[mangelsnc]

Summary

Last release of the v2.x line. Cut criterion: data compatibility — every change preserves existing keypairs and .enc files.

Fixed

• keysExists() operator bug (|| → &&): half-broken keypairs no longer reach encrypt/decrypt.
• Argument validation in set / get / delete: usage hints instead of Cannot read properties of undefined.
• mkdirSync made recursive in both handleInit and generateKeyPair.
• RSA padding pinned to OAEP-SHA1 explicitly (matches Node's historical default; protects against a future default change silently breaking existing secrets). SHA-256 is reserved for v3.0.0 where the on-disk format changes anyway.
• Private key written with 0o600 on generation.
• process.env.PWD → process.cwd() across the codebase (Windows + non-shell invocation portability).

Added

• init now appends .env to the project root .gitignore via a new ensureGitignoreEntry helper.
• .github/workflows/ci.yml: lint / build / test on every PR (Node 16, matching the v2.x baseline).
• .github/workflows/release.yml: on push to main, reads package.json version, exits idempotently if v<version> already exists, otherwise tags, creates a GitHub Release (notes extracted from CHANGELOG.md), and npm publishes. Third-party softprops/action-gh-release pinned to commit SHA 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2).

Removed

• .github/workflows/npm-publish.yml (replaced by release.yml).

Changed

• CHANGELOG.md: new ## [2.3.0] - 2026-06-15 entry.
• package.json / package-lock.json: version bumped to 2.3.0 (lockfile previously had a stale 1.3.0, now correct).
• style: apply prettier formatting over the rest of src/ to keep the lint check green in the new CI workflow.