# Use the isolated/symlinked install layout (pnpm-style) instead of the flat
# hoisted one. This deduplicates the react-aria ecosystem to a single physical
# copy per version (a `.store/` + symlinks), shrinking node_modules ~3x and
# cutting install time from minutes to ~20s on a fast filesystem.
install-strategy=linked

# Supply-chain cooldown: only resolve package versions that have been public for
# at least this many DAYS (npm >= 11.16). Blunts "publish malware, get pulled in
# instantly" attacks by refusing brand-new releases when the tree is (re)resolved
# at `npm install` time. Frozen `npm ci` installs the already-vetted lockfile as
# is. Complements the check:deps guardrail (scripts/check-node-modules.mjs).
min-release-age=1
