chore: migrate from npm to pnpm 11 with 2-day release-age cooldown

.devcontainer/setup.sh

@@ -23,9 +23,13 @@ cargo install cargo-llvm-cov cargo2junit
 echo "📋 Installing Task runner..."
 sudo sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin
 
-# Install npm dependencies
-echo "📦 Installing npm dependencies..."
-npm install
+# Enable Corepack so pnpm (pinned in package.json) is available
+echo "📦 Enabling Corepack for pnpm..."
+corepack enable
+
+# Install dependencies with pnpm
+echo "📦 Installing dependencies with pnpm..."
+pnpm install --frozen-lockfile
 
 # Build all runtimes
 echo "🔨 Building all runtimes..."

.github/dependabot.yml

@@ -12,6 +12,8 @@ updates:
       day: "friday"
       time: "09:00"
       timezone: "America/Los_Angeles"
+    cooldown:
+      default-days: 2
     groups:
       napi:
         patterns:
@@ -26,24 +28,32 @@ updates:
       day: "friday"
       time: "09:00"
       timezone: "America/Los_Angeles"
+    cooldown:
+      default-days: 2
   - package-ecosystem: "github-actions" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
       day: "friday"
       time: "09:00"
       timezone: "America/Los_Angeles"
-  - package-ecosystem: "npm" # See documentation for possible values
+    cooldown:
+      default-days: 2
+  - package-ecosystem: "npm" # Dependabot auto-detects pnpm from pnpm-lock.yaml
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
       day: "friday"
       time: "09:00"
       timezone: "America/Los_Angeles"
+    cooldown:
+      default-days: 2
   - package-ecosystem: "rust-toolchain" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
       day: "friday"
       time: "09:00"
       timezone: "America/Los_Angeles"
+    cooldown:
+      default-days: 2

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ on:
       - "Cargo.toml"
       - "Cargo.lock"
       - "package.json"
-      - "package-lock.json"
+      - "pnpm-lock.yaml"
       - "build.rs"
       - "deno.json"
       - "deno.lock"
@@ -31,7 +31,7 @@ on:
       - "Cargo.toml"
       - "Cargo.lock"
       - "package.json"
-      - "package-lock.json"
+      - "pnpm-lock.yaml"
       - "build.rs"
       - "deno.json"
       - "deno.lock"
@@ -102,15 +102,20 @@ jobs:
       - name: Setup Task runner
         uses: go-task/setup-task@v2
 
+      # Enable Corepack for pnpm (version pinned in package.json packageManager field)
+      - name: Enable Corepack
+        run: corepack enable
+
       # Setup Node.js
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 22
+          cache: pnpm
 
       # Install Node.js dependencies
       - name: Install Node.js dependencies
-        run: npm install
+        run: pnpm install --frozen-lockfile
 
       # Build all runtime libraries (includes compilation)
       - name: Build all runtime libraries

.github/workflows/formatting.yml

@@ -25,14 +25,17 @@ jobs:
       - name: Setup Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
 
+      - name: Enable Corepack
+        run: corepack enable
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 20
-          cache: npm
+          node-version: 22
+          cache: pnpm
 
       - name: Install Node.js dependencies
-        run: npm install
+        run: pnpm install --frozen-lockfile
 
       - name: Setup Task runner
         uses: go-task/setup-task@v2

.github/workflows/linting.yml

@@ -57,14 +57,17 @@ jobs:
         with:
           prefix-key: ${{ runner.os }}-rust
 
+      - name: Enable Corepack
+        run: corepack enable
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 20
-          cache: npm
+          node-version: 22
+          cache: pnpm
 
       - name: Install Node.js dependencies
-        run: npm install
+        run: pnpm install --frozen-lockfile
 
       - name: Setup Task runner
         uses: go-task/setup-task@v2

.github/workflows/release.yml

@@ -43,11 +43,13 @@ jobs:
           echo "man-db man-db/auto-update boolean false" | sudo debconf-set-selections
           sudo rm -f /var/lib/man-db/auto-update
       - uses: actions/checkout@v6
+      - name: Enable Corepack
+        run: corepack enable
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
-          node-version: 20
-          package-manager-cache: false
+          node-version: 22
+          cache: pnpm
       - name: Setup Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -60,7 +62,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libcups2-dev pkg-config clang
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Build N-API module
         run: |
           echo "Building for target: ${{ matrix.settings.target }}"
@@ -140,11 +142,13 @@ jobs:
         with:
           bun-version: latest
           no-cache: true
+      - name: Enable Corepack
+        run: corepack enable
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
-          node-version: 20
-          package-manager-cache: false
+          node-version: 22
+          cache: pnpm
       - name: Setup Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -168,7 +172,7 @@ jobs:
           done
           ls -la npm/ 2>/dev/null || dir npm
       - name: Install Node.js dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Run comprehensive tests (includes compilation)
         run: |
           if [ -n "${{ matrix.settings.test_runtimes }}" ]; then
@@ -196,14 +200,16 @@ jobs:
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Enable Corepack
+        run: corepack enable
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org/
-          package-manager-cache: false
+          cache: pnpm
       - name: Install Node.js dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Download all N-API binary artifacts
         uses: actions/download-artifact@v8
         with:
@@ -222,14 +228,5 @@ jobs:
           ls -la npm/ 2>/dev/null || dir npm
       - name: Compile TypeScript for publishing
         run: task compile
-      - name: Clean npm cache before publish
-        run: npm cache clean --force
       - name: Publish to npm
-        run: npm publish
-      - name: Upload npm logs
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: npm-publish-logs
-          path: ~/.npm/_logs/
-          if-no-files-found: warn
+        run: pnpm publish --no-git-checks

.npmrc

@@ -1 +1,2 @@
 @jsr:registry=https://npm.jsr.io
+minimum-release-age=2880

.prettierignore

@@ -8,6 +8,7 @@ dist/
 node_modules/
 *.lock
 *.log
+pnpm-lock.yaml
 Cargo.toml
 Cargo.lock
 LICENSE

CONTRIBUTING.md

@@ -5,8 +5,11 @@ This document provides technical documentation for contributing to the cross-run
 ## Quick Start
 
 ```bash
+# Enable Corepack so pnpm (pinned in package.json) is available
+corepack enable
+
 # Install dependencies
-npm install
+pnpm install
 
 # Build everything
 task build
@@ -75,7 +78,10 @@ target/                # Rust build artifacts
    go install github.com/go-task/task/v3/cmd/task@latest
    ```
 
-3. **Node.js 20+** - Build scripts and N-API builds
+3. **Node.js 22.13+** - Build scripts and N-API builds. Run `corepack enable`
+   once to activate pnpm 11 (the version is pinned via the `packageManager`
+   field in `package.json`). pnpm 11 itself requires Node 22.13+ (consumers of
+   the published package only need Node 20+, per the `engines` field).
 
 **Optional (for testing specific runtimes):**
 
@@ -259,7 +265,7 @@ If encountering symlink errors on Windows:
 ```bash
 # Clean build
 rm -rf npm/ target/ node_modules/
-npm install
+pnpm install
 task build
 ```
 

Taskfile.yml

@@ -52,7 +52,7 @@ tasks:
 
   test:direct:node:
     desc: Run Node.js tests directly
-    cmd: "{{.SIMULATE}} npx tsx src/tests/node-test-runner.ts"
+    cmd: "{{.SIMULATE}} pnpm exec tsx src/tests/node-test-runner.ts"
 
   test:direct:bun:
     desc: Run Bun tests directly
@@ -68,15 +68,15 @@ tasks:
 
   lint:eslint:
     desc: Lint TypeScript/JavaScript files
-    cmd: npx eslint .
+    cmd: pnpm exec eslint .
 
   lint:rust:
     desc: Lint Rust code with Clippy
     cmd: cargo clippy -- -D warnings
 
   lint:fix:
     desc: Fix linting issues in all code
-    cmd: npx eslint . --fix
+    cmd: pnpm exec eslint . --fix
 
   remove-env-check:
     desc: Remove NAPI_RS_NATIVE_LIBRARY_PATH check from generated N-API files
@@ -86,13 +86,13 @@ tasks:
     desc: Prepare and publish packages
     cmds:
       # Update main package.json with optionalDependencies but don't publish platform packages
-      - npx napi prepublish -t npm --no-gh-release --skip-optional-publish
+      - pnpm exec napi prepublish -t npm --no-gh-release --skip-optional-publish
       # Now publish platform packages with our custom script that preserves ESM files
       - node scripts/publish-platform-packages.js
 
   prepublish:dry:
     desc: Prepare package for publishing (dry run)
-    cmd: npx napi prepublish -t npm --dry-run
+    cmd: pnpm exec napi prepublish -t npm --dry-run
 
   fmt:
     desc: Format all code
@@ -104,11 +104,11 @@ tasks:
 
   fmt:prettier:
     desc: Format TypeScript/JavaScript with Prettier
-    cmd: npx prettier --write .
+    cmd: pnpm exec prettier --write .
 
   fmt:prettier:check:
     desc: Check TypeScript/JavaScript formatting with Prettier
-    cmd: npx prettier --check .
+    cmd: pnpm exec prettier --check .
 
   fmt:rust:
     desc: Format Rust code
@@ -124,7 +124,7 @@ tasks:
 
   check:typescript:
     desc: Type check TypeScript code
-    cmd: npx tsc --noEmit
+    cmd: pnpm exec tsc --noEmit
 
   check:node:
     desc: Type check Node.js code (via build)