chore(deps): bump @cosyte/terminology from 0.0.9 to 0.0.13

[dependabot]

Bumps @cosyte/terminology from 0.0.9 to 0.0.13.

Release notes

Sourced from @​cosyte/terminology's releases.

v0.0.13

What changed

• Repository tooling: the PHI scanner now refuses a run that read only some of the targets it enumerated.

Full detail for each change is in CHANGELOG.md.

Install

npm install @cosyte/terminology@0.0.13

npm: https://www.npmjs.com/package/@​cosyte/terminology/v/0.0.13

v0.0.12

What changed

Internal tooling and CI only. No change to the published package surface.

Install

npm install @cosyte/terminology@0.0.12

npm: https://www.npmjs.com/package/@​cosyte/terminology/v/0.0.12

v0.0.11

What changed

• CHANGELOG.md is now written by the release rather than by hand, so the copy inside every published tarball stops presenting already-shipped work as unreleased.
• The README lockup now links to cosyte.com (ASSETS).

Full detail for each change is in CHANGELOG.md.

Install

npm install @cosyte/terminology@0.0.11

npm: https://www.npmjs.com/package/@​cosyte/terminology/v/0.0.11

v0.0.10

What changed

• The publish gate's --no-definitely-typed forwarding was pinned by nothing, so a gate that accepted the flag and then dropped it looked exactly like one that forwards it.

Full detail for each change is in CHANGELOG.md.

... (truncated)

Changelog

Sourced from @​cosyte/terminology's changelog.

0.0.13

Patch Changes

• 87d7263: Repository tooling: the PHI scanner now refuses a run that read only some of the targets it enumerated.

  The observation rule already existed at two scopes, and each was a floor of one at its own scope: a scan root was satisfied by yielding one file, and a whole run was satisfied by reading one target. Nothing spoke for the other targets on the list. So naming an ordinary file beside a bypassed one printed OK: no hits and exited 0 while the bypassed file was never opened, byte-identical to a genuine clean run, on both the paths route and the --staged pre-commit route. The false green was reached by following the printed remedy of the tier above it.

  A third tier refuses (exit 2) when a target the run enumerated was never read, and names those paths. It compares sets rather than counts, so it says which target went unread rather than how many did. It runs after the whole-invocation tier, whose refusal set is a strict subset of its own.

  Three supporting fixes. --allow-fixture now seeds the target list unconditionally: it used to do so only when no positional path was given, so with one present the flag was validated, audit-checked and then silently ignored. A bypass naming a path the run does not enumerate now refuses as well, which is what makes the pre-commit route obey this: that route builds its target list from its own predicate, so a bypass outside it landed on nothing and passed. And the hit footer no longer offers a whole-file bypass as a remedy, because that remedy now leads to a refusal.

  A whole-file bypass therefore cannot reach exit 0 in any mode, by those two refusals together and neither alone. The token-level allow-list, which leaves the file read, is the mechanism that remains. No invocation became more permissive: every changed exit code moved toward a refusal.

  No change to the published package.

0.0.12

Patch Changes

• db98da6: Repository PHI commit-gate only, with no runtime impact: the sweep now walks scripts/, so the scanner is under its own scan, and any run that had targets and read none of them refuses instead of printing its clean line.

  Two false-green doors, both the same shape. The gate reported clean over something it never looked at. Both were pre-existing, both were found by the refuters on the previous change to this scanner, and every reading below was taken back to back on a clone of this repository at 7e68603.

  DOOR 1: THE SCANNER NEVER SCANNED ITSELF

  scripts/ was under no scan root. The recogniser's own patterns, the allow-list this scanner refuses to run without, and the override log it points a developer at all live there, so the one directory guaranteed to hold PHI-shaped text was the one nothing enumerated. Measured: scripts/planted.ts carrying a dashed SSN and an off-domain address exited 0 OK: no hits in all-mode, while naming the same file directly reported both at exit 1 over the same bytes.

  The fix is the declaration and nothing else. Both completeness rules already read SCAN_ROOTS: the per-root observation rule and the reconciliation against git ls-files. Adding scripts to that one list widens the walk, the per-root floor and the reconciliation together, with no new machinery, and each of the three is pinned separately rather than assumed to have followed.

  The scope was re-derived and this root is not shaped like test/. git ls-files scripts returns 8 paths and they are not all TypeScript: two .ts, three .mjs, two .sh, one .txt. So it is the first root partly outside the source-literal view, and the two halves of the previous widening land unevenly: .ts and .mjs get the raw floor and the escape-decoded view, .sh and .txt get the raw floor only. That is the right answer for a .txt, which is its own document, and a residual for a .sh, which can spell a value through a shell escape. Recorded rather than guarded, and pinned by an anti-fabrication case so the boundary is visible instead of inferred.

  No exemption was needed and none was added. All 8 files were measured against both recognisers, raw and decoded, before the root was declared: zero hits, so the widening lands green on its own bytes rather than on a new carve-out. The scanner is now under its own scan, so a real-looking value

... (truncated)

Commits

• ad25193 Version Packages (#58)
• 87d7263 fix(phi-scan): refuse a run that read only some of the targets it enumerated ...
• 4e1582b Version Packages (#56)
• db98da6 fix(phi-scan): scan the scanner's own directory, and refuse a sweep that obse...
• 7e68603 fix(phi-scan): walk test/, read the document the literals spell, and reconcil...
• d97a3de style(brand): sweep U+2014 out of the tree and land the CI gate with it (EMDA...
• 88b33ff Version Packages (#51)
• 3967c3d fix(changeset): say the old flag without quoting it, and guard the summary th...
• 7ae2c1b docs(readme): link the Cosyte lockup to cosyte.com (ASSETS) (#50)
• 9b5b390 fix(npm): take the em dash out of the package description (EMDASH-CONFORMANCE...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)