chore: migrate npm to pnpm across CI, Docker, and scripts

.changeset/bright-clocks-jam.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Migrate project tooling from npm to pnpm across CI workflows, Docker setup, hooks, and contributor commands.

.github/workflows/changesets.yml

@@ -21,19 +21,23 @@ jobs:
         with:
           fetch-depth: 0
 
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
+
       - uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc
-          cache: npm
+          cache: pnpm
 
       - name: Install package dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Create Release Pull Request or Publish
         uses: changesets/action@v1
         with:
-          version: npm run changeset:version
-          publish: npm run changeset:tag
+          version: pnpm run changeset:version
+          publish: pnpm run changeset:tag
           createGithubReleases: true
           title: "chore(release): version packages"
         env:

.github/workflows/checks.yml

@@ -20,12 +20,15 @@ jobs:
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
       - uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc
-          cache: npm
+          cache: pnpm
       - name: Install package dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Run commitlint
         uses: wagoid/commitlint-github-action@v5
   lint:
@@ -34,30 +37,36 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
       - uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc
-          cache: npm
+          cache: pnpm
       - name: Install package dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Run Biome
-        run: npm run lint
+        run: pnpm run lint
       - name: Run Knip
-        run: npm run knip
+        run: pnpm run knip
   build-check:
     name: Build check
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
       - uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc
-          cache: npm
+          cache: pnpm
       - name: Install package dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Run build check
-        run: npm run build:check
+        run: pnpm run build:check
   test-units-and-cover:
     name: Unit Tests And Coverage
     runs-on: ubuntu-latest
@@ -68,16 +77,19 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
       - uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc
-          cache: npm
+          cache: pnpm
       - name: Install package dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Run unit tests
-        run: npm run test:unit
+        run: pnpm run test:unit
       - name: Run coverage for unit tests
-        run: npm run cover:unit
+        run: pnpm run cover:unit
         if: ${{ always() }}
       - uses: actions/upload-artifact@v4
         name: Upload coverage report for unit tests
@@ -103,11 +115,14 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
       - uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc
       - name: Run integration tests
-        run: npm run docker:test:integration
+        run: pnpm run docker:test:integration
       - name: Generate Cucumber report annotations
         uses: deblockt/cucumber-report-annotations-action@v1.7
         if: ${{ always() }}
@@ -116,7 +131,7 @@ jobs:
           access-token: ${{ secrets.GITHUB_TOKEN }}
           path: .test-reports/integration/report.json
       - name: Run coverage for integration tests
-        run: npm run docker:cover:integration
+        run: pnpm run docker:cover:integration
       - name: Coveralls
         uses: coverallsapp/github-action@master
         if: ${{ always() }}
@@ -151,11 +166,14 @@ jobs:
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
       - uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc
-          cache: npm
+          cache: pnpm
       - name: Install package dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Check for changeset
-        run: npx changeset status --since origin/${{ github.base_ref }}
+        run: pnpm exec changeset status --since origin/${{ github.base_ref }}

.gitignore

@@ -13,12 +13,15 @@ npm-debug.log*
 
 # Dependency directories
 node_modules/
+package-lock.json
 
 # TypeScript cache
 *.tsbuildinfo
 
-# Optional npm cache directory
+# Optional package manager cache directories
 .npm
+.pnpm-store
+pnpm-debug.log*
 
 # Caches
 .eslintcache

.husky/commit-msg

@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
-npx --no -- commitlint --edit ${1}
+pnpm exec commitlint --edit "${1}"

.husky/pre-commit

@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
-npm run lint
-npm run build:check
-npm run test:unit
+pnpm run lint
+pnpm run build:check
+pnpm run test:unit

CONFIGURATION.md

@@ -94,16 +94,16 @@ The schema ships with a small, query-driven set of indexes. The most important o
 Run the read-only benchmark against your own database to confirm the planner is using the expected indexes and to record baseline latencies:
 
 ```sh
-npm run db:benchmark
-npm run db:benchmark -- --runs 5 --kind 1 --limit 500
+pnpm run db:benchmark
+pnpm run db:benchmark --runs 5 --kind 1 --limit 500
 ```
 
 The `db:benchmark` script loads the local `.env` file automatically (via `node --env-file-if-exists=.env`), using the same `DB_HOST`/`DB_PORT`/`DB_USER`/`DB_PASSWORD`/`DB_NAME` variables as the relay. The benchmark issues only `EXPLAIN (ANALYZE, BUFFERS)` and `SELECT` statements — it never writes. Flags: `--runs <n>` (default 3), `--kind <n>` (default 1 / `TEXT_NOTE`; pass `0` for SET_METADATA), `--limit <n>` (default 500), `--horizon-days <n>` (default 7), `--help`.
 
 For a full before/after proof of the index impact (seeds a throwaway dataset, drops and recreates the indexes, and prints a BEFORE/AFTER table), use:
 
 ```sh
-npm run db:verify-index-impact
+pnpm run db:verify-index-impact
 ```
 
 The hot-path index migration (`20260420_120000_add_hot_path_indexes.js`) uses `CREATE INDEX CONCURRENTLY`, so it can be applied to a running relay without taking `ACCESS EXCLUSIVE` locks on the `events` or `invoices` tables.

CONTRIBUTING.md

@@ -11,10 +11,10 @@ Please keep the conversations civil, respectful and focus on the topic being dis
 Run dead code and dependency analysis before opening a pull request:
 
 ```
-npm run knip
+pnpm run knip
 ```
 
-`npm run lint` now runs Biome.
+`pnpm run lint` now runs Biome.
 
 ## Pull Request Process
 
@@ -35,7 +35,7 @@ Every pull request that changes behavior, adds a feature, or fixes a bug **must
 To add a changeset:
 
 ```bash
-npx changeset
+pnpm exec changeset
 ```
 
 This interactive prompt will ask you to:
@@ -49,7 +49,7 @@ The command creates a file in `.changeset/` — commit it with your PR.
 If your PR only updates documentation and should not affect versioning, add an empty changeset:
 
 ```bash
-npx changeset --empty
+pnpm exec changeset --empty
 ```
 
 Commit the generated `.changeset/*.md` file with your PR. This satisfies CI without producing a version bump or changelog entry.
@@ -66,6 +66,6 @@ Commit the generated `.changeset/*.md` file with your PR. This satisfies CI with
 Run Biome checks before opening a pull request:
 
 ```
-npm run lint
-npm run format:check
+pnpm run lint
+pnpm run format:check
 ```

Dockerfile

@@ -2,13 +2,13 @@ FROM node:24-alpine AS build
 
 WORKDIR /build
 
-COPY ["package.json", "package-lock.json", "./"]
+COPY ["package.json", "pnpm-lock.yaml", "./"]
 
-RUN npm install --quiet
+RUN corepack enable && pnpm install --frozen-lockfile --silent
 
 COPY . .
 
-RUN npm run build
+RUN pnpm run build
 
 FROM node:24-alpine
 
@@ -24,8 +24,9 @@ RUN apk add --no-cache --update git
 ADD resources /app/resources
 
 COPY --from=build /build/dist .
+COPY --from=build /build/package.json /build/pnpm-lock.yaml ./
 
-RUN npm install --omit=dev --quiet
+RUN corepack enable && pnpm install --prod --frozen-lockfile --silent
 
 USER node:node
 

Dockerfile.railwayapp

@@ -17,15 +17,15 @@ ENV DB_NAME=$PGDATABASE
 ENV DB_USER=$PGUSER
 ENV DB_PASSWORD=$PGPASSWORD
 
-COPY ["package.json", "package-lock.json","knexfile.js","./"]
+COPY ["package.json", "pnpm-lock.yaml","knexfile.js","./"]
 
 ADD migrations /build/migrations
 
-RUN npm install -g knex@2.4.0 && npm install --quiet
+RUN corepack enable && pnpm install --frozen-lockfile --silent
 
 COPY . .
 
-RUN npm run build
+RUN pnpm run build
 
 FROM node:24-alpine
 
@@ -74,17 +74,17 @@ WORKDIR /app
 
 # Copy runtime artifacts and configuration
 COPY --from=build /build/dist .
-COPY --from=build /build/package.json /build/package-lock.json ./
+COPY --from=build /build/package.json /build/pnpm-lock.yaml ./
 COPY --from=build /build/knexfile.js ./
 COPY --from=build /build/migrations ./migrations
 COPY --from=build /build/seeds ./seeds
 
-RUN npm install --omit=dev --quiet && npm install -g knex@2.4.0
+RUN corepack enable && pnpm install --prod --frozen-lockfile --silent
 
 USER 1000:1000
 
 RUN mkdir -p $NOSTR_CONFIG_DIR
 
 ENTRYPOINT ["dumb-init", "--"]
 
-CMD ["sh", "-c", "npm run db:migrate && node src/index.js"]
+CMD ["sh", "-c", "pnpm run db:migrate && node src/index.js"]

Dockerfile.test

@@ -2,8 +2,8 @@ FROM node:24-alpine
 
 WORKDIR /code
 
-COPY ["package.json", "package-lock.json", "./"]
+COPY ["package.json", "pnpm-lock.yaml", "./"]
 
-RUN npm install --quiet
+RUN corepack enable && pnpm install --frozen-lockfile --silent
 
 CMD ["true"]