bunfig.toml

Rama main · réplica de lectura del repositorio original.

# Run the Sentry preload before any entry point. Bun honors `preload` for
# `bun run <file>`, `bun <file>`, and `bun test`, so this covers the chart's
# `bun run src/cli/index.ts serve` command override, `bun start`, and local dev
# from one place — it can't be forgotten by a launcher that doesn't pass a flag.
#
# The preload is a no-op unless NB_SENTRY_ENABLED=true (see instrument/sentry.ts),
# so OSS/dev/test never load the SDK. Sentry must stay OUT of the kernel (`src/`);
# this file and `instrument/` are the sanctioned out-of-kernel seam.
preload = ["./instrument/sentry.ts"]

# Hold a newly published version for 14 days before it can be resolved.
# Matches the cooldown Renovate applies to its own PRs, so a dependency
# reaches this repo on the same terms whether a bot or a person adds it.
# The window is what makes it worth having: a compromised or typo-squatted
# publish is usually caught and yanked well inside two weeks.
#
# This filters RESOLUTION only — `bun add`, `bun update`, and a non-frozen
# `bun install`. Every install in CI and in both Dockerfiles is frozen, so
# they replay the lockfile and are unaffected either way.
#
# bunfig.toml is NOT resolved up the directory tree, so this governs only
# installs run from this directory. Every package with its own bun.lock
# carries a copy; test/unit/release-age.test.ts holds them to Renovate's window.
[install]
minimumReleaseAge = 1209600
# `latest` here tracks the installed bun rather than naming a version, and
# holding it back would pin types older than the runtime they describe.
#
# `@nimblebrain/synapse` is ours. The window buys time for a compromised or
# typo-squatted publish to be caught and yanked, and neither vector reaches a
# package we publish ourselves: there is no name to squat on that we would then
# install, and the publish runs on npm trusted publishing (OIDC, provenance
# attestation, no static token), so forging one means compromising the release
# workflow of a repo we own — which two weeks of waiting does not help us
# notice. What the window does cost here is real: this repo cannot consume a
# fix on the day we ship it, including a fix we shipped FOR this repo.
#
# Scoped to the one package, not to `@nimblebrain/*`. A future first-party
# dependency should be a decision someone makes, not one this line already made.
#
# The three MCP SDK v2 packages are excluded because the runtime tracks the
# protocol as it is fixed: the 2026-07-28 revision and its extensions land in
# patch and minor releases (the tasks extension's `Mcp-Name` binding arrived in
# 2.1.0), and a peer on the new revision refuses a request the older release
# builds. The window's protection is traded for that, deliberately and for
# these three names only; every other `@modelcontextprotocol/*` package keeps it.
#
# `@agentclientprotocol/sdk` is excluded on the same terms: the runtime drives
# external agent runtimes over ACP and tracks the SDK line those runtimes are
# built against, and its 2.x line is where the stable v1 API now lives.
minimumReleaseAgeExcludes = [
  "@agentclientprotocol/sdk",
  "@types/bun",
  "@nimblebrain/synapse",
  "@modelcontextprotocol/client",
  "@modelcontextprotocol/core",
  "@modelcontextprotocol/server",
]