@githonllc/avouch 0.1.1 → 0.1.3

package/README.md

@@ -129,10 +129,12 @@ claude plugin install avouch@avouch
 Inside a Claude Code session, the same two steps are `/plugin marketplace add githonllc/avouch` and `/plugin install avouch@avouch`.
 
 The plugin has two skills:
-- `avouch-cli`: checks an ontology and runs `avouch query`.
-- `aquery-scan` (also `/aquery-scan [project-dir]`): drafts or updates a project's ontology from its design documents. The result is a candidate. `avouch check` must exit 0, and each source gap is listed with a proposed fix to the document.
+- `cli` (`/avouch:cli`): checks an ontology and runs `avouch query`.
+- `scan` (`/avouch:scan [project-dir]`): drafts or updates a project's ontology from its design documents. The result is a candidate. `avouch check` must exit 0, and each source gap is listed with a proposed fix to the document.
 
-The skills run the CLI with `npx -y @githonllc/avouch@<version>`, pinned to the version of this repository. Set `AVOUCH_CLI` to a built `dist/cli/avouch.js` to use a local build instead. The `prepare` script builds `dist/` when npm installs the package from git (`npx -y github:githonllc/avouch`). `skills/aquery-scan/fixture/` is the test project for the skill.
+Before 0.1.3 the two skills were named `avouch-cli` and `aquery-scan`.
+
+The skills run the CLI with `npx -y @githonllc/avouch@<version>`, pinned to the version of this repository. Set `AVOUCH_CLI` to a built `dist/cli/avouch.js` to use a local build instead. The `prepare` script builds `dist/` when npm installs the package from git (`npx -y github:githonllc/avouch`). `skills/scan/fixture/` is the test project for the skill.
 
 ## Publishing
 
@@ -149,6 +151,10 @@ A release needs the explicit approval of the project owner. Releases are publish
 
 Version 0.1.0 was published by hand, because npm accepts a trusted publisher only for a package that exists.
 
+CI and the release workflow run `scripts/scan-private.mjs`. It scans the path and text of each tracked file, and the commit messages of a pull request, for private content: local paths, tokens, private keys, and the patterns in the repository secret `PRIVATE_PATTERNS`. A hit shows only the file and line (or commit) and a pattern label, never the text. Pull requests from forks do not get the secret, so they run with the built-in patterns only. Pushes to `main`, pull requests from this repository and releases fail if the secret is missing.
+
+The secret is generated from a list kept in a private repository; maintainers never edit it by hand. After the list changes, a maintainer runs the generator, which prints a pattern count and a sha256 fingerprint, and re-sets the secret with `gh secret set PRIVATE_PATTERNS`. The scan prints `PRIVATE_PATTERNS: <n> patterns, sha256 <12 hex>` for the patterns it loaded (comment lines dropped, pattern lines joined by `\n`); the next CI run on `main` must show the same count and fingerprint as the generator.
+
 ## Versions and identifiers
 
 The ontology file has `formatVersion: 1`. The schema `$id` is `https://w3id.org/avouch/v1/schema.json`. The version rules are in SPEC section 8.

package/dist/src/index.d.ts

@@ -6,3 +6,4 @@ export * from "./reconcile.js";
 export * from "./patch.js";
 export * from "./query.js";
 export * from "./markdown.js";
+export * from "./unknown.js";

package/dist/src/index.js

@@ -6,3 +6,4 @@ export * from "./reconcile.js";
 export * from "./patch.js";
 export * from "./query.js";
 export * from "./markdown.js";
+export * from "./unknown.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githonllc/avouch",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",