# Changelog - Memorio

All notable changes to this project will be documented in this file.

---

## v4.6.1 (Security Patch) - 2026-08-14 — CRITICAL Security Fix

### 🔐 Security NOTICE (v4.6.0)

**CRITICAL**: A Gitea Personal Access Token was accidentally committed to `.npmrc` in v4.6.0

**Affected**: `v4.6.0` tag and all builds from that version

**Action Required**:
- **IMMEDIATE**: Revoke ALL tokens on Gitea Packages by admin access
- **GENERATE**: Create new PAT with scope `write:package` only
- **CONFIGURE**: Add as secret `PAT` in GitHub Actions or Gitea Actions
- **UPGRADE**: Use v4.6.1 where the token is replaced with `${PAT}` environment variable

The hardcoded token `2f398d5d7a734781e96108fdd0dbbabad41ef77a` has been removed in v4.6.1.

### 🐛 Bug Fixes

- **SECURITY**: Removed hardcoded Gitea PAT from `.npmrc` (exposed token remediated)
- Replaced with environment variable `${PAT}` for secure authentication

### 📝 Documentation Updates

- `.npmrc`: Token replaced with environment variable reference
- `.gitea/workflows/npm.yml`: Configured to use secrets `GITEA_USER` and `PAT`

---

## v4.6.0 (Previous - SECURITY ISSUE) - 2026-08-13 — Refactoring & Documentation

**⚠️ WARNING**: This version had a hardcoded PAT token that was later remediated in v4.6.1**

### 🐛 Bug Fixes

- Fixed circular import in `idb/index.ts` → `core/global`
- Fixed dead `globalThis._propertyAccessLog` reference in `observer`
- Fixed `dispatch.remove(f)` tuple bug in `functions/dispatch.ts`
- Fixed `logger.isDebugEnabled` using wrong module reference
- Removed dead `propertyAccessLog` / `pushPropertyAccess` from `core/internal.ts`
- Removed duplicate path-tracking block in `state` get handler
- Removed redundant `?? key` fallback in `state` set handler

### 🔧 Code Refactoring

- **Self-contained modules**: All modules now work independently without internal `globalThis.memorio.*` reads/writes
- **Module-local state**: Created `core/internal.ts` for module-local singletons
- **Bootstrap-only global**: `core/global.ts` now only publishes to `globalThis.memorio` at initialization
- **Removed dead code**: `core/constructor.ts` deleted (unused)
- **Extracted helpers**: `_read`/`_write`/`_remove` in `store` and `session` to eliminate duplication
- **Fixed circular imports**: `dispatch` → `observer` via `globalThis.events`

### 📝 Documentation Updates

- `docs/README.md`: Added Classic `import { state } from 'memorio'` section, improved badges layout, enhanced "Why memorio?" comparison table
- `docs/markdown/STORE.md`: Added classic import note
- `docs/markdown/IMPORT.md`: New file for named export guide
- `docs/SUMMARY.md`: Updated to include `IMPORT.md`
- `README.md`: Badge corrections, header cleanup, removed unverified bundle size claims

### 🆕 GitHub Actions / Gitea Workflows

- Added `.gitea/workflows/npm.yml` for automatic npm package publishing to Gitea Packages on `v*` tags
- Requires `GITEA_USER` and `PAT` secrets

### 🧪 Tests

- **Result: 9 suites · 101 passed · 4 skipped · 1 todo**
- All lint and typecheck clean

---

## v3.0.2 (Current) - 2026-05-19 — Bug Fix, Security & API Expansion

### 🐛 Bug Fixes

- Removed dead code: `buildPathTracker` from `functions/state/index.ts` (unused Proxy builder, exported nowhere)
- Removed double `delete` in state `removeAll` handler (redundant null-check + delete on same key)
- Removed unbound `globalThis.state` reference in state init (would throw `ReferenceError` in strict mode)
- Removed `Object.freeze(observer)` referencing undeclared variable (`ReferenceError` on module load)
- Removed `confirm()` synchronous blocking call from `idb.db.delete` (library must not block main thread)

### 🔒 Security Improvements

- Removed `esbuild-sass-plugin` and `esbuild-scss-modules-plugin` from `devDependencies` (unnecessary for a library with no styles)
- Removed `injectStyle: true`, `sassPlugin()` and `.css` loader from `tsup.config.ts`
- Deleted `tsup.plugin.injectCss.ts` (code injection vector completely removed from build pipeline)
- `console.error`/`console.warn` → `console.debug` in `devtools` and `idb` error handlers (consistent debug-only logging policy)
- `store.set()` now blocks function values instead of silently logging and continuing
- All `PRIVATE License` headers in `functions/idb/` replaced with `MIT License`

### 🔧 Code Quality

- Added JSDoc to `observerFunction` in `functions/observer/index.ts`
- Added JSDoc to `cache` global in `functions/cache/index.ts`
- `lint` and `tsc` pass clean — 0 vulnerabilities from `npm audit`

### 🆕 API — New in 3.0.2

| Function | Description |
|----------|-------------|
| `memorio.isBrowser()` | Returns `true` when running in a browser |
| `memorio.isNode()` | Returns `true` when running in Node.js |
| `memorio.isDeno()` | Returns `true` when running in Deno |
| `memorio.isEdge()` | Returns `true` in Cloudflare Workers, Vercel Edge, etc. |
| `memorio.getCapabilities()` | Full capabilities object (`platform`, `hasLocalStorage`, `hasIndexedDB`, …) |
| `memorio.createContext(name?)` | Create multi-tenant isolated context |
| `memorio.listContexts()` | List all active isolated contexts |
| `memorio.deleteContext(id)` | Delete isolated context by ID |
| `memorio.isolate(name?)` | Shorthand alias for `createContext` |

### 🧪 Tests
- **Result: 8 suites · 95 passed · 3 skipped · 0 failed**

### 🗑️ Dependency Changes

| Removed | Reason |
|---------|--------|
| `esbuild-sass-plugin@3.7.0` | No SCSS in a library |
| `esbuild-scss-modules-plugin@1.1.1` | No SCSS in a library |
| 36 transitive packages | Removed from `node_modules` |

### 📝 Documentation Updates

- `docs/README.md`: replaced `console.debug` with `console.debug` in usage examples; fixed `esbuild` badge → `tsup`
- `.github/CHANGELOG.md`: restructured with fix / security / changed sections
- `.github/HISTORY.md`: complete rewrite through v3.0.2
- `.github/SECURITY.md`: NIST/NSA standard + OWASP Top 10 mapping
- `.github/CITATION.cff`: license PRIVATE → MIT to match `package.json`
- `.project/*`: all context documents updated to v3.0.2

---

## v2.9.0 — 2026-05-13

### Added
- DevTools — `memorio.devtools.inspect()`, `stats()`, `exportData()`
- Logger with full history, stats and export
- Platform detection (`isBrowser`, `isNode`, `isDeno`, `isEdge`, `getCapabilities`)
- Session isolation via `crypto.randomUUID()`

### Changed
- Updated dependencies to latest versions
- Improved cross-platform support (Deno, Edge Workers, Node.js)

### Security
- Secure random session IDs replaced `Math.random()`
- Key validation (max 512 chars + character whitelist)

---

## v2.5.0 — 2026-02-17

- Initial release of memorio (state, store, session, cache, idb)
- Observer pattern (`observer`)
- `useObserver` React hook