chore(ci): commit pnpm-lock.yaml and install frozen

.github/workflows/npm-publish-github-packages.yml

@@ -7,16 +7,21 @@ on:
   release:
     types: [created]
 
+env:
+  NODE_VERSION: 24
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
-      - run: npm install
-      - run: npm test
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm test
 
   publish-gpr:
     needs: build
@@ -26,11 +31,16 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
           registry-url: https://npm.pkg.github.com/
-      - run: npm install
+      - run: pnpm install --frozen-lockfile
+      # npm publish, not pnpm publish: pnpm adds git-state checks the release flow
+      # does not need. prepublishOnly runs the build either way.
+      # No --provenance: GitHub Packages does not accept provenance attestations.
       - run: npm publish
         env:
           NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/test.yml

@@ -4,13 +4,18 @@ on:
   pull_request:
     branches: ["main"]
 
+env:
+  NODE_VERSION: 24
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
-      - run: npm install
-      - run: npm test
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm test

.gitignore

@@ -2,9 +2,10 @@
 dist
 
 # dependencies
+# pnpm-lock.yaml is committed on purpose — CI installs --frozen-lockfile so builds
+# and the published artifact are reproducible. Other package managers are not used.
 node_modules
 package-lock.json
-pnpm-lock.yaml
 yarn.lock
 
 # log
@@ -13,14 +14,4 @@ npm-debug.log
 # macos
 .DS_Store
 
-# env files
-env
-
-data
-
-config/*
-!config/dev.yml
-!config/test.yml
-bin
-
 coverage

CLAUDE.md

@@ -12,7 +12,12 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - **Transpile**: `pnpm run transpile` — TypeScript compilation only
 
 These are the only scripts defined in `package.json`. CI (`.github/workflows/`) runs
-`npm install` + `npm test` on Node 24; the package declares `engines: node >=22`.
+`pnpm install --frozen-lockfile` + `pnpm test` on Node 24; the package declares
+`engines: node >=22`.
+
+**pnpm only** — never npm or yarn. `pnpm-lock.yaml` is committed and CI installs
+frozen, so dependency changes are reviewed as a lockfile diff. The pnpm version is
+pinned by `packageManager` in `package.json`; `pnpm/action-setup` reads it.
 
 ## Project Architecture
 

CONTRIBUTING.md

@@ -1 +1,38 @@
-- Add tag for a minor/major release by `npm version minor` and `npm version major` after commit
+# Contributing
+
+## Setup
+
+This repository uses **pnpm** (pinned via `packageManager` in `package.json`). Do not
+use npm or yarn — `pnpm-lock.yaml` is the committed lockfile and the only one CI reads.
+
+```bash
+pnpm install
+pnpm test
+pnpm run build
+```
+
+`pnpm-lock.yaml` is committed deliberately. CI installs with `--frozen-lockfile`, so a
+dependency change must be reviewed as a lockfile diff like any other change. If an
+install fails in CI with a lockfile mismatch, run `pnpm install` locally and commit the
+updated lockfile.
+
+## Pull requests
+
+- `main` requires one approving review, and `require_last_push_approval` is set — any
+  push after an approval dismisses it, so get the branch final before requesting review.
+- Keep coverage at 100%; `pnpm run test:coverage` reports it.
+- Bugs and follow-ups go in **GitHub issues**, not a tracked file in the repo.
+
+## Releases
+
+**Do not put a version bump in a feature or fix PR**, and do not create tags by hand.
+
+Releasing is a separate act on `main`:
+
+1. Bump `version` in `package.json` in its own commit, whose message is just the
+   version number (`2.16.0`), matching existing history.
+2. Create a **GitHub Release**. That is what creates the tag and triggers
+   `npm-publish-github-packages.yml` to publish. Pushing to `main` alone publishes
+   nothing.
+
+See `.claude/skills/release/SKILL.md` for the full checklist.

package.json

@@ -55,5 +55,6 @@
     "ts-jest": "^29.4.9",
     "ts-node": "^10.9.2",
     "typescript": "^6.0.3"
-  }
+  },
+  "packageManager": "pnpm@10.13.1"
 }