single-file-core 1.5.89 → 1.5.90

package/.github/workflows/publish.yml

@@ -0,0 +1,88 @@
+# .github/workflows/publish.yml
+
+name: Publish
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  # nothing else guarantees that the released commit was verified: the vendor workflow runs on push,
+  # so this waits for its run on that exact commit and refuses to publish unless it succeeded
+  check_vendor:
+    name: 'Check vendor rebuild'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      # only used to resolve the tag to a commit, so it runs no code from the repository and keeps no
+      # git credentials behind
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
+      # the tag is typed in the release UI, so nothing ties it to the version that is about to be
+      # published: a mistyped tag, or a bump that was never pushed, publishes a version nobody asked for
+      - name: Verify the tag matches the declared version
+        env:
+          TAG_NAME: ${{ github.event.release.tag_name }}
+        run: |
+          version=$(jq -r .version package.json)
+          if [ "$TAG_NAME" != "v$version" ]; then
+            echo "::error::release $TAG_NAME but package.json declares $version"
+            exit 1
+          fi
+      - name: Wait for the vendor rebuild check of the released commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          sha=$(git rev-parse HEAD)
+          echo "released commit: $sha"
+          missing=0
+          for attempt in $(seq 1 60); do
+            run=$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/vendor.yml/runs?head_sha=$sha&per_page=1" \
+              --jq 'if (.workflow_runs | length) == 0 then "none none none"
+                    else (.workflow_runs[0] | "\(.status) \(.conclusion) \(.html_url)") end')
+            run_status=$(echo "$run" | cut -d' ' -f1)
+            conclusion=$(echo "$run" | cut -d' ' -f2)
+            url=$(echo "$run" | cut -d' ' -f3)
+            if [ "$run_status" = "none" ]; then
+              missing=$((missing + 1))
+              if [ "$missing" -ge 10 ]; then
+                echo "::error::no vendor run for $sha, run the vendor workflow on this commit and publish again"
+                exit 1
+              fi
+              echo "no vendor run found yet for $sha"
+            else
+              echo "vendor run: status=$run_status conclusion=$conclusion $url"
+              if [ "$run_status" = "completed" ]; then
+                if [ "$conclusion" = "success" ]; then
+                  exit 0
+                fi
+                echo "::error::the vendor rebuild concluded $conclusion for $sha, see $url"
+                exit 1
+              fi
+            fi
+            sleep 30
+          done
+          echo "::error::timed out waiting for the vendor rebuild of $sha"
+          exit 1
+
+  publish_npm:
+    needs: check_vendor
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      # Setup .npmrc file to publish to npm
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm publish

package/.github/workflows/vendor.yml

@@ -0,0 +1,21 @@
+# .github/workflows/vendor.yml
+
+name: Vendor
+
+on: [push, pull_request]
+
+jobs:
+  rebuild:
+    name: 'Rebuild vendor/zip'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '24'
+      - run: npm ci
+        working-directory: zip-build
+      - run: npm run build
+        working-directory: zip-build
+      # the checked-in files in vendor/zip must be exactly what the sources in zip-build produce
+      - run: git diff --exit-code vendor/zip

package/package.json

@@ -1,11 +1,15 @@
 {
   "name": "single-file-core",
-  "version": "1.5.89",
+  "version": "1.5.90",
   "description": "SingleFile Core",
   "author": "Gildas Lormeau",
   "license": "AGPL-3.0-or-later",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "bump-patch": "npm version patch --no-git-tag-version && npm run bump-commit",
+    "bump-minor": "npm version minor --no-git-tag-version && npm run bump-commit",
+    "bump-major": "npm version major --no-git-tag-version && npm run bump-commit",
+    "bump-commit": "git commit -m \"bump up version\" package.json package-lock.json"
   },
   "repository": {
     "type": "git",
@@ -18,4 +22,4 @@
   "devDependencies": {
     "eslint": "^9.39.1"
   }
-}
+}

package/zip-build/README.md

@@ -0,0 +1,56 @@
+# Rebuilding `vendor/zip`
+
+The three files in [`../vendor/zip`](../vendor/zip) are custom builds of
+[@zip.js/zip.js](https://www.npmjs.com/package/@zip.js/zip.js) with
+[fflate](https://www.npmjs.com/package/fflate) as `DecompressionStream`
+fallback:
+
+- `zip.min.js` — extraction bundle used by self-extracting pages
+  (`ZipReader`, `HttpRangeReader`, blob/text/data-URI readers and writers,
+  no web workers, fflate fallback for browsers without
+  `DecompressionStream`)
+- `zip.js` — creation bundle used when saving pages (full zip-core plus
+  `deflateRaw`/`inflateRaw`)
+- `z-worker.js` — web worker script for the creation bundle
+
+This directory rebuilds them byte-for-byte from their sources. All
+dependencies are pinned to exact versions by `package.json` and
+`package-lock.json`, and the build embeds no timestamps, so the output is
+reproducible on any platform with a recent Node.js version:
+
+```sh
+cd zip-build
+npm ci
+npm run build
+git diff --exit-code ../vendor/zip
+```
+
+An empty diff means the checked-in files match the sources exactly. The
+GitHub Actions workflow `.github/workflows/vendor.yml` runs the same steps
+on every push.
+
+## Files
+
+- `lib/zip.js`, `lib/zip-vendor.js`, `lib/zip-vendor-worker.js` — bundle
+  entry points; they import the zip.js sources from the pinned npm package
+- `lib/fflate.js` — vendored [fflate](https://github.com/101arrowz/fflate)
+  0.8.3 (MIT)
+- `lib/fflate-streams.js` — `CompressionStream`/`DecompressionStream`
+  adapter over fflate
+- `reserved-property-names.json` — property names protected from terser
+  property mangling; generated by `reserved-property-names.js` in the
+  [zip.js repository](https://github.com/gildas-lormeau/zip.js) at the
+  pinned version (the script is not part of the npm package)
+
+## Updating zip.js
+
+1. Bump `@zip.js/zip.js` in `package.json` and run `npm install`.
+2. Regenerate `reserved-property-names.json` from a checkout of the zip.js
+   repository at the matching tag, with its dev dependencies installed:
+
+   ```sh
+   node --input-type=module -e "import { getReservedPropertyNames } from './reserved-property-names.js'; console.log(JSON.stringify([...getReservedPropertyNames()], null, '\t'))" > path/to/single-file-core/zip-build/reserved-property-names.json
+   ```
+
+3. Run `npm run build` and commit the regenerated files in `../vendor/zip`
+   together with the changes in this directory.

package/zip-build/lib/fflate-streams.js

@@ -0,0 +1,47 @@
+/* global TransformStream */
+
+import { Deflate, Inflate } from "./fflate.js";
+
+const FORMAT_DEFLATE_RAW = "deflate-raw";
+
+class FflateStream extends TransformStream {
+	constructor(codec) {
+		super({
+			start(controller) {
+				codec.ondata = chunk => {
+					if (chunk.length) {
+						controller.enqueue(chunk);
+					}
+				};
+			},
+			transform(chunk) {
+				codec.push(chunk);
+			},
+			flush() {
+				codec.push(new Uint8Array(0), true);
+			}
+		});
+	}
+}
+
+class CompressionStreamFallback extends FflateStream {
+	constructor(format, { level } = {}) {
+		checkFormat(format);
+		super(new Deflate(level === undefined ? {} : { level }));
+	}
+}
+
+class DecompressionStreamFallback extends FflateStream {
+	constructor(format) {
+		checkFormat(format);
+		super(new Inflate());
+	}
+}
+
+function checkFormat(format) {
+	if (format != FORMAT_DEFLATE_RAW) {
+		throw new TypeError("Unsupported compression format: " + format);
+	}
+}
+
+export { CompressionStreamFallback, DecompressionStreamFallback };