syntropylog 0.12.4 → 0.12.6

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.12.6
+
+## 0.12.5
+
+### Patch Changes
+
+- Remove **yaml** dependency and `loadLoggerConfig`; config is passed to `init()` only. Reduces supply-chain surface and aligns with Socket/security tooling. SECURITY.md and README updated (no file-based config).
+
+  **Breaking:** If you used `loadLoggerConfig()` or loaded config from YAML/JSON files, migrate to passing options directly to `syntropyLog.init({ ... })`. The package no longer exports `loadLoggerConfig` or depends on `yaml`.
+
 ## 0.12.4
 
 ### Patch Changes

package/README.md

@@ -631,7 +631,7 @@ Secure this route (e.g. auth, internal only). When debugging in a POD is finishe
 **Filesystem access:** The package only reads the files described below; it does not scan or read arbitrary paths.
 
 - **Native addon loader** (`syntropylog-native`): Reads only (1) the presence of native `.node` binaries inside the package’s own directory (`__dirname`) to choose the correct build for the current OS/arch, and (2) on Linux only, the system `ldd` binary (e.g. `/usr/bin/ldd`) to detect musl vs glibc. No user or application files are read.
-- **Config loader** (`loadLoggerConfig`): Reads only paths you control. If you use it, it reads at most one file: either the path you pass in `opts.configPath`, or a file under `opts.configDir` with a name derived from `opts.defaultBase` and `opts.environment` (default: `./config/logger.yaml` or `./config/logger-{env}.yaml`). You can avoid filesystem access entirely by not calling `loadLoggerConfig` and passing config directly to `init()`.
+Configuration is passed to `init()` only; the package does not load config from files.
 
 | Dynamically configurable | Fixed at init |
 |--------------------------|---------------|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "syntropylog",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "engines": {
     "node": ">=20.0.0"
   },
@@ -139,11 +139,9 @@
     "access": "public",
     "provenance": true
   },
-  "dependencies": {
-    "yaml": "^2.8.2"
-  },
+  "dependencies": {},
   "optionalDependencies": {
-    "syntropylog-native": "0.1.0"
+    "syntropylog-native": "0.1.1"
   },
   "devDependencies": {
     "@changesets/cli": "^2.27.1",

package/dist/types/config/loadLoggerConfig.d.ts

@@ -1,48 +0,0 @@
-import { LoggerOptions } from '../types';
-/**
- * Defines the options for customizing the logger configuration loading behavior.
- */
-export interface LoggerConfigLoaderOptions {
-    /**
-     * Explicit absolute path to the configuration file.
-     * If provided, this takes highest precedence.
-     */
-    configPath?: string;
-    /**
-     * The explicit environment name used to determine the environment-specific
-     * suffix for the config file name (e.g., 'production').
-     */
-    environment?: string;
-    /**
-     * The directory where the configuration files are located.
-     * @default './config'
-     */
-    configDir?: string;
-    /**
-     * The base name for the configuration file (e.g., 'logger' results in 'logger.yaml'
-     * or 'logger-production.yaml').
-     * @default 'logger'
-     */
-    defaultBase?: string;
-}
-/**
- * Loads logger configuration from a YAML file.
- * The function determines the file path with the following priority:
- * 1. The explicit path provided in `opts.configPath`.
- * 2. The environment-specific path (e.g., `{configDir}/{defaultBase}-{environment}.yaml`).
- * 3. The default base path (e.g., `{configDir}/{defaultBase}.yaml`).
- *
- * It does NOT read environment variables directly; all state must be passed via `opts`.
- * If no file is found, it returns an empty object, making the config file optional.
- *
- * **Security:** A restricted schema (`json`) is used to avoid prototype pollution
- * and dangerous types. Only use with configuration files under deployment team
- * control (controlled paths and permissions). This function reads only the paths
- * derived from opts (configPath, configDir, defaultBase, environment); no other
- * filesystem access is performed.
- *
- * @param opts - Options to customize the loading behavior.
- * @returns A partial `LoggerOptions` object, or an empty object if no file is found.
- * @throws An error if a config file is found but fails to be read or parsed.
- */
-export declare function loadLoggerConfig(opts?: LoggerConfigLoaderOptions): Partial<LoggerOptions>;