pricing-renderer 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,137 @@
 # Changelog
 
+## [0.2.0] - 2026-11-07
+
+### Highlights
+
+- **Subscription changes.** A review screen, `<pricing-change-review>`, shows what
+  changes between the current subscription and the new one: plan, price and its
+  difference, add-ons, features and usage limits. The core gains
+  `compareSelections`, `reconcileSelection` and the DOM-free selection logic
+  (`planSelectionChange`, `applySelectionChange` and friends); the element shows
+  the customer's current plan through `currentSelection` and loads a known one
+  with `applySelection`; `pricing-renderer/space` adds helpers for SPACE
+  contracts.
+- **Headless React.** `PricingRendererProvider` and the
+  `pricing-renderer/react/headless` entry, with the `usePricingSelection`,
+  `usePricingSource` and `usePricingRendererState` hooks, render props for the
+  CTA, summary actions, loading and error states, a `style` prop and typed DOM
+  events.
+- **Fitting a host.** `slots`, `hideSections` (whole sections and the pieces of
+  the hero), `density`, new design tokens, `theme-minimal.css`,
+  `tokens-shadcn.css`, a host `.dark` class, stable state attributes and
+  per-locale unit labels.
+- **Large pricings.** Compact add-on cards above eight add-ons with a filter,
+  "Only differences", comparison groups by tag, fluid plan columns, a sticky
+  plan header and an "Add-on" marker in the comparison.
+- **Add-ons and totals.** An add-on that cannot be combined with one already
+  selected is shown as unavailable, naming what blocks it; quantity relations
+  sit on the face of the card; a price breakdown explains the estimated total,
+  which no longer hides inside the add-on layout.
+- **Loading and robustness.** `loadPricingSource`, timeouts and size limits on
+  every step of a load, cancellation of stale loads, a human error sentence and
+  instance-prefixed, collision-free ids.
+- **Accessibility and security.** Focus stays inside the renderer when content
+  collapses, variable controls describe their help and errors, and
+  `isSafeLink` rejects more unsafe link forms.
+
+### Publication
+
+Published by hand with npm two-factor authentication while GitHub Actions was
+unavailable, so this version carries no npm provenance attestation. The release
+workflow publishes later versions with provenance again.
+
+### Behaviour changes to check when upgrading
+
+- An add-on excluded by a selected add-on is no longer selectable; the
+  confirmation dialog no longer opens for exclusions.
+- Price expressions use strict equality for `==` and `!=`.
+- Add-on quantities are always kept on the min/step grid.
+- The comparison groups rows by their declared `tag`, and "Only differences"
+  starts checked for long comparisons when the attribute is absent.
+- The estimated total is no longer rendered inside the add-on layout, which
+  drops its sidebar column.
+
+### All changes
+
+#### Minor
+
+- An add-on that cannot be combined with one already selected is now shown as unavailable, the way an add-on the plan does not offer already was: not selectable, its checkbox disabled, and a status on the card that names what blocks it — "Not available with Github Codespaces 2 Core" — instead of letting a click open a dialog to say so.
+- Add `applySelection(selection)` to `<pricing-renderer>` to load a known selection, such as the customer's current subscription, once the pricing is ready.
+- Review screen for a subscription change.
+- Export the selection logic of the element from the core, free of the DOM: `planSelectionChange`, `applySelectionChange`, `selectionWithVariable`, `selectionWithAddOnQuantity`, `selectionInEffect` and `createPriceStabilizer`, with the types `SelectionChangeIntent`, `SelectionChangeResult`, `PriceStabilizer` and `PendingAddOnChange`.
+- `<pricing-renderer>` can show the customer's current subscription.
+- New opt-in `density` attribute, property and React prop (`'comfortable' | 'compact'`).
+- New optional design tokens for fitting the renderer into a host design system.
+- Add `reconcileSelection`, which deselects add-ons that are unavailable for the selected plan and the add-ons that depend on them.
+- `<pricing-renderer>` accepts a `slots` property (no attribute) with the names `plan-cta`, `summary-actions`, `loading` and `error`.
+- `<pricing-renderer>` and the React `PricingRenderer` accept `hideSections` (attribute `hide-sections`), a list of section names (`hero`, `metadata`, `billing`, `variables`, `plans`, `comparison`, `addOns`, `summary`) that are not rendered.
+- Darken the renderer and the change review when a host `.dark` class is on an ancestor and the element has `theme="auto"`, with the same tokens as `data-theme='dark'`.
+- Add `loadPricingSource` to `pricing-renderer/yaml`.
+- Type `addEventListener` for `pricing-ready`, `pricing-selection-change`, `pricing-action` and `pricing-diagnostic` through a global `HTMLElementEventMap` augmentation, so `element.addEventListener('pricing-action', (event) => event.detail.actionId)` needs no cast.
+- Add the warning `PR_VALUE_TYPE_MISMATCH` when a `NUMERIC` feature or usage limit has a text value (default value, plan or add-on override, `{ value: ...
+- Explain the estimated total with a price breakdown.
+- Add `PricingRendererProvider` and the `pricing-renderer/react/headless` entry.
+- `PricingRenderer` accepts the render props `renderPlanCta`, `renderSummaryActions`, `renderLoading` and `renderError`.
+- `PricingRenderer` in the React adapter now accepts a `style` prop.
+- Four changes to what the renderer puts on the page.
+- Three fixes to the change review, all found by driving it on a real page.
+- `<pricing-change-review>` takes a `hideSections` property (and a `hide-sections` attribute) with three parts: `actions`, for a diff the reader cannot act on; `relation`, the Upgrade/Downgrade badge, which follows the declaration order of `pricing.plans` and reads as a ladder that two configurations compared side by side do not have; and `title`, for a host whose own heading already names the comparison.
+- Security hardening: `isSafeLink`, and so plan CTA links, comparison-row documentation links and the metadata URL, now rejects values that start with `//` or `/\` (also with tab or newline characters between them) because browsers read them as links to another host.
+- Export `selectionToSearchParams` and `selectionFromSearchParams` from the core, free of the DOM, with the option types `SelectionToSearchParamsOptions` and `SelectionFromSearchParamsOptions`.
+- Pricings with more than 8 add-ons now render compact add-on cards of equal height per row, with the availability, dependency, exclusion and quantity details moved into the existing details disclosure (new i18n key `pricing.moreDetails`).
+- The React adapter now accepts the new `onlyDifferences`, `toolbarThreshold` and `addOnFilterThreshold` props.
+- The comparison groups now follow the declared `tag` of features and usage limits (visual change, approved by the owner).
+- New `only-differences` attribute sets the initial state of the comparison's "Only differences" checkbox; when it is absent, the checkbox starts checked for pricings with more than 100 comparison rows and 2 plans or more (visual change by default for those pricings, approved by the owner).
+- Add `presentation.unitLabels` to set the singular and plural text of a usage unit per locale and unit, with `*` as the default for every locale.
+- Plan and add-on cards and plan calls to action now expose stable state attributes: `data-featured` on plan cards, `data-available` on add-on cards and `data-kind` (`primary` or `secondary`) on plan calls to action.
+- Subscription change flow: comparison, SPACE helpers and guide.
+- New core function `compareSelections({ before, after, currentUsage?, expression?
+- New subpath `pricing-renderer/space` with helpers for SPACE contracts.
+- The running total no longer sits inside the add-on layout.
+- Add `pricing-renderer/theme-minimal.css`, a flat neutral theme (grayscale, no shadows, borders in the text color) that replaces `theme.css` and serves as a starting point for custom themes.
+- Add `pricing-renderer/tokens-shadcn.css`, an overlay that maps the renderer tokens to the shadcn/ui variables (`--primary`, `--card`, `--border`, `--radius`, ...) and follows the host `.dark` class.
+- Add the `usePricingSelection` hook to the `pricing-renderer/react/headless` entry, also re-exported from `pricing-renderer/react`.
+- Add the `usePricingSource` hook to the `pricing-renderer/react/headless` entry, also re-exported from `pricing-renderer/react`.
+- Add the `usePricingRendererState` hook to the `pricing-renderer/react/headless` entry, also re-exported from `pricing-renderer/react`.
+
+#### Patch
+
+- The "Add-on" marker now shows only in plans where a providing add-on can be bought; other cells keep the dash.
+- Price expressions now use strict equality for `==`, `===`, `!=` and `!==`, so `-0` equals `0` and `NaN` never equals `NaN`.
+- Add-on quantities are now always on the min/step grid: a quantity above the maximum is capped to the largest valid value (min 1, step 5, max 8 bills 6, not 8), and the quantity stepper uses the same limit.
+- `maxQuantityOnGrid` never exceeds the maximum because of floating-point error, and the quantity stepper in controlled mode shows and steps from the normalized quantity.
+- Add a design systems guide (`docs/design-systems.md`) for Tailwind CSS, CSS Modules and shadcn/ui hosts.
+- Document the events, the diagnostic codes and the Vue 3 integration.
+- Document which pricing version a page shows (`docs/pricing-versions.md`): signed-out visitors see the version SPACE assigns to new contracts, signed-in customers see their contract's version, and a SPACE-managed service is read through SPACE and not straight from SPHERE.
+- Document private pricings.
+- The element now uses the core selection functions (`planSelectionChange`, `applySelectionChange`, `selectionWithVariable`, `selectionWithAddOnQuantity`, `selectionInEffect` and `createPriceStabilizer`).
+- The focus ring on a comparison row that takes focus after "Show N more" is now drawn inside the row, so the sticky first column and the scroll container no longer hide it.
+- Ids derived from data (variable paths, group ids, add-on ids) now escape every character other than letters and digits as `_<hex>_`, so two different values can no longer produce the same id; these ids are not a documented hook.
+- Count the response body while `loadPricingFromUrl` reads it.
+- Apply `timeoutMs` and the abort signal to every step of `loadPricingFromUrl`: the `headers` function, `loadPricing`, `fetch` and the body read.
+- Show add-on names instead of identifiers in the "Requires ..." and "Cannot be combined with ..." lines of an add-on card and in the "Will add" and "Will remove" lines of the confirmation dialog.
+- Below 840px the top padding, the spacing between the rows above the plans (metadata, variables and diagnostics included) and the margin under the plans heading are capped exactly as they already are from 840px, so the first plan price fits in the first screen of a phone.
+- Show a status message instead of an empty comparison table when a pricing has no plans.
+- Show a human sentence in the element's error state instead of raw diagnostic codes.
+- Compare the `pricing`, `request` and `normalizeOptions` properties of the element by content (arrays and plain objects; functions, `Headers`, `AbortSignal` and other class instances by identity).
+- Give every `id` the element renders an instance prefix (`pr-<n>-plans-title`, `pr-<n>-dialog-title`, `pr-<n>-group-<id>`, and so on), so two renderers on one page no longer share ids and their `aria-labelledby`, `aria-describedby`, `aria-controls` and `for` references stay inside their own renderer.
+- Apply `request.maxBytes` (default 2 MiB) to a string returned by a custom `loadPricing`, measured in UTF-8 bytes.
+- Localize the loading text of the element: while it is idle or loading, the hidden heading and the status text use `loadingLabel` when set, and otherwise `pricing.loading` from the element's `locale` and `messages`, instead of a fixed English string.
+- A short comparison with `only-differences` now shows every row.
+- Resume a pricing load when the element is moved to another parent while it is still loading: the element observes its size again, measures its width and reloads, instead of staying on the loading skeleton.
+- Cancel the pricing load in flight when `reload()` finds no source or more than one: a slow `src` load that finishes after `src` was removed no longer emits `pricing-ready` or replaces the `PR_SOURCE_MISSING` / `PR_SOURCE_CONFLICT` error.
+- Tell the host how to fix a `PR_VERSION_UNSUPPORTED_MAJOR` error: for a major below 3 the message says to upgrade the pricing to 3.x on the server, for example with `retrievePricingFromText` from `pricing4ts/server`; for a major above 3 it says the version is not supported yet.
+- Pluralize the usage unit next to a numeric value in the comparison when the UI locale is English, so `3 unit` reads `3 units`.
+- Hydrating the React wrapper (`PricingRenderer`, `PricingChangeReview`) after the element has rendered no longer logs a recoverable hydration error and no longer replaces the host node.
+- Keyboard focus now stays inside the renderer when "Show N more" disappears in the comparison or in the add-on grid.
+- Clear the pending add-on change on direct commits, show loading after a stopped reload, and name the headless re-exports of the React entry.
+- The comparison no longer renders a row description that is empty or only repeats the row name.
+- Show an "Add-on" marker instead of the em dash in comparison rows that only an add-on provides (Spanish: Complemento).
+- Plan cards now fill the width in fluid columns chosen by the number of plans and the renderer width (at most 3 columns from 840px and at most 4 from 1040px, without a single card left alone in the last row where it can be avoided), and from 840px the hero title is smaller (3rem at most) and the plan cards and the space above them are tighter, so the first plan button fits in the first screen at 1440px.
+- The comparison table now scrolls vertically inside a box of at most 80% of the viewport height, so the plan header stays visible while reading a long table (the first column stays pinned and the mobile card layout is unchanged).
+- Point each variable control's `aria-describedby` at its help text and its error message, which now carry the ids `<control id>-help` and `<control id>-error`, so a screen reader reads both when the control is focused.
+
 ## [0.1.0] - 2026-07-29
 
 - Initial public npm release of the DOM-free TypeScript core, light-DOM Web
@@ -18,4 +150,5 @@
 - Public documentation, Vanilla/React/Next examples, visual baselines, and
   GitHub Release CD with npm provenance.
 
+[0.2.0]: https://github.com/javiercavlop/pricing-renderer/releases/tag/v0.2.0
 [0.1.0]: https://github.com/javiercavlop/pricing-renderer/releases/tag/v0.1.0

package/README.md

@@ -36,7 +36,7 @@ Source, issues, release notes, and immutable version tags remain public in
 
 ## Review the live example
 
-Node.js 22+ and pnpm are required for local development:
+Node.js 22.12 or newer and pnpm are required for local development (the development tools, Vite and Vitest, require it; the published library still supports `engines.node` `>=22`):
 
 ```bash
 git clone https://github.com/javiercavlop/pricing-renderer.git
@@ -57,6 +57,10 @@ pnpm demo:react
 pnpm demo:next
 ```
 
+A Vue 3 + Vite example is in [`examples/vue`](./examples/vue); run it with
+`pnpm build && pnpm --filter pricing-renderer-vue-demo dev`. See the
+[examples index](./examples/README.md).
+
 The Next example keeps the page server-rendered and isolates only the interactive
 renderer behind a client boundary.
 
@@ -79,22 +83,30 @@ yarn add pricing-renderer
 Pin the initial release when an exact, reproducible version is required:
 
 ```bash
-npm install pricing-renderer@0.1.0
+npm install pricing-renderer@0.2.0
+```
+
+Then import the renderer and its complete default stylesheet:
+
+```ts
+import 'pricing-renderer/define';
+import 'pricing-renderer/styles.css';
 ```
 
 Release locations:
 
 - npm package and provenance:
   [`pricing-renderer`](https://www.npmjs.com/package/pricing-renderer)
-- `0.1.0` release notes and source tag:
-  [`v0.1.0`](https://github.com/javiercavlop/pricing-renderer/releases/tag/v0.1.0)
+- `0.2.0` release notes and source tag:
+  [`v0.2.0`](https://github.com/javiercavlop/pricing-renderer/releases/tag/v0.2.0)
 - all GitHub releases:
   [`javiercavlop/pricing-renderer/releases`](https://github.com/javiercavlop/pricing-renderer/releases)
 
 Every published GitHub Release triggers the npm CD workflow. Stable releases
 publish under the `latest` dist-tag and GitHub prereleases under `next`; a tag,
 version, documentation, test, accessibility, visual, or package-validation
-failure stops before `npm publish`.
+failure stops before `npm publish`. Publication uses npm Trusted Publishing with
+short-lived GitHub OIDC credentials; the workflow contains no npm access token.
 
 Confirm the installed registry version with:
 
@@ -105,18 +117,47 @@ npm view pricing-renderer version
 See the [release guide](./docs/releasing.md) for provenance, validation, and
 Trusted Publishing details.
 
+### Reusable, tokenless CD
+
+The same [release workflow](./.github/workflows/release.yml) handles
+`release.published` automatically and exposes `workflow_call` with a required
+`release_tag` input. A caller in this repository can reuse all release gates:
+
+```yaml
+jobs:
+  publish:
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/release.yml
+    with:
+      release_tag: v0.2.0
+```
+
+The workflow queries GitHub before checkout and refuses drafts, missing releases,
+or mismatched tags. It derives `latest` versus `next` from the published Release,
+so callers cannot silently override the npm channel. No secrets are accepted or
+forwarded. npm trust remains intentionally bound to this package, repository,
+workflow filename, and `npm` environment; another package must configure its own
+Trusted Publisher.
+
 ## Package entry points
 
-| Import                        | Purpose                                                         |
-| ----------------------------- | --------------------------------------------------------------- |
-| `pricing-renderer`            | Types, normalization, resolution, expressions, i18n, view-model |
-| `pricing-renderer/yaml`       | YAML parsing and bounded remote loading                         |
-| `pricing-renderer/element`    | Web Component class without global registration                 |
-| `pricing-renderer/define`     | Register `<pricing-renderer>`                                   |
-| `pricing-renderer/react`      | Typed React 18/19 adapter                                       |
-| `pricing-renderer/base.css`   | Required structural and accessibility styles                    |
-| `pricing-renderer/theme.css`  | Default professional visual tokens                              |
-| `pricing-renderer/styles.css` | Base and theme combined                                         |
+| Import                                  | Purpose                                                         |
+| --------------------------------------- | --------------------------------------------------------------- |
+| `pricing-renderer`                      | Types, normalization, resolution, expressions, i18n, view-model |
+| `pricing-renderer/yaml`                 | YAML parsing and bounded remote loading                         |
+| `pricing-renderer/element`              | Web Component class without global registration                 |
+| `pricing-renderer/define`               | Register `<pricing-renderer>`                                   |
+| `pricing-renderer/define-change-review` | Register `<pricing-change-review>`                              |
+| `pricing-renderer/react`                | Typed React 18/19 adapter                                       |
+| `pricing-renderer/react/headless`       | React provider and hooks, no Lit and no element                 |
+| `pricing-renderer/space`                | SPACE helpers: selection, novation body, version, usage         |
+| `pricing-renderer/base.css`             | Required structural and accessibility styles                    |
+| `pricing-renderer/theme.css`            | Default professional visual tokens                              |
+| `pricing-renderer/styles.css`           | Base and theme combined                                         |
+| `pricing-renderer/tokens-shadcn.css`    | Overlay that maps the tokens to shadcn/ui variables             |
+| `pricing-renderer/theme-minimal.css`    | Flat grayscale theme that replaces `theme.css`                  |
 
 ## Web Component
 
@@ -139,8 +180,9 @@ configurePricingRenderer({
 
 Every option is optional. The deterministic built-in defaults are English
 (`en-US`), `/pricing`, selectable plans/add-ons, visible CTAs, and editable
-variables. `pricingPath` is the canonical host-application route; the library
-exposes it but does not mutate or install routes in the host router. An
+variables. `pricingPath` is deprecated metadata kept for compatibility: the
+host router owns the route, and nothing in the renderer reads the value (it is
+only validated, stored and reflected as the `pricing-path` attribute). An
 individual element or React instance can override any value. With
 `variablesEnabled: false`, formulas use the iPricing variable defaults.
 
@@ -163,8 +205,9 @@ Render a public remote source:
 ></pricing-renderer>
 ```
 
-`locale` and `pricingPath` are initial host configuration. Set them globally,
-when the renderer is created, or through the equivalent properties/React props.
+`locale` is initial host configuration (`pricingPath` is deprecated and has no
+effect). Set it globally, when the renderer is created, or through the
+equivalent property/React prop.
 The library does not inject a language picker into production UI. The showcase
 picker only demonstrates that locale configuration can be changed reactively.
 
@@ -210,6 +253,29 @@ The React entry is safe to import during SSR and is marked as a client
 component. Full pricing content appears after hydration; deep light-DOM SSR is
 not a v1 contract.
 
+The adapter assigns every prop on each render. The element compares `pricing`,
+`request` and `normalizeOptions` by content, so an inline `request` object with
+the same content does not reload. Functions, `Headers`, `AbortSignal` and other
+class instances are compared by identity, and so are `loadPricing`, `yaml` and
+`src`. Keep `loadPricing` and a `headers` function stable with `useCallback` or
+`useMemo`, or the element fetches again on every render. Call `reload()` on a ref
+to force a fetch, also after you changed an input object in place. The rules are
+in the [API reference](./docs/api-reference.md#when-a-property-starts-a-new-load).
+
+`pricing-renderer/react` needs both `react` and `react-dom` (the render props use
+`createPortal`). For your own pricing UI, `pricing-renderer/react/headless` has no Lit and no
+element: `PricingRendererProvider` shares settings without writing a global,
+`usePricingSource` loads a pricing, `usePricingSelection` holds the selection and view model, and
+`usePricingRendererState(ref)` reads the state of a rendered `PricingRenderer`.
+`PricingRenderer` also takes `renderPlanCta`, `renderSummaryActions`, `renderLoading` and
+`renderError` to draw your React output inside the renderer. See the
+[React guide](./docs/react.md) and the [Next.js guide](./docs/nextjs.md).
+
+## Vue 3
+
+The element works in Vue 3 with `isCustomElement` and the `.prop` modifier for
+object properties. See the [Vue 3 and Vite guide](./docs/vue.md).
+
 ## Plan highlights, inheritance, and badges
 
 Card highlights can reference both features and usage limits without ambiguity.
@@ -323,26 +389,55 @@ Public events:
 - `pricing-selection-change`
 - `pricing-action`
 - `pricing-diagnostic`
+- `pricing-slots-change`
+
+`addEventListener` is typed for these five names through the global
+`HTMLElementEventMap`, so a listener needs no cast. See the
+[events reference](./docs/events.md) for each payload and the diagnostic codes.
 
 ## Private remote sources
 
-Secrets are property-only and never reflected into markup:
+Never put a SPHERE or SPACE key in browser code. The safe default is a same-origin
+server route that holds the key and serves the pricing:
+
+```ts
+renderer.src = '/api/pricing';
+renderer.request = {
+  credentials: 'same-origin',
+  timeoutMs: 15_000,
+  maxBytes: 2 * 1024 * 1024,
+};
+```
+
+`request` is property-only and never reflected into markup. Use `request.headers`
+only for short-lived tokens of the signed-in user, and never put a token in `src`:
 
 ```ts
-renderer.src = 'https://api.example.com/private/pricing.yml';
 renderer.request = {
-  credentials: 'include',
   headers: async () => ({
     Authorization: `Bearer ${await refreshAccessToken()}`,
   }),
-  timeoutMs: 15_000,
-  maxBytes: 2 * 1024 * 1024,
 };
 ```
 
+See [Private pricings](./docs/private-pricings.md) for Next.js and Express recipes,
+version pinning and ETag revalidation.
+
 Use `loadPricing` for OAuth exchanges, signed URLs, proxies, or SDK clients. The
 built-in loader permits HTTP/HTTPS `GET` only, defaults to
 `credentials: "omit"`, honors cancellation, and never fetches during SSR.
+`request.timeoutMs` and an abort cut off every step: a `loadPricing`, `fetch` or
+`headers` function that ignores the signal fails the load with
+`PR_SOURCE_ABORTED`, its late result is ignored, and its work is not stopped. A
+signal already aborted at the start fails the load with `PR_SOURCE_ABORTED`.
+`request.maxBytes` (2 MiB by default) also limits a string that `loadPricing`
+returns, measured in UTF-8 bytes; a larger one fails with `PR_SOURCE_TOO_LARGE`.
+An object result is not measured.
+
+If the first load fails, the element shows a short sentence for the kind of
+failure (source, format, version or other) and a closed "Technical details"
+disclosure with the diagnostic codes. The codes are also in the `pricing-diagnostic`
+event. See [Error state](./docs/api-reference.md#error-state).
 
 ## Theming
 
@@ -381,15 +476,27 @@ Extend future/vendor syntax with `PricingSyntaxAdapter`, translations with
 `registerMessageCatalog`, and domain calculations through explicitly
 allow-listed expression functions. See [Extending](./docs/extending.md).
 
+## Used by
+
+- [Delivera](https://github.com/isa-group/Delivera) uses Pricing Renderer to show its pricing plans.
+
 ## Documentation
 
 - [Architecture](./docs/architecture.md)
 - [API reference](./docs/api-reference.md)
 - [Project and instance configuration](./docs/configuration.md)
+- [Events and diagnostics](./docs/events.md)
+- [React: provider, hooks and render props](./docs/react.md)
+- [Next.js (App Router)](./docs/nextjs.md)
+- [Vue 3 and Vite](./docs/vue.md)
+- [Private pricings](./docs/private-pricings.md)
+- [Preload the current subscription](./docs/preload-current-subscription.md)
+- [Change a subscription](./docs/change-subscription-flow.md)
 - [Demo and release acceptance](./docs/demo.md)
 - [Release and npm publication](./docs/releasing.md)
 - [Extending the library](./docs/extending.md)
 - [Theming](./docs/theming.md)
+- [Design systems](./docs/design-systems.md)
 - [Internationalization](./docs/i18n.md)
 - [Pricing2Yaml compatibility](./docs/pricing2yaml-compatibility.md)
 - [Contributing](./CONTRIBUTING.md)
@@ -409,7 +516,9 @@ pnpm package:check
 ```
 
 Browser coverage includes Chromium, Firefox, WebKit, Axe, keyboard paths, and
-visual breakpoints. Releases use Changesets, SemVer, npm provenance, and MIT.
+visual breakpoints. Releases use Changesets, SemVer, and MIT, and the release
+workflow publishes them with npm provenance. 0.2.0 is the exception: it was
+published by hand while GitHub Actions was unavailable, so it carries none.
 
 ## Security
 
@@ -417,3 +526,11 @@ Pricing text is escaped, links use safe schemes, and expressions cannot reach
 globals or prototypes. `private` only controls presentation—remove confidential
 data before delivering YAML to a browser. Report vulnerabilities through the
 process in [SECURITY.md](./SECURITY.md).
+
+## Funding
+
+This work has been partially supported by PID2024-155693NB-C44, funded by
+MICIU/AEI/10.13039/501100011033/FEDER, EU; SOL2024-31777 funded by the PPIT of
+the Universidad de Sevilla under the Programa Operativo FEDER Andalucía
+2021-2027; and the Horizonte 2027 doctoral training program funded by Junta de
+Andalucía (Consejería de Universidad, Investigación e Innovación).

package/THIRD_PARTY_NOTICES.md

@@ -1,10 +1,88 @@
 # Third-party notices
 
-This project was informed by the following MIT-licensed projects. Their editor
-implementations are not bundled into this package.
+## Projects that informed this package
 
-- Sphere — Copyright Alex-GF and contributors — https://github.com/Alex-GF/Sphere
-- Pricing4TS — Copyright Alex-GF and contributors — https://github.com/Alex-GF/Pricing4TS
+This project was informed by the following projects, both licensed under the
+MIT License (reproduced below). Their editor implementations are not bundled
+into this package.
 
-The full dependency license inventory is generated from the lockfile for every
-release. Each runtime dependency retains its own copyright and license terms.
+- Sphere — Copyright (c) 2024 Alejandro García Fernández — https://github.com/Alex-GF/Sphere
+- Pricing4TS — Copyright (c) 2024 Alejandro García Fernández — https://github.com/Alex-GF/Pricing4TS
+
+The copyright lines above were checked against the `LICENSE` file at the
+default branch of each repository.
+
+```text
+MIT License
+
+Copyright (c) 2024 Alejandro García Fernández
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## Direct runtime dependencies
+
+Versions and licenses were read from the `package.json` files installed in
+`node_modules` after `pnpm install --frozen-lockfile`. They reflect the
+lockfile at the time of writing and are maintained by hand; this file is not
+regenerated automatically.
+
+| Package    | Version | License      |
+| ---------- | ------- | ------------ |
+| lit        | 3.3.3   | BSD-3-Clause |
+| @lit/react | 1.0.8   | BSD-3-Clause |
+| yaml       | 2.9.0   | ISC          |
+
+## Optional peer dependencies
+
+These are not bundled or installed by this package. They are only needed for
+the React entry point. Versions are the ones installed for development.
+
+| Package   | Version | License |
+| --------- | ------- | ------- |
+| react     | 19.2.8  | MIT     |
+| react-dom | 19.2.8  | MIT     |
+
+## Transitive dependencies
+
+Transitive dependencies are not listed here. Each dependency retains its own
+copyright and license terms; see the package contents in `node_modules` or the
+lockfile for the full set.
+
+## Test data (not distributed)
+
+`tests/fixtures/spectra/` holds 37 iPricings from two sources:
+
+- SaaS Pricing Evaluation Corpus for Temporal Representation & Analysis
+  (SPECTRA) — Francisco Javier Cavero, José Antonio Parejo, Juan C. Alonso and
+  Antonio Ruiz-Cortés, 2025, Zenodo — version 1.2.0,
+  <https://doi.org/10.5281/zenodo.17237164> — licensed under
+  [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). 30 files.
+- pricing-intelligence-labpack (isa-group), extended copy of SPECTRA — commit
+  `49e90f5a3d4dde91d15614e5c8269085888b6f0b` of
+  <https://github.com/isa-group/pricing-intelligence-labpack> — licensed under
+  [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) according to the
+  `LICENSE.txt` at the root of the repository. 7 files: CircleCI, Okta,
+  Shopify, Trello, Webflow, ZenHub and Zoom.
+
+Modifications: the files were upgraded from Pricing2Yaml 2.1 to 3.1 with
+pricing4ts 0.12.1 and one Trello value was corrected; the fixture README lists
+the changes.
+
+The tests use these files; the published package does not contain them.