[hsd-bot]

Closes #113

Replaces #114, which was closed for the rewrite of #113.

Summary

• Validation (carried over unchanged from the reviewed test: smoke-test the built release files #114, since that never merged): IMAGEDIFF_LIBRARY=<path from repo root> npm test runs the Node specs with that file loaded through require and the browser specs with it loaded as a <script> global. If it's unset, the specs use js/imagediff.js. npm run test:built runs this for imagediff.js and then imagediff.min.js.
• npm run release runs npm run build && npm run test:built. The fresh files stay in place, ready to commit in the release PR. It doesn't bump, tag or publish.
• npm publish runs a prepublishOnly script: git diff --exit-code --stat HEAD -- imagediff.js imagediff.min.js && npm run test:built. It refuses to publish if the built files differ from what's committed or if they fail the specs. It never rebuilds.
• README and a new CONTRIBUTING "Releasing" section say to use npm run release.

Decisions

• The publish check compares against HEAD. npm publishes the working tree, so "what's published matches what's committed" needs an explicit check. Uncommitted edits to the built files make npm publish fail and print which file differs.
• The publish check doesn't compare to the source. Following the ticket, npm publish validates the committed files as they are. Whether they're a fresh build of the source is settled in the release PR by npm run release.
• The scripts use POSIX VAR=value in test:built, so they won't run under Windows cmd. They're maintainer-only release scripts.
• CLI: bin/imagediff loads js/imagediff.js, so the CLI specs in each run exercise the source, not the built file. Unchanged from test: smoke-test the built release files #114.
• The history isn't rewritten. I wasn't allowed to force-push, so this branch keeps test: smoke-test the built release files #114's two commits under the new one. The net diff against master is just this change, so squash-merging gives a clean result.
• chore(release): 2.0.0 #101 should say to run npm run release in the release PR. I didn't edit chore(release): 2.0.0 #101 itself because it's outside this ticket.

Found while testing (not fixed here, worth a ticket before 2.0.0)

npm publish --dry-run warns "bin[imagediff]" script name bin/imagediff was invalid and removed, and the published manifest would have no bin. Installs would then not get the imagediff command. This is the same on master, so it isn't caused by this change. npm also needs --tag to publish the prerelease version 2.0.0-alpha.1.

Testing (dev container image)

• npm run release: the build passes and the specs pass against both files (44 Node and 39 browser specs each). Afterwards git status shows the committed build outputs unchanged, so they match a fresh build.
• Appending a throw to imagediff.min.js makes npm run test:built exit 1.
• npm publish --dry-run, run in a container with the repo's .git mounted: prepublishOnly ran both test passes and they passed. npm then stopped on the prerelease --tag requirement above.
• The git diff --exit-code HEAD guard exits 1 with an edited imagediff.js and 0 when it's clean.
• npm test with IMAGEDIFF_LIBRARY unset still passes against the source.

🤖 Generated with Claude Code

[hsd-bot]

hsd review round 3

Verdict: approve. This does what the rewritten #113 asks. The validation is carried over unchanged from #114, which I approved in round 2. The new parts are the release and prepublishOnly scripts and the docs.

Checked in the dev container (hsd-js-imagediff-issue-113), at f9761bf:

• npm run release builds both files, then passes 44 Node specs and 39 browser specs against imagediff.js and against imagediff.min.js. It exits 0.
• After the release, git status is clean, so the committed outputs match a fresh build.
• Appending throw 1 to imagediff.min.js makes npm run test:built exit 1.
• On the host, the prepublishOnly guard git diff --exit-code --stat HEAD -- imagediff.js imagediff.min.js exits 0 on a clean tree. The PR reports it exits 1 when a built file has been edited.
• The PR's net diff against origin/master is 7 files (+35/−6), and CI is green.

Against the issue:

• npm run release builds and validates in place, and doesn't tag or publish. ✅
• npm publish runs prepublishOnly, which checks that the committed built files are unchanged and then runs test:built. It never rebuilds. ✅
• README and CONTRIBUTING say to use npm run release. ✅ chore(release): 2.0.0 #101 still needs that line added by hand.

Nits (not blocking):

• The branch still carries test: smoke-test the built release files #114's two commits, and one of them adds make/release-check.js, which the next commit deletes. Please squash-merge. A merge commit, which the repo has used so far, would bring that churn into master.
• npm publish --ignore-scripts skips prepublishOnly. That's expected npm behavior and fine for a guard aimed at the maintainer.
• Carried over: the CLI specs always run against the source, the VAR=x syntax only works in POSIX shells, and the published package still includes dev-only files.
• The PR found that npm drops bin when publishing ("bin[imagediff]" script name bin/imagediff was invalid and removed). That happens on master too, and it would ship 2.0 without the imagediff command, so it deserves its own ticket before release.

[hsd-bot]

hsd: ready for human review after 1 review round(s). Agent sessions are still live in tmux -L hsd-js-imagediff attach -t issue-113-test-smoke-test-the-built-release-files.