@qovira/theme 1.0.0 → 1.0.2

package/README.md

@@ -2,16 +2,17 @@
 
 Qovira's visual foundation as a distributable package: **Tailwind v4 tokens**,
 **self-hosted fonts**, and a small **framework-agnostic theming runtime**. It is
-the single source of color, type, spacing, radius, elevation, motion, and the two
-themes — **Daylight** and **Evening** — shared by every Qovira surface (the
-product web app and the [qovira.ai](http://qovira.ai) marketing site), so the
-brand stays identical across them without copy-paste.
+the single source of color, type, radius, elevation, and motion — plus spacing on
+Tailwind's stock 4px grid — and the two themes, **Daylight** and **Evening**,
+shared by every Qovira surface (the product web app and the
+[qovira.ai](https://qovira.ai) marketing site), so the brand stays identical
+across them without copy-paste.
 
 The package is the _foundation_ a component library is built on — it ships only
 tokens, fonts, and a tiny runtime, and has **no framework dependency**.
 
-> Status: early development. Tokens, fonts, runtime, and utilities are being
-> filled in; some entry points still resolve to placeholders.
+> Status: stable (1.0). Tokens, fonts, runtime, and utilities are shipped; all
+> four entry points resolve to real assets.
 
 ## Install
 
@@ -56,12 +57,7 @@ import { boot } from "@qovira/theme/boot"; // the raw snippet, as a string
 ### 3. Toggle / persist — `@qovira/theme/runtime`
 
 ```ts
-import {
-  getTheme,
-  setTheme,
-  toggleTheme,
-  subscribe,
-} from "@qovira/theme/runtime";
+import { getTheme, setTheme, toggleTheme, subscribe } from "@qovira/theme/runtime";
 ```
 
 Framework-agnostic get/set/persist with cross-tab sync. A Svelte store/rune
@@ -235,12 +231,52 @@ Use `rounded-full` only for true pills, toggles, and avatars.
 
 ```sh
 pnpm install
-pnpm build       # tsup → dist/{runtime,boot}.js + copy CSS/fonts → dist/
+pnpm build       # tsup → dist/{runtime,boot}.js (+ .d.ts) + copy CSS/fonts → dist/
 pnpm typecheck   # tsc --noEmit
 pnpm lint        # eslint + prettier --check
 pnpm test        # vitest run
 ```
 
+## Versioning & releases
+
+`@qovira/theme` follows **[semantic versioning](https://semver.org)**. It's the
+upstream of the Qovira stack: a breaking change here (a removed token, a changed
+runtime API) ripples to every consumer, so the version is a real contract.
+
+| Bump      | What changed                                                                                                                                                                 |
+| --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **major** | A breaking change: a token/utility/entry-point removed or renamed, a breaking runtime-API or storage-key change, a dropped theme/font, or a raised `tailwindcss` peer range. |
+| **minor** | A backward-compatible addition: a new token, utility, font, or additive runtime API.                                                                                         |
+| **patch** | A backward-compatible fix: a corrected token value, an accessibility/contrast fix, or a runtime edge-case fix.                                                               |
+
+### Cutting a release
+
+Versioning and the changelog are driven by
+[Changesets](https://github.com/changesets/changesets). The flow:
+
+1. **As you work**, record each consumer-visible change with a changeset —
+   `pnpm changeset` prompts for the bump level (per the table above) and a
+   summary, writing a file under `.changeset/`. (See `.changeset/README.md`.)
+2. **To release**, run `pnpm version-packages` (`changeset version`) on `main`:
+   it consumes the pending changesets, bumps `package.json`, and updates
+   `CHANGELOG.md`. Commit that, then create and push a matching `vX.Y.Z` tag.
+3. **The tag triggers** [`.github/workflows/release.yml`](.github/workflows/release.yml):
+   the full gate (tag-vs-`package.json`, build, lint, typecheck, test) runs on
+   Blacksmith, then a single GitHub-hosted job publishes to npm via **Trusted
+   Publishing** (tokenless OIDC) with a **provenance attestation**. Only `dist/`
+   is in the published tarball (`files: ["dist"]`).
+
+> **One-time npm setup** (outside this repo): on npmjs.com, configure
+> `@qovira/theme`'s **Trusted Publisher** to point at this repository and the
+> release workflow. No `NPM_TOKEN` secret is used — Trusted Publishing replaces
+> long-lived tokens entirely.
+
+## Contributing
+
+Contributions are welcome — read [CONTRIBUTING.md](./CONTRIBUTING.md) first, and
+please follow the [Code of Conduct](./CODE_OF_CONDUCT.md). Open an issue before
+sending a PR that adds or changes a token, color, or entry point.
+
 ## License
 
 [Apache-2.0](./LICENSE) © OMNILIUM ADVANCED CYBERNETICS SRL

package/dist/theme.css

@@ -55,7 +55,7 @@
    * Per-theme tint/text aliases live in the semantic layer. */
   --color-success: #2f9e6b;
   --color-warning: #e08a1e;
-  --color-error: #d6452e;
+  --color-error: #cc4029; /* darkened from #d6452e so white text clears WCAG AA (4.5:1) on bg-error fills */
   --color-info: #3b72c0;
 
   /* Font families. font-family is intentionally NOT carried by the --text-*
@@ -179,12 +179,9 @@
 
   --focus-ring: #e0a458; /* honey, both themes */
 
-  --shadow-sm:
-    0 1px 2px rgba(30, 24, 18, 0.1), 0 1px 1px rgba(30, 24, 18, 0.06);
-  --shadow-md:
-    0 2px 4px rgba(30, 24, 18, 0.08), 0 8px 20px rgba(30, 24, 18, 0.18);
-  --shadow-lg:
-    0 4px 8px rgba(30, 24, 18, 0.1), 0 20px 48px rgba(30, 24, 18, 0.26);
+  --shadow-sm: 0 1px 2px rgba(30, 24, 18, 0.1), 0 1px 1px rgba(30, 24, 18, 0.06);
+  --shadow-md: 0 2px 4px rgba(30, 24, 18, 0.08), 0 8px 20px rgba(30, 24, 18, 0.18);
+  --shadow-lg: 0 4px 8px rgba(30, 24, 18, 0.1), 0 20px 48px rgba(30, 24, 18, 0.26);
   --lamp-glow: 0 0 22px rgba(224, 164, 88, 0.5);
 
   /* Status tint/text — meaning only, never decoration. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qovira/theme",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Qovira's visual foundation — Tailwind v4 tokens, self-hosted fonts, and a framework-agnostic theming runtime.",
   "keywords": [
     "qovira",
@@ -39,6 +39,7 @@
     "tailwindcss": "^4.0.0"
   },
   "devDependencies": {
+    "@changesets/cli": "^2.31.0",
     "@eslint/js": "^10.0.1",
     "@fontsource-variable/figtree": "^5.2.10",
     "@fontsource-variable/fraunces": "^5.2.9",
@@ -63,6 +64,8 @@
     "typecheck": "tsc --noEmit",
     "lint": "eslint . && prettier --check .",
     "format": "prettier --write .",
-    "test": "vitest run"
+    "test": "vitest run",
+    "changeset": "changeset",
+    "version-packages": "changeset version"
   }
 }