fix(examples): apply the 24 h release-age cooldown to the pnpm examples

docs/contributing.md

@@ -96,6 +96,7 @@ Examples are runtime-isolated demos. Each one installs the packed `@variablelab/
    ```jsonc
    "@variablelab/env": "file:../../package/.local/variablelab-env.tgz"
    ```
+   A pnpm example also copies the `.npmrc` from an existing pnpm example.
 3. Add a `mise.toml` with the runtime tools (`node`, `bun`, `deno` or `pnpm`) and the standard tasks (`setup`, `start`, `test:e2e`, `check`). Use the existing example with the closest runtime as a template.
 4. Add a `biome.json` extending `@rrlab/biome-config`, except in a Deno-only example.
 5. Add the path to `[monorepo].config_roots` in the root [`mise.toml`](../mise.toml).

docs/development.md

@@ -281,7 +281,7 @@ Avoid `for d in examples/*/; do ...; done`: it runs one example at a time and pr
 
 ### pnpm tries to install across the whole monorepo from inside an example
 
-The example directories sit inside the same tree as `pnpm-workspace.yaml`, so pnpm takes them for workspace members. They aren't, but pnpm needs an explicit `--ignore-workspace` to honor that. The pnpm-based examples already pass it in their `setup` tasks, and a new pnpm-based example has to do the same.
+The example directories sit inside the same tree as `pnpm-workspace.yaml`, so pnpm takes them for workspace members. They aren't, but pnpm needs an explicit `--ignore-workspace` to honor that. The pnpm-based examples already pass it in their `setup` tasks, and a new pnpm-based example has to do the same. `--ignore-workspace` also skips the cooldown in `pnpm-workspace.yaml`, so each pnpm-based example has an `.npmrc` with the same settings, and a new one copies it.
 
 ### Deno can't import the library from the tarball
 

examples/backend-node-cjs/.npmrc

@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*

examples/backend-node/.npmrc

@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*

examples/edge-nextjs/.npmrc

@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*

examples/spa-vite-dynamic/.npmrc

@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*

examples/spa-vite-plugin/.npmrc

@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*

examples/ssr-react-router/.npmrc

@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*

examples/ssr-tanstack-start/.npmrc

@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*

examples/worker-cloudflare/.npmrc

@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*

pnpm-workspace.yaml

@@ -24,6 +24,7 @@ publicHoistPattern:
   - "@total-typescript/*"
 
 # Supply-chain cooldown: malicious releases are usually pulled within 24h; pattern excludes need pnpm >= 10.17.
+# The pnpm examples install with --ignore-workspace, which skips this file, so each carries the same values in its own .npmrc.
 minimumReleaseAge: 1440
 minimumReleaseAgeExclude:
   - "@variablelab/*"