Modernize tooling and add TypeScript strict mode + tests

.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run lint
+      - run: npm test
+      - run: npm run build

.github/workflows/npm-publish.yml

@@ -1,5 +1,5 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
+# This workflow builds the package and publishes it to npm when a release is created.
+# For more information see: https://docs.github.com/actions/guides/publishing-nodejs-packages
 
 name: Node.js Package
 
@@ -12,14 +12,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: 14
+          node-version: 20
+          cache: npm
           registry-url: https://registry.npmjs.org/
-      - run: npm i
-      - run: rm -rf ./dist/*
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run lint
+      - run: npm test
       - run: npm run build
       - run: npm publish
         env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/ossar-analysis.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
 
     # Ensure a compatible version of dotnet is installed.
     # The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201.
@@ -32,6 +32,6 @@ jobs:
 
       # Upload results to the Security tab
     - name: Upload OSSAR results
-      uses: github/codeql-action/upload-sarif@v1
+      uses: github/codeql-action/upload-sarif@v3
       with:
         sarif_file: ${{ steps.ossar.outputs.sarifFile }}

.github/workflows/sitemap.yml

@@ -9,9 +9,9 @@ jobs:
 
     steps:
     - name: Checkout the repo
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
-        fetch-depth: 0 
+        fetch-depth: 0
 
     - name: generate-sitemap
       # You may pin to the exact commit or the version.

.gitignore

@@ -103,4 +103,6 @@ dist
 # TernJS port file
 .tern-port
 .parcel-cache/
-package-lock.json
+
+# Vitest coverage
+coverage/

ROADMAP.md

@@ -0,0 +1,80 @@
+# Cropo Roadmap
+
+This document tracks the path from the current modernized `0.6.x` line to a stable
+`1.0.0` release.
+
+## Where we are: `0.6.0` (tooling & maintenance refresh)
+
+The library code (`script.ts`) is unchanged in behavior, but the project around it has
+been brought back up to date after a long pause:
+
+- **Build**: migrated from the unmaintained `microbundle` to **tsup** (esbuild based).
+  Outputs ESM (`dist/script.js`), CommonJS (`dist/script.cjs`), an IIFE/global build
+  (`dist/script.global.js`) for `<script>`/CDN usage, plus type declarations.
+- **TypeScript**: added an explicit `tsconfig.json` with `strict` mode enabled and an
+  `npm run typecheck` script. The source was updated to satisfy strict null/initialization
+  checks (definite-assignment assertions, null-guards on `getContext`/`toBlob`).
+- **Linting**: migrated to **ESLint 9 flat config** (`eslint.config.mjs`) with
+  `typescript-eslint`, replacing the legacy `.eslintrc.json` + unmaintained
+  `eslint-config-standard`.
+- **Tests**: introduced **Vitest** (`jsdom` environment) with an initial suite covering
+  construction, crop-info math, panning/clamping, and export guards.
+- **CI**: a single `ci.yml` runs typecheck + lint + test + build on every push/PR (Node 20);
+  `npm-publish.yml` runs the same gate before publishing. Deprecated GitHub Actions were
+  upgraded (`checkout@v4`, `setup-node@v4`, `codeql-action@v3`).
+- **Reproducibility**: `package-lock.json` is now committed and CI uses `npm ci`.
+- **Demo site** (`docsSrc/`): removed unused React and a hardcoded local-tarball dependency,
+  fixed the build to install/run on any machine, and upgraded Parcel + Tailwind 3.
+
+## The road to `1.0.0` (breaking changes)
+
+`1.0.0` is the cleanup release that removes the long-deprecated compatibility layer. These
+are **breaking** changes and must land together behind a major version bump, only after the
+test suite covers the affected behavior.
+
+### 1. Remove the deprecated function-style API
+
+`script.ts` currently exports standalone functions (`download`, `loadCanvas`,
+`loadImageFromUrl`, `loadSlider`, `move`, `getCropInfo`, `getDataUrl`) that proxy to a
+single shared module-level `new Cropo({})` instance. They have carried
+`@deprecated since 0.6` notices since 2022.
+
+- Delete the function exports and the module-level `const cr = new Cropo({})`.
+- This also removes a side effect on import (the shared instance currently constructs a
+  canvas at module load), which is good for tree-shaking and SSR-safety.
+
+**Migration for consumers:**
+
+```ts
+// Before (deprecated function API)
+import { loadCanvas, loadImageFromUrl, download } from 'cropo'
+loadCanvas(canvasEl)
+loadImageFromUrl(url)
+download()
+
+// After (class API)
+import { Cropo } from 'cropo'
+const cropo = new Cropo({ canvas: canvasEl, imageUrl: url })
+cropo.download()
+```
+
+### 2. Make constructor options required
+
+The constructor options object is currently fully optional (`options?: { ... }`) — see the
+`// TODO: remove optional from version 1.0.0` marker in `script.ts`. For 1.0:
+
+- Require the options object, and require at least a `canvas` (or document the canvas it
+  creates). Keep individual tuning fields (`maxScale`, `fit`, etc.) optional.
+- Remove the `// TODO` once done.
+
+### 3. Tighten and expand tests before the cut
+
+- Add coverage for zoom (`zoomScale`/`zoomDelta`), slider input, and the export paths
+  (`getDataUrl`/`getBlob`) using the canvas stubs already in `test/setup.ts`.
+- These guard the behavior that the API cleanup must preserve.
+
+## Possible follow-ups (post-1.0, not committed)
+
+- Tailwind 4 upgrade for the demo (CSS-first config) — deferred to avoid churn now.
+- Replace the manual `docsSrc/test.tsx` demo wiring with a small typed entry, or document it.
+- Consider publishing with npm provenance (`--provenance`) from CI.