Consider Including UMD build as part of npm package

[gaelmotte]

Hi,

The Salesforce Platform does not allow importing ESM or CJS package.
Instead, it requires UMD built js files to be added as a static resource in the packaged product to be deployed (and cannot be retrieved through CDNs)

This causes me add a fixed TAR release form GH as a dependency
npm i https://github.com/panva/jose/archive/refs/tags/v4.14.5.tar.gz

This makes it much harder to update the jose as any other dependency in the project.
Forge does release UMD built files through their npm package for instance.

I believe this proposed change would be :

• change package.json to remove "!dist/**/*.umd.js",
• Possibly add this exclusion in other package targets : tools/publish(...).js
• kinda related to 3b3100a

Thanks for your consideration on this one.

[panva]

Because of unfortunately popular amongst developers metrics, such as bundlephobia and npm's own total files / unpacked size metrics adding the complete bundle a third time (already present is cjs and esm) to the "main" jose npm release is not an option. What I mean, while irrelevant to those in the know, for those who aren't this makes the module look bad to a point where they won't consider using it... unfortunately.

I can add the umd bundle to the https://www.npmjs.com/package/jose-browser-runtime npm releases tho? These runtime specific releases are deployed from the same gh workflow...

[panva]

done in https://github.com/panva/jose/releases/tag/v4.14.6

[gaelmotte]

Thanks alot @panva !
updated the dependency on my hand. works like a charm.