Changelog

1.5.0

Minor Changes

• 95638de: Audit-driven refactor across all 15 public packages. Closes type holes, hardens security boundaries, eliminates dead code, and dedups duplicated patterns.

  Highlights

• duck-docs — CompiledMdxBody branded type gates new Function(body); sanitizeSvg covers SMIL, unquoted javascript: URIs, nested script, CSS url(), bare iframe; code-preview tag + attr allowlists

• duck-registry-build — safe-path containment at every fs sink; per-phase Zod cache schemas; JSON.stringify in generated TSX; cache manifest rejection on tamper

• duck-cli — install pipeline path containment unified across add/init/update; env-var allowlist contract reconciled with one-time warning; aliases.ui regex validation

• duck-primitives — observe-element-rect rAF loop guard (no leak when empty); compose-ref useCallback memo fix; popper forwardRef restored for R18 peer compat

• duck-hooks — useDebounce is now a real hook (stable identity, unmount cleanup); useStableId delegates to React.useId (SSR-safe); scheduleTransitionTimeout rename strips two useHookAtTopLevel lint suppressions

• duck-lazy — spread order fix restores the lazy swap; next/image moved behind /lazy-image-next subpath so non-Next consumers don't pull the peer

• duck-vim — single document listener fans out to chord matcher + sequence manager; canonical modifier order; requireReset auto-clears for chord bindings; all three hook dep arrays corrected

• duck-variants — Props<T, D> makes defaulted variant keys optional and non-defaulted required; bounded preludeCache LRU; second-layer filter2 set eliminates last clone in hot path

• duck-ttest — predictates/ renamed to predicates/, twin dirs deleted, type-utility duplicates reconciled to canonical sources, IsVoid actually distinguishes void from undefined now

• duck-calendar — ./* wildcard export removed; falsy-zero weekStartDay: 0 (Sunday) bug fixed; Gregorian helpers extracted; Hebrew addMonths uses Metonic cycle

• duck-libs — cnMemo bounded LRU; filteredObject rejects typo keys at compile time; parseDate rejects ambiguous one-token inputs

• duck-query — single AnyReq boundary cast replaces 14 as any; param regex escape; throws on unresolved :tokens

• registers — schema tightened (z.any() removed); ~1000 LoC of identical block-registry boilerplate replaced with builders

• registry-ui — _audio / _upload (~1.1K LoC) deleted; motion-shell HOC + withMotion collapses simple motion clones; toDirection() narrower replaces 52 as IDirection.Kind casts; chart CSS_NAMED_COLORS finite allowlist

• duck-motion — refcounted body pointer-events ownership; easing/blur/duration token dedup; half of public exports were unused and removed

Tests: 3133+ across the monorepo, all green. Type-checks clean across every project. No commits skipped hooks.

1.4.1

Patch Changes

• 95dbbce: Standardize README headers across all packages: centered logo, h1, tagline, nav links, and npm badges (matching the @duck-md template). Replace per-repo *.gentleduck.org subdomain refs with path-based gentleduck.org/duck-<name> URLs. No runtime code changes.

1.4.0

Minor Changes

• 09c11ed: Add theme command for managing theme tokens.

  Three subcommands:

• duck-cli theme list — list every theme in the registry (--json for machine output)

• duck-cli theme info <name> — print color tokens for one theme (--json supported)

• duck-cli theme add <name> — install a theme into your globals.css (--css <path> to override)

theme add writes a guarded block bracketed by /* @gentleduck/cli theme:start */ and /* @gentleduck/cli theme:end */. Re-running theme add with another theme replaces the block in place, so swapping themes is a one-command operation. Defaults search the common globals.css locations (app/globals.css, src/app/globals.css, src/index.css, src/styles/globals.css, styles/globals.css).

Backed by:

• New getRegistryThemesIndex() helper that fetches /r/themes/index.json
• New getRegistryTheme(name) helper that fetches /r/themes/<name>.json
• Zod schemas registryThemesIndexSchema and registryThemeSchema exported from ~/utils/get-registry
• Registry now ships a generated /r/themes/index.json alongside the per-theme JSON files

Tests: 18 new unit + integration tests covering rendering, merging, path resolution, network errors, and schema validation.

1.3.2

Patch Changes

• 918b34c: Strip workspace:* and catalog: protocol tokens from devDependencies/dependencies/peerDependencies of every public package before changeset publish. Previously published artifacts leaked these tokens into npm metadata, which broke strict resolvers (bun, deno) for downstream consumers. Adds scripts/clean-publish.ts and wires it into the root release script with a git checkout restore step so source remains workspace-friendly.

1.3.1

Patch Changes

• 7d6fb7b: Align tsconfig shared configs, fix TS strict mode errors (exactOptionalPropertyTypes, verbatimModuleSyntax), align package.json deps to catalog refs, apply biome lint fixes.

1.3.0

Minor Changes

• 6f0e067: Add --template flag to the init command for scaffolding projects from templates. Run npx @gentleduck/cli init --template acme to download and extract the acme monorepo template.

1.2.7

Patch Changes

• 42f8439: fix(cli): resolve monorepo config, CSS, and components to workspace directory

  • Write duck-ui.config.json to workspace instead of monorepo root
  • Write CSS theme file to workspace instead of monorepo root
  • Set workspace: { root: ".", project: "." } when config lives in workspace
  • Resolve config search path from workspace in all commands (init, add, update, diff, remove)
  • Fix tsconfig paths template to use ./src/* so components land in <workspace>/src/ui/
  • Add platform: 'node' to tsdown config for proper CJS/Node resolution

1.2.6

Patch Changes

• 2b6e8d0: Resolve all biome lint warnings, improve type safety, and add test coverage across the monorepo.

1.2.5

Patch Changes

• 288d274: fix: --yes flag now skips per-component overwrite prompts

  Previously only --force skipped overwrite prompts. Now --yes (non-interactive mode) also skips them, since the user explicitly opted out of interactive prompts.

• f45aa97: fix: show actual error output when dependency installation fails

  Previously stderr was suppressed with stdio:'ignore', making it impossible to diagnose install failures. Now the actual package manager error is included in the failure message.

1.2.4

Patch Changes

• 9a3a651: test: add test cases for dependency deduplication, registry dep filtering, and overwrite prompt behavior

• 4fc4d25: fix: deduplicate dependencies and skip already-installed components

  • Filter initial registry dependencies against already-installed top-level components to avoid false "already exists" prompts on first install
  • Move dependency deduplication to right before the package manager install so all collected deps (including from registry dependencies) are properly deduplicated

1.2.3

Patch Changes

• 22fa78f: fix: align ThemeResponse type with updated registry API response shape

  The theme registry endpoint now returns light, dark, and radius at the top level instead of nesting them under cssVars. Updated all consumers to match the new response shape.

1.2.2

Patch Changes

• 7c2aa88: Update dependencies and publish unpublished packages

1.2.1

Patch Changes

• c9bbef8: Documentation and style updates.

1.2.0

Minor Changes

• ad86755: Major CLI overhaul with interactive merge/diff GUI, architecture refactor, and comprehensive test coverage.

  Features:

• Add interactive merge GUI with three-way conflict resolution and syntax highlighting

• Add interactive diff viewer with side-by-side comparison

• Add figlet ASCII banner and dynamic terminal resize handling

• Add merge conflict marker colorization (ours=green, theirs=blue, base=yellow)

• Add --verbose flag for detailed logging output

• Add update, remove, and diff commands with workspace support

Architecture Refactor:

• Replace axios with native fetch API across all HTTP operations
• Split monolithic merge-screen into workflow hook and keyboard hook modules
• Split monolithic diff-screen into workflow hook and keyboard hook modules
• Extract shared utilities (formatting helpers, ANSI constants, type definitions)
• Consolidate scattered type definitions into centralized modules
• Add VimStdin.asInkStdin() method to encapsulate stream type casting

Infrastructure:

• Fix tsconfig module resolution (add module: esnext, change to bundler resolution)
• Sync local registry schema with canonical @gentleduck/registers source
• Add comprehensive vitest test suite with 170 tests across unit, integration, and e2e
• Add JSDoc documentation and inline comments throughout the codebase
• Clean up dependencies, deduplicate logic, remove dead code
• Fix critical bugs in install command, error handling, and binary resolution

1.1.0

Minor Changes

• Add robust monorepo workspace support across CLI commands.

  • Add --workspace <path> support for init, add, update, remove, and diff
  • Validate workspace targets (package.json and tsconfig.json where required)
  • Infer workspace from current directory when running inside a monorepo workspace
  • Improve config handling with legacy migration errors for missing workspace
  • Add command help/docs/test coverage for workspace behavior

1.0.11

Patch Changes

• Fix binary entry point resolution for global CLI installation via npx.