@ciqol/resenv 0.1.0-beta.1

package/CONTRIBUTING.md

@@ -0,0 +1,189 @@
+# Contributing
+
+Starting a new session? Read the [maintainer handoff](docs/maintainer-handoff.md)
+and [repository instructions](https://github.com/ciqol/resenv/blob/beta/AGENTS.md) before editing or releasing.
+
+The [README](README.md) covers using resenv in an application. This guide covers
+changing resenv itself and verifying those changes.
+
+Releases start at `0.1.0-beta.1` on the sole branch `beta`, using npm channel
+`beta`. Semantic-release's official commit-analysis and release-notes plugins
+select releasable changes and generate notes; actual beta tags supply the next
+prerelease counter. The root and ordinary local builds remain private prototypes.
+CI generates the publishable manifest before packing and testing it, then stages
+the exact archive through npm OIDC for maintainer approval. See
+[releasing](docs/releasing.md) and the bounded [release-tool review](docs/release-security.md).
+The source uses the [MIT license](LICENSE), copyright ciqol contributors.
+
+## Local development
+
+Use the Node version in `.nvmrc` and npm:
+
+```sh
+nvm use
+npm ci
+npm run verify
+```
+
+`npm run verify` is the complete local check: lint, strict source/spec type
+checks, build, unit/process tests and installed-package checks. To build without
+running the checks, use `npm run build`.
+
+After building, try the CLI from this checkout:
+
+```sh
+node dist/bin/resenv.cjs --help
+```
+
+Author library and CLI code as `.ts`; Rollup's TypeScript plugin produces both
+module formats and declarations from that implementation. Colocate Vitest unit
+specs as `*.spec.ts` beside each tested module and import its source. Build and
+release scripts have colocated `*.spec.mjs` Vitest specs. Keep
+process, package and integration checks in `test/` as `.mjs`; they exercise
+compiled output and installed packages. Tests use dummy credentials and commands.
+Never use real secrets in fixtures, terminal output, screenshots, issues, or
+pull requests.
+
+Provider detection belongs to the original environment values, including library
+calls without options. Keep shell execution behind `commands: true`, preserve
+literal fetched output, and validate references before any command runs.
+
+ESLint applies rules that use type information to the TypeScript implementation and specs
+and checks the JavaScript build tooling.
+Use `npm run lint:fix` for available automatic fixes; preserve the repository's
+existing compact formatting. Public object shapes use `type` with `readonly`
+properties. `Environment` is intentionally mutable because in-place resolution
+updates it. `npm run typecheck` checks the entire library and CLI with `strict`
+and `noUncheckedIndexedAccess`. A separate spec configuration checks tests without
+shipping them in JavaScript or declarations. Do not maintain separate handwritten declarations.
+
+```sh
+npm run test:unit         # colocated Vitest specs, no build required
+npm run test:watch        # watch unit specs while editing
+npm run test:coverage     # source unit coverage, text and lcov output
+npm run test:integration  # process checks, requires a build
+```
+
+`npm test` runs unit and process tests. Mock or inject provider calls, credential
+helpers, browser launchers and process control in unit tests. Keep checks that
+spawn actual commands or temporary applications in `test/`. The unit coverage
+report measures source and is separate from packed-package and process checks.
+
+Use normal npm lifecycle behavior locally and in CI. Review install hooks,
+including implicit native builds, when changing dependencies; record any
+required setup in [the dependency review](docs/dependencies.md). Suppressing
+lifecycle hooks can skip required setup, so it is not part of the standard
+installation commands. The explicit build/check commands remain required.
+
+The package check packs `dist/` and installs that tarball into a temporary
+consumer outside the repository. The install is offline, uses npm's existing
+cache and the repository's reviewed runtime lock entries. It installs with
+`npm ci` without needing cached registry metadata. It does not link the source
+tree or publish. Run `npm ci` first to populate the archive cache. The check
+exercises both module formats, CLI and preloads, shared error identity, single
+preload execution and `.cts`/`.mts` consumer types.
+
+Pass an existing archive to test the same build CI uses:
+`npm run test:package -- /absolute/path/to/package.tgz`. For a final CI candidate,
+also pass its `release.json` as the second argument. The supplied package's
+name, version, executable mode and manifest are checked before runtime probes.
+`npm run verify` runs lint, typecheck, build and tests; `npm run release:check`
+also previews the package contents. Neither publishes or creates a tag.
+
+Rebuild after source, declarations, metadata or documentation changes. The build
+cleans `dist/` first and generates its manifest from the root package. See
+[docs/build.md](docs/build.md). Ordinary local builds remain private. Only a validated CI release plan removes
+that guard from the distribution manifest; never edit it by hand.
+
+## Try changes in an application
+
+### Install a local archive
+
+From the resenv checkout:
+
+```sh
+npm run build
+npm run pack:local
+```
+
+Install the resulting archive from the application's directory:
+
+```sh
+npm install --save-exact /absolute/path/to/ciqol-resenv-0.1.0-beta.1.tgz
+```
+
+This changes the application's manifest and lockfile. The archive must exist
+wherever it installs dependencies. Use a new archive version for changes to an
+already shared build; never overwrite an archive another project uses. Root
+package overrides do not propagate to consumers; inspect the installed tree
+against [the dependency review](docs/dependencies.md).
+
+### Try local changes without changing the application's CI
+
+Link this checkout's built `dist/` directory at the application's ignored
+`node_modules/@ciqol/resenv`, retaining any existing installation first. Keep
+references in an ignored `.env.serve.local` and the application's target edit
+local. Leave its manifest, lockfile and CI configuration unchanged.
+
+Rebuild resenv after source, metadata or documentation changes and restart the
+application. An application `npm ci` can remove the link; recreate it when needed.
+If you only created the package link, run its CLI directly:
+
+```sh
+node node_modules/@ciqol/resenv/bin/resenv.cjs login doppler
+```
+
+For login from the resenv checkout, use
+`node dist/bin/resenv.cjs login doppler`. Real login is a manual integration
+check; automated tests must use injected or mocked credentials.
+
+## Optional integration checks
+
+`npm run bench` measures fresh-process startup, a plain 200-variable environment,
+and a mocked provider with eight distinct lookups. It needs a build first and
+does not contact a provider. Timings are observations, not CI pass/fail thresholds.
+See [the review](docs/security-performance-review.md) for the recorded comparison.
+
+With an existing Nx installation:
+
+```sh
+npm run test:nx -- /absolute/path/to/workspace/node_modules
+```
+
+This creates a temporary Nx workspace and checks target-file loading,
+precedence and secret resolution with dummy values. It does not use the
+source workspace's dotenv files, credentials or remote cache.
+
+## Changes
+
+Keep dotenv file discovery with the caller. Doppler is the only built-in cloud
+provider; its authentication and lookups live under `src/doppler/`.
+Preserve all-or-nothing environment updates, strict failures, explicit command
+opt-in and literal handling of resolved values. Update the public API types and
+documentation together with behavior changes.
+
+Keep one public resolver, `resolve()`. It always returns an independent
+resolved copy and replaces input values only with `{ replace: true }`. Preloads
+enable that option; the CLI passes the returned copy to its child process.
+
+Add regression tests for changed behavior and avoid real provider calls. Use
+Conventional Commit subjects, for example `fix(resolver): preserve empty values`.
+Dependency changes require an updated [review record](docs/dependencies.md).
+
+CODEOWNERS identifies the maintainer. Keep bug reports and pull requests focused
+on observable behavior and include the checks run. Weekly dependency updates are
+grouped, with major version updates reviewed separately; bots cannot merge them.
+
+Keep the README focused on installation, authentication, application integration,
+API behavior and troubleshooting. Put contributor tooling, test commands and
+local development instructions here; detailed internals belong in `docs/`.
+
+Security reports follow [SECURITY.md](SECURITY.md). Publication and repository
+visibility changes require a separate maintainer decision; see the
+[release checklist](docs/releasing.md).
+
+npm releases run only through GitHub Actions with npm trusted publishing (OIDC).
+The maintainer configures the npm side. Local development and release checks
+do not require `npm login`; do not publish from a developer machine or add npm
+publishing tokens. CI must publish the exact candidate archive that its tests
+verified.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ciqol contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,243 @@
+# @ciqol/resenv
+
+**Replace references already in `process.env` with their resolved values at
+application startup.** Your existing loader, such as Nx, chooses the dotenv
+files. resenv resolves the resulting environment before application code runs.
+
+**Doppler is the only built-in cloud provider.** A value such as
+`doppler://my-project/dev/API_TOKEN` tells resenv which secret to fetch. The
+application then reads the actual value from `process.env.API_TOKEN`.
+
+```text
+Nx or another loader sets process.env
+                  |
+resenv fetches the referenced values and replaces them in memory
+                  |
+Application starts with ordinary environment values
+```
+
+Resolution happens once at startup. It does not watch the provider for changes;
+restart the application to fetch updated values. No filename is passed to
+resenv, and dotenv files are never rewritten.
+
+Requires Node.js 20 or later. This is an experimental beta, currently distributed
+as a package archive; it has not been published to npm.
+
+## Install
+
+Install the archive supplied by the maintainer in your application project:
+
+```sh
+npm install --save-exact /path/to/ciqol-resenv-0.1.0-beta.1.tgz
+```
+
+This records resenv in your project's manifest and lockfile. Keep the archive
+available wherever that project installs dependencies. Once the beta is
+published to npm, you will be able to install `@ciqol/resenv@beta` instead.
+
+The CLI examples below use `npx --no-install` to run the copy installed in your
+project. In an npm script, use `resenv` directly.
+
+## Use with Doppler
+
+### 1. Authenticate locally
+
+After installing the package, run:
+
+```sh
+npx --no-install resenv login doppler
+```
+
+Each developer authenticates with their own Doppler access. Secret reads use
+the HTTPS API. Credentials come from `DOPPLER_TOKEN`, the saved OS credential,
+or an existing Doppler CLI login, in that order. Startup reports missing access
+and stops; it does not open a login prompt.
+
+Native login uses the browser flow observed in Doppler's official MCP client
+and saves the token in macOS Keychain or Linux Secret Service. The CLI is a
+fallback; the browser protocol is not a public OAuth contract and fresh native
+login is not yet verified end to end. Windows needs `DOPPLER_TOKEN` because
+native login/storage is not implemented there. See
+[Doppler login and platform details](docs/doppler.md).
+
+### 2. Declare references in the environment your app already loads
+
+For example, in an Nx application's `.env.serve`:
+
+```dotenv
+API_TOKEN=doppler://my-project/dev/API_TOKEN
+PORT=3000
+```
+
+The reference contains the Doppler project, config and secret name. This is
+resenv's reference syntax. Plain values such as `PORT` pass through unchanged.
+The reference itself grants no access: the authenticated identity needs
+permission to read that secret. Doppler references need no dotenvx private key.
+
+### 3. Preload resenv on the application process
+
+Once the environment has been loaded:
+
+```sh
+node --require @ciqol/resenv/resolve app.cjs
+node --import @ciqol/resenv/resolve app.mjs
+```
+
+The preload replaces `process.env.API_TOKEN` before the application and its
+imports execute. It infers Doppler from the value, so no provider flag is needed.
+
+Alternatively, wrap a command whose environment is already populated:
+
+```sh
+npx --no-install resenv run -- node app.mjs
+```
+
+The wrapper supplies resolved values to the child process. It inherits
+stdin/stdout/stderr, preserves exit status and forwards SIGINT, SIGTERM and
+SIGHUP to that child.
+
+## Nx integration
+
+Put the preload on the application's target, after Nx loads its dotenv files:
+
+```json
+{
+  "name": "app",
+  "targets": {
+    "serve": {
+      "executor": "nx:run-commands",
+      "cache": false,
+      "continuous": true,
+      "options": {
+        "command": "node --require=@ciqol/resenv/resolve app.mjs",
+        "cwd": "{projectRoot}"
+      }
+    }
+  }
+}
+```
+
+Run `nx serve app`. Nx selects `.env.serve` and any applicable overrides,
+then starts the application with resenv. Use your application's existing path
+and target options. For an existing `@nx/js:node` target, add:
+
+```json
+"runtimeArgs": ["--require", "@ciqol/resenv/resolve"]
+```
+
+Preloading the outer `nx` process runs too early. A shell-wide `NODE_OPTIONS`
+setting also affects unrelated processes. Keep the preload on the application
+target. If a build needs secrets, its process needs its own integration after
+its environment is loaded; values embedded in build output remain in that output.
+
+## Resolution behavior
+
+- Only the enabled reference forms are resolved. Ordinary values pass through.
+- Doppler fetches only the named secrets; repeated references share one request
+  within a resolution pass. Values are not cached on disk.
+- All lookups must succeed before the environment is changed or a child starts.
+  Missing access, malformed references and provider failures stop startup.
+- Fetched values stay literal, even if they contain `$()` or another reference.
+- The canonical preload leaves shell expressions literal. Executing commands
+  requires the separate opt-in described below.
+- Application code can read its resolved environment. Access to the same
+  credentials also permits other code or sessions to retrieve those secrets.
+
+See [Doppler limits](docs/doppler.md#resolution-and-security-boundaries) and
+[security guidance](SECURITY.md).
+
+## Library API
+
+Call the library after your loader has populated the environment, before
+importing modules that read configuration:
+
+```js
+import { resolve } from '@ciqol/resenv'
+
+const childEnv = resolve()
+
+// Also replace values in process.env; the returned copy can be ignored.
+resolve(process.env, { replace: true })
+```
+
+`resolve(env = process.env, options = {})` always returns a new resolved
+environment. `replace` defaults to `false`, leaving the input unchanged. With
+`replace: true`, it also replaces values in the input after every lookup succeeds;
+the return value is still an independent copy.
+
+Providers are inferred from each original value, just as with `/resolve` and
+`run`. Doppler is the only supported cloud provider today. No options are
+required: without references, the result is an unchanged copy and no credentials
+are accessed. An environment can contain several references, including different
+Doppler projects/configs. Each value selects its own source; a command can supply
+a Doppler token. Commands still require
+`commands: true`. Returned secret values are never interpreted again.
+
+CommonJS uses the same API through
+`require('@ciqol/resenv')`. Both formats share the `ResenvError` class, whose
+`code` identifies the failure. CLI and preload failures exit with a safe message.
+
+Using `replace: true` requires `process.env` or writable data properties. A read-only
+property, setter or Proxy target fails before any replacement is committed.
+Keep the default copy mode for inputs that should remain unchanged. The Node
+preloads enable in-place replacement so application imports see resolved values.
+
+## Debug startup
+
+```sh
+NODE_DEBUG=ciqol:resenv node --require @ciqol/resenv/resolve app.mjs
+```
+
+For the Nx target above, use `NODE_DEBUG=ciqol:resenv nx serve app`. Set `NODE_DEBUG`
+when launching Node, before dotenv loading. Diagnostics use `node:util`'s
+`debuglog` and are off by default:
+
+```text
+CIQOL:RESENV 12345: Replaced secret value for "API_TOKEN".
+CIQOL:RESENV 12345: Done: replaced 1 secret value(s).
+```
+
+With no matching references, the only message is `Nothing to handle.` Failures
+include a safe error and completion summary. Logs omit values, tokens, command
+text and provider responses; no log files are created.
+
+`NODE_DEBUG=child_process` (including `NODE_DEBUG=*`) makes Node print spawn
+options containing credentials. resenv blocks its subprocess operations with
+`UNSAFE_DEBUG_LOGGING` in that mode. Use `NODE_DEBUG=ciqol:resenv` instead.
+
+## Optional commands
+
+- **Opt-in shell commands:** `/resolve-commands` resolves complete `$(command)`
+  values through `/bin/sh`. The canonical `/resolve` preload leaves these values
+  literal for both `--require` and `--import`, including when `RESENV_COMMANDS`
+  is set in the environment. `resenv run --commands -- ...` enables commands
+  alongside inferred Doppler references, as does the command preload. Use only
+  trusted configuration; commands run with your permissions. A timeout limits
+  execution time, but cannot undo file changes, network requests or other effects.
+  Leave this option disabled when the environment can contain untrusted input.
+  Commands have closed stdin, a 30-second timeout and a 64 KiB combined output
+  limit. Trailing LF characters are removed; fetched output stays literal.
+  Embedded forms such as `prefix$(command)suffix` are unsupported.
+
+Values beginning with `encrypted:` are left unchanged. resenv resolves cloud
+references; dotenvx decryption is outside its scope. The package has no runtime
+npm dependencies.
+
+`/resolve-doppler` is an equivalent name for `/resolve`; `run --doppler` remains
+accepted. New integrations should use the canonical entry points above.
+
+Use one preload mode per process. Combining `/resolve` and `/resolve-commands`
+or combining a preload with `resenv run` fails with `CONFLICTING_PRELOADS` to
+prevent reinterpreting fetched values. Do not configure a second resolver in
+the child process through `NODE_OPTIONS` or other launch hooks.
+For both modes together, use `resenv run --commands -- ...` or one library call
+with `{ commands: true }`.
+
+## Contributing
+
+For checkout setup, building, testing, trying local changes in another project
+and submitting fixes, see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+[MIT](LICENSE). Copyright (c) 2026 ciqol contributors.

package/SECURITY.md

@@ -0,0 +1,74 @@
+# Security
+
+## Scope and trust
+
+resenv resolves values in a process environment. It does not provide a vault,
+access-control service, key rotation, or isolation between programs running
+with the same credentials. The application can read its resolved secrets and
+any credentials supplied to it.
+
+Doppler mode uses a fixed HTTPS API origin, disables redirects and fetches only
+referenced secret names. It does not execute shell expressions. Credentials
+come from an explicit token, resenv's OS credential store or a fixed Doppler CLI
+helper. An API rejection never triggers a switch to another identity. Native
+browser login uses endpoints observed in Doppler's official MCP client rather
+than a public third-party OAuth contract. See [Doppler details](docs/doppler.md)
+for fallback rules, credential scope and platform limits.
+The canonical `resolve` preload and `run` command select Doppler only for
+`doppler://` values. They do not infer shell execution from `$()` values.
+Startup does not initiate login; the separate login command rejects CI and
+noninteractive sessions.
+
+The local credential store does not prevent code running as the same user from
+requesting credentials. resenv does not automatically remove an explicitly
+supplied `DOPPLER_TOKEN` from the application environment. Interactive login
+displays a temporary human authorization code; tokens and the polling code are
+not logged. The Node preload's private worker exchanges credentials and results
+over captured pipes, never process arguments or dotenv files.
+
+Command mode executes trusted configuration with the current user's
+permissions. Enable it only for configuration you have reviewed. Commands can
+access files and the network; failed resolution cannot undo their external
+effects. Commands are bounded by timeout and output limits, and their output
+is not included in resenv diagnostics.
+
+Node's `child_process` debug category prints spawn options, including stdin
+and environment values. resenv refuses its own subprocess and credential-helper
+operations when that category is enabled, including through `NODE_DEBUG=*`.
+Use `NODE_DEBUG=ciqol:resenv` for diagnostics that omit values. This guard does not
+control application logs, other instrumentation, or a debugger attached to the
+process.
+
+All values are resolved before resenv updates the caller's environment or
+starts the application. Provider failures, command failures and invalid
+environment values stop startup. Fetched values are never evaluated recursively. Application logs are outside resenv's control.
+
+Different automatic preload modes cannot be combined in one process. Otherwise
+the second mode could execute literal data fetched by the first.
+Combining a preload with the CLI is rejected for the same reason. Do not add
+another resolver to the child through `NODE_OPTIONS` or other launch hooks.
+Use one `resenv run --commands` invocation or one library call with commands
+enabled to resolve cloud references and commands together. Repeated manual
+library calls are separate operations; only pass original configuration to them.
+
+Provider responses must be valid UTF-8 and JSON, and resolved strings must not
+contain lone Unicode surrogates or null bytes. In-place replacement preflights
+all changed properties; read-only properties, setters and Proxy targets are
+rejected before any values are committed. Use `resolve()` to obtain a copy
+when the input is not a writable environment record.
+
+This experimental package has not had an independent security audit. Validation
+evidence and platform limits are recorded in [docs/validation.md](docs/validation.md).
+
+## Reporting a vulnerability
+
+Do not open a public issue containing a vulnerability, credentials or sensitive
+output. Open the repository's Security tab and use "Report a vulnerability"
+when available. If that option is unavailable, contact the maintainer through
+an existing private channel. Before the public transition is complete,
+maintainers must enable GitHub private vulnerability reporting and verify that
+it is available.
+
+Include affected versions, platform, impact and a minimal reproduction using
+dummy data. Never include production tokens, private keys or environment dumps.
+There is no guaranteed response time or long-term support policy yet.

package/assert-safe-diagnostics.cjs

@@ -0,0 +1,15 @@
+'use strict';
+
+var node_util = require('node:util');
+var errors = require('./errors.cjs');
+
+const childProcessDebug = node_util.debuglog('child_process');
+function assertSafeDiagnostics() {
+    // Node logs spawn options, including stdin and env, before starting a child.
+    // Test Node's actual debug state, including wildcard selectors and caching.
+    if (childProcessDebug.enabled) {
+        throw new errors.ResenvError('UNSAFE_DEBUG_LOGGING', 'Disable child_process in NODE_DEBUG before resolving secrets or starting a child. Use NODE_DEBUG=ciqol:resenv for value-free diagnostics.');
+    }
+}
+
+exports.assertSafeDiagnostics = assertSafeDiagnostics;

package/bin/resenv.cjs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+'use strict';
+
+var node_child_process = require('node:child_process');
+var node_os = require('node:os');
+var assertSafeDiagnostics = require('../assert-safe-diagnostics.cjs');
+var preload = require('../preload.cjs');
+var index = require('../index.cjs');
+var auth = require('../doppler/auth.cjs');
+var system = require('../doppler/system.cjs');
+var references = require('../doppler/references.cjs');
+var values = require('../values.cjs');
+
+const usage = 'Usage: resenv run [--commands] -- <command> [arguments...]\n       resenv login [doppler] [--cli] [--no-browser]\n       resenv logout doppler\nInfer secret providers from values already in the environment.\n--doppler remains accepted for compatibility.\n--commands enables whole-value $(command) expressions using /bin/sh.\n';
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.length === 1 && ['--help', '-h'].includes(args[0] || '')) {
+        process.stdout.write(usage);
+        return;
+    }
+    const explicitProvider = args[1] === 'doppler';
+    if (args[0] === 'login' && args.slice(explicitProvider ? 2 : 1).every(arg => ['--cli', '--no-browser'].includes(arg))) {
+        if (!explicitProvider && !references.references(process.env).length) {
+            process.stderr.write('Nothing to handle: no cloud secret references in the environment. Load your target environment first, or use resenv login doppler.\n');
+            return;
+        }
+        await auth.login({ cli: args.includes('--cli'), noBrowser: args.includes('--no-browser') });
+        return;
+    }
+    if (args.length === 2 && args[0] === 'logout' && args[1] === 'doppler') {
+        system.createSystem().remove();
+        process.stderr.write('Removed the resenv credential. Doppler CLI credentials and DOPPLER_TOKEN are unchanged; revoke the token in Doppler to invalidate it.\n');
+        return;
+    }
+    let commands = false;
+    while (args[0] === 'run' && ['--commands', '--doppler'].includes(args[1] || '')) {
+        if (args[1] === '--commands')
+            commands = true;
+        args.splice(1, 1);
+    }
+    const [operation, separator, command, ...commandArgs] = args;
+    if (operation !== 'run' || separator !== '--' || !command) {
+        process.stderr.write(usage);
+        process.exitCode = 2;
+        return;
+    }
+    let env;
+    try {
+        preload.assertNoPreload();
+        env = index.resolve(process.env, { commands });
+    }
+    catch (err) {
+        process.stderr.write(`${index.formatError(err)}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    assertSafeDiagnostics.assertSafeDiagnostics();
+    const child = node_child_process.spawn(command, commandArgs, { env, stdio: 'inherit', shell: false });
+    const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+    const handlers = new Map();
+    for (const signal of signals) {
+        const handler = () => { child.kill(signal); };
+        handlers.set(signal, handler);
+        process.on(signal, handler);
+    }
+    function cleanup() {
+        for (const [signal, handler] of handlers)
+            process.removeListener(signal, handler);
+    }
+    child.once('error', err => {
+        cleanup();
+        const code = values.hasErrorCode(err, 'ENOENT') ? 'COMMAND_NOT_FOUND' : 'COMMAND_START_FAILED';
+        process.stderr.write(`[resenv] ${code}: Could not start the requested command.\n`);
+        process.exitCode = values.hasErrorCode(err, 'ENOENT') ? 127 : 126;
+    });
+    child.once('exit', (code, signal) => {
+        cleanup();
+        if (signal) {
+            process.exitCode = 128 + (node_os.constants.signals[signal] || 1);
+            if (process.platform !== 'win32')
+                process.kill(process.pid, signal);
+        }
+        else {
+            process.exitCode = code ?? 1;
+        }
+    });
+}
+void main().catch(err => {
+    process.stderr.write(`${index.formatError(err)}\n`);
+    process.exitCode = 1;
+});

package/bin/resenv.mjs

@@ -0,0 +1 @@
+import './resenv.cjs';