llms.txt@bulma-ui git:20260814.51573e9A

Immutable. This exact content never changes and is served at /api/v1/blob/8be58188255139fb.

# @allxsmith/bestax-bulma

React components for Bulma v1.

- Docs index: https://bestax.io/llms.txt
- Full docs (one file): https://bestax.io/llms-full.txt
- Any docs page as markdown: append .md (e.g. https://bestax.io/docs/api/elements/button.md)
- LLM guide: https://bestax.io/docs/guides/llms
- Agent skills: https://bestax.io/docs/skills/intro
- MCP server: `npx bestax-mcp` — setup at https://bestax.io/docs/guides/llms#mcp-server

Supply-chain posture — same claims as the package README; every item is verifiable:

- Signed provenance on every release (sigstore; check `npm audit signatures` or the npm Provenance section)
- npm OIDC trusted publishing — no long-lived `NPM_TOKEN`; release commits and tags are GPG-signed
- Socket.dev scans every PR for malware, install scripts, obfuscated code, and privilege escalation
- Install scripts blocked unless allow-listed; versions younger than 3 days will not install
- Every GitHub Action pinned to a full commit SHA
- CodeQL, Dependency Review, Dependabot, and a high-severity `pnpm audit` gate
- Layered AI review (CodeRabbit + an independent adversarial Claude review) plus required green CI, an approving review, and a human merge

Full detail: https://github.com/allxsmith/bestax/blob/main/SECURITY.md · https://bestax.io/docs/guides/security