feat(fetch): use native global fetch instead of cross-fetch for workers

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        version: [16, 18, 20, 22, 24]
+        version: [18, 20, 22, 24]
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        version: [16, 18, 20, 22, 24]
+        version: [18, 20, 22, 24]
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -116,7 +116,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        version: [16, 18, 20, 22, 24]
+        version: [18, 20, 22, 24]
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

README.md

@@ -5,7 +5,10 @@ for a backend written in Node.js. You can read more on the [Descope Website](htt
 
 ## Requirements
 
-The SDK supports Node version 16 and above.
+The SDK supports Node version 18 and above.
+
+The SDK uses the runtime's native `fetch` and requires no Node built-in modules, so it also runs
+on Cloudflare Workers and other edge runtimes.
 
 ## Installing the SDK
 

lib/fetch-polyfill.test.ts

@@ -0,0 +1,21 @@
+// the dist assertion requires to run `npm run build` before running the test
+
+import { readFileSync } from 'fs';
+import polyfillFetch from './fetch-polyfill';
+
+describe('fetch-polyfill', () => {
+  it('should delegate to the runtime native fetch', async () => {
+    const res = { ok: true };
+    const spy = jest.spyOn(globalThis, 'fetch').mockResolvedValue(res as Response);
+
+    await expect(polyfillFetch('https://example.com', { method: 'POST' })).resolves.toBe(res);
+    expect(spy).toHaveBeenCalledWith('https://example.com', { method: 'POST' });
+  });
+
+  it('should not bundle node-only http clients into the build', () => {
+    const dist = readFileSync('./dist/index.esm.js', 'utf-8');
+    ['cross-fetch', 'node-fetch', 'node:http', 'node:https'].forEach((specifier) => {
+      expect(dist).not.toContain(specifier);
+    });
+  });
+});

lib/fetch-polyfill.ts

@@ -1,31 +1,7 @@
-import { fetch as crossFetch, Headers } from 'cross-fetch';
-
-globalThis.Headers ??= Headers;
-
-const highWaterMarkMb = 1024 * 1024 * 30; // 30MB
-
-// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big
-const patchedFetch = (...args: Parameters<typeof crossFetch>) => {
-  // we can get Request on the first arg, or RequestInfo on the second arg
-  // we want to make sure we are setting the "highWaterMark" so we are doing it on both args
-  args.forEach((arg) => {
-    // Updated to only apply highWaterMark to objects, as it can't be applied to strings (it breaks it)
-    if (arg && typeof arg === 'object') {
-      // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions
-      (arg as any).highWaterMark ??= highWaterMarkMb;
-    }
-  });
-
-  return crossFetch(...args);
-};
-
-// node-fetch@2 (bundled by cross-fetch) throws a false ERR_STREAM_PREMATURE_CLOSE on
-// keep-alive responses on Node >= 22.23.0 / 24.17.0 (nodejs/node#63989, the CVE-2026-48931
-// http.Agent fix). Node's built-in fetch (undici, Node >= 18) is unaffected, so prefer it
-// when present and fall back to cross-fetch (node-fetch) only on older runtimes.
-const polyfillFetch =
-  typeof globalThis.fetch === 'function'
-    ? (...args: Parameters<typeof globalThis.fetch>) => globalThis.fetch(...args)
-    : patchedFetch;
+// Native fetch only (Node >= 18, browsers, Cloudflare Workers and other edge runtimes).
+// Bundling a Node-based polyfill (cross-fetch/node-fetch) pulls `http`/`https` into edge
+// builds, where unenv stubs them with functions that throw on call.
+// Bound through a wrapper so undici's fetch keeps its correct `this`.
+const polyfillFetch = (...args: Parameters<typeof globalThis.fetch>) => globalThis.fetch(...args);
 
 export default polyfillFetch as unknown as typeof fetch;

lib/index.ts

@@ -52,7 +52,7 @@ const nodeSdk = ({
 }: NodeSdkArgs) => {
   const nodeHeaders = {
     'x-descope-sdk-name': 'nodejs',
-    'x-descope-sdk-node-version': process?.versions?.node || '',
+    'x-descope-sdk-node-version': globalThis.process?.versions?.node || '',
     'x-descope-sdk-version': BUILD_VERSION,
   };
 

package.json

@@ -25,7 +25,7 @@
     "url": "git://github.com/descope/node-sdk.git"
   },
   "engines": {
-    "node": ">= 16.0.0"
+    "node": ">= 18.0.0"
   },
   "scripts": {
     "build": "rimraf dist && rollup -c",
@@ -103,7 +103,6 @@
   },
   "dependencies": {
     "@descope/core-js-sdk": "^2.66.0",
-    "cross-fetch": "^4.0.0",
     "jose": "5.2.2",
     "tslib": "^2.0.0"
   }