@ciqol/resenv 0.1.0-beta.1 → 0.1.0-beta.2

package/docs/releasing.md

@@ -2,8 +2,8 @@
 
 ## Versions
 
-`beta` is the sole remote and default branch. Releases start at `0.1.0-beta.1`
-and use the npm `beta` tag. A beta tag is not promoted to `latest`.
+`beta` is the sole release and default branch. Releases start at `0.1.0-beta.1`
+and use npm tags `beta` and `latest`, both pointing to the same tested beta.
 
 The planner uses semantic-release's official commit-analysis and release-notes
 plugins. Conventional Commits decide whether changes need a release. Each
@@ -23,7 +23,7 @@ Never edit a generated manifest or overwrite a previously shared archive.
 
 ## CI pipeline
 
-The [CI workflow](../.github/workflows/ci.yml) builds one archive:
+The [CI workflow](https://github.com/ciqol/resenv/blob/beta/.github/workflows/ci.yml) builds one archive:
 
 1. **Build:** normal npm installation, runtime/development audits, registry
    signatures, lint, strict types and colocated Vitest specs. The read-only
@@ -40,9 +40,10 @@ The [CI workflow](../.github/workflows/ci.yml) builds one archive:
    staging receipt; no Git tag or GitHub release is created yet.
 4. **Approval and recording:** the maintainer reviews and approves the staged
    package in npm using interactive 2FA. Wait for npm to make it available,
-   then rerun the original release job. It verifies the published integrity
-   against the original tested archive before creating its Git tag and GitHub
-   prerelease. It does not stage or publish the package again.
+   update `latest` to the approved version, then rerun the original release job.
+   It verifies the published integrity against the original tested archive and
+   requires npm tags `beta` and `latest` to point to that version before creating
+   its Git tag and GitHub prerelease. It does not stage or publish the package again.
 
 Pushes, PRs and dispatches with `publish: false` cannot stage a package. Release
 jobs are serialized and not cancelled. Artifacts last seven days. A fresh
@@ -74,7 +75,7 @@ setup, set Actions variable `RELEASE_ENABLED=true`. Leave it unset until then
 to prevent a dispatch from creating an unrestricted environment automatically.
 Environment creation or protection changes require explicit authorization.
 
-## Run the first beta
+## Run a beta release
 
 Open [CI](https://github.com/ciqol/resenv/actions/workflows/ci.yml), choose
 **Run workflow**, select `beta`, and enable the staging input. When build and
@@ -91,8 +92,15 @@ npm stage approve <stage-id>
 
 These are maintainer review/approval commands; the archive is built and staged
 by GitHub Actions. OIDC cannot perform the approval step. Wait for npm scanning
-and public availability, then rerun the original release job to record the tag.
-Verify the npm version, `beta` tag, archive integrity, provenance and GitHub
+and public availability, then update the default install tag in the maintainer
+session:
+
+```sh
+npm dist-tag add @ciqol/resenv@<approved-version> latest
+```
+
+Rerun the original release job to record the release. Verify the npm version,
+`beta` and `latest` tags, archive integrity, provenance and GitHub
 prerelease. Never infer success from a staging receipt alone.
 
 For a hosted rehearsal, leave the staging input off. Local verification is:
@@ -118,8 +126,8 @@ matches its candidate. A conflicting archive, changed beta head or conflicting
 Git tag stops recovery. Keep the beta branch at the reviewed commit until the
 release is recorded. If its artifact expires, review recovery separately.
 
-The maintainer removed the accidental `1.0.0` publication. Retain the
-`0.0.0-stage` placeholder until `0.1.0-beta.1` is publicly available and verified.
+Retain the `0.0.0-stage` placeholder until a functional beta is publicly
+available and verified.
 With explicit authorization, remove that exact placeholder version and check
 remaining versions and tags. Never unpublish the whole package. npm's unpublish
 policy still applies; deleted versions cannot be reused.
@@ -127,16 +135,19 @@ See [npm's policy](https://docs.npmjs.com/policies/unpublish/).
 
 ## Security and platform limits
 
-The runtime package has no npm dependencies or advisory exceptions. The
-release-tool tree has bounded, executable advisory exceptions expiring November
-9, 2026; it is not vulnerability-free. The privileged job does not install that
-tree. See [release security](release-security.md).
-
-Doppler is the only built-in cloud provider. Fresh native browser login has not
-been verified end to end, Linux credential storage has mock coverage, and
-Windows native login/storage is not implemented. Explicit tokens and existing
-CLI credentials remain supported. Commands require explicit opt-in. Dotenvx
-ciphertext is left unchanged. See [Security](../SECURITY.md).
+The runtime package has no npm dependencies or advisory exceptions. Installed
+runtime and development audits must pass with the unused engine/publisher peer graph
+omitted. Audit and planning enforce that absence; the lockfile still records
+the uninstalled peers. The existing November 9, 2026 review deadline remains
+for the policy and separately reviewed platform npm. The privileged job does
+not install release-tool modules. See [release security](release-security.md).
+
+Doppler is the only built-in cloud provider. Authentication is owned by the
+Doppler CLI; resenv reads its existing directory-scoped token or accepts
+`DOPPLER_TOKEN` for unattended use. It does not manage native credential storage
+or browser login. Standard Windows CLI discovery has injected coverage but no
+native Windows end-to-end verification. Commands require explicit opt-in.
+Dotenvx ciphertext is left unchanged. See [Security](../SECURITY.md).
 
 Sources: [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/),
 [staged publishing](https://docs.npmjs.com/cli/v11/commands/npm-stage/),

package/doppler/auth.cjs

@@ -1,125 +1,19 @@
 'use strict';
 
-var promises = require('node:timers/promises');
-var node_module = require('node:module');
 var errors = require('../errors.cjs');
-var values = require('../values.cjs');
 var http = require('./http.cjs');
 var system = require('./system.cjs');
 
-const manifest = node_module.createRequire(require('node:url').pathToFileURL(__filename).href)('@ciqol/resenv/package.json');
-if (!values.isRecord(manifest) || typeof manifest.version !== 'string')
-    throw new Error('Invalid package version');
-const { version } = manifest;
-function credential(env, system$1 = system.createSystem()) {
+function credential(env, system$1) {
     return Promise.resolve().then(() => {
-        // An explicitly selected identity is never replaced after an API rejection.
+        // An explicit identity is never replaced after validation or API rejection.
         if (env.DOPPLER_TOKEN !== undefined)
             return http.validateToken(env.DOPPLER_TOKEN);
-        let saved;
-        try {
-            saved = system$1.read();
-        }
-        catch (err) {
-            if (!values.hasErrorCode(err, 'DOPPLER_KEYRING_UNAVAILABLE'))
-                throw err;
-        }
-        if (saved)
-            return saved;
-        const token = system$1.cliToken();
+        const token = (system$1 || system.createSystem()).cliToken();
         if (token)
             return token;
-        throw new errors.ResenvError('DOPPLER_AUTH_REQUIRED', 'Run resenv login doppler, or supply DOPPLER_TOKEN. Startup never opens a login prompt.');
+        throw new errors.ResenvError('DOPPLER_AUTH_REQUIRED', 'Run doppler login from your application directory, or supply DOPPLER_TOKEN. Startup never opens a login prompt.');
     });
 }
-async function login({ cli = false, noBrowser = false } = {}, { request = http.createClient(), system: system$1 = system.createSystem(), output = text => process.stderr.write(`${text}\n`), interactive = Boolean(process.stdin.isTTY && process.stderr.isTTY), env = process.env, sleep = promises.setTimeout, now = Date.now } = {}) {
-    if (!interactive || env.CI)
-        throw new errors.ResenvError('DOPPLER_INTERACTIVE_REQUIRED', 'Login requires an interactive local terminal outside CI. Supply DOPPLER_TOKEN for unattended runs.');
-    if (env.DOPPLER_TOKEN !== undefined)
-        throw new errors.ResenvError('DOPPLER_TOKEN_OVERRIDE', 'Unset DOPPLER_TOKEN before logging in; it overrides saved credentials.');
-    const fallback = ({ storeUnavailable = false } = {}) => {
-        output('Using Doppler CLI login.');
-        system$1.cliLogin();
-        if (system$1.canStore && !storeUnavailable) {
-            // Keep the identity chosen by this login ahead of an older resenv token.
-            try {
-                system$1.write(http.validateToken(system$1.cliToken()));
-            }
-            catch {
-                throw new errors.ResenvError('DOPPLER_KEYRING_UNAVAILABLE', 'CLI login completed, but resenv could not update its saved credential. Unlock the credential store and retry.');
-            }
-        }
-        output('Done: Doppler CLI login completed.');
-        return 'cli';
-    };
-    if (cli || !system$1.canStore)
-        return fallback();
-    // Check keyring access before creating an authorization session.
-    try {
-        system$1.read();
-    }
-    catch (err) {
-        if (!values.hasErrorCode(err, 'DOPPLER_KEYRING_UNAVAILABLE'))
-            throw err;
-        return fallback({ storeUnavailable: true });
-    }
-    let challenge;
-    try {
-        // Observed in Doppler's official MCP client, not a public OAuth contract.
-        // Identify resenv honestly rather than impersonating Doppler's MCP client.
-        const query = new URLSearchParams({ hostname: 'resenv', version: `v${version}`, os: process.platform, arch: process.arch });
-        challenge = await request(`/v3/auth/cli/generate/2?${query.toString()}`);
-    }
-    catch (err) {
-        if (values.hasErrorCode(err, 'DOPPLER_ENDPOINT_UNAVAILABLE'))
-            return fallback();
-        throw err;
-    }
-    let url;
-    try {
-        url = new URL(typeof challenge?.auth_url === 'string' ? challenge.auth_url : '');
-    }
-    catch (err) {
-        if (!(err instanceof TypeError))
-            throw err;
-    }
-    if (!challenge || !url || url.origin !== 'https://dashboard.doppler.com' || url.username || url.password || url.pathname !== '/workplace/auth/cli' ||
-        typeof challenge.code !== 'string' || !/^[A-Za-z0-9_-]{8,256}$/.test(challenge.code) ||
-        typeof challenge.polling_code !== 'string' || !/^[A-Za-z0-9_.-]{8,512}$/.test(challenge.polling_code)) {
-        throw new errors.ResenvError('DOPPLER_INVALID_RESPONSE', 'Doppler returned an invalid browser authorization challenge.');
-    }
-    // Display the human authorization code only in the explicit login command.
-    output(`Authorize resenv at ${url.href}`);
-    output(`Authorization code: ${challenge.code}`);
-    if (!noBrowser)
-        system$1.openBrowser(url.href);
-    const deadline = now() + 300000;
-    while (now() < deadline) {
-        const result = await request('/v3/auth/cli/authorize', { body: { code: challenge.polling_code }, pending: true });
-        if (result) {
-            const token = http.validateToken(result.token);
-            try {
-                system$1.write(token);
-            }
-            catch {
-                // Do not leave a newly minted, unpersisted credential active if storage fails.
-                try {
-                    await request('/v3/auth/revoke', { token, body: { token } });
-                }
-                catch (err) {
-                    if (!(err instanceof errors.ResenvError)) {
-                        throw new errors.ResenvError('DOPPLER_KEYRING_UNAVAILABLE', 'Could not save or revoke the login credential. Check Doppler CLI Tokens before retrying.');
-                    }
-                }
-                throw new errors.ResenvError('DOPPLER_KEYRING_UNAVAILABLE', 'Could not save the login credential. Revocation was attempted; check Doppler CLI Tokens, then try resenv login doppler --cli.');
-            }
-            output('Done: Doppler login saved in the OS credential store.');
-            return 'native';
-        }
-        await sleep(2000);
-    }
-    throw new errors.ResenvError('DOPPLER_LOGIN_TIMEOUT', 'Doppler login timed out. Run resenv login doppler to try again.');
-}
 
 exports.credential = credential;
-exports.login = login;

package/doppler/http.cjs

@@ -6,24 +6,19 @@ var values = require('../values.cjs');
 const API_ORIGIN = 'https://api.doppler.com';
 // No environment-controlled endpoint or redirects: credentials stay at Doppler.
 function createClient(fetchImpl = globalThis.fetch) {
-    return async function request(path, { token, body, pending = false } = {}) {
+    return async function request(path, { token } = {}) {
         let response;
         try {
             response = await fetchImpl(new URL(path, API_ORIGIN), {
-                method: body === undefined ? 'GET' : 'POST',
+                method: 'GET',
                 headers: {
                     'content-type': 'application/json',
                     'user-agent': 'ciqol-resenv',
                     ...(token ? { authorization: `Bearer ${token}` } : {})
                 },
-                body: body === undefined ? undefined : JSON.stringify(body),
                 redirect: 'error',
                 signal: AbortSignal.timeout(10000)
             });
-            if (pending && response.status === 409) {
-                await response.body?.cancel();
-                return null;
-            }
             if (!response.ok) {
                 await response.body?.cancel();
                 const code = response.status === 401 ? 'DOPPLER_AUTH_REQUIRED'
@@ -68,7 +63,7 @@ function createClient(fetchImpl = globalThis.fetch) {
 }
 function validateToken(token) {
     if (typeof token !== 'string' || !/^dp\.[a-z]+\.[A-Za-z0-9_.-]{10,512}$/.test(token)) {
-        throw new errors.ResenvError('DOPPLER_INVALID_TOKEN', 'The Doppler credential is malformed. Run resenv login doppler or supply a valid DOPPLER_TOKEN.');
+        throw new errors.ResenvError('DOPPLER_INVALID_TOKEN', 'The Doppler credential is malformed. Check your Doppler CLI login or supply a valid DOPPLER_TOKEN.');
     }
     return token;
 }

package/doppler/system.cjs

@@ -3,96 +3,47 @@
 var node_child_process = require('node:child_process');
 var node_fs = require('node:fs');
 var node_os = require('node:os');
+var node_path = require('node:path');
 var errors = require('../errors.cjs');
 var assertSafeDiagnostics = require('../assert-safe-diagnostics.cjs');
 var http = require('./http.cjs');
 
-// Preserve saved logins from before the package rename.
-const SERVICE = 'ciqol.envref.doppler';
-const ACCOUNT = 'default';
-// Do not pass application secrets, NODE_OPTIONS, loader variables or a
-// repository's PATH to credential helpers. No helper is invoked via a shell.
-function helperEnvironment() {
-    const env = { HOME: node_os.userInfo().homedir, PATH: '/usr/bin:/bin', LANG: 'C.UTF-8' };
-    for (const key of ['SystemRoot', 'USERPROFILE', 'DBUS_SESSION_BUS_ADDRESS', 'XDG_RUNTIME_DIR', 'DISPLAY', 'WAYLAND_DISPLAY']) {
+// Do not pass application secrets, loader variables or a repository's PATH to
+// the worker or CLI. Keep only the OS session needed by Doppler's own storage.
+function helperEnvironment({ platform = process.platform, home = node_os.userInfo().homedir } = {}) {
+    const env = { HOME: home, PATH: '/usr/bin:/bin', LANG: 'C.UTF-8' };
+    for (const key of ['SystemRoot', 'DBUS_SESSION_BUS_ADDRESS', 'XDG_RUNTIME_DIR', 'DISPLAY', 'WAYLAND_DISPLAY']) {
         if (process.env[key])
             env[key] = process.env[key];
     }
+    if (platform === 'win32') {
+        env.USERPROFILE = home;
+        env.APPDATA = node_path.win32.join(home, 'AppData', 'Roaming');
+        env.LOCALAPPDATA = node_path.win32.join(home, 'AppData', 'Local');
+        env.PATH = node_path.win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32');
+    }
     return env;
 }
-function createSystem({ platform = process.platform, run = node_child_process.spawnSync, exists = node_fs.existsSync } = {}) {
-    const invoke = (file, args, options = {}) => {
-        assertSafeDiagnostics.assertSafeDiagnostics();
-        return run(file, args, {
-            env: helperEnvironment(), encoding: 'utf8', timeout: 15000,
-            maxBuffer: 16384, stdio: ['pipe', 'pipe', 'pipe'], shell: false, ...options
-        });
-    };
-    const mac = platform === 'darwin' && exists('/usr/bin/security');
-    const linux = platform === 'linux' && exists('/usr/bin/secret-tool');
-    const cli = ['/opt/homebrew/bin/doppler', '/usr/local/bin/doppler', '/usr/bin/doppler'].find(exists);
-    const unavailable = () => new errors.ResenvError('DOPPLER_KEYRING_UNAVAILABLE', 'The OS credential store is unavailable. Use the Doppler CLI or supply DOPPLER_TOKEN.');
-    function read() {
-        if (!mac && !linux)
-            return undefined;
-        const result = mac
-            ? invoke('/usr/bin/security', ['find-generic-password', '-s', SERVICE, '-a', ACCOUNT, '-w'])
-            : invoke('/usr/bin/secret-tool', ['lookup', 'service', SERVICE, 'account', ACCOUNT]);
-        if (!result.error && result.status === 0)
-            return http.validateToken(result.stdout.trim());
-        if (!result.error && ((mac && result.status === 44) || (linux && result.status === 1 && !result.stderr)))
-            return undefined;
-        throw unavailable();
-    }
-    function write(token) {
-        http.validateToken(token);
-        if (!mac && !linux)
-            throw unavailable();
-        // security's interactive interpreter receives the token on stdin, never
-        // the OS process argument list. The token alphabet excludes separators.
-        const result = mac
-            ? invoke('/usr/bin/security', ['-i'], { input: `add-generic-password -U -s ${SERVICE} -a ${ACCOUNT} -w ${token}\n` })
-            : invoke('/usr/bin/secret-tool', ['store', '--label=resenv Doppler', 'service', SERVICE, 'account', ACCOUNT], { input: token });
-        if (result.error || result.status !== 0)
-            throw unavailable();
-        // security -i may report a subcommand failure with a zero process status.
-        if (read() !== token)
-            throw unavailable();
-    }
-    function remove() {
-        if (!mac && !linux)
-            throw unavailable();
-        const result = mac
-            ? invoke('/usr/bin/security', ['delete-generic-password', '-s', SERVICE, '-a', ACCOUNT])
-            : invoke('/usr/bin/secret-tool', ['clear', 'service', SERVICE, 'account', ACCOUNT]);
-        if (result.error || (result.status !== 0 && !(mac && result.status === 44)))
-            throw unavailable();
-    }
+function createSystem({ platform = process.platform, home = node_os.userInfo().homedir, run = node_child_process.spawnSync, exists = node_fs.existsSync } = {}) {
+    // Use standard installation locations so npm's repository-local PATH cannot
+    // substitute a credential helper. Windows locations cover WinGet and Scoop.
+    const paths = platform === 'win32'
+        ? [node_path.win32.join(home, 'AppData', 'Local', 'Microsoft', 'WinGet', 'Links', 'doppler.exe'), node_path.win32.join(home, 'scoop', 'apps', 'doppler', 'current', 'doppler.exe')]
+        : ['/opt/homebrew/bin/doppler', '/usr/local/bin/doppler', '/usr/bin/doppler', node_path.join(home, '.local', 'bin', 'doppler'), node_path.join(home, 'bin', 'doppler')];
     function cliToken() {
+        assertSafeDiagnostics.assertSafeDiagnostics();
+        const cli = paths.find(exists);
         if (!cli)
-            return undefined;
-        const result = invoke(cli, ['configure', 'get', 'token', '--plain']);
+            throw new errors.ResenvError('DOPPLER_CLI_UNAVAILABLE', 'Install the Doppler CLI in a standard location and run doppler login, or supply DOPPLER_TOKEN. See https://docs.doppler.com/docs/cli.');
+        const result = run(cli, ['configure', 'get', 'token', '--plain', '--no-check-version', '--no-read-env'], {
+            env: helperEnvironment({ platform, home }), encoding: 'utf8', timeout: 15000,
+            maxBuffer: 16384, stdio: ['pipe', 'pipe', 'pipe'], shell: false
+        });
         if (result.error || result.status !== 0 || !result.stdout.trim())
             return undefined;
         return http.validateToken(result.stdout.trim());
     }
-    function cliLogin() {
-        if (!cli)
-            throw new errors.ResenvError('DOPPLER_CLI_UNAVAILABLE', 'Doppler CLI fallback is unavailable. Install Doppler or supply DOPPLER_TOKEN.');
-        const result = invoke(cli, ['login'], { stdio: 'inherit', timeout: 300000 });
-        if (result.error || result.status !== 0)
-            throw new errors.ResenvError('DOPPLER_LOGIN_FAILED', 'Doppler CLI login did not complete.');
-        if (!cliToken())
-            throw new errors.ResenvError('DOPPLER_LOGIN_FAILED', 'Doppler CLI login did not provide a credential.');
-    }
-    function openBrowser(url) {
-        const file = mac ? '/usr/bin/open' : '/usr/bin/xdg-open';
-        if (!exists(file))
-            return false;
-        const result = invoke(file, [url]);
-        return !result.error && result.status === 0;
-    }
-    return { read, write, remove, cliToken, cliLogin, openBrowser, canStore: mac || linux };
+    return { cliToken };
 }
 
 exports.createSystem = createSystem;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ciqol/resenv",
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.2",
   "description": "Replace environment references with their resolved values at application startup",
   "license": "MIT",
   "publishConfig": {

package/types/src/doppler/auth.d.ts

@@ -1,19 +1,4 @@
 import type { Environment } from '../types.js';
-import type { Request } from './http.js';
 import type { CredentialSystem } from './system.js';
-type LoginOptions = {
-    readonly cli?: boolean;
-    readonly noBrowser?: boolean;
-};
-type LoginDependencies = {
-    readonly request?: Request;
-    readonly system?: CredentialSystem;
-    readonly output?: (text: string) => void;
-    readonly interactive?: boolean;
-    readonly env?: Readonly<Environment>;
-    readonly sleep?: (ms: number) => Promise<unknown>;
-    readonly now?: () => number;
-};
-declare function credential(env: Readonly<Environment>, system?: Pick<CredentialSystem, 'read' | 'cliToken'>): Promise<string>;
-declare function login({ cli, noBrowser }?: LoginOptions, { request, system, output, interactive, env, sleep, now }?: LoginDependencies): Promise<'cli' | 'native'>;
-export { credential, login };
+declare function credential(env: Readonly<Environment>, system?: CredentialSystem): Promise<string>;
+export { credential };

package/types/src/doppler/http.d.ts

@@ -1,9 +1,7 @@
 export type RequestOptions = {
     readonly token?: string;
-    readonly body?: Readonly<Record<string, string>>;
-    readonly pending?: boolean;
 };
-export type Request = (path: string, options?: RequestOptions) => Promise<Record<string, unknown> | null>;
+export type Request = (path: string, options?: RequestOptions) => Promise<Record<string, unknown>>;
 declare function createClient(fetchImpl?: typeof globalThis.fetch): Request;
 declare function validateToken(token: unknown): string;
 export { createClient, validateToken };

package/types/src/doppler/system.d.ts

@@ -7,18 +7,13 @@ type SyncOptions = SpawnSyncOptionsWithStringEncoding & {
 export type SyncRunner = (file: string, args: readonly string[], options: SyncOptions) => SpawnSyncReturns<string>;
 type SystemOptions = {
     readonly platform?: NodeJS.Platform;
+    readonly home?: string;
     readonly run?: SyncRunner;
     readonly exists?: typeof existsSync;
 };
 export type CredentialSystem = ReturnType<typeof createSystem>;
-declare function helperEnvironment(): Environment;
-declare function createSystem({ platform, run, exists }?: SystemOptions): {
-    read: () => string | undefined;
-    write: (token: string) => void;
-    remove: () => void;
+declare function helperEnvironment({ platform, home }?: Pick<SystemOptions, 'platform' | 'home'>): Environment;
+declare function createSystem({ platform, home, run, exists }?: SystemOptions): {
     cliToken: () => string | undefined;
-    cliLogin: () => void;
-    openBrowser: (url: string) => boolean;
-    canStore: boolean;
 };
 export { createSystem, helperEnvironment };

package/docs/maturity.md

@@ -1,61 +0,0 @@
-# Maturity evaluation
-
-Evaluated on October 8, 2026 with the Tashtit maturity 0.3.1 catalog, using
-static working-tree evidence only. This measures the catalog's repository
-hygiene rules; it does not certify security or readiness to publish. Tests
-and hosted checks are recorded separately in [validation](validation.md).
-
-## Maturity: 91% (11/120 weight failing)
-
-The maintained source tree scores 100% (0/97 weight failing). The full catalog
-also discovers the generated `dist/package.json`, so its findings are retained.
-
-| Scope | Failing weight | Relevant weight |
-| --- | ---: | ---: |
-| Root npm project | 0 | 41 |
-| Generated distribution | 11 | 23 |
-| Repository hygiene | 0 | 24 |
-| GitHub Actions | 0 | 32 |
-| Total | 11 | 120 |
-
-## Findings
-
-- **High: generated package has no sibling lockfile** (`lockfile-missing`, 8).
-  Evidence: `dist/package.json:2`; no `dist/package-lock.json` exists. A maintained
-  npm project needs a lockfile. This directory is generated from the root's v3
-  lockfile and consumers maintain their own locks; it is not another workspace.
-  Reference: [npm lockfiles](https://docs.npmjs.com/cli/configuring-npm/package-lock-json).
-- **Medium: generated package has no sibling runtime-version file**
-  (`setup-nvmrc`, 3). Evidence: `dist/package.json:2`; no `dist/.nvmrc` exists.
-  Development projects should pin a runtime. The generated package declares
-  `engines.node: >=20` and does not need contributor setup files. The root
-  `.nvmrc` pins Node 24.19.0. Reference: [nvm version files](https://github.com/nvm-sh/nvm#nvmrc).
-
-## Passed checks
-
-- Root: one v3 npm lockfile, no competing yarn lockfile, `.npmrc`, `.nvmrc`, and
-  registry dependencies with exact direct versions. CI uses `npm ci` and
-  normal lifecycle behavior; it does not pass `--ignore-scripts`.
-- Repository: valid CODEOWNERS syntax, README, CONTRIBUTING and `.editorconfig`.
-- CI: a parseable workflow, explicit scoped token permissions, bounded job
-  timeouts, no `pull_request_target`, and pinned remote actions. The GitHub-owned
-  upload action's exact `v7.0.1` tag is permitted by the catalog.
-
-The earlier 88% score included a lifecycle-script finding that is now resolved.
-No dependency installation, build, test, or remote request was used to derive
-this static score.
-
-## Not evaluated by this catalog
-
-- Docker rules: no candidate Dockerfile exists.
-- Repository protections, private vulnerability reporting and maintainer access.
-- License suitability, secret history, provider login, and runtime behavior.
-
-See [public readiness](public-readiness.md) for the separate exposure audit and
-[validation](validation.md) for observed checks.
-
-## Fixable findings
-
-No automatic fix is appropriate. The generated package's broad runtime range
-does not identify a development version to pin, and adding another lockfile
-would misrepresent it as a maintained workspace.