feat: add dynamic version sync from package.json

- Use createRequire to dynamically import version from package.json
- Ensures CLI version always matches package.json version
- Eliminates manual version synchronization issues

Also includes:
- Security documentation updates
- JSONata security warnings in README
- GitHub issue for future hardening options

Author: mindsocket

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ost-tools",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Tools for working with Opportunity Solution Tree structures and other product management and strategy frameworks",
   "module": "./dist/index.js",
   "type": "module",

src/commands/dump.ts

@@ -1,13 +1,14 @@
 import { statSync } from 'node:fs';
+import JSON5 from 'json5';
 import { readSpaceDirectory } from '../read-space-directory';
 import { readSpaceOnAPage } from '../read-space-on-a-page';
 
 export async function dump(path: string) {
   if (statSync(path).isFile()) {
     const { nodes, diagnostics } = readSpaceOnAPage(path);
-    console.log(JSON.stringify({ nodes, diagnostics }, null, 2));
+    console.log(JSON5.stringify({ nodes, diagnostics }, null, 2));
   } else {
     const { nodes, skipped, nonSpace: nonOst } = await readSpaceDirectory(path);
-    console.log(JSON.stringify({ nodes, skipped, nonOst }, null, 2));
+    console.log(JSON5.stringify({ nodes, skipped, nonOst }, null, 2));
   }
 }

src/config.ts

@@ -96,10 +96,10 @@ function resolveRelativePaths(config: Config, configDir: string): Config {
   };
 }
 
-export function loadConfig(): Config {
-  const path = configPath();
+function _loadConfig(path: string): Config {
   if (!existsSync(path)) {
-    return { spaces: [] };
+    console.error(`Config file not found: ${path}`);
+    process.exit(1);
   }
 
   const config = JSON5.parse(readFileSync(path, 'utf-8'));
@@ -110,8 +110,13 @@ export function loadConfig(): Config {
     console.error('Invalid config.json:', validate.errors);
     process.exit(1);
   }
+  return config as unknown as Config;
+}
 
-  return resolveRelativePaths(config as unknown as Config, dirname(resolve(path)));
+export function loadConfig(): Config {
+  const path = configPath();
+  const config = _loadConfig(path);
+  return resolveRelativePaths(config, dirname(resolve(path)));
 }
 
 /** Resolve alias-or-path to a filesystem path. Falls through if not an alias. */
@@ -153,14 +158,11 @@ export function resolveTemplateSettings(config: Config, space?: SpaceConfig): Te
 /** Update a field on a space entry and persist config.json. */
 export function updateSpaceField(alias: string, field: keyof SpaceConfig, value: string): void {
   const path = configPath();
-  if (!existsSync(path)) {
-    throw new Error(`Config file not found: ${path}`);
-  }
-  const raw = JSON5.parse(readFileSync(path, 'utf-8'));
-  const space = raw.spaces?.find((s: SpaceConfig) => s.alias === alias);
+  const config = _loadConfig(path);
+  const space = config.spaces?.find((s: SpaceConfig) => s.alias === alias);
   if (!space) {
     throw new Error(`Unknown space config: "${alias}". Check config.json.`);
   }
   space[field] = value;
-  writeFileSync(path, `${JSON.stringify(raw, null, 2)}\n`);
+  writeFileSync(path, `${JSON5.stringify(config, null, 2)}\n`);
 }

src/index.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { createRequire } from 'node:module';
 import { Command } from 'commander';
 import { diagram } from './commands/diagram';
 import { dump } from './commands/dump';
@@ -8,12 +9,15 @@ import { validate } from './commands/validate';
 import { loadConfig, resolveSchema, resolveSpacePath, resolveTemplateSettings, setConfigPath } from './config';
 import { miroSync } from './miro/sync';
 
+const require = createRequire(import.meta.url);
+const packageJson = require('../package.json');
+
 const program = new Command();
 
 program
   .name('ost-tools')
   .description('Opportunity Solution Tree validation and diagram generation tool')
-  .version('0.1.0')
+  .version(packageJson.version)
   .option('--config <path>', 'Path to config file (overrides default config.json locations)');
 
 program.hook('preAction', () => {

src/schema.ts

@@ -31,10 +31,9 @@ export function buildSchemaRegistry(dir: string, targetFile?: string): Map<strin
 
 /**
  * Load a schema as a self-contained object for direct traversal (e.g. template-sync).
- * External $refs are resolved against peer schemas in the same directory: their $defs
+ * External $refs are resolved against peer schemas: their $defs
  * are merged in and the refs rewritten to internal #/$defs/... form.
- * Note: only one level of ref resolution is performed here. Full cross-schema traversal
- * will be addressed when template-sync is updated in #15.
+ * Note: only one level of ref resolution is performed here currently.
  */
 export function loadSchema(schemaPath: string): JsonSchemaObject {
   const absPath = resolve(schemaPath);