v2.2.0

Added

• scripts/check-links.mjs: handles single-quoted and unquoted attributes, flags empty href/src, decodes safely
• scripts/wiki-markdown.mjs: stripFrontMatter handles CRLF, BOM, no-trailing-newline, and empty front matter
• verify-docs-pipeline.mjs: AbortSignal timeout per fetch, 5xx vs 404 differentiation, attempts floored at 1

Changed

• release-prod.yml: publish to npm BEFORE creating tag/Release; full checkout history; release target is prod
• validate: no longer calls process.exit from inside the reusable command (callers pass {exit:false})
• doctor --json: output is now a single valid JSON object
• get: exit code is now 2 (not 0) when a component already exists without --force
• registry-install: vendor paths preserve subfolders; manifest records the real on-disk relative path

Fixed

• validate .specui now finds and checks the project-root AGENTS.md block
• add token: refuses to silently destroy existing themed maps or scalars without --force
• update --name : no longer crashes copying read-only .git/objects
• registry-install: closes path traversal in vendor writes
• get: caps recursive dependency installs and skips external-host deps by default
• check-links.mjs: regex no longer matches data-href/data-src; empty href flagged
• quick-start docs: get example uses a non-preset component; note about state-row-empty warnings
• scenarios docs: load uses bare relative path or file://; Scenario H no longer claims init without --force refreshes AGENTS.md