fix: refresh dependencies and pause automatic publication

.github/workflows/ci.yml

@@ -24,7 +24,12 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.10
+          bun-version: 1.3.13
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -36,10 +41,15 @@ jobs:
         run: bunx @biomejs/biome ci .
 
       - name: Typecheck
-        run: bun run typecheck
+        run: |
+          bun run typecheck
+          bun run --cwd ui typecheck
 
       - name: Test
         run: bun run test
 
       - name: Build
         run: bun run build
+
+      - name: Check package tarball
+        run: bun run pack:check

.github/workflows/release.yml

@@ -1,67 +1,89 @@
 name: Release
 
+# Publication is intentionally disabled pending an audited npm publisher.
+# This workflow can verify main and maintain release PRs, but cannot create
+# tags/GitHub releases or publish packages. Restore publication in a reviewed PR.
+
 on:
   push:
     branches:
       - main
   workflow_dispatch:
 
 permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-  id-token: write
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
-  release:
+  release-pr:
+    needs: verify
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
-    timeout-minutes: 20
-
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v5
         with:
-          fetch-depth: 0
-
+          persist-credentials: false
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.10
-
+          bun-version: 1.3.13
       - name: Setup Node
         uses: actions/setup-node@v5
         with:
           node-version: 24
-          registry-url: https://registry.npmjs.org
+      - name: Install audited release tooling
+        run: bun install --frozen-lockfile
+      - name: Audit release tooling
+        run: bun audit --audit-level=moderate && npm audit --audit-level=moderate
+      - name: Update release PR
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node scripts/release-control.mjs pr
 
+  verify:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.13
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
       - name: Install dependencies
         run: bun install --frozen-lockfile
-
       - name: Install UI dependencies
         run: bun install --cwd ui --frozen-lockfile
-
-      - name: Build distributable files
+      - name: Audit application, UI, and release tooling
+        run: bun run audit
+      - name: Lint
+        run: bun run lint
+      - name: Typecheck
         run: |
-          bun run --cwd ui build
-          bun run sync-ui-dist
-          bun run build-bin
-
-      - name: Show Node and npm versions
-        run: |
-          node --version
-          npm --version
-
-      - name: Upgrade npm
-        run: npm install -g npm@latest
-
-      - name: Show npm version after upgrade
-        run: npm --version
-
-      - name: Publish release
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          NPM_CONFIG_PROVENANCE: true
-        run: bun run release
+          bun run typecheck
+          bun run --cwd ui typecheck
+      - name: Test
+        run: bun run test
+      - name: Build
+        run: bun run build
+      - name: Check package tarball
+        run: bun run pack:check

.github/workflows/security.yml

@@ -27,7 +27,12 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.10
+          bun-version: 1.3.13
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -36,7 +41,7 @@ jobs:
         run: bun install --cwd ui --frozen-lockfile
 
       - name: Dependency audit
-        run: bun audit --audit-level=moderate
+        run: bun run audit
 
   codeql:
     runs-on: ubuntu-latest
@@ -59,7 +64,12 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.10
+          bun-version: 1.3.13
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.3.0"
+}

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.11/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
   "files": {
     "includes": ["**", "!dist", "!ui/dist"]
   },
@@ -10,7 +10,7 @@
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true
+      "preset": "recommended"
     }
   },
   "overrides": [