{PROJECT_NAME}

{PROJECT_DESCRIPTION}

Getting Started

Prerequisites

• pnpm 11.x (see packageManager in package.json; use Corepack: corepack enable)
• Node.js 22+ (see engines in package.json; .node-version pins the version used for local dev and CI)

Dependency installs follow pnpm 11 supply-chain settings in pnpm-workspace.yaml: minimum release age (this template uses a 7-day quarantine, stricter than pnpm’s built-in 24-hour default), blocking exotic transitive dependencies, and an allowBuilds allowlist for packages that run install scripts. See pnpm 11 release notes and Supply-chain defaults (Socket).

Linting and formatting use Trunk (ESLint, Prettier, and more). The Trunk launcher is installed with project dependencies—you do not need a separate Trunk install for the default workflow.

Installation

pnpm install

Optional: prefetch Trunk’s hermetic tools (helpful for offline work or CI images):

pnpm exec trunk install

If you prefer a global trunk on your PATH, see the Trunk installation guide (e.g. brew install trunk-io on macOS).

Supply-chain protections

The template uses pnpm 11 with settings in pnpm-workspace.yaml: a 7-day minimumReleaseAge (10080 minutes, stricter than pnpm’s default 1 day), blockExoticSubdeps enabled, and an allowBuilds map for dependencies that must run install scripts (pnpm 11 requires this for native toolchain packages such as esbuild). See the pnpm 11 release notes.

CI: pull requests and main run pnpm lint:security then generate/scan an SPDX SBOM (.github/workflows/sbom.yml). Publish re-checks pnpm lint:security before npm publish.

Build

pnpm build

Test

pnpm test

Linting & Formatting

pnpm lint
pnpm format

Project Structure

• packages/: Monorepo packages
  • common/: Shared utilities and types

License

{LICENSE}