chore: migrate from npm to pnpm with supply-chain hardening

.githooks/pre-commit

@@ -1,2 +1,2 @@
 #!/usr/bin/env sh
-npm run lint && npm test
+pnpm run lint && pnpm test

.github/workflows/ci.yml

@@ -16,33 +16,36 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
+            - uses: pnpm/action-setup@v4
             - uses: actions/setup-node@v4
               with:
                   node-version: 22.x
-                  cache: "npm"
-            - run: npm ci
-            - run: npm run build
+                  cache: "pnpm"
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm run build
 
     lint:
         name: Lint
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
+            - uses: pnpm/action-setup@v4
             - uses: actions/setup-node@v4
               with:
                   node-version: 22.x
-                  cache: "npm"
-            - run: npm ci
-            - run: npm run lint
+                  cache: "pnpm"
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm run lint
 
     test:
         name: Test
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
+            - uses: pnpm/action-setup@v4
             - uses: actions/setup-node@v4
               with:
                   node-version: 22.x
-                  cache: "npm"
-            - run: npm ci
-            - run: npm test
+                  cache: "pnpm"
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm test

.github/workflows/release.yml

@@ -20,10 +20,12 @@ jobs:
         steps:
             - uses: actions/checkout@v4
 
+            - uses: pnpm/action-setup@v4
+
             - uses: actions/setup-node@v4
               with:
                   node-version: 22.x
-                  cache: "npm"
+                  cache: "pnpm"
 
             - name: Verify manifest version matches tag
               run: |
@@ -34,8 +36,8 @@ jobs:
                       exit 1
                   fi
 
-            - run: npm ci
-            - run: npm run build
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm run build
 
             - name: Extract changelog for ${{ github.ref_name }}
               id: changelog

.gitignore

@@ -5,7 +5,7 @@
 *.iml
 .idea
 
-# npm
+# dependencies
 node_modules
 
 # test coverage output

.npmrc

@@ -1 +1,4 @@
-tag-version-prefix=""
+tag-version-prefix=""
+minimum-release-age=10080
+trust-policy-ignore-after=43200
+fund=false

CLAUDE.md

@@ -10,10 +10,10 @@ Watches the editor for lines matching user-configured trigger tags (e.g. `#perso
 ## Commands
 
 ```bash
-npm run dev        # esbuild watch mode (outputs main.js)
-npm run build      # type-check + production build
-npm test           # vitest run
-npm run lint       # eslint
+pnpm run dev       # esbuild watch mode (outputs main.js)
+pnpm run build     # type-check + production build
+pnpm test          # vitest run
+pnpm run lint      # eslint
 ```
 
 ---

README.md

@@ -120,8 +120,8 @@ All five standard fields are optional and their names are configurable (see [Fro
 ```bash
 git clone https://github.com/bartvw/entity-notes
 cd entity-notes
-npm install
-npm run dev   # watch mode
+pnpm install
+pnpm run dev   # watch mode
 ```
 
 Copy (or symlink) the folder into `<vault>/.obsidian/plugins/entity-notes/` and enable it in Obsidian.