Publish as @schneiderjoseph/devia

.devia/00_OVERVIEW.md

@@ -27,7 +27,7 @@ the memory stays true, and runs the readiness gates. It replaces two earlier sta
 | Content | Markdown with YAML frontmatter | Parsed by the in-repo YAML subset parser |
 | Tests | `node --test` | `tests/*.test.mjs` |
 | CI | GitHub Actions | `.github/workflows/ci.yml` |
-| Distribution | npm package `devia` | `files` in `package.json` decides what ships |
+| Distribution | npm package `@schneiderjoseph/devia` | Scoped; the binary it installs is `devia` |
 
 ## Modules
 

.devia/01_ARCHITECTURE.md

@@ -58,6 +58,7 @@ Content is data. Code reads it; code never encodes what a rule says.
 | `check` scans what git carries, not what the disk holds | A P0 failure on an ignored build artefact is a false positive that teaches people to ignore the gate | `src/lib/git.mjs` |
 | Design rule IDs carried over unchanged | Consolidation must not invalidate existing citations | `MIGRATION.md` |
 | A check that cannot answer returns SKIP | `PASS` must mean verified, never assumed | `src/commands/check.mjs` |
+| The npm package is scoped, the command is not | npm refused the bare name `devia` as too similar to `degit`, `dexie` and `dva`; scoped names skip that filter. Docs say `npm i -D @schneiderjoseph/devia`, then `npx devia` | `package.json` |
 
 ## Current vs target
 

.devia/02_SURFACES.md

@@ -28,7 +28,7 @@ say where, or `--yes` to accept it. Nothing is written before that question is s
 |---|---|---|
 | `.` | `src/cli.mjs` | Programmatic `run(argv)` |
 | `./rules` | `src/lib/rules.mjs` | Loading and validating the registry |
-| `bin.devia` | `bin/devia.mjs` | The `devia` / `npx devia` executable |
+| `bin.devia` | `bin/devia.mjs` | The `devia` executable. The package is `@schneiderjoseph/devia`, the command is `devia`: `npx devia <cmd>` resolves once the package is a dependency |
 
 ## What an adopter receives
 

.devia/05_FLOWS.md

@@ -6,7 +6,7 @@
 
 | Journey | Steps | Covered by |
 |---|---|---|
-| Adopt | `npm i -D devia` → `devia init` → memory, adapters and vendored standard exist | `tests/cli.test.mjs` "init creates the memory…" |
+| Adopt | `npm i -D @schneiderjoseph/devia` → `devia init` → memory, adapters and vendored standard exist | `tests/cli.test.mjs` "init creates the memory…" |
 | Re-run safely | `devia init` on a repository that already has a filled memory keeps every decision | "init does not overwrite a filled memory" |
 | Verify | `devia validate` → structure, config, impact map, registry ids, placeholders | "validate reports placeholders…", "validate detects a reused registry id" |
 | Gate | `devia check` → P0 failures block, exit code 1 | "check blocks on P0 and explains why", "check finds a committed secret" |

.devia/06_INTEGRATIONS.md

@@ -22,6 +22,6 @@ None.
 
 | Service | Effect |
 |---|---|
-| npm | Existing installs keep working; `npx devia` cannot fetch a new version |
+| npm | Existing installs keep working from `node_modules`; nothing new can be fetched. `npx devia` with nothing installed never resolves anyway — the published name is scoped |
 | GitHub Actions | No merges until it returns — gates are not bypassed to unblock work (`OPS-003`) |
 | git absent | `devia doctor` reports staleness as `SKIP`, every other command is unaffected |

.devia/13_RECIPES.md

@@ -67,10 +67,12 @@ only the one that actually changed — an adopter pins the standard and reports
 3. npm run validate && npm test && node bin/devia.mjs check --root . && node bin/devia.mjs validate
 4. npm pack --dry-run          # read the file list: what is missing here is missing for everyone
 5. npm login                   # once per machine
-6. npm publish                 # prepublishOnly re-runs validate + test
+6. npm publish                 # prepublishOnly re-runs validate + test.
+                               # Scoped package: publishConfig.access=public in package.json
+                               # already makes it public, no --access flag to remember
 7. git tag v<version> && git push --tags
 8. Smoke test the published tarball, not the working tree:
-     cd $(mktemp -d) && npm init -y && npm i devia@<version>
+     cd $(mktemp -d) && npm init -y && npm i @schneiderjoseph/devia@<version>
      npx devia init && npx devia validate && npx devia doctor
 ```
 

CHANGELOG.md

@@ -67,8 +67,12 @@ living project memory.
 ### Adopting
 
 ```bash
-npm install -D devia && npx devia init
+npm install -D @schneiderjoseph/devia && npx devia init
 ```
 
 Replace `node scripts/production-check.mjs` in CI with `npx devia check`, and add
 `npx devia validate`.
+
+The package is scoped, the command is not: npm refused the bare name `devia` as too similar to
+existing packages, so installs read `@schneiderjoseph/devia` while everything you type afterwards
+stays `devia`.

MIGRATION.md

@@ -42,7 +42,7 @@ rules are `DB-*`.
 ## If a repo already adopted one of the old standards
 
 ```bash
-npm install -D devia
+npm install -D @schneiderjoseph/devia
 npx devia init          # writes .devia/ and the agent adapters
 npx devia validate
 npx devia check

README.md

@@ -29,7 +29,7 @@ Devia fixes it with three things that reinforce each other:
 ## Quick start
 
 ```bash
-npm install -D devia          # or: npx devia init
+npm install -D @schneiderjoseph/devia    # the binary it installs is `devia`
 npx devia init                # creates .devia/ + agent adapters
 npx devia validate            # memory integrity
 npx devia check               # production readiness (P0/P1)

package.json

@@ -1,5 +1,5 @@
 {
-  "name": "devia",
+  "name": "@schneiderjoseph/devia",
   "version": "0.1.0",
   "description": "One standard, one memory: engineering and design rules plus living project memory for AI coding agents",
   "type": "module",
@@ -65,6 +65,9 @@
     "prepublishOnly": "npm run validate && npm test && node bin/devia.mjs check --root . && node bin/devia.mjs validate",
     "check": "node bin/devia.mjs check --root ."
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "engines": {
     "node": ">=20"
   }