From 2c3c9b78eb34d2bb607325cc2adeb7773a3e8128 Mon Sep 17 00:00:00 2001
From: Steve Larson <9larsons@gmail.com>
Date: Thu, 6 Aug 2026 10:46:15 -0500
Subject: [PATCH] Improved Source dependency installation controls

ref https://linear.app/ghost/issue/PLA-321/make-the-72-hour-pnpm-cooldown-explicit-across-first-party-themes

Source is installed both as Ghost's default-theme submodule and as a standalone release archive, so both paths should retain the same explicit 72-hour cooldown and fail-closed pnpm policy without permitting dependency lifecycle scripts.
---
 gulpfile.js         | 3 ++-
 pnpm-workspace.yaml | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/gulpfile.js b/gulpfile.js
index f347a251..8b3941b4 100644
--- a/gulpfile.js
+++ b/gulpfile.js
@@ -81,7 +81,8 @@ function zipper(done) {
             '!dist', '!dist/**',
             '!pnpm-debug.log',
             '!pnpm-lock.yaml',
-            '!pnpm-workspace.yaml',
+            // Keep pnpm-workspace.yaml so standalone installs inherit
+            // the supply-chain policy.
             '!AGENTS.md',
             '!CLAUDE.md',
             '!gulpfile.js'
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 86556e06..4ca9157d 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,3 +1,7 @@
+strictDepBuilds: true
+minimumReleaseAge: 4320
+blockExoticSubdeps: true
+
 allowBuilds:
   # Optional dtrace bindings for bunyan through gscan; not needed to build, zip, or scan the theme.
   dtrace-provider: false