.

Author: wunderships

.changeset/bright-icons-glow.md

@@ -1,5 +1,5 @@
 ---
-"@baseui.sh/react": minor
+"@wundercorp/baseui": minor
 ---
 
 Adopt Phosphor Icons as the canonical production icon dependency, migrate built-in component glyphs to Phosphor, add semantic and full-library icon entry points, and preserve circular spinner geometry.

.github/workflows/release.yml

@@ -2,28 +2,38 @@ name: Release
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
 
 permissions:
   contents: write
   id-token: write
   pull-requests: write
 
+concurrency:
+  group: npm-release
+  cancel-in-progress: false
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v6
         with:
-          node-version: 20
-          cache: npm
+          node-version: "24"
           registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      - run: npm install --global npm@^11.5.1
       - run: npm ci
       - run: npm run ci
+
       - uses: changesets/action@v1
         with:
           publish: npm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

README.md

@@ -1,18 +1,26 @@
 # baseui.sh
 
+[![npm version](https://img.shields.io/npm/v/@wundercorp/baseui.svg)](https://www.npmjs.com/package/@wundercorp/baseui) [![npm downloads](https://img.shields.io/npm/dm/@wundercorp/baseui.svg)](https://www.npmjs.com/package/@wundercorp/baseui) [![CI](https://github.com/wundercorp/baseui/actions/workflows/ci.yml/badge.svg)](https://github.com/wundercorp/baseui/actions/workflows/ci.yml) [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+
 A restrained, accessible component library and design language for React product interfaces.
 
 baseui.sh is maintained as an independent open-source repository. Product applications consume it as a normal package rather than copying dashboard-specific CSS or importing source from another monorepo.
 
 ## Install
 
 ```bash
-npm install @baseui.sh/react
+npm install @wundercorp/baseui
+```
+
+```bash
+pnpm add @wundercorp/baseui
+yarn add @wundercorp/baseui
+bun add @wundercorp/baseui
 ```
 
 ```tsx
-import { BaseUIProvider, Button, Card } from "@baseui.sh/react";
-import "@baseui.sh/react/styles.css";
+import { BaseUIProvider, Button, Card } from "@wundercorp/baseui";
+import "@wundercorp/baseui/styles.css";
 
 export function Application() {
   return (
@@ -30,7 +38,7 @@ export function Application() {
 ```text
 apps/docs                 Living component catalogue
 examples/vite-react       Consumer integration example
-packages/react             Published @baseui.sh/react package
+packages/react             Published @wundercorp/baseui package
 docs                       Design, architecture, accessibility, and release guidance
 .github                    CI, release, issue, and contribution automation
 .changeset                 Versioning and changelog metadata
@@ -52,19 +60,19 @@ npm run verify:package
 The root package exposes the complete API. Category subpaths make ownership and discovery clearer:
 
 ```tsx
-import { Button } from "@baseui.sh/react/actions";
-import { Field, Input } from "@baseui.sh/react/forms";
-import { Dialog } from "@baseui.sh/react/overlays";
-import "@baseui.sh/react/styles.css";
+import { Button } from "@wundercorp/baseui/actions";
+import { Field, Input } from "@wundercorp/baseui/forms";
+import { Dialog } from "@wundercorp/baseui/overlays";
+import "@wundercorp/baseui/styles.css";
 ```
 
 Tokens and icons are independently consumable:
 
 ```tsx
-import { baseUITokens } from "@baseui.sh/react/tokens";
-import { Icon, PhosphorIcon } from "@baseui.sh/react/icons";
-import { RocketLaunchIcon } from "@baseui.sh/react/phosphor";
-import "@baseui.sh/react/tokens.css";
+import { baseUITokens } from "@wundercorp/baseui/tokens";
+import { Icon, PhosphorIcon } from "@wundercorp/baseui/icons";
+import { RocketLaunchIcon } from "@wundercorp/baseui/phosphor";
+import "@wundercorp/baseui/tokens.css";
 
 <Icon name="settings" />
 <PhosphorIcon icon={RocketLaunchIcon} label="Launch" />
@@ -81,7 +89,7 @@ import "@baseui.sh/react/tokens.css";
 
 ## Releasing
 
-Changesets drive package versions and changelogs. Publishing is handled by the release workflow using npm trusted publishing or an `NPM_TOKEN` repository secret. See [RELEASING.md](RELEASING.md).
+Changesets drive versions and changelogs. The first package version is published interactively, then GitHub Actions publishes future versions through npm trusted publishing with OIDC and provenance. See [RELEASING.md](RELEASING.md) and [docs/publishing.md](docs/publishing.md).
 
 ## Open source
 

RELEASING.md

@@ -1,26 +1,87 @@
 # Releasing
 
-baseui.sh uses Changesets and npm provenance.
+baseui.sh uses Changesets, npm trusted publishing, and npm provenance.
+
+## Package identity
+
+The published package is `@wundercorp/baseui`. Publishing under this name requires control of the npm organization and scope named `baseui.sh`.
+
+If that npm organization is unavailable, rename the package before the first publication. The recommended fallback is `@wundercorp/baseui`.
+
+## One-time bootstrap
+
+Trusted publishing is configured from an existing npm package, so the first version must be published interactively.
+
+1. Create or claim the `baseui.sh` organization on npm.
+2. Enable two-factor authentication on the publishing account.
+3. Log in and confirm the active account.
+4. Validate and inspect the package.
+5. Publish version `0.1.0` publicly.
+
+```bash
+npm login
+npm whoami
+npm run release:dry-run
+cd packages/react
+npm publish --access public --provenance=false
+```
+
+The local bootstrap publish disables provenance because npm provenance is generated from supported CI environments. Subsequent automated releases use trusted publishing and include provenance automatically.
+
+## Configure trusted publishing
+
+After the first publication, open the package settings on npm and add a GitHub Actions trusted publisher with these values:
+
+```text
+GitHub organization or user: wundercorp
+Repository: baseui
+Workflow filename: release.yml
+Allowed action: npm publish
+Environment: leave empty
+```
+
+The workflow is `.github/workflows/release.yml`. It uses a GitHub-hosted runner, OIDC permissions, Node 24, and npm 11.5.1 or newer. No `NPM_TOKEN` secret is required after trusted publishing is configured.
+
+After verifying one automated release, configure the npm package to require two-factor authentication and disallow traditional publishing tokens.
 
 ## Pull requests
 
-Run `npm run changeset` for any user-visible change to `@baseui.sh/react`. Select patch, minor, or major based on semantic versioning.
+Run the following command for every user-visible package change:
 
-## Version pull request
+```bash
+npm run changeset
+```
 
-The release workflow opens or updates a version pull request. Merging it updates package versions and changelogs.
+Choose patch, minor, or major according to semantic versioning and commit the generated Changeset file with the pull request.
 
-## Publish
+## Version pull request
 
-On the next run, the release workflow builds, validates, and publishes the package with public access and provenance.
+The release workflow opens or updates a Changesets version pull request on `main`. Merging that pull request updates versions and changelogs.
 
-Repository configuration must provide either npm trusted publishing for the GitHub workflow or an `NPM_TOKEN` secret with publish access to the `@baseui.sh` scope.
+On the next workflow run, Changesets publishes the new package version to npm.
 
-## Manual dry run
+## Local release checks
 
 ```bash
 npm ci
-npm run ci
-npm pack --workspace @baseui.sh/react
-npm publish --workspace @baseui.sh/react --dry-run --access public
+npm run release:dry-run
+npm run verify:consumer
+```
+
+Inspect the package that npm would publish:
+
+```bash
+npm run release:inspect
+```
+
+## Consumer verification
+
+After publishing, verify the public registry from a clean directory:
+
+```bash
+mkdir baseui-install-check
+cd baseui-install-check
+npm init -y
+npm install react react-dom @wundercorp/baseui
+npm view @wundercorp/baseui version
 ```

apps/docs/package.json

@@ -9,7 +9,7 @@
     "check": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@baseui.sh/react": "0.1.0",
+    "@wundercorp/baseui": "0.1.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },

apps/docs/src/components/BaseUIShowcase.tsx

@@ -91,7 +91,7 @@ import {
   VisuallyHidden,
   type BaseUITheme,
   type IconName,
-} from "@baseui.sh/react";
+} from "@wundercorp/baseui";
 
 type ShowcaseSection =
   | "overview"
@@ -309,7 +309,7 @@ function FoundationsSection() {
           <Text size="lg">Large body copy for introductions and important explanatory content.</Text>
           <Text>Default body copy for product interfaces, forms, and documentation.</Text>
           <Text size="sm">Secondary detail and compact supporting information.</Text>
-          <Inline><Eyebrow>Eyebrow label</Eyebrow><Label>Form label</Label><Code>npm install @baseui.sh/react</Code><Kbd>⌘ K</Kbd></Inline>
+          <Inline><Eyebrow>Eyebrow label</Eyebrow><Label>Form label</Label><Code>npm install @wundercorp/baseui</Code><Kbd>⌘ K</Kbd></Inline>
         </Stack>
       </ComponentExample>
 
@@ -396,7 +396,7 @@ function ActionsSection() {
         <ComponentExample title="Links and copy actions">
           <Inline gap="lg">
             <Link href="#">Documentation</Link>
-            <CopyButton value="npm install @baseui.sh/react" label="Copy install command" />
+            <CopyButton value="npm install @wundercorp/baseui" label="Copy install command" />
           </Inline>
         </ComponentExample>
         <ComponentExample title="Tags and removable filters">
@@ -671,7 +671,7 @@ function PatternsSection() {
       <ComponentExample title="Accordion and collapsible documentation patterns" fullWidth>
         <div id="installation" />
         <Stack gap="lg">
-          <Accordion><AccordionItem title="Installation" description="Add the package and global stylesheet." open><CodeBlock>{`npm install @baseui.sh/react\n\nimport "@baseui.sh/react/styles.css";`}</CodeBlock></AccordionItem><AccordionItem title="Theming" description="Set light, dark, or system mode at the provider boundary."><CodeBlock>{`<BaseUIProvider theme="dark">\n  <Application />\n</BaseUIProvider>`}</CodeBlock></AccordionItem><AccordionItem title="Design invariants" description="Rules that should not be overridden in product code."><List divided><ListItem title="Radius" description="4 px across controls, surfaces, and floating layers; circular indicators use the circle token." /><ListItem title="Accent" description="Reserved for primary actions, focus, and active navigation." /><ListItem title="Monospace" description="Used for code, identifiers, measurements, and technical values only." /></List></AccordionItem></Accordion>
+          <Accordion><AccordionItem title="Installation" description="Add the package and global stylesheet." open><CodeBlock>{`npm install @wundercorp/baseui\n\nimport "@wundercorp/baseui/styles.css";`}</CodeBlock></AccordionItem><AccordionItem title="Theming" description="Set light, dark, or system mode at the provider boundary."><CodeBlock>{`<BaseUIProvider theme="dark">\n  <Application />\n</BaseUIProvider>`}</CodeBlock></AccordionItem><AccordionItem title="Design invariants" description="Rules that should not be overridden in product code."><List divided><ListItem title="Radius" description="4 px across controls, surfaces, and floating layers; circular indicators use the circle token." /><ListItem title="Accent" description="Reserved for primary actions, focus, and active navigation." /><ListItem title="Monospace" description="Used for code, identifiers, measurements, and technical values only." /></List></AccordionItem></Accordion>
           <Collapsible title="Compact disclosure alias"><Text size="sm">Collapsible provides a concise disclosure API while retaining native details semantics.</Text></Collapsible>
         </Stack>
       </ComponentExample>

apps/docs/src/main.tsx

@@ -1,6 +1,6 @@
 import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
-import "@baseui.sh/react/styles.css";
+import "@wundercorp/baseui/styles.css";
 import "./showcase.css";
 import { App } from "./App.js";
 

docs/icons.md

@@ -1,13 +1,13 @@
 # Icons
 
-baseui.sh uses Phosphor Icons as its canonical icon family. `@phosphor-icons/react` is a production dependency of `@baseui.sh/react`.
+baseui.sh uses Phosphor Icons as its canonical icon family. `@phosphor-icons/react` is a production dependency of `@wundercorp/baseui`.
 
 ## Semantic icons
 
 Use `Icon` for stable concepts owned by the design system. Semantic names isolate application code from upstream glyph naming changes.
 
 ```tsx
-import { Icon } from "@baseui.sh/react/icons";
+import { Icon } from "@wundercorp/baseui/icons";
 
 <Icon name="search" />
 <Icon name="warning" weight="fill" label="Warning" />
@@ -18,16 +18,16 @@ Decorative icons are hidden from assistive technology. Set `label` when the icon
 ## Full Phosphor library
 
 ```tsx
-import { PhosphorIcon } from "@baseui.sh/react/icons";
-import { RocketLaunchIcon } from "@baseui.sh/react/phosphor";
+import { PhosphorIcon } from "@wundercorp/baseui/icons";
+import { RocketLaunchIcon } from "@wundercorp/baseui/phosphor";
 
 <PhosphorIcon icon={RocketLaunchIcon} label="Launch" />
 ```
 
 For server components and SSR-only environments:
 
 ```tsx
-import { RocketLaunchIcon } from "@baseui.sh/react/phosphor/ssr";
+import { RocketLaunchIcon } from "@wundercorp/baseui/phosphor/ssr";
 ```
 
 For the smallest development graph, consumers may import individual upstream glyph modules directly from `@phosphor-icons/react/dist/csr/<IconName>`.

docs/integration.md

@@ -3,19 +3,19 @@
 ## Standard React application
 
 ```bash
-npm install @baseui.sh/react
+npm install @wundercorp/baseui
 ```
 
 Import the stylesheet once near the application entry point:
 
 ```tsx
-import "@baseui.sh/react/styles.css";
+import "@wundercorp/baseui/styles.css";
 ```
 
 Wrap the product surface:
 
 ```tsx
-import { BaseUIProvider } from "@baseui.sh/react";
+import { BaseUIProvider } from "@wundercorp/baseui";
 
 root.render(
   <BaseUIProvider theme="system">
@@ -29,8 +29,8 @@ root.render(
 Category imports keep feature ownership explicit:
 
 ```tsx
-import { Button } from "@baseui.sh/react/actions";
-import { Field, Input } from "@baseui.sh/react/forms";
+import { Button } from "@wundercorp/baseui/actions";
+import { Field, Input } from "@wundercorp/baseui/forms";
 ```
 
 ## Existing applications
@@ -50,7 +50,7 @@ Use a normal workspace dependency during development:
 ```json
 {
   "dependencies": {
-    "@baseui.sh/react": "workspace:*"
+    "@wundercorp/baseui": "workspace:*"
   }
 }
 ```

docs/naming.md

@@ -1,6 +1,6 @@
 # Naming and project identity
 
-baseui.sh is the project and design-language name. The npm package is `@baseui.sh/react`.
+baseui.sh is the project and design-language name. The npm package is `@wundercorp/baseui`.
 
 There are existing open-source projects named Base UI and Base Web, including packages using `@base-ui/react` and `baseui`. baseui.sh must remain visually and verbally distinct and must not imply affiliation, compatibility, endorsement, or shared maintainership.