# Supply-chain hardening.

# - strict-dep-builds: fail install if a dependency tries to run a build script

# that isn't listed in pnpm-workspace.yaml's allowBuilds. Turns the default

# "warn and continue" into a hard stop so a new transitive postinstall must

# be reviewed before it lands.

# - verify-deps-before-run: refuse to run pnpm scripts when node_modules

# diverges from the lockfile, catching the "edited package.json, forgot

# to install" drift class.

# - resolution-mode: when resolving a range, prefer the version that was

# current as of the most-recent direct dep publish. Limits exposure to a

# compromised brand-new release of a transitive dependency.

strict-dep-builds=true

verify-deps-before-run=error

resolution-mode=time-based

# Enforce engines.node and engines.pnpm at install time. Without this the

# fields are advisory; with it pnpm refuses to install on a mismatched runtime,

# turning the soft contract into a hard floor.

engine-strict=true