@ciqol/resenv 0.1.0-beta.1 → 0.1.0-beta.2

package/docs/public-readiness.md

@@ -1,138 +0,0 @@
-# Public repository readiness
-
-## Follow-up review — 2026-10-12
-
-The repository is now public, with `beta` as the sole remote and default branch.
-CI has staged the first `0.1.0-beta.1` candidate; npm approval and release
-recording are still pending. The accidental public `1.0.0` has been removed,
-and the `0.0.0-stage` placeholder remains. Recheck live state before release work.
-
-Private vulnerability reporting returned `enabled: false` during this review.
-The security policy's reporting prerequisite remains outstanding until that
-setting is enabled and verified. See [the session handoff](maintainer-handoff.md)
-and [validation](validation.md) for current behavior and observed checks.
-The dated transition plan below is historical evidence.
-
-## Approved transition - 2026-10-10
-
-The current release pipeline and launch state are documented in [releasing](releasing.md).
-The release-tool review and expiring advisory policy are in [release security](release-security.md).
-Earlier dated entries below remain historical evidence and are superseded where
-the current release guide describes a different state.
-
-The user approved public visibility, default branch `beta`, and deletion of
-the four older ancestor branch references. A fresh settings snapshot, complete
-Git bundle and verified restore are retained outside the repository. Recheck
-remote heads and ancestry immediately before deletion. Other governance changes
-and PR creation remain outside this transition.
-
-
-Reviewed on October 8, 2026 at `cb6ebe92c3182051a034dd29e192d51a182b5d22`, before
-the accompanying documentation cleanup. Repository: `ciqol/resenv`. Maintainer
-and authenticated GitHub account: `titan-ron`.
-
-## Result
-
-No real credentials or private machine/employer references were identified in
-the reviewed Git history or hosted Actions outputs. The source can become a
-public experimental repository after the remaining decisions below. This does
-not establish npm release readiness or an independent security audit.
-
-The repository remains private. No branch, default-branch, access, protection,
-or visibility setting was changed by this audit.
-
-## Exposure review
-
-- Gitleaks 8.30.1 scanned all 24 commits reachable from the fetched refs. Its
-  nine matches were synthetic Doppler credentials in tests: eight use a dummy
-  marker and one uses an alternative fixture marker with sequential digits.
-  The tests inject provider and credential helpers instead of authenticating
-  those values. No detector exception or history rewrite was added.
-- TruffleHog 3.97.4 scanned the local Git history with network verification and
-  update checks disabled. It reported no credentials. Sandbox process-inspection
-  restrictions produced temporary-cleanup warnings; the scan completed.
-- Reachable-blob inspection found no committed dotenv/private-key files,
-  absolute developer paths, employer references, or private service URLs.
-- All 14 existing Actions log archives and 14 unexpired package artifacts were
-  downloaded into a private audit folder and scanned offline. Gitleaks found
-  no secrets. Package inspection covered 755 regular files across the archives
-  and found no credential files or private developer/employer references.
-- There are no existing issues or pull requests to review for public exposure.
-- The latest pre-cleanup [CI run](https://github.com/ciqol/resenv/actions/runs/37778134741)
-  passed on Linux Node 20/22/24 and macOS Node 24.
-
-Detection tools cannot prove the absence of every secret. No candidate
-credential was sent to a provider to test whether it works. Git history remains
-visible after deleting an ancestor branch. GitHub exposes existing Actions
-history and logs when visibility becomes public; see
-[GitHub's visibility documentation](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility).
-
-## Cleanup prepared
-
-- Ignore local `.idea/` settings without deleting the developer's files.
-- Keep installation and contributor text independent of repository visibility.
-- Include the MIT license and ciqol contributors copyright, selected on October 8.
-  Registry publication remains disabled.
-- Mark historical validation/dependency entries so old APIs and version plans
-  are not mistaken for current usage instructions.
-- Remove unnecessary references to other project names from current docs.
-  Historical commits remain unchanged.
-- Direct security questions from the issue chooser to the security policy.
-- Prepare `beta` as the sole normal release branch on npm's `beta` channel. CI
-  also checks the current `titan/beta` preparation branch until branch cleanup.
-  PR checks and manual dispatch remain; publishing stays disabled.
-- Recalculate maturity: 91% including generated output, 100% for the maintained
-  source tree. These scores do not establish release readiness.
-
-## Remaining decisions and settings
-
-1. **License resolved:** MIT was selected on October 8, 2026, with copyright
-   held by ciqol contributors. The root and generated manifests declare MIT;
-   the [license](../LICENSE) is included in the package archive.
-2. **Branches:** the selected sole normal release branch is `beta`, with npm
-   channel `beta`. A local dry run with only that branch calculated `1.0.0`;
-   another stable branch is unnecessary. Default-branch selection and deletion
-   of the older branches remain pending. See [release preparation](releasing.md).
-3. **Private reporting:** the endpoint returned HTTP 404 while the repository
-   is private. Enable and verify it after the approved visibility transition,
-   and verify the reporting option described in SECURITY.md. It is not yet available.
-4. **Protections:** all branch entries report `protected: false`; the ruleset
-   API returned HTTP 403 under the current private plan. Re-audit effective
-   protections after the transition. No protection policy was applied.
-
-## Proposed transition
-
-This plan is for review. It does not authorize npm publication, collaborator or
-team changes, merge-policy changes, rulesets, or a pull request.
-
-| Branch | Observed head | Action for the beta-only layout |
-| --- | --- | --- |
-| `beta` | Same reviewed source head as the preparation branch | Keep; make default |
-| `titan/beta` | Current preparation branch | Delete after verifying its head is retained by `beta` |
-| `titan/bootstrap-envref` | `b25da7cfe730bfaca0a470d9a31a303cef7d33ad` | Delete branch pointer |
-| `titan/rename-resenv` | `60e70a4e43b39fc9a87379990e4ed44de50726cb` | Delete branch pointer |
-| `titan/prepare-first-release` | `0c313483d7123b8b4afd360b4e8daae58abc4241` | Delete after changing the default |
-
-At the original audit, all three older heads were ancestors of `titan/beta`;
-none contained unique commits. Before deletion, re-check every remote head and
-verify all four older branches are ancestors of the retained `beta` head. Stop
-if any contains newer or unique work.
-
-After the branch decision, obtain explicit approval for the default
-branch, listed deletions, public visibility, and private vulnerability reporting.
-The CI push filter and release docs are prepared for this layout. Apply
-only approved scopes and verify branches, default, visibility, reporting and
-CI by read-back. Keep npm publishing disabled until its separate prerequisites
-are complete.
-
-## Recovery
-
-A private settings snapshot and complete Git bundle are retained outside this
-repository. Bundle verification and a restore into a separate local bare
-repository reproduced all four original remote branch heads exactly.
-
-Restore deleted branch pointers from their recorded SHAs or bundle before
-restoring the old default branch. Visibility can be set back to private, but
-public forks, downloaded code and copied logs cannot be recalled. A settings
-rollback cannot undo public disclosure. Never overwrite newer branch work or
-weaken protections to force a restore.

package/docs/security-performance-review.md

@@ -1,150 +0,0 @@
-# Security and performance review
-
-Historical review: the October 12 beta removes dotenvx decryption and its entire
-runtime dependency tree. Earlier cryptography and ciphertext findings below
-apply to the prototype. Current behavior is in [Security](../SECURITY.md).
-
-## Release preparation update - 2026-10-10
-
-The current release pipeline and launch state are documented in [releasing](releasing.md).
-The release-tool review and expiring advisory policy are in [release security](release-security.md).
-Earlier dated entries below remain historical evidence and are superseded where
-the current release guide describes a different state.
-
-
-Reviewed on 2026-10-06 against the private 0.1.0 candidate, starting at
-`b50fa9b`. This is a source review with targeted reproductions, regression tests
-and measurements. It is not an independent audit or a security certification.
-
-A later change on the same day migrates the implementation and CLI to strict
-TypeScript. The findings below describe the reviewed baseline and fixes; see
-[the current build contract](build.md) and [validation](validation.md) for the
-generated declarations and implementation checks that supersede the earlier
-declaration-only setup.
-
-## Findings and changes
-
-| Priority | Finding reproduced | Change and regression coverage |
-| --- | --- | --- |
-| P1 | Node's `child_process` debug category printed dummy credentials from subprocess environment values and private worker stdin. | Reject resenv subprocess/helper operations before spawning when that native debug category is enabled. Cover wildcards, case, cached debug state and safe no-work preloads in [diagnostic tests](https://github.com/ciqol/resenv/blob/e57a8fe72ecf956fc99c661d40b1ca707bbcd172/test/diagnostics.test.mjs). |
-| P1 | Combining automatic resolution modes could interpret a fetched secret as a shell expression on the second pass. | Share preload state across CJS/ESM, reject mixed modes and reject CLI resolution after a preload. Verify both preload orders and the CLI combination in [runtime tests](https://github.com/ciqol/resenv/blob/e57a8fe72ecf956fc99c661d40b1ca707bbcd172/test/doppler-runtime.test.mjs). |
-| P2 | Invalid UTF-8 from the provider was silently converted to a different secret value; escaped lone surrogates were also accepted. | Decode JSON with fatal UTF-8 validation and reject malformed Unicode values. Cover both paths in [Doppler tests](https://github.com/ciqol/resenv/blob/e57a8fe72ecf956fc99c661d40b1ca707bbcd172/test/doppler.test.mjs). |
-| P2 | A non-writable second property could fail after the first environment property had already changed. | Preflight all changed descriptors before committing; reject setters and Proxy targets. Preserve writable sealed records. Cover atomicity in [resolver tests](https://github.com/ciqol/resenv/blob/e57a8fe72ecf956fc99c661d40b1ca707bbcd172/test/resolver.test.mjs). |
-| P2 | Unique Doppler lookups ran sequentially, making startup latency grow with each request. | Deduplicate references and allow four requests at a time. Stop scheduling after failure, await active requests and discard partial results. Deterministic tests check overlap, deduplication and failure behavior. |
-| P2 | The generic in-place return type preserved an input's literal reference type after its value had changed. | Return `Environment`; add compile-time regression checks to both installed CJS and ESM consumers. |
-
-Unexpected cleanup errors now produce safe errors instead of disappearing in
-empty catch blocks. Known already-exited process groups remain harmless.
-Credential-revocation failures retain a safe message without raw provider
-details. Regression tests cover these cases with dummy values.
-
-The debug guard uses Node's actual `debuglog().enabled` state. Clearing
-`NODE_DEBUG` after Node initializes it is insufficient. Use `NODE_DEBUG=ciqol:resenv`
-for variable names and outcome messages without values. See Node's
-[debuglog documentation](https://nodejs.org/api/util.html#utildebuglogsection-callback).
-
-## Reviewed boundaries
-
-- Only original environment references are processed within a resolution call.
-  Fetched and decrypted output remains literal.
-- Doppler requests use a fixed HTTPS origin, reject redirects and request only
-  named secrets. An explicit identity is not silently replaced after rejection.
-- The synchronous worker receives references and an optional token over stdin.
-  Credential helpers receive a filtered environment and fixed executable paths.
-  Application secrets, loader options and a repository's PATH are not forwarded
-  to those helpers.
-- Requests have a ten-second deadline and a 1 MiB response limit. A resolution
-  allows at most 128 references, with a 64 KiB limit per cloud value. The worker
-  has a 60-second deadline and 1 MiB captured-output limit.
-- Shell execution requires explicit opt-in. Startup never starts interactive
-  login automatically; login rejects CI and noninteractive use.
-- Plain environments avoid subprocesses, credential discovery and loading the
-  cryptography dependency. Runtime dependency versions are unchanged.
-
-These boundaries do not isolate secrets from the application, a debugger or
-other code running as the same user. Commands execute with that user's access,
-and their external effects cannot be rolled back. Configure one resolver per
-launch; repeated manual calls or a separately installed child-process preload
-can reinterpret values. See [SECURITY.md](../SECURITY.md).
-
-## Performance measurements
-
-Run `npm run bench` after building. The benchmark uses dummy values and a mocked
-provider, with no real credentials or network requests. Measurements below use
-Node 24.19.0 on macOS arm64; they are observations, not CI timing thresholds.
-
-| Measurement | Before | After |
-| --- | ---: | ---: |
-| 16 references, eight unique requests, 40 ms simulated latency per request; median of five runs | 332.069 ms | 81.705 ms |
-| Peak concurrent provider requests | 1 | 4 |
-| No-work library call with 200 plain variables; median of 5,000 calls | 0.047 ms | 0.045 ms |
-
-The mocked lookup case is about 4.1 times faster. Real Doppler latency, rate
-limits and credential-store latency may differ; four is a conservative client
-limit, not a published provider concurrency allowance.
-
-The final fresh-process measurements interleave baseline, CJS preload and ESM
-preload runs. Each reports the median of 20 samples after discarding three
-warmup samples; disk caches remain warm.
-
-| Final startup measurement | Median |
-| --- | ---: |
-| Node alone | 46.427 ms |
-| Node with `--require @ciqol/resenv/resolve` and no references | 52.177 ms |
-| Node with `--import @ciqol/resenv/resolve` and no references | 50.722 ms |
-
-The observed extra startup cost was about 4-6 ms. Scheduling and filesystem
-noise affect these small measurements; no startup speedup is claimed.
-
-## Standards applied
-
-The requested TypeScript authoring, library-build and style standards were
-applied to the existing `.mjs` project and its public declarations:
-
-- Public option objects use type aliases and readonly properties. `Environment`
-  remains mutable because in-place resolution writes it.
-- ESLint checks runtime/build JavaScript and declarations. Rules cover undefined
-  names, empty handlers, parameter count, catch naming and the selected public
-  TypeScript conventions. Existing compact JavaScript formatting is preserved.
-- Declaration checks and installed `.cts`/`.mts` consumers use `strict` and
-  `noUncheckedIndexedAccess`. This checks the declaration contract, not the
-  `.mjs` implementation with TypeScript.
-- Rollup still emits explicit CJS/ESM extensions with a shared implementation,
-  types-first conditional exports and external runtime dependencies. Clean
-  consumers verify the packed artifact without source-tree links or lint/build
-  tools installed as runtime dependencies.
-- CI runs lint and declaration checks before building one archive for every
-  compatibility job. Actions are pinned, permissions are read-only and install
-  lifecycle scripts are disabled. Both manifests remain private by request.
-
-The new development dependencies and their provenance limits are recorded in
-[the dependency review](dependencies.md). No new runtime dependency was added.
-
-## Validation and remaining work
-
-- All 70 unit/process tests passed locally on Node 20.20.2, 22.22.3 and 24.19.0.
-- The packed package passed 13 runtime checks and two typed consumers on Node
-  24. Lint and strict declaration checks passed.
-- Nx 23.2.1 passed target dotenv loading, local/shell precedence, target
-  isolation and strict failures for command and Doppler modes. Tests used a
-  temporary workspace, dummy credentials and an existing Nx installation
-  read-only; consumer files were not changed.
-- npm reported zero known vulnerabilities, 103 verified registry signatures
-  and 37 verified attestations in the installed development tree. Advisory and
-  signature checks do not rule out unknown vulnerabilities.
-- [Hosted CI](https://github.com/ciqol/resenv/actions/runs/37462966577) passed for
-  `e57a8fe`: one build and four compatibility jobs on Linux (Node 20, 22 and 24)
-  and macOS (Node 24). Each job passed all 70 tests, 13 installed runtime checks
-  and two typed consumers against the same archive. The Linux build verified
-  103 registry signatures and 38 attestations with zero known vulnerabilities.
-  Counts apply to each platform's installed tree.
-- Workflow structure and documentation links passed local checks. Existing
-  distributed archives retained their original SHA-256 hashes. The final
-  documentation update records the tested commit; it does not change runtime code.
-
-Before public release, settle the license and whether to retain the older
-dotenvx decryption feature. The fresh native browser-login flow and live Linux
-keyring integration still need verification. Windows native login/storage is
-not implemented. Repository reporting/protection and npm publishing setup are
-also outstanding in [the release plan](releasing.md). The repository remains
-private and unpublished, with PR creation on hold.