
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Build your libraries with ease
Rollup based build tool for building libraries based on package.json config and simple CLI options.
It is simple building tool that supports building to different targets like: es
, cjs
, umd
without additional trasformation other than minification using terser
or preprocess using rollup-plugin-preprocess
.
It is created to easily build libraries that contains mutliple subpath exports (entry points, subpackages) because it is not that easy to do at the moment with microbundle
, tsdx
or ng-packagr
(if you are on Typescript).
Using npm:
npm install --save-dev pkgbld
npm init
npm install --save-dev pkgbld
src/index.ts
"scripts": {
"build": "pkgbld"
},
Run npm run build
.
pkgbld
expects name field to be filled in the package.json file. exports
field defines what entries/outputs should be build for this package.
pkgbld --umd=index,core
Where index,core
should be replaced by entry points that should be comiled in umd format, index is top level '.'
entry point.
If package.json
defined umd field option will be defaulted to index
.
pkgbld --compress=es,umd
Where es,umd
should be replaced by formats that should be compressed using terser.
pkgbld --sourcemaps=es,cjs
Where es,cjs
should be replaced by targets for which sourcemaps should be generated. Default umd
.
Supported targets for this option: es
, cjs
and umd
.
pkgbld --formats=es
Defines what formats to build, only supports es
and cjs
at the moment. Use umd
flag to build umd target.
pkgbld --preprocess=index
Defines what entry points/files should be preprocessed using rollup-plugin-preprocess
. For the entry point will be defined variable es (for esm target), cjs (for commonjs) and umd (for umd) depending on the target type. Please request more variables / more granular logic if you want more.
pkgbld --dir=dist
Directory to put output files.
pkgbld --sourcedir=src
Directory to search for input files.
pkgbld --bin=./dist/index.cjs,./dist/index.mjs
File(s) to make executable. First entry will be added to package.json
pkgbld --include-externals
Bundles all externals into package.
pkgbld --eject
Ejects Rollup config.
pkgbld --no-ts-config
Do not check / write tsconfig.json.
pkgbld --no-update-package-json
Do not write package.json.
pkgbld
reads all installed packages named pkgbld-plugin-*
and assumes they are plugins
Plugins suppose to implement one or more of following interface methods as their package exports:
interface PkgbldPlugin {
options(parsedArgs: {[key: string]: string | number}, options: ReturnType<typeof getCliOptions>): void;
processPackageJson(packageJson: PackageJson, inputs: string[], logger: Logger): void;
processTsConfig(config: Json): void;
providePlugins(provider: Provider, config: Record<string, string | string[] | boolean>, inputs: string[]): Promise<void>;
getExtraOutputSettings(format: InternalModuleFormat, inputs: string[]): Partial<OutputOptions>;
buildEnd(): Promise<void>;
}
FAQs
README.md
The npm package pkgbld receives a total of 14 weekly downloads. As such, pkgbld popularity was classified as not popular.
We found that pkgbld demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.