chore: consolidate dependency automation

.github/dependabot.yml

@@ -3,12 +3,19 @@ updates:
   - package-ecosystem: npm
     directory: /
     schedule:
-      interval: weekly
+      interval: monthly
+    open-pull-requests-limit: 1
     groups:
       workspace-dependencies:
         patterns:
           - '*'
+
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: weekly
+      interval: monthly
+    open-pull-requests-limit: 1
+    groups:
+      github-actions-dependencies:
+        patterns:
+          - '*'

.github/workflows/ci.yml

@@ -20,11 +20,11 @@ jobs:
     name: Quality and build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
         with:
           version: 11.21.0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -39,11 +39,11 @@ jobs:
     name: Browser smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
         with:
           version: 11.21.0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: pnpm

.gitignore

@@ -1,6 +1,7 @@
 node_modules/
 .pnpm-store/
 .next/
+apps/world-lab/next-env.d.ts
 dist/
 coverage/
 playwright-report/

AGENTS.md

@@ -29,4 +29,7 @@ These instructions apply throughout the repository.
 - Update architecture, security, testing, and roadmap docs when changing the corresponding contract.
 - Do not commit `.env` files, credentials, generated build output, test reports, or caches.
 - Use Conventional Commit messages. Keep pull requests within one roadmap milestone.
-- Before handing off a change, run `pnpm validate`; run `pnpm test:e2e` for World Lab behavior changes.
+- Coding agents write and update appropriate tests, configure automatic GitHub CI, and provide the exact local validation commands for the repository owner to run.
+- The repository owner runs local formatting checks, lint, type checking, tests, builds, and Playwright. Coding agents must not run local validation unless the owner explicitly requests it in that session.
+- Automatic GitHub CI may run after a branch is pushed. Coding agents may inspect CI status and failure logs.
+- Coding agents must never claim local tests passed unless the repository owner supplied the results.

apps/game-api/package.json

@@ -18,7 +18,7 @@
     "hono": "4.13.2"
   },
   "devDependencies": {
-    "@types/node": "26.2.0",
+    "@types/node": "24.13.3",
     "esbuild": "0.28.2",
     "tsx": "4.23.12",
     "vitest": "4.1.10"

apps/world-lab/package.json

@@ -9,7 +9,7 @@
     "lint": "eslint .",
     "start": "next start",
     "test": "vitest run",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "next typegen && tsc --noEmit"
   },
   "dependencies": {
     "@agentborne/shared": "workspace:*",

docs/TESTING.md

@@ -2,6 +2,8 @@
 
 Default validation is deterministic, offline except for dependency/browser installation and the World Lab basemap requested during manual viewing. No test calls a model provider.
 
+Coding agents write and update appropriate tests, configure automatic GitHub CI, and provide exact validation commands. The repository owner runs local formatting, lint, type checking, tests, builds, and Playwright unless they explicitly request an agent to run validation in that session. Agents may inspect automatic CI after a branch is pushed, but must not claim local checks passed unless the owner supplied the results.
+
 ## Local sequence
 
 ```bash
@@ -23,6 +25,8 @@ development server on another port, run for example
 
 `pnpm validate` aggregates formatting, lint, type checking, unit/integration tests, and builds. Browser smoke coverage remains separate because it installs and starts Chromium.
 
+The World Lab typecheck runs `next typegen` before TypeScript. Next.js manages `apps/world-lab/next-env.d.ts`; the file remains in `tsconfig.json` but is ignored by Git so development, builds, and type generation can recreate it without dirtying the working tree.
+
 ## Layers
 
 - Shared schema unit tests cover the four allowed requested-action forms and reject invented verbs.

package.json

@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "@playwright/test": "1.62.1",
-    "@types/node": "26.2.0",
+    "@types/node": "24.13.3",
     "eslint": "9.39.5",
     "eslint-config-next": "16.3.1",
     "prettier": "3.9.6",