fix(packaging): declare engines.node on published packages — Node 16 installs then fails on global fetch - #973
Merged
ralyodio merged 1 commit intoAug 19, 2026
Conversation
`@profullstack/sh1pt`, `-core` and `-policy` publish to npm without an `engines` field, but
the CLI depends on global `fetch` (login.ts, build.ts, cloud-vault.ts, core/setup-helpers.ts),
which Node only exposes from v18. A user on Node 16 installs cleanly and then hits
`ReferenceError: fetch is not defined` at first run instead of an install-time engine warning.
Declares `"engines": { "node": ">=20" }` — Node 20 is the oldest maintained LTS that has
global fetch and covers the ES2022 output target. mise.toml pins 22 and CI runs 22 (threatcrush
uses 20), so >=20 is satisfied by every environment the project already builds and tests in.
Tighten to >=22 if you prefer the declared floor to match mise exactly.
Only the three published packages are touched; the private root is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #972, as offered there.
Problem
The three published packages declare no
enginesfield:@profullstack/sh1pt@profullstack/sh1pt-core@profullstack/sh1pt-policyThe CLI relies on global
fetch, which Node only exposes from v18:packages/cli/src/commands/login.ts—/api/v1/cli/pair,/api/v1/cli/claimpackages/cli/src/commands/build.ts— HEAD/GET probespackages/cli/src/cloud-vault.ts—authedFetchpackages/core/src/setup-helpers.ts— OAuth token exchangeWithout
engines, npm and pnpm cannot warn. A user on Node 16 gets a clean install and thenReferenceError: fetch is not definedon first run — an error that points at nothing actionable.Fix
Declare
"engines": { "node": ">=20" }on the three published packages.Why
>=20rather than>=18or>=22:>=18is the bare functional floor (global fetch) but Node 18 is out of maintenance.>=20is the oldest maintained LTS with global fetch, and matches the ES2022 output target.mise.tomlpins Node 22 and the workflows run 22 (threatcrush-scanuses 20), so everyenvironment the project already builds and tests in satisfies
>=20.Happy to change it to
>=22so the declared floor matchesmise.tomlexactly — one-line edit,just say which you prefer.
Scope
Three
package.jsonfiles, additive only. The private root package is untouched. No source,dependency, or build changes. Existing key order and formatting preserved.