@allxsmith/bestax-bulma 5.11.0 → 5.11.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/AGENTS.md +12 -0
  2. package/CLAUDE.md +12 -0
  3. package/llms.txt +12 -0
  4. package/package.json +1 -1
package/AGENTS.md CHANGED
@@ -26,6 +26,18 @@ https://bestax.io/docs/skills/intro
26
26
  - Existing project: `npx skills add https://github.com/allxsmith/bestax --skill bestax-form`
27
27
  (repeat per skill, or omit `--skill` to pick interactively)
28
28
 
29
+ Supply-chain posture — same claims as the package README; every item is verifiable:
30
+
31
+ - Signed provenance on every release (sigstore; check `npm audit signatures` or the npm Provenance section)
32
+ - npm OIDC trusted publishing — no long-lived `NPM_TOKEN`; release commits and tags are GPG-signed
33
+ - Socket.dev scans every PR for malware, install scripts, obfuscated code, and privilege escalation
34
+ - Install scripts blocked unless allow-listed; versions younger than 3 days will not install
35
+ - Every GitHub Action pinned to a full commit SHA
36
+ - CodeQL, Dependency Review, Dependabot, and a high-severity `pnpm audit` gate
37
+ - Layered AI review (CodeRabbit + an independent adversarial Claude review) plus required green CI, an approving review, and a human merge
38
+
39
+ Full detail: https://github.com/allxsmith/bestax/blob/main/SECURITY.md · https://bestax.io/docs/guides/security
40
+
29
41
  Three components Bulma will talk you out of — everything else here gets found
30
42
  because Bulma has no equivalent, but these have a near-miss that ends the search:
31
43
 
package/CLAUDE.md CHANGED
@@ -26,6 +26,18 @@ https://bestax.io/docs/skills/intro
26
26
  - Existing project: `npx skills add https://github.com/allxsmith/bestax --skill bestax-form`
27
27
  (repeat per skill, or omit `--skill` to pick interactively)
28
28
 
29
+ Supply-chain posture — same claims as the package README; every item is verifiable:
30
+
31
+ - Signed provenance on every release (sigstore; check `npm audit signatures` or the npm Provenance section)
32
+ - npm OIDC trusted publishing — no long-lived `NPM_TOKEN`; release commits and tags are GPG-signed
33
+ - Socket.dev scans every PR for malware, install scripts, obfuscated code, and privilege escalation
34
+ - Install scripts blocked unless allow-listed; versions younger than 3 days will not install
35
+ - Every GitHub Action pinned to a full commit SHA
36
+ - CodeQL, Dependency Review, Dependabot, and a high-severity `pnpm audit` gate
37
+ - Layered AI review (CodeRabbit + an independent adversarial Claude review) plus required green CI, an approving review, and a human merge
38
+
39
+ Full detail: https://github.com/allxsmith/bestax/blob/main/SECURITY.md · https://bestax.io/docs/guides/security
40
+
29
41
  Three components Bulma will talk you out of — everything else here gets found
30
42
  because Bulma has no equivalent, but these have a near-miss that ends the search:
31
43
 
package/llms.txt CHANGED
@@ -8,3 +8,15 @@ React components for Bulma v1.
8
8
  - LLM guide: https://bestax.io/docs/guides/llms
9
9
  - Agent skills: https://bestax.io/docs/skills/intro
10
10
  - MCP server: `npx bestax-mcp` — setup at https://bestax.io/docs/guides/llms#mcp-server
11
+
12
+ Supply-chain posture — same claims as the package README; every item is verifiable:
13
+
14
+ - Signed provenance on every release (sigstore; check `npm audit signatures` or the npm Provenance section)
15
+ - npm OIDC trusted publishing — no long-lived `NPM_TOKEN`; release commits and tags are GPG-signed
16
+ - Socket.dev scans every PR for malware, install scripts, obfuscated code, and privilege escalation
17
+ - Install scripts blocked unless allow-listed; versions younger than 3 days will not install
18
+ - Every GitHub Action pinned to a full commit SHA
19
+ - CodeQL, Dependency Review, Dependabot, and a high-severity `pnpm audit` gate
20
+ - Layered AI review (CodeRabbit + an independent adversarial Claude review) plus required green CI, an approving review, and a human merge
21
+
22
+ Full detail: https://github.com/allxsmith/bestax/blob/main/SECURITY.md · https://bestax.io/docs/guides/security
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@allxsmith/bestax-bulma",
3
- "version": "5.11.0",
3
+ "version": "5.11.1",
4
4
  "description": "A fully-typed React component library for the Bulma CSS framework. Build modern UIs quickly with reusable, accessible, and customizable Bulma-based React components.",
5
5
  "main": "dist/index.cjs.js",
6
6
  "module": "dist/index.esm.js",