chore: switch from npm to pnpm

pnpm is faster and has stricter behavior with regards to transitive
dependencies.

For now, a valid package-lock.json file is retained for npm
compatibility, but will likely be removed in the future.

.github/workflows/build.yml

@@ -34,35 +34,35 @@ jobs:
           node-version: 20.x
           cache: "npm"
           cache-dependency-path: |
-            package-lock.json
-            examples/**/package-lock.json
-      - run: npm install
-      - run: npm run format:fix
+            pnpm-lock.yaml
+            examples/**/pnpm-lock.yaml
+      - run: pnpm install
+      - run: pnpm run format:fix
       - name: Check for dirty working directory
         run: git diff --exit-code
-      - run: npm run lint:check
+      - run: pnpm run lint:check
       - name: Typecheck with TypeScript
-        run: npm run typecheck
+        run: pnpm run typecheck
       - name: Build client bundles
         run: |
           build_info="{'tag':'$(git describe --always --tags)', 'url':'https://github.com/google/neuroglancer/commit/$(git rev-parse HEAD)', 'timestamp':'$(date)'}"
-          npm run build -- --no-typecheck --no-lint --define NEUROGLANCER_BUILD_INFO="${build_info}"
+          pnpm run build --no-typecheck --no-lint --define NEUROGLANCER_BUILD_INFO="${build_info}"
           echo $build_info > ./dist/client/version.json
         shell: bash
       - name: Build Python client bundles
-        run: npm run build-python -- --no-typecheck --no-lint
-      - run: npm run build-package
-      - run: npm publish --dry-run
+        run: pnpm run build-python --no-typecheck --no-lint
+      - run: pnpm run build-package
+      - run: pnpm publish --dry-run
         working-directory: dist/package
       - uses: ./.github/actions/setup-firefox
       - name: Run JavaScript tests (including WebGL)
-        run: npm test
+        run: pnpm test
         if: ${{ runner.os != 'macOS' }}
       - name: Run JavaScript tests (excluding WebGL)
-        run: npm test -- --project node
+        run: pnpm test -- --project node
         if: ${{ runner.os == 'macOS' }}
       - name: Run JavaScript benchmarks
-        run: npm run benchmark
+        run: pnpm run benchmark
       - name: Upload NPM package as artifact
         uses: actions/upload-artifact@v4
         with:
@@ -156,10 +156,10 @@ jobs:
         id: pip-cache
         run: |
           echo "dir=$(pip cache dir)" >> "$GITHUB_OUTPUT"
-      - run: npm install
+      - run: pnpm install
       - run: |
           build_info="{'tag':'$(git describe --always --tags)', 'url':'https://github.com/google/neuroglancer/commit/$(git rev-parse HEAD)', 'timestamp':'$(date)'}"
-          npm run build-python -- --no-typecheck --no-lint --define NEUROGLANCER_BUILD_INFO="${build_info}"
+          pnpm run build-python --no-typecheck --no-lint --define NEUROGLANCER_BUILD_INFO="${build_info}"
         shell: bash
       - name: Check for dirty working directory
         run: git diff --exit-code
@@ -245,7 +245,7 @@ jobs:
         if: ${{ startsWith(github.ref, 'refs/tags/v') }}
       - name: Publish to NPM registry
         if: ${{ startsWith(github.ref, 'refs/tags/v') }}
-        run: npm publish
+        run: pnpm publish
         working-directory: npm-package
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/build_preview.yml

@@ -17,10 +17,10 @@ jobs:
         uses: actions/setup-node@v1
         with:
           node-version: ${{ matrix.node-version }}
-      - run: npm install
+      - run: pnpm install
       - run: |
           build_info="{'tag':'$(git describe --always --tags)', 'url':'https://github.com/google/neuroglancer/commit/$(git rev-parse HEAD)', 'timestamp':'$(date)'}"
-          npm run build -- --no-typecheck --no-lint --define NEUROGLANCER_BUILD_INFO="${build_info}"
+          pnpm build --no-typecheck --no-lint --define NEUROGLANCER_BUILD_INFO="${build_info}"
       - name: Upload client as artifact
         uses: actions/upload-artifact@v4
         with:

.ncurc.yml

@@ -3,3 +3,4 @@ reject:
   - "gl-matrix"
   - "@types/gl-matrix"
   - "codemirror"
+packageManager: "pnpm"

.prettierignore

@@ -7,3 +7,4 @@ dist
 /lib
 /docs/_build/
 /.ruff_cache
+pnpm-lock.yaml

CONTRIBUTING.md

@@ -28,20 +28,20 @@ are linted with `eslint` and formatted by `prettier`.
 You can check for lint/format issues with:
 
 ```shell
-npm run lint:check
-npm run format:check
+pnpm run lint:check
+pnpm run format:check
 ```
 
 To reformat run:
 
 ```shell
-npm run format:fix
+pnpm run format:fix
 ```
 
 To automatically apply safe lint fixes, run:
 
 ```shell
-npm run lint:fix
+pnpm run lint:fix
 ```
 
 Python code is linted and formatted using

README.md

@@ -133,20 +133,20 @@ https://github.com/creationix/nvm
 
    (From within this directory)
 
-   `npm i`
+   `pnpm i`
 
    Also re-run this any time the dependencies listed in [package.json](package.json) may have
    changed, such as after checking out a different revision or pulling changes.
 
 4. To run a local server for development purposes:
 
-   `npm run dev-server`
+   `pnpm run dev-server`
 
    This will start a server on <http://localhost:8080>.
 
 5. To run the unit test suite on Chrome:
 
-   `npm test`
+   `pnpm test`
 
 6. See [package.json](package.json) for other commands available.
 

build_tools/after-version-change.ts

@@ -1,6 +1,6 @@
 // Script to run after bumping the version.
 //
-// Runs `npm install` on all examples to ensure their lockfiles have the updated
+// Runs `pnpm install` on all examples to ensure their lockfiles have the updated
 // version.
 
 import childProcess from "node:child_process";
@@ -12,11 +12,11 @@ const execFileAsync = promisify(childProcess.execFile);
 
 const rootDir = path.resolve(import.meta.dirname, "..");
 
-await execFileAsync("npm", ["install", "--no-audit", "--no-fund"], {
+await execFileAsync("pnpm", ["install"], {
   cwd: rootDir,
 });
 
-await execFileAsync("npm", ["run", "build-package"], {
+await execFileAsync("pnpm", ["run", "build-package"], {
   cwd: rootDir,
 });
 
@@ -25,11 +25,20 @@ await Promise.all(
   (await glob("examples/*/*/package.json", { absolute: true, cwd: rootDir }))
     .map((examplePackageJsonPath) => path.dirname(examplePackageJsonPath))
     .map(async (exampleDir: string) => {
-      await execFileAsync("npm", ["install", "--no-audit", "--no-fund"], {
-        cwd: exampleDir,
-      });
-      await execFileAsync("git", ["add", "package-lock.json"], {
+      await execFileAsync("pnpm", ["install"], {
         cwd: exampleDir,
       });
     }),
 );
+
+await execFileAsync(
+  "git",
+  [
+    "add",
+    ...(await glob("examples/*/*/pnpm-lock.yaml", {
+      absolute: false,
+      cwd: rootDir,
+    })),
+  ],
+  { cwd: rootDir },
+);

build_tools/build-package.ts

@@ -122,6 +122,7 @@ async function buildPackage(options: {
     const { postpack } = packageJson["scripts"];
     delete packageJson["scripts"];
     packageJson["scripts"] = { postpack };
+    packageJson["files"] = ["lib/**/*"];
   } else {
     delete packageJson["private"];
     packageJson["scripts"] = {};

build_tools/update-example-dependencies.ts

@@ -7,11 +7,11 @@ const execFileAsync = promisify(childProcess.execFile);
 
 const rootDir = path.resolve(import.meta.dirname, "..");
 
-await execFileAsync("npm", ["install", "--no-audit", "--no-fund"], {
+await execFileAsync("pnpm", ["install"], {
   cwd: rootDir,
 });
 
-await execFileAsync("npm", ["run", "build-package"], {
+await execFileAsync("pnpm", ["run", "build-package"], {
   cwd: rootDir,
 });
 
@@ -20,10 +20,10 @@ await Promise.all(
   (await glob("examples/*/*/package.json", { absolute: true, cwd: rootDir }))
     .map((examplePackageJsonPath) => path.dirname(examplePackageJsonPath))
     .map(async (exampleDir: string) => {
-      await execFileAsync("npx", ["npm-check-updates", "-u"], {
+      await execFileAsync("npx", ["npm-check-updates", "-u", "-p", "pnpm"], {
         cwd: exampleDir,
       });
-      await execFileAsync("npm", ["install", "--no-audit", "--no-fund"], {
+      await execFileAsync("pnpm", ["install"], {
         cwd: exampleDir,
       });
     }),

examples/README.md

@@ -9,19 +9,13 @@ Neuroglancer can be used as a dependency in two ways:
 1. Installing directly from the Github repository, via:
 
    ```shell
-   npm install google/neuroglancer
+   pnpm install google/neuroglancer
    ```
 
 2. Linking to a local checkout of the Neuroglancer repository via:
 
    ```shell
-   npm link neuroglancer
-   ```
-
-   or
-
-   ```shell
-   npm install file:/local/path/to/neuroglancer
+   pnpm install file:/local/path/to/neuroglancer
    ```
 
    This may be useful when developing Neuroglancer locally. In this case the