fuaran-ui 0.7.0__tar.gz

fuaran_ui-0.7.0/.gitattributes

@@ -0,0 +1,31 @@
+# Pin canonical text-file line endings to LF.
+#
+# `text=auto` lets git detect text vs. binary; `eol=lf` pins the
+# canonical in-repo line ending. On a Windows checkout, files stay LF
+# on disk (no autocrlf round-trip churn), eliminating the recurring
+# "LF will be replaced by CRLF the next time Git touches it" warnings
+# and phantom "modified" churn on tool-regenerated files.
+
+* text=auto eol=lf
+
+# Explicit binary types — git's auto-detection is usually correct
+# but spell out the common ones to be safe.
+*.png   binary
+*.jpg   binary
+*.jpeg  binary
+*.gif   binary
+*.ico   binary
+*.svg   binary
+*.dll   binary
+*.exe   binary
+*.pdb   binary
+*.nupkg binary
+*.snupkg binary
+*.zip   binary
+*.tar   binary
+*.gz    binary
+*.pdf   binary
+*.woff  binary
+*.woff2 binary
+*.ttf   binary
+*.eot   binary

fuaran_ui-0.7.0/.github/dependabot.yml

@@ -0,0 +1,21 @@
+# Dependabot — the other half of SHA-pinning a GitHub Action.
+#
+# A digest pin removes the "a moved tag silently changed the credential-bearing
+# code in my publish job" hazard, and replaces it with "the pin is now frozen at
+# whatever was current the day it was written". This config is what keeps the
+# second from becoming permanent: Dependabot proposes each bump as a reviewable
+# PR carrying the new digest and the release notes behind it, so an upgrade is a
+# decision somebody made rather than one that happened.
+#
+# Scope is `github-actions` only. The language ecosystems in this repository are
+# pinned and reviewed through their own lockfiles/props and are deliberately not
+# on Dependabot's schedule here.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: ci

fuaran_ui-0.7.0/.github/workflows/ci.yml

@@ -0,0 +1,231 @@
+# Build, test and wire-format conformance gate for the Python host.
+#
+# ── Layout ───────────────────────────────────────────────────────────────────
+# The conformance corpus is its own public repository. The test suite resolves
+# it as a SIBLING of this repo root (tests/_corpus.py walks to
+# `<container>/wire-format-fixtures`), so this repo is checked out into a
+# subdirectory and the corpus beside it:
+#
+#     $GITHUB_WORKSPACE/
+#     ├── fuaran-py/               ← this repo
+#     └── wire-format-fixtures/    ← the corpus (fuaran-ui/fuaran-ui-specification)
+#
+# The corpus repository is PUBLIC, so the checkout is anonymous — no token.
+#
+# ── Why the corpus assertion below is not optional ───────────────────────────
+# When the corpus is absent, tests/_corpus.py does NOT fail — it silently falls
+# back to the committed offline snapshot under conformance/corpus/. A layout
+# drift would therefore leave the suite certifying against a stale local copy of
+# the spec while the job stayed green, which is the one failure mode a
+# conformance gate must never have. The assertion turns that into a hard stop.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+env:
+  # ── QUARANTINE ──────────────────────────────────────────────────────────────────────────
+  # Cases that fail on a clean tree are excluded from the blocking gate here, so
+  # that a NEW regression is caught while known drift stays visible. An entry is
+  # not a judgement that a case is wrong — it is a record of known, understood,
+  # outstanding work, and the list SHRINKS TO EMPTY as the decoder catches up.
+  # Delete entries as they start passing; do not add to it to make a red build
+  # green without a root-cause note — a new failure here is the regression this
+  # gate exists to catch.
+  #
+  # EMPTY as of 2026-08-13: the Toggle/Now/Switch vocabulary landed
+  # (3ac3c87/8e9fac3), the offline corpus snapshot was re-synced (392abd6), and
+  # every formerly quarantined case passes against the current corpus —
+  # verified by the full suite at 1627 passed with zero deselections AND each
+  # former entry re-run by node ID (24 passed). The machinery stays armed; a
+  # future corpus advance repopulates the list the same way.
+  QUARANTINE: ""
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # 3.12 is the declared floor (pyproject requires-python); 3.13 stays as the
+        # workspace's own interpreter. Both must pass, or the floor is a claim.
+        python-version: ['3.12', '3.13']
+        # The `live-host` extra carries what `samples/fastapi-host/` needs to be
+        # TESTED. Both rows are needed and they prove different things: with the
+        # extra, `tests/test_fastapi_host.py` gates — the sample's credential
+        # containment is asserted rather than assumed; without it, the suite is
+        # proven to skip CLEANLY, which is what lets `fuaran-ui` claim to be
+        # dependency-light. Before this axis existed only the second arrangement
+        # ever ran, so the sample's tests skipped on every run in a green job.
+        extras: ['dev', 'dev,live-host']
+    name: "Test (py${{ matrix.python-version }}, ${{ matrix.extras }})"
+    defaults:
+      run:
+        working-directory: fuaran-py
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: fuaran-py
+
+      # Deliberately UNPINNED: the corpus is the shared conformance authority
+      # every host certifies against, and one current spec for all hosts is the
+      # point of giving it a single home. Pinning here would let this host drift
+      # from the spec without anything going red.
+      - name: Check out the wire-format conformance corpus
+        uses: actions/checkout@v4
+        with:
+          repository: fuaran-ui/fuaran-ui-specification
+          path: wire-format-fixtures
+          # Full history, because the drift step below measures the DISTANCE
+          # between the committed snapshot's recorded commit and this HEAD. The
+          # default depth of 1 holds HEAD and nothing else, under which that
+          # distance is unmeasurable — the check would report "unknown" on every
+          # run and the number the report exists to give would never appear.
+          fetch-depth: 0
+
+      - name: Assert the corpus is where the tests resolve it
+        run: test -f ../wire-format-fixtures/manifest.json
+
+      # ── The reference host, for the render-parity oracles ────────────────────
+      # The class-vocabulary parity lock and the reference-stylesheet byte-copy
+      # check read the F# reference host's own sources. Before this step those
+      # oracles SKIPPED here — this job was a single-host checkout, which is the
+      # one shape in which skipping is honest, and the note further down said so
+      # at length. Honest is not the same as useful: the drift they exist to
+      # catch was therefore visible only on a maintainer's workspace checkout,
+      # so a stale oracle looked valid everywhere a machine actually ran it, and
+      # the one that mattered had gone vacuous for months.
+      #
+      # Sparse: only the renderer projects are read (the vocabulary derivation
+      # globs `src/Fuaran.UI.Renderer*`, and the stylesheet lives under one of
+      # them), so the checkout stays small. The repo is PUBLIC — anonymous, no
+      # token — and deliberately UNPINNED, for the reason the corpus checkout
+      # above gives: pinning would let this host drift from the reference
+      # without anything going red.
+      - name: Check out the F# reference host (render-parity oracles)
+        uses: actions/checkout@v4
+        with:
+          repository: fuaran-ui/fuaran-dotnet
+          path: fuaran-dotnet
+          sparse-checkout: src/Fuaran.UI.Renderer*
+          sparse-checkout-cone-mode: false
+
+      - name: Assert the reference host is where the oracles resolve it
+        run: test -d ../fuaran-dotnet/src/Fuaran.UI.Renderer.Core
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      # Non-blocking, on every push: how far the committed offline snapshot
+      # (conformance/corpus/, and the authority commit it records in
+      # snapshot.json) has fallen behind the authority at HEAD.
+      #
+      # It is a WARN and not a gate on purpose. A snapshot lagging the authority
+      # is not by itself a defect — the suite certifies against the AUTHORITY
+      # here, so a lagging snapshot changes nothing about what this run proved,
+      # and reddening main for it would train people to ignore it. What it does
+      # is make the distance visible before the release gesture, where the same
+      # check IS a refusal (publish-pypi.yml). The first v0.1.0 tag failed its
+      # gated test_corpus_sync because the authority had moved twice after CI
+      # passed on that head, and nothing between the two runs said so.
+      #
+      # Needs no install: the check is standard library plus git.
+      - name: Corpus snapshot drift (reported, non-blocking)
+        continue-on-error: true
+        run: |
+          set +e
+          python conformance/sync_corpus.py --check 2>&1 | tee corpus-drift.log
+          status=${PIPESTATUS[0]}
+          {
+            echo "### Corpus snapshot vs the authority"
+            echo
+            echo '```'
+            cat corpus-drift.log
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+          exit $status
+
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[${{ matrix.extras }}]"
+
+      - name: Lint (ruff check)
+        run: python -m ruff check .
+
+      - name: Format check (ruff format)
+        run: python -m ruff format --check .
+
+      - name: Type check (mypy)
+        run: python -m mypy
+
+      # Print what this gate does NOT cover, on every run. A cap nobody can see
+      # reads as "covered everything".
+      - name: Report the conformance quarantine
+        run: |
+          if [ -n "$QUARANTINE" ]; then
+            echo "The blocking gate below EXCLUDES these known-failing cases:"
+            echo "$QUARANTINE" | tr ' ' '\n' | grep -v '^--deselect$' | sed 's/^/  - /'
+          else
+            echo "Quarantine EMPTY — the blocking gate covers the full conformance suite."
+          fi
+          echo
+          echo "ALSO NOT GATED HERE — inert rather than quarantined (see the skip"
+          echo "summary that -rs prints under each test run below):"
+          echo "  - NOTHING, on the reference-renderer parity axis, as of Phase 1654."
+          echo "    This job now checks the F# reference host out beside the corpus, so"
+          echo "    the class-vocabulary parity lock and the stylesheet byte-copy check"
+          echo "    GATE here rather than skipping. They used to skip, honestly and"
+          echo "    uselessly: this was a single-host checkout, which is the one shape in"
+          echo "    which skipping is right, and the consequence was that the oracle ran"
+          echo "    only on a maintainer's workspace checkout. It had been VACUOUS for"
+          echo "    months when that was finally measured — admitting every possible"
+          echo "    class through one over-broad prefix extracted from a doc comment —"
+          echo "    and no run anywhere would have said so."
+          echo "  - the FastAPI sample-host tests, on the rows that install [dev] ALONE."
+          echo "    fastapi is a sample-only dependency, so the skip there is honest and is"
+          echo "    itself the evidence that this package is dependency-light. The [dev,live-host]"
+          echo "    rows install it and those tests GATE — read the matrix row name to know"
+          echo "    which arrangement this run is."
+          {
+            echo "### Conformance quarantine (excluded from the blocking gate)"
+            echo
+            if [ -n "$QUARANTINE" ]; then
+              echo '```'
+              echo "$QUARANTINE" | tr ' ' '\n' | grep -v '^--deselect$'
+              echo '```'
+            else
+              echo "Empty — the blocking gate covers the full conformance suite."
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      # Non-blocking: runs the FULL suite so the size of the existing drift is
+      # measured on every run rather than inferred from the quarantine list.
+      - name: Conformance drift (reported, non-blocking)
+        continue-on-error: true
+        run: |
+          set +e
+          python -m pytest -q -rs > drift.log 2>&1
+          status=$?
+          tail -40 drift.log
+          {
+            echo "### Full suite, including quarantined cases (non-blocking)"
+            echo
+            echo '```'
+            grep -E '^[0-9]+ (failed|passed)|failed,|passed,' drift.log | tail -3
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+          exit 0
+
+      # THE GATE. Everything the suite currently passes, including every
+      # conformance case outside the quarantine above.
+      - name: Test (gated)
+        run: python -m pytest -q -rs $QUARANTINE

fuaran_ui-0.7.0/.github/workflows/publish-pypi-placeholder.yml

@@ -0,0 +1,91 @@
+# Publish the BARE-NAME PLACEHOLDER distribution `fuaran` to PyPI, via Trusted Publishing.
+#
+# This is not the host. The host is `fuaran-ui`, published by `publish-pypi.yml` from the same
+# repository on a `v*` tag. This workflow publishes `placeholder/` — a package that exports
+# nothing and never will — so the unqualified name `fuaran` cannot be taken by an unrelated
+# project and mistaken for the Python host. Same posture as the unscoped npm name `fuaran` and
+# the bare `fuaran` crate.
+#
+# Trigger: a `placeholder-v*` tag ONLY. That prefix is deliberate and load-bearing: the host's
+# workflow triggers on `v*`, which matches tags BEGINNING with `v`, so `placeholder-v0.0.0`
+# reaches this workflow and never that one. Do not "tidy" the prefix to `v*`.
+#
+# Prerequisites (one-time, on pypi.org, operator only): register a PENDING PUBLISHER for project
+# `fuaran` — owner `fuaran-ui`, repository `fuaran-py`, workflow `publish-pypi-placeholder.yml`,
+# environment `pypi`. It is a SEPARATE registration from the `fuaran-ui` one: a
+# trusted-publisher policy is scoped to a project name.
+#
+# PEP 541 tolerates a held name that points somewhere real and refuses an empty squat, so
+# `placeholder/README.md` is part of what makes this publishable rather than decoration — it
+# names the real distribution, the import, the repository and the docs.
+name: publish-pypi-placeholder
+
+on:
+  push:
+    tags: ["placeholder-v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: placeholder
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      # The tag must equal the placeholder's own version, for the reason the host's workflow
+      # states: a mistyped tag must not publish a mismatched release.
+      - name: Version gate — tag must equal placeholder/pyproject.toml
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME#placeholder-v}"
+          ver="$(python - <<'PY'
+          import tomllib
+          print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])
+          PY
+          )"
+          if [ "$tag" != "$ver" ]; then
+            echo "tag placeholder-v$tag does not match placeholder version $ver" >&2
+            exit 1
+          fi
+
+      # The only assertion worth making about this package: that it exports nothing. A
+      # placeholder that grew an API would be a different thing under the same held name.
+      - name: Assert the package is empty
+        run: |
+          set -euo pipefail
+          python -c "import sys; sys.path.insert(0, 'src'); import fuaran; assert fuaran.__all__ == [], fuaran.__all__"
+
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist-placeholder
+          path: placeholder/dist/
+          if-no-files-found: error
+
+  publish:
+    needs: [build]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist-placeholder
+          path: dist/
+      # SHA-pinned for the reason the host's workflow states: this step holds the OIDC-minted
+      # publishing identity, so a moved `release/v1` is credential-bearing code nobody reviewed.
+      # `skip-existing` is deliberately absent here too.
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

fuaran_ui-0.7.0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,203 @@
+# Publish fuaran-ui to PyPI on a version tag, via PyPI Trusted Publishing (OIDC — no stored token).
+#
+# THE PROJECT IS `fuaran-ui`; THE REPOSITORY IS STILL `fuaran-py`. Registry names carry the
+# domain and drop the language (`Fuaran.UI.*`, `@fuaran-ui/*`, the `fuaran-ui` crate,
+# `io.fuaran:fuaran-ui`), while repo names stay — `fuaran-ui/fuaran-py` is disambiguated by the
+# org, and renaming it would cost redirects, CI checkouts, corpus resolvers and `workspace.json`
+# for no consumer-visible gain.
+#
+# THE `fuaran-py` PROJECT ON PYPI IS LEFT EXACTLY AS IT STANDS (operator decision, 2026-09-10).
+# Its releases up to 0.5.0 remain downloadable and must remain so — a public demo page and three
+# CI workflows still install them by exact version. It is never re-tagged and never published to
+# again; there is no deprecation shim, because nothing has ever consumed it as a dependency.
+#
+# Trigger: a `v*` tag push only. A branch push reaches no publish job.
+# Prerequisites (one-time, on pypi.org): register a PENDING PUBLISHER for the NEW project —
+# project `fuaran-ui`, owner `fuaran-ui`, repository `fuaran-py`, workflow `publish-pypi.yml`,
+# environment `pypi` — then create the `pypi` environment on this repository. The registration
+# that named project `fuaran-py` does NOT carry over: a trusted-publisher policy is scoped to a
+# project name, so the first `fuaran-ui` tag fails at the OIDC exchange until the new pending
+# publisher exists. That is the right failure — loud, and before any artefact is uploaded.
+# The tag must equal the version in pyproject.toml; the gate below refuses otherwise, so a
+# mistyped tag never publishes a mismatched release.
+#
+# WHAT THIS WORKFLOW REFUSES TO PUBLISH, and why each refusal exists:
+#   * a tag whose version does not match pyproject.toml — the `build` job's version gate;
+#   * a tree whose suite is red — the `test` job below, which `publish` `needs`. Until it
+#     existed, a `v*` tag published whatever was at that commit having run no test, no lint
+#     and no type check: the ONLY gate on the released artefact was that it built. CI runs
+#     the same checks on a branch push, but a tag push is a different event on a different
+#     ref, so "CI was green on main" was never a statement about the tagged commit;
+#   * a version PyPI already serves — `skip-existing` is deliberately absent. With it, a
+#     re-tag of an already-published version exited 0 having uploaded nothing, so a release
+#     that silently did not happen was indistinguishable from one that did. Without it the
+#     run fails, by name, and the fix is to cut a new version.
+#   * a tree whose committed corpus snapshot is behind the authority — the `test` job's
+#     corpus-drift refusal, which runs FIRST and names both commits and the re-sync command.
+#     Both this workflow and CI check the corpus out at HEAD, so a snapshot that matched when
+#     CI passed can be behind it minutes later when the tag is cut; the first v0.1.0 tag failed
+#     that way, deep inside `test_corpus_sync`, and had to be withdrawn and re-cut. Refusing up
+#     front makes the failure read as what it is — a stale snapshot, not a broken host.
+#
+# ── THE STEP A RELEASE OFTEN NEEDS AND NOTHING ELSE ASKS FOR: the no-op re-sync ──────────
+#
+# The drift refusal above compares the authority COMMIT the snapshot records against the
+# authority's HEAD, and nothing else. It is deliberately not a payload diff: the authority is
+# a REPOSITORY, and a snapshot that cannot say which revision of it was copied cannot answer
+# "is this current" at all — only "do these bytes happen to match today's", which is a
+# different and weaker claim. `conformance/corpus/snapshot.json` is what carries the answer.
+#
+# The cost of that choice, which is real and lands on the person cutting a tag: a corpus
+# commit touching NO bundled fixture — a README edit, a doc pointer, a change under
+# `conformance/` or `dag/` or any path the sync does not copy — still moves the authority's
+# HEAD, so the recorded commit no longer equals it and this job refuses, with the snapshot's
+# payload byte-for-byte correct. The refusal is accurate ("your snapshot was taken from an
+# older revision") and reads as alarming ("the corpus moved and you did not adopt it").
+#
+# So the recipe is: BEFORE cutting a `v*` tag, run
+#
+#     python conformance/sync_corpus.py
+#
+# and commit whatever it writes — frequently `conformance/corpus/snapshot.json` alone. That
+# is a legitimate, expected commit and not a workaround; it is the snapshot recording which
+# revision of the authority it was last checked against. Run it even when you are confident
+# no fixture changed: confirming it costs one command, and discovering it costs a withdrawn
+# tag (the version cannot simply be re-tagged — `skip-existing` is absent above, on purpose).
+#
+# Do NOT "fix" this by making `--check` diff the payload instead. That would report a stale
+# snapshot as current whenever the authority's change happened to miss the copied set, which
+# is precisely the state a release must not be able to enter unknowingly.
+name: publish-pypi
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  # The gate on the TAGGED tree. Mirrors ci.yml's blocking steps — the corpus
+  # checkout it certifies against, the lint/format/type checks, and the suite —
+  # on the release interpreter. Its failure is what stops `publish` below.
+  test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: fuaran-py
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: fuaran-py
+
+      # Deliberately UNPINNED, for the reason ci.yml states: the corpus is the
+      # shared conformance authority and one current spec for all hosts is the
+      # point of giving it a single home.
+      - name: Check out the wire-format conformance corpus
+        uses: actions/checkout@v4
+        with:
+          repository: fuaran-ui/fuaran-ui-specification
+          path: wire-format-fixtures
+          # Full history — the refusal below reports how many commits the
+          # snapshot is behind, which the default depth of 1 cannot answer.
+          fetch-depth: 0
+
+      # Every corpus-dependent test skips when the corpus is absent, so a layout
+      # drift would retire the conformance leg and still report green. Assert it.
+      - name: Assert the corpus is where the tests resolve it
+        run: test -f ../wire-format-fixtures/manifest.json
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      # THE RELEASE-PATH REFUSAL, and deliberately the FIRST thing this job
+      # decides — before the install, the lint, the type check and the suite.
+      #
+      # The same check CI runs as a warning on every push is a hard refusal here,
+      # because the two workflows differ in exactly the way that matters: on a
+      # push a lagging snapshot costs nothing (the suite certifies against the
+      # authority it just checked out), while on a tag the gated
+      # `test_corpus_sync` compares the snapshot to a HEAD that may have moved
+      # since CI passed. That is not hypothetical — it is how the first v0.1.0
+      # tag failed and had to be withdrawn.
+      #
+      # Running it first is the whole point. The same staleness reached as a
+      # `test_corpus_sync` failure two minutes into pytest reads as a broken
+      # host; reached here it reads as what it is, and the message carries both
+      # commits and the one command that fixes it.
+      #
+      # Needs no install: the check is standard library plus git.
+      - name: Refuse a corpus snapshot behind the authority
+        run: python conformance/sync_corpus.py --check
+
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]"
+
+      - name: Lint (ruff check)
+        run: python -m ruff check .
+
+      - name: Format check (ruff format)
+        run: python -m ruff format --check .
+
+      - name: Type check (mypy)
+        run: python -m mypy
+
+      - name: Test (gated)
+        run: python -m pytest -q -rs
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Version gate — tag must equal pyproject version
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME#v}"
+          ver="$(python - <<'PY'
+          import tomllib
+          print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])
+          PY
+          )"
+          if [ "$tag" != "$ver" ]; then
+            echo "tag v$tag does not match pyproject version $ver" >&2
+            exit 1
+          fi
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    # BOTH, not just `build`: a green build says the artefact assembles, which is
+    # not a statement about whether the code in it works.
+    needs: [test, build]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      # SHA-PINNED, not tag-pinned: this step holds the OIDC-minted publishing
+      # identity, so a moved `release/v1` is credential-bearing code nobody
+      # reviewed. `# v1.14.2` records which release the digest is; Dependabot's
+      # `github-actions` schedule proposes the bumps as reviewable PRs.
+      #
+      # `skip-existing` is deliberately ABSENT — see the header. A re-tag of an
+      # already-published version must fail, not exit 0 having uploaded nothing.
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

fuaran_ui-0.7.0/.gitignore

@@ -0,0 +1,32 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Tooling caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+coverage.xml
+
+# Editors / OS
+.vscode/
+.idea/
+.DS_Store
+Thumbs.db
+
+# The synced corpus snapshot (conformance/corpus/) IS committed — it makes
+# fuaran-py standalone-testable offline and gives the drift guard
+# (tests/test_corpus_sync.py) a committed baseline to pin against the authority.
+# Re-sync + re-commit it whenever the authoritative corpus regenerates
+# (python conformance/sync_corpus.py), per the §11 forward-coupling rule.