@chemx/starter-kit 26.9.9-700 → 26.9.9-720

package/cli/audit.js

@@ -183,6 +183,18 @@ export const auditFile = (filePath, relativePath) => {
   return violations;
 };
 
+const IGNORED_DIRS = new Set(['node_modules', 'dist', 'build', 'vendor', '.git', '.next', '.turbo', '.output', 'out']);
+
+const isSourceFile = (name) => {
+  return (
+    /\.(tsx|ts|jsx|js|vue)$/.test(name) &&
+    !name.endsWith('.d.ts') &&
+    !name.includes('.test.') &&
+    !name.includes('.spec.') &&
+    !name.includes('.min.')
+  );
+};
+
 export const scanDirectory = (targetDir, baseDir) => {
   let results = [];
   if (!fs.existsSync(targetDir)) return results;
@@ -193,10 +205,10 @@ export const scanDirectory = (targetDir, baseDir) => {
     const relPath = path.relative(baseDir, fullPath);
 
     if (entry.isDirectory()) {
-      if (!['node_modules', 'dist', '.git', '.next', 'out'].includes(entry.name)) {
+      if (!IGNORED_DIRS.has(entry.name)) {
         results = results.concat(scanDirectory(fullPath, baseDir));
       }
-    } else if (/\.(tsx|ts|jsx|js|vue)$/.test(entry.name) && !entry.name.endsWith('.d.ts') && !entry.name.includes('.test.')) {
+    } else if (isSourceFile(entry.name)) {
       results = results.concat(auditFile(fullPath, relPath));
     }
   }
@@ -211,10 +223,10 @@ const countTotalScannedFiles = (targetDir) => {
   for (const entry of entries) {
     const fullPath = path.join(targetDir, entry.name);
     if (entry.isDirectory()) {
-      if (!['node_modules', 'dist', '.git', '.next', 'out'].includes(entry.name)) {
+      if (!IGNORED_DIRS.has(entry.name)) {
         count += countTotalScannedFiles(fullPath);
       }
-    } else if (/\.(tsx|ts|jsx|js|vue)$/.test(entry.name) && !entry.name.endsWith('.d.ts') && !entry.name.includes('.test.')) {
+    } else if (isSourceFile(entry.name)) {
       count += 1;
     }
   }

package/cli/index.js

@@ -41,10 +41,11 @@ const hasGum = () => {
 };
 
 const gumChoose = (options, header = '') => {
-  const args = ['choose', ...options, '--cursor.foreground=81'];
+  const args = ['choose'];
   if (header) {
-    args.unshift(`--header=${header}`, '--header.foreground=81');
+    args.push(`--header=${header}`, '--header.foreground=81');
   }
+  args.push('--cursor.foreground=81', ...options);
   const res = spawnSync('gum', args, { encoding: 'utf-8', stdio: ['inherit', 'pipe', 'inherit'] });
   return (res.stdout || '').trim();
 };

package/docs/CHANGELOG.md

@@ -43,5 +43,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Removed embedded offline blueprint fallbacks and preview bypass keys from CLI executable (`cli/index.js`).
 - Restricted npm package distribution via `files` whitelist and `.npmignore` to prevent leaking private blueprints and hooks in public tarballs.
 - Added explicit `--tag` support and automatic default fallback for prerelease/CalVer versions in multi-target publisher (`scripts/publish-both.mjs`).
+- Removed unscoped `chem-x` target from publisher script due to npm registry similarity protection with `chemx`.
+- Excluded 3rd-party `vendor` and `build` directories, as well as minified bundles (`*.min.*`), from the AST context hazard audit to eliminate false positives on bundled external libraries.
+- Fixed argument ordering in `gumChoose` to pass `--header` and styling flags to the `choose` subcommand rather than prepending to the parent binary.
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chemx/starter-kit",
-  "version": "26.9.9-700",
+  "version": "26.9.9-720",
   "description": "Chemical X Protocol: Private drop-in architecture starter kit and capsule generator",
   "type": "module",
   "bin": {