@naeil/ui 0.7.1 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. package/CHANGELOG.md +10 -1
  2. package/README.md +15 -10
  3. package/dist/{chunk-QQQQZEPV.js → chunk-KPE4KKYM.js} +111 -14
  4. package/dist/{chunk-OLKTEYLS.js → chunk-ULZPJI5X.js} +103 -73
  5. package/dist/{chunk-VWIUN35X.js → chunk-WA5D7UI2.js} +1 -1
  6. package/dist/components/index.d.ts +2 -2
  7. package/dist/components/index.js +3 -3
  8. package/dist/components/naeil-footer.d.ts +2 -2
  9. package/dist/components/naeil-footer.js +3 -1
  10. package/dist/components/naeil-header.d.ts +8 -2
  11. package/dist/components/naeil-header.js +3 -3
  12. package/dist/components/ui/index.d.ts +2 -2
  13. package/dist/components/ui/index.js +1 -1
  14. package/dist/lib/ui-release.d.ts +1 -1
  15. package/dist/lib/ui-release.js +1 -1
  16. package/dist/{navigation-CgPeL9tF.d.ts → navigation-D8N1tMTu.d.ts} +4 -2
  17. package/dist/{site-footer-vXDa_6yr.d.ts → site-footer-s113FZgC.d.ts} +1 -1
  18. package/dist/source/components/naeil-footer.js +2 -0
  19. package/dist/source/components/naeil-header-account.js +54 -19
  20. package/dist/source/components/naeil-header-content.d.ts +1 -25
  21. package/dist/source/components/naeil-header-content.js +0 -28
  22. package/dist/source/components/naeil-header.d.ts +8 -2
  23. package/dist/source/components/naeil-header.js +50 -24
  24. package/dist/source/components/ui/navigation.d.ts +8 -2
  25. package/dist/source/components/ui/navigation.js +112 -15
  26. package/dist/source/lib/ui-release.d.ts +1 -1
  27. package/dist/source/lib/ui-release.js +1 -1
  28. package/docs/components/README.md +3 -3
  29. package/docs/components/application-layout.md +48 -13
  30. package/docs/components/naeil-footer.md +2 -2
  31. package/docs/components/naeil-header.md +37 -7
  32. package/docs/design/v2-migration.md +11 -10
  33. package/docs/package-release.md +44 -14
  34. package/package.json +1 -1
  35. package/src/styles/components.css +113 -0
@@ -1,14 +1,14 @@
1
1
  # Package verification and release policy
2
2
 
3
- The current implementation candidate is **@naeil/ui 0.7.0**, adding the canonical footer and release identity contract. It is unpublished and requires an explicit migration/release decision. The completed **0.6.0** [release record](https://github.com/naeil-dev/naeil-ui/releases/tag/v0.6.0) remains the evidence for the published application frame; do not republish it. Verified 0.5.0, 0.4.0 and 0.3.0 evidence remains dated history. UI v2 names a design generation, not an npm major. Future breaking changes require an explicit migration and version decision. Version-scoped installation is in the [README](../README.md#use-the-ui).
3
+ **Published baseline: 0.7.2** (`40a3928`, registry archive SHA-256 `b7919ed182307c5c3b48515f68567b0e4f51c611c86b7acf8861e769f596e2ec`, 139 files). **0.8.0 is an unpublished candidate** adding the canonical Home menu/brand/status/controlled-sheet API and package-owned chrome typography. Contract version stays `1` only while every existing invariant passes. The historical 0.7.1 publication and immutable archive below remain unchanged. UI v2 names a design generation, not an npm major. Hosted Docs and per-service activation retain separate receipts. Version-scoped installation is in the [README](../README.md#use-the-ui).
4
4
 
5
5
  ## Architecture
6
6
 
7
- One repository contains the shared package and the separate Next.js brand/example website. `@naeil/ui/ui` provides React primitives and generic Navigation/SiteFooter. The opt-in React-only `@naeil/ui/naeil-header` provides the complete actual naeil.dev branded header; see [its consumer contract](components/naeil-header.md). The legacy root is a framework compatibility entry with static Next/next-intl imports, even when selecting only Logo or a heading; React-only consumers use the documented shared deep modules. Next and next-intl are optional peers, not optional behavior inside the root. Supply them when importing that entry, Nav, Footer, or i18n/routing. Theme controls and Toaster use the framework-independent React library next-themes, retained as a runtime dependency.
7
+ One repository contains the shared package and the separate Next.js brand/example website. `@naeil/ui/ui` provides React primitives and generic Navigation/SiteFooter. The opt-in React-only `@naeil/ui/naeil-header` provides the complete actual naeil.dev branded header and `NaeilHeaderAccountControl`; see [its consumer contract](components/naeil-header.md). Owned apps render that control in `authSlot` and supply session state, pending state and guarded callbacks above the header. The legacy root is a framework compatibility entry with static Next/next-intl imports, even when selecting only Logo or a heading; React-only consumers use the documented shared deep modules. Next and next-intl are optional peers, not optional behavior inside the root. Supply them when importing that entry, Nav, Footer, or i18n/routing. Theme controls and Toaster use the framework-independent React library next-themes, retained as a runtime dependency.
8
8
 
9
- Owned services use `@naeil/ui/naeil-footer` for the canonical localized destinations in full/compact variants; generic SiteFooter and legacy Footer retain their APIs. Footer navigation adapters preserve application save/flush decisions and modified-click behavior. `@naeil/ui/release` is server-safe metadata; it contains no application artifact, credential or environment. Applications compile their own allowlisted artifact/source identity. See [the footer contract](components/naeil-footer.md). The release coordinator remains disabled until its concrete policy, source mappings, immutable artifacts, deployment bridges and recovery targets are reviewed. Publishing a package, creating an update PR or merging it never establishes complete consumer rollout.
9
+ Owned services use `@naeil/ui/naeil-footer` for the canonical localized destinations in full/compact variants; generic SiteFooter and legacy Footer retain their APIs. Footer navigation adapters preserve application save/flush decisions and modified-click behavior. `@naeil/ui/release` is server-safe metadata; it contains no application artifact, credential or environment. Applications compile their own allowlisted artifact/source identity. See [the footer contract](components/naeil-footer.md). Current coordinator policy, selected services, activation and recovery evidence are maintained in the [rollout records](https://github.com/naeil-dev/naeil-ui/tree/main/docs/rollout); historical disabled-policy statements describe their dated checkpoints. Publishing a package, creating an update PR or merging it never establishes complete consumer rollout. Home Console is outside the selected shared-UI rollout.
10
10
 
11
- Website tools remain development dependencies so maintainers can develop both products. npm tarball consumers install only component runtime dependencies and their host React/ReactDOM. Build entries, package exports and packed checks constrain the public boundary. There is no bundled website action, Supabase helper, Three/hero/cursor module, blog engine or full application message catalog. The opt-in header includes only its three header dictionaries and canonical project catalog. Its five decorative images reference official `https://naeil.dev/images/*.png` URLs and require network access; no image bytes are bundled, and unresolved artwork redistribution provenance remains in [third-party notices](../THIRD_PARTY_NOTICES.md).
11
+ Website tools remain development dependencies so maintainers can develop both products. npm tarball consumers install only component runtime dependencies and their host React/ReactDOM. Build entries, package exports and packed checks constrain the public boundary. There is no bundled website action, Supabase helper, Three/hero/cursor module, blog engine or full application message catalog. The opt-in header includes only its three header dictionaries and canonical project catalog. Its 0.7.2 default catalog contains naeil-ui and references the official `https://naeil.dev/images/whale.png` URL and require network access; no image bytes are bundled, and unresolved artwork redistribution provenance remains in [third-party notices](../THIRD_PARTY_NOTICES.md).
12
12
 
13
13
  ## Checks
14
14
 
@@ -42,7 +42,7 @@ NAEIL_UI_EXPECTED_ARCHIVE_SHA256=FULL_LOWERCASE_SHA256 pnpm check:package
42
42
 
43
43
  Each check hashes its actual `npm pack` output and prints the digest. An unset expectation preserves normal development checks; a defined malformed or mismatched digest fails. Record matching boundary and clean React/Next results against the final archive, then reconcile package metadata, source revision and the consumer lock/archive identities. A provisional pack pass does not verify later documentation or archive bytes.
44
44
 
45
- CI runs these checks and a separate actual Storybook/browser job. Configured browser projects run Chromium, Firefox and WebKit in CI. Local Chromium/WebKit results and the Firefox environment launch block are distinguished in the [current support matrix](design/public-ui-support.md) and [dated Stage 3 verification](design/public-ui-stage3-verification.md) and [Stage 4 extension verification](design/public-ui-stage4-verification.md); configured CI is not a recorded remote pass. Automated axe/keyboard checks are not manual screen-reader or native Safari certification. The website build checks compatibility independently from package consumption; fonts fetched through next/font may require network access. Supabase OAuth and deployed behavior remain separate checks.
45
+ CI runs these checks and a separate actual Storybook/browser job. Configured browser projects run Chromium, Firefox and WebKit in CI. Verification and manual Pages jobs use the pinned Playwright 1.63.0 image, mounted-directory ownership correction and a version/browser launch preflight before builds; CI does not download browsers or OS packages during those jobs. Local Chromium/WebKit results and the historical Firefox launch block remain distinguished in the [support matrix](design/public-ui-support.md), [dated Stage 3 verification](design/public-ui-stage3-verification.md) and [Stage 4 extension verification](design/public-ui-stage4-verification.md). Automated axe/keyboard checks are not manual screen-reader or native Safari certification. The website build checks compatibility independently from package consumption; fonts fetched through next/font may require network access. Supabase OAuth and deployed behavior remain separate checks.
46
46
 
47
47
  At baseline `bcf99fca3467ae2b1cd29d54fa24f2569fb6001c`, both [push CI](https://github.com/naeil-dev/naeil-ui/actions/runs/36945564443) and [PR CI](https://github.com/naeil-dev/naeil-ui/actions/runs/36945943651) passed package-and-site and failed the browser job. Linux Firefox application coverage passed in those runs. The [final correction follow-up](design/public-ui-final-verification.md) preserves that baseline and the initial local freeze evidence, then records independent scoped review approval and successful [push CI](https://github.com/naeil-dev/naeil-ui/actions/runs/36948276767) and [PR CI](https://github.com/naeil-dev/naeil-ui/actions/runs/36948280881) at exact correction commit `9f90493abb4fb1186c948084026c3f4c04074013`. The PR browser job passed 209 tests with 4 expected Firefox/WebKit forced-colors skips; package-and-site and optional helper checks passed. The downloaded CI preview also passed actual Chromium/WebKit subpath navigation/font checks. This acceptance applies to that source; [merged PR checks](https://github.com/naeil-dev/naeil-ui/pull/1/checks) retain the release-preparation checks. Subsequent documentation changes require their own verification. Publication and manual platform acceptance remain separate.
48
48
 
@@ -50,6 +50,24 @@ The explicit font-notice regression gate copies the real React fixture config in
50
50
 
51
51
  ## Publication and deployment
52
52
 
53
+ ### Verified 0.7.1 registry publication and maintained Docs — 2026-10-23
54
+
55
+ The published release preserves these immutable identities:
56
+
57
+ | Item | Identity |
58
+ | --- | --- |
59
+ | Package source and pushed `v0.7.1` tag | `32108fd8e1cb1db6dae24a09f3ca72ac9a91f618` |
60
+ | Frozen archive | `docs/rollout/frozen/naeil-ui-0.7.1.tgz` |
61
+ | Archive SHA-256 | `ecd656c595fd63516417eef58a5e2624d1f1bf928ba0465761292d05502ab3f8` |
62
+ | Archive size / contents | 167705 compressed bytes; 139 files; 904985 unpacked bytes |
63
+ | Chrome contract | 1, with matching frozen frame/account references |
64
+
65
+ The frozen archive was published directly with scripts disabled. npm records publication at `2026-10-23T01:14:11.387Z`; `latest` was verified as `0.7.1`. An independent [registry archive](https://registry.npmjs.org/@naeil/ui/-/ui-0.7.1.tgz) download matched the frozen SHA-256, SHA-1, SRI, length and contents. Do not build or pack maintained main and call it the same frozen release. Earlier exact-archive validation is retained in the [dated account-correction evidence](https://github.com/naeil-dev/naeil-ui/tree/main/docs/rollout/evidence/account-correction-2026-10-17). [CI run 39859416335](https://github.com/naeil-dev/naeil-ui/actions/runs/39859416335) passed at `041c3c4f61755eca422d9a5727b32adc8c02a1f4`, including 563 unit tests and 380 browser tests (5 and 4 expected skips respectively), contrast, package/site and consumer checks. Its rebuilt archive differs because maintained guides changed; that CI is current compatibility evidence, not byte-identical frozen validation.
66
+
67
+ The archive's bundled guides are an immutable preparation snapshot, including 0.6.0 installation copy. Release notes must point to maintained instructions. Deploy Docs from a separately reviewed commit containing current guidance, the `v0.7.1` link correction and the corrected manual workflow. Record that Docs SHA, workflow run, deployment and actual hosted checks separately; retain `v0.7.1` at the frozen package source.
68
+
69
+ Postpublication registry checks passed on 2026-10-23. Separate fresh React/Next fixtures installed exact `@naeil/ui@0.7.1` from npmjs with independent empty caches and no repository dependency symlinks; every installed file matched the frozen 139-file inventory in both fixtures. Types, production builds, public root/deep import boundaries, release/footer/account SSR and browser checks passed, including the React fixture's absence of Next/Supabase/Three. The retained `registry-receipt.json` and successful `npm-publication-verification.json` bind these checks to the frozen source/archive; the latter records `checkedAt: 2026-10-23T01:19:50.385Z`. At the 01:19 UTC registry checkpoint, the tag had been pushed and the Release draft prepared. GitHub Release publication, hosted Docs and standing activation require separate receipts; see the release assets and [current rollout runbook](https://github.com/naeil-dev/naeil-ui/blob/main/docs/rollout/standing-rollout.md). Native/manual, real OAuth and global service-discovery evidence retain their separate scopes and limits.
70
+
53
71
  ### 0.6.0 release scope — 2026-10-16
54
72
 
55
73
  The owner authorized publication and deployment of the shared 1600px frame, responsive gutters and navigation/footer adoption improvements. Use the exact reviewed source and frozen archive; record npm, GitHub Release, Pages and production results independently. Existing consumer applications need their own upgrade and composition migration. The minor increment marks the deliberate default-width change and added public frame tokens/class.
@@ -86,15 +104,15 @@ The immutable npm archive's bundled guides are the release-preparation snapshot.
86
104
 
87
105
  ### Release procedure
88
106
 
89
- Storybook resolves relative Markdown guide links against the release's `v0.6.0` source tag. The tag must point to the reviewed release source, and hosted verification checks that guide links resolve. Historical foundation/source-authority links remain at their original revisions. Freeze subsequent documentation changes separately from immutable release archives.
107
+ Maintained Storybook resolves relative Markdown guide links against the published `v0.7.2` source `40a3928e24cd2f0141be3e605eed0a75260938fd`. The unpublished 0.8.0 candidate keeps that published guide-link target until a separately reviewed Docs release. That tag is independent of the reviewed Docs deployment SHA. Hosted verification checks that the pinned links resolve; the unpublished `v0.7.0` tag is not a valid target. Historical foundation/source-authority links remain at their original revisions. Freeze subsequent documentation changes separately from immutable release archives.
90
108
 
91
109
  The authorized 0.3.0 release completed main merge, npm 0.3.0, a GitHub Release and hosted Docs as recorded above. The release maintainer performs external authentication and publication; documentation preparation does not itself execute those operations. The automatic verification workflow does not publish or deploy. Record native/manual observations with their actual scope and carry unrun checks as limitations; do not substitute automated WebKit/axe checks or publication authorization for human certification.
92
110
 
93
111
  The procedure preserves the distinction between preparation and external verification. Use the intended version in place of `VERSION`; future releases require their own authorization and frozen source/archive:
94
112
 
95
113
  1. Review the changelog, migration, dated verification and the [2026-10-02 native environment report](design/public-ui-release-validation.md). Its capability blockers leave all native/manual acceptance rows open and add no native component pass. Confirm maintained links, actual Storybook Docs/Usage and legal notices for the intended source. Record unresolved manual coverage without inventing passes.
96
- 2. Build and inspect a fresh archive with `npm pack --ignore-scripts --json --pack-destination /path/to/candidate`; preserve its SHA-256, file list and source revision outside the archive. Run boundary/relative-link checks and clean packed consumers with `NAEIL_UI_EXPECTED_ARCHIVE_SHA256` set to that digest; confirm both generated archives match the candidate.
97
- 3. Check registry availability for `@naeil/ui@VERSION` immediately before publication. Publish the verified candidate archive, then verify the registry version, integrity and dist-tag; a changelog or install command alone proves none of these.
114
+ 2. When freezing a new release, build and inspect an archive with `npm pack --ignore-scripts --json --pack-destination /path/to/candidate`; preserve its SHA-256, file list and source revision outside the archive. Run boundary/relative-link checks and clean packed consumers with `NAEIL_UI_EXPECTED_ARCHIVE_SHA256` set to that digest; confirm both generated archives match the candidate. For already frozen 0.7.1, rehash the existing file and retain its exact-archive evidence; maintained guide updates must not replace it.
115
+ 3. Check registry availability for `@naeil/ui@VERSION` immediately before publication. Publish the verified archive with `--ignore-scripts`, then independently verify registry version/time, integrity, dist-tag and archive bytes, followed by fresh exact-version registry consumers. If that version already exists, inspect equality rather than attempt overwrite; a changelog or install command alone proves none of these.
98
116
  4. Create the release tag/GitHub Release for the recorded source and retain version, artifact identity, validation scope and support limitations.
99
117
  5. Publish the reviewed Storybook artifact through the manual Pages workflow below. Verify the actual hosted URL, subpath Docs-to-Usage navigation, fonts and notices over HTTP before reporting it live.
100
118
 
@@ -102,9 +120,20 @@ npm publication, GitHub Releases, main merge and hosted Docs are distinct operat
102
120
 
103
121
  `vercel.json` disables Git deployments only for `feat/public-ui-readiness`. Other branches retain Vercel's default behavior, so merging or pushing another branch requires a separate deployment decision. The automatic GitHub Actions checks are verification-only; enabling repository workflows is not evidence of a hosted site or approved release.
104
122
 
123
+
124
+ ### Manual exact-archive preparation for 0.8.0
125
+
126
+ The standing `scripts/rollout/prepare-release.mjs` accepts consecutive stable 0.7.x releases only. Do not change rollout policy, `release.json` or the chrome contract to admit 0.8.0. Use the manual release procedure above: complete P1–P7 from the `docs/superpowers/specs/2026-10-28-canonical-home-chrome.md` acceptance contract, freeze the exact source SHA/archive, then run boundary and clean React/Next checks with `NAEIL_UI_EXPECTED_ARCHIVE_SHA256`. The paired browser gate accepts `NAEIL_UI_CHROME_PACKAGE=/absolute/extracted/package` to exercise that exact archive, alongside SHA-512-pinned B1. It retains numeric differences and screenshots for human review; new renders never replace expectations automatically.
127
+
128
+ The candidate adds `appNavigation`, `brandSuffix`, `statusSlot` and controlled/observer sheet props; see [NaeilHeader](components/naeil-header.md) for supported host CSS and consumer-supplied fonts. Default catalog/blog/legacy overrides must remain equivalent to B1. Home uses the complete default toolbar and full footer. A source rollback must revert adapter, CSS and manifest/lock together; pin-only rollback cannot support the new API.
129
+
130
+ The shipped guide records the B1 empty-menu desktop limitation, controlled-mobile asynchronous account/focus handoff versus desktop/uncontrolled selection-time behavior, and Home's confirmation-owned desktop cancel fallback. Compatibility comparisons normalize only the contract markers/language/release identity and Radix-generated IDs; SVG/Logo and consumer IDs stay exact. Source or guide corrections require a new archive and exact-archive gates; earlier candidate digests are historical evidence.
131
+
132
+ Package publication, tag, GitHub Release, main merge and Home deployment each require separate explicit approval. naeil.dev imports this repository's source, so a main merge upgrades its default header to 0.8.0 and is held until the owner approves that site impact and timing. Estimate/Jev stay on 0.7.2, and STOP remains. A prepared archive or local gate result grants no publication or rollout authority.
133
+
105
134
  ## Storybook preview artifact
106
135
 
107
- `pnpm build:storybook` builds 17 actual Docs pages: 15 UI families (the 13 primitives plus Navigation and SiteFooter) and Brand / Logo and NaeilHeader. Interactive Usage examples include the complete branded header and its JapaneseApplication adapter. It copies generated documentation notices and approved canonical brand SVGs, bundles locally installed Pretendard/Noto Sans JP and disables Vite publicDir. The artifact check verifies real Docs/story entries, exact MIT/shadcn/font notices, brand references and absence of website public images/SVGs/HTML. It does not claim those excluded site assets have cleared rights.
136
+ `pnpm build:storybook` builds 17 actual Docs pages: 15 UI families (the 13 primitives plus Navigation and SiteFooter) and Brand / Logo and NaeilHeader. Interactive examples include the complete branded header, JapaneseApplication, canonical footer ReferenceFull/ReferenceCompact and AccountStates. Canonical footer/account examples live within existing stories, without a separate NaeilFooter Docs family. It copies generated documentation notices and approved canonical brand SVGs, bundles locally installed Pretendard/Noto Sans JP and disables Vite publicDir. The artifact check verifies real Docs/story entries, exact MIT/shadcn/font notices, brand references and absence of website public images/SVGs/HTML. It does not claim those excluded site assets have cleared rights.
108
137
 
109
138
  CI uploads `storybook-preview` after a successful build; it is a downloadable static artifact, not a hosted deployment. Download/unzip it and serve the extracted directory (containing index.html):
110
139
 
@@ -118,18 +147,19 @@ Run the command from this checkout after installing its dependencies. It serves
118
147
 
119
148
  ### Authorized GitHub Pages publication
120
149
 
121
- The public Docs destination [https://naeil-dev.github.io/naeil-ui/](https://naeil-dev.github.io/naeil-ui/) last completed [Pages run38737502303](https://github.com/naeil-dev/naeil-ui/actions/runs/38737502303) for0.5.0 source `04229adbecac302efbf50ab2b8a3a40edb0a04bb`, rechecked2026-10-16. Subsequent deployments belong to their release records. Pages uses `build_type=workflow` and a **github-pages** main-only deployment branch policy. See [workflow status](https://github.com/naeil-dev/naeil-ui/actions/workflows/publish-docs-manual.yml).
150
+ The public Docs destination [https://naeil-dev.github.io/naeil-ui/](https://naeil-dev.github.io/naeil-ui/) has recorded [Pages run 38737502303](https://github.com/naeil-dev/naeil-ui/actions/runs/38737502303) for 0.5.0 source `04229adbecac302efbf50ab2b8a3a40edb0a04bb`, rechecked 2026-10-16. Subsequent deployments belong to their release records; this preparation does not establish 0.7.1 hosted publication. Pages uses `build_type=workflow` and a **github-pages** main-only deployment branch policy. See [workflow status](https://github.com/naeil-dev/naeil-ui/actions/workflows/publish-docs-manual.yml).
122
151
 
123
152
  `.github/workflows/publish-docs-manual.yml` is an explicit `workflow_dispatch` recipe with no PR/push trigger. Pages is configured to use **GitHub Actions**; the **github-pages** environment permits deployment from main only. Run the authorized workflow from main with the exact reviewed source SHA; configuration alone does not establish a successful deployment. The workflow file does not enable Pages itself. A default-branch merge can separately invoke the brand site's existing Vercel integration; that production deployment and its asset/font provenance require separate handling.
124
153
 
125
- Select **Publish reviewed UI docs (manual only)** in Actions (or use the command below), supply the exact full reviewed source SHA and type `PUBLISH_REVIEWED_DOCS`. The job checks out that SHA, rebuilds/verifies its actual preview/notices, runs the configured three-engine browser suite, and deploys only the Pages artifact through its environment. Failed checks do not reach deploy. Native observations and remaining manual limitations belong in the release evidence; the workflow does not certify them.
154
+ Select **Publish reviewed UI docs (manual only)** in Actions (or use the command below), supply the exact full reviewed Docs source SHA and type `PUBLISH_REVIEWED_DOCS`. The job checks out that SHA, corrects mounted-directory ownership before the exact Git check, verifies preinstalled Chromium/Firefox/WebKit in the pinned Playwright image, rebuilds/verifies its actual preview/notices, runs the configured three-engine browser suite, and deploys only the Pages artifact through its environment. Failed checks do not reach deploy. Native observations and remaining manual limitations belong in the release evidence; the workflow does not certify them.
126
155
 
127
156
  ```sh
128
- # Release maintainer: replace with the exact frozen source commit.
129
- gh workflow run publish-docs-manual.yml -f reviewed_sha=FULL_REVIEWED_COMMIT_SHA -f confirmation=PUBLISH_REVIEWED_DOCS
157
+ # Release maintainer: dispatch the corrected workflow from main.
158
+ # For 0.7.1, reviewed_sha is the separately reviewed Docs commit, not 32108fd.
159
+ gh workflow run publish-docs-manual.yml --ref main -f reviewed_sha=FULL_REVIEWED_DOCS_COMMIT_SHA -f confirmation=PUBLISH_REVIEWED_DOCS
130
160
  ```
131
161
 
132
- After a 0.6.0 deployment, verify the manager and iframe under `/naeil-ui/`, all 15 UI and 2 Brand Docs pages, their Usage examples and NaeilHeader JapaneseApplication, canonical artwork and official image references, Docs links, local fonts and exact LICENSE/THIRD_PARTY_NOTICES/font notices. Retain the deployment URL, source SHA and observed HTTP/navigation results. Hosted Storybook uses simulated data and requires no Supabase project, design API key or external font server. Only the reviewed Storybook directory is uploaded; website public assets stay excluded.
162
+ After the reviewed Docs deployment, verify the manager and iframe under `/naeil-ui/`, all 15 UI and 2 Brand Docs pages, their Usage examples, NaeilHeader JapaneseApplication, canonical footer full/compact destinations, and signed-out/signed-in/menu/busy account states. Check the maintained `v0.7.2` guide links (or the separately approved release target), canonical artwork and official image references, local fonts and exact LICENSE/THIRD_PARTY_NOTICES/font notices over HTTP. Retain the deployment URL, Docs source SHA, workflow run and observed results separately from the package source/tag. Hosted Storybook uses simulated data and requires no Supabase project, design API key or external font server. Only the reviewed Storybook directory is uploaded; website public assets stay excluded.
133
163
 
134
164
  Normal builds are network-independent after dependency installation. Vite collects notices for actual preview modules; checked-in manager notices conservatively cover named embedded packages and versions from Storybook 10.4.6's original source lock. `check-storybook` fails if a named embedded module lacks a full notice. Four vendored tiny modules have no embedded version in that lock/comments; their original npm notice source is explicitly marked, without an exact-version claim. The exact use-composed-ref@1.4.0 tarball/repository provides MIT metadata but no standalone notice; its metadata plus full declared terms are retained without inventing a year/holder. The client-only@0.0.1 React marker retains its exact metadata and the original React MIT notice. Other missing notices fail the build; no generic MIT fallback passes arbitrary packages.
135
165
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@naeil/ui",
3
- "version": "0.7.1",
3
+ "version": "0.8.0",
4
4
  "type": "module",
5
5
  "license": "MIT",
6
6
  "sideEffects": [
@@ -536,6 +536,119 @@
536
536
  }
537
537
  }
538
538
 
539
+
540
+ /* Canonical chrome owns final typography. Unlayered, marker-scoped rules also
541
+ beat supported (0,3,0) host rules even when loaded later. Body portals stay local. */
542
+ html:root [data-naeil-chrome][lang] {
543
+ /* Keep the base :lang(ja) fallback local while slot font utilities still win. */
544
+ --font-sans: 'Pretendard Variable', Pretendard, 'Noto Sans JP', -apple-system, system-ui, sans-serif;
545
+ --naeil-chrome-font: "Pretendard Variable", Pretendard, "Noto Sans JP", -apple-system, system-ui, sans-serif;
546
+ font-family: var(--naeil-chrome-font);
547
+ font-size: 16px;
548
+ font-weight: 400;
549
+ line-height: 1.5625;
550
+ letter-spacing: normal;
551
+ -webkit-font-smoothing: antialiased;
552
+ -moz-osx-font-smoothing: grayscale;
553
+ }
554
+ html:root [data-naeil-chrome][lang] .ui-navigation-link:not([data-app-toolbar] *):not([data-app-brand]),
555
+ html:root [data-naeil-chrome][lang] .naeil-header-login,
556
+ html:root [data-naeil-chrome][lang] .naeil-header-account-trigger,
557
+ html:root [data-naeil-chrome][lang] .ui-navigation-title,
558
+ html:root [data-naeil-chrome][lang][data-app-toolbar] > [data-slot="button"]:first-child,
559
+ html:root [data-naeil-chrome][lang][data-app-toolbar] > [data-slot="select-trigger"]:nth-child(2) {
560
+ font-family: var(--naeil-chrome-font);
561
+ font-size: 16px;
562
+ font-weight: 400;
563
+ line-height: 1.5625;
564
+ letter-spacing: normal;
565
+ }
566
+ html:root [data-naeil-chrome][lang] :is(.ui-navigation-title, .naeil-header-login) {
567
+ font-weight: 500;
568
+ }
569
+ html:root [data-naeil-chrome][lang] .ui-navigation-entry[aria-current="page"] .ui-navigation-title {
570
+ font-weight: 600;
571
+ }
572
+ html:root [data-naeil-chrome][lang] :is(.ui-navigation-description, .ui-navigation-group-label, .ui-site-footer-description, .ui-site-footer-label, .ui-site-footer-link, .ui-site-footer-meta) {
573
+ font-family: var(--naeil-chrome-font);
574
+ font-size: 14px;
575
+ font-weight: 400;
576
+ line-height: 1.5625;
577
+ letter-spacing: normal;
578
+ }
579
+ html:root [data-naeil-chrome][lang] :is(.ui-navigation-group-label, .ui-site-footer-label) {
580
+ font-weight: 600;
581
+ }
582
+ html:root [data-naeil-chrome][lang] .ui-navigation-sheet-heading > h2 {
583
+ font-family: var(--naeil-chrome-font);
584
+ font-size: 20px;
585
+ font-weight: 600;
586
+ line-height: 28px;
587
+ letter-spacing: normal;
588
+ }
589
+ html:root [data-naeil-chrome][lang] :is([data-slot="select-item"], [data-slot="dropdown-menu-item"]) {
590
+ font-family: var(--naeil-chrome-font);
591
+ font-size: 16px;
592
+ font-weight: 400;
593
+ line-height: 24px;
594
+ letter-spacing: normal;
595
+ }
596
+ html:root [data-naeil-chrome][lang] [data-slot="dropdown-menu-label"] {
597
+ font-family: var(--naeil-chrome-font);
598
+ font-size: 14px;
599
+ font-weight: 400;
600
+ line-height: 20px;
601
+ letter-spacing: normal;
602
+ }
603
+ html:root [data-naeil-chrome][lang] [data-slot="dropdown-menu-label"] > .text-base {
604
+ font-family: var(--naeil-chrome-font);
605
+ font-size: 16px;
606
+ font-weight: 500;
607
+ line-height: 24px;
608
+ letter-spacing: normal;
609
+ }
610
+ html:root [data-naeil-chrome][lang] [data-slot="dropdown-menu-label"] > .text-sm {
611
+ font-family: var(--naeil-chrome-font);
612
+ font-size: 14px;
613
+ font-weight: 400;
614
+ line-height: 20px;
615
+ letter-spacing: normal;
616
+ }
617
+ html:root [data-naeil-chrome][lang][data-app-toolbar] > [data-slot="button"]:first-child {
618
+ font-weight: 500;
619
+ line-height: 24px;
620
+ }
621
+ html:root [data-naeil-chrome][lang]:lang(ja),
622
+ html:root [data-naeil-locale-menu][lang] :lang(ja) {
623
+ --naeil-chrome-font: "Noto Sans JP", "Pretendard Variable", Pretendard, "Noto Sans JP", -apple-system, system-ui, sans-serif;
624
+ font-family: var(--naeil-chrome-font);
625
+ }
626
+
627
+ .naeil-header-brand-row {
628
+ display: flex;
629
+ align-items: center;
630
+ gap: 8px;
631
+ width: max-content;
632
+ }
633
+ html:root [data-naeil-chrome][lang] .naeil-header-brand-suffix {
634
+ font-family: var(--naeil-chrome-font);
635
+ margin-inline-start: 4px;
636
+ font-size: 14px;
637
+ font-weight: 400;
638
+ line-height: 21.875px;
639
+ letter-spacing: normal;
640
+ white-space: nowrap;
641
+ transform: translateY(1px);
642
+ }
643
+ @supports (text-box-trim: trim-both) {
644
+ html:root [data-naeil-chrome][lang] .naeil-header-brand-suffix {
645
+ font-family: var(--naeil-chrome-font);
646
+ text-box-trim: trim-both;
647
+ text-box-edge: cap alphabetic;
648
+ transform: none;
649
+ }
650
+ }
651
+
539
652
  @keyframes ui-reveal {
540
653
  from {
541
654
  opacity: 0;