Convert to npm

[peachbits]

Note

Low Risk
Only package-manager config and Travis install/scripts change; no application or native runtime logic in this diff.

Overview
This PR finishes moving the repo from Yarn to npm for installs and CI.

.gitignore no longer ignores package-lock.json, so the npm lockfile is versioned. .npmrc is added with legacy-peer-deps=true and ignore-scripts=true (replacing .yarnrc, which is removed). .travis.yml now runs npm ci on install and npm run lint / npm run prepare instead of the frozen yarn equivalents.

^{Reviewed by Cursor Bugbot for commit c476006. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0bed030. Configure here.}

[cursor]

Travis Node twelve breaks npm ci

High Severity

Travis still targets Node 12, whose bundled npm cannot install from a package-lock.json with lockfileVersion 3. The install step now uses npm ci, and the lockfile is no longer gitignored, so CI is likely to fail on the install phase.

Additional Locations (1)

• .gitignore#L8-L13

 

^{Reviewed by Cursor Bugbot for commit 0bed030. Configure here.}

[cursor]

Stale comment

[cursor]

🔒 Agentic Security Review
Severity: HIGH

Switching CI from Yarn with --ignore-scripts true to npm ci removes install-script hardening, so dependency lifecycle scripts can now execute during install.

Impact: A compromised or malicious package in the lockfile can run arbitrary commands in CI before build/test steps, which can tamper outputs or exfiltrate CI-accessible secrets.