.npmrc

# Supply-chain hardening (gate-84). THREE settings that only work together;
# any one alone is a configuration that looks like protection and is not:
#
#   1. min-release-age            — the cooldown window itself
#   2. min-release-age-exclude[]  — first-party releases must NOT be delayed
#   3. package.json engines.npm   — npm 10 does NOT implement min-release-age
#
# `min-release-age=0` (the previous value here) is a cooldown of ZERO: fully
# inert while looking configured. The comment above it claimed a 24h window,
# so this file read as hardened and enforced nothing — the rest of the fleet
# was moved to `2` and this app was missed.
#
# Without the exclusion the cooldown does not fail loudly — it silently
# resolves BACKWARDS. Installing @conduction/nextcloud-vue on release day
# under a cooldown with no exclusion resolves an old version and exits 0.
min-release-age=2
min-release-age-exclude[]=@conduction/*