chore: modernize tooling/build to 2026

.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm typecheck
+      - run: pnpm lint
+      - run: pnpm test
+      - run: pnpm build
+      - run: pnpm validate
+      - name: Build demo
+        working-directory: demo
+        run: pnpm build

.github/workflows/pages.yml

@@ -0,0 +1,48 @@
+name: pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+      - name: Build demo
+        working-directory: demo
+        run: pnpm build
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: demo/dist
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write # npm provenance
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm typecheck
+      - run: pnpm test
+      - run: pnpm build
+      - run: pnpm validate
+      - run: pnpm publish --provenance --access public --no-git-checks
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -9,3 +9,6 @@ dist-debug
 .cache-demo
 demo/.cache
 coverage
+*.tgz
+demo/monaco-declarations/*.d.ts
+test-results

.husky/pre-commit

@@ -0,0 +1 @@
+pnpm exec lint-staged

.pinact.yaml

@@ -0,0 +1,5 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json
+# pinact - https://github.com/suzuki-shunsuke/pinact
+version: 3
+min_age:
+  value: 7

.prettierrc

@@ -0,0 +1,3 @@
+{
+  "singleQuote": true
+}

README.md

@@ -4,25 +4,23 @@
 </p>
 
 [![License](https://img.shields.io/github/license/spotify/NFPlayerJS.svg)](LICENSE)
-[![Spotify FOSS Slack](https://slackin.spotify.com/badge.svg)](https://slackin.spotify.com)
-[![Readme Score](http://readme-score-api.herokuapp.com/score.svg?url=https://github.com/spotify/NFPlayerJS)](http://clayallsopp.github.io/readme-score?url=https://github.com/spotify/NFPlayerJS)
 
 A JavaScript/TypeScript audio engine for the Web and Server capable of multitrack time stretching, pitch shifting, declarative effects, faster than realtime processing, and more!
 
-Developed at Spotify 2017-2018, Discontinued and handed over to new maintainers January 2023 
+Developed at Spotify 2017-2018, Discontinued and handed over to new maintainers January 2023
 
 # Getting Started (Browser) 🚀
 
-1. Install the player: `npm install --save nf-player`
-2. Describe your audio experience using [NFGrapher][nfgrapher] `npm install --save nf-grapher`, or use a prebuilt [JSON Score](./fixtures).
+1. Install the player: `pnpm add nf-player`
+2. Describe your audio experience using [NFGrapher][nfgrapher] (`pnpm add nf-grapher`), or use a prebuilt [JSON Score](./fixtures).
 3. Listen to it!
 
 ```js
 // In a browser, probably webpack-powered...
 import { SmartPlayer, TimeInstant } from 'nf-player';
 import * as ScoreJSON from './your-score.json';
 
-(async function() {
+(async function () {
   // Create player. By default it uses Web Audio to insert audio data into
   // the current audio device.
   const p = new SmartPlayer();
@@ -47,7 +45,7 @@ There are also in-progress [API Docs][api docs].
 A [CLI](./src/cli.ts) also ships with this package!
 
 ```sh
-$ npx nf-player save --duration 120 --input-file ./fixtures/roxanne-30s-preview-shifted-infinite.json --output-file ./roxanne.wav
+$ pnpm dlx nf-player save --duration 120 --input-file ./fixtures/roxanne-30s-preview-shifted-infinite.json --output-file ./roxanne.wav
 ```
 
 The above command will load the Score JSON, download the audio files, and render 120 seconds of audio to a file called `tng.wav`. This should happen in about 5 seconds of realtime, depending on your computer and internet connection.
@@ -117,42 +115,46 @@ See the [Playground][playground]!
 
 # Development 🏗
 
-Clone this repo, then:
+Requires Node ≥20 and [pnpm](https://pnpm.io/).
 
 ```sh
-$ npm install
+$ pnpm install      # installs the package + the demo workspace
+$ pnpm build        # build the library (tsdown → dist/, ESM + CJS + .d.ts)
+$ pnpm test         # vitest
+$ pnpm typecheck    # tsc -b (whole solution)
+$ pnpm lint
 ```
 
-To build the library and start the development environment:
+To run the demo / playground locally:
 
 ```sh
-$ npm start
+$ pnpm --filter ./demo dev
 ```
 
-To build and publish the demo to [gh-pages](playground) manually, run:
+The demo also exposes a cut-down debug entry at `demo/debug.html` (source: `demo/src/debug.ts`) for poking at single Scores or scripts.
 
-```sh
-$ npm run deploy:demo:manual
-```
+# Deployment / Publishing / Release 🚢
 
-Otherwise the demo is actually built and deployed on each push to main.
+### Publishing:
 
-There is also a more cut-down [debug environment](./debug-harness/index.ts) useful for debugging / developing single Scores or scripts:
+1. Bump the version: `pnpm version <major|minor|patch|premajor|preminor|prepatch|prerelease>`
+2. push, then cut a GitHub Release. Publishing occurs via [`release.yml`](./.github/workflows/release.yml).
 
-```sh
-$ npm run debug-harness
-```
+### Demo Deployment:
 
-# Deployment / Publishing / Release 🚢
+- The demo is deployed to GitHub Pages automatically by `pages.yml` on each push to `main`.
 
-### Publishing:
+### CI workflow actions (SHA-pinned):
 
-- `npm version [major|minor|patch]`, then PR.
-- TravisCI will attempt to publish any tagged commit.
+Third-party GitHub Actions in `.github/workflows/*.yml` are pinned to full commit SHAs for safety. To bump them, use [pinact](https://github.com/suzuki-shunsuke/pinact):
 
-### Demo Deployment:
+```sh
+$ brew install suzuki-shunsuke/pinact/pinact
+$ pinact run --update           # resolves each tag to its latest SHA, rewrites in place
+$ pinact run --verify           # verify SHA ↔ comment match + min-age policy
+```
 
-- The demo is deployed automatically on main builds using the TravisCI gh-pages provider.
+Project policy lives in [`.pinact.yaml`](./.pinact.yaml).
 
 # Contributing 💖⌨️
 

demo.tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig.json",
+  "compilerOptions": {
+    "composite": true,
+    "noEmit": true,
+    "tsBuildInfoFile": "./node_modules/.cache/tsbuildinfo/demo.tsbuildinfo",
+    "strict": true,
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "preserve",
+    "customConditions": ["source"],
+    "jsx": "react-jsx",
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["demo/src/**/*"]
+}

debug-harness/index.html → demo/debug.html

@@ -1,14 +1,12 @@
-<!<!DOCTYPE html>
+<!DOCTYPE html>
 <html>
 <head>
   <meta charset="utf-8">
   <meta http-equiv="X-UA-Compatible" content="IE=edge">
   <title>NF Debug Harness</title>
   <meta name="viewport" content="width=device-width, initial-scale=1">
-  <!-- <link rel="stylesheet" type="text/css" media="screen" href="main.css"> -->
-  <script src="index.ts"></script>
 </head>
 <body>
-
+  <script type="module" src="./src/debug.ts"></script>
 </body>
-</html>
+</html>