release: v1.0.11 - bump @cldmv/fix-headers to 2.1.4 and restamp file…

README.md

@@ -8,6 +8,23 @@
 
 **@cldmv/envm** is a modern, cross-platform environment variable manager for Node.js projects. Designed for both developers and automation, it lets you safely read, write, and manipulate environment variables on Windows and POSIX systems—without ever touching a class. With robust backup and restore features, a powerful CLI, and a clean, ESM-first API, `envm` makes managing your environment variables simple, safe, and scriptable. Whether you're tweaking your PATH, rolling back a bad change, or automating setup across platforms, `envm` gives you the control and confidence you need.
 
+## ✨ What's New
+
+### Latest: v1.0.11 (October 2026)
+
+- **Header tooling on fix-headers 2.2.0** — the `@cldmv/fix-headers` dev dependency moves to 2.2.0 and `@cldmv/configs` to 1.2.4, so `@Last modified by` now follows content edits only. Every file already matched, so nothing was restamped, and no library or CLI code changed (#34, #40).
+- **Complete version history** — every release from v1.0.2 onward now has a changelog under [docs/changelog/](https://github.com/CLDMV/envm/tree/master/docs/changelog/). v1.0.2 is the only version published to npm so far; v1.0.3 through v1.0.10 changed tooling, CI and documentation only, with no change to the library or CLI.
+- [View full v1.0.11 Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.11.md)
+
+### Recent Releases
+
+- **v1.0.10** (October 2026) — the CI `✅ Required PR Check` mirror job runs on every path instead of being skipped on in-repo PRs (#32) ([Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.10.md))
+- **v1.0.9** (October 2026) — a skipped PR run no longer satisfies the `✅ Required PR Check` ruleset (#30) ([Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.9.md))
+- **v1.0.8** (October 2026) — uniform file headers from the shared CLDMV config, the verbatim Apache-2.0 license text, a v4.29.2 workflow sync and vitest 5.0.2 (#19, #20, #22, #23, #24, #26, #27, #28) ([Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.8.md))
+- **v1.0.7** (September 2026) — vitest 5, signed redirected security PRs and grouped Dependabot updates (#18) ([Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.7.md))
+
+📚 **For complete version history, see [docs/changelog/](https://github.com/CLDMV/envm/tree/master/docs/changelog/) and the [GitHub Releases](https://github.com/CLDMV/envm/releases).**
+
 ## Features
 
 - **Cross-platform:** Works on Windows (registry) and POSIX (dotfiles, /etc/environment)

docs/changelog/v1/v1.0.10.md

@@ -0,0 +1,25 @@
+# @cldmv/envm v1.0.10 Changelog
+
+**Release Date**: October 2026
+**Release Type**: Patch
+**Availability**: GitHub Release only ([v1.0.10](https://github.com/CLDMV/envm/releases/tag/v1.0.10)); not published to npm
+
+---
+
+## Overview
+
+A CI-only release: the `✅ Required PR Check` mirror job now runs on every path instead of being skipped on in-repo feature PRs. No library or CLI code changed.
+
+---
+
+## 🔧 CI & tooling
+
+### Run the in-repo PR mirror job instead of skipping it ([#32](https://github.com/CLDMV/envm/pull/32))
+
+The fix in [v1.0.9](./v1.0.9.md) gave the mirror job a conditional name so a skipped run would not report under the required name, but GitHub does not evaluate the `name:` of a skipped job, so the skipped run showed up under the raw expression text. The job now always runs (`if: always()`), so its name is always evaluated: on the paths that own the status it reports as `✅ Required PR Check` and mirrors the test matrix's result, and on an in-repo feature PR's `pull_request` run it reports as `⏭️ Required PR Check (reported by the push run)` and exits as a no-op.
+
+---
+
+## Upgrade notes
+
+- No runtime changes.

docs/changelog/v1/v1.0.11.md

@@ -0,0 +1,31 @@
+# @cldmv/envm v1.0.11 Changelog
+
+**Release Date**: October 2026
+**Release Type**: Patch
+**Branch**: `release/1.0.11`
+
+---
+
+## Overview
+
+A dev-dependency release. `@cldmv/fix-headers` moves from 2.1.1 to 2.2.0, passing through 2.1.4, and the shared `@cldmv/configs` config moves from 1.2.0 to 1.2.4. Both header passes were re-run and every header already matched what the new versions write, so no file was restamped: the net change to the repository outside documentation is the two version ranges in `package.json` and the lockfile. No library or CLI code, published file or dependency used at runtime changed.
+
+---
+
+## 📚 Documentation
+
+- **NEW:** [docs/changelog/v1/v1.0.11.md](./v1.0.11.md) — this changelog, plus backfilled changelog files for every earlier release, [v1.0.2](./v1.0.2.md) through [v1.0.10](./v1.0.10.md).
+- **NEW:** README **✨ What's New** section.
+
+## 🔧 Dependencies
+
+Both are dev-only and affect only the `npm run fix:headers` script, which extends `@cldmv/configs/fix-headers.json`.
+
+- `@cldmv/fix-headers` `^2.1.1` → `^2.2.0`, in two steps. 2.1.4 ([#34](https://github.com/CLDMV/envm/pull/34)) stops the tool from writing comment headers into files that cannot carry one, such as strict JSON, and from walking `node_modules`. 2.2.0 ([#40](https://github.com/CLDMV/envm/pull/40)) makes `@Last modified by` follow edits to a file's content only, so a run that merely rewrites a header keeps the recorded editor.
+- `@cldmv/configs` `^1.2.0` → `^1.2.4` ([#40](https://github.com/CLDMV/envm/pull/40)). The shared fix-headers config now sets `forceAuthorUpdate` and `forceLastModifiedAuthorUpdate` to `false`, so `@Author` keeps the file's creator and `@Last modified by` changes only with real content edits. The 1.2.1 and 1.2.2 releases of that package only changed its own CI.
+
+---
+
+## Upgrade notes
+
+- No runtime changes — drop-in for v1.0.10.

docs/changelog/v1/v1.0.2.md

@@ -0,0 +1,61 @@
+# @cldmv/envm v1.0.2 Changelog
+
+**Release Date**: August 2025
+**Release Type**: Initial release
+
+---
+
+## Overview
+
+First release of `@cldmv/envm`, a cross-platform environment variable manager for Node.js. It is ESM-only and class-free: the API is a single `envManager` object of plain functions, and the package also ships an `envm` command-line tool. Windows is backed by the registry (via `reg`), POSIX by `~/.profile` and `/etc/environment`. This is the only version published to npm.
+
+On POSIX, reading a `user` or `system` scope value (`getRaw`, and therefore `getExpanded`, `path.get` and the verification step inside `set` / `unset`) is not implemented in this release and throws `Not implemented`; the `session` scope works everywhere, and the Windows adapter reads all three scopes.
+
+---
+
+## ✨ Features
+
+### Node.js API
+
+`import { envManager } from "@cldmv/envm"` exposes:
+
+- `envManager.getRaw(name, { scope })` and `envManager.getExpanded(name, { scope })` read a variable; expansion handles `%VAR%` on Windows and `$VAR` / `${VAR}` on POSIX.
+- `envManager.set(name, value, { scope, backup, verify, rollbackOnFail })` and `envManager.unset(name, { scope, backup, verify, rollbackOnFail })` write or remove a variable and resolve to a result object (`ok`, `scope`, `name`, `previous`, `next`, `verification`, `rollback`, `notes`).
+- `envManager.path.{get,prepend,append,remove,sort,unique}` manipulate PATH-like variables (default name `PATH`, delimiter `;` on Windows and `:` elsewhere, overridable with `delim`); `prepend` and `append` accept `unique` and `validate`.
+- `envManager.backup.{list,restore,setBackupDir,getBackupDir,purge}` manage backups.
+- `envManager.platform` (`"win"` or `"posix"`) and `envManager.delim` report the active adapter.
+
+### Scopes
+
+- `session`: the current process only (`process.env`).
+- `user`: `HKCU\Environment` on Windows, a managed `# envm-begin` / `# envm-end` block in `~/.profile` on POSIX.
+- `system`: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment` on Windows, `/etc/environment` on POSIX.
+
+### CLI
+
+The `envm` binary (`dist/cli.mjs`, also exported as `@cldmv/envm/cli`) supports:
+
+- `envm get`, `envm set`, `envm unset` with `--name`, `--value` and `--scope` (default `session`); `get` takes `--raw` or expanded output.
+- `envm path get|prepend|append|remove|sort|unique` with `--values` split on the platform delimiter, plus `--unique` and `--validate`.
+- `envm backup list` and `envm backup restore <id>`.
+- `--backup false` and `--verify false` to turn those safeguards off, `--dry-run` to preview `set` / `unset`, and `envm version` / `--version`.
+
+### Safety and backups
+
+- Writes to the `user` and `system` scopes create a timestamped backup first (`<scope>-<name>-<timestamp>.bak`) unless backups are disabled. Windows backups are a `reg export` of the environment key; POSIX backups are the previous contents of the target file.
+- After a write the value is read back for verification, and if verification fails and a backup exists the previous state is restored (`rollbackOnFail`, default true).
+- Backups live in `.backup/.envm-backups` under the project directory by default; `backup.setBackupDir()` overrides it.
+- `backup.purge({ maxPerScope = 20, maxAgeDays = 30 })` removes old backups, and the CLI purges on process exit and on `SIGINT` / `SIGTERM`.
+- Windows variable names are normalized to upper case, and PATH de-duplication can be case-insensitive.
+
+---
+
+## 🔧 CI & tooling
+
+- Build is esbuild minification of `src/` into `dist/` with `.mjs` output, run automatically by `prepublishOnly`; tests are written for vitest. The build and clean scripts use Windows `cmd` syntax in this release.
+
+---
+
+## Upgrade notes
+
+- Initial release; nothing to upgrade from.

docs/changelog/v1/v1.0.3.md

@@ -0,0 +1,35 @@
+# @cldmv/envm v1.0.3 Changelog
+
+**Release Date**: August 2026
+**Release Type**: Patch
+**Availability**: GitHub Release only ([v1.0.3](https://github.com/CLDMV/envm/releases/tag/v1.0.3)); not published to npm
+
+---
+
+## Overview
+
+A tooling release: the build now runs on any operating system, the dev toolchain is upgraded (esbuild 0.28, vitest 4), and the repository gains the CLDMV v4 CI/release workflows and a vitest runner. No runtime code under `src/` changed ([#5](https://github.com/CLDMV/envm/pull/5)).
+
+---
+
+## 🔧 CI & tooling
+
+- The `clean` and `build` scripts no longer use Windows-only `cmd` syntax (`rmdir /s /q`, `for %f in ... ren`). `clean` removes `dist/` with Node, and `build` is a single esbuild call that writes `dist/*.mjs` and `dist/platform/*.mjs` using `--out-extension:.js=.mjs --outbase=src`, so the package can be built on Linux and macOS as well as Windows. The emitted file layout is unchanged.
+- `test` now runs `node tests/run-vitest.mjs`, a wrapper around `@cldmv/vitest-runner` that runs each test file in its own process; new scripts are `test:watch`, `coverage`, `ci:coverage` and `build:ci`. Vitest settings live in `.configs/vitest.config.mjs`.
+- The v4 workflow set (CI, publish, release PR opener and reset, CodeQL, dependency review, Scorecard, CLA, labeler, stale, and related workflows) and `.github/dependabot.yml` are added, and `.github/` is no longer git-ignored.
+- One test assertion was corrected: `unique()` is case-sensitive unless told otherwise, so on POSIX `a` and `A` stay distinct (3 segments) and only collapse on Windows (2).
+
+## 🔧 Dependencies
+
+All changes are dev-only; `@cldmv/envm` still has no runtime dependencies.
+
+- `esbuild` `^0.19.0` to `^0.28.1` (dev-only).
+- `vitest` `^1.0.0` to `^4.1.10` (dev-only).
+- **NEW** `@vitest/coverage-v8` `^4.1.10` (dev-only).
+- **NEW** `@cldmv/vitest-runner` `^1.2.0` (dev-only).
+
+---
+
+## Upgrade notes
+
+- No runtime changes; the package's `main`, `exports` and `bin` are unchanged.

docs/changelog/v1/v1.0.4.md

@@ -0,0 +1,23 @@
+# @cldmv/envm v1.0.4 Changelog
+
+**Release Date**: August 2026
+**Release Type**: Patch
+**Availability**: GitHub Release only ([v1.0.4](https://github.com/CLDMV/envm/releases/tag/v1.0.4)); not published to npm
+
+---
+
+## Overview
+
+A test-layout release: the test file is renamed to follow the CLDMV `*.test.vitest.mjs` convention. No runtime code changed ([#7](https://github.com/CLDMV/envm/pull/7)).
+
+---
+
+## 🔧 CI & tooling
+
+- `tests/env-manager.test.mjs` is renamed to `tests/env-manager.test.vitest.mjs` (a pure rename, no content change). The vitest `include` glob in `.configs/vitest.config.mjs` and the `testFilePattern` in `tests/run-vitest.mjs` are updated to match.
+
+---
+
+## Upgrade notes
+
+- No runtime changes.

docs/changelog/v1/v1.0.5.md

@@ -0,0 +1,23 @@
+# @cldmv/envm v1.0.5 Changelog
+
+**Release Date**: August 2026
+**Release Type**: Patch
+**Availability**: Release commit on `master` only; not tagged and not published to npm
+
+---
+
+## Overview
+
+A CI-only release: the concurrency policy of `ci.yml` changes so release-relevant runs are no longer cancelled. No runtime code changed ([#9](https://github.com/CLDMV/envm/pull/9)).
+
+---
+
+## 🔧 CI & tooling
+
+- `ci.yml` derives the release base branch (the `CLDMV_RELEASE_BASE` variable, falling back to the repository's default branch) instead of hardcoding `master` / `main`. Pushes to the release base, to `next` and `hotfixes`, and `next` / `hotfixes` release PRs now each get a unique concurrency group per run, so a burst of release-time pushes no longer cancels a run and leaves a red cancelled check on the release PR. Feature branches still cancel superseded runs.
+
+---
+
+## Upgrade notes
+
+- No runtime changes.

docs/changelog/v1/v1.0.6.md

@@ -0,0 +1,28 @@
+# @cldmv/envm v1.0.6 Changelog
+
+**Release Date**: August 2026
+**Release Type**: Patch
+**Availability**: GitHub Release only ([v1.0.6](https://github.com/CLDMV/envm/releases/tag/v1.0.6)); not published to npm
+
+---
+
+## Overview
+
+A maintenance release: an esbuild patch bump and bot-identity secret mappings in three release workflows. No runtime code changed ([#11](https://github.com/CLDMV/envm/pull/11)).
+
+---
+
+## 🔧 CI & tooling
+
+- `feature-pr.yml`, `next-release.yml` and `hotfixes-release.yml` now pass `BOT_NAME` and `BOT_EMAIL` (from the `CLDMV_BOT_NAME` and `CLDMV_BOT_EMAIL` secrets) to the reusable workflows.
+
+## 🔧 Dependencies
+
+- `esbuild` 0.28.1 to 0.28.2, resolved in the lockfile within the existing `^0.28.1` range (dev-only).
+- `vitest` and `@vitest/coverage-v8` 4.1.10 to 4.1.11 in the lockfile (dev-only).
+
+---
+
+## Upgrade notes
+
+- No runtime changes.

docs/changelog/v1/v1.0.7.md

@@ -0,0 +1,30 @@
+# @cldmv/envm v1.0.7 Changelog
+
+**Release Date**: September 2026
+**Release Type**: Patch
+**Availability**: GitHub Release only ([v1.0.7](https://github.com/CLDMV/envm/releases/tag/v1.0.7)); not published to npm
+
+---
+
+## Overview
+
+A tooling release: vitest 5, the CLDMV bot's GPG secrets for redirected security PRs, and grouped Dependabot updates. No runtime code changed ([#18](https://github.com/CLDMV/envm/pull/18)).
+
+---
+
+## 🔧 CI & tooling
+
+- `hotfix-redirector.yml` now maps `CLDMV_BOT_NAME`, `CLDMV_BOT_EMAIL`, `CLDMV_BOT_GPG_PRIVATE_KEY` and `CLDMV_BOT_GPG_PASSPHRASE` so security PRs redirected to `hotfixes` are cherry-picked as signed commits.
+- `ci.yml` and `publish.yml` raise the Node test-matrix defaults: `min_node_version` from `22` to `22.12.0` (the floor vitest 5 runs on) and `max_node_major` from `22` to `26`.
+- `.github/dependabot.yml` adds `vitest`, `eslint` and `prettier` update groups so peer-locked packages are bumped together.
+
+## 🔧 Dependencies
+
+- `vitest` `^4.1.10` to `^5.0.0` (dev-only).
+- `@vitest/coverage-v8` `^4.1.10` to `^5.0.0` (dev-only).
+
+---
+
+## Upgrade notes
+
+- No runtime changes; the package declares no `engines` field, and that is unchanged.

docs/changelog/v1/v1.0.8.md

@@ -0,0 +1,38 @@
+# @cldmv/envm v1.0.8 Changelog
+
+**Release Date**: October 2026
+**Release Type**: Patch
+**Availability**: GitHub Release only ([v1.0.8](https://github.com/CLDMV/envm/releases/tag/v1.0.8)); not published to npm
+
+---
+
+## Overview
+
+A maintenance release with no change to the library or CLI. Every source, test, config and workflow file now carries the uniform CLDMV file header from the shared `@cldmv/configs` fix-headers config, the `LICENSE` file is restored to the verbatim Apache-2.0 text, the workflows are synced with the `CLDMV/.github` v4.29.2 templates, and the vitest toolchain moves to 5.0.2. The only edits under `src/` are the new header comments.
+
+---
+
+## 🔧 CI & tooling
+
+### Uniform file headers from the shared CLDMV config ([#26](https://github.com/CLDMV/envm/pull/26))
+
+A new `fix:headers` script runs `@cldmv/fix-headers` against `.configs/fix-headers.json`, which extends `@cldmv/configs/fix-headers.json`. The first run stamped every file under `src/` and `tests/`, `eslint.config.mjs`, `jest.config.mjs` and `.configs/vitest.config.mjs` with a header, and rewrote the workflow headers to the same layout, with ISO 8601 dates.
+
+### v4 workflow sync with CLDMV/.github v4.29.2 ([#23](https://github.com/CLDMV/envm/pull/23), [#24](https://github.com/CLDMV/envm/pull/24))
+
+The workflows are synced with the current templates, adding `bundle-size.yml`, `dependabot-recreate.yml`, `member-auto-merge.yml`, `pr-notify.yml`, `provenance.yml` and `release-merge.yml`, keeping the template's full `release-merge` workflow list, moving `master-commit-audit.yml` onto the reusable workflow, and correcting the template header metadata.
+
+## 📚 Documentation
+
+- `LICENSE` is restored to the verbatim Apache-2.0 text ([#22](https://github.com/CLDMV/envm/pull/22)): the Trademarks clause regains its "reasonable and customary use" wording. The license terms are unchanged.
+
+## 🔧 Dependencies
+
+- `vitest` 5.0.0 → 5.0.2 ([#19](https://github.com/CLDMV/envm/pull/19), [#27](https://github.com/CLDMV/envm/pull/27)) and `@vitest/coverage-v8` 5.0.0 → 5.0.2 ([#20](https://github.com/CLDMV/envm/pull/20), [#28](https://github.com/CLDMV/envm/pull/28)) — dev-only.
+- **NEW** dev dependencies: `@cldmv/configs` `^1.2.0` and `@cldmv/fix-headers` `^2.1.1`, for the header tooling ([#26](https://github.com/CLDMV/envm/pull/26)).
+
+---
+
+## Upgrade notes
+
+- No runtime changes.

docs/changelog/v1/v1.0.9.md

@@ -0,0 +1,25 @@
+# @cldmv/envm v1.0.9 Changelog
+
+**Release Date**: October 2026
+**Release Type**: Patch
+**Availability**: Tagged [`v1.0.9`](https://github.com/CLDMV/envm/tree/v1.0.9); no GitHub Release and not published to npm
+
+---
+
+## Overview
+
+A CI-only release: a skipped PR run can no longer satisfy the `✅ Required PR Check` ruleset. No library or CLI code changed.
+
+---
+
+## 🔧 CI & tooling
+
+### A skipped PR run no longer satisfies Required PR Check ([#30](https://github.com/CLDMV/envm/pull/30))
+
+On an in-repo feature PR, the `pull_request` run skips the `required-check` mirror job because the push run on the head branch owns the status. GitHub still posts a check run for a skipped job and treats a skipped required check as passing, so the skipped job, named `✅ Required PR Check`, could green-light the ruleset (and auto-merge) before the push run's real mirror existed. The job name is now an expression that evaluates to `✅ Required PR Check` only on the paths that own the status.
+
+---
+
+## Upgrade notes
+
+- No runtime changes.