feat(ui): [FEATURE BRANCH] Guarantee consuming-app global CSS can't distort Bible components - Shadow DOM

.changeset/all-humans-leave.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/bitter-pigs-type.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/bright-shadows-plan.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/calm-browsers-test.md

@@ -0,0 +1,5 @@
+---
+'@youversion/platform-react-ui': patch
+---
+
+Preserve SDK spacing in Safari inside Shadow DOM and document roots by scoping the host CSS reset and inlining the fixed Tailwind spacing scale.

.changeset/cool-settings-wait.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/flat-shadows-report.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/friendly-verses-scroll.md

@@ -0,0 +1,5 @@
+---
+'@youversion/platform-react-ui': patch
+---
+
+Keep verse actions open when touch selection moves to another verse, restore focus for initially anchored or conditionally mounted verse actions, and keep reader settings scrollable in constrained popovers. Clarify the Shadow DOM prototype's document-owned font and root-sizing dependencies without expanding its rollout scope.

.changeset/full-flies-worry.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/fuzzy-spiders-check.md

@@ -0,0 +1,5 @@
+---
+'@youversion/platform-react-ui': patch
+---
+
+Audit the compiled Shadow DOM stylesheet custom-property contract and fail builds on unexplained ambient references.

.changeset/leaf-shadows-wait.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/little-fans-burn.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/prototype-shadow-dom-isolation.md

@@ -0,0 +1,7 @@
+---
+'@youversion/platform-core': major
+'@youversion/platform-react-hooks': major
+'@youversion/platform-react-ui': major
+---
+
+Prototype automatic Shadow DOM style isolation on `YouVersionAuthButton`, plus a shadow-local native top-layer strategy for isolated Popovers. The spike also constrains Popovers to Radix's available collision height.

.changeset/prove-production-shadow-overlays.md

@@ -0,0 +1,4 @@
+---
+---
+
+Prove nested and concurrent overlays through the production ShadowRootHost seam (YPE-5355).

.changeset/quiet-dialogs-return.md

@@ -0,0 +1,5 @@
+---
+'@youversion/platform-react-ui': patch
+---
+
+Fix focus restoration for opt-in Shadow DOM dialogs by preserving the original opener across a close/reopen during exit, while ignoring disconnected targets and targets moved out of their captured root.

.changeset/reader-shadows-wait.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/safe-shadows-fallback.md

@@ -0,0 +1,5 @@
+---
+'@youversion/platform-react-ui': patch
+---
+
+Keep isolated UI content rendered with local styles when constructable stylesheet setup fails.

.changeset/salty-lizards-dance.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/scripture-shadows-wait.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/shadow-aware-verse-actions.md

@@ -0,0 +1,5 @@
+---
+'@youversion/platform-react-ui': patch
+---
+
+Keep verse action popovers in their component's shadow-local portal and restore focus after dismissal.

.changeset/six-shrimps-stare.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/tidy-shadow-events.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/tidy-shadows-reset.md

@@ -0,0 +1,5 @@
+---
+'@youversion/platform-react-ui': patch
+---
+
+Harden Shadow DOM style isolation so text direction is the only intentionally inherited CSS property and host custom properties cannot alter known SDK spacing or radius values. Document-root font sizing still affects the prototype's rem-based dimensions.

.changeset/validate-shadow-dialog.md

@@ -0,0 +1,5 @@
+---
+'@youversion/platform-react-ui': patch
+---
+
+Validate shadow-local top-layer Dialog behavior, including focus containment and modal background inertness.

.github/scripts/major-release-signoff.test.sh

@@ -30,10 +30,58 @@ extract_step() {
 }
 
 extract_step "Resolve PR context" > "$TMP/context.sh"
+extract_step "Restore release tooling from the base branch" > "$TMP/restore-tooling.sh"
+extract_step "Compute release preview" > "$TMP/preview.sh"
 extract_step "Decide whether a signoff is required" > "$TMP/decision.sh"
 extract_step "Regenerate and verify release contents" > "$TMP/verify.sh"
 extract_step "Post an unresolved status" > "$TMP/unresolved.sh"
 
+TOOLING_SOURCE="$TMP/tooling-source"
+TOOLING_WORK="$TMP/tooling-work"
+git init --quiet "$TOOLING_SOURCE"
+git -C "$TOOLING_SOURCE" config commit.gpgsign false
+git -C "$TOOLING_SOURCE" config user.name test
+git -C "$TOOLING_SOURCE" config user.email test@example.com
+mkdir -p "$TOOLING_SOURCE/scripts" "$TOOLING_SOURCE/.changeset" \
+  "$TOOLING_SOURCE/packages/ui" "$TOOLING_SOURCE/examples/demo" "$TOOLING_SOURCE/tools/config"
+for file in scripts/preview-release.mjs package.json pnpm-lock.yaml \
+  pnpm-workspace.yaml .changeset/config.json .npmrc packages/ui/package.json \
+  examples/demo/package.json tools/config/package.json; do
+  printf 'main %s\n' "$file" > "$TOOLING_SOURCE/$file"
+done
+git -C "$TOOLING_SOURCE" add -A
+git -C "$TOOLING_SOURCE" commit --quiet -m main
+git -C "$TOOLING_SOURCE" branch -M main
+git -C "$TOOLING_SOURCE" switch --quiet -c journey
+mkdir -p "$TOOLING_SOURCE/packages/pr-only"
+printf 'journey-only importer\n' > "$TOOLING_SOURCE/packages/pr-only/package.json"
+for file in scripts/preview-release.mjs package.json pnpm-lock.yaml \
+  pnpm-workspace.yaml .changeset/config.json packages/ui/package.json; do
+  printf 'journey %s\n' "$file" > "$TOOLING_SOURCE/$file"
+done
+rm "$TOOLING_SOURCE/.npmrc"
+printf 'journey pnpm hook\n' > "$TOOLING_SOURCE/.pnpmfile.cjs"
+git -C "$TOOLING_SOURCE" add -A
+git -C "$TOOLING_SOURCE" commit --quiet -m journey
+TOOLING_HEAD=$(git -C "$TOOLING_SOURCE" rev-parse HEAD)
+git -C "$TOOLING_SOURCE" switch --quiet main
+git clone --quiet "$TOOLING_SOURCE" "$TOOLING_WORK"
+git -C "$TOOLING_WORK" checkout --quiet "$TOOLING_HEAD"
+
+if (cd "$TOOLING_WORK" && bash "$TMP/restore-tooling.sh") >/dev/null 2>&1 &&
+  [ "$(git -C "$TOOLING_WORK" rev-parse HEAD)" = "$TOOLING_HEAD" ] &&
+  [ "$(cat "$TOOLING_WORK/package.json")" = 'main package.json' ] &&
+  [ "$(cat "$TOOLING_WORK/pnpm-lock.yaml")" = 'main pnpm-lock.yaml' ] &&
+  [ "$(cat "$TOOLING_WORK/packages/ui/package.json")" = 'main packages/ui/package.json' ] &&
+  [ "$(cat "$TOOLING_WORK/.npmrc")" = 'main .npmrc' ] &&
+  [ ! -e "$TOOLING_WORK/packages/pr-only/package.json" ] &&
+  [ ! -e "$TOOLING_WORK/.pnpmfile.cjs" ]; then
+  pass "restores the complete release dependency graph from trusted main"
+else
+  fail "restores the complete release dependency graph from trusted main" \
+    "expected main-owned workspace manifests and install inputs with PR-only importers removed"
+fi
+
 mkdir "$TMP/bin"
 # The context step backs off between retries; real delays would add ~9s per error case.
 cat > "$TMP/bin/sleep" <<'EOF'
@@ -376,7 +424,7 @@ run_decision_case "failed ordinary previews remain blocked, not major" \
   'blocked=release preview did not succeed (failure)' false false skipped '' failure ''
 
 extract_step "Restore release tooling from the base branch" > "$TMP/restore.sh"
-PREVIEW_REPO="$TMP/preview-repo"
+PREVIEW_REPO="$TMP/restore-preview-repo"
 git init --quiet --initial-branch=main "$PREVIEW_REPO"
 git -C "$PREVIEW_REPO" config commit.gpgsign false
 git -C "$PREVIEW_REPO" config user.name test
@@ -440,6 +488,106 @@ else
   fail "generated release identity always stays out of the ordinary preview" "preview does not use generated release identity"
 fi
 
+PREVIEW_REMOTE="$TMP/preview-remote.git"
+PREVIEW_REPO="$TMP/preview-repo"
+git init --quiet --bare "$PREVIEW_REMOTE"
+git init --quiet "$PREVIEW_REPO"
+git -C "$PREVIEW_REPO" config commit.gpgsign false
+git -C "$PREVIEW_REPO" config user.name test
+git -C "$PREVIEW_REPO" config user.email test@example.com
+git -C "$PREVIEW_REPO" remote add origin "$PREVIEW_REMOTE"
+mkdir -p "$PREVIEW_REPO/scripts" "$PREVIEW_REPO/.changeset" \
+  "$PREVIEW_REPO/packages/core" "$PREVIEW_REPO/packages/hooks" "$PREVIEW_REPO/packages/ui"
+cp "$ROOT/scripts/preview-release.mjs" "$PREVIEW_REPO/scripts/preview-release.mjs"
+cp "$ROOT/.changeset/config.json" "$PREVIEW_REPO/.changeset/config.json"
+cat > "$PREVIEW_REPO/package.json" <<'EOF'
+{"name":"preview-fixture","private":true,"packageManager":"pnpm@11.10.0"}
+EOF
+cat > "$PREVIEW_REPO/pnpm-workspace.yaml" <<'EOF'
+packages:
+  - "packages/*"
+EOF
+for package in core hooks ui; do
+  case "$package" in
+    core) name='@youversion/platform-core' ;;
+    hooks) name='@youversion/platform-react-hooks' ;;
+    ui) name='@youversion/platform-react-ui' ;;
+  esac
+  printf '{"name":"%s","version":"1.0.0"}\n' "$name" > "$PREVIEW_REPO/packages/$package/package.json"
+done
+git -C "$PREVIEW_REPO" add -A
+git -C "$PREVIEW_REPO" commit --quiet -m main
+git -C "$PREVIEW_REPO" branch -M main
+git -C "$PREVIEW_REPO" push --quiet origin main
+
+git -C "$PREVIEW_REPO" switch --quiet -c target
+cat > "$PREVIEW_REPO/.changeset/target-major.md" <<'EOF'
+---
+"@youversion/platform-core": major
+---
+
+Major change inherited from the target branch.
+EOF
+git -C "$PREVIEW_REPO" add -A
+git -C "$PREVIEW_REPO" commit --quiet -m 'target major'
+git -C "$PREVIEW_REPO" push --quiet origin target
+PREVIEW_BASE_SHA=$(git -C "$PREVIEW_REPO" rev-parse HEAD)
+
+git -C "$PREVIEW_REPO" switch --quiet -c pr
+printf 'non-major PR change\n' > "$PREVIEW_REPO/README.md"
+git -C "$PREVIEW_REPO" add README.md
+git -C "$PREVIEW_REPO" commit --quiet -m 'non-major PR change'
+git -C "$PREVIEW_REPO" push --quiet origin pr
+ln -s "$ROOT/node_modules" "$PREVIEW_REPO/node_modules"
+PREVIEW_BIN="$TMP/preview-bin"
+mkdir "$PREVIEW_BIN"
+cat > "$PREVIEW_BIN/pnpm" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+[ "\$1" = exec ] && [ "\$2" = changeset ] && [ "\$3" = status ]
+output=\${4#--output=}
+printf '%s\n' \
+  '{"releases":[{"name":"@youversion/platform-core","type":"major","oldVersion":"1.0.0","newVersion":"2.0.0"}]}' \
+  > "\$output"
+EOF
+chmod +x "$PREVIEW_BIN/pnpm"
+
+run_preview_case() {
+  local name="$1" expected_introduced="$2" expected_output="$3"
+  local output="$TMP/preview-output"
+  local error="$TMP/preview-error"
+  local preview="$PREVIEW_REPO/preview.json"
+  local head_sha
+  head_sha=$(git -C "$PREVIEW_REPO" rev-parse HEAD)
+  : > "$output"
+  rm -f "$preview"
+  if (cd "$PREVIEW_REPO" && \
+    PATH="$PREVIEW_BIN:$PATH" BASE_SHA="$PREVIEW_BASE_SHA" HEAD_SHA="$head_sha" \
+    GITHUB_OUTPUT="$output" \
+    bash "$TMP/preview.sh") >/dev/null 2> "$error" &&
+    jq -e ".introduced_major == $expected_introduced" "$preview" >/dev/null &&
+    grep -Fxq "is_major=$expected_output" "$output"; then
+    pass "$name"
+  else
+    fail "$name" \
+      "expected introduced_major=$expected_introduced and is_major=$expected_output; preview: $(cat "$preview" 2>/dev/null || true); output: $(tr '\n' ' ' < "$output"); error: $(tr '\n' ' ' < "$error")"
+  fi
+}
+
+run_preview_case "stacked PRs ignore a major inherited from their target branch" false 0
+
+cat > "$PREVIEW_REPO/.changeset/pr-major.md" <<'EOF'
+---
+"@youversion/platform-react-ui": major
+---
+
+Major change introduced by the pull request.
+EOF
+git -C "$PREVIEW_REPO" add .changeset/pr-major.md
+git -C "$PREVIEW_REPO" commit --quiet -m 'PR major'
+git -C "$PREVIEW_REPO" push --quiet origin pr
+run_preview_case "stacked PRs require signoff for a newly introduced major" true 1
+
 if grep -Fq 'Generated release PR; major signoff is enforced on source PRs.' "$WORKFLOW"; then
   pass "generated releases publish an explicit lifecycle-aware success"
 else

.github/workflows/major-release-signoff.yml

@@ -269,16 +269,24 @@ jobs:
 
       - name: Restore release tooling from the base branch
         # The PR supplies changeset *data* only. The detector that reads it, the dependency
-        # set it runs under, and the changesets config all come from `main`, so a branch
-        # cannot rewrite the check that gates it. This runs before pnpm is set up, since
-        # `pnpm/action-setup` reads `packageManager` out of package.json.
+        # graph it runs under, and the changesets config all come from trusted `main`, so a
+        # branch cannot rewrite the check that gates it. This runs before pnpm is set up,
+        # since `pnpm/action-setup` reads `packageManager` out of package.json.
         run: |
           set -euo pipefail
           git fetch --no-tags --force origin main:refs/heads/main
           # All of main's tooling, or none of it. The detector, the dependency set it runs
           # under, and the changesets config have to agree, so restoring some from main and
           # taking the rest from the PR gives a detector without its own dependencies.
           if git cat-file -e main:scripts/preview-release.mjs 2>/dev/null; then
+            # Frozen workspace installs validate every importer. Remove PR-only importers,
+            # then restore every manifest selected by main's workspace configuration so its
+            # lockfile and dependency graph remain internally consistent.
+            git ls-files |
+              grep -E '^(packages|examples|tools)/[^/]+/package[.]json$' |
+              while IFS= read -r f; do
+                git cat-file -e "main:$f" 2>/dev/null || rm -f "$f"
+              done
             for f in scripts/preview-release.mjs package.json pnpm-lock.yaml \
                      pnpm-workspace.yaml .changeset/config.json; do
               git cat-file -e "main:$f" 2>/dev/null && git checkout main -- "$f"
@@ -318,17 +326,19 @@ jobs:
       - name: Compute release preview
         id: preview
         env:
+          BASE_SHA: ${{ needs.context.outputs.base_sha }}
           HEAD_SHA: ${{ needs.context.outputs.head_sha }}
         run: |
           set -euo pipefail
           # `changeset status` resolves `baseBranch` (main) as a LOCAL ref and fails with
           # "Failed to find where HEAD diverged from main" if it is missing. A PR checkout
           # has only origin/main, so create the local branch too.
           git fetch --no-tags --force origin main:refs/heads/main
-          # Merge-base, not the PR's base sha: on a synchronize event the base
-          # branch may have moved, and diffing against its tip would attribute
-          # someone else's changesets to this PR.
-          BASE=$(git merge-base main "$HEAD_SHA")
+          git fetch --no-tags --force origin "$BASE_SHA"
+          # Compare from the common ancestor of the immutable PR endpoints. This excludes
+          # major changesets inherited from a stacked PR's base without attributing later
+          # movement on that base branch to the PR being evaluated.
+          BASE=$(git merge-base "$BASE_SHA" "$HEAD_SHA")
           node scripts/preview-release.mjs --base "$BASE" --head "$HEAD_SHA" > preview.json
           cat preview.json
           # `introduced_major`, not `is_major`: a major already pending on main

.github/workflows/storybook.yml

@@ -39,3 +39,37 @@ jobs:
           YVP_APP_KEY: ${{ secrets.YVP_APP_KEY }}
           STORYBOOK_YOUVERSION_API_HOST: ${{ secrets.YVP_API_HOST }}
           STORYBOOK_YOUVERSION_APP_KEY: ${{ secrets.STORYBOOK_YOUVERSION_APP_KEY }}
+
+  shadow-browser-tests:
+    name: Shadow DOM (${{ matrix.browser }})
+    runs-on: ubuntu-latest
+    container:
+      image: mcr.microsoft.com/playwright:v1.56.1-noble
+    strategy:
+      fail-fast: false
+      matrix:
+        browser: [firefox, webkit]
+    env:
+      VITEST_BROWSER: ${{ matrix.browser }}
+      STORYBOOK_YOUVERSION_APP_KEY: ${{ secrets.STORYBOOK_YOUVERSION_APP_KEY }}
+      STORYBOOK_AUTH_REDIRECT_URL: ${{ secrets.STORYBOOK_AUTH_REDIRECT_URL }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm build
+
+      - name: Run Shadow DOM browser tests
+        run: cd packages/ui && pnpm run test:shadow-browser
+        env:
+          HOME: /root

.size-limit.js

@@ -49,7 +49,7 @@ export default [
     name: 'ui / Separator only',
     path: 'packages/ui/dist/index.js',
     import: '{ Separator }',
-    limit: '19 KB',
+    limit: '21.7 KB',
     ignore: ['react', 'react-dom', 'react/jsx-runtime', '@tanstack/react-query'],
   },
   {