0.7.0: appearance controls, community health files, and npm release setup

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,72 @@
+name: Bug report
+description: Something in ForgeDialog behaves differently than documented
+labels: ['bug']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. Please do not use this form for security
+        vulnerabilities — report those privately through a
+        [draft security advisory](https://github.com/cmm-cmm/ForgeDialog/security/advisories/new).
+
+  - type: input
+    id: version
+    attributes:
+      label: ForgeDialog version
+      placeholder: 0.7.0
+    validations:
+      required: true
+
+  - type: dropdown
+    id: entry
+    attributes:
+      label: Entry point
+      description: |
+        Which import did you use? This matters: the single-purpose entries ship a
+        lightweight appearance applier and ignore the richer options unless
+        `forgedialog/appearance` is imported alongside them.
+      options:
+        - forgedialog
+        - forgedialog/core
+        - forgedialog/alert, /confirm or /prompt
+        - forgedialog/presentation
+        - forgedialog/workflows
+        - A framework adapter (react, vue, svelte, web-component)
+        - Script tag / IIFE global
+    validations:
+      required: true
+
+  - type: input
+    id: environment
+    attributes:
+      label: Browser and bundler
+      description: Include versions where you can.
+      placeholder: Chrome 141, Vite 7
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: |
+        The smallest code that shows the problem, or a link to a running example.
+        `demo/index.html` in this repository is a good starting point.
+      render: ts
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected, and what happened instead
+    validations:
+      required: true
+
+  - type: textarea
+    id: extra
+    attributes:
+      label: Anything else
+      description: Console errors, screenshots, or a recording for visual issues.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/cmm-cmm/ForgeDialog/security/advisories/new
+    about: Report privately through a draft security advisory, not a public issue.
+  - name: Contributing guide
+    url: https://github.com/cmm-cmm/ForgeDialog/blob/main/CONTRIBUTING.md
+    about: Setup, the checks CI runs, and the gotchas worth knowing before a pull request.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,42 @@
+name: Feature request
+description: Suggest a capability ForgeDialog does not have yet
+labels: ['enhancement']
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do?
+      description: Describe the situation rather than the API you have in mind, so alternatives stay open.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What would the API look like?
+      render: ts
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: What have you tried?
+      description: |
+        Existing options that came close, or workarounds you are using today —
+        `appearance`, a plugin hook, `content`, or your own CSS on the `fd-` classes.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: constraints
+    attributes:
+      label: Does this fit the project's constraints?
+      description: |
+        ForgeDialog is dependency-free, framework-agnostic, accessible by default,
+        and holds its bundles to gzip budgets. Proposals that conflict with those
+        are still worth raising — just say so.
+      options:
+        - label: This can work without adding a runtime dependency
+        - label: This does not require a specific framework
+        - label: I am aware this may need to ship as an opt-in entry point to stay within bundle budgets

.github/pull_request_template.md

@@ -0,0 +1,23 @@
+## Summary
+
+<!-- What changed and why. Call out API or accessibility impact explicitly. -->
+
+## Verification
+
+<!-- Tick what you ran. `npm run validate` is the same gate CI uses. -->
+
+- [ ] `npm run validate`
+- [ ] `npm run test:e2e` (needs `npx playwright install`), or a note below on why it was skipped
+- [ ] Added or updated tests covering the change
+
+## Checklist
+
+- [ ] Added a changeset (`npm run changeset`) for user-facing changes
+- [ ] Refreshed API reports (`npm run api:update`, `npm run api:subpaths:update`) if the public
+      surface changed
+- [ ] Raised a gzip budget in this PR, with a reason, if the change needed more room
+- [ ] Refreshed the visual baseline, and said so, if a demo change shifted the screenshot
+
+## Screenshots
+
+<!-- For visual, animation, or demo changes. Delete this section if it does not apply. -->

.github/workflows/ci.yml

@@ -28,6 +28,7 @@ jobs:
       - run: npm run api:check
       - run: npm run api:subpaths
       - run: npm run test:consumers
+      - run: npm run test:capabilities
       - run: npm run test:csp
       - run: npm run package:size
       - run: npm pack --dry-run

.github/workflows/release.yml

@@ -11,6 +11,8 @@ on:
 
 permissions:
   contents: read
+  # Required for npm trusted publishing: npm exchanges this token for a
+  # short-lived credential, so no NPM_TOKEN secret is needed.
   id-token: write
 
 jobs:
@@ -24,17 +26,30 @@ jobs:
           node-version: 24
           registry-url: https://registry.npmjs.org
           package-manager-cache: false
+
+      # Trusted publishing needs a recent npm; the version bundled with Node
+      # varies by patch release, so pin it here rather than inherit it.
+      - name: Use an npm that supports trusted publishing
+        run: |
+          npm install -g npm@latest
+          npm --version
+
       - run: npm ci
+      - name: Verify the release is publishable
+        run: npm run check:release
       - run: npx playwright install --with-deps
       - run: npm run validate:all
       - run: npm sbom --sbom-format cyclonedx > forgedialog-sbom.json
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: forgedialog-sbom
           path: forgedialog-sbom.json
+
       - name: Publish to npm with OIDC
         if: vars.NPM_PUBLISH_ENABLED == 'true'
-        run: npm publish --access public
+        run: npm publish
       - name: Skip npm publishing until trusted publishing is enabled
         if: vars.NPM_PUBLISH_ENABLED != 'true'
-        run: echo "Set the NPM_PUBLISH_ENABLED repository variable after configuring npm trusted publishing."
+        run: |
+          echo "NPM_PUBLISH_ENABLED is not 'true', so nothing was published."
+          echo "See docs/releasing.md for the one-time npm setup."

CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.7.0
+
+- Added per-component appearance controls: `surfaceColor`, `titleColor`, `titleBackground`,
+  `titleOpacity`, `contentColor`, `contentOpacity`, and `borderOpacity`, so color and transparency
+  can be set on the title, body, and border instead of only on the dialog surface and backdrop.
+- Added `appearance.radius` for corner rounding, which was previously fixed to the global
+  `--fd-radius` token. It takes one value for every corner, any CSS `border-radius` value, or a
+  per-corner object whose omitted corners keep the theme radius. Drawers and bottom sheets keep
+  their shapes unless a radius is given explicitly.
+- Added composable shadows: `appearance.shadow` now also accepts `angle`, which chooses the
+  direction the shadow falls, alongside `distance`, `blur`, `spread`, `color`, `opacity`, and
+  `inset`. Presets and raw CSS `box-shadow` values keep working unchanged.
+- Added `appearance.hover`, applied only while the pointer is over the dialog and only for dialogs
+  that opt in, accepting the same color and shadow options plus `lift`, `scale`, and `duration`.
+- Hover transforms honour `prefers-reduced-motion` and are suspended while a dialog is being
+  dragged, so a hover lift or scale can no longer push a dragged dialog outside its bounds.
+- Added a `forgedialog/appearance` entry point. Both `forgedialog` and `forgedialog/core` ship the
+  full appearance applier, so the richer options need no extra import; the single-purpose entries
+  (`forgedialog/alert`, `/confirm`, `/prompt`) keep a lightweight applier covering surface opacity,
+  backdrop, border, and shadow presets, and can be upgraded by importing `forgedialog/appearance`.
+- Fixed capability imports being dropped by bundlers. Entries are published unsplit, because ESM
+  code splitting moved the `registerAppearanceApplier` call into a shared chunk that `sideEffects`
+  cannot name, so a bundler discarded the bare import and `import 'forgedialog/appearance'` was
+  silently a no-op. `forgedialog/interactions` and `forgedialog/animations` happened to escape this
+  only through how their code was chunked.
+- Added `npm run test:capabilities`, which bundles the published entries and asserts each capability
+  actually registers while `forgedialog/alert` stays on the lightweight applier.
+- Widened the gzip and tarball budgets. Several artifacts sat within 0.1 KiB of their limits, so
+  ordinary changes tripped them; the budgets now carry real headroom and cover both the full
+  appearance applier in the core entry and the unsplit output.
+- Expanded the demo's appearance builder with per-component color, shadow direction, and hover
+  controls, and refreshed the visual regression baseline for the taller page.
+
 ## 0.6.0
 
 - Fixed focus trapping skipping over targets that cannot receive focus: hidden inputs and anything

CODE_OF_CONDUCT.md

@@ -0,0 +1,114 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a
+harassment-free experience for everyone, regardless of age, body size, visible or invisible
+disability, ethnicity, sex characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race, caste, color, religion,
+or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive,
+and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes, and learning from the
+  experience
+- Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address, without their
+  explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior
+and will take appropriate and fair corrective action in response to any behavior that they deem
+inappropriate, threatening, offensive, or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits,
+code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and
+will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is
+officially representing the community in public spaces. Examples of representing our community
+include using an official email address, posting via an official social media account, or acting as
+an appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the
+maintainers privately through the repository's **Security** tab, using **Report a vulnerability**,
+which opens a private thread visible only to the maintainers.
+
+All complaints will be reviewed and investigated promptly and fairly. All community leaders are
+obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for
+any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or
+unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the
+nature of the violation and an explanation of why the behavior was inappropriate. A public apology
+may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people
+involved, including unsolicited interaction with those enforcing the Code of Conduct, for a
+specified period of time. This includes avoiding interactions in community spaces as well as
+external channels like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including sustained inappropriate
+behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the
+community for a specified period of time. No public or private interaction with the people involved,
+including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this
+period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including
+sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement
+of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.