tinymoon 0.0.1__tar.gz → 0.2.0__tar.gz

tinymoon-0.2.0/.github/workflows/ci-go.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# Per-SHA group: re-runs of the same commit dedupe, but a new commit never
+# cancels an earlier commit's in-flight run (release CI conclusions stay intact).
+concurrency:
+  group: ${{ github.workflow_ref }}-${{ github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      # go.mod: go 1.26
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: go vet ./...
+      - run: go test ./... -race -short -timeout=10m

{tinymoon-0.0.1/.rlsbl/bases → tinymoon-0.2.0}/.github/workflows/publish.yml

@@ -7,7 +7,7 @@ concurrency:
   group: ${{ github.workflow_ref }}-${{ github.ref }}
   cancel-in-progress: false
 permissions:
-  contents: read
+  contents: write
   id-token: write
 jobs:
   gate:
@@ -145,7 +145,8 @@ jobs:
       # --access public is hardcoded on purpose: scoped packages are forbidden
       # in this ecosystem, and unscoped public packages require --access public.
       # --provenance is toggled by the pipeline's `provenance` config key.
-      - run: npm publish --access public ${{ steps.dist-tag.outputs.tag }}
+      - run: npm publish --provenance --access public ${{ 
+          steps.dist-tag.outputs.tag }}
         if: steps.check-npm.outputs.skip != 'true'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -166,3 +167,26 @@ jobs:
       - uses: pypa/gh-action-pypi-publish@release/v1
         with:
           skip-existing: true
+  go:
+    needs: gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
+      - name: Scan source for secrets
+        run: |
+          gitleaks dir .
+      - uses: goreleaser/goreleaser-action@v7
+        with:
+          version: ~> v2
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

tinymoon-0.2.0/.rlsbl/bases/.github/workflows/ci-go.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# Per-SHA group: re-runs of the same commit dedupe, but a new commit never
+# cancels an earlier commit's in-flight run (release CI conclusions stay intact).
+concurrency:
+  group: ${{ github.workflow_ref }}-${{ github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      # go.mod: go 1.26
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: go vet ./...
+      - run: go test ./... -race -short -timeout=10m

{tinymoon-0.0.1 → tinymoon-0.2.0/.rlsbl/bases}/.github/workflows/publish.yml

@@ -7,7 +7,7 @@ concurrency:
   group: ${{ github.workflow_ref }}-${{ github.ref }}
   cancel-in-progress: false
 permissions:
-  contents: read
+  contents: write
   id-token: write
 jobs:
   gate:
@@ -145,7 +145,8 @@ jobs:
       # --access public is hardcoded on purpose: scoped packages are forbidden
       # in this ecosystem, and unscoped public packages require --access public.
       # --provenance is toggled by the pipeline's `provenance` config key.
-      - run: npm publish --access public ${{ steps.dist-tag.outputs.tag }}
+      - run: npm publish --provenance --access public ${{ 
+          steps.dist-tag.outputs.tag }}
         if: steps.check-npm.outputs.skip != 'true'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -166,3 +167,26 @@ jobs:
       - uses: pypa/gh-action-pypi-publish@release/v1
         with:
           skip-existing: true
+  go:
+    needs: gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
+      - name: Scan source for secrets
+        run: |
+          gitleaks dir .
+      - uses: goreleaser/goreleaser-action@v7
+        with:
+          version: ~> v2
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

tinymoon-0.2.0/.rlsbl/bases/.rlsbl/lint/go.toml

@@ -0,0 +1,17 @@
+[forbidden-imports]
+modules = [
+    "net/http",
+    "github.com/spf13/cobra",
+    "github.com/urfave/cli",
+]
+
+[stdout]
+enabled = true
+ignore = []
+
+[entry-point]
+enabled = true
+ignore = []
+
+[files]
+exclude = []

tinymoon-0.2.0/.rlsbl/bases/VERSION

@@ -0,0 +1 @@
+0.0.1

tinymoon-0.2.0/.rlsbl/changes/0.1.0.jsonl

@@ -0,0 +1,16 @@
+{"id":"18c1cbdfd89f0985a0ff2a57d2ee4b65a7ff437d638fa135","commits":["082cacea8f4b501b69715af612ec1ac9f5e50c49"],"user_facing":false}
+{"id":"18c1cc207af6d28ae50104a7c416497d834df9c5e7eb060d","commits":["cb890eca94f6b4a257119bd8ce27f09cffb87b12"],"user_facing":true,"description":"README now leads with the project philosophy: zero-build vanilla web framework, strict by design.","type":"feature"}
+{"id":"18c1cc216d0e32fa1029e07eadb84cc8a47ea09d511e4fc4","commits":["604bbf9419bf4db817c4ad2a3a6226299b54ce2e"],"user_facing":false}
+{"id":"18c1d16c4ff40426c9396b1d34574a9687d9e70ce70f028e","commits":["477451297681bfbe84958583473fa9dde3256a26"],"user_facing":true,"description":"Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.","type":"feature"}
+{"id":"18c1d16c59cfd8eba0d008f9942249e7a407ef9da52d1250","commits":["c178a68686e7cd6f827a2d45b2066906300ef471"],"user_facing":true,"description":"ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.","type":"feature"}
+{"id":"18c1d16c62a5f347fe8d55bcfd294566a5cadd9620cd601f","commits":["29a10e0467085db87204b1255e23e5ccbc0e30fc"],"user_facing":true,"description":"Interactive gallery documenting every token and primitive.","type":"feature"}
+{"id":"18c1d16c6be3c768cb6a5bcd8c09475a90fd633aa0b9ce15","commits":["0aae65bc64a8ca820bd7b67bfc7357ddf324a0d9"],"user_facing":true,"description":"Go module exposing the assets as an embed.FS and http.Handler.","type":"feature"}
+{"id":"18c1d16c7517dc51e5b33cf473ca45a5ad21cc8e4fc5b519","commits":["996a1c49badcf2c4edb2ef5c4d1d28c45d51d8b7","3b7e85aedd9d3a813d2456c53571dbeaafdcf76a"],"user_facing":true,"description":"npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.","type":"feature"}
+{"id":"18c1d16c7e995ce7d5018132b0124ffa89328c3cef44a51c","commits":["b4261db38b071bc5a7d4b83ae206503de249a71b"],"user_facing":false}
+{"id":"18c1d25bee418647d9089eaebbfb4167813a6e53edb43057","commits":["d70a61efb8f76f627a43d204a97d47ec6e5d788e","fac0004d3e14b8f483097c977d8ee32c304566c0"],"user_facing":true,"description":"`tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.","type":"feature"}
+{"id":"18c1d25bf5a91bee7158b15a377a4597abeb94aac506f2f7","commits":["4f58441627685fb483be937a625b4911269c0f1e"],"user_facing":false}
+{"id":"18c1d359658284a3d564b15a8c5345e89c1840af08132930","commits":["a0327331794a1382163146b058315965b3f813a2"],"user_facing":false}
+{"id":"18c1d369a6b5de997e56f62f572e4c12b8d2f6a51637cc98","commits":["8d4491cbde919706bbe3a6e0f3d21466bde5a66c","b14c8a479c939c4da141001181d1d1e697944ca8"],"user_facing":true,"description":"Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).","type":"fix"}
+{"id":"18c1d36fc6a2bee0ceb0f88bbb914d3f9ba8e6eab8e4d970","commits":["0d4fc35f1568821d402c4232b38f7a5b79669ef4"],"user_facing":false}
+{"id":"18c1d379a83bdaa08da38f9076534ed596435afec77c2712","commits":["de1df0c8c815f7c6401b0cf0b8cc012d3c3cc724"],"user_facing":false}
+{"id":"18c1d382ff296fe949f8bc2ac98e4a1f9b00e33b2e1f9968","commits":["0022b941f2cb31cc5a9330eb00885d994de861fe"],"user_facing":false}

tinymoon-0.2.0/.rlsbl/changes/0.1.0.md

@@ -0,0 +1,15 @@
+## 0.1.0
+
+### Features
+
+- README now leads with the project philosophy: zero-build vanilla web framework, strict by design.
+- Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.
+- ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.
+- Interactive gallery documenting every token and primitive.
+- Go module exposing the assets as an embed.FS and http.Handler.
+- npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.
+- `tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.
+
+### Fixes
+
+- Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).

tinymoon-0.2.0/.rlsbl/changes/0.2.0.jsonl

@@ -0,0 +1,18 @@
+{"id":"18c1d43b7a2262ff2e0202cd43804fc1ba48268d5e5e2a51","commits":["932014ebb4ebb376e31326dc01dbb2912a83e29c"],"user_facing":false}
+{"id":"18c1d59ca44d85ed8f777e7a40344bc79d266d41d9e236e2","commits":["082cacea8f4b501b69715af612ec1ac9f5e50c49"],"user_facing":false}
+{"id":"18c1d59cbddf5121dd287f4b22d0448d9c0e0c4c38502150","commits":["cb890eca94f6b4a257119bd8ce27f09cffb87b12"],"user_facing":true,"description":"README now leads with the project philosophy: zero-build vanilla web framework, strict by design.","type":"feature"}
+{"id":"18c1d59cda4308380fde673ae46f4dcd8df18d20ac87a7e4","commits":["604bbf9419bf4db817c4ad2a3a6226299b54ce2e"],"user_facing":false}
+{"id":"18c1d59cf535841fc7e98b450a184c989134a9e151148174","commits":["477451297681bfbe84958583473fa9dde3256a26"],"user_facing":true,"description":"Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.","type":"feature"}
+{"id":"18c1d59d09485a94390cdfb95b6a4654a0b11fe0c662d4ed","commits":["c178a68686e7cd6f827a2d45b2066906300ef471"],"user_facing":true,"description":"ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.","type":"feature"}
+{"id":"18c1d59d1bc2b6642a34bb811d9c44069ff56ab9e0a0dfc4","commits":["29a10e0467085db87204b1255e23e5ccbc0e30fc"],"user_facing":true,"description":"Interactive gallery documenting every token and primitive.","type":"feature"}
+{"id":"18c1d59d2f3afceed9b010336cd842c7a5ae63bdef3a05c2","commits":["0aae65bc64a8ca820bd7b67bfc7357ddf324a0d9"],"user_facing":true,"description":"Go module exposing the assets as an embed.FS and http.Handler.","type":"feature"}
+{"id":"18c1d59d63dd4aa47d26c99423a0428fab687212df723be9","commits":["996a1c49badcf2c4edb2ef5c4d1d28c45d51d8b7","3b7e85aedd9d3a813d2456c53571dbeaafdcf76a"],"user_facing":true,"description":"npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.","type":"feature"}
+{"id":"18c1d59ffb346491d2e75c3552f74a4cb9e1e08675edb22a","commits":["b4261db38b071bc5a7d4b83ae206503de249a71b"],"user_facing":false}
+{"id":"18c1d5a0236fd39cbf5363a20fb14cf989230047fe0d0a1a","commits":["d70a61efb8f76f627a43d204a97d47ec6e5d788e","fac0004d3e14b8f483097c977d8ee32c304566c0"],"user_facing":true,"description":"`tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.","type":"feature"}
+{"id":"18c1d5abe5649f48ca9540f667c34a62be80da1c71d6069d","commits":["4f58441627685fb483be937a625b4911269c0f1e"],"user_facing":false}
+{"id":"18c1d5abeeec42bacb98f6f8bf434bdd814ad752ea94599a","commits":["a0327331794a1382163146b058315965b3f813a2"],"user_facing":false}
+{"id":"18c1d5abf8cf452da0f6f26530f549b28075eb2a606e7383","commits":["8d4491cbde919706bbe3a6e0f3d21466bde5a66c","b14c8a479c939c4da141001181d1d1e697944ca8"],"user_facing":true,"description":"Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).","type":"fix"}
+{"id":"18c1d5ac0308b8767c3ae6a92e1b4214a590acb5425b791e","commits":["0d4fc35f1568821d402c4232b38f7a5b79669ef4"],"user_facing":false}
+{"id":"18c1d5ac0e9f013a3065b2908de04c4d8f183f7b6d4e3989","commits":["de1df0c8c815f7c6401b0cf0b8cc012d3c3cc724"],"user_facing":false}
+{"id":"18c1d5ac19479beecbfe680ebdc747aea2f4c5f9478cb8cc","commits":["0022b941f2cb31cc5a9330eb00885d994de861fe"],"user_facing":false}
+{"id":"18c1d5fb7c39c10f0ead38c10d724d78be3530b7444c940e","commits":["8d4db2d807aa5ca5715fda2f7f1a69be46fc2a35"],"user_facing":false}

tinymoon-0.2.0/.rlsbl/changes/0.2.0.md

@@ -0,0 +1,24 @@
+## 0.2.0
+
+The framework lands: design tokens, base styles, app shell, and UI primitives as zero-build vanilla CSS and ES modules; embeddable Go module; conformance checker CLI.
+
+<details>
+<summary>Context</summary>
+
+0.0.1 was a name reservation across registries. 0.1.0 was tagged but never published anywhere: a release-tooling failure caused the CI gate to fail, all registry jobs were skipped, and the v0.1.0 tag was subsequently removed. 0.2.0 is therefore the first release that actually ships the framework: npm carries the browser assets (vanilla CSS and native ES modules, zero build step), PyPI carries the same assets plus the `tinymoon check` conformance checker CLI, and the Go module wraps the assets in an embed.FS for server-side embedding. All three targets are versioned together.
+
+</details>
+
+### Features
+
+- README now leads with the project philosophy: zero-build vanilla web framework, strict by design.
+- Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.
+- ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.
+- Interactive gallery documenting every token and primitive.
+- Go module exposing the assets as an embed.FS and http.Handler.
+- npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.
+- `tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.
+
+### Fixes
+
+- Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).

{tinymoon-0.0.1 → tinymoon-0.2.0}/.rlsbl/config.json

@@ -1,17 +1,23 @@
 {
   "targets": [
     "npm",
-    "pypi"
+    "pypi",
+    "go"
   ],
   "private": false,
   "pipelines": {
     "npm": {
       "type": "npm",
-      "local": false
+      "local": false,
+      "provenance": true
     },
     "pypi": {
       "type": "pypi",
       "local": false
+    },
+    "go": {
+      "type": "go",
+      "local": false
     }
   }
 }

tinymoon-0.2.0/.rlsbl/lint/go.toml

@@ -0,0 +1,17 @@
+[forbidden-imports]
+modules = [
+    "net/http",
+    "github.com/spf13/cobra",
+    "github.com/urfave/cli",
+]
+
+[stdout]
+enabled = true
+ignore = []
+
+[entry-point]
+enabled = true
+ignore = []
+
+[files]
+exclude = []

tinymoon-0.2.0/.rlsbl/managed-files.json

@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "files": {
+    ".github/workflows/ci-pypi.yml": "0bf3efb9f0e1ae3b75c2e1b18929bfcee7b69d7341e2093844bcda06a96dedb4",
+    ".github/workflows/ci-go.yml": "1d32c5f7d5242080895136e2e5773a1ff2a0cf0a3a2bf098b37e78c4239a9a61",
+    ".npmignore": "7c0eea9785c0318aeb39bf8b670ce8384f4a5b812fde69ce23d7d018057325a3",
+    "VERSION": "e6635045e1d2478ec4ca712d8c0e1dfcef8bb7b5b1e8e3bb560d37fe399a9e72",
+    ".github/workflows/publish.yml": "6738e166964a6f4e3741ef8b634b0829f2559d6eff1d3c5fafed743dc933ae07",
+    "CHANGELOG.md": "2565aecb5d684d6cd56b6bf982b956ec807949b67dedb9c8c93f154d09ac943f",
+    ".gitignore": "80572c78bfc39d5b9de7b7a327b44934ee8c8205dcf7179ff3594d854bb377b6",
+    ".rlsbl/changes/unreleased.jsonl": "2e04e2b43ae64dcd8b40d7ed1635d58a4559ce07e7293cf31354d376df5051f8",
+    ".rlsbl/lint/python.toml": "9cfbcef2e010d5fad243437bf2fd8df54a1fae70ee0762f9d11da70fe207501c",
+    ".rlsbl/lint/npm.toml": "baa36014e65923d8cc5c8b83c77fa651da79351627570476402da66840027645",
+    ".rlsbl/lint/go.toml": "807d5cf760baad6d571a5bfd43cb163efe356f7462ba9f1918d72de45f62339f"
+  }
+}

tinymoon-0.2.0/.rlsbl/releases/v0.2.0.toml

@@ -0,0 +1,14 @@
+# Version bump type: patch, minor, major, hotfix, or prerelease
+bump = "minor"
+# Short description of this release (required)
+description = "The framework lands: design tokens, base styles, app shell, and UI primitives as zero-build vanilla CSS and ES modules; embeddable Go module; conformance checker CLI."
+# Optional context explaining why these changes were made
+context = """
+0.0.1 was a name reservation across registries. 0.1.0 was tagged but never published anywhere: a release-tooling failure caused the CI gate to fail, all registry jobs were skipped, and the v0.1.0 tag was subsequently removed. 0.2.0 is therefore the first release that actually ships the framework: npm carries the browser assets (vanilla CSS and native ES modules, zero build step), PyPI carries the same assets plus the `tinymoon check` conformance checker CLI, and the Go module wraps the assets in an embed.FS for server-side embedding. All three targets are versioned together.
+"""
+# Pre-release identifier: alpha, beta, rc, or stable
+# preid = ""
+# Set to true to generate a blog post for this release
+# blog = false
+include = ["npm", "pypi", "go"]
+exclude = []

tinymoon-0.2.0/.strictcli/schema.json

@@ -0,0 +1,66 @@
+{
+  "schema_version": 1,
+  "defaults": {
+    "schema_version": 1,
+    "app": {
+      "env_prefix": null,
+      "config": false,
+      "global_flags": [],
+      "commands": {},
+      "groups": {},
+      "deprecated": {},
+      "tag_contracts": {}
+    },
+    "flag": {
+      "short": null,
+      "default": null,
+      "env": null,
+      "choices": null,
+      "repeatable": false,
+      "unique": false,
+      "env_separator": null,
+      "negatable": null,
+      "hidden": false
+    },
+    "arg": {
+      "type": "str",
+      "required": true,
+      "default": null,
+      "variadic": false,
+      "choices": null
+    },
+    "command": {
+      "passthrough": false,
+      "flags": [],
+      "args": [],
+      "tags": [],
+      "constraints": [],
+      "hidden": false,
+      "interactive": false
+    },
+    "group": {
+      "commands": {},
+      "groups": {},
+      "deprecated": {},
+      "tags": [],
+      "hidden": false
+    }
+  },
+  "project_id": "tinymoon",
+  "name": "tinymoon",
+  "version": "0.2.0",
+  "help": "Tooling for the tinymoon web framework. Ships the conformance checker that enforces the framework's non-negotiables (no external URLs, no native browser controls, no title= attributes, no rounded corners, no off-token colors) as hard errors.",
+  "commands": {
+    "check": {
+      "name": "check",
+      "help": "Recursively scan the .html/.css/.js files under --dir for conformance violations: external URLs (external-url), native browser controls (native-control), title= attributes (title-attr), non-zero border-radius (border-radius), and off-token color literals (raw-color). Prints one line per violation (path:line: [rule-id] message) and a summary count. Exits 0 when clean, 1 on any violation -- there is no bypass. An optional tinymoon-allowlist.txt at the scanned directory root (one exact URL per line, # comments allowed) exempts exact URL matches from the external-url rule.",
+      "flags": [
+        {
+          "name": "dir",
+          "type": "str",
+          "help": "Directory to scan (required -- the checker never scans the current directory implicitly)"
+        }
+      ]
+    }
+  }
+}

tinymoon-0.2.0/CHANGELOG.md

@@ -0,0 +1,52 @@
+<!-- Generated by rlsbl from .rlsbl/changes/ — do not edit -->
+
+# Changelog
+
+## 0.2.0
+
+The framework lands: design tokens, base styles, app shell, and UI primitives as zero-build vanilla CSS and ES modules; embeddable Go module; conformance checker CLI.
+
+<details>
+<summary>Context</summary>
+
+0.0.1 was a name reservation across registries. 0.1.0 was tagged but never published anywhere: a release-tooling failure caused the CI gate to fail, all registry jobs were skipped, and the v0.1.0 tag was subsequently removed. 0.2.0 is therefore the first release that actually ships the framework: npm carries the browser assets (vanilla CSS and native ES modules, zero build step), PyPI carries the same assets plus the `tinymoon check` conformance checker CLI, and the Go module wraps the assets in an embed.FS for server-side embedding. All three targets are versioned together.
+
+</details>
+
+### Features
+
+- README now leads with the project philosophy: zero-build vanilla web framework, strict by design.
+- Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.
+- ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.
+- Interactive gallery documenting every token and primitive.
+- Go module exposing the assets as an embed.FS and http.Handler.
+- npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.
+- `tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.
+
+### Fixes
+
+- Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).
+
+## 0.1.0
+
+### Features
+
+- README now leads with the project philosophy: zero-build vanilla web framework, strict by design.
+- Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.
+- ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.
+- Interactive gallery documenting every token and primitive.
+- Go module exposing the assets as an embed.FS and http.Handler.
+- npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.
+- `tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.
+
+### Fixes
+
+- Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).
+
+## 0.0.1
+
+Initial placeholder release reserving the tinymoon name on npm and PyPI.
+
+### Features
+
+- Initial name-reservation placeholder release for npm and PyPI.

tinymoon-0.2.0/CLAUDE.md

@@ -0,0 +1,21 @@
+# CLAUDE.md
+
+These rules are mandatory for every AI session working in this repo. They derive from the project philosophy in `README.md` and are not negotiable.
+
+## Shipped assets (the framework itself — HTML/CSS/JS/fonts)
+
+- Keep shipped assets pure vanilla: native ES modules and plain CSS only. Never introduce a build step, bundler, transpiler, minifier, or preprocessor for shipped assets. Never add a runtime dependency.
+- Never load anything from the network at runtime: no CDNs, no external fonts, scripts, styles, or images. Vendor everything into the repo.
+- Never use native browser controls (checkbox, radio, select, file input, dialog) or `title=` attributes in framework HTML/JS. Use the framework's own primitives.
+- `border-radius` is `0` everywhere. The identity constants — three-font system, mono-for-data, glow language, 100–180ms motion timing, grain — are non-negotiable. Never add options that disable them.
+- Route all colors, spacing, and typography through design tokens. Never hardcode palette values in CSS or in canvas-rendering JS. Add or derive a token instead.
+
+## Tooling side (checker CLI, tests, dev scripts)
+
+- Dev-time tooling and own-ecosystem dependencies are permitted for the tooling side only — never for shipped assets.
+- Enforce with hard errors: conformance checks block and exit non-zero. Never add warn-and-continue behavior, `--skip`, `--ignore`, or any bypass flag for a guardrail.
+
+## General
+
+- Never reference other private projects by name in any file in this repo.
+- This repo is rlsbl-managed: follow the standard changelog and release discipline. Never push manually.

tinymoon-0.2.0/PKG-INFO

@@ -0,0 +1,129 @@
+Metadata-Version: 2.4
+Name: tinymoon
+Version: 0.2.0
+Summary: Zero-dependency vanilla JS/CSS UI framework (placeholder release)
+Project-URL: Homepage, https://github.com/smm-h/tinymoon
+Project-URL: Repository, https://github.com/smm-h/tinymoon
+Author-email: smm-h <smmh72@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: css,framework,rlsbl,ui,vanilla-js,zero-dependency
+Classifier: Development Status :: 1 - Planning
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Requires-Python: >=3.11
+Requires-Dist: strictcli
+Description-Content-Type: text/markdown
+
+# tinymoon
+
+A lean web framework that turns plain, semantic web content into a polished-looking web app.
+
+## Usage
+
+Link the four CSS layers (tokens first) and import the ES modules — no build step, no bundler:
+
+```html
+<link rel="stylesheet" href="assets/css/tokens.css">
+<link rel="stylesheet" href="assets/css/base.css">
+<link rel="stylesheet" href="assets/css/shell.css">
+<link rel="stylesheet" href="assets/css/primitives.css">
+```
+
+```js
+import { mountShell, createSettings, toast } from "tinymoon";
+// or import primitives standalone: import { toast } from "tinymoon/assets/js/toast.js";
+
+const settings = createSettings({ storageKey: "my-app", defaults: { theme: "dark" } });
+settings.load();
+settings.applyTheme();
+
+const shell = mountShell({
+  root: document.body,
+  brand: { name: "myapp", logoHTML: '<div class="wordmark">my<b>app</b></div>' },
+  routes: {
+    home: { title: "Home", icon: "library", view: () => HomeView },
+  },
+  defaultRoute: "home",
+});
+```
+
+Consumer apps can extend the built-in icon set with `registerIcons({name: svgString})` — colliding with an existing icon name is a hard error, never a silent overwrite.
+
+Views are plain objects following the contract `{root, built, build(), refresh(), setSub?}` — the [gallery](gallery/) is a complete working app and documents every token, primitive, and extension point (serve the repo root with a static server and open `/gallery/`).
+
+From Go, the assets ship as an embedded filesystem:
+
+```go
+import "github.com/smm-h/tinymoon" // tinymoon.Assets, tinymoon.FS(), tinymoon.Handler()
+```
+
+From Python, the wheel carries the assets; `tinymoon.assets_path()` returns their directory.
+
+## Philosophy
+
+**Content-first.** You bring plain, semantic content; tinymoon brings the app: shell, typography, widgets, motion. A page of tables and forms dropped into the shell should look like a finished product before you write a line of custom CSS.
+
+**Zero build, zero dependencies, zero network.** Native ES modules and plain CSS. No bundler, no transpiler, no framework runtime, no `npm install` to use it, no CDN, no external fonts — everything is vendored. These are enforced by tests, not promised.
+
+**No overhead — as a number, not a vibe.** No virtual DOM, no reactivity engine, no diffing. Views build their DOM once and mutate data in place; expensive work is cached and lazily loaded. Size budgets are checked in CI so the framework can never quietly bloat.
+
+**Gorgeous and coherent — by constraint, not by option.** The visual identity is a short list of non-negotiables: sharp corners everywhere, no native browser widgets, a three-font system with monospace for data, a restrained glow language, motion limited to 100–180ms eases. Design tokens let you re-theme and re-accent; they do not let you opt out of the identity. Coherence survives because these are not configurable.
+
+**Modular and DRY.** Every primitive is an independently importable ES module. Design tokens are the single source of truth for color, spacing, and type — including inside canvas rendering.
+
+**You define components; tinymoon defines the language.** tinymoon is not a component library you exhaust — it is a component language: an element factory, tokens, a small view contract, a namespaced event bus, and explicit extension points (routes, context-menu providers, settings schema, footer slot). A well-written consumer component is indistinguishable from a built-in.
+
+**Very strict.** Hard errors over warnings, no escape hatches, fewer options and more opinions. tinymoon ships a conformance checker that consumer projects run as a hard CI gate — external URLs, native widgets, `title=` attributes, rounded corners, and off-token colors are build failures, not style suggestions. Strictness is what keeps consumer-defined components coherent.
+
+## Conformance
+
+`tinymoon check` scans a directory's `.html`, `.css`, and `.js` files and enforces the framework's non-negotiables as hard errors:
+
+- **external-url** — no network loads: no `http://`, `https://`, or protocol-relative `//host` URLs in HTML `src`/`href`/`srcset`, CSS `url()`/`@import`, or JS import specifiers and `fetch()`/`import()` literals (XML namespace identifiers and URLs in comments/prose are fine).
+- **native-control** — no native `<select>`, `<dialog>`, or `<input type=checkbox|radio|file>`, in markup or created from JS; use the framework's primitives.
+- **title-attr** — no `title=` attributes (SVG `<title>` child elements are fine); use the tooltip primitive instead.
+- **border-radius** — no `border-radius` (or `borderRadius` in JS) other than `0`/`0px`; corners are sharp everywhere.
+- **raw-color** — no color literals (hex, `rgb()`/`rgba()`/`hsl()`/`hsla()`/`oklch()`) outside custom-property definitions in `:root`/`html[data-theme=...]` blocks; everything else goes through `var(--token)` or `cssVar()`. (Named CSS colors are not checked.)
+
+Run it against your project's web directory:
+
+```
+uvx tinymoon check --dir ./web
+```
+
+or install it once with `uv tool install tinymoon` and run `tinymoon check --dir ./web`. The `--dir` flag is required — the checker never scans the current directory implicitly.
+
+It prints one line per violation (`path:line: [rule-id] message`) plus a summary, and exits non-zero if anything is found. There is deliberately no `--skip`, `--ignore`, warning mode, or any other bypass — a violation is a build failure.
+
+If a specific URL genuinely must be exempt, add it to a `tinymoon-allowlist.txt` file at the scanned directory root — one exact URL per line, `#` comments allowed. The allowlist is a reviewable file in your repo, not a CLI flag.
+
+Use it as a hard gate in CI:
+
+```yaml
+- run: uvx tinymoon check --dir ./web
+```
+
+The step fails the build on any violation; there is nothing to configure and nothing to bypass.
+
+## Install
+
+npm:
+
+```
+npm install tinymoon
+```
+
+PyPI:
+
+```
+pip install tinymoon
+```
+
+## License
+
+MIT