@chemx/starter-kit 26.9.9-632 → 26.9.9-720

package/cli/audit.d.ts

@@ -0,0 +1,25 @@
+export interface HazardViolation {
+  filePath: string;
+  line: number;
+  hazard: string;
+  rule: string;
+  directive: string;
+}
+
+export interface AuditReport {
+  scannedFiles: number;
+  totalViolations: number;
+  violations: HazardViolation[];
+}
+
+export declare function auditFile(filePath: string, relativePath: string): HazardViolation[];
+export declare function scanDirectory(targetDir: string, baseDir: string): HazardViolation[];
+export declare function runAudit(targetDir?: string): AuditReport;
+
+declare const _default: {
+  auditFile: typeof auditFile;
+  scanDirectory: typeof scanDirectory;
+  runAudit: typeof runAudit;
+};
+
+export default _default;

package/cli/audit.js

@@ -0,0 +1,253 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { parse } from '@babel/parser';
+import traverse from '@babel/traverse';
+import * as t from '@babel/types';
+
+const countLogicalOperators = (node) => {
+  let count = 0;
+  if (t.isLogicalExpression(node)) {
+    count += 1;
+    count += countLogicalOperators(node.left);
+    count += countLogicalOperators(node.right);
+  } else if (t.isUnaryExpression(node) && node.operator === '!') {
+    count += 1;
+    count += countLogicalOperators(node.argument);
+  }
+  return count;
+};
+
+const extractParseableCode = (content, ext) => {
+  if (ext === '.vue') {
+    const scriptMatch = content.match(/<script\b[^>]*>([\s\S]*?)<\/script>/i);
+    return scriptMatch ? scriptMatch[1] : '';
+  }
+  return content;
+};
+
+export const auditFile = (filePath, relativePath) => {
+  const violations = [];
+  const content = fs.readFileSync(filePath, 'utf-8');
+  const lines = content.split('\n');
+  const lineCount = lines.length;
+  const ext = path.extname(filePath);
+
+  // 1. Line Budget Checks
+  const isMolecule = relativePath.includes('molecules') || relativePath.includes('/m-');
+  if (lineCount > 500) {
+    violations.push({
+      filePath: relativePath,
+      line: 1,
+      hazard: `File line budget exceeded (${lineCount} > 500 lines)`,
+      rule: 'LINE_BUDGET_FILE',
+      directive: 'Decompose monolith into domain capsules and molecules'
+    });
+  } else if (isMolecule && lineCount > 100) {
+    violations.push({
+      filePath: relativePath,
+      line: 1,
+      hazard: `Molecule capsule budget exceeded (${lineCount} > 100 lines)`,
+      rule: 'LINE_BUDGET_MOLECULE',
+      directive: 'Split molecule into focused sub-molecules or extract state to hook'
+    });
+  }
+
+  const codeToParse = extractParseableCode(content, ext);
+  if (!codeToParse.trim()) {
+    return violations;
+  }
+
+  let ast;
+  try {
+    ast = parse(codeToParse, {
+      sourceType: 'module',
+      plugins: ['typescript', 'jsx']
+    });
+  } catch (err) {
+    const errorMsg = err instanceof Error ? err.message : String(err);
+    violations.push({
+      filePath: relativePath,
+      line: 1,
+      hazard: `Parse error: ${errorMsg}`,
+      rule: 'SYNTAX_PARSE_ERROR',
+      directive: 'Fix syntax errors before static analysis'
+    });
+    return violations;
+  }
+
+  const traverseFn = traverse.default || traverse;
+
+  traverseFn(ast, {
+    // 2. Hook Saturation Check
+    Function(astPath) {
+      let hookCount = 0;
+      astPath.traverse({
+        CallExpression(callPath) {
+          if (t.isIdentifier(callPath.node.callee) && /^use[A-Z0-9]/.test(callPath.node.callee.name)) {
+            if (callPath.getFunctionParent() === astPath) {
+              hookCount += 1;
+            }
+          }
+        }
+      });
+
+      if (hookCount > 5) {
+        const line = astPath.node.loc?.start.line || 1;
+        violations.push({
+          filePath: relativePath,
+          line,
+          hazard: `Hook saturation detected (${hookCount} hooks > 5 limit)`,
+          rule: 'HOOK_SATURATION',
+          directive: 'Extract related state and effects into dedicated domain hooks'
+        });
+      }
+    },
+
+    // 3. Control Flow Complexity
+    JSXExpressionContainer(astPath) {
+      const expr = astPath.node.expression;
+      if (t.isLogicalExpression(expr) || t.isUnaryExpression(expr)) {
+        const opCount = countLogicalOperators(expr);
+        if (opCount > 2) {
+          const line = expr.loc?.start.line || astPath.node.loc?.start.line || 1;
+          violations.push({
+            filePath: relativePath,
+            line,
+            hazard: `Inline boolean complexity (${opCount} logical operators > 2 limit)`,
+            rule: 'CONTROL_FLOW_INLINE_BOOLEAN',
+            directive: 'Compose booleans into Stage 1 concepts and Stage 2 decision variables'
+          });
+        }
+      }
+    },
+
+    ConditionalExpression(astPath) {
+      if (t.isConditionalExpression(astPath.node.consequent) || t.isConditionalExpression(astPath.node.alternate)) {
+        const line = astPath.node.loc?.start.line || 1;
+        violations.push({
+          filePath: relativePath,
+          line,
+          hazard: 'Nested ternary operator detected',
+          rule: 'CONTROL_FLOW_NESTED_TERNARY',
+          directive: 'Extract display states into computed descriptor objects or early returns'
+        });
+      }
+    },
+
+    // 4. Timer Discipline
+    CallExpression(astPath) {
+      const callee = astPath.node.callee;
+      if (t.isIdentifier(callee) && (callee.name === 'setInterval' || callee.name === 'setTimeout')) {
+        const fnParent = astPath.getFunctionParent();
+        let hasCleanup = false;
+        if (fnParent) {
+          fnParent.traverse({
+            ReturnStatement(retPath) {
+              if (retPath.node.argument) {
+                hasCleanup = true;
+              }
+            }
+          });
+        }
+
+        if (!hasCleanup) {
+          const line = astPath.node.loc?.start.line || 1;
+          violations.push({
+            filePath: relativePath,
+            line,
+            hazard: `Raw ${callee.name} lacking lifecycle scope disposal`,
+            rule: 'TIMER_DISCIPLINE',
+            directive: 'Wrap timers in self-cleaning hooks returning cleanup disposers'
+          });
+        }
+      }
+    },
+
+    // 5. Type Co-location
+    TSTypeLiteral(astPath) {
+      if (astPath.node.members.length > 3) {
+        if (!astPath.findParent((p) => p.isTSTypeAliasDeclaration() || p.isTSInterfaceDeclaration())) {
+          const line = astPath.node.loc?.start.line || 1;
+          violations.push({
+            filePath: relativePath,
+            line,
+            hazard: `Inlined anonymous complex type (${astPath.node.members.length} members)`,
+            rule: 'TYPE_COLOCATION',
+            directive: 'Define co-located domain interfaces in types/*.d.ts'
+          });
+        }
+      }
+    }
+  });
+
+  return violations;
+};
+
+const IGNORED_DIRS = new Set(['node_modules', 'dist', 'build', 'vendor', '.git', '.next', '.turbo', '.output', 'out']);
+
+const isSourceFile = (name) => {
+  return (
+    /\.(tsx|ts|jsx|js|vue)$/.test(name) &&
+    !name.endsWith('.d.ts') &&
+    !name.includes('.test.') &&
+    !name.includes('.spec.') &&
+    !name.includes('.min.')
+  );
+};
+
+export const scanDirectory = (targetDir, baseDir) => {
+  let results = [];
+  if (!fs.existsSync(targetDir)) return results;
+
+  const entries = fs.readdirSync(targetDir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(targetDir, entry.name);
+    const relPath = path.relative(baseDir, fullPath);
+
+    if (entry.isDirectory()) {
+      if (!IGNORED_DIRS.has(entry.name)) {
+        results = results.concat(scanDirectory(fullPath, baseDir));
+      }
+    } else if (isSourceFile(entry.name)) {
+      results = results.concat(auditFile(fullPath, relPath));
+    }
+  }
+  return results;
+};
+
+const countTotalScannedFiles = (targetDir) => {
+  let count = 0;
+  if (!fs.existsSync(targetDir)) return count;
+
+  const entries = fs.readdirSync(targetDir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(targetDir, entry.name);
+    if (entry.isDirectory()) {
+      if (!IGNORED_DIRS.has(entry.name)) {
+        count += countTotalScannedFiles(fullPath);
+      }
+    } else if (isSourceFile(entry.name)) {
+      count += 1;
+    }
+  }
+  return count;
+};
+
+export const runAudit = (targetDir = 'src') => {
+  const cwd = process.cwd();
+  const absoluteTarget = path.resolve(cwd, targetDir);
+  const violations = scanDirectory(absoluteTarget, cwd);
+  const scannedFiles = countTotalScannedFiles(absoluteTarget);
+
+  return {
+    scannedFiles,
+    totalViolations: violations.length,
+    violations
+  };
+};
+
+export default {
+  auditFile,
+  scanDirectory,
+  runAudit
+};

package/cli/index.js

@@ -5,6 +5,7 @@ import path from 'node:path';
 import os from 'node:os';
 import readline from 'node:readline';
 import { spawnSync } from 'node:child_process';
+import { runAudit as executeAstAudit, auditFile } from './audit.js';
 
 const rawArgs = process.argv.slice(2);
 const invokedBin = path.basename(process.argv[1] || '');
@@ -40,8 +41,11 @@ const hasGum = () => {
 };
 
 const gumChoose = (options, header = '') => {
-  const args = ['choose', ...options];
-  if (header) args.unshift(`--header=${header}`);
+  const args = ['choose'];
+  if (header) {
+    args.push(`--header=${header}`, '--header.foreground=81');
+  }
+  args.push('--cursor.foreground=81', ...options);
   const res = spawnSync('gum', args, { encoding: 'utf-8', stdio: ['inherit', 'pipe', 'inherit'] });
   return (res.stdout || '').trim();
 };
@@ -128,30 +132,33 @@ const obtainLicenseKey = async () => {
 
   if (useGum) {
     const choice = gumChoose([
-      '1. Enter Chemical X License Key',
-      '2. Buy Standard Edition ($49) [mycompassconsulting.com]',
-      '3. Buy Master Bundle ($99) [mycompassconsulting.com]',
+      '1. Buy Standard Edition ($49) -> Launch Checkout',
+      '2. Buy Master Bundle ($99) -> Launch Checkout',
+      '3. Enter License Key (CX-XXXX-XXXX-XXXX)',
       '4. Run Free Public Audit (npx chemx audit)',
       '5. Exit'
-    ], 'Select an option to proceed:');
+    ], 'Chemical X Scaffolding Requires a Paid License:');
 
-    if (choice.startsWith('2.')) {
+    if (choice.startsWith('1.')) {
       process.stdout.write(`\x1b[36mOpening checkout in default browser:\x1b[0m ${URL_STANDARD}\n`);
       openBrowser(URL_STANDARD);
       process.stdout.write('\nOnce completed, paste your Sponsor / VIP License Key below.\n');
       return gumInput('License Key (CX-XXXX-XXXX-XXXX):', 'CX-XXXX-XXXX-XXXX');
     }
 
-    if (choice.startsWith('3.')) {
+    if (choice.startsWith('2.')) {
       process.stdout.write(`\x1b[36mOpening checkout in default browser:\x1b[0m ${URL_MASTER}\n`);
       openBrowser(URL_MASTER);
       process.stdout.write('\nOnce completed, paste your Sponsor / VIP License Key below.\n');
       return gumInput('License Key (CX-XXXX-XXXX-XXXX):', 'CX-XXXX-XXXX-XXXX');
     }
 
+    if (choice.startsWith('3.')) {
+      return gumInput('License Key (CX-XXXX-XXXX-XXXX):', 'CX-XXXX-XXXX-XXXX');
+    }
+
     if (choice.startsWith('4.')) {
-      runAudit();
-      process.exit(0);
+      await runAudit(null, true);
     }
 
     if (choice.startsWith('5.') || !choice) {
@@ -161,30 +168,33 @@ const obtainLicenseKey = async () => {
     return gumInput('License Key (CX-XXXX-XXXX-XXXX):', 'CX-XXXX-XXXX-XXXX');
   }
 
-  process.stdout.write('\x1b[1mAuthentication Options:\x1b[0m\n');
-  process.stdout.write('  [1] Enter License Key\n');
-  process.stdout.write('  [2] Buy Standard Edition ($49) - Opens browser\n');
-  process.stdout.write('  [3] Buy Master Bundle ($99) - Opens browser\n');
+  process.stdout.write('\x1b[1mChemical X Scaffolding Requires a Paid License:\x1b[0m\n');
+  process.stdout.write('  [1] Buy Standard Edition ($49) - Opens browser\n');
+  process.stdout.write('  [2] Buy Master Bundle ($99) - Opens browser\n');
+  process.stdout.write('  [3] Enter License Key\n');
   process.stdout.write('  [4] Run Free Public Audit (npx chemx audit)\n');
   process.stdout.write('  [5] Exit\n\n');
 
   const selection = await promptQuestion('Select option [1-5]: ');
 
-  if (selection === '2') {
+  if (selection === '1') {
     process.stdout.write(`Opening: ${URL_STANDARD}\n`);
     openBrowser(URL_STANDARD);
     return promptQuestion('Enter License Key after purchase: ');
   }
 
-  if (selection === '3') {
+  if (selection === '2') {
     process.stdout.write(`Opening: ${URL_MASTER}\n`);
     openBrowser(URL_MASTER);
     return promptQuestion('Enter License Key after purchase: ');
   }
 
+  if (selection === '3') {
+    return promptQuestion('Enter License Key (CX-XXXX-XXXX-XXXX): ');
+  }
+
   if (selection === '4') {
-    runAudit();
-    process.exit(0);
+    await runAudit(null, true);
   }
 
   if (selection === '5') {
@@ -227,6 +237,12 @@ const fetchStarterKitFiles = async (licenseKey) => {
 const runScaffold = async (projectName) => {
   renderBanner('Chemical X: Quantum Scaffolder (npm create chemx)');
 
+  const licenseKey = await obtainLicenseKey();
+  if (!licenseKey) {
+    process.stderr.write('\x1b[31m✕ Valid license key is required to scaffold blueprints.\x1b[0m\n');
+    process.exit(1);
+  }
+
   let targetName = projectName;
   if (!targetName) {
     if (hasGum()) {
@@ -244,12 +260,6 @@ const runScaffold = async (projectName) => {
     process.exit(1);
   }
 
-  const licenseKey = await obtainLicenseKey();
-  if (!licenseKey) {
-    process.stderr.write('\x1b[31m✕ Valid license key is required to scaffold blueprints.\x1b[0m\n');
-    process.exit(1);
-  }
-
   const files = await fetchStarterKitFiles(licenseKey);
 
   process.stdout.write(`Scaffolding Quantum Architecture into: \x1b[36m${finalDirName}/\x1b[0m\n`);
@@ -358,80 +368,107 @@ export type { ${pascalName}Props } from './types';
   process.stdout.write(`  - ${normalizedName}/index.ts\n\n`);
 };
 
-export const runAudit = () => {
-  process.stdout.write('\n\x1b[38;2;98;201;255m[Chemical X Public Audit]\x1b[0m Scanning codebase for line-budget hazards...\n');
-  const targetDir = process.cwd();
+export const runAudit = async (customDir = null, isCli = false) => {
+  const isJson = rawArgs.includes('--json');
+  const dirFlag = rawArgs.find((arg) => arg.startsWith('--dir='));
+  const targetDir = customDir || (dirFlag ? dirFlag.split('=')[1] : (fs.existsSync('src') ? 'src' : '.'));
 
-  let scanned = 0;
-  let violations = 0;
-  const offendingFiles = [];
+  const report = executeAstAudit(targetDir);
 
-  const checkFile = (filePath) => {
-    const ext = path.extname(filePath);
-    if (!['.ts', '.tsx', '.js', '.jsx', '.vue'].includes(ext)) return;
-    if (filePath.includes('node_modules') || filePath.includes('.next') || filePath.includes('dist') || filePath.includes('.git')) return;
+  if (isJson) {
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    if (isCli) process.exit(report.violations.length > 0 ? 1 : 0);
+    return report;
+  }
 
-    try {
-      const content = fs.readFileSync(filePath, 'utf-8');
-      const lines = content.split('\n').length;
-      scanned++;
-
-      if (lines > 500) {
-        const rel = path.relative(targetDir, filePath);
-        offendingFiles.push({ file: rel, lines });
-        violations++;
-      }
-    } catch {
-      // Fallback
+  process.stdout.write('\n\x1b[38;2;98;201;255m[Chemical X Context Hazard Audit]\x1b[0m Scanning codebase for AST architectural hazards...\n');
+  process.stdout.write(`Target Directory: ${targetDir}\n`);
+  process.stdout.write(`Scanned ${report.scannedFiles} source files.\n\n`);
+
+  if (report.violations.length === 0) {
+    process.stdout.write('\x1b[1m\x1b[32m✔ 100% Quantum Compliant: Zero context hazard violations detected across all line budgets, hooks, and AST rules.\x1b[0m\n\n');
+  } else {
+    process.stdout.write(`\x1b[31m✕ FAILED: ${report.totalViolations} context hazard violations detected:\x1b[0m\n\n`);
+    for (const v of report.violations) {
+      process.stdout.write(`  \x1b[31m[${v.rule}]\x1b[0m \x1b[33m${v.filePath}:${v.line}\x1b[0m\n`);
+      process.stdout.write(`    Hazard:    ${v.hazard}\n`);
+      process.stdout.write(`    Directive: ${v.directive}\n\n`);
     }
-  };
+  }
 
-  const walk = (dir) => {
-    try {
-      const files = fs.readdirSync(dir);
-      for (const file of files) {
-        const full = path.join(dir, file);
-        const stat = fs.statSync(full);
-        if (stat.isDirectory()) {
-          if (!['node_modules', '.git', '.next', 'dist', 'out'].includes(file)) {
-            walk(full);
-          }
-        } else {
-          checkFile(full);
+  if (isCli) {
+    while (true) {
+      if (hasGum()) {
+        spawnSync('gum', [
+          'style',
+          '--border=rounded',
+          '--border-foreground=81',
+          '--padding=0 1',
+          '--bold',
+          'Eliminate AI Context Rot with Chemical X Architecture'
+        ], { stdio: 'inherit' });
+
+        const choice = gumChoose([
+          '1. Buy Standard Edition ($49) -> Launch Checkout',
+          '2. Buy Master Bundle ($99) -> Launch Checkout',
+          '3. Enter License Key to Scaffold (Paid License Holders)',
+          '4. Exit'
+        ], 'Select a CTA action:');
+
+        if (choice.startsWith('1.')) {
+          process.stdout.write(`\n\x1b[36mOpening Standard Edition checkout in browser:\x1b[0m ${URL_STANDARD}\n\n`);
+          openBrowser(URL_STANDARD);
+          continue;
+        }
+        if (choice.startsWith('2.')) {
+          process.stdout.write(`\n\x1b[36mOpening Master Bundle checkout in browser:\x1b[0m ${URL_MASTER}\n\n`);
+          openBrowser(URL_MASTER);
+          continue;
+        }
+        if (choice.startsWith('3.')) {
+          await runScaffold();
+          break;
         }
+        break;
+      } else {
+        process.stdout.write('\x1b[1m\x1b[38;2;98;201;255mEliminate AI Context Rot with Chemical X Architecture:\x1b[0m\n');
+        process.stdout.write(`  [1] Buy Standard Edition ($49) - ${URL_STANDARD}\n`);
+        process.stdout.write(`  [2] Buy Master Bundle ($99) - ${URL_MASTER}\n`);
+        process.stdout.write('  [3] Enter License Key to Scaffold (Paid License Holders)\n');
+        process.stdout.write('  [4] Exit\n\n');
+
+        const selection = await promptQuestion('Select option [1-4]: ');
+        if (selection === '1') {
+          process.stdout.write(`\nOpening: ${URL_STANDARD}\n\n`);
+          openBrowser(URL_STANDARD);
+          continue;
+        }
+        if (selection === '2') {
+          process.stdout.write(`\nOpening: ${URL_MASTER}\n\n`);
+          openBrowser(URL_MASTER);
+          continue;
+        }
+        if (selection === '3') {
+          await runScaffold();
+          break;
+        }
+        break;
       }
-    } catch {
-      // Fallback
-    }
-  };
-
-  walk(targetDir);
-
-  process.stdout.write(`Scanned ${scanned} source files.\n\n`);
-
-  if (violations === 0) {
-    process.stdout.write('\x1b[1m\x1b[32m✔ 100% Quantum Compliant: All source files meet the 500-line budget ceiling.\x1b[0m\n\n');
-  } else {
-    process.stdout.write(`\x1b[31m✕ Found ${violations} Monolith Line-Budget Hazards (> 500 lines):\x1b[0m\n`);
-    for (const item of offendingFiles) {
-      process.stdout.write(`  - \x1b[33m${item.file}\x1b[0m (${item.lines} lines)\n`);
     }
-
-    process.stdout.write('\n\x1b[1m\x1b[38;2;98;201;255mEliminate AI Context Rot with Chemical X Architecture:\x1b[0m\n');
-    process.stdout.write(`  * Book & Standards:  ${URL_STANDARD}\n`);
-    process.stdout.write(`  * Master Bundle:     ${URL_MASTER}\n`);
-    process.stdout.write('  * Create Starter:    npm create chemx\n');
-    process.stdout.write('  * Drop-in Capsules:  npx @chemx/starter-kit init\n\n');
+    process.exit(report.violations.length > 0 ? 1 : 0);
   }
+  return report;
 };
 
+export { auditFile };
+
 const printHelp = () => {
   renderBanner();
   process.stdout.write('\x1b[1mAvailable Commands:\x1b[0m\n');
-  process.stdout.write('  \x1b[36mnpm create chemx [dir]\x1b[0m              Scaffold complete Quantum Architecture project\n');
-  process.stdout.write('  \x1b[36mnpx @chemx/starter-kit init [dir]\x1b[0m   Drop blueprints & hooks into existing project\n');
+  process.stdout.write('  \x1b[36mnpm create chemx [dir]\x1b[0m              [PAID] Scaffold complete Quantum Architecture project\n');
+  process.stdout.write('  \x1b[36mnpx @chemx/starter-kit init [dir]\x1b[0m   [PAID] Drop blueprints & hooks into existing project\n');
   process.stdout.write('  \x1b[36mnpx chemx generate <m-name>\x1b[0m         Generate isolated molecule capsule (< 100 lines)\n');
-  process.stdout.write('  \x1b[36mnpx chemx audit\x1b[0m                     [FREE] Scan codebase for line-budget hazards\n\n');
+  process.stdout.write('  \x1b[36mnpx chemx audit [--json] [--dir=src]\x1b[0m[FREE] Scan codebase for AST architectural hazards\n\n');
 };
 
 const main = async () => {
@@ -445,7 +482,7 @@ const main = async () => {
 
   switch (firstArg) {
     case 'audit':
-      runAudit();
+      await runAudit(null, true);
       break;
     case 'init':
       await runInit(rawArgs[1] || 'src/chemical-x');

package/docs/CHANGELOG.md

@@ -21,9 +21,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ### Added
 - Edge-authenticated single-device project scaffolding command (`npx chemical-x init`) with machine fingerprinting and Cloudflare KV validation.
 - AST hazard line budget audit command (`npx chemical-x audit`) scanning project trees for > 500 line monolith hazards.
+- AST Context Hazard Audit engine module (`cli/audit.js`, `cli/audit.d.ts`) supporting 5 AST rules: line budget, hook saturation, control flow complexity, timer discipline, and type co-location.
+- `./audit` subpath export in `package.json` for programmatic consumption by test suites and benchmarks.
+- CLI flags `--json` and `--dir=<path>` for `npx chemx audit`.
 - Automated NPM publish GitHub Actions workflow (`.github/workflows/publish.yml`) chained to `Auto Version` completion via `workflow_run`.
 
 ### Changed
+- Upgraded `runAudit` in `cli/index.js` from basic line counting to full Babel AST static analysis engine.
 - Updated default API endpoint in CLI (`cli/index.js`) to production custom domain `https://chemicalx.xophz.com`.
 - Expanded `AGENTS.md` blueprint in CLI (`cli/index.js`) to include all 7 Quantum Engineering Architecture pillars.
 - Configured npm package distribution for `@chemx/starter-kit` with `create-chemx`, `chemx`, `chem-x`, and `chemical-x` binary aliases.
@@ -32,10 +36,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Added cross-platform browser checkout launcher for `mycompassconsulting.com/buy/chemical-x/standard` and `master`.
 - Unlocked `npx chemx audit` command as 100% free, unauthenticated, and ungated public utility with conversion CTAs.
 - Added dual project scaffolder (`npm create chemx` / `create-chemx`) and in-repo capsule drop-in (`init`).
+- Gated `runScaffold` (`npm create chemx`) with upfront license validation prior to project directory name prompt.
+- Integrated interactive Gum CTA action buttons at the conclusion of public audit for instant checkout launch ($49 Standard / $99 Master) and key-gated scaffolding for license holders.
 
 ### Fixed
 - Removed embedded offline blueprint fallbacks and preview bypass keys from CLI executable (`cli/index.js`).
 - Restricted npm package distribution via `files` whitelist and `.npmignore` to prevent leaking private blueprints and hooks in public tarballs.
 - Added explicit `--tag` support and automatic default fallback for prerelease/CalVer versions in multi-target publisher (`scripts/publish-both.mjs`).
+- Removed unscoped `chem-x` target from publisher script due to npm registry similarity protection with `chemx`.
+- Excluded 3rd-party `vendor` and `build` directories, as well as minified bundles (`*.min.*`), from the AST context hazard audit to eliminate false positives on bundled external libraries.
+- Fixed argument ordering in `gumChoose` to pass `--header` and styling flags to the `choose` subcommand rather than prepending to the parent binary.
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chemx/starter-kit",
-  "version": "26.9.9-632",
+  "version": "26.9.9-720",
   "description": "Chemical X Protocol: Private drop-in architecture starter kit and capsule generator",
   "type": "module",
   "bin": {
@@ -18,16 +18,24 @@
     "README.md",
     "docs"
   ],
+  "exports": {
+    ".": "./cli/index.js",
+    "./audit": "./cli/audit.js"
+  },
   "scripts": {
     "publish:both": "node scripts/publish-both.mjs",
     "typecheck": "tsc --noEmit",
     "create-capsule": "node cli/index.js"
   },
   "dependencies": {
+    "@babel/parser": "^7.26.9",
+    "@babel/traverse": "^7.26.9",
+    "@babel/types": "^7.26.9",
     "react": "^18.3.1",
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
+    "@types/babel__traverse": "^7.20.6",
     "@types/node": "^22.13.5",
     "@types/react": "^18.3.18",
     "@types/react-dom": "^18.3.5",