# Unsloth OXC validator npm configuration. Same supply-chain defences as
# studio/frontend/.npmrc; the installers run `npm ci` here on user machines.
#
# Refuse tarballs published less than 7 days ago (npm >=11.10; bare integer
# means DAYS). `npm ci` still installs the locked versions, so this only
# gates new resolutions.
min-release-age=7
# Keep exact pins when a maintainer runs `npm install <pkg>` here.
save-exact=true
# No registry= pin here: this install runs on every Studio setup and update,
# and a project pin would override a corporate mirror in the user's ~/.npmrc.
# Every lock entry carries an integrity hash, so `npm ci` rejects tampered
# tarballs whichever registry serves them.
# No git/GitHub dependencies: they bypass the registry, the cooldown and the
# integrity pin, and run `prepare` on install. The lockfile has none.
allow-git=none
audit-level=high
fund=false
