build: add the canton-token-forge registry service as a dev dependency

[lmcorbalan]

Summary

Closes #150

Nothing in the repository could serve instrument metadata or a transfer-factory
choice context. The registry ships from canton-token-forge as a git dependency
pinned to a tag.

Changes

• pnpm exec canton-token-forge-registry runs from the repo root after one root install
• pnpm is allowed to build the git dependency, without which the bin resolves to nothing
• knip stops reporting the dependency as unused

Deviations

• canton-token-forge was private, which broke every CI job that installs and both Vercel builds, since a workflow token reaches only its own repo; it is now public, so nothing here carries a credential

Acceptance criteria

• package.json pins github:BootNodeDev/canton-token-forge#v0.2.0
• pnpm-workspace.yaml allowBuilds carries the resolved git specifier
• pnpm exec canton-token-forge-registry exits 1 on a missing env var, proving the bin was built
• pnpm knip passes

Test plan

Automated tests

1. Check out this branch and run pnpm install
2. Run pnpm knip, then pnpm lint
3. Expect both to exit 0

Manual verification

1. Run pnpm exec canton-token-forge-registry
2. Expect exit 1 and a log line invalid configuration naming missing required env var LEDGER_API_URL

Breaking changes

None.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
demo.canton-dappbooster	Ready	Preview	Sep 4, 2026 2:22pm UTC
docs.canton-dappbooster	Ready	Preview	Sep 4, 2026 2:22pm UTC

[Copilot]

🟢 Approval recommended

The change is a mechanical, internally consistent dependency addition matching the issue's acceptance criteria and mirroring the existing git-dependency pattern, with no issues found.

Pull request overview

This PR adds the canton-token-forge registry service as a root-level dev dependency so pnpm exec canton-token-forge-registry can serve instrument metadata and a transfer-factory choice context after a single root pnpm install. It follows the established pattern already used for the canton-wallet-service git dependency: allowlist the build script and exclude the tool from knip's unused-dependency check. This is a mechanical dependency addition (closes #150) with no runtime wiring yet.

Changes:

• Pins @bootnodedev/canton-token-forge to the v0.2.0 tag as a dev dependency and locks it to the resolved git SHA.
• Adds the resolved git specifier to pnpm-workspace.yaml allowBuilds so pnpm runs the package's prepare build (which produces the bin).
• Adds the package to knip.json ignoreDependencies so knip does not report it as unused.

File summaries

File	Description
package.json	Adds the @bootnodedev/canton-token-forge#v0.2.0 dev dependency.
pnpm-lock.yaml	Locks the git dependency to SHA da18cbebd… and records its Express/openapi-validator transitive graph.
pnpm-workspace.yaml	Allowlists the resolved git id for build scripts, with a comment explaining why.
knip.json	Ignores the new dependency, which has no import site.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 3/4 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.