fix: declare no runtime dependencies so npm install cargo-hauler works on npm 12

.changeset/no-runtime-dependencies.md

@@ -0,0 +1,5 @@
+---
+'cargo-hauler': patch
+---
+
+Declare no runtime `dependencies`: `npm install -g cargo-hauler` fetches one tarball and nothing else. 0.4.7 listed the build-time stack (`@agent-bundle/runtime` as a pkg.pr.new tarball, `bashjsast` as a `github:` ref, `effect`, `react`, `zod`, …) under `dependencies` even though every shipped file bundles what it uses, so npm 12's default `allow-remote=none` / `allow-git=none` refused the install (`EALLOWREMOTE` for the tarball, `EALLOWGIT` for the git ref). The whole stack now lives under `devDependencies`; the emitted packs and `dist/bin` executables are unchanged. (#82)

README.md

@@ -393,7 +393,10 @@ The npm package ships one plugin per host under `artifact/<host>` — the
 Claude Code plugin with its local marketplace, the Codex plugin, and the Cursor
 plugin with its `install.mjs` — plus three executables: `hauler` (the CLI),
 `cargo-hauler` (the routed commands), and `cargo-hauler-install`. Every pack
-also contains an `INSTALL.md` with the exact commands for that host.
+also contains an `INSTALL.md` with the exact commands for that host. The
+package declares no runtime dependencies — every library the packs and
+executables use is bundled into them — so `npm install` fetches this one
+tarball and nothing else.
 
 ### With the bundled installer
 

package.json

@@ -56,31 +56,29 @@
     "release:publish": "pnpm run build && changeset publish",
     "release:version": "changeset version"
   },
-  "dependencies": {
+  "devDependencies": {
     "@agent-bundle/runtime": "https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@42539ff5fbafdff0656317b841a50100ac0fc141",
+    "@changesets/cli": "3.0.1",
     "@effect/atom-react": "4.0.0-rc.112",
     "@effect/platform-node": "4.0.0-rc.112",
-    "@modelcontextprotocol/server": "2.0.0",
-    "bashjsast": "github:woolkingx/bashjsast#131f4b677d1906774fc49cfceab0ccb7b370b2e6",
-    "effect": "4.0.0-rc.112",
-    "proper-lockfile": "^4.1.2",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
-    "scheduler": "^0.27.0",
-    "zod": "4.5.4"
-  },
-  "devDependencies": {
-    "@changesets/cli": "3.0.1",
     "@effect/tsgo": "0.38.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "@rstest/core": "0.11.11",
     "@types/node": "^22.18.0",
     "@types/proper-lockfile": "^4.1.4",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.5",
     "@typescript/native-preview": "^7.0.0-dev.20260707.2",
     "agent-bundle": "https://pkg.pr.new/ScriptedAlchemy/agent-bundle/agent-bundle@42539ff5fbafdff0656317b841a50100ac0fc141",
+    "bashjsast": "github:woolkingx/bashjsast#131f4b677d1906774fc49cfceab0ccb7b370b2e6",
+    "effect": "4.0.0-rc.112",
     "effect-rstest": "https://pkg.pr.new/ScriptedAlchemy/effect-rstest@e5f8d5f",
-    "typescript": "7.0.2"
+    "proper-lockfile": "^4.1.2",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "scheduler": "^0.27.0",
+    "typescript": "7.0.2",
+    "zod": "4.5.4"
   },
   "packageManager": "pnpm@11.23.0"
 }