chore: migrate from npm to pnpm

README.md

@@ -36,31 +36,31 @@ Vercel env vars:
 | `APP_CACHE_SECONDS` | Cache TTL for upstream API responses (default 600) |
 | `NUM_DAYS_WARNING_NOT_UPDATED` | Default warning threshold in days (default 30; per-group override via `/setdayswarning`) |
 
-Operator-only `.env.deploy` (used by `npm run register` + `npm run describe`) — see `.env.deploy.example`.
+Operator-only `.env.deploy` (used by `pnpm register` + `pnpm describe`) — see `.env.deploy.example`.
 
 ## Run
 
 Local dev:
 
 ```sh
-npm install
+pnpm install
 vercel link            # link to your Vercel project
 vercel env pull .env.local
-npm run dev            # vercel dev
+pnpm dev               # vercel dev
 ```
 
 Deploy:
 
 ```sh
-npm run deploy         # vercel deploy --prod && register webhook
+pnpm deploy            # vercel deploy --prod && register webhook
 ```
 
-`npm run register` re-points the Telegram webhook at the URL in `.env.deploy:WORKER_URL`,
+`pnpm register` re-points the Telegram webhook at the URL in `.env.deploy:WORKER_URL`,
 and refreshes the menu: default scope = user commands only, plus a chat-scoped menu
 (full set including admin commands) for every ID in `.env.deploy:ADMIN_IDS`. Re-run it
 whenever `src/bot/commands/index.js` changes — Telegram caches the menu until
-`setMyCommands` is called again. `npm run deploy` does this automatically.
-`npm run describe` updates the bot's profile description / about-text (run once when copy changes).
+`setMyCommands` is called again. `pnpm deploy` does this automatically.
+`pnpm describe` updates the bot's profile description / about-text (run once when copy changes).
 
 ## Operations
 
@@ -72,7 +72,7 @@ whenever `src/bot/commands/index.js` changes — Telegram caches the menu until
 ### Credential rotation (quarterly)
 
 - **Upstash REST token** — regenerate in Upstash console, update `UPSTASH_REDIS_REST_TOKEN` in Vercel env, redeploy
-- **Telegram webhook secret** — generate new value, update `TELEGRAM_WEBHOOK_SECRET` in Vercel env, redeploy, then `npm run register`
+- **Telegram webhook secret** — generate new value, update `TELEGRAM_WEBHOOK_SECRET` in Vercel env, redeploy, then `pnpm register`
 
 ### Dependency security
 

package.json

@@ -10,13 +10,14 @@
   "main": "api/webhook.js",
   "scripts": {
     "dev": "vercel dev",
-    "deploy": "vercel deploy --prod && npm run register",
+    "deploy": "vercel deploy --prod && pnpm register",
     "register": "node --env-file=.env.deploy scripts/register-webhook.js",
     "register:dry": "node --env-file=.env.deploy scripts/register-webhook.js --dry-run",
     "describe": "node --env-file=.env.deploy scripts/set-bot-description.js",
     "describe:dry": "node --env-file=.env.deploy scripts/set-bot-description.js --dry-run",
     "lint": "node scripts/check-secret-leaks.js"
   },
+  "packageManager": "pnpm@11.1.1",
   "license": "Apache-2.0",
   "dependencies": {
     "@upstash/redis": "^1.38.0",
@@ -28,5 +29,8 @@
     "form-data": "^2.5.4",
     "qs": "^6.14.1",
     "tough-cookie": "^4.1.3"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": ["es5-ext"]
   }
 }