@b9g/shovel 0.2.19 → 0.2.21

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to Shovel will be documented in this file.
 
+## [0.2.21] - 2026-07-14
+
+### Security
+
+- **Unhandled errors leaked stack traces to clients** — The debug error page renders `error.stack` into the response body, gated on `import.meta.env.MODE !== "production"`. `MODE` was never set at build time, so on platforms with no populated `import.meta.env` (Cloudflare Workers) the check saw `undefined`, concluded "not production", and served stack traces to the public on every unhandled 4xx/5xx. Node and Bun leaked the same way unless `NODE_ENV=production` happened to be set.
+
+  The build now bakes `MODE` into the bundle, and the error-verbosity gates test `MODE === "development"` so an unset mode **fails closed**. The verbose branch is now a build-time constant and gets eliminated from production bundles entirely. Sites deployed to Cloudflare should upgrade. (fixes [#91](https://github.com/bikeshaving/shovel/issues/91), [#100](https://github.com/bikeshaving/shovel/issues/100); [PR #102](https://github.com/bikeshaving/shovel/pull/102))
+
+  **Note:** `@b9g/router` used standalone (outside shovel's bundler) now returns the minimal production error response by default instead of the HTML debug page. Set `MODE=development` to restore verbose errors.
+
+## [0.2.20] - 2026-07-13
+
+### Bug Fixes
+
+- **Client asset minification restored in production** — PR [#68](https://github.com/bikeshaving/shovel/pull/68) (issue [#67](https://github.com/bikeshaving/shovel/issues/67)) made the client asset path honor `build.minify`, but that option defaults to `false` — so it silently stopped minifying CSS/JS in production for any site that never set it (shovel.js.org's client CSS grew from 10,656 to 13,174 bytes). Client assets now minify in production by default again; an explicit `build.minify` still overrides both paths, and the server bundle stays opt-in. ([PR #93](https://github.com/bikeshaving/shovel/pull/93))
+
 ## [0.2.19] - 2026-03-17
 
 ### Bug Fixes

package/bin/cli.js

@@ -5,7 +5,7 @@ import {
   DEFAULTS,
   findProjectRoot,
   loadConfig
-} from "../src/_chunks/chunk-MUNERPYV.js";
+} from "../src/_chunks/chunk-2JH5U6L5.js";
 
 // bin/cli.ts
 import { resolve, relative } from "path";
@@ -75,7 +75,7 @@ program.command("develop <entrypoint>").description("Start development server wi
   DEFAULTS.WORKERS
 ).option("--platform <name>", "Runtime platform (node, cloudflare, bun)").action(async (entrypoint, options) => {
   checkPlatformReexec(options);
-  const { developCommand } = await import("../src/_chunks/develop-Y2BWTIZ6.js");
+  const { developCommand } = await import("../src/_chunks/develop-2S2Q2Z6R.js");
   await developCommand(entrypoint, options, config);
 });
 program.command("create [name]").description("Create a new Shovel project").action(async (name) => {
@@ -91,7 +91,7 @@ program.command("build <entrypoint>").description("Build app for production").op
   "Run ServiceWorker lifecycle after build (install or activate, default: activate)"
 ).action(async (entrypoint, options) => {
   checkPlatformReexec(options);
-  const { buildCommand } = await import("../src/_chunks/build-YQCWR6LD.js");
+  const { buildCommand } = await import("../src/_chunks/build-GE2SPTLH.js");
   await buildCommand(entrypoint, options, config);
   process.exit(0);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@b9g/shovel",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "ServiceWorker-first universal deployment platform. Write ServiceWorker apps once, deploy anywhere (Node/Bun/Cloudflare). Registry-based multi-app orchestration.",
   "license": "MIT",
   "repository": {
@@ -39,7 +39,7 @@
     "@b9g/router": "^0.2.5",
     "@eslint/js": "^9.0.0",
     "@logtape/file": "^2.0.0",
-    "@types/bun": "^1.3.4",
+    "@types/bun": "^1.3.11",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "@typescript-eslint/parser": "^8.0.0",
     "eslint": "^9.0.0",

package/src/_chunks/{build-YQCWR6LD.js → build-GE2SPTLH.js}

@@ -1,11 +1,11 @@
 import {
   ServerBundler,
   loadPlatformModule
-} from "./chunk-JY5SZDJK.js";
+} from "./chunk-TVQDBRFO.js";
 import {
   findProjectRoot,
   findWorkspaceRoot
-} from "./chunk-MUNERPYV.js";
+} from "./chunk-2JH5U6L5.js";
 
 // src/commands/build.ts
 import { resolve, join, dirname, basename } from "path";

package/src/_chunks/{chunk-MUNERPYV.js → chunk-2JH5U6L5.js}

@@ -1060,7 +1060,9 @@ ${issues}`);
     },
     build: {
       target: validated.build?.target ?? "es2022",
-      minify: validated.build?.minify ?? false,
+      // Keep undefined when unset — collapsing to false here silently
+      // disables production client-asset minify (regression #68/#67).
+      minify: validated.build?.minify,
       sourcemap: validated.build?.sourcemap ?? false,
       treeShaking: validated.build?.treeShaking ?? true,
       define: validated.build?.define ?? {},

package/src/_chunks/{chunk-JY5SZDJK.js → chunk-TVQDBRFO.js}

@@ -4,7 +4,7 @@ import {
   generateStorageTypes,
   getNodeModulesPath,
   loadRawConfig
-} from "./chunk-MUNERPYV.js";
+} from "./chunk-2JH5U6L5.js";
 
 // src/utils/bundler.ts
 import * as ESBuild2 from "esbuild";
@@ -943,6 +943,7 @@ var ServerBundler = class {
     const target = userBuildConfig?.target ?? "es2022";
     const sourcemap = userBuildConfig?.sourcemap ?? (watch2 ? "inline" : false);
     const minify = userBuildConfig?.minify ?? false;
+    const assetMinify = userBuildConfig?.minify ?? (!this.#options.development && !watch2);
     const treeShaking = userBuildConfig?.treeShaking ?? true;
     const esbuildEntryPoints = {
       config: "shovel:config"
@@ -964,7 +965,7 @@ var ServerBundler = class {
       assetsPlugin({
         outDir: outputDir,
         plugins: userPlugins,
-        minify,
+        minify: assetMinify,
         jsx: jsxOptions.jsx,
         jsxFactory: jsxOptions.jsxFactory,
         jsxFragment: jsxOptions.jsxFragment,
@@ -998,6 +999,10 @@ var ServerBundler = class {
       define: {
         ...platformESBuildConfig.define ?? {},
         ...userBuildConfig?.define ?? {},
+        // Error verbosity keys off MODE. Platforms without a populated
+        // import.meta.env (Cloudflare) would otherwise leave it undefined,
+        // so bake it in — the check then folds away at build time.
+        "import.meta.env.MODE": JSON.stringify(mode),
         __SHOVEL_OUTDIR__: JSON.stringify(outputDir),
         __SHOVEL_GIT__: JSON.stringify(getGitSHA(this.#projectRoot))
       },

package/src/_chunks/{develop-Y2BWTIZ6.js → develop-2S2Q2Z6R.js}

@@ -1,10 +1,10 @@
 import {
   ServerBundler,
   loadPlatformModule
-} from "./chunk-JY5SZDJK.js";
+} from "./chunk-TVQDBRFO.js";
 import {
   DEFAULTS
-} from "./chunk-MUNERPYV.js";
+} from "./chunk-2JH5U6L5.js";
 
 // src/commands/develop.ts
 import { getLogger } from "@logtape/logtape";