Standardize the fleet on pnpm (one package manager, one lockfile, pnpm CI everywhere)

[rep0x]

🎯 Goal

Standardize every Node repo in the MIND-Studio org on pnpm — one package manager, one lockfile format, one CI install path. Today the fleet is split (mostly npm, a few pnpm, one repo with no committed lockfile at all), which causes drift, mismatched lockfiles, and per-repo special-casing during cross-fleet work (e.g. the recent @mind-studio/ui 0.7.0 rollout, where two PRs shipped the wrong lockfile type).

📊 Current state (survey 2026-06-21)

Repo	Pkg mgr	CI	Action
ui	pnpm	✅	⭐ reference — already standard
compass	pnpm	❌ no ci.yml	keep pnpm · ➕ add CI
mind-maps	pnpm	❌ no ci.yml	keep pnpm · ➕ add CI
product	pnpm	❌ no ci.yml	keep pnpm · ➕ add CI
builder	npm	✅	🔁 convert → pnpm
calendar	npm	✅	🔁 convert → pnpm
chat	npm	✅	🔁 convert → pnpm
codespaces	npm	✅	🔁 convert → pnpm
contacts	npm	✅	🔁 convert → pnpm
dock	npm	✅	🔁 convert → pnpm
drive	npm	✅	🔁 convert → pnpm
landing	npm	✅	🔁 convert → pnpm
mind-cli	npm	✅	🔁 convert → pnpm
notes	npm	✅	🔁 convert → pnpm
photos	npm	✅	🔁 convert → pnpm
projects	npm	✅	🔁 convert → pnpm
shell	npm	✅	🔁 convert → pnpm
slides	npm	✅	🔁 convert → pnpm
videos	npm	✅	🔁 convert → pnpm
whiteboard	npm	✅	🔁 convert → pnpm
core	⚠️ none	✅	🔁 adopt pnpm (no lockfile committed today)

Totals: 4 already pnpm · 16 npm to convert · 1 (core) with no committed lockfile · 3 pnpm repos missing CI.

🔧 Per-repo conversion recipe

Use ui as the reference for .npmrc, packageManager pin, and CI shape.

1. Generate the pnpm lockfile from the existing npm one (preserves resolved versions): pnpm import → then pnpm install to materialize. For core (no lockfile), just pnpm install.
2. Remove npm lockfile: git rm package-lock.json.
3. Pin the toolchain: add "packageManager": "pnpm@<version>" to package.json (match ui's pinned version) so Corepack uses one pnpm everywhere. (No repo sets this today.)
4. Keep .npmrc pointing @mind-studio at GitHub Packages — unchanged; pnpm reads the same ${NODE_AUTH_TOKEN}.
5. Update CI (.github/workflows/*.yml): add pnpm/action-setup (or corepack enable), set actions/setup-node cache: pnpm, and swap commands:
   • npm ci → pnpm install --frozen-lockfile
   • npm run <x> → pnpm <x> · npx <x> → pnpm dlx <x> (or pnpm exec)
   • keep the NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN || secrets.GITHUB_TOKEN }} env on install/build steps.
6. Sweep other npm call sites: Dockerfiles, release.yml/release-please.yml, husky hooks (lint-staged), README/CONTRIBUTING, and any scripts/* that shell out to npm/npx.
7. Verify: pnpm install --frozen-lockfile && pnpm typecheck && pnpm build (and pnpm test where present) green.
8. Conventional Commit per repo, e.g. build: standardize on pnpm (no JIRA id).

➕ Add CI to the pnpm repos that lack it

compass, mind-maps, product have no ci.yml. Add the standard pnpm CI (lint + typecheck + test + build) as part of this effort so "pnpm everywhere" also means "verified everywhere."

🏛️ Make it the org standard

Update the org standards in MIND-Studio/.github to mandate pnpm (pinned via packageManager + Corepack) for all Node repos, so new repos start compliant and reviews can enforce it.

⚠️ Sequencing note — coordinate with the ui 0.7.0 rollout

The @mind-studio/ui 0.7.0 brand refresh (ui#29) currently has open PRs touching package.json + lockfiles in 15 repos. To avoid churn/conflicts, convert each repo to pnpm AFTER its brand-refresh bump PR merges (or fold the conversion into that PR where it's still open). Do not run both passes on the same repo simultaneously.

✅ Acceptance criteria

• Every Node repo listed above uses pnpm: a committed pnpm-lock.yaml, no package-lock.json/yarn.lock, and a packageManager: pnpm@<v> pin.
• All CI/release workflows install with pnpm install --frozen-lockfile and run pnpm-prefixed scripts; NODE_AUTH_TOKEN still wired for GitHub Packages.
• No remaining npm/npx invocations in Dockerfiles, scripts, hooks, or docs.
• compass, mind-maps, product have a working CI workflow.
• MIND-Studio/.github standards updated to require pnpm.
• Each repo green on pnpm install --frozen-lockfile && pnpm build (+ typecheck/test where present).

🔗 Related

• Fleet rollout: adopt @mind-studio/ui brand refresh (weave logo + per-app wordmark + typography + ./brand) across all consumers ui#29 — the brand-refresh fleet rollout that surfaced the lockfile drift (chat/calendar shipped wrong lockfile types).