Modernize toolchain, CI, and packaging

[botre]

What changed

Dependencies

• TypeScript 5.9.3 to 6.0.3, the last JS-based release. TypeScript 7 (Go-native) ships without the programmatic compiler API that tsup's dts build depends on, so 6.x is the ceiling until the 7.1 API lands and tsup adopts it. The tsconfig gets ignoreDeprecations: "6.0" because tsup injects the deprecated baseUrl option during dts builds.
• vitest and @vitest/coverage-v8 4.1.5 to 4.1.10, prettier 3.8.3 to 3.9.6. tsup was already at the latest 8.5.1.
• Added an overrides entry pinning esbuild to ^0.28.1. tsup pins ^0.27.0, which sits inside the GHSA-g7r4-m6w7-qqqr advisory range. esbuild 0.28 only changed binary download integrity checks, no build API or output format changes. npm audit is now clean (was 1 low, 3 high).

CI

• actions/checkout v6 to v7 and actions/setup-node v6 to v7. checkout v7 blocks fork PR checkout for pull_request_target/workflow_run triggers, which these workflows do not use; setup-node v7 is an internal ESM migration.
• Check workflow now runs a Node 22.x / 24.x matrix and a new npm run typecheck (tsc) step, which was previously not enforced anywhere.

Packaging

• Added an exports map (import to dist/index.mjs with index.d.mts types, require to dist/index.js with index.d.ts types) plus sideEffects: false. The legacy main/module/unpkg/types fields are kept for older tooling.
• Added export default { toJSON }. Before the exports map, Node ESM import resolved to the CJS build where cjs-module-lexer only surfaces a default namespace, so existing import Formson from ... consumers relied on Formson.toJSON. The default export keeps that pattern working now that import resolves to the real ESM build.

Tests

• Six new cases locking in parser edge behavior: top-level bracket index, consecutive dots, trailing dot, dot-only key, whitespace-only keys, and File values under array notation. 30 tests total, all passing.

README

• Added an npm installation section alongside the script tag one.
• Removed non-breaking space characters that had crept into the complex structure example.

Version bumped to 0.2.0 (minor: packaging surface additions). Not published; the release workflow handles that on merge.

Compat verification

Baselined against the published 0.1.2 tarball (npm pack @formspark/formson), then installed 0.1.2 and the freshly packed 0.2.0 into throwaway consumers and ran an identical battery (25 key-shape cases covering nesting, arrays, repeated keys, empty values, boundary indices, prototype pollution keys, unicode, plus File passthrough) through every access pattern:

Pattern	0.1.2	0.2.0
CJS require().toJSON	works	works
CJS require().default.toJSON	absent	works
ESM import { toJSON }	broken (link error)	works
ESM default .toJSON	works	works
IIFE Formson.toJSON	works	works

• Conversion outputs are byte-identical between versions across the whole battery.
• No access pattern that worked in 0.1.2 is lost; two that were previously broken now work.
• Tarball file lists are identical.
• Consumer-side tsc --moduleResolution node16 type resolution verified for both .mts and .cts consumers.

Risks

• The exports map restricts deep imports like @formspark/formson/dist/index.mjs under Node resolution. No known consumers do this; unpkg URL paths are unaffected.
• require() output now carries an extra default key; purely additive but visible to key enumeration.
• TypeScript 7 remains blocked until tsup supports the new compiler API.