chore: switch package managers to pnpm

.changeset/test-calver-comparison.sh

@@ -283,15 +283,15 @@ cp package.json package.json.backup
 
 # Replace the version script to use raw changeset instead of CalVer script
 if command -v perl >/dev/null 2>&1; then
-    perl -i -pe 's/"version": "npm run version:changeset && node \.changeset\/enforce-calver-ci\.js && npm run version:post && npm run format"/"version": "changeset version"/' package.json
+    perl -i -pe 's/"version": "pnpm run version:changeset && node \.changeset\/enforce-calver-ci\.js && pnpm run version:post && pnpm run format"/"version": "changeset version"/' package.json
 else
     # Use portable sed syntax that works on both macOS and Linux
     if sed --version 2>/dev/null | grep -q GNU; then
         # GNU sed (Linux)
-        sed -i 's/"version": "npm run version:changeset && node \.changeset\/enforce-calver-ci\.js && npm run version:post && npm run format"/"version": "changeset version"/' package.json
+        sed -i 's/"version": "pnpm run version:changeset && node \.changeset\/enforce-calver-ci\.js && pnpm run version:post && pnpm run format"/"version": "changeset version"/' package.json
     else
         # BSD sed (macOS)
-        sed -i.tmp 's/"version": "npm run version:changeset && node \.changeset\/enforce-calver-ci\.js && npm run version:post && npm run format"/"version": "changeset version"/' package.json
+        sed -i.tmp 's/"version": "pnpm run version:changeset && node \.changeset\/enforce-calver-ci\.js && pnpm run version:post && pnpm run format"/"version": "changeset version"/' package.json
         rm -f package.json.tmp 2>/dev/null || true
     fi
 fi
@@ -312,7 +312,7 @@ else
 fi
 
 # Run standard changeset (now using raw changeset without CalVer)
-npm run version > /dev/null 2>&1 || true
+pnpm run version > /dev/null 2>&1 || true
 
 # Restore original package.json
 mv package.json.backup package.json

.claude/settings.local.json

@@ -3,10 +3,10 @@
     "allow": [
       "WebFetch(domain:github.com)",
       "Bash(gh run view:*)",
-      "Bash(npm test:*)",
+      "Bash(pnpm test:*)",
       "Bash(gh pr view:*)",
-      "Bash(npm run ci:checks:*)",
-      "Bash(npm run cookbook:*)",
+      "Bash(pnpm run ci:checks:*)",
+      "Bash(pnpm run cookbook:*)",
       "WebFetch(domain:gist.githubusercontent.com)"
     ]
   },

.cursor/worktrees.json

@@ -1,3 +1,3 @@
 {
-  "setup-worktree": ["npm ci"]
+  "setup-worktree": ["pnpm install --frozen-lockfile"]
 }

.github/workflows/changesets-reminder.yml

@@ -16,5 +16,5 @@ jobs:
           changelogRegex: "\\.changeset"
           message: |
             We detected some changes in `packages/*/package.json` or `packages/*/src`, and there are no updates in the `.changeset`.
-            If the changes are user-facing and should cause a version bump, run `npm run changeset add` to track your changes and include them in the next release CHANGELOG.
+            If the changes are user-facing and should cause a version bump, run `pnpm run changeset add` to track your changes and include them in the next release CHANGELOG.
             If you are making simple updates to examples or documentation, you do not need to add a changeset.

.github/workflows/ci.yml

@@ -76,20 +76,24 @@ jobs:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: 📦 Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          run_install: false
+
       - name: ⎔ Setup node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: 'pnpm-lock.yaml'
 
       - name: 📥 Install dependencies
         run: |
-          npm ci
-          npm rebuild
+          pnpm install --frozen-lockfile
 
       - name: 🔬 Lint
-        run: npm run lint
+        run: pnpm run lint
 
   format:
     name: ⬣ Prettier
@@ -102,20 +106,24 @@ jobs:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: 📦 Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          run_install: false
+
       - name: ⎔ Setup node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: 'pnpm-lock.yaml'
 
       - name: 📥 Install dependencies
         run: |
-          npm ci
-          npm rebuild
+          pnpm install --frozen-lockfile
 
       - name: 🔬 Check Formatting
-        run: npm run format:check
+        run: pnpm run format:check
 
   typecheck:
     name: Typescript
@@ -128,17 +136,21 @@ jobs:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: 📦 Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          run_install: false
+
       - name: ⎔ Setup node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: 'pnpm-lock.yaml'
 
       - name: 📥 Install dependencies
         run: |
-          npm ci
-          npm rebuild
+          pnpm install --frozen-lockfile
 
       # Enabling the turbo cache causes deployments to fail intermittently.
       # The build step fails with dependency issues. More investigation needed.
@@ -154,13 +166,13 @@ jobs:
       #       turbo-${{ github.job }}-${{ github.ref_name }}-
 
       - name: 📦 Build packages and templates
-        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false npm run build:all
+        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false pnpm run build:all
 
       - name: ✅ Typecheck
-        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false npm run typecheck
+        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false pnpm run typecheck
 
       - name: 🧑‍💻 CLI manifest check
-        run: 'test -z "$(git status --porcelain "packages/cli/oclif.manifest.json" )" || { echo -e "Run npm generate:manifest in packages/cli before pushing new commands or flags. Diff here:\n\n$(git diff)" ; exit 1; }'
+        run: 'test -z "$(git status --porcelain "packages/cli/oclif.manifest.json" )" || { echo -e "Run pnpm --dir packages/cli run generate:manifest before pushing new commands or flags. Diff here:\n\n$(git diff)" ; exit 1; }'
 
   test_e2e:
     name: ⬣ E2E tests
@@ -173,23 +185,27 @@ jobs:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: 📦 Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          run_install: false
+
       - name: ⎔ Setup node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: 'pnpm-lock.yaml'
 
       - name: 📥 Install dependencies
         run: |
-          npm ci
-          npm rebuild
+          pnpm install --frozen-lockfile
 
       - name: 📦 Build packages and templates
-        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false npm run build:all
+        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false pnpm run build:all
 
       - name: 🎭 Install Playwright Chromium
-        run: npx playwright install chromium --with-deps
+        run: pnpm exec playwright install chromium --with-deps
 
       - name: 🔐 Install ejson
         run: |
@@ -199,7 +215,7 @@ jobs:
           echo "$HOME/go/bin" >> $GITHUB_PATH
 
       - name: 🧪 Run E2E tests
-        run: npx playwright test --workers=1
+        run: pnpm exec playwright test --workers=1
         env:
           EJSON_PRIVATE_KEY: ${{ secrets.EJSON_PRIVATE_KEY }}
 
@@ -222,23 +238,27 @@ jobs:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: 📦 Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          run_install: false
+
       - name: ⎔ Setup node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: 'pnpm-lock.yaml'
 
       - name: 📥 Install dependencies
         run: |
-          npm ci
-          npm rebuild
+          pnpm install --frozen-lockfile
 
       - name: 📦 Build packages and templates
-        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false npm run build:all
+        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false pnpm run build:all
 
       - name: 🔬 Test
-        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false npm run test
+        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false pnpm run test
 
   validate_recipes:
     name: ⬣ Validate Recipes
@@ -251,25 +271,29 @@ jobs:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: 📦 Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          run_install: false
+
       - name: ⎔ Setup node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: 'pnpm-lock.yaml'
 
       - name: 📥 Install dependencies
         run: |
-          npm ci
-          npm rebuild
+          pnpm install --frozen-lockfile
 
       - name: 📦 Build packages
-        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false npm run build:pkg
+        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false pnpm run build:pkg
 
       - name: 📝 Validate schema
         working-directory: cookbook
-        run: npm run cookbook -- schema && git diff --exit-code recipe.schema.json
+        run: pnpm run cookbook -- schema && git diff --exit-code recipe.schema.json
 
       - name: 🧐 Validate Recipes
         working-directory: cookbook
-        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false npm run cookbook -- validate
+        run: SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false pnpm run cookbook -- validate

.github/workflows/cla.yml

@@ -17,7 +17,7 @@ jobs:
       || (github.event.pull_request
         && !github.event.pull_request.merged
         && !contains(github.event.commits.*.message, '[ci] release')
-        && !contains(github.event.commits.*.message, '[ci] Update package-lock.json')
+        && !contains(github.event.commits.*.message, '[ci] Update pnpm-lock.yaml')
       )
     steps:
       - uses: Shopify/shopify-cla-action@v1

.github/workflows/deploy-examples.yml

@@ -2,7 +2,7 @@
 #! oxygen_storefront_id: 1000014888
 
 name: Deploy Recipe Examples
-on: 
+on:
   push:
     branches: [main]
   pull_request:
@@ -26,76 +26,80 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        recipes:
-          [
+        recipes: [
             {name: 'metaobjects', token: '1000014928'},
-            {name: 'third-party-api', token: '1000014929'},  # Replaces third-party-queries-caching
+            {name: 'third-party-api', token: '1000014929'}, # Replaces third-party-queries-caching
             {name: 'custom-cart-method', token: '1000014930'},
             {name: 'legacy-customer-account-flow', token: '1000022490'},
           ]
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: 📦 Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          run_install: false
+
       - name: ⎔ Setup node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: 'pnpm-lock.yaml'
 
       - name: Cache node modules
-        id: cache-npm
+        id: cache-pnpm
         uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
         env:
           cache-name: cache-node-modules
         with:
-          path: ~/.npm
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-name }}-
             ${{ runner.os }}-build-
             ${{ runner.os }}-
-      
+
       - name: 📥 Install dependencies (root)
-        run: npm ci
-      
+        run: pnpm install --frozen-lockfile
+
       - name: 📦 Build packages
         run: |
-          CI=true npm run build:pkg
-      
+          CI=true pnpm run build:pkg
+
       - name: 📥 Install dependencies (cookbook)
         working-directory: cookbook
-        run: npm ci
-      
+        run: pnpm install --frozen-lockfile
+
       - name: 🍳 Apply recipe to skeleton
         working-directory: cookbook
         run: |
           echo "Applying recipe: ${{ matrix.recipes.name }}"
-          npm run cookbook -- apply --recipe ${{ matrix.recipes.name }}
-      
+          pnpm run cookbook -- apply --recipe ${{ matrix.recipes.name }}
+
       - name: 📥 Install dependencies (skeleton with recipe)
         working-directory: templates/skeleton
         run: |
           # Install in the monorepo context to use workspace packages
-          npm install
-      
+          pnpm install --frozen-lockfile
+
       - name: 📝 Generate GraphQL types
         working-directory: templates/skeleton
         run: |
-          npm run codegen
-      
+          pnpm run codegen
+
       - name: 🔨 Build skeleton with recipe
         working-directory: templates/skeleton
         run: |
-          SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false npm run build
-      
+          SHOPIFY_HYDROGEN_FLAG_LOCKFILE_CHECK=false pnpm run build
+
       - name: 🚀 Deploy to Oxygen
         id: deploy
         working-directory: templates/skeleton
         run: |
-          npx shopify hydrogen deploy --force --no-lockfile-check --token=$OXYGEN_DEPLOYMENT_TOKEN_${{ matrix.recipes.token }}
+          pnpm exec shopify hydrogen deploy --force --no-lockfile-check --token=$OXYGEN_DEPLOYMENT_TOKEN_${{ matrix.recipes.token }}
         env:
-          SHOPIFY_HYDROGEN_FLAG_METADATA_DESCRIPTION: "Recipe: ${{ matrix.recipes.name }} - ${{ github.event.head_commit.message }}"
+          SHOPIFY_HYDROGEN_FLAG_METADATA_DESCRIPTION: 'Recipe: ${{ matrix.recipes.name }} - ${{ github.event.head_commit.message }}'
           OXYGEN_DEPLOYMENT_TOKEN_1000014888: ${{ secrets.OXYGEN_DEPLOYMENT_TOKEN_1000014888 }}
           OXYGEN_DEPLOYMENT_TOKEN_1000022490: ${{ secrets.OXYGEN_DEPLOYMENT_TOKEN_1000022490 }}
           OXYGEN_DEPLOYMENT_TOKEN_1000014892: ${{ secrets.OXYGEN_DEPLOYMENT_TOKEN_1000014892 }}