@nyuchi/ui 0.4.0

The release of staging to main after @bundu/ui 0.4.0 and @nyuchi/ui 0.3.0. Under the org versioning policy each package with changes takes the next minor: @bundu/ui 0.5.0 carries MetaList 1.1.0 and ResultGrid 1.1.0 from the registry v4.5.0 pin and brand-circles.css; @nyuchi/ui 0.4.0 carries brand-circles.css (both from the entries below). @bundu/server (0.1.0) has no package changes and is not republished.

Changed (@bundu/ui): registry pin v4.5.0 — MetaList 1.1.0 and ResultGrid 1.1.0

scripts/registry-ref.json moves from 5067b5e (registry v4.4.0) to 9f3631c, the v4.5.0 release on registry main (mzizi-dev/mzizi-registry#454), and pnpm registry:sync rebuilds the two components it changes:

• discover/MetaList 1.1.0 is a valid description list: each row is <div><dt><dd></div> with the icon inside the <dt>, and a row whose value is empty hides itself (mzizi-registry#450).
• discover/ResultGrid 1.1.0 has an error state (state="error" and an error slot) beside ok and empty (mzizi-registry#451).
• Their contracts move with them (contracts/discover/{meta-list,result-grid}.contract.json, contracts/index.json).

tokens/canon.snapshot.json follows live canon: circles is tanzanite, "Mukoko Circles". api.mzizi.dev does not serve the row's accent yet (mzizi-dev/mzizi-api#62, on its staging), so the LOCAL_BRAND_MINERALS bridge now keeps supplying the terracotta --brand-accent while canon's mineral matches and canon has no accent; brand-circles.css is unchanged apart from its header comment.

Added (@bundu/ui, @nyuchi/ui): brand-circles.css, tanzanite with a terracotta --brand-accent

Mukoko Circles (circles.mukoko.com) is tanzanite primary + terracotta accent (owner decision, 2026-10-06). The canon row is corrected in mzizi-dev/mzizi-registry#449. The overlay sets --primary and --ring to tanzanite and --brand-accent to terracotta, light and dark, and both packages export it. The generator learns an optional accent family per brand. A LOCAL_BRAND_MINERALS bridge entry can now supersede a snapshot row that canon is correcting; once the snapshot catches up, canon wins.

---

npm: https://www.npmjs.com/package/@nyuchi/ui/v/0.4.0
Changelog: https://github.com/mzizi-dev/packages-npm/blob/@nyuchi/ui@0.4.0/CHANGELOG.md

@bundu/ui 0.5.0

The release of staging to main after @bundu/ui 0.4.0 and @nyuchi/ui 0.3.0. Under the org versioning policy each package with changes takes the next minor: @bundu/ui 0.5.0 carries MetaList 1.1.0 and ResultGrid 1.1.0 from the registry v4.5.0 pin and brand-circles.css; @nyuchi/ui 0.4.0 carries brand-circles.css (both from the entries below). @bundu/server (0.1.0) has no package changes and is not republished.

Changed (@bundu/ui): registry pin v4.5.0 — MetaList 1.1.0 and ResultGrid 1.1.0

scripts/registry-ref.json moves from 5067b5e (registry v4.4.0) to 9f3631c, the v4.5.0 release on registry main (mzizi-dev/mzizi-registry#454), and pnpm registry:sync rebuilds the two components it changes:

• discover/MetaList 1.1.0 is a valid description list: each row is <div><dt><dd></div> with the icon inside the <dt>, and a row whose value is empty hides itself (mzizi-registry#450).
• discover/ResultGrid 1.1.0 has an error state (state="error" and an error slot) beside ok and empty (mzizi-registry#451).
• Their contracts move with them (contracts/discover/{meta-list,result-grid}.contract.json, contracts/index.json).

tokens/canon.snapshot.json follows live canon: circles is tanzanite, "Mukoko Circles". api.mzizi.dev does not serve the row's accent yet (mzizi-dev/mzizi-api#62, on its staging), so the LOCAL_BRAND_MINERALS bridge now keeps supplying the terracotta --brand-accent while canon's mineral matches and canon has no accent; brand-circles.css is unchanged apart from its header comment.

Added (@bundu/ui, @nyuchi/ui): brand-circles.css, tanzanite with a terracotta --brand-accent

Mukoko Circles (circles.mukoko.com) is tanzanite primary + terracotta accent (owner decision, 2026-10-06). The canon row is corrected in mzizi-dev/mzizi-registry#449. The overlay sets --primary and --ring to tanzanite and --brand-accent to terracotta, light and dark, and both packages export it. The generator learns an optional accent family per brand. A LOCAL_BRAND_MINERALS bridge entry can now supersede a snapshot row that canon is correcting; once the snapshot catches up, canon wins.

---

npm: https://www.npmjs.com/package/@bundu/ui/v/0.5.0
Changelog: https://github.com/mzizi-dev/packages-npm/blob/@bundu/ui@0.5.0/CHANGELOG.md

@nyuchi/ui 0.3.0

The first release from the release workflow, which publishes and tags on merge to
main with no hand-pushed tag (#25). Owner decision, 2026-10-04:
versions that were bumped here but never published are reset to the org versioning
policy, so each package's next release is one minor above what npm has. npm has
@bundu/ui 0.2.0 and @nyuchi/ui 0.2.0, so both are 0.3.0; @bundu/server is new,
at 0.1.0.

This one entry carries all of the unreleased entries before it. The changes this
file recorded under @bundu/ui 0.3.0, 0.4.0, 0.4.1 and 0.5.0, @nyuchi/ui 0.3.0 and
0.4.0, and the Discover Standard (Unreleased) are all here. None of those versions
reached npm, and 0.4.0, 0.4.1 and 0.5.0 are not used. Breaking changes are marked
Breaking.

Added

• @bundu/server 0.1.0 — a new package: server-side helpers, the companion to
  @bundu/ui as mzizi-roots-server is to mzizi-roots. Dependency-free on Web APIs,
  so it runs in Astro server routes, Node 20+ and Cloudflare Workers alike:
  createSealer (AES-256-GCM values bound to a purpose, wire-compatible with the Rust
  sealer in the Nyuchi console backend, checked both ways), randomToken,
  pkceChallenge, cookie helpers with safe defaults, createFlash (one-shot messages
  carried as a key, never text), the theme preference, safeBack (same-origin return
  paths, refusing //, \ and control characters), parseOrigin (bare https
  origins), withSecurityHeaders, and the table query and paging core. Built from
  TypeScript to dist/ with declarations on prepack. 36 unit tests. Tracking:
  #19.

• @bundu/ui — @bundu/ui/lib/table now re-exports @bundu/server/table, which
  holds the code, and @bundu/ui depends on @bundu/server. The same API.

• @bundu/ui — app patterns for signed-in apps and consoles (@bundu/ui/app/*).
  AppShell, SideNav, AccountMenu, PageHeader, DataTable (one card per row on
  phones), FilterBar, Pagination, DetailPanel, FormLayout, FormField,
  StateMessage, Toast, StatTile and BarChart, and the primitives under them
  (Button, Badge, Card, Alert, Input, Label, Skeleton). All are pure
  Astro: no React or other framework under them and no client JavaScript. Badge
  follows the Mzizi registry's badge contract (default, secondary, destructive,
  outline, ghost, link). Plus @bundu/ui/lib/table (parseTableQuery,
  filterRows, paginate, withParams). Built for the Nyuchi console's move to Astro
  and Rust (nyuchi/nyuchi-platform#330), which keeps local copies until this release
  is published.

• @bundu/ui — @bundu/ui/ui/variants. The class recipes (buttonVariants,
  cardVariants, alertVariants, inputClasses, labelClasses, skeletonClasses,
  badgeClasses) with no React in them, shared by the React primitives and the Astro
  components. Each .tsx still exports its own recipe, so existing imports keep
  working.

• @bundu/ui — rendering tests for the app patterns. src/app/app.test.ts renders
  every component through Astro's container API with no framework renderer
  registered, and checks the semantics each one promises (landmarks, labels, aria-*
  wiring, escaped cell text, no <script> and no island), plus a source check that no
  app component imports a framework. @bundu/ui gains a test script, a
  vitest.config.ts (Astro's getViteConfig) and an astro dev dependency; the root
  pnpm test runs each package's tests. Not in the tarball.

• brand-kweli.css (malachite) and brand-learning.css (gold), in both
  packages, so Kweli and Nyuchi Learning dashboards can adopt the Mzizi
  Dashboard Standard (mzizi-dev/mzizi-registry#404). Owner decisions,
  2026-10-04: Kweli is malachite (it used to borrow Mukoko's tanzanite), and
  Nyuchi Learning / education is gold, because every Nyuchi brand is gold.
  Canon's ecosystem table now carries kweli, learning, news and
  weather rows (mzizi-dev/mzizi-registry#409); until the snapshot picks them
  up through /v1/brand, LOCAL_BRAND_MINERALS gives the same answers, and
  the news and weather overlays now cite canon instead of the mini-app accent
  table. A canon row that disagrees still fails the generator. New
  scripts/brand-overlays.test.mjs checks, in both packages, that every
  decided brand ships on its decided family, that every overlay repoints
  --primary and --ring only, and that every overlay is exported.

• Brand overlays for six sub-apps, in both packages: brand-nhimbe.css
  (malachite), brand-lingo.css (cobalt), brand-bushtrade.css (gold),
  brand-campfire.css (malachite), brand-news.css (cobalt) and
  brand-weather.css (cobalt), so their dashboards can adopt the Mzizi
  Dashboard Standard (mzizi-dev/mzizi-registry#404). Generated like the others:
  the first four from canon's ecosystem table; news and weather have no canon
  row yet, so their mineral comes from the registry's own mini-app accent table
  (lib/tokens/index.ts brandOverrides) until canon carries one, and a canon
  row that disagrees fails the generator. Each repoints --primary and
  --ring only.

• @bundu/ui — a contract for every app component. The 31 components under
  @bundu/ui/app/* each have a Mzizi component contract, authored in
  mzizi-dev/mzizi-registry (contracts/, mzizi-dev/mzizi-registry#404) and
  shipped in contracts/ (exports @bundu/ui/contracts/index.json,
  …/contracts/app/* and the schema). New src/app/contracts.test.ts renders
  every component in every named state and evaluates its clauses, selector
  checks, fine and coarse pointer heights, the brand-overlay rule (no colour
  values; minerals only as declared status colours), the no-JS rule, and that
  its props and slots are the contract's. An unevaluable clause fails.
  pnpm contracts:fetch / contracts:check sync the copy from the registry.
  Together the contracts are the Mzizi Dashboard Standard.

• @bundu/ui — Button destructive and destructive-outline variants
  in both buttonVariants (ui/button) and appButtonVariants
  (app/Button.astro). They use only the destructive /
  destructive-foreground tokens, so brand overlays never change them. Use
  destructive for the one irreversible action on a page and
  destructive-outline for secondary ones (revoke, remove). The Button
  contract delta is on mzizi-dev/mzizi-registry#404. This replaces the
  console's local TODO(mzizi) destructive buttons
  (nyuchi/nyuchi-platform#330).

• @bundu/ui — the app patterns become a full-width product dashboard.
  New under @bundu/ui/app/*: WorkspaceSwitcher,
  QuickSearch and CommandPalette (⌘K), TopBarAction, Toolbar and
  ToolbarMenu, StatTiles, InfoTip, EmptyState, and BrandMark with the
  official Nyuchi mark (the Mzizi registry's bee icon pair, scaled to 128px, in
  assets/brand/). @bundu/ui/app/nav (and the root) gains groupNav,
  currentHref, flattenNav, searchNav and matchesQuery. Icon gains 36
  app glyphs. ui/variants gains appButtonVariants and appInputClasses.
  Built for the Nyuchi console (nyuchi/nyuchi-platform#330).

• styles/brand-events.css (Mukoko Events; owner decisions, 2026-10-04,
  mukoko-dev/nhimbe#155: the nhimbe
  brand is retired, the events platform is Mukoko Events at events.mukoko.com, and its
  mineral stays malachite): the Mukoko Events overlay (malachite), exported
  in both packages. Canon's row is events (mzizi-dev/mzizi-registry#411). Until
  the snapshot carries it, the mineral is bridged in LOCAL_BRAND_MINERALS.

The Mzizi Discover Standard (@bundu/ui)

Owner decision, 2026-10-04: the discover pages of news, events, circles and
weather must be identical, so they move into the Mukoko super-app on the web
unchanged (mzizi-dev/mzizi-registry#413).

• Eleven pure Astro components, @bundu/ui/discover/*: DiscoverShell,
  DiscoverMeta, DiscoverHero, DiscoverSearch, CategoryChips,
  CategoryChip, DiscoverSection, ResultGrid, DiscoverCard (variants
  article, event, circle, place), LoadMore and OpenInApp. No client
  JavaScript, no inline styles, and each works in a server-filled shell
  ({{placeholders}}).
• Contracts: contracts/discover/ (11), fetched from the registry, rendered
  in every state by src/app/contracts.test.ts; src/discover/discover.test.ts
  renders a whole Discover page and the server-filled mode.

Changed

• Repository tooling: Vite+ 1.0. vite-plus joins the root dev dependencies
  (prettier stays, for the token generator only), and vp check (format plus
  type-aware lint) is the repo's check. Source files in both packages were re-wrapped
  by the formatter, and @nyuchi/ui's Breadcrumb writes its JSON-LD closing tag as
  <\/script> (the same string at runtime) so the linter can parse the component.
  No API change.

• Removed .github/workflows/lint.yml. The mzizi-dev org ruleset now runs the shared lint on every pull request through mzizi-dev/.github's org-lint.yml, publishing the same five lint / … checks, so the repo's own caller only ran lint a second time.

• Breaking — AppShell is full width. A fixed sidebar (16.25rem) and a main
  column filling the rest, with no max-w-[96rem] centred container; the nav
  is rendered once (the sidebar is a popover drawer below 64rem) instead of
  twice; new slots workspace, search, actions, overlay; new props
  collapsed, persist, footerLinks, sidebarLabel, id. The sidebar
  collapses to an icon rail.

• Breaking — SideNav shows the label only. An item's description (or
  the earlier summary) is a tooltip and the link's aria-describedby, no longer
  printed under the label. Takes groups with icons, badges and nested items;
  flat items still wor...

@bundu/ui 0.4.0

The release of staging to main after @bundu/ui 0.3.0, which npm has had since
2026-10-05 (published from main at 4ce82a7). Under the org versioning policy this
release is the next minor, so @bundu/ui is 0.4.0: it carries every @bundu/ui entry
below, down to the 0.3.0 heading, which were merged into staging after 0.3.0 left
main. @nyuchi/ui (0.3.0) and @bundu/server (0.1.0) have no package changes and
are not republished. Three repository entries below (the README's design-system link,
the versioning policy and the last "Changed (repository)" list) were already on main
when 0.3.0 was published.

Changed (repository): the registry pin follows the v4.4.0 release on registry main

scripts/registry-ref.json moves from 95318a9 on registry staging to 5067b5e, mzizi-dev/mzizi-registry#447. That is the v4.4.0 release of staging to main, and its tree is the same as 95318a9 plus the version bump (mzizi-dev/mzizi-registry#446). No package file changes: pnpm registry:check reports all 86 files identical, and contracts/ match at the new pin (66 contracts). The packages are now built from a released registry commit rather than a staging one.

Added (@bundu/ui): the Nyuchi console's form, chart and table deltas, and the registry primitives

The registry pin moves to mzizi-dev/mzizi-registry#443 (95318a9 on registry staging). That PR takes four deltas from the Nyuchi console (nyuchi/nyuchi-platform console/web) into the Dashboard Standard contracts.

• app/FormField.astro (contract app/form-field 1.1.0):
  • as: "textarea" with rows (default 5), or as: "select" with options ({ value, label }[]) and emptyOption. Both have the same wiring and app density as the input; a read-only select is disabled.
  • type adds number, date and file. accept and multiple apply to a file input, which never carries a value; min, max and step to number and date inputs.
  • inputmode adds numeric and decimal.
  • wide spans both FormLayout columns.
• app/FormLayout.astro (1.1.0): enctype: "multipart/form-data" for a form with a file field.
• app/BarChart.astro (1.1.0): column-layout axis labels never crowd. At most 6 show from sm up; below sm, only the first, the middle (from 5 points) and the last.
• app/DataTable.astro (1.1.0): a cell's tone (neutral, success, warning, info, accent or premium) is a status pill, data-slot="status" in the mineral status colours. badge keeps the registry badge variants.
• ui/variants: appTextareaClasses, appFileInputClasses, STATUS_TONES / StatusTone and statusToneClasses.
• The registry primitives with ui/ contracts are now shipped as @bundu/ui/{Alert,Button,Card,Input,Label,Skeleton,StatusBadge}.astro. The app/ builds of Alert, Button, Card, Input, Label and Skeleton now come from the registry's app-* files (mzizi-dev/mzizi-registry#428). NativeSelect, SegmentedControl and Toaster follow mzizi-dev/mzizi-registry#441 and #442.

Changed (repository): trusted publishing only, and a never-published package fails clearly

Owner decision, 2026-10-05: npm publishing is trusted publishing (OIDC) only, with no
npm token ever; the NPM_TOKEN org secret is deleted. The short-lived token fallback for
first publishes is gone from the Release workflow and scripts/release-publish.mjs.
npm attaches a trusted publisher only to an existing package, so the script now checks
each unpublished package first: when npm answers E404 for its name, it is reported as
"failed" with the manual first-publish steps (npm login --auth-type=web, pnpm pack,
npm publish <tgz> --access public, then add its trusted publisher and re-run), and its
dependants stay blocked. Every child process runs with NODE_AUTH_TOKEN, NPM_TOKEN
and npm_config_*_authToken variables stripped. setup-node no longer gets a
registry-url, so no .npmrc placeholder token can mask a failed OIDC exchange. The
README's "Publishing" section has the owner steps. No package changes.

Changed (repository): @bundu/ui and @bundu/server are built from the Mzizi registry

Owner decision, 2026-10-04: mzizi-dev/mzizi-registry is the single source of every component in every format. The 54 Astro components and their modules moved there (mzizi-dev/mzizi-registry#430), beside each component's .tsx and .rs, and this repo now builds them from it.

• pnpm registry:sync (scripts/sync-registry.mjs) writes, from the registry at the commit pinned in scripts/registry-ref.json:

  • every @bundu/ui .astro component and the modules they use (lib/utils, ui/variants, app/nav, icons, breadcrumbs, safe-area, discover/open);
  • every @bundu/server helper (the registry's n4-safety/server-*.ts, the TypeScript mirror of mzizi-roots-server);
  • the brand-mark PNGs;
  • the contract runner.

  scripts/registry-map.json names the package file each registry item becomes. scripts/registry-imports.mjs rewrites the registry's flat imports into the published layout, and its test checks every mapped file survives the round trip.

• pnpm registry:check, run by the new Registry workflow on every PR and push, fails if any of those files differs from the registry, or if a package holds an .astro that the registry does not. The same workflow checks contracts/ at the same pin. Never edit these files here: fix the registry, then bump the pin.

• Package APIs are unchanged. Every export keeps its path and its props.

• @nyuchi/ui is not built from the registry. It is Svelte, and the registry has no Svelte format.

Added

• @bundu/ui: the Discover detail pattern (mzizi-dev/mzizi-registry#429): @bundu/ui/discover/DetailHero.astro, DiscoverBreadcrumb.astro, MetaList.astro, DetailActions.astro and RelatedRail.astro, each with its registry contract.

• @bundu/ui/discover/open (openInMukokoUrl) builds the canonical Open in Mukoko link, https://mukoko.com/open/<service>/<id>. OpenInApp (contract 1.1.0) gains service and id, and href stays as an override.

• @bundu/ui: contracts for every component. The site/ family covers Hero, Section, SectionHeader, Container, Breadcrumb, Icon, SocialIcon and MineralStrip. The ui/ family covers NativeSelect, SegmentedControl, Toaster and SafeAreaFrame. src/app/contracts.test.ts runs all 59.

• @bundu/ui: Hero no longer renders @bundu/ui/ui/button (React) under Astro. It uses an internal pure-Astro CtaButton that renders the same markup from the same buttonVariants.

• SafeAreaFrame draws SVG geometry instead of inline style attributes, so pages can keep style-src 'self'.

• Breadcrumb and SocialIcon gain a root data-slot.

• @bundu/ui: SegmentedControl, NativeSelect, Toaster and
  SafeAreaFrame (@bundu/ui/<Name>.astro), first used by nyuchi-tools
  (nyuchi/workspace-tools). SegmentedControl is native radios, so it needs
  no script; NativeSelect is a real <select> in the pill input style;
  Toaster is window.toast(message, kind?) in a polite live region, for
  client-side feedback (server-rendered flash messages stay with
  @bundu/ui/app/Toast.astro); SafeAreaFrame draws a canvas shape with its
  platform-covered bands, and its geometry, safeAreaBands, is exported from the
  root and @bundu/ui/safe-area with the same numbers as the registry's
  safe-area-frame in React and Rust (mzizi-dev/mzizi-registry#398). Icon
  gains image, layers, mail, grid, download, upload, copy, sun,
  moon, sparkle, shield and history. src/components.test.ts renders
  each through Astro's container API. None of the four has a registry contract
  yet, so they are not under @bundu/ui/app/*.

Added (repository): the README links the published Mzizi design system

The README links the Design System artifact
(https://claude.ai/artifact/G8CCtAbZ8w717uQ3R5itCc), the Mzizi design system published on
claude.ai, and names its source of truth: the design-system/ folder in
mzizi-dev/mzizi-registry, arriving with mzizi-registry#418. No package changes.

Changed (repository): releases publish with npm trusted publishing (OIDC), not NPM_TOKEN

npm refused the NPM_TOKEN secret (401), so nothing published. The Release workflow
now publishes by npm trusted publishing:
the job's GitHub OIDC token (id-token: write) is exchanged for a short-lived token for
each package, and no npm token is read. The workflow installs npm 11.21.0 (pinned;
trusted publishing needs npm >= 11.5.1) and prints npm --version;
scripts/release-publish.mjs packs each package with pnpm pack (which still rewrites
workspace: ranges and runs prepack) and publishes the tarball with
npm publish <tarball> --access public, with provenance. The already-published skip,
the versioning policy check, the tags and releases (RELEASE_BUMP_TOKEN) and the
"Not published" failure are unchanged. Each package needs a one-time trusted publisher
setup on npmjs.com before it can publish this way; the README's "Publishing" section has
the steps. No package changes.

Changed (repository): releases follow the org versioning policy

The Release workflow checks each unpublished version against the org's shared calculator
(nyuchi/.github next-version.mjs, at a pinned commit) before publishing it. A version
that is not the next minor above that package's highest version on npm is refused, with the
version it should be, and the other packages still publish. A major needs a manual run with
bump: major.

Changed (repository)

• pnpm contracts:fetch reads every contract family (FAMILIES in
  scripts/contract-paths.mjs: app, discover), and the path guard accepts
  only those directories.
• The canon snapshot carries events (Mukoko Events). api.mzizi.dev now
  serves ca...

@bundu/ui 0.3.0

The first release from the release workflow, which publishes and tags on merge to
main with no hand-pushed tag (#25). Owner decision, 2026-10-04:
versions that were bumped here but never published are reset to the org versioning
policy, so each package's next release is one minor above what npm has. npm has
@bundu/ui 0.2.0 and @nyuchi/ui 0.2.0, so both are 0.3.0; @bundu/server is new,
at 0.1.0.

This one entry carries all of the unreleased entries before it. The changes this
file recorded under @bundu/ui 0.3.0, 0.4.0, 0.4.1 and 0.5.0, @nyuchi/ui 0.3.0 and
0.4.0, and the Discover Standard (Unreleased) are all here. None of those versions
reached npm, and 0.4.0, 0.4.1 and 0.5.0 are not used. Breaking changes are marked
Breaking.

Added

• @bundu/server 0.1.0 — a new package: server-side helpers, the companion to
  @bundu/ui as mzizi-roots-server is to mzizi-roots. Dependency-free on Web APIs,
  so it runs in Astro server routes, Node 20+ and Cloudflare Workers alike:
  createSealer (AES-256-GCM values bound to a purpose, wire-compatible with the Rust
  sealer in the Nyuchi console backend, checked both ways), randomToken,
  pkceChallenge, cookie helpers with safe defaults, createFlash (one-shot messages
  carried as a key, never text), the theme preference, safeBack (same-origin return
  paths, refusing //, \ and control characters), parseOrigin (bare https
  origins), withSecurityHeaders, and the table query and paging core. Built from
  TypeScript to dist/ with declarations on prepack. 36 unit tests. Tracking:
  #19.

• @bundu/ui — @bundu/ui/lib/table now re-exports @bundu/server/table, which
  holds the code, and @bundu/ui depends on @bundu/server. The same API.

• @bundu/ui — app patterns for signed-in apps and consoles (@bundu/ui/app/*).
  AppShell, SideNav, AccountMenu, PageHeader, DataTable (one card per row on
  phones), FilterBar, Pagination, DetailPanel, FormLayout, FormField,
  StateMessage, Toast, StatTile and BarChart, and the primitives under them
  (Button, Badge, Card, Alert, Input, Label, Skeleton). All are pure
  Astro: no React or other framework under them and no client JavaScript. Badge
  follows the Mzizi registry's badge contract (default, secondary, destructive,
  outline, ghost, link). Plus @bundu/ui/lib/table (parseTableQuery,
  filterRows, paginate, withParams). Built for the Nyuchi console's move to Astro
  and Rust (nyuchi/nyuchi-platform#330), which keeps local copies until this release
  is published.

• @bundu/ui — @bundu/ui/ui/variants. The class recipes (buttonVariants,
  cardVariants, alertVariants, inputClasses, labelClasses, skeletonClasses,
  badgeClasses) with no React in them, shared by the React primitives and the Astro
  components. Each .tsx still exports its own recipe, so existing imports keep
  working.

• @bundu/ui — rendering tests for the app patterns. src/app/app.test.ts renders
  every component through Astro's container API with no framework renderer
  registered, and checks the semantics each one promises (landmarks, labels, aria-*
  wiring, escaped cell text, no <script> and no island), plus a source check that no
  app component imports a framework. @bundu/ui gains a test script, a
  vitest.config.ts (Astro's getViteConfig) and an astro dev dependency; the root
  pnpm test runs each package's tests. Not in the tarball.

• brand-kweli.css (malachite) and brand-learning.css (gold), in both
  packages, so Kweli and Nyuchi Learning dashboards can adopt the Mzizi
  Dashboard Standard (mzizi-dev/mzizi-registry#404). Owner decisions,
  2026-10-04: Kweli is malachite (it used to borrow Mukoko's tanzanite), and
  Nyuchi Learning / education is gold, because every Nyuchi brand is gold.
  Canon's ecosystem table now carries kweli, learning, news and
  weather rows (mzizi-dev/mzizi-registry#409); until the snapshot picks them
  up through /v1/brand, LOCAL_BRAND_MINERALS gives the same answers, and
  the news and weather overlays now cite canon instead of the mini-app accent
  table. A canon row that disagrees still fails the generator. New
  scripts/brand-overlays.test.mjs checks, in both packages, that every
  decided brand ships on its decided family, that every overlay repoints
  --primary and --ring only, and that every overlay is exported.

• Brand overlays for six sub-apps, in both packages: brand-nhimbe.css
  (malachite), brand-lingo.css (cobalt), brand-bushtrade.css (gold),
  brand-campfire.css (malachite), brand-news.css (cobalt) and
  brand-weather.css (cobalt), so their dashboards can adopt the Mzizi
  Dashboard Standard (mzizi-dev/mzizi-registry#404). Generated like the others:
  the first four from canon's ecosystem table; news and weather have no canon
  row yet, so their mineral comes from the registry's own mini-app accent table
  (lib/tokens/index.ts brandOverrides) until canon carries one, and a canon
  row that disagrees fails the generator. Each repoints --primary and
  --ring only.

• @bundu/ui — a contract for every app component. The 31 components under
  @bundu/ui/app/* each have a Mzizi component contract, authored in
  mzizi-dev/mzizi-registry (contracts/, mzizi-dev/mzizi-registry#404) and
  shipped in contracts/ (exports @bundu/ui/contracts/index.json,
  …/contracts/app/* and the schema). New src/app/contracts.test.ts renders
  every component in every named state and evaluates its clauses, selector
  checks, fine and coarse pointer heights, the brand-overlay rule (no colour
  values; minerals only as declared status colours), the no-JS rule, and that
  its props and slots are the contract's. An unevaluable clause fails.
  pnpm contracts:fetch / contracts:check sync the copy from the registry.
  Together the contracts are the Mzizi Dashboard Standard.

• @bundu/ui — Button destructive and destructive-outline variants
  in both buttonVariants (ui/button) and appButtonVariants
  (app/Button.astro). They use only the destructive /
  destructive-foreground tokens, so brand overlays never change them. Use
  destructive for the one irreversible action on a page and
  destructive-outline for secondary ones (revoke, remove). The Button
  contract delta is on mzizi-dev/mzizi-registry#404. This replaces the
  console's local TODO(mzizi) destructive buttons
  (nyuchi/nyuchi-platform#330).

• @bundu/ui — the app patterns become a full-width product dashboard.
  New under @bundu/ui/app/*: WorkspaceSwitcher,
  QuickSearch and CommandPalette (⌘K), TopBarAction, Toolbar and
  ToolbarMenu, StatTiles, InfoTip, EmptyState, and BrandMark with the
  official Nyuchi mark (the Mzizi registry's bee icon pair, scaled to 128px, in
  assets/brand/). @bundu/ui/app/nav (and the root) gains groupNav,
  currentHref, flattenNav, searchNav and matchesQuery. Icon gains 36
  app glyphs. ui/variants gains appButtonVariants and appInputClasses.
  Built for the Nyuchi console (nyuchi/nyuchi-platform#330).

• styles/brand-events.css (Mukoko Events; owner decisions, 2026-10-04,
  mukoko-dev/nhimbe#155: the nhimbe
  brand is retired, the events platform is Mukoko Events at events.mukoko.com, and its
  mineral stays malachite): the Mukoko Events overlay (malachite), exported
  in both packages. Canon's row is events (mzizi-dev/mzizi-registry#411). Until
  the snapshot carries it, the mineral is bridged in LOCAL_BRAND_MINERALS.

The Mzizi Discover Standard (@bundu/ui)

Owner decision, 2026-10-04: the discover pages of news, events, circles and
weather must be identical, so they move into the Mukoko super-app on the web
unchanged (mzizi-dev/mzizi-registry#413).

• Eleven pure Astro components, @bundu/ui/discover/*: DiscoverShell,
  DiscoverMeta, DiscoverHero, DiscoverSearch, CategoryChips,
  CategoryChip, DiscoverSection, ResultGrid, DiscoverCard (variants
  article, event, circle, place), LoadMore and OpenInApp. No client
  JavaScript, no inline styles, and each works in a server-filled shell
  ({{placeholders}}).
• Contracts: contracts/discover/ (11), fetched from the registry, rendered
  in every state by src/app/contracts.test.ts; src/discover/discover.test.ts
  renders a whole Discover page and the server-filled mode.

Changed

• Repository tooling: Vite+ 1.0. vite-plus joins the root dev dependencies
  (prettier stays, for the token generator only), and vp check (format plus
  type-aware lint) is the repo's check. Source files in both packages were re-wrapped
  by the formatter, and @nyuchi/ui's Breadcrumb writes its JSON-LD closing tag as
  <\/script> (the same string at runtime) so the linter can parse the component.
  No API change.

• Removed .github/workflows/lint.yml. The mzizi-dev org ruleset now runs the shared lint on every pull request through mzizi-dev/.github's org-lint.yml, publishing the same five lint / … checks, so the repo's own caller only ran lint a second time.

• Breaking — AppShell is full width. A fixed sidebar (16.25rem) and a main
  column filling the rest, with no max-w-[96rem] centred container; the nav
  is rendered once (the sidebar is a popover drawer below 64rem) instead of
  twice; new slots workspace, search, actions, overlay; new props
  collapsed, persist, footerLinks, sidebarLabel, id. The sidebar
  collapses to an icon rail.

• Breaking — SideNav shows the label only. An item's description (or
  the earlier summary) is a tooltip and the link's aria-describedby, no longer
  printed under the label. Takes groups with icons, badges and nested items;
  flat items still wor...

@bundu/server 0.1.0

The first release from the release workflow, which publishes and tags on merge to
main with no hand-pushed tag (#25). Owner decision, 2026-10-04:
versions that were bumped here but never published are reset to the org versioning
policy, so each package's next release is one minor above what npm has. npm has
@bundu/ui 0.2.0 and @nyuchi/ui 0.2.0, so both are 0.3.0; @bundu/server is new,
at 0.1.0.

This one entry carries all of the unreleased entries before it. The changes this
file recorded under @bundu/ui 0.3.0, 0.4.0, 0.4.1 and 0.5.0, @nyuchi/ui 0.3.0 and
0.4.0, and the Discover Standard (Unreleased) are all here. None of those versions
reached npm, and 0.4.0, 0.4.1 and 0.5.0 are not used. Breaking changes are marked
Breaking.

Added

• @bundu/server 0.1.0 — a new package: server-side helpers, the companion to
  @bundu/ui as mzizi-roots-server is to mzizi-roots. Dependency-free on Web APIs,
  so it runs in Astro server routes, Node 20+ and Cloudflare Workers alike:
  createSealer (AES-256-GCM values bound to a purpose, wire-compatible with the Rust
  sealer in the Nyuchi console backend, checked both ways), randomToken,
  pkceChallenge, cookie helpers with safe defaults, createFlash (one-shot messages
  carried as a key, never text), the theme preference, safeBack (same-origin return
  paths, refusing //, \ and control characters), parseOrigin (bare https
  origins), withSecurityHeaders, and the table query and paging core. Built from
  TypeScript to dist/ with declarations on prepack. 36 unit tests. Tracking:
  #19.

• @bundu/ui — @bundu/ui/lib/table now re-exports @bundu/server/table, which
  holds the code, and @bundu/ui depends on @bundu/server. The same API.

• @bundu/ui — app patterns for signed-in apps and consoles (@bundu/ui/app/*).
  AppShell, SideNav, AccountMenu, PageHeader, DataTable (one card per row on
  phones), FilterBar, Pagination, DetailPanel, FormLayout, FormField,
  StateMessage, Toast, StatTile and BarChart, and the primitives under them
  (Button, Badge, Card, Alert, Input, Label, Skeleton). All are pure
  Astro: no React or other framework under them and no client JavaScript. Badge
  follows the Mzizi registry's badge contract (default, secondary, destructive,
  outline, ghost, link). Plus @bundu/ui/lib/table (parseTableQuery,
  filterRows, paginate, withParams). Built for the Nyuchi console's move to Astro
  and Rust (nyuchi/nyuchi-platform#330), which keeps local copies until this release
  is published.

• @bundu/ui — @bundu/ui/ui/variants. The class recipes (buttonVariants,
  cardVariants, alertVariants, inputClasses, labelClasses, skeletonClasses,
  badgeClasses) with no React in them, shared by the React primitives and the Astro
  components. Each .tsx still exports its own recipe, so existing imports keep
  working.

• @bundu/ui — rendering tests for the app patterns. src/app/app.test.ts renders
  every component through Astro's container API with no framework renderer
  registered, and checks the semantics each one promises (landmarks, labels, aria-*
  wiring, escaped cell text, no <script> and no island), plus a source check that no
  app component imports a framework. @bundu/ui gains a test script, a
  vitest.config.ts (Astro's getViteConfig) and an astro dev dependency; the root
  pnpm test runs each package's tests. Not in the tarball.

• brand-kweli.css (malachite) and brand-learning.css (gold), in both
  packages, so Kweli and Nyuchi Learning dashboards can adopt the Mzizi
  Dashboard Standard (mzizi-dev/mzizi-registry#404). Owner decisions,
  2026-10-04: Kweli is malachite (it used to borrow Mukoko's tanzanite), and
  Nyuchi Learning / education is gold, because every Nyuchi brand is gold.
  Canon's ecosystem table now carries kweli, learning, news and
  weather rows (mzizi-dev/mzizi-registry#409); until the snapshot picks them
  up through /v1/brand, LOCAL_BRAND_MINERALS gives the same answers, and
  the news and weather overlays now cite canon instead of the mini-app accent
  table. A canon row that disagrees still fails the generator. New
  scripts/brand-overlays.test.mjs checks, in both packages, that every
  decided brand ships on its decided family, that every overlay repoints
  --primary and --ring only, and that every overlay is exported.

• Brand overlays for six sub-apps, in both packages: brand-nhimbe.css
  (malachite), brand-lingo.css (cobalt), brand-bushtrade.css (gold),
  brand-campfire.css (malachite), brand-news.css (cobalt) and
  brand-weather.css (cobalt), so their dashboards can adopt the Mzizi
  Dashboard Standard (mzizi-dev/mzizi-registry#404). Generated like the others:
  the first four from canon's ecosystem table; news and weather have no canon
  row yet, so their mineral comes from the registry's own mini-app accent table
  (lib/tokens/index.ts brandOverrides) until canon carries one, and a canon
  row that disagrees fails the generator. Each repoints --primary and
  --ring only.

• @bundu/ui — a contract for every app component. The 31 components under
  @bundu/ui/app/* each have a Mzizi component contract, authored in
  mzizi-dev/mzizi-registry (contracts/, mzizi-dev/mzizi-registry#404) and
  shipped in contracts/ (exports @bundu/ui/contracts/index.json,
  …/contracts/app/* and the schema). New src/app/contracts.test.ts renders
  every component in every named state and evaluates its clauses, selector
  checks, fine and coarse pointer heights, the brand-overlay rule (no colour
  values; minerals only as declared status colours), the no-JS rule, and that
  its props and slots are the contract's. An unevaluable clause fails.
  pnpm contracts:fetch / contracts:check sync the copy from the registry.
  Together the contracts are the Mzizi Dashboard Standard.

• @bundu/ui — Button destructive and destructive-outline variants
  in both buttonVariants (ui/button) and appButtonVariants
  (app/Button.astro). They use only the destructive /
  destructive-foreground tokens, so brand overlays never change them. Use
  destructive for the one irreversible action on a page and
  destructive-outline for secondary ones (revoke, remove). The Button
  contract delta is on mzizi-dev/mzizi-registry#404. This replaces the
  console's local TODO(mzizi) destructive buttons
  (nyuchi/nyuchi-platform#330).

• @bundu/ui — the app patterns become a full-width product dashboard.
  New under @bundu/ui/app/*: WorkspaceSwitcher,
  QuickSearch and CommandPalette (⌘K), TopBarAction, Toolbar and
  ToolbarMenu, StatTiles, InfoTip, EmptyState, and BrandMark with the
  official Nyuchi mark (the Mzizi registry's bee icon pair, scaled to 128px, in
  assets/brand/). @bundu/ui/app/nav (and the root) gains groupNav,
  currentHref, flattenNav, searchNav and matchesQuery. Icon gains 36
  app glyphs. ui/variants gains appButtonVariants and appInputClasses.
  Built for the Nyuchi console (nyuchi/nyuchi-platform#330).

• styles/brand-events.css (Mukoko Events; owner decisions, 2026-10-04,
  mukoko-dev/nhimbe#155: the nhimbe
  brand is retired, the events platform is Mukoko Events at events.mukoko.com, and its
  mineral stays malachite): the Mukoko Events overlay (malachite), exported
  in both packages. Canon's row is events (mzizi-dev/mzizi-registry#411). Until
  the snapshot carries it, the mineral is bridged in LOCAL_BRAND_MINERALS.

The Mzizi Discover Standard (@bundu/ui)

Owner decision, 2026-10-04: the discover pages of news, events, circles and
weather must be identical, so they move into the Mukoko super-app on the web
unchanged (mzizi-dev/mzizi-registry#413).

• Eleven pure Astro components, @bundu/ui/discover/*: DiscoverShell,
  DiscoverMeta, DiscoverHero, DiscoverSearch, CategoryChips,
  CategoryChip, DiscoverSection, ResultGrid, DiscoverCard (variants
  article, event, circle, place), LoadMore and OpenInApp. No client
  JavaScript, no inline styles, and each works in a server-filled shell
  ({{placeholders}}).
• Contracts: contracts/discover/ (11), fetched from the registry, rendered
  in every state by src/app/contracts.test.ts; src/discover/discover.test.ts
  renders a whole Discover page and the server-filled mode.

Changed

• Repository tooling: Vite+ 1.0. vite-plus joins the root dev dependencies
  (prettier stays, for the token generator only), and vp check (format plus
  type-aware lint) is the repo's check. Source files in both packages were re-wrapped
  by the formatter, and @nyuchi/ui's Breadcrumb writes its JSON-LD closing tag as
  <\/script> (the same string at runtime) so the linter can parse the component.
  No API change.

• Removed .github/workflows/lint.yml. The mzizi-dev org ruleset now runs the shared lint on every pull request through mzizi-dev/.github's org-lint.yml, publishing the same five lint / … checks, so the repo's own caller only ran lint a second time.

• Breaking — AppShell is full width. A fixed sidebar (16.25rem) and a main
  column filling the rest, with no max-w-[96rem] centred container; the nav
  is rendered once (the sidebar is a popover drawer below 64rem) instead of
  twice; new slots workspace, search, actions, overlay; new props
  collapsed, persist, footerLinks, sidebarLabel, id. The sidebar
  collapses to an icon rail.

• Breaking — SideNav shows the label only. An item's description (or
  the earlier summary) is a tooltip and the link's aria-describedby, no longer
  printed under the label. Takes groups with icons, badges and nested items;
  flat items still wor...

NPM Publish

What's Changed

• chore: initialise packages-ui with the design system UI package by Bryan Fawcett (@bryanfawcett) in #1

New Contributors

• Bryan Fawcett (@bryanfawcett) made their first contribution in #1

Full Changelog: https://github.com/nyuchi/packages-ui/commits/v0.1.0