`cross-spawn` is bundled instead of listed as a dependency

[iiroj]

Hello,

when looking at the inner workings of tinyexec I notice cross-spawn is used to parse the command string to values passed to spawn from node:child_process:

tinyexec/src/main.ts

Lines 298 to 304 in dac1064

	const crossResult = _parse(normalisedCommand, normalisedArgs, nodeOptions);
	const handle = spawn(
	crossResult.command,
	crossResult.args,
	crossResult.options
	);

I was curious because it seems to be only listed as a development dependency — looks like it gets bundled/inlined into the production code that is shipped to npm. Is there a reason for this? Would it make sense to instead list cross-spawn as a dependency that gets automatically installed?

At least the licence of cross-spawn should be distributed in tinyexec, but I couldn't find it from the distribution: https://github.com/moxystudio/node-cross-spawn/blob/master/LICENSE

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

[43081j]

it gets bundled on purpose

it shouldn't really exist anymore in its current state (cross-spawn as a whole). the plan was to do the work to figure out what is actually still needed and implement it ourselves. we just didn't get around to it yet, so it is bundled until then

we should mention the LICENSE, you're right

@sxzz do you happen to know a way we can include the license in the build output? it doesn't belong in the repo given there's no cross-spawn code in here. but it does belong in the distributed code

[iiroj]

Thank you for the response! I'll leave this ticket open in case you add the license.

[sxzz]

You may consider using https://www.npmjs.com/package/rollup-plugin-license or refer to https://github.com/vitejs/vite/blob/main/packages/vite/rollupLicensePlugin.ts for more information.