From 8e004f664ee6791cfa2beb05494a2228c04a90d6 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 5 Aug 2026 21:32:00 -0700 Subject: [PATCH] docs(pnpm-policy): stop publishing our account topology MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README stated our package count "behind one maintainer account". That is a detail about how our publishing is structured, on a public README for a tool whose whole subject is supply-chain risk — it points at the single thing worth compromising. Says "over 1100 published packages" instead. The number carries the point (a bare wait would stall on our own releases constantly); how many accounts sit behind it does not. The exact count is dropped in both places for the same reason: it is precise enough to track over time and adds nothing to the explanation. `maintainers` stays throughout as the config key and the concept — the README needs it to explain what the setting does. What is removed is the statement about our own arrangement. --- packages/pnpm-policy/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/pnpm-policy/README.md b/packages/pnpm-policy/README.md index 441bf06..2ba5a0d 100644 --- a/packages/pnpm-policy/README.md +++ b/packages/pnpm-policy/README.md @@ -33,7 +33,7 @@ minimumReleaseAgeExclude: Your releases install immediately. Everything else waits. -At Constructive that is 1104 published packages behind one maintainer account, fetched in 5 requests and under two seconds, compressing to 5 scope globs plus 85 individual names for a workspace with ~1800 resolved dependencies. +At Constructive that is over 1100 published packages, fetched in 5 requests and under two seconds, compressing to 5 scope globs plus 85 individual names for a workspace with ~1800 resolved dependencies. ## Installation @@ -172,7 +172,7 @@ Two rules govern how it compresses: **Unscoped names are listed individually**, which is exact: they come from your own maintainer query. -**Intersection.** By default only names this workspace actually resolves (read from `pnpm-lock.yaml`) are written out — 1104 published packages becomes the ~85 that appear in this repo. Scope globs are never intersected: nobody else can publish into a scope you own, so the glob stays correct when a new package lands there tomorrow. Pass `--no-intersect` to emit everything. A config with no `inventory:` has no individual names to narrow, so it needs no lockfile at all — which is what lets a freshly scaffolded workspace generate its policy before its first install. +**Intersection.** By default only names this workspace actually resolves (read from `pnpm-lock.yaml`) are written out — over 1100 published packages becomes the ~85 that appear in this repo. Scope globs are never intersected: nobody else can publish into a scope you own, so the glob stays correct when a new package lands there tomorrow. Pass `--no-intersect` to emit everything. A config with no `inventory:` has no individual names to narrow, so it needs no lockfile at all — which is what lets a freshly scaffolded workspace generate its policy before its first install. Commit the inventory and review its diffs. It is an exemption list, so a name appearing in it is a name that stops being quarantined — worth one human glance, which is also why refreshing it should open a pull request rather than run silently in an install hook.