# pnpm: the "write" policy, with the npm registry and pnpm's store and
# cache. Packages' install scripts run here, which is the point: they
# reach nothing but the registry and node-gyp's headers. A package can
# still publish what it reads to the registry, with a token of its own.
# The store and cache are writable: a package that is not yours can put
# things there that later installs outside the sandbox use.
# policies/commands/pnpm.policy in blinker's config directory comes first.

# type  access  pattern
include write
file    write   ${XDG_CONFIG_HOME:-~/.config}/pnpm
file    write   ${XDG_DATA_HOME:-~/.local/share}/pnpm/
file    write   ${XDG_STATE_HOME:-~/.local/state}/pnpm/
file    write   ${XDG_CACHE_HOME:-~/.cache}/pnpm/
file    write   ${XDG_CACHE_HOME:-~/.cache}/node-gyp/

host    allow   registry.npmjs.org
host    allow   nodejs.org
host    allow   github.com
host    allow   codeload.github.com
host    allow   *.githubusercontent.com

env     allow   NODE_PATH
env     allow   NODE_OPTIONS
env     allow   npm_config_*
env     allow   NPM_CONFIG_*
env     allow   PNPM_HOME