# Changelog All notable changes to this project are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Current line: **1.4.0** (Tailwind migrate CLI · Migration Intelligence · Scanner diagnostics). Previous: Motion Clips **1.3.0**. Overview: [`RELEASE_NOTES_1.4.0.md`](RELEASE_NOTES_1.4.0.md). Upgrade: [`UPGRADING.md`](UPGRADING.md). --- ## [1.4.0](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.4.0) - 2026-09-02 **Tailwind → VelinStyle migration CLI** · **Migration Intelligence** · **Scanner diagnostics & link integrity** · optional Compat package · Skills 2.0 · Adaptive Runtime foundations. Details: [`RELEASE_NOTES_1.4.0.md`](RELEASE_NOTES_1.4.0.md) · Guides: [`docs/guides/tailwind-migrate.md`](docs/guides/tailwind-migrate.md) · Public CLI Scan docs · ADR 0019 / 0020 / 0024 / 0025. ### Added - CLI **`velinstyle migrate tailwind`** / **`migrate rollback`** (dry-run default; `--write` / `--apply`) - Tailwind **v4** detection without requiring `tailwind.config.js` - Coverage report: **Detected · Mapped · Warnings · Unresolved** + `.velin/migration/` reports - Snapshot under `.velin/migration/snapshots/` + rollback (project-local only) - **Migration Intelligence:** classifier → clusters → policies → **23 User Actions** → **6 Strategy Blocks** → Acceptance Persistenz → Rewrite Manifest → Preflight → Dry-Run → Apply Write - Decision-first assistance report under `.velin/migration/intelligence/` - Catalog infrastructure for optional Tailwind Compat: `collectVelinClasses` / `loadCatalog` with `compatRoots` - `@birdapi/velinstyle-tailwind` **Compat CSS** (MVP + slash-opacity, responsive wrappers, static-scale tiers) - CLI **`velinstyle migrate tailwind --compat tailwind`** and opt-in **`--heuristic palette-roles`** (map-only semantic approximation) - **Skills 2.0 (agent surface):** skills registry **1.0.0** with **58** skills; domains Build / Review / Migration / Intelligence / Rewrite; reuse-first routing; skill contracts and stop rules; public Agent Workflows docs (EN/DE) - **Site AI / Agent Discovery (1.4.0):** `/.well-known/ai.json` entry pointer; site `llms.txt` = package generator base + site overlay (no second skill inventory); public `velin-agent.json` projects full registry skill set; AI / Agent Resources docs EN/DE under Docs → AI & Intelligence - **Studio Inspector Core** (`@birdapi/velinstyle/inspector`): read model, selection, `data-velin-block` detection, Adapt/Audit read access - **Velin Blocks:** official blocks registry (10 blocks) + CLI `velinstyle blocks list|info|add`; community manifest validation - **Local AI Ranker (opt-in):** optional ranker on Adapt pipeline (`startAdapt({ ai })`); default AI off; no cloud AI - **Safe Adaptation Engine** + **Semantic Runtime Contract:** signals → policy → intent → validate → apply → audit → undo; `@birdapi/velinstyle/adapt` - **CLI scan — link integrity (Detect only):** `links/local-href-target` and `links/local-fragment-target` for local HTML paths (incl. directory `index.html` / `index.htm`) and `#fragment` ids against the scan root; no Live-HTTP; no automatic path or id rewrites - **CLI scan — structured finding diagnostics:** additive `diagnostic` on link integrity and selected a11y rules; optional candidates and related hints; review-only — candidates are not auto-fixes (`exact` ≠ Apply) - **CLI scan — safe fix dry-run:** `--fix-dry-run` and JSON `autoFix.plans` / `autoFix.rejected` describe each planned SAFE change without writing files - **CLI scan — additional a11y Detect rules:** `a11y/empty-link`, `a11y/positive-tabindex`, `a11y/focus-outline-suppressed`, `a11y/aria-idref-target`, `a11y/aria-controls-target`, `a11y/tab-missing-controls`, `a11y/scrollable-region-hint`, `a11y/nested-interactive`, `a11y/role-button-contract` (Detect only unless listed under SAFE Apply) ### Changed - **CLI Discoverability & Scan SARIF (1.4.0):** Docgen `REGISTERED_COMMANDS` includes `blocks` (aligned with router/manifest). `velinstyle scan --sarif` / `--format sarif` emits SARIF 2.1.0 from the same findings as `--json` (`fixable`, SAFE eligibility, `diagnostic`, Detect-only for `links/*`). Experience human scan shows Apply column (SAFE / review / detect) without dumping JSON. Help lists `--quiet` and Scan SAFE wording. Site CLI EN/DE + AI Resources / Help updated; branding footer gates unchanged. - **CLI scan `--help` (1.4.0 freeze):** `velinstyle scan --help` / `-h` (also with `--json` / `--sarif` / `--format`) prints Experience human help and does **not** scan `.`; machine flags do not force JSON/SARIF for the help path - **Homepage search index (1.4.0 quality):** Package `search index` emits real `.md` paths for generated docs (no invented `.html`). `sync:dist` rebuilds `docs/search-index.json` then refreshes `dist/search-index.json` via `sync-home-search` so homepage search stays site-resolvable and includes crawled guides (e.g. AI Resources) - **Docs themeToggle null (1.4.0 quality):** Legacy inline `#themeToggle` handlers (spaced `const themeToggle = …`) threw `addEventListener` on null after header moved to ``; `sync-sidebar` strip now matches whitespace and removes the dead script - **Component counts clarity:** llms lists 43 canonical WC + 3 helpers + loader aliases; Atelier hero/demo stats aligned to **43** Web Components (was stale 38) - **Component minimal examples:** curated `velin-persist` / `velin-scrollspy` from human docs (43/46); helpers flip/haptic/reveal remain MISSING without inventing APIs - **Site documentation & frontpage (1.4.0):** Homepage EN/DE surfaces AI Resources, scan diagnostics / SAFE boundaries, 58 skills and 36 attributes; `release-1-4-0` overview aligned to Phase 5/6 freeze (not Phase 6.1); Help Center pinned to 1.4.0; CLI docs document Experience footer / `--quiet` and SAFE-only `scan.fix`; site `llms.txt` overlay refreshed via `patch:seo` - **CLI scan:** Auto-fix re-validates file content at apply time (fail-closed). Link-integrity rules (`links/*`) are never applied. SAFE Apply limited to `html-lang`, `skip-link` (only with `id="main"`), `safe-external-link`, `z-index-token`, and `hardcoded-email` - **Agent metadata:** `velin-agent.json` / `llms.txt` from `meta:build` project skills deterministically from the skills registry (SoT), including registry version metadata in the agent bundle and an derived skills inventory section in `llms.txt` - **Agent discovery pointers & scan policy:** `meta:build` publishes `docs/generated/rules/scan-policy.json` from existing scanner rule meta + SAFE Apply gates; agent manifest / `.well-known/ai.json` point at skills, docs, components, Atelier, CLI, and scan policy without duplicating inventories - **Public skill semantics:** `velin-agent.json` `skills.items` project registry `name` and `description` (SoT `packages/velinstyle-skills/registry.json`) so agents can read skill meaning without a second skill list or invented per-skill URLs - **Agent minimal WC examples:** `docs generate` publishes Minimal working examples for Web Components when curated or knowledge-SoT HTML exists; related-resource pointers only for existing human docs / CLI / Atelier library (no Skill↔Component graph) - **Agent WC human-doc extract & doc aliases:** fail-closed Minimal examples may be derived from existing human component docs (`exampleSource: human-doc`) after curated/knowledge; explicit EN doc aliases (`toast`→`toasts`, `tooltip`→`tooltips`, `tabs`→`navs-tabs`) plus DE twins via `doc-lang-map.js` only; structural component-doc contract check (facts only — no a11y/runtime claims, no Skill/Atelier heuristics) - **Agent discovery contract & curated WC starters:** public Atelier catalog mirror at `docs/generated/atelier/catalog.json` (SoT remains `cli/atelier-catalog.json`); curated minimal examples for `velin-live-dot` and `velin-progress-ring`; discovery/atelier inventory contract checks (pointer reachability, counts, no package-internal public paths) - **CLI branding footer & skill clarity:** human Experience terminal output appends a short branding footer (`Built with VelinStyle · Powered by SKYLITE.DESIGN`); suppressed for `--quiet`, `--json`, SARIF, and compact modes. Selected skill registry descriptions clarified for agents (Detect/Review/Apply boundaries; Candidates ≠ Apply) — 58 skill IDs unchanged - **CLI scan:** `a11y/skip-link` marked fixable only when `id="main"` already exists (Detect aligned with Apply gate) - **CLI scan:** `a11y/interactive-aria-hidden` flags only the interactive host with `aria-hidden="true"` (decorative children no longer false positives) - **CLI scan:** `a11y/aria-controls-target` / IDREF helpers skip VelinStyle WC runtime ids (`velin-*-N`) in addition to templates - **CLI scan:** `a11y/nested-interactive` also flags interactive children inside `` (Detect only) - **Tokens / dark media:** `prefers-color-scheme: dark` no longer overrides when `data-velin-theme="light"` or `data-velin-color-scheme="light"` is set - **`velin-theme-toggle`:** Light mode sets `data-velin-theme="light"` (no longer clears the attribute) - **Tokens:** light `--velin-color-info` darkened so `--velin-color-on-info` meets WCAG AA; contrast check covers `on-info` / `info` - A11y skills (`velin-a11y-page-checklist`, `velin-a11y-scan-fix`): diagnostics workflow, Candidate ≠ Apply, Dry-Run before `--fix`; still **review-only** - Migration docs / CLI manifest: three migrate modes (Core-only · `--compat tailwind` · `--heuristic palette-roles`) - Public docs aligned for Core Features / Agent Workflows / Migration Intelligence / CLI Scan (diagnostics, link integrity, SAFE limits) - Review CLI help lists **`ecommerce`** profile; `detectProfile` also considers HTML ids/body hints - PixVerse setup copy wording ### Fixed - Public changelog HTML: guide links resolve to local `.html` when published, otherwise GitHub (no public 404) - Public docs sidebar: Atelier / Library links use site-root paths (`/atelier/…`) - Public site theme init: Light sets `data-velin-theme="light"` so OS dark preference cannot leave dark tokens on light chrome - Public docs Light theme: brand/link/code and sidebar accents meet AA on tinted chrome - Public site changelog generator: version label in `` is non-interactive (nested-interactive) - Public site home release tabs: `aria-controls` points at `#expo-release-panels` tabpanel (EN/DE) - Public docs header: tools/search sizing no longer uses `100vw` (reduces overflow under high zoom) - Public Atelier hub hero: tighter orb sizing + paint containment under zoom - Public home: `velin-dialog#expoDialog` naming via dialog API title (no redundant host `aria-label`) - Public docs: search input / result items expose `:focus-visible` rings; overflowed code `
` keyboard-reachable only when it scrolls
- Public site: Atelier Library route restored; sitemap regenerated; AI Skills version badges aligned to **1.4.0**

### Accessibility

Structured scan diagnostics (review-only; never invent ids, labels, or paths):

- `a11y/duplicate-id` — occurrences and similar-id candidates
- `a11y/aria-idref-target` / `a11y/aria-controls-target` — resolution state (`idref-not-found` / `idref-empty` / `idref-ambiguous`)
- `a11y/empty-link` — accessible-name source flags
- `a11y/positive-tabindex` — tabindex context
- `a11y/focus-outline-suppressed` — static CSS focus-outline details (`staticOnly`; not runtime proof)
- `a11y/button-label` / `a11y/input-label` — name/label source and `label[for]` association state
- `a11y/nested-interactive` — outer/inner nesting details
- `a11y/role-button-contract` — contract reasons (`runtimeUnverified`)
- `a11y/heading-order` — real heading skip lines
- `a11y/scrollable-region-hint` — static overflow flags on `
`

Link integrity: `links/local-href-target` and `links/local-fragment-target` remain **`fixable: false`** — candidates (`exact` / `candidate` / `ambiguous` / `none`) are review hints only.

### Developer Experience

- Finding → Diagnostic → Candidate → Fixability → Dry-Run → Apply pipeline on a single scanner engine
- Additive `diagnostic` fields: `source`, `resolution`, `reason`, optional `candidates`, `related`, `runtimeUnverified`, `staticOnly`, `originHint` (links), `noAutoRepair`
- No finding-level `action` field; no separate `fixability` object — use `fixable` + `--fix-dry-run` / `autoFix.plans` for Apply decisions
- Filter link checks: `velinstyle scan --only links`
- Skills registry **1.0.0** unchanged; no new skill IDs; A11y skills remain **review-only**

### Security / Boundaries

- Migration: **SAFE_REWRITE = 0** without freigegebene Residual-Mappings · Catalog ≠ Manifest ≠ Apply · ACCEPTED ≠ APPLIED
- **No** heuristischen Intelligence-Rewrite-Mappings · **no** automatic target invention · **no** nearest-token/color
- Security gates: path/realpath · SHA-256 · mappingSource allowlist · target allowlist · fail-closed rollback
- Scan Apply: fail-closed re-validation · `links/*` blocked · Detect ≠ Fix ≠ Apply · Candidates review-only
- Honest Compat pilot coverage with heuristic remains about **69.4%** — not Tailwind parity; ≥80% not claimed

### Known limits

- Pilot coverage with Compat + heuristic ≈ **69.4%** — not Tailwind parity
- Residual Theme/Palette without freigegebene Catalog-Zeilen: **SAFE_REWRITE = 0**
- Unresolved / Warning tokens are never silently rewritten; Tailwind dependencies never auto-removed
- Static scan is not a full accessibility audit; no Live-HTTP link checks; no automatic EN↔DE or path rewrites

---

## [1.3.0](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.3.0) - 2026-08-09

**Velin Motion Clips.** Package `@birdapi/velinstyle-motion` + CLI image→clip pipeline (local + optional PixVerse AI provider).

Details: [`RELEASE_NOTES_1.3.0.md`](RELEASE_NOTES_1.3.0.md) · Guide: [`docs/guides/velin-motion-clips.md`](docs/guides/velin-motion-clips.md).

### Added

- Package **`@birdapi/velinstyle-motion`** / export `@birdapi/velinstyle/motion-clip`
- Local clip engine: zoom · pan · rotate · particles · intro/outro · transitions → HTML/CSS
- Clip presets: soft-zoom · cinematic · atelier · rotate · particle-reveal · rotate-explode · ai-reveal
- CLI: `motion create` · `atelier` · `transition` · `sequence` · `usage` · `providers` · `setup pixverse` · effect shortcuts · `presets --clips`
- Interactive wizard + mini-prompt → motion profile
- AiProvider interface + **PixVerse** provider (models/capabilities; cost gate; dry-run)
- PixVerse onboarding: affiliate open once (`pixverse.setup_completed`) · key in `.velin/motion/.env` · never logged
- Hard CI rule: `--yes` + AI + no key → exit 1 (no browser / prompts)
- `.velin/motion/` config · jobs · cache · usage
- Docs EN/DE: Clip guide, Page-Motion update, PixVerse setup, package README

### Changed

- Motion CLI help / registry lists clip subcommands (1.3)
- Version pin **1.3.0**

### Fixed

- Clip inputs: reject **empty** files, unsupported extensions (only `.webp` / `.png` / `.jpg` / `.jpeg`), and non-image payloads (magic-byte check) before local/AI processing

---

## [1.2.9](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.9) - 2026-08-06

**Release Candidate.** Versions, site badges, and docs aligned on one line after Technical Debt **1.2.8**.

Details: [`RELEASE_NOTES_1.2.9.md`](RELEASE_NOTES_1.2.9.md).

### Changed

- Monorepo / workspace / Site / CLI registry version surfaces synchronized to **1.2.9**
- CHANGELOG / UPGRADING narrative: Security → Debt → RC; Motion drafts marked WIP vs GA claims
- Motion guide: V1 triggers stable; V2 planned + visible fallback documented

### Fixed

- **Site home (`velinstyle-site`):** `verify:home` again green — `core-count` ignores optional `velin-signature`; `lang-switch` matches multi-class `expo-lang`; What’s New title/CTA pinned to **1.2.9** (EN/DE); site `package.json` version aligned

### Known limits (RC)

- No live `npm outdated` network rule
- Production report images still “coming soon”
- Motion V2 triggers / Physics / Studio UI not first-class

---

## [1.2.8](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.8) - 2026-08-06

**Technical Debt** — audit follow-up from [`docs/internal/CODE_AUDIT_2026-08-06.md`](docs/internal/CODE_AUDIT_2026-08-06.md).

Details: [`RELEASE_NOTES_1.2.8.md`](RELEASE_NOTES_1.2.8.md).

### Added

- `velinstyle check` **security** step (`securityCheckStep`)
- Publish rule **`publish.pack-dry-run`** (`npm pack --dry-run`, timeout-safe)
- Experience help category **`design`** (Motion visible in `--help`)

### Changed

- Lockfile finding uses `code: no-lockfile` (not “outdated”)
- Dependency Health reports no-lockfile + heuristic outdated note (no live `npm outdated`)
- Malware rules (`lifecycle-hooks`, `typosquat`) use `category: malware`; empty malware score is **n/a**
- Planned Motion V2 triggers: `runtime: false` + documented visible fallback
- `test:security` includes `tests/security.test.js`

### Fixed

- Engine `deps`/`repo`/`consumer`/`publish` category maps include **malware** so malware rules actually run

---

## [1.2.7](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.7) - 2026-08-05

**Velin Motion — Engine Surface (in-tree draft).** Timeline/Composer runtime, motion metrics, review/optimize, blueprint kinds.

> Status: **Draft / WIP** in the working tree — not claimed as npm GA. V2 triggers listed below are **planned** (runtime falls back to `visible`).

Details: [`RELEASE_NOTES_1.2.7.md`](RELEASE_NOTES_1.2.7.md) · Guide: [`docs/guides/velin-motion.md`](docs/guides/velin-motion.md).

### Motion Engine

- Timeline Registry + `velin-timeline` / `runTimeline`
- Composer `Motion.sequence` + `velin-motion-sequence`
- Transition helpers (`runViewTransition`, modal/drawer hints)
- Triggers (planned V2, fallback visible): `hidden` · `idle` · `media` · `container` · `theme` · `custom`
- CLI: `motion analyze|review|report|optimize|blueprint`
- Blueprints: landing · dashboard · pricing · portfolio · shop · forum · docs · blog · crm · login
- `check` integrates motion doctor step
- Gallery timeline/sequence sections

### Docs

- Extended Velin Motion guide; RELEASE_NOTES 1.2.7; UPGRADING; Site EN/DE

---

## [1.2.6](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.6) - 2026-08-05

**Velin Motion — Foundation (in-tree draft).** Motion Design System subsystem: full Registry (all building blocks) + Trigger Engine (Studio-ready data).

Details: [`RELEASE_NOTES_1.2.6.md`](RELEASE_NOTES_1.2.6.md) · Guide: [`docs/guides/velin-motion.md`](docs/guides/velin-motion.md).

### Motion Registry & Trigger Engine

- Registry namespaces: Presets · Timelines · Transitions · Physics · Composers · Triggers · Policies · Blueprints
- Compatibility + categories + descriptions on every record
- Trigger Engine + `velin-trigger` (`load` · `visible` · `hover` · `focus` · `click` · `scroll`)
- Unified attrs `velin-motion` · `velin-duration` · `velin-delay` · `velin-ease`
- Policies: safe · reduced · marketing · minimal · accessibility · performance · disabled
- Token aliases `--velin-motion-*`, `--velin-bounce`, `--velin-spring`
- Scroll slide-down/left/right CSS; Production bare-attr detection
- CLI: `motion list|presets|doctor|scan|policy|demo`
- Playground: `samples/motion-gallery.html`

### Docs

- Product guide Velin Motion; RELEASE_NOTES 1.2.6; Experience cross-links

---

## [1.2.5](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.5) - 2026-08-05

**Product Surface.** Velin Experience ships `dashboard`, `--record` + `replay`, plugin registry skeleton, and local analytics hints.

Details: [`RELEASE_NOTES_1.2.5.md`](RELEASE_NOTES_1.2.5.md) · Guide: [`docs/guides/velin-experience.md`](docs/guides/velin-experience.md).

### Velin Experience — Product Surface

- `velinstyle dashboard` — multi-signal project overview (doctor · review · scan · production folder)
- `--record` writes JSON / Markdown / HTML / ASCII under `.velin/records/`; `velinstyle replay `
- Plugin skeleton: `registerPluginCommand` on the Experience Registry
- Local analytics hints (opt-in via `velinstyle-cli.json` / `--analytics`) — no cloud telemetry
- Layout / Perf / Scan audit paths render through the Output Contract

### Docs

- Product guide Velin Experience; Landing What’s New; Site CLI / Production guides EN/DE

---

## [1.2.4](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.4) - 2026-08-05

**Engine Experience.** Production / Review / Check on the Output Contract; Content Scanner (Blade first-class); Production Report breakdown.

### Content Scanner

- Scan **your project**, not only HTML: `.html`, `.blade.php` (first-class), `.twig`, `.vue`, `.jsx`/`.tsx`, `.astro`, `.md`/`.mdx`
- Template delimiters stripped so Blade/Twig noise is not tokenized as classes

### Production Report Breakdown

- Structured before→after rows: CSS · Runtime · Icons · Themes · Motion · Components + Savings %
- Terminal / Markdown / JSON (additive Contract fields); Experience widgets `bundle` / `savings`

### Modes & Notifications

- Modes: compact · standard · dashboard · verbose · debug · json · sarif · markdown
- Notification / suggestion widgets on Result surfaces

---

## [1.2.3](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.3) - 2026-08-06

**Security Suite.** Introduces **Velin Security Suite** (CLI) on **Velin Security Engine** (`core/security/`).

### Security Engine

- Rule registry: `registerSecurityRule` — categories repo · consumer · ci · publish · deps · secrets
- Scores: overall Security Score, Dependency Health, Release Health
- Security Timeline persisted under `.velin/security/timeline.json`
- Export: `@birdapi/velinstyle/security`

### CLI

```bash
velinstyle security doctor|scan|audit|publish|ci|deps|secrets|report
```

- Auto-detect maintainer vs consumer projects; flags `--repo` · `--consumer` · `--ci` · `--publish`
- Experience output + `--json` · `--strict`
- Guide: [`docs/guides/velin-security.md`](docs/guides/velin-security.md) · [`RELEASE_NOTES_1.2.3.md`](RELEASE_NOTES_1.2.3.md)

### Note

Earlier unpublished drafts for Experience packaging remain in the tree; **1.2.3 ship focus** is Security. Motion Design System remains a later line (1.2.6+).

---

## [1.2.2](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.2) - 2026-08-04

**Production Release.** VelinStyle 1.2.2 focuses on production builds and developer workflow. The new Production Builder creates optimized output based on the actual project instead of shipping the complete framework. This release also introduces the first Atelier CLI integration and new production-ready components.

**Build only what your project actually uses.**

Details: [`RELEASE_NOTES_1.2.2.md`](RELEASE_NOTES_1.2.2.md).

### Production Builder

- Do not ship the full framework blindly — analyze the project and emit an optimized production package
- CLI: `velinstyle build --production` and `velinstyle production [path]`
- CSS only for used components (graph closure + utility filter); runtime only for needed Web Components
- Themes / icons / motion / fonts only when used
- Report with size comparison; `--explain` lists removals; `--watch`, `--report`, `--safelist`
- Pipeline under `cli/production/`; `component-graph.json`; config `production: { out, safelist, themes }`
- Review: `scores.optimization` + soft `optimization.*` issues
- Guides: [`docs/guides/production-build.md`](docs/guides/production-build.md); Vitest `tests/production/production.test.js`

### Atelier CLI (Beta)

- `velinstyle atelier list` · `velinstyle atelier 24` · `velinstyle scaffold --atelier 24` (also `plan --atelier …`)
- Pull curated Atelier Library showcases (local `--from` / `VELINSTYLE_ATELIER_ROOT` or HTTPS)
- `--format html|blade|vue|react` — blade/vue/react are **integration wrappers**, not native rewrites
- Separates **Atelier Library** from **Velin Studio** (Studio remains **planned**)
- Guide: [`docs/guides/atelier-cli.md`](docs/guides/atelier-cli.md); Vitest `tests/atelier.test.js`

### New components

- ``, ``, `` (Showcase P0 gaps)
- Empty-state blueprint uses ``

### Improvements

- Overlay title slot + reactive `title` on ``, ``, ``
- Data-table / table row severity modifiers (`velin-data-table__row--*`, `data-severity`, `.velin-table--*` aliases)
- CLI help / `cli-manifest.json` document Production Builder and Atelier; prefer Production output over blind full-bundle for publish (documented)

---

## [1.2.1](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.1) - 2026-08-02

VelinStyle **1.2.1** ships the **Velin Transparency Framework** foundation: labeling **and** provenance as a subsystem (not an AI badge).

### Added

- Transparency subsystem at `@birdapi/velinstyle/transparency` — Engine, Registry, Policy, Providers, Validator, Doctor, Reporter, Export, Migrate, Renderer
- HTML bridge `velin-transparency` / `velin-disclosure` + provenance attributes
- Claim taxonomy (`ai.generated`, `review.human`, `license.*`, …)
- CLI: `velinstyle transparency doctor|validate|report|export|migrate` (scan alias)
- Integration into `velinstyle check` / review scores (Transparency + pillars)
- CSS marks (badge, overlay, ribbon, inline, footer, panel, tooltip, icon)
- Example policy `examples/transparency.policy.json`
- Docs guides EN/DE: Transparency Framework

### Changed

- Soft default transparency policy so existing `check` runs stay non-breaking; strict media rules via policy file

---

## [1.2.0](https://github.com/SkyliteDesign/velinstyle/releases/tag/v1.2.0) - 2026-08-01

VelinStyle **1.2.0** ships Core + Design Intelligence Foundation and the Trust/Ship surface (`create`, `check`, `serve`, `doctor`), trust-oriented scan/review gates, AI skills registry tooling, and new app primitives (calendar, file dropzone, editable data table). Claims stay honest: excellent for landings and docs; not yet a primary multipage shop/enterprise-admin stack.

### 🚀 Highlights

#### Framework
- Logical spacing honesty and denser padding steps for blueprint fidelity
- App-shell layout utilities
- Lite CSS preset for marketing budgets

#### Design Intelligence (Beta)
- Review profiles (`marketing` | `app` | `docs` | `fragment` | `ecommerce`)
- Thin-content floors so junk pages cannot score conversion/SEO at 10

#### AI Foundation (Beta)
- Skill engine + 40 official skill records, packs, bundles, templates, workflows
- `velinstyle skills` / `workflow` CLI; `skills doctor` path integrity

#### CLI
- `create landing|dashboard|docs|auth`, `check` (`--json` / `--sarif`), `serve`, `doctor`
- `wc api `, `build --preset lite`, `--out` / `-o` aliases

#### Components
- ``, ``, ``

#### Blueprints
- `split-hero`, `pricing-band`, `app-chrome`, `ops-console`

#### Quality
- Trust scan rules (nested interactive, contrast-inline, role=button, and more)
- Chaos + misses fixtures; blueprint `--strict` CI
- Windows ESM path fixes; vendor mini-docs on create

### Release Status

| Area | Status |
|------|--------|
| CSS Framework | Stable |
| Utilities | Stable (honesty expansions) |
| Runtime | Stable |
| Web Components | Stable (+ new primitives) |
| CLI | Stable (expanded surface) |
| Blueprints | Stable |
| Review Engine | Beta |
| Prompt Engine | Beta |
| Knowledge Graph | Beta |
| AI Metadata | Beta |
| AI Skills | Beta / Foundation |
| Workflow Graphs | Beta / Foundation |
| Studio | Planned |
| Utility Engine Generator | Planned |

### Added

#### CLI
- `velinstyle serve`, `velinstyle doctor`, `velinstyle create landing|dashboard|docs|auth`
- `blueprint --strict` / `npm run check:blueprints` CI gate
- `velinstyle check` (doctor + blueprint `--strict` + scan + review) with `--json` / `--sarif`
- Aliases: `validate` → `check`, `documentation` → `docs`
- `velinstyle wc api ` (source-backed WC API + examples)
- `velinstyle skills doctor` / `npm run skills:doctor` path integrity
- `velinstyle build --preset lite` marketing layer subset; `--out` / `--output` / `-o` aliases
- `velinstyle skills show  --human` Markdown view

#### Components
- `` (month picker)
- `` (client upload UX)
- `` inline edit (`velin-data-table-edit` event)

#### Scanner / Review
- Scan rules: `a11y/duplicate-id`, `css/unknown-velin-class`, `wc/invalid-attribute`, HTML `security/no-document-write`, `a11y/target-size-min`, `a11y/nested-interactive`, `a11y/contrast-inline`, `a11y/role-button-contract`
- `check:chaos` covers chaos + `misses.html` (fixtures under `fixtures/`)
- Review thin-content floors (SEO/conversion capped on junk pages)
- Review `--profile marketing|app|docs|fragment|ecommerce`

#### Utilities / Layout
- Spacing: `velin-py-*` (padding-block alias) and denser `velin-pb-*` / `velin-pi-*` steps **10** and **12**
- Logical spacing honesty: `velin-mbe-1/3`, `velin-mbs-1/3`, `velin-pbe-*`, `velin-pbs-*`, `velin-border-inline-end/start`
- App-shell layout utilities

#### Blueprints
- `split-hero`, `pricing-band`, `app-chrome`, `ops-console` (validated classes only)

#### AI Skills
- AI Runtime foundation: `packages/skill-engine` and `packages/velinstyle-skills` (registry-first)
- 40 official skill records across 16 categories (capabilities, compatibility, status, confidence, cost hints, dependency graph metadata, typed inputs/outputs)
- Workflow graph manifests (`landingpage`, `component-ship`, `release-gate`), plus packs, bundles, project templates, and project skill chains
- CLI: `velinstyle skills ...`, `velinstyle workflow ...`
- Schemas: `skill-record`, `skill-registry`, `skill-pack`, `skill-graph`, `skill-bundle`, `skill-template`, `skill-project`

#### Documentation
- Guides: `landing-15-min`, `marketing-lite-css`, `docs/guides/ai-skills.html`, `docs/guides/ecommerce.html`
- Docgen minimal WC copy-paste examples (copy, tooltip, lightbox, icon, command, menubar, form-summary, data-table)
- Strategy/ADR deep-dives remain maintainer-local (monorepo `interne_docs/strategy/`; not published)
- `UPGRADING.md` draft for **1.1.0 → 1.2.0** (publish when cutting the minor)
- `RELEASE_NOTES_1.2.0.md` companion overview

### Changed

#### Security
- Production dependency `isomorphic-dompurify` **3.13 → 3.21.0** (DOMPurify 3.4.x) so `npm audit --omit=dev` reports **0** vulnerabilities before the 1.2.0 upload

#### CLI
- `velinstyle scan` and `velinstyle perf` accept a single HTML/CSS/JS file or a directory (no more `ENOTDIR` on file paths)
- `velinstyle init` copies vendor assets when framework `dist/` is available and scaffolds starter HTML with `data-velin-reveal-auto` + icon sprite meta
- `velinstyle create` emits zero-warning HTML (no inline styles, `label for`/`id`), copies vendor into the target dir, boots via `bootFromDOM` when the package resolves (vendor full-bundle fallback)
- Create vendor copy includes mini WC docs under `vendor/velinstyle/docs/`
- `velinstyle build` invokes local `lightningcss` from the package `node_modules`; `--preset lite` prints size vs `dist/velinstyle.min.css`
- Unknown CLI commands exit **1** with "Did you mean ...?" instead of dumping help with a success-looking exit
- Top-level `--help` / README CLI tables list all create kinds and `wc api` / `skills doctor`
- `velinstyle meta page --write` merges curated `goals`/`intent` and **warns** when dropping non-allowlisted keys

#### Review Engine
- Hero CTA heuristic strips scripts/styles/code-blocks and counts only real ``/`