@wpmoo/ui 1.4.3 → 2.0.0

package/LICENSE

@@ -19,31 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
----
-
-Chart.js v4.5.1
-
-The MIT License (MIT)
-
-Copyright (c) 2014-2024 Chart.js Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
----
-
-@kurkle/color v0.3.4
-
-The MIT License (MIT)
-
-Copyright (c) 2018-2024 Jukka Kurkela
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -140,6 +140,17 @@ if (combobox) {
 
 The runtime bundle is optional and side-effect-free. Import the aggregate
 `@wpmoo/ui/moo-ui.js` entrypoint, or import only the component module you use.
+Chart consumers install the optional peer explicitly (other components need no Chart dependency):
+
+```sh
+npm install chart.js@4.6.1
+```
+
+Chart.js supplies its own `@kurkle/color` dependency and vendor licenses. Neither
+implementation is embedded in Moo UI's npm archive. Bundlers resolve `chart.js/auto`
+from that installation. Native browser/CDN hosts must configure the version-pinned
+import map in the [Installation guide](https://ui.wpmoo.org/installation/) before
+loading MooChart. Self-hosted vendors must retain their upstream license files.
 The aggregate loads Chart.js only when `loadChart()` is called:
 
 ```js
@@ -168,6 +179,22 @@ import { initSheets } from "@wpmoo/ui/sheet.js";
 initSheets(document);
 ```
 
+For a non-modal floating Card, initialize the optional controller explicitly:
+
+```js
+import FloatingPanel from "@wpmoo/ui/floating-panel.js";
+const panel = FloatingPanel.getOrCreateInstance(document.getElementById("onboarding"));
+// panel.dispose(); // release listeners and restore the original hidden/ARIA state
+```
+
+Use an id on the `data-floating-panel` element. Plain buttons target that id with
+`data-floating-panel-open` or, inside the panel, `data-floating-panel-dismiss`.
+Controls share the panel's nearest `.moo-ui` boundary. An optional
+`data-floating-panel-key` remembers dismissal in browser local storage; use an
+application-owned, account-specific key when appropriate. This is a local UI
+preference, not authorization or server-side task state. See the
+[Card example](https://ui.wpmoo.org/components/card/#floating-panel) for markup.
+
 For an opt-in document overlay scrollbar, load the stylesheet first and pass
 the resolved page theme owner explicitly:
 
@@ -181,6 +208,31 @@ const scrollbar = OverlayScrollbar.getOrCreateInstance(document.querySelector(".
 // scrollbar.dispose(); // restore the native scrollbar
 ```
 
+For dependency-free password requirements feedback, initialize an identified
+`fieldset[data-password-requirements]` explicitly:
+
+```js
+import PasswordRequirements from "@wpmoo/ui/password-requirements.js";
+const feedback = PasswordRequirements.getOrCreateInstance(
+  document.getElementById("password-rules"),
+);
+await feedback.ready;
+// feedback.dispose(); // restore original markup, attributes and control state
+```
+
+The [Field example](https://ui.wpmoo.org/components/field/#password-feedback-preview)
+shows the rendered contract. Policy version3 supports length, maximum, case,
+number and symbol requirements, plus optional confirmation and submit binding.
+All controls share a form and nearest `.moo-ui` owner. Submit feedback requires
+Bootstrap Tooltip on that document's window. There is no bundled estimator,
+strength score, breached-password lookup, network request or storage access.
+Meeting these checks does **not** establish password strength or replace server
+validation. A trusted host may supply synchronous `analyze(value)`, returning
+`{met: boolean, score: 0..4}`; this callback receives the normalized password and
+owns its security/privacy behavior. Without it no score is produced. `onChange`
+receives only Boolean check states, an active flag and the optional host score.
+See the [public policy contract](https://github.com/wpmoo-org/ui/blob/main/docs/contracts/PACKAGE_SURFACE_DECISIONS.md#200-external-chart-vendors-and-password-requirements).
+
 The module preserves native document/touch/wheel scrolling. Its thin thumb
 appears while scrolling, near the trailing mouse edge or on keyboard focus;
 show/hide never reserves a layout gutter. Initial activation removes any native
@@ -223,10 +275,12 @@ calm.
 
 ## Status And Support
 
-The `1.4.3` patch release target prepares native-hidden document scrolling
-before first paint and preserves the original visibility for explicit overlay
-native mode and disposal. Public exports and Bootstrap compatibility remain
-unchanged from 1.4.2.
+The `2.0.0` major release target externalizes Chart.js and adds dependency-free password requirements,
+optional host-supplied analysis and native confirmation/submit feedback.
+Field, Input, Button and Tooltip gain additive composition options. Existing
+exports and Bootstrap compatibility are preserved; no estimator is bundled.
+Chart consumers must now install the external Chart.js peer or provide a browser
+import map; the previously self-contained Chart setup changes in this major.
 Component certification remains
 `preview`, with its documented manual and browser/device limits. Public exports, package boundaries, browser support, and release evidence live in [Support & Evidence](https://ui.wpmoo.org/support/).
 Complete release notes are on
@@ -249,8 +303,8 @@ paths live in the [Installation guide](https://ui.wpmoo.org/installation/).
 
 Moo UI source code is MIT licensed. License details live in
 [LICENSE](LICENSE) and the [License page](https://ui.wpmoo.org/license/).
-The published `LICENSE` also retains the full MIT notices for bundled
-Chart.js and `@kurkle/color`.
-Asset terms live in [ASSET_LICENSE.md](ASSET_LICENSE.md); dependency notices
-live in the
-[version-pinned third-party notices](https://github.com/wpmoo-org/ui/blob/v1.4.3/THIRD_PARTY_NOTICES.md).
+Third-party distribution details and notices are kept separately in
+[THIRD_PARTY_NOTICES.md](https://github.com/wpmoo-org/ui/blob/v2.0.0/THIRD_PARTY_NOTICES.md).
+Catalog visual assets and their license are repository-only and are not
+included in the npm package. Asset terms live in the
+[visual asset license](https://github.com/wpmoo-org/ui/blob/v2.0.0/ASSET_LICENSE.md).

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,87 @@
+# Third-Party Notices
+
+Moo UI's own MIT license is kept separately in `LICENSE`. The full Moo CSS
+includes Bootstrap-derived styles. Catalog-only assets and optional external
+Chart vendors have separate distributions and licenses as described below.
+
+## Bootstrap
+
+Moo UI vendors the official `twbs/bootstrap` v5.3.3 SCSS source and bundled
+JavaScript. Bootstrap is licensed under the MIT License; the bundled license is
+stored at `vendor/bootstrap/LICENSE`.
+
+The MIT License (MIT)
+
+Copyright (c) 2011-2024 The Bootstrap Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+Bootstrap's component and Button documentation are behavior, semantics, and
+accessibility references for this product.
+
+## shadcn/ui
+
+Moo UI is designed for server-rendered interfaces that keep Bootstrap markup as
+the durable contract. shadcn/ui is used as a visual-intent and catalog-coverage
+reference. If you are building React and Tailwind applications, use shadcn/ui
+directly: https://ui.shadcn.com/
+
+## Lucide
+
+Moo UI vendors a build-time icon metadata subset from Iconify's Lucide icon
+set at `src/icons/lucide-icons.json` and renders selected Lucide icons into the
+generated catalog. Lucide is licensed under the ISC License. The source
+metadata identifies the Lucide project, its contributors, and the upstream
+license URL. The root favicon set (`favicon.svg`, `favicon.ico`,
+`apple-touch-icon.png`, `icon-192.png`, and `icon-512.png`) uses the Lucide
+Blocks geometry and remains covered by the same ISC license notice.
+
+## Geist
+
+Moo UI vendors `Geist-Variable.woff2` for catalog chrome typography only.
+Geist is licensed under the SIL Open Font License 1.1 (`OFL-1.1`); the bundled
+license is stored at `vendor/geist/LICENSE`.
+
+## Chart.js
+
+Chart.js4.6.1 is an external optional peer of Moo UI, not embedded in either
+`dist/js/chart.js` or `dist/js/chart.min.js`. These files contain the MooChart
+adapter. Consumers install Chart.js separately or serve its native ESM files
+with an import map. The catalog serves exact locked files separately under
+`vendor/chart.js/`, including its unchanged `LICENSE.md`.
+
+- **License:** MIT
+- **Source and license:** <https://github.com/chartjs/Chart.js/blob/v4.6.1/LICENSE.md>
+
+## @kurkle/color
+
+Color0.3.4 is Chart.js's own dependency, not embedded in the Moo npm archive.
+The catalog serves its native ESM file and unchanged license separately under
+`vendor/@kurkle/color/`. npm consumers receive it through their Chart.js install.
+
+- **License:** MIT
+- **Source and license:** <https://github.com/kurkle/color/blob/v0.3.4/LICENSE.md>
+
+## WPMoo visual assets
+
+WPMoo-generated visual assets, including image assets under `site/static/images/`,
+are original WPMoo work and are not licensed under MIT unless explicitly
+stated. See the
+[repository visual asset license](https://github.com/wpmoo-org/ui/blob/v2.0.0/ASSET_LICENSE.md).
+These assets and their license file are not included in the npm package.

package/certification.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "0.1",
   "status": "preview",
-  "coreVersion": "1.4.3",
+  "coreVersion": "2.0.0",
   "bootstrap": {
     "canonicalVersion": "5.3.3",
     "targetRange": ">=5.3.0 <5.4",
@@ -21,6 +21,7 @@
       "./moo.min.css"
     ],
     "esm": [
+      "./password-requirements.js",
       "./moo-ui.js",
       "./moo-ui.min.js",
       "./combobox.js",
@@ -32,6 +33,7 @@
       "./overlay-scrollbar.js",
       "./table-of-contents.js",
       "./sheet.js",
+      "./floating-panel.js",
       "./chart.js",
       "./chart.min.js",
       "./datepicker.js",

package/dist/assets/css/moo-ui.css

@@ -1,5 +1,5 @@
 /*!
- * Moo UI v1.4.3 (https://wpmoo.org/)
+ * Moo UI v2.0.0 (https://wpmoo.org/)
  * Copyright 2026 WPMoo Authors
  * Licensed under MIT (https://github.com/wpmoo-org/ui/blob/main/LICENSE)
  *

package/dist/assets/css/moo-ui.min.css

@@ -1,5 +1,5 @@
 /*!
- * Moo UI v1.4.3 (https://wpmoo.org/)
+ * Moo UI v2.0.0 (https://wpmoo.org/)
  * Copyright 2026 WPMoo Authors
  * Licensed under MIT (https://github.com/wpmoo-org/ui/blob/main/LICENSE)
  *

package/dist/assets/css/moo.css

@@ -1,5 +1,5 @@
 /*!
- * Moo UI v1.4.3 (https://wpmoo.org/)
+ * Moo UI v2.0.0 (https://wpmoo.org/)
  * Copyright 2026 WPMoo Authors
  * Licensed under MIT (https://github.com/wpmoo-org/ui/blob/main/LICENSE)
  *

package/dist/assets/css/moo.min.css

@@ -1,5 +1,5 @@
 /*!
- * Moo UI v1.4.3 (https://wpmoo.org/)
+ * Moo UI v2.0.0 (https://wpmoo.org/)
  * Copyright 2026 WPMoo Authors
  * Licensed under MIT (https://github.com/wpmoo-org/ui/blob/main/LICENSE)
  *