on_the_money 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.2] — 2026-07-20
+
+### Changed
+
+- **HTML-106 promoted from warn to error tier.** The production trial closed with zero false positives across both consumers and one true positive (a `the()` write projecting into a slot that doesn't exist — dead state the deletion test exists to catch). Runs that previously reported-and-passed now fail on unconsumed global keys; consume the key or delete the write. The warn-tier machinery remains for future rules. (#136)
+- **HTML-107 pairs by CSS reference, not name coupling** (landed post-0.7.1 as #144): the state key revealing a span may be named anything — a reveal rule necessarily references the span it reveals, so the reference is the proof. Kills the false-positive class that condemned functional cross-named wiring. (#143)
+
+## [0.7.1] — 2026-07-19
+
+Port feedback, same day: the first downstream migrations onto the 0.7.0 batteries surfaced three regressions. Issues #132–#135, #137; PRs #138–#142.
+
+### Fixed
+
+- **`otm/no-raw-websocket` flags only the browser global.** Scope-resolved: an imported or locally declared `WebSocket` (a Node `ws`-package client) passes — the hand-rolled-lifecycle slop vector the rule targets doesn't exist there. (#132)
+- **`.ejs` joins otm-lint's markup universe** for cross-file rules (reveal spans, slots, actions); per-file rules stay `.html`-only so template syntax never trips HTML-004. HTML-107's css→span direction is silent when zero reveal spans were found anywhere — an empty universe is blindness, not dead wiring. Kills 46 false errors on server-templated projects. (#133)
+- **src-first entry — the core singleton unforked.** `exports "."` (and `main`/`module`) resolve to `src/core/index.js`, the same graph every battery subpath imports; previously `.` pointed at the dist bundle, so importing the entry plus any battery loaded two `The` singletons and `boot()` configured one while batteries read the other. The redundant `./src` alias is gone; `dist/` demotes to a CDN/script-tag artifact. Reverses the 0.2.0 dist-entry decision — deliberately, no legacy. (#134)
+- Test-runner IPC flake (`Unable to deserialize cloned data`) starved at the source: the CLI's console chatter is mocked in its tests. (#30 lineage)
+
+### Changed
+
+- Blog example modernized to 0.7.0 idioms: `$.cloneEach` + `data-bind` replace the manual clone loop and per-clone `setAttribute`. (#135)
+
 ## [0.7.0] — 2026-07-19
 
 The boundary release. OTM's mandate extends to the browser side of live data — batteries for the platform's gaps, contracts instead of server code, and the lint stack grown into a drift wall — under a ratified constitution: a battery ships only if it wraps a platform *absence*, rides an existing standard or published machine-readable convention, lands with lint + doctest on day one, lives in a subpath the core never pays for, and carries an explicit NOT-list. Issues #84, #86–#89, #115–#120; PRs #121–#131.

package/README.md

@@ -763,10 +763,10 @@ npx otm-lint --check ./src
 | **HTML-103** | `data-i18n-{var}` attr has no matching `{var}` placeholder in the dictionary template | The token is silently dropped at runtime. Either remove the unused attr or add `{var}` to the template. |
 | **HTML-104** | A global `the("key", ...)` write collides with a `data-text="key"` slot inside a `<template>` | Global writes walk the whole document and clobber every cloned instance. Rename the template slot key or the global key. |
 | **HTML-105** | `data-action` values and `on()` `[data-action="..."]` selector literals disagree | Both directions: a `data-action` no handler references is a dead control; a selector no element carries is an orphan handler. A generic `[data-action]` dispatch selector in JS waives the dead-control direction; `data-otm-dynamic` opts an element out. |
-| **HTML-106** *(warn)* | A globally written state key nothing consumes | The deletion test as lint: no CSS attribute selector, `[data-text]` slot, `"data-key"` JS string literal (e.g. MutationObserver `attributeFilter`), or `the("key")` read touches it — dead state or a missing CSS rule. Warn-level: reported, never fails the run. |
-| **HTML-107** | A `data-K-key="V"` reveal span with no `[data-K="V"]` state-CSS rule, or a CSS `[data-K-key="V"]` reference with no span | Either half missing means the message silently never shows (or the rule is dead wiring). Add the missing half or delete the orphan; `data-otm-dynamic` opts a span out of the span→CSS direction. |
+| **HTML-106** | A globally written state key nothing consumes | The deletion test as lint: no CSS attribute selector, `[data-text]` slot, `"data-key"` JS string literal (e.g. MutationObserver `attributeFilter`), or `the("key")` read touches it — dead state or a missing CSS rule. Promoted from warn to error after a zero-false-positive production trial. |
+| **HTML-107** | A `data-K-key="V"` reveal span no state-CSS rule references, or a CSS `[data-K-key="V"]` reference no element carries | Pairing is by CSS reference — the state key revealing a span may be named anything (`body[data-form-error="V"] [data-error-key="V"]` is fine). Either half missing means the message silently never shows (or the rule is dead wiring); `data-otm-dynamic` opts a span out of the span→CSS direction. |
 
-`otm-lint` walks `.html`, `.js`, `.css`, and locale `.json` files. HTML files get the per-file rules above (template content included); `.js` files contribute `$.clone` references, `the()` write/read keys, and `data-action` selectors; `.css` files contribute attribute-selector consumption for HTML-106; locale dicts get loaded per HTML file's `<meta name="i18n">` for HTML-102/103. Default excludes: `node_modules`, `dist`, `.git`, dotdirs. Exit code is nonzero when error-level violations are found.
+`otm-lint` walks `.html`, `.ejs` (cross-file rules only — per-file rules stay `.html`), `.js`, `.css`, and locale `.json` files. HTML files get the per-file rules above (template content included); `.js` files contribute `$.clone` references, `the()` write/read keys, and `data-action` selectors; `.css` files contribute attribute-selector consumption for HTML-106; locale dicts get loaded per HTML file's `<meta name="i18n">` for HTML-102/103. Default excludes: `node_modules`, `dist`, `.git`, dotdirs. Exit code is nonzero when error-level violations are found.
 
 ### Lint-rule scope
 
@@ -849,9 +849,11 @@ src/
 test/
 └── integration.test.js    # cross-module integration suite
 dist/
-└── on_the_money.min.js    # built ESM bundle (esbuild)
+└── on_the_money.min.js    # CDN/script-tag artifact only — npm resolves "." to src
 ```
 
+**One module graph.** The npm entry (`.`) and every battery subpath resolve into the same `src/` graph, so `The`'s statics (`dictionary`, `locale`, `prefix`, `persistKeys`) are one singleton everywhere. `dist/on_the_money.min.js` exists solely for `<script type="module">` hotlinking — importing it *alongside* npm subpaths would fork the core, which is exactly the bug this arrangement removes.
+
 Unit tests are co-located with source: `src/core/On.test.js`, etc.
 
 ## Commands

package/package.json

@@ -1,16 +1,15 @@
 {
 	"name": "on_the_money",
-	"version": "0.7.0",
+	"version": "0.7.2",
 	"description": "Opinionated, attribute-driven, standards-oriented modern framework. Native browser APIs only. See README.md for the authoring context.",
 	"type": "module",
-	"main": "dist/on_the_money.min.js",
-	"module": "dist/on_the_money.min.js",
+	"main": "src/core/index.js",
+	"module": "src/core/index.js",
 	"bin": {
 		"otm-lint": "./src/linter/main.js"
 	},
 	"exports": {
-		".": "./dist/on_the_money.min.js",
-		"./src": "./src/core/index.js",
+		".": "./src/core/index.js",
 		"./live": "./src/live/index.js",
 		"./clipboard": "./src/clipboard/index.js",
 		"./test": "./src/test/index.js",

package/src/eslint/plugin.js

@@ -293,9 +293,14 @@ const noRawWebsocket = {
 	create(context) {
 		return {
 			NewExpression(node) {
-				if (node.callee?.name === "WebSocket") {
-					context.report({ node, messageId: "useLive" });
-				}
+				if (node.callee?.name !== "WebSocket") return;
+				// Only the browser GLOBAL is banned. An imported or locally
+				// declared WebSocket (a Node ws-package client) resolves to a
+				// definition and is outside live()'s reach — let it pass.
+				const scope = context.sourceCode.getScope(node);
+				const ref = scope.references.find((r) => r.identifier === node.callee);
+				if (ref?.resolved?.defs.length) return;
+				context.report({ node, messageId: "useLive" });
 			},
 		};
 	},

package/src/linter/Linter.js

@@ -371,7 +371,6 @@ export default class Linter {
 				{ line: writer.line, column: 1 },
 				"HTML-106",
 				`State key "${key}" is written via the() but never consumed by a CSS attribute selector, a [data-text] slot, or a JS data-attribute reference — dead state or a missing CSS rule (the deletion test).`,
-				"warn",
 			);
 		}
 
@@ -405,13 +404,18 @@ export default class Linter {
 		}
 
 		// Inline <style> blocks ride along in the raw HTML sources.
+		// Pairing is by CSS *reference*, never by name coupling: the state key
+		// that reveals a span may be named anything (body[data-form-error="V"]
+		// revealing [data-error-key="V"] is fully functional) — a reveal rule
+		// necessarily references the span it reveals, so the ref IS the proof.
 		const styleTexts = [...cssSources, ...htmlSources];
-		const stateRules = new Set();
 		const spanRefs = [];
+		const refPairs = new Set();
 		for (const { file, source } of styleTexts) {
 			for (const m of source.matchAll(
 				/\[data-([a-z0-9-]+?)-key=["']?([\w-]+)["']?\]/g,
 			)) {
+				refPairs.add(`${m[1]} ${m[2]}`);
 				spanRefs.push({
 					group: m[1],
 					value: m[2],
@@ -419,25 +423,23 @@ export default class Linter {
 					line: Linter.#lineOf(source, m.index),
 				});
 			}
-			for (const m of source.matchAll(
-				/\[data-([a-z0-9-]+)=["']?([\w-]+)["']?\]/g,
-			)) {
-				if (!m[1].endsWith("-key")) stateRules.add(`${m[1]} ${m[2]}`);
-			}
 		}
 
 		for (const span of revealSpans) {
-			if (stateRules.has(`${span.group} ${span.value}`)) continue;
+			if (refPairs.has(`${span.group} ${span.value}`)) continue;
 			Linter.#addViolation(
 				violations,
 				span.file,
 				{ line: span.line, column: span.column },
 				"HTML-107",
-				`Reveal span data-${span.group}-key="${span.value}" has no state-CSS rule matching [data-${span.group}="${span.value}"] — the message can never show. Add the reveal rule, or delete the span, or mark it data-otm-dynamic.`,
+				`Reveal span data-${span.group}-key="${span.value}" is referenced by no state-CSS rule — the message can never show. Add a reveal rule selecting [data-${span.group}-key="${span.value}"], or delete the span, or mark it data-otm-dynamic.`,
 			);
 		}
 
-		for (const ref of spanRefs) {
+		// An empty span universe is evidence of blindness (markup living in
+		// templates the scan can't see), not of dead wiring — the css→span
+		// direction only fires when at least one reveal span was found.
+		for (const ref of spanPairs.size > 0 ? spanRefs : []) {
 			if (spanPairs.has(`${ref.group} ${ref.value}`)) continue;
 			Linter.#addViolation(
 				violations,

package/src/linter/cli.js

@@ -62,8 +62,19 @@ export default class Cli {
 	}
 
 	static async scan(dir) {
-		const allFiles = await Cli.getFiles(dir, [".html", ".js", ".json", ".css"]);
-		const htmlPaths = allFiles.filter((f) => f.endsWith(".html"));
+		const allFiles = await Cli.getFiles(dir, [
+			".html",
+			".ejs",
+			".js",
+			".json",
+			".css",
+		]);
+		// .ejs joins the markup universe for cross-file rules (reveal spans,
+		// slots, actions); per-file rules stay .html-only — Linter.check
+		// skips non-.html, so template syntax never false-positives HTML-004.
+		const htmlPaths = allFiles.filter(
+			(f) => f.endsWith(".html") || f.endsWith(".ejs"),
+		);
 		const jsPaths = allFiles.filter((f) => f.endsWith(".js"));
 		const cssPaths = allFiles.filter((f) => f.endsWith(".css"));
 		let totalViolations = 0;