codebar-ag · StanBarrows · Jul 30, 2026 · Jul 29, 2026 · Jul 30, 2026 · Jul 30, 2026
diff --git a/.storybook/main.ts b/.storybook/main.ts
@@ -13,6 +13,19 @@ const config: StorybookConfig = {
         const { default: tailwindcss } = await import('@tailwindcss/vite');
         cfg.plugins = cfg.plugins ?? [];
         cfg.plugins.push(tailwindcss());
+
+        /*
+         | Storybook inherits vite.config.ts, so the declaration-file plugin runs
+         | here too — and this build has no declarations to emit. It is not just
+         | wasted work: bundling types means API Extractor, which walks the
+         | stories and dies on Vue's internal template symbols ("Symbol not found
+         | for identifier: __VLS_1"). Dropping it here is what lets the library
+         | build bundle its types without the docs build having to cope.
+         */
+        cfg.plugins = cfg.plugins.filter(
+            (plugin) => !(plugin && 'name' in plugin && String(plugin.name).includes('dts')),
+        );
+
         return cfg;
     },
 };

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,164 @@
+# Changelog
+
+All notable changes to `@codebar-ag/storybook`.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
+this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## v1.7.0
+
+### Added
+
+- **Tokenless installs from this repository.** A `prepare` script builds `dist`
+  on install, so the package can be consumed straight from the public repo as a
+  git dependency and no GitHub Packages token is needed:
+
+  ```json
+  "@codebar-ag/storybook": "github:codebar-ag/storybook.codebar.ch#v1.7.0"
+  ```
+
+  `files` is `["dist"]` and `dist` is gitignored, so a git install previously
+  resolved to a package with no entry point at all. It also means `npm publish`
+  always ships a freshly built `dist` rather than whatever was last in the
+  working tree.
+
+- `CHANGELOG.md` — release notes now live here instead of in the README.
+
+### Fixed
+
+- **The dependency tree could not be installed at all.** `npm ci` failed on
+  `main` — and with it the `release`, `pages` and `test` workflows — because
+  `@storybook/vue3-vite` was `^10.5.3` while `storybook` stayed `^9.0.0` and both
+  addons `^9.1.20`, leaving its peer requirement of `storybook@^10`
+  unsatisfiable.
+
+- **All five security advisories cleared** (`npm audit`: 0 vulnerabilities, was
+  5 high). The half-finished `^10.5.3` bump was reaching for a real fix, so it
+  was completed rather than reverted: aligning the Storybook family on `^10.5.5`
+  pulls `vue-component-meta` and `@vue/language-core` to versions whose
+  `minimatch`/`brace-expansion` are patched, and takes `postcss` to `8.5.25`,
+  closing the source-map path-traversal advisory.
+
+- **`main` had lost the published v1.6.0.** That release was tagged and
+  published from a commit that was never merged, so `main` was missing
+  `CodeEditor`, `FullscreenPanel`, `Card`'s `sm` size, the `PageHeading` actions
+  slot and the `CodePreview` changes — 437 lines that consumers on `^1.6.0`
+  already depended on. Merged back in; anything released from `main` before this
+  would have silently regressed them.
+
+- **Types are a single bundled `index.d.ts` again.** `vite-plugin-dts` 5 renamed
+  `rollupTypes` to `bundleTypes` and *ignores* the old name instead of rejecting
+  it, so the build had quietly started emitting split per-component
+  declarations — an 84 KB entry point became 9 KB plus a `components/` tree.
+  Consumers that parse the declaration file rather than merely importing from it
+  saw an apparently valid file describing almost nothing. Adds
+  `@microsoft/api-extractor`, which `bundleTypes` requires.
+
+- Two implicit-`any` handler parameters in `Pagination.vue`. Pre-existing and
+  unrelated to the upgrade, but `typecheck` could not run while the tree was
+  uninstallable, so nothing had reported them.
+
+### Changed
+
+- Storybook and its addons: `^9` → `^10.5.5`. No config migration was needed —
+  the full docs build and all 184 Playwright story tests pass unchanged.
+- `publishConfig.access`: `restricted` → `public`. This affects *future*
+  publishes only. The existing package's visibility is a setting on the package
+  itself, and GitHub's npm registry requires a token for every read regardless
+  of visibility — the git dependency above is what actually removes the token.
+
+## v1.6.0
+
+- `CodeEditor` and `FullscreenPanel` promoted to the public API.
+- `PageHeading` gained an actions slot.
+- `Card` gained the `sm` size.
+- `CodePreview` and `useEscapeKey` refinements, plus `codeMirrorTheme` helper.
+
+> **Note:** published to GitHub Packages but never merged to `main`. If you
+> pinned a git dependency to a commit rather than the tag, upgrade to v1.7.0,
+> which is the first release where `main` actually contains this work.
+
+## v1.5.0
+
+- `Toaster` gained a `maxWidth` prop.
+- `DataTable` row cursor fix.
+
+## v1.4.3
+
+- Maintenance release.
+
+## v1.4.2
+
+- **Placeholder names in story fixtures.** Real client and person names were
+  replaced with `Mustermann AG` / `Max Mustermann` placeholders (and
+  `mustermann.*` hosts) throughout the Storybook stories. No component or API
+  changes.
+
+## v1.4.1
+
+- **All-mono restored.** v1.4.0 switched the UI font to Inter; that is reverted.
+  The all-mono look (JetBrains Mono everywhere, via `--font-mono`) is the
+  brand's visual identity and is intentional. Skip v1.4.0 and upgrade straight
+  to v1.4.1.
+
+## v1.4.0
+
+- Switched the UI font to Inter. **Superseded — do not use;** see v1.4.1.
+
+## v1.3.1
+
+- Restored the package name `@codebar-ag/storybook`.
+
+## v1.3.0
+
+### Added
+
+- **New components** — atoms `Avatar`, `Divider`, `Kbd`, `Spinner`; molecules
+  `Accordion`/`AccordionItem`, `Combobox`, `InputNumber`, `PasswordInput`,
+  `PinInput`, `Popover`, `Tabs`, `Tooltip`; organisms `DataTable` (sortable,
+  selectable, paginated), `Drawer`, `Navbar`, `Sidebar`/`SidebarGroup`/
+  `SidebarItem`; layouts `AppShell`, `AuthLayout`, `ErrorLayout`.
+- **Composables are now part of the public API** — overlay/keyboard utilities
+  (`useFocusTrap`, `useClickOutside`, `useEscapeKey`, `useScrollLock`,
+  `useListNavigation`), form helpers (`useFieldA11y`, `useFormErrors`,
+  `usePasswordManagerAttrs`), data-table helpers (`useSort`, `useSelection`,
+  `usePagination`), plus `useControllable` and `useRootAttrs`.
+- **Helpers** — `cx` class combiner and `resolveTone` with the
+  `Tone`/`LegacyTone` types.
+- **Storybook** — Foundations docs (colors, typography, spacing, radii &
+  shadows, icons), example pages (Auth, Errors, Dashboard), docs + a11y
+  addons, and per-story play functions that run in CI via Playwright.
+
+### Migration notes
+
+Non-breaking, but worth knowing when upgrading:
+
+- **Tones unified.** `Badge`/`StatusBadge` now use the semantic tones
+  `neutral | info | success | warning | danger`; `Alert` gained `danger`.
+  The old values (`gray`/`blue`/`green`/`amber`/`red`, Alert's `error`) keep
+  rendering identically via `resolveTone()` but log a dev-only deprecation
+  warning and will be removed in the next major.
+- **Dropdown DOM changed.** The root moved from `<details>/<summary>` to
+  `<div><button aria-haspopup="menu">…` with full keyboard support (arrows,
+  Home/End, Escape, click-outside). Props and slots are unchanged; only CSS
+  targeting `details`/`summary` needs updating. Optional `v-model:open`.
+- **Button** gained a `loading` prop (spinner + `disabled` + `aria-busy`);
+  the default slot is now wrapped in a layout `<span>`.
+- **Modal** now traps focus, locks page scroll, restores focus on close and
+  supports `initialFocus`; API unchanged.
+- **FileInput** supports `v-model` (`File[]`); the previous `change`
+  (FileList) emit is retained. It now renders inside the standard control box.
+- **`Switch`** is a new alias export for `Toggle` (both names work).
+- **Components moved** into `src/components/{atoms,molecules,organisms,layouts}`;
+  the public API (`src/index.ts`) is unchanged.
+- **Storybook story IDs changed** with the new `Foundations/Atoms/Molecules/
+  Organisms/Layouts/Pages` hierarchy — deep links into the published
+  styleguide need re-copying.
+- **Bugfix:** dismissed toasts were hidden but never removed from the DOM
+  (`useToast` reassigned the array its consumers had captured); they are now
+  spliced in place.
+
+## v1.2.0
+
+- First public shape of the design system: Vue 3 + Tailwind v4 atoms, tokens
+  and Storybook.
diff --git a/README.md b/README.md
@@ -15,7 +15,24 @@ and its variants, deployed automatically from `main`.
 
 ## Install
 
-The package is published to **GitHub Packages**. Add an `.npmrc` to the consuming app:
+Two ways, and the first needs no credentials.
+
+### From this repository — no token
+
+The repository is public and `prepare` builds `dist` on install, so a git
+dependency works anywhere with no setup:
+
+```bash
+npm install github:codebar-ag/storybook.codebar.ch#v1.7.0
+```
+
+Pin a tag rather than a branch, so installs stay reproducible. npm installs this
+repo's devDependencies to run the build, which makes a cold install slower than a
+registry one — that is the trade for needing no token.
+
+### From GitHub Packages — token required
+
+Add an `.npmrc` to the consuming app:
 
 ```
 @codebar-ag:registry=https://npm.pkg.github.com
@@ -26,10 +43,11 @@ The package is published to **GitHub Packages**. Add an `.npmrc` to the consumin
 npm install @codebar-ag/storybook
 ```
 
-> **Note:** the package is private; GitHub's npm registry requires
-> authentication to install. Set `GITHUB_TOKEN` to a GitHub token with the
-> `read:packages` scope (a classic PAT works) — locally, in CI, and on deploy
-> targets.
+> **Note:** GitHub's npm registry requires authentication for **every** read,
+> public packages included — unlike npmjs.com. This repository being public does
+> not change that, and neither does the package's own visibility. Set
+> `GITHUB_TOKEN` to a token with the `read:packages` scope (a classic PAT works,
+> as does `gh auth token`) locally, in CI, and on every deploy target.
 
 ## Use
 
@@ -108,66 +126,10 @@ npm run typecheck        # vue-tsc
 npm run lint
 ```
 
-## What's new in v1.4.2
-
-- **Placeholder names in story fixtures.** Real client and person names were
-  replaced with `Mustermann AG` / `Max Mustermann` placeholders (and
-  `mustermann.*` hosts) throughout the Storybook stories. No component or API
-  changes.
-
-## What's new in v1.4.1
-
-- **All-mono restored.** v1.4.0 switched the UI font to Inter; that is reverted.
-  The all-mono look (JetBrains Mono everywhere, via `--font-mono`) is the
-  brand's visual identity and is intentional. Skip v1.4.0 and upgrade straight
-  to v1.4.1.
-
-## What's new in v1.3.0
-
-- **New components** — atoms `Avatar`, `Divider`, `Kbd`, `Spinner`; molecules
-  `Accordion`/`AccordionItem`, `Combobox`, `InputNumber`, `PasswordInput`,
-  `PinInput`, `Popover`, `Tabs`, `Tooltip`; organisms `DataTable` (sortable,
-  selectable, paginated), `Drawer`, `Navbar`, `Sidebar`/`SidebarGroup`/
-  `SidebarItem`; layouts `AppShell`, `AuthLayout`, `ErrorLayout`.
-- **Composables are now part of the public API** — overlay/keyboard utilities
-  (`useFocusTrap`, `useClickOutside`, `useEscapeKey`, `useScrollLock`,
-  `useListNavigation`), form helpers (`useFieldA11y`, `useFormErrors`,
-  `usePasswordManagerAttrs`), data-table helpers (`useSort`, `useSelection`,
-  `usePagination`), plus `useControllable` and `useRootAttrs`.
-- **Helpers** — `cx` class combiner and `resolveTone` with the
-  `Tone`/`LegacyTone` types.
-- **Storybook** — Foundations docs (colors, typography, spacing, radii &
-  shadows, icons), example pages (Auth, Errors, Dashboard), docs + a11y
-  addons, and per-story play functions that run in CI via Playwright.
-
-### Migration notes
-
-Non-breaking, but worth knowing when upgrading:
-
-- **Tones unified.** `Badge`/`StatusBadge` now use the semantic tones
-  `neutral | info | success | warning | danger`; `Alert` gained `danger`.
-  The old values (`gray`/`blue`/`green`/`amber`/`red`, Alert's `error`) keep
-  rendering identically via `resolveTone()` but log a dev-only deprecation
-  warning and will be removed in the next major.
-- **Dropdown DOM changed.** The root moved from `<details>/<summary>` to
-  `<div><button aria-haspopup="menu">…` with full keyboard support (arrows,
-  Home/End, Escape, click-outside). Props and slots are unchanged; only CSS
-  targeting `details`/`summary` needs updating. Optional `v-model:open`.
-- **Button** gained a `loading` prop (spinner + `disabled` + `aria-busy`);
-  the default slot is now wrapped in a layout `<span>`.
-- **Modal** now traps focus, locks page scroll, restores focus on close and
-  supports `initialFocus`; API unchanged.
-- **FileInput** supports `v-model` (`File[]`); the previous `change`
-  (FileList) emit is retained. It now renders inside the standard control box.
-- **`Switch`** is a new alias export for `Toggle` (both names work).
-- **Components moved** into `src/components/{atoms,molecules,organisms,layouts}`;
-  the public API (`src/index.ts`) is unchanged.
-- **Storybook story IDs changed** with the new `Foundations/Atoms/Molecules/
-  Organisms/Layouts/Pages` hierarchy — deep links into the published
-  styleguide need re-copying.
-- **Bugfix:** dismissed toasts were hidden but never removed from the DOM
-  (`useToast` reassigned the array its consumers had captured); they are now
-  spliced in place.
+## Changelog
+
+Release notes, migration notes and upgrade warnings live in
+[CHANGELOG.md](CHANGELOG.md).
 
 ## License