v0.10.0

[0.10.0] - 2026-04-09

Synchronized version bump for all @stackbilt/* packages to 0.10.0.

Added

• charter blast <files> — Compute blast radius for a set of seed files. Builds a reverse dependency graph by walking TS/JS imports and BFS-traverses up to a configurable depth. Reports affected files, hot files (most imported), and warns on ≥20-file blast radius as a CROSS_CUTTING signal.

  Import resolution handles: ES modules, CommonJS require, dynamic import(), re-exports, ESM .js → .ts rewrite, tsconfig path aliases (including extends chains), src/index.* monorepo fallback, package.json source/types/main fields, index files, cycles, and comment stripping. Zero runtime dependencies.

• charter surface — Extract the API surface of a project. Detects HTTP routes from Hono, Express, and itty-router (regex-based, requires / prefix to reduce false positives) and parses D1/SQLite CREATE TABLE statements with column flags (pk, unique, nullable, default). Strips block and line comments before scanning. Ignores __tests__/, *.test.*, *.spec.* files. Supports --markdown output for injection into .ai/ modules or AI mission briefs. Zero runtime dependencies.

• @stackbilt/blast — New standalone package exporting buildGraph, blastRadius, extractImports, resolveSpecifier, topHotFiles. 19 tests.

• @stackbilt/surface — New standalone package exporting extractSurface, extractRoutes, extractSchema, formatSurfaceMarkdown. 14 tests.

• .ai/analysis.adf — New on-demand ADF module documenting the analysis subsystem (blast + surface). Triggers on blast, surface, dependency graph, blast radius, route extraction, schema extraction.

Rationale

Originally inspired by analysis of the CodeSight project's blast-radius and route-detection patterns. Extracted the two highest-value algorithms into Charter as deterministic (no LLM) commands that feed into governance workflows: blast radius for CROSS_CUTTING classification, surface extraction for auto-generated .ai/surface.adf modules and cc-taskrunner mission-brief fingerprinting.

Validated on

Real-world dogfooding caught six bugs that made it into the first commit and were fixed before release:

1. Global CLI flags (--format, --config) being swept into positional seed list
2. JSDoc example strings matching as real routes
3. Test fixture routes matching as real routes
4. tsconfig extends chain not being followed, breaking monorepo alias resolution
5. Package alias resolving to compiled .d.ts instead of source .ts
6. ESM .js → .ts extension rewrite missing for TypeScript ESM projects

Validation runs:

• AEGIS web Worker (263 files): 95 routes + 50 D1 tables extracted in ~15s. dispatch.ts blast radius = 72, types.ts = 127, PWA fix files = 1.
• Charter monorepo (121 files): 0 routes (correctly identifies as CLI, not Worker). packages/types/src/index.ts blast radius = 27 files across cli/adf/git/validate/drift.

All 345 existing tests pass.

What's Changed

• [auto] [Issue #59] Suppress release.yml false-failure notifications by @stackbilt-admin in #62
• [auto] [Issue #61] Guided onboarding for charter init by @stackbilt-admin in #63
• [auto] fix: bootstrap --yes vs --force separation + backup + orphan detection by @stackbilt-admin in #67
• fix: sentinel awareness, fmt normalization, lifecycle-scaled scoring by @stackbilt-admin in #76
• chore(deps): bump @types/node from 25.2.3 to 25.5.0 by @dependabot[bot] in #84
• chore(ci): bump pnpm/action-setup from a15d269cd4658e1107c09f1fabf4cbd7bd1f308a to fc06bc1257f339d1d5d8b3a19a8cae5388b55320 by @dependabot[bot] in #78
• chore(ci): bump actions/upload-artifact from 4.6.2 to 7.0.0 by @dependabot[bot] in #77
• chore(deps): bump @modelcontextprotocol/sdk from 1.27.1 to 1.29.0 by @dependabot[bot] in #83
• docs: add WSL2 + Windows filesystem install guidance by @stackbilt-admin in #91
• fix(cli): vendor scaffold-response types, unblock 0.10.0 publish by @stackbilt-admin in #93

New Contributors

• @dependabot[bot] made their first contribution in #84

Full Changelog: v0.9.2...v0.10.0