# Every install resolves from bun.lock and nothing else. `bun install` fails rather than quietly
# resolving a new version — including a transitive one nobody asked for.
#
# This is here rather than in a habit or a README because a supply-chain compromise does not wait for
# the one time somebody forgets the flag. On 2026-08-04 eleven cache packages (keyv, flat-cache,
# file-entry-cache, cacheable-request and friends) were published with a `preinstall` dropper that
# harvested npm and GitHub tokens, cloud credentials, SSH keys, .env files and .claude/settings.json,
# then republished itself through any token it found. It spread to 434 more packages. A floating
# transitive range is all it takes; a frozen lockfile is the difference between "we were not affected"
# and "we ran `bun install` on the wrong afternoon".
#
# When a dependency genuinely needs to change: edit package.json, run `bun install --no-frozen-lockfile`
# deliberately, READ the lockfile diff, and commit it. The friction is the point.
[install]
frozenLockfile = true

[serve.static]
plugins = ["bun-plugin-tailwind"]
env = "BUN_PUBLIC_*"

[test]
coverage = true
coverageDir = "coverage"
preload = ["./test-setup.ts"]
root = "./src"