Retire Node 18, and take the patched test runner

[patchstackdave]

Two runtime contracts answer different questions and are tested separately.

Consumer support

The engines.node range moves from >=18 to >=20. This is the supported consumer floor: Node 18 is no longer tested, and package managers may warn or refuse installation there according to their engine policy. The artifact may still execute on Node 18, but that runtime is outside this package's supported range.

The floor is exercised as a consumer sees it:

• Pack the artifact builds the tarball on the release runtime from .node-version.
• Consumers on the declared Node floor reads the exact lowest version from engines.node, installs only that tarball with engine-strict, and runs six explicitly named package/runtime probes.
• The six probes cover ESM and CommonJS imports, screening through both published module formats, the installed CLI, and export-map encapsulation.
• The floor suite refuses to run if one of those probes is missing or acquires a fixture dependency. It cannot silently narrow to a smaller green suite.
• The ordinary consumer matrix continues to run all nine shapes on Node 22 across the supported package managers.

Only a plain >= floor is accepted by the version reader. A range it cannot map to one exact minimum is refused instead of guessed.

Maintainer toolchain

The maintainer toolchain requires ^20.19.0 || >=22.12.0. This is a union rather than one floor: Node 21 and Node 22.0 through 22.11 are outside it. Validation therefore pins exact 20.19.0 and 22.12.0 beside the current Node 20, 22, 24, and 26 lines, with strict engine checks enabled.

Vitest moves to 4.1.11, the first patched release for GHSA-82fw-gwwq-j7x9. The build target follows the consumer floor at node20. Runtime comments now describe the availability of web crypto rather than tying the fallback to one Node release, since edge runtimes expose different globals.

Release constraint

This change must ship as 0.5.0 using a minor release. RELEASING.md records the durable rule: while the package is 0.x, a compatibility break needs at least a minor release; from 1.0 onward it needs a major release.

Verified locally on this head

• exact Node 20.0.0 with npm 9.6.4: all 6 declared-floor consumer shapes pass against the packed artifact
• npm test: 170 files, 2,685 passed, 7 skipped
• npm run typecheck: clean; 8 templates checked
• npm run build: clean
• npm run verify:edge: no Node builtins in the edge bundle
• capability and rule-contract artifacts: up to date
• one signed commit based on current main

[coderbuds]

CI workflow and scripts clearly enforce the updated Node 20 floor with robust consumer testing.

🎯 Quality: 90% Elite · 📦 Size: Extra Large — strongly consider breaking this down

🛡️ Standards: no pre-flight fit check ran for this change — wire assess-change-fit into your coding agents to catch size before opening.

📈 This month: Your 209th PR — above team average · Averaging Good

_{See how your team is trending →}

[patchstackdave]

/review