{ pkgs, lib, ... }:

let
  # Most registry compromises are caught and unpublished within days, so a
  # week-old version has had time to be noticed. Lifecycle scripts are
  # already blocked by pnpm unless a project allows them.
  pnpmConfig = ''
    minimumReleaseAge: 10080
    trustPolicy: no-downgrade
    blockExoticSubdeps: true
  '';
in
{
  # pnpm reads $XDG_CONFIG_HOME/pnpm/config.yaml, and on macOS falls back to
  # ~/Library/Preferences/pnpm when XDG_CONFIG_HOME is unset (GUI apps, editors).
  xdg.configFile."pnpm/config.yaml".text = pnpmConfig;
  home.file."Library/Preferences/pnpm/config.yaml" = lib.mkIf pkgs.stdenv.isDarwin {
    text = pnpmConfig;
  };

  # An env var rather than ~/.npmrc, which `npm login` must be able to write.
  # pnpm ignores it. Explicit `npm run <script>` still runs.
  home.sessionVariables.npm_config_ignore_scripts = "true";

  home.packages = [ pkgs.osv-scanner ];
}