build: migrate from bun to pnpm and upgrade semantic-release to v25

.codex/environments/environment.toml

@@ -3,4 +3,4 @@ version = 1
 name = "quickadd"
 
 [setup]
-script = "bun install"
+script = "pnpm install"

.github/PULL_REQUEST_TEMPLATE.md

@@ -8,7 +8,7 @@
 
 ## Testing / validation
 
-<!-- How did you verify this? e.g. `bun run build-with-lint`, `bun run test`, and
+<!-- How did you verify this? e.g. `pnpm run build-with-lint`, `pnpm run test`, and
      manual checks in Obsidian (include the Obsidian version; screenshots for UI). -->
 
 ## Checklist

.github/dependabot.yml

@@ -16,8 +16,8 @@ updates:
       - dependencies
       - github-actions
 
-  # Plugin dependencies (root package.json + bun.lock).
-  - package-ecosystem: bun
+  # Plugin dependencies (root package.json + pnpm-lock.yaml).
+  - package-ecosystem: npm
     directory: /
     schedule:
       interval: weekly
@@ -35,8 +35,8 @@ updates:
     labels:
       - dependencies
 
-  # Docs site (docs/package.json + docs/bun.lock).
-  - package-ecosystem: bun
+  # Docs site (docs/package.json + docs/pnpm-lock.yaml).
+  - package-ecosystem: npm
     directory: /docs
     schedule:
       interval: weekly

.github/workflows/ci.yml

@@ -33,18 +33,18 @@ jobs:
               uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
               with:
                   persist-credentials: false
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-              with:
-                  bun-version: 1.3.14
+            - name: Setup pnpm
+              uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
             - name: Use Node.js 24
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 24
+                  check-latest: true
+                  cache: pnpm
             - name: Install dependencies
-              run: bun install --frozen-lockfile
+              run: pnpm install --frozen-lockfile
             - name: Run tests
-              run: bun run test
+              run: pnpm run test
 
     build-lint:
         name: Build + Lint
@@ -58,20 +58,20 @@ jobs:
               uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
               with:
                   persist-credentials: false
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-              with:
-                  bun-version: 1.3.14
+            - name: Setup pnpm
+              uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
             - name: Use Node.js 24
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 24
+                  check-latest: true
+                  cache: pnpm
             - name: Install dependencies
-              run: bun install --frozen-lockfile
+              run: pnpm install --frozen-lockfile
             - name: Run build with lint
-              run: bun run build-with-lint
+              run: pnpm run build-with-lint
             - name: Svelte check
-              run: bun run check
+              run: pnpm run check
 
     dependency-review:
         name: Dependency Review

.github/workflows/release.yml

@@ -45,28 +45,31 @@ jobs:
                   fetch-depth: 0
                   token: ${{ secrets.GITHUB_TOKEN }}
 
-            - name: Setup Bun
-              uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-              with:
-                  bun-version: 1.3.14
+            - name: Setup pnpm
+              uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
             - name: Use Node.js 24
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 24
+                  check-latest: true
+                  cache: pnpm
+                  cache-dependency-path: |
+                      pnpm-lock.yaml
+                      docs/pnpm-lock.yaml
 
             - name: Install dependencies
               run: |
-                  bun install --frozen-lockfile
-                  cd docs && bun install --frozen-lockfile
+                  pnpm install --frozen-lockfile
+                  cd docs && pnpm install --frozen-lockfile
 
             # Build must run before Release: it produces main.js / styles.css that
             # @semantic-release/github uploads and attest-build-provenance signs.
             - name: Build
-              run: bun run build
+              run: pnpm run build
 
             - name: Run tests
-              run: bun run test
+              run: pnpm run test
 
             - name: Release
               id: release
@@ -83,7 +86,7 @@ jobs:
                   BEFORE_HEAD="$(git rev-parse HEAD)"
                   # `set -e` (default for run blocks) aborts the step if
                   # semantic-release fails, so we only reach the check on success.
-                  bunx semantic-release $EXTRA_ARGS
+                  pnpm exec semantic-release $EXTRA_ARGS
 
                   # A real release advances HEAD via @semantic-release/git's release
                   # commit; a dry run or "no relevant changes" leaves HEAD untouched.

.gitignore

@@ -2,11 +2,13 @@
 *.iml
 .idea
 
-# npm/pnpm/yarn
+# Dependencies
 node_modules
+
+# Foreign package-manager lockfiles (this project uses pnpm; pnpm-lock.yaml is committed)
 package-lock.json
-pnpm-lock.yaml
 yarn.lock
+bun.lock
 
 # build
 main.js

AGENTS.md

@@ -8,25 +8,25 @@ templates, captures, macros, and multis.
 QuickAdd is an Obsidian community plugin. Source code lives in `src/`: core logic under `engine/`, `services/`, and `utils/`; Svelte UI in `src/gui`; shared types in `src/types`; settings entry in `src/quickAddSettingsTab.ts`. Bundled artifacts `main.js` and `styles.css` stay at the repo root and should be generated, not hand-edited. Place tests and stubs in `tests/`, and keep user-facing docs in `docs/`.
 
 ## Tooling & GitHub
-- Use `bun` for package management and scripts. Avoid npm/yarn/pnpm.
+- Use `pnpm` for package management and scripts. Avoid npm/yarn/bun.
 - Use the GitHub CLI (`gh`) for issues, PRs, and releases.
 - When resolving a GitHub issue, use `gh issue develop <issue-number>` to
   create/link the working branch before implementation.
 - GitHub does not allow approving your own PR from the same account; do not
   block merge waiting for self-approval.
 
 ## Build, Test, and Development Commands
-- `bun run dev`: watch-mode bundle via `esbuild.config.mjs`, regenerating `main.js` as you edit.
-- `bun run build`: run `tsc --noEmit` then produce the production bundle.
-- `bun run build-with-lint`: type-check, run ESLint (`bun lint`), then produce the production build; use for release packaging.
-- `bun run lint`: apply ESLint to TypeScript sources to catch type and usage issues.
-- `bun run test`: execute Vitest with `--passWithNoTests` for fast local verification.
+- `pnpm run dev`: watch-mode bundle via `esbuild.config.mjs`, regenerating `main.js` as you edit.
+- `pnpm run build`: run `tsc --noEmit` then produce the production bundle.
+- `pnpm run build-with-lint`: type-check, run ESLint (`pnpm lint`), then produce the production build; use for release packaging.
+- `pnpm run lint`: apply ESLint to TypeScript sources to catch type and usage issues.
+- `pnpm run test`: execute Vitest with `--passWithNoTests` for fast local verification.
 
 ## Coding Style & Naming Conventions
 The project uses tab indentation and LF endings (see `.editorconfig`); align editor settings. Use camelCase for variables and functions, PascalCase for classes and Svelte components, and kebab-case for directories and utilities. Preserve the hand-ordered imports in `src/main.ts`; disable auto-sorting there. Prefer type-only imports and route logging through the `logger` utilities for consistent output.
 
 ## Testing Guidelines
-Vitest (configured in `vitest.config.mts`) runs under jsdom and cannot load real Obsidian modules. Structure production code so Obsidian dependencies are injected behind interfaces; unit tests target pure logic and swap in adapters or `tests/obsidian-stub.ts`. Co-locate specs with their source or group them under `tests/feature-name`. Add regression coverage for bug fixes, and ensure `bun run test` passes before pushing.
+Vitest (configured in `vitest.config.mts`) runs under jsdom and cannot load real Obsidian modules. Structure production code so Obsidian dependencies are injected behind interfaces; unit tests target pure logic and swap in adapters or `tests/obsidian-stub.ts`. Co-locate specs with their source or group them under `tests/feature-name`. Add regression coverage for bug fixes, and ensure `pnpm run test` passes before pushing.
 
 ## Commit & Pull Request Guidelines
 Follow Conventional Commits (`feat:`, `fix:`, `test:`, `release(version): ...`) so semantic-release can determine versions. Keep generated files in the same commit as the changes that produced them. Pull requests must include a concise summary, reproduction steps or screenshots for UI changes, linked issues when relevant, and explicit notes on release or migration impact. Request review from maintainers closest to the touched area.
@@ -36,7 +36,7 @@ Docs live in `docs/` and use Docusaurus with versioned documentation. The curren
 
 **When releasing a new version:**
 ```bash
-cd docs && bun run docusaurus docs:version X.Y.Z
+cd docs && pnpm run docusaurus docs:version X.Y.Z
 ```
 This snapshots `docs/docs/` as the new stable version. Update `docs/docusaurus.config.js` to set `lastVersion` to the new version and add an entry under `versions`.
 
@@ -49,7 +49,7 @@ This snapshots `docs/docs/` as the new stable version. Update `docs/docusaurus.c
 Keep docs in sync: update `docs/docs/` when adding features, and snapshot when releasing.
 
 ## Agent Playbook
-Automation or scripted work should surface disruptive operations in the PR description and rerun `bun run build-with-lint` to keep `main.js`, `manifest.json`, and `versions.json` synchronized. Treat unexpected diffs in those artifacts as blockers until a maintainer approves.
+Automation or scripted work should surface disruptive operations in the PR description and rerun `pnpm run build-with-lint` to keep `main.js`, `manifest.json`, and `versions.json` synchronized. Treat unexpected diffs in those artifacts as blockers until a maintainer approves.
 
 ## Dev workflow
 Always use the `obsidian` cli to test changes in the dev vault.
@@ -67,7 +67,7 @@ Anything you can do in Obsidian can be done from the command line. Obsidian CLI
 - Dev vault root path: `/Users/christian/Developer/dev_vault/dev/`.
 - QuickAdd plugin path in the vault:
   `/Users/christian/Developer/dev_vault/dev/.obsidian/plugins/quickadd`.
-- Run `bun run dev` in this repository to generate/update `main.js` for
+- Run `pnpm run dev` in this repository to generate/update `main.js` for
   development.
 - Reload QuickAdd after build/deploy with:
   `obsidian vault=dev plugin:reload id=quickadd`.

CONTRIBUTING.md

@@ -17,11 +17,11 @@ vault flow you used, and any relevant screenshots for UI changes.
 
 ## Development
 
-QuickAdd uses `bun` for local development tasks.
+QuickAdd uses `pnpm` for local development tasks.
 
 ```bash
-bun run test
-bun run build
+pnpm run test
+pnpm run build
 ```
 
 For changes that affect the plugin at runtime, verify the behavior in Obsidian

README.md

@@ -27,11 +27,11 @@ For detailed instructions and examples on using QuickAdd, see the [QuickAdd docu
 
 ## Development
 
-QuickAdd uses `bun` for local development tasks:
+QuickAdd uses `pnpm` for local development tasks:
 
-- `bun run test` runs the unit test suite.
-- `bun run build` type-checks and bundles the plugin.
-- `bun run test:e2e` runs Obsidian-backed end-to-end tests.
+- `pnpm run test` runs the unit test suite.
+- `pnpm run build` type-checks and bundles the plugin.
+- `pnpm run test:e2e` runs Obsidian-backed end-to-end tests.
 
 The E2E suite is local-only today. It depends on a locally installed Obsidian
 app, the `obsidian` CLI being available on `PATH`, and the `dev` vault being