wrong for anyone who also maintains popular upstream code.

Two published inventories replace it, merged by pnpm-policy:

    inventory:
      - "@constructive-io/pnpm-policy/inventory.json"
      - "@constructive-io/pnpm-policy-graphile/inventory.json"

The graphile one enumerates 16 package names, derived from what the
lockfiles resolve and filtered to packages published from Graphile-owned
repositories. All 16 are still exempt. The eight above are not, and now
wait like any other third-party dependency — we upgrade graphql rarely,
so the wait costs nothing.

Deletes the local 1041-line pnpm-policy.inventory.json. The list lived in
two places, went stale independently, and had to be reviewed by hand;
both sources are now pinned packages, so a change to what skips the wait
arrives as a version bump. Drops `policy:refresh` with it — refreshing
happens where the inventories are published.

No npm account is named anywhere in this repo now.

Verified: policy check matches, generate is byte-identical on a second
run, and the exemption list goes from 49 first-party names to 41 with all
16 graphile packages retained and none of the eight.
---
 package.json               |    7 +-
 pnpm-lock.yaml             |   32 +-
 pnpm-policy.inventory.json | 1041 ------------------------------------
 pnpm-policy.yaml           |   43 +-
 pnpm-workspace.yaml        |   12 +-
 5 files changed, 54 insertions(+), 1081 deletions(-)
 delete mode 100644 pnpm-policy.inventory.json

diff --git a/package.json b/package.json
index cbb83cc2a..98f2fa1e9 100644
--- a/package.json
+++ b/package.json
@@ -24,11 +24,12 @@
     "fixtures:install": "node pgpm/cli/dist/index.js install -W",
     "fixtures:install:force": "node pgpm/cli/dist/index.js install -W --force",
     "policy": "pnpm-policy generate",
-    "policy:check": "pnpm-policy check",
-    "policy:refresh": "pnpm-policy inventory"
+    "policy:check": "pnpm-policy check"
   },
   "devDependencies": {
     "@constructive-io/eslint-config": "^0.2.0",
+    "@constructive-io/pnpm-policy": "0.3.1",
+    "@constructive-io/pnpm-policy-graphile": "0.2.0",
     "@jest/test-sequencer": "^30.4.1",
     "@types/jest": "^30.0.0",
     "@types/jest-in-case": "^1.0.9",
@@ -44,7 +45,7 @@
     "jest-in-case": "^1.0.2",
     "lerna": "^8.2.3",
     "makage": "^0.3.0",
-    "pnpm-policy": "^0.2.2",
+    "pnpm-policy": "^0.4.0",
     "prettier": "^3.9.6",
     "rimraf": "^6.1.3",
     "ts-jest": "^29.4.12",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 26b451fcb..41b881074 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -30,6 +30,12 @@ importers:
       '@constructive-io/eslint-config':
         specifier: ^0.2.0
         version: 0.2.0(eslint@9.39.2(jiti@2.7.0))(typescript@5.9.3)
+      '@constructive-io/pnpm-policy':
+        specifier: 0.3.1
+        version: 0.3.1
+      '@constructive-io/pnpm-policy-graphile':
+        specifier: 0.2.0
+        version: 0.2.0
       '@jest/test-sequencer':
         specifier: ^30.4.1
         version: 30.4.1
@@ -76,8 +82,8 @@ importers:
         specifier: ^0.3.0
         version: 0.3.0
       pnpm-policy:
-        specifier: ^0.2.2
-        version: 0.2.2
+        specifier: ^0.4.0
+        version: 0.4.0
       prettier:
         specifier: ^3.9.6
         version: 3.9.6
@@ -4575,6 +4581,18 @@ packages:
     peerDependencies:
       eslint: ^9
 
+  '@constructive-io/pnpm-policy-graphile@0.2.0':
+    resolution:
+      {
+        integrity: sha512-1V2VlZxBPDyK8HD7c0uq1Vo6Hmh7YQCqESQSA9sYKut+aXHgQ+RcS+J+AZn+zDIJxsogDCVCdv8nC+7hhOw78g==,
+      }
+
+  '@constructive-io/pnpm-policy@0.3.1':
+    resolution:
+      {
+        integrity: sha512-v2nimFniinTq2HGMn6QQehXAYRihd+csUefXCocXLqMAKuypqfxjzVVd3I94dTuexrjPghNt7hTxSeoflZkcYg==,
+      }
+
   '@constructive-io/fetch@1.1.2':
     resolution:
       {
@@ -13321,10 +13339,10 @@ packages:
       }
     engines: { node: '>=4' }
 
-  pnpm-policy@0.2.2:
+  pnpm-policy@0.4.0:
     resolution:
       {
-        integrity: sha512-Fj5/ACIZG/AGynTvhT8/7fJTf8ya3jG/Mkq/OMNVZhfTTJ1oniRTsKBHlXGF4sSecvIFqkmeHpn8CsQFwGcENA==,
+        integrity: sha512-ZtywuzjErUZ7PZzuZJ0FMSJ5wFmKRZaZT7onF6GbYB2gUkgczCtLzqy6P6s8regOi1dAXgs7PyIVrkuMPRJtNw==,
       }
     hasBin: true
 
@@ -16080,6 +16098,10 @@ snapshots:
       - supports-color
       - typescript
 
+  '@constructive-io/pnpm-policy-graphile@0.2.0': {}
+
+  '@constructive-io/pnpm-policy@0.3.1': {}
+
   '@constructive-io/fetch@1.1.2': {}
 
   '@cspotcode/source-map-support@0.8.1':
@@ -22295,7 +22317,7 @@ snapshots:
 
   pluralize@7.0.0: {}
 
-  pnpm-policy@0.2.2:
+  pnpm-policy@0.4.0:
     dependencies:
       yaml: 2.9.0
       yamlize: 0.12.1
diff --git a/pnpm-policy.inventory.json b/pnpm-policy.inventory.json
deleted file mode 100644
index 2d089ceac..000000000
--- a/pnpm-policy.inventory.json
+++ /dev/null
@@ -1,1041 +0,0 @@
-{
-  "generatedAt": "2026-08-05T23:04:07.132Z",
-  "maintainers": [
-    "benjie",
-    "pyramation"
-  ],
-  "scopes": [
-    "@constructive-db",
-    "@constructive-io",
-    "@launchql",
-    "@pgpm",
-    "@pgpmjs",
-    "@pgsql"
-  ],
-  "packages": [
-    "12factor-env",
-    "@agentic-db/cli",
-    "@agentic-db/documents-loader",
-    "@agentic-db/sdk",
-    "@agentic-db/services",
-    "@agentic-kit/agent",
-    "@agentic-kit/anthropic",
-    "@agentic-kit/bradie",
-    "@agentic-kit/chat",
-    "@agentic-kit/cli",
-    "@agentic-kit/harness",
-    "@agentic-kit/ollama",
-    "@agentic-kit/openai",
-    "@agentic-kit/pi",
-    "@agentic-kit/protocol",
-    "@agentic-kit/react",
-    "@agentic-sdk/sdk",
-    "@benjie/gatsby-mdx",
-    "@benjie/graphiql",
-    "@benjie/moo",
-    "@benjie/persistgraphql",
-    "@benjie/persistgraphql-webpack-plugin",
-    "@benjie/pg-connection-string",
-    "@benjie/pg-query-native",
-    "@benjie/tsconfig",
-    "@chain-registry/assets",
-    "@chain-registry/cli",
-    "@chain-registry/client",
-    "@chain-registry/cosmostation",
-    "@chain-registry/interfaces",
-    "@chain-registry/juno",
-    "@chain-registry/keplr",
-    "@chain-registry/osmosis",
-    "@chain-registry/types",
-    "@chain-registry/utils",
-    "@chain-registry/v2",
-    "@chain-registry/v2-client",
-    "@chain-registry/v2-cosmostation",
-    "@chain-registry/v2-keplr",
-    "@chain-registry/v2-types",
-    "@chain-registry/v2-utils",
-    "@chain-registry/workflows",
-    "@chainmos/common",
-    "@chainmos/provider",
-    "@chainmos/router",
-    "@chainmos/types",
-    "@chainmos/wc-client",
-    "@constructive-sdk/cli",
-    "@cosmjson/stargaze",
-    "@cosmjson/stargaze-base-factory",
-    "@cosmjson/stargaze-base-minter",
-    "@cosmjson/stargaze-claim",
-    "@cosmjson/stargaze-ics721",
-    "@cosmjson/stargaze-minter",
-    "@cosmjson/stargaze-royalty-group",
-    "@cosmjson/stargaze-sg721",
-    "@cosmjson/stargaze-sg721-base",
-    "@cosmjson/stargaze-sg721-metdata-onchain",
-    "@cosmjson/stargaze-sg721-nt",
-    "@cosmjson/stargaze-splits",
-    "@cosmjson/stargaze-vending-factory",
-    "@cosmjson/stargaze-vending-minter",
-    "@cosmjson/stargaze-whitelist",
-    "@cosmjson/wasmswap",
-    "@cosmology-ui/animation",
-    "@cosmology-ui/base",
-    "@cosmology-ui/buttons",
-    "@cosmology-ui/chain-dropdown",
-    "@cosmology-ui/connect-modal",
-    "@cosmology-ui/copy-address-button",
-    "@cosmology-ui/react",
-    "@cosmology-ui/swap",
-    "@cosmology-ui/theme",
-    "@cosmology-ui/utils",
-    "@cosmology/ast",
-    "@cosmology/babel",
-    "@cosmology/babel-plugin-transform-bigint",
-    "@cosmology/cli",
-    "@cosmology/core",
-    "@cosmology/cosmjs",
-    "@cosmology/cosmos-registry",
-    "@cosmology/db-client",
-    "@cosmology/lcd",
-    "@cosmology/proto-parser",
-    "@cosmology/protobufjs",
-    "@cosmology/protobufs",
-    "@cosmology/react",
-    "@cosmology/telescope",
-    "@cosmology/ts-codegen-types",
-    "@cosmology/types",
-    "@cosmology/ui",
-    "@cosmology/utils",
-    "@cosmonauts/ast-gen",
-    "@cosmonauts/auth",
-    "@cosmonauts/core",
-    "@cosmonauts/cosmjs",
-    "@cosmonauts/cosmos",
-    "@cosmonauts/cosmos-amino",
-    "@cosmonauts/cosmos-cosmjs",
-    "@cosmonauts/cosmos-cosmwasm-stargate",
-    "@cosmonauts/cosmos-msgs",
-    "@cosmonauts/cosmos-proto",
-    "@cosmonauts/cosmos-query",
-    "@cosmonauts/cosmos-stargate",
-    "@cosmonauts/injective",
-    "@cosmonauts/interchain",
-    "@cosmonauts/osmosis",
-    "@cosmonauts/protobuf",
-    "@cosmonauts/telescope",
-    "@cosmonauts/types",
-    "@cosmonauts/utils",
-    "@cosmos-kit/arculus",
-    "@cosmos-kit/arculus-mobile",
-    "@cosmos-kit/aria",
-    "@cosmos-kit/aria-extension",
-    "@cosmos-kit/aria-mobile",
-    "@cosmos-kit/bitgetwallet",
-    "@cosmos-kit/bitgetwallet-extension",
-    "@cosmos-kit/cdcwallet",
-    "@cosmos-kit/cdcwallet-extension",
-    "@cosmos-kit/coin98",
-    "@cosmos-kit/coin98-extension",
-    "@cosmos-kit/compass",
-    "@cosmos-kit/compass-extension",
-    "@cosmos-kit/config",
-    "@cosmos-kit/core",
-    "@cosmos-kit/cosmos-extension-metamask",
-    "@cosmos-kit/cosmostation",
-    "@cosmos-kit/cosmostation-extension",
-    "@cosmos-kit/cosmostation-mobile",
-    "@cosmos-kit/ctrl",
-    "@cosmos-kit/ctrl-extension",
-    "@cosmos-kit/exodus",
-    "@cosmos-kit/exodus-extension",
-    "@cosmos-kit/figure-markets",
-    "@cosmos-kit/figure-markets-mobile",
-    "@cosmos-kit/fin",
-    "@cosmos-kit/fin-extension",
-    "@cosmos-kit/foxwallet",
-    "@cosmos-kit/foxwallet-extension",
-    "@cosmos-kit/frontier",
-    "@cosmos-kit/frontier-extension",
-    "@cosmos-kit/galaxy-station",
-    "@cosmos-kit/galaxy-station-extension",
-    "@cosmos-kit/galaxy-station-mobile",
-    "@cosmos-kit/gatewallet",
-    "@cosmos-kit/gatewallet-extension",
-    "@cosmos-kit/imtoken",
-    "@cosmos-kit/imtoken-extension",
-    "@cosmos-kit/initia",
-    "@cosmos-kit/initia-extension",
-    "@cosmos-kit/ins",
-    "@cosmos-kit/keplr",
-    "@cosmos-kit/keplr-extension",
-    "@cosmos-kit/keplr-mobile",
-    "@cosmos-kit/leap",
-    "@cosmos-kit/leap-capsule-social-login",
-    "@cosmos-kit/leap-extension",
-    "@cosmos-kit/leap-metamask-cosmos-snap",
-    "@cosmos-kit/leap-mobile",
-    "@cosmos-kit/ledger",
-    "@cosmos-kit/ninji",
-    "@cosmos-kit/ninji-extension",
-    "@cosmos-kit/oko",
-    "@cosmos-kit/okto-extension",
-    "@cosmos-kit/okxwallet",
-    "@cosmos-kit/okxwallet-extension",
-    "@cosmos-kit/omni",
-    "@cosmos-kit/omni-extension",
-    "@cosmos-kit/omni-mobile",
-    "@cosmos-kit/owallet",
-    "@cosmos-kit/owallet-extension",
-    "@cosmos-kit/owallet-mobile",
-    "@cosmos-kit/prax-extension",
-    "@cosmos-kit/react",
-    "@cosmos-kit/react-lite",
-    "@cosmos-kit/registry",
-    "@cosmos-kit/shell",
-    "@cosmos-kit/shell-extension",
-    "@cosmos-kit/station",
-    "@cosmos-kit/station-extension",
-    "@cosmos-kit/tailwind",
-    "@cosmos-kit/tailwind-extension",
-    "@cosmos-kit/terra-extension",
-    "@cosmos-kit/terrastation",
-    "@cosmos-kit/terrastation-extension",
-    "@cosmos-kit/trust",
-    "@cosmos-kit/trust-extension",
-    "@cosmos-kit/trust-mobile",
-    "@cosmos-kit/types",
-    "@cosmos-kit/vectis",
-    "@cosmos-kit/vectis-extension",
-    "@cosmos-kit/vultisig",
-    "@cosmos-kit/vultisig-extension",
-    "@cosmos-kit/walletconnect",
-    "@cosmos-kit/walletconnect-v1",
-    "@cosmos-kit/walletconnect-v2",
-    "@cosmos-kit/wallets",
-    "@cosmos-kit/web3auth",
-    "@cosmos-kit/xdefi",
-    "@cosmos-kit/xdefi-extension",
-    "@cosmos-wallet/core",
-    "@cosmos-wallet/keplr",
-    "@cosmos-wallet/react",
-    "@cosmos-wallet/registry",
-    "@cosmos-wallet/types",
-    "@cosmwasm/ts-codegen",
-    "@cosmwasm/ts-codegen-ast",
-    "@cosmwasm/ts-codegen-types",
-    "@dataplan/json",
-    "@dataplan/pg",
-    "@decryption/base",
-    "@decryption/bip32",
-    "@decryption/bip39",
-    "@decryption/ciphers",
-    "@decryption/cli",
-    "@decryption/core",
-    "@decryption/cosmology-compat",
-    "@decryption/curves",
-    "@decryption/hashes",
-    "@decryption/keys",
-    "@decryption/legacy",
-    "@decryption/secrets",
-    "@decryption/shamir",
-    "@decryption/vault",
-    "@decryption/wallet",
-    "@fbp/evaluator",
-    "@fbp/graph-editor",
-    "@fbp/litegraph",
-    "@fbp/spec",
-    "@fbp/types",
-    "@genomic/scaffolds",
-    "@genomic/utils",
-    "@grafserv/persisted",
-    "@graphile-contrib/constraint-error-tags",
-    "@graphile-contrib/graphql-sse",
-    "@graphile-contrib/pg-dynamic-attributes",
-    "@graphile-contrib/pg-many-to-many",
-    "@graphile-contrib/pg-non-null",
-    "@graphile-contrib/pg-omit-archived",
-    "@graphile-contrib/pg-order-by-multi-column-index",
-    "@graphile-contrib/pg-order-by-related",
-    "@graphile-contrib/pg-simplify-inflector",
-    "@graphile-contrib/pgdbi",
-    "@graphile-contrib/postgraphile-plugin-fulltext-filter",
-    "@graphile/depth-limit",
-    "@graphile/federation",
-    "@graphile/global-ids",
-    "@graphile/lds",
-    "@graphile/logger",
-    "@graphile/lru",
-    "@graphile/operation-hooks",
-    "@graphile/persisted-operations",
-    "@graphile/pg-aggregates",
-    "@graphile/pg-pubsub",
-    "@graphile/postgis",
-    "@graphile/pro",
-    "@graphile/simplify-inflection",
-    "@graphile/smart-tags-table",
-    "@graphile/subscriptions-lds",
-    "@graphile/supporter",
-    "@graphiql/plugin-code-exporter",
-    "@graphiql/plugin-doc-explorer",
-    "@graphiql/plugin-explorer",
-    "@graphiql/plugin-history",
-    "@graphiql/plugin-utils",
-    "@graphiql/react",
-    "@graphiql/toolkit",
-    "@grateful-hug/react",
-    "@hyperweb/build",
-    "@hyperweb/cli",
-    "@hyperweb/explorer",
-    "@hyperweb/mcp-server",
-    "@hyperweb/parse",
-    "@hyperweb/playground",
-    "@hyperweb/telescope",
-    "@hyperweb/ts-json-schema",
-    "@inquirerer/test",
-    "@inquirerer/utils",
-    "@interchain-kit/backpack-extension",
-    "@interchain-kit/coin98-extension",
-    "@interchain-kit/compass-extension",
-    "@interchain-kit/core",
-    "@interchain-kit/cosmos-extension-metamask",
-    "@interchain-kit/cosmostation-extension",
-    "@interchain-kit/exodus-extension",
-    "@interchain-kit/fin-extension",
-    "@interchain-kit/frontier-extension",
-    "@interchain-kit/galaxy-station-extension",
-    "@interchain-kit/keplr-extension",
-    "@interchain-kit/keplr-mobile",
-    "@interchain-kit/leap-cosmos-extension-metamask",
-    "@interchain-kit/leap-extension",
-    "@interchain-kit/leap-mobile",
-    "@interchain-kit/ledger",
-    "@interchain-kit/metamask-extension",
-    "@interchain-kit/mock-wallet",
-    "@interchain-kit/ninji-extension",
-    "@interchain-kit/okx-extension",
-    "@interchain-kit/phantom-extension",
-    "@interchain-kit/react",
-    "@interchain-kit/shell-extension",
-    "@interchain-kit/solflare-extension",
-    "@interchain-kit/station-extension",
-    "@interchain-kit/store",
-    "@interchain-kit/trust-extension",
-    "@interchain-kit/vue",
-    "@interchain-kit/vultisig-extension",
-    "@interchain-kit/xdefi-extension",
-    "@interchain-ui/react",
-    "@interchain-ui/react-no-ssr",
-    "@interchain-ui/vue",
-    "@interchainjs/amino",
-    "@interchainjs/auth",
-    "@interchainjs/cosmos",
-    "@interchainjs/cosmos-msgs",
-    "@interchainjs/cosmos-query",
-    "@interchainjs/cosmos-types",
-    "@interchainjs/crypto",
-    "@interchainjs/encoding",
-    "@interchainjs/ethereum",
-    "@interchainjs/ethermint",
-    "@interchainjs/injective",
-    "@interchainjs/math",
-    "@interchainjs/pubkey",
-    "@interchainjs/react",
-    "@interchainjs/solana",
-    "@interchainjs/types",
-    "@interchainjs/utils",
-    "@interchainjs/vue",
-    "@interweb-js/interwebjs",
-    "@interweb-ui/cli",
-    "@interweb-ui/compiler",
-    "@interweb-ui/react",
-    "@interweb-utils/casing",
-    "@interweb-utils/find-pkg",
-    "@interweb/build",
-    "@interweb/casing",
-    "@interweb/eslint",
-    "@interweb/fetch-api-client",
-    "@interweb/find-pkg",
-    "@interweb/http-errors",
-    "@interweb/interweb",
-    "@interweb/node-api-client",
-    "@interweb/test-template-module",
-    "@interweb/ts-json-schema",
-    "@interweb/visual-diff",
-    "@interwebjs/interwebjs",
-    "@juno-network/assets",
-    "@juno-network/swap",
-    "@kubernetesjs/cli",
-    "@kubernetesjs/client",
-    "@kubernetesjs/manifests",
-    "@kubernetesjs/ops",
-    "@kubernetesjs/ops-cli",
-    "@kubernetesjs/react",
-    "@latex2js/html5",
-    "@latex2js/macros",
-    "@latex2js/pstricks",
-    "@latex2js/react",
-    "@latex2js/settings",
-    "@latex2js/utils",
-    "@latex2js/vue",
-    "@libpg-query/browser",
-    "@libpg-query/parser",
-    "@libpg-query/v13",
-    "@localrepo/pledge",
-    "@lql-pg/achievements",
-    "@lql-pg/base32",
-    "@lql-pg/database-jobs",
-    "@lql-pg/default-roles",
-    "@lql-pg/defaults",
-    "@lql-pg/encrypted-secrets",
-    "@lql-pg/encrypted-secrets-table",
-    "@lql-pg/faker",
-    "@lql-pg/geotypes",
-    "@lql-pg/inflection",
-    "@lql-pg/jobs",
-    "@lql-pg/jwt-claims",
-    "@lql-pg/measurements",
-    "@lql-pg/meta-db",
-    "@lql-pg/meta-db-modules",
-    "@lql-pg/meta-db-test",
-    "@lql-pg/stamps",
-    "@lql-pg/supabase",
-    "@lql-pg/totp",
-    "@lql-pg/types",
-    "@lql-pg/utils",
-    "@lql-pg/uuid",
-    "@lql-pg/verify",
-    "@mathapedia/css",
-    "@mesh-security/types",
-    "@osmonauts/ast",
-    "@osmonauts/ast-gen",
-    "@osmonauts/babel",
-    "@osmonauts/helpers",
-    "@osmonauts/lcd",
-    "@osmonauts/math",
-    "@osmonauts/osmosis",
-    "@osmonauts/proto-parser",
-    "@osmonauts/telescope",
-    "@osmonauts/transpiler",
-    "@osmonauts/types",
-    "@osmonauts/utils",
-    "@osmosis-labs/codegen",
-    "@osmosis-labs/math",
-    "@osmosis-labs/pools",
-    "@osmosis-labs/proto-codecs",
-    "@osmosis-labs/stores",
-    "@pagebond/my-first",
-    "@pagebond/my-second",
-    "@pagebond/my-third",
-    "@pgpm-demo/clinical",
-    "@pgpm-demo/documents",
-    "@pgpm-demo/lab-orders",
-    "@pgpm-demo/lab-results",
-    "@pgpm-demo/medications",
-    "@pgpm-demo/patients",
-    "@pgpm-demo/prescriptions",
-    "@pgpm-demo/scheduling",
-    "@pgpm-demo/us-states",
-    "@pgpm-testing/achievements",
-    "@pgpm-testing/base32",
-    "@pgpm-testing/database-jobs",
-    "@pgpm-testing/db-meta-modules",
-    "@pgpm-testing/db-meta-schema",
-    "@pgpm-testing/defaults",
-    "@pgpm-testing/encrypted-secrets",
-    "@pgpm-testing/encrypted-secrets-table",
-    "@pgpm-testing/faker",
-    "@pgpm-testing/geotypes",
-    "@pgpm-testing/inflection",
-    "@pgpm-testing/jobs",
-    "@pgpm-testing/jwt-claims",
-    "@pgpm-testing/measurements",
-    "@pgpm-testing/stamps",
-    "@pgpm-testing/totp",
-    "@pgpm-testing/types",
-    "@pgpm-testing/utils",
-    "@pgpm-testing/uuid",
-    "@pgpm-testing/verify",
-    "@pgql/parse",
-    "@protobufs/akash",
-    "@protobufs/amino",
-    "@protobufs/axelar",
-    "@protobufs/bcna",
-    "@protobufs/bitsong",
-    "@protobufs/canto",
-    "@protobufs/cht",
-    "@protobufs/comdex",
-    "@protobufs/confio",
-    "@protobufs/cosmos",
-    "@protobufs/cosmos_proto",
-    "@protobufs/cosmwasm",
-    "@protobufs/cronos",
-    "@protobufs/cyber",
-    "@protobufs/desmos",
-    "@protobufs/echelon",
-    "@protobufs/em",
-    "@protobufs/eve",
-    "@protobufs/evmos",
-    "@protobufs/galaxy",
-    "@protobufs/gogoproto",
-    "@protobufs/google",
-    "@protobufs/ibc",
-    "@protobufs/injective",
-    "@protobufs/juno",
-    "@protobufs/kava",
-    "@protobufs/likechain",
-    "@protobufs/lumenx",
-    "@protobufs/omniflix",
-    "@protobufs/oracle",
-    "@protobufs/osmosis",
-    "@protobufs/panacea",
-    "@protobufs/passage3d",
-    "@protobufs/persistence",
-    "@protobufs/provenance",
-    "@protobufs/pylons",
-    "@protobufs/regen",
-    "@protobufs/scavenge",
-    "@protobufs/secret",
-    "@protobufs/sentinel",
-    "@protobufs/shentu",
-    "@protobufs/sifnode",
-    "@protobufs/stargaze",
-    "@protobufs/tendermint",
-    "@protobufs/umee",
-    "@protobufs/uptake",
-    "@protobufs/vidilum",
-    "@protobufs/vidulum",
-    "@pyramation/a-test-cosmwasm-module",
-    "@pyramation/args",
-    "@pyramation/args-js",
-    "@pyramation/aws",
-    "@pyramation/babel-preset-env",
-    "@pyramation/content-type-stream",
-    "@pyramation/cosmonautsjs",
-    "@pyramation/cosmos-networks",
-    "@pyramation/cosmos-registry",
-    "@pyramation/cosmos-telescope-test",
-    "@pyramation/crypto-cli",
-    "@pyramation/crypto-coins",
-    "@pyramation/crypto-fetch",
-    "@pyramation/crypto-keys",
-    "@pyramation/crypto-networks",
-    "@pyramation/docker-env",
-    "@pyramation/dotenv",
-    "@pyramation/graphql-ast",
-    "@pyramation/htpasswd",
-    "@pyramation/inquirerer",
-    "@pyramation/json-schema-ref-parser",
-    "@pyramation/json-schema-to-typescript",
-    "@pyramation/junesmodule",
-    "@pyramation/lernademo",
-    "@pyramation/libpg-query",
-    "@pyramation/libpg-query-wasm",
-    "@pyramation/minimist",
-    "@pyramation/osmojs",
-    "@pyramation/osmosis-protobufs",
-    "@pyramation/package-merge",
-    "@pyramation/pcrypto-cli",
-    "@pyramation/pg-query-context",
-    "@pyramation/pg-query-native",
-    "@pyramation/pg-simplify-inflector",
-    "@pyramation/pgsql-parser",
-    "@pyramation/pgsql-parser-plpgsql",
-    "@pyramation/postgis",
-    "@pyramation/postgraphile",
-    "@pyramation/postgraphile-plugin-fulltext-filter",
-    "@pyramation/postgraphile-upload-field",
-    "@pyramation/prettier",
-    "@pyramation/prompt",
-    "@pyramation/protobufjs",
-    "@pyramation/react-chords",
-    "@pyramation/rpc-server",
-    "@pyramation/s3-streamer",
-    "@pyramation/s3-utils",
-    "@pyramation/sg721-stargaze",
-    "@pyramation/some-lerna-module",
-    "@pyramation/storybook-addon-chakra-theme",
-    "@pyramation/stream-to-s3",
-    "@pyramation/testingnpmmodule",
-    "@pyramation/upload-names",
-    "@pyramation/url-domains",
-    "@pyramation/us-states",
-    "@pyramation/webql",
-    "@pyramation/webql-cli",
-    "@pyramation/webql-core",
-    "@safegres/test",
-    "@san-francisco/sf-docs-embeddings",
-    "@schema-typescript/cli",
-    "@sf-ai/rag-core",
-    "@sf-ai/rag-functions",
-    "@sf-ai/rag-indexes",
-    "@sf-ai/rag-loader",
-    "@sf-ai/sdk",
-    "@sf-ai/sf-docs-embeddings",
-    "@sf-bot/rag-core",
-    "@sf-bot/rag-functions",
-    "@sf-bot/rag-indexes",
-    "@sf-bot/rag-loader",
-    "@sf-bot/sf-docs-embeddings",
-    "@stargaze-zone/chain",
-    "@stargaze-zone/contracts",
-    "@starship-ci/cli",
-    "@starship-ci/client",
-    "@starship-ci/generator",
-    "@starship-ci/types",
-    "@uni-sign/auth",
-    "@uni-sign/cosmos",
-    "@uni-sign/cosmos-msgs",
-    "@uni-sign/cosmos-query",
-    "@uni-sign/ethereum",
-    "@uni-sign/injective",
-    "@uni-sign/types",
-    "@uni-sign/utils",
-    "@wavegrid/animations",
-    "@wavegrid/canvas",
-    "@wavegrid/cli",
-    "@wavegrid/debug",
-    "@wavegrid/layout",
-    "@wavegrid/osc",
-    "@wavegrid/receiver",
-    "@wavegrid/relay",
-    "@wavegrid/server",
-    "@wavegrid/settings",
-    "@wavegrid/simulator",
-    "@webql/base32",
-    "@webql/utils",
-    "@yamlize/cli",
-    "agentic-db",
-    "agentic-kit",
-    "agentic-server",
-    "airdb",
-    "airpage",
-    "airpage-cli",
-    "airscript",
-    "akashjs",
-    "appstash",
-    "ast-stringify",
-    "autosmosis",
-    "awesome-swap",
-    "babel-plugin-icon-property-package-name",
-    "babel-slim",
-    "backbone-redis-store",
-    "backoff-script",
-    "badkids",
-    "badkidsjs",
-    "bash-ast",
-    "bitcanna",
-    "bradie",
-    "cel-proto-parser",
-    "chain-chooser",
-    "chain-connect",
-    "chain-registry",
-    "chain-registry-utils",
-    "chainmodal",
-    "clean-ansi",
-    "cm6-graphql",
-    "codemirror-graphql",
-    "comdex",
-    "confstash",
-    "connect-cosmos",
-    "connect-ibc",
-    "connect-interchain",
-    "constructiv",
-    "constructive-db",
-    "constructive-io",
-    "constructive-sdk",
-    "constructive-test",
-    "constructivejs",
-    "coolir",
-    "coolir-cli",
-    "coolir-commander",
-    "coolir-commander-utils",
-    "cosmjs-utils",
-    "cosmology",
-    "cosmos-app",
-    "cosmos-connect",
-    "cosmos-evm",
-    "cosmos-kit",
-    "cosmoscript",
-    "cosmscript",
-    "cosmwasm-contracts",
-    "cosmwasm-typescript-gen",
-    "cpbf",
-    "create-akash-app",
-    "create-akt-app",
-    "create-an-app-test",
-    "create-constructive-app",
-    "create-cosmos-app",
-    "create-cosmos-appchain",
-    "create-cosmos-chain",
-    "create-cosmos-contract",
-    "create-cosmos-dapp",
-    "create-cosmwasm-app",
-    "create-evmos-app",
-    "create-gen-app",
-    "create-hyperweb-app",
-    "create-ibc-app",
-    "create-ibc-chain",
-    "create-interchain-app",
-    "create-interweb-app",
-    "create-juno-app",
-    "create-osmo-app",
-    "create-osmosis-app",
-    "create-pg-app",
-    "create-pgpm-app",
-    "create-postgres-app",
-    "create-postgresql-app",
-    "create-scrt-app",
-    "create-secret-app",
-    "create-sql-app",
-    "create-stargaze-app",
-    "create-stars-app",
-    "create-telescope-app",
-    "create-terra-app",
-    "csv-to-gql",
-    "csv-to-pg",
-    "cwscript",
-    "da0da0",
-    "da0da0js",
-    "daodao",
-    "daodaojs",
-    "dataplanner",
-    "db-migrate-plugin-babel",
-    "dexmos",
-    "docker-parser",
-    "drizzle-orm-test",
-    "dydx",
-    "dydxjs",
-    "dymensionjs",
-    "dynargs",
-    "eslint-config-benjie",
-    "eslint-plugin-graphile-export",
-    "eslint-plugin-pg-sql",
-    "eslint-stylish-mapped",
-    "etag-hash",
-    "etag-stream",
-    "eve-network",
-    "file-ts",
-    "file-type-detection",
-    "find-and-require-package-json",
-    "flow2typescript",
-    "gatsby-source-pg",
-    "genomic",
-    "git-changed",
-    "gno",
-    "gnojs",
-    "gql-ast",
-    "gqlcheck",
-    "grafast",
-    "grafserv",
-    "graphile",
-    "graphile-authz",
-    "graphile-bucket-provisioner-plugin",
-    "graphile-build",
-    "graphile-build-pg",
-    "graphile-bulk-mutations",
-    "graphile-cache",
-    "graphile-client",
-    "graphile-column-privileges-mutations",
-    "graphile-config",
-    "graphile-connection-filter",
-    "graphile-export",
-    "graphile-function-bindings",
-    "graphile-gen",
-    "graphile-gen-js",
-    "graphile-gen-sql",
-    "graphile-history",
-    "graphile-i18n",
-    "graphile-llm",
-    "graphile-ltree",
-    "graphile-many-to-many",
-    "graphile-meta",
-    "graphile-meta-schema",
-    "graphile-migrate",
-    "graphile-misc-plugins",
-    "graphile-pg-aggregates",
-    "graphile-pg-textsearch-plugin",
-    "graphile-pg-type-mappings",
-    "graphile-pgvector-plugin",
-    "graphile-plugin-connection-filter",
-    "graphile-plugin-connection-filter-postgis",
-    "graphile-plugin-fulltext-filter",
-    "graphile-plugin-utils",
-    "graphile-postgis",
-    "graphile-presigned-url-plugin",
-    "graphile-query",
-    "graphile-realtime-subscriptions",
-    "graphile-realtime-test",
-    "graphile-schema",
-    "graphile-search",
-    "graphile-search-plugin",
-    "graphile-settings",
-    "graphile-simple-inflector",
-    "graphile-sql-expression-validator",
-    "graphile-test",
-    "graphile-upload-plugin",
-    "graphile-utils",
-    "graphile-worker",
-    "graphiql",
-    "graphql",
-    "graphql-build",
-    "graphql-build-pg",
-    "graphql-codegen-grafast",
-    "graphql-http",
-    "graphql-language-service",
-    "graphql-language-service-cli",
-    "graphql-language-service-server",
-    "graphql-parse-resolve-info",
-    "graphql-relay",
-    "graphql-server-test",
-    "graphql-sock",
-    "graphql-toe",
-    "graphql-training-check",
-    "hubot-irc2",
-    "hubot-pim",
-    "hyperweb-kit",
-    "hyperwebjs",
-    "ibc-connect",
-    "ibc-kit",
-    "ibc-script",
-    "immutable-backbone",
-    "inflekt",
-    "injective-query",
-    "injective-react",
-    "injective-vue",
-    "injectivejs",
-    "inquirerer",
-    "insforge-test",
-    "interchain",
-    "interchain-assets",
-    "interchain-chooser",
-    "interchain-connect",
-    "interchain-id",
-    "interchain-kit",
-    "interchain-lcd",
-    "interchain-query",
-    "interchain-react",
-    "interchain-registry",
-    "interchain-router",
-    "interchain-rpc",
-    "interchain-ui",
-    "interchain-utils",
-    "interchain-vue",
-    "interchain-wallet",
-    "interchain46",
-    "interchainjs",
-    "interweb",
-    "interweb-id",
-    "interweb-kit",
-    "interweb-query",
-    "interweb-registry",
-    "interweb-ui",
-    "interweb-wallet",
-    "interwebjs",
-    "introspectron",
-    "jest-serializer-graphql-schema",
-    "jest-serializer-simple",
-    "jest-time-helpers",
-    "json-schema-patch",
-    "json-stringify-simple",
-    "jsonldjs",
-    "jsqltest",
-    "juno-network",
-    "juno-rpc",
-    "junots",
-    "kavajs",
-    "kjsonl",
-    "komoji",
-    "kubernetes-test",
-    "kubernetesjs",
-    "latex2html5",
-    "latex2js",
-    "latex2js-macros",
-    "latex2js-mathjax",
-    "latex2js-pstricks",
-    "latex2js-settings",
-    "latex2js-utils",
-    "latex2react",
-    "latex2vue",
-    "launchql",
-    "launchql-client",
-    "launchql-extension-default-roles",
-    "launchql-extension-defaults",
-    "launchql-extension-jobs",
-    "launchql-extension-utils",
-    "launchql-extension-verify",
-    "launchql-gen",
-    "launchql-hooks",
-    "launchql-query",
-    "launchql-react",
-    "launchql-test",
-    "lerna-module-boilerplate-get",
-    "lerna-module-boilerplate-tsx",
-    "lerna-submodule-boilerplate-tsx",
-    "libpg-query",
-    "libpg-query-m1-native",
-    "libpg-query-win",
-    "lql-protobufjs",
-    "makage",
-    "mathjaxjs",
-    "mathjaxjs-react",
-    "mehserve",
-    "members-area",
-    "members-area-banking",
-    "members-area-gocardless",
-    "members-area-passport",
-    "members-area-payments",
-    "members-area-register-of-members",
-    "members-area-remote-auth",
-    "members-area-theme-somakeit",
-    "mermaid2react",
-    "mesh-security",
-    "mime-bytes",
-    "mobilecoin",
-    "mobilecoinjs",
-    "monaco-graphql",
-    "my-new-awesome-chain-js",
-    "neon-test",
-    "neondb-test",
-    "nested-obj",
-    "nginx-ast",
-    "niftymagick",
-    "node-type-registry",
-    "octant",
-    "omnisign",
-    "osmo-query",
-    "osmojs",
-    "osmojs-bigint",
-    "osmojs-rc",
-    "osmojs-react-query",
-    "osmojs-tsc-build",
-    "osmosisjs",
-    "parallel-transpile",
-    "pg-ast",
-    "pg-cache",
-    "pg-codegen",
-    "pg-deparser",
-    "pg-env",
-    "pg-introspection",
-    "pg-proto-parser",
-    "pg-query-context",
-    "pg-query-native-latest",
-    "pg-query-string",
-    "pg-seed",
-    "pg-spec",
-    "pg-sql2",
-    "pg-utils",
-    "pgl",
-    "pglint",
-    "pglite-test",
-    "pgpm",
-    "pgpmjs",
-    "pgrita",
-    "pgsql-client",
-    "pgsql-codegen",
-    "pgsql-deparser",
-    "pgsql-enums",
-    "pgsql-lint",
-    "pgsql-parse",
-    "pgsql-parser",
-    "pgsql-seed",
-    "pgsql-test",
-    "pgsql-types",
-    "pim-client",
-    "pimscript",
-    "pkg-prompt",
-    "plpgsql-deparser",
-    "plpgsql-parse",
-    "plpgsql-parser",
-    "pnpm-policy",
-    "postgraphile",
-    "postgraphile-apollo-server",
-    "postgraphile-core",
-    "postgraphile-derived-upload-field",
-    "postgraphile-log-consola",
-    "postgraphile-plugin-connection-filter",
-    "postgraphile-plugin-pgvector",
-    "postgraphql-build",
-    "postgres-codegen",
-    "prettier-plugin-pg",
-    "promql-ast",
-    "publish-scripts",
-    "pylonsjs",
-    "query-spec",
-    "quicksilverjs",
-    "rego-deparser",
-    "ruru",
-    "ruru-components",
-    "ruru-types",
-    "rust-ast-stringify",
-    "safegres",
-    "schema-sdk",
-    "schema-typescript",
-    "screenmagick",
-    "scriptmagick",
-    "sdkscript",
-    "sf-bot",
-    "sf-rag-utils",
-    "sigma-streamer-pulse",
-    "simple-aws",
-    "simple-smtp-server",
-    "skitch",
-    "skitch-env",
-    "skitch-ext-defaults",
-    "skitch-ext-jobs",
-    "skitch-ext-utilities",
-    "skitch-ext-verify",
-    "skitch-extension-default-roles",
-    "skitch-extension-defaults",
-    "skitch-extension-jobs",
-    "skitch-extension-utilities",
-    "skitch-extension-utils",
-    "skitch-extension-verify",
-    "skitch-install",
-    "skitch-path",
-    "skitch-prompt",
-    "skitch-template",
-    "skitch-templates",
-    "skitch-testing",
-    "skitch-transform",
-    "skitch-types",
-    "skitch-utils",
-    "sscad",
-    "standalone-module",
-    "stargaze-query",
-    "stargaze-zone",
-    "stargazejs",
-    "starshipjs",
-    "storybook-addon-chakra-theme",
-    "stream-to-etag",
-    "strfy-js",
-    "supabase-test",
-    "symlink-workspace",
-    "tamedevil",
-    "teritori",
-    "teritorijs",
-    "terrascope",
-    "teslapi",
-    "thorchain",
-    "toml-ast",
-    "torch-typescript",
-    "torchscript",
-    "tpsql",
-    "uuid-hash",
-    "uuid-stream",
-    "validator-registry",
-    "vscode-graphql-syntax",
-    "vue-latex2js",
-    "wallet-chooser",
-    "wallet-registry",
-    "warn-undefined",
-    "wasm-ast-types",
-    "wavegrid",
-    "webhook-templates",
-    "webql-cli",
-    "webql-db",
-    "wgutils",
-    "ws-changed",
-    "yamlize",
-    "yanse",
-    "yarn-compose"
-  ]
-}
diff --git a/pnpm-policy.yaml b/pnpm-policy.yaml
index 95824ec53..94eeffcba 100644
--- a/pnpm-policy.yaml
+++ b/pnpm-policy.yaml
@@ -8,7 +8,7 @@
 
 # Third-party releases wait two days before we can install them. A compromised
 # release is normally reported and yanked within hours, so a short wait catches it
-# without stalling upgrades. Our own packages are exempt (see `maintainers` below),
+# without stalling upgrades. Our own packages are exempt (see `inventory` below),
 # so publishing does not lock us out of our own workspace.
 minimumReleaseAge: 2d
 
@@ -17,17 +17,11 @@ minimumReleaseAge: 2d
 # inside a policy rollout.
 blockExoticSubdeps: false
 
-# The npm accounts whose releases skip the wait: the ones we publish under, plus
-# any upstream account we trust as if it were ours. Adding an account here
-# exempts everything it publishes, so each addition is a trust decision.
-maintainers:
-  - pyramation
-  # Trusted upstream, not ours: the graphile v5 stack (grafast, graphile-build*,
-  # postgraphile, grafserv, @dataplan/*, graphile-config, pg-sql2) is all one
-  # maintainer, we pin his exact versions, and we run his code in-process. A
-  # two-week wait on that stack only ever blocks us from the versions we
-  # deliberately upgraded to.
-  - benjie
+# No `maintainers` here. That key exists to BUILD an inventory by querying npm,
+# and this workspace consumes published ones instead (see `inventory`). Listing
+# an account would also exempt everything that account will ever publish, which
+# is how `graphql` ended up exempt: the account behind the graphile stack
+# co-maintains it, along with graphiql and monaco-graphql.
 
 # Scopes we own outright, emitted as `@scope/*`.
 scopes:
@@ -38,14 +32,19 @@ scopes:
   - "@pgpmjs"
   - "@pgsql"
 
-# The generated inventory: every unscoped and other-scoped package our
-# maintainers publish, listed by name. Rebuild it with `pnpm run policy:refresh`
-# after adding a maintainer, and review the diff.
+# Two published inventories, merged. Neither is checked in here: they are pinned
+# packages, so a change to what skips the wait arrives as a version bump you can
+# review, not as an edit to a 1000-line file in this repo.
 #
-# Local rather than the shared `@constructive-io/pnpm-policy/inventory.json`
-# because that package is built from pyramation alone, and this workspace also
-# trusts benjie (see `maintainers`).
-inventory: ./pnpm-policy.inventory.json
+#   pnpm-policy          our own packages, derived from what we publish
+#   pnpm-policy-graphile the graphile packages we run, a reviewed allowlist
+#
+# The graphile list enumerates names on purpose. It was an account entry until it
+# turned out to exempt `graphql` itself, which now waits like any other
+# third-party dependency — we upgrade it rarely, so the wait costs nothing.
+inventory:
+  - "@constructive-io/pnpm-policy/inventory.json"
+  - "@constructive-io/pnpm-policy-graphile/inventory.json"
 
 # Exempt only the inventory names this workspace's lockfile actually resolves —
 # the list should describe this repo, not the whole npm account. Scope globs are
@@ -79,9 +78,9 @@ allowBuilds: []
 # the version is already in the lockfile. `until` is the day that version turns
 # two weeks old, so `check` expires the waiver the moment it stops mattering.
 #
-# The graphile v5 stack is deliberately absent: `benjie` is a maintainer, so the
-# whole family is exempt by inventory instead of by waivers that would need
-# rewriting on every upgrade.
+# The graphile v5 stack is deliberately absent: it is exempt via the
+# pnpm-policy-graphile inventory instead of by waivers that would need rewriting
+# on every upgrade.
 exceptions:
   # Toolchain floors caught up with the newest release, so the floor itself is
   # the only satisfying version.
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 5f14f37a3..037090353 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -15,8 +15,8 @@ packages:
 # Most malicious releases are found and yanked well inside that window.
 minimumReleaseAge: 2880
 
-# Exempt from the wait: 6 scope glob(s), 49 first-party package(s), 9 exception(s).
-# First-party membership comes from what pyramation, benjie publish on npm — waiting on your own release protects nothing.
+# Exempt from the wait: 6 scope glob(s), 41 first-party package(s), 9 exception(s).
+# First-party membership comes from the inventory.
 minimumReleaseAgeExclude:
   - "@constructive-db/*"
   - "@constructive-io/*"
@@ -29,10 +29,6 @@ minimumReleaseAgeExclude:
   - "@decryption/hashes"
   - "@graphile-contrib/pg-many-to-many"
   - "@graphile/lru"
-  - "@graphiql/plugin-doc-explorer"
-  - "@graphiql/plugin-history"
-  - "@graphiql/react"
-  - "@graphiql/toolkit"
   - "@inquirerer/test"
   - "@inquirerer/utils"
   - appstash
@@ -47,15 +43,11 @@ minimumReleaseAgeExclude:
   - graphile-build-pg
   - graphile-config
   - graphile-utils
-  - graphiql
-  - graphql
-  - graphql-language-service
   - inflekt
   - inquirerer
   - komoji
   - libpg-query
   - makage
-  - monaco-graphql
   - nested-obj
   - pg-introspection
   - pg-proto-parser