chore: restore npm publishing via OIDC, update toolchain

[JacobLinCool]

Why

The Release workflow has been failing since the last merge to main, so 0.7.2 was never published — the registry is still on 0.7.1. Root cause: the NPM_TOKEN secret was created 2022-07-24 and was a classic token, and npm permanently revoked all classic tokens on 2025-12-09.

Publishing: OIDC trusted publishing

Rather than rotate to a granular token (capped at 90 days, so this recurs every quarter), publishing now uses OIDC. Verified by decompiling the pnpm bundles rather than trusting docs:

	ACTIONS_ID_TOKEN_REQUEST_URL	publish path
pnpm 10.33.2	0 occurrences	runNpm(npmPath ?? "npm", ["publish", ...])
pnpm 11.21.0	5 occurrences	native

pnpm 10 just shells out to whatever npm is on PATH, and ubuntu-latest ships npm 10.9.8 — below the 11.5.1 that trusted publishing needs. Moving to pnpm 11 makes that irrelevant: the workflow only needs id-token: write, with no actions/setup-node and no npm upgrade step.

NPM_TOKEN is deliberately absent from the workflow env — changesets/action writes an .npmrc whenever it sees one, and that credential would take precedence over OIDC. The secret has been deleted from the repo. Provenance signs automatically for a public repo + public package; it must not be set explicitly (changesets#1914).

Setup done outside this PR: Trusted Publisher configured on npmjs.com pointing at release.yml.

Bug fix: CLOUDFLARED_VERSION was ignored

postinstall hardcoded bin install latest, so the env var the README documents had no effect. Reproduced: setting CLOUDFLARED_VERSION=2025.11.1 installed 2026.7.3. Installing an explicit version also printed Installing cloudflared undefined, because the message read the raw argument instead of the resolved version. CI never caught this because the tests reinstall the binary themselves, bypassing the postinstall path.

Verified after the fix: env var honoured, unset still resolves to latest, explicit version still works.

pnpm 11 migration notes

Two breaking changes worth flagging for review:

1. The pnpm field in package.json is no longer read — onlyBuiltDependencies moves to pnpm-workspace.yaml under the new allowBuilds syntax.
2. pnpm 11 ships a minimumReleaseAge supply-chain check (24h default) that rejected @typescript-eslint@8.67.0, published the same day. pnpm's own suggestion was to add the packages to minimumReleaseAgeExclude — that was dropped, since it disables the check that just did its job. Pinned to 8.66.0 instead. Direct pinning alone isn't enough: @typescript-eslint/project-service depends on its siblings via a caret range, so an overrides block holds the whole set. That block is temporary and commented as such.

Confirmed the policy is a pnpm built-in default, not local config (pnpm config get minimumReleaseAge → undefined), so CI would hit it too. Validated with --frozen-lockfile.

TypeScript stays on 6.0.3 — 7.0.2 breaks both build and lint (typescript-eslint does not support TS 7.0, and typedoc hasn't caught up either).

Other maintenance

• actions/checkout v4→v7 and pnpm/action-setup v4→v6, both Node 24, ahead of the Node 20 runner removal on 2026-09-16. Confirmed peaceiris/actions-gh-pages@v4 and changesets/action@v1 are already Node 24.
• test.yml's sudo call now uses the action's bin_dest output instead of $PNPM_HOME, which v6 changed the handling of.
• Test matrix refreshed to latest / 2026.7.3 / 2026.5.0 / 2026.2.0 / 2025.11.1. Keeping one explicit newest version is deliberate — install.ts uses a different download URL for latest than for a pinned version.
• Dropped changeset@0.2.6, an unrelated LevelDB JSON-diff utility from 2013 that was never the changesets CLI.
• typedoc moved to a config file, silencing 10 @platform warnings.
• pnpm-lock.yaml added to .prettierignore — pnpm format was rewriting the lockfile.
• eslint: dropped jest-era ignores, no-unused-expressions raised to error now that the source is clean.
• README's ESM snippets linked to the CommonJS example files.

Verification

build / lint (0 warnings) / docs (0 warnings) / format / test (2 passed, 1 skipped) all pass under pnpm 11.21.0 with --frozen-lockfile.

Note: 0.7.2 will be skipped; the next release goes straight to 0.7.3 with both CHANGELOG entries intact.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9844a3a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
cloudflared	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR