save-exact=true
prefer-frozen-lockfile=true
audit-level=moderate

# Security: prevent lifecycle scripts from untrusted packages
ignore-scripts=true
# Allow pnpm to run pre/post lifecycle scripts (e.g. predev, prebuild)
enable-pre-post-scripts=true

# Supply-chain protection (https://gajus.com/blog/3-pnpm-settings-to-protect-yourself-from-supply-chain-attacks)
# Quarantine newly published packages for 7 days (10080 minutes)
minimum-release-age=10080
# Block subdependencies that use exotic specifiers (git:, tarball URLs, etc.)
block-exotic-subdeps=true

# Ensure all resolved packages come from the official registry over HTTPS
registry=https://registry.npmjs.org/
