feat: add native ESM builds

.github/workflows/codechecks.yml

@@ -11,4 +11,5 @@ jobs:
         with:
           node-version: 20
       - run: npm ci
-      - run: npx nx run-many -t test lint
+      - run: npm test
+      - run: npm run lint

.gitignore

@@ -4,7 +4,3 @@ dist
 node_modules
 npm-debug.log
 tsconfig.tsbuildinfo
-
-
-.nx/cache
-.nx/workspace-data

README.md

@@ -16,3 +16,52 @@ Zero-dependency library for generating CSP policies. It can be used for both HTT
 [![NPM downloads](https://img.shields.io/npm/dm/express-csp-header.svg?style=flat)](https://www.npmjs.com/package/express-csp-header)
 
 This is a `csp-header` wrapped in a middleware with auto-tld support and nonce generation. It's ready to use in your Express application.
+
+## Releasing
+
+Both packages are released together and must have the same version. Run the release from a clean `master` branch and make sure `npm whoami` returns an account that can publish both packages.
+
+The examples below use `6.4.0` as the new version. Replace it with the actual version being released.
+
+1. Update both package versions and the internal dependency:
+
+   ```bash
+   npm --no-git-tag-version version 6.4.0 --workspaces
+   npm pkg set 'dependencies.csp-header=^6.4.0' --workspace express-csp-header
+   npm install --package-lock-only
+   ```
+
+2. Add the release notes to `CHANGELOG.md`, then build and verify everything:
+
+   ```bash
+   npm run clean
+   npm test
+   npm run lint
+   npm pack --dry-run --workspace csp-header
+   npm pack --dry-run --workspace express-csp-header
+   ```
+
+3. Commit the release and create its tag:
+
+   ```bash
+   git add CHANGELOG.md package.json package-lock.json packages/*/package.json
+   git commit -m "chore(release): publish 6.4.0"
+   git tag v6.4.0
+   ```
+
+4. Publish the core package first, followed by the Express middleware:
+
+   ```bash
+   npm publish --workspace csp-header --access public
+   npm publish --workspace express-csp-header --access public
+   ```
+
+   npm will prompt for a one-time password when the publishing account requires two-factor authentication.
+
+5. Push the release commit and tag:
+
+   ```bash
+   git push origin master --follow-tags
+   ```
+
+Published package versions cannot be reused. Always check the dry-run output before publishing.