fix(deps): pin vana-sdk to 4.0.0 until 4.2.0's ESM break is fixed

[volod-vana]

What broke

@opendatalabs/vana-sdk@4.2.0 was published at 2026-09-16T17:59:46Z. Its dist/protocol/jobs-client.js line 35 is:

import { CONTRACTS } from "../config/contracts.config";

No file extension. Node's ESM resolver rejects that, so anything importing the module dies at startup:

ERR_MODULE_NOT_FOUND: Cannot find module .../vana-sdk/dist/config/contracts.config
  imported from .../vana-sdk/dist/protocol/jobs-client.js

The CLI imports it directly, from src/cli/app/read.ts:27. Neither 4.0.0 nor 4.1.0 references contracts.config at all, so this is new in 4.2.0.

Why it reached us

^4.0.0 let both install paths float onto it:

• npm install vana-cli resolves the SDK at install time, so every fresh install is broken today, at any CLI version. Reproduced on a clean tree with 0.23.11.
• scripts/build-sea.mjs:274 builds the binary payload by writing a synthetic package.json carrying the root dependency ranges and running a bare npm install. It never sees pnpm-lock.yaml. So the SEA payload floats too.

That is why the v0.23.11 release passed build and then failed its own post-install self-check (vana status --json). Confirmed by running the published vana-linux-x64.tar.gz under Docker.

Note that pnpm-lock.yaml had it at 4.0.0 the whole time. CI tested one version and shipped another.

The change

One line: ^4.0.0 becomes 4.0.0, the version the lockfile already resolved. That puts the npm tree, the SEA payload and CI on the same build. Revert to a range once the SDK ships a fixed release.

Verified

• pnpm validate: 364 tests, lint and format clean
• simulated the SEA install (npm install --omit=dev --ignore-scripts against the root ranges) and it now resolves 4.0.0, not 4.2.0
• the lockfile diff is genuinely one line; pnpm install rewrites the file in its own style because the committed copy is prettier-formatted by lint-staged, and the hook normalizes it back

Follow-ups, not in this PR

1. The SDK needs fixing upstream. 4.2.0 is unusable for any ESM consumer, not just this CLI.
2. The SEA build should install from a lockfile. Floating dependency resolution means an upstream publish can break a signed release with no change on our side, and it puts unreviewed code into a notarized binary.

[github-actions]

🎉 This PR is included in version 0.23.12 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀