@dszp/csl-screen 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/README.md +2 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,18 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [0.1.1] — 2026-10-18
|
|
11
|
+
|
|
12
|
+
The library's code and API are unchanged from 0.1.0.
|
|
13
|
+
|
|
14
|
+
### Changed
|
|
15
|
+
|
|
16
|
+
- Releases are published from GitHub Actions through npm trusted publishing, so each version from
|
|
17
|
+
0.1.1 on carries a provenance statement linking it to the commit and workflow that built it.
|
|
18
|
+
- Tests cover the content hash for an added entry, a removed entry, and an empty list.
|
|
19
|
+
- The README links [dszp/csl-history](https://github.com/dszp/csl-history), a public history of the
|
|
20
|
+
list that a run's `contentSha256` or `sha256` can be looked up in.
|
|
21
|
+
|
|
10
22
|
## [0.1.0] — 2026-10-17
|
|
11
23
|
|
|
12
24
|
First release.
|
package/README.md
CHANGED
|
@@ -108,6 +108,8 @@ The report header lists the parties in the run, how many were screened, and how
|
|
|
108
108
|
|
|
109
109
|
A snapshot carries two hashes. `sha256` covers the downloaded bytes, so it changes whenever the file is republished, including when only `search_performed_at` or a list's `last_imported` moved. `contentSha256` covers the entries alone: it hashes each entry's `key` and `fingerprint`, sorted by key, so it changes only when an entry is added, removed or edited. Compare `contentSha256` to decide whether the list changed. `contentHashOf(entries)` computes the same value from any array of `{ key, fingerprint }`.
|
|
110
110
|
|
|
111
|
+
trade.gov publishes only the current list. [dszp/csl-history](https://github.com/dszp/csl-history) keeps a public history of it: one commit per content change, and each month's raw download as a release asset. To prove which list a run screened against, find its `contentSha256` in that history. Its `sha256` matches a release asset only when the run used that month's archived download.
|
|
112
|
+
|
|
111
113
|
## Development
|
|
112
114
|
|
|
113
115
|
```sh
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@dszp/csl-screen",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.1",
|
|
4
4
|
"description": "Restricted-party screening against the US Consolidated Screening List: name normalisation, fuzzy matching and reviewable decisions. Zero runtime dependencies; runs in Node and Cloudflare Workers.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|