@jelinek/ui 0.5.0 → 0.5.1

package/README.md

@@ -464,24 +464,48 @@ cascade that `pnpm test`'s jsdom environment structurally cannot check
 The `publish` job is separate and gated on a tag matching `ui-v*` — it
 does not run on ordinary merges to `master`, only when someone pushes a
 `ui-v*` tag, and it also depends on `verify` passing first. It publishes
-to **npmjs.org with `--access public`**, authenticating with the
-`NPM_TOKEN` repo secret (a granular token for the `jelinek` npm org — a
-different namespace from the GitHub org, which is named
-`JELINEK-nabytek-a-matrace`). No provenance (`--provenance`) is
-generated: npm rejects it for builds from a private repository.
-
-**That job does not currently work, and 0.3.0 was released by hand.** npm
-requires a second factor for every publish, and a granular token only
-satisfies that if "Bypass two-factor authentication (2FA)" was ticked
-*when the token was created* — the setting cannot be added to an existing
-token, and npm is in the middle of restricting bypass tokens outright
-(account changes Aug 2026, direct publishing Jan 2027). Without it the
-registry answers a `PUT` with a misleading `E404 Not Found` in CI, and a
-clearer `E403 … Two-factor authentication or granular access token with
-bypass 2fa enabled is required` locally.
-
-So the working release procedure is manual, from a machine that can reach
-a browser:
+to **npmjs.org with `--access public`**.
+
+### Releasing
+
+1. Bump `version` in `svelte/package.json`, commit, push `master`.
+2. `git tag ui-v<version> && git push origin ui-v<version>`.
+3. `verify` runs, then `publish` — nothing else to do.
+
+The tag is what records which commit a version came from, so push it even
+if a release has to be finished by hand.
+
+### How the publish authenticates
+
+**Trusted publishing (GitHub Actions OIDC), no secret.** The job asks
+GitHub for an OIDC token and npm exchanges it for a short-lived publish
+credential. Registered on npmjs under the package's *Trusted publisher*:
+org `JELINEK-nabytek-a-matrace`, repo `brand-guide`, workflow filename
+`ui.yml`, environment left empty. All three are checked on every publish
+— **renaming `ui.yml`, or adding an `environment:` to the publish job,
+breaks releases** until the publisher entry is edited to match.
+
+Two consequences worth knowing:
+
+- The job runs `npm publish`, not `pnpm publish`. The OIDC exchange lives
+  in the npm CLI (11.5.1+, which the job installs explicitly); pnpm would
+  look for an auth token, find none, and fail.
+- Provenance stays off (`NPM_CONFIG_PROVENANCE=false`). npm can only
+  attest a build from a public repository and this one is private
+  (licensed fonts). Trusted publishing does not require provenance.
+
+There is no `NPM_TOKEN` secret any more. It never worked: npm requires a
+second factor for every publish, and a granular token only satisfies that
+if "Bypass two-factor authentication (2FA)" was ticked *when the token was
+created* — a setting that cannot be added afterwards, on a mechanism npm
+is retiring outright (account changes Aug 2026, direct publishing Jan
+2027). Without it the registry answered a `PUT` with a misleading `E404
+Not Found` in CI. 0.3.0 through 0.5.0 were released by hand because of it.
+
+### Fallback: publishing by hand
+
+If the job fails, the release is not stuck — publish from a machine that
+can reach a browser:
 
 ```
 cd svelte && npm publish --access public --auth-type=web
@@ -490,13 +514,7 @@ cd svelte && npm publish --access public --auth-type=web
 That prints a `npmjs.com/auth/cli/…` URL; approving it there with a
 passkey (or an authenticator app) completes the publish. `--otp=<code>`
 works too, but only with an authenticator app — a passkey produces no
-code. Push the `ui-v*` tag anyway: `verify` still gates the release, and
-the tag is what records which commit a version came from.
-
-Fixing CI means either a bypass-enabled token while npm still issues
-them, or trusted publishing via GitHub Actions OIDC — the latter is
-untested here and may be unavailable for the same reason provenance is,
-namely that this repo is private.
+code.
 
 ## Known design debt
 

package/dist/components/OptionTile.svelte

@@ -143,8 +143,13 @@
 			>
 				{#if swatchLabel}
 					<!-- Literal white + a soft shadow: the swatch is an arbitrary
-					     consumer colour, so no theme token can promise contrast. -->
-					<span class="font-semibold text-white [text-shadow:0_1px_2px_rgba(0,0,0,0.35)]"
+					     consumer colour, so no theme token can promise contrast.
+					     `font-bold`, not `font-semibold`: GT Walsheim Pro ships
+					     300/400/500/700/900 and no 600, so semibold silently
+					     renders as Medium 500 (e2e/font-faces.spec.ts caught it).
+					     `font-semibold` is only legal on the logo subtitle, which
+					     switches to Avenir Next, whose Demi *is* 600. -->
+					<span class="font-bold text-white [text-shadow:0_1px_2px_rgba(0,0,0,0.35)]"
 						>{swatchLabel}</span
 					>
 				{/if}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jelinek/ui",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "JELÍNEK Svelte 5 component kit, generated from the brand guide",
   "license": "UNLICENSED",
   "type": "module",