rational 0.1.0a1__tar.gz

rational-0.1.0a1/.gitignore

@@ -0,0 +1,183 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#pdm.lock
+#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
+#   in version control.
+#   https://pdm.fming.dev/latest/usage/project/#working-with-version-control
+.pdm.toml
+.pdm-python
+.pdm-build/
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Cursor  
+#  Cursor is an AI-powered code editor.`.cursorignore` specifies files/directories to 
+#  exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
+#  refer to https://docs.cursor.com/context/ignore-files
+.cursorignore
+.cursorindexingignore
+# Local databases from examples
+*.db

rational-0.1.0a1/CHANGELOG.md

@@ -0,0 +1,51 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/) (pre-1.0: minor versions may break the API).
+
+## [Unreleased]
+
+### Added
+- A `media` example and walkthrough covering local and remote images, multiple favicon sources,
+  internal and external links, video sources, and embedded PDF documents through `h()`.
+- Structured request logging and telemetry through `app.logging`: request IDs, request and event
+  timings, slow-render warnings, and optional OpenTelemetry spans.
+- A broken app no longer kills the dev server: import failures and failing startup hooks serve the
+  readable error page instead (with live reload, so the browser recovers once you save a fix).
+  `rational.cli.TargetError` replaces the `SystemExit` raised for unusable targets.
+
+### Changed
+- Examples and the tutorial project use a new layout: `app.py`, `settings.py`, `models/`,
+  `services/` and `views/{styles,components,pages}`. Imports are relative inside a layer and
+  absolute across layers (`from views.styles import X`).
+
+## [0.1.0a1] - 2026-10-22
+
+First public alpha.
+
+### Added
+- Component model: `Component`, `Page`, props from annotations, `State` with component, page
+  and session scopes, dependency tracking, keyed identity, async `mount()`/`render()`.
+- Safe node IR and deterministic HTML serializer (escaping, tag/attribute/URL validation).
+- Typed `Style` objects compiled to hashed, deduplicated CSS classes; pseudo-states,
+  viewport breakpoints, container queries; four theme presets with light/dark/system modes.
+- Primitives: text, headings, buttons, links, images, layout, cards, accessible form controls.
+- HTTP event protocol v1 with DOM morphing, CSRF, session binding, payload validation,
+  rate and size limits, stale-handler resynchronization.
+- `Service` and `@remote`: a typed JSON API under `/api` with OpenAPI docs.
+- Async SQLAlchemy integration (`Database`, `Model`).
+- `python app.py --dev` (supervised hot reload, live browser reload, readable error pages
+  and overlays) and `--prod` (single origin, proxy-aware); `python -m rational`.
+- `rational.testing.TestClient`, Playwright browser tests, benchmarks, Sphinx documentation.
+- `Router` for declaring pages, services and startup hooks in their own modules (`App.include`).
+- Swagger UI at `/api/docs` that sends the session's CSRF token, so "Try it out" works when signed in;
+  `App(description=..., version=...)`, API tags from service docstrings.
+- `FieldError` for business-rule errors shown under form fields; validator messages without the
+  "Value error, " prefix.
+- `Badge` and `Avatar` primitives; `js.confirm()` to ask before a server event.
+- `rational.testing` finds controls by accessible name (`aria-label`, then text).
+- Examples, each laid out as a project: hello, counter, dashboard, cv-portfolio, todos, blog,
+  user-platform, marketplace, social-network.
+- Documentation: a step-by-step tutorial (tested), example walkthroughs, a project-structure guide,
+  GitHub Pages and Read the Docs publishing.

rational-0.1.0a1/CONTRIBUTING.md

@@ -0,0 +1,38 @@
+# Contributing
+
+Thanks for helping make web development less irrational!
+
+## Setup
+
+```console
+$ python -m venv .venv && . .venv/bin/activate      # Windows: .venv\Scripts\activate
+$ pip install -e ".[dev,docs,browser]"
+$ playwright install chromium                         # optional: real-browser tests
+```
+
+## Checks
+
+Every change should pass:
+
+```console
+$ pytest                         # unit, integration, examples (+ browser tests if Chromium is present)
+$ ruff check . && ruff format --check .
+$ mypy                           # strict
+$ python -m sphinx -W -b html docs docs/_build/html
+```
+
+## Guidelines
+
+- Keep the core small. A feature that can live in user code or an optional module should.
+- Every behaviour change needs a test; security-relevant code needs a test for the *attack*,
+  not only the happy path.
+- Public API changes need docs (`docs/`) and a `CHANGELOG.md` entry under *Unreleased*.
+- Performance claims need a benchmark (`benchmarks/run.py`).
+- Write code that reads like the code around it.
+
+## Releasing (maintainers)
+
+1. Update `__version__` in `src/rational/__init__.py` and move *Unreleased* entries in
+   `CHANGELOG.md` under the new version.
+2. Tag `vX.Y.Z` and push the tag. The *Release* workflow builds, checks, and publishes to PyPI
+   through trusted publishing.

rational-0.1.0a1/LICENSE

@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>

rational-0.1.0a1/PKG-INFO

@@ -0,0 +1,308 @@
+Metadata-Version: 2.5
+Name: rational
+Version: 0.1.0a1
+Summary: A Python-first, object-oriented web framework: server-rendered components, typed styles, explicit remote calls.
+Project-URL: Homepage, https://github.com/DutraIRS/Rational-Web
+Project-URL: Repository, https://github.com/DutraIRS/Rational-Web
+Project-URL: Issues, https://github.com/DutraIRS/Rational-Web/issues
+Project-URL: Changelog, https://github.com/DutraIRS/Rational-Web/blob/main/CHANGELOG.md
+Project-URL: Funding, https://ko-fi.com/dutrairs
+Author: Iago Riveiro Santos Dutra
+License-Expression: Unlicense
+License-File: LICENSE
+Keywords: components,css-in-python,fastapi,framework,reactive,ssr,web
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Web Environment
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
+Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: fastapi>=0.110
+Requires-Dist: pydantic>=2.6
+Requires-Dist: uvicorn>=0.27
+Provides-Extra: browser
+Requires-Dist: playwright>=1.44; extra == 'browser'
+Provides-Extra: db
+Requires-Dist: aiosqlite>=0.19; extra == 'db'
+Requires-Dist: sqlalchemy[asyncio]>=2.0; extra == 'db'
+Provides-Extra: dev
+Requires-Dist: aiosqlite>=0.19; extra == 'dev'
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: httpx2>=2; extra == 'dev'
+Requires-Dist: httpx<0.28,>=0.27; extra == 'dev'
+Requires-Dist: hypothesis>=6; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.5; extra == 'dev'
+Requires-Dist: sqlalchemy[asyncio]>=2.0; extra == 'dev'
+Requires-Dist: twine>=5; extra == 'dev'
+Provides-Extra: docs
+Requires-Dist: furo>=2024.1; extra == 'docs'
+Requires-Dist: sphinx-autobuild>=2024.2; extra == 'docs'
+Requires-Dist: sphinx>=7; extra == 'docs'
+Provides-Extra: telemetry
+Requires-Dist: opentelemetry-api>=1.25; extra == 'telemetry'
+Provides-Extra: testing
+Requires-Dist: httpx2>=2; extra == 'testing'
+Requires-Dist: httpx<0.28,>=0.27; extra == 'testing'
+Description-Content-Type: text/markdown
+
+# Rational Web
+
+*Trying to make web development less irrational.*
+
+[![PyPI](https://img.shields.io/pypi/v/rational.svg)](https://pypi.org/project/rational/)
+[![Python](https://img.shields.io/pypi/pyversions/rational.svg)](https://pypi.org/project/rational/)
+[![License: Unlicense](https://img.shields.io/badge/license-Unlicense-blue.svg)](LICENSE)
+
+Rational Web is a Python-first, object-oriented web framework. Pages, components, services
+and models are Python objects. HTML, CSS and JavaScript still exist, but as implementation
+details behind one consistent, typed, inspectable API. It is built on FastAPI, Pydantic and
+(optionally) SQLAlchemy.
+
+```python
+from rational import App, Button, Column, Component, Page, State, Text
+
+app = App()
+
+
+class Counter(Component):
+    count = State(0)
+
+    def increment(self):
+        self.count += 1
+
+    def render(self):
+        return Column(Text(f"Count: {self.count}"), Button("Increment", on_click=self.increment))
+
+
+@app.page("/")
+class Home(Page):
+    def render(self):
+        return Counter()
+
+
+if __name__ == "__main__":
+    app.run()
+```
+
+```console
+$ pip install rational
+$ python app.py --dev     # hot reload, live browser reload, readable errors
+$ python app.py --prod    # production: pages at /, JSON API at /api, one origin
+```
+
+> **Status: alpha (0.1).** The architecture is implemented and tested end to end, including in
+> a real browser, but the public API may still change before 1.0.
+
+## Why
+
+Full-stack Python today usually means two codebases: a Python API and a JavaScript front end,
+glued together by hand-written fetch calls, duplicated validation and a build pipeline.
+Rational Web keeps the whole application in Python **without pretending the browser isn't
+there**:
+
+- **Server-rendered first.** Every page is real HTML before any script runs. Static pages ship
+  zero JavaScript. Interactive pages load a 4 KiB (gzipped) runtime that wires events and
+  morphs updated HTML into place, preserving focus and typing.
+- **Explicit boundaries.** Event handlers always run on the server. Only methods marked
+  `@remote` become an HTTP API. Nothing is callable from the browser by accident.
+- **Typed boundaries.** Path parameters, event payloads and API bodies are validated from your
+  annotations by Pydantic. Invalid form input never reaches your handler and shows up next to
+  the right field. Component prop annotations support static typing; runtime checks cover required
+  and unexpected prop names.
+- **Styles as values.** Immutable `Style` objects compile to deduplicated, hashed CSS classes,
+  with theme tokens, pseudo-states, `@media` breakpoints and `@container` queries. You get no
+  specificity wars, no class-name soup and no CSS injection.
+- **Secure by default.** Escaped output, session-bound events, CSRF tokens, session rotation,
+  rate and size limits, and an optional nonce-based CSP.
+
+## Features
+
+| | |
+|---|---|
+| Components | Props from annotations, `State` (component/page/session scope), keyed identity, async `mount()`/`render()` |
+| Primitives | `Text`, `Heading`, `Button`, `Link`, `Image`, `Badge`, `Avatar`, `Row`/`Column`/`Stack`/`Grid`, `Card`, `Container`, `Form`, `Input`, `Textarea`, `Select`, `Checkbox`, semantic regions, `h()` for anything else |
+| Events | `on_click`, `on_input` (debounced), `on_change`, `on_submit`, `on_enter`, `on_keydown`, `on_blur`; sync or async; lambdas capture values server-side |
+| Forms | Pydantic validation from handler annotations; `FieldError` for business rules; messages shown under the right field |
+| Local interactions | `js.confirm`, `js.toggle_class`, `js.set_attr`, `js.focus`, `js.set_theme`... run with no round trip |
+| Styling | `Style` merging with `\|`, four theme presets, light/dark/system, responsive breakpoints and container queries |
+| Backend | `Service` + `@remote` → typed JSON API under `/api`, interactive **Swagger UI** at `/api/docs`; async SQLAlchemy |
+| Projects | `Router` (pages and services in their own modules, with prefixes) and a composition root in `app.py` |
+| Developer experience | `--dev` hot reload on every OS, live browser reload, error pages that point at *your* line with hints |
+| Deployment | `--prod`, `python -m rational`, any ASGI server, mountable under a sub-path, proxy-aware |
+| Testing | `rational.testing.TestClient` drives pages by accessible name: `page.click("Save")` |
+
+## Examples
+
+Ten complete applications, each laid out like a real project (see [`examples/`](examples/)):
+
+| Example | What you'll learn |
+|---|---|
+| [hello](examples/hello/) | The smallest app: pages, primitives, zero-JS output |
+| [counter](examples/counter/) | State, keys, events, debounced input |
+| [media](examples/media/) | Favicons, local and remote images, links, video and document embeds |
+| [dashboard](examples/dashboard/) | Breakpoints, container queries, fluid grids, no custom CSS |
+| [cv-portfolio](examples/cv-portfolio/) | Content as data, function components, a honeypot contact form |
+| [todos](examples/todos/) | Databases, services, per-user isolation, the JSON API |
+| [blog](examples/blog/) | Path parameters, safe rich text, a live-preview editor, RSS |
+| [user-platform](examples/user-platform/) | Password hashing, authenticators, `FieldError`, roles and an admin area |
+| [marketplace](examples/marketplace/) | A session cart shared across tabs, transactional checkout, money |
+| [social-network](examples/social-network/) | Follows, likes and timelines with a fixed number of queries |
+
+```console
+$ pip install "rational[db]"
+$ cd examples/marketplace
+$ python app.py --dev
+```
+
+## Documentation
+
+The documentation is a Sphinx site in [`docs/`](docs/):
+
+- **Tutorial:** build a guestbook step by step, from one file to a tested, deployed project. Every
+  step is a runnable file, executed by the test suite.
+- **Examples:** a file-by-file walkthrough of all ten examples.
+- **Guide:** components, styling, services and the API, project structure, running and deploying,
+  security, testing.
+- **Background and reference:** the design record, benchmarks and the full API reference.
+
+Preview it locally, rebuilding as you edit:
+
+```console
+$ pip install -e ".[docs]"
+$ sphinx-autobuild docs docs/_build/html      # then open http://127.0.0.1:8000
+```
+
+Publishing is ready on two hosts. The `Docs` GitHub Actions workflow builds the site with warnings
+as errors and deploys it to GitHub Pages (enable *Settings → Pages → Source: GitHub Actions* once),
+and `.readthedocs.yaml` configures Read the Docs.
+
+## Benchmarks
+
+Is it blazingly fast? It's Python, so not in the Rust or Go sense. It is built so that the
+framework is never the bottleneck of a typical page, and so that the browser does very little
+work. The numbers below are measured, not claimed: run `python benchmarks/run.py` to
+reproduce them.
+
+These are full requests through the ASGI stack in-process (routing, rendering, CSS compilation,
+sessions, JSON) on **one CPU core**, with no network. The baseline is plain FastAPI returning
+an equivalent *pre-built* HTML string. Measured on Python 3.14.7, Windows 11, Intel Core
+(Tiger Lake).
+
+| Scenario | Requests/s | p50 | p95 |
+|---|---:|---:|---:|
+| FastAPI baseline: prebuilt HTML string | 2,651 | 0.35 ms | 0.56 ms |
+| **Rational: static page** | 1,942 | 0.48 ms | 0.76 ms |
+| **Rational: interactive page** (counter) | 1,390 | 0.66 ms | 0.88 ms |
+| **Rational: event round trip** (click → patch) | 1,390 | 0.69 ms | 0.92 ms |
+| Rational: 100-row styled table page | 390 | 2.39 ms | 2.91 ms |
+
+| On the wire | gzip |
+|---|---:|
+| `runtime.js` (interactive pages only, cached) | 4.0 KiB |
+| Theme CSS (immutable, cached) | 1.2 KiB |
+| A click's response | 0.2 KiB |
+
+- A static page keeps ~73% of raw FastAPI throughput while rendering components and
+  compiling CSS.
+- An interaction costs well under 1 ms of server time, so network latency dominates.
+- Rendering costs about 18 µs per element, so pages with thousands of rows should paginate.
+
+See [docs/benchmarks.rst](docs/benchmarks.rst) for the method and the micro-benchmarks.
+
+## Manifesto
+
+1. **Python is the interface; the web platform is the implementation.** We don't hide HTML,
+   CSS, JavaScript or HTTP. We give them one coherent, typed front door.
+2. **The network is a boundary, not a detail.** Where code runs must always be obvious. Nothing
+   crosses the wire unless you said so.
+3. **HTML first.** A page should be useful before a single script runs. JavaScript is an
+   enhancement, measured in kilobytes.
+4. **Secure is the default, not a setting.** Escaping, CSRF, validation and isolation are on
+   before you know you need them.
+5. **Values over magic.** Styles are immutable values, render output is plain data, and state
+   changes are explicit. What happens can be inspected.
+6. **Composition over inheritance.** Small pieces combine: `Style | Style`, components in
+   components, services in services.
+7. **Escape hatches, always.** Raw CSS, raw HTML, FastAPI routes, SQLAlchemy queries and
+   custom JavaScript are always available. The framework should never trap you.
+8. **Measure, don't claim.** Performance, accessibility and security are tested, not
+   asserted.
+
+## Roadmap
+
+**0.1: foundation** *(this release)*
+- [x] Component model, `State` scopes, dependency tracking, keyed identity
+- [x] Safe HTML IR and serializer, typed `Style` compiler, four themes, responsive variants
+- [x] HTTP event protocol with morph patches, CSRF, session binding, validation, rate limits
+- [x] Services with `@remote` → typed JSON API, async SQLAlchemy integration
+- [x] `--dev` (hot reload, live reload, readable errors) and `--prod` modes
+- [x] `Router` for multi-file projects; Swagger UI that works with sessions and CSRF
+- [x] Test client, Playwright browser tests, benchmarks
+- [x] Sphinx documentation with a step-by-step tutorial and ten example projects
+
+**0.2: interactivity**
+- [ ] WebSocket transport (optional) and server push for collaborative pages
+- [ ] Client-side navigation between pages, with no full reload
+- [ ] Finer-grained server diffs (text and attribute patches)
+- [ ] More components: `Modal`, `Tabs`, `Table`, `Toast`, `Menu`, with full keyboard support
+- [ ] Pluggable session store (for example Redis); page runtimes remain worker-local, so
+      multi-worker deployments still need sticky routing
+
+**0.3: productivity**
+- [ ] `rational new` project scaffolding and an Alembic migration workflow
+- [x] Structured logging and request telemetry (`app.logging`): request IDs, event timing,
+      slow-render tracing, standard-library logs + optional OpenTelemetry spans
+- [ ] Streaming SSR and loading states
+- [ ] Form helpers bound to Pydantic models
+- [ ] Internationalization
+- [ ] Optional Bootstrap and Tailwind adapters
+
+**1.0: stability**
+- [ ] Frozen public API with a deprecation policy
+- [ ] Accessibility audit and an automated a11y suite
+- [ ] Browser matrix in CI (Chromium, Firefox, WebKit) and load tests
+- [ ] Independent security review
+
+Have an idea? Open an issue. The roadmap is a conversation.
+
+## Contributing
+
+```console
+git clone https://github.com/DutraIRS/Rational-Web.git
+cd Rational-Web
+python -m venv .venv
+. .venv/bin/activate                                  # Windows: .venv\Scripts\activate
+pip install -e ".[dev,docs,browser]"
+pytest                                                # browser tests run if Chromium is available
+ruff check . && ruff format --check . && mypy
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Report security issues privately as described in
+[SECURITY.md](SECURITY.md).
+
+## Sponsor
+
+Rational Web is free, public-domain software built in the open. If it saves you time, or you
+want to see the roadmap happen sooner, please consider sponsoring:
+
+- **Ko-fi:** https://ko-fi.com/dutrairs
+- **Companies:** sponsorship can fund a specific roadmap item. Get in touch through GitHub.
+
+Sponsors are thanked in the release notes. Thank you for helping keep web development
+rational. ❤️
+
+## License
+
+Public domain, under the [Unlicense](LICENSE).