@ciqol/resenv 0.1.0-beta.1 → 0.1.0

package/doppler/system.cjs

@@ -3,96 +3,47 @@
 var node_child_process = require('node:child_process');
 var node_fs = require('node:fs');
 var node_os = require('node:os');
+var node_path = require('node:path');
 var errors = require('../errors.cjs');
 var assertSafeDiagnostics = require('../assert-safe-diagnostics.cjs');
 var http = require('./http.cjs');
 
-// Preserve saved logins from before the package rename.
-const SERVICE = 'ciqol.envref.doppler';
-const ACCOUNT = 'default';
-// Do not pass application secrets, NODE_OPTIONS, loader variables or a
-// repository's PATH to credential helpers. No helper is invoked via a shell.
-function helperEnvironment() {
-    const env = { HOME: node_os.userInfo().homedir, PATH: '/usr/bin:/bin', LANG: 'C.UTF-8' };
-    for (const key of ['SystemRoot', 'USERPROFILE', 'DBUS_SESSION_BUS_ADDRESS', 'XDG_RUNTIME_DIR', 'DISPLAY', 'WAYLAND_DISPLAY']) {
+// Do not pass application secrets, loader variables or a repository's PATH to
+// the worker or CLI. Keep only the OS session needed by Doppler's own storage.
+function helperEnvironment({ platform = process.platform, home = node_os.userInfo().homedir } = {}) {
+    const env = { HOME: home, PATH: '/usr/bin:/bin', LANG: 'C.UTF-8' };
+    for (const key of ['SystemRoot', 'DBUS_SESSION_BUS_ADDRESS', 'XDG_RUNTIME_DIR', 'DISPLAY', 'WAYLAND_DISPLAY']) {
         if (process.env[key])
             env[key] = process.env[key];
     }
+    if (platform === 'win32') {
+        env.USERPROFILE = home;
+        env.APPDATA = node_path.win32.join(home, 'AppData', 'Roaming');
+        env.LOCALAPPDATA = node_path.win32.join(home, 'AppData', 'Local');
+        env.PATH = node_path.win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32');
+    }
     return env;
 }
-function createSystem({ platform = process.platform, run = node_child_process.spawnSync, exists = node_fs.existsSync } = {}) {
-    const invoke = (file, args, options = {}) => {
-        assertSafeDiagnostics.assertSafeDiagnostics();
-        return run(file, args, {
-            env: helperEnvironment(), encoding: 'utf8', timeout: 15000,
-            maxBuffer: 16384, stdio: ['pipe', 'pipe', 'pipe'], shell: false, ...options
-        });
-    };
-    const mac = platform === 'darwin' && exists('/usr/bin/security');
-    const linux = platform === 'linux' && exists('/usr/bin/secret-tool');
-    const cli = ['/opt/homebrew/bin/doppler', '/usr/local/bin/doppler', '/usr/bin/doppler'].find(exists);
-    const unavailable = () => new errors.ResenvError('DOPPLER_KEYRING_UNAVAILABLE', 'The OS credential store is unavailable. Use the Doppler CLI or supply DOPPLER_TOKEN.');
-    function read() {
-        if (!mac && !linux)
-            return undefined;
-        const result = mac
-            ? invoke('/usr/bin/security', ['find-generic-password', '-s', SERVICE, '-a', ACCOUNT, '-w'])
-            : invoke('/usr/bin/secret-tool', ['lookup', 'service', SERVICE, 'account', ACCOUNT]);
-        if (!result.error && result.status === 0)
-            return http.validateToken(result.stdout.trim());
-        if (!result.error && ((mac && result.status === 44) || (linux && result.status === 1 && !result.stderr)))
-            return undefined;
-        throw unavailable();
-    }
-    function write(token) {
-        http.validateToken(token);
-        if (!mac && !linux)
-            throw unavailable();
-        // security's interactive interpreter receives the token on stdin, never
-        // the OS process argument list. The token alphabet excludes separators.
-        const result = mac
-            ? invoke('/usr/bin/security', ['-i'], { input: `add-generic-password -U -s ${SERVICE} -a ${ACCOUNT} -w ${token}\n` })
-            : invoke('/usr/bin/secret-tool', ['store', '--label=resenv Doppler', 'service', SERVICE, 'account', ACCOUNT], { input: token });
-        if (result.error || result.status !== 0)
-            throw unavailable();
-        // security -i may report a subcommand failure with a zero process status.
-        if (read() !== token)
-            throw unavailable();
-    }
-    function remove() {
-        if (!mac && !linux)
-            throw unavailable();
-        const result = mac
-            ? invoke('/usr/bin/security', ['delete-generic-password', '-s', SERVICE, '-a', ACCOUNT])
-            : invoke('/usr/bin/secret-tool', ['clear', 'service', SERVICE, 'account', ACCOUNT]);
-        if (result.error || (result.status !== 0 && !(mac && result.status === 44)))
-            throw unavailable();
-    }
+function createSystem({ platform = process.platform, home = node_os.userInfo().homedir, run = node_child_process.spawnSync, exists = node_fs.existsSync } = {}) {
+    // Use standard installation locations so npm's repository-local PATH cannot
+    // substitute a credential helper. Windows locations cover WinGet and Scoop.
+    const paths = platform === 'win32'
+        ? [node_path.win32.join(home, 'AppData', 'Local', 'Microsoft', 'WinGet', 'Links', 'doppler.exe'), node_path.win32.join(home, 'scoop', 'apps', 'doppler', 'current', 'doppler.exe')]
+        : ['/opt/homebrew/bin/doppler', '/usr/local/bin/doppler', '/usr/bin/doppler', node_path.join(home, '.local', 'bin', 'doppler'), node_path.join(home, 'bin', 'doppler')];
     function cliToken() {
+        assertSafeDiagnostics.assertSafeDiagnostics();
+        const cli = paths.find(exists);
         if (!cli)
-            return undefined;
-        const result = invoke(cli, ['configure', 'get', 'token', '--plain']);
+            throw new errors.ResenvError('DOPPLER_CLI_UNAVAILABLE', 'Install the Doppler CLI in a standard location and run doppler login, or supply DOPPLER_TOKEN. See https://docs.doppler.com/docs/cli.');
+        const result = run(cli, ['configure', 'get', 'token', '--plain', '--no-check-version', '--no-read-env'], {
+            env: helperEnvironment({ platform, home }), encoding: 'utf8', timeout: 15000,
+            maxBuffer: 16384, stdio: ['pipe', 'pipe', 'pipe'], shell: false
+        });
         if (result.error || result.status !== 0 || !result.stdout.trim())
             return undefined;
         return http.validateToken(result.stdout.trim());
     }
-    function cliLogin() {
-        if (!cli)
-            throw new errors.ResenvError('DOPPLER_CLI_UNAVAILABLE', 'Doppler CLI fallback is unavailable. Install Doppler or supply DOPPLER_TOKEN.');
-        const result = invoke(cli, ['login'], { stdio: 'inherit', timeout: 300000 });
-        if (result.error || result.status !== 0)
-            throw new errors.ResenvError('DOPPLER_LOGIN_FAILED', 'Doppler CLI login did not complete.');
-        if (!cliToken())
-            throw new errors.ResenvError('DOPPLER_LOGIN_FAILED', 'Doppler CLI login did not provide a credential.');
-    }
-    function openBrowser(url) {
-        const file = mac ? '/usr/bin/open' : '/usr/bin/xdg-open';
-        if (!exists(file))
-            return false;
-        const result = invoke(file, [url]);
-        return !result.error && result.status === 0;
-    }
-    return { read, write, remove, cliToken, cliLogin, openBrowser, canStore: mac || linux };
+    return { cliToken };
 }
 
 exports.createSystem = createSystem;

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@ciqol/resenv",
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0",
   "description": "Replace environment references with their resolved values at application startup",
   "license": "MIT",
   "publishConfig": {
     "access": "public",
-    "tag": "beta",
+    "tag": "latest",
     "registry": "https://registry.npmjs.org/"
   },
   "repository": {

package/types/src/doppler/auth.d.ts

@@ -1,19 +1,4 @@
 import type { Environment } from '../types.js';
-import type { Request } from './http.js';
 import type { CredentialSystem } from './system.js';
-type LoginOptions = {
-    readonly cli?: boolean;
-    readonly noBrowser?: boolean;
-};
-type LoginDependencies = {
-    readonly request?: Request;
-    readonly system?: CredentialSystem;
-    readonly output?: (text: string) => void;
-    readonly interactive?: boolean;
-    readonly env?: Readonly<Environment>;
-    readonly sleep?: (ms: number) => Promise<unknown>;
-    readonly now?: () => number;
-};
-declare function credential(env: Readonly<Environment>, system?: Pick<CredentialSystem, 'read' | 'cliToken'>): Promise<string>;
-declare function login({ cli, noBrowser }?: LoginOptions, { request, system, output, interactive, env, sleep, now }?: LoginDependencies): Promise<'cli' | 'native'>;
-export { credential, login };
+declare function credential(env: Readonly<Environment>, system?: CredentialSystem): Promise<string>;
+export { credential };

package/types/src/doppler/http.d.ts

@@ -1,9 +1,7 @@
 export type RequestOptions = {
     readonly token?: string;
-    readonly body?: Readonly<Record<string, string>>;
-    readonly pending?: boolean;
 };
-export type Request = (path: string, options?: RequestOptions) => Promise<Record<string, unknown> | null>;
+export type Request = (path: string, options?: RequestOptions) => Promise<Record<string, unknown>>;
 declare function createClient(fetchImpl?: typeof globalThis.fetch): Request;
 declare function validateToken(token: unknown): string;
 export { createClient, validateToken };

package/types/src/doppler/system.d.ts

@@ -7,18 +7,13 @@ type SyncOptions = SpawnSyncOptionsWithStringEncoding & {
 export type SyncRunner = (file: string, args: readonly string[], options: SyncOptions) => SpawnSyncReturns<string>;
 type SystemOptions = {
     readonly platform?: NodeJS.Platform;
+    readonly home?: string;
     readonly run?: SyncRunner;
     readonly exists?: typeof existsSync;
 };
 export type CredentialSystem = ReturnType<typeof createSystem>;
-declare function helperEnvironment(): Environment;
-declare function createSystem({ platform, run, exists }?: SystemOptions): {
-    read: () => string | undefined;
-    write: (token: string) => void;
-    remove: () => void;
+declare function helperEnvironment({ platform, home }?: Pick<SystemOptions, 'platform' | 'home'>): Environment;
+declare function createSystem({ platform, home, run, exists }?: SystemOptions): {
     cliToken: () => string | undefined;
-    cliLogin: () => void;
-    openBrowser: (url: string) => boolean;
-    canStore: boolean;
 };
 export { createSystem, helperEnvironment };

package/docs/maturity.md

@@ -1,61 +0,0 @@
-# Maturity evaluation
-
-Evaluated on October 8, 2026 with the Tashtit maturity 0.3.1 catalog, using
-static working-tree evidence only. This measures the catalog's repository
-hygiene rules; it does not certify security or readiness to publish. Tests
-and hosted checks are recorded separately in [validation](validation.md).
-
-## Maturity: 91% (11/120 weight failing)
-
-The maintained source tree scores 100% (0/97 weight failing). The full catalog
-also discovers the generated `dist/package.json`, so its findings are retained.
-
-| Scope | Failing weight | Relevant weight |
-| --- | ---: | ---: |
-| Root npm project | 0 | 41 |
-| Generated distribution | 11 | 23 |
-| Repository hygiene | 0 | 24 |
-| GitHub Actions | 0 | 32 |
-| Total | 11 | 120 |
-
-## Findings
-
-- **High: generated package has no sibling lockfile** (`lockfile-missing`, 8).
-  Evidence: `dist/package.json:2`; no `dist/package-lock.json` exists. A maintained
-  npm project needs a lockfile. This directory is generated from the root's v3
-  lockfile and consumers maintain their own locks; it is not another workspace.
-  Reference: [npm lockfiles](https://docs.npmjs.com/cli/configuring-npm/package-lock-json).
-- **Medium: generated package has no sibling runtime-version file**
-  (`setup-nvmrc`, 3). Evidence: `dist/package.json:2`; no `dist/.nvmrc` exists.
-  Development projects should pin a runtime. The generated package declares
-  `engines.node: >=20` and does not need contributor setup files. The root
-  `.nvmrc` pins Node 24.19.0. Reference: [nvm version files](https://github.com/nvm-sh/nvm#nvmrc).
-
-## Passed checks
-
-- Root: one v3 npm lockfile, no competing yarn lockfile, `.npmrc`, `.nvmrc`, and
-  registry dependencies with exact direct versions. CI uses `npm ci` and
-  normal lifecycle behavior; it does not pass `--ignore-scripts`.
-- Repository: valid CODEOWNERS syntax, README, CONTRIBUTING and `.editorconfig`.
-- CI: a parseable workflow, explicit scoped token permissions, bounded job
-  timeouts, no `pull_request_target`, and pinned remote actions. The GitHub-owned
-  upload action's exact `v7.0.1` tag is permitted by the catalog.
-
-The earlier 88% score included a lifecycle-script finding that is now resolved.
-No dependency installation, build, test, or remote request was used to derive
-this static score.
-
-## Not evaluated by this catalog
-
-- Docker rules: no candidate Dockerfile exists.
-- Repository protections, private vulnerability reporting and maintainer access.
-- License suitability, secret history, provider login, and runtime behavior.
-
-See [public readiness](public-readiness.md) for the separate exposure audit and
-[validation](validation.md) for observed checks.
-
-## Fixable findings
-
-No automatic fix is appropriate. The generated package's broad runtime range
-does not identify a development version to pin, and adding another lockfile
-would misrepresent it as a maintained workspace.

package/docs/public-readiness.md

@@ -1,138 +0,0 @@
-# Public repository readiness
-
-## Follow-up review — 2026-10-12
-
-The repository is now public, with `beta` as the sole remote and default branch.
-CI has staged the first `0.1.0-beta.1` candidate; npm approval and release
-recording are still pending. The accidental public `1.0.0` has been removed,
-and the `0.0.0-stage` placeholder remains. Recheck live state before release work.
-
-Private vulnerability reporting returned `enabled: false` during this review.
-The security policy's reporting prerequisite remains outstanding until that
-setting is enabled and verified. See [the session handoff](maintainer-handoff.md)
-and [validation](validation.md) for current behavior and observed checks.
-The dated transition plan below is historical evidence.
-
-## Approved transition - 2026-10-10
-
-The current release pipeline and launch state are documented in [releasing](releasing.md).
-The release-tool review and expiring advisory policy are in [release security](release-security.md).
-Earlier dated entries below remain historical evidence and are superseded where
-the current release guide describes a different state.
-
-The user approved public visibility, default branch `beta`, and deletion of
-the four older ancestor branch references. A fresh settings snapshot, complete
-Git bundle and verified restore are retained outside the repository. Recheck
-remote heads and ancestry immediately before deletion. Other governance changes
-and PR creation remain outside this transition.
-
-
-Reviewed on October 8, 2026 at `cb6ebe92c3182051a034dd29e192d51a182b5d22`, before
-the accompanying documentation cleanup. Repository: `ciqol/resenv`. Maintainer
-and authenticated GitHub account: `titan-ron`.
-
-## Result
-
-No real credentials or private machine/employer references were identified in
-the reviewed Git history or hosted Actions outputs. The source can become a
-public experimental repository after the remaining decisions below. This does
-not establish npm release readiness or an independent security audit.
-
-The repository remains private. No branch, default-branch, access, protection,
-or visibility setting was changed by this audit.
-
-## Exposure review
-
-- Gitleaks 8.30.1 scanned all 24 commits reachable from the fetched refs. Its
-  nine matches were synthetic Doppler credentials in tests: eight use a dummy
-  marker and one uses an alternative fixture marker with sequential digits.
-  The tests inject provider and credential helpers instead of authenticating
-  those values. No detector exception or history rewrite was added.
-- TruffleHog 3.97.4 scanned the local Git history with network verification and
-  update checks disabled. It reported no credentials. Sandbox process-inspection
-  restrictions produced temporary-cleanup warnings; the scan completed.
-- Reachable-blob inspection found no committed dotenv/private-key files,
-  absolute developer paths, employer references, or private service URLs.
-- All 14 existing Actions log archives and 14 unexpired package artifacts were
-  downloaded into a private audit folder and scanned offline. Gitleaks found
-  no secrets. Package inspection covered 755 regular files across the archives
-  and found no credential files or private developer/employer references.
-- There are no existing issues or pull requests to review for public exposure.
-- The latest pre-cleanup [CI run](https://github.com/ciqol/resenv/actions/runs/37778134741)
-  passed on Linux Node 20/22/24 and macOS Node 24.
-
-Detection tools cannot prove the absence of every secret. No candidate
-credential was sent to a provider to test whether it works. Git history remains
-visible after deleting an ancestor branch. GitHub exposes existing Actions
-history and logs when visibility becomes public; see
-[GitHub's visibility documentation](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility).
-
-## Cleanup prepared
-
-- Ignore local `.idea/` settings without deleting the developer's files.
-- Keep installation and contributor text independent of repository visibility.
-- Include the MIT license and ciqol contributors copyright, selected on October 8.
-  Registry publication remains disabled.
-- Mark historical validation/dependency entries so old APIs and version plans
-  are not mistaken for current usage instructions.
-- Remove unnecessary references to other project names from current docs.
-  Historical commits remain unchanged.
-- Direct security questions from the issue chooser to the security policy.
-- Prepare `beta` as the sole normal release branch on npm's `beta` channel. CI
-  also checks the current `titan/beta` preparation branch until branch cleanup.
-  PR checks and manual dispatch remain; publishing stays disabled.
-- Recalculate maturity: 91% including generated output, 100% for the maintained
-  source tree. These scores do not establish release readiness.
-
-## Remaining decisions and settings
-
-1. **License resolved:** MIT was selected on October 8, 2026, with copyright
-   held by ciqol contributors. The root and generated manifests declare MIT;
-   the [license](../LICENSE) is included in the package archive.
-2. **Branches:** the selected sole normal release branch is `beta`, with npm
-   channel `beta`. A local dry run with only that branch calculated `1.0.0`;
-   another stable branch is unnecessary. Default-branch selection and deletion
-   of the older branches remain pending. See [release preparation](releasing.md).
-3. **Private reporting:** the endpoint returned HTTP 404 while the repository
-   is private. Enable and verify it after the approved visibility transition,
-   and verify the reporting option described in SECURITY.md. It is not yet available.
-4. **Protections:** all branch entries report `protected: false`; the ruleset
-   API returned HTTP 403 under the current private plan. Re-audit effective
-   protections after the transition. No protection policy was applied.
-
-## Proposed transition
-
-This plan is for review. It does not authorize npm publication, collaborator or
-team changes, merge-policy changes, rulesets, or a pull request.
-
-| Branch | Observed head | Action for the beta-only layout |
-| --- | --- | --- |
-| `beta` | Same reviewed source head as the preparation branch | Keep; make default |
-| `titan/beta` | Current preparation branch | Delete after verifying its head is retained by `beta` |
-| `titan/bootstrap-envref` | `b25da7cfe730bfaca0a470d9a31a303cef7d33ad` | Delete branch pointer |
-| `titan/rename-resenv` | `60e70a4e43b39fc9a87379990e4ed44de50726cb` | Delete branch pointer |
-| `titan/prepare-first-release` | `0c313483d7123b8b4afd360b4e8daae58abc4241` | Delete after changing the default |
-
-At the original audit, all three older heads were ancestors of `titan/beta`;
-none contained unique commits. Before deletion, re-check every remote head and
-verify all four older branches are ancestors of the retained `beta` head. Stop
-if any contains newer or unique work.
-
-After the branch decision, obtain explicit approval for the default
-branch, listed deletions, public visibility, and private vulnerability reporting.
-The CI push filter and release docs are prepared for this layout. Apply
-only approved scopes and verify branches, default, visibility, reporting and
-CI by read-back. Keep npm publishing disabled until its separate prerequisites
-are complete.
-
-## Recovery
-
-A private settings snapshot and complete Git bundle are retained outside this
-repository. Bundle verification and a restore into a separate local bare
-repository reproduced all four original remote branch heads exactly.
-
-Restore deleted branch pointers from their recorded SHAs or bundle before
-restoring the old default branch. Visibility can be set back to private, but
-public forks, downloaded code and copied logs cannot be recalled. A settings
-rollback cannot undo public disclosure. Never overwrite newer branch work or
-weaken protections to force a restore.

package/docs/security-performance-review.md

@@ -1,150 +0,0 @@
-# Security and performance review
-
-Historical review: the October 12 beta removes dotenvx decryption and its entire
-runtime dependency tree. Earlier cryptography and ciphertext findings below
-apply to the prototype. Current behavior is in [Security](../SECURITY.md).
-
-## Release preparation update - 2026-10-10
-
-The current release pipeline and launch state are documented in [releasing](releasing.md).
-The release-tool review and expiring advisory policy are in [release security](release-security.md).
-Earlier dated entries below remain historical evidence and are superseded where
-the current release guide describes a different state.
-
-
-Reviewed on 2026-10-06 against the private 0.1.0 candidate, starting at
-`b50fa9b`. This is a source review with targeted reproductions, regression tests
-and measurements. It is not an independent audit or a security certification.
-
-A later change on the same day migrates the implementation and CLI to strict
-TypeScript. The findings below describe the reviewed baseline and fixes; see
-[the current build contract](build.md) and [validation](validation.md) for the
-generated declarations and implementation checks that supersede the earlier
-declaration-only setup.
-
-## Findings and changes
-
-| Priority | Finding reproduced | Change and regression coverage |
-| --- | --- | --- |
-| P1 | Node's `child_process` debug category printed dummy credentials from subprocess environment values and private worker stdin. | Reject resenv subprocess/helper operations before spawning when that native debug category is enabled. Cover wildcards, case, cached debug state and safe no-work preloads in [diagnostic tests](https://github.com/ciqol/resenv/blob/e57a8fe72ecf956fc99c661d40b1ca707bbcd172/test/diagnostics.test.mjs). |
-| P1 | Combining automatic resolution modes could interpret a fetched secret as a shell expression on the second pass. | Share preload state across CJS/ESM, reject mixed modes and reject CLI resolution after a preload. Verify both preload orders and the CLI combination in [runtime tests](https://github.com/ciqol/resenv/blob/e57a8fe72ecf956fc99c661d40b1ca707bbcd172/test/doppler-runtime.test.mjs). |
-| P2 | Invalid UTF-8 from the provider was silently converted to a different secret value; escaped lone surrogates were also accepted. | Decode JSON with fatal UTF-8 validation and reject malformed Unicode values. Cover both paths in [Doppler tests](https://github.com/ciqol/resenv/blob/e57a8fe72ecf956fc99c661d40b1ca707bbcd172/test/doppler.test.mjs). |
-| P2 | A non-writable second property could fail after the first environment property had already changed. | Preflight all changed descriptors before committing; reject setters and Proxy targets. Preserve writable sealed records. Cover atomicity in [resolver tests](https://github.com/ciqol/resenv/blob/e57a8fe72ecf956fc99c661d40b1ca707bbcd172/test/resolver.test.mjs). |
-| P2 | Unique Doppler lookups ran sequentially, making startup latency grow with each request. | Deduplicate references and allow four requests at a time. Stop scheduling after failure, await active requests and discard partial results. Deterministic tests check overlap, deduplication and failure behavior. |
-| P2 | The generic in-place return type preserved an input's literal reference type after its value had changed. | Return `Environment`; add compile-time regression checks to both installed CJS and ESM consumers. |
-
-Unexpected cleanup errors now produce safe errors instead of disappearing in
-empty catch blocks. Known already-exited process groups remain harmless.
-Credential-revocation failures retain a safe message without raw provider
-details. Regression tests cover these cases with dummy values.
-
-The debug guard uses Node's actual `debuglog().enabled` state. Clearing
-`NODE_DEBUG` after Node initializes it is insufficient. Use `NODE_DEBUG=ciqol:resenv`
-for variable names and outcome messages without values. See Node's
-[debuglog documentation](https://nodejs.org/api/util.html#utildebuglogsection-callback).
-
-## Reviewed boundaries
-
-- Only original environment references are processed within a resolution call.
-  Fetched and decrypted output remains literal.
-- Doppler requests use a fixed HTTPS origin, reject redirects and request only
-  named secrets. An explicit identity is not silently replaced after rejection.
-- The synchronous worker receives references and an optional token over stdin.
-  Credential helpers receive a filtered environment and fixed executable paths.
-  Application secrets, loader options and a repository's PATH are not forwarded
-  to those helpers.
-- Requests have a ten-second deadline and a 1 MiB response limit. A resolution
-  allows at most 128 references, with a 64 KiB limit per cloud value. The worker
-  has a 60-second deadline and 1 MiB captured-output limit.
-- Shell execution requires explicit opt-in. Startup never starts interactive
-  login automatically; login rejects CI and noninteractive use.
-- Plain environments avoid subprocesses, credential discovery and loading the
-  cryptography dependency. Runtime dependency versions are unchanged.
-
-These boundaries do not isolate secrets from the application, a debugger or
-other code running as the same user. Commands execute with that user's access,
-and their external effects cannot be rolled back. Configure one resolver per
-launch; repeated manual calls or a separately installed child-process preload
-can reinterpret values. See [SECURITY.md](../SECURITY.md).
-
-## Performance measurements
-
-Run `npm run bench` after building. The benchmark uses dummy values and a mocked
-provider, with no real credentials or network requests. Measurements below use
-Node 24.19.0 on macOS arm64; they are observations, not CI timing thresholds.
-
-| Measurement | Before | After |
-| --- | ---: | ---: |
-| 16 references, eight unique requests, 40 ms simulated latency per request; median of five runs | 332.069 ms | 81.705 ms |
-| Peak concurrent provider requests | 1 | 4 |
-| No-work library call with 200 plain variables; median of 5,000 calls | 0.047 ms | 0.045 ms |
-
-The mocked lookup case is about 4.1 times faster. Real Doppler latency, rate
-limits and credential-store latency may differ; four is a conservative client
-limit, not a published provider concurrency allowance.
-
-The final fresh-process measurements interleave baseline, CJS preload and ESM
-preload runs. Each reports the median of 20 samples after discarding three
-warmup samples; disk caches remain warm.
-
-| Final startup measurement | Median |
-| --- | ---: |
-| Node alone | 46.427 ms |
-| Node with `--require @ciqol/resenv/resolve` and no references | 52.177 ms |
-| Node with `--import @ciqol/resenv/resolve` and no references | 50.722 ms |
-
-The observed extra startup cost was about 4-6 ms. Scheduling and filesystem
-noise affect these small measurements; no startup speedup is claimed.
-
-## Standards applied
-
-The requested TypeScript authoring, library-build and style standards were
-applied to the existing `.mjs` project and its public declarations:
-
-- Public option objects use type aliases and readonly properties. `Environment`
-  remains mutable because in-place resolution writes it.
-- ESLint checks runtime/build JavaScript and declarations. Rules cover undefined
-  names, empty handlers, parameter count, catch naming and the selected public
-  TypeScript conventions. Existing compact JavaScript formatting is preserved.
-- Declaration checks and installed `.cts`/`.mts` consumers use `strict` and
-  `noUncheckedIndexedAccess`. This checks the declaration contract, not the
-  `.mjs` implementation with TypeScript.
-- Rollup still emits explicit CJS/ESM extensions with a shared implementation,
-  types-first conditional exports and external runtime dependencies. Clean
-  consumers verify the packed artifact without source-tree links or lint/build
-  tools installed as runtime dependencies.
-- CI runs lint and declaration checks before building one archive for every
-  compatibility job. Actions are pinned, permissions are read-only and install
-  lifecycle scripts are disabled. Both manifests remain private by request.
-
-The new development dependencies and their provenance limits are recorded in
-[the dependency review](dependencies.md). No new runtime dependency was added.
-
-## Validation and remaining work
-
-- All 70 unit/process tests passed locally on Node 20.20.2, 22.22.3 and 24.19.0.
-- The packed package passed 13 runtime checks and two typed consumers on Node
-  24. Lint and strict declaration checks passed.
-- Nx 23.2.1 passed target dotenv loading, local/shell precedence, target
-  isolation and strict failures for command and Doppler modes. Tests used a
-  temporary workspace, dummy credentials and an existing Nx installation
-  read-only; consumer files were not changed.
-- npm reported zero known vulnerabilities, 103 verified registry signatures
-  and 37 verified attestations in the installed development tree. Advisory and
-  signature checks do not rule out unknown vulnerabilities.
-- [Hosted CI](https://github.com/ciqol/resenv/actions/runs/37462966577) passed for
-  `e57a8fe`: one build and four compatibility jobs on Linux (Node 20, 22 and 24)
-  and macOS (Node 24). Each job passed all 70 tests, 13 installed runtime checks
-  and two typed consumers against the same archive. The Linux build verified
-  103 registry signatures and 38 attestations with zero known vulnerabilities.
-  Counts apply to each platform's installed tree.
-- Workflow structure and documentation links passed local checks. Existing
-  distributed archives retained their original SHA-256 hashes. The final
-  documentation update records the tested commit; it does not change runtime code.
-
-Before public release, settle the license and whether to retain the older
-dotenvx decryption feature. The fresh native browser-login flow and live Linux
-keyring integration still need verification. Windows native login/storage is
-not implemented. Repository reporting/protection and npm publishing setup are
-also outstanding in [the release plan](releasing.md). The repository remains
-private and unpublished, with PR creation on hold.