Release esdev@0.24.0 · Open-Tech-Foundation/ES-Runtime

esdev <file> --import-policy (D194), with esrun's: a dependency policy is
applied by esdev build, which names it in esdev.json.

esdev build applies the import policy esdev.json names as
build.importPolicy to what every build ships (D193): each module read into
a bundle, for every target and the dev loop's builds. A deployed bundle
inlines its packages, so the runtime loader never saw them and a policy
governed nothing that shipped. A refusal lists every refused package and
writes nothing; "unlisted": "warn" reports instead; build tools whose code
does not ship are never judged.
An import policy's allow entries can pin a package:
{ "package": "zod", "version": "3.23.8", "integrity": "h1:…", "reason": "…" }.
esdev build checks each shipped copy's installed version and, where
integrity is given, Go's h1: hash of its installed files; a mismatch
fails the build in every mode (D193).
esdev build --inventory=<file> writes what the build shipped as a draft
import policy — each package's version and h1: hash, an empty reason,
and the project's own directories — for a security team to review and
commit. The configured policy is still applied, and the draft is written
even when it refuses; the reviewed file itself is never overwritten.
build.subresourceIntegrity adds integrity="sha384-…" to every
<script> and stylesheet, preload or modulepreload <link> a release
HTML build writes, so a browser refuses a file that changed after the build.
Off by default, as a CDN that rewrites files breaks it.

The programs esdev runs get RUNTIME_ENV when the shell has not set it
(D192): development for esdev <file> and the server esdev start runs,
test under esdev test, so environment() in runtime:process says
where code is running. esdev build still defines only
process.env.NODE_ENV, which describes the build.
esdev --install-types adds its compilerOptions.types entry to a
tsconfig.json with comments or trailing commas, keeping both and the
file's layout, where it used to leave such a file alone and print the lines
to add (D191). A file that is not valid JSONC is still left alone, and says
so.
The spa, fullstack, docs and library starters follow the framework's
rename from OTF Web to AFW: they depend on
@opentf/esdev-plugin-afw, @opentf/afw, @opentf/afw-docs,
@opentf/afw-cli and @opentf/afw-test, the docs config is
afw.config.js, routes come from @afw/routes, and TypeScript projects get
afw-env.d.ts. The menu group reads "AFW". Projects scaffolded earlier keep
working on the @opentf/web* packages they were pinned to.

esdev build and esdev start no longer recognise a project built by the
retired otfw CLI (an otfw.config.js, or scripts calling otfw) to point
at its own toolchain. AFW projects are esdev projects with an esdev.json;
a directory without one gets the ordinary missing-esdev.json error.

esdev build --minify keeps the space after a closing ] or ) in a
selector, which is the descendant combinator: [data-theme="dark"] * was
written as [data-theme="dark"]*, which matches the themed element alone.
Every Tailwind dark: utility built on a class or attribute variant matched
only <html>, so a minified site's dark mode left its own components light.
[open] .x and :not(.a) .b lost their space the same way.
The docs starter builds its search index: its config named an unknown
search provider (otf), so the build skipped the index and the navbar
search had nothing to query. The fullstack starter's sample middleware
sends x-powered-by: afw.
The docs starter's root layout uses the theme's afwd-shell classes, so
the navbar, page and footer stack as the theme lays them out.

Navigation Menu