chore: streamline toolchain, packaging and CI

[Maximvdw]

Brings @openhps/core onto the shared OpenHPS toolchain baseline and fixes several packaging defects that were shipping.

Toolchain

TypeScript 5.9, ESLint 9 with a native flat config, typescript-eslint 8, prettier 3, mocha 11, chai 6, c8, typedoc 0.28, @types/node 24, engines.node >=22. npm replaces yarn fleet-wide.

TypeScript 7 and ESLint 10 are deliberately not adopted: typedoc 0.28 peers typescript 5.0-6.0, typescript-eslint 8 peers <6.1, and eslint-plugin-import@2.32 peers eslint <=9.

Packaging defects fixed

• exports.import pointed at dist/esm5, leaving the modern dist/esm output unreachable to every consumer. The esm5 target was pure duplication: its tsconfig used target es6 while the esm one used es2015 — the same TypeScript alias, with the same module: es2020.
• dist/esm had never been loadable by Node as ESM. Three causes, all needing to be fixed together: no type marker (Node read it as CommonJS), TypeScript-emitted directory imports (export * from './graph' → ERR_UNSUPPORTED_DIR_IMPORT), and typedjson deep imports rewritten to a lib/esm path that cannot be loaded from an ES module at all — typedjson declares no "type": "module" and its ESM build uses extensionless internal imports. Its CommonJS build can be loaded, so the specifiers now keep pointing there and only gain the extension Node requires.
• tslib was undeclared despite the tsconfig setting both importHelpers and noEmitHelpers, a combination that always emits import ... from "tslib". It resolved only by hoisting.
• The files array shipped all three internal.* root shims but none of the lite.* ones, so @openhps/core/lite resolved to nothing from a published tarball.
• shelljs was required by scripts/build.three.js but declared nowhere — one dependency-tree change away from breaking npm run build at its very first step. That script is now written on node:fs.
• @types/three was 12 minors behind the three it describes, and build.three.js copies the types over the vendored sources, so the drift was baked into dist/types/three. Aligning them required switching Matrix{3,4}.elements to the fixed-length tuple types and dropping a dead Matrix re-export.
• Circular, unused devDependencies on @openhps/geospatial and @openhps/video put two copies of core — with two reflect-metadata decorator registries — into core's own test tree.
• lodash.clonedeep was loaded with a bare require in a file re-exported through the public barrel, which tsc leaves intact in ESM output: a ReferenceError for any native-ESM consumer. Replaced by an internal deep clone. structuredClone is not a substitute, since the serialization layer clones typedjson metadata holding constructor references and function hooks.

Testing and CI

• Coverage moves from nyc to c8. nyc 18's spawn-wrap breaks down on Node 22: the tests visibly run while the parent process reports 0 passing and 0% (0/1 statements). Real measured figures are 85.8% statements, 85.97% branches, 73.75% functions, and thresholds are set from those rather than the previous 50/50/50/50, which was never enforceable.
• cover:ci now writes a real test-results.xml. reporterEnabled had been sitting at the top level of .mocharc.json where mocha ignores it, so the JUnit file CI consumed had never been produced.
• CI adopts the OpenHPS/workflows reusable workflow: Node 22 and 24 instead of EOL Node 18, every job installs its own dependency tree rather than depending on an actions/cache hit for node_modules, and lint no longer waits on build (it previously ran type-aware rules with src/three absent).
• paper.yml filtered on './docs/paper/**'. GitHub path patterns are repository-root-relative and reject a leading ./, so those triggers had never once fired.

Verified locally

345 tests passing, lint clean (0 errors), publint no errors, all four bundle budgets met, and both require() and import() resolving 172 exports.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FtN6Tx33QW5a6AtCH1zYQh