single-file-cli 2.6.1 → 2.6.3

package/.github/workflows/ci.yml

@@ -28,3 +28,27 @@ jobs:
       -
         name: Run tests
         run: npm test
+
+  # lib/ holds generated code that is committed, so nothing at runtime notices when it falls behind
+  # the core release it was built from — a stale bundle just silently runs old code, and a dev build
+  # (build-dev.sh, unminified, built from a local core checkout) silently replaces the released one.
+  # build.sh is reproducible: it pins both the core package and esbuild, so rebuilding here and
+  # diffing catches either case before it ships.
+  build-output:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      -
+        name: Checkout sources
+        uses: actions/checkout@v7
+      -
+        name: Set up Deno
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+      -
+        name: Rebuild the released artifacts
+        run: bash build.sh
+      -
+        name: Check lib/ matches the pinned core release
+        run: git diff --exit-code --stat -- lib/

package/build-dev.sh

@@ -16,7 +16,7 @@ await build({
   ],
   bundle: true,
   globalName: 'singlefile',
-  outdir: 'lib/',
+  outdir: 'lib-dev/',
   platform: 'browser',
   sourcemap: false,
   minify: false,
@@ -30,7 +30,7 @@ await build({
   ],
   bundle: true,
   globalName: 'singlefileBootstrap',
-  outdir: 'lib/',
+  outdir: 'lib-dev/',
   platform: 'browser',
   sourcemap: false,
   minify: false,
@@ -43,7 +43,7 @@ await build({
     '../single-file-core/single-file-hooks-frames.js'
   ],
   bundle: true,
-  outdir: 'lib/',
+  outdir: 'lib-dev/',
   platform: 'browser',
   sourcemap: false,
   minify: false,
@@ -57,7 +57,7 @@ await build({
   ],
   bundle: true,
   globalName: 'zip',
-  outdir: 'lib/',
+  outdir: 'lib-dev/',
   platform: 'browser',
   sourcemap: false,
   minify: false,
@@ -70,7 +70,7 @@ await build({
     '../single-file-core/single-file-archive.js'
   ],
   bundle: true,
-  outfile: 'lib/single-file-archive.js',
+  outfile: 'lib-dev/single-file-archive.js',
   platform: 'neutral',
   sourcemap: false,
   minify: false,
@@ -79,23 +79,44 @@ await build({
 });
 
 const SCRIPTS = [
-	'lib/single-file.js',
-	'lib/single-file-bootstrap.js',
-	'lib/zip.min.js'
+	'lib-dev/single-file.js',
+	'lib-dev/single-file-bootstrap.js',
+	'lib-dev/zip.min.js'
 ];
 
 let script = '';
 const scripts = SCRIPTS.map(script => Deno.readTextFile(script));
 const sources = await Promise.all(scripts);
 script += 'const script = ' + JSON.stringify(sources.join(';')) + ';';
-const hookScript = await Deno.readTextFile('lib/single-file-hooks-frames.js');
+const hookScript = await Deno.readTextFile('lib-dev/single-file-hooks-frames.js');
 script += 'const hookScript = ' + JSON.stringify(hookScript) + ';';
-const zipScript = await Deno.readTextFile('lib/zip.min.js');
+const zipScript = await Deno.readTextFile('lib-dev/zip.min.js');
 script += 'const zipScript = ' + JSON.stringify(zipScript) + ';';
 script += 'export { script, zipScript, hookScript };';
-await Deno.writeTextFile('lib/single-file-bundle.js', script)
+await Deno.writeTextFile('lib-dev/single-file-bundle.js', script)
 await Promise.all(SCRIPTS.map(script => Deno.remove(script)));
-await Deno.remove('lib/single-file-hooks-frames.js');
+await Deno.remove('lib-dev/single-file-hooks-frames.js');
 const version = JSON.parse(await Deno.readTextFile('./deno.json')).version;
-await Deno.writeTextFile('lib/version.js', 'export const version = ' + JSON.stringify(version) + ';');
-" |  deno run --allow-read --allow-write --allow-net --allow-run --allow-env --lock="$build_dir/build.lock" -
+await Deno.writeTextFile('lib-dev/version.js', 'export const version = ' + JSON.stringify(version) + ';');
+" |  deno run --allow-read --allow-write --allow-net --allow-run --allow-env --lock="$build_dir/build.lock" -
+
+# Stage a runnable tree in .dev/, with the freshly built artifacts overlaid on the hand-written
+# files from lib/. Generated code never lands in the tracked lib/ directory, so a dev build cannot
+# leave an unminified bundle where the release one belongs, and using the dev build is something you
+# opt into by invoking .dev/single-file rather than something you get by forgetting to rebuild.
+rm -rf .dev
+mkdir -p .dev
+cp ./single-file ./single-file-node.js ./single-file-launcher.js ./single-file-cli-api.js ./options.js ./deno.json ./package.json .dev/
+cp -R ./resources .dev/resources
+cp -R ./lib .dev/lib
+cp lib-dev/* .dev/lib/
+
+core_revision=$(git -C ../single-file-core rev-parse --short HEAD 2>/dev/null || echo "unknown")
+if [ -n "$(git -C ../single-file-core status --porcelain 2>/dev/null | head -1)" ]; then
+	core_revision="$core_revision+uncommitted"
+fi
+
+echo
+echo "Dev build ready: single-file-core $core_revision"
+echo "  run it with:  node .dev/single-file <url> <output>"
+echo "  tracked lib/ is untouched; .dev/ and lib-dev/ are git-ignored"

package/build.sh

@@ -2,7 +2,7 @@
 
 set -e
 
-CORE_PACKAGE="npm:single-file-core@1.5.115"
+CORE_PACKAGE="npm:single-file-core@1.5.118"
 ESBUILD_PACKAGE="npm:esbuild@0.27.7"
 
 project_dir=$(pwd)

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@single-file/single-file-cli",
-  "version": "2.6.1",
+  "version": "2.6.3",
   "description": "SingleFile CLI",
   "exports": {
     ".": "./single-file-cli-api.js"

package/eslint.config.mjs

@@ -1,7 +1,7 @@
 import js from "@eslint/js";
 
 export default [
-	{ ignores: ["lib/single-file-archive.js"] },
+	{ ignores: ["lib/single-file-archive.js", "lib-dev/**", ".dev/**"] },
 	js.configs.recommended,
 	{
 		languageOptions: {

package/lib/deno-polyfill.js

@@ -128,11 +128,13 @@ const pathAPI = {
 
 const isDeno = DENO_RUNTIME_DETECTED;
 
-// the connection to the browser relies on the WebSocket of the runtime, which
-// Node.js provides since 22.4.0 and can still be turned off with
-// --no-experimental-websocket
+// the connection to the browser relies on the WebSocket of the runtime. Every version the
+// engines field supports has one, so reaching this means either an older runtime than that,
+// or Node.js started with --no-experimental-websocket, which still removes the global on
+// current versions. The message names neither version, so that it cannot drift away from
+// the engines field the way it already did once
 if (typeof globalThis.WebSocket !== "function") {
-	throw new Error("WebSocket is not available, Node.js 22.4.0 or later is required");
+	throw new Error("WebSocket is not available: the runtime is older than this package supports, or it was started with --no-experimental-websocket");
 }
 
 export { DenoAPI as Deno, pathAPI as path, isDeno };