chore: release-readiness hygiene (attribution, CHANGELOG, CONTRIBUTING, dependabot)

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Default reviewer for everything. Update with a team (e.g. @Altinity/<team>)
+# if/when one is set up.
+* @BorisTyshkevich

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,17 @@
+---
+name: Bug report
+about: Something isn't working
+labels: bug
+---
+
+### What happened
+<!-- Steps to reproduce, what you expected, what you saw. -->
+
+### Environment
+- Browser + version:
+- ClickHouse server (version / Antalya or OSS):
+- Auth mode (OAuth IdP / credentials):
+- App version (from the build, if shown):
+
+### Notes
+<!-- Console errors, screenshots, the SQL involved, etc. -->

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,14 @@
+---
+name: Feature request
+about: Suggest an enhancement
+labels: enhancement
+---
+
+### Problem / motivation
+<!-- What's slow, missing, or awkward today? -->
+
+### Proposed solution
+<!-- What should it do? Sketch the UX. -->
+
+### Notes
+<!-- Alternatives considered, links, prior art. -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,10 @@
+## What & why
+<!-- What does this change and why? Link issues, e.g. "Closes #123". -->
+
+## Checklist
+- [ ] `npm test` passes (the per-file coverage gate is non-negotiable)
+- [ ] Tests added/updated in the same change as the code
+- [ ] `npm run build` succeeds (single-file `dist/sql.html`)
+- [ ] Layers kept honest: pure logic in `src/core/`, network in `src/net/` (injected fetch), DOM in `src/ui/`
+- [ ] No new runtime dependency (or it's a deliberate, justified addition — see CONTRIBUTING)
+- [ ] README / `CHANGELOG.md` (`[Unreleased]`) updated if behavior or the deployed surface changed

.github/dependabot.yml

@@ -0,0 +1,17 @@
+# Dependency update alerts/PRs. The two runtime deps (Chart.js, @dagrejs/dagre)
+# are inlined into the shipped dist/sql.html, so a vuln in them ships to every
+# browser that loads the page — keep them watched, alongside devDeps and Actions.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      dev-dependencies:
+        dependency-type: development
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

CHANGELOG.md

@@ -0,0 +1,64 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project aims to
+adhere to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+GitHub Releases (cut from `v*` tags by `.github/workflows/release.yml`) carry the
+auto-generated per-PR notes; this file is the curated, human-readable history.
+
+## [Unreleased]
+
+### Added
+- `NOTICE` + `THIRD-PARTY-NOTICES.md`, and the bundled Chart.js / dagre (MIT)
+  notices are now embedded in the built `dist/sql.html`.
+- `CONTRIBUTING.md` and this `CHANGELOG.md`.
+- Dependabot configuration for npm + GitHub Actions updates.
+
+## [0.1.4] - 2026-06-28
+
+### Changed
+- Schema detail pane: removed the "Insert SHOW CREATE" action button; opening a
+  node now rings its card (a double border) and the ring clears on every
+  pane-close path including Esc (#65).
+- Code-review follow-ups for the schema/zoom work: extracted `schemaLayout()` and
+  a `fixedAnchor()` helper, and the transitive-lineage node cap now counts only
+  linked nodes so a large single database isn't truncated early (#64).
+
+## [0.1.3] - 2026-06-28
+
+### Changed
+- Whole-database schema graph now draws **every** table (linked or not), packs the
+  unlinked tables into a grid below the lineage, and drops the redundant `<db>.`
+  prefix from node labels for objects in the focused database (#63).
+
+## [0.1.2] - 2026-06-28
+
+### Fixed
+- Bridged the shipped `html { zoom }` across the full-view schema panel and the
+  splitter / detail-pane-resize / popover coordinate math, so the full view fits
+  one screen (the detail-pane DDL was previously pushed off-screen) and drags and
+  popovers track the cursor (#62).
+
+## [0.1.1] - 2026-06-28
+
+### Added
+- `antalya-oauth` demo connection (Google SSO).
+
+### Changed
+- Documentation updates; dropped the inaccurate "zero-dependency" framing (the
+  app bundles two deliberate runtime dependencies).
+
+## [0.1.0] - 2026-06-28
+
+### Added
+- Initial release: OAuth-gated (PKCE) single-file SQL browser served from
+  ClickHouse — SQL editor, sortable results table + chart view, EXPLAIN pipeline
+  graph, and the schema data-flow graph. Built by esbuild into one `dist/sql.html`.
+
+[Unreleased]: https://github.com/Altinity/altinity-sql-browser/compare/v0.1.4...HEAD
+[0.1.4]: https://github.com/Altinity/altinity-sql-browser/compare/v0.1.3...v0.1.4
+[0.1.3]: https://github.com/Altinity/altinity-sql-browser/compare/v0.1.2...v0.1.3
+[0.1.2]: https://github.com/Altinity/altinity-sql-browser/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/Altinity/altinity-sql-browser/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/Altinity/altinity-sql-browser/releases/tag/v0.1.0

CONTRIBUTING.md

@@ -0,0 +1,64 @@
+# Contributing to the Altinity SQL Browser
+
+Thanks for your interest! This is a modular, no-framework ES-module SPA that
+builds to **one self-contained HTML file** (`dist/sql.html`) served from a
+ClickHouse cluster. Quality is held by tests and a strict layering discipline —
+please read the hard rules below before opening a PR.
+
+## Quickstart
+
+```bash
+npm install
+npm test            # vitest + coverage gate (must pass)
+npm run build       # esbuild → dist/sql.html
+npm run local       # build, then serve locally with a connection picker
+npm run test:e2e    # Playwright (chromium + firefox); needs: npx playwright install chromium firefox
+```
+
+Requirements: Node 22, a POSIX shell. No other toolchain.
+
+## Hard rules (non-negotiable)
+
+These mirror `CLAUDE.md` (the in-repo agent guide) — the same rules apply to human
+contributors.
+
+1. **The coverage gate must pass.** `npm test` enforces **100% per-file** for the
+   pure / network / state / DOM / render layers. `src/ui/app.js` + `src/main.js`
+   are the browser glue, gated lower and integration-tested. **Add tests in the
+   same change as the code.**
+2. **Keep the layers honest.**
+   - Pure logic → `src/core/` (no DOM, no globals).
+   - Network → `src/net/` with the `fetch` seam **injected**, never imported.
+   - DOM rendering → `src/ui/` as functions that take the `app` controller.
+   - Side-effectful environment access (location, crypto, storage, fetch) is
+     injected through `createApp(env)` so everything is testable under happy-dom.
+3. **No secrets in git.** `config.json` (rendered) is gitignored; only
+   `deploy/config.json.example` is committed. `config.json` is served to browsers
+   — prefer a PKCE public client (see the README "Configuring OAuth" and
+   `SECURITY.md`).
+4. **The build is esbuild only; runtime deps are rare and deliberate.** There are
+   exactly **two** bundled runtime dependencies — **Chart.js** and
+   **@dagrejs/dagre** — both inlined so the page makes zero third-party requests.
+   Adding another is a deliberate decision that grows the single served file. When
+   a feature needs a library, keep the testable logic pure in `src/core/` and make
+   the library call an **injected seam** (like `app.Chart` / `app.Dagre`).
+
+## How to add a result view / panel / feature
+
+Touch these in one change:
+- the module under `src/core/` (pure logic) or `src/ui/` (render);
+- its `tests/unit/<module>.test.js` to 100%;
+- if it changes the deployed surface, `deploy/http_handlers.xml` + the README.
+
+## Pull requests
+
+- Branch off `main`; keep PRs focused.
+- `npm test` green (coverage gate) and `npm run build` succeeds.
+- Update the README / `CHANGELOG.md` (`[Unreleased]`) when behavior or the
+  deployed surface changes.
+- Releases are cut by pushing a `vX.Y.Z` tag (see `.github/workflows/release.yml`).
+
+## Reporting bugs / security
+
+Open a GitHub issue for bugs and feature requests. For security-sensitive
+reports, follow `SECURITY.md` instead of filing a public issue.

NOTICE

@@ -0,0 +1,11 @@
+Altinity SQL Browser
+Copyright 2026 Altinity, Inc.
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+It bundles the following third-party components into the built single-file
+artifact (dist/sql.html). Their licenses and copyright notices are reproduced in
+THIRD-PARTY-NOTICES.md and are embedded in the artifact:
+
+  - Chart.js (MIT) — https://www.chartjs.org
+  - @dagrejs/dagre (MIT) — https://github.com/dagrejs/dagre

README.md

@@ -76,10 +76,9 @@ in-memory schema. Highlighting then tracks the connected server's actual
 keyword/function set, so it's version-correct. Folding and multi-cursor are out
 of scope for a textarea and tracked separately (CodeMirror, issue #21).
 
-> Design source of truth: the handoff bundle under `design/` (imported from the
-> "Altinity Play" Claude Design project) — read `design/README.md` before UI
-> work. The `.jsx` files there are React prototypes; production is the vanilla
-> ES-module code under `src/`.
+> Design source of truth: the "Altinity Play" Claude Design project (external).
+> Production is the vanilla ES-module code under `src/` — there is no React in
+> the shipped app.
 
 ## EXPLAIN views
 
@@ -445,7 +444,6 @@ src/
   styles.css
 build/        esbuild → single-file dist/sql.html
 deploy/       install.sh, uninstall.sh, http_handlers.xml, config.json.example
-design/       imported design handoff bundle (UI spec; reference only, not built)
 tests/        vitest + happy-dom, one spec per module
 docs/         ARCHITECTURE.md, DEPLOYMENT.md, ASSET-DISTRIBUTION.md,
               CLICKHOUSE-OAUTH.md, CLICKHOUSE-OSS-OAUTH.md

THIRD-PARTY-NOTICES.md

@@ -0,0 +1,34 @@
+# Third-party notices
+
+The Altinity SQL Browser is licensed under Apache-2.0 (see `LICENSE`). The built
+single-file artifact (`dist/sql.html`) inlines the two runtime dependencies
+below; this file reproduces their MIT license texts as required, and the same
+notices are embedded as a comment at the top of the built artifact.
+
+---
+
+## Chart.js — v4.5.1
+
+The MIT License (MIT)
+
+Copyright (c) 2014-2024 Chart.js Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---
+
+## @dagrejs/dagre — v3.0.0
+
+The MIT License (MIT)
+
+Copyright (c) 2012-2014 Chris Pettitt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

build/build.mjs

@@ -28,7 +28,15 @@ async function main() {
   const styles = await readFile(resolve(root, 'src/styles.css'), 'utf8');
   const template = await readFile(resolve(here, 'template.html'), 'utf8');
 
+  // The two runtime deps (Chart.js, dagre) are MIT and inlined into the bundle,
+  // so the artifact must carry their notices. esbuild strips legal comments
+  // (legalComments: 'none'), so embed THIRD-PARTY-NOTICES.md as a leading HTML
+  // comment — sanitized so its text can't close the comment early.
+  const notices = (await readFile(resolve(root, 'THIRD-PARTY-NOTICES.md'), 'utf8')).replace(/--+>?/g, '-');
+  const thirdParty = '<!--\n' + notices.trim() + '\n-->';
+
   const html = template
+    .replace('<!--__THIRDPARTY__-->', () => thirdParty)
     .replace('/*__STYLES__*/', () => styles)
     .replace('/*__SCRIPT__*/', () => script);
 

build/template.html

@@ -1,13 +1,15 @@
 <!DOCTYPE html>
 <html lang="en" data-theme="light">
 <head>
+<!--__THIRDPARTY__-->
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Altinity SQL Browser</title>
 <link rel="icon" href="data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIwIDAgMTUwIDE1MCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cGF0aCBkPSJtMTkgNzIgODItNDhMNzUgOSAxOSA0MnptNSAzIDIzIDE0VjYyem00OSAzNEwxOSA3OHY2MnptMjgtNTIgMjktMTctMjQtMTMtMjggMTd6bTMgN3Y2MGwyOCAxNlY4MHptMi00IDI2IDE1VjQ1eiIgZmlsbD0iIzAwNzlBRCIvPjwvc3ZnPg==">
 <style>/*__STYLES__*/</style>
 </head>
 <body>
+<noscript><div style="padding:24px;font:14px/1.5 system-ui,sans-serif">The Altinity SQL Browser requires JavaScript to run.</div></noscript>
 <div id="root"></div>
 <script>/*__SCRIPT__*/</script>
 </body>