Merge phase 1: modern toolchain (still JS)

Replaces webpack + Grunt + Babel with tsdown (dual ESM+CJS+UMD+.d.ts,
generated exports map), Jest with Vitest, ESLint 4 with ESLint 9 flat
config + Prettier scaffold, sets Node 18+ / drops IE11, and stands up
GitHub Actions CI (ci.yml) with a release.yml scaffold, replacing
.travis.yml.

No library behavior changed. Full suite green against wp-env:
805 passed, 16 skipped, 0 failed — identical to the Phase 0 baseline.
See handoff.md for the tricky decisions and workarounds this phase
required.

Author: kadamwhite

.eslintignore

@@ -0,0 +1,86 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+
+jobs:
+  # tsdown/rolldown require Node >=22.18 to run; vitest requires >=20. The
+  # published library itself only requires Node >=18 (see `engines` in
+  # package.json) — that promise is checked separately by `dist-smoke` below,
+  # against the pre-built output, without needing the build tooling to run.
+  test:
+    name: Lint, typecheck, build & unit test (Node ${{ matrix.node-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [ 22, 24, latest ]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run build
+      - run: npm run test:unit
+      - if: matrix.node-version == 'latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist
+          retention-days: 1
+
+  dist-smoke:
+    name: Published dist works on Node ${{ matrix.node-version }}
+    runs-on: ubuntu-latest
+    needs: test
+    strategy:
+      matrix:
+        node-version: [ 18, 20 ]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - run: npm ci --omit=dev
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - run: |
+          node -e "
+            const WPAPI = require('./dist/index.cjs');
+            const wp = new WPAPI({ endpoint: 'http://localhost/wp-json' });
+            if (typeof wp.posts !== 'function') throw new Error('CJS entry did not bootstrap');
+          "
+          node --input-type=module -e "
+            import WPAPI from './dist/index.mjs';
+            const wp = new WPAPI({ endpoint: 'http://localhost/wp-json' });
+            if (typeof wp.posts !== 'function') throw new Error('ESM entry did not bootstrap');
+          "
+
+  integration:
+    name: Integration tests (wp-env)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run env:start
+      - run: npm run env:seed
+      - run: npm run test:integration
+      # `npm run env:logs` defaults to `--watch`, which never exits; pass
+      # `--no-watch` directly so this step prints once and completes.
+      - if: always()
+        run: npx @wordpress/env logs development --no-watch
+      - if: always()
+        run: npm run env:stop

.eslintrc.js

@@ -0,0 +1,30 @@
+name: Release
+
+# Scaffolded in Phase 1, replacing the local `release-npm` script; not yet
+# exercised until publishing resumes (requires an `NPM_TOKEN` secret).
+on:
+  release:
+    types: [ published ]
+
+jobs:
+  publish:
+    name: Build, test & publish to npm
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          # tsdown/rolldown require Node >=22.18 to run the build itself.
+          node-version: 22
+          cache: npm
+          registry-url: https://registry.npmjs.org
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run build
+      - run: npm run test:unit
+      - run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/ci.yml

@@ -45,8 +45,5 @@ documentation/index.html
 *.sublime-*
 .ruby-version
 
-# Built files (for use in browser)
-browser/
-
-# Consuming applications should maintain their own lockfile.
-package-lock.json
+# Built files (tsdown output: ESM/CJS/UMD + .d.ts)
+dist/

.github/workflows/release.yml

@@ -0,0 +1,7 @@
+{
+	"useTabs": true,
+	"singleQuote": true,
+	"semi": true,
+	"trailingComma": "all",
+	"printWidth": 90
+}

.gitignore

@@ -0,0 +1,4 @@
+'use strict';
+
+// Browser build stand-in for `form-data`: use the native global instead.
+module.exports = FormData;