chore(repo): migrate from bun to pnpm

.agents/skills/build-jsdoc/SKILL.md

@@ -49,12 +49,13 @@ the canonical tree, and `AGENTS.md` resolves to `CLAUDE.md`.
 
 ## Install and Build
 
-Use the repository-pinned Bun version from `packageManager` (`bun@1.3.12`):
+Use the repository-pinned pnpm version from `packageManager` (`pnpm@11.1.1`), activated through
+corepack:
 
 ```sh
-bun install --frozen-lockfile
-bun run --filter @morpho-org/market-making-bot jsdoc:check
-bun run --filter @morpho-org/market-making-bot jsdoc:build
+pnpm install --frozen-lockfile
+pnpm --filter @morpho-org/market-making-bot run jsdoc:check
+pnpm --filter @morpho-org/market-making-bot run jsdoc:build
 ```
 
 - Coverage command: `jsdoc:check`
@@ -134,13 +135,13 @@ URL, default runtime environment, raw provider response, or generated source-map
    explicit documented return type. Do not disable warnings-as-errors.
 3. If TypeDoc warns about a private implementation alias, keep the alias private and avoid exposing it
    through an inferred public signature; prefer an explicit exported boundary type.
-4. If installation changes unrelated lockfile entries, restore them and reinstall with Bun 1.3.12.
+4. If installation changes unrelated lockfile entries, restore them and reinstall with pnpm 11.1.1.
 5. If generated HTML is staged, unstage and delete it; only source, config, script, dependency, and
    lockfile changes belong in the PR.
 
 ## Verification Checklist
 
-- [ ] Pinned Bun install succeeds with the lockfile frozen.
+- [ ] Pinned pnpm install succeeds with the lockfile frozen.
 - [ ] AST coverage prints the exhaustive public declaration inventory and exits zero.
 - [ ] TypeDoc exits zero with warnings-as-errors enabled.
 - [ ] `bots/market-making/build/jsdoc/index.html` exists and is non-empty.

.claude/commands/babysit-pr.md

@@ -438,10 +438,10 @@ For **CI failures**:
 After all comments are addressed, run validation on affected packages:
 
 ```bash
-bun run --filter <affected-package> typecheck
-bun lint
+pnpm --filter <affected-package> run typecheck
+pnpm lint
 bun test
-bun format
+pnpm format
 ```
 
 Fix any issues found.

.claude/commands/check-dependency-vulnerability.md

@@ -109,17 +109,26 @@ DO NOT just check package.json specifiers. Semver ranges like `^15.0.5` can reso
 compatible version.
 
 Use deterministic package manager commands to find the ACTUAL installed version for EACH package in
-your checklist. This repo uses bun as its package manager — `bun.lock` is the authoritative source
-of installed versions.
+your checklist. This repo uses pnpm as its package manager — `pnpm-lock.yaml` is the authoritative
+source of installed versions.
 
 ```bash
-# bun pm ls — show installed packages and their resolved versions across the workspace
-bun pm ls --all | grep <package-name>
+# pnpm why — show which workspace projects pull a package, and at which resolved version.
+# This is the most direct answer for "is <package> in this repo, and at what version?"
+pnpm why <package-name> -r --depth 0
 
-# Inspect bun.lock directly for the resolved version entries
-grep -A 2 "\"<package-name>@" bun.lock
+# pnpm list — the full resolved tree across every workspace project
+pnpm list -r --depth Infinity | grep <package-name>
+
+# Inspect pnpm-lock.yaml directly. Entries in the `packages:` section are keyed `name@version`,
+# so anchoring on two leading spaces matches the resolved version and not a dependency mention.
+grep -n "^  <package-name>@" pnpm-lock.yaml
 ```
 
+Note that pnpm records peer-dependency variations, so one package can legitimately appear at the
+same version several times with different peer suffixes (for example
+`viem@2.47.17(typescript@6.0.2)(zod@3.25.76)`). Those are the same install, not a version conflict.
+
 If the project also has `node_modules` populated, you can confirm by reading the package's own
 `package.json`:
 
@@ -132,9 +141,10 @@ cat node_modules/<package-name>/package.json | grep '"version"'
 You MUST show the exact command output used to determine the installed version. For example:
 
 ```
-Command: bun pm ls --all | grep next
+Command: pnpm why next -r --depth 0
 Output:
-└── next@15.5.5
+next@15.5.5
+└── @morpho-org/some-bot@0.1.0 (dependencies)
 
 Installed version determined: 15.5.5
 ```
@@ -194,38 +204,37 @@ If `grep` or direct file search was used, you MUST also include:
 - The exact line numbers where vulnerable versions were found
 - The raw line content from those locations
 
-If `bun pm ls`, lockfile inspection, or similar package manager commands were used, you MUST
+If `pnpm why`, `pnpm list`, lockfile inspection, or similar package manager commands were used, you MUST
 provide:
 
 - The exact commands executed (copy-pasteable)
 - A note that the user can run these commands themselves to verify
 
-Example (using `bun pm ls`):
+Example (using `pnpm why`):
 
 ```
 Package: viem
-Command: bun pm ls --all | grep viem
+Command: pnpm why viem -r --depth 0
 Evidence: └── viem@2.20.0
 Version line: 2.20.x
 Safe version for 2.20.x: 2.21.0
 Comparison: 2.20.0 < 2.21.0
 Result: VULNERABLE
 
-To verify, run: bun pm ls --all | grep viem
+To verify, run: pnpm why viem -r --depth 0
 ```
 
-Example (using grep on `bun.lock`):
+Example (using grep on `pnpm-lock.yaml`):
 
 ```
 Package: viem
-Command: grep -n "\"viem@" bun.lock
+Command: grep -n "^  viem@" pnpm-lock.yaml
 Files searched:
-- /path/to/project/bun.lock
+- /path/to/project/pnpm-lock.yaml
 
 Evidence found:
-- bun.lock:1542: "viem@2.20.0":
-- bun.lock:1543:   resolution: ...
-- bun.lock:1544:   version: 2.20.0
+- pnpm-lock.yaml:1547:   viem@2.20.0:
+- pnpm-lock.yaml:1548:     resolution: {integrity: sha512-...}
 
 Version determined from line 1544: 2.20.0
 Version line: 2.20.x

.claude/commands/execute-issue.md

@@ -71,7 +71,7 @@ Execute the implementation plan for Linear issue {{issue_id}}:
    - **Post-implementation agents:** After implementing, review the agent team (`.claude/agents/`)
      and invoke any agents whose trigger conditions match the changes (e.g., `documentor` for
      architectural changes).
-   - Run `bun lint` and `bun run --filter <affected-package> typecheck` to ensure code quality
+   - Run `pnpm lint` and `pnpm --filter <affected-package> run typecheck` to ensure code quality
    - **Pre-push review:** After lint and typecheck pass, invoke the `reviewer` agent to validate
      all changes against `docs/CONVENTIONS.md`. If the reviewer reports must-fix issues, address
      them before pushing. If only suggestions are reported, note them but proceed with the push.

.claude/commands/railway.md

@@ -24,7 +24,7 @@ and redeploys that bot's services. Secrets come from the bot's `.env.local`.
 
    ```bash
    set -a; source bots/<bot>/.env.local; set +a
-   bun run --filter @morpho-org/<bot> deploy:railway
+   pnpm --filter @morpho-org/<bot> run deploy:railway
    ```
 
 3. Success = the script prints `SUCCESS` for each service. Then verify with `logs`.

.claude/commands/retro.md

@@ -191,7 +191,7 @@ Use reference-style markdown links for all PR and TIB references (at the bottom
 3. Run formatting:
 
    ```bash
-   bun format
+   pnpm format
    ```
 
 4. Verify the document:

.claude/commands/review.md

@@ -1,6 +1,6 @@
 # review
 
-Reviews a GitHub Pull Request with expertise in TypeScript, viem, bun workspaces, and Morpho
+Reviews a GitHub Pull Request with expertise in TypeScript, viem, pnpm workspaces, and Morpho
 protocol best practices.
 
 ## Usage
@@ -18,7 +18,7 @@ protocol best practices.
 ## Prompt
 
 You are an expert code reviewer specializing in TypeScript, viem (no wagmi — bots have no React
-surface), bun-based monorepos, and Morpho protocol code paths.
+surface), pnpm-based monorepos, and Morpho protocol code paths.
 
 Review the provided PR thoroughly and interactively guide the user through each finding.
 
@@ -116,7 +116,7 @@ Review the provided PR thoroughly and interactively guide the user through each
 5. **Use Context7 MCP**: When reviewing implementation details, use the Context7 MCP tools to verify
    against official documentation for:
    - viem (contract interactions, encoding, decoding, transports)
-   - bun (workspaces, test runner, lockfile semantics)
+   - pnpm (workspaces, catalog, lockfile semantics) and bun (test runner, runtime)
 
 6. **TIB Consideration**: Check if the PR introduces changes that warrant a Technical Intent Brief
    (TIB) (see `docs/GUIDANCE.md`). Flag as "Minor" severity if the PR:
@@ -194,7 +194,7 @@ Review the provided PR thoroughly and interactively guide the user through each
      `--sandbox danger-full-access`, `git push --force`)? Flag any escalation of tool access or
      sandbox permissions.
    - **Evaluation completeness**: For review-type commands or checklists, are there gaps in
-     coverage given the codebase's stack (viem, multi-chain, bun, oxlint)?
+     coverage given the codebase's stack (viem, multi-chain, pnpm, bun, oxlint)?
    - **Cross-reference accuracy**: If the file references other files (TIBs, CONVENTIONS.md
      sections, other commands), verify those references are valid and up to date.
 

.cursor/worktrees.json

@@ -1,3 +1,3 @@
 {
-  "setup-worktree": ["bun install"]
+  "setup-worktree": ["pnpm install"]
 }

.github/actions/setup/action.yml

@@ -1,5 +1,5 @@
 name: 'Setup'
-description: 'Sets up the repository (Bun + Node) and builds dist-emitting workspace packages'
+description: 'Sets up the repository (pnpm + Node + Bun) and builds dist-emitting workspace packages'
 inputs:
   install:
     description: 'Whether to install dependencies'
@@ -16,23 +16,37 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: Set up Bun
-      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-      with:
-        bun-version: 1.3.12
+    # pnpm owns installs, workspace resolution, and script running. The version comes from
+    # package.json#packageManager, so it is not repeated here.
+    #
+    # Upstream now scopes `action-setup` to pnpm v10 and older and points v11+ at its successor,
+    # `pnpm/setup`. We stay on `action-setup` regardless: the org's GitHub Actions allowlist permits
+    # `pnpm/action-setup@*` and not `pnpm/setup@*`, so the successor fails every job at the Setup
+    # step with "is not allowed in morpho-org/morpho-bots". `action-setup` installs pnpm 11.1.1 here
+    # correctly. Moving to `pnpm/setup` — worth doing, since it verifies pnpm's release binary
+    # against GitHub's published digest rather than bootstrapping through an `npm ci` of `@pnpm/exe`
+    # — needs an org admin to allowlist it first.
+    - name: Set up pnpm
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
 
     - name: Install Node.js
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version-file: .nvmrc
 
+    # bun remains the runtime and the test runner; pnpm only manages dependencies and tasks.
+    - name: Set up Bun
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      with:
+        bun-version: 1.3.12
+
     - name: Install dependencies
       if: ${{ inputs.install == 'true' }}
       shell: bash
       run: |
-        bun install ${{ inputs.frozen-lockfile == 'true' && '--frozen-lockfile' || '' }}
+        pnpm install ${{ inputs.frozen-lockfile == 'true' && '--frozen-lockfile' || '' }}
 
     - name: Build @repo/contracts
       if: ${{ inputs.build-contracts == 'true' }}
       shell: bash
-      run: bun run --filter @repo/contracts build
+      run: pnpm --filter @repo/contracts run build

.github/workflows/checks.yml

@@ -19,10 +19,10 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Run lint
-        run: bun lint
+        run: pnpm lint
 
       - name: Run format check
-        run: bun format:check
+        run: pnpm format:check
 
   Typecheck:
     runs-on: ubuntu-latest
@@ -32,7 +32,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Run typecheck
-        run: bun run --filter '*' typecheck
+        run: pnpm -r run typecheck
 
   Test:
     runs-on: ubuntu-latest
@@ -69,4 +69,4 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Check for unused code and dependencies
-        run: bun knip
+        run: pnpm knip

.github/workflows/deploy-bot.yml

@@ -73,4 +73,4 @@ jobs:
             crossed-books) pkg='@morpho-org/midnight-crossed-books' ;;
             *) echo "Unknown bot: $BOT" >&2; exit 1 ;;
           esac
-          bun run --filter "$pkg" deploy:railway
+          pnpm --filter "$pkg" run deploy:railway

.husky/pre-commit

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
 set -e
 
-bun lint-staged
-bun knip
+pnpm lint-staged
+pnpm knip

.oxfmtrc.json

@@ -18,7 +18,7 @@
     ]
   },
   "ignorePatterns": [
-    "bun.lock",
+    "pnpm-lock.yaml",
     "**/dist/**",
     "**/build/**",
     "**/coverage/**",

.oxlintrc.json

@@ -30,7 +30,7 @@
     "**/build",
     "**/coverage",
     "**/generated",
-    "bun.lock",
+    "pnpm-lock.yaml",
     "**/*.cjs",
     "**/*.mjs",
     "**/*.js"

CLAUDE.md

@@ -27,12 +27,12 @@ Agent conventions:
 - **Test verification**: After writing or modifying tests, run them, then temporarily break one
   assertion to confirm the test actually fails. Revert after confirming. This guards against tests
   that pass vacuously.
-- **Format**: Run `bun format` directly in the validation suite (see Self-Verification) — do not
-  run `bun format:check` first, just auto-format.
+- **Format**: Run `pnpm format` directly in the validation suite (see Self-Verification) — do not
+  run `pnpm format:check` first, just auto-format.
 - **JSDoc public surface**: Every externally facing function and public method changed in TypeScript
   requires substantive JSDoc covering its applicable parameters, return value, failures, and side
   effects. Before completion, follow `.agents/skills/build-jsdoc/SKILL.md` and run
-  `bun run --filter @morpho-org/market-making-bot jsdoc:build`; `.claude/skills` must be the real
+  `pnpm --filter @morpho-org/market-making-bot run jsdoc:build`; `.claude/skills` must be the real
   symlink `../.agents/skills`, and independent checks must continue to run concurrently through
   `Promise.all` where possible.
 - **Utility isolation**: Utility functions must live in a different file from every file containing
@@ -76,18 +76,18 @@ your expectation, THEN claim success.
 ### During development
 
 Running lint or typecheck mid-implementation is fine — use your judgment. For tricky changes, a
-quick `bun run --filter <pkg> typecheck` or `bun lint` can help you course-correct early. But
+quick `pnpm --filter <pkg> run typecheck` or `pnpm lint` can help you course-correct early. But
 **do not force the full validation suite after every change**. Focus on writing code.
 
 ### Before committing or when the user says "validate"
 
 Run the full suite once the user confirms they're happy with the code (or when preparing to
 commit/push):
 
-1. **Type safety**: Run `bun run --filter <affected-package> typecheck` — zero errors required.
-2. **Lint**: Run `bun lint` from the repo root — zero warnings policy. Lint is a workspace-level
+1. **Type safety**: Run `pnpm --filter <affected-package> run typecheck` — zero errors required.
+2. **Lint**: Run `pnpm lint` from the repo root — zero warnings policy. Lint is a workspace-level
    concern; oxlint walks the whole tree and per-package `lint` scripts are deliberately omitted.
-3. **Format**: Run `bun format` — auto-fixes formatting in place.
+3. **Format**: Run `pnpm format` — auto-fixes formatting in place.
 4. **Existing tests**: Run `bun test` — all must pass.
 
 **Escalation rule**: After 3 failed fix attempts for the same issue, STOP. Tell the user what you
@@ -147,7 +147,7 @@ These files provide important background information about dependencies and rela
 
 ## Architecture Overview
 
-This is a **bun workspaces monorepo** housing off-chain Morpho curator bots:
+This is a **pnpm workspaces monorepo** housing off-chain Morpho curator bots:
 
 - `/bots/` — individual bot apps, one per bot. Each is a **standalone long-running TypeScript
   program**: `main()` in `src/index.ts` loads config from the environment (fail-loud). The
@@ -185,9 +185,10 @@ transparent JSON-Lines wire contract) was tried for ~a week and reverted — see
 which supersedes the now-historical
 [TIB-2026-07-13-bot-architecture](./docs/decisions/TIB-2026-07-13-bot-architecture.md).
 
-**Key technologies**: bun 1.3.12 (runtime + package manager + workspace task runner), Node.js
-24.14.1, TypeScript 6.0, viem for Web3, oxlint + oxfmt for lint/format, knip for dead-code
-detection, bun's built-in test runner.
+**Key technologies**: pnpm 11.1.1 (package manager + workspace resolution + version catalog + task
+runner; lifecycle scripts are default-denied via `allowBuilds` in `pnpm-workspace.yaml`), bun 1.3.12
+(runtime + test runner), Node.js 24.14.1, TypeScript 6.0, viem for Web3, oxlint + oxfmt for
+lint/format, knip for dead-code detection.
 
 **Node.js requirement**: `24.14.1` (see `.nvmrc`).