1.4.0

.github/workflows/browser-tests.yml

@@ -20,16 +20,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - name: Use Node.js 24
-        uses: actions/setup-node@v5
+      - name: Use Node.js 22
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: 24
+          node-version: 22
           cache: npm
 
       - name: Install dependencies
         run: npm ci
 
       - name: Run browser validation
-        run: npm run validate:browsers
+        run: npm run validate:browsers

.github/workflows/ci.yaml

@@ -12,25 +12,35 @@ concurrency:
 
 jobs:
   quality:
-    name: Package quality checks
+    name: Package quality checks (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
+    strategy:
+      fail-fast: false
+      # Run the full deterministic release gate on the minimum supported major and the preferred LTS major.
+      matrix:
+        include:
+          - node-version: 20
+            validation-script: validate:node20
+          - node-version: 22
+            validation-script: validate:ci
+
     permissions:
       contents: read
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - name: Use Node.js 24
-        uses: actions/setup-node@v5
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: 24
+          node-version: ${{ matrix.node-version }}
           cache: npm
 
       - name: Install dependencies
         run: npm ci
 
       - name: Validate package
-        run: npm run validate:ci
+        run: npm run ${{ matrix.validation-script }}

.github/workflows/npm-publish.yml

@@ -3,7 +3,6 @@ name: Publish to npm
 on:
   release:
     types: [published]
-  workflow_dispatch:
 
 concurrency:
   group: npm-publish-${{ github.ref }}
@@ -21,15 +20,40 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          ref: ${{ github.event.release.tag_name }}
 
-      - name: Use Node.js 24
-        uses: actions/setup-node@v5
+      - name: Use Node.js 22
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: 24
+          node-version: 22
           registry-url: https://registry.npmjs.org/
           cache: npm
 
+      - name: Validate release metadata
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          node <<'NODE'
+          const { readFileSync } = require("node:fs");
+
+          const manifest = JSON.parse(readFileSync("package.json", "utf8"));
+          const changelog = readFileSync("CHANGELOG.md", "utf8");
+          const expectedTag = `v${manifest.version}`;
+          const escapedVersion = manifest.version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+          const releaseHeadings =
+            changelog.match(new RegExp(`^## ${escapedVersion} - \\d{4}-\\d{2}-\\d{2}\\r?$`, "gm")) ?? [];
+
+          if (process.env.RELEASE_TAG !== expectedTag) {
+            throw new Error(`Release tag ${process.env.RELEASE_TAG} must equal ${expectedTag}.`);
+          }
+
+          if (releaseHeadings.length !== 1) {
+            throw new Error(`Expected exactly one dated changelog heading for ${manifest.version}.`);
+          }
+          NODE
+
       - name: Install dependencies
         run: npm ci
 
@@ -39,4 +63,4 @@ jobs:
       - name: Publish to npm
         run: npm publish --provenance --access public --ignore-scripts
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/wiki-sync.yml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Checkout wiki repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           repository: ${{ github.repository }}.wiki
           token: ${{ github.token }}

.stylelintrc.cjs

@@ -7,6 +7,6 @@ module.exports = {
     "color-function-notation": null,
     "alpha-value-notation": null,
     "property-no-vendor-prefix": null,
-    "no-descending-specificity": null
-  }
+    "no-descending-specificity": null,
+  },
 };

CHANGELOG.md

@@ -6,6 +6,46 @@ All notable changes to this package are documented in this file.
 
 ## Unreleased
 
+## 1.4.0 - 2026-07-19
+
+### Added
+
+- Added the state-only `state-core.css` entry point for consumers whose design system already owns paint and geometry.
+- Added the complete `standalone-preset.css` entry point while preserving every established 1.x root, CSS, CommonJS, and ESM import.
+- Added a state-first interaction lab with live action, toggle, navigation, selection, loading, disabled, variant, level, and icon-control examples.
+
+### Changed
+
+- Raised the npm engine contract and release validation matrix to Node.js 20+ with explicit Node.js 20 and Node.js 22 CI lanes.
+- Split authored CSS into focused state-core and standalone-preset modules, then generate all public and distribution bundles from those sources.
+- Made interaction lift composable with consumer and companion-library transforms by using token-driven individual translation.
+- Reorganized the npm README, demo, and wiki around entry-point choice, semantic state recipes, and clear ecosystem ownership.
+
+### Fixed
+
+- Fixed native file input selector-button styling by mapping `input[type="file"].interactive-surface::file-selector-button` into the same token, hover, focus, active, and disabled state contract as the host surface.
+- Fixed disabled-state precedence so native, ARIA, and class-based disabled surfaces cannot retain active, persistent, or loading feedback.
+- Fixed UI Style Kit motion composition across supported bridge modifiers and stylesheet import orders.
+- Fixed token-dialog focus containment, focus restoration, and stale status feedback between editing sessions.
+
+### Accessibility
+
+- Added semantic coverage for mixed pressed, non-false current, selected, busy, and loading states.
+- Preserved static state meaning with reduced motion and strengthened focus and persistent-state affordances in forced-colors and greater-contrast modes.
+- Kept hover feedback gated to hover-capable pointers while retaining press, focus, and persistent feedback for coarse-pointer users.
+
+### Documentation
+
+- Rebuilt the README as an npm-first guide with durable wiki links, pinned 1.4.0 examples, accessibility responsibilities, and migration-free compatibility guidance.
+- Updated the wiki API, tokens, installation, testing, publishing, roadmap, FAQ, and contribution guidance to match the 1.4.0 package contract.
+- Linked the Interface Systems Lab as the canonical integrated proof with `ui-style-kit-css` and `layout-style-css`.
+
+### Testing
+
+- Added generated-bundle, documentation, public-selector, state-core, and entry-point contract coverage.
+- Expanded rendered browser coverage for semantic states, motion preferences, forced colors, pointer capabilities, companion-library integration, and the responsive demo.
+- Added actual packed-tarball inspection and temporary-consumer resolution checks for every legacy and new public export.
+
 ## 1.3.0 - 2026-07-08
 
 ### Added