What problem does it solve? Adding or bumping a package in this repository is a permanent supply-chain commitment, and the pnpm configuration enforces strict gates — a release-age cooldown, install-script rulings, strict peer ranges, and a TypeScript version ceiling — that fail installs in ways that are easy to misdiagnose. This Skill tells you exactly what review record a new runtime dependency needs, how to verify a change before it lands, and what each policy failure actually means. ## Core Features & Use Cases - Dependency review checklist: Records why a builtin cannot replace the package, maintainer continuity, license compatibility, transitive surface, install scripts, and which dependency field it belongs in. - Verification workflow: Runs pnpm install, check:quick, build, and coverage in order, plus the targeted module test suite that surfaces a bump first. - Policy interpretation: Explains minimumReleaseAge cooldown behavior, allowBuilds rulings, strictPeerDependencies exceptions, and the manual pin process for .mcp.json's MCP server. - Use Case: When pnpm install fails because a freshly published version violates the release-age cooldown, use this Skill to understand the failure and either wait, pick an older range, or follow the documented exception process. ## Quick Start Ask the AI to review whether a specific package may be added to package.json and what verification steps the change requires before landing.
