fix: make SDK_VERSION bundling-safe (literal + drift test); 1.0.1

[gavin09527]

Summary

Fixes a bundling regression in 1.0.0 and releases it as 1.0.1.

1.0.0 set SDK_VERSION via createRequire(import.meta.url)('../package.json').version. That runtime read does not survive bundling: when a consumer inlines the SDK into a self-contained artifact (e.g. claude-openmax bundles src into its dist/*.mjs), the call is preserved and resolves ../package.json relative to the consumer's bundle at load time — which throws when the bundle runs in isolation.

Surfaced by claude-openmax's own self-contained bundle smoke test after bumping to 1.0.0:

Error: Cannot find module '../package.json'

(alpha.3 had SDK_VERSION as a literal, so this is a 1.0.0 regression for any consumer that bundles the SDK.)

Changes

• src/index.js: SDK_VERSION is now a hardcoded literal ('1.0.1'); removed the now-unused createRequire import. No runtime package.json read remains in the library source → nothing breaks when the SDK is bundled.
• src/version.test.js: drift guard — asserts SDK_VERSION === package.json.version. Reading package.json in a test is safe (tests run in-repo and are never bundled). This preserves the anti-drift guarantee that motivated the original createRequire, but enforces it at CI time instead of library runtime.
• package.json / lock: 1.0.0 → 1.0.1 (patch — behavior fix for bundling consumers).

Testing

• npm test — 309/309 (adds the drift-guard test)
• semgrep scan --config auto --error — 0 findings
• Verified no runtime createRequire('../package.json') remains in non-test src/
• SDK_VERSION (1.0.1) matches package.json version

Reviewer

• Approved by someone other than the last pusher (org ruleset).

🤖 Generated with Claude Code

[zylos-luna-coco]

Good catch and clean fix for the 1.0.0 bundling regression.

Root cause correct: createRequire(import.meta.url)('../package.json') survives in the consumer's bundle as a literal path resolution — but ../package.json is relative to the bundle, not the SDK's installed location. Any consumer that bundles the SDK (claude-openmax's esbuild flow) hits Cannot find module at load time.

Fix approach correct: revert to a hardcoded literal + add a CI-time drift guard (src/version.test.js) that reads package.json in-repo (safe — tests are never bundled). This preserves the anti-drift guarantee without the runtime read. Clean separation of concerns.

RELEASING.md: Good addition — spells out exactly which files to bump, explicitly warns against re-introducing the runtime createRequire read, and documents the tag → release → dist-tag flow. The "Do NOT" section is the key knowledge preservation.

Verified:

• SDK_VERSION literal '1.0.1' matches package.json version
• No runtime createRequire('../package.json') remains in non-test src/
• 309/309 tests per PR description (drift guard included)
• Version: 1.0.0 → 1.0.1 (patch — behavior fix for bundling consumers)

LGTM.