@dsh-gis/dsh-opengis-skill 0.1.0 → 0.1.2

package/.editorconfig

@@ -0,0 +1,19 @@
+# Editor defaults for the repository. Mirrors the LF normalization in
+# .gitattributes; editors that support EditorConfig apply these automatically.
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{js,mjs}]
+indent_style = tab
+
+[*.{json,jsonc,yaml,yml,md}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

package/CHANGELOG.md

@@ -0,0 +1,96 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.2] - 2026-10-19
+
+### Added
+
+- Tests for the frontmatter parser, the catalog builder, Markdown link resolution,
+  and the sync/validate scripts, plus expanded provider coverage in `test/plugin.test.mjs`.
+- A SHA-256 integrity manifest in `upstream.json` (`schemaVersion: 1`,
+  `hashAlgorithm: "sha256"`, `files` keyed by the POSIX path relative to `assets/`),
+  so validation no longer needs an upstream checkout.
+- Generated README sections: the skill count and skill table are rendered from the
+  vendored assets and verified by `npm run validate`.
+- `.editorconfig` and this changelog.
+
+### Changed
+
+- Compatibility: `engines.dsh` widened to `>=0.2.0-rc.2 <0.3.0-0`. The registry API
+  and candidate/definition contract of `@deepseek-ai/dsh-skill` are byte-identical
+  between 0.2.0-rc.2 and 0.2.1-rc.2, and 0.2.0-rc.2 already supports
+  `dsh.bundle.patch`, locale and icon metadata, so the old `>=0.2.1-rc.2` gate
+  needlessly blocked users on the npm-latest DSH 0.2.0-rc.2.
+- Runtime hardening: canonical provider registration via
+  `ctx.skills.registerProvider(() => provider)` (the returned disposer is owned by
+  the calling fiber, so no extra `ctx.effect` wrapper), a strict BOM-tolerant
+  frontmatter parser, a clear error when the asset root is missing, and
+  forward-slash `resourceBase` paths on Windows.
+- Tooling hardening: two-way `sync:check` (drift plus upstream additions/removals),
+  SHA-256 manifest verification, generated README count/table verification,
+  validation of every relative Markdown link in the repository docs and assets,
+  and CRLF detection.
+- CI: the test matrix now covers Ubuntu (Node 22/24) and Windows (Node 24), and a
+  new `sync` job verifies the vendored snapshot against the pinned upstream commit.
+- `npm run check` (`validate && test`) added; `prepublishOnly` now runs it.
+- Docs refreshed: README rewritten without hardcoded skill counts, with an English
+  summary, a compatibility note, install/uninstall/update notes, upstream integrity
+  docs and a troubleshooting section; package description and locale metadata
+  updated.
+
+### Fixed
+
+- `SKILL.md` files with a UTF-8 BOM are parsed correctly; frontmatter parsing is
+  strict and reports unterminated quotes or block scalars instead of silently
+  ignoring them.
+- A missing `assets/` directory now fails with a clear error that names the expected
+  asset root instead of an opaque `ENOENT`.
+- `resourceBase` paths are emitted with forward slashes on Windows, so relative
+  references resolve consistently across platforms.
+- Stale hardcoded skill counts removed from the README, locale metadata and the npm
+  description; count and table are generated from the vendored assets.
+- CRLF line endings in vendored assets are detected and reported by validation.
+- Sync refuses a `--from` directory that is not itself a git checkout root, so an
+  enclosing repository's HEAD can no longer be recorded as forged upstream
+  provenance; the manifest commit is now mandatory and validated.
+- Sync rejects `gis/` directories without `SKILL.md` and stray files at the
+  `assets/` root instead of silently dropping or blessing them.
+- Stray files at the `assets/` root are pruned by sync and rejected by
+  validation, so `assets/` publishes only skill directories.
+- CI actions are pinned to release commit SHAs, and the external upstream
+  checkout disables persisted credentials.
+- Validation checks the bundle row structurally, the locale file grammar, and the
+  engine range shape instead of accepting any non-empty string.
+
+## [0.1.1] - 2026-10-19
+
+### Fixed
+
+- Vendored skill assets are written with LF bytes regardless of the source
+  checkout's line endings, so the snapshot matches the upstream git blob on every
+  platform.
+- Corrected the release documentation shipped with 0.1.0.
+
+## [0.1.0] - 2026-10-19
+
+### Added
+
+- Initial public release: a DeepSeek Harness bundle and plugin that vendors the
+  `gis/` skills of opengis-skills and registers one skill provider (`opengis`) on
+  `ctx.skills`.
+- Bundled assets under `assets/<skill>/` (`SKILL.md` plus `reference/*.md`), bundle
+  wiring (`cordis.patch.yml`), locale metadata, icon, and npm packaging.
+- Source-repository tooling: `npm run sync` / `npm run sync:check`, `npm run
+  validate`, `npm test`, and GitHub Actions CI.
+
+## [0.0.0-stage] - 2026-10-19
+
+### Added
+
+- First staging release: bundle/plugin skeleton, vendored skill assets, locale and
+  icon metadata, and the initial sync/validate/test scripts for installation
+  checks.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 tj
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 tj
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,17 +1,36 @@
 # @dsh-gis/dsh-opengis-skill
 
-DeepSeek Harness 的 **OpenGIS 技能包插件**：把 [opengis-skills](https://github.com/znlgis/opengis-skills) 中 **gis/ 分类的 32 个 GIS 技能**打包成可安装、可启停的 DSH bundle。会话技能目录只列出名称与描述，技能正文与参考资料按需加载。
+> **English summary** — A DeepSeek Harness bundle that packages the `gis/` skills of
+> [opengis-skills](https://github.com/znlgis/opengis-skills) as installable, toggleable skills.
+> The session catalog lists names and descriptions only; skill bodies and their
+> `reference/*.md` files are loaded on demand. Zero runtime dependencies: every asset
+> ships inside the npm package.
+>
+> Compatibility: DeepSeek Harness `>=0.2.0-rc.2 <0.3.0-0`; Node.js `>=22` for development
+> only. MIT licensed.
+
+DeepSeek Harness 的 **OpenGIS 技能包插件**：把 [opengis-skills](https://github.com/znlgis/opengis-skills) 中 `gis/` 分类的 GIS 技能打包成可安装、可启停的 DSH bundle。会话技能目录只列出名称与描述，技能正文与参考资料按需加载。
 
 ## 特性
 
-- **32 个 GIS 技能**：GDAL、GDAL API、QGIS（qgis_process / PyQGIS / QGIS Server）、GeoServer（含 REST API 与 Cloud）、MapServer、PostGIS、PROJ、PDAL、GRASS GIS、JTS、NetTopologySuite、Esri Geometry API（Java/.NET）、Shapely、GeoPandas、GeoPipeAgent、OpenGisDAF、CesiumJS、OpenLayers、Leaflet、Mapbox GL JS、deck.gl、SharpMap、Mapsui、GeoTools、OpenGIS Utils（Java/.NET）、opengis-all 全流程索引。
+- **覆盖 GIS 全链路**：GDAL、GDAL API、QGIS（qgis_process / PyQGIS / QGIS Server）、GeoServer（含 REST API 与 Cloud）、MapServer、PostGIS、PROJ、PDAL、GRASS GIS、JTS、NetTopologySuite、Esri Geometry API（Java/.NET）、Shapely、GeoPandas、GeoPipeAgent、OpenGisDAF、CesiumJS、OpenLayers、Leaflet、Mapbox GL JS、deck.gl、SharpMap、Mapsui、GeoTools、OpenGIS Utils（Java/.NET），以及 `opengis-all` 全流程索引。
 - **按需加载**：注册的是 skill provider（`ctx.skills.registerProvider`），发现阶段只读 frontmatter；正文每次加载时读取，参考资料（`reference/*.md`）通过技能目录（resource base）相对解析。
-- **零运行时依赖**：只用 Node 内置模块，npm 包内自带全部资产（约 640 KB），不 import DSH 内部包。
-- **可同步上游**：`npm run sync` 从 opengis-skills 检出复制资产，记录上游 commit 到 `upstream.json`，并重新生成本文下方技能表。
+- **零运行时依赖**：只用 Node 内置模块，不 import DSH 内部包；全部资产随 npm 包分发，整个包解包后约 670 KiB。
+- **可同步上游**：`npm run sync` 从 opengis-skills 检出复制资产，记录上游 commit 与每个文件的 SHA-256 到 `upstream.json`，并重新生成本文下方技能清单。
 - **可启停**：单包同时是 bundle 与插件（`dsh.bundle.patch` 插入自身行），在 Plugins 里启用/停用即可。
 
+## 兼容性
+
+- **DeepSeek Harness**：`>=0.2.0-rc.2 <0.3.0-0`（`package.json` 的 `engines.dsh`）。本包通过 Host 提供的 `ctx.skills` 注册 provider，遵循 `@deepseek-ai/dsh-skill` 的 registry API 与 candidate/definition 契约；该契约在 0.2.0-rc.2 与 0.2.1-rc.2 之间字节一致，`dsh.bundle.patch`、locale 与图标元数据在 0.2.0-rc.2 已经可用。
+- **Node.js**：`>=22`（`engines.node`）。仅开发脚本与测试需要，插件本身运行在 DSH 内。
+- **运行时依赖**：无。`dependencies` 为空，只使用 Node 内置模块，不 import DSH 内部包。
+
 ## 技能清单
 
+<!-- skills:count:start -->
+共 **32** 个技能，描述取自上游 frontmatter。
+<!-- skills:count:end -->
+
 <!-- skills:start -->
 | Skill | Description (upstream frontmatter) |
 | --- | --- |
@@ -53,9 +72,10 @@ DeepSeek Harness 的 **OpenGIS 技能包插件**：把 [opengis-skills](https://
 
 ### 方式一：Plugins 界面（本地目录，适合开发）
 
-1. 打开 DSH 的 **Plugins / 插件** 页面，选择安装 bundle（安装本地包目录）。
-2. 目标填本仓库的绝对路径，例如 `D:\self\code\dsh-opengis-skill`。
-3. 在列表中找到 **OpenGIS 技能包** 并启用。
+1. 在 DSH 中打开 **Plugins / 插件** 页面，选择安装 bundle（本地目录方式）。
+2. 目标填**包根目录**的绝对路径，也就是包含 `package.json` 的目录，例如本仓库 `D:\self\code\dsh-opengis-skill`。
+3. 安装后在列表中找到 **OpenGIS 技能包** 并启用；记录写入当前所选 profile 的插件配置。
+4. 本地目录方式直接引用源码目录，改动会随重载生效，适合开发与试用；正式使用建议走下面的 npm 方式，便于升级与版本校验。
 
 ### 方式二：npm
 
@@ -63,11 +83,19 @@ DeepSeek Harness 的 **OpenGIS 技能包插件**：把 [opengis-skills](https://
 dsh plugin --profile <profile> add @dsh-gis/dsh-opengis-skill
 ```
 
-安装后在 Plugins 页面启用该 bundle。desktop profile 由 Electron 应用独占，推荐直接用 Plugins 界面操作；安装、升级或启停之后，需要新会话（或重启 dsh）才会出现最新的技能目录。
+安装后在 Plugins 页面启用该 bundle。卸载：
+
+```bash
+dsh plugin --profile <profile> remove @dsh-gis/dsh-opengis-skill
+```
+
+- desktop profile 由 Electron 应用独占，推荐直接使用 Plugins 界面操作。
+- 安装、升级或启停之后，需要重载/重启 dsh，并**新开会话**，技能目录才会反映最新状态（bundle 与技能目录在会话启动时装配）。
+- 升级到新版本后同样需要重载 + 新会话；本地目录方式改动 `package.json` 或 `assets/` 后也一样。
 
 ## 使用
 
-- 技能目录会列出 32 个技能的名称与描述；模型用 `skill("gdal")` 之类的调用加载，用户也可以在输入框直接输入 `/gdal`。
+- 技能目录只列出每个技能的名称与描述；模型用 `skill("gdal")` 之类的调用加载，用户也可以在输入框直接输入 `/gdal`。
 - 常用入口：
   - `opengis-all` — 端到端 GIS 流程索引（GDAL → 处理 → GeoServer → 可视化）；
   - `gdal` / `gdal-api` — 命令行与编程式栅格/矢量处理；
@@ -75,10 +103,12 @@ dsh plugin --profile <profile> add @dsh-gis/dsh-opengis-skill
   - `geoserver` + `geoserver-rest-api` — 发布与管理 OGC 服务；
   - `postgis` — 空间数据库；`proj` — 坐标转换；
   - `openlayers` / `cesiumjs` / `deck-gl` — Web 2D/3D 可视化。
-- 加载结果会给出该技能的 Base directory；正文中的 `reference/*.md` 与 `../<其他技能>/SKILL.md` 相对链接都据此解析（资源随包全量分发）。
+- 加载结果会给出该技能的 **Base directory**；正文中的 `reference/*.md` 与 `../<其他技能>/SKILL.md` 相对链接都据此解析。因为全部技能资产随同一个包一起分发，跨技能链接不需要额外安装或配置。
 
 ## 上游同步
 
+> 本节只适用于**本仓库的源码开发**。`scripts/` 与 `test/` 不在 npm 发布包内（`package.json` 的 `files` 未包含它们），安装用户无需执行这些命令。
+
 ```bash
 # 默认从 ../opengis-skills 读取，也可用 --from 或 OPENGIS_SKILLS_DIR 指定
 npm run sync -- --from ../opengis-skills
@@ -87,45 +117,76 @@ npm run sync -- --from ../opengis-skills
 npm run sync:check -- --from ../opengis-skills
 ```
 
-同步脚本会：逐文件复制 `gis/<skill>/`（不含任何改写）、校验 frontmatter（name 必须为 kebab-case 且与目录同名）、清理上游已删除的技能目录、更新 `upstream.json`（仓库地址、commit、同步时间、技能清单）以及本文的技能表。
+同步脚本会：逐文件复制 `gis/<skill>/`（文本统一为 LF，保证与上游 git blob 跨平台字节一致）、校验 frontmatter（name 必须为 kebab-case 且与目录同名）、清理上游已删除的技能目录、更新 `upstream.json`，并重新生成 README 中的技能数量与技能表（生成区域由 `<!-- skills:count:* -->` 与 `<!-- skills:* -->` 标记界定）。`sync:check` 做双向比较：既检查已同步文件是否漂移，也检查上游新增/删除的技能是否遗漏。
+
+为避免伪造来源，`npm run sync` 要求 `--from` 指向 opengis-skills 的 **git 检出根目录**：脚本用 `git rev-parse --show-toplevel` 校验该目录就是仓库根，避免把外层仓库的 HEAD 误记成上游 commit；无法证明 commit 时同步直接失败。上游 `gis/` 下若出现没有 `SKILL.md` 的目录，同步会报错而不是静默跳过（否则上游改名会静默丢技能）；`gis/` 根目录的普通文件（上游分类索引 `gis/SKILL.md` 等）不参与同步，也不会被当作技能打包。
+
+`upstream.json` 同时是一份完整性清单：`schemaVersion` 为 `1`，`hashAlgorithm` 为 `"sha256"`，`files` 以相对 `assets/` 的 POSIX 路径为键、对应文件的 SHA-256 摘要为值。`npm run validate` 会重新计算并比对全部摘要，因此**不依赖上游 checkout** 也能发现资产被手改、缺失或未列入清单的情况；CI 的 `sync` 任务再用固定 commit 的上游检出做一次 `sync:check`，确保快照与上游一致。
 
 ## 开发
 
+需要 Node.js 22+。
+
 ```bash
-npm test            # Node 内置测试运行器，覆盖 provider 目录/加载/链接
-npm run validate    # 资产、元数据、bundle 接线与打包校验
+npm run check       # validate + test，发布前必跑（也是 prepublishOnly）
+npm run validate    # 资产、元数据、bundle 接线、完整性清单与断链校验
+npm test            # Node 内置测试运行器
 npm pack --dry-run  # 查看实际发布内容
 ```
 
+编辑器默认值见 [.editorconfig](./.editorconfig)（UTF-8、LF、最终换行；JS/MJS 用 Tab，JSON/YAML/Markdown 用 2 空格；Markdown 保留行尾空格）。版本变更记录见 [CHANGELOG.md](./CHANGELOG.md)。
+
 ### 目录结构
 
 ```text
 dsh-opengis-skill/
-├── package.json            # dsh.bundle.patch、engines、files、icons/locales 导出
-├── cordis.patch.yml        # bundle 层：把 opengis-skill provider 行插入 Host
+├── package.json                  # dsh.bundle.patch、engines、files、图标/本地化导出
+├── cordis.patch.yml              # bundle 层：把 opengis-skill provider 行插入 Host
 ├── lib/
-│   ├── index.js            # provider 插件（扫描 assets、注册 ctx.skills）
-│   ├── skill-file.js       # SKILL.md frontmatter 解析（插件/脚本/测试共用）
-│   └── *.d.ts              # 手写类型声明
-├── assets/<skill>/         # 32 个技能资产（SKILL.md + reference/*.md，随上游同步）
-├── locale/{en,zh}.json     # Plugins 里显示的标题与描述
-├── icon.svg                # bundle 图标
-├── scripts/                # 同步与校验脚本
-├── test/plugin.test.mjs    # 单元测试
-└── upstream.json           # 上游仓库、commit、同步时间与技能清单
+│   ├── index.js                  # provider 插件（注册 ctx.skills、list/get）
+│   ├── catalog.js                # 扫描 assets/ 构建技能目录、生成 README 区域
+│   ├── markdown-links.js         # Markdown 相对链接解析与断链校验
+│   ├── skill-file.js             # SKILL.md frontmatter 解析（插件/脚本/测试共用）
+│   └── *.d.ts                    # 手写类型声明
+├── assets/<skill>/               # 技能资产（SKILL.md + reference/*.md，随上游同步）
+├── locale/{en,zh}.json           # Plugins 里显示的标题与描述
+├── icon.svg                      # bundle 图标
+├── scripts/
+│   ├── sync-opengis-skills.mjs   # 上游同步（assets/、upstream.json、README 生成区域）
+│   └── validate-skills.mjs       # 发布前校验（自包含，无需上游 checkout）
+├── test/
+│   ├── plugin.test.mjs           # provider 目录/加载/链接
+│   ├── skill-file.test.mjs       # frontmatter 解析
+│   ├── catalog.test.mjs          # 目录构建与 README 生成区域
+│   ├── markdown-links.test.mjs   # 相对链接解析与断链检测
+│   └── scripts.test.mjs          # 同步/校验脚本（临时目录夹具）
+├── .editorconfig                 # 编辑器默认值
+├── CHANGELOG.md                  # 版本变更记录
+├── README.md
+└── upstream.json                 # 上游仓库、commit、同步时间、技能清单与 SHA-256 清单
 ```
 
 ### 设计说明
 
-- `apply` 时扫描 `assets/*/SKILL.md`，解析并校验名称与描述，然后 `ctx.effect(() => ctx.skills.registerProvider(...))`；provider 名为 `opengis`，候选 rank 为 600（与官方内置技能包一致），模型与用户均可调用。
-- 目录（list）只含元数据；正文（get）每次重新读盘，因此编辑资产后重新加载插件即可生效，无需清缓存。插件不注册工具、不注入提示段、不写会话状态。
-- 相对链接不做改写：包内是全量 32 个技能目录，`reference/*.md` 与 `../<skill>/SKILL.md` 都能解析；如果将来裁剪技能，`npm run validate` 会报断链。
+- **规范注册**：`apply` 时调用 `ctx.skills.registerProvider(() => provider)`；返回的 disposer 由调用方 fiber 拥有，卸载时自动清理，因此**不需要**再套一层 `ctx.effect(...)`。
+- provider 名为 `opengis`，`source` 为 `opengis`，候选 rank 为 600（即 `BUNDLED_SKILL_RANK`，与官方内置技能包一致），`invocation` 为模型与用户均可调用。
+- `list` 只返回元数据（名称、描述、rank、source、`locator`/`path`、`resourceBase`）；`get` 每次重新读盘并解析正文，因此编辑资产后重新加载插件即可生效，无需清缓存。插件不注册工具、不注入提示段、不写会话状态。
+- **运行时加固**：frontmatter 解析严格且容忍 UTF-8 BOM（`name` 必须为 kebab-case、`description` 必填，未闭合引号或块标量会报可读错误）；`assets/` 缺失时报错会指明期望的资产根目录；`resourceBase` 在 Windows 上也统一输出为正斜杠，跨平台链接一致。
+- 相对链接不做改写：包内是全量技能目录，`reference/*.md` 与 `../<skill>/SKILL.md` 都能解析；`npm run validate` 会扫描全部 Markdown 相对链接，断链或越出 `assets/` 都会失败。
+
+## 故障排查
+
+- **技能目录没有出现**：确认 bundle 已在 Plugins 中启用；安装、升级或启停后需要重载/重启 dsh 并新开会话。若用本地目录方式，确认填的是包含 `package.json` 的包根目录。
+- **加载技能失败**：错误信息会带出具体资产路径（例如 `.../assets/gdal/SKILL.md` 的 frontmatter 问题）；按提示修复，或从上游重新同步，不要手工编辑 `assets/`。
+- **本地验证**：`npm run validate` 检查资产、元数据、bundle 接线、完整性清单与链接；`npm test` 跑单元测试；发布前统一用 `npm run check`。
+- **同名技能冲突**：技能注册表按 rank、再按注册顺序决定同名技能的解析优先级；本包 rank 为 600。若其他 provider 也提供了同名技能，检查是否有另一份 OpenGIS 技能包或自定义技能被同时启用。
+- **不要手改 `assets/`**：它是上游快照，手工修改会导致 SHA-256 完整性校验与同步检查失败；需要改内容时先改上游，再 `npm run sync` 重新生成。
 
 ## 与 @dsh-gis 其他插件的关系
 
-- ```dsh-gis/dsh-gis`：GIS 工具与地图界面（inspect/query/CRS/OGC/UI）。
-- ```dsh-gis/dsh-prompt-gis`：一段 GIS system-prompt 与两个内联技能（`gis-inspect-first`、`gis-query-patterns`）。
-- 本包：纯知识型技能包（32 个 GIS 技能），不提供工具，可与上述插件同时安装。
+- `@dsh-gis/dsh-gis`：GIS 工具与地图界面（inspect/query/CRS/OGC/UI）。
+- `@dsh-gis/dsh-prompt-gis`：一段 GIS system-prompt 与两个内联技能（`gis-inspect-first`、`gis-query-patterns`）。
+- 本包：纯知识型技能包，不提供工具，可与上述插件同时安装。
 
 ## 许可
 

package/THIRD_PARTY_NOTICES.md

@@ -2,21 +2,48 @@
 
 ## opengis-skills
 
-The skill instructions under `assets/` are copied verbatim from the
+The skill instructions under `assets/` are copied from the
 [opengis-skills](https://github.com/znlgis/opengis-skills) repository
 (`gis/` category), which is licensed under the MIT License:
 
-> MIT License
->
-> Copyright (c) 2024-2026 znlgis
+```text
+MIT License
+
+Copyright (c) 2024-2026 znlgis
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
 
 The exact upstream commit, sync time, and the list of vendored skills are
-recorded in [`upstream.json`](./upstream.json); the copy is performed by
-[`scripts/sync-opengis-skills.mjs`](./scripts/sync-opengis-skills.mjs). The
-skills are documentation: each one describes an independent open-source project
-(GDAL, QGIS, GeoServer, PostGIS, JTS, CesiumJS, OpenLayers, and others) and
-links to that project's own repository, documentation, and license. Those
-projects keep their own licenses; nothing in this package re-licenses them.
+recorded in [`upstream.json`](./upstream.json), together with a SHA-256
+integrity manifest of the snapshot: `schemaVersion` 1, `hashAlgorithm`
+`sha256`, and a `files` map from every vendored file's POSIX path (relative
+to `assets/`) to its digest. `npm run validate` recomputes those digests and
+fails when the vendored bytes drift from the recorded manifest. The copy is
+performed by `scripts/sync-opengis-skills.mjs`, which lives in the source
+repository (<https://github.com/znlgis/dsh-opengis-skill>) and is not part of
+the published package. Text files are vendored with LF line endings so the
+snapshot matches the upstream git blob on every platform. The skills are
+documentation: each one describes an independent open-source project (GDAL,
+QGIS, GeoServer, PostGIS, JTS, CesiumJS, OpenLayers, and others) and links to
+that project's own repository, documentation, and license. Those projects
+keep their own licenses; nothing in this package re-licenses them.
 
 ## DeepSeek Harness