.npmrc

# Never write registry URLs into a committed package-lock.json.
#
# `resolved` records the exact feed a package came from. Public npm is blocked on some Microsoft
# networks, so a contributor installing through an internal Azure Artifacts feed would otherwise
# rewrite every `resolved` to that internal URL and leak it into this OSS repo on the next commit.
# Omitting the field keeps `integrity` (the sha512 that actually protects the supply chain) while
# making the lock feed-agnostic, so it resolves against whatever registry each contributor uses.
# Same setting microsoft/powerplatform-vscode uses.
#
# NOTE: npm reads the per-project .npmrc from the directory that OWNS package.json -- it does not
# walk up. This root copy therefore does NOT cover plugins/model-apps/scripts/_vendor-build, which
# has its own package.json and its own .npmrc (verified with `npm config get` from inside it). This
# copy is the default for any future package.json added at the repo root.
#
# It likewise does NOT affect the other plugins: plugins/mobile-apps/template and the
# plugins/power-pages/skills/create-site/assets/* packages each own a package.json, and
# `npm config get omit-lockfile-registry-resolved` reads false in each. That is deliberate -- those
# are templates scaffolded into USER projects, and forcing our lockfile policy onto a user's project
# would be wrong. They also ship no lock file today. A repo-wide test
# (plugins/model-apps/scripts/tests/run-tests.test.js) sweeps every committed package-lock.json and
# fails if any records a non-public feed URL, so a lock added elsewhere is still covered.
omit-lockfile-registry-resolved=true