.npmrc

# Fail `npm install` on an unsupported Node instead of producing a checkout that
# breaks later at an unrelated-looking command.
#
# The floor tracks the Node LTS line the Dockerfile ships (currently 24, Active
# LTS), stated to a minor where a broken npm forces it. It began lower and
# for a narrower reason: `npm run worker`, `npm run db:migrate`, and
# `npm run smoke:wanderer` pass `--env-file-if-exists`, added in Node 22.9,
# which older node rejects outright with `node: bad option` — and db:migrate is
# fly.toml's release_command, so that would fail every deploy. The current
# floor is well above that, but the failure mode is the reason this file exists.
#
# Why >=24.15.0 rather than bare >=24: npm's dependency resolver mishandles an
# *optional* peerDependency that has no satisfying node in the lock. Arborist's
# loadPeerSet resolves the unmet optional edge against the registry instead of
# skipping it, so `npm ci` demands a version that was never in the lock:
#
#   npm error Missing: esbuild@0.28.2 from lock file        (+26 @esbuild/*)
#
# vitest's nested vite@8 declares esbuild exactly that way. `npm install`
# accepts the same tree, so nothing looks wrong until someone runs `npm ci`.
# Regenerating the lock on an affected npm "fixes" it by committing esbuild
# 0.28.2 and 26 platform packages that CI does not install; don't.
#
# The floor is set where npm *documents* the fix, not where this lockfile
# happens to pass. npm/cli#8981 (npm 11.10.1) fixed peerOptional resolution in
# buildIdealTree; npm/cli#9083 (npm 11.11.1) stopped `ci` counting the
# lockfile's optional deps as missing. Node 24.15.0 is the first 24.x carrying
# npm >= 11.11.1 (11.12.1). Today's lockfile in fact survives as far down as
# 24.13.1 (npm 11.8.0), but only incidentally: the affected npm range is not
# even contiguous (11.5.x and 11.6.0 pass, 11.6.1 and 11.6.2 fail), and
# dependabot reshapes this tree weekly. Do not lower this to the empirical
# boundary.
#
# The Dockerfile COPYs this file before `npm ci` (both stages) so the image
# build fails fast on a bad base image rather than deferring the crash to
# release time. See docs/superpowers/specs/2026-08-03-local-dev-setup.md (D7a).
engine-strict=true