pnpm - SFW

.ebextensions/runtime-bundle.config

@@ -0,0 +1,5 @@
+container_commands:
+  01_verify_runtime_bundle:
+    command: |
+      test -d node_modules
+      test -f .next/BUILD_ID

.gitattributes

@@ -0,0 +1 @@
+bin/*.cmd text eol=crlf

.github/workflows/build-upload-deploy-prod.yml

@@ -25,21 +25,33 @@
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+
+      - name: Install pinned pnpm
+        uses: pnpm/action-setup@v5
 
       - name: Install Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: "22"
+          cache: "pnpm"
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Install Socket Firewall
+        id: socket_firewall
+        uses: SocketDev/action@2d3f25590c6ed6ba11a9a14c064d962a3a04698f # v1.3.1
+        with:
+          mode: firewall
 
-      - name: Verify registry signatures
-        run: npm audit signatures
+      - name: Assert npm lockfile is absent
+        run: ./bin/6529 guard:no-package-lock
+
+      - name: Install dependencies
+        env:
+          SFW_BIN: ${{ steps.socket_firewall.outputs.firewall-path-binary }}
+        run: ./bin/6529 install:frozen
 
       - name: Lint package.json versions
-        run: npm run lint:package-json
+        run: ./bin/6529 lint:package-json
 
       - name: Build App
         env:
@@ -58,13 +70,16 @@
           ASSETS_FROM_S3: ${{ env.ASSETS_FROM_S3 }}
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-        run: npm run build
+        run: ./bin/6529 build
+
+      - name: Prune to production dependencies
+        run: ./bin/6529 prune:prod
 
       - name: Build Target
         run: |
           mkdir -p target/_next
           cp -r .next/static target/_next/
-          zip -r package.zip . -x '*.git*' 'node_modules/*' 'target/*'
+          zip -yr package.zip . -x '*.git*' 'target/*'
           mv package.zip target/
 
       - name: Configure AWS Credentials

.gitignore

@@ -2,6 +2,8 @@
 
 # dependencies
 /node_modules
+/.pnpm-store
+/.corepack-tmp
 /.pnp
 .pnp.js
 

Procfile

@@ -0,0 +1 @@
+web: node scripts/start-next.cjs

README.md

@@ -52,7 +52,9 @@ again to approve the updated file.
 From the repo root, you should be able to run:
 
 ```bash
+which 6529
 which ghruns
+6529 dev --help
 ghruns
 ```
 
@@ -98,22 +100,63 @@ Are you sure you want to deploy <branch-name> to production?
 
 If you confirm, it triggers the production workflow from `.github/workflows/build-upload-deploy-prod.yml` against your current branch.
 
-PORT: 3000
+Default app port: `3001` unless `PORT` is set.
 
 ### Documentation
 
 User-facing documentation lives in [`docs/README.md`](docs/README.md).
+Developer package-management guidance lives in [`docs/developer/pnpm-and-socket-firewall.md`](docs/developer/pnpm-and-socket-firewall.md).
 
 ### Install
 
+Bootstrap Corepack and Socket Firewall once on your machine:
+
+```bash
+npm install --global sfw
+corepack enable pnpm
+corepack prepare "$(node -p 'require("./package.json").packageManager')" --activate
 ```
-npm i
+
+That command reads the pinned version directly from the `packageManager` field
+in `package.json` so the bootstrap command stays aligned with the repo pin.
+
+Then install project dependencies through the secure path:
+
+```bash
+6529 install
 ```
 
-### Build
+Plain `pnpm install`, `pnpm dev`, and `npm run ...` repo script execution are intentionally blocked. Use the `6529` wrapper only.
+
+If `direnv` is enabled for the repo, you can also use the repo-local wrapper:
+
+```bash
+6529 install
+6529 dev
+6529 build
+6529 approve-builds
+6529 staging
+```
+
+If you want plain `6529 ...` commands to work on a server shell without
+`direnv`, run this once from the repo root:
 
+```bash
+./bin/6529 bootstrap
 ```
-npm run build
+
+Then open a new shell, or source the rc file that matches your shell.
+
+If you want a one-liner for the current shell, use:
+
+```bash
+source <(./bin/6529 bootstrap --print-export)
+```
+
+### Build
+
+```bash
+6529 build
 ```
 
 ### Environment
@@ -134,7 +177,7 @@ gateway usage:
 
 To test end-to-end:
 
-1. Run `npm run dev`.
+1. Run `6529 dev`.
 2. Paste any pepe.wtf link in chat, for example `https://pepe.wtf/asset/GOXPEPE`
    or `https://pepe.wtf/artists/Easy-B`, and confirm the preview renders with
    imagery and stats.
@@ -145,20 +188,40 @@ To test end-to-end:
 
 - Locally
 
+```bash
+6529 dev
 ```
-npm run dev
+
+- Staging update / rebuild
+
+```bash
+./bin/6529 staging
 ```
 
-- Production
+- One-time server bootstrap for plain `6529 ...`
 
+```bash
+./bin/6529 bootstrap
 ```
-npm run start
+
+Then open a new shell, or source the rc file that matches your shell.
+
+- After `direnv allow`, the shorthand also works
+
+```bash
+6529 staging
 ```
 
-### RUN USING PM2
+- Production
 
+```bash
+6529 start
 ```
-pm2 start npm --name=6529seize -- run start
+
+### RUN USING PM2
+
+```bash
+pm2 start ./bin/6529 --name=6529seize -- start
 ```
 
 ## Directory Structure

bin/6529

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+export COREPACK_HOME="${COREPACK_HOME:-${TMPDIR:-/tmp}/6529-corepack}"
+export COREPACK_ENABLE_DOWNLOAD_PROMPT="0"
+export SEIZE_6529_COMMAND="1"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+command_name="${1:-}"
+
+if [[ -z "$command_name" ]]; then
+  cat <<'EOF'
+Usage:
+  6529 <command> [args...]
+
+Common commands:
+  6529 bootstrap       -> install the global 6529 shim for future shells
+  6529 install         -> pnpm run install:secure
+  6529 i               -> pnpm run install:secure
+  6529 install:frozen  -> pnpm run install:secure:frozen
+  6529 ci              -> pnpm run install:secure:frozen
+  6529 install:prod    -> pnpm run install:secure:prod
+  6529 dev             -> node scripts/dev-with-fallback.cjs
+  6529 build           -> pnpm build
+  6529 approve-builds  -> pnpm approve-builds
+  6529 prune:prod      -> pnpm run prune:prod
+  6529 staging         -> bash repo-rooted scripts/staging.sh
+  6529 start           -> node scripts/start-next.cjs
+  6529 test            -> pnpm test
+  6529 lint            -> pnpm lint
+
+Anything else is forwarded to pnpm unchanged.
+EOF
+  exit 1
+fi
+
+shift
+
+case "$command_name" in
+  bootstrap)
+    exec bash "$REPO_ROOT/scripts/bootstrap-6529-command.sh" "$@"
+    ;;
+  dev)
+    exec node scripts/dev-with-fallback.cjs "$@"
+    ;;
+  dev:webpack)
+    exec env USE_TURBO=false node scripts/dev-with-fallback.cjs "$@"
+    ;;
+  dev:open)
+    exec node scripts/dev-open.cjs "$@"
+    ;;
+  staging)
+    exec bash "$REPO_ROOT/scripts/staging.sh" "$@"
+    ;;
+  start)
+    exec node scripts/start-next.cjs "$@"
+    ;;
+esac
+
+clean_path=""
+IFS=':' read -r -a path_parts <<< "${PATH:-}"
+for part in "${path_parts[@]}"; do
+  if [[ -z "$part" || "$part" == "$SCRIPT_DIR" ]]; then
+    continue
+  fi
+  if [[ -z "$clean_path" ]]; then
+    clean_path="$part"
+  else
+    clean_path="${clean_path}:$part"
+  fi
+done
+
+REAL_PNPM="$(PATH="$clean_path" command -v pnpm || true)"
+
+if [[ -z "$REAL_PNPM" ]]; then
+  echo "pnpm is not available. Activate the repo-pinned pnpm with Corepack first." >&2
+  exit 1
+fi
+
+case "$command_name" in
+  i)
+    exec "$REAL_PNPM" run install:secure "$@"
+    ;;
+  install)
+    exec "$REAL_PNPM" run install:secure "$@"
+    ;;
+  ci)
+    exec "$REAL_PNPM" run install:secure:frozen "$@"
+    ;;
+  install:frozen)
+    exec "$REAL_PNPM" run install:secure:frozen "$@"
+    ;;
+  install:prod)
+    exec "$REAL_PNPM" run install:secure:prod "$@"
+    ;;
+  prune:prod)
+    exec "$REAL_PNPM" run prune:prod "$@"
+    ;;
+  run)
+    exec "$REAL_PNPM" run "$@"
+    ;;
+  exec)
+    exec "$REAL_PNPM" exec "$@"
+    ;;
+  *)
+    exec "$REAL_PNPM" "$command_name" "$@"
+    ;;
+esac

bin/6529.cmd

@@ -0,0 +1,4 @@
+@echo off
+setlocal
+cd /d "%~dp0.."
+bash "%~dp06529" %*

bin/npm

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "Direct npm usage is blocked in this repository." >&2
+echo "Use the \`6529\` wrapper instead." >&2
+echo "Examples:" >&2
+echo "  6529 install" >&2
+echo "  6529 dev" >&2
+echo "  6529 build" >&2
+exit 1

bin/npx

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "Direct npx usage is blocked in this repository." >&2
+echo "Use the \`6529\` wrapper instead." >&2
+exit 1