v2.6.32 — a no-optional install is now clean and runnable

A supply-chain and dependency-hygiene release. npm install --omit=optional token-goat is now clean and, for the first time, actually runnable.

An install without optional packages could not run at all. SECURITY.md recommends --omit=optional to avoid the advisories carried by the native packages, and that install stopped on a missing fflate before any command started: even token-goat --version failed. The zip reader imported an optional package at the top of the file, which puts it on the path Node resolves before anything runs, so one missing optional package took out every command. It loads on demand now. A guard reads the built bundle rather than the source, because a top-level import is what the failure was.

That install is also clean now. html-to-text was listed as a runtime dependency and brought deepmerge-ts, htmlparser2, selderee and dom-serializer with it. The build inlines it and nothing in the published files imports the package, so every consumer downloaded five packages no code would load. It is a development dependency now: npm audit reports nothing across 46 packages, and the text a fetched page is reduced to is byte-for-byte what it was.

Three packages with no license grant at all left the tree. buffers, chainsaw and traverse shipped with no license field, which is worse for a review than a copyleft grant because there is nothing to apply a policy to. What cannot be removed is written down instead: SECURITY.md now names every remaining production package a scanner cannot resolve or that carries a copyleft term, what it actually grants, and the fact that all of them are optional.

The package declared its license in the form scanners cannot resolve. All four files said SEE LICENSE IN LICENSE; the identifier PolyForm-Noncommercial-1.0.0 is on the SPDX list and is now declared. The grant and terms are unchanged: commercial use still requires a license, and the point is to be identified correctly as noncommercial rather than to look permissive.

Dependabot watched only the action pins, so the npm tree went unwatched entirely. Both manifests are covered now, each with a seven-day cooldown. Workflows ran on whatever token the repository handed them; both now default to contents: read.

Also fixed: an allow list written with a non-English domain name refused every URL; excluding a directory left everything already indexed under it readable; prune matched paths by case but not by separator.

Full detail in CHANGELOG.md.