fix: support npm 12 installs

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           node-version: 'lts/*'
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci
@@ -61,7 +61,7 @@ jobs:
         with:
           node-version: lts/*
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci
@@ -88,7 +88,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci

.github/workflows/devenv-e2e.yml

@@ -32,7 +32,7 @@ jobs:
         with:
           node-version: 'lts/*'
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci

.github/workflows/npm-publish.yml

@@ -21,9 +21,6 @@ jobs:
       pull-requests: write
     steps:
       - uses: Automattic/vip-actions/npm-publish@c8022b66e78461df4f802b935dc0dbb8399f96bc # v0.7.4
-        env:
-          # npm@12 no longer supports npm-shrinkwrap.json with npm ci in this repository.
-          NPM_CONFIG_TAG: next-11
         with:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           USE_TRUSTED_PUBLISHING: 'true'
@@ -60,9 +57,6 @@ jobs:
       pull-requests: write
     steps:
       - uses: Automattic/vip-actions/npm-publish-prerelease@c8022b66e78461df4f802b935dc0dbb8399f96bc # v0.7.4
-        env:
-          # npm@12 no longer supports npm-shrinkwrap.json with npm ci in this repository.
-          NPM_CONFIG_TAG: next-11
         with:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           USE_TRUSTED_PUBLISHING: 'true'

.github/workflows/sea-build-sign.yml

@@ -60,7 +60,7 @@ jobs:
         with:
           node-version: '22.x'
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci

.npmrc

@@ -0,0 +1 @@
+allow-git=root

docs/COMMANDER-MIGRATION.md

@@ -5,7 +5,7 @@ Goal: remove the abandoned `args` package, keep CLI behavior stable, and support
 ## Migration Outcome
 
 - `src/lib/cli/command.js` is the active Commander-backed compatibility wrapper for all bins that call `command()`.
-- `args` has been removed from `package.json` and `npm-shrinkwrap.json`.
+- `args` has been removed from `package.json` and `package-lock.json`.
 - Root command flow (`src/bin/vip.js`) now dispatches via the shared Commander wrapper again, preserving login gating and subcommand chaining.
 - Temporary side-path wrapper work has been removed (`src/lib/cli/command-commander.ts` deleted).