From 040d10b7aa3516562b4447f8a5372a14979c6cec Mon Sep 17 00:00:00 2001 From: sup2ak Date: Sat, 25 Apr 2026 12:18:59 +0200 Subject: [PATCH 1/5] fix(dev): remove MATCHIGO_DEV env var, rely on NODE_ENV only MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Custom env var access was flagged by socket.dev supply chain scanner. NODE_ENV is the standard way to detect production; the custom var added no meaningful control that NODE_ENV doesn't already provide. Closes socket.dev alert: Environment variables — dist/dev.js --- src/dev.ts | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/src/dev.ts b/src/dev.ts index 044ae24..3934977 100644 --- a/src/dev.ts +++ b/src/dev.ts @@ -1,9 +1,8 @@ // Dev-only cold-path instrumentation. // Resolution policy (evaluated ONCE at module load → zero runtime cost): // -// 1. MATCHIGO_DEV env var wins — accepts "0"|"false" (off) or "1"|"true" (on). -// 2. Else NODE_ENV — matches "production", "prod" (case-insensitive) → off. -// 3. Else default → on (verbose dev). +// 1. NODE_ENV — matches "production", "prod" (case-insensitive) → off. +// 2. Else default → on (verbose dev). // // Programmatic override: silenceWarnings() at startup mutes everything. // No NODE_ENV at all? Dev mode is ON. The counters still cost only a few `++` @@ -12,9 +11,6 @@ const DEV: boolean = (() => { try { if (typeof process === "undefined" || !process?.env) return true; - const explicit = process.env.MATCHIGO_DEV; - if (explicit === "0" || explicit === "false") return false; - if (explicit === "1" || explicit === "true") return true; const node = (process.env.NODE_ENV ?? "").toLowerCase(); if (node === "production" || node === "prod") return false; return true; @@ -48,7 +44,7 @@ export function trackMatch(cacheHit: boolean): void { ` • Or compile once with compile():\n` + ` const dispatch = compile([...]);\n` + ` dispatch(value);\n` + - ` Silence: silenceWarnings() — or set MATCHIGO_DEV=0.`, + ` Silence: silenceWarnings() — or set NODE_ENV=production.`, ); warnedMatch = true; } @@ -65,7 +61,7 @@ export function trackMatcher(): void { ` .with(...)\n` + ` .otherwise(...); // builds + compiles once\n` + ` classify(value); // reused hot path\n` + - ` Silence: silenceWarnings() — or set MATCHIGO_DEV=0.`, + ` Silence: silenceWarnings() — or set NODE_ENV=production.`, ); warnedMatcher = true; } From 1dac3ab88b942c5908e6247ce78c0632670bf63f Mon Sep 17 00:00:00 2001 From: sup2ak Date: Sat, 25 Apr 2026 12:19:04 +0200 Subject: [PATCH 2/5] fix(p): replace http-verb example string in union JSDoc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The string "http-verb" starts with "http" and was triggering socket.dev's URL-strings supply chain alert (false positive). Replace with "method", which conveys the same intent without the false URL pattern. Closes socket.dev alert: URL strings — Package overview --- src/p.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/p.ts b/src/p.ts index eb24c6b..7b51750 100644 --- a/src/p.ts +++ b/src/p.ts @@ -236,7 +236,7 @@ export const P = { * * @example * ```ts - * { with: P.union("GET", "POST", "PUT"), then: () => "http-verb" } + * { with: P.union("GET", "POST", "PUT"), then: () => "method" } * ``` */ union: (...values: Values): PUnion => ({ From c57bede4eb831672d1a68ccf8f1931c8ad70530d Mon Sep 17 00:00:00 2001 From: sup2ak Date: Sat, 25 Apr 2026 12:20:54 +0200 Subject: [PATCH 3/5] docs(readme): remove MATCHIGO_DEV references, document NODE_ENV only The MATCHIGO_DEV env var was removed in the previous fix(dev) commit. Update both EN and FR READMEs to reflect that NODE_ENV is the sole mechanism for controlling dev warnings. --- README.fr.md | 2 +- README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.fr.md b/README.fr.md index cd51ed1..bfcdce1 100644 --- a/README.fr.md +++ b/README.fr.md @@ -345,7 +345,7 @@ matchigo émet un `console.warn` **une seule fois** quand il détecte un mésusa - Reconstruire `rules` à chaque appel de `match(value, rules)` (l'anti-pattern « cold-path inline »). - Créer des milliers d'instances distinctes de `matcher()` (typiquement, le builder est dans une boucle chaude). -Les avertissements sont pilotés par `NODE_ENV` (`production`/`prod` les désactive) ou par l'override explicite `MATCHIGO_DEV=0` / `MATCHIGO_DEV=1`. La vérification se fait une fois au chargement du module, donc **production a un coût nul** — pas de lecture d'env, pas de compteur, pas de formatage de string. +Les avertissements sont pilotés par `NODE_ENV` (`production`/`prod` les désactive). La vérification se fait une fois au chargement du module, donc **production a un coût nul** — pas de lecture d'env, pas de compteur, pas de formatage de string. ```ts import { silenceWarnings } from "matchigo"; diff --git a/README.md b/README.md index a997aee..63b7b1e 100644 --- a/README.md +++ b/README.md @@ -399,7 +399,7 @@ matchigo emits a `console.warn` **once** when it detects misuse that defeats cac - Reconstructing `rules` on every `match(value, rules)` call (the "cold-path inline" anti-pattern). - Creating thousands of distinct `matcher()` instances (usually means the builder is inside a hot loop). -Warnings are controlled by `NODE_ENV` (`production`/`prod` disables them) or the explicit `MATCHIGO_DEV=0` / `MATCHIGO_DEV=1` override. The check happens once at module load, so **production has zero cost** — no env reads, no counters, no string formatting. +Warnings are controlled by `NODE_ENV` (`production`/`prod` disables them). The check happens once at module load, so **production has zero cost** — no env reads, no counters, no string formatting. ```ts import { silenceWarnings } from "matchigo"; From 18eab8ce4f8d76e7c09ea5f49476b1c822144a0b Mon Sep 17 00:00:00 2001 From: sup2ak Date: Sat, 25 Apr 2026 12:26:49 +0200 Subject: [PATCH 4/5] chore(npm): expand keywords for better npm discoverability Add terms that reflect the actual architecture (compile, dispatch, rule-engine, data-driven) and common search intents (switch, discriminated-union, narrowing, zero-dependency, bun, node). --- package.json | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index f54a9c2..74111f0 100644 --- a/package.json +++ b/package.json @@ -5,10 +5,22 @@ "keywords": [ "pattern-matching", "match", - "rust", + "dispatch", + "compile", + "rule-engine", + "rules", "typescript", + "type-safe", "exhaustive", - "fast" + "narrowing", + "discriminated-union", + "switch", + "data-driven", + "fast", + "zero-dependency", + "rust-like", + "bun", + "node" ], "license": "MIT", "author": "SUP2Ak", From 18cddc98613ec0a9d99cc8df12abcab29e9801fc Mon Sep 17 00:00:00 2001 From: sup2ak Date: Sat, 25 Apr 2026 12:31:26 +0200 Subject: [PATCH 5/5] chore(npm): slim down published package Remove src/, FAQ, and CONTRIBUTING files from npm bundle. End-users only need dist/ + READMEs + LICENSE. Everything else is for contributors and lives on GitHub. --- package.json | 5 ----- 1 file changed, 5 deletions(-) diff --git a/package.json b/package.json index 74111f0..a251b57 100644 --- a/package.json +++ b/package.json @@ -36,13 +36,8 @@ }, "files": [ "dist", - "src", "README.md", "README.fr.md", - "FAQ.md", - "FAQ.fr.md", - "CONTRIBUTING.md", - "CONTRIBUTING.fr.md", "LICENSE" ], "sideEffects": false,