# Supply-chain safety. See SUPPLY-CHAIN-SECURITY.md.

# Block install/lifecycle scripts by default (the primary exfiltration vector).
# The repo's git hooks are installed explicitly via `npm run prepare` (an explicit
# `npm run` still executes under ignore-scripts; install-time scripts do not).
ignore-scripts=true
engine-strict=true

# Pin exact versions on `npm install <pkg>` and always maintain the lockfile.
save-exact=true
package-lock=true

# 14-day cool-off floor: npm only resolves versions published >=14 days ago.
# NOTE: `min-release-age` (days) is the npm key, honored on npm 11.10+. The
# minutes-based `minimum-release-age` key is pnpm-only and silently ignored by
# npm. On older npm, the cool-off is enforced via NPM_CONFIG_BEFORE in the shell
# env plus the committed lockfile + frozen `npm ci` installs. Repository
# workflows pin a compatible Node/npm pair and remove conflicting ambient
# package-manager variables before invoking npm.
min-release-age=14
