💥 Modernize toolchain: pnpm, tsdown, Vitest, Biome, TypeScript 7, CI

[SylvainEstevez]

Step 0–8 of CHECKLIST.md for @tselect/schema. Fourth repo after url, thrown and http-method, taken out of turn — and the reason it was scheduled late did not survive contact with the code.

Suggested squash commit message

This repo's ruleset allows squash only, and repo settings are PR_TITLE + BLANK, so the branch's gitmoji series does not survive on its own. Paste this as the commit body at merge time:

:boom: Modernize toolchain: pnpm, tsdown, Vitest, Biome, TypeScript 7, CI

Eight concerns, one commit — this repository's ruleset allows squash merges
only, so the gitmoji series from `chore/modernize` is recorded here rather
than replayed onto `main`:

  :bug:                 Repo hygiene: fix what ships and stop tracking build artefacts
  :wrench:              Migrate to pnpm
  :heavy_minus_sign:    Drop the @types/ajv stub and demote ajv to a devDependency
  :sparkles:            Add dual ESM + CJS build via tsdown, on TypeScript 7
  :white_check_mark:    Migrate test suite to Vitest
  :rotating_light:      Replace TSLint with Biome
  :memo:                Add LICENSE, keywords and a full README API section
  :construction_worker: Run CI from the org-wide reusable workflow

`:boom:` rather than the branch's `:wrench:` because a squash leaves one
commit to infer the bump from, and `:wrench:` infers as no release at all.
The `bump: major` override is still the documented way to ship this; the
history now says so on its own as well.

Why this is a major, four times over

• engines.node becomes >=22 — the bottom of the CI matrix, so the floor is proven by construction rather than asserted.
• The exports map closes deep imports. gh search code "@tselect/schema/dist" found no consumer doing it, but it is a break.
• enumeration()'s return type moves from any to TJSONSchema — a compile-time break for callers relying on any to skip narrowing. Same call thrown made.
• ajv leaves dependencies, closing a transitive install for anyone resolving it through this package rather than declaring it.

The scheduling premise was wrong: ajv is test-only

schema was ordered second-to-last because of ajv@6, on the theory that 6 → 8 was a breaking change this package owed its consumers. src/ never imports ajv. The only references are test/factories/object.test.ts and test/factories/uuid.test.ts, which compile a produced schema to prove it is valid JSON Schema; the published 1.0.0 tarball contains no reference to ajv either. It was a devDependency declared as a runtime one. Moved, upgraded to 8, and the risk the ordering existed to defer evaporated. @types/ajv@1.0.0 — a deprecated stub with "typings": null — is deleted.

Headline fix: the entire package was broken in ESM

All seven utils used import * as Lodash from 'lodash'. lodash assigns its exports dynamically, so cjs-module-lexer cannot detect them and the ESM namespace comes back empty. Because makeSchema → cleanOptions → Lodash.omit, every factory in the package would have thrown on the ESM entry while CJS kept working — the whole surface, not one function as in http-method. Fixed with the default import, which Node's CJS interop always populates.

Checked non-vacuous: restoring the namespace form makes dist/index.mjs throw Lodash.omit is not a function on string() while dist/index.cjs still returns {"type":"string"}.

lodash is kept rather than vendored — nine helpers including cloneDeep and mergeWith, which is more than the removal policy's "handful". Only the import form changed.

Two smaller API fixes, both found by running things rather than reading them

• cleanOptions's signature made its own purpose uncallable. Its first parameter was TCommonOptions, i.e. { nullable?: boolean }, so cleanOptions({ nullable: true, title: 'T' }) — exactly what the function exists to do — failed excess property checking and would not compile. Widened to TOptions<TJSONSchema>, which is what every internal caller already passed. Strictly widening; three tests cover it, the first doubling as the compile-time guard.
• isJSONSchemaLike(obj: {}) → obj: unknown, also strictly widening: every call that compiled before still does, and unknown values no longer need a cast at the call site.

One inconsistency pinned rather than fixed

nullable(enumSchema, false) strips 'null' from type but still appends null to enum, so the two disagree. Published 1.0.0 behaves identically, so it is not a regression — and this is a tooling refresh, so it is left alone. A test with a comment pins the current behaviour and gives the fix somewhere to land. Say the word if you would rather it were fixed here.

Verification

Everything below was run against a clean copy of the tracked tree, not the working directory. That discipline earned its keep immediately: the first attempt built ESM-only with no CJS bundle and no .d.cts, because tsdown.config.ts had been written but never git added — and the build still exited 0.

Gate	Result
Differential vs published 1.0.0	105 scenarios across all 30 exports × new CJS + new ESM = 212 comparisons, 0 mismatches; export names identical across all three
README examples	65 assertions, all matched; typechecks under strict + nodenext on TS 7 with no casts on any documented call
Tests	74 passed (58 baseline + 16)
Coverage	100% statements, branches, functions, lines — branches were 89.55% before ten added tests
pnpm audit	0, down from 17, by subtraction rather than audit fix
biome check · tsc --noEmit	clean
attw --profile node16	no problems, all four resolution modes
es-check es2015	clean on both bundles
Tarball	16 kB / 9 files, against the published 31 kB / 84 files

The published tarball was shipping a stray 30 kB .log32156 and tslint.json; .npmignore is replaced by "files": ["dist"], since a denylist cannot enumerate what does not exist yet.

Biome raised 16 findings, 15 in the public API. They were triaged rather than ruled on: two changed as deliberate API decisions (above), the mechanical ones fixed properly, and four anys kept with a per-line biome-ignore and the reason written at the site — TJSONSchema's [key: string]: any index signature is what makes the type open to the whole of JSON Schema, and under unknown every schema.minLength read would need narrowing. Nothing is disabled in biome.json.

Still open after this merges

• 19 @bluejay-era tags, and none of them is v1.0.0 — an unprefixed 1.0.0, v1.1.0 through v1.9.5, and v3.0.0-beta.0. Nothing names 64abede, the commit the registry records as 1.0.0's gitHead, so the release plan job would count every commit in the history. A third variant of the same problem: url had a squatter on the tag its major wanted, thrown had no tags at all. Clearing it is a step 9 prerequisite; since-ref is the escape hatch until then.
• Publishing, deferred until all seven repos are modernized.
• CodeQL's actions language cannot be enabled until workflows exist on the default branch — it will pick up on the next tselect sync after this merges.