skill-family-engineering-kit 0.8.0 → 0.8.2

package/package.json

@@ -8,8 +8,8 @@
     "url": "https://github.com/ifoohoo/skill-family-engineering-kit/issues"
   },
   "dependencies": {
-    "skill-family-contracts": "0.8.0",
-    "skill-family-harness-node": "0.8.0"
+    "skill-family-contracts": "0.8.2",
+    "skill-family-harness-node": "0.8.2"
   },
   "description": "Build-time scaffold, adoption planning, projection, and checks.",
   "engines": {
@@ -48,7 +48,7 @@
     "url": "https://github.com/ifoohoo/skill-family-engineering-kit.git"
   },
   "type": "module",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/release-notes/0.8.1.yaml

@@ -0,0 +1,21 @@
+version: 0.8.1
+date: 2026-08-22
+locales:
+  en:
+    summary: Engineering Kit now preserves its own package version when a host bundles it into a single-file adapter.
+    changes:
+      fixed:
+        - Replaces the runtime import.meta.url package-manifest lookup with a static JSON import, so source and installed-package execution still read the Kit manifest while esbuild inlines the same version into a host bundle.
+        - Adds a regression test that bundles Engineering Kit as a third-party dependency into one host entry file, runs it outside the package tree, and verifies the reported version against the package manifest.
+      changed:
+        - Moves Contracts, Harness, and Engineering Kit together to version 0.8.1; the Contracts 1.7.0 and Profile SPI v3 surfaces remain unchanged.
+    upgradeNotes: Host adapters that bundle Engineering Kit must pin 0.8.1. Source and ordinary installed-package consumers keep the existing API and require no migration.
+  zh-CN:
+    summary: 宿主把 Engineering Kit 打包进单文件适配器后，Kit 仍能保留自身的包版本。
+    changes:
+      fixed:
+        - 用静态 JSON import 替换运行时基于 import.meta.url 的包清单查找。源码与普通安装包仍读取 Kit 自身清单，esbuild 则把同一版本值内联到宿主 bundle。
+        - 新增回归测试：把 Engineering Kit 作为第三方依赖打包成单一宿主入口，在包目录之外运行，并用包清单复核其报告版本。
+      changed:
+        - Contracts、Harness 与 Engineering Kit 一同升至 0.8.1；Contracts 1.7.0 与 Profile SPI v3 表面保持不变。
+    upgradeNotes: 把 Engineering Kit 打包进宿主适配器的消费者必须精确锁定 0.8.1；源码和普通安装包消费者沿用现有 API，不需要迁移。

package/release-notes/0.8.2.yaml

@@ -0,0 +1,21 @@
+version: 0.8.2
+date: 2026-08-23
+locales:
+  en:
+    summary: Managed offline Bundles now carry the strict-read source required by the fixed candidate mechanism bridge.
+    changes:
+      added:
+        - Projects strict-read.mjs into the managed Bundle and maps its closure, errors, and paths dependencies to sibling runtime modules.
+        - Records the real strict-read.mjs source in Foundation provenance and verifies the read-file-strict bridge in an offline runner.
+      changed:
+        - Moves the package version to 0.8.2 together with Contracts and Harness; the four stable top-level Kit commands remain unchanged.
+    upgradeNotes: Consumers must pin Contracts, Harness, and Engineering Kit to exactly 0.8.2 and rebuild the managed Bundle. Existing Bundles do not gain read-file-strict by changing a worktree reference.
+  zh-CN:
+    summary: 受管离线 Bundle 现在携带固定候选机制桥接所需的 strict-read 源码。
+    changes:
+      added:
+        - 把 strict-read.mjs 投影进受管 Bundle，并把它的 closure、errors 和 paths 依赖映射到相邻运行时模块。
+        - 在 Foundation provenance 中记录真实 strict-read.mjs 源码，并通过离线 runner 复验 read-file-strict。
+      changed:
+        - 包版本与 Contracts、Harness 一同升至 0.8.2；Kit 的四个稳定顶层命令保持不变。
+    upgradeNotes: 消费者必须把 Contracts、Harness 和 Engineering Kit 精确锁定到 0.8.2，再重建受管 Bundle。修改工作树引用不会让已有 Bundle 获得 read-file-strict。

package/src/skeleton.mjs

@@ -1,6 +1,3 @@
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
 import { CONTRACTS_VERSION } from "skill-family-contracts";
 import { digestBytes } from "skill-family-harness-node";
 import { invalidParamsError, kitError, KIT_ERROR_KINDS } from "./errors.mjs";
@@ -11,6 +8,7 @@ import {
   loadLicensingProfile,
 } from "./licensing.mjs";
 import { MIGRATION_MANIFEST_PATH } from "./migration.mjs";
+import { KIT_VERSION } from "./version.mjs";
 
 /**
  * The planned skeleton of one Skill Family project.
@@ -34,10 +32,7 @@ import { MIGRATION_MANIFEST_PATH } from "./migration.mjs";
  */
 
 export const KIT_TOOL_NAME = "skill-family-engineering-kit";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const _kitPkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf8"));
-export const KIT_VERSION = _kitPkg.version;
+export { KIT_VERSION };
 
 /** Kit-owned document paths inside a target workspace. */
 export const PROJECT_MANIFEST_PATH = "skill-family.project-manifest.json";

package/src/version.mjs

@@ -0,0 +1,8 @@
+import kitPackage from "../package.json" with { type: "json" };
+
+// The package manifest is the version authority. A static JSON import keeps
+// source and installed-package execution bound to those exact bytes, while
+// bundlers such as esbuild inline the dependency value into a host bundle.
+// Never derive this path from import.meta.url at runtime: after single-file
+// bundling that URL belongs to the host adapter, not to this package.
+export const KIT_VERSION = kitPackage.version;