2.0.0

.github/workflows/ci.yml

@@ -0,0 +1,66 @@
+name: Continuous Integration
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Node ${{ matrix.node-version }} / Chromium quick gate
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [20, 22]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Chromium
+        run: npx --no-install playwright install --with-deps chromium
+
+      - name: Run package gate
+        run: npm run check
+
+  browser-compatibility:
+    name: Rendered matrix / ${{ matrix.browser }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        browser: [chromium, firefox, webkit]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install selected Playwright browser
+        run: npx --no-install playwright install --with-deps ${{ matrix.browser }}
+
+      - name: Build generated CSS
+        run: npm run build
+
+      # Keep engine failures isolated so a browser-specific regression is immediately visible.
+      - name: Run rendered browser matrix
+        run: npm run test:demo:${{ matrix.browser }}

.github/workflows/npm-publish.yml

@@ -6,23 +6,38 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: "Release tag to publish, for example v1.1.2"
+        description: "Release tag to publish, for example v2.0.0"
         required: true
         type: string
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
+    environment:
+      name: npm
     env:
       RELEASE_TAG: ${{ github.event.inputs.release_tag || github.event.release.tag_name }}
     steps:
-      - name: Check out release tag
+      - name: Validate release tag format
+        shell: bash
+        run: |
+          set -euo pipefail
+          SEMVER_PATTERN='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*)|([0-9]*[A-Za-z-][0-9A-Za-z-]*))(\.((0|[1-9][0-9]*)|([0-9]*[A-Za-z-][0-9A-Za-z-]*)))*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'
+          if [[ ! "$RELEASE_TAG" =~ $SEMVER_PATTERN ]]; then
+            echo "::error title=Invalid release tag::Expected a strict v-prefixed semantic version, got ${RELEASE_TAG}."
+            exit 1
+          fi
+
+      - name: Check out exact release tag
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.release_tag || github.event.release.tag_name }}
+          ref: refs/tags/${{ github.event.inputs.release_tag || github.event.release.tag_name }}
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -31,22 +46,43 @@ jobs:
           cache: npm
           registry-url: https://registry.npmjs.org/
 
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Validate release tag
+      - name: Verify release trust boundary
+        shell: bash
         run: |
-          # The published tag is the package artifact contract; fail before npm publish if it drifts.
-          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+          set -euo pipefail
+          TAG_REF="refs/tags/${RELEASE_TAG}"
+          git show-ref --verify --quiet "$TAG_REF"
+          TAG_COMMIT="$(git rev-parse "${TAG_REF}^{commit}")"
+          HEAD_COMMIT="$(git rev-parse HEAD)"
+
+          if [ "$HEAD_COMMIT" != "$TAG_COMMIT" ]; then
+            echo "::error title=Release checkout mismatch::HEAD ${HEAD_COMMIT} does not match ${TAG_REF} at ${TAG_COMMIT}."
+            exit 1
+          fi
+
+          # Only commits reachable from protected main may execute package lifecycle code.
+          git fetch --no-tags origin "+refs/heads/main:refs/remotes/origin/main"
+          if ! git merge-base --is-ancestor "$TAG_COMMIT" refs/remotes/origin/main; then
+            echo "::error title=Untrusted release commit::${TAG_REF} is not reachable from origin/main."
+            exit 1
+          fi
+
+          PACKAGE_VERSION="$(node -e "process.stdout.write(JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version)")"
           if [ "v${PACKAGE_VERSION}" != "$RELEASE_TAG" ]; then
             echo "::error title=Release tag mismatch::Expected v${PACKAGE_VERSION}, got ${RELEASE_TAG}."
             exit 1
           fi
 
-      - name: Verify package
-        run: npm run check
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Playwright browsers
+        run: npx --no-install playwright install --with-deps chromium firefox webkit
+
+      - name: Verify release package
+        run: npm run release:verify
 
       - name: Publish package to npm
-        run: npm publish --access public
+        run: npm publish --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CHANGELOG.md

@@ -1,8 +1,33 @@
 # Changelog
 
-All notable changes to `layout-style-css` are documented here.
+All notable changes to `layout-style-css` are documented here. This project follows semantic versioning.
 
-This project follows semantic versioning. The `1.1.2` release is a patch recovery for the `1.1.1` package and keeps the existing `ly-*` public contract intact.
+## [2.0.0] - 2026-07-19
+
+### Breaking
+
+- Rebuilt the package as a dependency-free, container-first layout system requiring Node.js 20 or newer for development scripts.
+- Replaced size-tier wrappers with compact, prose, content, wide, full, and breakout semantics; wrappers now include fluid logical gutters and safe-area compensation.
+- Standardized personalities, recipes, and regions on `data-ly-layout`, `data-ly-recipe`, and `data-ly-area`.
+- Replaced root personality exports and companion `all-with-ui-kit*` aggregates with focused modules under `personalities/` and `integrations/`.
+- Moved v1 containers, root hooks, columns, and recipe aliases into the opt-in `legacy.css` bundle for the v2 line; removal is scheduled for v3.
+
+### Added
+
+- Added stack, cluster, center, cover, switcher, sidebar, grid, split, panes, media, reel, frame, and bounded-scroll primitives.
+- Added seven functional recipes that preserve mobile DOM, reading, and focus order while rearranging named areas at `48rem` and `64rem` container thresholds.
+- Made every `data-ly-recipe` value a complete alternative to its matching class and kept explicit wrapper measures authoritative under all personalities.
+- Added sixteen spatially distinct personalities across left-rail, right-rail, three-zone, mosaic, and equal-split families.
+- Added explicit base, medium-container, and large-container order escape hatches with accessibility guidance.
+- Added a maintainable interactive layout lab with allowlisted query state, copyable snippets, ecosystem modes, and rendered coverage at 375px, 768px, 1280px, and 1440px.
+- Added a complete 1.x-to-2.0 migration guide, Node.js 20/22 CI, and Chromium, Firefox, and WebKit release verification.
+
+### Integration
+
+- Pinned `ui-style-kit-css@2.0.1` and `interactive-surface-css@1.4.0` as development fixtures only; the default package has no companion imports, peer dependencies, or runtime dependencies.
+- Documented the all-three import order as UI Style Kit bridge, Interactive Surface `state-core.css`, Layout integration bridge, then Layout core.
+- Kept the upcoming UI Style Kit revision as a follow-up outside this release.
+- Preserved structural v1 `.ly-content` and `.ly-divider` compatibility while leaving the removed paint-owned `.ly-surface--raised` selector to UI Style Kit or application themes.
 
 ## [1.1.2] - 2026-07-08
 

CONTRIBUTING.md

@@ -8,6 +8,7 @@ Thanks for improving `layout-style-css`. This repository is a CSS layout library
 npm install
 npm run build
 npm run lint
+npm run check:demo-js
 npm test
 ```
 
@@ -23,14 +24,17 @@ npm run release:verify
 - Regenerate `dist/` with `npm run build`; do not hand-edit generated dist files.
 - Keep public layout classes prefixed with `ly-`.
 - Leave colors, typography, borders, shadows, native controls, focus states, themes, and modes to `ui-style-kit-css`.
-- Add structural aliases in `styles/layout-ui-style-kit-bridge.css` only when they map to layout primitives or layout recipes.
+- Add structural aliases in `styles/integrations/ui-style-kit.css` only when they map to layout primitives or layout recipes.
+- Preserve semantic mobile DOM, reading, and focus order; built-in recipes must use named areas instead of `order`.
+- Test container behavior below and above `48rem` and `64rem`.
 - Update README, `docs/wiki`, and `CHANGELOG.md` when a public class, export, recipe, release workflow, or package behavior changes.
 
 ## Testing Expectations
 
 Every change that affects public behavior should update or preserve:
 
 - `test/layout-css-contract.test.mjs` for package, CSS, docs, and tarball contracts.
+- `test/release-docs-contract.test.mjs` for current documentation and workflow contracts.
 - `test/demo-smoke.test.mjs` for rendered demo behavior.
 - `test/pages-artifact.test.mjs` for GitHub Pages output.
 - `stylelint` for authored CSS formatting.
@@ -42,6 +46,7 @@ Every change that affects public behavior should update or preserve:
 - README examples use exported package entrypoints.
 - Documentation links resolve to versioned files.
 - Demo controls remain compact on mobile and tablet viewports.
+- Chromium, Firefox, and WebKit pass for release-facing rendered changes.
 - New CSS does not introduce UI Style Kit-owned visual declarations.
 
 ## Wiki Updates