chore: align pnpm 11 requirements across docs and workspace

apps/docs/content/docs/ai/getting-started.mdx

@@ -14,7 +14,8 @@ Each step below maps to **one guide**: install and connect (single walkthrough),
 Ensure you have the following prerequisites installed on your computer before installing ProofKit.
 - FileMaker Pro (client for Mac or Windows)
 - MCP-compatible coding agent (e.g. [Cursor](https://cursor.com), [Claude](https://claude.ai), [Codex](https://chatgpt.com/codex/), etc.)
-- [Node.js](https://nodejs.org/en/download/) (a supported LTS release, such as 22.x or 24.x)
+- [Node.js](https://nodejs.org/en/download/) (a supported LTS release, such as 22.x, 24.x, or 26.x)
+- [pnpm](https://pnpm.io/) (version 11 is recommended; it is currently the most secure package manager option)
 - Git (source control tool for managing the web code your agent will produce)
 
 If you are using a chat-first tool such as Claude Desktop or ChatGPT, you can still use ProofKit to explore FileMaker metadata and data. Building Web Viewer apps requires a coding agent that can work in a project folder. See [Chat Mode vs Code Mode](/docs/ai/chat-vs-code-mode) for the difference.

apps/docs/content/docs/ai/technical-requirements.mdx

@@ -19,6 +19,7 @@ To build ProofKit apps, you need:
 
 - **FileMaker Pro** with the target file open.
 - **Node.js LTS** installed locally. Choose a release that is explicitly marked LTS. Today that means **Node.js 22**, **Node.js 24**, or **Node.js 26**.
+- **pnpm** version 11 is recommended. It is currently the most secure package manager option.
 - **An MCP-compatible coding agent**, such as Cursor, Claude Code, Codex, OpenCode, or another agent that supports MCP servers.
 
 FileMaker Server is not required for the development loop. ProofKit can work against a local or hosted file as long as it is open in FileMaker Pro.
@@ -64,6 +65,19 @@ If you are not already managing Node versions, the native installer from nodejs.
   </Tab>
 </Tabs>
 
+## pnpm
+
+ProofKit projects use `pnpm` for workspace installs, scripts, and monorepo tooling. We recommend **pnpm 11** because it is the fastest and most secure package manager available for the Node.js ecosystem.
+
+- Learn more: [pnpm.io](https://pnpm.io/)
+- Installation guide: [pnpm installation docs](https://pnpm.io/installation)
+
+After installing, verify your version:
+
+```sh
+pnpm -v
+```
+
 ## Developer background
 
 You do not need to be a web developer to get started. Familiarity with React, TypeScript, a terminal, and Git will help, but the workflow is designed so the agent does much of the setup and implementation work.

package.json

@@ -44,7 +44,7 @@
     "varlock": "^0.6.4",
     "vitest": "^4.0.17"
   },
-  "packageManager": "pnpm@11.0.0",
+  "packageManager": "pnpm@11.1.0",
   "engines": {
     "node": ">=18"
   },

packages/cli/tests/integration.test.ts

@@ -51,7 +51,7 @@ describe("integration scaffold generation", () => {
       }),
       {
         templateDir: getSharedTemplateDir("nextjs-shadcn"),
-        packageManagerVersion: "10.27.0",
+        packageManagerVersion: "11.1.0",
       },
     );
 
@@ -66,7 +66,7 @@ describe("integration scaffold generation", () => {
       await readScaffoldArtifacts(projectDir);
 
     expect(packageJson.name).toBe("browser-app");
-    expect(packageJson.packageManager).toBe("pnpm@10.27.0");
+    expect(packageJson.packageManager).toBe("pnpm@11.1.0");
     expect(packageJson.proofkitMetadata).toMatchObject({
       scaffoldPackage: "@proofkit/cli",
     });

packages/cli/tests/live-git-init.test.ts

@@ -41,7 +41,7 @@ describe("live git init", () => {
     vi.clearAllMocks();
     execaMock.mockImplementation((command: string, args: string[]) => {
       if (command === "pnpm" && args[0] === "-v") {
-        return Promise.resolve({ stdout: "10.27.0" });
+        return Promise.resolve({ stdout: "11.1.0" });
       }
 
       if (command === "git" && args[0] === "commit") {

packages/cli/tests/test-layer.ts

@@ -334,7 +334,7 @@ export function makeTestLayer(options: {
       },
     }),
     Layer.succeed(PackageManagerService, {
-      getVersion: () => Effect.succeed("10.27.0"),
+      getVersion: () => Effect.succeed("11.1.0"),
     }),
     Layer.succeed(ProcessService, {
       run: (command: string, args: string[]) => {

packages/registry/package.json

@@ -41,7 +41,7 @@
   ],
   "author": "",
   "license": "ISC",
-  "packageManager": "pnpm@10.14.0",
+  "packageManager": "pnpm@11.1.0",
   "devDependencies": {
     "@vitest/coverage-v8": "^2.1.9",
     "chokidar-cli": "^3.0.0",