build: pin the Node major in .nvmrc and declare the supported range

Nothing said which Node TREK runs on. The image is node:24, part of CI
ran 22 under comments saying 22 matched the server runtime, and the dev
guide said "22+". A bare-metal or dev install on an unsupported Node
installed without a word and then failed at runtime: isomorphic-dompurify
needs ^22.22.2 or ^24.15.0, the plugin jail's --permission flag is new
in 22.x.

.nvmrc now holds the major the Docker image runs, for nvm/fnm and for
every workflow to read. engines in the root and each workspace states
the range the runtime dependencies accept, the same one
isomorphic-dompurify declares. Without engine-strict npm only warns
outside it, so no existing install stops installing.

.nvmrc

@@ -0,0 +1 @@
+24

CLAUDE.md

@@ -54,7 +54,7 @@ npm run i18n:parity --workspace=shared            # audit (exit 0)
 npm run i18n:parity:strict --workspace=shared     # CI gate (exit 1 on drift)
 ```
 
-Dev ports: the server listens on **3001**; the Vite dev server proxies the API, websocket, uploads, MCP and OAuth paths to it (see `client/vite.config.js`). There is no Node version pin — the CI workflows and the Dockerfile define what is tested. `server/.env.example` is the env-var reference.
+Dev ports: the server listens on **3001**; the Vite dev server proxies the API, websocket, uploads, MCP and OAuth paths to it (see `client/vite.config.js`). `.nvmrc` pins the Node major the Docker image runs and every CI job reads; `engines` in each package.json states the range that installs (npm only warns outside it). `server/.env.example` is the env-var reference.
 
 ## Server invariants
 

README.md

@@ -223,7 +223,7 @@ Open `http://localhost:3000`. On first boot TREK seeds an admin account — if y
 
 <div align="center">
 
-![Node.js](https://img.shields.io/badge/Node.js_22-339933?style=flat-square&logo=node.js&logoColor=white)
+![Node.js](https://img.shields.io/badge/Node.js_24-339933?style=flat-square&logo=node.js&logoColor=white)
 ![NestJS](https://img.shields.io/badge/NestJS_11-E0234E?style=flat-square&logo=nestjs&logoColor=white)
 ![SQLite](https://img.shields.io/badge/SQLite-003B57?style=flat-square&logo=sqlite&logoColor=white)
 ![React](https://img.shields.io/badge/React_19-61DAFB?style=flat-square&logo=react&logoColor=black)

client/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@trek/client",
   "version": "4.3.3",
+  "engines": {
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+  },
   "private": true,
   "type": "module",
   "scripts": {

package-lock.json

@@ -16,6 +16,9 @@
         "concurrently": "^10.0.4",
         "unrun": "^0.3.1"
       },
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+      },
       "optionalDependencies": {
         "@img/sharp-linuxmusl-arm64": "0.35.4",
         "@img/sharp-linuxmusl-x64": "0.35.4",
@@ -98,6 +101,9 @@
         "vite": "8.3.0",
         "vite-plugin-pwa": "^1.3.0",
         "vitest": "^4.1.11"
+      },
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
       }
     },
     "client/node_modules/@vitejs/plugin-react": {
@@ -22015,6 +22021,9 @@
         "typescript-eslint": "^8.70.0",
         "unplugin-swc": "^1.6.0",
         "vitest": "^4.1.11"
+      },
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
       }
     },
     "server/node_modules/@eslint/config-array": {
@@ -22319,6 +22328,9 @@
         "typescript": "^6.0.3",
         "typescript-eslint": "^8.70.0",
         "vitest": "^4.1.11"
+      },
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
       }
     },
     "shared/node_modules/@oxc-project/types": {

package.json

@@ -2,6 +2,9 @@
   "name": "@trek/root",
   "private": true,
   "version": "4.3.3",
+  "engines": {
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+  },
   "workspaces": [
     "client",
     "server",

server/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@trek/server",
   "version": "4.3.3",
+  "engines": {
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+  },
   "main": "src/index.ts",
   "scripts": {
     "start": "node --require tsconfig-paths/register dist/index.js",

shared/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@trek/shared",
   "version": "4.3.3",
+  "engines": {
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+  },
   "private": true,
   "description": "Shared API contracts (Zod schemas) — single source of truth for TREK server and client.",
   "type": "module",

wiki/Development-environment.md

@@ -4,7 +4,7 @@
 
 ## Prerequisites
 
-- Node.js 22+
+- Node.js 24, the version in `.nvmrc` and the one the Docker image and CI run (`nvm use` or `fnm use` picks it up). 22.22.2 or later still installs, but nothing tests it.
 - npm
 - Git
 - Python 3 and a C++ toolchain (`build-essential` on Debian/Ubuntu, the Xcode Command Line Tools on macOS, the Visual Studio Build Tools on Windows). better-sqlite3 ships prebuilt binaries, but a lockfile-driven `npm install` still runs node-gyp against them and stops without these (npm/cli#9837).