build: move world to pnpm, and declare the five dependencies it was borrowing

npm hoists every transitive package into a flat node_modules, so code can import
things the manifest never asked for and nothing complains. This app was importing
five of them. pnpm links only what is declared, which is how they surfaced:

  @deck.gl/mesh-layers, @luma.gl/engine, @luma.gl/shadertools  — used directly,
  reached only because @deck.gl/geo-layers pulls them in
  @types/geojson        — the types country-geometry.ts annotates against
  workbox-window        — what vite-plugin-pwa's virtual pwa-register imports

They are pinned to the versions already resolved, so nothing moves; the manifest
now just says what the code does. Any of them could have vanished under an
unrelated deck.gl or vite-plugin-pwa bump and taken the build with it.

The rest is the usual: pnpm-lock.yaml is the one tracked lockfile,
package-lock.json is gone and other managers' are ignored, corepack takes the
version from `packageManager` in Docker, and CI installs through pnpm/action-setup
(which reads the same field) with --frozen-lockfile. setup-node's cache moved from
'npm' to 'pnpm' — it keys off the lockfile, and the npm one no longer exists.

@vaadin/vaadin-usage-statistics is listed in allowBuilds as false rather than left
out. Its install script reports usage to the vendor, nothing here needs it to have
run, and naming it keeps the decision visible instead of one `pnpm approve-builds`
away from being flipped.

Verified: frozen-lockfile install clean, tsc 0 errors, `pnpm build` and
`pnpm build:react` both compile.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

.github/workflows/build-desktop.yml

@@ -67,11 +67,12 @@ jobs:
         shell: bash
         run: echo "JOB_START_EPOCH=$(date +%s)" >> "$GITHUB_ENV"
 
+      - uses: pnpm/action-setup@v4
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '22'
-          cache: 'npm'
+          cache: 'pnpm'
 
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
@@ -92,7 +93,7 @@ jobs:
           sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
 
       - name: Install frontend dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Bundle Node.js runtime
         shell: bash

.github/workflows/lint.yml

@@ -11,9 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
-          cache: 'npm'
-      - run: npm ci
-      - run: npm run lint:md
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm lint:md

.gitignore

@@ -38,3 +38,8 @@ data/world.db
 data/world.db-wal
 data/world.db-shm
 /world
+
+# pnpm is the one package manager here — pnpm-lock.yaml is the tracked lockfile.
+package-lock.json
+yarn.lock
+bun.lockb

Dockerfile

@@ -27,18 +27,18 @@
 FROM node:20-bookworm-slim AS web
 WORKDIR /app
 COPY package.json package-lock.json ./
-RUN npm ci
+RUN corepack enable && pnpm install --frozen-lockfile
 COPY . .
 # vite.config.ts: default base '/', default outDir 'dist'. VITE_VARIANT defaults
 # to the full layer set; no build-time secrets are required (the runtime API base
 # is same-origin, resolved in the browser).
 ARG VITE_MAPBOX_TOKEN
 ENV VITE_MAPBOX_TOKEN=$VITE_MAPBOX_TOKEN
-RUN npm run build
+RUN pnpm build
 # The @hanzo/gui (Tamagui) React rewrite, built to /app/dist-react as the opt-in
 # canary surface. Served only to sessions that pass ?react (see cmd/world:
 # canaryHandler); the vanilla dist above stays the default.
-RUN npm run build:react
+RUN pnpm build:react
 
 # ---- go stage: build the static server binary (CGO-free) -----------------
 # go 1.26: go.mod requires >= 1.26.4 (github.com/hanzoai/sqlite drop-in). The

package.json

@@ -3,6 +3,7 @@
   "description": "Hanzo World — real-time global intelligence dashboard.",
   "private": true,
   "version": "2.4.51",
+  "packageManager": "pnpm@11.17.0",
   "type": "module",
   "scripts": {
     "lint:md": "markdownlint-cli2 '**/*.md'",
@@ -23,15 +24,15 @@
     "test:e2e:tech": "VITE_VARIANT=tech playwright test",
     "test:e2e:finance": "VITE_VARIANT=finance playwright test",
     "test:e2e:runtime": "VITE_VARIANT=full playwright test e2e/runtime-fetch.spec.ts",
-    "test:e2e": "npm run test:e2e:runtime && npm run test:e2e:full && npm run test:e2e:tech && npm run test:e2e:finance",
+    "test:e2e": "pnpm test:e2e:runtime && pnpm test:e2e:full && pnpm test:e2e:tech && pnpm test:e2e:finance",
     "test:data": "node --test tests/*.test.mjs",
     "test:sidecar": "node --test src-tauri/sidecar/local-api-server.test.mjs api/_cors.test.mjs api/youtube/embed.test.mjs api/cyber-threats.test.mjs",
     "test:e2e:visual:full": "VITE_VARIANT=full playwright test -g \"matches golden screenshots per layer and zoom\"",
     "test:e2e:visual:tech": "VITE_VARIANT=tech playwright test -g \"matches golden screenshots per layer and zoom\"",
-    "test:e2e:visual": "npm run test:e2e:visual:full && npm run test:e2e:visual:tech",
+    "test:e2e:visual": "pnpm test:e2e:visual:full && pnpm test:e2e:visual:tech",
     "test:e2e:visual:update:full": "VITE_VARIANT=full playwright test -g \"matches golden screenshots per layer and zoom\" --update-snapshots",
     "test:e2e:visual:update:tech": "VITE_VARIANT=tech playwright test -g \"matches golden screenshots per layer and zoom\" --update-snapshots",
-    "test:e2e:visual:update": "npm run test:e2e:visual:update:full && npm run test:e2e:visual:update:tech",
+    "test:e2e:visual:update": "pnpm test:e2e:visual:update:full && pnpm test:e2e:visual:update:tech",
     "desktop:dev": "VITE_DESKTOP_RUNTIME=1 tauri dev",
     "desktop:build:full": "VITE_VARIANT=full VITE_DESKTOP_RUNTIME=1 tauri build",
     "desktop:build:tech": "VITE_VARIANT=tech VITE_DESKTOP_RUNTIME=1 tauri build --config src-tauri/tauri.tech.conf.json",
@@ -53,6 +54,7 @@
     "@playwright/test": "^1.61.1",
     "@tauri-apps/cli": "^2.11.4",
     "@types/d3": "^7.4.3",
+    "@types/geojson": "^7946.0.16",
     "@types/maplibre-gl": "^1.13.2",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
@@ -65,6 +67,7 @@
     "typescript": "^5.9.3",
     "vite": "^6.4.3",
     "vite-plugin-pwa": "^1.3.0",
+    "workbox-window": "^7.4.1",
     "ws": "^8.21.1"
   },
   "dependencies": {
@@ -73,12 +76,15 @@
     "@deck.gl/geo-layers": "^9.3.7",
     "@deck.gl/layers": "^9.3.7",
     "@deck.gl/mapbox": "^9.3.7",
+    "@deck.gl/mesh-layers": "^9.3.7",
     "@hanzo/ai": "^0.2.2",
     "@hanzo/brand": "^1.4.1",
     "@hanzo/event": "^0.3.3",
     "@hanzo/gui": "^7.3.0",
     "@hanzogui/config": "^7.3.0",
     "@hanzogui/shell": "^7.6.1",
+    "@luma.gl/engine": "^9.3.6",
+    "@luma.gl/shadertools": "^9.3.6",
     "@upstash/redis": "^1.38.0",
     "@xenova/transformers": "^2.17.2",
     "d3": "^7.9.0",

pnpm-workspace.yaml

@@ -0,0 +1,30 @@
+# pnpm settings for this app. There is no workspace here — world is one package —
+# but pnpm reads its settings from this file, so this is where they live.
+
+# pnpm does not run a dependency's install scripts unless it is named here, so this
+# list is the full set of packages allowed to execute code at install time.
+#
+# The three that are true ship a native binary or generate code and do not work
+# without doing so: esbuild is the bundler the build invokes, sharp is an image
+# codec, protobufjs generates its runtime.
+#
+# @vaadin/vaadin-usage-statistics is false deliberately. Its install script exists to
+# report usage back to the vendor; nothing in this app needs it to have run, and a
+# build machine reaching out to a third party is not something to enable by default.
+# It is listed rather than omitted so the decision is visible and does not get
+# silently flipped by the next person who runs `pnpm approve-builds`.
+allowBuilds:
+  '@vaadin/vaadin-usage-statistics': false
+  esbuild: true
+  protobufjs: true
+  sharp: true
+
+# pnpm refuses packages published in the last few days, so a compromised release has
+# to survive a cooling-off period before it can reach a build. Keep that for the
+# registry at large; exclude our own scopes, which we publish and consume the same
+# hour. Excluding by SCOPE rather than by version matters: pnpm rewrites a
+# per-version entry on every bump, and a file that rewrites itself during install
+# makes --frozen-lockfile fail in CI.
+minimumReleaseAgeExclude:
+  - '@hanzo/*'
+  - '@hanzogui/*'