on_the_money 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.1] — 2026-07-19
+
+Port feedback, same day: the first downstream migrations onto the 0.7.0 batteries surfaced three regressions. Issues #132–#135, #137; PRs #138–#142.
+
+### Fixed
+
+- **`otm/no-raw-websocket` flags only the browser global.** Scope-resolved: an imported or locally declared `WebSocket` (a Node `ws`-package client) passes — the hand-rolled-lifecycle slop vector the rule targets doesn't exist there. (#132)
+- **`.ejs` joins otm-lint's markup universe** for cross-file rules (reveal spans, slots, actions); per-file rules stay `.html`-only so template syntax never trips HTML-004. HTML-107's css→span direction is silent when zero reveal spans were found anywhere — an empty universe is blindness, not dead wiring. Kills 46 false errors on server-templated projects. (#133)
+- **src-first entry — the core singleton unforked.** `exports "."` (and `main`/`module`) resolve to `src/core/index.js`, the same graph every battery subpath imports; previously `.` pointed at the dist bundle, so importing the entry plus any battery loaded two `The` singletons and `boot()` configured one while batteries read the other. The redundant `./src` alias is gone; `dist/` demotes to a CDN/script-tag artifact. Reverses the 0.2.0 dist-entry decision — deliberately, no legacy. (#134)
+- Test-runner IPC flake (`Unable to deserialize cloned data`) starved at the source: the CLI's console chatter is mocked in its tests. (#30 lineage)
+
+### Changed
+
+- Blog example modernized to 0.7.0 idioms: `$.cloneEach` + `data-bind` replace the manual clone loop and per-clone `setAttribute`. (#135)
+
 ## [0.7.0] — 2026-07-19
 
 The boundary release. OTM's mandate extends to the browser side of live data — batteries for the platform's gaps, contracts instead of server code, and the lint stack grown into a drift wall — under a ratified constitution: a battery ships only if it wraps a platform *absence*, rides an existing standard or published machine-readable convention, lands with lint + doctest on day one, lives in a subpath the core never pays for, and carries an explicit NOT-list. Issues #84, #86–#89, #115–#120; PRs #121–#131.

package/README.md

@@ -766,7 +766,7 @@ npx otm-lint --check ./src
 | **HTML-106** *(warn)* | A globally written state key nothing consumes | The deletion test as lint: no CSS attribute selector, `[data-text]` slot, `"data-key"` JS string literal (e.g. MutationObserver `attributeFilter`), or `the("key")` read touches it — dead state or a missing CSS rule. Warn-level: reported, never fails the run. |
 | **HTML-107** | A `data-K-key="V"` reveal span with no `[data-K="V"]` state-CSS rule, or a CSS `[data-K-key="V"]` reference with no span | Either half missing means the message silently never shows (or the rule is dead wiring). Add the missing half or delete the orphan; `data-otm-dynamic` opts a span out of the span→CSS direction. |
 
-`otm-lint` walks `.html`, `.js`, `.css`, and locale `.json` files. HTML files get the per-file rules above (template content included); `.js` files contribute `$.clone` references, `the()` write/read keys, and `data-action` selectors; `.css` files contribute attribute-selector consumption for HTML-106; locale dicts get loaded per HTML file's `<meta name="i18n">` for HTML-102/103. Default excludes: `node_modules`, `dist`, `.git`, dotdirs. Exit code is nonzero when error-level violations are found.
+`otm-lint` walks `.html`, `.ejs` (cross-file rules only — per-file rules stay `.html`), `.js`, `.css`, and locale `.json` files. HTML files get the per-file rules above (template content included); `.js` files contribute `$.clone` references, `the()` write/read keys, and `data-action` selectors; `.css` files contribute attribute-selector consumption for HTML-106; locale dicts get loaded per HTML file's `<meta name="i18n">` for HTML-102/103. Default excludes: `node_modules`, `dist`, `.git`, dotdirs. Exit code is nonzero when error-level violations are found.
 
 ### Lint-rule scope
 
@@ -849,9 +849,11 @@ src/
 test/
 └── integration.test.js    # cross-module integration suite
 dist/
-└── on_the_money.min.js    # built ESM bundle (esbuild)
+└── on_the_money.min.js    # CDN/script-tag artifact only — npm resolves "." to src
 ```
 
+**One module graph.** The npm entry (`.`) and every battery subpath resolve into the same `src/` graph, so `The`'s statics (`dictionary`, `locale`, `prefix`, `persistKeys`) are one singleton everywhere. `dist/on_the_money.min.js` exists solely for `<script type="module">` hotlinking — importing it *alongside* npm subpaths would fork the core, which is exactly the bug this arrangement removes.
+
 Unit tests are co-located with source: `src/core/On.test.js`, etc.
 
 ## Commands

package/package.json

@@ -1,16 +1,15 @@
 {
 	"name": "on_the_money",
-	"version": "0.7.0",
+	"version": "0.7.1",
 	"description": "Opinionated, attribute-driven, standards-oriented modern framework. Native browser APIs only. See README.md for the authoring context.",
 	"type": "module",
-	"main": "dist/on_the_money.min.js",
-	"module": "dist/on_the_money.min.js",
+	"main": "src/core/index.js",
+	"module": "src/core/index.js",
 	"bin": {
 		"otm-lint": "./src/linter/main.js"
 	},
 	"exports": {
-		".": "./dist/on_the_money.min.js",
-		"./src": "./src/core/index.js",
+		".": "./src/core/index.js",
 		"./live": "./src/live/index.js",
 		"./clipboard": "./src/clipboard/index.js",
 		"./test": "./src/test/index.js",

package/src/eslint/plugin.js

@@ -293,9 +293,14 @@ const noRawWebsocket = {
 	create(context) {
 		return {
 			NewExpression(node) {
-				if (node.callee?.name === "WebSocket") {
-					context.report({ node, messageId: "useLive" });
-				}
+				if (node.callee?.name !== "WebSocket") return;
+				// Only the browser GLOBAL is banned. An imported or locally
+				// declared WebSocket (a Node ws-package client) resolves to a
+				// definition and is outside live()'s reach — let it pass.
+				const scope = context.sourceCode.getScope(node);
+				const ref = scope.references.find((r) => r.identifier === node.callee);
+				if (ref?.resolved?.defs.length) return;
+				context.report({ node, messageId: "useLive" });
 			},
 		};
 	},

package/src/linter/Linter.js

@@ -437,7 +437,10 @@ export default class Linter {
 			);
 		}
 
-		for (const ref of spanRefs) {
+		// An empty span universe is evidence of blindness (markup living in
+		// templates the scan can't see), not of dead wiring — the css→span
+		// direction only fires when at least one reveal span was found.
+		for (const ref of spanPairs.size > 0 ? spanRefs : []) {
 			if (spanPairs.has(`${ref.group} ${ref.value}`)) continue;
 			Linter.#addViolation(
 				violations,

package/src/linter/cli.js

@@ -62,8 +62,19 @@ export default class Cli {
 	}
 
 	static async scan(dir) {
-		const allFiles = await Cli.getFiles(dir, [".html", ".js", ".json", ".css"]);
-		const htmlPaths = allFiles.filter((f) => f.endsWith(".html"));
+		const allFiles = await Cli.getFiles(dir, [
+			".html",
+			".ejs",
+			".js",
+			".json",
+			".css",
+		]);
+		// .ejs joins the markup universe for cross-file rules (reveal spans,
+		// slots, actions); per-file rules stay .html-only — Linter.check
+		// skips non-.html, so template syntax never false-positives HTML-004.
+		const htmlPaths = allFiles.filter(
+			(f) => f.endsWith(".html") || f.endsWith(".ejs"),
+		);
 		const jsPaths = allFiles.filter((f) => f.endsWith(".js"));
 		const cssPaths = allFiles.filter((f) => f.endsWith(".css"));
 		let totalViolations = 0;