Convert to npm

[peachbits]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none

Description

none

---

Note

Low Risk
Tooling-only change; main caveat is install behavior (ignore-scripts, overrides) affecting hooks/build on npm install, not runtime library logic.

Overview
This PR migrates the repo from Yarn to npm by adding a committed package-lock.json, removing .yarnrc, and introducing .npmrc with legacy-peer-deps=true and ignore-scripts=true (the latter mirrors the old Yarn ignore-scripts setting).

package.json updates the runtime dep bn.js to ^4.12.3, bumps mocha to ^10.6.0, drops babel-cli, and moves babel-eslint to ^10.1.0. New overrides pin transitive versions (babel-eslint, lodash, serialize-javascript, flatted, micromatch) for a reproducible npm tree.

There are no changes to library source under src/—only install and devDependency tooling.

^{Reviewed by Cursor Bugbot for commit 4a0931a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Mocha forced serialize-javascript seven

Medium Severity

The overrides entry forces serialize-javascript to 7.0.5, which requires Node >=20. However, mocha@10.6.0 depends on serialize-javascript@^6.0.2 and supports Node >=14. This version mismatch can cause npm test to fail on Node versions 14-19.

 

^{Reviewed by Cursor Bugbot for commit e060008. Configure here.}

[cursor]

Incompatible TypeScript ESLint versions

Medium Severity

Adding legacy-peer-deps=true lets npm install succeed while the lockfile keeps @typescript-eslint/eslint-plugin at 3.8.0 (peer @typescript-eslint/parser ^3.0.0) alongside @typescript-eslint/parser 2.34.0. With type-aware parserOptions.project in .eslintrc.json, lint-staged / npm run lint can fail or mis-handle TypeScript despite a green install.

Additional Locations (2)

• package-lock.json#L333-L356
• package-lock.json#L471-L492

 

^{Reviewed by Cursor Bugbot for commit e060008. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4a0931a. Configure here.}

[cursor]

Publish skips build via scripts

High Severity

Project .npmrc sets ignore-scripts=true, and npm honors that for npm publish / npm pack, so the root prepare script (husky install && npm run build) does not run before packing. Published files point at lib/*, but lib/ is gitignored and only produced by build, so a publish from a clean tree can ship without compiled main / types artifacts.

Additional Locations (1)

• package.json#L33-L34

 

^{Reviewed by Cursor Bugbot for commit 4a0931a. Configure here.}