# Every install resolves from bun.lock and nothing else. `bun install` fails rather than quietly
# resolving a new version — including a transitive one nobody asked for.
#
# This is here rather than in a habit or a README because a supply-chain compromise does not wait for
# the one time somebody forgets the flag. On 2026-08-04 eleven cache packages (keyv, flat-cache,
# file-entry-cache, cacheable-request and friends) were published with a `preinstall` dropper that
# harvested npm and GitHub tokens, cloud credentials, SSH keys, .env files and .claude/settings.json,
# then republished itself through any token it found. It spread to 434 more packages. A floating
# transitive range is all it takes; a frozen lockfile is the difference between "we were not affected"
# and "we ran `bun install` on the wrong afternoon".
#
# When a dependency genuinely needs to change: edit package.json, run `bun install --no-frozen-lockfile`
# deliberately, READ the lockfile diff, and commit it. The friction is the point.
[install]
frozenLockfile = true

[serve.static]
plugins = ["bun-plugin-tailwind"]
env = "BUN_PUBLIC_*"

[test]
coverage = true
coverageDir = "coverage"
preload = ["./test-setup.ts"]
# The repo, not just `src` — a plugin's tests are the platform's tests.
#
# This was "./src" until 2026-08-15, when music became `plugins/music/` and took `lyrics.test.ts` with
# it. `bun test` then stopped running it and said nothing: the count fell by nine and the suite still
# read green-ish. A test that quietly stops running is worse than one that fails, and every future
# extraction would have taken its tests out of the suite the same way.
#
# Positional filters do not help — `bun test plugins` matches paths UNDER root, so it finds
# `src/servers/plugins/` and not `plugins/`. Root is the only lever.
root = "."