composeui 0.1.0__tar.gz

composeui-0.1.0/.gitignore

@@ -0,0 +1,20 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv
+
+# coverage
+*.coverage
+
+*.pipe
+# downloaded by `make css`, not committed
+css/vendor/
+
+# built by `make docs`
+docs/_build/

composeui-0.1.0/.python-version

@@ -0,0 +1 @@
+3.9

composeui-0.1.0/AGENTS.md

@@ -0,0 +1,206 @@
+# AGENTS.md
+
+ComposeUI is a small, framework-agnostic MVVM layer for building UIs in Python. Views are
+typed `attrs` classes; a `Renderer` binds each view to a toolkit widget; `Signal` objects
+carry events between view, model and application code. See `README.md` for the overview and
+quickstart, `docs/user-guide/` for each feature, `docs/examples-guide.md` for the example apps, and
+`docs/technical-guide.md` for the architecture and development.
+
+## Setup
+
+- Package manager: [uv](https://docs.astral.sh/uv/). Python `>=3.9` (`.python-version` pins 3.9).
+- Install everything needed for development:
+
+  ```bash
+  uv sync --group dev --all-extras   # extras: pyside6, tui (Textual), web (Starlette), report, reload, dataframe
+  ```
+
+- Always run tools through `uv run` (or the `make` targets below), never a global Python.
+
+## Commands
+
+```bash
+make lint    # ruff format + ruff check --fix
+make mypy    # mypy on composeui, examples and tests, Qt binding resolved to PySide6
+make typecheck  # mypy on source + tests; Pyright, Pyrefly and ty on tests
+make pyright pyrefly ty  # individual test checkers
+make zuban   # optional test checker; currently reports known incompatibilities
+make test    # pytest tests in parallel, Qt offscreen, with coverage (browser tests excluded)
+make browser-test  # the web backend in headless Chromium (tests/test_browser.py, Playwright)
+make translations  # each app's catalogs against the text it translates (TRANSLATED_MAIN_VIEWS)
+make check   # lint + mypy + translations
+make all     # clean + check + test
+make css     # rebuild webcore/static/app.css after changing classes in webcore (commit it)
+make web-deps  # htmx, uPlot, Cally and deck.gl from npm at pinned versions and SHA-256 (commit them)
+make docs    # Sphinx + MyST site in docs/_build/html, warnings as errors (needs `--group docs`)
+make screenshots   # docs/images/<example>-<backend>.png for the docs and README (Chromium)
+```
+
+On Windows without `make`, run the same targets in PowerShell with `make.ps1`
+(`.\make.ps1 check test`; `-Examples pipeform, batman` for `EXAMPLES`, `-TailwindPlatform`
+for `TAILWIND_PLATFORM`). Keep it in step with the `Makefile`, including its
+`$TranslatedMainViews` list (`TRANSLATED_MAIN_VIEWS`).
+
+`make mypy` checks source, examples and tests together. It installs the `browser` group and
+all extras so every test import resolves; Chromium is not needed. The other checker targets
+also install the `typecheck` group. The same targets are available in `make.ps1`.
+Zuban is excluded from the aggregate target and retains its nonzero exit status when
+diagnostics remain.
+
+Run a single test file or test:
+
+```bash
+QT_QPA_PLATFORM=offscreen uv run pytest tests/test_qtrenderer.py -k combobox
+```
+
+`QT_QPA_PLATFORM=offscreen` is required for Qt tests in a headless environment (CI, WSL,
+agents). Run the examples with `uv run python -m examples.pipeform --backend qt` (or
+`textual`, or `web`) or `uv run python -m examples.textual_demo` (Textual).
+
+## Project layout
+
+```
+src/composeui/
+  core/          # toolkit-agnostic: views, signals, renderer base, application, registry
+  qtcore/        # Qt backend via qtpy (QtApplication, qtrenderer.py, custom widgets/)
+  textualcore/   # Textual (TUI) backend
+  webcore/       # Web backend (Starlette + htmx + daisyUI); static/app.css is built
+css/             # source of webcore/static/app.css (`make css`; tools land in css/vendor/)
+src/examples/    # example apps (pipeform.py, pipecatalogue.py, ...), also used by tests; not in the wheel
+tests/           # pytest suite (pytest-qt, pytest-asyncio, Textual run_test pilot)
+docs/            # user guide, examples guide, technical guide; Sphinx site (conf.py, api/, _ext/)
+```
+
+## Architecture rules
+
+- **`composeui.core` must never import a backend** (Qt, Textual, Starlette) at import time.
+  Backends are resolved lazily through `composeui.core.registry`.
+- **Backend registration:** each `RendererType` member's value is a `Backend`: the dotted
+  paths of the backend's renderers module, exposing a
+  `RENDERERS: dict[str, Callable[[Any], Renderer]]` mapping, and of its application module,
+  exposing `APPLICATION` and `MODEL_APPLICATION` (what `core.application.run` starts),
+  plus the extra that installs its dependencies and their top-level modules (`run` names
+  the extra when one is missing). A view picks its renderer by its `_renderer_key` class variable. A backend that doesn't
+  register a key simply doesn't render that view (returns `None`), so partial backends are
+  fine.
+- **Adding a widget:** define the view in `core/view.py` (set `_renderer_key`), then add a
+  renderer + `RENDERERS` entry in each backend that should support it, plus tests per backend.
+- **Adding a backend:** add one `RendererType` member in `core/registry.py` (with its extra
+  in `pyproject.toml`), one
+  `RENDERERS` mapping in the new backend's renderers module, and its application classes
+  (built from `build_main_view=`, plus `build_model=`/`setup_model=` for the model one) as
+  `APPLICATION`/`MODEL_APPLICATION`. `core/view.py` should not need changes.
+- **Renderer contract:** implement `render`, `refresh_attribute` and the
+  `_refresh_dispatcher` (one handler per view attribute the renderer cares about; a missing
+  handler raises `MissingRefreshAttributeFunctionError`). The user's changes reach the view
+  from the widget's signals, set inside `stop_refresh()`.
+- Views are reactive: setting a view attribute pushes the change to its renderer. Don't add
+  manual `update()`/`refresh()` calls.
+- `Signal.connect` injects `main_view` and `model`, and `Application.connect` also `view`, as
+  keyword arguments based on the callback's parameter names; keep those names exact.
+- View state is (de)serialized with `cattrs` (`MainView.save_state` / `load_state`); new view
+  fields must remain serializable, or be excluded like `Signal`/`Renderer`/`Validator` fields.
+
+## Code style
+
+- `ruff` with `select = ["ALL"]` and line length 100; see `pyproject.toml` for the ignore list.
+  Fix lint properly rather than adding `noqa`, unless it is clearly justified.
+- `mypy` must pass. Fully type-annotate new code; the package ships `py.typed`.
+- Every Python module starts with `from __future__ import annotations` (after its docstring).
+  Ruff enforces it (`required-imports`, rule I002) and `make lint` adds it to a new file.
+  Annotations are then strings, so: don't quote them; define views that `attrs`/`cattrs`
+  resolve (`attrs.resolve_types`) at module level, not inside a function, so their field
+  types resolve from the module globals; and give `cattrs` hooks their type explicitly
+  (`CONVERTER.register_structure_hook(cls, func)`) rather than as a bare decorator, which
+  reads the annotation.
+- Stay compatible with Python 3.9: use `Optional[...]`/`Union[...]`, not `X | Y`, in
+  annotations that `attrs`/`cattrs` evaluate at runtime (view fields), since `X | Y` fails
+  there on 3.9 (ruff's `keep-runtime-typing` stops pyupgrade from rewriting them).
+- Use `qtpy` imports, never `PySide6`/`PyQt*` directly, in `qtcore`.
+- In `webcore`, build HTML with `Markup(template).format(...)`, never an f-string: it
+  escapes every value (see the `web-security` skill).
+- Put imports only needed for typing under `if TYPE_CHECKING:`.
+- The public API is the `__all__` of each `composeui.core` module: the API reference shows
+  only it, and `tests/test_docs.py` checks that the docs and examples import nothing else.
+  Add a name that apps use to it. The other names, also those the backends import, can
+  change in any release.
+- Match the existing comment density: brief docstrings, comments explain *why*.
+
+## Permission for documentation and tests
+
+- Ask the user for explicit permission before creating, editing, moving, or deleting
+  documentation or tests.
+- Permission to implement a feature or fix a bug does not authorize documentation or test
+  changes. Ask first when those changes are needed by the rules below.
+
+## Testing
+
+- Every behavior change needs a test in `tests/`. Backend tests should exercise real rendered
+  widgets (`qtbot` for Qt, `App.run_test()` for Textual, `httpx`/Starlette test client for web).
+- Tests for optional backends guard with `pytest.importorskip(...)`.
+- `make test` runs the tests in parallel, a worker per CPU (pytest-xdist): a test must not
+  depend on another's state or order. Without `-n`, `pytest` runs them one after another.
+- What only a browser shows (the page's scripts, htmx swaps) goes in `tests/test_browser.py`,
+  marked `browser`. It needs the `browser` group and a Chromium:
+  `uv run --group browser playwright install chromium` once, then `make browser-test`.
+- `make test` fails below 100% coverage of lines and branches (`fail_under` in
+  `pyproject.toml`, child processes included). A new line comes with its test, or with a
+  `# pragma: no cover` that says why no test reaches it. A line only POSIX runs gets a
+  `# posix only` comment, which coverage leaves out on Windows (`make.ps1`).
+- `make check test` must be clean before committing; CI (`.github/workflows/ci.yml`) runs the
+  same checks on Python 3.9 to 3.14 for every pull request and push to `main`, and the tests
+  on Windows (`.\make.ps1 translations test`) and macOS (`make translations test`), on
+  Python 3.9 and 3.14. A change of
+  the documentation only (`docs/`, Markdown files) runs only the docs build and its lint.
+  The existing mypy matrix also checks tests. Separate CI jobs run Pyright, Pyrefly and ty
+  on tests on Python 3.9. Zuban runs in an additional non-blocking job while its known
+  incompatibilities remain.
+
+## Documentation
+
+Load the `documentation-style` skill before you write or review documentation: `README.md`,
+`docs/`, docstrings, `ROADMAP.md`, this file, or a skill. It holds the writing rules, which
+document owns what, and the checks.
+
+- **Change the docs in the commit that changes the behavior.** A change that users see gets
+  a line under "Unreleased" in `CHANGELOG.md`. A new view gets a section
+  in its page of `docs/user-guide/` and a class docstring, which the widget catalog shows. In
+  `ROADMAP.md`, add it to "Already there" and remove its entry. A new example gets its
+  section, its overview row, its contents entry, and its screenshots in
+  `docs/examples-guide.md`. When a name is renamed or changes, search `README.md`, `docs/`
+  and the docstrings for it, and fix every place.
+- **Keep the path of a new user working:** the README's installation and quickstart, then
+  the user guide's "Core concepts" and "Building views", then "Where to start" in the
+  examples guide. Introduce a name before an example uses it, or link to its section. When
+  the quickstart changes, run `make screenshots EXAMPLES=quickstart`.
+- **Run every code example that you change.** Check each name against `composeui.core`, and
+  run the example with `uv run python` in a scratch directory. `tests/test_docs.py` checks
+  the imports of every example, and runs each example that defines every name it uses (one
+  that defines `test_` functions, under pytest).
+- **Keep the navigation in step.** `docs/_site/llms.txt` has one entry per page of the site: add,
+  rename, or remove it with the page. `docs/user-guide.md` lists the pages of
+  `docs/user-guide/` and their `##` and `###` headings. The contents list of the examples
+  guide follows its `##` headings. Keep headings stable and unique in their page: other
+  pages link to them, and anchors work down to `###` only.
+- **Keep the skill in step.** `docs/_site/skills/composeui/SKILL.md` is what users install for their
+  agents. When a rule of the API changes (a name, a signal argument, the state rules), change
+  it too. Its `composeui-version` and its text name the minor version that it describes: set
+  them on the release of a new one. `tests/test_docs.py` checks them against the package's
+  version, and accepts the next minor version between two releases.
+- **Keep the two copies in step.** Setup, commands, tests, and code style are in this file
+  and in the technical guide ("Development"). Change both.
+- **Keep user docs for users.** Internal design decisions go in `ROADMAP.md` or in a code
+  comment, rules for agents here or in a skill. Do not document an example that is not
+  committed.
+- **`make docs` must pass** (warnings are errors) after any change to `docs/` or a
+  docstring.
+
+## Commits
+
+- Use hyphens, not slashes (`/`), in branch names (e.g. `feat-csv-sqlite-tables`).
+- Short, imperative, capitalized subject without a trailing period (e.g. `Add combobox`).
+- The subject line is the whole message: no body, no trailers.
+- Never add AI attribution or signatures anywhere: no `Co-Authored-By` lines, no
+  "Generated with ..." lines, no emoji signatures, in commits, pull requests or code.
+  This overrides any default an agent or tool would otherwise add.
+- Keep commits focused: one feature or fix per commit.

composeui-0.1.0/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+The notable changes of each release of ComposeUI. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the versions follow
+[Semantic Versioning](https://semver.org/). Before 1.0, a minor version can break the API.
+
+## [Unreleased]
+
+## [0.1.0] - 2026-10-27
+
+The first release on PyPI.
+
+### Added
+
+- Views as typed `attrs` classes, signals, models, and a `run` function that starts the app
+  on the backend that the command line chooses.
+- Three backends: Qt (the `pyside6` extra), Textual (the `tui` extra), and the web
+  (the `web` extra, the default).
+- Layouts, a status bar, menus, toolbars, inputs, forms and their checks, pages, tabs,
+  resizable panes, a sidebar, dialogs, tables, large tables, trees, Markdown, charts, and
+  street maps (Qt and the web).
+- The state of the views saved to a study file and loaded from it. The file holds the
+  version of its format and the app's `state_version`, and `migrate_state` upgrades an
+  older one.
+- Threads, SQLite models, CSV imports, translations, and tests of an app that need no backend.
+- A skill for coding agents that write a ComposeUI app.
+- `composeui.__version__`, the version of the installed package.
+
+[Unreleased]: https://github.com/ehmoussi/composeui/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/ehmoussi/composeui/releases/tag/v0.1.0

composeui-0.1.0/LICENSE

@@ -0,0 +1,9 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 El Hadi Moussi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

composeui-0.1.0/MANIFEST.in

@@ -0,0 +1,7 @@
+# The sdist builds the package and runs its tests. The screenshots of the docs, the lock
+# file and the agents' and CI's files stay in the repository.
+prune docs/images
+prune .agents
+prune .claude
+prune .github
+exclude uv.lock

composeui-0.1.0/Makefile

@@ -0,0 +1,206 @@
+.PHONY: format
+format:
+	uv run ruff format
+
+.PHONY: check
+check:
+	uv run ruff check
+
+.PHONY: check_fix
+check_fix:
+	uv run ruff check --fix
+
+.PHONY: lint
+lint: format check_fix
+	
+.PHONY: mypy
+mypy:
+	uv run --locked --group browser --all-extras mypy \
+		--config-file pyproject.toml \
+		--package composeui \
+		--package examples \
+		--package tests \
+		--always-false=PYQT5 \
+		--always-false=PYSIDE2 \
+		--always-false=PYQT6 \
+		--always-true=PYSIDE6 \
+		--show-traceback
+
+# Tests import every backend and Playwright; static checks need their packages, not Chromium.
+TYPECHECK_RUN = uv run --locked --group typecheck --group browser --all-extras
+
+.PHONY: typecheck pyright pyrefly ty zuban
+typecheck: mypy pyright pyrefly ty
+
+pyright:
+	$(TYPECHECK_RUN) pyright
+
+pyrefly:
+	$(TYPECHECK_RUN) pyrefly check
+
+ty:
+	$(TYPECHECK_RUN) ty check
+
+# Keep its nonzero exit visible locally; CI runs Zuban as a non-blocking job.
+zuban:
+	$(TYPECHECK_RUN) zuban mypy tests
+
+# the main views of the apps with catalogs, as module:Class
+TRANSLATED_MAIN_VIEWS := examples.pipeform:PipeMainView \
+	examples.pipesweep:PipeSweepMainView \
+	examples.taskview:TaskMainView
+
+# every catalog against the text its app translates; each app reported before failing
+.PHONY: translations
+translations:
+	@status=0; for main_view in $(TRANSLATED_MAIN_VIEWS); do \
+		uv run python -m composeui.core.translationcheck $$main_view || status=1; \
+	done; exit $$status
+
+.PHONY: check
+check: lint mypy translations
+
+.PHONY: test
+# in parallel, a worker per CPU (pytest-xdist)
+test:
+	QT_QPA_PLATFORM=offscreen uv run pytest tests -m "not browser" -n auto --cov=src --cov-report=term-missing:skip-covered
+
+# the web backend in headless Chromium; skipped unless Chromium is installed:
+# uv run --group browser playwright install chromium
+# No pytest-qt: it refuses to start without a Qt binding, which these tests don't need.
+.PHONY: browser-test
+browser-test:
+	uv run --group browser pytest tests/test_browser.py -m browser -p no:pytest-qt
+
+# the documentation site (Sphinx + MyST): the guides, the widget catalog and the API
+# reference, in docs/_build/html; any warning fails it. The API reference imports every
+# backend's application module: run `uv sync --group docs --all-extras` first.
+.PHONY: docs
+docs:
+	uv run --group docs sphinx-build -W --keep-going -b html docs docs/_build/html
+
+# the screenshots of the examples guide, on every backend, into docs/images/; needs the
+# browser group's Chromium (see browser-test). Pass names to take only some of them:
+# make screenshots EXAMPLES="pipeform batman"
+.PHONY: screenshots
+screenshots:
+	QT_QPA_PLATFORM=offscreen uv run --group browser python docs/screenshots.py $(EXAMPLES)
+
+# Tailwind's standalone CLI and daisyUI's plugin files: no Node/npm needed. Downloaded
+# once into css/vendor/ (not committed); the built static/app.css is committed.
+TAILWIND_VERSION := 4.3.3
+DAISYUI_VERSION := 5.7.47
+CSS_VENDOR := css/vendor
+# Tailwind's release names for this machine: linux, macos or windows (Git Bash, MSYS2 or
+# Cygwin report MINGW64_NT-..., MSYS_NT-..., CYGWIN_NT-...), then x64 or arm64. Override
+# it for another build, e.g. `make css TAILWIND_PLATFORM=linux-x64-musl` on Alpine.
+TAILWIND_PLATFORMS := linux-x64 linux-arm64 macos-x64 macos-arm64 linux-x64-musl \
+	linux-arm64-musl windows-x64
+TAILWIND_PLATFORM ?= $(shell uname -s | sed -e 's/^Linux$$/linux/' -e 's/^Darwin$$/macos/' \
+	-e 's/^MINGW.*/windows/' -e 's/^MSYS.*/windows/' -e 's/^CYGWIN.*/windows/')-$(shell uname -m | sed -e 's/^x86_64$$/x64/' \
+	-e 's/^aarch64$$/arm64/')
+# Windows only runs it as an .exe
+TAILWIND_SUFFIX := $(if $(filter windows-%,$(TAILWIND_PLATFORM)),.exe)
+# the platform in the name: a checkout shared between machines keeps one binary for each
+TAILWIND := $(CSS_VENDOR)/tailwindcss-$(TAILWIND_VERSION)-$(TAILWIND_PLATFORM)$(TAILWIND_SUFFIX)
+DAISYUI := $(CSS_VENDOR)/daisyui.mjs
+DAISYUI_THEME := $(CSS_VENDOR)/daisyui-theme.mjs
+# the SHA-256 of each download, from Tailwind's sha256sums.txt and the digests of daisyUI's
+# release assets: change them with the versions
+TAILWIND_SHA256_linux-x64 := dc61b3ac6b8c9ca874c0cc4c57b2409791a64c5540404ca5f5367360babc313a
+TAILWIND_SHA256_linux-arm64 := 55fd0b241214eff3de1e8ee4f22796662f2d2e7a49bcfca7477cfd0bac398195
+TAILWIND_SHA256_macos-x64 := 7922e0953f2110c05976e3bf58f14e643d90427575e766b7d433f5f80cbee7e1
+TAILWIND_SHA256_macos-arm64 := cdf646702987a743464dff4d9c60fd4480d1c1e73dd819a9a67f1078815dce9d
+TAILWIND_SHA256_linux-x64-musl := a04d34ceacc8f52cbe8920ad846cdeb61d3d0021dba32db0d1f77c9d9fad7a6c
+TAILWIND_SHA256_linux-arm64-musl := 71ea4be79c9de9827545682df3e040053fb535d37c71ed2cfdedf9385a0868e0
+TAILWIND_SHA256_windows-x64 := e0e260ce048014e9268f6237ff18f8ccf02cef521cbd0ae04e82c2cdf7aa3955
+TAILWIND_SHA256 := $(TAILWIND_SHA256_$(TAILWIND_PLATFORM))
+DAISYUI_SHA256 := 85819d3fe86a852237b439b13f481481aac58e562ac47694cd11c3038e994f2a
+DAISYUI_THEME_SHA256 := d92d2f488933dab757f046e81ebd4986e51e9423307798dc3545d09a15542c89
+# macOS before 15 has shasum, not sha256sum
+SHA256SUM := $(shell command -v sha256sum >/dev/null 2>&1 && echo sha256sum || echo shasum -a 256)
+# download URL $(1) into file $(2), kept only when its SHA-256 is $(3)
+fetch = mkdir -p $(dir $(2)) && curl -sSfL -o $(2).tmp $(1) \
+	&& { echo "$(3)  $(2).tmp" | $(SHA256SUM) -c || { rm -f $(2).tmp; exit 1; }; } \
+	&& mv $(2).tmp $(2)
+
+$(TAILWIND):
+	$(if $(filter $(TAILWIND_PLATFORM),$(TAILWIND_PLATFORMS)),,\
+		$(error No Tailwind binary for '$(TAILWIND_PLATFORM)': pass one of \
+		$(TAILWIND_PLATFORMS) as TAILWIND_PLATFORM))
+	$(call fetch,https://github.com/tailwindlabs/tailwindcss/releases/download/v$(TAILWIND_VERSION)/tailwindcss-$(TAILWIND_PLATFORM)$(TAILWIND_SUFFIX),$@,$(TAILWIND_SHA256))
+	chmod +x $@
+
+$(DAISYUI):
+	$(call fetch,https://github.com/saadeghi/daisyui/releases/download/v$(DAISYUI_VERSION)/daisyui.mjs,$@,$(DAISYUI_SHA256))
+
+$(DAISYUI_THEME):
+	$(call fetch,https://github.com/saadeghi/daisyui/releases/download/v$(DAISYUI_VERSION)/daisyui-theme.mjs,$@,$(DAISYUI_THEME_SHA256))
+
+# the files already there are checked too: they can be from an older version, or have
+# changed since
+.PHONY: css
+css: $(TAILWIND) $(DAISYUI) $(DAISYUI_THEME)
+	@printf '%s  %s\n' $(TAILWIND_SHA256) $(TAILWIND) $(DAISYUI_SHA256) $(DAISYUI) \
+		$(DAISYUI_THEME_SHA256) $(DAISYUI_THEME) | $(SHA256SUM) -c \
+		|| { echo "Delete $(CSS_VENDOR)/ to download them again"; exit 1; }
+	$(TAILWIND) -i css/app.css -o src/composeui/webcore/static/app.css --minify
+
+# the web page's scripts from npm, through unpkg, and uPlot's stylesheet, which app.css
+# imports: committed, so the package needs no download. Change a version and its SHA-256,
+# run `make web-deps css`, and commit the files.
+STATIC := src/composeui/webcore/static
+HTMX_VERSION := 2.0.10
+UPLOT_VERSION := 1.6.32
+CALLY_VERSION := 0.9.2
+DECKGL_VERSION := 9.2.6
+DECKGL_SHA256 := 234e0af97a691b8e5aea6c6ca9e703a7ba5206fd1f53daa9f670e41db089de2d
+DECKGL_LICENSE_SHA256 := e499a2c2ba3b9faabe91fdfddf43e329439263264b7148e5548d0ec605cce9f2
+HTMX_SHA256 := 71ea67185bfa8c98c39d31717c6fce5d852370fcdfd129db4543774d3145c0de
+UPLOT_SHA256 := 19c8d4c6ad88929a79f4ae49d6f7161566dfd0ba3d15cc495e974f787eb78f1f
+UPLOT_CSS_SHA256 := df630c6a8d6f8eeaff264b50f73ce5b114f646ffd9a0bb74f049b0a00135fa04
+CALLY_SHA256 := 4dcba6a3b8ec63b66ff2fbfc6cf47b7dee1eb4896eac89fe7487d82e28e15870
+CALLY_LICENSE_SHA256 := c48fd407090d6d752b0370d39db55bd750e6dfc678ee252d4c906bddf54132eb
+UPLOT_LICENSE_SHA256 := 8f989229699b4fe2f1a0432d0e9edc338a8a911e250e2d1b01ecd770a5f5b1bd
+# daisyUI's classes are built into app.css (`make css`); its license ships beside it
+DAISYUI_LICENSE_SHA256 := 8709e3ac65c84637c422dc8082b893d9997fce093751c77b2f1983bf29dbf9ea
+
+# Cally's file has no license comment: it gets Cally's LICENSE as one; uPlot's has only its
+# address, and its LICENSE goes beside it
+.PHONY: web-deps
+web-deps:
+	$(call fetch,https://unpkg.com/deck.gl@$(DECKGL_VERSION)/dist.min.js,$(STATIC)/deckgl.min.js,$(DECKGL_SHA256))
+	$(call fetch,https://unpkg.com/deck.gl@$(DECKGL_VERSION)/LICENSE,$(STATIC)/deckgl.LICENSE,$(DECKGL_LICENSE_SHA256))
+	$(call fetch,https://unpkg.com/htmx.org@$(HTMX_VERSION)/dist/htmx.min.js,$(STATIC)/htmx.min.js,$(HTMX_SHA256))
+	$(call fetch,https://unpkg.com/uplot@$(UPLOT_VERSION)/dist/uPlot.iife.min.js,$(STATIC)/uPlot.iife.min.js,$(UPLOT_SHA256))
+	$(call fetch,https://unpkg.com/uplot@$(UPLOT_VERSION)/LICENSE,$(STATIC)/uPlot.LICENSE,$(UPLOT_LICENSE_SHA256))
+	$(call fetch,https://unpkg.com/uplot@$(UPLOT_VERSION)/dist/uPlot.min.css,css/uPlot.min.css,$(UPLOT_CSS_SHA256))
+	$(call fetch,https://unpkg.com/daisyui@$(DAISYUI_VERSION)/LICENSE,$(STATIC)/daisyui.LICENSE,$(DAISYUI_LICENSE_SHA256))
+	$(call fetch,https://unpkg.com/cally@$(CALLY_VERSION)/dist/cally.js,$(STATIC)/cally.dist.js,$(CALLY_SHA256))
+	$(call fetch,https://unpkg.com/cally@$(CALLY_VERSION)/LICENSE,$(STATIC)/cally.LICENSE,$(CALLY_LICENSE_SHA256))
+	{ echo '/*! https://github.com/WickyNilliams/cally (v$(CALLY_VERSION)), its dependency atomico bundled in'; \
+		sed -e 's/^/ * /' -e 's/ *$$//' $(STATIC)/cally.LICENSE; echo ' */'; \
+		cat $(STATIC)/cally.dist.js; } > $(STATIC)/cally.js
+	rm -f $(STATIC)/cally.dist.js $(STATIC)/cally.LICENSE
+
+.PHONY: clean
+clean:
+	rm -rf `find . -name __pycache__`
+	rm -f `find . -type f -name '*.py[co]'`
+	rm -f `find . -type f -name '*~'`
+	rm -f `find . -type f -name '.*~'`
+	rm -rf .cache
+	rm -rf .pytest_cache
+	rm -rf .ruff_cache
+	rm -rf htmlcov
+	rm -rf *.egg-info
+	rm -f .coverage
+	rm -f .coverage.*
+	rm -rf build
+	rm -rf dist
+	rm -rf site
+	rm -rf docs/_build
+	rm -rf coverage.xml
+
+.PHONY: all
+all: clean check test