Correctness, security and packaging overhaul — release 0.4.0

[mt3o]

Seven commits of correctness, security and packaging work, released as 0.4.0. Full detail in CHANGELOG.md; this is the summary.

Security

• Prototype pollution fixed. A layer could write to Object.prototype via __proto__ or constructor.prototype — reachable in practice, since a layer parsed from JSON carries __proto__ as a real own property that hasOwnProperty does not filter out.

Breaking

• A missing key now warns (once per config) and resolves to undefined instead of throwing.
• cfg['a.b'] and cfg.a.b were separate resolvers that disagreed — inverted layer precedence, one-level-deep merging, arrays returned as {"0":"a"}, array merge strategies invisible. They are now one resolver.
• Key paths match own properties only, so cfg['constructor.name'] and friends no longer resolve.
• The config deep-copies everything it exposes, so mutating a layer afterwards no longer changes what it resolves, and freeze: true no longer freezes objects you still hold.
• Protocol lookups (toJSON, toString, unknown symbols, $$/@@ sentinels) resolve to undefined instead of throwing.
• UMD global renamed Config Layers → ConfigLayers; types corrected to dist/index.d.ts.

Notable fixes

• The library crashed on iOS 15 / Safari 15. Key splitting used a regex lookbehind, unsupported below Safari 16.4; the bundler silently rewrites it to new RegExp("…"), which parses and then throws on the first key lookup. The splitter is now hand-written and the bundle contains no regexes at all.
• Merging destroyed Date, Buffer and class instances, and threw when a layer overrode a scalar with an object.
• __derive dropped symbol-named layers and reordered numeric-looking ones, inverting precedence.
• String(config), JSON.stringify(config), config.name and Object.getOwnPropertyDescriptor all misbehaved or threw.

Performance

Measured against 0.2.1, both in one process:

operation	0.2.1	0.4.0
config['a.b.c.d']	1174 ns	154 ns	7.6× faster
config('a.b.c.d')	1144 ns	129 ns	8.9× faster
config.flat	164 ns	49 ns	3.4× faster
fromLayers(...)	3120 ns	6392 ns	2× slower

Construction pays for the deep copy that makes the ownership guarantees real — microseconds, once at startup. Read paths are guarded against regressing by tests/performance.test.ts.

Tooling

• Tests: 78 (2 failing) → 290 passing, 18 files, with coverage thresholds.
• ESLint added; CI on every push and PR across Node 20/22/24; release workflow publishes the version named by the tag.
• Minified builds: CJS 13.0 → 7.3 kB, UMD 14.2 → 7.5 kB. sideEffects: false added.

Why 0.4.0 and not 0.3.0

config-layers@0.3.0 is already on npm (published 2026-04-21) from a separate line of work not in this history, and npm does not allow republishing a version. The changelog records the gap.

Releasing

After merge, tag from main — that fires release.yml, which verifies, builds, packs, creates the GitHub Release and publishes to npm with provenance:

git checkout main && git pull
git tag v0.4.0 && git push origin v0.4.0

Requires NPM_TOKEN in Actions secrets; without it the workflow completes but skips publishing with a notice rather than failing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EKcR1Xs7sAKKYYgn5vs69q