fix(cli): add exports field to core-cli package.json

[jchris]

Summary

• Adds "exports": { ".": "./index.js" } to @fireproof/core-cli package.json
• Fixes DEP0151 deprecation warnings that fire twice per npx vibes-diy invocation
• DEP0151 will become an error in a future Node.js version

Closes #1774

Test plan

• cd cli && pnpm test — 57/57 pass
• After publish, verify: npm view @fireproof/core-cli@0.24.17 exports
• Update vibes-diy dep, confirm no DEP0151 warnings on npx vibes-diy system

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added an explicit module entry point for the CLI package to clarify module resolution.
  • Set the project Node version specifier to 24.
  • CI publishing workflow no longer forces a global npm install before publishing.
  • CI runtime configuration updated to use Node 24 for actions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: daa2779f-6ec6-4b34-9493-4fc760e7de60

📥 Commits

Reviewing files that changed from the base of the PR and between 37ce12d and d6ec82d.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• .nvmrc
• actions/core-publish/action.yaml
• actions/runtime/action.yaml

💤 Files with no reviewable changes (1)

• actions/core-publish/action.yaml

✅ Files skipped from review due to trivial changes (2)

• .nvmrc
• actions/runtime/action.yaml

---

Walkthrough

Added an "exports" field to cli/package.json to declare the package root entry point. Also pinned the repository Node.js target in .nvmrc to 24, removed an explicit npm global install from actions/core-publish/action.yaml, and bumped actions/runtime/action.yaml Node version from 22→24.

Changes

Cohort / File(s)	Summary
Package Configuration cli/package.json	Added "exports": { ".": "./index.js" } to explicitly map the package root entry point.
Local Node version file .nvmrc	Changed Node version specifier from lts/* → 24.
Publish workflow actions/core-publish/action.yaml	Removed the step that installed/pinned npm globally (npm install -g npm@11); now reports npm --version and proceeds.
Runtime composite action actions/runtime/action.yaml	Updated actions/setup-node@v4 node-version input from 22 → 24.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Issue 1057  #1058 — Modifies package.json handling and transforms exports; closely related to adding/exporting entry points.
• export cli #1056 — Changes CLI package entry/packaging configuration; related to cli/package.json edits.
• use npm oicd follow from gh-action #1438 — Alters publish workflow/npm install steps; related to changes in actions/core-publish/action.yaml.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	Changes to .nvmrc, action.yaml files are out of scope; the PR should focus on the core-cli package.json fix for issue #1774.	Remove unrelated Node.js version updates and npm install changes; these should be in a separate PR or issue.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding an exports field to the core-cli package.json to fix DEP0151 warnings.
Linked Issues check	✅ Passed	The PR adds exports field as required by #1774, though it implements only the minimal version without the sub-exports pattern.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jchris/fix/core-cli-exports-1774

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (2)

cli/package.json (2)

6-8: Consider adding a "main" field for backward compatibility.

While the "exports" field is the modern approach and resolves the DEP0151 warning, adding a "main" field alongside it would ensure compatibility with older Node.js versions and tools that don't yet support the "exports" field.

📦 Optional: Add "main" field for broader compatibility

   "type": "module",
   "exports": {
     ".": "./index.js"
   },
+  "main": "./index.js",
   "bin": {
     "core-cli": "run.js"
   },

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@cli/package.json` around lines 6 - 8, Add a "main" field to package.json
alongside the existing "exports" to provide backward compatibility for older
Node.js versions and tools; specifically, add a "main": "./index.js" entry at
the top-level so modules that rely on the legacy main entry point will still
resolve to the same entry as the current "exports" mapping.

---

6-8: Consider if the wildcard export pattern is needed.

The linked issue #1774 suggested a preferred solution that included a wildcard pattern: "./*": "./*.js". This would allow consumers to import subpaths directly (e.g., import foo from '@fireproof/core-cli/foo.js').

The current implementation only exports the package root. If the package is intended to have a restricted public API with only the root export, then the current approach is correct. However, if there are submodules that should be importable, consider adding the wildcard pattern.

🔧 Optional: Add wildcard pattern for subpath exports

   "exports": {
-    ".": "./index.js"
+    ".": "./index.js",
+    "./*": "./*.js"
   },

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@cli/package.json` around lines 6 - 8, The package currently only exposes the
package root via the "exports" field ("." -> "./index.js"); decide whether
subpath imports should be allowed and if so add the wildcard export pattern
`"./*": "./*.js"` to the same "exports" object so consumers can import
submodules (e.g., '@fireproof/core-cli/foo.js'); otherwise keep the current
restricted export but add a brief comment in package.json or README explaining
the intentional single-entry export to document the choice.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@cli/package.json`:
- Around line 6-8: Add a "main" field to package.json alongside the existing
"exports" to provide backward compatibility for older Node.js versions and
tools; specifically, add a "main": "./index.js" entry at the top-level so
modules that rely on the legacy main entry point will still resolve to the same
entry as the current "exports" mapping.
- Around line 6-8: The package currently only exposes the package root via the
"exports" field ("." -> "./index.js"); decide whether subpath imports should be
allowed and if so add the wildcard export pattern `"./*": "./*.js"` to the same
"exports" object so consumers can import submodules (e.g.,
'@fireproof/core-cli/foo.js'); otherwise keep the current restricted export but
add a brief comment in package.json or README explaining the intentional
single-entry export to document the choice.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c3a54b31-9fb4-4664-9a81-5b30fe673b50

📥 Commits

Reviewing files that changed from the base of the PR and between 90d1467 and 37ce12d.

📒 Files selected for processing (1)

• cli/package.json