@allxsmith/bestax-bulma 5.11.0 → 5.11.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/AGENTS.md +12 -0
  2. package/CLAUDE.md +12 -0
  3. package/LICENSE +21 -0
  4. package/llms.txt +12 -0
  5. package/package.json +26 -28
package/AGENTS.md CHANGED
@@ -26,6 +26,18 @@ https://bestax.io/docs/skills/intro
26
26
  - Existing project: `npx skills add https://github.com/allxsmith/bestax --skill bestax-form`
27
27
  (repeat per skill, or omit `--skill` to pick interactively)
28
28
 
29
+ Supply-chain posture — same claims as the package README; every item is verifiable:
30
+
31
+ - Signed provenance on every release (sigstore; check `npm audit signatures` or the npm Provenance section)
32
+ - npm OIDC trusted publishing — no long-lived `NPM_TOKEN`; release commits and tags are GPG-signed
33
+ - Socket.dev scans every PR for malware, install scripts, obfuscated code, and privilege escalation
34
+ - Install scripts blocked unless allow-listed; versions younger than 3 days will not install
35
+ - Every GitHub Action pinned to a full commit SHA
36
+ - CodeQL, Dependency Review, Dependabot, and a high-severity `pnpm audit` gate
37
+ - Layered AI review (CodeRabbit + an independent adversarial Claude review) plus required green CI, an approving review, and a human merge
38
+
39
+ Full detail: https://github.com/allxsmith/bestax/blob/main/SECURITY.md · https://bestax.io/docs/guides/security
40
+
29
41
  Three components Bulma will talk you out of — everything else here gets found
30
42
  because Bulma has no equivalent, but these have a near-miss that ends the search:
31
43
 
package/CLAUDE.md CHANGED
@@ -26,6 +26,18 @@ https://bestax.io/docs/skills/intro
26
26
  - Existing project: `npx skills add https://github.com/allxsmith/bestax --skill bestax-form`
27
27
  (repeat per skill, or omit `--skill` to pick interactively)
28
28
 
29
+ Supply-chain posture — same claims as the package README; every item is verifiable:
30
+
31
+ - Signed provenance on every release (sigstore; check `npm audit signatures` or the npm Provenance section)
32
+ - npm OIDC trusted publishing — no long-lived `NPM_TOKEN`; release commits and tags are GPG-signed
33
+ - Socket.dev scans every PR for malware, install scripts, obfuscated code, and privilege escalation
34
+ - Install scripts blocked unless allow-listed; versions younger than 3 days will not install
35
+ - Every GitHub Action pinned to a full commit SHA
36
+ - CodeQL, Dependency Review, Dependabot, and a high-severity `pnpm audit` gate
37
+ - Layered AI review (CodeRabbit + an independent adversarial Claude review) plus required green CI, an approving review, and a human merge
38
+
39
+ Full detail: https://github.com/allxsmith/bestax/blob/main/SECURITY.md · https://bestax.io/docs/guides/security
40
+
29
41
  Three components Bulma will talk you out of — everything else here gets found
30
42
  because Bulma has no equivalent, but these have a near-miss that ends the search:
31
43
 
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2025 Alex Smith
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/llms.txt CHANGED
@@ -8,3 +8,15 @@ React components for Bulma v1.
8
8
  - LLM guide: https://bestax.io/docs/guides/llms
9
9
  - Agent skills: https://bestax.io/docs/skills/intro
10
10
  - MCP server: `npx bestax-mcp` — setup at https://bestax.io/docs/guides/llms#mcp-server
11
+
12
+ Supply-chain posture — same claims as the package README; every item is verifiable:
13
+
14
+ - Signed provenance on every release (sigstore; check `npm audit signatures` or the npm Provenance section)
15
+ - npm OIDC trusted publishing — no long-lived `NPM_TOKEN`; release commits and tags are GPG-signed
16
+ - Socket.dev scans every PR for malware, install scripts, obfuscated code, and privilege escalation
17
+ - Install scripts blocked unless allow-listed; versions younger than 3 days will not install
18
+ - Every GitHub Action pinned to a full commit SHA
19
+ - CodeQL, Dependency Review, Dependabot, and a high-severity `pnpm audit` gate
20
+ - Layered AI review (CodeRabbit + an independent adversarial Claude review) plus required green CI, an approving review, and a human merge
21
+
22
+ Full detail: https://github.com/allxsmith/bestax/blob/main/SECURITY.md · https://bestax.io/docs/guides/security
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@allxsmith/bestax-bulma",
3
- "version": "5.11.0",
3
+ "version": "5.11.2",
4
4
  "description": "A fully-typed React component library for the Bulma CSS framework. Build modern UIs quickly with reusable, accessible, and customizable Bulma-based React components.",
5
5
  "main": "dist/index.cjs.js",
6
6
  "module": "dist/index.esm.js",
@@ -18,29 +18,6 @@
18
18
  "**/*.css",
19
19
  "**/*.scss"
20
20
  ],
21
- "scripts": {
22
- "build": "rollup -c",
23
- "dev": "rollup -c --watch",
24
- "watch": "rollup -c --watch",
25
- "test": "jest",
26
- "test:watch": "jest --watch",
27
- "test:coverage": "jest --coverage",
28
- "bundle:stats": "rollup -c --configPlugin visualizer",
29
- "lint": "eslint src",
30
- "typecheck": "tsc --noEmit",
31
- "format": "prettier --write \"src/**/*.{ts,tsx}\"",
32
- "format:check": "prettier --check \"src/**/*.{ts,tsx}\"",
33
- "clean": "rimraf dist",
34
- "storybook": "storybook dev -p 6006",
35
- "start": "storybook dev -p 6006",
36
- "build-storybook": "storybook build",
37
- "release": "npx semantic-release",
38
- "test-storybook": "test-storybook",
39
- "test-storybook:dark": "STORYBOOK_THEME=dark test-storybook",
40
- "test-storybook:ci": "node scripts/test-storybook-ci.mjs",
41
- "prepack": "node scripts/pack-pointer-files.mjs prepack",
42
- "postpack": "node scripts/pack-pointer-files.mjs postpack"
43
- },
44
21
  "devDependencies": {
45
22
  "@faker-js/faker": "^10.5.0",
46
23
  "@fortawesome/fontawesome-free": "^7.3.1",
@@ -201,7 +178,28 @@
201
178
  "url": "https://github.com/allxsmith/bestax/issues"
202
179
  },
203
180
  "publishConfig": {
204
- "access": "public",
205
- "provenance": true
206
- }
207
- }
181
+ "access": "public"
182
+ },
183
+ "scripts": {
184
+ "build": "rollup -c",
185
+ "dev": "rollup -c --watch",
186
+ "watch": "rollup -c --watch",
187
+ "test": "jest",
188
+ "test:watch": "jest --watch",
189
+ "test:coverage": "jest --coverage",
190
+ "bundle:stats": "rollup -c --configPlugin visualizer",
191
+ "lint": "eslint src",
192
+ "typecheck": "tsc --noEmit",
193
+ "format": "prettier --write \"src/**/*.{ts,tsx}\"",
194
+ "format:check": "prettier --check \"src/**/*.{ts,tsx}\"",
195
+ "clean": "rimraf dist",
196
+ "storybook": "storybook dev -p 6006",
197
+ "start": "storybook dev -p 6006",
198
+ "build-storybook": "storybook build",
199
+ "release": "npx semantic-release",
200
+ "test-storybook": "test-storybook",
201
+ "test-storybook:dark": "STORYBOOK_THEME=dark test-storybook",
202
+ "test-storybook:ci": "node scripts/test-storybook-ci.mjs"
203
+ },
204
+ "readme": "# @allxsmith/bestax-bulma\n\n[![npm version](https://img.shields.io/npm/v/@allxsmith/bestax-bulma.svg)](https://www.npmjs.com/package/@allxsmith/bestax-bulma)\n[![npm downloads](https://img.shields.io/npm/dm/@allxsmith/bestax-bulma.svg)](https://www.npmjs.com/package/@allxsmith/bestax-bulma)\n[![bundle size](https://img.shields.io/bundlephobia/minzip/@allxsmith/bestax-bulma.svg)](https://bundlephobia.com/package/@allxsmith/bestax-bulma)\n[![TypeScript](https://img.shields.io/badge/TypeScript-100%25-blue.svg)](https://www.typescriptlang.org/)\n[![Coverage](https://img.shields.io/badge/coverage-99%25-brightgreen.svg)](https://github.com/allxsmith/bestax/blob/main/bulma-ui/jest.config.js)\n[![Bulma](https://img.shields.io/badge/Bulma-v1.0+-00d1b2.svg)](https://bulma.io)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Socket Badge](https://socket.dev/api/badge/npm/package/@allxsmith/bestax-bulma)](https://socket.dev/npm/package/@allxsmith/bestax-bulma/overview)\n[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/allxsmith/bestax/badge)](https://scorecard.dev/viewer/?uri=github.com/allxsmith/bestax)\n[![npm provenance](https://img.shields.io/badge/npm-provenance-3fb950.svg)](https://www.npmjs.com/package/@allxsmith/bestax-bulma#provenance)\n[![Security policy](https://img.shields.io/badge/security-policy-blue.svg)](https://github.com/allxsmith/bestax/blob/main/SECURITY.md)\n\nTypeScript-first React component library for the **Bulma v1** CSS framework — 80+ fully typed, tree-shakeable components, including extras like Carousel, Dialog, Sidebar, Steps, and date/time pickers.\n\n**Requires React `^18 || ^19`.** Bulma v1 is the only runtime dependency and installs automatically.\n\nPart of the [bestax monorepo](https://github.com/allxsmith/bestax) — see also [`create-bestax`](https://www.npmjs.com/package/create-bestax) for scaffolding new projects.\n\n---\n\n## 📚 Comprehensive Documentation\n\n**Looking for full documentation, guides, API references, and best practices?** \n👉 **Visit our official docs at [https://bestax.io](https://bestax.io)**\n\n> The documentation site is the best place to learn about all bestax-bulma features, usage patterns, and updates. We strongly recommend using the docs as your primary resource!\n\n---\n\n## 🚀 Getting Started\n\nStarting fresh? Scaffold a ready-to-go app instead: `npm create bestax@latest my-app`.\n\n### 1. Install the package\n\n```bash\nnpm install @allxsmith/bestax-bulma\n# or\npnpm add @allxsmith/bestax-bulma\n```\n\n### 2. Import the CSS\n\nThe library bundles its own CSS (Bulma v1 + the bestax extras). Import it once in your main JS/TS file:\n\n```js\nimport '@allxsmith/bestax-bulma/bestax.css';\n```\n\nPrefer stock Bulma? That works too — add `extras.css` for the bestax-only components' styles:\n\n```js\nimport 'bulma/css/bulma.min.css';\nimport '@allxsmith/bestax-bulma/extras.css';\n```\n\nMore flavors are shipped as subpath exports — prefixed classes (`versions/bestax-prefixed.css` + `<ConfigProvider classPrefix=\"bestax-\">`), no-helpers, no-dark-mode, and raw SCSS at `@allxsmith/bestax-bulma/scss/*`. See the [installation guide](https://bestax.io/docs/guides/getting-started/installation).\n\n### 3. (Optional) Add an Icon Library\n\nFive icon libraries are supported as optional peer dependencies: [Font Awesome](https://fontawesome.com/) (`@fortawesome/fontawesome-free`), Material Design Icons (`@mdi/font`), `ionicons`, `material-icons`, and `material-symbols`.\n\n```bash\nnpm install @fortawesome/fontawesome-free\n```\n\nSet the default for your whole app with [`ConfigProvider`](https://bestax.io/docs/api/helpers/config), e.g. `<ConfigProvider iconLibrary=\"fa\">`.\n\n### 4. Quick Example\n\n```tsx\nimport '@allxsmith/bestax-bulma/bestax.css';\nimport { Button } from '@allxsmith/bestax-bulma';\n\nfunction App() {\n return (\n <Button color=\"primary\" onClick={() => alert('Clicked!')}>\n Click Me\n </Button>\n );\n}\n\nexport default App;\n```\n\n### 5. Theming and Dark Mode\n\nWrap your app in [`Theme`](https://bestax.io/docs/api/helpers/theme) to override Bulma's `--bulma-*` CSS variables and control the color scheme:\n\n```tsx\nimport { Theme } from '@allxsmith/bestax-bulma';\n\n<Theme isRoot colorMode=\"system\">\n {/* colorMode: 'light' | 'dark' | 'system' */}\n <App />\n</Theme>;\n```\n\n---\n\n## ⭐ Why Choose bestax-bulma?\n\n- **Supports the latest Bulma v1.x**\n Other React Bulma libraries are stuck on Bulma 0.9.4 — bestax-bulma is built for the future.\n- **80+ components**\n All of Bulma v1, plus extras: Carousel, Dialog, Sidebar, Steps, Autocomplete, Taginput, DateInput/TimeInput/DateTimeInput pickers, and more. (Migrating from v2? Snackbar merged into [Toast](https://bestax.io/docs/api/components/toast).)\n- **Dark mode & theming built in**\n `Theme colorMode`, `--bulma-*` variable overrides, and prefixed-class builds via `ConfigProvider`.\n- **Just one dependency: Bulma**\n Every Bulma library depends on it — we ship it automatically. Clean install, fewer security concerns.\n- **Tree-shakeable ESM + CJS**\n Import only what you use — see the live [bundle size](https://bundlephobia.com/package/@allxsmith/bestax-bulma).\n- **99% unit test coverage**\n Enforced in CI by the [jest config](https://github.com/allxsmith/bestax/blob/main/bulma-ui/jest.config.js) — not just claimed.\n- **100% TypeScript**\n Full type safety for you and your team.\n- **Active developer support**\n Issues? Questions? PRs? Get fast responses and real improvements.\n\n---\n\n## 📦 NPM Package\n\nView the package on npmjs: \n👉 [https://www.npmjs.com/package/@allxsmith/bestax-bulma](https://www.npmjs.com/package/@allxsmith/bestax-bulma)\n\n---\n\n## 🔒 Hardened by default\n\nThis package is one runtime dependency deep (Bulma) and is published under a deliberately strict pipeline:\n\n- **Signed provenance** — every release carries a sigstore attestation linking the tarball to the exact commit and CI run that built it. Verify it in the **Provenance** section of the [npm page](https://www.npmjs.com/package/@allxsmith/bestax-bulma#provenance), or run `npm audit signatures` in your project.\n- **npm OIDC trusted publishing** — short-lived, per-run credentials; no long-lived `NPM_TOKEN` exists to be stolen. Release commits and tags are GPG-signed.\n- **Socket.dev scans every PR** for malware, install scripts, obfuscated code, and privilege escalation before it can reach `main`.\n- **Dependencies are a deliberate act** — install scripts are blocked unless individually allow-listed, freshly published versions are refused for 3 days, and CI installs only what the reviewed lockfile resolves.\n- **Every GitHub Action is pinned to a full commit SHA**, so a compromised action release can't roll silently into a build of this package.\n- **CodeQL, Dependency Review, and Dependabot** run continuously, alongside a high-severity `pnpm audit` gate.\n- **Layered AI review before merge** — [CodeRabbit](https://coderabbit.ai) plus an independent adversarial Claude review (a different model from the one writing AI-authored changes), on top of required green CI, an approving review, and a human merge.\n\nFull detail: [`SECURITY.md`](https://github.com/allxsmith/bestax/blob/main/SECURITY.md) · [Security guide](https://bestax.io/docs/guides/security)\n\n---\n\n## 📚 Documentation\n\n**For full documentation, guides, and best practices, please use our official docs site:**\n\n👉 [https://bestax.io](https://bestax.io)\n\n> **Always refer to the [documentation site](https://bestax.io) first:** \n> It's the most complete and up-to-date source for everything bestax-bulma!\n\n---\n\n## 📖 Storybook\n\nExplore live, interactive component examples in our Storybook:\n\n👉 [https://bestax.io/storybook](https://bestax.io/storybook)\n\n---\n\n## 🤖 For AI Tools\n\nBuilding with an AI agent (Claude Code, Cursor, Copilot)? bestax-bulma ships LLM-optimized docs:\n\n- 📘 **[LLMs guide](https://bestax.io/docs/guides/llms)** — how to use the library with AI tools\n- 📄 **[llms.txt](https://bestax.io/llms.txt)** — curated index · **[llms-full.txt](https://bestax.io/llms-full.txt)** — the full docs in one file · every docs page is also served as raw markdown\n- 📦 **In the npm package** — the tarball ships `llms.txt`, `AGENTS.md`, and `CLAUDE.md` pointer files, so agents exploring `node_modules` land on these resources by filename\n- 🧩 **[Agent Skills](https://bestax.io/docs/skills/intro)** — teach your agent the bestax way:\n\n | Skill | Use it when… |\n | ------------------------- | -------------------------------------------------------------------------------- |\n | `bestax-layout-scaffold` | Turning a high-level request (dashboard, landing page, …) into a responsive page |\n | `bestax-form` | Building forms — Field/Control composition and the full input inventory |\n | `bestax-theming` | Customizing colors, fonts, dark mode via `Theme` and `--bulma-*` variables |\n | `bestax-custom-component` | Building a new custom component beyond stock Bulma, the bestax way |\n | `bestax-icons` | Adding icons — Icon/IconText and the five supported icon libraries |\n | `bestax-optimize` | Shrinking the built CSS — flavor builds, modular Sass, import hygiene |\n | `bestax-migrate` | Moving an app off react-bulma-components (v4) onto bestax-bulma |\n\n ```bash\n npx skills add https://github.com/allxsmith/bestax --skill bestax-layout-scaffold\n ```\n\n New projects get the skills automatically with `npm create bestax@latest my-app --skills` (plus a generated `CLAUDE.md`).\n\n---\n\n## 🙏 Attribution\n\nbestax-bulma is built on top of the incredible [Bulma](https://bulma.io) CSS framework,\n© [Jeremy Thomas](https://github.com/jgthms) and licensed under the\n[MIT License](https://github.com/jgthms/bulma/blob/main/LICENSE). Some example content and\ndocumentation is adapted from the Bulma website\n([CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/)), © Jeremy Thomas.\n\nIf you find Bulma useful, please consider\n[sponsoring Jeremy Thomas](https://github.com/sponsors/jgthms) to support its continued\ndevelopment.\n\n_We are not affiliated with Bulma or Jeremy Thomas in any way — we're just big fans of the\nBulma framework!_\n\n## License\n\nSource code licensed MIT\n"
205
+ }