@crustjs/crust-windows-arm64 0.5.4 → 0.5.5

package/bin/crust-bun-windows-arm64.exe

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/crust-bun-windows-arm64.exe
-size: 77742592 bytes
-sha256: 55cbde278a141b0e9b8ff5d7e1a0738abb01c2207c614b77ed03b857fe684ecb
+size: 77745152 bytes
+sha256: 5f64f9337b97aeeab855413f233d5f2e026c846e3e81ca4ecc758d0a7efbd346

package/bin/dist/index.d.ts

@@ -73,12 +73,13 @@ type BuildResult = {
  * `bin` entry, each the command's bundle (artifact `package`) or a Node
  * launcher (artifact `binary`), plus for binaries one platform package per
  * target holding one executable per command. Command names and source entries
- * come from `bin`; the runtime, artifact, Bun plugins, and extra directories
- * from package.json `crust`. Bundling and Command Snapshots run in bun
- * subprocesses (bun on PATH, or the running Bun executable), so this works
- * under Node as well when Bun is installed; Deno binaries and Deno runtime
- * packages (experimental, deno 2.5.0 or newer) need deno on PATH, and Node
- * binaries a node on PATH that Crust's tsdown can build executables with.
+ * come from `bin`; the runtime, artifact, Bun plugins, extra directories, and
+ * external dependencies from package.json `crust`. Bundling and Command
+ * Snapshots run in bun subprocesses (bun on PATH, or the running Bun
+ * executable), so this works under Node as well when Bun is installed; Deno
+ * binaries and Deno runtime packages (experimental, deno 2.5.0 or newer) need
+ * deno on PATH, and Node binaries a node on PATH that Crust's tsdown can build
+ * executables with.
  *
  * Throws on any failure. Planning and compiler-selection failures (bad
  * options or package.json, a missing or hung compiler, an engines mismatch) leave the

package/bin/dist/index.js

@@ -3117,13 +3117,14 @@ async function runBuildProcess(runner, args, outfilePath, cwd) {
 * Node, or Bun-targeted so the installed bin launches with Bun rather than Node.
 */
 async function execScriptBuild(target, entryPath, outfilePath, settings, runner = resolveBunBuildRunner()) {
-	const { cwd, minify, envFiles } = settings;
+	const { cwd, minify, envFiles, external } = settings;
 	if (settings.bunPlugins.length > 0) await runBunPluginDriver({
 		entrypoints: [entryPath],
 		minify,
 		env: "PUBLIC_*",
 		target,
-		format: "esm"
+		format: "esm",
+		external
 	}, outfilePath, settings, runner);
 	else await runBuildProcess(runner, [
 		"build",
@@ -3135,6 +3136,7 @@ async function execScriptBuild(target, entryPath, outfilePath, settings, runner
 		target,
 		"--format",
 		"esm",
+		...external.flatMap((name) => ["--external", name]),
 		"--outfile",
 		outfilePath,
 		...minify ? ["--minify"] : [],
@@ -3319,6 +3321,7 @@ function buildDistributionRootPackageJson(metadata, commands, targets, { artifac
 		type: "module",
 		files: ["bin", ...artifactDirs],
 		bin: Object.fromEntries(commands.map((command) => [command, `bin/${command}.js`])),
+		dependencies: metadata.dependencies,
 		...targets.length > 0 ? { optionalDependencies: Object.fromEntries(targets.map((target) => [target.packageName, metadata.version])) } : {},
 		...manPages.length > 0 ? { man: manPages.map((page) => `./man/${page}`) } : {},
 		exports: metadata.exports,
@@ -3384,16 +3387,23 @@ function validateStagedExports(exports, rootDir, sourceType) {
 	checkTarget(exports, "\".\"");
 }
 /**
+* The staged manifests go to npm as written, so a range the registry cannot
+* resolve (a workspace, catalog, or local path protocol) would leak into it.
+* Bare paths and scheme-less tarball names are local too, except GitHub
+* owner/repo[#ref] shorthand: npm resolves hosted Git before its file fallback.
+*/
+function assertPublishableRange(range, label) {
+	if (range === void 0 || !isString$1(range) || /^(?:(?:workspace|catalog|file|link|portal):|[.]|~[/\\]|[/\\]|[a-zA-Z]:)/.test(range) || !/^[a-z][a-z+]*:/i.test(range) && !/^[^@\s/:#\\]+\/[^@\s/:#\\]+(?:#.*)?$/.test(range) && /[.](?:tgz|tar\.gz|tar)$/i.test(range)) throw new Error(`${label} must be a publishable range, not ${JSON.stringify(range)}.\n  crust build publishes the staged root package as written; workspace:, catalog:, file:, link:, portal:, and local path ranges are never rewritten.`);
+}
+/**
 * Carries `peerDependencies` (and `peerDependenciesMeta`) into the root package
 * so a library `exports` entry can declare what its published types import.
-* Ranges must be publishable as written: the staged manifests go to npm
-* directly, so `workspace:` and `catalog:` ranges would leak into the registry.
 */
 function validatePeerDependencies(peerDependencies, peerDependenciesMeta) {
 	if (!isJsonObject(peerDependencies)) throw new Error("package.json peerDependencies must be an object of package names to ranges.");
 	const ranges = {};
 	for (const [name, range] of Object.entries(peerDependencies)) {
-		if (!isString$1(range) || /^(workspace|catalog):/.test(range)) throw new Error(`package.json peerDependencies[${JSON.stringify(name)}] must be a publishable range, not ${JSON.stringify(range)}.\n  crust build publishes the staged root package as written; workspace: and catalog: ranges are never rewritten.`);
+		assertPublishableRange(range, `package.json peerDependencies[${JSON.stringify(name)}]`);
 		ranges[name] = range;
 	}
 	if (peerDependenciesMeta === void 0) return { peerDependencies: ranges };
@@ -3430,7 +3440,16 @@ function pickRootMetadata(pkgJson) {
 function validatePackageNameLength(packageName) {
 	if (packageName.length > MAX_PACKAGE_NAME_LENGTH) throw new Error(`Generated package name is too long for npm: ${packageName}\n  Keep package names at or below ${MAX_PACKAGE_NAME_LENGTH} characters after the platform suffix is added.`);
 }
-function resolveDistributionMetadata(pkgJson) {
+/** `crust.external` ranges, already validated by `planBuild`; re-asserted for their type. */
+function externalDependencies(pkgJson, external) {
+	const dependencies = pkgJson.dependencies !== void 0 && isJsonObject(pkgJson.dependencies) ? pkgJson.dependencies : {};
+	return Object.fromEntries(external.map((name) => {
+		const range = dependencies[name];
+		assertPublishableRange(range, `package.json dependencies[${JSON.stringify(name)}]`);
+		return [name, range];
+	}));
+}
+function resolveDistributionMetadata(pkgJson, external) {
 	validatePackageNameLength(pkgJson.name);
 	return {
 		rootPackageName: pkgJson.name,
@@ -3438,7 +3457,8 @@ function resolveDistributionMetadata(pkgJson) {
 		rootPackageJson: pickRootMetadata(pkgJson),
 		sourceType: pkgJson.type,
 		...pkgJson.exports !== void 0 ? { exports: pkgJson.exports } : {},
-		...pkgJson.peerDependencies !== void 0 ? validatePeerDependencies(pkgJson.peerDependencies, pkgJson.peerDependenciesMeta) : {}
+		...pkgJson.peerDependencies !== void 0 ? validatePeerDependencies(pkgJson.peerDependencies, pkgJson.peerDependenciesMeta) : {},
+		...external.length > 0 ? { dependencies: externalDependencies(pkgJson, external) } : {}
 	};
 }
 function resolveDistributionTarget(table, stageDir, rootPackageName, target) {
@@ -3528,7 +3548,7 @@ function stageDistributionPackages(cwd, stageDir, metadata, platformMetadata, co
 * Returns every generated package.json, launcher, and compiled command in staging order.
 */
 async function runDistributeBuild(plan, distribution, io, build) {
-	const sourceMetadata = resolveDistributionMetadata(plan.userPackageJson);
+	const sourceMetadata = resolveDistributionMetadata(plan.userPackageJson, plan.external);
 	const commands = plan.entries.map((entry) => entry.command);
 	const table = distribution.table;
 	const platformMetadata = plan.runtime === "node" && table ? {
@@ -3813,7 +3833,8 @@ async function execNodeBinaryBuild(entryPath, outfilePath, target, settings, com
 		const exeDir = join(workDir, "exe");
 		await execScriptBuild("node", resolve(cwd, entryPath), bunBundle, {
 			...settings,
-			bunPlugins: []
+			bunPlugins: [],
+			external: []
 		}, bunRunner);
 		await writeFile(scriptPath, createNodeExeBuildScript({
 			tsdownPackageJson: compiler.backend.packageJsonPath,
@@ -4074,7 +4095,8 @@ const CRUST_CONFIG_KEYS = [
 	"artifact",
 	"targets",
 	"bunPlugins",
-	"include"
+	"include",
+	"external"
 ];
 function isBuildRuntime(value) {
 	return typeof value === "string" && BUILD_RUNTIMES.some((runtime) => runtime === value);
@@ -4116,11 +4138,54 @@ function readCrustConfig(pkg) {
 		if (!isStringArray(crust.include)) throw new Error("package.json crust.include must be an array of directory names relative to the project root, e.g. [\"templates\"].");
 		config.include = crust.include;
 	}
+	const external = crust.external;
+	if (external !== void 0) {
+		if (!isStringArray(external)) throw new Error("package.json crust.external must be an array of package names from dependencies, e.g. [\"better-sqlite3\"].");
+		const duplicate = external.find((name, index) => external.indexOf(name) !== index);
+		if (duplicate !== void 0) throw new Error(`package.json crust.external lists ${JSON.stringify(duplicate)} more than once.`);
+		config.external = external;
+	}
 	return config;
 }
 function hasDependency(pkg, name) {
 	return [pkg.dependencies, pkg.devDependencies].some((deps) => deps !== void 0 && isJsonObject(deps) && name in deps);
 }
+const NON_DEPENDENCY_SECTIONS = [
+	"devDependencies",
+	"optionalDependencies",
+	"peerDependencies"
+];
+/**
+* `crust.external` names ship as root `dependencies` of a Node or Bun runtime
+* package, so each needs a publishable `dependencies` range. Crust packages
+* stay bundled: core reads `process.env.CRUST_INTERNAL_BUILD`, which the
+* bundler defines only in bundled code, and an external `@crustjs/*` package
+* would load a second copy of core.
+*/
+function validateExternal(external, pkg, runtime, artifact) {
+	if (external.length === 0) return;
+	if (artifact === "binary") throw new Error("package.json crust.external is not supported for standalone binaries (artifact binary).\n  A binary bundles every dependency; remove crust.external or use artifact package.");
+	if (runtime === "deno") throw new Error("package.json crust.external is not supported with the deno runtime.\n  crust.external applies to Node and Bun runtime packages; remove crust.external or set crust.runtime to node or bun.");
+	const dependencies = pkg.dependencies !== void 0 && isJsonObject(pkg.dependencies) ? pkg.dependencies : {};
+	const rejectCrustPackage = (quoted, detail) => {
+		throw new Error(`package.json crust.external cannot name ${quoted}${detail}.\n  Crust packages must stay bundled: core detects a packaged build through a define the bundler injects, and an external Crust package would load a second copy of core.`);
+	};
+	for (const name of external) {
+		const quoted = JSON.stringify(name);
+		if (name.startsWith("@crustjs/")) rejectCrustPackage(quoted, "");
+		if (!Object.hasOwn(dependencies, name)) {
+			const sections = NON_DEPENDENCY_SECTIONS.filter((section) => {
+				const deps = pkg[section];
+				return deps !== void 0 && isJsonObject(deps) && Object.hasOwn(deps, name);
+			});
+			throw new Error(sections.length > 0 ? `package.json crust.external entry ${quoted} is in ${sections.join(" and ")}, not dependencies.\n  Only dependencies ship with the staged package; move ${quoted} to dependencies.` : `package.json crust.external entry ${quoted} is not in package.json dependencies.\n  crust.external names packages from dependencies, which ship with the staged package; add ${quoted} to dependencies.`);
+		}
+		const range = dependencies[name];
+		assertPublishableRange(range, `package.json dependencies[${quoted}]`);
+		const aliased = /^npm:(@crustjs\/[^@]+)/.exec(range)?.[1];
+		if (aliased !== void 0) rejectCrustPackage(quoted, ` (an alias of ${aliased})`);
+	}
+}
 const DENO_CONFIG_FILES = ["deno.json", "deno.jsonc"];
 /**
 * package.json `crust.runtime` > inference > Bun. Inference uses only
@@ -4248,6 +4313,7 @@ function planBuild(options, cwd) {
 	validatePackageIdentity(userPackageJson, "package.json");
 	const envFiles = resolveEnvFilePaths(cwd, options.envFiles);
 	const bunPlugins = config.bunPlugins ?? [];
+	const external = config.external ?? [];
 	if (artifact === "package" && options.targets?.length) throw new Error("--target cannot be used with runtime packages (artifact package).\n  A runtime package is one portable JavaScript bundle; drop --target or use artifact binary.");
 	if (artifact === "package" && config.targets !== void 0) throw new Error("package.json crust.targets is not supported for runtime packages (artifact package).\n  A runtime package is one portable JavaScript bundle; remove crust.targets or set \"artifact\": \"binary\".");
 	const denoTool = artifact === "binary" ? "deno compile" : "deno bundle";
@@ -4255,6 +4321,7 @@ function planBuild(options, cwd) {
 	if (runtime === "deno" && envFiles.length > 0) throw new Error(artifact === "binary" ? "--env-file is not supported with the deno runtime.\n  deno compile embeds every variable from the file into the binary — secrets included —\n  with no PUBLIC_* filter. Load configuration at runtime instead (e.g. deno run --env-file)." : "--env-file is not supported with the deno runtime.\n  deno bundle has no PUBLIC_* build-time constants. Load configuration at runtime instead (e.g. deno run --env-file).");
 	if (runtime === "deno" && bunPlugins.length > 0) throw new Error(`package.json crust.bunPlugins is not supported with the deno runtime.\n  ${denoTool} has no Bun bundler; remove crust.bunPlugins or set crust.runtime to bun.`);
 	if (runtime === "node" && artifact === "binary" && bunPlugins.length > 0) throw new Error("package.json crust.bunPlugins is not supported for node standalone binaries.\n  Remove crust.bunPlugins, or use artifact package or the bun runtime.");
+	validateExternal(external, userPackageJson, runtime, artifact);
 	const stageDir = resolve(cwd, CRUST_DIR);
 	const common = {
 		cwd,
@@ -4264,6 +4331,7 @@ function planBuild(options, cwd) {
 		envFiles,
 		bunPlugins,
 		include: config.include ?? [],
+		external,
 		outDir: join(stageDir, "artifacts"),
 		stageDir,
 		validate: options.validate ?? true,
@@ -4398,12 +4466,13 @@ async function prepareEntries(plan, io, runner) {
 * `bin` entry, each the command's bundle (artifact `package`) or a Node
 * launcher (artifact `binary`), plus for binaries one platform package per
 * target holding one executable per command. Command names and source entries
-* come from `bin`; the runtime, artifact, Bun plugins, and extra directories
-* from package.json `crust`. Bundling and Command Snapshots run in bun
-* subprocesses (bun on PATH, or the running Bun executable), so this works
-* under Node as well when Bun is installed; Deno binaries and Deno runtime
-* packages (experimental, deno 2.5.0 or newer) need deno on PATH, and Node
-* binaries a node on PATH that Crust's tsdown can build executables with.
+* come from `bin`; the runtime, artifact, Bun plugins, extra directories, and
+* external dependencies from package.json `crust`. Bundling and Command
+* Snapshots run in bun subprocesses (bun on PATH, or the running Bun
+* executable), so this works under Node as well when Bun is installed; Deno
+* binaries and Deno runtime packages (experimental, deno 2.5.0 or newer) need
+* deno on PATH, and Node binaries a node on PATH that Crust's tsdown can build
+* executables with.
 *
 * Throws on any failure. Planning and compiler-selection failures (bad
 * options or package.json, a missing or hung compiler, an engines mismatch) leave the

package/bin/schema/package.json

@@ -52,6 +52,14 @@
 					"items": {
 						"type": "string"
 					}
+				},
+				"external": {
+					"description": "Packages left out of a node or bun runtime package's bundle and shipped as `dependencies` of the staged root package with their package.json `dependencies` range, e.g. native addons, packages the CLI reads files from or runs, or very large dependencies. Each must be a `dependencies` key with a publishable range (no workspace:, catalog:, file:, link:, portal:, local paths, or local tarballs); @crustjs/* packages and npm aliases of them are rejected. Rejected for binaries and for Deno.",
+					"type": "array",
+					"uniqueItems": true,
+					"items": {
+						"type": "string"
+					}
 				}
 			}
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crustjs/crust-windows-arm64",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "CLI to build and publish Crust apps as npm packages or standalone binaries",
   "license": "MIT",
   "author": "chenxin-yan",