From 7324200e6f828bca13cd815fc692e484988dbb6a Mon Sep 17 00:00:00 2001
From: NnamdiCyber <ogazi133@gmail.com>
Date: Sat, 17 Oct 2026 21:21:31 +0100
Subject: [PATCH] chore: pin packageManager to pnpm@10.34.4

Add packageManager field to package.json pinning pnpm@10.34.4, the
version that created pnpm-lock.yaml, so local and CI installs use the
same version.

CI pnpm/action-setup pins 10.34.4 instead of floating 10. Add a
check:pnpm-version script (run in CI and pre-commit) that rejects
lockfile updates from an incompatible pnpm major.
---
 .github/workflows/ci.yml       | 21 ++++++++++----------
 .husky/pre-commit              |  2 +-
 package.json                   |  2 ++
 scripts/check-pnpm-version.mjs | 36 ++++++++++++++++++++++++++++++++++
 4 files changed, 50 insertions(+), 11 deletions(-)
 create mode 100644 scripts/check-pnpm-version.mjs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 727ec22..4be9647 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,12 +16,13 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 10.34.4
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: pnpm run check:pnpm-version
       - run: pnpm run format:check
       - run: pnpm build
       - run: pnpm api:check
@@ -41,7 +42,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 10.34.4
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
@@ -61,7 +62,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 10.34.4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
@@ -104,7 +105,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 10.34.4
       - uses: oven-sh/setup-bun@v2
         if: matrix.bun
         with:
@@ -143,7 +144,7 @@ jobs:
       - uses: pnpm/action-setup@v4
         if: steps.should-run.outputs.run == 'true'
         with:
-          version: 10
+          version: 10.34.4
 
       - uses: actions/setup-node@v4
         if: steps.should-run.outputs.run == 'true'
@@ -189,7 +190,7 @@ jobs:
       - uses: pnpm/action-setup@v4
         if: steps.should-run.outputs.run == 'true'
         with:
-          version: 10
+          version: 10.34.4
 
       - uses: actions/setup-node@v4
         if: steps.should-run.outputs.run == 'true'
@@ -217,7 +218,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 10.34.4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
@@ -233,7 +234,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 10.34.4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
@@ -258,7 +259,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 10.34.4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
@@ -283,7 +284,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 10.34.4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
diff --git a/.husky/pre-commit b/.husky/pre-commit
index 7d97457..4fd6379 100644
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1 +1 @@
-npx pnpm format:check && npx pnpm build && npx pnpm test
+npx pnpm check:pnpm-version && npx pnpm format:check && npx pnpm build && npx pnpm test
diff --git a/package.json b/package.json
index b3b896b..e36a376 100644
--- a/package.json
+++ b/package.json
@@ -48,8 +48,10 @@
   "engines": {
     "node": ">=20"
   },
+  "packageManager": "pnpm@10.34.4",
   "scripts": {
     "build": "tsup",
+    "check:pnpm-version": "node scripts/check-pnpm-version.mjs",
     "test": "vitest run --exclude 'test/chains/stellar/properties.test.ts' --exclude 'test/leaks/scan-leak.test.ts' --exclude 'test/leaks/heap-snapshot.test.ts' && pnpm --filter @wraith-protocol/sdk-svelte test",
     "docs": "typedoc",
     "test:exports": "node test/smoke/run.mjs",
diff --git a/scripts/check-pnpm-version.mjs b/scripts/check-pnpm-version.mjs
new file mode 100644
index 0000000..3417284
--- /dev/null
+++ b/scripts/check-pnpm-version.mjs
@@ -0,0 +1,36 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+
+const packageJsonPath = fileURLToPath(new URL('../package.json', import.meta.url));
+const { packageManager } = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
+
+if (!packageManager) {
+  console.error('error: package.json has no "packageManager" field');
+  process.exit(1);
+}
+
+const [name, pinnedVersion] = packageManager.split('@');
+const pinnedMajor = Number(pinnedVersion.split('.')[0]);
+
+let actualVersion;
+try {
+  actualVersion = execFileSync('pnpm', ['--version'], { encoding: 'utf8' }).trim();
+} catch {
+  console.error('error: pnpm is not available on PATH');
+  process.exit(1);
+}
+
+const actualMajor = Number(actualVersion.split('.')[0]);
+
+if (actualMajor !== pinnedMajor) {
+  console.error(
+    `error: pnpm major version mismatch: lockfile pinned to ${packageManager}, but running pnpm@${actualVersion}`,
+  );
+  console.error(
+    'Re-run install with the pinned pnpm major before modifying the lockfile.',
+  );
+  process.exit(1);
+}
+
+console.log(`ok: pnpm@${actualVersion} matches ${packageManager}`);