paneltir 0.6.0

package/dist/style.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/fingerprint.json

@@ -0,0 +1,7 @@
+{
+  "name": "paneltir",
+  "version": "0.6.0",
+  "hash": "sha256:cb1a1df3cac0d3cc775fbaa7b9f385d6d35e22cecbe86cc0a1da4338cf43de37",
+  "fileCount": 151,
+  "generatedAt": "2026-09-06T10:08:28.981Z"
+}

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "paneltir",
+  "version": "0.6.0",
+  "description": "A React UI kit for admin panels: page frame, a board with touch-ready drag and drop, detail sheets, and a whole panel in one component. Structure and behaviour are fixed; colour and brand belong to each project.",
+  "license": "SEE LICENSE IN LICENSE",
+  "author": "DFKlabs (https://DFKlabs.com)",
+  "homepage": "https://paneltir.dfklabs.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/daifukus/paneltir.git"
+  },
+  "bugs": {
+    "url": "https://github.com/daifukus/paneltir/issues"
+  },
+  "keywords": [
+    "react",
+    "dashboard",
+    "admin-panel",
+    "kanban",
+    "drag-and-drop",
+    "theming",
+    "ui-kit"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./style.css": "./dist/style.css"
+  },
+  "bin": {
+    "paneltir": "./bin/paneltir.mjs"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "template",
+    "README.md",
+    "INSTALL.md",
+    "CLAUDE_MD_SNIPPET.md",
+    "renovate.json.example",
+    "LICENSE",
+    "fingerprint.json"
+  ],
+  "sideEffects": [
+    "**/*.css"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "prepare": "npm run build",
+    "typecheck": "tsc --noEmit",
+    "fingerprint": "node scripts/fingerprint.mjs",
+    "fingerprint:check": "node scripts/fingerprint.mjs --check",
+    "icons": "node scripts/icons.mjs",
+    "icons:check": "node scripts/icons.mjs --check",
+    "seo": "node scripts/seo.mjs",
+    "seo:check": "node scripts/seo.mjs --check",
+    "test:auth": "node scripts/test-auth.mjs",
+    "check:boards": "node scripts/check-boards.mjs",
+    "demo:install": "npm --prefix examples/demo ci",
+    "demo:build": "npm --prefix examples/demo run build",
+    "verify": "npm run typecheck && npm run build && npm run icons:check && npm run seo:check && npm run test:auth && npm run test:marketplace && npm run test:init && npm run test:board && npm run check:boards && npm run check:docs && npm run check:package && npm run fingerprint:check",
+    "site:install": "npm --prefix site ci",
+    "site:dev": "npm --prefix site run dev",
+    "site:build": "npm --prefix site run build",
+    "test:marketplace": "node scripts/test-marketplace.mjs",
+    "check:docs": "node scripts/check-docs.mjs",
+    "check:package": "node scripts/check-package.mjs",
+    "test:init": "node scripts/test-init.mjs",
+    "test:board": "node scripts/test-board.mjs"
+  },
+  "peerDependencies": {
+    "react": ">=18",
+    "react-dom": ">=18"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "@types/react": "^18.3.0",
+    "@types/react-dom": "^18.3.0",
+    "esbuild": "0.27.7",
+    "react": "^18.3.0",
+    "react-dom": "^18.3.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.5.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/renovate.json.example

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "packageRules": [
+    {
+      "matchPackageNames": ["paneltir"],
+      "groupName": "paneltir",
+      "labels": ["paneltir"],
+      "prPriority": 5,
+      "schedule": ["before 9am on monday"]
+    }
+  ]
+}

package/template/.claude/skills/panel/SKILL.md

@@ -0,0 +1,155 @@
+---
+name: panel
+description: Work this project's Paneltir board. Reads src/data/panel-state.json, builds the list of what the owner has already asked for through the panel — orders, intents, unticked steps, notes — and works it in order, writing the board back to say what happened. Use when the user says /panel, "what's on the board", "do what's pending", "qué queda por hacer", "vacía el tablero", or asks what the panel says.
+---
+
+# The board is the queue
+
+This project has a Paneltir panel. The board lives at
+`src/data/panel-state.json` (or wherever `PANEL_FILE` points) and the owner
+edits it from a browser, often from a phone. They do not write instructions in
+prose — they tap. This skill reads those taps.
+
+So `/panel` means *carry out what I have already told you through the panel*,
+not *guess what needs doing*.
+
+## Reading a card
+
+Six fields decide whether a card is yours and what you may do with it.
+
+**`column`** — where it sits. The board defines its own columns; two of them
+carry meaning in the data rather than in their name: the column marked
+`active` is work in flight (entering it stamps `startedAt`), and the one
+marked `done` is finished (entering it stamps `completedAt`). A column named
+for the owner — `yours` in the default board — **is never yours to complete.**
+You may still help it: sharpen its checklist, or leave a note answering a
+question in its body.
+
+**`owner`** — `you` means the person, `claude` means you. Combined with the
+column: a `claude` card in a queued or active column is work; a `you` card is
+not, whatever column it is in.
+
+**`order: true`** — the one flag that means *I am asking you to do this*. It
+is the strongest signal on the board and outranks position in the column.
+
+**`intent`** — *how* to do it, and it **beats anything you would otherwise
+decide**:
+
+| `intent` | What it obliges you to do |
+| --- | --- |
+| `decide` | Pick between the options and act. Say what you picked and why, in one line. |
+| `explain` | **Change nothing.** Come back with the trade-off and wait. |
+| `solve` | Fix it if it is small and reversible. If it is neither, stop and say so. |
+| `do` | Build it. Every detail not written down is yours to choose. |
+| `cheap` | Choose whatever needs the least looking after later, even if it is duller. |
+| `safe` | Take the conservative option. No new dependency, no new failure mode. |
+| `fast` | Ship the smallest thing that works. Note the debt you took on. |
+| `askme` | Read, plan, propose. **Change nothing** until they answer. |
+| `hold` | **Leave it alone.** It is on the board so it is not forgotten, not so it is done. |
+| absent | No instruction. Use judgement, and prefer the smaller move. |
+
+`explain`, `askme` and `hold` are refusals to act. Honour them exactly: doing
+the work anyway is worse than doing nothing, because it spends the owner's
+trust in the mechanism.
+
+**`checks`** — the definition of done, written in advance. Tick a step only
+when you have actually done it and can say how. A tick you cannot defend is a
+lie in a file the owner reads on a phone.
+
+**`risk`** — what it costs if it goes wrong, not how soon it is wanted. A
+high-risk card gets the safer approach even when its intent says `fast`.
+
+## Read the analysis before deciding anything
+
+`analysis.choices` holds the questions the owner has already answered, grouped
+by the four screens of the Analysis view — `board`, `project`, `strategy`,
+`market`. Each carries its options and a `value` naming the one chosen.
+
+**An answer there beats your judgement**, the same way a card's `intent` does.
+It was given once, deliberately, so it would not have to be given again on
+every card. Read them before picking an approach, and say which one you were
+following when it decided something.
+
+**`value: null` is not missing data.** It means the owner has deliberately not
+decided. Do not answer it for them, and do not act on the half of the work
+that depends on it: do everything that does not, and say plainly which
+question is holding the rest.
+
+**Adding a choice with `value: null` is how you ask a question** that outlives
+the conversation — the panel's bell surfaces every open one. Writing the
+question is yours to do. Answering it is not: never write `value`, `decidedAt`
+or `decidedBy` yourself. Those are the panel's stamps for a tap the owner
+made, and a decision you recorded on their behalf is a decision nobody made.
+
+## Moving a card is a claim
+
+**Into the active column when you start it, not when you plan to.** The board
+stamps `startedAt` the moment it lands there, and that stamp is the evidence
+the work was picked up.
+
+**Into the done column only when the work is finished and you have checked it
+does what the card says.** Merged is not finished if the thing it enables was
+never exercised once. In that case the card stays where it is with a note
+saying exactly what is shipped and what is unverified — or the verification
+becomes a card in the owner's column, when only they can do it.
+
+A card carrying `completedAt` with no `startedAt` was declared finished
+without ever being picked up, and the panel marks it. Never create that shape.
+
+## Writing back
+
+The board is a conversation. Leave it saying what happened:
+
+- Tick the `checks` you completed.
+- Move a finished card to done; move one you started to the active column.
+- **Clear `order` when the order is carried out** — leaving it set means the
+  next session does it again.
+- Add a note with `by: "claude"` and the date.
+- Never delete a card. An empty untitled card is a stray tap; leave it.
+- **Append one entry to `runs`**: the date, `by: "claude"`, a summary of what
+  the pass actually did, and the ids of the cards it touched. That list is the
+  account the owner reads instead of taking the claim on trust, so name only
+  cards you really changed.
+
+Then commit the board with the rest of the change, so the card that moved to
+done sits in the same diff as the work that finished it.
+
+## The theme the panel may ask you for
+
+If the board carries `importedTheme`, it is a theme derived from *this*
+project, stored with where it came from: `from.files`, `from.colours` and
+`from.reasoning`. That provenance is not decoration — it is what makes
+deriving it again a comparison rather than a coin toss.
+
+`refreshRequested` is a date the owner tapped. It is a message to you, because
+the panel cannot run anything: read the files it names again, map what you find
+onto the tokens, write the new `tokens`, `form` and `from`, set `importedAt`
+to today, and clear `refreshRequested` back to `null`. Say in `from.reasoning`
+what changed and why, in a sentence or two. Leaving the request set means the
+next session does it all over again.
+
+Never invent a palette. If the project has no colours of its own, say so and
+leave the theme alone — the kit ships presets for exactly that case, and one
+of them is a light theme.
+
+## When the board will not open
+
+Run `npx paneltir board`. It reads the file and names every problem by
+location — `cards[3].column: "in-progress" is not one of the board's columns`
+— which is the difference between a fix and a hunt. The same check runs on
+every save, so a broken board almost always got that way from a hand edit
+rather than from the panel.
+
+Nothing repairs it for you, deliberately: a board quietly corrected is a board
+whose owner never learns what changed. The file is in git, so `git diff` shows
+it, and `git revert` undoes it.
+
+## Two things never to do
+
+- **Never edit anything inside `node_modules/paneltir`.** Not even when asked
+  to "change the dashboard": that phrasing almost always means the content or
+  the data, not the library. A change to the kit itself belongs upstream and
+  arrives here as a new version.
+- **Never put a secret in the board.** Passwords and tokens live in the
+  hosting environment. The board is a file in the repository, with a diff and
+  a history, and everything written into it stays there.

package/template/api/login.ts

@@ -0,0 +1,63 @@
+/**
+ * Exchanges this project's panel password for a session cookie.
+ *
+ * COPIED FROM PANELTIR, AND NOW YOURS.
+ *
+ * This is the only route that accepts the password, and it is reachable
+ * without a session — signing in cannot require being signed in. It answers
+ * with the same message and the same shape whether the password was wrong or
+ * the account name was, so a caller learns only "not this".
+ */
+import { env, issueToken, safeEqual, sessionCookie } from '../lib/session'
+
+export const config = { runtime: 'edge' }
+
+/** Always the same wording, whatever was wrong about the attempt. */
+function rejected(): Response {
+  return new Response(JSON.stringify({ error: 'That password is not right.' }), {
+    status: 401,
+    headers: { 'content-type': 'application/json', 'Cache-Control': 'no-store' },
+  })
+}
+
+export default async function handler(request: Request): Promise<Response> {
+  if (request.method !== 'POST') {
+    return new Response(JSON.stringify({ error: 'Use POST.' }), {
+      status: 405,
+      headers: { 'content-type': 'application/json', Allow: 'POST', 'Cache-Control': 'no-store' },
+    })
+  }
+
+  const expected = env('ADMIN_PASSWORD')
+  if (!expected) {
+    return new Response(JSON.stringify({ error: 'The panel is not configured yet.' }), {
+      status: 503,
+      headers: { 'content-type': 'application/json', 'Cache-Control': 'no-store' },
+    })
+  }
+
+  let password = ''
+  try {
+    const body = (await request.json()) as { password?: unknown }
+    if (typeof body?.password === 'string') password = body.password
+  } catch {
+    return rejected()
+  }
+
+  // Runs even for an empty password, so the timing does not separate
+  // "nothing sent" from "wrong password".
+  if (!safeEqual(password, expected)) return rejected()
+
+  const token = await issueToken()
+  if (!token) return rejected()
+
+  const secure = new URL(request.url).protocol === 'https:'
+  return new Response(JSON.stringify({ ok: true }), {
+    status: 200,
+    headers: {
+      'content-type': 'application/json',
+      'set-cookie': sessionCookie(token, { secure }),
+      'Cache-Control': 'no-store',
+    },
+  })
+}

package/template/api/logout.ts

@@ -0,0 +1,31 @@
+/**
+ * Ends the session by expiring the cookie.
+ *
+ * COPIED FROM PANELTIR, AND NOW YOURS.
+ *
+ * It answers the same way whether there was a session or not: there is
+ * nothing to report, and nothing to protect, in being told you were already
+ * signed out.
+ */
+import { clearedCookie } from '../lib/session'
+
+export const config = { runtime: 'edge' }
+
+export default async function handler(request: Request): Promise<Response> {
+  if (request.method !== 'POST') {
+    return new Response(JSON.stringify({ error: 'Use POST.' }), {
+      status: 405,
+      headers: { 'content-type': 'application/json', Allow: 'POST', 'Cache-Control': 'no-store' },
+    })
+  }
+
+  const secure = new URL(request.url).protocol === 'https:'
+  return new Response(JSON.stringify({ ok: true }), {
+    status: 200,
+    headers: {
+      'content-type': 'application/json',
+      'set-cookie': clearedCookie({ secure }),
+      'Cache-Control': 'no-store',
+    },
+  })
+}