Prepare WeBaseUI 1.0 RC

.changeset/README.md

@@ -7,5 +7,15 @@ npm run changeset
 ```
 
 Select only packages whose published contract changes. Documentation-only site
-changes do not need a changeset. Package publishing remains disabled until the
-standalone WeBaseUI repository and registry credentials are configured.
+changes do not need a changeset. Pull requests that change publishable package
+files are checked automatically, and releases publish the resulting versions to npm.
+
+The `Release` workflow creates or updates the release PR on `main`. After that PR
+is merged, the same workflow versions packages and synchronizes `package-lock.json`,
+then publishes both packages with npm trusted publishing,
+OIDC, and provenance enabled, then installs the published versions in the registry
+smoke fixture. The stable action uses `commitMode: github-api`, so it does not
+depend on persisted checkout credentials. `workflow_dispatch` supports `next`
+and `canary` pre-release tags; pre-release publication never runs from a local
+shell. The exact npm trusted-publisher setup and provenance verification steps
+live in [`docs/RELEASE_RUNBOOK.md`](../docs/RELEASE_RUNBOOK.md).

.changeset/bright-tokens-rise.md

@@ -0,0 +1,14 @@
+---
+"@webaseui/core": minor
+"@webaseui/svelte": patch
+---
+
+Add a documented three-layer token contract for palette, semantic, and
+component values, then migrate form, choice, overlay, feedback, navigation,
+selection, and action styles to shared geometry and motion tokens without
+changing their rendered defaults. Accordion, Card, Divider, EmptyState,
+SectionHeader, and Skeleton presentation values use the same contract. Add an
+exact per-component declaration budget and separately audited media-query list
+so future hardcoded-value growth requires explicit review. Tighten the example
+brand theme's muted ink and hover brand colors so normal text combinations meet
+WCAG 2.2 contrast requirements.

.changeset/calm-forms-act.md

@@ -0,0 +1,6 @@
+---
+"@webaseui/core": patch
+"@webaseui/svelte": minor
+---
+
+Include package license files, add native form-control props and Select form participation, and make Dialog, Card, and EmptyState actions explicitly actionable.

.changeset/clear-directions-hold.md

@@ -0,0 +1,10 @@
+---
+"@webaseui/core": patch
+"@webaseui/svelte": patch
+---
+
+Map semantic tokens to system colors in forced-colors mode so component
+surfaces, borders, focus rings, and state colors remain distinguishable. Make
+direction-sensitive component layout use logical properties, align Select and
+Tooltip floating content from the anchor's inherited direction, and reverse
+Tabs horizontal arrow semantics in RTL.

.changeset/focused-collections-roam.md

@@ -0,0 +1,7 @@
+---
+"@webaseui/svelte": patch
+---
+
+Unify Tabs and Accordion keyboard navigation through a tested internal roving
+focus helper, preserving wrapping and Home/End behavior while normalizing
+state against the latest dynamic collection.

.changeset/locale-numbers-flow.md

@@ -0,0 +1,7 @@
+---
+"@webaseui/svelte": minor
+---
+
+Add consumer-controlled numeric formatting callbacks to Accordion, Pagination,
+Progress, Slider, and Textarea. Existing visual defaults remain unchanged while
+localized consumers can use Intl.NumberFormat or domain-specific notation.

.changeset/localized-copy-fits.md

@@ -0,0 +1,7 @@
+---
+"@webaseui/svelte": patch
+---
+
+Expose the EmptyState kicker as a localization prop and make long labels wrap
+inside alerts, empty states, tabs, form labels, links, and card actions. Mirror
+directional action icons and slider progress in RTL.

.changeset/quick-options-cycle.md

@@ -0,0 +1,7 @@
+---
+"@webaseui/svelte": patch
+---
+
+Make Select typeahead refine multi-character queries, cycle repeated-character
+matches, skip disabled options, and clean up its reset timer through a reusable
+internal controller.

.changeset/quiet-floating-edges-align.md

@@ -0,0 +1,8 @@
+---
+"@webaseui/svelte": patch
+---
+
+Share manual-popover synchronization and collision-aware floating positioning
+between Select and Tooltip. Overlays now flip and shift within the visual
+viewport, follow nested scrolling and resize changes, keep Select trigger width,
+and retain a fixed-position fallback when the Popover API is unavailable.

.changeset/steady-overlays-lock.md

@@ -0,0 +1,7 @@
+---
+"@webaseui/svelte": patch
+---
+
+Make Dialog body scroll locking safe for nested overlays, restore opener focus
+consistently across Chromium, Firefox, and WebKit, and reuse a shared,
+cleaned-up pointer-outside listener for Select dismissal.

.changeset/tactile-targets-rest.md

@@ -0,0 +1,8 @@
+---
+"@webaseui/core": minor
+"@webaseui/svelte": patch
+---
+
+Add a public minimum interactive target token, reduced-motion coverage for
+Field and Pagination, touch-safe hover behavior, and 24px hit areas for
+choice controls, sliders, navigation links, breadcrumbs, and card actions.

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Default review responsibility for the design-system repository.
+* @willxue
+
+# Package and release changes need the repository maintainer's review.
+/packages/ @willxue
+/.github/ @willxue
+/DEVELOPMENT_PLAN.md @willxue

.github/ISSUE_TEMPLATE/accessibility.md

@@ -0,0 +1,27 @@
+---
+name: Accessibility issue
+about: Report an accessibility barrier or propose an accessibility improvement
+title: "[a11y] "
+labels: "accessibility"
+assignees: ""
+---
+
+## Barrier
+
+Describe what prevents access or makes the interaction unclear.
+
+## Affected surface
+
+- Component or documentation route:
+- Package and version:
+- Assistive technology, browser, and operating system:
+- Input mode (keyboard, touch, pointer, voice, or screen reader):
+
+## Reproduction and expected behavior
+
+Provide steps, the current announcement or focus result, and the expected
+result based on the relevant WAI-ARIA pattern or WCAG criterion.
+
+## Evidence
+
+<!-- Add a reduced test case, recording, trace, or screenshot without personal data. -->

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,27 @@
+---
+name: Bug report
+about: Report a reproducible problem in a published component or the documentation
+title: ""
+labels: "bug"
+assignees: ""
+---
+
+## What happened?
+
+Describe the observed behavior and the expected behavior.
+
+## Reproduction
+
+- Package and version:
+- Svelte, Node, browser, and operating system:
+- Minimal reproduction or repository:
+- Steps to reproduce:
+
+## Accessibility and compatibility
+
+- Does this affect keyboard, focus, screen-reader, reduced-motion, RTL, forced-colors, touch, or zoom behavior?
+- Which browser engines reproduce it?
+
+## Evidence
+
+<!-- Add a focused console error, trace, screenshot, or failing test. Remove secrets and personal data. -->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/WeOpen/WeBaseUI/security/advisories/new
+    about: Use GitHub private vulnerability reporting. Do not disclose security issues publicly.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,30 @@
+---
+name: Component or API proposal
+about: Propose a user-facing capability with a concrete consumer need
+title: ""
+labels: "enhancement"
+assignees: ""
+---
+
+## Consumer problem
+
+Which application workflow is blocked, and who is affected?
+
+## Proposed API
+
+Describe the component, props, events, snippets, native attributes, and token
+surface. Include a small usage example when possible.
+
+## Alternatives and scope
+
+What existing component or composition was considered? What is explicitly out
+of scope for the first version?
+
+## Quality and maintenance
+
+- Keyboard and ARIA pattern:
+- Reduced-motion and equivalent-input behavior:
+- RTL, forced-colors, and localization considerations:
+- SSR/hydration considerations:
+- Expected package-size or dependency impact:
+- Is a Changeset and migration note required?

.github/ISSUE_TEMPLATE/release_review.md

@@ -0,0 +1,43 @@
+---
+name: Minor release review
+about: Record adoption, defects, accessibility, compatibility, and package-size evidence after a minor release
+title: "[release review] "
+labels: "release"
+assignees: ""
+---
+
+## Release identity
+
+- Package versions:
+- Release commit and workflow run:
+- npm provenance attestations:
+- Registry smoke result:
+
+## Quality evidence
+
+- Blocking CI, browser, visual, SSR/hydration, consumer, audit, and size runs:
+- Manual VoiceOver/Safari audit record:
+- Manual NVDA/Firefox or Chrome audit record:
+- Open P0 defects:
+- Open P1 defects:
+
+## Adoption review
+
+- External consumers checked or upgraded:
+- API escape hatches or component bypasses:
+- Theme overrides that required copied component CSS:
+- SSR, hydration, routing, or form-integration issues:
+- Missing capability backed by a real workflow:
+
+## Performance and compatibility
+
+- Package and consumer bundle changes from the previous baseline:
+- Changes above the 5% review threshold and rationale:
+- Weekly Node, Svelte, TypeScript, Vite, and browser warnings:
+- Dependency additions, removals, or license changes:
+
+## Follow-up
+
+List each accepted action with an owner and target milestone. Link rejected or
+deferred requests to the API, accessibility, maintenance-cost, or consumer
+evidence that supports the decision.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## Change summary
+
+<!-- What user or maintainer problem does this change solve? -->
+
+## Quality gate
+
+- [ ] Public API, native attribute forwarding, and controlled/bindable state are unchanged or documented.
+- [ ] Keyboard, focus, screen-reader, reduced-motion, and equivalent-input behavior were checked for affected components.
+- [ ] Tests cover the changed behavior at the appropriate unit, browser, SSR, or visual layer.
+- [ ] Documentation and migration notes are updated when the public contract changes.
+- [ ] A Changeset is included for published package changes, or the omission is intentional and explained.
+- [ ] Package-size and visual-baseline changes are reviewed and explained.
+- [ ] `npm run check`, `npm run check:consumer`, and relevant browser/visual checks pass.
+
+## Verification notes
+
+<!-- List commands, consumer fixtures, browser projects, or known residual risk. -->

.github/workflows/check.yml

@@ -22,11 +22,65 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          fetch-depth: 0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22.13
           cache: npm
+      - run: npm install --global npm@11.5.1
       - run: npm ci
+      - run: npm run check:changeset
       - run: npm audit --audit-level=high
       - run: npm run check
       - run: npm run check:consumer
+
+  browser:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        browser:
+          - chromium
+          - firefox
+          - webkit
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.13
+          cache: npm
+      - run: npm install --global npm@11.5.1
+      - run: npm ci
+      - run: npx playwright install --with-deps ${{ matrix.browser }}
+      - run: npm run test:browser:project -- --project=${{ matrix.browser }}
+      - if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-${{ matrix.browser }}
+          path: test-results
+          retention-days: 7
+
+  visual:
+    runs-on: macos-14
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.13
+          cache: npm
+      - run: npm install --global npm@11.5.1
+      - run: npm ci
+      - run: npx playwright install chromium
+      - run: npm run test:visual
+      - if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-visual
+          path: test-results
+          retention-days: 7