@ciqol/resenv 0.1.0-beta.2 → 0.1.1

package/README.md

@@ -20,19 +20,25 @@ Resolution happens once at startup. It does not watch the provider for changes;
 restart the application to fetch updated values. No filename is passed to
 resenv, and dotenv files are never rewritten.
 
-Requires Node.js 20 or later. This is an experimental beta, published on npm's
-`beta` channel.
+Requires Node.js 20 or later. The package is experimental and remains in initial
+development; its API may change between 0.x releases.
+
+Each npm package includes this README for the version you installed. The
+[repository README](https://github.com/ciqol/resenv#readme) and linked online
+guides follow current development and may describe newer versions.
+
+Background: [A new Git worktree shouldn't mean another copy of your secrets](https://dev.to/titanron/a-new-git-worktree-shouldnt-mean-another-copy-of-your-secrets-424).
 
 ## Install
 
-Install the beta in your application project:
+Install in your application project:
 
 ```sh
-npm install --save-exact @ciqol/resenv@beta
+npm install --save-exact @ciqol/resenv
 ```
 
-This records the selected beta version in your project's manifest and lockfile.
-The `latest` tag points to the same beta; omitting `@beta` installs it too.
+This records the version selected by npm's `latest` tag in your project's
+manifest and lockfile.
 
 The CLI examples below use `npx --no-install` to run the copy installed in your
 project. In an npm script, use `resenv` directly.
@@ -66,7 +72,7 @@ access stop startup without opening a browser or prompting for login.
 
 For CI and other unattended environments, supply `DOPPLER_TOKEN` through your
 runner's secret facility; the CLI is not needed in that mode. See
-[Doppler authentication and platform details](docs/doppler.md), including
+[Doppler authentication and platform details](https://github.com/ciqol/resenv/blob/main/docs/doppler.md), including
 migration from the earlier resenv-managed login.
 
 Need another secrets provider, operating system or CLI installation method?
@@ -157,8 +163,8 @@ its environment is loaded; values embedded in build output remain in that output
 - Application code can read its resolved environment. Access to the same
   credentials also permits other code or sessions to retrieve those secrets.
 
-See [Doppler limits](docs/doppler.md#resolution-and-security-boundaries) and
-[security guidance](SECURITY.md).
+See the current [Doppler limits](https://github.com/ciqol/resenv/blob/main/docs/doppler.md#resolution-and-security-boundaries)
+and [security guidance](https://github.com/ciqol/resenv/blob/main/SECURITY.md).
 
 ## Library API
 
@@ -250,7 +256,7 @@ with `{ commands: true }`.
 ## Contributing
 
 For checkout setup, building, testing, trying local changes in another project
-and submitting fixes, see [CONTRIBUTING.md](CONTRIBUTING.md).
+and submitting fixes, see [CONTRIBUTING.md](https://github.com/ciqol/resenv/blob/main/CONTRIBUTING.md).
 
 ## License
 

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@ciqol/resenv",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.1",
   "description": "Replace environment references with their resolved values at application startup",
   "license": "MIT",
   "publishConfig": {
     "access": "public",
-    "tag": "beta",
+    "tag": "latest",
     "registry": "https://registry.npmjs.org/"
   },
   "repository": {
@@ -71,7 +71,6 @@
   "engines": {
     "node": ">=20"
   },
-  "dependencies": {},
   "files": [
     "*.cjs",
     "*.mjs",
@@ -79,11 +78,6 @@
     "*.d.mts",
     "doppler",
     "bin",
-    "types",
-    "README.md",
-    "LICENSE",
-    "CONTRIBUTING.md",
-    "SECURITY.md",
-    "docs"
+    "types"
   ]
 }

package/CONTRIBUTING.md

@@ -1,209 +0,0 @@
-# Contributing
-
-Starting a new session? Read the [maintainer handoff](docs/maintainer-handoff.md)
-and [repository instructions](https://github.com/ciqol/resenv/blob/beta/AGENTS.md) before editing or releasing.
-
-The [README](README.md) covers using resenv in an application. This guide covers
-changing resenv itself and verifying those changes.
-
-Releases start at `0.1.0-beta.1` on the sole branch `beta`, using npm tags
-`beta` and `latest` for the same tested version. Semantic-release's official
-commit-analysis and release-notes plugins select releasable changes and generate
-notes; actual beta tags supply the next
-prerelease counter. The root and ordinary local builds remain private prototypes.
-CI generates the publishable manifest before packing and testing it, then stages
-the exact archive through npm OIDC for maintainer approval. See
-[releasing](docs/releasing.md) and the bounded [release-tool review](docs/release-security.md).
-The source uses the [MIT license](LICENSE), copyright ciqol contributors.
-
-## Local development
-
-Use the Node version in `.nvmrc` and npm:
-
-```sh
-nvm use
-npm ci
-npm run verify
-```
-
-The committed `.npmrc` omits automatically installed peer dependencies. The
-release planner calls the two official plugins directly, so their full engine
-peer and its publisher dependencies are intentionally not installed. Audit and
-planning enforce that absence. `npm ls` still reports the declared missing
-engine peers; standalone plugin behavior is covered directly by the release
-specs. Keep this install policy when refreshing the lockfile; do not use force
-or legacy peer resolution. See [the dependency review](docs/dependencies.md).
-
-`npm run verify` is the complete local check: lint, strict source/spec type
-checks, build, unit/process tests and installed-package checks. To build without
-running the checks, use `npm run build`.
-
-After building, try the CLI from this checkout:
-
-```sh
-node dist/bin/resenv.cjs --help
-```
-
-Author library and CLI code as `.ts`; Rollup's TypeScript plugin produces both
-module formats and declarations from that implementation. Colocate Vitest unit
-specs as `*.spec.ts` beside each tested module and import its source. Build and
-release scripts have colocated `*.spec.mjs` Vitest specs. Keep
-process, package and integration checks in `test/` as `.mjs`; they exercise
-compiled output and installed packages. Tests use dummy credentials and commands.
-Never use real secrets in fixtures, terminal output, screenshots, issues, or
-pull requests.
-
-Provider detection belongs to the original environment values, including library
-calls without options. Keep shell execution behind `commands: true`, preserve
-literal fetched output, and validate references before any command runs.
-
-ESLint applies rules that use type information to the TypeScript implementation and specs
-and checks the JavaScript build tooling.
-Use `npm run lint:fix` for available automatic fixes; preserve the repository's
-existing compact formatting. Public object shapes use `type` with `readonly`
-properties. `Environment` is intentionally mutable because in-place resolution
-updates it. `npm run typecheck` checks the entire library and CLI with `strict`
-and `noUncheckedIndexedAccess`. A separate spec configuration checks tests without
-shipping them in JavaScript or declarations. Do not maintain separate handwritten declarations.
-
-```sh
-npm run test:unit         # colocated Vitest specs, no build required
-npm run test:watch        # watch unit specs while editing
-npm run test:coverage     # source unit coverage, text, lcov and Cobertura output
-npm run test:integration  # process checks, requires a build
-```
-
-`npm test` runs unit and process tests. Mock or inject provider calls, credential
-lookup and process control in unit tests. Keep checks that spawn actual commands
-or temporary applications in `test/`. The unit coverage
-report measures source and is separate from packed-package and process checks.
-`npm run verify` enforces a 90% global floor for source statements, branches,
-functions and lines. Worker and preload entry files stay in the denominator;
-the CLI is checked separately by process and packed-package tests. CI retains
-LCOV and Cobertura reports for seven days in the `resenv-coverage` artifact.
-The official `actions/upload-code-coverage` action uploads Cobertura in a separate
-job; fork PRs retain the local gate and reports but cannot upload. CLI lookup
-checks use injected helpers and temporary dummy executables; they never access
-a developer credential store or authenticated provider session.
-
-Use normal npm lifecycle behavior locally and in CI. Review install hooks,
-including implicit native builds, when changing dependencies; record any
-required setup in [the dependency review](docs/dependencies.md). Suppressing
-lifecycle hooks can skip required setup, so it is not part of the standard
-installation commands. The explicit build/check commands remain required.
-
-The package check packs `dist/` and installs that tarball into a temporary
-consumer outside the repository. The install is offline, uses npm's existing
-cache and the repository's reviewed runtime lock entries. It installs with
-`npm ci` without needing cached registry metadata. It does not link the source
-tree or publish. Run `npm ci` first to populate the archive cache. The check
-exercises both module formats, CLI and preloads, shared error identity, single
-preload execution and `.cts`/`.mts` consumer types.
-
-Pass an existing archive to test the same build CI uses:
-`npm run test:package -- /absolute/path/to/package.tgz`. For a final CI candidate,
-also pass its `release.json` as the second argument. The supplied package's
-name, version, executable mode and manifest are checked before runtime probes.
-The README inside the archive must match the checkout, install from npm's
-`beta` channel and avoid unpublished or local-archive installation guidance.
-`npm run verify` runs lint, typecheck, build and tests; `npm run release:check`
-also previews the package contents. Neither publishes or creates a tag.
-
-Rebuild after source, declarations, metadata or documentation changes. The build
-cleans `dist/` first and generates its manifest from the root package. See
-[docs/build.md](docs/build.md). Ordinary local builds remain private. Only a validated CI release plan removes
-that guard from the distribution manifest; never edit it by hand.
-
-## Try changes in an application
-
-### Install a local archive
-
-From the resenv checkout:
-
-```sh
-npm run build
-npm run pack:local
-```
-
-Install the resulting archive from the application's directory:
-
-```sh
-npm install --save-exact /absolute/path/to/ciqol-resenv-0.1.0-beta.1.tgz
-```
-
-This changes the application's manifest and lockfile. The archive must exist
-wherever it installs dependencies. Use a new archive version for changes to an
-already shared build; never overwrite an archive another project uses. Root
-package overrides do not propagate to consumers; inspect the installed tree
-against [the dependency review](docs/dependencies.md).
-
-### Try local changes without changing the application's CI
-
-Link this checkout's built `dist/` directory at the application's ignored
-`node_modules/@ciqol/resenv`, retaining any existing installation first. Keep
-references in an ignored `.env.serve.local` and the application's target edit
-local. Leave its manifest, lockfile and CI configuration unchanged.
-
-Rebuild resenv after source, metadata or documentation changes and restart the
-application. An application `npm ci` can remove the link; recreate it when needed.
-Authenticate with the official Doppler CLI from the application's directory:
-
-```sh
-doppler login
-```
-
-resenv reuses that login at runtime. Automated tests use injected or mocked
-credentials; real login is a manual integration check owned by Doppler's CLI.
-
-## Optional integration checks
-
-`npm run bench` measures fresh-process startup, a plain 200-variable environment,
-and a mocked provider with eight distinct lookups. It needs a build first and
-does not contact a provider. Timings are observations, not CI pass/fail thresholds.
-
-With an existing Nx installation:
-
-```sh
-npm run test:nx -- /absolute/path/to/workspace/node_modules
-```
-
-This creates a temporary Nx workspace and checks target-file loading,
-precedence and secret resolution with dummy values. It does not use the
-source workspace's dotenv files, credentials or remote cache.
-
-## Changes
-
-Keep dotenv file discovery with the caller. Doppler is the only built-in cloud
-provider; its authentication and lookups live under `src/doppler/`.
-Preserve all-or-nothing environment updates, strict failures, explicit command
-opt-in and literal handling of resolved values. Update the public API types and
-documentation together with behavior changes.
-
-Keep one public resolver, `resolve()`. It always returns an independent
-resolved copy and replaces input values only with `{ replace: true }`. Preloads
-enable that option; the CLI passes the returned copy to its child process.
-
-Add regression tests for changed behavior and avoid real provider calls. Use
-Conventional Commit subjects, for example `fix(resolver): preserve empty values`.
-Review dependency changes under the [dependency policy](docs/dependencies.md)
-and put the evidence in the PR. Update the guide when a lasting choice changes.
-
-CODEOWNERS identifies the maintainer. Keep bug reports and pull requests focused
-on observable behavior and include the checks run. Weekly dependency updates are
-grouped, with major version updates reviewed separately; bots cannot merge them.
-
-Keep the README focused on installation, authentication, application integration,
-API behavior and troubleshooting. Put contributor tooling, test commands and
-local development instructions here; detailed internals belong in `docs/`.
-Keep docs current rather than appending session logs, dated audit reports or
-test transcripts. Record run results in PRs and CI.
-
-Security reports follow [SECURITY.md](SECURITY.md). Publication and repository
-visibility changes require a separate maintainer decision; see the
-[release checklist](docs/releasing.md).
-
-npm releases run only through GitHub Actions with npm trusted publishing (OIDC).
-The maintainer configures the npm side. Local development and release checks
-do not require `npm login`; do not publish from a developer machine or add npm
-publishing tokens. CI must publish the exact candidate archive that its tests
-verified.

package/SECURITY.md

@@ -1,74 +0,0 @@
-# Security
-
-## Scope and trust
-
-resenv resolves values in a process environment. It does not provide a vault,
-access-control service, key rotation, or isolation between programs running
-with the same credentials. The application can read its resolved secrets and
-any credentials supplied to it.
-
-Doppler mode uses a fixed HTTPS API origin, disables redirects and fetches only
-referenced secret names. It does not execute shell expressions. Credentials
-come from an explicit `DOPPLER_TOKEN` or the current directory's existing
-Doppler CLI login. A fixed CLI helper captures that token privately; resenv
-does not parse Doppler's config files. An API rejection never triggers a switch
-to another identity. The official Doppler CLI owns browser authorization,
-token storage, login and logout. See [Doppler details](docs/doppler.md)
-for lookup rules, credential scope, migration and platform limits.
-The canonical `resolve` preload and `run` command select Doppler only for
-`doppler://` values. They do not infer shell execution from `$()` values.
-Startup does not initiate login. Use `doppler login` separately for local
-development or supply a suitably scoped token for unattended runs.
-
-Doppler's credential storage does not isolate credentials from other code
-running as the same user with access to them. resenv does not read or write the
-OS credential store directly or persist login tokens or fetched secrets.
-It does not automatically remove an explicitly supplied `DOPPLER_TOKEN` from
-the application environment. Tokens, captured CLI output and provider response
-bodies are not logged. The Node preload's private worker exchanges credentials
-and results over captured pipes, never process arguments or dotenv files.
-
-Command mode executes trusted configuration with the current user's
-permissions. Enable it only for configuration you have reviewed. Commands can
-access files and the network; failed resolution cannot undo their external
-effects. Commands are bounded by timeout and output limits, and their output
-is not included in resenv diagnostics.
-
-Node's `child_process` debug category prints spawn options, including stdin
-and environment values. resenv refuses its own subprocess and credential-helper
-operations when that category is enabled, including through `NODE_DEBUG=*`.
-Use `NODE_DEBUG=ciqol:resenv` for diagnostics that omit values. This guard does not
-control application logs, other instrumentation, or a debugger attached to the
-process.
-
-All values are resolved before resenv updates the caller's environment or
-starts the application. Provider failures, command failures and invalid
-environment values stop startup. Fetched values are never evaluated recursively. Application logs are outside resenv's control.
-
-Different automatic preload modes cannot be combined in one process. Otherwise
-the second mode could execute literal data fetched by the first.
-Combining a preload with the CLI is rejected for the same reason. Do not add
-another resolver to the child through `NODE_OPTIONS` or other launch hooks.
-Use one `resenv run --commands` invocation or one library call with commands
-enabled to resolve cloud references and commands together. Repeated manual
-library calls are separate operations; only pass original configuration to them.
-
-Provider responses must be valid UTF-8 and JSON, and resolved strings must not
-contain lone Unicode surrogates or null bytes. In-place replacement preflights
-all changed properties; read-only properties, setters and Proxy targets are
-rejected before any values are committed. Use `resolve()` to obtain a copy
-when the input is not a writable environment record.
-
-This experimental package has not had an independent security audit. See
-[verification](CONTRIBUTING.md) and [Doppler platform limits](docs/doppler.md).
-
-## Reporting a vulnerability
-
-Do not open a public issue containing a vulnerability, credentials or sensitive
-output. [Report a vulnerability privately](https://github.com/ciqol/resenv/security/advisories/new)
-through GitHub. If that option is unavailable, contact the maintainer through
-an existing private channel.
-
-Include affected versions, platform, impact and a minimal reproduction using
-dummy data. Never include production tokens, private keys or environment dumps.
-There is no guaranteed response time or long-term support policy yet.

package/docs/build.md

@@ -1,135 +0,0 @@
-# Build and package contract
-
-The repository is one Node.js package. The library and CLI are authored in
-strict TypeScript. Vitest unit specs use colocated `*.spec.ts` files. Process,
-package and integration checks and build orchestration use `.mjs`. Rollup's official
-TypeScript plugin compiles the implementation; consumers need no TypeScript
-loader or compiler.
-
-```sh
-npm ci
-npm run build
-npm test
-npm run test:package
-```
-
-## Output
-
-| Public entry | ESM | CommonJS | Declarations |
-| --- | --- | --- | --- |
-| `@ciqol/resenv` | `index.mjs` | `index.cjs` | `index.d.mts`, `index.d.cts` |
-| `@ciqol/resenv/resolve` | `resolve.mjs` | `resolve.cjs` | `resolve.d.mts`, `resolve.d.cts` |
-| `@ciqol/resenv/resolve-commands` | `resolve-commands.mjs` | `resolve-commands.cjs` | `resolve-commands.d.mts`, `resolve-commands.d.cts` |
-| `@ciqol/resenv/resolve-doppler` | `resolve-doppler.mjs` | `resolve-doppler.cjs` | `resolve-doppler.d.mts`, `resolve-doppler.d.cts` |
-
-These paths are relative to `dist/`. The executable points to
-`bin/resenv.cjs`; Rollup also emits its ESM wrapper. The command's user-facing
-name stays `resenv`.
-
-`resolve` reads the inherited environment and replaces Doppler references with
-their fetched values before application code starts. Doppler is the only
-built-in cloud provider. Original `encrypted:` values remain literal.
-`resolve-doppler` imports that same preload, so loading both names does not resolve fetched output again. Arbitrary commands require the
-separate `resolve-commands` entry or `run --commands`.
-
-The private `doppler-worker.cjs` entry lets synchronous preloads wait for HTTPS
-without turning the public CommonJS API into a promise. The worker is packed
-alongside the entries but is not a public export. It is located through package
-self-resolution, so the installed tarball does not depend on source paths.
-
-The root exports map defines the public entries. The build compiles their
-source with Rollup and its TypeScript plugin, then generates ESM facades from the exported
-names. Both formats load one CommonJS implementation. This preserves error
-class identity and shares the module cache when both preload forms are used.
-It follows Node's documented mitigation for the
-[dual-package hazard](https://nodejs.org/api/packages.html#dual-commonjs-es-module-packages).
-
-The CommonJS build preserves the module graph. Source unit specs import their
-adjacent modules; higher-level process and clean-consumer checks exercise the
-compiled modules and the same archive. Matrix jobs do not recompile TypeScript. Only the
-entries in the exports map are public package imports.
-
-The package has no runtime npm dependencies. Node built-ins remain external;
-Rollup does not bundle build tools into the application package. The build
-resolves `import.meta.url` to the Node filename in CJS output; browser-like
-globals in a Node test environment cannot change it.
-[Rollup's external option](https://rollupjs.org/configuration-options/#external)
-controls which imports remain outside the bundle.
-
-The compiler emits declarations into `dist/types/`. Generated `.d.mts` and
-`.d.cts` entry facades re-export that shared declaration graph; there is no
-handwritten public declaration file or separate declaration-bundler dependency.
-The generated package has no `type` field, so its shared `.d.ts` graph describes
-the CommonJS implementation. The exports map lists `types` first and selects
-the entry facade for the consumer's
-module format, as described by
-[TypeScript's ESM/CommonJS package guidance](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-4-7.html).
-Consumer compilation checks both formats, including invalid inputs that must
-remain type errors.
-
-Public options use type aliases and readonly properties. `Environment` stays
-mutable for optional in-place replacement. `resolve()` always returns a new
-`Environment`, with input replacement enabled only by `{ replace: true }`. It
-does not preserve a generic input type: resolved strings cannot retain a
-literal reference type.
-ESLint uses type information and enforces the selected style rules. The compiler
-checks all library/CLI source, colocated unit specs and both consumer formats with `strict` and
-`noUncheckedIndexedAccess`. Provider responses and parsed worker input start as
-`unknown` and are validated before use. Compiler failures stop the build.
-
-The source target is ES2023. `ES2024.String` supplies the declaration for
-`isWellFormed()`, whose availability is also checked by the Node 20/22/24 runtime
-tests. Node types match the Node 24 development toolchain; the runtime matrix
-remains necessary to detect use of APIs absent from the oldest supported Node.
-
-## Generated manifest and packing
-
-The build removes stale output first. It derives `dist/package.json` from the
-root manifest, rebases entry paths, and omits development dependencies, scripts,
-overrides and a package-wide `type` field. Explicit `.mjs` and `.cjs` extensions
-select the output format. README, the MIT `LICENSE`, contributor/security guides
-and docs are copied into the distribution and included in the archive.
-
-Ordinary local builds retain `private: true`. The CI build accepts a validated
-release plan and sets its computed version, removing `private` before the final
-archive is packed and tested. The development root stays private. Only the
-manual release workflow stages that tested archive for npm approval; see
-[releasing](releasing.md).
-
-`npm run pack:local` packs the generated directory. `npm run test:package`
-instead packs into a temporary directory and installs it offline into a clean
-consumer. It checks imports, requires, preloads, CLI behavior and declarations;
-the consumer cannot load resenv's source files or build dependencies. The
-runtime entries from the repository lockfile are used in the consumer lockfile.
-Its only direct dependency is the packed archive. An offline `npm ci` verifies
-archive integrity and installs the reviewed versions without registry metadata.
-
-With `npm run test:package -- /path/to/package.tgz`, the same checks inspect
-and install the supplied archive without rebuilding it. Its name, version,
-manifest and executable mode must match the package contract. CI uses this
-form so every platform checks the same built bytes.
-
-Keep tarballs already consumed by other projects immutable. No existing
-consumer artifact is rebuilt in place by these tests.
-
-## CI
-
-The `build` job uses normal npm lifecycle behavior, checks dependency advisories and
-signatures, runs typed lint, implementation/spec checks and Vitest source coverage,
-builds once and uploads the packed
-archive. The `test` matrix downloads that artifact, verifies the installed
-package, extracts the same build
-for the process tests, and never recompiles it. The matrix checks Node 20
-and 22 on Linux plus the `.nvmrc` version on Linux and macOS.
-
-Build and test jobs have read-only repository permissions and receive no application or
-registry secrets. Missing artifacts and digest mismatches fail the run. The
-archive is retained for seven days for maintainer review. A separate release
-job requires manual dispatch on `beta`, the protected `release` environment and
-all candidate checks. Hosted results must be observed before treating the workflow definition
-as a passing CI run.
-
-Official `actions/*` and `github/*` actions use exact release tags under the
-repository's GitHub publisher trust policy. Other remote actions require full
-commit SHAs. Installs use normal npm lifecycle behavior, and dependency updates
-require an install-hook review. Build commands run explicitly.

package/docs/dependencies.md

@@ -1,61 +0,0 @@
-# Dependencies
-
-resenv has no runtime npm dependencies. Build, test and release tools are
-development-only and excluded from the consumer archive. Exact versions live
-in the [source manifest](https://github.com/ciqol/resenv/blob/beta/package.json);
-the lockfile pins their resolved artifacts.
-
-## Tool choices
-
-| Packages | Purpose | License |
-| --- | --- | --- |
-| `rollup`, `@rollup/plugin-typescript` | Compile TypeScript, preserve the module graph and generate declarations | MIT |
-| `typescript` | Strict implementation, spec and consumer type checks | Apache-2.0 |
-| `tslib` | Helpers used by the TypeScript build plugin | 0BSD |
-| `@types/node` | Node platform types for the pinned development runtime | MIT |
-| `eslint`, `typescript-eslint` | Lint source and tooling, including rules that use type information | MIT |
-| `vitest`, `@vitest/coverage-v8` | Colocated unit tests and source coverage | MIT |
-| `@semantic-release/commit-analyzer`, `@semantic-release/release-notes-generator` | Official Conventional Commit classification and release notes | MIT |
-
-The [Doppler CLI](doppler.md) is a separately installed authentication helper,
-owned and updated by the user. resenv does not download or vendor it. Supplying
-`DOPPLER_TOKEN` avoids the CLI dependency.
-
-## Installation policy
-
-Use the Node version in `.nvmrc`, `npm ci` and normal npm lifecycle behavior.
-Do not disable scripts globally. Review published install hooks and implicit
-native builds when dependencies change. Rollup uses platform-specific optional
-binaries; keep the Linux/macOS clean-install checks. The lockfile marks optional
-`fsevents` as having an install script, although its reviewed artifact has no
-install hook or `binding.gyp`; npm may warn about that metadata.
-
-The committed `.npmrc` sets `omit=peer`. The two release plugins export the
-standalone functions the planner uses, but declare the full `semantic-release`
-engine as a peer for their usual integration. Omitting that unused peer also
-keeps its npm/GitHub publisher dependency graph off disk. Audit and planning
-guards require those modules to be unresolvable from the project and both
-plugins. See [release security](release-security.md).
-
-npm still resolves omitted peers into the lockfile. `npm ls` reports the
-deliberately missing engine peers; an audit with `--include=peer` can report
-vulnerabilities in those uninstalled entries. Do not conceal the peer warning
-with `--force`, `--legacy-peer-deps` or an alias package. Restoring the engine
-requires a dependency/security review and a deliberate guard change.
-
-## Updating dependencies
-
-Maintainers own dependency admission and updates. Keep direct versions exact
-and review the manifest and lockfile diff, upstream source and release notes,
-distributed licenses, provenance, advisories and install hooks. Keep Vitest and
-its coverage provider compatible. Changes to release plugins also require
-reviewing their standalone exports and executable guards.
-
-Run `npm ci`, `npm run audit`, `npm audit signatures` and `npm run verify`.
-Review hosted matrix checks before release. Record review evidence and check
-results in the PR and CI; update this guide only when a lasting choice or
-installation requirement changes. Do not append dated intake or test logs.
-
-Official `actions/*` and `github/*` actions use exact release tags under the
-repository's GitHub publisher trust policy. Other remote actions require full
-commit SHAs. Review action source, permissions and license when updating them.

package/docs/doppler.md

@@ -1,155 +0,0 @@
-# Doppler references and CLI authentication
-
-Doppler is resenv's only built-in cloud provider. After Nx or another loader
-populates the environment, resenv fetches referenced values through HTTPS and
-replaces them in memory before application startup. It resolves once per startup;
-restart the application to fetch changed secrets. This mode does not execute
-shell commands.
-The canonical `--require @ciqol/resenv/resolve` preload infers Doppler from
-`doppler://` values. The equivalent `--import` and `resenv run -- ...` do the
-same. The library also infers Doppler from values; call `resolve()` without
-a provider option. `resolve-doppler` and
-`run --doppler` remain supported for compatibility.
-
-## Local setup
-
-After [installing resenv](../README.md#install) in your application project,
-install the [official Doppler CLI](https://docs.doppler.com/docs/cli) and run
-this from the application's directory:
-
-```sh
-doppler login
-```
-
-Doppler owns browser authorization, token persistence, login scopes and logout.
-Use `doppler logout` to manage the CLI login. resenv never opens a browser,
-prompts for login, issues or revokes tokens, or reads or writes the OS
-credential store directly. There is no separate resenv login.
-
-Existing Doppler users can reuse their login. resenv asks the CLI for the token
-selected by its current working directory, so Doppler's directory-scoped
-workplace identities continue to apply. See
-[Doppler's scope guide](https://docs.doppler.com/docs/multiple-workplaces).
-`doppler setup` is not required for resenv references: their project and config
-are already explicit in each `doppler://` value. Nx or the caller remains
-responsible for dotenv file loading.
-
-### Platforms and installation locations
-
-The CLI handles its own credential storage on macOS, Linux and Windows. resenv
-does not require `secret-tool`, a separate keyring package or native Node addons.
-It discovers the CLI in these standard locations:
-
-| Platform | Locations, in lookup order |
-| --- | --- |
-| macOS / Linux | `/opt/homebrew/bin/doppler`, `/usr/local/bin/doppler`, `/usr/bin/doppler`, `~/.local/bin/doppler`, `~/bin/doppler` |
-| Windows | `~/AppData/Local/Microsoft/WinGet/Links/doppler.exe`, `~/scoop/apps/doppler/current/doppler.exe` |
-
-Here `~` is the OS user's home directory. Windows paths cover default per-user
-WinGet and Scoop installations. Custom and system-wide Windows installations
-outside these locations need an explicit `DOPPLER_TOKEN`. WSL uses the Linux
-installation and login within WSL. The runtime deliberately ignores the
-application's `PATH` so a repository-local executable cannot replace the
-credential helper.
-
-Windows discovery is covered with injected process tests; a native Windows
-end-to-end run is not yet verified. Automated checks never use a developer's
-Doppler login or OS credential store.
-
-### Migration from resenv-managed login
-
-`resenv login` and `resenv logout` have been removed. Run `doppler login` to
-establish the CLI identity, then start the application normally. Earlier resenv
-credentials stored under service `ciqol.envref.doppler`, account `default`, are
-ignored and are not migrated or deleted automatically. If you used that flow,
-remove the obsolete entry through your OS credential manager and revoke the
-obsolete token in Doppler when it is no longer needed.
-
-## Declare a reference
-
-Put references in the dotenv file Nx already selects, such as `.env.serve`:
-
-```dotenv
-API_TOKEN=doppler://my-project/dev/API_TOKEN
-```
-
-This is **resenv's own syntax**, not an official Doppler URI standard or
-SecretSpec's provider URI. All three fields are required: project, config and
-secret name. Project/config slugs must be lowercase letters, digits, `_` or
-`-`. Secret names can use Doppler's permissive punctuation; percent encoding
-is accepted for a secret name, such as `payments%2Fapi.key`. Query strings,
-fragments, credentials, ports and executable expressions are rejected.
-
-For an Nx Node target, put the preload on the application process:
-
-```json
-"runtimeArgs": ["--require", "@ciqol/resenv/resolve"]
-```
-
-For an Nx command target, use `resenv run -- node app.mjs` inside the
-target. Preloading the outer Nx process would run before Nx loads target files.
-resenv does not choose, read or rewrite dotenv files.
-
-## Runtime credential lookup
-
-Resolution checks these sources in order:
-
-1. An explicitly supplied `DOPPLER_TOKEN`.
-2. The current directory's existing Doppler CLI login, retrieved with the
-   documented `doppler configure get token --plain` operation.
-
-resenv captures the token internally and fetches secrets through HTTPS; it does
-not parse the CLI's private config format. The command uses a fixed executable,
-separate arguments, `--no-check-version` and `--no-read-env`, with a restricted
-environment. It inherits the application's working directory to preserve login
-scopes. Lookup has a fifteen-second timeout and a 16 KiB output limit. Captured
-output and helper errors are never forwarded to application logs.
-
-If the CLI is missing, install it in a supported location and run `doppler login`,
-or supply `DOPPLER_TOKEN`. A failed or empty CLI lookup reports that login is
-required. An explicitly supplied invalid token, malformed CLI token, access
-denial or network failure stops the operation without switching identities or
-starting login.
-
-In CI, containers and other unattended environments, supply a suitably scoped
-`DOPPLER_TOKEN` through the runner's secret facility. No CLI installation or
-local credential store is needed in that mode. Changing the CLI login affects
-the next application startup; resenv does not keep a persistent token cache.
-
-## Resolution and security boundaries
-
-- Fetches only named secrets from the public retrieve-secret endpoint. Repeated
-  references share one request per startup; values are not cached on disk.
-- Requires the computed value. Restricted, missing, null and invalid values
-  fail startup; resenv never substitutes a raw value as a fallback.
-- Keeps fetched output literal, including strings that start with `encrypted:`
-  or contain `$()`. Neither fetched nor original ciphertext is decrypted.
-- Resolves everything before applying changes. A failure leaves the caller's
-  environment untouched. Existing command mode remains separately opt-in.
-- Uses a fixed HTTPS origin, disables redirects, and has a ten-second timeout
-  per request. The synchronous preload uses a private Node worker with a
-  sixty-second overall limit. Up to four distinct lookups run concurrently;
-  duplicate references share one lookup. After a failure, no new lookups are
-  scheduled and active requests settle before failure is returned. Limits are
-  128 references, 64 KiB per value and
-  1 MiB for each response and the worker's captured output.
-- Preloads use a child Node process to wait for asynchronous HTTPS while
-  retaining `--require` compatibility. It receives only references and an
-  explicit credential through stdin, with results returned through a private
-  pipe. No Doppler CLI is required when `DOPPLER_TOKEN` is supplied.
-- Diagnostics show variable names and error codes, never tokens, provider
-  response bodies, CLI output or resolved values.
-
-This removes shell evaluation from Doppler lookups. It does not isolate
-untrusted repository code or agents that can access the same user's credential
-store. Doppler account permissions remain the authorization boundary. CLI user
-tokens inherit the user's privileges; a read-only service token can limit CI
-to a specific config.
-
-## Sources
-
-- [Doppler CLI installation and authentication](https://docs.doppler.com/docs/cli)
-- [Directory-scoped workplace logins](https://docs.doppler.com/docs/multiple-workplaces)
-- [Retrieve a secret](https://docs.doppler.com/reference/secrets-get)
-- [API authentication](https://docs.doppler.com/reference/api)
-- [Retrieve the CLI token](https://docs.doppler.com/docs/cli#fetch-cli-token-from-your-local-environment)

package/docs/maintainer-handoff.md

@@ -1,39 +0,0 @@
-# Maintainer guide
-
-Start with [AGENTS.md](https://github.com/ciqol/resenv/blob/beta/AGENTS.md) for repository policy and
-[CONTRIBUTING.md](../CONTRIBUTING.md) for setup and verification. Work in an
-isolated task worktree on a `titan/*` branch. Authenticate as `titan-ron` for
-[ciqol/resenv](https://github.com/ciqol/resenv); `beta` is the default and sole
-release branch.
-
-Inspect current Git status, branches, push remote and recent commits before
-editing. Read live GitHub checks, releases and npm metadata before release
-work; old chat messages or check results are not authoritative. Never copy
-credentials between sessions.
-
-| Guide | Maintained information |
-| --- | --- |
-| [README](../README.md) | Application installation, API and CLI usage |
-| [Doppler](doppler.md) | CLI authentication, lookup, migration and platform limits |
-| [Build](build.md) | Module formats, declarations, archive and CI contract |
-| [Dependencies](dependencies.md) | Tool rationale, installation and update policy |
-| [Releasing](releasing.md) | Candidate checks, npm staging/approval and recovery |
-| [Release security](release-security.md) | Isolation guards, advisory policy and platform review deadline |
-| [Security](../SECURITY.md) | Trust boundaries and private vulnerability reporting |
-
-## Code map
-
-| Path | Responsibility |
-| --- | --- |
-| `src/index.ts` | Resolution API and atomic environment replacement |
-| `src/preload.ts`, `src/resolve*.ts` | Startup integration and shared preload state |
-| `src/doppler/` | References, HTTPS, concurrency and CLI credential lookup |
-| `src/commands.ts` | Explicit shell substitution and process limits |
-| `bin/resenv.ts` | Child-process CLI |
-| `rollup.config.mjs`, `scripts/build.mjs` | CJS implementation, ESM facades, types and manifest |
-| `scripts/release-plan.mjs` | Official release plugins and beta counter |
-| `scripts/publish.mjs` | Tested-archive staging and verified release recording |
-| `.github/workflows/ci.yml` | Build once, archive matrix tests and manual release |
-
-Keep docs focused on current contracts, decisions and procedures. Put per-run
-test results, benchmarks, audit snapshots and session history in PRs or CI.

package/docs/release-security.md

@@ -1,70 +0,0 @@
-# Release-tool security
-
-Maintainer: `titan-ron`. Runtime dependencies have no advisory exceptions.
-The executable development policy is [security-exceptions.json](security-exceptions.json).
-Its review expires **November 9, 2026 at 00:00 UTC**. This is a project review
-deadline, also enforced by the publisher for platform npm; removing unused
-development tools does not extend it.
-
-## Release planning
-
-The planner calls the official commit-analysis and release-notes plugins
-directly. It reads Git history and published beta tags without GitHub write,
-npm or OIDC credentials. The full `semantic-release` engine and its publishing
-plugins are unnecessary for this beta-only workflow.
-
-The committed peer-omission policy keeps the engine, `@semantic-release/npm`,
-`@semantic-release/github` and their npm module off disk. Before auditing or
-planning, `scripts/release-guards.mjs` requires that none resolve from the
-project or either selected plugin. Its planner hook also rejects bare and
-resolved imports of those tools. An audit explicitly including omitted peers
-can still report their locked entries; see [installation policy](dependencies.md).
-
-The guard pins both plugins, micromatch and braces. It replaces every callable
-braces export with a throwing guard before loading the plugins. The selected
-micromatch matching calls use picomatch; vulnerable brace expansion must never
-execute. Version drift fails until the guards are reviewed.
-
-`npm run audit` checks runtime dependencies without exceptions, then the
-installed development tree. Moderate/high/critical findings must match an exact
-advisory URL, development-only lockfile path, version and unexpired policy
-entry. New advisories, changed paths, runtime occurrences and expired
-exceptions fail. The retained exception entries do not authorize reinstalling
-the excluded tools. Prefer an upstream fix or removing unused dependencies;
-never broaden the policy to make a check pass.
-
-## Publishing platform
-
-The privileged publisher installs no release-tool dependencies and accepts only
-the archive described by the verified candidate plan. It checks source identity
-and hashes before invoking npm. Publication follows the [release runbook](releasing.md).
-
-The platform is pinned to Node.js 24.19.0 and its npm 11.17.0. Platform npm has
-separately reviewed bundled-component risks; omitting development peers does
-not fix those components. `scripts/publish.mjs` rejects platform version drift
-and an expired review, including on a failed-job retry.
-
-The staging command accepts a fixed tarball and HTTPS npm registry, with no
-package lifecycle scripts in the generated manifest. It runs with a fresh home,
-configuration and cache, strips proxy/token/arbitrary npm configuration, and
-uses the protected workflow's OIDC identity. It accepts no login, shell,
-selector or arbitrary URL input. Registry and signing services remain trusted
-inputs. These controls bound exposure; they do not patch the platform CLI.
-
-The publisher validates the staging receipt's package name, version and
-integrity. npm approval publishes the stage. A retry verifies the public
-archive's integrity and both npm tags before recording the Git tag/release.
-No tag is created for a pending stage.
-
-## Reviewing changes
-
-Review the actual published artifacts, including bundled copies; patching a
-standalone package does not establish that npm's bundled copy is fixed.
-Recheck platform npm before the deadline and remove obsolete exception entries
-when upstream fixes or dependency removal make them unnecessary. Do not extend
-the deadline or bypass executable controls to unblock publication.
-
-Run `npm run audit`, `npm audit signatures` and `npm run verify`. Release tooling
-specs cover absence/version guards, policy scope and expiry, adversarial commit
-analysis, real Git release history and publisher isolation. Keep review evidence
-in the PR and CI, and maintain this document as the current policy.

package/docs/releasing.md

@@ -1,154 +0,0 @@
-# Releases
-
-## Versions
-
-`beta` is the sole release and default branch. Releases start at `0.1.0-beta.1`
-and use npm tags `beta` and `latest`, both pointing to the same tested beta.
-
-The planner uses semantic-release's official commit-analysis and release-notes
-plugins. Conventional Commits decide whether changes need a release. Each
-releasable update increments the counter from the latest reachable
-`v0.1.0-beta.N` tag; docs-only changes do not release. Breaking changes during
-this experimental line also increment the beta counter. Selecting a stable
-line or another base version is a separate release-policy change.
-
-The full semantic-release engine requires a normal release branch and defaults
-to a first version of 1.0.0. Using its official plugins directly preserves the
-requested sole-beta-branch setup without inventing a stable branch or a release
-that never happened. The base line is declared in `release.config.mjs`.
-
-The development manifest and ordinary local builds stay private. Only a valid
-release plan sets the distribution version and removes `private` before packing.
-Never edit a generated manifest or overwrite a previously shared archive.
-
-## CI pipeline
-
-The [CI workflow](https://github.com/ciqol/resenv/blob/beta/.github/workflows/ci.yml) builds one archive:
-
-1. **Build:** normal npm installation, runtime/development audits, registry
-   signatures, lint, strict types and colocated Vitest specs. The read-only
-   planner generates the beta version and notes from Git history. Rollup builds
-   it once; npm packs it and records SHA-256 and SHA-512 integrity.
-2. **Consumers:** Linux Node 20, 22 and the pinned Node 24, plus macOS Node 24,
-   install and test the same archive. Checks cover ESM, CJS, types, preloads,
-   CLI, literal secret output and failure boundaries. Nothing is rebuilt.
-3. **Release:** a manual dispatch from `beta` with `publish: true`, after every
-   check passes. The protected job verifies hashes, workflow identity and the
-   current branch head. It installs no project dependencies and runs no package
-   code. `npm stage publish` submits the exact archive through OIDC with
-   provenance and the explicit `beta` tag. The job validates and saves npm's
-   staging receipt; no Git tag or GitHub release is created yet.
-4. **Approval and recording:** the maintainer reviews and approves the staged
-   package in npm using interactive 2FA. Wait for npm to make it available,
-   update `latest` to the approved version, then rerun the original release job.
-   It verifies the published integrity against the original tested archive and
-   requires npm tags `beta` and `latest` to point to that version before creating
-   its Git tag and GitHub prerelease. It does not stage or publish the package again.
-
-Pushes, PRs and dispatches with `publish: false` cannot stage a package. Release
-jobs are serialized and not cancelled. Artifacts last seven days. A fresh
-workflow run is not a substitute for rerunning the original release job when
-recovering an already staged/published candidate.
-
-## Required setup
-
-The existing npm trusted publisher must match:
-
-| Field | Value |
-| --- | --- |
-| Provider | GitHub Actions |
-| Organization | `ciqol` |
-| Repository | `resenv` |
-| Workflow filename | `ci.yml` |
-| Environment | `release` |
-| Permission | `npm stage publish` |
-
-No permanent npm token or direct-publish permission is needed. The pinned
-Node 24.19.0/npm 11.17.0 platform includes staged publishing. New trusted
-publisher configurations must be validated by a successful CI operation before
-the deadline shown in npm settings.
-
-The GitHub environment `release` accepts only the `beta` branch and has no
-required GitHub reviewers. CI submits staged packages; the maintainer approves
-publication in npm. After reading back the branch policy and verifying npm
-setup, set Actions variable `RELEASE_ENABLED=true`. Leave it unset until then
-to prevent a dispatch from creating an unrestricted environment automatically.
-Environment creation or protection changes require explicit authorization.
-
-## Run a beta release
-
-Open [CI](https://github.com/ciqol/resenv/actions/workflows/ci.yml), choose
-**Run workflow**, select `beta`, and enable the staging input. When build and
-consumer checks pass, the release job stages the archive without another GitHub
-approval. Its summary and the `resenv-stage` artifact contain the stage
-identifier and tested integrity.
-
-Review the staged package in npm, then approve it with the stage identifier:
-
-```sh
-npm stage view <stage-id> --json
-npm stage approve <stage-id>
-```
-
-These are maintainer review/approval commands; the archive is built and staged
-by GitHub Actions. OIDC cannot perform the approval step. Wait for npm scanning
-and public availability, then update the default install tag in the maintainer
-session:
-
-```sh
-npm dist-tag add @ciqol/resenv@<approved-version> latest
-```
-
-Rerun the original release job to record the release. Verify the npm version,
-`beta` and `latest` tags, archive integrity, provenance and GitHub
-prerelease. Never infer success from a staging receipt alone.
-
-For a hosted rehearsal, leave the staging input off. Local verification is:
-
-```sh
-npm ci
-npm run audit
-npm run release:check
-```
-
-None of these commands publishes. The planner can generate a non-publishing
-plan with `node scripts/release-plan.mjs /absolute/path/to/candidate-directory`.
-
-## Recovery and old versions
-
-A failed stage operation creates no Git tag or GitHub release. Check npm before
-retrying an ambiguous outcome: a staged version reserves its version number.
-Do not attempt to stage it again while awaiting approval. Approve or reject the
-existing stage through npm. Rejection requires a reviewed replacement candidate.
-
-The original release job accepts an existing public version only if integrity
-matches its candidate. A conflicting archive, changed beta head or conflicting
-Git tag stops recovery. Keep the beta branch at the reviewed commit until the
-release is recorded. If its artifact expires, review recovery separately.
-
-Retain the `0.0.0-stage` placeholder until a functional beta is publicly
-available and verified.
-With explicit authorization, remove that exact placeholder version and check
-remaining versions and tags. Never unpublish the whole package. npm's unpublish
-policy still applies; deleted versions cannot be reused.
-See [npm's policy](https://docs.npmjs.com/policies/unpublish/).
-
-## Security and platform limits
-
-The runtime package has no npm dependencies or advisory exceptions. Installed
-runtime and development audits must pass with the unused engine/publisher peer graph
-omitted. Audit and planning enforce that absence; the lockfile still records
-the uninstalled peers. The existing November 9, 2026 review deadline remains
-for the policy and separately reviewed platform npm. The privileged job does
-not install release-tool modules. See [release security](release-security.md).
-
-Doppler is the only built-in cloud provider. Authentication is owned by the
-Doppler CLI; resenv reads its existing directory-scoped token or accepts
-`DOPPLER_TOKEN` for unattended use. It does not manage native credential storage
-or browser login. Standard Windows CLI discovery has injected coverage but no
-native Windows end-to-end verification. Commands require explicit opt-in.
-Dotenvx ciphertext is left unchanged. See [Security](../SECURITY.md).
-
-Sources: [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/),
-[staged publishing](https://docs.npmjs.com/cli/v11/commands/npm-stage/),
-[semantic-release branching](https://semantic-release.org/foundation/workflow-configuration/).

package/docs/security-exceptions.json

@@ -1,139 +0,0 @@
-{
-  "expires": "2026-11-09T00:00:00.000Z",
-  "owner": "titan-ron",
-  "scope": "Release planning only; runtime audit has no exceptions.",
-  "exceptions": [
-    {
-      "advisory": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
-      "package": "brace-expansion",
-      "versions": [
-        "5.0.9"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/brace-expansion"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
-      "package": "brace-expansion",
-      "versions": [
-        "5.0.9"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/brace-expansion"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
-      "package": "brace-expansion",
-      "versions": [
-        "5.0.9"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/brace-expansion"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm",
-      "package": "braces",
-      "versions": [
-        "3.0.3"
-      ],
-      "nodes": [
-        "node_modules/braces"
-      ],
-      "reason": "The planner blocks every braces callable and only uses micromatch matching, which delegates to picomatch."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-ch52-4w7c-c8xp",
-      "package": "http-cache-semantics",
-      "versions": [
-        "4.2.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/http-cache-semantics"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q",
-      "package": "ip-address",
-      "versions": [
-        "10.5.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/ip-address"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-2vr4-cq9g-pvrc",
-      "package": "ip-address",
-      "versions": [
-        "10.5.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/ip-address"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-j6r3-76f7-8jcv",
-      "package": "ip-address",
-      "versions": [
-        "10.5.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/ip-address"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw",
-      "package": "ip-address",
-      "versions": [
-        "10.5.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/ip-address"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
-      "package": "postcss-selector-parser",
-      "versions": [
-        "7.1.4"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/postcss-selector-parser"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-3wwx-pv8p-q78v",
-      "package": "undici",
-      "versions": [
-        "6.28.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/undici"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    },
-    {
-      "advisory": "https://github.com/advisories/GHSA-rfgv-xxqx-mfg5",
-      "package": "undici",
-      "versions": [
-        "6.28.0"
-      ],
-      "nodes": [
-        "node_modules/npm/node_modules/undici"
-      ],
-      "reason": "Bundled inside npm for the unselected @semantic-release/npm plugin. The planner blocks loading that plugin, the GitHub plugin and bundled npm; the publisher does not install release dependencies."
-    }
-  ]
-}