From 77e712fbdb5a46bc7f8e7616cd0925d8ce3c7be9 Mon Sep 17 00:00:00 2001
From: curtis <curtis@monad.com>
Date: Tue, 11 Aug 2026 15:14:24 -0400
Subject: [PATCH] build(embed): pin node 24.19.0 and pnpm 11.20.0 to match ui

The release workflow publishes tokenless via OIDC trusted publishing, but
pnpm 9.15 has no native OIDC support, so its publish delegated to npm and
leaked pnpm's own --no-git-checks flag, aborting publish with EUNKNOWNCONFIG.
pnpm 11.20 does trusted publishing and provenance natively.

Aligns the toolchain with the ui repo: node 24.19.0 / pnpm 11.20.0 via a
shared .tool-versions file. Adds allowBuilds for esbuild (pnpm 11 blocks
dependency lifecycle scripts by default) and drops the manual npm upgrade
step, now redundant since node 24 bundles npm 11.x and pnpm publishes directly.
---
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/release.yml | 7 +------
 .tool-versions                | 2 ++
 package.json                  | 6 +++---
 pnpm-workspace.yaml           | 5 +++++
 5 files changed, 13 insertions(+), 11 deletions(-)
 create mode 100644 .tool-versions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6182646..2d2d03b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version-file: '.tool-versions'
 
       - name: Spectral lint the OpenAPI contract
         run: pnpm dlx @stoplight/spectral-cli@6 lint packages/embed/openapi/embed.openapi.yaml --ruleset packages/embed/openapi/.spectral.yaml
@@ -34,7 +34,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version-file: '.tool-versions'
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ba3521e..919464e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,14 +25,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version-file: '.tool-versions'
           cache: pnpm
 
-      # Trusted publishing + `--provenance` require npm >= 11.5.
-      # setup-node ships npm 10.x, so upgrade explicitly.
-      - name: Upgrade npm
-        run: npm install -g npm@latest
-
       - run: pnpm install --frozen-lockfile
 
       - run: pnpm run build
diff --git a/.tool-versions b/.tool-versions
new file mode 100644
index 0000000..49c192d
--- /dev/null
+++ b/.tool-versions
@@ -0,0 +1,2 @@
+nodejs 24.19.0
+pnpm 11.20.0
diff --git a/package.json b/package.json
index 595033d..8cd3b28 100644
--- a/package.json
+++ b/package.json
@@ -14,10 +14,10 @@
 	"bugs": {
 		"url": "https://github.com/monad-inc/embed/issues"
 	},
-	"packageManager": "pnpm@9.15.0",
+	"packageManager": "pnpm@11.20.0",
 	"engines": {
-		"node": ">=20",
-		"pnpm": ">=9"
+		"node": ">=24.19.0 <25",
+		"pnpm": ">=11"
 	},
 	"scripts": {
 		"build": "pnpm -r run build",
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 18ec407..3dfc6fe 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,2 +1,7 @@
 packages:
   - 'packages/*'
+# pnpm 10+ blocks dependency lifecycle scripts by default; allowBuilds is the
+# pnpm 11 replacement for onlyBuiltDependencies. esbuild (used by tsup) is
+# non-functional without its install script.
+allowBuilds:
+  esbuild: true