memorio 4.5.0 → 4.6.4

package/markdown/CHANGELOG.md

@@ -4,6 +4,77 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## v4.6.1 (Security Patch) - 2026-08-14 — CRITICAL Security Fix
+
+### 🔐 Security NOTICE (v4.6.0)
+
+**CRITICAL**: A Gitea Personal Access Token was accidentally committed to `.npmrc` in v4.6.0
+
+**Affected**: `v4.6.0` tag and all builds from that version
+
+**Action Required**:
+- **IMMEDIATE**: Revoke ALL tokens on Gitea Packages by admin access
+- **GENERATE**: Create new PAT with scope `write:package` only
+- **CONFIGURE**: Add as secret `PAT` in GitHub Actions or Gitea Actions
+- **UPGRADE**: Use v4.6.1 where the token is replaced with `${PAT}` environment variable
+
+The hardcoded token `2f398d5d7a734781e96108fdd0dbbabad41ef77a` has been removed in v4.6.1.
+
+### 🐛 Bug Fixes
+
+- **SECURITY**: Removed hardcoded Gitea PAT from `.npmrc` (exposed token remediated)
+- Replaced with environment variable `${PAT}` for secure authentication
+
+### 📝 Documentation Updates
+
+- `.npmrc`: Token replaced with environment variable reference
+- `.gitea/workflows/npm.yml`: Configured to use secrets `GITEA_USER` and `PAT`
+
+---
+
+## v4.6.0 (Previous - SECURITY ISSUE) - 2026-08-13 — Refactoring & Documentation
+
+**⚠️ WARNING**: This version had a hardcoded PAT token that was later remediated in v4.6.1**
+
+### 🐛 Bug Fixes
+
+- Fixed circular import in `idb/index.ts` → `core/global`
+- Fixed dead `globalThis._propertyAccessLog` reference in `observer`
+- Fixed `dispatch.remove(f)` tuple bug in `functions/dispatch.ts`
+- Fixed `logger.isDebugEnabled` using wrong module reference
+- Removed dead `propertyAccessLog` / `pushPropertyAccess` from `core/internal.ts`
+- Removed duplicate path-tracking block in `state` get handler
+- Removed redundant `?? key` fallback in `state` set handler
+
+### 🔧 Code Refactoring
+
+- **Self-contained modules**: All modules now work independently without internal `globalThis.memorio.*` reads/writes
+- **Module-local state**: Created `core/internal.ts` for module-local singletons
+- **Bootstrap-only global**: `core/global.ts` now only publishes to `globalThis.memorio` at initialization
+- **Removed dead code**: `core/constructor.ts` deleted (unused)
+- **Extracted helpers**: `_read`/`_write`/`_remove` in `store` and `session` to eliminate duplication
+- **Fixed circular imports**: `dispatch` → `observer` via `globalThis.events`
+
+### 📝 Documentation Updates
+
+- `docs/README.md`: Added Classic `import { state } from 'memorio'` section, improved badges layout, enhanced "Why memorio?" comparison table
+- `docs/markdown/STORE.md`: Added classic import note
+- `docs/markdown/IMPORT.md`: New file for named export guide
+- `docs/SUMMARY.md`: Updated to include `IMPORT.md`
+- `README.md`: Badge corrections, header cleanup, removed unverified bundle size claims
+
+### 🆕 GitHub Actions / Gitea Workflows
+
+- Added `.gitea/workflows/npm.yml` for automatic npm package publishing to Gitea Packages on `v*` tags
+- Requires `GITEA_USER` and `PAT` secrets
+
+### 🧪 Tests
+
+- **Result: 9 suites · 101 passed · 4 skipped · 1 todo**
+- All lint and typecheck clean
+
+---
+
 ## v3.0.2 (Current) - 2026-05-19 — Bug Fix, Security & API Expansion
 
 ### 🐛 Bug Fixes

package/markdown/IMPORT.md

@@ -0,0 +1,139 @@
+# Classic `import` support
+
+Memorio supports two equivalent styles: the original global side-effect import,
+and the new named exports. Both share the same instances (one source of truth).
+
+```typescript
+// Global style (original)
+import 'memorio'
+state.user = { name: 'Sara' }
+
+// Classic import style (new)
+import { state } from 'memorio'
+state.user = { name: 'Sara' }
+```
+
+`state` in both examples is the exact same Proxy object.
+
+---
+
+## Why two styles?
+
+| Style | When to use |
+|-------|-------------|
+| `import 'memorio'` | Zero-config, global access everywhere, legacy scripts |
+| `import { state } from 'memorio'` | Explicit dependencies, tree-shakeable bundles, TypeScript IntelliSense |
+
+---
+
+## ESM named imports
+
+All modules are available as named exports:
+
+```typescript
+import {
+  state,
+  store,
+  session,
+  cache,
+  idb,
+  observer,
+  useObserver,
+  dispatch,
+  message,
+  devtools,
+  logger
+} from 'memorio'
+```
+
+Platform helpers:
+
+```typescript
+import {
+  isBrowser,
+  isNode,
+  isDeno,
+  isEdge,
+  getCapabilities,
+  createContext,
+  listContexts,
+  deleteContext
+} from 'memorio'
+```
+
+Internal utilities (for tests/debug):
+
+```typescript
+import internal, { propertyName } from 'memorio'
+import { setContext, getContext } from 'memorio'
+```
+
+Default export (the public `memorio` namespace):
+
+```typescript
+import memorio from 'memorio'
+memorio.help()
+```
+
+---
+
+## CJS usage
+
+```javascript
+const { state, store, memorio } = require('memorio')
+```
+
+---
+
+## React / useObserver
+
+`useObserver` works the same way via named import:
+
+```tsx
+import { useObserver, state } from 'memorio'
+
+function Counter() {
+  const [, forceUpdate] = useReducer(x => x + 1, 0)
+
+  useObserver(forceUpdate, [state.counter])
+
+  return <div>Count: {state.counter}</div>
+}
+```
+
+---
+
+## Context isolation
+
+```typescript
+import { createContext, listContexts, deleteContext, isolate } from 'memorio'
+
+const ctx = createContext('tenant-123')
+ctx.state.user = { name: 'Isolated' }
+ctx.store.set('settings', { theme: 'dark' })
+
+listContexts() // ['tenant-123']
+deleteContext('tenant-123')
+```
+
+---
+
+## Same-instance guarantee
+
+Named exports point to the same instances published on `globalThis` by
+`core/global` at bootstrap. Mutating via named export mutates the global,
+and vice versa.
+
+```typescript
+import { state } from 'memorio'
+
+state.importedFlag = true
+console.debug(globalThis.state.importedFlag) // true
+```
+
+---
+
+## Migration from global-only
+
+No code changes required. Existing `import 'memorio'` + `state.foo = 1`
+continues to work unchanged. Named exports are additive.

package/markdown/PLATFORM.md

@@ -41,8 +41,8 @@ Memorio automatically detects the environment on import:
 import 'memorio';
 
 // Check current platform
-console.debug(memorio.platform);   // 'browser' | 'node' | 'deno' | 'edge'
-console.debug(memorio.isPersistent); // true if using real storage
+console.debug(memorio.getCapabilities().platform); // 'browser' | 'node' | 'deno' | 'edge'
+console.debug(store.isPersistent); // true if using real localStorage
 ```
 
 ### Available Platform APIs
@@ -257,5 +257,9 @@ Same as browser - localStorage and sessionStorage are available.
 | Property | Type | Description |
 |----------|------|-------------|
 | `memorio.version` | `string` | Memorio version |
-| `memorio.platform` | `string` | Current platform |
+| `memorio.getCapabilities().platform` | `string` | Current platform |
+| `memorio.isBrowser()` / `isNode()` / `isDeno()` / `isEdge()` | `boolean` | Platform checks |
 | `memorio._sessionId` | `string` | Unique session identifier |
+
+> **Classic `import`**: context APIs are also named exports.
+> `import { createContext, listContexts, deleteContext, isolate } from 'memorio'`.

package/markdown/STATE.md

@@ -16,6 +16,9 @@ import 'memorio';
 
 That's it. `state` is now global.
 
+> **Classic `import`**: `state` is also a named export.
+> `import { state } from 'memorio'` returns the exact same proxy as `globalThis.state`.
+
 ---
 
 ## Quick Examples

package/markdown/STORE.md

@@ -15,6 +15,9 @@ npm install memorio
 import 'memorio';
 ```
 
+> **Classic `import`**: `store` is also a named export.
+> `import { store } from 'memorio'` returns the exact same instance as `globalThis.store`.
+
 ---
 
 ## Quick Examples

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "memorio",
   "codeName": "memorio",
-  "version": "4.5.0",
+  "version": "4.6.4",
   "description": "Memorio, State + Observer, Store and iDB for an easy life - Cross-platform compatible",
   "main": "./index.cjs",
-  "browser": "./index.cjs",
+  "browser": "./index.js",
   "module": "./index.js",
+  "type": "module",
   "types": "./index.d.ts",
   "typing": "./types/*",
   "license": "MIT",
@@ -50,6 +51,10 @@
   "files": [
     "**/*"
   ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": true,
   "support": {
     "name": "Dario Passariello",
     "url": "https://dario.passariello.ca/",

package/types/exports.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Named exports for classic `import` usage.
+ *
+ * Every export below points to the exact same instance
+ * already defined on globalThis by the core modules.
+ * `import { state } from 'memorio'` === `globalThis.state`.
+ *
+ * @see index.ts (runtime re-export)
+ */
+
+/// <reference path="./memorio.d.ts" />
+/// <reference path="./state.d.ts" />
+/// <reference path="./store.d.ts" />
+/// <reference path="./session.d.ts" />
+/// <reference path="./cache.d.ts" />
+/// <reference path="./idb.d.ts" />
+/// <reference path="./observer.d.ts" />
+/// <reference path="./useObserver.d.ts" />
+
+export const memorio: _memorio
+export const state: _state
+export const store: _store
+export const session: _session
+export const cache: _cache
+export const idb: _idb
+export const observer: _observer
+export const useObserver: _useObserver
+export const dispatch: _dispatch
+export const events: Record<string, any>
+
+export const isBrowser: () => boolean
+export const isNode: () => boolean
+export const isDeno: () => boolean
+export const isEdge: () => boolean
+export const getCapabilities: (...args: unknown[]) => any
+export const createContext: _memorio['createContext']
+export const listContexts: _memorio['listContexts']
+export const deleteContext: _memorio['deleteContext']
+export const isolate: _memorio['isolate']
+export const message: (...args: unknown[]) => void
+export const help: () => void
+
+export const propertyName: (container: any, object: any) => string | null
+export const internal: {
+  debug: boolean
+  tracking: boolean
+  trackedPaths: Set<string>
+  locked: boolean
+  lastAccessedPath: string
+  stateVersion: number
+  currentContext: string | null
+  clearTrackedPaths(): void
+  bumpStateVersion(): number
+}
+export const setContext: (id: string) => void
+export const getContext: () => string | null
+
+export default memorio