fix: security and connection-lifecycle hardening

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default owner for everything in this repository.
+* @deniscuciuc

.github/workflows/ci.yml

@@ -1,28 +1,39 @@
 name: CI
 
 on:
+  # Every branch, not just main and develop: a feature branch previously ran no CI at all,
+  # so a push had to become a PR before anything was checked.
   push:
-    branches: [main, develop]
+    branches: ['**']
   pull_request:
-    branches: [main, develop]
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
 
 jobs:
   ci:
-    name: Lint & Build
+    name: Lint, build & test (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest
 
     strategy:
+      fail-fast: false
       matrix:
-        node-version: ["20", "22"]
+        # 20.6 is the floor (the dev scripts use --env-file); 24 is current.
+        node-version: ["20", "22", "24"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: pnpm/action-setup@v4
         with:
           version: 10
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node-version }}
           cache: "pnpm"
@@ -36,5 +47,9 @@ jobs:
       - name: Build
         run: pnpm build
 
+      - name: Test
+        run: pnpm test
+
       - name: Smoke test - help output
-        run: node dist/index.js --help
+        run: node dist/src/cli/main.js --help
+

.github/workflows/publish.yml

@@ -5,52 +5,84 @@ on:
     tags:
       - "v*"
 
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   publish:
     name: Publish to npm & create GitHub Release
     runs-on: ubuntu-latest
+    # Publishing a version to npm is irreversible. Configure the `npm` environment with a
+    # required reviewer in repository settings to gate it.
+    environment: npm
+    permissions:
+      contents: write # Create the GitHub release
+      id-token: write # npm provenance
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - uses: pnpm/action-setup@v4
         with:
           version: 10
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
-          node-version: "20"
+          node-version: "22"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
 
+      - name: Extract version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Verify the tag matches package.json
+        env:
+          TAG_VERSION: ${{ steps.version.outputs.VERSION }}
+        run: |
+          PKG_VERSION="$(node -p "require('./package.json').version")"
+          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::Tag v$TAG_VERSION does not match package.json version $PKG_VERSION"
+            exit 1
+          fi
+          echo "Version $PKG_VERSION matches the tag."
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Lint
+        run: pnpm lint
+
       - name: Build
         run: pnpm build
 
-      - name: Publish to npm
-        run: pnpm publish --access public --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Extract version from tag
-        id: version
-        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+      - name: Test
+        run: pnpm test
 
       - name: Extract CHANGELOG section for this version
+        env:
+          TAG_VERSION: ${{ steps.version.outputs.VERSION }}
         run: |
-          VERSION="${{ steps.version.outputs.VERSION }}"
-          NOTES=$(awk "/^## \[$VERSION\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md)
-          if [ -z "$NOTES" ]; then
-            NOTES="See [CHANGELOG.md](./CHANGELOG.md) for details."
+          # awk reads the version from the environment rather than interpolating it into the
+          # script, so the tag name is never treated as code.
+          awk -v v="$TAG_VERSION" '
+            $0 ~ "^## \\[" v "\\]" { found = 1; next }
+            found && /^## \[/ { exit }
+            found { print }
+          ' CHANGELOG.md > /tmp/release-notes.md
+          if [ ! -s /tmp/release-notes.md ]; then
+            echo "::error::No CHANGELOG.md section for $TAG_VERSION"
+            exit 1
           fi
-          echo "$NOTES" > /tmp/release-notes.md
+          cat /tmp/release-notes.md
+
+      - name: Publish to npm
+        # --provenance publishes a signed attestation linking the tarball to this workflow
+        # run, which needs the id-token permission above.
+        run: pnpm publish --access public --provenance --no-git-checks
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2

CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-09-10
+
+### Added
+
+- A programmatic API. `PostgresAnalyzer` is exported from the package root, alongside the
+  analyzers, collectors, reporters and every report type. Importing the package now has
+  no side effects — previously `require("@deniscuciuc/pg-analyzer")` connected to the
+  database and ran an analysis, because the CLI was the package entry point and
+  `main`/`types` pointed at it. The CLI moved to `src/cli/main.ts` and is still reached
+  through the `pg-analyzer` binary.
+- A test suite. `pnpm test` runs it, and CI runs it on Node 20, 22 and 24.
+- `SECURITY.md` and `CODE_OF_CONDUCT.md`.
+
+### Fixed
+
+- `--watch -1` was mistaken for a flag and silently replaced by the default interval
+  instead of being rejected.
+- Numeric flags were parsed with no validation, so `--port abc` produced `NaN` and
+  surfaced as a confusing driver error far from the actual mistake. Each flag now reports
+  its own name.
+- A flag at the end of the argument list stored `undefined` rather than failing.
+- An unknown flag was silently ignored, so a typo like `--jsno` produced human-readable
+  output instead of JSON.
+- The connection is no longer torn down by an unhandled `error` event: with no listener
+  attached, an idle-connection failure terminated the process, which was near-certain in
+  `--watch` mode.
+- Ctrl+C during a query did nothing, and a second Ctrl+C did nothing either, so the CLI
+  appeared to hang. A second signal now exits, and `SIGTERM` is handled so `docker stop`
+  reaches the connection cleanup.
+- `process.exitCode` is set instead of calling `process.exit`, which could truncate
+  buffered output when piping `--json` to a file.
+
+### Changed
+
+- The npm tarball no longer contains the compiled tests.
+- Stricter TypeScript (`noUncheckedIndexedAccess` and friends) and Biome rules; unused
+  variables and imports are errors rather than warnings.
+- CI runs on every branch, not just `main` and `develop`, and cancels superseded runs.
+- Publishing now emits npm provenance and verifies the tag matches `package.json`.
+
 ## [1.0.0] - 2026-06-13
 
 ### Added

CODE_OF_CONDUCT.md

@@ -0,0 +1,113 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best for the overall community
+
+Examples of unacceptable behavior:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Project maintainers are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Project maintainers have the right and responsibility to remove, edit, or reject
+comments, commits, code, issues, and other contributions that are not aligned to
+this Code of Conduct, and will communicate reasons for moderation decisions when
+appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the project maintainers at denis.cuciuc@zelqonworks.com. All
+complaints will be reviewed and investigated promptly and fairly.
+
+All project maintainers are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Project maintainers will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from project maintainers, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved for a specified period of time. Violating
+these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. Violating
+these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/inclusion).
+
+[homepage]: https://www.contributor-covenant.org

CONTRIBUTING.md

@@ -37,7 +37,7 @@ pnpm lint:fix
 
 ## Coding standards
 
-- TypeScript strict mode - no `any`
+- TypeScript strict mode, with `noUncheckedIndexedAccess` — and no `any`, which Biome enforces
 - Biome formatting (tab indent, enforced by CI)
 - No new runtime dependencies without discussion in an issue first