Typescript Rewrite

[Phillip9587]

This PR is a full TypeScript rewrite of the package as suggested by @blakeembrey in #104 (comment). It also uses tsdown to build a dual bundle: CommonJS for Node.js consumers and an ESM build for browsers and bundlers.

This is another big step for #114.

Tooling

I tried to align the tooling as much as possible with Blake's @borderless/ts-scripts but went for not using it directly. So the package now uses:

• tsdown as build tool (tsdown is powered by rolldown - the same bundler/transformer as vite 8 uses)
• vitest as testing tool with native typescript and coverage support
• eslint and typescript-eslint
• arethetypeswrong and publint for package validation
• prettier as formatter
• husky for git hooks combined with pretty-quick to format only staged files

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	husky@​9.1.7
	@​vitest/​coverage-v8@​3.2.4
	typescript-eslint@​8.55.0
	@​arethetypeswrong/​core@​0.18.2
	vitest@​3.2.4
	@​types/​node@​20.19.33
	prettier-plugin-packagejson@​3.0.0
	publint@​0.3.17
	pretty-quick@​4.2.2
	tsdown@​0.20.3
	typescript@​5.9.3
	prettier@​3.8.1
	eslint@​8.57.1 ⏵ 9.39.2	-2		+1	+46
	@​eslint/​js@​8.57.1 ⏵ 9.39.2			+14

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm vite is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: ? → npm/vitest@3.2.4 → npm/vite@7.3.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@7.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[blakeembrey]

I'm not sure we need to do both ESM and CommonJS, just CommonJS should be fine for a package like this.

Also the TypeScript refactor changes exports but this didn't update the README.

[blakeembrey]

I prefer to have test run everything needed to pass, instead of configuring this in each place (e.g. local, CI, etc). That way everyone knows it's just npm test and if it passes you're good.

[blakeembrey]

Why is this used?

[blakeembrey]

This package shouldn't need @types/node now right?

[blakeembrey]

I'd prefer to just use the TypeScript compiler directly. This adds a bunch of overhead I don't need, e.g. without checking out this PR locally I can't confirm if it's generating the file structure with source maps and .d.ts files correctly, and it shouldn't be bundling any dependencies.

[blakeembrey]

Suggested change

	"types": ["node"],
	"types": [],

[blakeembrey]

Do we need to export package.json?

[blakeembrey]

I tried to align the tooling as much as possible with Blake's @borderless/ts-scripts but went for not using it directly.

I'd love to know why. It's totally understandable to skip it as it's just something I started using once I was maintaining hundreds of packages and got sick of the config bloat of every package, as well as keeping up with minor changes/improvements to things like husky everywhere.