@ai-matrx/alchemy 0.8.2 → 0.8.4

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.8.4
+### Secure SheetJS release
+
+- Replaced the stale npm-registry SheetJS 0.18.5 dependency with the official SheetJS 0.20.3 release. This removes the prototype-pollution and ReDoS advisories from the lazy XLSX export engine.
+
+### Consumer action
+
+None.
+
+## 0.8.3
+### engine subscribe loop
+
+- The phone sheet's verb strip is icon-only and scrolls (seven labelled verbs wrapped letter by letter at 390px).
+- Fix: an action store that notifies inside `subscribe` (a hydration read — read-aloud, thumbs) looped the engine (subscribe → notify → resolve → resubscribe; "Maximum update depth exceeded" on /chat right-click). Subscriptions are now keyed by the resolved ids and a synchronous notify during subscribe is ignored. Test red before the fix (timeout), green after.
+
+### Consumer action
+
+None.
+
 ## 0.8.2
 ### ALC-15 chair rulings
 
@@ -234,4 +253,3 @@ Initial `@ai-matrx/alchemy` distribution package. It exports the existing kit co
 
 Wait for the initial npm publish and the required sibling package releases. Then install `@ai-matrx/alchemy` and replace multiple Alchemy package imports with the matching distribution subpath.
 
-

package/dist/core.cjs

@@ -5,8 +5,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)