# Build scripts: allow only what each runtime needs; rest false so
# strictDepBuilds (pnpm >=10.26 / 11) passes.
allowBuilds:
  esbuild: true
  workerd: true
  sharp: false

# Supply-chain hardening: cooldown on brand-new releases (EmDash exempt)
# and no non-registry transitive sources. (No trustPolicy: no-downgrade --
# it trips on upstream provenance regressions we don't control.)
minimumReleaseAge: 1440
minimumReleaseAgeExclude:
  - emdash
  - "@emdash-cms/*"
blockExoticSubdeps: true