build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. allowBuilds for esbuild becomes
package.json#allowScripts. The Dockerfile installs with npm ci --omit=dev and
no longer prepares pnpm through corepack; .npmrc keeps engine-strict, which npm
honours natively.

minimumReleaseAgeExclude is dropped rather than translated: pnpm's
minimumReleaseAge was never set, so the 30-entry exclusion list had nothing to
exclude from. Direct dependency versions resolve identically to the pnpm
lockfile.

renderer/.github/workflows/ci.yml

@@ -10,17 +10,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 11.9.0
       - uses: actions/setup-node@v4
         with:
           node-version: 24
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm lint
-      - run: pnpm typecheck
-      - run: pnpm test
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm test
       - name: Install Remotion browser runtime libraries
         run: |
           sudo apt-get update
@@ -32,6 +29,6 @@ jobs:
             libasound2t64 \
             libxshmfence1 \
             fonts-noto
-      - run: pnpm browser:ensure
-      - run: pnpm render:smoke
-      - run: pnpm api:smoke
+      - run: npm run browser:ensure
+      - run: npm run render:smoke
+      - run: npm run api:smoke

renderer/AGENTS.md

@@ -9,11 +9,11 @@ animated wheel-of-names GIFs with Remotion.
 
 - Use JavaScript and JSDoc. Do not add TypeScript source files.
 - Keep public API routes under `/api`.
-- Run `pnpm lint`, `pnpm typecheck`, and `pnpm test` before committing code
+- Run `npm run lint`, `npm run typecheck`, and `npm test` before committing code
   changes.
-- Run `pnpm render:smoke` when renderer, Remotion composition, Docker runtime,
+- Run `npm run render:smoke` when renderer, Remotion composition, Docker runtime,
   or GIF output behavior changes.
-- Run `pnpm api:smoke` when API render behavior, bundle warm-up, or production
+- Run `npm run api:smoke` when API render behavior, bundle warm-up, or production
   render flow changes.
 - Do not commit `.env`, generated GIFs, tokens, secrets, or temporary render
   artifacts.

renderer/Dockerfile

@@ -35,14 +35,12 @@ RUN apt-get update \
     xdg-utils \
   && rm -rf /var/lib/apt/lists/*
 
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY package.json package-lock.json ./
 COPY scripts/ensure-browser.js ./scripts/ensure-browser.js
-RUN corepack enable \
-  && corepack prepare pnpm@11.9.0 --activate \
-  && pnpm install --prod --frozen-lockfile \
-  && pnpm browser:ensure
+RUN npm ci --omit=dev \
+  && npm run browser:ensure
 
 COPY . .
 
 EXPOSE 3000
-CMD ["pnpm", "start"]
+CMD ["npm", "start"]

renderer/README.md

@@ -36,14 +36,14 @@ Response is `image/gif` with winner metadata headers:
 Install dependencies and Chromium once:
 
 ```sh
-pnpm install
-pnpm browser:ensure
+npm install
+npm run browser:ensure
 ```
 
 Start the local API:
 
 ```sh
-pnpm dev
+npm run dev
 ```
 
 ### Generate GIF files locally
@@ -52,20 +52,20 @@ Generate the quick smoke fixture at the git-ignored path
 `fixtures/smoke.gif`:
 
 ```sh
-pnpm render:smoke
+npm run render:smoke
 ```
 
 Generate the complete fixture set at `fixtures/smoke.gif`,
 `fixtures/vietnamese.gif`, and `fixtures/sixteen-options.gif`:
 
 ```sh
-pnpm render:fixtures
+npm run render:fixtures
 ```
 
 Render a custom GIF directly without starting the API server:
 
 ```powershell
-pnpm render:local -- `
+npm run render:local -- `
   --output wheel.gif `
   --option "Chiều nay uống CraneTea" `
   --option "Chiều nay uống CraneTea" `
@@ -76,7 +76,7 @@ pnpm render:local -- `
 macOS, Linux, or Git Bash:
 
 ```sh
-pnpm render:local -- \
+npm run render:local -- \
   --output wheel.gif \
   --option "Chiều nay uống CraneTea" \
   --option "Chiều nay uống CraneTea" \
@@ -85,7 +85,7 @@ pnpm render:local -- \
 ```
 
 `--winner` is a zero-based index and is random when omitted. Run
-`pnpm render:local -- --help` for duration, hold, FPS, size, theme, and timeout
+`npm run render:local -- --help` for duration, hold, FPS, size, theme, and timeout
 options. The documented root `wheel.gif` and `fixtures/*.gif` outputs are
 git-ignored and safe to delete; custom output paths may need their own ignore
 rule.
@@ -95,10 +95,10 @@ rule.
 Run the API smoke test and quality gates:
 
 ```sh
-pnpm api:smoke
-pnpm lint
-pnpm typecheck
-pnpm test
+npm run api:smoke
+npm run lint
+npm run typecheck
+npm test
 ```
 
 ## Deploy

renderer/docs/deployment.md

@@ -41,7 +41,7 @@ the service is CPU-bound or concurrency-limited.
 
 Local non-Docker render smoke requires Chrome Headless Shell shared libraries,
 including `libnspr4` and `libnss3`. Prefer Docker for consistent verification.
-The Docker image runs `pnpm browser:ensure` during build so production requests
+The Docker image runs `npm run browser:ensure` during build so production requests
 do not need to download Chrome Headless Shell on first render.
 
 `RENDER_TIMEOUT_MS` is a total render timeout. Values below `7000` are raised to

renderer/docs/render-benchmarks.md

@@ -3,7 +3,7 @@
 Fill this after running:
 
 ```sh
-pnpm render:fixtures
+npm run render:fixtures
 ```
 
 | Fixture | Size | FPS | Duration | Bytes | Render Time | Notes |

renderer/package.json

@@ -38,5 +38,8 @@
     "prettier": "3.9.4",
     "typescript": "6.0.3",
     "vitest": "4.1.10"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

renderer/pnpm-workspace.yaml

@@ -1,34 +0,0 @@
-allowBuilds:
-  esbuild: true
-minimumReleaseAgeExclude:
-  - '@remotion/bundler@4.0.485'
-  - '@remotion/canvas-capture@4.0.485'
-  - '@remotion/compositor-darwin-arm64@4.0.485'
-  - '@remotion/compositor-darwin-x64@4.0.485'
-  - '@remotion/compositor-linux-arm64-gnu@4.0.485'
-  - '@remotion/compositor-linux-arm64-musl@4.0.485'
-  - '@remotion/compositor-linux-x64-gnu@4.0.485'
-  - '@remotion/compositor-linux-x64-musl@4.0.485'
-  - '@remotion/compositor-win32-x64-msvc@4.0.485'
-  - '@remotion/licensing@4.0.485'
-  - '@remotion/media-parser@4.0.485'
-  - '@remotion/media-utils@4.0.485'
-  - '@remotion/paths@4.0.485'
-  - '@remotion/player@4.0.485'
-  - '@remotion/renderer@4.0.485'
-  - '@remotion/shapes@4.0.485'
-  - '@remotion/streaming@4.0.485'
-  - '@remotion/studio-shared@4.0.485'
-  - '@remotion/studio@4.0.485'
-  - '@remotion/timeline-utils@4.0.485'
-  - '@remotion/web-renderer@4.0.485'
-  - '@remotion/zod-types@4.0.485'
-  - '@vitest/expect@4.1.10'
-  - '@vitest/mocker@4.1.10'
-  - '@vitest/pretty-format@4.1.10'
-  - '@vitest/runner@4.1.10'
-  - '@vitest/snapshot@4.1.10'
-  - '@vitest/spy@4.1.10'
-  - '@vitest/utils@4.1.10'
-  - remotion@4.0.485
-  - vitest@4.1.10

renderer/scripts/render-local.js

@@ -4,7 +4,7 @@ import {renderWheelGif} from '../src/render/render-gif.js';
 import {parseRenderLocalArgs} from './render-local-args.js';
 
 const usage = `Usage:
-  pnpm render:local -- --option <text> --option <text> [options]
+  npm run render:local -- --option <text> --option <text> [options]
 
 Options:
   -o, --output <path>   Output file (default: wheel.gif)