# Vendored frontend assets

Downloaded once and committed as-is — the dashboard binary must work fully
offline, with no runtime CDN dependency (see `docs/PLAN_ADMIN_DASHBOARD.md`).
Do not "update" these files casually; bump deliberately, in their own
commit, if a newer version is actually needed.

| File | Source | Version | Fetched |
|---|---|---|---|
| `htmx.min.js` | https://unpkg.com/htmx.org@2.0.10/dist/htmx.min.js | 2.0.10 | 2026-08-23 |
| `alpine.min.js` | https://unpkg.com/alpinejs@3.16.2/dist/cdn.min.js | 3.16.2 | 2026-08-23 |
| `fonts.css` + `fonts/*.woff2` | Google Fonts CSS2 API (`family=JetBrains+Mono:wght@400;500;600;700;800\|family=IBM+Plex+Sans:wght@400;500;600;700`) | JetBrains Mono v24, IBM Plex Sans v23 | 2026-08-26 |

## Fonts

The dashboard's design system (`../dashboard.css`) uses **JetBrains
Mono** (all headings/nav/labels/table chrome *and* tabular data — IP
addresses, timestamps, ports, counters — a single monospace register
throughout) and **IBM Plex Sans** (body copy, form microcopy). Both are
variable fonts, so one file per subset covers every vendored weight.
Only the `latin`, `latin-ext`, `cyrillic`, and `cyrillic-ext` subsets are
vendored (the UI is Russian/English only) — `greek` and `vietnamese` from
the upstream CSS were dropped. `fonts.css` was hand-rewritten from the
fetched Google Fonts CSS to point at the local `fonts/*.woff2` files
instead of `fonts.gstatic.com`, keeping the original `unicode-range`
subsetting so browsers still only fetch the subset(s) actually used.

Replaces the previously vendored Manrope + IBM Plex Mono (removed
2026-08-26 — superseded, no longer referenced by `dashboard.css`).

No CSS framework is vendored: the design system in `dashboard.css` is
hand-written (sidebar shell, panels, tables, pills, forms, buttons,
alerts) rather than built on Bootstrap/Pico/etc — see
`docs/PLAN_ADMIN_DASHBOARD.md` for why (a framework's default look kept
fighting the "modern, compact, rounded" brief; a small hand-rolled system
gave full control for less code than fighting one).

Only htmx's and Alpine's CSS-adjacent-nothing JS is vendored — no
`bootstrap.bundle.min.js`/Popper equivalent is needed since the dashboard
doesn't use any component that requires JS beyond htmx/Alpine themselves
(the mobile sidebar toggle is a pure-CSS checkbox trick, not JS;
confirmations use the browser's native dialog via htmx's `hx-confirm`).

Licenses: htmx (BSD 2-Clause), Alpine.js (MIT), JetBrains Mono (OFL-1.1),
IBM Plex Sans (OFL-1.1) — all permit vendoring/redistribution unmodified.