@abuzareal/contour-ui 0.6.3 → 0.6.4

package/README.md

@@ -8,7 +8,7 @@ Use it when you want this visual style with typed controls, feedback, navigation
 
 [Complete core component guides](COMPONENT-GUIDES.md) are maintained in a public authored dataset with runnable [family examples](examples/catalogue); they cover actual behavior as well as emitted props.
 
-This source checkout targets **0.6.3**. Package publication and application upgrades are separate; check the npm registry for release availability and each application's manifest for its installed version. Catalogue examples include application patterns as well as package components. Check the exports below before treating an example as an importable component.
+This source checkout targets **0.6.4**. Package publication and application upgrades are separate; check the npm registry for release availability and each application's manifest for its installed version. Catalogue examples include application patterns as well as package components. Check the exports below before treating an example as an importable component.
 
 [Public API and maturity register](PUBLIC-API.md) · [Architecture, scope and compatibility](CONTRACTS.md)
 
@@ -25,7 +25,7 @@ Version 0.6 adds a single-select [Combobox](COMBOBOX.md) backed by pinned Base U
 Use an existing React application with a bundler that resolves package CSS imports. Contour ships ESM and TypeScript declarations. The package declares Node.js 22 or newer; repository tooling uses Vite 8, which needs Node.js 22.12+ or 24+.
 
 ```sh
-npm install @abuzareal/contour-ui@0.6.3 --save-exact
+npm install @abuzareal/contour-ui@0.6.4 --save-exact
 ```
 
 Your app must provide matching `react` and `react-dom` versions: **18.3.1 or React 19**. The compatibility script covers 18.3.1, 19.0.0, and 19.3.0; it doesn't establish support for every framework or React Server Component setup. Put interactive components inside a client boundary when your framework requires one.
@@ -182,7 +182,7 @@ Give scenes a sized container and a usable static fallback. `SceneBoundary` hide
 **0.2.0** adds native field refs, controlled tabs and popover/menu open state, menu keyboard improvements, native reset synchronization, Three.js lifecycle fixes and a tested Next.js App Router integration. Existing uncontrolled defaults and React 18/19 support remain. `fonts-latin.css`, introduced in 0.1.2, now uses packaged relative font URLs for webpack resolution. `CHANGELOG.md` is included in the package archive and [npm's Code view](https://www.npmjs.com/package/@abuzareal/contour-ui?activeTab=code); it contains the upgrade details for each version.
 
 ```sh
-npm install @abuzareal/contour-ui@0.6.3 --save-exact
+npm install @abuzareal/contour-ui@0.6.4 --save-exact
 ```
 
 Commit your manifest and lockfile, run your application's checks, and review both themes, dialogs, forms, and motion before deploying. Version 0.1.1 includes a document scroll lock for dialogs and drawers. Review any app-level lock before removing it, including nested dialogs and short screens. Package publication doesn't update deployed consumers automatically.
@@ -250,7 +250,7 @@ export function AccountControls() {
 }
 ```
 
-Interactive module boundaries retain `use client` in the built package. The pinned Next.js App Router consumer checks the packed candidate archive. Follow [Next.js setup](NEXTJS.md) for the pinned Next.js 16.4.0 / React 19.3.0 pair. Pure URL/theme-bootstrap helpers remain usable from the server. A separate fixture mode checks lazy optional Three.js loading and navigation cleanup. Lenis integration, other Next versions and alternate bundlers remain separate compatibility questions.
+Interactive module boundaries retain `use client` in the built package. The pinned Next.js App Router consumer checks the packed candidate archive. Follow [Next.js setup](NEXTJS.md) for the pinned Next.js 16.4.3 / React 19.3.0 pair. Pure URL/theme-bootstrap helpers remain usable from the server. A separate fixture mode checks lazy optional Three.js loading and navigation cleanup. Lenis integration, other Next versions and alternate bundlers remain separate compatibility questions.
 
 Custom `useThreeStage` setup can register disposal through `context.onDispose?.(cleanup)` immediately after acquiring each resource, including resources allocated before setup returns. Registered resources are released on failed initialization and unmount; avoid also disposing the same resource in `StageScene.dispose`. A stage may implement `resize()` to reflow after aspect changes while motion is paused.
 

package/RECIPES.md

@@ -40,4 +40,4 @@ The optional **password visibility recipe** keeps the same input mounted, name a
 
 Use native p/span and h1–h6 with [typography tokens](STYLING.md). Heading level follows the document outline; size/weight are CSS choices. No Text/Heading wrappers are added without an independent semantic/variant contract. These explicit scope decisions do not complete deferred NumberField, full grid, calendar or other optional features.
 
-[Report Table/recipes 0.6.3](https://github.com/abuzareal/contour-ui/issues/new?template=bug_report.yml&title=Table%20recipes%200.6.3%3A%20&component=Table%20recipes&version=0.6.3); [standalone reproduction](examples/reproduction). See [public API](PUBLIC-API.md) for exact types, [styling](STYLING.md) and [onboarding](GETTING-STARTED.md). Release source links become available with the published tag.
+[Report Table/recipes 0.6.4](https://github.com/abuzareal/contour-ui/issues/new?template=bug_report.yml&title=Table%20recipes%200.6.4%3A%20&component=Table%20recipes&version=0.6.4); [standalone reproduction](examples/reproduction). See [public API](PUBLIC-API.md) for exact types, [styling](STYLING.md) and [onboarding](GETTING-STARTED.md). Release source links become available with the published tag.

package/REFERENCE.md

@@ -1,6 +1,6 @@
 # Export reference register
 
-Generated for 0.6.3 from actual source/runtime declarations and the manifest. This register maps all symbols and CSS/data entry points; it does not promote every component page. Human behavior guidance lives in the linked references. Source and exact types remain in [PUBLIC-API.md](PUBLIC-API.md). Run npm run check:reference; newly added hook/helper sources need an authored mapping before this register can update.
+Generated for 0.6.4 from actual source/runtime declarations and the manifest. This register maps all symbols and CSS/data entry points; it does not promote every component page. Human behavior guidance lives in the linked references. Source and exact types remain in [PUBLIC-API.md](PUBLIC-API.md). Run npm run check:reference; newly added hook/helper sources need an authored mapping before this register can update.
 
 | Entry | Symbol | Kind | Reference |
 | --- | --- | --- | --- |

package/SIZE.md

@@ -8,7 +8,7 @@ CONTOUR_SIZE_OUTPUT=/absolute/path/sizes.json npm run measure:size
 CONTOUR_SIZE_OUTPUT=/absolute/path/check.json npm run check:size
 ```
 
-Set `CONTOUR_ARCHIVE` to the already packed candidate to reuse it. Fixtures install React/React DOM 19.3.0; Next uses 16.4.0, and Vite/Chromium/Node versions are recorded from the running tools. The report names package/source commit/dirty state, archive checksum/files/compressed/unpacked bytes, the fresh dependency lock hash, resolved dependency versions, fixtures, exclusions, raw/gzip file sizes and actual Resource Timing transfers. These are reproducible fixtures, not latency or production-site benchmarks. No React/framework externals are removed from the application totals. Next shared JS is the intersection of actually fetched URLs across the measured fresh routes; route-specific JS is listed separately. Server build output is excluded from client bytes.
+Set `CONTOUR_ARCHIVE` to the already packed candidate to reuse it. Fixtures install React/React DOM 19.3.0; Next uses 16.4.3, and Vite/Chromium/Node versions are recorded from the running tools. The report names package/source commit/dirty state, archive checksum/files/compressed/unpacked bytes, the fresh dependency lock hash, resolved dependency versions, fixtures, exclusions, raw/gzip file sizes and actual Resource Timing transfers. These are reproducible fixtures, not latency or production-site benchmarks. No React/framework externals are removed from the application totals. Next shared JS is the intersection of actually fetched URLs across the measured fresh routes; route-specific JS is listed separately. Server build output is excluded from client bytes.
 
 Raw minified JS/CSS is reported per actual fetched file and by fixture. Gzip level 9 is reported **per file**, never summed and advertised as an application gzip total. Network transfer, encoded body and decoded body measurements are kept separately, including document/RSC resources. CSS/font requests, archive size and library dependency-closure installed file bytes are separate categories. Install counts exclude Next/Vite/development tooling and record React peers separately. Optional Three.js, Lenis and RHF are absent from core fixtures.
 
@@ -46,6 +46,6 @@ Three.js/Lenis stay optional peers behind their entries. Core imports do not ins
 
 ## 0.6 Combobox measurement
 
-On 14 October 2026, an initial 0.6.0 candidate used the same production fixtures to measure the new Combobox journey with React 19.3.0, Vite 8.3.2, Next 16.4.0/webpack, Node 26.10.0 and Chromium 153. A fresh Vite page fetched 365,549 raw JS bytes; selective forms/actions CSS fetched 24,729 bytes (aggregate 47,625). The Next Combobox route fetched 593,605 raw client JS bytes and 46,807 CSS bytes, including framework/shared assets. These are dated candidate measurements, not immutable final-archive byte counts. The release gate remeasures its exact archive. These whole-application fixtures are not an isolated component size or an upstream bundle-size badge. Per-file gzip and actual Resource Timing are retained in the report; independent gzip files are not advertised as an additive component total.
+On 14 October 2026, an initial 0.6.0 candidate used the same production fixtures to measure the new Combobox journey with React 19.3.0, Vite 8.3.2, Next 16.4.3/webpack, Node 26.10.0 and Chromium 153. A fresh Vite page fetched 365,549 raw JS bytes; selective forms/actions CSS fetched 24,729 bytes (aggregate 47,625). The Next Combobox route fetched 593,605 raw client JS bytes and 46,807 CSS bytes, including framework/shared assets. These are dated candidate measurements, not immutable final-archive byte counts. The release gate remeasures its exact archive. These whole-application fixtures are not an isolated component size or an upstream bundle-size badge. Per-file gzip and actual Resource Timing are retained in the report; independent gzip files are not advertised as an additive component total.
 
 Every previous journey stays within its existing budget. Initial Combobox budgets are added separately under the same 10% plus 1,024-byte policy; old budgets are not reset to the new measurements. The root Button fixture remains 227,291 raw Vite JS bytes with zero font requests; importing one component does not require downloading the Combobox route's full client code. All runtime dependencies still install with the package. Base UI adds installed files and an unstyled interaction dependency; see FOUNDATION.md for the identical-host comparison and its limitations. Its optional date/time peers are absent from core consumers. TanStack Table/Store and RHF are recipe dependencies only.

package/STYLING.md

@@ -69,4 +69,4 @@ Forced-color rules preserve focus, selected control outlines, radio marks, inval
 
 ## Version and reproduction
 
-Reference version **0.6.3**. A source version does not establish publication; check the npm registry for availability. [Versioned source](https://github.com/abuzareal/contour-ui/tree/v0.6.3/src) and [emitted type inventory](PUBLIC-API.md) describe this contract; tag links resolve after release. [Report Styles 0.6.3](https://github.com/abuzareal/contour-ui/issues/new?template=bug_report.yml&component=Styles&version=0.6.3), using the [public minimal reproduction](examples/reproduction) and synthetic data.
+Reference version **0.6.4**. A source version does not establish publication; check the npm registry for availability. [Versioned source](https://github.com/abuzareal/contour-ui/tree/v0.6.4/src) and [emitted type inventory](PUBLIC-API.md) describe this contract; tag links resolve after release. [Report Styles 0.6.4](https://github.com/abuzareal/contour-ui/issues/new?template=bug_report.yml&component=Styles&version=0.6.4), using the [public minimal reproduction](examples/reproduction) and synthetic data.

package/SUPPORT.md

@@ -33,4 +33,4 @@ Every result should name package/commit/archive, date, OS/browser/tool versions,
 
 ## Version and reproduction
 
-Reference version **0.6.3**. A source version does not establish publication; check the npm registry for availability. [Versioned source](https://github.com/abuzareal/contour-ui/tree/v0.6.3/src) and [emitted type inventory](PUBLIC-API.md) describe this contract; tag links resolve after release. [Report Support matrix 0.6.3](https://github.com/abuzareal/contour-ui/issues/new?template=bug_report.yml&component=Support%20matrix&version=0.6.3), using the [public minimal reproduction](examples/reproduction) and synthetic data.
+Reference version **0.6.4**. A source version does not establish publication; check the npm registry for availability. [Versioned source](https://github.com/abuzareal/contour-ui/tree/v0.6.4/src) and [emitted type inventory](PUBLIC-API.md) describe this contract; tag links resolve after release. [Report Support matrix 0.6.4](https://github.com/abuzareal/contour-ui/issues/new?template=bug_report.yml&component=Support%20matrix&version=0.6.4), using the [public minimal reproduction](examples/reproduction) and synthetic data.

package/THREE.md

@@ -37,4 +37,4 @@ Use one stage owner per host, stable setup and deliberate size. Product controls
 
 ## Version and reproduction
 
-Reference version **0.6.3**. A source version does not establish publication; check the npm registry for availability. [Versioned source](https://github.com/abuzareal/contour-ui/tree/v0.6.3/src) and [emitted type inventory](PUBLIC-API.md) describe this contract; tag links resolve after release. [Report Three 0.6.3](https://github.com/abuzareal/contour-ui/issues/new?template=bug_report.yml&component=Three&version=0.6.3), using the [public minimal reproduction](examples/reproduction) and synthetic data.
+Reference version **0.6.4**. A source version does not establish publication; check the npm registry for availability. [Versioned source](https://github.com/abuzareal/contour-ui/tree/v0.6.4/src) and [emitted type inventory](PUBLIC-API.md) describe this contract; tag links resolve after release. [Report Three 0.6.4](https://github.com/abuzareal/contour-ui/issues/new?template=bug_report.yml&component=Three&version=0.6.4), using the [public minimal reproduction](examples/reproduction) and synthetic data.

package/dist/components/ui/Avatar.js

@@ -1,12 +1,16 @@
+"use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 /** Round avatar showing a photo or Space Grotesk initials, with an optional presence dot. */
+import { useState } from "react";
 import { ccx } from "../../lib/classNames.js";
 const initialsOf = (name) => name
-    .split(" ")
+    .trim()
+    .split(/\s+/)
     .map((part) => part[0])
     .slice(0, 2)
     .join("")
     .toUpperCase();
 export default function Avatar({ name, initials, src, size = "md", status, statusLabel, }) {
-    return (_jsxs("span", { className: ccx("avatar", `avatar-${size}`), children: [src ? (_jsx("img", { src: src, alt: name, loading: "lazy", decoding: "async" })) : (_jsx("span", { role: "img", "aria-label": name, className: ccx("avatar-initials"), children: initials ?? initialsOf(name) })), status && (_jsx("span", { className: ccx("avatar-status", `avatar-status-${status}`), role: "img", "aria-label": statusLabel ?? (status === "online" ? "Online" : "Away") }))] }));
+    const [failedSource, setFailedSource] = useState();
+    return (_jsxs("span", { className: ccx("avatar", `avatar-${size}`), children: [src && src !== failedSource ? (_jsx("img", { src: src, alt: name, loading: "lazy", decoding: "async", onError: () => setFailedSource(src) }, src)) : (_jsx("span", { role: "img", "aria-label": name, className: ccx("avatar-initials"), children: initials ?? initialsOf(name) })), status && (_jsx("span", { className: ccx("avatar-status", `avatar-status-${status}`), role: "img", "aria-label": statusLabel ?? (status === "online" ? "Online" : "Away") }))] }));
 }

package/dist/components/ui/SegmentedControl.js

@@ -6,11 +6,12 @@ import { useRef } from "react";
 import { nextIndexForKey } from "../../lib/keyboard.js";
 export default function SegmentedControl({ label, options, value, onChange, }) {
     const buttons = useRef([]);
+    const focusIndex = Math.max(0, options.findIndex((option) => option.value === value));
     return (_jsx("div", { className: ccx("segmented"), role: "radiogroup", "aria-label": label, children: options.map((option, index) => {
             const selected = option.value === value;
             return (_jsx("button", { ref: (element) => {
                     buttons.current[index] = element;
-                }, type: "button", role: "radio", "aria-checked": selected, tabIndex: selected ? 0 : -1, className: ccx("segmented-option"), onClick: () => onChange(option.value), onKeyDown: (event) => {
+                }, type: "button", role: "radio", "aria-checked": selected, tabIndex: index === focusIndex ? 0 : -1, className: ccx("segmented-option"), onClick: () => onChange(option.value), onKeyDown: (event) => {
                     const next = nextIndexForKey(event.key, index, options.length, "horizontal", event.currentTarget.ownerDocument.defaultView?.getComputedStyle(event.currentTarget).direction === "rtl"
                         ? "rtl"
                         : "ltr");

package/dist/components/ui/ToastProvider.js

@@ -7,14 +7,26 @@ import { ToastContext, } from "../../hooks/useToast.js";
 import { ccx } from "../../lib/classNames.js";
 const autoDismissAfter = 5000;
 function Toast({ toast, onDismiss, dismissLabel, }) {
-    const [paused, setPaused] = useState(false);
+    const [hovered, setHovered] = useState(false);
+    const [focused, setFocused] = useState(false);
+    const [hidden, setHidden] = useState(false);
+    const paused = hovered || focused || hidden;
+    useEffect(() => {
+        const update = () => setHidden(document.visibilityState === "hidden");
+        update();
+        document.addEventListener("visibilitychange", update);
+        return () => document.removeEventListener("visibilitychange", update);
+    }, []);
     useEffect(() => {
         if (paused)
             return;
         const timer = window.setTimeout(() => onDismiss(toast.id), autoDismissAfter);
         return () => window.clearTimeout(timer);
     }, [paused, toast.id, onDismiss]);
-    return (_jsxs("li", { className: ccx("toast", `toast-${toast.tone ?? "neutral"}`), onPointerEnter: () => setPaused(true), onPointerLeave: () => setPaused(false), onFocus: () => setPaused(true), onBlur: () => setPaused(false), children: [_jsx("span", { className: ccx("toast-bar"), "aria-hidden": "true" }), _jsxs("div", { className: ccx("toast-content"), children: [_jsx("strong", { children: toast.title }), toast.message && _jsx("p", { children: toast.message })] }), _jsx("button", { type: "button", className: ccx("toast-close"), "aria-label": dismissLabel, onClick: () => onDismiss(toast.id), children: _jsx(X, { size: 15 }) })] }));
+    return (_jsxs("li", { className: ccx("toast", `toast-${toast.tone ?? "neutral"}`), onPointerEnter: () => setHovered(true), onPointerLeave: () => setHovered(false), onFocus: () => setFocused(true), onBlur: (event) => {
+            if (!event.currentTarget.contains(event.relatedTarget))
+                setFocused(false);
+        }, children: [_jsx("span", { className: ccx("toast-bar"), "aria-hidden": "true" }), _jsxs("div", { className: ccx("toast-content"), children: [_jsx("strong", { children: toast.title }), toast.message && _jsx("p", { children: toast.message })] }), _jsx("button", { type: "button", className: ccx("toast-close"), "aria-label": dismissLabel, onClick: () => onDismiss(toast.id), children: _jsx(X, { size: 15 }) })] }));
 }
 export default function ToastProvider({ children, label = "Notifications", dismissLabel = "Dismiss notification", }) {
     const [toasts, setToasts] = useState([]);

package/docs/component-guides.json

@@ -64,7 +64,7 @@
           "initials / src",
           "string",
           "Derived initials / omitted",
-          "No automatic failed-image-to-initials switch."
+          "Failed images fall back to initials. Changing src attempts the new image."
         ],
         ["size", "sm | md | lg | xl", "md", "Visual size only."],
         [
@@ -80,10 +80,10 @@
       "detail": {
         "use": "Use for identity context. Do not use initials or a presence color as the sole explanation of a person/action; put actionable behavior on a separate native control.",
         "anatomy": "Wrapper holds an img with alt=name or a role=img initials span; optional presence dot has its own accessible label.",
-        "state": "src chooses image versus initials. initials overrides a basic first-two-space-separated-name-parts derivation. size defaults md; status is caller-supplied online/away.",
+        "state": "src chooses image versus initials. initials overrides a first-two-whitespace-separated-name-parts derivation. size defaults md; status is caller-supplied online/away.",
         "forms": "Not a successful form control: no name, required constraint or native reset behavior. Reset any application-owned content/request state separately.",
         "ref": "No public native-element ref is forwarded. Keep focus on actual native interactive children rather than making the presentation wrapper focusable.",
-        "edgeCases": "If an image fails, native alt text remains; the app must remove/change src to select initials. Test empty/long names and unavailable status without inventing live presence.",
+        "edgeCases": "A failed image falls back to explicit initials or initials derived from the name. A new src attempts a new image. Supply a new URL to retry a previously failed source.",
         "localization": "Supply explicit initials for scripts/emoji/name order that basic splitting cannot handle. Translate statusLabel and keep full accessible names meaningful.",
         "reference": "props",
         "styling": "Use .contour-avatar, size and presence hooks with released semantic color/line/spacing tokens. Preserve native structure, visible labels and owned state/ARIA; visual customization does not change the interaction contract."
@@ -1344,8 +1344,8 @@
           "Update the selected value; no default/uncontrolled API."
         ]
       ],
-      "keyboard": "Tab enters the selected button. Arrows/Home/End move and select with RTL-aware horizontal navigation; Enter/Space uses native button activation.",
-      "limits": "No name/form/required serialization, disabled-option support, async state or forwarded aggregate ref. An absent selected value leaves no selected tab stop; validate it in the parent.",
+      "keyboard": "Tab enters the selected button. Arrows/Home/End move and select with RTL-aware horizontal navigation; Enter/Space uses native button activation. If value is absent from the options, the first option remains reachable with Tab without silently changing the controlled value.",
+      "limits": "No name/form/required serialization, disabled-option support, async state or forwarded aggregate ref. An absent value remains unselected; the first option stays keyboard reachable. Reconcile application state in the parent.",
       "tasks": "A controlled single-choice button group with radio semantics and roving focus. Use for a small mutually exclusive view/filter choice. Use native RadioGroup for successful form inputs and required validation; this does not create a global density/theme API.",
       "detail": {
         "use": "Use for a small mutually exclusive view/filter choice. Use native RadioGroup for successful form inputs and required validation; this does not create a global density/theme API.",
@@ -2088,10 +2088,10 @@
       "detail": {
         "use": "Use for brief established outcomes. Keep actionable errors beside the task; use an in-page alert for a failure that needs sustained attention.",
         "anatomy": "Provider owns a polite notification region with up to the latest three messages and dismiss buttons. Descendants call useToast().show({title,message?,tone?}).",
-        "state": "The queue auto-dismisses after five seconds and pauses while hovered/focused. show reports an outcome; it does not run an operation. There are no IDs, update commands, undo or durable inbox.",
+        "state": "The queue auto-dismisses after five seconds and pauses while hovered, focused or in a hidden document. show reports an outcome; it does not run an operation. There are no IDs, update commands, undo or durable inbox.",
         "forms": "No native form value or reset contract. Notify only after a real save result, and preserve field validation in the form.",
         "ref": "No native provider ref. Calling useToast outside the provider throws; mount a provider around actual consumers.",
-        "edgeCases": "Rapid messages displace older entries. Do not put the only record of a failure in a temporary toast. Respect focus/motion and test translated long messages.",
+        "edgeCases": "Dismissal pauses while the toast is hovered, contains keyboard focus, or the document is hidden. Once all pause conditions clear, a fresh five-second reading period begins. The queue retains up to three notifications.",
         "localization": "Set label and dismissLabel on the provider and translate each title/message. Manual screen-reader announcement review remains pending; polite markup is not proof of every announcement.",
         "reference": "hooks",
         "styling": "Use the released scoped CSS and semantic tokens inside contour-root/ThemeScope. Preserve native semantics, public part/state hooks and geometry ownership; see the component-specific anatomy and STYLING.md."

package/docs/prop-metadata.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.6.3",
+  "version": "0.6.4",
   "compiler": "5.9.3",
   "scope": "All exported component contracts from emitted declarations, including call/construct signatures and authored/inherited prop names. Selected prop types include authored guide fields, owned fields and native integration attributes. Only explicit source parameter initializers are defaults; absence is not a browser default inference.",
   "components": {

package/examples/catalogue/theme-copy.tsx

@@ -7,7 +7,7 @@ import {
 
 export default function PreferencesAndCopy({
   animate = true,
-  command = "npm install @abuzareal/contour-ui@0.6.3 --save-exact",
+  command = "npm install @abuzareal/contour-ui@0.6.4 --save-exact",
 }: {
   animate?: boolean;
   command?: string;

package/examples/reproduction/package.json

@@ -13,7 +13,7 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@abuzareal/contour-ui": "0.6.3",
+    "@abuzareal/contour-ui": "0.6.4",
     "react": "18.3.1",
     "react-dom": "18.3.1"
   },
@@ -22,6 +22,6 @@
     "@types/react-dom": "18.3.7",
     "@types/node": "26.6.5",
     "typescript": "5.9.3",
-    "vite": "8.3.2"
+    "vite": "8.3.5"
   }
 }

package/examples/starters/next/README.md

@@ -9,7 +9,7 @@ npm run build
 npm start
 ```
 
-Direct versions: Contour 0.6.1, Next 16.4.0, React/React DOM 19.3.0, TypeScript 7.0.2; webpack explicitly selected. Commit the generated application lockfile and use npm ci afterward. There are no workspace aliases, optional Three/Lenis peers, fonts or required providers. To opt into branded fonts, import `@abuzareal/contour-ui/fonts-latin.css` in app/layout.tsx. Root CSS and route composition belong to the application.
+Direct versions: Contour 0.6.4, Next 16.4.3, React/React DOM 19.3.0, TypeScript 7.0.2; webpack explicitly selected. Commit the generated application lockfile and use npm ci afterward. There are no workspace aliases, optional Three/Lenis peers, fonts or required providers. To opt into branded fonts, import `@abuzareal/contour-ui/fonts-latin.css` in app/layout.tsx. Root CSS and route composition belong to the application.
 
 layout.tsx and the page are server components. Demo.tsx owns client state, refs and handlers. The pure theme-bootstrap subpath is server-safe; before-paint script changes only the root theme attribute and theme-color. The root's suppressHydrationWarning is narrowly for this attribute, not a workaround for arbitrary mismatches.
 

package/examples/starters/next/package.json

@@ -13,10 +13,10 @@
     "start": "next start"
   },
   "dependencies": {
-    "@abuzareal/contour-ui": "0.6.3",
+    "@abuzareal/contour-ui": "0.6.4",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "next": "16.4.0"
+    "next": "16.4.3"
   },
   "devDependencies": {
     "@types/react": "19.3.0",

package/examples/starters/vite/README.md

@@ -9,7 +9,7 @@ npm run build
 npm run preview
 ```
 
-Uses Contour 0.6.1, React/React DOM 18.3.1, TypeScript 5.9.3 and Vite 8.3.2. No aliases, workspace links, optional peers, font download, private catalogue or provider are required. Scoped CSS includes tokens and component families without the legacy global reset. The application owns the small body/layout stylesheet. Optional branded fonts: import `@abuzareal/contour-ui/fonts-latin.css` once.
+Uses Contour 0.6.4, React/React DOM 18.3.1, TypeScript 5.9.3 and Vite 8.3.5. No aliases, workspace links, optional peers, font download, private catalogue or provider are required. Scoped CSS includes tokens and component families without the legacy global reset. The application owns the small body/layout stylesheet. Optional branded fonts: import `@abuzareal/contour-ui/fonts-latin.css` once.
 
 The Vite config inserts the exact released theme bootstrap before the application, with a calculated CSP script hash. Keep the placeholder in index.html; recalculate through the build after upgrades. Script execution is restricted; style attributes are allowed because popup positioning and some components use inline styles. Extend connect-src intentionally for your service/development socket. An HTTP CSP header may replace this meta policy if it contains the same hash. See the package GETTING-STARTED.md for embedded themes and optional features.
 

package/examples/starters/vite/package.json

@@ -13,7 +13,7 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@abuzareal/contour-ui": "0.6.3",
+    "@abuzareal/contour-ui": "0.6.4",
     "react": "18.3.1",
     "react-dom": "18.3.1"
   },
@@ -22,6 +22,6 @@
     "@types/react-dom": "18.3.7",
     "@types/node": "26.6.5",
     "typescript": "5.9.3",
-    "vite": "8.3.2"
+    "vite": "8.3.5"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abuzareal/contour-ui",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "private": false,
   "description": "Editorial React components, themes, restrained motion, and optional Three.js objects.",
   "type": "module",
@@ -156,7 +156,7 @@
     "react-dom": "18.3.1",
     "three": "^0.186.1",
     "typescript": "^5.5.3",
-    "vite": "^8.3.2"
+    "vite": "^8.3.5"
   },
   "engines": {
     "node": ">=22"