v0.0.2

Fixes three faults in 0.0.1 that affected every install. Upgrading is recommended.

npm install astrosharp@0.0.2

Fixed

Vite warned about a missing sourcemap for every module. The published .js files each ended
with a //# sourceMappingURL comment while the .map files were deliberately excluded from the
package, so Vite went looking for files that were not there — 46 warnings on a hello-world build.
Sourcemap generation is off, so the reference is gone along with the file.

// @ts-check in astro.config.mjs reported a wall of TS2322. The integration declared its own
copies of Astro's hook parameter types, and one of them demanded an index signature that Astro's
AstroConfig does not have. Because hook parameters are contravariant, that made the whole
integration unassignable to AstroIntegration. The types are now derived from Astro's own
AstroIntegration rather than copied, so they resolve against whichever Astro you have installed
and cannot drift from it.

npm audit reported a critical vulnerability via astrosharp. The WASI toolchain
(@bytecodealliance/jco) was a hard dependency for the experimental wasm render mode, which is off
by default — so every install paid roughly 97 MB of node_modules and inherited a critical advisory
through decompress, whether or not it used wasm.

A plain install is now 141 MB instead of 403 MB and reports 0 vulnerabilities.

If you use experimental: { serverRendering: 'wasm' }

The toolchain is now an optional peer dependency, so install it explicitly:

npm install -D @bytecodealliance/jco @bytecodealliance/preview2-shim

Building without it fails immediately with a message naming that command. Nothing else about the
mode has changed. This is the only breaking change in the release, and it affects only that mode.

How these were missed, and what now catches them

Every test in the repository consumed the package through the npm workspace, from source. That
resolves exports but ignores files, never type-checks a consumer's config, and never sees the
dependency tree an install produces — so all three faults were invisible to a green suite.

The package verification step now installs the tarball outside the workspace and additionally:

• type-checks a // @ts-check astro.config.mjs against the shipped .d.ts, under Astro's own
  strict preset
• fails if any shipped file points at a sourcemap that is not shipped
• fails if a plain install pulls the WASI toolchain

All three were confirmed by running them against the published 0.0.1 tarball, where all three fail.