Nixify development

.github/workflows/ci.yml

@@ -15,12 +15,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -43,12 +43,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -67,12 +67,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: 'pnpm'
 
       - name: Install dependencies

.github/workflows/release.yml

@@ -132,18 +132,19 @@ jobs:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: 'pnpm'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Upgrade npm
-        # Trusted publishing (OIDC) requires npm >= 11.5.1, newer than the
-        # version bundled with Node 20. Without this, publish fails with a
+        # Trusted publishing (OIDC) requires npm >= 11.5.1. Node 24 already
+        # bundles a new enough npm, but pinning to latest keeps this working if
+        # the runner's Node ever moves back. Without it, publish fails with a
         # misleading 404 on the PUT to the registry.
         run: npm install -g npm@latest
 

.gitignore

@@ -14,11 +14,10 @@ coverage/
 .env
 .env.local
 .env.*.local
-.envrc
 
-.direnv
-flake.nix
-flake.lock
+# Nix: flake.nix and flake.lock are tracked; direnv setup is per-developer
+.envrc
+.direnv/
 
 # IDE
 .vscode/

README.md

@@ -11,10 +11,12 @@ Monorepo for @parallel-web npm packages.
 
 ## Development
 
-This is a pnpm monorepo. Make sure you have pnpm installed:
+This is a pnpm monorepo requiring Node >= 22.13. The pnpm version is pinned by
+the `packageManager` field in `package.json`, so use corepack rather than a
+globally installed pnpm:
 
 ```bash
-npm install -g pnpm
+corepack enable
 ```
 
 ### Setup
@@ -25,6 +27,18 @@ Install dependencies:
 pnpm install
 ```
 
+#### With Nix (optional)
+
+A flake provides Node and a corepack-backed `pnpm` matching CI:
+
+```bash
+nix develop
+pnpm install
+```
+
+With [direnv](https://direnv.net), `echo "use flake" > .envrc && direnv allow`
+enters the shell automatically. `.envrc` is gitignored, so this stays per-developer.
+
 ### Commands
 
 ```bash

flake.nix

@@ -0,0 +1,55 @@
+{
+  description = "Nix flake for the @parallel-web npm packages monorepo";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = {
+    self,
+    nixpkgs,
+    flake-utils,
+    ...
+  }:
+    flake-utils.lib.eachDefaultSystem (system: let
+      pkgs = import nixpkgs {
+        inherit system;
+      };
+
+      # pnpm comes from corepack rather than nixpkgs, so the version always
+      # matches package.json's "packageManager" field (and therefore CI and the
+      # lockfile) instead of drifting with nixpkgs.
+      pnpm = pkgs.writeShellScriptBin "pnpm" ''
+        exec corepack pnpm "$@"
+      '';
+    in {
+      devShells.default = pkgs.mkShell {
+        # nodejs_24 ships corepack, which is what resolves and runs the exact
+        # pnpm pinned by package.json's "packageManager" field.
+        packages = with pkgs; [
+          nodejs_24
+          pnpm
+          git
+        ];
+
+        env = {
+          # corepack shims must never block on a y/n prompt when they download
+          # the pinned package manager (CI, first shell entry, etc).
+          COREPACK_ENABLE_DOWNLOAD_PROMPT = "0";
+        };
+
+        shellHook = ''
+          echo "parallel-npm-packages dev shell"
+          echo "node:     $(node --version 2>/dev/null)"
+          echo "corepack: $(corepack --version 2>/dev/null)"
+          echo "pnpm:     $(pnpm --version 2>/dev/null)"
+          echo
+          echo "Suggested setup:"
+          echo "  pnpm install"
+          echo "  pnpm build"
+          echo "  pnpm test"
+        '';
+      };
+    });
+}

package.json

@@ -25,8 +25,8 @@
     "vitest": "^1.0.4"
   },
   "engines": {
-    "node": ">=18.0.0",
-    "pnpm": ">=9.0.0"
+    "node": ">=22.13.0",
+    "pnpm": ">=11.0.0"
   },
-  "packageManager": "pnpm@9.15.2"
+  "packageManager": "pnpm@11.21.0"
 }

pnpm-workspace.yaml

@@ -1,2 +1,12 @@
 packages:
   - 'packages/*'
+
+# pnpm >= 11 refuses to install unless every dependency lifecycle script is
+# explicitly allowed or denied. esbuild's postinstall fetches its platform
+# binary; nothing else here needs to run code at install time.
+allowBuilds:
+  '@google/genai': false
+  esbuild: true
+  koffi: false
+  msgpackr-extract: false
+  protobufjs: false