chore: migrate to pnpm 11 via corepack and test Node 22/24/26

[jaredwray]

Summary

Migrates the SDK from pnpm 10 to pnpm 11 using corepack, and refreshes the CI tooling and Node.js test matrix.

Changes

• pnpm 11 via corepack — added "packageManager": "pnpm@11.8.0+sha512…" to package.json (generated with corepack use pnpm@11.8.0). pnpm now resolves from this field rather than the previous unpinned npm install pnpm -g.
• allowBuilds config — pnpm 11 removed onlyBuiltDependencies (and neverBuiltDependencies, ignoredBuiltDependencies, etc.), replacing them with the unified allowBuilds map. pnpm-workspace.yaml now uses:

  allowBuilds:
    '@swc/core': true
    esbuild: true
    unrs-resolver: true

  Without this, pnpm 11 reports ERR_PNPM_IGNORED_BUILDS for @swc/core and esbuild.
• Node test matrix — tests.yaml now runs against Node 22, 24, and 26.
• Node 24 stays the LTS — .nvmrc is unchanged (24) and the single-version workflows (release.yaml, code-coverage.yaml) continue to use Node 24.
• Workflow pnpm setup — all workflows now use pnpm/action-setup@v6 + corepack enable, with the pnpm store cached via actions/setup-node (cache: 'pnpm'), replacing npm install pnpm -g && pnpm install. This matches the pattern used in the sibling Hyphen/nodejs-sdk and jaredwray/cacheable repos.

Verification

Run locally with pnpm 11.8.0:

• pnpm install --frozen-lockfile — ✅ clean, build scripts now run (@swc/core, esbuild), no ignored-builds error
• pnpm build — ✅ passes
• pnpm test — ✅ 151/156 pass; the 5 failures are the live-API Toggle Evaluations tests that require HYPHEN_PUBLIC_API_KEY / HYPHEN_APPLICATION_ID (provided via secrets in CI, absent locally) — unrelated to this change.

Note: the request referenced pnpm/setup-action; the actual published action is pnpm/action-setup (pnpm/setup-action does not exist), so that is what's used here.

🤖 Generated with Claude Code

---

Generated by Claude Code

[aikido-pr-checks]

3rd party Github Actions should be pinned - high severity
A third-party GitHub Action was imported, and is not pinned via a hash. This leaves your CI/CD at risk for potential supply chain attacks, if the affected GitHub Action is compromised.

Suggested change

	uses: pnpm/action-setup@v6
	uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[aikido-pr-checks]

3rd party Github Actions should be pinned - high severity
A third-party GitHub Action was imported, and is not pinned via a hash. This leaves your CI/CD at risk for potential supply chain attacks, if the affected GitHub Action is compromised.

Suggested change

	uses: pnpm/action-setup@v6
	uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[aikido-pr-checks]

3rd party Github Actions should be pinned - high severity
A third-party GitHub Action was imported, and is not pinned via a hash. This leaves your CI/CD at risk for potential supply chain attacks, if the affected GitHub Action is compromised.

Suggested change

	uses: pnpm/action-setup@v6
	uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[gemini-code-assist]

Code Review

This pull request configures the package manager in package.json and attempts to set up build permissions in pnpm-workspace.yaml. Feedback indicates that allowBuilds is not supported in pnpm-workspace.yaml and is incorrectly formatted as a map; it should instead be configured as an array under the "pnpm" field in the root package.json.

[gemini-code-assist]

In pnpm, configuration options like allowBuilds (or the deprecated onlyBuiltDependencies) are not supported in pnpm-workspace.yaml. Placing them here will cause pnpm to ignore them, which can lead to ERR_PNPM_IGNORED_BUILDS errors during installation because the build scripts for @swc/core, esbuild, and unrs-resolver won't be allowed to run.

Additionally, in pnpm 11, allowBuilds is defined as an array of package names (strings), rather than a map of package names to booleans.

These configurations should be moved to the root package.json under the "pnpm" field, or defined in .npmrc as allow-builds.

minimumReleaseAge: 2880

[gemini-code-assist]

To correctly configure allowed builds in pnpm 11, define allowBuilds as an array of package names under the "pnpm" field in your root package.json.

  "dependencies": {
    "hookified": "^2.1.1"
  },
  "pnpm": {
    "allowBuilds": [
      "@swc/core",
      "esbuild",
      "unrs-resolver"
    ]
  },
  "packageManager": "pnpm@11.8.0+sha512.c1f5e7c4cb241c8f174b743851d82f42b802324afc8b0f116b96adb15aa06664948dde36960a3ba1079ba5b4b29dd0140135b94b5b5f5263592249d68e555f26"