@canmi/web 2026.1005.1 → 2026.1005.2

package/dist/disclose/src/build.d.ts

@@ -0,0 +1,12 @@
+import { Disclosure } from "./index.js";
+//#region disclose/src/build.d.ts
+/**
+ * What an app is made of, read from its `package.json` at build time.
+ *
+ * A version is the installed package's, read from its own `package.json` beside the app rather than
+ * through its exports, which rarely offer it. See spec/web/disclose.md.
+ */
+export declare function disclosure(root: string): Disclosure;
+/** `disclosure(root)` as a Vite `define` entry, so a page reads it as `import.meta.env.VITE_DISCLOSURE`. */
+export declare function discloseDefine(root: string): Record<string, string>;
+//#endregion

package/dist/disclose/src/build.js

@@ -0,0 +1,44 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+//#region disclose/src/build.ts
+/**
+* The packages whose version a Wappalyzer fingerprint reads, by the name an app installs them as.
+*
+* Only an app that lists one in its own `package.json` gets its version; the others are absent.
+*/
+const VERSIONED = [
+	"@codemirror/view",
+	"@videojs/core",
+	"algoliasearch",
+	"d3-hierarchy"
+];
+/** A dependency an app is deployed to Cloudflare Workers with. */
+const WORKERS = ["@sveltejs/adapter-cloudflare", "wrangler"];
+function readJson(path) {
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+/**
+* What an app is made of, read from its `package.json` at build time.
+*
+* A version is the installed package's, read from its own `package.json` beside the app rather than
+* through its exports, which rarely offer it. See spec/web/disclose.md.
+*/
+function disclosure(root) {
+	const manifest = readJson(join(root, "package.json"));
+	const names = /* @__PURE__ */ new Set([...Object.keys(manifest.dependencies ?? {}), ...Object.keys(manifest.devDependencies ?? {})]);
+	const versions = {};
+	for (const name of VERSIONED) {
+		if (!names.has(name)) continue;
+		versions[name] = readJson(join(root, "node_modules", name, "package.json")).version;
+	}
+	return {
+		versions,
+		...WORKERS.some((name) => names.has(name)) ? { runtime: "Cloudflare Workers" } : {}
+	};
+}
+/** `disclosure(root)` as a Vite `define` entry, so a page reads it as `import.meta.env.VITE_DISCLOSURE`. */
+function discloseDefine(root) {
+	return { "import.meta.env.VITE_DISCLOSURE": JSON.stringify(disclosure(root)) };
+}
+//#endregion
+export { discloseDefine, disclosure };

package/dist/disclose/src/index.d.ts

@@ -1,7 +1,18 @@
 //#region disclose/src/index.d.ts
+/**
+ * What an app is made of, worked out at build time by `disclosure` in `./build` and read by its
+ * pages as `import.meta.env.VITE_DISCLOSURE`.
+ */
+export interface Disclosure {
+  /** Installed versions, by package name, of the packages a fingerprint reads a version for. */
+  readonly versions: Readonly<Record<string, string>>;
+  /** Where the app runs, when a fingerprint names it: set for an app deployed to Workers. */
+  readonly runtime?: 'Cloudflare Workers';
+}
 /**
  * What the page is built with, said where a profiler reads it: each dotted path set on `window`,
- * the objects on the way made as needed, and nothing already there replaced. A patch for
+ * the objects on the way made as needed, nothing already there replaced, and an undefined value
+ * skipped, so an entry the build did not find is simply absent. A patch for
  * Wappalyzer, whose fingerprints read globals -- and read a version only from some. See
  * spec/web/disclose.md.
  */

package/dist/disclose/src/index.js

@@ -1,7 +1,8 @@
 //#region disclose/src/index.ts
 /**
 * What the page is built with, said where a profiler reads it: each dotted path set on `window`,
-* the objects on the way made as needed, and nothing already there replaced. A patch for
+* the objects on the way made as needed, nothing already there replaced, and an undefined value
+* skipped, so an entry the build did not find is simply absent. A patch for
 * Wappalyzer, whose fingerprints read globals -- and read a version only from some. See
 * spec/web/disclose.md.
 */
@@ -10,7 +11,7 @@ function disclose(entries) {
 	for (const [path, value] of Object.entries(entries)) {
 		const keys = path.split(".");
 		const last = keys.pop();
-		if (!last) continue;
+		if (!last || value === void 0) continue;
 		let target = window;
 		for (const key of keys) {
 			const next = target[key];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canmi/web",
-  "version": "2026.1005.1",
+  "version": "2026.1005.2",
   "description": "SvelteKit compat, referer and Sentry.",
   "keywords": [
     "browserslist",
@@ -44,6 +44,10 @@
       "types": "./dist/sentry/src/server.d.ts",
       "default": "./dist/sentry/src/server.js"
     },
+    "./disclose/build": {
+      "types": "./dist/disclose/src/build.d.ts",
+      "default": "./dist/disclose/src/build.js"
+    },
     "./disclose": {
       "types": "./dist/disclose/src/index.d.ts",
       "default": "./dist/disclose/src/index.js"