Bump eslint from 9.39.5 to 10.9.1 in /docs

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,65 @@
+name: Bug report
+description: A component renders the wrong markup, or the plugin misbehaves.
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For a security vulnerability, do **not** file here — see
+        [SECURITY.md](https://github.com/aldi/ralma/blob/master/SECURITY.md).
+
+  - type: input
+    id: component
+    attributes:
+      label: Component
+      description: Which Ralma component? Leave blank if it's `registerRalma` itself or the build.
+      placeholder: navbar-link
+    validations:
+      required: false
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: The template and the data you bound to it. Smallest version that still shows the problem.
+      render: html
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual output
+      description: The HTML you got.
+      render: html
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected output
+      description: The HTML you expected instead.
+      render: html
+    validations:
+      required: true
+
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      description: Ralma, Ractive, and Bulma versions. Include Node and browser if relevant.
+      placeholder: ralma 1.0.0, ractive 1.4.4, bulma 1.0.2
+    validations:
+      required: true
+
+  - type: dropdown
+    id: how-loaded
+    attributes:
+      label: How is Ralma loaded?
+      options:
+        - npm package (`import { registerRalma } from 'ralma'`)
+        - Browser bundle (`bin/ralma.js`)
+        - Browser bundle, minified (`bin/ralma.min.js`)
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/aldi/ralma/security/advisories/new
+    about: Report privately through a GitHub Security Advisory. Please do not open a public issue.
+  - name: Question or usage help
+    url: https://github.com/aldi/ralma/discussions
+    about: Ask how to use a component, or discuss an idea before filing a request.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,47 @@
+name: Feature request
+description: Propose a new component, or a new option on an existing one.
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Ralma covers the most common Bulma widgets, not all of Bulma. For anything specific or
+        unusual, writing the original Bulma markup by hand is often the better answer — that's a
+        deliberate scope decision, not a gap.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What's verbose or awkward today?
+      description: Show the Bulma markup you're writing by hand and would rather not.
+      render: html
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed component or option
+      description: What the Ralma version would look like.
+      render: html
+    validations:
+      required: true
+
+  - type: input
+    id: bulma-docs
+    attributes:
+      label: Bulma documentation link
+      description: The Bulma page for the widget this wraps.
+      placeholder: https://bulma.io/documentation/components/...
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: constraints
+    attributes:
+      label: Constraints
+      options:
+        - label: This needs no runtime dependencies (Ralma has zero and intends to keep it that way)
+          required: true
+        - label: This is stateless — it renders from bound data and holds no internal state
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+## What does this change?
+
+<!-- One or two sentences. Link the issue it closes, if any. -->
+
+## Checklist
+
+- [ ] `npm test` passes
+- [ ] `npm run build` was run and the regenerated `bin/` files are **committed** (CI fails otherwise —
+      this is the most common cause of a red build)
+- [ ] `npm run lint`, `npm run typecheck`, and `npm run format:check` pass
+- [ ] No new runtime dependencies (this package intentionally has zero)
+
+## If this adds or changes a component
+
+- [ ] The definition sets `isolated: true`
+- [ ] If it renders an `href`: the name is in `hrefAwareComponentNames` and the template renders
+      `{{safeHref}}`, not `{{href}}`
+- [ ] `docs/src/data/ralmaCatalog.js` was updated to match
+
+## Rendered output
+
+<!-- For template changes, paste the before/after HTML. Behavior-preserving refactors should show an
+     empty diff. -->

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      # One PR for routine bumps; majors still arrive individually.
+      minor-and-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: npm
+    directory: /docs
+    schedule:
+      interval: weekly
+    groups:
+      minor-and-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ['*']

.github/workflows/ci.yml

@@ -0,0 +1,95 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # 22 = maintenance LTS (EOL 2027-04), 24 = active LTS, 26 = current.
+        node-version: [22, 24, 26]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      - name: Audit dependencies
+        if: matrix.node-version == 24
+        run: npm run audit
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build
+
+      # Artifact and style checks are version-independent; run them on one leg only.
+      - name: Ensure generated files are up to date
+        if: matrix.node-version == 24
+        run: git diff --exit-code -- bin/ralma.js bin/ralma.min.js
+
+      - name: Bundle size check
+        if: matrix.node-version == 24
+        run: npm run size:check
+
+      - name: Typecheck
+        if: matrix.node-version == 24
+        run: npm run typecheck
+
+      - name: Lint
+        if: matrix.node-version == 24
+        run: npm run lint
+
+      - name: Formatting sanity check
+        if: matrix.node-version == 24
+        run: npm run format:check
+
+      - name: Coverage
+        if: matrix.node-version == 24
+        run: npm run test:coverage
+
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          # docs/ pins its own Node version; next.config.mjs also reads ../package.json,
+          # so the repo root must be checked out (it is).
+          node-version-file: docs/.nvmrc
+          cache: npm
+          cache-dependency-path: docs/package-lock.json
+
+      - name: Install
+        run: npm run docs:install
+
+      - name: Audit dependencies
+        run: npm --prefix docs run audit
+
+      - name: Lint
+        run: npm run docs:lint
+
+      - name: Build
+        run: npm run docs:build

.github/workflows/deploy-docs.yml

@@ -0,0 +1,57 @@
+name: Deploy docs
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Never run two Pages deploys at once, but let an in-flight deploy finish.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: docs/.nvmrc
+          cache: npm
+          cache-dependency-path: docs/package-lock.json
+
+      - name: Configure Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Install
+        run: npm run docs:install
+
+      # next.config.mjs sets output: 'export' and basePath: '/ralma' when NODE_ENV=production,
+      # writing the static site to docs/out.
+      - name: Build
+        run: npm run docs:build
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: docs/out
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/npm-publish.yml

@@ -0,0 +1,52 @@
+name: Publish to npm
+
+on:
+  release:
+    types: [published]
+
+permissions: {}
+
+jobs:
+  publish:
+    if: ${{ !github.event.release.prerelease }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Verify release version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: node -e 'const pkg = require("./package.json"); if (process.env.RELEASE_TAG !== pkg.version) { throw new Error(`Release tag ${process.env.RELEASE_TAG} does not match package version ${pkg.version}`); }'
+
+      - name: Verify package
+        run: npm run verify
+
+      - name: Verify committed package artifacts
+        run: |
+          git diff --check
+          git diff --exit-code -- bin/ralma.js bin/ralma.min.js
+          test -z "$(git status --porcelain --untracked-files=all -- bin/ralma.js bin/ralma.min.js)"
+          npm pack --dry-run --ignore-scripts
+
+      - name: Publish to npm
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}