The published shrinkwrap prevented npm from deduplicating pi-ai for library users and blocked consumer overrides for vulnerable transitive deps. The pi.dev installer keeps pinned deps through the generated install lock. Self-updates of package-manager installs now recommend switching to the installer.
Refs #5653
Separate stable and development entrypoints, exclude remote harness code from distributions, and verify isolated consumer installs before release. Fixes#9132.
Usage: npm run release:patch|minor|major
Automates:
- Check for uncommitted changes
- Bump version
- Update CHANGELOGs: [Unreleased] -> [version] - date
- Commit and tag
- Publish to npm
- Add new [Unreleased] sections
- Push