@tollerud/ui 4.0.2 → 4.0.3

package/AGENTS.md

@@ -44,7 +44,7 @@ npm install @tollerud/footer
 
 Adjust `@source` relative to your CSS file. Without it, classes used only inside `@tollerud/ui` dist may be purged.
 
-**Optional preset shim** — extra utilities from `tollerud-preset.js`:
+**Optional preset shim** — extra utilities from `@tollerud/ui/preset`:
 
 ```ts
 // tailwind.config.ts

package/CHANGELOG.md

@@ -7,6 +7,31 @@
      • Never write bold mid-paragraph as a heading substitute — it merges into surrounding text
 -->
 
+## 4.0.3 — 2026-06-09 — Publish pipeline hardening
+
+Patch release: aligns npm publish with `validate`, fixes preset export shape, enables provenance via OIDC, and fixes `@tollerud/footer` CI build.
+
+### Changed
+
+- `prepublishOnly` and `publish-npm.yml` now run `verify:footer-sync` and `test:consumer` before publish
+- `publish-npm.yml` auto-builds and publishes `@tollerud/footer` alongside `@tollerud/ui`
+- `tollerud-preset.js` renamed to `tollerud-preset.cjs` — fixes publint CJS-in-ESM warning; import via `@tollerud/ui/preset`
+- `@tollerud/ui/utils` subpath no longer ships `'use client'` — `cn` is safe to import from Server Components
+- Removed `engines.node` from `package.json` (contributor Node/npm guidance stays in `CONTRIBUTING.md`)
+- Publish uses npm Trusted Publishers (OIDC) with `--provenance` instead of `NPM_TOKEN`
+- `@tollerud/footer` ships its own `tsup.config.ts` — stops inheriting root TS 6 `tsconfig.build.json` during DTS emit
+
+### Docs
+
+- `README.md`, `GETTING_STARTED.md`, `SKILL.md`, `AGENTS.md` — preset import path updated
+- Added `NPM_PACKAGE_PLAN.md` — npm hardening audit and task list
+
+### Migration
+
+Nothing breaking. If you copied `tollerud-preset.js` locally, rename to `tollerud-preset.cjs` or switch to `import preset from '@tollerud/ui/preset'`.
+
+---
+
 ## 4.0.2 — 2026-06-10 — Repo layout and publish surface cleanup
 
 Patch release: consolidates docs and CI fixtures, stops shipping internal manifests, and clarifies docs copy after the npm-only pivot.

package/GETTING_STARTED.md

@@ -29,7 +29,7 @@ npm install @paper-design/shaders-react
 
 `globals.css` bundles Tailwind v4, design tokens, and all component layer styles. Point `@source` at the package `dist` folder relative to your CSS file so component utility classes are not purged.
 
-**Optional preset shim** — for extra theme tokens from `tollerud-preset.js`:
+**Optional preset shim** — for extra theme tokens from `@tollerud/ui/preset` (`tollerud-preset.cjs`):
 
 ```ts
 // tailwind.config.ts

package/README.md

@@ -51,7 +51,7 @@ npm install @paper-design/shaders-react
 
 Adjust the `@source` path relative to your CSS file so it resolves to `node_modules/@tollerud/ui/dist`.
 
-**Optional preset shim** — if you need utilities from `tollerud-preset.js` beyond what `tokens.css` provides:
+**Optional preset shim** — if you need utilities from `@tollerud/ui/preset` beyond what `tokens.css` provides:
 
 ```ts
 // tailwind.config.ts
@@ -97,13 +97,13 @@ import { Button, Card, Badge, StatusDot, CodeBlock, Kbd, CommandMenu, NoirGlowBa
 
 TypeScript types are included — no `@types/*` package needed. See **[COMPONENTS.md](COMPONENTS.md)** for the full prop reference for every component.
 
-Publish a new version by bumping `version` in `package.json` and pushing to `main` — the `publish-npm` GitHub Action detects the version change, runs `npm publish` (using the `NPM_TOKEN` secret), and then creates a matching GitHub Release automatically.
+Publish a new version by bumping `version` in `package.json` and pushing to `main` — the `publish-npm` GitHub Action detects the version change, runs `npm publish --provenance` via npm Trusted Publishers (OIDC), and then creates a matching GitHub Release automatically.
 
 ### Copy from repo (alternative)
 
 ```bash
 npm install clsx tailwind-merge
-cp tollerud-preset.js globals.css components/ -r <your-next-project>/
+cp tollerud-preset.cjs globals.css components/ -r <your-next-project>/
 ```
 
 Then use local paths instead of `@tollerud/ui` in the snippets above.
@@ -235,7 +235,7 @@ design-system/
 ├── globals-v3.css            # Tailwind v3 legacy
 ├── globals-layers.css        # Shared component CSS layers
 ├── tokens.css                # Design tokens
-├── tollerud-preset.js        # Tailwind preset
+├── tollerud-preset.cjs       # Tailwind preset (CJS)
 ├── scripts/                  # Build, validate, docs, and release helpers
 ├── docs-app/                 # Next.js docs site (static export → _site/)
 │   ├── app/                  # App Router + globals.css

package/SKILL.md

@@ -22,7 +22,7 @@ npm install @paper-design/shaders-react
 
 As of **v4.0.1**, install is **npm-only** — `import { Button } from '@tollerud/ui'` or subpaths like `@tollerud/ui/button`. Copy-via-shadcn registry CLI is unsupported. As of **v4.0.0**, `@tollerud/ui/globals-v4.css` is removed — use `globals.css` only. Brand assets live at `@tollerud/ui/brand/*`. As of **v3.1.1**, `.tollerud-display-shimmer` ships in `globals.css` for animated hero accent text. As of **v3.1.0**, `Monogram` ships as an inline SVG component (`color`: `yellow` | `black` | `white`). As of **v3.0.0**, the package is **ESM-only** (no CJS `require` entry). As of **v2.0.0**, Radix, Lucide, Framer Motion, and Sonner are **required peers** (not bundled).
 
-Apply the Tailwind preset when you need extra utilities from `tollerud-preset.js` — `globals.css` already includes tokens and component layers for v4:
+Apply the Tailwind preset when you need extra utilities from `@tollerud/ui/preset` — `globals.css` already includes tokens and component layers for v4:
 
 ```css
 /* app/globals.css — Tailwind v4 (default) */

package/dist/utils.js

@@ -1,4 +1,3 @@
-'use client';
 export { cn } from './chunk-WSQNPRGN.js';
 //# sourceMappingURL=utils.js.map
 //# sourceMappingURL=utils.js.map

package/globals.css

@@ -6,7 +6,7 @@
      @import '@tollerud/ui/globals.css';
      @source '../node_modules/@tollerud/ui/dist';
 
-   Optional preset shim (extra theme tokens from tollerud-preset.js):
+   Optional preset shim (extra theme tokens from tollerud-preset.cjs):
 
      @import 'tailwindcss';
      @config './tailwind.config.ts';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tollerud/ui",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "Tollerud User Interface — dark, monochrome + yellow accent. Noir aesthetic meets modern utility.",
   "private": false,
   "type": "module",
@@ -13,11 +13,8 @@
     "url": "https://github.com/Tollerud/ui/issues"
   },
   "license": "MIT",
-  "author": "Mathias Tollerud <mathias.tollerud@gmail.com>",
+  "author": "Mathias Tollerud <mathias@tollerud.no>",
   "packageManager": "npm@11.16.0",
-  "engines": {
-    "node": ">=20"
-  },
   "sideEffects": [
     "*.css"
   ],
@@ -36,7 +33,7 @@
     "./globals-layers.css": "./globals-layers.css",
     "./tailwind.css": "./tailwind.css",
     "./tokens.css": "./tokens.css",
-    "./preset": "./tollerud-preset.js",
+    "./preset": "./tollerud-preset.cjs",
     "./brand/tollerud-logo.svg": "./brand/tollerud-logo.svg",
     "./brand/tollerud-avatar.svg": "./brand/tollerud-avatar.svg",
     "./brand/tollerud-avatar.png": "./brand/tollerud-avatar.png",
@@ -56,7 +53,7 @@
     "globals-layers.css",
     "tailwind.css",
     "tokens.css",
-    "tollerud-preset.js",
+    "tollerud-preset.cjs",
     "GETTING_STARTED.md",
     "COMPONENTS.md",
     "CHANGELOG.md",
@@ -86,7 +83,7 @@
     "docs:props": "node scripts/generate-props.mjs",
     "test:props": "node scripts/verify-props-drift.mjs",
     "validate": "npm run typecheck && npm run lint && npm run test && npm run build && npm run test:subpath && npm run test:drift && npm run test:package && npm run test:size && npm run test:props && npm run verify:footer-sync && npm run build:docs && npm run test:consumer",
-    "prepublishOnly": "npm run sync:registry && npm run typecheck && npm run lint && npm run test && npm run build && npm run test:subpath && npm run test:drift && npm run test:package && npm run test:size && npm run test:props",
+    "prepublishOnly": "npm run sync:registry && npm run typecheck && npm run lint && npm run test && npm run build && npm run test:subpath && npm run test:drift && npm run test:package && npm run test:size && npm run test:props && npm run verify:footer-sync && npm run test:consumer",
     "build:docs": "node scripts/build-docs.mjs",
     "preview:docs": "npx --yes serve _site -l 4173"
   },

package/{tollerud-preset.js → tollerud-preset.cjs}

@@ -4,7 +4,7 @@
   * Drop this into any Tailwind project:
   *
   *   // tailwind.config.ts
-  *   import tollerudPreset from './path/to/tollerud-preset'
+  *   import tollerudPreset from '@tollerud/ui/preset'
  *   export default {
  *     presets: [tollerudPreset],
  *     content: ['your-source-files'],