npm ci fails on main: package-lock.json is out of sync with package.json #1011

Summary

A fresh install from the current main branch fails with npm ci because the committed package-lock.json is not consistent with the workspace manifests.

This prevents a reproducible contributor/CI install.

Environment

• Node.js: v22.22.0
• npm: 10.9.4
• Commit: 10163d20

Reproduction

git clone https://github.com/SonicJs-Org/sonicjs.git
cd sonicjs
npm ci

Actual result

npm ci exits with EUSAGE, including:

Missing: @emnapi/runtime@1.11.2 from lock file
Missing: @emnapi/core@1.11.2 from lock file
Invalid: lock file's esbuild@0.19.12 does not satisfy esbuild@0.28.1
Missing: @esbuild/netbsd-arm64@0.28.1 from lock file

A normal install also currently fails without a peer-dependency workaround:

npm install

ERESOLVE could not resolve

peerOptional @cloudflare/workers-types@"^5.20260714.1" from wrangler@4.112.0

Found:
@cloudflare/workers-types@"^4.20251014.0"

wrangler is declared with a permissive ^4.65.0 range, which now resolves to a version expecting Workers Types v5 while the
repository declares v4.

Expected result

npm ci should succeed from a clean clone, using the committed lockfile.

Suggested direction

Regenerate and commit package-lock.json against an intentionally compatible dependency set, then either:

• update @cloudflare/workers-types to a compatible v5 range; or
• constrain wrangler to a version compatible with the project’s current Workers Types v4 range.

The fix should be verified with at least:

  npm ci
  npm run type-check
  npm test

Context

Observed on the current main / v3.0.0-beta.25 development line.