refactor: migrate from Bun to pnpm as package manager

.github/workflows/claude-code-review.yml

@@ -64,8 +64,8 @@ jobs:
 
             ## What's Already Automated (Don't Review)
 
-            - ❌ Lint errors → `bun run lint` (automated by pr.yml)
-            - ❌ Build failures → `bun run build` (automated by pr.yml)
+            - ❌ Lint errors → `pnpm run lint` (automated by pr.yml)
+            - ❌ Build failures → `pnpm run build` (automated by pr.yml)
             - ❌ Formatting issues → Automated
 
             ## Focus Your Review On (Significant Issues Only)

.github/workflows/claude.yml

@@ -58,4 +58,4 @@ jobs:
           additional_permissions: |
             actions: read
 
-          claude_args: '--allowed-tools "Read,Glob,Grep,Bash(gh:*),Bash(bun run:*),Bash(git diff:*),Bash(git log:*),Bash(git status)"'
+          claude_args: '--allowed-tools "Read,Glob,Grep,Bash(gh:*),Bash(pnpm:*),Bash(git diff:*),Bash(git log:*),Bash(git status)"'

.github/workflows/pr.yml

@@ -10,6 +10,9 @@ permissions:
 
 jobs:
   lint-and-build:
+    permissions:
+      contents: read
+      id-token: write
     runs-on:
       group: neondatabase-protected-runner-group
       labels: linux-ubuntu-latest
@@ -19,37 +22,53 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Setup JFrog CLI with OIDC
+        id: setup-jfrog
+        uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5 # v4.9.1
+        env:
+          JF_URL: https://databricks.jfrog.io
+        with:
+          oidc-provider-name: github-actions
+      - name: Configure npm registry for JFrog
+        run: |
+          echo "::add-mask::${{ steps.setup-jfrog.outputs.oidc-token }}"
+          printf 'save-exact=true\nshamefully-hoist=true\nregistry=https://databricks.jfrog.io/artifactory/api/npm/db-npm/\n' > .npmrc
+          echo "//databricks.jfrog.io/artifactory/api/npm/db-npm/:_authToken=${{ steps.setup-jfrog.outputs.oidc-token }}" >> .npmrc
+          cp .npmrc ~/.npmrc
       - name: Setup Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
-          bun-version: "1.2.13"
-      - name: Cache Bun dependencies
+          package_json_file: landing/package.json
+      - name: Get pnpm store path
+        id: pnpm-store
+        run: echo "path=$(pnpm store path)" >> "$GITHUB_OUTPUT"
+      - name: Cache pnpm dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
-          path: ~/.bun/install/cache
-          key: bun-${{ runner.os }}-${{ hashFiles('landing/bun.lock') }}
+          path: ${{ steps.pnpm-store.outputs.path }}
+          key: pnpm-${{ runner.os }}-${{ hashFiles('landing/pnpm-lock.yaml') }}
           restore-keys: |
-            bun-${{ runner.os }}-
+            pnpm-${{ runner.os }}-
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
       - name: Validate server.json version sync
         run: |
           node -e "const fs=require('fs'); const pkg=JSON.parse(fs.readFileSync('package.json','utf8')); const server=JSON.parse(fs.readFileSync('../server.json','utf8')); if (pkg.version !== server.version) { console.error('Version mismatch: landing/package.json=' + pkg.version + ' server.json=' + server.version); process.exit(1); }"
       - name: Format check
-        run: bun run fmt:check
+        run: pnpm run fmt:check
       - name: Lint
-        run: bun run lint
+        run: pnpm run lint
       - name: Check unused code and dependencies
-        run: bun run knip
+        run: pnpm run knip
       - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium
+        run: pnpm exec playwright install --with-deps chromium
       - name: Run tests
-        run: bun run test
+        run: pnpm run test
       - name: Build
         env:
           NODE_OPTIONS: --max-old-space-size=4096
-        run: bun run build
+        run: pnpm run build

CLAUDE.md

@@ -10,16 +10,18 @@ This is the **Neon MCP Server** - a Model Context Protocol server that bridges n
 
 ## Development Commands
 
-All commands should be run from the `landing/` directory. The project uses [Bun](https://bun.sh) as the package manager.
+All commands should be run from the `landing/` directory. The project uses [pnpm](https://pnpm.io) as the package manager, pinned via Corepack. Run `corepack enable` to activate it.
+
+> **Troubleshooting:** If `pnpm install` fails with registry or network errors, check whether your npm registry is configured to use the Databricks proxy. Set the registry in `~/.npmrc` or `landing/.npmrc`.
 
 ### Building and Running
 
 ```bash
 cd landing
-bun install
+pnpm install
 
 # Start the Next.js dev server (for the remote MCP server)
-bun run dev
+pnpm run dev
 ```
 
 ### Formatting, Linting, and Type Checking
@@ -28,25 +30,25 @@ bun run dev
 cd landing
 
 # Check formatting (runs in CI)
-bun run fmt:check
+pnpm run fmt:check
 
 # Auto-fix formatting
-bun run fmt
+pnpm run fmt
 
 # Lint
-bun run lint
+pnpm run lint
 
 # Auto-fix lint + formatting together
-bun run lint:fix
+pnpm run lint:fix
 
 # Type check
-bun run typecheck
+pnpm run typecheck
 
 # Check for unused code and dependencies
-bun run knip
+pnpm run knip
 
 # Auto-fix unused exports/dependencies
-bun run knip:fix
+pnpm run knip:fix
 ```
 
 ### Testing
@@ -55,22 +57,22 @@ bun run knip:fix
 cd landing
 
 # Run full test suite (unit + integration + e2e; used in CI)
-bun run test
+pnpm run test
 
 # Run unit tests
-bun run test:unit
+pnpm run test:unit
 
 # Run integration tests
-bun run test:integration
+pnpm run test:integration
 
 # Run MCP protocol e2e tests (real tool calls over MCP protocol)
-bun run test:e2e:mcp
+pnpm run test:e2e:mcp
 
 # Run website e2e tests (Playwright; provisions/validates ephemeral DB first)
-bun run test:e2e:web
+pnpm run test:e2e:web
 
 # Run all e2e tests
-bun run test:e2e
+pnpm run test:e2e
 ```
 
 ### Testing Pyramid Rules
@@ -100,7 +102,7 @@ Merge-gating tests must be deterministic. Do not make third-party uptime (for ex
 - **Global setup** (`e2e/global-setup.ts`): Provisions an ephemeral Postgres database via [Instagres](https://instagres.com) and generates a random `COOKIE_SECRET`. Both are written to `.env.e2e` (gitignored) and passed to the Next.js dev server.
 - **No secrets needed**: The e2e infrastructure is fully self-contained. Instagres databases expire after 72 hours; no explicit teardown is required.
 - **Reuse across runs**: If `.env.e2e` already exists, global-setup reuses it instead of re-provisioning. Delete the file to force a fresh database.
-- **CI**: The PR workflow runs format, lint, knip, `bun run test`, and build before merge.
+- **CI**: The PR workflow runs format, lint, knip, `pnpm run test`, and build before merge.
 
 ## Architecture
 
@@ -405,10 +407,10 @@ This repository uses an enhanced Claude Code Review workflow that provides inlin
 
 ### What's Automated (Not Reviewed by Claude)
 
-- Formatting: `bun run fmt:check` (checked by pr.yml)
-- Linting: `bun run lint` (checked by pr.yml)
-- Tests: `bun run test` (unit + integration + MCP e2e + website e2e, checked by `pr.yml`)
-- Building: `bun run build` (checked by pr.yml)
+- Formatting: `pnpm run fmt:check` (checked by pr.yml)
+- Linting: `pnpm run lint` (checked by pr.yml)
+- Tests: `pnpm run test` (unit + integration + MCP e2e + website e2e, checked by `pr.yml`)
+- Building: `pnpm run build` (checked by pr.yml)
 
 ### Review Process
 

README.md

@@ -51,7 +51,7 @@ There are a few options for setting up the Neon MCP Server:
 - A [Neon account](https://console.neon.tech/signup).
 - **Node.js (>= v18.0.0):** Download from [nodejs.org](https://nodejs.org).
 
-For development, you'll also need [Bun](https://bun.sh) installed.
+For development, you'll need Node.js 22+ (pnpm is provided via Corepack — run `corepack enable` to activate it).
 
 ### Option 1. Quick Setup with API Key
 
@@ -305,29 +305,30 @@ The "Start" command accepts a migration and runs it in a new temporary branch. U
 
 # Development
 
-This project uses [Bun](https://bun.sh) as the package manager and runtime.
+This project uses [pnpm](https://pnpm.io) as the package manager, pinned via Corepack.
 
 ## Project Structure
 
 The MCP server code lives in the `landing/` directory, which is a Next.js application deployed to Vercel at `mcp.neon.tech`.
 
 ```bash
 cd landing
-bun install
+corepack enable
+pnpm install
 ```
 
 ## Local Development
 
 ```bash
 # Start the Next.js dev server (for the remote MCP server)
-bun run dev
+pnpm run dev
 ```
 
 ## Linting and Type Checking
 
 ```bash
-bun run lint
-bun run typecheck
+pnpm run lint
+pnpm run typecheck
 ```
 
 ## Environment Variables
@@ -358,22 +359,22 @@ All tests run from `landing/`.
 cd landing
 
 # Unit tests
-bun run test:unit
+pnpm run test:unit
 
 # Integration tests
-bun run test:integration
+pnpm run test:integration
 
 # MCP protocol end-to-end tests (real MCP client/server tool calls)
-bun run test:e2e:mcp
+pnpm run test:e2e:mcp
 
 # Website end-to-end tests (Playwright; provisions/validates ephemeral DB first)
-bun run test:e2e:web
+pnpm run test:e2e:web
 
 # Full end-to-end suite
-bun run test:e2e
+pnpm run test:e2e
 
 # Full test pyramid (unit + integration + e2e; used in CI)
-bun run test
+pnpm run test
 ```
 
 Testing strategy:

landing/.npmrc

@@ -1 +1,2 @@
-save-exact=true
+save-exact=true
+shamefully-hoist=true

landing/.prettierignore

@@ -3,7 +3,7 @@ node_modules/
 dist/
 build/
 out/
-bun.lock
+pnpm-lock.yaml
 coverage/
 .vercel/
 patches/