diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index b787a7c..3415bdc 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -54,9 +54,6 @@ jobs:
}
NODE
- - name: Install trusted-publishing npm CLI
- run: npm install --global npm@11.5.1
-
- name: Install dependencies
run: npm ci
@@ -102,5 +99,8 @@ jobs:
- name: Run ecosystem release preflight
run: npm run release:preflight -- --fixture-root $GITHUB_WORKSPACE/_ecosystem/ui-style-kit-css --layout-repo $GITHUB_WORKSPACE/_ecosystem/Layout-Style-CSS --layout-docs-repo $GITHUB_WORKSPACE/_ecosystem/Layout-Style-CSS --interactive-docs-repo $GITHUB_WORKSPACE
+ - name: Install trusted-publishing npm CLI
+ run: npm install --global npm@11.5.1
+
- name: Publish to npm
run: npm publish --provenance --access public --ignore-scripts
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1c5ade7..21dbd1b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,16 @@ All notable changes to this package are documented in this file.
## Unreleased
+## 1.7.3 - 2026-09-26
+
+### Fixed
+
+- Moved the OIDC-capable npm CLI installation after the immutable ecosystem preflight so legacy fixture pack output remains machine-readable and trusted publishing still runs with npm 11.5.1.
+
+### Testing
+
+- Strengthened the workflow contract to require all validation and ecosystem preflight work before the trusted-publishing CLI is installed immediately ahead of `npm publish`.
+
## 1.7.2 - 2026-09-26
### Fixed
diff --git a/README.md b/README.md
index 1d17031..270e017 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
Framework-agnostic CSS for reliable hover, focus, press, selected, current, loading, disabled, outcome feedback, and motion affordances on interactive controls. Use it alone or as the interaction layer beside your existing layout and theme system.
-Version 1.7.2 is the current release. Existing 1.x imports, selectors, data hooks, ARIA hooks, and tokens remain supported.
+Version 1.7.3 is the current release. Existing 1.x imports, selectors, data hooks, ARIA hooks, and tokens remain supported.
The package targets Node.js 20+ for npm installs and local validation. CI proves the minimum Node 20 lane and the preferred Node 22 lane before release.
@@ -56,11 +56,11 @@ For a no-build page, pin the release:
```html
```
-The equivalent unpkg URL is `https://unpkg.com/interactive-surface-css@1.7.2/standalone-preset.css`. To follow future releases deliberately, use `https://cdn.jsdelivr.net/npm/interactive-surface-css@latest/standalone-preset.css` — unpinned opt-in.
+The equivalent unpkg URL is `https://unpkg.com/interactive-surface-css@1.7.3/standalone-preset.css`. To follow future releases deliberately, use `https://cdn.jsdelivr.net/npm/interactive-surface-css@latest/standalone-preset.css` — unpinned opt-in.
## Semantic recipes
@@ -136,7 +136,7 @@ Native `disabled` is preferred because the browser suppresses focus and activati
| `import "interactive-surface-css/interactive-surface.css";` | Complete standalone compatibility bundle | Existing direct-CSS 1.x consumers |
| `import "interactive-surface-css";` | JavaScript entry that imports the complete compatibility bundle | Existing bundlers configured for CSS imports |
-`standalone-preset.css` and `interactive-surface.css` are generated from the same authored modules and are behaviorally equivalent in 1.7.2. The compatibility paths remain stable; no 1.x migration is required.
+`standalone-preset.css` and `interactive-surface.css` are generated from the same authored modules and are behaviorally equivalent in 1.7.3. The compatibility paths remain stable; no 1.x migration is required.
The package `main` and `module` fields preserve the CommonJS and ESM entries; both load `interactive-surface.css`. The `style`, `unpkg`, and `jsdelivr` fields also resolve to that complete compatibility bundle.
diff --git a/index.html b/index.html
index ce69cea..7ba361f 100644
--- a/index.html
+++ b/index.html
@@ -607,7 +607,7 @@
Edit token
Framework-agnostic CSS for reliable hover, focus, press, selected, current, loading, disabled, outcome feedback, and motion affordances on interactive controls. Use it alone or as the interaction layer beside your existing layout and theme system.
-Version 1.7.2 is the current release. Existing 1.x imports, selectors, data hooks, ARIA hooks, and tokens remain supported.
+Version 1.7.3 is the current release. Existing 1.x imports, selectors, data hooks, ARIA hooks, and tokens remain supported.
The package targets Node.js 20+ for npm installs and local validation. CI proves the minimum Node 20 lane and the preferred Node 22 lane before release.
@@ -658,11 +658,11 @@
Edit token
```html
```
-The equivalent unpkg URL is `https://unpkg.com/interactive-surface-css@1.7.2/standalone-preset.css`. To follow future releases deliberately, use `https://cdn.jsdelivr.net/npm/interactive-surface-css@latest/standalone-preset.css` — unpinned opt-in.
+The equivalent unpkg URL is `https://unpkg.com/interactive-surface-css@1.7.3/standalone-preset.css`. To follow future releases deliberately, use `https://cdn.jsdelivr.net/npm/interactive-surface-css@latest/standalone-preset.css` — unpinned opt-in.
## Semantic recipes
@@ -738,7 +738,7 @@
Edit token
| `import "interactive-surface-css/interactive-surface.css";` | Complete standalone compatibility bundle | Existing direct-CSS 1.x consumers |
| `import "interactive-surface-css";` | JavaScript entry that imports the complete compatibility bundle | Existing bundlers configured for CSS imports |
-`standalone-preset.css` and `interactive-surface.css` are generated from the same authored modules and are behaviorally equivalent in 1.7.2. The compatibility paths remain stable; no 1.x migration is required.
+`standalone-preset.css` and `interactive-surface.css` are generated from the same authored modules and are behaviorally equivalent in 1.7.3. The compatibility paths remain stable; no 1.x migration is required.
The package `main` and `module` fields preserve the CommonJS and ESM entries; both load `interactive-surface.css`. The `style`, `unpkg`, and `jsdelivr` fields also resolve to that complete compatibility bundle.
diff --git a/manifest.json b/manifest.json
index 9461b2e..bef6fcc 100644
--- a/manifest.json
+++ b/manifest.json
@@ -5,7 +5,7 @@
"breakingChange": "increment-schemaVersion-before-removing-or-renaming-fields"
},
"name": "interactive-surface-css",
- "version": "1.7.2",
+ "version": "1.7.3",
"entrypoints": {
"stateCore": "./state-core.css",
"standalonePreset": "./standalone-preset.css",
diff --git a/package-lock.json b/package-lock.json
index 112ca0b..877de0f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
{
"name": "interactive-surface-css",
- "version": "1.7.2",
+ "version": "1.7.3",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "interactive-surface-css",
- "version": "1.7.2",
+ "version": "1.7.3",
"license": "MIT",
"devDependencies": {
"@playwright/test": "^1.57.0",
diff --git a/package.json b/package.json
index 9ed92d9..c6668a3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "interactive-surface-css",
- "version": "1.7.2",
+ "version": "1.7.3",
"description": "A framework-agnostic, accessible CSS interaction primitive for buttons, cards, and icon controls with token-driven theming.",
"keywords": [
"css",
diff --git a/tests/package-contract.test.mjs b/tests/package-contract.test.mjs
index e7b10ae..8ccacfb 100644
--- a/tests/package-contract.test.mjs
+++ b/tests/package-contract.test.mjs
@@ -8,7 +8,7 @@ import { spawnSync } from "node:child_process";
import test from "node:test";
const EXPECTED_NAME = "interactive-surface-css";
-const EXPECTED_VERSION = "1.7.2";
+const EXPECTED_VERSION = "1.7.3";
const CHECKOUT_V4_SHA = "34e114876b0b11c390a56381ad16ebd13914f8d5";
const CHECKOUT_V5_SHA = "93cb6efe18208431cddfb8368fd83d5badbf9bfd";
const SETUP_NODE_V5_SHA = "a0853c24544627f65ddf259abe73b1d18a591444";
@@ -260,7 +260,7 @@ function collectReferencedAssetPaths(assetFile, assetSource) {
.sort();
}
-test("the release manifest and validation graph are pinned to 1.7.2", () => {
+test("the release manifest and validation graph are pinned to 1.7.3", () => {
assert.equal(manifest.name, EXPECTED_NAME);
assert.equal(manifest.version, EXPECTED_VERSION);
assert.equal(
@@ -307,7 +307,7 @@ test("release security overrides resolve audited transitive tooling", () => {
}
});
-test("the changelog keeps the complete 1.7.2 release after the Unreleased section", async () => {
+test("the changelog keeps the complete 1.7.3 release after the Unreleased section", async () => {
const changelog = await readFile(
path.join(repositoryRoot, "CHANGELOG.md"),
"utf8",
@@ -370,6 +370,9 @@ test("the npm publishing workflow only accepts a matching published release", as
const packageValidation = workflow.indexOf(
"- name: Validate publish package",
);
+ const ecosystemPreflight = workflow.indexOf(
+ "- name: Run ecosystem release preflight",
+ );
const packagePublish = workflow.indexOf("- name: Publish to npm");
const guardProgramStart = workflow.indexOf("node <<'NODE'");
const guardProgramEnd = workflow.indexOf(
@@ -429,12 +432,13 @@ test("the npm publishing workflow only accepts a matching published release", as
/run: npm publish --provenance --access public --ignore-scripts/,
);
assert.ok(
- releaseGuard !== -1 && releaseGuard < trustedPublishingCli,
- "Release metadata must be checked before the trusted-publishing CLI is installed",
+ releaseGuard !== -1 && releaseGuard < dependencyInstall,
+ "Release metadata must be checked before npm ci",
);
assert.ok(
- trustedPublishingCli < dependencyInstall,
- "The OIDC-capable npm CLI must be installed before npm ci and publish",
+ ecosystemPreflight < trustedPublishingCli &&
+ trustedPublishingCli < packagePublish,
+ "The OIDC-capable npm CLI must be installed after preflight and immediately before publish",
);
assert.ok(
dependencyInstall < packageValidation && packageValidation < packagePublish,
diff --git a/tests/release-preflight.test.mjs b/tests/release-preflight.test.mjs
index 5cf0e2b..148ca1a 100644
--- a/tests/release-preflight.test.mjs
+++ b/tests/release-preflight.test.mjs
@@ -78,7 +78,7 @@ test("candidate version overlay repairs stale current fixture drift only", () =>
const overlay = releaseContract.withCandidateCurrentVersion(
fixtureContract,
"interactive-surface-css",
- "1.7.2",
+ "1.7.3",
);
assert.equal(
@@ -89,7 +89,7 @@ test("candidate version overlay repairs stale current fixture drift only", () =>
assert.deepEqual(overlay.supportedCombinations, {
minimum: fixtureContract.supportedCombinations.minimum,
current: {
- "interactive-surface-css": "1.7.2",
+ "interactive-surface-css": "1.7.3",
"layout-style-css": "3.0.1",
"ui-style-kit-css": "2.1.0",
},
@@ -151,7 +151,7 @@ test("publishing guide records the immutable bootstrap and merge sequence", () =
for (const phrase of [
"U-I bootstrap",
- "Interactive Surface CSS 1.7.2 release",
+ "Interactive Surface CSS 1.7.3 release",
"Push a stable UI bootstrap ref",
"merge commits",
"Update and verify the final UI companion pins",
diff --git a/wiki/API-Reference.md b/wiki/API-Reference.md
index 492b4d3..143c186 100644
--- a/wiki/API-Reference.md
+++ b/wiki/API-Reference.md
@@ -1,6 +1,6 @@
# API Reference
-Interactive Surface CSS 1.7.2 is a CSS state primitive. It exports stylesheets and compatibility JavaScript entries, but it does not ship state-management or component-runtime behavior.
+Interactive Surface CSS 1.7.3 is a CSS state primitive. It exports stylesheets and compatibility JavaScript entries, but it does not ship state-management or component-runtime behavior.
## Entry points
@@ -11,7 +11,7 @@ Interactive Surface CSS 1.7.2 is a CSS state primitive. It exports stylesheets a
| `interactive-surface-css/interactive-surface.css` | Preserved complete 1.x compatibility bundle |
| `interactive-surface-css` | Preserved JavaScript entry that imports the compatibility bundle |
-The preset and compatibility stylesheet are generated from the same authored modules and are behaviorally equivalent in 1.7.2.
+The preset and compatibility stylesheet are generated from the same authored modules and are behaviorally equivalent in 1.7.3.
Package metadata keeps established resolution intact: `main` points to the CommonJS entry, `module` points to the ESM entry, and both load `interactive-surface.css`. The `style`, `unpkg`, and `jsdelivr` fields point directly to that complete compatibility bundle.
diff --git a/wiki/FAQ.md b/wiki/FAQ.md
index bcf5d33..06a8645 100644
--- a/wiki/FAQ.md
+++ b/wiki/FAQ.md
@@ -46,9 +46,9 @@ No. Application code decides the outcome, applies `data-surface-feedback="error"
In the standalone preset and compatibility bundle it supplies centered icon presentation and a 44 × 44px minimum target. A core-only consumer owns that geometry. Every icon-only control still needs an accessible name.
-## Is 1.7.2 published?
+## Is 1.7.3 published?
-Yes. Verify the registry and pinned 1.7.2 CDN URLs independently; a local pack or successful validation workflow is not publication proof.
+Yes. Verify the registry and pinned 1.7.3 CDN URLs independently; a local pack or successful validation workflow is not publication proof.
## What browsers are tested?
diff --git a/wiki/Getting-Started.md b/wiki/Getting-Started.md
index 1c4d583..445f187 100644
--- a/wiki/Getting-Started.md
+++ b/wiki/Getting-Started.md
@@ -1,6 +1,6 @@
# Getting Started
-This is the shortest reliable path to the Interactive Surface CSS 1.7.2 release.
+This is the shortest reliable path to the Interactive Surface CSS 1.7.3 release.
## Install
@@ -76,11 +76,11 @@ Pin the release version:
```html
```
-The unpkg equivalent is `https://unpkg.com/interactive-surface-css@1.7.2/standalone-preset.css`. Use `https://cdn.jsdelivr.net/npm/interactive-surface-css@latest/standalone-preset.css` — unpinned opt-in — only when automatically following future releases is intentional.
+The unpkg equivalent is `https://unpkg.com/interactive-surface-css@1.7.3/standalone-preset.css`. Use `https://cdn.jsdelivr.net/npm/interactive-surface-css@latest/standalone-preset.css` — unpinned opt-in — only when automatically following future releases is intentional.
## Already have a design system?
diff --git a/wiki/Home.md b/wiki/Home.md
index b591a1f..adb30e3 100644
--- a/wiki/Home.md
+++ b/wiki/Home.md
@@ -2,7 +2,7 @@
Interactive Surface CSS is a framework-agnostic interaction-state layer for buttons, links, toggles, tabs, cards, icon controls, and similar interactive hosts. It provides consistent focus, hover, press, current, selected, loading, disabled, outcome feedback, reduced-motion, and forced-colors treatment without requiring a component runtime.
-Version 1.7.2 is the current release. It preserves every established 1.x import and selector while ensuring consumer-owned positioned controls remain authoritative beside the focused `state-core.css` and complete `standalone-preset.css` entry points.
+Version 1.7.3 is the current release. It preserves every established 1.x import and selector while ensuring consumer-owned positioned controls remain authoritative beside the focused `state-core.css` and complete `standalone-preset.css` entry points.
## Choose the layer you need
@@ -14,7 +14,7 @@ Version 1.7.2 is the current release. It preserves every established 1.x import
Use one library, use two compatible libraries, or use all three. None of the packages is a prerequisite for another.
-## 1.7.2 entry points
+## 1.7.3 entry points
- `interactive-surface-css/standalone-preset.css`: complete state behavior plus neutral standalone paint and geometry.
- `interactive-surface-css/state-core.css`: state behavior and the public interaction token contract without theme paint or consumer-facing layout.
diff --git a/wiki/Installation-and-Usage.md b/wiki/Installation-and-Usage.md
index 5ad0df5..54dffbe 100644
--- a/wiki/Installation-and-Usage.md
+++ b/wiki/Installation-and-Usage.md
@@ -1,6 +1,6 @@
# Installation and Usage
-These instructions target the Interactive Surface CSS 1.7.2 release. Existing 1.x imports remain supported.
+These instructions target the Interactive Surface CSS 1.7.3 release. Existing 1.x imports remain supported.
The npm package targets Node.js 20+ for installation and local validation. CI also proves the preferred Node.js 22 release lane.
@@ -51,11 +51,11 @@ Pin the release in reproducible pages:
```html
```
diff --git a/wiki/Publishing-and-Releases.md b/wiki/Publishing-and-Releases.md
index 4f56ded..1317562 100644
--- a/wiki/Publishing-and-Releases.md
+++ b/wiki/Publishing-and-Releases.md
@@ -1,6 +1,6 @@
# Publishing and Releases
-Interactive Surface CSS 1.7.2 is the current release. It carries the complete 1.7.1 CSS payload forward and repairs publication through the package's OIDC trusted publisher.
+Interactive Surface CSS 1.7.3 is the current release. It carries the complete 1.7.1 CSS payload forward and repairs publication through the package's OIDC trusted publisher without changing runtime CSS.
## Release ownership
@@ -13,10 +13,10 @@ The repository's intended path is:
See the [npm publish workflow](https://github.com/Foscat/Interactive-Surface-CSS/blob/main/.github/workflows/npm-publish.yml) for the executable release rules.
-## 1.7.2 release checklist
+## 1.7.3 release checklist
-1. Confirm `package.json` and `package-lock.json` identify `1.7.2`.
-2. Confirm the 1.7.2 changelog entry records the OIDC publication repair and retained 1.7.1 CSS payload.
+1. Confirm `package.json` and `package-lock.json` identify `1.7.3`.
+2. Confirm the 1.7.3 changelog entry records the preflight-safe OIDC publication order and retained 1.7.1 CSS payload.
3. Confirm absolute, fixed, and sticky consumer positions win even when application CSS loads before Interactive Surface.
4. Confirm semantic feedback, reduced motion, higher contrast, forced colors, state precedence, and focus priority remain covered.
5. Confirm manifest, README, embedded README, wiki, changelog, and generated bundles agree on the candidate contract.
@@ -55,7 +55,7 @@ The deterministic publish guard avoids downloading browser binaries. The separat
## Coordinated U-I bootstrap sequence
-The U-I bootstrap gives the Interactive Surface CSS 1.7.2 release an immutable UI compatibility fixture. The cross-repository pins require this exact remote sequence:
+The U-I bootstrap gives the Interactive Surface CSS 1.7.3 release an immutable UI compatibility fixture. The cross-repository pins require this exact remote sequence:
1. Push a stable UI bootstrap ref containing `3869ca49c11d8cc085affa25115e8e80546f7a3c`.
2. Use merge commits: push and merge Interactive Surface CSS so its reviewed candidate commit SHA remains reachable.
@@ -67,19 +67,19 @@ The U-I bootstrap SHA is deliberately stable: the Interactive Surface release wo
## Release identity
-The tag, GitHub Release, package version, lockfile version, and changelog heading must agree. The expected tag is `v1.7.2`.
+The tag, GitHub Release, package version, lockfile version, and changelog heading must agree. The expected tag is `v1.7.3`.
## Distribution verification
After an approved publish, verify:
- `https://registry.npmjs.org/interactive-surface-css`
-- `https://cdn.jsdelivr.net/npm/interactive-surface-css@1.7.2/interactive-surface.css`
-- `https://cdn.jsdelivr.net/npm/interactive-surface-css@1.7.2/state-core.css`
-- `https://cdn.jsdelivr.net/npm/interactive-surface-css@1.7.2/standalone-preset.css`
-- `https://unpkg.com/interactive-surface-css@1.7.2/interactive-surface.css`
-- `https://unpkg.com/interactive-surface-css@1.7.2/state-core.css`
-- `https://unpkg.com/interactive-surface-css@1.7.2/standalone-preset.css`
+- `https://cdn.jsdelivr.net/npm/interactive-surface-css@1.7.3/interactive-surface.css`
+- `https://cdn.jsdelivr.net/npm/interactive-surface-css@1.7.3/state-core.css`
+- `https://cdn.jsdelivr.net/npm/interactive-surface-css@1.7.3/standalone-preset.css`
+- `https://unpkg.com/interactive-surface-css@1.7.3/interactive-surface.css`
+- `https://unpkg.com/interactive-surface-css@1.7.3/state-core.css`
+- `https://unpkg.com/interactive-surface-css@1.7.3/standalone-preset.css`
Do not treat a local pack or a successful workflow validation as proof that these live URLs are available.
@@ -98,4 +98,4 @@ npm publish --access public
- Minor: backward-compatible capabilities or entry points.
- Major: intentional breaking changes.
-The 1.7.2 patch preserves consumer-owned positioned-control topology while retaining the 1.7.0 semantic feedback API, focused entry points, complete 1.x contract, and compatibility ranges. It also replaces legacy token publication with the existing OIDC trusted publisher. The reviewed U-I bootstrap revision remains immutable fixture history for coordinated ecosystem release validation.
+The 1.7.3 patch preserves consumer-owned positioned-control topology while retaining the 1.7.0 semantic feedback API, focused entry points, complete 1.x contract, and compatibility ranges. It also runs the legacy immutable ecosystem preflight before installing the OIDC-capable npm CLI for trusted publication. The reviewed U-I bootstrap revision remains immutable fixture history for coordinated ecosystem release validation.
diff --git a/wiki/Roadmap.md b/wiki/Roadmap.md
index 9253fd3..d7fbf37 100644
--- a/wiki/Roadmap.md
+++ b/wiki/Roadmap.md
@@ -1,8 +1,8 @@
# Roadmap
-Interactive Surface CSS 1.7.2 is the current release. This patch preserves consumer-owned positioned-control topology without expanding into layout, theme, tooltip, or runtime ownership.
+Interactive Surface CSS 1.7.3 is the current release. This patch preserves consumer-owned positioned-control topology without expanding into layout, theme, tooltip, or runtime ownership.
-## 1.7.2 release
+## 1.7.3 release
- Preserve every existing 1.x import, selector, hook, token fallback, and complete or companion stylesheet entry point.
- Preserve the 1.7.0 semantic feedback hooks, tokens, precedence, and preference behavior.
@@ -19,7 +19,7 @@ Publication, tagging, and a GitHub Release remain separate approval-gated steps.
- 1.6.0 added optional shared semantic fallbacks for standalone paint, control geometry, focus, and default motion.
- 1.7.0 added CSS-only semantic outcome feedback, complete precedence coverage, and composable interaction motion.
-## After 1.7.2
+## After 1.7.3
Potential follow-up work must be driven by demonstrated consumer need:
diff --git a/wiki/Testing-and-Quality.md b/wiki/Testing-and-Quality.md
index 1dce547..cd084a0 100644
--- a/wiki/Testing-and-Quality.md
+++ b/wiki/Testing-and-Quality.md
@@ -1,6 +1,6 @@
# Testing and Quality
-The 1.7.2 release uses layered gates so contributors can choose fast deterministic checks or the complete cross-browser suite without confusing the two.
+The 1.7.3 release uses layered gates so contributors can choose fast deterministic checks or the complete cross-browser suite without confusing the two.
## Validation tiers
@@ -36,7 +36,7 @@ The Playwright configuration uses a stable two-worker limit. Focused release pro
| `npm run pack:dry` | Inspect the npm tarball allowlist without publishing |
| `npm audit` | Check the dependency tree against the npm advisory database |
-The exact script graph is finalized as part of the 1.7.2 release before publication. Browser downloads intentionally remain outside `prepublishOnly`.
+The exact script graph is finalized as part of the 1.7.3 release before publication. Browser downloads intentionally remain outside `prepublishOnly`.
## Contract coverage