# Vendored frontend assets

Downloaded once and committed as-is — the dashboard binary must work fully
offline, with no runtime CDN dependency (see `docs/PLAN_ADMIN_DASHBOARD.md`).
Do not "update" these files casually; bump deliberately, in their own
commit, if a newer version is actually needed.

| File | Source | Version | Fetched |
|---|---|---|---|
| `htmx.min.js` | https://unpkg.com/htmx.org@2.0.10/dist/htmx.min.js | 2.0.10 | 2026-08-23 |
| `alpine.min.js` | https://unpkg.com/alpinejs@3.16.2/dist/cdn.min.js | 3.16.2 | 2026-08-23 |
| `bootstrap.min.css` | https://unpkg.com/bootstrap@5.3.8/dist/css/bootstrap.min.css | 5.3.8 | 2026-08-23 |

Only Bootstrap's CSS is vendored — no `bootstrap.bundle.min.js`/Popper: the
dashboard doesn't use any Bootstrap component that requires JS (navbar
collapse, dropdowns, modals, tooltips). Confirmations use the browser's
native dialog via htmx's `hx-confirm`, not a Bootstrap modal. If a future
page genuinely needs Bootstrap JS, vendor `bootstrap.bundle.min.js`
alongside this file rather than pulling it from a CDN.

Previously used Pico CSS (classless build) — replaced by Bootstrap 5 for a
more compact, conventional admin-dashboard look (denser tables/forms via
`table-sm`/`*-sm` utilities) per explicit request.

Licenses: htmx (BSD 2-Clause), Alpine.js (MIT), Bootstrap (MIT) — all
permit vendoring/redistribution unmodified.