@naeil/ui 0.13.0 → 0.13.1

package/CHANGELOG.md

@@ -1,8 +1,15 @@
 # Changelog
 
-## 0.13.0 — design-system audit fixes and owned-service headers (unpublished candidate)
+## 0.13.1 — publication and auto-update policy (unpublished candidate)
 
-Not published. Includes PR #47 (design-system audit fixes, based on the 2026-11-12 audit b17a015) and PR #48 (owned-service header profiles). Public imports, exports, types and consumer `className` overrides are preserved; changed defaults are listed under compatibility.
+Not published. Docs-only patch to exercise the protected npm publishing workflow and the services' auto-update flow. Since frozen 0.13.0 source `08ee159`, the only package-shipped change on main is `docs/package-release.md` from #50: same-major consumer updates, a new major for public API/header-contract breaks (including 1.0.0 for a header break while on 0.x), and protected exact-archive publication guidance.
+
+- Component code, public APIs, header markup/geometry, styles, dependencies and chrome contract 1 are unchanged.
+- Package metadata, generated `/release`, React/Next fixture versions and maintained guidance move to 0.13.1. The owner approved publication directly to `latest` for Dependabot visibility; `next` stays 0.13.0 unless separately moved. Publication, environment approval, source tag/Release and manual service deployments remain separate actions.
+
+## 0.13.0 — design-system audit fixes and owned-service headers (published 2026-11-12)
+
+Published to `next` on 2026-11-12; registry bytes matched the frozen archive on 2026-11-13 JST. The preparation notes below retain their original scope. Includes PR #47 (design-system audit fixes, based on the 2026-11-12 audit b17a015) and PR #48 (owned-service header profiles). Public imports, exports, types and consumer `className` overrides are preserved; changed defaults are listed under compatibility.
 
 - Header: add opt-in `service`, `NaeilService`, `NaeilServiceHeaderProps` and readonly `naeilServices` through standalone/provider chrome entries. The DS owns lowercase service branding, product-only tabs and canonical toolbar; toolbar-only mobile sheets omit empty navigation and restore visible toolbar focus on desktop crossing. Generic Navigation exposes opt-in `omitEmptyNavigation` (default false preserves B1). Keep `NaeilHeaderProps` as the extensible legacy interface; service-first/legacy-last component overloads preserve inferred legacy props. Invalid runtime service ids fall back to the legacy profile with a development-only warning; the warning guard tolerates absent `process`. Add four service stories and matching browser contracts.
 - Locale runtime: protocol-hook request-header deletions and replacements are preserved instead of restoring incoming headers (security hardening). Literal backslashes in query/fragment no longer invalidate a registered route (path backslashes still 404). A late commit after a transition timeout clears the error, `retry()` replays the latest failed request and clears an already-satisfied one. Encoded spellings of every reserved protocol segment, including service `protocolPrefixes`, are rejected. `/favicon.svg` passes as a public file; the matcher/public-file contract is documented.

package/README.md

@@ -2,9 +2,9 @@
 
 React components, semantic design tokens, and shared styles for naeil products. The approved system uses a neutral light/dark palette, Pretendard, 16px controls, comfortable or compact density, purpose-specific content widths, and restrained motion. Radix supplies interaction behavior.
 
-**0.13.0 is an unpublished release candidate.** It combines PR #47's design-system audit fixes with PR #48's opt-in owned-service headers. This checkout and its React/Next fixtures pin 0.13.0; registry tags remain `latest=0.12.0`, `next=0.12.0` (checked 2026-11-12). See the [release procedure](docs/package-release.md) for the source/archive freeze and compatibility notes.
+**0.13.1 is an unpublished release candidate.** This docs-only patch includes #50's consumer auto-update version policy and protected publication guidance; it changes no component code or public API. This checkout and its React/Next fixtures pin 0.13.1. Registry tags checked 2026-11-13 JST are `latest=0.12.0`, `next=0.13.0`; 0.13.0 is published. The owner approved publishing the frozen 0.13.1 archive directly to `latest` to exercise the workflow and service auto-update flow, leaving `next=0.13.0`. See the [release procedure](docs/package-release.md).
 
-**0.12.0 published and registry-verified — 2026-11-10; `latest=0.12.0`, `next=0.12.0` since 2026-11-11.** It adds public Sheet primitives, optional Dialog close labels and the 896px workflow width on top of 0.10.0's opt-in [`/naeil-locale` runtime](docs/components/naeil-locale.md) for owned Next services. The registry archive matches frozen SHA-256 `7f5f01407c576e3c5fa956cf76ebfb3a8ef59b58619de99da68351974aca721b` (178 files, source/tag `e03af076b725d742c4b319aca5ebb2379e2f0258`); see the [0.12.0 receipt](https://github.com/naeil-dev/naeil-ui/blob/main/docs/releases/0.12.0/README.md) and [GitHub Release](https://github.com/naeil-dev/naeil-ui/releases/tag/v0.12.0). Hosted Docs remain separately recorded. The retained [local runner](https://github.com/naeil-dev/naeil-ui/blob/main/docs/rollout/local-runner.md) supports historical **0.7.x only** and cannot deploy or recover current releases.
+**Historical 0.12.0 publication — 2026-11-10; both tags were 0.12.0 on 2026-11-11.** It adds public Sheet primitives, optional Dialog close labels and the 896px workflow width on top of 0.10.0's opt-in [`/naeil-locale` runtime](docs/components/naeil-locale.md) for owned Next services. The registry archive matches frozen SHA-256 `7f5f01407c576e3c5fa956cf76ebfb3a8ef59b58619de99da68351974aca721b` (178 files, source/tag `e03af076b725d742c4b319aca5ebb2379e2f0258`); see the [0.12.0 receipt](https://github.com/naeil-dev/naeil-ui/blob/main/docs/releases/0.12.0/README.md) and [GitHub Release](https://github.com/naeil-dev/naeil-ui/releases/tag/v0.12.0). Hosted Docs remain separately recorded. The retained [local runner](https://github.com/naeil-dev/naeil-ui/blob/main/docs/rollout/local-runner.md) supports historical **0.7.x only** and cannot deploy or recover current releases.
 
 This repository also contains the **naeil.dev brand/example website** and an **optional agent reference workflow**. Choose the path you need:
 
@@ -17,13 +17,13 @@ This repository also contains the **naeil.dev brand/example website** and an **o
 
 ## Use the UI
 
-Use React 19 / ReactDOM 19 and Tailwind 4. UI v2 names the design generation independently of npm versioning. The installation example pins the 0.13.0 candidate and requires its publication first; until then, use the reviewed archive for candidate validation or the published 0.12.0 baseline for registry installs:
+Use React 19 / ReactDOM 19 and Tailwind 4. UI v2 names the design generation independently of npm versioning. The installation example pins the 0.13.1 candidate and requires its publication first; until then, use the reviewed archive for candidate validation or the published 0.13.0 version for registry installs:
 
 ```sh
-pnpm add --save-exact @naeil/ui@0.13.0
+pnpm add --save-exact @naeil/ui@0.13.1
 ```
 
-The [npm 0.12.0 archive](https://registry.npmjs.org/@naeil/ui/-/ui-0.12.0.tgz) is byte-identical to its frozen release archive. Bundled guides record the preparation snapshot; maintained guides record later publication outcomes. For local development, `pnpm build:pkg` and `npm pack --ignore-scripts --pack-destination /tmp` produce `/tmp/naeil-ui-VERSION.tgz`, where `VERSION` is the checked-out `package.json` version (currently the unpublished 0.13.0 candidate). Use the exact reviewed archive for release verification; later source or guide changes require a new freeze. The [0.6.0 release record](https://github.com/naeil-dev/naeil-ui/releases/tag/v0.6.0) retains its archive, publication and deployment evidence.
+The [npm 0.13.0 archive](https://registry.npmjs.org/@naeil/ui/-/ui-0.13.0.tgz) is byte-identical to its frozen release archive (verified 2026-11-13 JST). Bundled guides record the preparation snapshot; maintained guides record later publication outcomes. For local development, `pnpm build:pkg` and `npm pack --ignore-scripts --pack-destination /tmp` produce `/tmp/naeil-ui-VERSION.tgz`, where `VERSION` is the checked-out `package.json` version (currently the unpublished 0.13.1 candidate). Use the exact reviewed archive for release verification; later source or guide changes require a new freeze. The [0.6.0 release record](https://github.com/naeil-dev/naeil-ui/releases/tag/v0.6.0) retains its archive, publication and deployment evidence.
 
 The preceding [0.5.0 release](https://github.com/naeil-dev/naeil-ui/releases/tag/v0.5.0) was published on 2026-10-15 and introduced the whole shared header. Version 0.6.0 adds the shared 1600px frame; existing applications must upgrade and adopt its layout composition.
 

package/dist/{chunk-5BXZPDHZ.js → chunk-ESTQITQO.js}

@@ -4,7 +4,7 @@ import {
   NaeilStandaloneMessages,
   uiRelease,
   useNaeilMessages
-} from "./chunk-A2DCQVTP.js";
+} from "./chunk-L25A4OKY.js";
 import {
   Badge,
   Button,

package/dist/{chunk-A2DCQVTP.js → chunk-L25A4OKY.js}

@@ -1425,7 +1425,7 @@ function NaeilStandaloneMessages({ locale, children }) {
 }
 
 // src/lib/ui-release.ts
-var uiRelease = { version: "0.13.0", contractVersion: "1" };
+var uiRelease = { version: "0.13.1", contractVersion: "1" };
 
 export {
   Logo,

package/dist/components/index.js

@@ -2,13 +2,13 @@
 import {
   NaeilHeader,
   headerLocales
-} from "../chunk-5BXZPDHZ.js";
+} from "../chunk-ESTQITQO.js";
 import {
   Logo,
   en_default,
   ja_default,
   ko_default
-} from "../chunk-A2DCQVTP.js";
+} from "../chunk-L25A4OKY.js";
 import {
   SiteFooter
 } from "../chunk-HSTDPY56.js";

package/dist/components/naeil-footer.js

@@ -5,7 +5,7 @@ import {
   NaeilStandaloneMessages,
   uiRelease,
   useNaeilMessages
-} from "../chunk-A2DCQVTP.js";
+} from "../chunk-L25A4OKY.js";
 import {
   SiteFooter
 } from "../chunk-HSTDPY56.js";

package/dist/components/naeil-header.js

@@ -6,8 +6,8 @@ import {
   NaeilHeaderLocaleControl,
   NaeilHeaderThemeControl,
   naeilServices
-} from "../chunk-5BXZPDHZ.js";
-import "../chunk-A2DCQVTP.js";
+} from "../chunk-ESTQITQO.js";
+import "../chunk-L25A4OKY.js";
 import "../chunk-Y5LW3ADW.js";
 import "../chunk-JBTDRVZ7.js";
 export {

package/dist/lib/ui-release.d.ts

@@ -1 +1 @@
-export declare const uiRelease: Readonly<{version: "0.13.0"; contractVersion: "1"}>;
+export declare const uiRelease: Readonly<{version: "0.13.1"; contractVersion: "1"}>;

package/dist/lib/ui-release.js

@@ -1 +1 @@
-export const uiRelease = Object.freeze({"version":"0.13.0","contractVersion":"1"});
+export const uiRelease = Object.freeze({"version":"0.13.1","contractVersion":"1"});

package/dist/naeil-locale/chrome.js

@@ -1895,7 +1895,7 @@ function Navigation(_a) {
 }
 
 // src/lib/ui-release.ts
-var uiRelease = { version: "0.13.0", contractVersion: "1" };
+var uiRelease = { version: "0.13.1", contractVersion: "1" };
 
 // src/components/naeil-header-data.ts
 var headerLocales = ["en", "ko", "ja"];

package/dist/source/lib/ui-release.d.ts

@@ -1,5 +1,5 @@
 declare const uiRelease: {
-    readonly version: "0.13.0";
+    readonly version: "0.13.1";
     readonly contractVersion: "1";
 };
 

package/dist/source/lib/ui-release.js

@@ -1,4 +1,4 @@
-const uiRelease = { version: "0.13.0", contractVersion: "1" };
+const uiRelease = { version: "0.13.1", contractVersion: "1" };
 export {
   uiRelease
 };

package/docs/package-release.md

@@ -2,13 +2,25 @@
 
 **Publication receipt: 0.12.0 published 2026-11-10; registry tags verified 2026-11-11.** Source/tag `e03af076b725d742c4b319aca5ebb2379e2f0258`, frozen archive SHA-256 `7f5f01407c576e3c5fa956cf76ebfb3a8ef59b58619de99da68351974aca721b`, 178 regular files. Registry bytes matched; verified tags are `latest=0.12.0`, `next=0.12.0` ([receipt](https://github.com/naeil-dev/naeil-ui/blob/main/docs/releases/0.12.0/README.md), [GitHub Release](https://github.com/naeil-dev/naeil-ui/releases/tag/v0.12.0)). Earlier baseline 0.10.0 — 2026-11-04: source/tag `455f2f9aedb108606af2f429c18281260eafd2dd`, SHA-256 `a4a1e312f2f608358a10f9019c248af37a8172bb116d3bc506144442cb963fb4`, 175 files, tags then `latest=0.7.2`, `next=0.10.0`. See the [publication and three-service acceptance receipts](https://github.com/naeil-dev/naeil-ui/blob/main/docs/design/shared-language-2026-11-04/implementation-progress.md). Historical releases, archives and receipts remain immutable; hosted Docs require their own receipt. The retained [local runner](https://github.com/naeil-dev/naeil-ui/blob/main/docs/rollout/local-runner.md) is a **0.7.x-only, contract 1** release/recovery tool, outside release and recovery procedures for 0.8.0 and later. UI v2 names a design generation, not an npm major. Version-scoped installation is in the [README](../README.md#use-the-ui).
 
-## 0.13.0 candidate — audit fixes and owned-service headers
+## 0.13.1 candidate — publication and auto-update policy
 
-Not published. PR #47 supplies the 2026-11-12 audit fixes: server-safe utility imports, locale request/protocol hardening, pressed/theme/typography/accessibility behavior, package payload cleanup and CI checks. PR #48 adds strict opt-in `service` profiles for `abstorm`, `home`, `estimate` and `jev`, canonical lowercase branding and service-only tabs, plus toolbar-only mobile sheets with desktop focus restoration. Legacy props/output and inferred `NaeilHeaderProps` remain supported through service-first/legacy-last overloads. Deprecated brand/status/toolbar escape hatches remain functional without `service`; see [header profiles](components/naeil-header.md) and [compatibility changes](../CHANGELOG.md).
+Not published. This docs-only patch exercises the protected npm workflow and services' auto-update flow. Comparing main `63a032f` with frozen 0.13.0 source `08ee159`, only `docs/package-release.md` changed within the package payload: #50's consumer same-major policy and protected publication guidance. No non-doc package change was found. Component code, public APIs, header markup/geometry, styles and dependencies stay unchanged; only release metadata and maintained release guidance advance to 0.13.1. Chrome contract 1 stays unchanged.
 
-Package metadata, generated `/release` and clean React/Next fixture versions are 0.13.0. Chrome contract 1 is unchanged because the service branch is opt-in and the omitted-service legacy contract is preserved; the audit's changed visual defaults and dependency/font guidance are listed in the changelog. Freeze all bundled source and guide edits in the source/version commit, then retain the exact archive, full member hashes and final local gates outside the npm payload in a separate evidence-only commit, as for 0.12.0. Rebuild from that frozen Git source and require byte-identical packing.
+Registry checked 2026-11-13 JST: `latest=0.12.0`, `next=0.13.0`; exact 0.13.1 is absent. 0.13.0 was published 2026-11-12 and its registry bytes match the retained archive. The owner approved publishing the frozen 0.13.1 archive directly to `latest` so Dependabot can propose it; leave `next=0.13.0` unless separately moved. Prefer `publish-npm.yml` with the reviewed version/SHA-256 and `dist_tag=latest`, then approve through the protected `npm-publish` environment. Manual OTP publication of the exact archive with `--tag latest` remains the fallback. Freeze source and evidence in separate commits; preparation may push/open the candidate PR but does not merge, publish, tag, create a Release, dispatch workflows or deploy services.
 
-Registry checked 2026-11-12: `latest=0.12.0`, `next=0.12.0`; 0.13.0 is absent. The owner runs the manual publication command with OTP, publishes the reviewed archive to `next` and preserves `latest` unless separately approved. Intended tag `v0.13.0` must identify the frozen source. Preparation executes none of publication, dist-tag changes, tag/Release creation, workflow dispatch, push/merge, hosted Docs deployment or service adoption; each requires its own maintainer action and receipt. Historical release directories, archives, receipts and the 0.7.x rollout runner stay unchanged.
+## 0.13.0 release — audit fixes and owned-service headers
+
+Published to `next` on 2026-11-12; registry bytes verified against the frozen archive on 2026-11-13 JST. PR #47 supplies the 2026-11-12 audit fixes: server-safe utility imports, locale request/protocol hardening, pressed/theme/typography/accessibility behavior, package payload cleanup and CI checks. PR #48 adds strict opt-in `service` profiles for `abstorm`, `home`, `estimate` and `jev`, canonical lowercase branding and service-only tabs, plus toolbar-only mobile sheets with desktop focus restoration. Legacy props/output and inferred `NaeilHeaderProps` remain supported through service-first/legacy-last overloads. Deprecated brand/status/toolbar escape hatches remain functional without `service`; see [header profiles](components/naeil-header.md) and [compatibility changes](../CHANGELOG.md).
+
+The frozen 0.13.0 package metadata, generated `/release` and clean React/Next fixture versions agree. Chrome contract 1 is unchanged because the service branch is opt-in and the omitted-service legacy contract is preserved; the audit's changed visual defaults and dependency/font guidance are listed in the changelog. Freeze all bundled source and guide edits in the source/version commit, then retain the exact archive, full member hashes and final local gates outside the npm payload in a separate evidence-only commit, as for 0.12.0. Rebuild from that frozen Git source and require byte-identical packing.
+
+The [0.13.0 preparation receipt](https://github.com/naeil-dev/naeil-ui/blob/main/docs/releases/0.13.0/README.md) retains its frozen source, archive identity and prepublication checks. Later publication does not rewrite that archive or historical receipt. Future candidates follow the frozen source/evidence procedure and the protected workflow after [owner setup](https://github.com/naeil-dev/naeil-ui/blob/main/docs/rollout/auto-update.md#one-time-owner-setup).
+
+## Consumer auto-update version policy
+
+Owned services auto-merge same-major `@naeil/ui` updates after their CI and merge guards pass. Any break to a public API or the owned-service header contract (service-profile props, markup, geometry or the header rule) requires a new major, excluding it from automatic merging. While on 0.x, a header-breaking change requires **1.0.0**, not another 0.x minor; subsequent breaks require the next major. This is the project's explicit compatibility policy even though SemVer permits less stability before 1.0.
+
+Dependabot proposes versions only up to npm's `latest` dist-tag. Publication to `next` alone does not reach services; promotion to `latest` is a separate owner decision. See [auto-update operations](https://github.com/naeil-dev/naeil-ui/blob/main/docs/rollout/auto-update.md) for guards, pause and rollback. Service deployment remains manual.
 
 ## 0.12.0 release — shared UI refinements and Sheet
 
@@ -151,12 +163,14 @@ The procedure preserves the distinction between preparation and external verific
 
 1. Review the changelog, migration, dated verification and the [2026-10-02 native environment report](design/public-ui-release-validation.md). Its capability blockers leave all native/manual acceptance rows open and add no native component pass. Confirm maintained links, actual Storybook Docs/Usage and legal notices for the intended source. Record unresolved manual coverage without inventing passes.
 2. When freezing a new release, build and inspect an archive with `npm pack --ignore-scripts --json --pack-destination /path/to/candidate`; preserve its SHA-256, file list and source revision outside the archive. Run boundary/relative-link checks and clean packed consumers with `NAEIL_UI_EXPECTED_ARCHIVE_SHA256` set to that digest; confirm both generated archives match the candidate. For already frozen 0.7.1, rehash the existing file and retain its exact-archive evidence; maintained guide updates must not replace it.
-3. Check registry availability for `@naeil/ui@VERSION` immediately before publication. Publish the verified archive with `--ignore-scripts`, then independently verify registry version/time, integrity, dist-tag and archive bytes, followed by fresh exact-version registry consumers. If that version already exists, inspect equality rather than attempt overwrite; a changelog or install command alone proves none of these.
+3. Check registry availability for `@naeil/ui@VERSION` immediately before publication. After owner setup, prefer `.github/workflows/publish-npm.yml`: dispatch the reviewed ref with `version`, the reviewed archive `sha256` and `dist_tag` (default `next`), then approve through the protected `npm-publish` environment. It validates and publishes only the retained archive using OIDC, without an npm token or rebuild, and verifies registry integrity/shasum. Manual OTP fallback remains: `npm publish docs/releases/VERSION/naeil-ui-VERSION.tgz --access public --tag next --ignore-scripts --otp=OTP`. Independently verify registry version/time, integrity, dist-tag and archive bytes, followed by fresh exact-version registry consumers. If that version already exists, inspect equality rather than attempt overwrite; a failed post-publication check must not trigger another publish. A changelog or install command alone proves none of these.
 4. Create the release tag/GitHub Release for the recorded source and retain version, artifact identity, validation scope and support limitations.
 5. Publish the reviewed Storybook artifact through the manual Pages workflow below. Verify the actual hosted URL, subpath Docs-to-Usage navigation, fonts and notices over HTTP before reporting it live.
 
 npm publication, GitHub Releases, main merge and hosted Docs are distinct operations. Production deployment of the brand website remains a separate scope; shared-package checks do not clear unknown site-art or fetched-site-font provenance.
 
+The npm workflow requires a stable `MAJOR.MINOR.PATCH` version and lower-case SHA-256. Required reviewers are repository settings, not installed by the YAML: configure them before any dispatch. See [owner setup and publication operations](https://github.com/naeil-dev/naeil-ui/blob/main/docs/rollout/auto-update.md). npm's trusted publishing generates provenance automatically for supported public-repository publishes; private repositories do not receive provenance. Retain that limitation in the publication receipt.
+
 `vercel.json` disables Git deployments only for `feat/public-ui-readiness`. Other branches retain Vercel's default behavior, so merging or pushing another branch requires a separate deployment decision. The automatic GitHub Actions checks are verification-only; enabling repository workflows is not evidence of a hosted site or approved release.
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naeil/ui",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "type": "module",
   "license": "MIT",
   "sideEffects": [