# Use public registry only (avoids E401 when user has custom/expired npm credentials)
registry=https://registry.npmjs.org/
# Supply-chain cooldown: refuse to install a package version published < 7 days ago (npm >= 11.10; ignored by `npm ci` so CI builds are unaffected).
min-release-age = 7
