Replaces the external tar process with zlib.gunzipSync plus a minimal
ustar reader, so the smoke test spawns nothing but Node and behaves
identically on every OS and Node version in the matrix. npm tarballs
are gzipped ustar archives of regular files only, which is the one
shape the reader accepts; a path-escape guard rejects anything else.
Keeps the published surface of bowser@2.14.1 intact while adding a real
ESM build, and rewrites CI so it can actually run the new toolchain.
Packaging
- Restore the flat artifact layout. es5.js and bundled.js stay at the
tarball root next to src/, so unpkg.com/bowser/es5.js and
require('bowser/bundled') keep working. bowser.mjs is added alongside.
- Build the UMD bundles from dedicated single-default-export entries in
build/entries/. src/bowser.js gained named exports (parse, getParser)
to fix#511, but a UMD bundle with named exports makes require('bowser')
a namespace object instead of the class: typeof flips from 'function' to
'object' and BROWSER_MAP / ENGINE_MAP / OS_MAP / PLATFORMS_MAP disappear,
since they are static getters rather than exports.
- globalName back to lowercase 'bowser', matching the shipped es5.js.
Renaming it to 'Bowser' would break every script-tag consumer.
- Enumerate every legacy subpath in the exports map. Conditional exports
are honoured from Node 12.16.0 onward, so a "."-only map turns paths
that resolve today into ERR_PACKAGE_PATH_NOT_EXPORTED. Subpath patterns
("./src/*") need Node 12.20.0+ and the trailing-slash folder form was
removed in Node 17, so explicit per-file keys are the only spelling that
works across the whole supported range. Extension-less aliases included:
the README documents require('bowser/bundled').
- main, browser and module keep their existing values. No engines field
(npm warns EBADENGINE, pnpm fails under engine-strict) and no type
field (it would reclassify es5.js as ESM).
Build
- Minify the UMD bundles with terser instead of rolldown's built-in oxc
minifier. oxc prints every string literal as a template literal and
rejects any compress.target below es2015, so it cannot emit ES5 and was
silently undoing babel's lowering. terser is what webpack 4 used.
- Wire up the copyright banner, which was declared but never passed to a
config, and restore bundled.js as the polyfilled build via core-js/stable.
- Add index.d.mts so the import condition has ESM types. Reusing the
export = declarations for both conditions describes an ES module with
CommonJS types.
CI
- Replace npm ci with pnpm across all workflows. This is what was failing:
the lockfile was swapped for pnpm-lock.yaml but the workflows still ran
npm ci, pinned to Node 12.16.3 and 16. Build now runs on Node 24, which
tsdown requires.
- Add a pack-smoke job that installs the packed tarball on Node 12.16.3,
14, 18, 20 and 24 and exercises every documented entry point, plus
publint and attw on the tarball. This is what makes "non-breaking" a
tested claim rather than an argument; it catches all of the above.
- Restore test-list-of-ua.js to asserting src against the built es5.js.
It had been collapsed to comparing Bowser.parse with itself.
