## 1.5.0

### Minor Changes

* 95638de: Audit-driven refactor across all 15 public packages. Closes type holes, hardens security boundaries, eliminates dead code, and dedups duplicated patterns.

  **Highlights**

  * `duck-docs` — CompiledMdxBody branded type gates `new Function(body)`; sanitizeSvg covers SMIL, unquoted javascript: URIs, nested script, CSS url(), bare iframe; code-preview tag + attr allowlists
  * `duck-registry-build` — safe-path containment at every fs sink; per-phase Zod cache schemas; JSON.stringify in generated TSX; cache manifest rejection on tamper
  * `duck-cli` — install pipeline path containment unified across add/init/update; env-var allowlist contract reconciled with one-time warning; aliases.ui regex validation
  * `duck-primitives` — `observe-element-rect` rAF loop guard (no leak when empty); `compose-ref` useCallback memo fix; popper forwardRef restored for R18 peer compat
  * `duck-hooks` — `useDebounce` is now a real hook (stable identity, unmount cleanup); `useStableId` delegates to React.useId (SSR-safe); `scheduleTransitionTimeout` rename strips two `useHookAtTopLevel` lint suppressions
  * `duck-lazy` — spread order fix restores the lazy swap; `next/image` moved behind `/lazy-image-next` subpath so non-Next consumers don't pull the peer
  * `duck-vim` — single document listener fans out to chord matcher + sequence manager; canonical modifier order; `requireReset` auto-clears for chord bindings; all three hook dep arrays corrected
  * `duck-variants` — `Props<T, D>` makes defaulted variant keys optional and non-defaulted required; bounded `preludeCache` LRU; second-layer `filter2` set eliminates last clone in hot path
  * `duck-ttest` — `predictates/` renamed to `predicates/`, twin dirs deleted, type-utility duplicates reconciled to canonical sources, `IsVoid` actually distinguishes void from undefined now
  * `duck-calendar` — `./*` wildcard export removed; falsy-zero `weekStartDay: 0` (Sunday) bug fixed; Gregorian helpers extracted; Hebrew `addMonths` uses Metonic cycle
  * `duck-libs` — `cnMemo` bounded LRU; `filteredObject` rejects typo keys at compile time; `parseDate` rejects ambiguous one-token inputs
  * `duck-query` — single AnyReq boundary cast replaces 14 `as any`; param regex escape; throws on unresolved `:tokens`
  * `registers` — schema tightened (`z.any()` removed); ~1000 LoC of identical block-registry boilerplate replaced with builders
  * `registry-ui` — `_audio` / `_upload` (~1.1K LoC) deleted; `motion-shell` HOC + `withMotion` collapses simple motion clones; `toDirection()` narrower replaces 52 `as IDirection.Kind` casts; chart `CSS_NAMED_COLORS` finite allowlist
  * `duck-motion` — refcounted body `pointer-events` ownership; easing/blur/duration token dedup; half of public exports were unused and removed

  Tests: 3133+ across the monorepo, all green. Type-checks clean across every project. No commits skipped hooks.

## 1.4.1

### Patch Changes

* 95dbbce: Standardize README headers across all packages: centered logo, h1, tagline, nav links, and npm badges (matching the @duck-md template). Replace per-repo `*.gentleduck.org` subdomain refs with path-based `gentleduck.org/duck-<name>` URLs. No runtime code changes.

## 1.4.0

### Minor Changes

* 09c11ed: Add `theme` command for managing theme tokens.

  Three subcommands:

  * `duck-cli theme list` — list every theme in the registry (`--json` for machine output)
  * `duck-cli theme info <name>` — print color tokens for one theme (`--json` supported)
  * `duck-cli theme add <name>` — install a theme into your `globals.css` (`--css <path>` to override)

  `theme add` writes a guarded block bracketed by `/* @gentleduck/cli theme:start */` and `/* @gentleduck/cli theme:end */`. Re-running `theme add` with another theme replaces the block in place, so swapping themes is a one-command operation. Defaults search the common globals.css locations (`app/globals.css`, `src/app/globals.css`, `src/index.css`, `src/styles/globals.css`, `styles/globals.css`).

  Backed by:

  * New `getRegistryThemesIndex()` helper that fetches `/r/themes/index.json`
  * New `getRegistryTheme(name)` helper that fetches `/r/themes/<name>.json`
  * Zod schemas `registryThemesIndexSchema` and `registryThemeSchema` exported from `~/utils/get-registry`
  * Registry now ships a generated `/r/themes/index.json` alongside the per-theme JSON files

  Tests: 18 new unit + integration tests covering rendering, merging, path resolution, network errors, and schema validation.

## 1.3.2

### Patch Changes

* 918b34c: Strip `workspace:*` and `catalog:` protocol tokens from `devDependencies`/`dependencies`/`peerDependencies` of every public package before `changeset publish`. Previously published artifacts leaked these tokens into npm metadata, which broke strict resolvers (bun, deno) for downstream consumers. Adds `scripts/clean-publish.ts` and wires it into the root `release` script with a `git checkout` restore step so source remains workspace-friendly.

## 1.3.1

### Patch Changes

* 7d6fb7b: Align tsconfig shared configs, fix TS strict mode errors (exactOptionalPropertyTypes, verbatimModuleSyntax), align package.json deps to catalog refs, apply biome lint fixes.

## 1.3.0

### Minor Changes

* 6f0e067: Add `--template` flag to the `init` command for scaffolding projects from templates. Run `npx @gentleduck/cli init --template acme` to download and extract the acme monorepo template.

## 1.2.7

### Patch Changes

* 42f8439: fix(cli): resolve monorepo config, CSS, and components to workspace directory

  * Write `duck-ui.config.json` to workspace instead of monorepo root
  * Write CSS theme file to workspace instead of monorepo root
  * Set `workspace: { root: ".", project: "." }` when config lives in workspace
  * Resolve config search path from workspace in all commands (init, add, update, diff, remove)
  * Fix tsconfig paths template to use `./src/*` so components land in `<workspace>/src/ui/`
  * Add `platform: 'node'` to tsdown config for proper CJS/Node resolution

## 1.2.6

### Patch Changes

* 2b6e8d0: Resolve all biome lint warnings, improve type safety, and add test coverage across the monorepo.

## 1.2.5

### Patch Changes

* 288d274: fix: --yes flag now skips per-component overwrite prompts

  Previously only --force skipped overwrite prompts. Now --yes (non-interactive mode) also skips them, since the user explicitly opted out of interactive prompts.

* f45aa97: fix: show actual error output when dependency installation fails

  Previously stderr was suppressed with stdio:'ignore', making it impossible to diagnose install failures. Now the actual package manager error is included in the failure message.

## 1.2.4

### Patch Changes

* 9a3a651: test: add test cases for dependency deduplication, registry dep filtering, and overwrite prompt behavior
* 4fc4d25: fix: deduplicate dependencies and skip already-installed components

  * Filter initial registry dependencies against already-installed top-level components to avoid false "already exists" prompts on first install
  * Move dependency deduplication to right before the package manager install so all collected deps (including from registry dependencies) are properly deduplicated

## 1.2.3

### Patch Changes

* 22fa78f: fix: align ThemeResponse type with updated registry API response shape

  The theme registry endpoint now returns `light`, `dark`, and `radius` at the top level instead of nesting them under `cssVars`. Updated all consumers to match the new response shape.

## 1.2.2

### Patch Changes

* 7c2aa88: Update dependencies and publish unpublished packages

## 1.2.1

### Patch Changes

* c9bbef8: Documentation and style updates.

## 1.2.0

### Minor Changes

* ad86755: Major CLI overhaul with interactive merge/diff GUI, architecture refactor, and comprehensive test coverage.

  **Features:**

  * Add interactive merge GUI with three-way conflict resolution and syntax highlighting
  * Add interactive diff viewer with side-by-side comparison
  * Add figlet ASCII banner and dynamic terminal resize handling
  * Add merge conflict marker colorization (ours=green, theirs=blue, base=yellow)
  * Add `--verbose` flag for detailed logging output
  * Add `update`, `remove`, and `diff` commands with workspace support

  **Architecture Refactor:**

  * Replace axios with native fetch API across all HTTP operations
  * Split monolithic merge-screen into workflow hook and keyboard hook modules
  * Split monolithic diff-screen into workflow hook and keyboard hook modules
  * Extract shared utilities (formatting helpers, ANSI constants, type definitions)
  * Consolidate scattered type definitions into centralized modules
  * Add VimStdin.asInkStdin() method to encapsulate stream type casting

  **Infrastructure:**

  * Fix tsconfig module resolution (add module: esnext, change to bundler resolution)
  * Sync local registry schema with canonical @gentleduck/registers source
  * Add comprehensive vitest test suite with 170 tests across unit, integration, and e2e
  * Add JSDoc documentation and inline comments throughout the codebase
  * Clean up dependencies, deduplicate logic, remove dead code
  * Fix critical bugs in install command, error handling, and binary resolution

## 1.1.0

### Minor Changes

* Add robust monorepo workspace support across CLI commands.

  * Add `--workspace <path>` support for `init`, `add`, `update`, `remove`, and `diff`
  * Validate workspace targets (`package.json` and `tsconfig.json` where required)
  * Infer workspace from current directory when running inside a monorepo workspace
  * Improve config handling with legacy migration errors for missing `workspace`
  * Add command help/docs/test coverage for workspace behavior

## 1.0.11

### Patch Changes

* Fix binary entry point resolution for global CLI installation via npx.