Migrate from pnpm to npm using min-release-age

npm v11.10.0 introduced min-release-age, the equivalent of pnpm's
minimumReleaseAge that we relied on as a supply-chain attack mitigation.
Moving back to npm removes the pnpm-only workarounds (notably the
`cd ~` dance for `pnpm login`) and shrinks the toolchain.

- .npmrc: min-release-age=7 (npm uses days, vs pnpm's 1440 minutes = 1 day; bumped to a week while we're at it)
- package.json: drop packageManager, set engines.node/npm and devEngines.packageManager.name=npm
- Replace pnpm-lock.yaml with package-lock.json
- Remove pnpm-workspace.yaml (only existed to hold minimumReleaseAge) and mise.toml (nodenv handles via .node-version)
- CI: drop pnpm/action-setup, use cache: npm, install npm@^11.10.0 to ensure min-release-age is honored
- Docs: update CLAUDE.md, README.md, and the release guide

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Kyome22

.github/how_to_release_for_npm.md

@@ -2,44 +2,40 @@
 
 ## 前提
 
-- `npm` コマンドは禁止。`pnpm` を使う。
-- `pnpm login` は **lobsterjs ディレクトリの外** で実行すること。
-  （lobsterjs 内で実行すると `devEngines` チェックに引っかかってエラーになる）
+- パッケージマネージャは `npm`（`devEngines.packageManager.name=npm`、`engines.npm` で `>=11.10.0`）。
+- `.npmrc` で `min-release-age=1` を設定しているため、npm のバージョンが 11.10.0 以上であること。
+  ```sh
+  npm --version  # 11.10.0 以上であること
+  ```
+  古ければ `npm install -g npm@latest` でアップグレードする。
 
 ## 手順
 
 ### 1. バージョンを上げる
 
-`package.json` の `version` を手動で編集し、git tag を打つ。
+`package.json` の `version` を編集し、git tag を打つ。
 
 ```bash
 git tag 0.x.x
-git push origin 0.x.x   # GitHub Release が CI で自動生成される
+git push origin 0.x.x   # GitHub Release が CI (release.yml) で自動生成される
 ```
 
 ### 2. npm にログイン（未ログインの場合）
 
 ```bash
-cd ~
-pnpm login --registry https://registry.npmjs.org
+npm login --registry https://registry.npmjs.org
 # ブラウザが開くので認証する
 
 # 確認
-pnpm whoami --registry https://registry.npmjs.org
+npm whoami --registry https://registry.npmjs.org
 ```
 
+> Note: pnpm 時代は `cd ~` してから `pnpm login` を実行する回避策が必要だったが、npm では不要。
+
 ### 3. ビルド & publish
 
 ```bash
-cd /path/to/lobsterjs
-pnpm run build
-pnpm publish --access public
+npm ci
+npm run build
+npm publish --access public
 ```
-
-## 注意
-
-- `pnpm login` を lobsterjs ディレクトリ内で実行すると以下のエラーが出る（npm が呼ばれてしまう）:
-  ```
-  npm error EBADDEVENGINES Invalid name "pnpm" does not match "npm"
-  ```
-  必ず `cd ~` などでディレクトリを移動してから実行すること。

.github/workflows/deploy.yml

@@ -23,20 +23,18 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.30.1
-
       - uses: actions/setup-node@v6
         with:
           node-version: "24.13.1"
-          cache: "pnpm"
+          cache: "npm"
+
+      - run: npm install -g npm@^11.10.0
 
-      - run: pnpm install
+      - run: npm ci
 
-      - run: pnpm test
+      - run: npm test
 
-      - run: pnpm build:docs
+      - run: npm run build:docs
 
       - uses: actions/configure-pages@v5
 

.github/workflows/release.yml

@@ -14,20 +14,18 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.30.1
-
       - uses: actions/setup-node@v6
         with:
           node-version: "24.13.1"
-          cache: "pnpm"
+          cache: "npm"
+
+      - run: npm install -g npm@^11.10.0
 
-      - run: pnpm install
+      - run: npm ci
 
-      - run: pnpm test
+      - run: npm test
 
-      - run: pnpm build
+      - run: npm run build
 
       - name: Package skills
         run: zip -r lobster-skills.zip skills/

.npmrc

@@ -0,0 +1 @@
+min-release-age=7

CLAUDE.md

@@ -10,18 +10,18 @@ Spec: `markdowns/spec.md` (English), `markdowns/spec-ja.md` (Japanese)
 
 ## Commands
 
-This project uses **pnpm** (enforced — npm/yarn will error).
+This project uses **npm** (declared via `devEngines`; requires npm `>=11.10.0` for the `min-release-age` setting in `.npmrc`).
 
 ```bash
-pnpm test           # Run all tests once (Vitest)
-pnpm test:watch     # Run tests in watch mode
-pnpm run build      # Build ESM bundle + emit .d.ts declarations
-pnpm run build:docs # Build and copy dist/lobster.js → docs/lobster.js
+npm test           # Run all tests once (Vitest)
+npm run test:watch # Run tests in watch mode
+npm run build      # Build ESM bundle + emit .d.ts declarations
+npm run build:docs # Build and copy dist/lobster.js → docs/lobster.js
 ```
 
 To run a single test file:
 ```bash
-pnpm vitest run tests/block-parser.test.ts
+npx vitest run tests/block-parser.test.ts
 ```
 
 ## Architecture

README.md

@@ -336,33 +336,34 @@ Once installed, Claude will use the skills automatically when you ask to create
 
 ### Requirements
 
-| Tool                          | Version    |
-| :---------------------------- | :--------- |
-| [mise](https://mise.jdx.dev/) | 2026.2.19+ |
-| pnpm                          | 10.30.1    |
-| Node.js                       | 24.13.1    |
+| Tool    | Version   |
+| :------ | :-------- |
+| Node.js | 24.13.1   |
+| npm     | >=11.10.0 |
+
+`.npmrc` sets `min-release-age=7` so newly published package versions (less than 7 days old) are not installed — a mitigation against npm supply-chain attacks. This requires npm 11.10.0 or later.
 
 ### Setup
 
 ```sh
-# Install mise
-brew install mise
-echo 'eval "$(mise activate zsh)"' >> ~/.zshrc
+# Use any Node version manager (nodenv, fnm, asdf, etc.) — .node-version pins 24.13.1
+nodenv install   # if using nodenv
 
-# Install pnpm and Node.js (versions defined in mise.toml)
-mise install
+# Node 24.13.1 ships with npm 11.x but may be older than 11.10.0;
+# upgrade so the min-release-age policy in .npmrc takes effect.
+npm install -g npm@latest
 
-# Install dependencies
-pnpm install
+# Install dependencies (uses package-lock.json)
+npm ci
 ```
 
 ### Commands
 
 ```sh
-pnpm test          # Run tests (Vitest)
-pnpm test:watch    # Watch mode
-pnpm build         # Bundle to dist/
-pnpm build:docs    # Copy bundle to docs/ for GitHub Pages
+npm test           # Run tests (Vitest)
+npm run test:watch # Watch mode
+npm run build      # Bundle to dist/
+npm run build:docs # Copy bundle to docs/ for GitHub Pages
 ```
 
 ### Project structure
@@ -394,7 +395,7 @@ Issues and pull requests are welcome.
 1. Fork the repository
 2. Create a feature branch: `git checkout -b feat/my-feature`
 3. Add tests for any new behaviour
-4. Run `pnpm test` and make sure all tests pass
+4. Run `npm test` and make sure all tests pass
 5. Open a pull request
 
 ---