chore: migrate from npm to pnpm 11

[yosriady]

• package.json: scripts npm->pnpm, drop npm-style overrides, add packageManager + devEngines.packageManager (pnpm@11.1.2) and engines.node>=22 (pnpm 11 requires Node 22+)
• pnpm-workspace.yaml: pnpm 11 config home (.npmrc is now auth/registry only). minimumReleaseAge: 2880 correctly encodes the 48h supply-chain cooldown (old .npmrc min-release-age=2 was malformed; pnpm 11 default is only 1440/24h). allowBuilds for @swc/core + unrs-resolver set false (prebuilt platform bindings used; strictDepBuilds is a pnpm 11 default). overrides migrated here (pnpm does not read npm-style top-level overrides).
• delete .npmrc (held only the malformed general setting)
• ci.yml/release.yml: SHA-pinned pnpm/action-setup@v6.0.8, cache: pnpm, pnpm install --frozen-lockfile / build / test. release.yml keeps npm publish --provenance (OIDC trusted publishing is an npm-registry feature)
• replace package-lock.json with pnpm-lock.yaml (v9.0)

Verified with pnpm 11.1.2 on Node 22: frozen-lockfile install, build (cjs+esm), test (34 passed, 4 skipped), lint all exit 0.

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jest@​30.3.0 ⏵ 30.4.2	+1		+1	+2
	@​types/​node@​25.5.0 ⏵ 25.8.0
	@​swc/​core@​1.15.21 ⏵ 1.15.33	+1

View full report

[gemini-code-assist]

Code Review

This pull request migrates the project from npm to pnpm 11, which includes updating the package manager, development engines, and build scripts, as well as introducing a pnpm-workspace.yaml configuration file. Feedback suggests that the update to Node.js version 22 in the engines field may be an unnecessary breaking change for consumers and recommends keeping a broader range if compatibility allows. Furthermore, it is advised to explicitly define workspace members in the new workspace configuration file to ensure full compliance with the pnpm schema.

[gemini-code-assist]

Bumping engines.node to >=22 is a breaking change for consumers of this library. While pnpm 11 requires Node 22+ for the development environment, this requirement does not necessarily extend to the library's runtime compatibility. If the code is still compatible with Node 18 or 20, it is recommended to keep a broader range in engines.node. The requirement for developers is already correctly handled by the devEngines field added in this PR.

[gemini-code-assist]

The pnpm-workspace.yaml file should explicitly define the workspace members using the packages field. Although pnpm may currently default to the root directory if it's the only package found, explicitly including '.' ensures compliance with the workspace schema and prevents potential issues if subdirectories are added or if pnpm commands are run from different locations.

packages:
  - '.'

# pnpm 11 configuration.