bunfig.toml

# Supply-chain protection: refuse Bun-installed packages published within the
# last 3 days. Honored by Bun 1.2+ (the `minimumReleaseAge` setting introduced
# alongside the npm v11 equivalent in response to recent supply-chain attacks).
#
# Older Bun versions silently ignore unknown settings. CI is on Bun 1.3+, so CI
# does enforce. Local dev should run `bun upgrade` to pick this up.
#
# 3 days = 259200 seconds. Adjust upward if you want a wider safety net.

[install]
minimumReleaseAge = 259200

# Test isolation for a bare `bun test` run from the monorepo ROOT (which
# recursively discovers every package's *.test.ts). Without this, a root-CWD
# `bun test` runs all suites with NO preload and a bare openDatabase() would hit
# the user's REAL shared DB — exactly how a worktree at a newer LATEST migrated
# the live DB (2026-06-01 v26 incident, recurred at v41). resolveDatabasePath()
# also has a NODE_ENV=test backstop, but this keeps the redirect canonical.
[test]
preload = ["./packages/plugin/test-preload.ts"]