Add CI + bring vercel-node-mongo pnpm setup up to repo standard

.github/workflows/vercel-mongo-ci.yml

@@ -0,0 +1,53 @@
+name: vercel-node-mongo CI
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - examples/vercel-node-mongo/**
+      - .github/workflows/vercel-mongo-ci.yml
+  pull_request:
+    paths:
+      - examples/vercel-node-mongo/**
+      - .github/workflows/vercel-mongo-ci.yml
+
+concurrency:
+  group: vercel-mongo-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    name: install / lint / test / build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: examples/vercel-node-mongo
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.1.1
+          run_install: false
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: examples/vercel-node-mongo/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm run lint
+
+      - name: Test
+        run: pnpm run test
+
+      - name: Build
+        run: pnpm run build

examples/vercel-node-mongo/.gitignore

@@ -1,4 +1,8 @@
 .vercel
 .env
 
-node_modules
+node_modules
+
+# Block npm/yarn lockfiles — this project is pnpm-only
+package-lock.json
+yarn.lock

examples/vercel-node-mongo/api/notifications.ts

@@ -4,9 +4,14 @@ import { saveItem } from '../lib/items'
 
 const { PLUGGY_CLIENT_ID, PLUGGY_CLIENT_SECRET } = process.env
 
-const pluggyClient = new PluggyClient({ clientId: PLUGGY_CLIENT_ID, clientSecret: PLUGGY_CLIENT_SECRET })
-
 export default async (req: VercelRequest, res: VercelResponse) => {
+  if (!PLUGGY_CLIENT_ID || !PLUGGY_CLIENT_SECRET) {
+    res.status(500).json({ message: 'Missing PLUGGY_CLIENT_ID or PLUGGY_CLIENT_SECRET' })
+    return
+  }
+
+  const pluggyClient = new PluggyClient({ clientId: PLUGGY_CLIENT_ID, clientSecret: PLUGGY_CLIENT_SECRET })
+
   const { id, event } = req.body
   if (!id) {
     res.status(400).json({ message: 'id parameter missing in body request.' })

examples/vercel-node-mongo/lib/db.ts

@@ -3,6 +3,10 @@ import { MongoClient } from 'mongodb'
 const { MONGO_URI } = process.env
 
 export function getClient() {
+  if (!MONGO_URI) {
+    throw new Error('Missing MONGO_URI environment variable')
+  }
+
   return new MongoClient(MONGO_URI, {
     useNewUrlParser: true,
     useUnifiedTopology: true

examples/vercel-node-mongo/package.json

@@ -1,16 +1,33 @@
 {
   "name": "pluggy-vercel-node-mongo-example",
+  "packageManager": "pnpm@11.1.1",
   "engines": {
-    "node": ">=22.11.0"
+    "node": ">=24.0.0",
+    "pnpm": ">=11.0.0"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": ">=24.0.0",
+      "onFail": "error"
+    }
+  },
+  "scripts": {
+    "preinstall": "pnpm audit && pnpm audit signatures",
+    "lint:lockfile": "pnpm install --frozen-lockfile",
+    "typecheck": "tsc --noEmit",
+    "lint": "tsc --noEmit",
+    "test": "tsc --noEmit",
+    "build": "tsc --noEmit"
   },
-  "packageManager": "pnpm@11.1.1",
   "dependencies": {
-    "mongodb": "3.6.6",
+    "mongodb": "3.6.10",
     "pg": "8.6.0",
     "pluggy-sdk": "0.7.1"
   },
   "devDependencies": {
     "@types/mongodb": "3.6.12",
-    "@vercel/node": "1.10.0"
+    "@vercel/node": "1.10.0",
+    "typescript": "5.9.3"
   }
 }

examples/vercel-node-mongo/pnpm-workspace.yaml

@@ -1,3 +1,56 @@
-minimumReleaseAge: 10080
-autoInstallPeers: true
+# Supply-chain hardening
+# ----------------------
 
+# Reject any package version published less than 14 days ago when
+# resolving. Most supply-chain attacks are detected within hours or
+# days; the 14-day window absorbs that while keeping upgrades moving
+# at a reasonable pace. For a critical CVE that demands a sub-14d
+# upgrade, add a temporary `minimumReleaseAgeExclude` entry with a
+# CVE link and remove it once the window closes.
+# 14 days = 60 * 24 * 14 minutes
+minimumReleaseAge: 20160
+
+# When the registry metadata is missing the `time` field for a
+# version, fall back to allowing it.
+minimumReleaseAgeIgnoreMissingTime: true
+
+# Whitelist for the 14-day wait. `@pluggyai/*` ships from our own
+# release pipeline.
+minimumReleaseAgeExclude:
+  - '@pluggyai/*'
+
+# Pinned explicitly to survive any future default change.
+resolutionMode: highest
+
+# Refuse to install if Node / pnpm don't satisfy the `engines` field.
+engineStrict: true
+
+# Fail the install if a package version's trust level drops
+# compared to earlier versions.
+trustPolicy: no-downgrade
+
+# Auto-skip the trust check for packages older than 90 days.
+trustPolicyIgnoreAfter: 129600
+
+# Block transitive deps from being resolved from exotic sources.
+blockExoticSubdeps: true
+
+
+# Version pinning
+# ---------------
+
+# Save exact resolved versions (no semver ranges) on `pnpm add`.
+savePrefix: ""
+
+
+# Per-package decisions
+# ---------------------
+
+# pnpm 11 blocks postinstall / install / preinstall scripts by
+# default; every package that ships one must be listed here.
+# Default-deny: new entries start as `false` and only flip to `true`
+# after a conscious review.
+allowBuilds: {}
+
+# Force a specific version on transitive dependencies.
+overrides: {}

examples/vercel-node-mongo/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "isolatedModules": true,
+    "noEmit": true
+  },
+  "include": ["api/**/*", "lib/**/*"]
+}