chore(deps): bump @cosyte/ncpdp from 0.0.8 to 0.0.12

[dependabot]

Bumps @cosyte/ncpdp from 0.0.8 to 0.0.12.

Release notes

Sourced from @​cosyte/ncpdp's releases.

v0.0.12

What changed

• An all-mode PHI sweep now reconciles the files it actually opened against git ls-files and refuses when a tracked in-scope file went unread, so an emptied scan root can no longer read as clean on that route.
• CHANGELOG.md is now written by the release rather than by hand, so the copy inside every published tarball stops describing already-shipped code as something still to come.
• The README lockup now links to cosyte.com (ASSETS).

Full detail for each change is in CHANGELOG.md.

Install

npm install @cosyte/ncpdp@0.0.12

npm: https://www.npmjs.com/package/@​cosyte/ncpdp/v/0.0.12

v0.0.11

What changed

Internal tooling and CI only. No change to the published package surface.

Install

npm install @cosyte/ncpdp@0.0.11

npm: https://www.npmjs.com/package/@​cosyte/ncpdp/v/0.0.11

v0.0.10

What changed

• Internal CI and repo tooling only.

Full detail for each change is in CHANGELOG.md.

Install

npm install @cosyte/ncpdp@0.0.10

npm: https://www.npmjs.com/package/@​cosyte/ncpdp/v/0.0.10

v0.0.9

What changed

• Test-only: the sanity suite now pins the exported VERSION to package.json, so a release that skipped scripts/sync-version.mjs goes red instead of publishing a constant that lies.

... (truncated)

Changelog

Sourced from @​cosyte/ncpdp's changelog.

0.0.12

Patch Changes

• b041427: An all-mode PHI sweep now reconciles the files it actually opened against git ls-files and refuses when a tracked in-scope file went unread, so an emptied scan root can no longer read as clean on that route. Internal repo tooling only: no published API, type, warning code or parse-result change.

  The root check shipped previously certifies that each declared scan root EXISTS and is ENUMERABLE. It never certified that anything was OBSERVED under one, and no version of it could: an empty directory enumerates perfectly. Measured in a clone at 16c2fea with that check in place, emptying src/ (51 tracked files, the directory left in place) printed OK: no hits (71 file(s) scanned) and exited 0; deleting src/telecom/ alone printed OK: no hits (105 file(s) scanned) exit 0 with 17 unopened; the healthy control printed 122.

  A denominator cannot detect either shape, which is the second time that has had to be recorded here: 71 next to a healthy 122 is not a number anything about the report makes look wrong, because a count counts the files that WERE found. The sweep now refuses (exit 2) naming every tracked in-scope file it did not open. The expected set comes from the index, never from the walk, because anything re-derived from the walk would agree with the walk forever.

  Fails closed when git cannot say what is tracked (pre-fix that case printed OK: no hits and exited 0; no denominator is quoted, because with .git gone git check-ignore cannot answer either and the count moves with whatever ignored files happen to be on disk). --staged and paths mode are deliberately not reconciled, since neither claims to have covered the tree. Exit codes were derived in this repo rather than ported from a sibling.

• df05854: CHANGELOG.md is now written by the release rather than by hand, so the copy inside every published tarball stops describing already-shipped code as something still to come.

  The file is listed in package.json#files, so it ships with the package. For the whole of this package's published history .changeset/config.json set "changelog": false, which meant no release ever wrote a version heading into it and nothing ever rolled its single hand-maintained [Unreleased] heading over. Its preamble went on describing the first pre-alpha release in the future tense, as a thing still to come, inside tarballs that had already carried the API surface it named for several versions.

  The mechanism changed rather than the sentence: changelog now names the default Changesets generator, so each release writes its own version heading and the changeset summary becomes the entry a reader sees. Correcting the preamble by hand would have left in place the mechanism that wrote it, to write it again on the next release.

  The hand-written history is preserved verbatim, moved under a new Released before this file was generated heading with generated sections above it. No entry was reworded, re-ordered, re-wrapped or re-sorted: the archived text is byte identical to what the repository already held. What was dropped was scaffolding for the workflow that no longer runs, together with the preamble it belonged to: the [Unreleased] heading, its link definition at the foot of the file, three empty section stubs, and the future-tense paragraph itself.

  The release's Prettier pass is left on, which is derived from this package having no .prettierignore and a format check that covers root markdown: with it off, generated output would fail that check on a file nobody edited.

  No runtime code, public API, type, warning code or parse result changed.

• 2978d94: The README lockup now links to cosyte.com (ASSETS).

  The <picture> block above the H1 is wrapped in an anchor to https://cosyte.com, per the founder requirement of 2026-08-06. Nothing inside the block moved: the <source>, the <img>, the alt text and both tile URLs are byte-identical.

  What the anchor does was measured on both surfaces by fhir, not assumed, because fourteen READMEs carry this shape. On GitHub the anchor works and the colour-scheme switch keeps working, because the <img> stays a direct child of <picture>, which is the condition the HTML spec puts on <source> applying at all. On an npm package page the anchor is lost: npm wraps a README image in its own anchor to the image file, a nested anchor is not representable, so the parser closes ours early and

... (truncated)

Commits

• 2d1b295 Version Packages (#67)
• 2978d94 docs(readme): link the Cosyte lockup to cosyte.com (ASSETS) (#66)
• 3e140ff fix(changeset): reword the pending summary so the release renders, and re-der...
• df05854 fix(changelog): turn the Changesets changelog generator on, so the tarball st...
• b041427 fix(phi-scan): reconcile the sweep against the index, so an emptied scan root...
• 16c2fea Version Packages (#62)
• bf276ff fix(phi-scan): refuse a declared scan root the walk cannot enumerate (PHI-SCA...
• 5e2b42b docs: split CLAUDE.md narrative into documentation/agent-notes.md, keeping ev...
• 8cc3326 Version Packages (#59)
• 8b2d525 fix(ci): make test-selection genuinely required and stop the workflow claimin...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)