[oddharsh]

Moves the repo from npm to pnpm, renames the root release script deploy → deploy:direct, and replaces npx with pnpm exec.

Why pnpm

npm, pnpm, bun and all three yarn 4 linkers were measured against this tree. All six produced an identical build and passed the full suite, so the decision came down to cost.

	warm install	2nd repo, real disk	config changes
npm 11.19	3.71s	459 MB	none
pnpm 11.20	1.50s	4 MB	three
bun 1.3.14	1.71s	3 MB	none
yarn 4 node-modules	2.24s	629 MB	two + version override
yarn 4 pnpm linker	3.80s	8 MB	same
yarn 4 PnP	0.65s	339 MB	same

The disk column is the one du lies about: it reports 340 MB for pnpm, but APFS clones the store, so a second repo's dependencies genuinely cost 4 MB. Measured by free space. centaur already runs pnpm, so this leaves one package manager rather than two.

Yarn failed rather than lost. The 4.9.1 that Workers Builds ships cannot install this repo: its builtin TypeScript compat patch expects lib/_tsc.js, and TypeScript 7 has no such file. Controls both ways — TS 5.9.3 installs on 4.9.1, TS 7.0.2 installs on 4.18.0. Its PnP linker is the fastest thing measured, and its disk win evaporates here because this dependency set is native-heavy (337 MB of .yarn/unplugged).

Bun is covered by gotcha 28 from #307, which landed mid-flight and supersedes what this branch originally said. My independent measurement agreed with it: bun 1.3.14 (current stable) silently ignores zstdCompressSync's dictionary and build.mjs's existing probe kills the build. #307 established that 1.4 canary fixes it.

Two behaviour changes worth reading

pnpm <script> runs the script. pnpm deploy does not hit pnpm's builtin the way pnpm deploy --help in an empty directory implies — it starts wrangler deploy against production at 100%. Under npm that path required the word run. The root script is deploy:direct now. lens-reader keeps a plain deploy, since it publishes a demo Worker.

minimumReleaseAge: 1440 refuses packages published in the last 24h, including from a committed lockfile. Expect dependabot PRs to fail install until the package ages out or lands in minimumReleaseAgeExclude.

npx → pnpm exec

The reason is the registry rather than tidiness: npx FETCHES what it cannot resolve locally, reaching registry.npmjs.org even under --no-install, while pnpm exec fails locally with no network call. A repo that pins Wrangler exactly and runs check-wrangler to enforce one version should not keep a command that will silently download another. 30 call sites moved.

pnpm dlx is npx's true twin and is the wrong tool here: every call site was npx wrangler, wrangler is a pinned devDependency, and dlx would fetch from the registry and ignore the pin.

Three npx strings deliberately survive — both Workers Builds commands in infra.json and the mirrored copies in wrangler.jsonc and check-infra.mjs. Those record what is typed into the Cloudflare dashboard, and infra:check compares them against the live values, so editing them here alone fails on invented drift. No dashboard edit is required, verified: npx wrangler resolves pnpm's node_modules/.bin and dry-runs clean.

Other fixes CI found

• pnpm install --no-audit --no-fund — pnpm rejects both flags.
• lens-reader needs --ignore-workspace. A bare pnpm install inside it walks UP to the root workspace and never creates lens-reader/node_modules, so its tests die on ERR_MODULE_NOT_FOUND. npm installed the local package.json instead, so this is a behaviour change.
• pnpm passes a literal -- through to scripts where npm strips it. pnpm run photos -- "$dir" would have handed add-photos.sh a -- as its first path. All 41 stray -- removed, proven with a script that echoes argv.
• check-wrangler.mjs now reads the installed tree instead of parsing the npm lockfile. Two assertions dropped because they only checked the lockfile echoed package.json, which --frozen-lockfile already enforces. Verified it still catches all three failure modes.

Verification

validate green. Locally on a clean tree: build, test, cal 59/59, lens-reader 5/5, typecheck, routes:check, pages:check, perf-budget, photos:check, check-wrangler, and infra:check against the live dashboard.

wire size vs merge base is red and expected to be. It checks out the merge base and builds it with this branch's workflow, so a base predating minimumReleaseAgeExclude gets the policy without the list (ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION). It self-resolves once this is on main, and it gates nothing.

Documented in CLAUDE.md gotcha 29.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	aadhar-sh	003e20a	Aug 10 2026, 04:33 PM