chore: keep lockfile registry-agnostic

[peakematt]

HELP-722 requires committed public SDK lockfiles to be independent of the registry used to generate them. The current lockfile records registry-specific resolved URLs, which couples it to the effective install registry.

This adds omit-lockfile-registry-resolved=true while preserving the existing lockfile. The narrow .gitignore exception allows the root npm configuration to be tracked without changing the broader ignore rule.

Verification found 694 registry resolved entries removed and all 694 integrity values preserved. Versions, package records, dependency relationships, non-registry resolutions, and lockfile version are unchanged. There are zero Socket Firewall host references and zero semantic verifier violations.

The branch was regenerated and checked with Node v24.20.0 and npm 11.19.0:

npm install --package-lock-only --ignore-scripts --no-audit --no-fund
npm ci --registry=https://registry.npmjs.org/
npm run prettier
npm run lint
npm run typecheck
npm run build
npm test

The clean public-registry install left the lockfile unchanged. This is a draft for early inspection; no reviewer action is requested yet. After this change merges, the live downstream dependency-bump commands will be repeated against representative npm and pnpm AuthKit projects before the remaining SDK changes are approved.

HELP-722: https://linear.app/workos/issue/HELP-722

[linear-code]

HELP-722

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Greptile Summary

This PR makes the repository lockfile registry-agnostic while retaining dependency versions, integrity hashes, and dependency relationships.

• Tracks a root .npmrc that enables omit-lockfile-registry-resolved.
• Adds a narrow .gitignore exception for the root npm configuration.
• Removes registry-specific resolved URLs from package-lock.json.

Confidence Score: 5/5

The PR appears safe to merge because supported repository environments recognize the npm setting and no dependency semantics are changed.

The changes only alter lockfile source metadata and repository npm configuration; supported Node/npm workflows remain compatible, and no concrete build, install, security, or runtime failure remains.

Important Files Changed

Filename	Overview
.npmrc	Enables npm’s registry-agnostic lockfile generation behavior for the repository.
.gitignore	Allows the root .npmrc to be tracked while retaining the existing general ignore pattern.
package-lock.json	Removes registry-specific resolution URLs without changing dependency versions, integrity values, or package relationships.

_{Reviews (1): Last reviewed commit: "fix: scope npm config exception to repos..." | Re-trigger Greptile}