build(deps): move @emnapi WASM fallbacks to devDependencies for deterministic lockfile across OS

Author: VariableThe

AUDIT_LOG.md

@@ -2,6 +2,16 @@
 
 This log tracks all significant changes, updates, and versions in the PaperCache project.
 
+## 2026-06-27 (Lockfile Sync)
+**Change:** build(deps): move @emnapi WASM fallbacks to devDependencies for deterministic lockfile resolution across OS targets
+
+**Details/Why:**
+When `@emnapi/core` and `@emnapi/runtime` were listed under `optionalDependencies` in `package.json`, running `npm install` on macOS arm64 stripped their resolution metadata from `package-lock.json` (since npm deemed WASM fallback bindings inapplicable to macOS native architecture). However, sub-dependencies like `@rolldown/binding-wasm32-wasi` still referenced them, causing `npm ci` on Linux and Windows runners to crash with `Missing: @emnapi/core@1.11.1 from lock file`. Moved `@emnapi/core` and `@emnapi/runtime` to `devDependencies` to guarantee their resolution entries are preserved in `package-lock.json` across all OS targets.
+
+**Files changed:** `package.json`, `package-lock.json`, `AUDIT_LOG.md`.
+
+---
+
 ## 2026-06-27 (Update)
 **Change:** fix: resolve TypeScript strict build errors in GraphView and setupTests
 

package-lock.json

@@ -52,6 +52,8 @@
     "@codemirror/search": "^6.7.0",
     "@codemirror/state": "^6.6.0",
     "@codemirror/view": "^6.43.0",
+    "@emnapi/core": "^1.11.1",
+    "@emnapi/runtime": "^1.11.1",
     "@eslint/js": "^10.0.1",
     "@lezer/common": "^1.5.2",
     "@lezer/highlight": "^1.2.3",
@@ -80,9 +82,5 @@
     "vite": "^8.0.12",
     "vitest": "^4.1.7",
     "zustand": "^5.0.14"
-  },
-  "optionalDependencies": {
-    "@emnapi/core": "1.11.1",
-    "@emnapi/runtime": "1.11.1"
   }
 }