pi-jscpd 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -7,6 +7,18 @@ published releases use [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-09-05
+
+### Changed
+
+- Simplified README installation guidance, kept detailed Effect internals in the
+  architecture guide, and added links to the maintainer's other Pi packages.
+
+### Security
+
+- Removed the one-time npm bootstrap credential path and repository secret after
+  the registry confirmed `0.1.0`; future releases use trusted publishing only.
+
 ## [0.1.0] - 2026-09-05
 
 ### Added
@@ -95,5 +107,6 @@ published releases use [Semantic Versioning](https://semver.org/).
 - Project paths, child output, reports, temporary directories, cancellation,
   configuration trust, and lifecycle cleanup are bounded and fail open.
 
-[Unreleased]: https://github.com/revazi/pi-jscpd/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/revazi/pi-jscpd/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/revazi/pi-jscpd/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/revazi/pi-jscpd/releases/tag/v0.1.0

package/README.md

@@ -18,20 +18,9 @@ languages, and statistics.
 pi install npm:pi-jscpd
 ```
 
-The package includes pinned jscpd `5.1.2` and Effect `3.22.1` runtime
-dependencies plus an on-demand `jscpd` agent skill—there is no separate analyzer
-installation and no runtime download.
-Effect owns bounded process execution, analyzer probing, temporary report
-workspaces, adapter serialization, trusted configuration and signal reads,
-canonical source-path validation, baseline generations, changed-file attribution,
-acknowledgement transactions, verification checkpoints, scoped scheduling,
-automatic finding delivery, scan/changed/status/Fallow application workflows,
-and one managed runtime/layer graph per extension instance. Legacy Promise/service
-paths are removed from those layers, and host-launched baseline work is settled at
-lifecycle boundaries. If your project already installs
-a compatible jscpd locally, or `jscpd`/`cpd` is available on `PATH`, the
-extension uses that installation first and keeps the bundled version as a
-fallback.
+`pi-jscpd` includes jscpd and its on-demand agent skill, so there is no
+separate analyzer setup or runtime download. It prefers a compatible project or
+`PATH` installation and otherwise uses its bundled analyzer.
 
 Start Pi in your project and verify the setup:
 
@@ -194,6 +183,16 @@ and limitations.
 See the [compatibility policy](docs/compatibility.md) for the exact tested
 fixtures and certification matrix.
 
+## More Pi packages by Revaz
+
+| Package | Purpose |
+| --- | --- |
+| [`pi-fallow`](https://www.npmjs.com/package/pi-fallow) | Fallow codebase intelligence for Pi |
+| [`pi-reads`](https://www.npmjs.com/package/pi-reads) | Source capture, cited reading, Obsidian, EPUB, PDF, and Kindle workflows |
+| [`pi-career`](https://www.npmjs.com/package/pi-career) | Deterministic resume and career workflows |
+| [`pi-tmux-orchestrator`](https://www.npmjs.com/package/pi-tmux-orchestrator) | Multi-agent coordination in tmux |
+| [`@tasklight/pi-tasklight`](https://www.npmjs.com/package/@tasklight/pi-tasklight) | Tasklight notifications for Pi |
+
 ## Development
 
 ```sh

package/docs/release.md

@@ -43,20 +43,18 @@ artifact, and cannot publish or create a GitHub release.
    lifecycle scripts disabled; and
 8. creates the matching GitHub release only after npm publication succeeds.
 
-Because npm cannot attach trusted-publisher settings before an unscoped package
-exists, the `v0.1.0` publish step alone may receive a short-lived granular
-`NPM_TOKEN` repository secret for first-publication bootstrap. Dependency
-installation and release validation do not receive it, and `npm publish` runs
-with lifecycle scripts disabled. Delete the secret and remove this fallback as
-soon as npm confirms `0.1.0`; all later releases must use OIDC only. Default
-GitHub permissions are empty; the release job receives only `contents: write`
-for the GitHub release and `id-token: write` for trusted publishing.
-
-Before later tags are pushed, the repository's protected `npm` environment and
-npm trusted-publisher binding must match the exact repository and
-`.github/workflows/release.yml`. Authentication details, token values, `.npmrc`
-files, screenshots, and credential output must never be committed or copied into
-issues or CI logs.
+The first publication used a short-lived granular token isolated to the
+lifecycle-disabled publish step because npm could not attach trusted-publisher
+settings before the unscoped package existed. That repository secret and
+workflow fallback were deleted immediately after npm confirmed `0.1.0`.
+
+All later releases must use OIDC only. Default GitHub permissions are empty; the
+release job receives only `contents: write` for the GitHub release and
+`id-token: write` for trusted publishing. Before another tag is pushed, the
+repository's protected `npm` environment and npm trusted-publisher binding must
+match the exact repository and `.github/workflows/release.yml`. Authentication
+details, token values, `.npmrc` files, screenshots, and credential output must
+never be committed or copied into issues or CI logs.
 
 ## Version and changelog procedure
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-jscpd",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "A Pi-native, polyglot duplication guardrail powered by jscpd.",
   "type": "module",
   "license": "MIT",