@qovira/theme 1.0.1 → 1.0.2

package/README.md

@@ -57,12 +57,7 @@ import { boot } from "@qovira/theme/boot"; // the raw snippet, as a string
 ### 3. Toggle / persist — `@qovira/theme/runtime`
 
 ```ts
-import {
-  getTheme,
-  setTheme,
-  toggleTheme,
-  subscribe,
-} from "@qovira/theme/runtime";
+import { getTheme, setTheme, toggleTheme, subscribe } from "@qovira/theme/runtime";
 ```
 
 Framework-agnostic get/set/persist with cross-tab sync. A Svelte store/rune
@@ -242,6 +237,40 @@ pnpm lint        # eslint + prettier --check
 pnpm test        # vitest run
 ```
 
+## Versioning & releases
+
+`@qovira/theme` follows **[semantic versioning](https://semver.org)**. It's the
+upstream of the Qovira stack: a breaking change here (a removed token, a changed
+runtime API) ripples to every consumer, so the version is a real contract.
+
+| Bump      | What changed                                                                                                                                                                 |
+| --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **major** | A breaking change: a token/utility/entry-point removed or renamed, a breaking runtime-API or storage-key change, a dropped theme/font, or a raised `tailwindcss` peer range. |
+| **minor** | A backward-compatible addition: a new token, utility, font, or additive runtime API.                                                                                         |
+| **patch** | A backward-compatible fix: a corrected token value, an accessibility/contrast fix, or a runtime edge-case fix.                                                               |
+
+### Cutting a release
+
+Versioning and the changelog are driven by
+[Changesets](https://github.com/changesets/changesets). The flow:
+
+1. **As you work**, record each consumer-visible change with a changeset —
+   `pnpm changeset` prompts for the bump level (per the table above) and a
+   summary, writing a file under `.changeset/`. (See `.changeset/README.md`.)
+2. **To release**, run `pnpm version-packages` (`changeset version`) on `main`:
+   it consumes the pending changesets, bumps `package.json`, and updates
+   `CHANGELOG.md`. Commit that, then create and push a matching `vX.Y.Z` tag.
+3. **The tag triggers** [`.github/workflows/release.yml`](.github/workflows/release.yml):
+   the full gate (tag-vs-`package.json`, build, lint, typecheck, test) runs on
+   Blacksmith, then a single GitHub-hosted job publishes to npm via **Trusted
+   Publishing** (tokenless OIDC) with a **provenance attestation**. Only `dist/`
+   is in the published tarball (`files: ["dist"]`).
+
+> **One-time npm setup** (outside this repo): on npmjs.com, configure
+> `@qovira/theme`'s **Trusted Publisher** to point at this repository and the
+> release workflow. No `NPM_TOKEN` secret is used — Trusted Publishing replaces
+> long-lived tokens entirely.
+
 ## Contributing
 
 Contributions are welcome — read [CONTRIBUTING.md](./CONTRIBUTING.md) first, and

package/dist/theme.css

@@ -55,7 +55,7 @@
    * Per-theme tint/text aliases live in the semantic layer. */
   --color-success: #2f9e6b;
   --color-warning: #e08a1e;
-  --color-error: #d6452e;
+  --color-error: #cc4029; /* darkened from #d6452e so white text clears WCAG AA (4.5:1) on bg-error fills */
   --color-info: #3b72c0;
 
   /* Font families. font-family is intentionally NOT carried by the --text-*
@@ -179,12 +179,9 @@
 
   --focus-ring: #e0a458; /* honey, both themes */
 
-  --shadow-sm:
-    0 1px 2px rgba(30, 24, 18, 0.1), 0 1px 1px rgba(30, 24, 18, 0.06);
-  --shadow-md:
-    0 2px 4px rgba(30, 24, 18, 0.08), 0 8px 20px rgba(30, 24, 18, 0.18);
-  --shadow-lg:
-    0 4px 8px rgba(30, 24, 18, 0.1), 0 20px 48px rgba(30, 24, 18, 0.26);
+  --shadow-sm: 0 1px 2px rgba(30, 24, 18, 0.1), 0 1px 1px rgba(30, 24, 18, 0.06);
+  --shadow-md: 0 2px 4px rgba(30, 24, 18, 0.08), 0 8px 20px rgba(30, 24, 18, 0.18);
+  --shadow-lg: 0 4px 8px rgba(30, 24, 18, 0.1), 0 20px 48px rgba(30, 24, 18, 0.26);
   --lamp-glow: 0 0 22px rgba(224, 164, 88, 0.5);
 
   /* Status tint/text — meaning only, never decoration. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qovira/theme",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Qovira's visual foundation — Tailwind v4 tokens, self-hosted fonts, and a framework-agnostic theming runtime.",
   "keywords": [
     "qovira",
@@ -39,6 +39,7 @@
     "tailwindcss": "^4.0.0"
   },
   "devDependencies": {
+    "@changesets/cli": "^2.31.0",
     "@eslint/js": "^10.0.1",
     "@fontsource-variable/figtree": "^5.2.10",
     "@fontsource-variable/fraunces": "^5.2.9",
@@ -63,6 +64,8 @@
     "typecheck": "tsc --noEmit",
     "lint": "eslint . && prettier --check .",
     "format": "prettier --write .",
-    "test": "vitest run"
+    "test": "vitest run",
+    "changeset": "changeset",
+    "version-packages": "changeset version"
   }
 }