UDIOT compatibility and support

This document is included in the public npm archive so consumers do not need access to the private source repository to read the core compatibility guidance. Stable 1.0 has not shipped. Candidate metadata or an RC publication does not establish stable support, certify every exported feature or approve production use.

API status

No new stable surface is approved yet. Existing deprecated APIs remain deprecated. Pin and test upgrades that use experimental APIs; they may change in minor releases. For APIs eventually approved as stable, the proposed policy preserves documented types and runtime behavior in patches/minors, announces deprecations and requires migration guidance and a major release for removals.

Upgrading and evaluating an RC

• Use Node >=22.17.0 and npm >=9. Validate your application's independent lockfile and run its own audit, typecheck, tests and production build.
• Ordinary npm install @tagna/udiot selects npm latest. An RC is published separately to next only after approval. For a pilot, install the exact approved RC with npm install --save-exact @tagna/udiot@1.0.0-rc.1; retain its registry integrity and application lockfile. Do not substitute a moving next tag for an exact pilot record.
• A release candidate is not a completed pilot. Obtain application-owner approval for the environment, workload, soak interval and rollback rehearsal before testing; production rollout is a separate decision.
• Shared rate-limit stores must implement atomic increment(key, windowMs). Separate read/write calls do not provide the required concurrency guarantees.
• Tenant selection is not authorization. Authenticate callers first; verified claims take precedence. Unresolved production tenants must not share a DB.
• Credentialed/query-bearing requests and private, cookie-setting or varied responses bypass shared caching. Keep tenant and host variants separate.
• Filesystem escape checks are not an OS sandbox for arbitrary executable code. Isolate untrusted commands outside the framework process.
• Optional bundler peers require esbuild ^0.28.1 or Vite ^6.4.3 / ^7.3.5 / ^8.0.16. Audit the complete graph of the adapters you actually install.
• Validate declarations with skipLibCheck: false. The shipped Supabase SDK has a narrowly scoped WebAuthn declaration compatibility patch and its own bundled notice. It does not modify a consumer's separately installed SDK. ESNext declaration libraries do not polyfill Temporal at runtime.
• The candidate's SSG builder accepts an application-owned registry implementing SSGPageRegistry (getAllPages and matchRoute). It no longer requires the private identity of the internal registry class. SSG remains experimental.

Security and support ownership

Read SECURITY.md before reporting a vulnerability. Do not disclose exploit details, credentials or customer data through public issues.

The sole project owner and security/support maintainer is @primeindian, confirmed on 2026-09-13. The owner designated harish@tagna.in on 2026-09-20 for private security reports from public npm users. Repository access is not required. Send only a minimal redacted report as described in SECURITY.md. A nonsensitive external delivery/receipt check still needs to be recorded before stable 1.0; no email was sent by the documentation update.

The supported-version window, backports, triage/patch commitments and response times are not yet approved. No SLA or guaranteed support duration is promised by this candidate. Clean automated audits are useful evidence, not proof that all vulnerabilities have been found.

Public package contents

The package remains publicly installable. It contains runnable minified JavaScript, TypeScript declarations, CLI templates, upstream dependencies/notices and consumer documentation. Framework implementation TypeScript and source maps are excluded. Anything distributed in a public npm archive can be downloaded and inspected; minification does not make JavaScript confidential.

See the documentation index for usage and LICENSE for license terms.