chore(deps): migrate to pnpm 11 (#2)

* chore(deps): migrate pnpm config from package.json to pnpm-workspace.yaml; bump packageManager to pnpm 11

- Remove `pnpm.onlyBuiltDependencies` from package.json (removed in pnpm 11)
- Create pnpm-workspace.yaml with allowBuilds map (esbuild, lefthook)
- Bump packageManager to pnpm@11.1.3
- Bump engines.pnpm to >=11.0.0

Removes the pnpm 10 pin that was a tactical measure during the Node 22
engine bump. Reference: https://pnpm.io/migration

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* ci(snyk): pass --all-projects flag

Snyk's pnpm plugin now sees pnpm-workspace.yaml (added in the prior
commit for the pnpm 11 migration) and treats the repo as a monorepo.
Without --all-projects it errors with SNYK-CLI-0000:

  Both `pnpm-lock.yaml` and `pnpm-workspace.yaml` were found in
  /github/workspace.
  Please run your command again specifying `--all-projects` flag.

This repo is single-project; --all-projects is the right answer per
Snyk's own error message. No behaviour change for a single-project
scan; just unblocks the workflow under the new pnpm config layout.

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: dnlbox

.github/workflows/snyk.yml

@@ -37,7 +37,7 @@ jobs:
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
-          args: --severity-threshold=high --sarif-file-output=snyk.sarif
+          args: --severity-threshold=high --sarif-file-output=snyk.sarif --all-projects
 
       - name: Upload results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v4

CHANGELOG.md

@@ -5,6 +5,7 @@ All notable changes are documented here. Format follows [Keep a Changelog](https
 ## [Unreleased]
 
 ### Changed
+- Dev: migrated pnpm config from `package.json` `pnpm.onlyBuiltDependencies` (removed in pnpm 11) to `pnpm-workspace.yaml` `allowBuilds`. `packageManager` and `engines.pnpm` bumped to pnpm 11. No user-facing behaviour change; published package surface is identical.
 - **BREAKING**: minimum Node version raised from 20 to 22 (`engines.node >=22.0.0`). Driven by upstream pnpm 11.x dropping Node 20 support (uses `node:sqlite`, available in Node 22.13+ only). `@types/node` bumped to `^24` (LTS line). `packageManager` field added (`pnpm@10.32.1`) to pin CI pnpm version; CI workflows updated to read from `packageManager` instead of a hardcoded `version` constraint.
 - Upgraded CLI framework `commander` 12→14. No user-facing behaviour change expected; `--help`, `--version`, and subcommand signatures (`validate`, `compare`, `normalize`, `info`, `list-resources`) are unchanged. If `--help` output formatting shifts (whitespace), it is upstream cosmetic.
 - Dev: bumped typescript 5.9→6; added `"ignoreDeprecations": "6.0"` to tsconfig.json to silence two TS6 deprecation warnings (`baseUrl` and `esModuleInterop: false`) — both intentional and will be revisited before TypeScript 7. No user-facing behaviour change.

package.json

@@ -64,9 +64,9 @@
     "prepublishOnly": "pnpm build && pnpm typecheck && pnpm test",
     "cli": "tsx src/cli/index.ts",
     "cli:watch": "tsx --watch src/cli/index.ts",
-    "docs:dev": "vitepress dev docs/site",
-    "docs:build": "vitepress build docs/site",
-    "docs:preview": "vitepress preview docs/site"
+    "docs:dev": "pnpm --dir docs/site dev",
+    "docs:build": "pnpm --dir docs/site build",
+    "docs:preview": "pnpm --dir docs/site preview"
   },
   "dependencies": {
     "commander": "^14.0.3",
@@ -86,18 +86,11 @@
     "tsx": "^4.22.3",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.59.4",
-    "vitepress": "^1.6.4",
     "vitest": "^3.2.4"
   },
-  "packageManager": "pnpm@10.32.1",
+  "packageManager": "pnpm@11.1.3",
   "engines": {
     "node": ">=22.0.0",
-    "pnpm": ">=10.0.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild",
-      "lefthook"
-    ]
+    "pnpm": ">=11.0.0"
   }
 }