chore: upgrade to Yarn 4 (node-modules) with supply-chain age gate

.github/workflows/prerelease.yml

@@ -72,7 +72,10 @@ jobs:
               });
             }
 
-      - run: yarn install --frozen-lockfile
+      - name: Enable Corepack
+        run: corepack enable
+
+      - run: yarn install --immutable
 
       # Generate prerelease version
       - name: Generate prerelease version

.github/workflows/publish.yml

@@ -26,7 +26,10 @@ jobs:
           # Defaults to the user or organization that owns the workflow file
           scope: '@elliottech'
 
-      - run: yarn install --frozen-lockfile
+      - name: Enable Corepack
+        run: corepack enable
+
+      - run: yarn install --immutable
 
       # Get next version based on existing tags
       - name: Calculate next version
@@ -58,7 +61,7 @@ jobs:
       # Update package.json with new version
       - name: Update package.json
         run: |
-          yarn version --new-version ${{ steps.version.outputs.version }} --no-git-tag-version
+          yarn version ${{ steps.version.outputs.version }}
           echo "Updated package.json to version: $(node -p "require('./package.json').version")"
       # Create and push git tag
       - name: Create and push tag

.gitignore

@@ -8,6 +8,17 @@
 node_modules/
 npm-debug.log
 yarn-error.log
+
+# yarn (berry) — keep node-modules linker; commit only the pkg-guard plugin
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+.yarn/cache
+.yarn/install-state.gz
 
 
 # Xcode

.yarn/releases/yarn-pkg-guard.cjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+/**
+ * pkg-guard pre-install wrapper around the bundled Yarn 4 release.
+ *
+ * Yarn 4 does not run the root `preinstall` script, so the old
+ * `preinstall: pkg-guard` hook stopped firing. This file is what `yarnPath`
+ * (and the classic `.yarnrc` `yarn-path`) point to, so EVERY `yarn`
+ * invocation — local or CI, corepack or Yarn 1 — goes through it.
+ *
+ * For dependency-mutating commands (install/add/up/dedupe, or bare `yarn`)
+ * it runs @elliottech/pkg-guard FIRST and aborts before Yarn touches the
+ * project if pkg-guard finds malware/vulns. Otherwise it transparently
+ * delegates to the real Yarn release.
+ *
+ * Bypass with SKIP_PKG_GUARD=1 (pkg-guard also honors the per-check
+ * SKIP_PKG_*_CHECK vars).
+ */
+const { spawnSync } = require(`child_process`);
+const path = require(`path`);
+
+const REAL_YARN = path.join(__dirname, `yarn-4.15.0.cjs`);
+const args = process.argv.slice(2);
+const mutatesDeps = args.length === 0 || [`install`, `add`, `up`, `dedupe`].includes(args[0]);
+
+if (mutatesDeps && !process.env.SKIP_PKG_GUARD) {
+  const result = spawnSync(`npx`, [`--yes`, `@elliottech/pkg-guard@latest`], {
+    stdio: `inherit`,
+    shell: process.platform === `win32`,
+    // Yarn 4 doesn't set npm_config_argv (which pkg-guard reads to detect
+    // `yarn add <pkg>`). Synthesize it from our argv so explicitly-added
+    // packages are checked, matching Yarn 1's behavior.
+    env: { ...process.env, npm_config_argv: process.env.npm_config_argv || JSON.stringify({ original: args }) },
+  });
+  if (result.error) {
+    // pkg-guard couldn't even be launched (e.g. npx missing). Fail closed —
+    // don't install unchecked. Use SKIP_PKG_GUARD=1 to bypass deliberately.
+    console.error(`[pkg-guard] failed to run: ${result.error.message} — blocking install (set SKIP_PKG_GUARD=1 to bypass)`);
+    process.exit(1);
+  } else if (result.status !== 0) {
+    // Malware/vuln found (or a block) — abort BEFORE Yarn installs anything.
+    process.exit(result.status);
+  }
+}
+
+// Hand off to the real Yarn release without re-triggering this wrapper.
+process.env.YARN_IGNORE_PATH = `1`;
+require(REAL_YARN);

.yarnrc

@@ -0,0 +1,3 @@
+# Yarn 1 (classic) reads this file, not .yarnrc.yml. Consumers/CI shipping Yarn 1
+# honor `yarn-path` and delegate to the committed Yarn 4 release.
+yarn-path "./.yarn/releases/yarn-pkg-guard.cjs"

.yarnrc.yml

@@ -0,0 +1,22 @@
+approvedGitRepositories:
+  - "**"
+
+enableScripts: true
+
+httpTimeout: 600000
+
+nodeLinker: node-modules
+
+npmMinimalAgeGate: 7d
+
+npmPreapprovedPackages:
+  - "@elliottech/*"
+  - zklighter-perps
+  - zklighter-perps-exp
+
+npmScopes:
+  elliottech:
+    npmAuthToken: "${NPM_TOKEN}"
+    npmRegistryServer: "https://npm.pkg.github.com"
+
+yarnPath: .yarn/releases/yarn-pkg-guard.cjs

package.json

@@ -24,5 +24,5 @@
     "react": "*",
     "react-native": ">=0.66.0"
   },
-  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
+  "packageManager": "yarn@4.15.0"
 }

pkg-guard.config.json

@@ -0,0 +1,15 @@
+{
+  "ageCheck": {
+    "enabled": false,
+    "minAgeDays": 7,
+    "packageMinAgeDays": {}
+  },
+  "malwareCheck": {
+    "enabled": true
+  },
+  "vulnCheck": {
+    "enabled": true,
+    "failOn": "critical"
+  },
+  "ignorePackages": ["@elliottech/*", "zklighter-perps", "zklighter-perps-exp"]
+}

yarn.lock

@@ -1,4 +1,15 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
+# This file is generated by running "yarn install" inside your project.
+# Manual changes might be lost - proceed with caution!
 
+__metadata:
+  version: 10
+  cacheKey: 10c0
 
+"@elliottech/react-native-kline-view@workspace:.":
+  version: 0.0.0-use.local
+  resolution: "@elliottech/react-native-kline-view@workspace:."
+  peerDependencies:
+    react: "*"
+    react-native: ">=0.66.0"
+  languageName: unknown
+  linkType: soft