[Bug] Build fails when cert-aware fetch wrapper is checked against current Node typings

[rksharma-owg]

Summary

A clean install on current main fails to build because createCertAwareFetch() is declared as returning typeof fetch, while the returned async function does not include the static preconnect member now present in current Node typings.

Environment

• OS: macOS
• Node.js version: v22.23.1 (supported by the project's >=18 engine range)
• Package manager: npm 10.9.8
• Lockfile type: package-lock.json
• CVE Lite CLI version: current main, commit 5d91e5e83796e80fcaa328706c3e1b9565b43037
• @types/node: 24.12.0 resolved by npm ci

Command used

npm ci
npm run build

Expected behavior

A clean install on a supported Node version should type-check and allow the test suite to start. The injected fetch contract should describe the callable request behavior used by the scanner, without requiring unrelated static members from a particular Node typing release.

Actual behavior

src/utils/network.ts(187,3): error TS2741: Property 'preconnect' is missing in type '(input: RequestInfo | URL, init?: RequestInit) => Promise<Response>' but required in type 'typeof fetch'.

npm test -- --runInBand fails for the same reason because the E2E global setup runs the build.

Reproduction

1. Clone current main.
2. Run npm ci.
3. Run npm run build.
4. Observe TS2741 before any build artifacts are produced.

Relevant files or output

The mismatch is at src/utils/network.ts:174-187. No matching issue or open PR was found.

Proposed scope

Introduce a focused callable fetch type, use it for the cert-aware wrapper and production injection points, and add regression coverage. No runtime scan behavior should change.

I reproduced this on current main and can submit a focused fix.

[rksharma-owg]

I reproduced this on the latest main with a clean install. I’m working on the focused callable-fetch typing fix and regression coverage described above; I’ll keep runtime behavior unchanged.

[Ayush7614]

Thanks for filing this @rksharma-owg — I double-checked on current main so triage stays accurate.

What I verified

• Synced to latest upstream/main (includes c2a3601)
• Lockfile resolves @types/node@24.12.0 + typescript@5.9.3 (same major stack you cited)
• Project tsconfig does not enable the DOM lib
• Locked Node fetch typings (@types/node/web-globals/fetch.d.ts) declare a plain callable fetch — no preconnect static
• npm run build succeeds locally (exit 0); no TS2741

Takeaway

The specific claim that a clean npm ci && npm run build on locked main always fails with:

Property 'preconnect' is missing … required in type 'typeof fetch'

does not reproduce in this environment. That TS2741 shape is real in some stacks (notably Bun’s typeof fetch, which includes preconnect, and similar “callable + static members” typings), but it is not currently forced by this repo’s locked @types/node fetch definitions.

Still useful

Using typeof fetch for injectable wrappers is brittle if a platform’s typings later add static members. A focused FetchLike / callable-only contract (as in #886) is reasonable hardening / future-proofing — just separate from “main is broken for everyone on @types/node 24.12.0 today.”

If you still hit TS2741 on a clean install, it would help to paste:

1. npm ls @types/node typescript @types/bun undici-types --depth=0
2. whether any tsconfig/types entry pulls in Bun or DOM
3. the full tsc error with file:line

That will show whether this is env-specific rather than a lockfile-wide build break.