Use devEngines for generated package managers

- write pnpm into `devEngines.packageManager`
- drop top-level `packageManager`
- update init warnings and tests

Author: eluce2

.changeset/package-manager-dev-engines.md

@@ -0,0 +1,5 @@
+---
+"@proofkit/cli": patch
+---
+
+Use devEngines packageManager in generated apps.

packages/cli/src/cli/init.ts

@@ -126,6 +126,13 @@ type ProofKitPackageJSON = PackageJson & {
   proofkitMetadata?: {
     initVersion: string;
   };
+  devEngines?: {
+    packageManager: {
+      name: string;
+      version: string;
+      onFail: "download";
+    };
+  };
 };
 
 const missingTypegenCommandPatterns = [
@@ -286,7 +293,14 @@ export const runInit = async (name?: string, opts?: CliFlags) => {
     const { stdout } = await execa(pkgManager, ["-v"], {
       cwd: projectDir,
     });
-    pkgJson.packageManager = `${pkgManager}>=${stdout.trim()}`;
+    pkgJson.packageManager = undefined;
+    pkgJson.devEngines = {
+      packageManager: {
+        name: pkgManager,
+        version: `^${stdout.trim()}`,
+        onFail: "download",
+      },
+    };
   }
 
   fs.writeJSONSync(path.join(projectDir, "package.json"), pkgJson, {

packages/cli/src/core/planInit.ts

@@ -97,8 +97,14 @@ export function planInit(
 
   const packageJson: InitPlan["packageJson"] = {
     name: request.scopedAppName,
-    packageManager: options.packageManagerVersion
-      ? `${request.packageManager}@${options.packageManagerVersion}`
+    devEngines: options.packageManagerVersion
+      ? {
+          packageManager: {
+            name: request.packageManager,
+            version: `^${options.packageManagerVersion}`,
+            onFail: "download",
+          },
+        }
       : undefined,
     proofkitMetadata: {
       initVersion: getScaffoldVersion(),
@@ -202,8 +208,9 @@ export function applyPackageJsonMutations(
 ) {
   packageJson.name = mutations.name;
   packageJson.proofkitMetadata = mutations.proofkitMetadata as PackageJson["proofkitMetadata"];
-  if (mutations.packageManager) {
-    packageJson.packageManager = mutations.packageManager;
+  if (mutations.devEngines) {
+    packageJson.devEngines = mutations.devEngines;
+    packageJson.packageManager = undefined;
   }
 
   if (!packageJson.dependencies) {

packages/cli/src/core/types.ts

@@ -105,7 +105,13 @@ export interface InitPlan {
   packageManagerExecuteCommand: string;
   packageJson: {
     name: string;
-    packageManager?: string;
+    devEngines?: {
+      packageManager: {
+        name: PackageManager;
+        version: string;
+        onFail: "download";
+      };
+    };
     proofkitMetadata: {
       initVersion: string;
       scaffoldPackage: "@proofkit/cli";

packages/cli/src/utils/sortPackageJson.ts

@@ -13,6 +13,7 @@ const ROOT_KEY_ORDER = [
   "funding",
   "type",
   "packageManager",
+  "devEngines",
   "engines",
   "bin",
   "exports",

packages/cli/tests/executor.test.ts

@@ -366,7 +366,7 @@ describe("executeInitPlan command paths", () => {
     await Effect.runPromise(executeInitPlan(plan).pipe(makeTestLayer({ cwd, packageManager: "npm", console })));
 
     expect(console.info.join("\n")).toContain(
-      "Warning: We strongly suggest using pnpm 11 or greater as your package manager for security reasons.",
+      "Warning: We strongly suggest using PNPM 11 or greater as your package manager to better protect your computer and your app.",
     );
   });
 

packages/cli/tests/init-scaffold-contract.test.ts

@@ -8,6 +8,13 @@ interface PackageJsonShape {
   version?: string;
   name?: string;
   packageManager?: string;
+  devEngines?: {
+    packageManager?: {
+      name?: string;
+      version?: string;
+      onFail?: string;
+    };
+  };
   scripts?: Record<string, string>;
   dependencies?: Record<string, string>;
   devDependencies?: Record<string, string>;
@@ -47,7 +54,7 @@ const expectedProofkitVersions = new Map([
     `^${readJsonFile<PackageJsonShape>(join(__dirname, "..", "..", "webviewer", "package.json")).version}`,
   ],
 ]);
-const packageManagerPattern = /^(npm|pnpm|yarn|bun)@/;
+const packageManagerVersionPattern = /^\^?\d+\.\d+\.\d+/;
 const ansiStylePrefixPattern = /^[0-9;]*m/;
 
 function runInit({ appType, projectName }: { appType: "browser" | "webviewer"; projectName: string }): string {
@@ -110,7 +117,7 @@ function checkNodeSyntax(projectDir: string, relativeFilePath: string): boolean
 }
 
 function getPackageManagerName(packageJson: PackageJsonShape): "npm" | "pnpm" | "yarn" | "bun" {
-  const raw = packageJson.packageManager?.split("@")[0];
+  const raw = packageJson.devEngines?.packageManager?.name ?? packageJson.packageManager?.split("@")[0];
   if (raw === "pnpm" || raw === "yarn" || raw === "bun") {
     return raw;
   }
@@ -161,7 +168,10 @@ describe("Init scaffold contract tests", () => {
     expect(packageJson.scripts?.build).toBe("next build --turbopack");
     expect(packageJson.scripts?.proofkit).toBe("proofkit");
     expect(packageJson.proofkitMetadata?.initVersion).toBe(cliVersion);
-    expect(packageJson.packageManager).toMatch(packageManagerPattern);
+    expect(packageJson.packageManager).toBeUndefined();
+    expect(packageJson.devEngines?.packageManager?.name).toBe("pnpm");
+    expect(packageJson.devEngines?.packageManager?.version).toMatch(packageManagerVersionPattern);
+    expect(packageJson.devEngines?.packageManager?.onFail).toBe("download");
     expect(allProofkitDependenciesUseCurrentVersions(packageJson)).toBe(true);
     expect(readFileSync(join(browserProjectDir, "CLAUDE.md"), "utf-8")).toBe("@AGENTS.md\n");
     expect(readFileSync(join(browserProjectDir, ".cursorignore"), "utf-8")).toBe("CLAUDE.md\n");
@@ -213,7 +223,10 @@ describe("Init scaffold contract tests", () => {
     expect(packageJson.scripts?.["typegen:ui"]).toBe("pnpx @proofkit/typegen ui");
     expect(packageJson.scripts?.proofkit).toBe("proofkit");
     expect(packageJson.proofkitMetadata?.initVersion).toBe(cliVersion);
-    expect(packageJson.packageManager).toMatch(packageManagerPattern);
+    expect(packageJson.packageManager).toBeUndefined();
+    expect(packageJson.devEngines?.packageManager?.name).toBe("pnpm");
+    expect(packageJson.devEngines?.packageManager?.version).toMatch(packageManagerVersionPattern);
+    expect(packageJson.devEngines?.packageManager?.onFail).toBe("download");
     expect(allProofkitDependenciesUseCurrentVersions(packageJson)).toBe(true);
     expect(readFileSync(join(webviewerProjectDir, "CLAUDE.md"), "utf-8")).toBe("@AGENTS.md\n");
     expect(readFileSync(join(webviewerProjectDir, ".cursorignore"), "utf-8")).toBe("CLAUDE.md\n");

packages/cli/tests/integration.test.ts

@@ -66,7 +66,12 @@ describe("integration scaffold generation", () => {
       await readScaffoldArtifacts(projectDir);
 
     expect(packageJson.name).toBe("browser-app");
-    expect(packageJson.packageManager).toBe("pnpm@11.1.0");
+    expect(packageJson.packageManager).toBeUndefined();
+    expect(packageJson.devEngines?.packageManager).toEqual({
+      name: "pnpm",
+      version: "^11.1.0",
+      onFail: "download",
+    });
     expect(packageJson.proofkitMetadata).toMatchObject({
       scaffoldPackage: "@proofkit/cli",
     });

packages/cli/tests/planner.test.ts

@@ -25,6 +25,11 @@ describe("planInit", () => {
     expect(plan.targetDir).toBe(path.resolve("/tmp/workspace", "demo-app"));
     expect(plan.templateDir).toBe("/templates/browser");
     expect(plan.packageJson.name).toBe("demo-app");
+    expect(plan.packageJson.devEngines?.packageManager).toEqual({
+      name: "pnpm",
+      version: "^11.0.0",
+      onFail: "download",
+    });
     expect(plan.settings.appType).toBe("browser");
     expect(plan.packageJson.devDependencies["@proofkit/cli"]).toBe(proofkitCliVersion);
     expect(plan.packageJson.devDependencies["@proofkit/typegen"]).toBe(proofkitTypegenVersion);
@@ -126,7 +131,7 @@ describe("planInit", () => {
     );
 
     expect(plan.nextSteps).toContain(
-      "Warning: We strongly suggest using pnpm 11 or greater as your package manager for security reasons.",
+      "Warning: We strongly suggest using PNPM 11 or greater as your package manager to better protect your computer and your app.",
     );
   });