Migrate Yarn 4 PnP to pnpm 11, and repair the quality gates that were hiding

.claude/agents/a11y-auditor.md

@@ -10,7 +10,7 @@ tools: Read, Grep, Glob, Bash
 You audit accessibility for cooperability.com.
 
 1. Read `.claude/cli/accessibility/COMMANDS.md` (or `.cursor/cli/accessibility/COMMANDS.md`).
-2. Prefer static review first (`yarn lint` / jsx-a11y). Run `yarn access` only if the user wants a full axe + Lighthouse pass (slow; needs free :3000).
+2. Prefer static review first (`pnpm lint` / jsx-a11y). Run `pnpm access` only if the user wants a full axe + Lighthouse pass (slow; needs free :3000).
 3. Check: semantics, labels, focus order, keyboard access, contrast (note theme false positives), ARIA misuse, alt text, form errors.
 4. Report a severity table (`Critical` / `High` / `Medium` / `Low`) with `file:line` and a concrete fix.
 5. Do not rewrite large UI without being asked; propose patches for the top issues.

.claude/agents/security-auditor.md

@@ -14,6 +14,6 @@ Follow the `security-testing` skill checklist. Extra attention here:
 - `dangerouslySetInnerHTML` / MDX HTML / SVG (`dangerouslyAllowSVG` in next.config)
 - Service worker registration and CSP implications
 - Any new `/api` or AI routes: key exposure, prompt injection, rate limits
-- Dependency advisories (`yarn audit:critical`, Dependabot)
+- Dependency advisories (`pnpm audit:critical`, Dependabot)
 
 Never write exploit PoCs against live systems. Report severity + `file:line` + fix sketch. Apply fixes only if asked.

.claude/agents/test-engineer.md

@@ -9,7 +9,7 @@ tools: Read, Grep, Glob, Bash, Edit, Write
 You own automated tests for this repo.
 
 1. Read `.claude/cli/test/COMMANDS.md`.
-2. Run tests with `yarn jest --ci --watchAll=false` (never `yarn test` watch mode).
+2. Run tests with `pnpm test` (never `pnpm test` watch mode).
 3. Prefer behavioral tests with `getByRole` / `getByLabelText` over implementation details.
 4. Place tests under `src/__tests__/` or beside features following existing layout.
 5. Fix failures caused by your changes; do not delete or weaken assertions to pass.

.claude/cli/accessibility/COMMANDS.md

@@ -4,9 +4,9 @@ Three layers in this repo (WCAG 2.1 AA oriented). Package manager: **Yarn 4**.
 
 | Layer | What | Command |
 |-------|------|---------|
-| Static ARIA / a11y | `eslint-plugin-jsx-a11y` via ESLint | `yarn lint` |
-| Runtime WCAG | `@axe-core/cli` (`wcag2aa`) | part of `yarn access` |
-| Lighthouse a11y | Lighthouse `--only-categories=accessibility` | part of `yarn access` |
+| Static ARIA / a11y | `eslint-plugin-jsx-a11y` via ESLint | `pnpm lint` |
+| Runtime WCAG | `@axe-core/cli` (`wcag2aa`) | part of `pnpm access` |
+| Lighthouse a11y | Lighthouse `--only-categories=accessibility` | part of `pnpm access` |
 
 Reports are gitignored under `accessibility-reports/`.
 
@@ -15,14 +15,14 @@ Reports are gitignored under `accessibility-reports/`.
 Starts Next dev server, then lint + axe + Lighthouse on key routes:
 
 ```bash
-yarn access
+pnpm access
 ```
 
 Under the hood (`access` → `access:run-audits`):
 
 1. `NEXT_PUBLIC_AXE_FORCE_THEME=light`
 2. Ensure `accessibility-reports/` exists
-3. `yarn lint` (includes jsx-a11y / ARIA static rules)
+3. `pnpm lint` (includes jsx-a11y / ARIA static rules)
 4. **axe-core** on:
    - `http://localhost:3000`
    - `http://localhost:3000/demos`
@@ -33,43 +33,43 @@ Under the hood (`access` → `access:run-audits`):
    - `accessibility-reports/lighthouse-report-demos.{json,html}`
    - `accessibility-reports/lighthouse-report-resources.{json,html}`
 
-**Agent notes:** Slow (minutes). Needs a free port `3000` (or stop an existing `yarn dev`). Run when the user asks for a11y / Lighthouse / axe — not on every unit-test pass.
+**Agent notes:** Slow (minutes). Needs a free port `3000` (or stop an existing `pnpm dev`). Run when the user asks for a11y / Lighthouse / axe — not on every unit-test pass.
 
 ## Static ARIA / jsx-a11y only (fast)
 
 ```bash
-yarn lint                 # ESLint incl. jsx-a11y (alt text, ARIA, semantics)
-yarn lint:mdx             # MDX subset
+pnpm lint                 # ESLint incl. jsx-a11y (alt text, ARIA, semantics)
+pnpm lint:mdx             # MDX subset
 ```
 
 ## Manual / partial runs (server already up)
 
-If `yarn dev` is already serving `http://localhost:3000`:
+If `pnpm dev` is already serving `http://localhost:3000`:
 
 ```bash
 # Create report dir
 node scripts/create-report-dir.js
 
 # axe only (WCAG 2 AA)
-yarn axe http://localhost:3000 http://localhost:3000/demos http://localhost:3000/resources \
+pnpm exec axe http://localhost:3000 http://localhost:3000/demos http://localhost:3000/resources \
   --tags wcag2aa \
   --save ./accessibility-reports/axe-report.json \
   --exit
 
 # Lighthouse accessibility only — one page
-yarn lighthouse http://localhost:3000 \
+pnpm exec lighthouse http://localhost:3000 \
   --output json --output html \
   --output-path ./accessibility-reports/lighthouse-report-home \
   --only-categories=accessibility \
   --chrome-flags='--headless --no-sandbox --disable-dev-shm-usage'
 
-yarn lighthouse http://localhost:3000/demos \
+pnpm exec lighthouse http://localhost:3000/demos \
   --output json --output html \
   --output-path ./accessibility-reports/lighthouse-report-demos \
   --only-categories=accessibility \
   --chrome-flags='--headless --no-sandbox --disable-dev-shm-usage'
 
-yarn lighthouse http://localhost:3000/resources \
+pnpm exec lighthouse http://localhost:3000/resources \
   --output json --output html \
   --output-path ./accessibility-reports/lighthouse-report-resources \
   --only-categories=accessibility \
@@ -79,7 +79,7 @@ yarn lighthouse http://localhost:3000/resources \
 Or run the packaged audit step (still expects server on :3000):
 
 ```bash
-yarn access:run-audits
+pnpm access:run-audits
 ```
 
 ## Review outputs
@@ -96,13 +96,13 @@ Known limits: axe may false-positive contrast on themed UI; theme states may nee
 
 ```bash
 # Unit tests only
-yarn jest --ci --watchAll=false
+pnpm test
 
 # Static a11y + unit
-yarn lint && yarn jest --ci --watchAll=false
+pnpm lint && pnpm test
 
 # Full a11y (axe + Lighthouse) when requested
-yarn access
+pnpm access
 ```
 
 ## Discover in any local project

.claude/cli/quality/COMMANDS.md

@@ -8,49 +8,49 @@
 ## Fast local gates
 
 ```bash
-yarn lint                 # ESLint (js/ts/tsx/mdx) incl. jsx-a11y / ARIA
-yarn lint:mdx             # MDX only
-yarn typecheck            # TypeScript --noEmit
-yarn format               # Prettier write (ask before large rewrites)
-yarn format:mdx           # MDX prettier
+pnpm lint                 # ESLint (js/ts/tsx/mdx) incl. jsx-a11y / ARIA
+pnpm lint:mdx             # MDX only
+pnpm typecheck            # TypeScript --noEmit
+pnpm format               # Prettier write (ask before large rewrites)
+pnpm format:mdx           # MDX prettier
 ```
 
 ## Automated tests (summary)
 
 ```bash
 # Jest (non-interactive)
-yarn jest --ci --watchAll=false
+pnpm test
 
 # Full a11y suite: lint + axe (WCAG2 AA) + Lighthouse a11y on /, /demos, /resources
-yarn access
+pnpm access
 ```
 
 ## Security
 
 ```bash
-yarn audit                # yarn npm audit
-yarn audit:critical       # fail on critical
-yarn audit:fix           # attempt automatic fixes (ask first)
+pnpm audit                # pnpm audit
+pnpm audit:critical       # fail on critical
+pnpm audit:fix           # attempt automatic fixes (ask first)
 ```
 
 ## Build / bundle
 
 ```bash
-yarn build                # next build + SW + sitemap (heavy)
-yarn analyze              # ANALYZE=true next build
+pnpm build                # next build + SW + sitemap (heavy)
+pnpm analyze              # ANALYZE=true next build
 ```
 
 ## Suggested agent sequences
 
 ```bash
 # After a code change (unit + static)
-yarn lint && yarn typecheck && yarn jest --ci --watchAll=false
+pnpm lint && pnpm typecheck && pnpm test
 
 # Before merge (hooks spirit)
-yarn audit:critical && yarn lint && yarn typecheck && yarn jest --ci --watchAll=false
+pnpm audit:critical && pnpm lint && pnpm typecheck && pnpm test
 
 # When user asks for accessibility / Lighthouse / ARIA runtime checks
-yarn access
+pnpm access
 ```
 
 ## Discover in any local project

.claude/cli/test/COMMANDS.md

@@ -1,45 +1,45 @@
 # Test CLI commands (Jest)
 
-Package manager: **Yarn 4 (PnP)**. Use `yarn` (not `npm`).
+Package manager: **pnpm 11**. Use `pnpm` (not `npm` or `yarn`).
 
 For axe / Lighthouse / ARIA audits → [../accessibility/COMMANDS.md](../accessibility/COMMANDS.md).
 
 ## Agent default (non-interactive)
 
-`yarn test` is **watch mode** — do **not** use it in agent/CI sessions.
+`pnpm test` is **watch mode** — do **not** use it in agent/CI sessions.
 
 ```bash
 # Full suite, single run (preferred)
-yarn jest --ci --watchAll=false
+pnpm test
 
 # Allow empty suite
-yarn jest --ci --watchAll=false --passWithNoTests
+pnpm test --passWithNoTests
 
 # Fail fast
-yarn jest --ci --watchAll=false --bail
+pnpm test --bail
 
 # One file / pattern
-yarn jest --ci --watchAll=false path/to/file.test.tsx
-yarn jest --ci --watchAll=false --testPathPattern=opioid
+pnpm test path/to/file.test.tsx
+pnpm test --testPathPattern=opioid
 
 # Related to staged/changed files (pre-commit style)
-yarn jest --bail --findRelatedTests --passWithNoTests --watchAll=false --ci <file...>
+pnpm jest --bail --findRelatedTests --passWithNoTests --watchAll=false --ci <file...>
 
 # Coverage
-yarn jest --ci --watchAll=false --coverage
+pnpm test --coverage
 ```
 
 ## Human / interactive
 
 ```bash
-yarn test                 # jest --watch
+pnpm test                 # jest --watch
 ```
 
 ## Related type gates
 
 ```bash
-yarn typecheck            # tsc --noEmit
-yarn test-types           # tsc --noEmit -p tsconfig.dev.json
+pnpm typecheck            # tsc --noEmit
+pnpm test-types           # tsc --noEmit -p tsconfig.dev.json
 ```
 
 ## Layout

.claude/skills/run-automated-tests/SKILL.md

@@ -22,15 +22,15 @@ Read (in order):
 
 | Intent | Command (this repo) |
 |--------|---------------------|
-| Default Jest suite | `yarn jest --ci --watchAll=false` |
+| Default Jest suite | `pnpm test` |
 | Fail fast | add `--bail` |
 | One area | path or `--testPathPattern=` |
 | Related to edits | `--findRelatedTests --passWithNoTests` on touched files |
-| Static ARIA / a11y | `yarn lint` |
-| Full axe + Lighthouse | `yarn access` (slow; needs :3000) |
+| Static ARIA / a11y | `pnpm lint` |
+| Full axe + Lighthouse | `pnpm access` (slow; needs :3000) |
 | + types/lint | see quality catalog |
 
-**Never** run `yarn test` in an agent session (it is watch mode). Do not run `yarn access` unless a11y/Lighthouse was requested.
+**Never** run `pnpm test` in an agent session (it is watch mode). Do not run `pnpm access` unless a11y/Lighthouse was requested.
 
 ## 3. Execute and report
 
@@ -44,7 +44,7 @@ Read (in order):
 When asked to “make sure CI would pass”:
 
 ```bash
-yarn lint && yarn typecheck && yarn jest --ci --watchAll=false
+pnpm lint && pnpm typecheck && pnpm test
 ```
 
-Add `yarn audit:critical` if security is in scope.
+Add `pnpm audit:critical` if security is in scope.

.cursor/agents/a11y-auditor.md

@@ -9,7 +9,7 @@ description: >-
 You audit accessibility for cooperability.com.
 
 1. Read `.cursor/cli/accessibility/COMMANDS.md`.
-2. Prefer static review first (`yarn lint` / jsx-a11y). Run `yarn access` only if the user wants a full axe + Lighthouse pass (slow; needs free :3000).
+2. Prefer static review first (`pnpm lint` / jsx-a11y). Run `pnpm access` only if the user wants a full axe + Lighthouse pass (slow; needs free :3000).
 3. Check: semantics, labels, focus order, keyboard access, contrast (note theme false positives), ARIA misuse, alt text, form errors.
 4. Report a severity table (`Critical` / `High` / `Medium` / `Low`) with `file:line` and a concrete fix.
 5. Do not rewrite large UI without being asked; propose patches for the top issues.

.cursor/agents/security-auditor.md

@@ -13,6 +13,6 @@ Follow the `security-testing` skill checklist. Extra attention here:
 - `dangerouslySetInnerHTML` / MDX HTML / SVG (`dangerouslyAllowSVG` in next.config)
 - Service worker registration and CSP implications
 - Any new `/api` or AI routes: key exposure, prompt injection, rate limits
-- Dependency advisories (`yarn audit:critical`, Dependabot)
+- Dependency advisories (`pnpm audit:critical`, Dependabot)
 
 Never write exploit PoCs against live systems. Report severity + `file:line` + fix sketch. Apply fixes only if asked.

.cursor/agents/test-engineer.md

@@ -8,7 +8,7 @@ description: >-
 You own automated tests for this repo.
 
 1. Read `.cursor/cli/test/COMMANDS.md`.
-2. Run tests with `yarn jest --ci --watchAll=false` (never `yarn test` watch mode).
+2. Run tests with `pnpm test` (never `pnpm test` watch mode).
 3. Prefer behavioral tests with `getByRole` / `getByLabelText` over implementation details.
 4. Place tests under `src/__tests__/` or beside features following existing layout.
 5. Fix failures caused by your changes; do not delete or weaken assertions to pass.