Package housekeeping: fix bundler compatibility, standardize on npm, add Dependabot

[nachogarcia]

Closes #127

Package housekeeping: fix bundler compatibility, standardize on npm, add Dependabot

Summary

• Add "sideEffects": true to fix Vite/esbuild breaking Temml (#sideeffects)
• Standardize on npm: remove yarn.lock, .yarnrc.yml, packageManager field (#lockfiles)
• Remove dead esm dependency, fix deprecated git:// repository URL (#dependencies)
• Add dist/ to .gitignore — build artifacts shouldn't be version-controlled (#dist-tracked)
• Add Dependabot configuration for automated weekly dependency updates (#dependabot)

Changes

Fix: sideEffects: true in package.json

Temml breaks when pre-bundled by Vite (esbuild) because the ~1,061 defineSymbol() and defineMacro() calls are treated as dead code and removed. Adding "sideEffects": true tells bundlers to preserve module-level initialization code.

A granular approach ("sideEffects": ["src/symbols.js", "src/macros.js"]) would not work because consumers resolve to the pre-built dist/temml.mjs — a single bundle where those source paths don't exist as separate modules.

Standardize on npm

• Deleted yarn.lock and .yarnrc.yml
• Removed "packageManager": "yarn@3.3.1" from package.json
• Replaced yarn with npm run in all scripts (test, build, dist)
• Regenerated package-lock.json with a clean npm install

npm ships with Node.js, requires no extra setup, and is what most contributors expect.

Remove dead dependency and fix repository URL

• Removed esm from devDependencies — it is never imported anywhere in the codebase
• Changed repository URL from git:// (disabled by GitHub since 2022) to https://

Add dist/ to .gitignore

The 13 files in dist/ are all generated by npm run dist. Tracking them inflates the repo and creates noisy diffs. npm publishing still works because dist/ is in the "files" field.

Also cleaned up stale Yarn PnP entries from .gitignore (.yarn/, .pnp.*).

Ran git rm --cached -r dist/ to stop tracking the existing files. A prepublishOnly script was added so npm publish automatically runs npm run dist first, guaranteeing fresh build artifacts in every release.

Since dist/ no longer exists on a fresh clone, added fs.mkdirSync('dist', { recursive: true }) to utils/copyfiles.js so npm run dist creates it automatically.

Add Dependabot

Added .github/dependabot.yml for weekly npm dependency update PRs.

Files changed

File	Change
package.json	sideEffects, remove esm/packageManager, fix URL, npm run scripts, prepublishOnly
utils/copyfiles.js	Create dist/ directory if missing
.gitignore	Add dist/, remove stale Yarn entries
.github/dependabot.yml	New file
yarn.lock	Deleted
.yarnrc.yml	Deleted
package-lock.json	Regenerated

Not included (suggest as follow-ups)

• Major dependency bumps: eslint 9→10, @eslint/js 9→10, globals 15→17 (breaking changes, should be separate PRs)
• site/ directory (339 tracked files): Likely used for GitHub Pages — separate discussion

Test plan

• npm install succeeds cleanly
• npm test passes (lint + unit tests)
• npm run build produces correct output in test/ and utils/
• npm run dist copies artifacts to dist/ correctly
• Verify a Vite project with import temml from 'temml' renders math correctly