document-rest 1.0.0 → 1.2.0

package/README.md

@@ -18,6 +18,10 @@ This binds a plain `node:http` listener to `127.0.0.1` (loopback only) on the gi
 
 > **Security note:** this listener has no authentication and no Host/Origin allowlisting of its own — anyone who can reach it can call every operation, including ones that read and write arbitrary filesystem paths. It is safe by default only because it binds to loopback; whatever fronts it for remote access (a tunnel, a reverse proxy) is responsible for authenticating callers before traffic ever reaches this process. Matches [`document-mcp`'s own `--transport http` listener](../document-mcp/README.md#remote-transport-http), which carries the identical note for the identical reason.
 
+### Standalone binary
+
+Every release also attaches a Node [single-executable application](https://nodejs.org/api/single-executable-applications.html) build for Linux, Windows, and macOS (both Apple Silicon and Intel) to that release's own GitHub Release assets — the entire server and its dependencies embedded in one file, needing no Node.js install or `npx` at all. For the "a caller with no Node runtime of its own" case this package exists for in the first place, this removes the last Node dependency too: download the asset matching your platform from the package's tag on the [Releases page](https://github.com/ExaDev/documents.js/releases), run it directly (`chmod +x` on Linux/macOS first), and it takes the identical `--port` flag.
+
 ## API
 
 **`GET /`** lists every available operation:

package/dist/bin.js

@@ -107,7 +107,7 @@ function createRestServer() {
 	});
 }
 //#endregion
-//#region src/bin.ts
+//#region src/cli.ts
 const DEFAULT_PORT = 3100;
 function readFlag(args, name) {
 	const prefix = `--${name}=`;
@@ -125,6 +125,11 @@ function parsePort(raw) {
 	if (!Number.isInteger(port) || String(port) !== raw.trim() || port < 0 || port > 65535) throw new Error(`--port must be an integer between 0 and 65535, got "${raw}"`);
 	return port;
 }
+/**
+* The real CLI entry logic, shared by both distribution shapes this package ships: `src/bin.ts` (the published npm `bin`, run under a real Node.js install) and `src/sea-entry.ts` (bundled into a Node single-executable application, which embeds its own Node runtime). Node's SEA feature runs only a CommonJS entry with no top-level await (see that file's own comment), so this function itself contains no top-level await of its own -- only `bin.ts` awaits calling it, at its own top level, which SEA never sees.
+*
+* Returns the listening `Server` rather than resolving `void` so a caller with a reason to stop it again (a test binding an ephemeral port for the duration of one assertion) can -- neither real distribution shape needs to, so both simply discard it.
+*/
 async function main() {
 	const portArg = readFlag(process.argv.slice(2), "port");
 	const port = portArg === void 0 ? DEFAULT_PORT : parsePort(portArg);
@@ -135,7 +140,10 @@ async function main() {
 	const address = server.address();
 	if (address === null || typeof address === "string") throw new Error("Expected the HTTP server to bind a TCP address, not a pipe or Unix socket");
 	console.error(`document-rest listening on http://127.0.0.1:${String(address.port)}`);
+	return server;
 }
+//#endregion
+//#region src/bin.ts
 await main();
 //#endregion
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "document-rest",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "A plain REST API server exposing document-operations' conversion, editing, inspection, and .odb operations as JSON-over-HTTP endpoints -- one POST route per operation, for a caller with no MCP client and no Node runtime of their own.",
   "type": "module",
   "repository": {