Polish the framework, add color themes, and modernize tooling

[bcomnes]

This started as a general framework review and grew into the next major version of mine.css: a softer, more consistent visual pass, a CSS-only package contract, named color themes, and a modernized development and release setup.

The core stylesheet keeps its classless character while tightening the parts that had drifted over time. The light and dark palettes have accessible links and controls, print gets a complete light-facing palette, fluid type is bounded, wide content is no longer clipped, safe-area spacing remains additive, and form controls have consistent rhythm and focus treatment. Borders and framed surfaces now use subtle depth instead of the heavier high-contrast treatment, while buttons retain their native browser appearance. Raised fieldsets, code panels, and framed media share a customizable --surface-shadow, which print disables automatically.

Light and dark mode have one source of truth: the browser's prefers-color-scheme value. The old JavaScript theme-switcher entry point, mode classes, stored light/dark choice, and site toggle are gone. The package root now resolves directly to dist/mine.css, with layout and the namespaced top bar available as optional sidecars.

Named palettes remain separate from light/dark mode. This PR introduces dist/themes/tron-legacy.css, adapted from the light and dark palettes in bcomnes/zed-theme-tron-legacy. data-mine-theme="tron" selects the document palette while the browser still chooses its light or dark variant. Matching syntax colors use the independent data-hljs-theme="tron" contract. Fixed tron-legacy-light.css and tron-legacy-dark.css Highlight.js entry points can be selected directly, while tron-legacy.css composes them through prefers-color-scheme; the style-guide top bar selects both theme systems for a coordinated preview, but consumers can choose either one alone.

The top bar is now an independent, namespaced reimplementation inspired by top-bar.css. Its translucent background follows the active palette, its drop shadow stays physically dark in both modes, narrow screens retain horizontal scrolling without visible scrollbar chrome, and link feedback stays tight around the labels without changing target spacing.

The static site now uses fragtml instead of uhtml-isomorphic. Rendered Markdown crosses one explicit raw() boundary, while metadata and ordinary interpolations remain escaped. The README, v11 migration guide, and repo-local migration skill document the new package, theme, browser, and selector contracts.

Tooling now follows the current esm-template approach: releasearoni, npm-run-all2, Neostandard, TypeScript checking, reproducible distribution checks, grouped Dependabot updates, Playwright browser coverage, and an OIDC-ready release workflow. CI follows the latest Node LTS line without duplicating pull-request runs, and the existing Neocities deployment remains in place.

Things worth reviewing closely

• The adjusted default palette, links, borders, inputs, and surface depth
• Browser-only light/dark behavior versus the optional named-theme selector
• The Tron document and Highlight.js light/dark palettes
• The CSS-only package entry point and removal of the JavaScript API
• The wider layout and bounded fluid type scale
• The optional layout and top-bar companion stylesheets
• The Node 22 floor and native CSS nesting browser contract
• The release workflow before using it for the next publish

Validation

• clean npm ci
• complete npm test on the current Node LTS line
• 10 Node tests and 10 Playwright tests
• default and Tron palettes exercised in browser-driven light and dark modes
• print-media, keyboard-focus, native-button, input-spacing, mobile-navigation, and overflow coverage
• visual browser passes at 320px and desktop sizes, including the settled dark top-bar shadow
• clean-build dist verification
• npm audit (0 vulnerabilities)
• npm pack --dry-run --json (17 files, 27.8 kB)
• releasearoni dry run
• local watch-mode smoke test

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​voxpelli/​tsconfig@​16.2.1
	npm/​releasearoni@​0.2.0
	npm/​fragtml@​0.0.9
	npm/​postcss@​8.5.18 ⏵ 8.5.16			-19	-7
	npm/​neostandard@​0.13.0
	npm/​npm-run-all2@​9.0.2
	npm/​typescript@​6.0.3
	npm/​@​playwright/​test@​1.61.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm es-abstract is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/neostandard@0.13.0 → npm/es-abstract@1.24.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm eslint-plugin-react is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/neostandard@0.13.0 → npm/eslint-plugin-react@7.37.5 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-react@7.37.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report