build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. The overrides move to
package.json#overrides with every range operator intact, and allowBuilds
becomes package.json#allowScripts for the packages present in the tree.

.github/workflows/deploy.yml

@@ -22,22 +22,21 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       
-      - uses: pnpm/action-setup@v4
 
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
           node-version: '24'
-          cache: 'pnpm'
+          cache: 'npm'
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: npm ci
 
       - name: Test
-        run: pnpm test
+        run: npm test
 
       - name: Build
-        run: pnpm build
+        run: npm run build
       
       - name: Setup Pages
         uses: actions/configure-pages@v4

.gitignore

@@ -4,7 +4,7 @@ logs
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
-pnpm-debug.log*
+npm-debug.log*
 lerna-debug.log*
 .
 node_modules

README.md

@@ -4,7 +4,7 @@ Turn-based stealth puzzle game built with Svelte 5. Play as a ninja rabbit navig
 grid-based levels inside the Vegetable Kingdom, avoiding detection by vegetable guards
 to rescue the missing carrot princess.
 
-Play: `pnpm dev` → `http://localhost:5173`
+Play: `npm run dev` → `http://localhost:5173`
 
 ---
 
@@ -32,7 +32,7 @@ Play: `pnpm dev` → `http://localhost:5173`
 
 ## Requirements
 
-[Node.js](https://nodejs.org) 24+ and [pnpm](https://pnpm.io) (CI pinned to Node 24; tested and verified working).
+[Node.js](https://nodejs.org) 24+ and npm (CI pinned to Node 24; tested and verified working).
 
 ---
 
@@ -41,9 +41,9 @@ Play: `pnpm dev` → `http://localhost:5173`
 ```sh
 git clone https://github.com/tiennm99/nntv
 cd nntv
-pnpm install
-pnpm dev        # dev server at http://localhost:5173
-pnpm build      # production build → dist/
+npm install
+npm run dev        # dev server at http://localhost:5173
+npm run build      # production build → dist/
 ```
 
 Then deploy `dist/` to GitHub Pages or any static host.
@@ -66,11 +66,11 @@ Then deploy `dist/` to GitHub Pages or any static host.
 
 | Command | Description |
 |---|---|
-| `pnpm dev` | Start development server |
-| `pnpm build` | Production build → `dist/` |
-| `pnpm preview` | Preview production build locally |
-| `pnpm test` | Run all unit + solvability tests |
-| `pnpm test:solvability` | Run only the BFS solvability suite |
+| `npm run dev` | Start development server |
+| `npm run build` | Production build → `dist/` |
+| `npm run preview` | Preview production build locally |
+| `npm test` | Run all unit + solvability tests |
+| `npm run test:solvability` | Run only the BFS solvability suite |
 
 ---
 

docs/project-overview-pdr.md

@@ -128,8 +128,8 @@
 - Responsive 360px–4K (uniform scale transform; no per-component media queries needed)
 - Localization: 167 keys, en/vi parity verified in CI
 - Touch controls: 44px minimum button targets; stone-throw usable without keyboard
-- `pnpm test` green: 243 passing unit + integration tests
-- `pnpm test:solvability` green: 39 solvability tests (11 solvable, 1 unsolvable, 27 status quo)
+- `npm test` green: 243 passing unit + integration tests
+- `npm run test:solvability` green: 39 solvability tests (11 solvable, 1 unsolvable, 27 status quo)
 
 ### Technical Constraints
 
@@ -144,7 +144,7 @@
 **Current Version:** 2.0.0 (Playable, Hard, Offline)
 **Repository:** GitHub (tiennm99/nntv)
 **Last Updated:** 2026-07-26
-**CI:** Node 24, pnpm 11.1.1; all tests passing (243 unit + solvability, 39 level-specific)
+**CI:** Node 24, npm; all tests passing (243 unit + solvability, 39 level-specific)
 
 ### Completed Phases
 1. **Engine correctness** — All 13 guards.js/turn-manager.js defects fixed; mirrors reflect, warm is lethal, swaps detected, suspicion persists, statics regrow

package.json

@@ -3,7 +3,6 @@
   "description": "Night Ninja: Twilight Voyage",
   "private": true,
   "version": "0.1.0",
-  "packageManager": "pnpm@11.1.1",
   "type": "module",
   "license": "Apache-2.0",
   "scripts": {
@@ -22,5 +21,13 @@
   },
   "dependencies": {
     "svelte": "^5.55.7"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1",
+    "postcss": "^8.5.18",
+    "brace-expansion": "^5.0.8"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

pnpm-workspace.yaml

@@ -1,22 +0,0 @@
-allowBuilds:
-  esbuild: true
-
-# Force patched esbuild (>= 0.28.1) to close GHSA-gv7w-rqvm-qjhr
-# esbuild is a transitive devDependency pulled in by Vite; pinning it here
-# overrides every consumer regardless of the version Vite requested.
-#
-# postcss >= 8.5.18 closes GHSA-r28c-9q8g-f849: parsing CSS that carries a
-# sourceMappingURL comment made PostCSS read that path off disk as a previous
-# source map, so crafted CSS could disclose arbitrary .map files. Also a
-# transitive devDependency of Vite.
-#
-# brace-expansion >= 5.0.8 closes GHSA-mh99-v99m-4gvg: unbounded brace
-# expansion could exhaust memory and crash the process. The advisory has no
-# backport, so the 2.x copy that workbox-build pulls in through
-# minimatch/filelist/jake is vulnerable and only a major bump clears it.
-# 5.x publishes a CommonJS entry alongside ESM, so the CJS consumers in that
-# chain still resolve; verified by a full build, which is what exercises them.
-overrides:
-  esbuild: ^0.28.1
-  postcss: ^8.5.18
-  brace-expansion: ^5.0.8

vite.config.js

@@ -54,7 +54,7 @@ export default defineConfig({
     // esbuild 0.28.x dropped support for transforming destructuring to very
     // old browser targets (chrome87/firefox78/safari14). Pin a modern target
     // so the Svelte plugin's esbuild transform path stays compatible with
-    // the patched esbuild forced via pnpm-workspace.yaml.
+    // the patched esbuild forced via package.json overrides.
     build: {
         target: 'es2022',
     },