chore: sync npm package.json to v0.8.0 (#79)

* ci: cross-platform tests, security audit, macOS x86_64 release, npm version sync

CI:
- Tests now run on Ubuntu, macOS, AND Windows (was Ubuntu-only)
- Added cargo-audit security scanning via rustsec/audit-check
- Each OS gets its own rust-cache key

Release:
- Added x86_64-apple-darwin target (Intel Macs were unsupported)
- 5 release targets: macOS ARM64, macOS x86_64, Linux x86_64,
  Linux ARM64, Windows x86_64

npm:
- Synced package.json version to 0.8.0

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: patch rustls-webpki vulnerability, configure audit to deny vulns only

Update rustls-webpki 0.103.9 → 0.103.11 (RUSTSEC-2026-0049).
Configure cargo-audit to --deny vulnerabilities only (not warnings
for unmaintained transitive deps in fastembed that we can't control).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: correct cargo-audit flags, ignore unmaintained transitive deps

The --deny flag doesn't accept 'vulnerabilities' as a value.
Instead, ignore the 3 specific warnings that are all in fastembed's
transitive deps (number_prefix, paste, rand) — we can't fix upstream.

Actual vulnerabilities (like the rustls-webpki we already patched)
will still fail the audit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: userFRM

.github/workflows/ci.yml

@@ -11,12 +11,18 @@ env:
 
 jobs:
   test:
-    name: Test
-    runs-on: ubuntu-latest
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.os }}
       - run: cargo test --workspace
 
   fmt:
@@ -39,3 +45,12 @@ jobs:
           components: clippy
       - uses: Swatinem/rust-cache@v2
       - run: cargo clippy --workspace --all-targets -- -D warnings
+
+  audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo install cargo-audit --locked
+      - run: cargo audit --ignore RUSTSEC-2025-0119 --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2026-0097

.github/workflows/release.yml

@@ -21,6 +21,8 @@ jobs:
         include:
           - target: aarch64-apple-darwin
             os: macos-latest
+          - target: x86_64-apple-darwin
+            os: macos-latest
           - target: x86_64-unknown-linux-gnu
             os: ubuntu-latest
           - target: x86_64-pc-windows-msvc

Cargo.lock

@@ -1,6 +1,6 @@
 {
   "name": "rpg-encoder",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "mcpName": "io.github.userFRM/rpg-encoder",
   "description": "RPG-Encoder — semantic code graph for AI-assisted code understanding",
   "license": "MIT",