name: yarn
description: Profile for yarn, extending npm-restrictive with yarn environment variables
inherits: npm-restrictive

package_managers:
  - yarn

environment:
  # Yarn berry authenticates via YARN_NPM_AUTH_*. Yarn classic reads .npmrc
  # with env interpolation and npm_config_* conventions, so the shared npm
  # auth set is also needed. Sibling tokens (BUN_AUTH_TOKEN) stay scrubbed.
  allow:
    - YARN_NPM_AUTH_TOKEN
    - YARN_NPM_AUTH_IDENT
    - NPM_TOKEN
    - NPM_AUTH_TOKEN
    - NODE_AUTH_TOKEN
    - npm_config_*
    - NPM_CONFIG_*
    - NODE_EXTRA_CA_CERTS