dsh-mask 0.2.11 → 0.2.12

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.12] - 2026-09-19
+
+### Changed
+
+- The release workflow now publishes through **npm trusted publishing** (OIDC) instead of the long-lived `NPM_TOKEN` secret: `setup-node` no longer sets `registry-url` (its empty `_authToken` line made the registry answer 404 on PUT), npm is upgraded to >= 11.5.1 before publishing, and the "NPM_TOKEN is not set -> skip" guard is gone so a missing publisher cannot turn a release into a silent no-op.
+
+- The two type rulers now measure two different universes: 	sconfig.check.json resolves `@deepseek-ai/*` through explicit paths into the deepseek-harness checkout's built types (guarded by `scripts/typecheck-checkout.mjs`, which reports `unverifiable` and exits 0 where no checkout exists), while `typecheck:ci` keeps measuring the published line from this repo's own `node_modules`. Before this, both configs resolved the same 
+ode_modules, so the second ruler was decorative.
+
 ## [0.2.11] - 2026-09-18
 
 ### Fixed

package/README-zh.md

@@ -148,7 +148,7 @@ profile patch 覆盖示例：
 
 ```sh
 pnpm install                                       # node ^22.19 || >=24
-pnpm run typecheck && pnpm run typecheck:ci        # 两把尺子：alpha.2 开发面 + 已发布线（清 paths）
+pnpm run typecheck && pnpm run typecheck:ci        # 两把尺子：checkout 面（带守卫，无 checkout 时不可验证）+ 已发布线面
 pnpm test                                          # node --test
 pnpm run verify:self-contained                     # 依赖 spec 均来自 registry
 pnpm run verify:artifacts                          # 发布文件齐全 + index.mjs 可 import

package/README.md

@@ -150,7 +150,7 @@ Example override in your profile patch:
 
 ```sh
 pnpm install                                       # node ^22.19 || >=24
-pnpm run typecheck && pnpm run typecheck:ci        # two rulers: alpha.2 dev face + published-line face (paths cleared)
+pnpm run typecheck && pnpm run typecheck:ci        # two rulers: checkout face (guarded; unverifiable without the checkout) + published-line face
 pnpm test                                          # node --test
 pnpm run verify:self-contained                     # dependency specs resolve from the registry
 pnpm run verify:artifacts                          # shipped files present + index.mjs importable

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-mask",
   "description": "PII masking middleware for DeepSeek Harness: regex-detect and replace phones, emails, ID cards, bank cards, keys, and (opt-in) IPs with placeholders before they reach the model, keep the restore table host-side (memory plus a controlled storage domain, never the session log) with the /mask restore command and the exported RestoreStore seam, and expose /mask status and the mask_test tool. Name and address recognition needs an external NER recognizer, which this pure-host form does not bundle: mode \"regex+ner\" and the person/address entities fail loudly at load. The phone and ID-card detectors match mainland-China formats only.",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/PerryLink/dsh-mask.git"
@@ -123,6 +123,7 @@
     "coverage": "node --test --experimental-test-coverage \"test/*.test.mjs\"",
     "lint": "oxlint",
     "verify:self-contained": "node scripts/verify-self-contained.mjs",
+    "check:lockfile": "node scripts/check-lockfile-drift.mjs",
     "verify:artifacts": "node scripts/verify-artifacts.mjs",
     "check:readmes": "node scripts/verify-readmes.mjs"
   },