Tags: perki/backloop.dev-node

5.2.1

5.2.0

5.2.0 as published to npm

5.1.0

5.1.0 as published to npm

Stop fetching the certificate when the module is imported

The ESM entry awaited the certificate at the top level and exported the result,
so `import httpsOptions from 'backloop.dev'` performed a network request merely
by being imported. That is where the broken Vite builds came from: Node refuses
require() on a graph containing a top-level await, and Vite loads vite.config.js
with require(), so a config importing this could not be loaded at all. A
production build that needs no certificate also downloaded one, and since 4.0.0
that meant it needed a secret to build.

It now exports the three functions, like the CommonJS entry, and nothing happens
until one is called. The default export holds the same three, so ESM and CJS
finally look alike.

Breaking, hence 5.0.0 — and breaking quietly would be worse than breaking. Code
that hands the default export to https.createServer used to get a working
options object; it would now get a module and start a server with no
certificate, failing somewhere far from the cause. Reading key, cert or ca
therefore throws a message naming the replacement.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Say, on npm only, that npm is no longer where this is updated

This branch exists to be published. It is main plus this one file, and it must
stay that way: notice.js on main already loads the module optionally, so nothing
shared needs touching and a rebase can never conflict.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Show one distribution warning per process, not one per package

A Vite project loads the plugin and this package, and both said the same thing
in turn — sixteen lines at every start, when the plugin's message already names
both dependencies to change.

Whichever speaks first now sets a well-known symbol on globalThis and the other
stays quiet. A symbol rather than an environment variable: it does not pollute
the environment, and it does not silence a child process that has its own story.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Say, on npm only, that npm is no longer where this is updated

This branch exists to be published. It is main plus this one file, and it must
stay that way: notice.js on main already loads the module optionally, so nothing
shared needs touching and a rebase can never conflict.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Tag what is published, so the artifact has a git ref

The npm branch adds a file, so the tarball differs from the tag of the same
name. Leaving that to be discovered is how a supply-chain question becomes an
unanswerable one; a -npm tag says exactly which tree was published.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>