build(deps): standardize JavaScript tooling on Bun

Author: FelixTJDietrich

.agents/skills/fix-ci/SKILL.md

@@ -7,7 +7,7 @@ disable-model-invocation: true
 allowed-tools:
   - Bash(gh *)
   - Bash(git *)
-  - Bash(pnpm *)
+  - Bash(bun *)
   - Bash(./mvnw *)
   - Read
   - Grep
@@ -62,17 +62,17 @@ Each leg's annotation names its own command; this table is only what the annotat
 
 | Failure | What it actually means |
 |---|---|
-| `routeTree.gen.ts is stale` | Only a Vite build writes it. `cd webapp && pnpm run build`, then commit the file. |
-| `README images are stale` | The storybook job runs `export:readme-assets` *after* `test:storybook`, so the job goes red having printed a clean pass line. Run `pnpm --filter webapp run export:readme-assets` and commit `docs/images/readme`. |
+| `routeTree.gen.ts is stale` | Only a Vite build writes it. `cd webapp && bun run build`, then commit the file. |
+| `README images are stale` | The storybook job runs `export:readme-assets` *after* `test:storybook`, so the job goes red having printed a clean pass line. Run `bun run --filter webapp export:readme-assets` and commit `docs/images/readme`. |
 | Migrations gate | A changelog that reached `main` was edited, renamed or deleted, or a `master.xml` `<include>` was not appended at the end. Fix forward with a new changeset; never edit the released file. |
 | `verify-changesets` | The PR touches shipped code with no `.changeset/*.md`. `/land-pr` step 9 has the rules. |
 | App Server leg red on a docs-only PR | Expected, not a misconfiguration: `docs/**` is inside the `application-server` paths filter, because `docs:lint` and `check:diagrams` run on that leg. |
 
 ## 4. Reproduce locally before pushing
 
 ```bash
-pnpm run format
-pnpm run check
+bun run format
+bun run check
 ```
 
 `check` runs every leg CI runs except those needing Docker or a live credential — `docs:lint`

.agents/skills/land-pr/SKILL.md

@@ -7,7 +7,7 @@ disable-model-invocation: true
 allowed-tools:
   - Bash(gh *)
   - Bash(git *)
-  - Bash(pnpm *)
+  - Bash(bun *)
   - Bash(./mvnw *)
   - Read
   - Grep
@@ -42,8 +42,8 @@ than guessing, and note the two shapes that surprise people:
 ## 3. Format, then check
 
 ```bash
-pnpm run format
-pnpm run check
+bun run format
+bun run check
 ```
 
 `check` is the complete local quality gate — every leg is listed under `check` in the root
@@ -57,9 +57,9 @@ Generated artefacts are never hand-edited, and regeneration is destructive — i
 directory first, so stash local edits.
 
 ```bash
-pnpm run generate:api          # controllers or DTOs changed: rewrites openapi.yaml AND webapp/src/api
-pnpm run db:draft-changelog    # entities changed (needs Docker); then prune the diff to real deltas
-pnpm run db:generate-erd-docs  # after any changelog change
+bun run generate:api          # controllers or DTOs changed: rewrites openapi.yaml AND webapp/src/api
+bun run db:draft-changelog    # entities changed (needs Docker); then prune the diff to real deltas
+bun run db:generate-erd-docs  # after any changelog change
 ```
 
 `generate:api:application-server:specs` **exits 0 having written nothing** when a port it needs is
@@ -69,7 +69,7 @@ busy — HTTP, management, or the JMX port it defaults to. Pass free ports; the
 ## 5. Run the tests your diff can break
 
 ```bash
-pnpm run test:webapp
+bun run test:webapp
 cd server && ./mvnw -pl application -am test -Dsurefire.includedGroups=unit -T 2C --batch-mode -q
 ```
 
@@ -85,11 +85,11 @@ A PR touching `server/`, `webapp/` or `docker/` needs a `.changeset/*.md` or `ve
 fails it.
 
 ```bash
-pnpm changeset          # user-facing: pick the bump, write the summary in the operator's voice
-pnpm changeset --empty  # no user-facing effect; say why in the body
+bun changeset          # user-facing: pick the bump, write the summary in the operator's voice
+bun changeset --empty  # no user-facing effect; say why in the body
 ```
 
-`pnpm changeset` is interactive — with no TTY, hand-write `.changeset/<slug>.md` (`.changeset/README.md`
+`bun changeset` is interactive — with no TTY, hand-write `.changeset/<slug>.md` (`.changeset/README.md`
 has the shape). The summary lands in `CHANGELOG.md` verbatim, so it names what an operator or user can
 now do, not a class or a file. **Pre-1.0, never pick `major`** — it would cut 1.0.0 and the gate
 rejects it; a breaking change rides in `minor` with `**Operators:** …` in the summary and a

.changeset/README.md

@@ -6,15 +6,15 @@ the version bump. (Not a Liquibase `<changeSet>` — a schema change needs both.
 Every PR that changes shipped code (anything under `server/`, `webapp/`, or `docker/` except tests and in-tree docs) ships one; CI (`verify-changesets`) enforces it.
 
 ```bash
-pnpm changeset          # write one (pick the bump, describe the change)
-pnpm changeset --empty  # no user-facing effect — then write why in the file body (non-interactive)
+bun changeset          # write one (pick the bump, describe the change)
+bun changeset --empty  # no user-facing effect — then write why in the file body (non-interactive)
 ```
 
 The summary lands in the changelog **verbatim**, in the operator/user's voice — lead with what they can now
 do, or the symptom a fix removes. No class/hook/file names. No agent-attribution trailers. One changeset per
 user-visible change; unsure whether it's visible? Add one — a reviewer can delete it, a missing note can't.
 
-No TTY (agents, CI)? `pnpm changeset` is interactive — instead write `.changeset/<slug>.md` by hand in the
+No TTY (agents, CI)? `bun changeset` is interactive — instead write `.changeset/<slug>.md` by hand in the
 format shown below. That is the one sanctioned hand-write; never touch `CHANGELOG.md` directly.
 
 **Bump = the operator's upgrade cost:**

.changeset/modern-bun-package-manager.md

@@ -0,0 +1,5 @@
+---
+---
+
+This package-management migration changes contributor and build infrastructure only; released
+application behavior and operator configuration are unchanged.

.claude/skills/fix-ci/SKILL.md

@@ -7,7 +7,7 @@ disable-model-invocation: true
 allowed-tools:
   - Bash(gh *)
   - Bash(git *)
-  - Bash(pnpm *)
+  - Bash(bun *)
   - Bash(./mvnw *)
   - Read
   - Grep
@@ -62,17 +62,17 @@ Each leg's annotation names its own command; this table is only what the annotat
 
 | Failure | What it actually means |
 |---|---|
-| `routeTree.gen.ts is stale` | Only a Vite build writes it. `cd webapp && pnpm run build`, then commit the file. |
-| `README images are stale` | The storybook job runs `export:readme-assets` *after* `test:storybook`, so the job goes red having printed a clean pass line. Run `pnpm --filter webapp run export:readme-assets` and commit `docs/images/readme`. |
+| `routeTree.gen.ts is stale` | Only a Vite build writes it. `cd webapp && bun run build`, then commit the file. |
+| `README images are stale` | The storybook job runs `export:readme-assets` *after* `test:storybook`, so the job goes red having printed a clean pass line. Run `bun run --filter webapp export:readme-assets` and commit `docs/images/readme`. |
 | Migrations gate | A changelog that reached `main` was edited, renamed or deleted, or a `master.xml` `<include>` was not appended at the end. Fix forward with a new changeset; never edit the released file. |
 | `verify-changesets` | The PR touches shipped code with no `.changeset/*.md`. `/land-pr` step 9 has the rules. |
 | App Server leg red on a docs-only PR | Expected, not a misconfiguration: `docs/**` is inside the `application-server` paths filter, because `docs:lint` and `check:diagrams` run on that leg. |
 
 ## 4. Reproduce locally before pushing
 
 ```bash
-pnpm run format
-pnpm run check
+bun run format
+bun run check
 ```
 
 `check` runs every leg CI runs except those needing Docker or a live credential — `docs:lint`

.claude/skills/land-pr/SKILL.md

@@ -7,7 +7,7 @@ disable-model-invocation: true
 allowed-tools:
   - Bash(gh *)
   - Bash(git *)
-  - Bash(pnpm *)
+  - Bash(bun *)
   - Bash(./mvnw *)
   - Read
   - Grep
@@ -42,8 +42,8 @@ than guessing, and note the two shapes that surprise people:
 ## 3. Format, then check
 
 ```bash
-pnpm run format
-pnpm run check
+bun run format
+bun run check
 ```
 
 `check` is the complete local quality gate — every leg is listed under `check` in the root
@@ -57,9 +57,9 @@ Generated artefacts are never hand-edited, and regeneration is destructive — i
 directory first, so stash local edits.
 
 ```bash
-pnpm run generate:api          # controllers or DTOs changed: rewrites openapi.yaml AND webapp/src/api
-pnpm run db:draft-changelog    # entities changed (needs Docker); then prune the diff to real deltas
-pnpm run db:generate-erd-docs  # after any changelog change
+bun run generate:api          # controllers or DTOs changed: rewrites openapi.yaml AND webapp/src/api
+bun run db:draft-changelog    # entities changed (needs Docker); then prune the diff to real deltas
+bun run db:generate-erd-docs  # after any changelog change
 ```
 
 `generate:api:application-server:specs` **exits 0 having written nothing** when a port it needs is
@@ -69,7 +69,7 @@ busy — HTTP, management, or the JMX port it defaults to. Pass free ports; the
 ## 5. Run the tests your diff can break
 
 ```bash
-pnpm run test:webapp
+bun run test:webapp
 cd server && ./mvnw -pl application -am test -Dsurefire.includedGroups=unit -T 2C --batch-mode -q
 ```
 
@@ -85,11 +85,11 @@ A PR touching `server/`, `webapp/` or `docker/` needs a `.changeset/*.md` or `ve
 fails it.
 
 ```bash
-pnpm changeset          # user-facing: pick the bump, write the summary in the operator's voice
-pnpm changeset --empty  # no user-facing effect; say why in the body
+bun changeset          # user-facing: pick the bump, write the summary in the operator's voice
+bun changeset --empty  # no user-facing effect; say why in the body
 ```
 
-`pnpm changeset` is interactive — with no TTY, hand-write `.changeset/<slug>.md` (`.changeset/README.md`
+`bun changeset` is interactive — with no TTY, hand-write `.changeset/<slug>.md` (`.changeset/README.md`
 has the shape). The summary lands in `CHANGELOG.md` verbatim, so it names what an operator or user can
 now do, not a class or a file. **Pre-1.0, never pick `major`** — it would cut 1.0.0 and the gate
 rejects it; a breaking change rides in `minor` with `**Operators:** …` in the summary and a

.claude/skills/react-best-practices/AGENTS.md

@@ -1403,7 +1403,7 @@ Reduce SVG coordinate precision to decrease file size. The optimal precision dep
 **Automate with SVGO:**
 
 ```bash
-pnpm exec svgo --precision=1 --multipass icon.svg
+bun x svgo --precision=1 --multipass icon.svg
 ```
 
 ### 6.5 Prevent Hydration Mismatch Without Flickering

.claude/skills/react-best-practices/rules/rendering-svg-precision.md

@@ -24,5 +24,5 @@ Reduce SVG coordinate precision to decrease file size. The optimal precision dep
 **Automate with SVGO:**
 
 ```bash
-pnpm exec svgo --precision=1 --multipass icon.svg
+bun x svgo --precision=1 --multipass icon.svg
 ```

.claude/skills/storybook-components/RUBRIC.md

@@ -2,7 +2,7 @@
 
 Scope: `webapp/src/components/**` and their colocated `*.stories.tsx`. **Grade a diff, not the repo.**
 
-**Calibration contract.** A file that renders correctly, is formatted, passes `pnpm run check`, has a
+**Calibration contract.** A file that renders correctly, is formatted, passes `bun run check`, has a
 story per variant and a green a11y panel scores **C**. C is the floor for competent work, not a
 criticism. B costs deliberate design. A costs a rejected alternative written down. A+ is rare by
 construction — at most one dimension per PR should reach it.
@@ -192,7 +192,7 @@ Nearly every file carries `tags: ["autodocs"]`, so a JSDoc block above `meta` or
   (`webapp/src/components/admin/practice-catalog/SortableCatalogTree.stories.tsx` — the stories render
   a harness).
 
-`node scripts/check-story-prose.ts` gates `<p>` only. For the D band there is no gate — it is a review
+`bun scripts/check-story-prose.ts` gates `<p>` only. For the D band there is no gate — it is a review
 question: *delete this block; is anything lost?* Rather less than half the files carry a meta JSDoc and
 rather less than half the stories carry one, so the absence of a block is not by itself a finding.
 
@@ -201,7 +201,7 @@ rather less than half the stories carry one, so the absence of a block is not by
 - **D** — A new rule added to prose that contradicts existing code, with no migration and no gate.
 - **C** — Rule in prose, no gate.
 - **B** — Rule in prose plus a mechanical check — an oxlint rule in `webapp/tools/oxlint/rules/`, or a
-  node gate in `scripts/` wired into `pnpm run check`.
+  repository gate in `scripts/` wired into `bun run check`.
 - **A** — B, and the gate's own comment explains the neighbouring shapes it deliberately does *not*
   match, so nobody widens it into a nuisance — the house rules in `webapp/tools/oxlint/rules/` are the
   worked examples.

.claude/skills/storybook-components/SKILL.md

@@ -29,7 +29,7 @@ Load the one file that answers your question.
 
 ## Already enforced — do not re-litigate, and do not restate in prose
 
-These fail `pnpm run check`. Treat a violation as a build error, not a style opinion, and do not
+These fail `bun run check`. Treat a violation as a build error, not a style opinion, and do not
 write a guideline that repeats one.
 
 The house rules are registered in `webapp/tools/oxlint/index.ts` — read it rather than trusting a