@ciqol/resenv 0.1.0-beta.1 → 0.1.0

package/docs/releasing.md

@@ -1,143 +1,78 @@
 # Releases
 
-## Versions
-
-`beta` is the sole remote and default branch. Releases start at `0.1.0-beta.1`
-and use the npm `beta` tag. A beta tag is not promoted to `latest`.
-
-The planner uses semantic-release's official commit-analysis and release-notes
-plugins. Conventional Commits decide whether changes need a release. Each
-releasable update increments the counter from the latest reachable
-`v0.1.0-beta.N` tag; docs-only changes do not release. Breaking changes during
-this experimental line also increment the beta counter. Selecting a stable
-line or another base version is a separate release-policy change.
-
-The full semantic-release engine requires a normal release branch and defaults
-to a first version of 1.0.0. Using its official plugins directly preserves the
-requested sole-beta-branch setup without inventing a stable branch or a release
-that never happened. The base line is declared in `release.config.mjs`.
-
-The development manifest and ordinary local builds stay private. Only a valid
-release plan sets the distribution version and removes `private` before packing.
-Never edit a generated manifest or overwrite a previously shared archive.
-
-## CI pipeline
-
-The [CI workflow](../.github/workflows/ci.yml) builds one archive:
-
-1. **Build:** normal npm installation, runtime/development audits, registry
-   signatures, lint, strict types and colocated Vitest specs. The read-only
-   planner generates the beta version and notes from Git history. Rollup builds
-   it once; npm packs it and records SHA-256 and SHA-512 integrity.
-2. **Consumers:** Linux Node 20, 22 and the pinned Node 24, plus macOS Node 24,
-   install and test the same archive. Checks cover ESM, CJS, types, preloads,
-   CLI, literal secret output and failure boundaries. Nothing is rebuilt.
-3. **Release:** a manual dispatch from `beta` with `publish: true`, after every
-   check passes. The protected job verifies hashes, workflow identity and the
-   current branch head. It installs no project dependencies and runs no package
-   code. `npm stage publish` submits the exact archive through OIDC with
-   provenance and the explicit `beta` tag. The job validates and saves npm's
-   staging receipt; no Git tag or GitHub release is created yet.
-4. **Approval and recording:** the maintainer reviews and approves the staged
-   package in npm using interactive 2FA. Wait for npm to make it available,
-   then rerun the original release job. It verifies the published integrity
-   against the original tested archive before creating its Git tag and GitHub
-   prerelease. It does not stage or publish the package again.
-
-Pushes, PRs and dispatches with `publish: false` cannot stage a package. Release
-jobs are serialized and not cancelled. Artifacts last seven days. A fresh
-workflow run is not a substitute for rerunning the original release job when
-recovering an already staged/published candidate.
-
-## Required setup
-
-The existing npm trusted publisher must match:
+**Merge the PR to `main`; CI publishes the release.** There is no separate
+approval button, npm staging queue or Finalize job. Manual workflow dispatch
+runs checks only. The default branch requires a PR, current passing checks,
+resolved review threads and squash merging, with no bypass actors. The sole
+maintainer approves by merging; no second reviewer is required.
+
+## Normal flow
+
+CI audits dependencies, checks signatures, lint, types and coverage, builds
+once, and tests the packed build across Linux Node 20/22/24 and macOS Node 24.
+After a merge, the protected release job downloads that build and invokes
+standard semantic-release. The official npm plugin prepares the release
+version and archive; consumer checks run again on the final package. The
+official npm and GitHub plugins publish to npm `latest` and create the GitHub
+release. No source is rebuilt during release.
+
+Conventional Commits determine releases: fixes and performance changes bump
+patch, features bump minor, and breaking changes bump minor while the package
+remains below 1.0. Docs and maintenance commits alone do not trigger a release.
+Squash PR titles must follow that convention. `0.x.x` denotes initial
+development, not a SemVer prerelease; published versions have no beta suffix.
+A guard blocks 1.0 until that transition is reviewed explicitly.
+
+## Initial 0.1.0 release
+
+semantic-release starts at 1.0.0 when no regular release tag exists. To preserve
+0.x numbering without a fake tag, the first enabled main release publishes the
+tested `0.1.0` archive through npm OIDC and records its real tag and GitHub
+release. Thereafter the normal engine uses that baseline. Existing beta tags
+and npm versions remain historical; the `beta` channel is not updated.
+
+## Setup
+
+- Default/release branch: `main`, protected by PRs and the actual CI/CodeQL checks.
+- npm trusted publisher: `ciqol/resenv`, `ci.yml`, environment `release`, with
+  **direct publish** permission. Stage-only permission cannot run this flow.
+- GitHub environment `release`: allow only `main`, with no required reviewers.
+- `RELEASE_ENABLED=true` only after protection, the npm publisher and dependency
+  audit are verified. The maintainer manages the npm setting.
+
+On npmjs.com, open **@ciqol/resenv → Settings → Trusted publishing** and
+configure its GitHub Actions publisher with these exact values:
 
 | Field | Value |
 | --- | --- |
-| Provider | GitHub Actions |
-| Organization | `ciqol` |
+| Organization or user | `ciqol` |
 | Repository | `resenv` |
-| Workflow filename | `ci.yml` |
-| Environment | `release` |
-| Permission | `npm stage publish` |
-
-No permanent npm token or direct-publish permission is needed. The pinned
-Node 24.19.0/npm 11.17.0 platform includes staged publishing. New trusted
-publisher configurations must be validated by a successful CI operation before
-the deadline shown in npm settings.
-
-The GitHub environment `release` accepts only the `beta` branch and has no
-required GitHub reviewers. CI submits staged packages; the maintainer approves
-publication in npm. After reading back the branch policy and verifying npm
-setup, set Actions variable `RELEASE_ENABLED=true`. Leave it unset until then
-to prevent a dispatch from creating an unrestricted environment automatically.
-Environment creation or protection changes require explicit authorization.
-
-## Run the first beta
-
-Open [CI](https://github.com/ciqol/resenv/actions/workflows/ci.yml), choose
-**Run workflow**, select `beta`, and enable the staging input. When build and
-consumer checks pass, the release job stages the archive without another GitHub
-approval. Its summary and the `resenv-stage` artifact contain the stage
-identifier and tested integrity.
-
-Review the staged package in npm, then approve it with the stage identifier:
-
-```sh
-npm stage view <stage-id> --json
-npm stage approve <stage-id>
-```
-
-These are maintainer review/approval commands; the archive is built and staged
-by GitHub Actions. OIDC cannot perform the approval step. Wait for npm scanning
-and public availability, then rerun the original release job to record the tag.
-Verify the npm version, `beta` tag, archive integrity, provenance and GitHub
-prerelease. Never infer success from a staging receipt alone.
-
-For a hosted rehearsal, leave the staging input off. Local verification is:
-
-```sh
-npm ci
-npm run audit
-npm run release:check
-```
-
-None of these commands publishes. The planner can generate a non-publishing
-plan with `node scripts/release-plan.mjs /absolute/path/to/candidate-directory`.
-
-## Recovery and old versions
-
-A failed stage operation creates no Git tag or GitHub release. Check npm before
-retrying an ambiguous outcome: a staged version reserves its version number.
-Do not attempt to stage it again while awaiting approval. Approve or reject the
-existing stage through npm. Rejection requires a reviewed replacement candidate.
-
-The original release job accepts an existing public version only if integrity
-matches its candidate. A conflicting archive, changed beta head or conflicting
-Git tag stops recovery. Keep the beta branch at the reviewed commit until the
-release is recorded. If its artifact expires, review recovery separately.
-
-The maintainer removed the accidental `1.0.0` publication. Retain the
-`0.0.0-stage` placeholder until `0.1.0-beta.1` is publicly available and verified.
-With explicit authorization, remove that exact placeholder version and check
-remaining versions and tags. Never unpublish the whole package. npm's unpublish
-policy still applies; deleted versions cannot be reused.
-See [npm's policy](https://docs.npmjs.com/policies/unpublish/).
-
-## Security and platform limits
-
-The runtime package has no npm dependencies or advisory exceptions. The
-release-tool tree has bounded, executable advisory exceptions expiring November
-9, 2026; it is not vulnerability-free. The privileged job does not install that
-tree. See [release security](release-security.md).
-
-Doppler is the only built-in cloud provider. Fresh native browser login has not
-been verified end to end, Linux credential storage has mock coverage, and
-Windows native login/storage is not implemented. Explicit tokens and existing
-CLI credentials remain supported. Commands require explicit opt-in. Dotenvx
-ciphertext is left unchanged. See [Security](../SECURITY.md).
-
-Sources: [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/),
-[staged publishing](https://docs.npmjs.com/cli/v11/commands/npm-stage/),
-[semantic-release branching](https://semantic-release.org/foundation/workflow-configuration/).
+| Workflow filename | `ci.yml` (filename only) |
+| Environment name | `release` |
+| Allow npm publish | Enabled |
+| Allow npm dist-tag | Not needed for this single-branch release flow |
+
+Save the configuration and complete npm's confirmation if prompted. Staging is
+always allowed; enabling direct publishing is the required change. The branch
+restriction lives in GitHub's `release` environment, which already allows only
+`main`. Keep account 2FA and the existing token restrictions; no npm token is
+needed. See [npm's trusted-publishing guide](https://docs.npmjs.com/trusted-publishers/).
+
+Never publish from a developer machine, configure a permanent npm publishing
+token, or request local npm login. Local `npm run release:check` is read-only
+with respect to publication. Only the trusted main push can pass the release
+guard. A merge does not waive a failing audit or the security review expiry.
+
+## Failures
+
+Inspect the failed run, npm version and GitHub tag before retrying. The standard
+engine creates its tag before calling publishers; a failed publication may
+therefore leave a tag or partial release. Rerunning is not a general repair for
+that state. Recover the intended version using its original source and archive
+after maintainer review; do not retag different code or silently replace a
+published version. The initial bootstrap creates its tag after npm succeeds;
+if GitHub recording fails, recover that published baseline before another run.
+
+No workflow automatically deletes tags, releases or npm versions. Existing
+beta versions without matching GitHub releases need separate recovery from
+their original evidence. See [release security](release-security.md).

package/docs/security-exceptions.json

@@ -1,139 +1,6 @@
 {
   "expires": "2026-11-09T00:00:00.000Z",
   "owner": "titan-ron",
-  "scope": "Release planning only; runtime audit has no exceptions.",
-  "exceptions": [
-    {
-      "advisory": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
-      "package": "brace-expansion",
-      "versions": [
-        "5.0.9"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/brace-expansion"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
-      "package": "brace-expansion",
-      "versions": [
-        "5.0.9"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/brace-expansion"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
-      "package": "brace-expansion",
-      "versions": [
-        "5.0.9"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/brace-expansion"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm",
-      "package": "braces",
-      "versions": [
-        "3.0.3"
-      ],
-      "nodes": [
-        "node_modules/braces"
-      ],
-      "reason": "The planner blocks every braces callable and only uses micromatch matching, which delegates to picomatch."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-ch52-4w7c-c8xp",
-      "package": "http-cache-semantics",
-      "versions": [
-        "4.2.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/http-cache-semantics"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q",
-      "package": "ip-address",
-      "versions": [
-        "10.5.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/ip-address"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-2vr4-cq9g-pvrc",
-      "package": "ip-address",
-      "versions": [
-        "10.5.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/ip-address"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-j6r3-76f7-8jcv",
-      "package": "ip-address",
-      "versions": [
-        "10.5.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/ip-address"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw",
-      "package": "ip-address",
-      "versions": [
-        "10.5.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/ip-address"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
-      "package": "postcss-selector-parser",
-      "versions": [
-        "7.1.4"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/postcss-selector-parser"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-3wwx-pv8p-q78v",
-      "package": "undici",
-      "versions": [
-        "6.28.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/undici"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-rfgv-xxqx-mfg5",
-      "package": "undici",
-      "versions": [
-        "6.28.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/undici"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    }
-  ]
+  "scope": "No advisory exceptions; the complete installed tree must pass npm audit at moderate severity.",
+  "exceptions": []
 }

package/doppler/auth.cjs

@@ -1,125 +1,19 @@
 'use strict';
 
-var promises = require('node:timers/promises');
-var node_module = require('node:module');
 var errors = require('../errors.cjs');
-var values = require('../values.cjs');
 var http = require('./http.cjs');
 var system = require('./system.cjs');
 
-const manifest = node_module.createRequire(require('node:url').pathToFileURL(__filename).href)('@ciqol/resenv/package.json');
-if (!values.isRecord(manifest) || typeof manifest.version !== 'string')
-    throw new Error('Invalid package version');
-const { version } = manifest;
-function credential(env, system$1 = system.createSystem()) {
+function credential(env, system$1) {
     return Promise.resolve().then(() => {
-        // An explicitly selected identity is never replaced after an API rejection.
+        // An explicit identity is never replaced after validation or API rejection.
         if (env.DOPPLER_TOKEN !== undefined)
             return http.validateToken(env.DOPPLER_TOKEN);
-        let saved;
-        try {
-            saved = system$1.read();
-        }
-        catch (err) {
-            if (!values.hasErrorCode(err, 'DOPPLER_KEYRING_UNAVAILABLE'))
-                throw err;
-        }
-        if (saved)
-            return saved;
-        const token = system$1.cliToken();
+        const token = (system$1 || system.createSystem()).cliToken();
         if (token)
             return token;
-        throw new errors.ResenvError('DOPPLER_AUTH_REQUIRED', 'Run resenv login doppler, or supply DOPPLER_TOKEN. Startup never opens a login prompt.');
+        throw new errors.ResenvError('DOPPLER_AUTH_REQUIRED', 'Run doppler login from your application directory, or supply DOPPLER_TOKEN. Startup never opens a login prompt.');
     });
 }
-async function login({ cli = false, noBrowser = false } = {}, { request = http.createClient(), system: system$1 = system.createSystem(), output = text => process.stderr.write(`${text}\n`), interactive = Boolean(process.stdin.isTTY && process.stderr.isTTY), env = process.env, sleep = promises.setTimeout, now = Date.now } = {}) {
-    if (!interactive || env.CI)
-        throw new errors.ResenvError('DOPPLER_INTERACTIVE_REQUIRED', 'Login requires an interactive local terminal outside CI. Supply DOPPLER_TOKEN for unattended runs.');
-    if (env.DOPPLER_TOKEN !== undefined)
-        throw new errors.ResenvError('DOPPLER_TOKEN_OVERRIDE', 'Unset DOPPLER_TOKEN before logging in; it overrides saved credentials.');
-    const fallback = ({ storeUnavailable = false } = {}) => {
-        output('Using Doppler CLI login.');
-        system$1.cliLogin();
-        if (system$1.canStore && !storeUnavailable) {
-            // Keep the identity chosen by this login ahead of an older resenv token.
-            try {
-                system$1.write(http.validateToken(system$1.cliToken()));
-            }
-            catch {
-                throw new errors.ResenvError('DOPPLER_KEYRING_UNAVAILABLE', 'CLI login completed, but resenv could not update its saved credential. Unlock the credential store and retry.');
-            }
-        }
-        output('Done: Doppler CLI login completed.');
-        return 'cli';
-    };
-    if (cli || !system$1.canStore)
-        return fallback();
-    // Check keyring access before creating an authorization session.
-    try {
-        system$1.read();
-    }
-    catch (err) {
-        if (!values.hasErrorCode(err, 'DOPPLER_KEYRING_UNAVAILABLE'))
-            throw err;
-        return fallback({ storeUnavailable: true });
-    }
-    let challenge;
-    try {
-        // Observed in Doppler's official MCP client, not a public OAuth contract.
-        // Identify resenv honestly rather than impersonating Doppler's MCP client.
-        const query = new URLSearchParams({ hostname: 'resenv', version: `v${version}`, os: process.platform, arch: process.arch });
-        challenge = await request(`/v3/auth/cli/generate/2?${query.toString()}`);
-    }
-    catch (err) {
-        if (values.hasErrorCode(err, 'DOPPLER_ENDPOINT_UNAVAILABLE'))
-            return fallback();
-        throw err;
-    }
-    let url;
-    try {
-        url = new URL(typeof challenge?.auth_url === 'string' ? challenge.auth_url : '');
-    }
-    catch (err) {
-        if (!(err instanceof TypeError))
-            throw err;
-    }
-    if (!challenge || !url || url.origin !== 'https://dashboard.doppler.com' || url.username || url.password || url.pathname !== '/workplace/auth/cli' ||
-        typeof challenge.code !== 'string' || !/^[A-Za-z0-9_-]{8,256}$/.test(challenge.code) ||
-        typeof challenge.polling_code !== 'string' || !/^[A-Za-z0-9_.-]{8,512}$/.test(challenge.polling_code)) {
-        throw new errors.ResenvError('DOPPLER_INVALID_RESPONSE', 'Doppler returned an invalid browser authorization challenge.');
-    }
-    // Display the human authorization code only in the explicit login command.
-    output(`Authorize resenv at ${url.href}`);
-    output(`Authorization code: ${challenge.code}`);
-    if (!noBrowser)
-        system$1.openBrowser(url.href);
-    const deadline = now() + 300000;
-    while (now() < deadline) {
-        const result = await request('/v3/auth/cli/authorize', { body: { code: challenge.polling_code }, pending: true });
-        if (result) {
-            const token = http.validateToken(result.token);
-            try {
-                system$1.write(token);
-            }
-            catch {
-                // Do not leave a newly minted, unpersisted credential active if storage fails.
-                try {
-                    await request('/v3/auth/revoke', { token, body: { token } });
-                }
-                catch (err) {
-                    if (!(err instanceof errors.ResenvError)) {
-                        throw new errors.ResenvError('DOPPLER_KEYRING_UNAVAILABLE', 'Could not save or revoke the login credential. Check Doppler CLI Tokens before retrying.');
-                    }
-                }
-                throw new errors.ResenvError('DOPPLER_KEYRING_UNAVAILABLE', 'Could not save the login credential. Revocation was attempted; check Doppler CLI Tokens, then try resenv login doppler --cli.');
-            }
-            output('Done: Doppler login saved in the OS credential store.');
-            return 'native';
-        }
-        await sleep(2000);
-    }
-    throw new errors.ResenvError('DOPPLER_LOGIN_TIMEOUT', 'Doppler login timed out. Run resenv login doppler to try again.');
-}
 
 exports.credential = credential;
-exports.login = login;

package/doppler/http.cjs

@@ -6,24 +6,19 @@ var values = require('../values.cjs');
 const API_ORIGIN = 'https://api.doppler.com';
 // No environment-controlled endpoint or redirects: credentials stay at Doppler.
 function createClient(fetchImpl = globalThis.fetch) {
-    return async function request(path, { token, body, pending = false } = {}) {
+    return async function request(path, { token } = {}) {
         let response;
         try {
             response = await fetchImpl(new URL(path, API_ORIGIN), {
-                method: body === undefined ? 'GET' : 'POST',
+                method: 'GET',
                 headers: {
                     'content-type': 'application/json',
                     'user-agent': 'ciqol-resenv',
                     ...(token ? { authorization: `Bearer ${token}` } : {})
                 },
-                body: body === undefined ? undefined : JSON.stringify(body),
                 redirect: 'error',
                 signal: AbortSignal.timeout(10000)
             });
-            if (pending && response.status === 409) {
-                await response.body?.cancel();
-                return null;
-            }
             if (!response.ok) {
                 await response.body?.cancel();
                 const code = response.status === 401 ? 'DOPPLER_AUTH_REQUIRED'
@@ -68,7 +63,7 @@ function createClient(fetchImpl = globalThis.fetch) {
 }
 function validateToken(token) {
     if (typeof token !== 'string' || !/^dp\.[a-z]+\.[A-Za-z0-9_.-]{10,512}$/.test(token)) {
-        throw new errors.ResenvError('DOPPLER_INVALID_TOKEN', 'The Doppler credential is malformed. Run resenv login doppler or supply a valid DOPPLER_TOKEN.');
+        throw new errors.ResenvError('DOPPLER_INVALID_TOKEN', 'The Doppler credential is malformed. Check your Doppler CLI login or supply a valid DOPPLER_TOKEN.');
     }
     return token;
 }