- CI uses voidzero-dev/setup-vp@v1.21.2 (cache: true for validate, false for
publish); Node + pnpm resolve from package.json devEngines, no .node-version
- Split publish into its own publish.yml (tags v*) using npm OIDC trusted
publishing (id-token: write, no registry-url, no NODE_AUTH_TOKEN);
validate stays on push to main
- package.json: add repository + devEngines (node 26.11.1 / pnpm 12.11.2,
onFail warn), drop the top-level packageManager field and .node-version
- Add pnpm-workspace.yaml: exclude @dldc/* from the 24h minimum-release-age
policy (trusting freshly-published own packages) and allow esbuild's build
- Add dependabot.yml (github-actions, weekly)
- Lockfile refreshed under pnpm 12; vp check / 273 tests / pack / examples /
npm consumer all green