@moinulmoin/eden 0.7.3 → 0.8.0

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.7.3
+npm install --global @moinulmoin/eden@0.8.0
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.7.3
+pnpm add --global @moinulmoin/eden@0.8.0
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.7.3
+bun add --global @moinulmoin/eden@0.8.0
 ```
 
 Then confirm the CLI is available:
@@ -92,8 +92,8 @@ eden deploy \
   --env-file ~/.config/my-eve-app/preview.env
 ```
 
-`eden preflight` is an optional read-only diagnostic. You do not need to run it
-before `deploy`:
+`eden preflight` is an optional diagnostic that changes nothing on
+Cloudflare. You do not need to run it before `deploy`:
 
 ```sh
 eden preflight \
@@ -151,6 +151,11 @@ Run `eden <command> --help` for command-specific options.
 - [Documentation index](https://github.com/moinulmoin/eden/blob/main/docs/README.md)
 - [Installation](https://github.com/moinulmoin/eden/blob/main/docs/install.md)
 - [Deploying Eve projects](https://github.com/moinulmoin/eden/blob/main/docs/deploy.md)
+- [How Eden works](https://github.com/moinulmoin/eden/blob/main/docs/how-it-works.md)
+- [Security](https://github.com/moinulmoin/eden/blob/main/docs/security.md)
+- [FAQ](https://github.com/moinulmoin/eden/blob/main/docs/faq.md)
+- [Reference](https://github.com/moinulmoin/eden/blob/main/docs/reference.md)
+- [Troubleshooting](https://github.com/moinulmoin/eden/blob/main/docs/troubleshooting.md)
 - [Validation and cleanup](https://github.com/moinulmoin/eden/blob/main/docs/validation.md)
 
 ## License

package/dist/eve-control-plane.js

@@ -214,10 +214,82 @@ function pooledPostgresReason(connectionString) {
     return undefined;
 }
 /**
- * Non-blocking World warnings. The container wipes its disk on sleep, so the
- * default local World loses pending approvals and sessions; and a pooled
- * Postgres URL breaks the World streamer, which relies on LISTEN/NOTIFY.
+ * Recognizes the generated channel, not arbitrary user authentication policies.
+ * The calls below match the Eve 0.82 initializer's agent/channels/eve.ts.
  */
+async function collectEveSetupWarnings(projectRoot) {
+    const warnings = [];
+    const source = async (path) => {
+        try {
+            return await readFile(join(projectRoot, path), "utf8");
+        }
+        catch {
+            return "";
+        }
+    };
+    const channel = (await source("agent/channels/eve.ts"))
+        .replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/gu, "")
+        .replace(/\s+/gu, "");
+    if (/exportdefaulteveChannel\(\{auth:\[vercelOidc\(\),localDev\(\),placeholderAuth\(\),?\],?\}\);?$/u
+        .test(channel)) {
+        warnings.push({
+            id: "EVE_AUTH_SCAFFOLD",
+            message: "Eve's generated channel auth does not grant Cloudflare callers access.",
+            remediation: "Replace agent/channels/eve.ts auth with your app's authenticator; put credentials in --env-file.",
+        });
+    }
+    try {
+        const manifest = JSON.parse(await source("package.json"));
+        const agent = await source("agent/agent.ts");
+        if (/export\s+default\s+defineAgent\s*\(\s*\{\s*model\s*:\s*["'][^"']+["']\s*,\s*reasoning\s*:\s*["'][^"']+["']\s*,?\s*\}\s*\)/u.test(agent)) {
+            warnings.push({
+                id: "EVE_WORLD_LOCAL",
+                message: "Local World stores memory on container disk; updates or a lost sleep snapshot reset sessions and approvals.",
+                remediation: "Configure @workflow/world-postgres; see docs/deploy.md#durable-state-postgres-world.",
+            });
+        }
+        if (manifest.dependencies?.["just-bash"] === undefined &&
+            agent.length > 0 &&
+            !/\bsandbox\s*:/u.test(agent)) {
+            const command = manifest.packageManager?.startsWith("pnpm@")
+                ? "pnpm add just-bash"
+                : "npm install just-bash";
+            warnings.push({
+                id: "EVE_JUST_BASH_MISSING",
+                message: "Eve's default sandbox needs the just-bash production dependency in Eden's builder.",
+                remediation: `Run ${command}, commit the updated manifest and lockfile, then retry.`,
+            });
+        }
+        if (!manifest.packageManager?.startsWith("pnpm@")) {
+            const lockText = await source("package-lock.json");
+            // Same trust level as the manifest above: npm wrote it; packaging validates it.
+            const lock = JSON.parse(lockText === "" ? "{}" : lockText);
+            const entries = lock.packages ?? {};
+            const skipped = new Set();
+            for (const [path, entry] of Object.entries(entries)) {
+                const at = path.lastIndexOf("node_modules/");
+                if (at !== -1 &&
+                    entry.hasInstallScript === true &&
+                    entry.dev !== true &&
+                    entry.optional !== true &&
+                    entry.devOptional !== true) {
+                    skipped.add(path.slice(at + "node_modules/".length));
+                }
+            }
+            if (skipped.size > 0) {
+                warnings.push({
+                    id: "EVE_NPM_INSTALL_SCRIPTS_SKIPPED",
+                    message: `Eden's npm install skips dependency install scripts; these production dependencies have one and may fail at runtime: ${[...skipped].sort().join(", ")}.`,
+                    remediation: "Use packages that need no install script, or switch to exact-pinned pnpm and list them under allowBuilds in pnpm-workspace.yaml.",
+                });
+            }
+        }
+    }
+    catch {
+        // Packaging reports invalid manifests; setup hints must not mask that result.
+    }
+    return warnings;
+}
 async function collectEveWorldWarnings(candidate, runtimeConfig) {
     const warnings = [];
     if (candidate !== undefined) {
@@ -227,7 +299,7 @@ async function collectEveWorldWarnings(candidate, runtimeConfig) {
             world === "@workflow/world-local") {
             warnings.push({
                 id: "EVE_WORLD_LOCAL",
-                message: "This project uses Eve's default local Workflow World; workflow state lives on the container disk, survives sleep, and resets when you update the agent.",
+                message: "Local World stores memory on container disk; updates or a lost sleep snapshot reset sessions and approvals.",
                 remediation: "Configure a durable Workflow World such as @workflow/world-postgres; see docs/deploy.md#durable-state-postgres-world.",
             });
         }
@@ -1981,6 +2053,7 @@ async function collectEvePreflight(request, options) {
             runtimeConfig,
         };
     }
+    warnings.push(...await collectEveSetupWarnings(request.projectRoot));
     eveProgress(options, "packaging project — snapshot, frozen install, eve build");
     const nodeImage = options.nodeImage ?? DEFAULT_EVE_NODE_IMAGE;
     const artifactRoot = options.artifactRoot ??
@@ -2087,6 +2160,10 @@ async function collectEvePreflight(request, options) {
     if (workflowWorld === "@moinulmoin/eden-world-cloudflare") {
         checks.push(check("EVE-WORLD", "passed", "world: Cloudflare Durable Object"));
     }
+    // Compiled configuration supersedes the early generated-source hint.
+    const localHint = warnings.findIndex((warning) => warning.id === "EVE_WORLD_LOCAL");
+    if (localHint !== -1)
+        warnings.splice(localHint, 1);
     warnings.push(...(await collectEveWorldWarnings(candidate, undefined)));
     const schedules = await readCompiledSchedules(candidate);
     const expressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) !== undefined);

package/dist/eve-packaging.d.ts

@@ -19,18 +19,15 @@ export interface EveNodeImage {
     readonly reference: string;
     readonly digest: string;
 }
+export type EvePackageManager = "pnpm" | "npm";
+export type EveInstallCommand = readonly ["corepack", "pnpm", "install", "--frozen-lockfile"] | readonly ["npm", "ci", "--ignore-scripts", "--no-audit", "--no-fund"];
 export interface EveProjectBuilderRequest {
     readonly generationRoot: string;
     readonly snapshotRoot: string;
     readonly inputManifestPath: string;
     readonly dockerfilePath: string | undefined;
     readonly packageManagerVersion: string;
-    readonly installCommand: readonly [
-        "corepack",
-        "pnpm",
-        "install",
-        "--frozen-lockfile"
-    ];
+    readonly installCommand: EveInstallCommand;
     readonly buildCommand: readonly ["./node_modules/.bin/eve", "build"];
     readonly platform: "linux/amd64";
     readonly sourceDigest: string;
@@ -75,7 +72,7 @@ export interface EveProjectInputManifest {
     readonly requestedRoot: string;
     readonly canonicalRoot: string;
     readonly projectId: string;
-    readonly packageManager: "pnpm";
+    readonly packageManager: EvePackageManager;
     readonly packageManagerVersion: string;
     readonly packageJsonSha256: string;
     readonly lockfileSha256: string;
@@ -123,14 +120,9 @@ export interface EveProjectBuildCandidate {
     readonly generationRoot: string;
     readonly snapshotRoot: string;
     readonly inputManifestPath: string;
-    readonly packageManager: "pnpm";
+    readonly packageManager: EvePackageManager;
     readonly packageManagerVersion: string;
-    readonly installCommand: readonly [
-        "corepack",
-        "pnpm",
-        "install",
-        "--frozen-lockfile"
-    ];
+    readonly installCommand: EveInstallCommand;
     readonly buildCommand: readonly ["./node_modules/.bin/eve", "build"];
     readonly eveExecutable: "node_modules/.bin/eve";
     readonly eveVersion: string;
@@ -145,14 +137,9 @@ export interface EveProjectBuildCandidate {
 }
 export interface EveProjectToolchain {
     readonly nodeVersion: "24.17.0";
-    readonly packageManager: "pnpm";
+    readonly packageManager: EvePackageManager;
     readonly packageManagerVersion: string;
-    readonly installCommand: readonly [
-        "corepack",
-        "pnpm",
-        "install",
-        "--frozen-lockfile"
-    ];
+    readonly installCommand: EveInstallCommand;
     readonly buildCommand: readonly ["./node_modules/.bin/eve", "build"];
     readonly startCommand: readonly [
         "./node_modules/.bin/eve",
@@ -227,7 +214,7 @@ export interface EveProjectPackagingResult {
             readonly sha256: string;
         };
         readonly lockfile: {
-            readonly path: "pnpm-lock.yaml";
+            readonly path: "pnpm-lock.yaml" | "package-lock.json";
             readonly sha256: string;
         };
         readonly sourceDigest: string;

package/dist/eve-packaging.js

@@ -167,6 +167,9 @@ const INSTALL_COMMAND = [
     "install",
     "--frozen-lockfile",
 ];
+const NPM_INSTALL_COMMAND = ["npm", "ci", "--ignore-scripts", "--no-audit", "--no-fund"];
+// Install this exact isolated manager without consulting project npm configuration.
+const NPM_VERSION = "11.13.0";
 const BUILD_COMMAND = ["./node_modules/.bin/eve", "build"];
 const EVE_ENTRYPOINT = ".output/server/index.mjs";
 const EVE_EXCLUDED_DIRECTORY_NAMES = new Set([
@@ -201,6 +204,7 @@ const EVE_COMPETING_LOCKFILES = new Set([
     "bun.lock",
     "bun.lockb",
     "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
     "package-lock.json",
     "yarn.lock",
 ]);
@@ -548,37 +552,76 @@ function validateProjectContract(inputs) {
             remediation: "Add a non-empty package.json name and retry.",
         });
     }
-    const packageManagerVersion = parsePnpmVersion(packageValue.packageManager);
-    const lockFiles = inputs.files.filter((file) => file.relativePath === "pnpm-lock.yaml" ||
-        file.relativePath.endsWith("/pnpm-lock.yaml"));
-    if (lockFiles.length !== 1 || lockFiles[0]?.relativePath !== "pnpm-lock.yaml") {
+    const npmLock = inputs.files.find((file) => file.relativePath === "package-lock.json");
+    const packageManager = npmLock === undefined ? "pnpm" : "npm";
+    const lockfilePath = packageManager === "npm" ? "package-lock.json" : "pnpm-lock.yaml";
+    const npmPin = typeof packageValue.packageManager === "string"
+        ? /^npm@((?:[7-9]|[1-9][0-9]+)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*))$/u.exec(packageValue.packageManager)?.[1]
+        : undefined;
+    const packageManagerVersion = packageManager === "pnpm"
+        ? parsePnpmVersion(packageValue.packageManager)
+        : npmPin ?? NPM_VERSION;
+    const lockFiles = inputs.files.filter((file) => file.relativePath === lockfilePath || file.relativePath.endsWith(`/${lockfilePath}`));
+    if (lockFiles.length !== 1 || lockFiles[0]?.relativePath !== lockfilePath) {
         throw new EvePackagingError({
             code: "DEPENDENCY_AMBIGUITY",
-            subject: "pnpm-lock.yaml",
-            reason: "The selected Eve root must contain exactly one regular root pnpm-lock.yaml.",
+            subject: lockfilePath,
+            reason: "The selected Eve root must contain exactly one regular root lockfile.",
             remediation: "Remove competing or nested lockfiles and retry with the matching root lockfile.",
         });
     }
-    const competing = inputs.files.find((file) => EVE_COMPETING_LOCKFILES.has(basename(file.relativePath)));
+    const competing = inputs.files.find((file) => EVE_COMPETING_LOCKFILES.has(basename(file.relativePath)) && file.relativePath !== lockfilePath);
     if (competing !== undefined) {
         throw new EvePackagingError({
             code: "DEPENDENCY_AMBIGUITY",
             subject: competing.relativePath,
             reason: "A competing package-manager lockfile was found at the selected Eve root.",
-            remediation: "Keep only the pinned pnpm toolchain and its matching root lockfile.",
+            remediation: "Keep only one supported package manager and its matching root lockfile.",
+        });
+    }
+    if (packageManager === "npm" && packageValue.packageManager !== undefined &&
+        npmPin === undefined) {
+        throw new EvePackagingError({
+            code: "UNSUPPORTED_TOOLCHAIN",
+            subject: "package.json.packageManager",
+            reason: "npm projects may omit packageManager or declare an exact npm version (major 7 or newer).",
+            remediation: `Remove the optional packageManager field to use npm@${NPM_VERSION}, or declare an exact npm@<major>.<minor>.<patch> pin.`,
         });
     }
     const lockfile = lockFiles[0];
-    if (lockfile === undefined || !lockfileMatchesPnpm(packageManagerVersion, lockfile.bytes)) {
+    let npmLockValid = false;
+    if (packageManager === "npm" && lockfile !== undefined) {
+        try {
+            const parsed = JSON.parse(lockfile.bytes.toString("utf8"));
+            npmLockValid = (parsed.lockfileVersion === 2 || parsed.lockfileVersion === 3) &&
+                parsed.packages !== null && typeof parsed.packages === "object" &&
+                !Array.isArray(parsed.packages) && parsed.packages[""] !== undefined;
+            for (const entry of Object.values(parsed.packages ?? {})) {
+                const dependency = entry;
+                if (typeof dependency.resolved === "string" &&
+                    !dependency.resolved.startsWith("https://registry.npmjs.org/"))
+                    npmLockValid = false;
+            }
+        }
+        catch {
+            npmLockValid = false;
+        }
+    }
+    if (lockfile === undefined || (packageManager === "pnpm"
+        ? !lockfileMatchesPnpm(packageManagerVersion, lockfile.bytes)
+        : !npmLockValid)) {
         throw new EvePackagingError({
             code: "DEPENDENCY_AMBIGUITY",
-            subject: "pnpm-lock.yaml",
-            reason: "The root pnpm-lock.yaml is malformed or does not match the exact packageManager pin.",
-            remediation: "Regenerate the lockfile with the declared pnpm version, without changing it during packaging.",
+            subject: lockfilePath,
+            reason: "The root lockfile is malformed or incompatible with the selected package manager or public registry.",
+            remediation: "Regenerate the root lockfile with the selected manager and public npm registry; private registries and project .npmrc configuration are not supported.",
         });
     }
     return {
         projectId,
+        packageManager,
+        lockfilePath,
+        installCommand: packageManager === "npm" ? NPM_INSTALL_COMMAND : INSTALL_COMMAND,
         packageManagerVersion,
         packageJsonSha256: packageFile.sha256,
         lockfileSha256: lockfile.sha256,
@@ -1077,7 +1120,7 @@ export async function eveSnapshotSourceEntries(snapshotRoot) {
 }
 async function writeDockerBuildFiles(options) {
     const image = imageReference(options.nodeImage, "The Linux/amd64 builder requires an immutable Node 24 image digest.", "Supply a verified Node 24 image reference and sha256 digest.");
-    const installSources = ["package.json", "pnpm-lock.yaml"];
+    const installSources = ["package.json", options.lockfilePath];
     if ((await lstat(join(options.snapshotRoot, "pnpm-workspace.yaml"))
         .catch(() => undefined))?.isFile() === true) {
         installSources.push("pnpm-workspace.yaml");
@@ -1085,17 +1128,27 @@ async function writeDockerBuildFiles(options) {
     const runtimeSourceCopies = (await eveSnapshotSourceEntries(options.snapshotRoot))
         .map((name) => `COPY --from=builder ${JSON.stringify([`/workspace/${name}`, `/app/${name}`])}`)
         .join("\n");
+    const npm = options.packageManager === "npm";
+    const lockCheck = `test "$(sha256sum ${options.lockfilePath} | cut -d ' ' -f1)" = "${options.lockfileSha256}"`;
+    const managerSetup = npm
+        ? `npm install --global npm@${options.packageManagerVersion} --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org/ && test "$(npm --version)" = "${options.packageManagerVersion}"`
+        : `corepack enable && corepack prepare pnpm@${options.packageManagerVersion} --activate && test "$(corepack pnpm --version)" = "${options.packageManagerVersion}"`;
+    const install = npm
+        ? "npm ci --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org/"
+        : "corepack pnpm install --frozen-lockfile --config.node-linker=hoisted --config.strict-dep-builds=false";
+    const productionInstall = npm
+        ? `${install} --omit=dev`
+        : "corepack pnpm install --frozen-lockfile --prod --config.node-linker=hoisted --config.strict-dep-builds=false";
+    const policy = npm ? "" : ` && ${IGNORED_BUILDS_GUARD}`;
     const dockerfile = `# syntax=docker/dockerfile:1
 FROM --platform=linux/amd64 ${image} AS builder
 WORKDIR /workspace
 COPY ${JSON.stringify([...installSources, "./"])}
-RUN corepack enable \\
-  && corepack prepare pnpm@${options.packageManagerVersion} --activate \\
-  && test "$(corepack pnpm --version)" = "${options.packageManagerVersion}" \\
-  && test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f1)" = "${options.lockfileSha256}" \\
-  && corepack pnpm install --frozen-lockfile --config.node-linker=hoisted --config.strict-dep-builds=false \\
-  && ${IGNORED_BUILDS_GUARD}
-${EVE_SANDBOX_RESUME_PATCH_DOCKERFILE_STEP}RUN test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f1)" = "${options.lockfileSha256}"
+RUN ${managerSetup} \\
+  && ${lockCheck} \\
+  && ${install}${policy} \\
+  && ${lockCheck}
+${EVE_SANDBOX_RESUME_PATCH_DOCKERFILE_STEP}RUN ${lockCheck}
 COPY . ./
 RUN test -x ./node_modules/.bin/eve \\
   && ./node_modules/.bin/eve build \\
@@ -1103,10 +1156,10 @@ RUN test -x ./node_modules/.bin/eve \\
 
 FROM builder AS runtime-deps
 RUN rm -rf node_modules \\
-  && corepack pnpm install --frozen-lockfile --prod --config.node-linker=hoisted --config.strict-dep-builds=false \\
-  && ${IGNORED_BUILDS_GUARD} \\
+  && ${productionInstall}${policy} \\
+  && ${lockCheck} \\
   && for l in node_modules/.bin/*; do t=$(readlink "$l") || continue; case "$t" in /*) ln -sfn "$(realpath --relative-to=node_modules/.bin "$t")" "$l" ;; esac; done
-${EVE_SANDBOX_RESUME_PATCH_DOCKERFILE_STEP}
+${EVE_SANDBOX_RESUME_PATCH_DOCKERFILE_STEP}RUN ${lockCheck}
 
 FROM --platform=linux/amd64 ${image} AS runtime
 WORKDIR /app
@@ -1627,13 +1680,24 @@ function classifyPnpmInstallFailure(stderr) {
     }
     return undefined;
 }
+function classifyNpmInstallFailure(stderr) {
+    if (!/\bnpm (?:ci|install|error|ERR!)/u.test(stderr))
+        return undefined;
+    const code = /npm (?:error|ERR!) code ([A-Z0-9_]+)/u.exec(stderr)?.[1];
+    return new EvePackagingError({
+        code: "DEPENDENCY_AMBIGUITY",
+        subject: code === undefined ? "frozen npm install" : `npm ${code}`,
+        reason: "The isolated pinned npm install could not complete with the captured lockfile and disabled lifecycle scripts.",
+        remediation: "Fix the reported npm failure; regenerate package-lock.json with the selected exact npm version if it is out of sync. Use public registry dependencies without .npmrc credentials or dependency build scripts.",
+    });
+}
 function classifyEveBuildFailure(stderr) {
     if (/\bjust-bash\b/u.test(stderr)) {
         return new EvePackagingError({
             code: "EVE_BUILD_FAILED",
             subject: "eve build",
             reason: "The project-local Eve build failed inside the isolated Linux/amd64 builder because Eve's default sandbox needs just-bash where no Docker daemon or /dev/kvm exists.",
-            remediation: "Declare just-bash as a production dependency of the Eve project, regenerate pnpm-lock.yaml, and retry.",
+            remediation: "Declare just-bash as a production dependency of the Eve project, regenerate its package-manager lockfile, and retry.",
         });
     }
     return new EvePackagingError({
@@ -1655,6 +1719,9 @@ function classifyDockerBuildFailure(error) {
         if (/\beve\b/u.test(step) && /\bbuild\b/u.test(step)) {
             return classifyEveBuildFailure(stderr);
         }
+        if (/\bnpm\b/u.test(step)) {
+            return classifyNpmInstallFailure(`npm ci\n${stderr}`);
+        }
         if (/pnpm|corepack/u.test(step)) {
             const pnpmFailure = classifyPnpmInstallFailure(stderr);
             if (pnpmFailure !== undefined)
@@ -1670,6 +1737,9 @@ function classifyDockerBuildFailure(error) {
     const pnpmFailure = classifyPnpmInstallFailure(stderr);
     if (pnpmFailure !== undefined)
         return pnpmFailure;
+    const npmFailure = classifyNpmInstallFailure(stderr);
+    if (npmFailure !== undefined)
+        return npmFailure;
     if (/\bjust-bash\b|Cannot find package/u.test(stderr)) {
         return classifyEveBuildFailure(stderr);
     }
@@ -1915,7 +1985,7 @@ export async function buildEveProjectSnapshot(options) {
         requestedRoot: roots.requestedRoot,
         canonicalRoot: roots.canonicalRoot,
         projectId: contract.projectId,
-        packageManager: "pnpm",
+        packageManager: contract.packageManager,
         packageManagerVersion: contract.packageManagerVersion,
         packageJsonSha256: contract.packageJsonSha256,
         lockfileSha256: contract.lockfileSha256,
@@ -1965,6 +2035,8 @@ export async function buildEveProjectSnapshot(options) {
                 snapshotRoot,
                 dockerfilePath,
                 nodeImage,
+                packageManager: contract.packageManager,
+                lockfilePath: contract.lockfilePath,
                 packageManagerVersion: contract.packageManagerVersion,
                 lockfileSha256: contract.lockfileSha256,
             });
@@ -1977,7 +2049,7 @@ export async function buildEveProjectSnapshot(options) {
             inputManifestPath,
             dockerfilePath: actualDockerfilePath,
             packageManagerVersion: contract.packageManagerVersion,
-            installCommand: INSTALL_COMMAND,
+            installCommand: contract.installCommand,
             buildCommand: BUILD_COMMAND,
             platform: "linux/amd64",
             sourceDigest: initialInputs.sourceDigest,
@@ -2009,14 +2081,14 @@ export async function buildEveProjectSnapshot(options) {
             const cleanupError = await discardBuiltCandidate();
             return blockedResult(cleanupError ?? afterBuildRace, { writtenPaths });
         }
-        const snapshotLockfile = await readStableFile(join(snapshotRoot, "pnpm-lock.yaml"), snapshotRoot);
+        const snapshotLockfile = await readStableFile(join(snapshotRoot, contract.lockfilePath), snapshotRoot);
         if (snapshotLockfile.sha256 !== contract.lockfileSha256 ||
             !snapshotLockfile.bytes.equals(contract.lockfileBytes)) {
             const dependencyError = new EvePackagingError({
                 code: "DEPENDENCY_AMBIGUITY",
-                subject: "pnpm-lock.yaml",
+                subject: contract.lockfilePath,
                 reason: "The frozen install changed the captured lockfile bytes.",
-                remediation: "Use the exact declared pnpm version with pnpm install --frozen-lockfile.",
+                remediation: "Use the selected exact package manager with its frozen install command.",
             });
             const cleanupError = await discardBuiltCandidate();
             return blockedResult(cleanupError ?? dependencyError, { writtenPaths });
@@ -2031,9 +2103,9 @@ export async function buildEveProjectSnapshot(options) {
         await writeJson(runtimeManifestPath, {
             version: 1,
             generationId: basename(generationRoot),
-            packageManager: "pnpm",
+            packageManager: contract.packageManager,
             packageManagerVersion: contract.packageManagerVersion,
-            installCommand: INSTALL_COMMAND,
+            installCommand: contract.installCommand,
             buildCommand: BUILD_COMMAND,
             startCommand: START_COMMAND,
             sourceDigest: initialInputs.sourceDigest,
@@ -2093,7 +2165,7 @@ export async function buildEveProjectSnapshot(options) {
                 sha256: contract.packageJsonSha256,
             },
             lockfile: {
-                path: "pnpm-lock.yaml",
+                path: contract.lockfilePath,
                 sha256: contract.lockfileSha256,
             },
             sourceDigest: initialInputs.sourceDigest,
@@ -2104,9 +2176,9 @@ export async function buildEveProjectSnapshot(options) {
             generationRoot,
             snapshotRoot,
             inputManifestPath,
-            packageManager: "pnpm",
+            packageManager: contract.packageManager,
             packageManagerVersion: contract.packageManagerVersion,
-            installCommand: INSTALL_COMMAND,
+            installCommand: contract.installCommand,
             buildCommand: BUILD_COMMAND,
             eveExecutable: "node_modules/.bin/eve",
             eveVersion: eve.version,
@@ -2137,9 +2209,9 @@ export async function buildEveProjectSnapshot(options) {
             snapshot,
             toolchain: {
                 nodeVersion: "24.17.0",
-                packageManager: "pnpm",
+                packageManager: contract.packageManager,
                 packageManagerVersion: contract.packageManagerVersion,
-                installCommand: INSTALL_COMMAND,
+                installCommand: contract.installCommand,
                 buildCommand: BUILD_COMMAND,
                 startCommand: START_COMMAND,
                 eveExecutable: eve.path,
@@ -2172,7 +2244,7 @@ export async function buildEveProjectSnapshot(options) {
                     id: "VAL-BUILD-001",
                     status: "pass",
                     subject: "package-manager",
-                    reason: "The exact pnpm pin and one matching regular root lockfile were verified.",
+                    reason: "The selected package manager and one matching regular root lockfile were verified.",
                     remediation: null,
                 },
                 {
@@ -2287,7 +2359,7 @@ export async function revalidateEveProjectCandidateInputs(candidate, runtimeConf
     }
     const observedLatest = latest ?? fail();
     const packageFile = observedLatest.files.find((file) => file.relativePath === "package.json");
-    const lockfile = observedLatest.files.find((file) => file.relativePath === "pnpm-lock.yaml");
+    const lockfile = observedLatest.files.find((file) => file.relativePath === (candidate.packageManager === "npm" ? "package-lock.json" : "pnpm-lock.yaml"));
     if (packageFile === undefined ||
         lockfile === undefined ||
         packageFile.sha256 !== candidate.packageJsonSha256 ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.7.3",
+  "version": "0.8.0",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -31,7 +31,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.7.3",
+    "@moinulmoin/eden-runtime-cloudflare": "0.8.0",
     "wrangler": "4.147.0"
   },
   "devDependencies": {