v2.4.1

Fixed

• Two of the four npm exports could not be loaded by any consumer.
  @scrapkit/engineering-kit/prettier imported a default export that
  prettier-plugin-tailwindcss does not have — it is ESM-only and exposes only
  options, parsers, printers — so the module failed to link, and since the
  failure came from inside the shared config a consumer could not override it.
  The plugin is now named as a string, the form Prettier resolves itself.
  @scrapkit/engineering-kit/vitest shipped as TypeScript source: Vite
  externalizes dependencies instead of bundling them, so the file reached Node's
  ESM loader as-is and Node refuses to strip types under node_modules
  (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING). It is now shipped as
  JavaScript. Both specifiers are unchanged, so consumers need no edit — the
  documented { ...base } and mergeConfig(base, …) snippets start working.

Changed

• js-configs.yml imports every npm export instead of syntax-checking two of
  them. node --check only parses: it never links imports, which is how both
  bugs above shipped across two releases and stayed invisible to the suite. The
  job now installs the dependencies and await import()s whatever
  package.json promises in exports, so a config that cannot load fails here
  rather than in a consumer project.

v2.4.0

Fixed

• The prompts no longer degrade in silence where Composer never reached.
  code-review and feature-development cited
  vendor/scrapkit/engineering-kit/docs/… as their checklist, but Claude Code
  materialises only plugins/engineering-kit/ when the plugin is installed:
  in a repository that does not require the package those paths do not exist,
  so the prompts ran against invented criteria without saying so. Only
  quality-audit noticed, and reported n/a. Each skill now carries the
  guidelines it checks against in its own references/ directory, so the
  checklist travels with the prompt on every route.

Added

• A SessionStart hook in the plugin, delivering the org-wide rules to the
  repositories Composer cannot reach — previously they arrived only through the
  @vendor/scrapkit/engineering-kit/claude/CLAUDE.md import. It is deliberately
  narrow: it runs only when the repository's origin remote is under
  Scrapkit/, and stays silent when that vendor file exists, because the
  Composer import already states the rules there. A fallback, never a second
  parallel channel.
• composer sync-claude-assets (scripts/sync-claude-assets.php) —
  regenerates the copies that have to live inside the plugin subtree.
  docs/ and claude/ stay the canonical, human-facing sources; the script
  writes the skills' references/ and resources/boost/skills/, prunes
  orphans, and the test suite fails on a copy that has drifted. Run it after
  editing a canonical file and commit what it writes.

Changed

• The four skills cite references/<document>.md instead of a vendor/ path,
  and quality-audit lost its "standards unreachable → n/a" branch: the
  documents ship with the skill, so the degraded path no longer exists. As a
  side effect the prompt and its standards are pinned by the same git ref, so
  an audit can no longer be scored against guidelines from a different release.
• tests.yml now also runs on changes under docs/, claude/, plugins/ and
  resources/. A docs-only pull request did not run Pest and could ship a
  stale generated copy.
• composer analyse passes --memory-limit=512M, and PHPStan analyses
  scripts/ alongside src/.

v2.3.2

Changed

• release.yml now calls Scrapkit/ci-pipeline/.github/workflows/github-release.yml@v1
  instead of carrying its own copy of the note-extraction logic. Two copies of
  the same thing diverge at the first edit, and the other eight packages needed
  it too. Behavior is unchanged; the shared workflow additionally accepts the
  ## [1.2.3] heading convention the rest of the packages use.

v2.3.1

Fixed

• release.yml now opens the GitHub Release for the tag it publishes. It only
  pushed to npm, so docs/package-guidelines.md shipped a rule — every tag gets
  a Release — that this repository was itself keeping by hand, and had already
  missed once on v2.0.0. The notes are the tag's own CHANGELOG.md section, so
  the two cannot drift, and a tag whose version has no entry now fails the
  release instead of shipping undocumented.

v2.3.0

Added

docs/package-guidelines.md — come si versiona e si rilascia un pacchetto scrapkit/*.

architecture-guidelines.md diceva già se creare un pacchetto, e il suo terzo criterio chiede che "someone owns its versioning and changelog" — ma nessun documento diceva cosa significhi possederli. Questo è quel documento:

• cosa conta come breaking change, concretamente
• perché 0.x è una sala d'attesa e non una destinazione
• tag e release: il tag contiene il proprio changelog e non resta mai fuori da main
• CHANGELOG secondo Keep a Changelog, con le istruzioni di migrazione inline
• deprecare prima di rimuovere
• publish tag, chiavi di config e migration come API pubblica
• constraint ^ nei consumer, @v1 invece di @main per i workflow riusabili

Ogni regola cita il rilascio in cui ignorarla è costato qualcosa.

Changed

architecture-guidelines.md rimanda al nuovo documento dal criterio che lo solleva, e claude/CLAUDE.md lo aggiunge ai doc che Claude consulta prima di versionare o rilasciare un pacchetto.

v2.2.0

Changed

I workflow riusabili sono ora pinnati a @v1, non più a @main.

Scrapkit/ci-pipeline non aveva tag, quindi ogni caller inseguiva il suo default branch: un singolo push su ci-pipeline entrava nella CI di tutti i consumer contemporaneamente, senza modo di fermarsi su una versione nota buona. ci-pipeline v1.0.0 introduce il tag mobile v1, e questa release ci porta sopra i tre workflow del kit e examples/laravel-react/.github/workflows/ci.yml.

Migrazione: nei tuoi workflow sostituisci @main con @v1 su ogni riferimento Scrapkit/ci-pipeline/.github/workflows/*.yml.

uses: Scrapkit/ci-pipeline/.github/workflows/pest.yml@v1

v1 continua ad avanzare con le release retrocompatibili; una modifica che rompe gli input di un workflow finirà su v2.

Inoltre: engineering-kit:install ora indica di pinnare @v1 nel suggerimento sul wiring della CI.

v2.1.0

Added

• Template e processo RFC. templates/rfc-template.md in stile ADR, installato come docs/rfc/0000-template.md; docs/rfc-guidelines.md definisce i quattro trigger che rendono un RFC obbligatorio e il ciclo Draft → Review → Accepted/Rejected/Superseded.
• Dodici documenti di standards/processes distillati dalla libreria di riferimento del team, divisi fra standards/ e processes/.
• Integrazione Laravel Boost: guidelines AI in resources/boost/guidelines/core.blade.php e i quattro prompt come Agent Skills sotto resources/boost/skills/.

Changed

• Il frontmatter delle skill ha ora una chiave name: e i body una sezione "When to use this skill", richieste dal formato Agent Skills di Boost.

Vedi CHANGELOG.md.

v2.0.0

Breaking: il plugin Claude Code è ora l'unica via per i prompt. engineering-kit:install non li copia più in .claude/commands/, ma abilita il plugin a livello di progetto.

Nota di migrazione: i prompt diventano namespaced — /quality-audit è ora /engineering-kit:quality-audit.

Vedi CHANGELOG.md.

Release creata a posteriori: il tag esisteva dal 2026-07-20 ma non era mai passata dal workflow.

v1.1.1

Fixed

• npm publish in the release workflow. It had never succeeded: the step that
  upgraded npm to satisfy trusted publishing (npm install -g npm@latest) made
  npm prune its own dependencies mid-upgrade, and --provenance then died on a
  missing sigstore. Node 24 bundles npm 11.16.0, past the 11.5.1 trusted
  publishing needs, so the upgrade is gone and the runtime supplies it. See #4.

No change to the guidelines, configs, prompts or plugin. v1.1.0 carries the
same content but was never published to npm, because its tag predates this fix.

v1.1.0

Note

This tag never reached npm — install v1.1.1 instead, which is this same content.

The Release run for this tag failed on a CI bug, fixed in #6 after the tag was cut. v1.1.1 changes nothing but the workflow and is published on npm with provenance; npm install @scrapkit/engineering-kit now resolves to 1.1.1.

The Composer package is not on Packagist yet (tracked in #4). The Claude Code plugin was never affected — it installs over git from this repository.

Added

• quality-audit Claude Code prompt, installed as .claude/commands/quality-audit.md.
  Writes a dated report to docs/audits/, recording the audited commit in
  front-matter so the next run can skip a codebase that has not changed.
• templates/quality-audit-workflow.yml — opt-in monthly schedule that opens a
  pull request with the report. Not copied by engineering-kit:install.
• Claude Code plugin. The repository now also serves a marketplace
  (.claude-plugin/marketplace.json) publishing the engineering-kit plugin,
  so the four prompts can be installed over git — with /plugin marketplace add scrapkit/engineering-kit — in projects where Composer does not reach. Prompts
  arriving this way are namespaced: /engineering-kit:quality-audit.

Changed

• The prompt sources moved from claude/prompts/*.md to
  plugins/engineering-kit/skills/*/SKILL.md. Both the plugin and
  engineering-kit:install read them from there, so there is a single copy to
  maintain. The files engineering-kit:install writes into a project are
  unchanged: still .claude/commands/{code-review,feature-development,refactoring,quality-audit}.md.
• quality-audit no longer runs unless you invoke it. Claude Code treats
  .claude/commands/*.md and a plugin's SKILL.md as the same thing, so until
  now Claude could start an audit on its own — one that adds a git worktree and
  writes a report — along either route. disable-model-invocation: true in the
  prompt closes both. The other three prompts stay model-invocable: they only
  advise.
• quality-audit reports Standards Compliance as n/a when neither
  vendor/scrapkit/engineering-kit/docs/ nor docs/ is present, instead of
  scoring the repository against guidelines it cannot read. This is the case in
  a repository reached by the plugin but not by Composer.