tinymoon 0.0.1__tar.gz → 0.3.0__tar.gz

tinymoon-0.3.0/.github/workflows/ci-go.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# Per-SHA group: re-runs of the same commit dedupe, but a new commit never
+# cancels an earlier commit's in-flight run (release CI conclusions stay intact).
+concurrency:
+  group: ${{ github.workflow_ref }}-${{ github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      # go.mod: go 1.26
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: go vet ./...
+      - run: go test ./... -race -short -timeout=10m

{tinymoon-0.0.1 → tinymoon-0.3.0}/.github/workflows/publish.yml

@@ -7,7 +7,7 @@ concurrency:
   group: ${{ github.workflow_ref }}-${{ github.ref }}
   cancel-in-progress: false
 permissions:
-  contents: read
+  contents: write
   id-token: write
 jobs:
   gate:
@@ -145,7 +145,8 @@ jobs:
       # --access public is hardcoded on purpose: scoped packages are forbidden
       # in this ecosystem, and unscoped public packages require --access public.
       # --provenance is toggled by the pipeline's `provenance` config key.
-      - run: npm publish --access public ${{ steps.dist-tag.outputs.tag }}
+      - run: npm publish --provenance --access public ${{ 
+          steps.dist-tag.outputs.tag }}
         if: steps.check-npm.outputs.skip != 'true'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -166,3 +167,36 @@ jobs:
       - uses: pypa/gh-action-pypi-publish@release/v1
         with:
           skip-existing: true
+  go:
+    needs: gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
+      - name: Scan source for secrets
+        run: |
+          gitleaks dir .
+      # tinymoon's Go module is a library (embed.FS + http.Handler) -- there
+      # is no main package, so goreleaser has nothing to build. For a Go
+      # library the pushed tag IS the publish: the module proxy serves it
+      # straight from git. This step primes proxy.golang.org and hard-fails
+      # if the tagged version does not resolve. Like the gate job, it assumes
+      # the run is at the tag ref (release trigger or dispatch at the tag).
+      - name: Verify module on the Go proxy
+        run: |
+          set -euo pipefail
+          mod="$(go list -m)"
+          ver="$GITHUB_REF_NAME"
+          dir="$(mktemp -d)"
+          cd "$dir"
+          go mod init proxyprime
+          GOPROXY=https://proxy.golang.org go mod download "${mod}@${ver}"
+          echo "Go proxy serves ${mod}@${ver}"

tinymoon-0.3.0/.rlsbl/bases/.github/workflows/ci-go.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# Per-SHA group: re-runs of the same commit dedupe, but a new commit never
+# cancels an earlier commit's in-flight run (release CI conclusions stay intact).
+concurrency:
+  group: ${{ github.workflow_ref }}-${{ github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      # go.mod: go 1.26
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: go vet ./...
+      - run: go test ./... -race -short -timeout=10m

{tinymoon-0.0.1 → tinymoon-0.3.0}/.rlsbl/bases/.github/workflows/publish.yml

@@ -7,7 +7,7 @@ concurrency:
   group: ${{ github.workflow_ref }}-${{ github.ref }}
   cancel-in-progress: false
 permissions:
-  contents: read
+  contents: write
   id-token: write
 jobs:
   gate:
@@ -145,7 +145,8 @@ jobs:
       # --access public is hardcoded on purpose: scoped packages are forbidden
       # in this ecosystem, and unscoped public packages require --access public.
       # --provenance is toggled by the pipeline's `provenance` config key.
-      - run: npm publish --access public ${{ steps.dist-tag.outputs.tag }}
+      - run: npm publish --provenance --access public ${{ 
+          steps.dist-tag.outputs.tag }}
         if: steps.check-npm.outputs.skip != 'true'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -166,3 +167,26 @@ jobs:
       - uses: pypa/gh-action-pypi-publish@release/v1
         with:
           skip-existing: true
+  go:
+    needs: gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
+      - name: Scan source for secrets
+        run: |
+          gitleaks dir .
+      - uses: goreleaser/goreleaser-action@v7
+        with:
+          version: ~> v2
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

tinymoon-0.3.0/.rlsbl/bases/.rlsbl/lint/go.toml

@@ -0,0 +1,17 @@
+[forbidden-imports]
+modules = [
+    "net/http",
+    "github.com/spf13/cobra",
+    "github.com/urfave/cli",
+]
+
+[stdout]
+enabled = true
+ignore = []
+
+[entry-point]
+enabled = true
+ignore = []
+
+[files]
+exclude = []

tinymoon-0.3.0/.rlsbl/bases/VERSION

@@ -0,0 +1 @@
+0.0.1

tinymoon-0.3.0/.rlsbl/changes/0.1.0.jsonl

@@ -0,0 +1,16 @@
+{"id":"18c1cbdfd89f0985a0ff2a57d2ee4b65a7ff437d638fa135","commits":["082cacea8f4b501b69715af612ec1ac9f5e50c49"],"user_facing":false}
+{"id":"18c1cc207af6d28ae50104a7c416497d834df9c5e7eb060d","commits":["cb890eca94f6b4a257119bd8ce27f09cffb87b12"],"user_facing":true,"description":"README now leads with the project philosophy: zero-build vanilla web framework, strict by design.","type":"feature"}
+{"id":"18c1cc216d0e32fa1029e07eadb84cc8a47ea09d511e4fc4","commits":["604bbf9419bf4db817c4ad2a3a6226299b54ce2e"],"user_facing":false}
+{"id":"18c1d16c4ff40426c9396b1d34574a9687d9e70ce70f028e","commits":["477451297681bfbe84958583473fa9dde3256a26"],"user_facing":true,"description":"Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.","type":"feature"}
+{"id":"18c1d16c59cfd8eba0d008f9942249e7a407ef9da52d1250","commits":["c178a68686e7cd6f827a2d45b2066906300ef471"],"user_facing":true,"description":"ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.","type":"feature"}
+{"id":"18c1d16c62a5f347fe8d55bcfd294566a5cadd9620cd601f","commits":["29a10e0467085db87204b1255e23e5ccbc0e30fc"],"user_facing":true,"description":"Interactive gallery documenting every token and primitive.","type":"feature"}
+{"id":"18c1d16c6be3c768cb6a5bcd8c09475a90fd633aa0b9ce15","commits":["0aae65bc64a8ca820bd7b67bfc7357ddf324a0d9"],"user_facing":true,"description":"Go module exposing the assets as an embed.FS and http.Handler.","type":"feature"}
+{"id":"18c1d16c7517dc51e5b33cf473ca45a5ad21cc8e4fc5b519","commits":["996a1c49badcf2c4edb2ef5c4d1d28c45d51d8b7","3b7e85aedd9d3a813d2456c53571dbeaafdcf76a"],"user_facing":true,"description":"npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.","type":"feature"}
+{"id":"18c1d16c7e995ce7d5018132b0124ffa89328c3cef44a51c","commits":["b4261db38b071bc5a7d4b83ae206503de249a71b"],"user_facing":false}
+{"id":"18c1d25bee418647d9089eaebbfb4167813a6e53edb43057","commits":["d70a61efb8f76f627a43d204a97d47ec6e5d788e","fac0004d3e14b8f483097c977d8ee32c304566c0"],"user_facing":true,"description":"`tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.","type":"feature"}
+{"id":"18c1d25bf5a91bee7158b15a377a4597abeb94aac506f2f7","commits":["4f58441627685fb483be937a625b4911269c0f1e"],"user_facing":false}
+{"id":"18c1d359658284a3d564b15a8c5345e89c1840af08132930","commits":["a0327331794a1382163146b058315965b3f813a2"],"user_facing":false}
+{"id":"18c1d369a6b5de997e56f62f572e4c12b8d2f6a51637cc98","commits":["8d4491cbde919706bbe3a6e0f3d21466bde5a66c","b14c8a479c939c4da141001181d1d1e697944ca8"],"user_facing":true,"description":"Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).","type":"fix"}
+{"id":"18c1d36fc6a2bee0ceb0f88bbb914d3f9ba8e6eab8e4d970","commits":["0d4fc35f1568821d402c4232b38f7a5b79669ef4"],"user_facing":false}
+{"id":"18c1d379a83bdaa08da38f9076534ed596435afec77c2712","commits":["de1df0c8c815f7c6401b0cf0b8cc012d3c3cc724"],"user_facing":false}
+{"id":"18c1d382ff296fe949f8bc2ac98e4a1f9b00e33b2e1f9968","commits":["0022b941f2cb31cc5a9330eb00885d994de861fe"],"user_facing":false}

tinymoon-0.3.0/.rlsbl/changes/0.1.0.md

@@ -0,0 +1,15 @@
+## 0.1.0
+
+### Features
+
+- README now leads with the project philosophy: zero-build vanilla web framework, strict by design.
+- Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.
+- ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.
+- Interactive gallery documenting every token and primitive.
+- Go module exposing the assets as an embed.FS and http.Handler.
+- npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.
+- `tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.
+
+### Fixes
+
+- Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).

tinymoon-0.3.0/.rlsbl/changes/0.2.0.jsonl

@@ -0,0 +1,18 @@
+{"id":"18c1d43b7a2262ff2e0202cd43804fc1ba48268d5e5e2a51","commits":["932014ebb4ebb376e31326dc01dbb2912a83e29c"],"user_facing":false}
+{"id":"18c1d59ca44d85ed8f777e7a40344bc79d266d41d9e236e2","commits":["082cacea8f4b501b69715af612ec1ac9f5e50c49"],"user_facing":false}
+{"id":"18c1d59cbddf5121dd287f4b22d0448d9c0e0c4c38502150","commits":["cb890eca94f6b4a257119bd8ce27f09cffb87b12"],"user_facing":true,"description":"README now leads with the project philosophy: zero-build vanilla web framework, strict by design.","type":"feature"}
+{"id":"18c1d59cda4308380fde673ae46f4dcd8df18d20ac87a7e4","commits":["604bbf9419bf4db817c4ad2a3a6226299b54ce2e"],"user_facing":false}
+{"id":"18c1d59cf535841fc7e98b450a184c989134a9e151148174","commits":["477451297681bfbe84958583473fa9dde3256a26"],"user_facing":true,"description":"Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.","type":"feature"}
+{"id":"18c1d59d09485a94390cdfb95b6a4654a0b11fe0c662d4ed","commits":["c178a68686e7cd6f827a2d45b2066906300ef471"],"user_facing":true,"description":"ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.","type":"feature"}
+{"id":"18c1d59d1bc2b6642a34bb811d9c44069ff56ab9e0a0dfc4","commits":["29a10e0467085db87204b1255e23e5ccbc0e30fc"],"user_facing":true,"description":"Interactive gallery documenting every token and primitive.","type":"feature"}
+{"id":"18c1d59d2f3afceed9b010336cd842c7a5ae63bdef3a05c2","commits":["0aae65bc64a8ca820bd7b67bfc7357ddf324a0d9"],"user_facing":true,"description":"Go module exposing the assets as an embed.FS and http.Handler.","type":"feature"}
+{"id":"18c1d59d63dd4aa47d26c99423a0428fab687212df723be9","commits":["996a1c49badcf2c4edb2ef5c4d1d28c45d51d8b7","3b7e85aedd9d3a813d2456c53571dbeaafdcf76a"],"user_facing":true,"description":"npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.","type":"feature"}
+{"id":"18c1d59ffb346491d2e75c3552f74a4cb9e1e08675edb22a","commits":["b4261db38b071bc5a7d4b83ae206503de249a71b"],"user_facing":false}
+{"id":"18c1d5a0236fd39cbf5363a20fb14cf989230047fe0d0a1a","commits":["d70a61efb8f76f627a43d204a97d47ec6e5d788e","fac0004d3e14b8f483097c977d8ee32c304566c0"],"user_facing":true,"description":"`tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.","type":"feature"}
+{"id":"18c1d5abe5649f48ca9540f667c34a62be80da1c71d6069d","commits":["4f58441627685fb483be937a625b4911269c0f1e"],"user_facing":false}
+{"id":"18c1d5abeeec42bacb98f6f8bf434bdd814ad752ea94599a","commits":["a0327331794a1382163146b058315965b3f813a2"],"user_facing":false}
+{"id":"18c1d5abf8cf452da0f6f26530f549b28075eb2a606e7383","commits":["8d4491cbde919706bbe3a6e0f3d21466bde5a66c","b14c8a479c939c4da141001181d1d1e697944ca8"],"user_facing":true,"description":"Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).","type":"fix"}
+{"id":"18c1d5ac0308b8767c3ae6a92e1b4214a590acb5425b791e","commits":["0d4fc35f1568821d402c4232b38f7a5b79669ef4"],"user_facing":false}
+{"id":"18c1d5ac0e9f013a3065b2908de04c4d8f183f7b6d4e3989","commits":["de1df0c8c815f7c6401b0cf0b8cc012d3c3cc724"],"user_facing":false}
+{"id":"18c1d5ac19479beecbfe680ebdc747aea2f4c5f9478cb8cc","commits":["0022b941f2cb31cc5a9330eb00885d994de861fe"],"user_facing":false}
+{"id":"18c1d5fb7c39c10f0ead38c10d724d78be3530b7444c940e","commits":["8d4db2d807aa5ca5715fda2f7f1a69be46fc2a35"],"user_facing":false}

tinymoon-0.3.0/.rlsbl/changes/0.2.0.md

@@ -0,0 +1,24 @@
+## 0.2.0
+
+The framework lands: design tokens, base styles, app shell, and UI primitives as zero-build vanilla CSS and ES modules; embeddable Go module; conformance checker CLI.
+
+<details>
+<summary>Context</summary>
+
+0.0.1 was a name reservation across registries. 0.1.0 was tagged but never published anywhere: a release-tooling failure caused the CI gate to fail, all registry jobs were skipped, and the v0.1.0 tag was subsequently removed. 0.2.0 is therefore the first release that actually ships the framework: npm carries the browser assets (vanilla CSS and native ES modules, zero build step), PyPI carries the same assets plus the `tinymoon check` conformance checker CLI, and the Go module wraps the assets in an embed.FS for server-side embedding. All three targets are versioned together.
+
+</details>
+
+### Features
+
+- README now leads with the project philosophy: zero-build vanilla web framework, strict by design.
+- Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.
+- ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.
+- Interactive gallery documenting every token and primitive.
+- Go module exposing the assets as an embed.FS and http.Handler.
+- npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.
+- `tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.
+
+### Fixes
+
+- Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).

tinymoon-0.3.0/.rlsbl/changes/0.3.0.jsonl

@@ -0,0 +1,2 @@
+{"id":"18c1d65de3b9d2de86a890bcf7074862b328946e3385930b","commits":["c6a33774c6adba04fc032378956edf906b18c20d"],"user_facing":false}
+{"id":"18c1e67b4ce0af025424ac641be147a984cd844ae78a2fd3","commits":["acaf60b814a213bd132770c2143b33919740f9b0","e4dc2294b4194c08ee5dc8da7d1b2a7351dc1900","fecd63801e77e57eae3cb6b2aea82d797fd7f351"],"user_facing":true,"description":"mountShell gains an onRoute(routeKey, sub) callback and a refreshCurrent() helper; toast errors can be mirrored via setToastErrorHook().","type":"feature"}

tinymoon-0.3.0/.rlsbl/changes/0.3.0.md

@@ -0,0 +1,7 @@
+## 0.3.0
+
+Shell routing hooks (onRoute, refreshCurrent) and a toast error hook for log mirroring.
+
+### Features
+
+- mountShell gains an onRoute(routeKey, sub) callback and a refreshCurrent() helper; toast errors can be mirrored via setToastErrorHook().

{tinymoon-0.0.1 → tinymoon-0.3.0}/.rlsbl/config.json

@@ -1,17 +1,23 @@
 {
   "targets": [
     "npm",
-    "pypi"
+    "pypi",
+    "go"
   ],
   "private": false,
   "pipelines": {
     "npm": {
       "type": "npm",
-      "local": false
+      "local": false,
+      "provenance": true
     },
     "pypi": {
       "type": "pypi",
       "local": false
+    },
+    "go": {
+      "type": "go",
+      "local": false
     }
   }
 }

tinymoon-0.3.0/.rlsbl/lint/go.toml

@@ -0,0 +1,17 @@
+[forbidden-imports]
+modules = [
+    "net/http",
+    "github.com/spf13/cobra",
+    "github.com/urfave/cli",
+]
+
+[stdout]
+enabled = true
+ignore = []
+
+[entry-point]
+enabled = true
+ignore = []
+
+[files]
+exclude = []

tinymoon-0.3.0/.rlsbl/managed-files.json

@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "files": {
+    ".github/workflows/ci-pypi.yml": "0bf3efb9f0e1ae3b75c2e1b18929bfcee7b69d7341e2093844bcda06a96dedb4",
+    ".github/workflows/ci-go.yml": "1d32c5f7d5242080895136e2e5773a1ff2a0cf0a3a2bf098b37e78c4239a9a61",
+    ".npmignore": "7c0eea9785c0318aeb39bf8b670ce8384f4a5b812fde69ce23d7d018057325a3",
+    "VERSION": "e6635045e1d2478ec4ca712d8c0e1dfcef8bb7b5b1e8e3bb560d37fe399a9e72",
+    ".github/workflows/publish.yml": "6738e166964a6f4e3741ef8b634b0829f2559d6eff1d3c5fafed743dc933ae07",
+    "CHANGELOG.md": "2565aecb5d684d6cd56b6bf982b956ec807949b67dedb9c8c93f154d09ac943f",
+    ".gitignore": "80572c78bfc39d5b9de7b7a327b44934ee8c8205dcf7179ff3594d854bb377b6",
+    ".rlsbl/changes/unreleased.jsonl": "2e04e2b43ae64dcd8b40d7ed1635d58a4559ce07e7293cf31354d376df5051f8",
+    ".rlsbl/lint/python.toml": "9cfbcef2e010d5fad243437bf2fd8df54a1fae70ee0762f9d11da70fe207501c",
+    ".rlsbl/lint/npm.toml": "baa36014e65923d8cc5c8b83c77fa651da79351627570476402da66840027645",
+    ".rlsbl/lint/go.toml": "807d5cf760baad6d571a5bfd43cb163efe356f7462ba9f1918d72de45f62339f"
+  }
+}

tinymoon-0.3.0/.rlsbl/releases/v0.2.0.toml

@@ -0,0 +1,14 @@
+# Version bump type: patch, minor, major, hotfix, or prerelease
+bump = "minor"
+# Short description of this release (required)
+description = "The framework lands: design tokens, base styles, app shell, and UI primitives as zero-build vanilla CSS and ES modules; embeddable Go module; conformance checker CLI."
+# Optional context explaining why these changes were made
+context = """
+0.0.1 was a name reservation across registries. 0.1.0 was tagged but never published anywhere: a release-tooling failure caused the CI gate to fail, all registry jobs were skipped, and the v0.1.0 tag was subsequently removed. 0.2.0 is therefore the first release that actually ships the framework: npm carries the browser assets (vanilla CSS and native ES modules, zero build step), PyPI carries the same assets plus the `tinymoon check` conformance checker CLI, and the Go module wraps the assets in an embed.FS for server-side embedding. All three targets are versioned together.
+"""
+# Pre-release identifier: alpha, beta, rc, or stable
+# preid = ""
+# Set to true to generate a blog post for this release
+# blog = false
+include = ["npm", "pypi", "go"]
+exclude = []

tinymoon-0.3.0/.rlsbl/releases/v0.3.0.toml

@@ -0,0 +1,12 @@
+# Version bump type: patch, minor, major, hotfix, or prerelease
+bump = "minor"
+# Short description of this release (required)
+description = "Shell routing hooks (onRoute, refreshCurrent) and a toast error hook for log mirroring."
+# Optional context explaining why these changes were made
+context = ""
+# Pre-release identifier: alpha, beta, rc, or stable
+# preid = ""
+# Set to true to generate a blog post for this release
+# blog = false
+include = ["npm", "pypi", "go"]
+exclude = []

tinymoon-0.3.0/.strictcli/schema.json

@@ -0,0 +1,66 @@
+{
+  "schema_version": 1,
+  "defaults": {
+    "schema_version": 1,
+    "app": {
+      "env_prefix": null,
+      "config": false,
+      "global_flags": [],
+      "commands": {},
+      "groups": {},
+      "deprecated": {},
+      "tag_contracts": {}
+    },
+    "flag": {
+      "short": null,
+      "default": null,
+      "env": null,
+      "choices": null,
+      "repeatable": false,
+      "unique": false,
+      "env_separator": null,
+      "negatable": null,
+      "hidden": false
+    },
+    "arg": {
+      "type": "str",
+      "required": true,
+      "default": null,
+      "variadic": false,
+      "choices": null
+    },
+    "command": {
+      "passthrough": false,
+      "flags": [],
+      "args": [],
+      "tags": [],
+      "constraints": [],
+      "hidden": false,
+      "interactive": false
+    },
+    "group": {
+      "commands": {},
+      "groups": {},
+      "deprecated": {},
+      "tags": [],
+      "hidden": false
+    }
+  },
+  "project_id": "tinymoon",
+  "name": "tinymoon",
+  "version": "0.3.0",
+  "help": "Tooling for the tinymoon web framework. Ships the conformance checker that enforces the framework's non-negotiables (no external URLs, no native browser controls, no title= attributes, no rounded corners, no off-token colors) as hard errors.",
+  "commands": {
+    "check": {
+      "name": "check",
+      "help": "Recursively scan the .html/.css/.js files under --dir for conformance violations: external URLs (external-url), native browser controls (native-control), title= attributes (title-attr), non-zero border-radius (border-radius), and off-token color literals (raw-color). Prints one line per violation (path:line: [rule-id] message) and a summary count. Exits 0 when clean, 1 on any violation -- there is no bypass. An optional tinymoon-allowlist.txt at the scanned directory root (one exact URL per line, # comments allowed) exempts exact URL matches from the external-url rule.",
+      "flags": [
+        {
+          "name": "dir",
+          "type": "str",
+          "help": "Directory to scan (required -- the checker never scans the current directory implicitly)"
+        }
+      ]
+    }
+  }
+}

tinymoon-0.3.0/CHANGELOG.md

@@ -0,0 +1,60 @@
+<!-- Generated by rlsbl from .rlsbl/changes/ — do not edit -->
+
+# Changelog
+
+## 0.3.0
+
+Shell routing hooks (onRoute, refreshCurrent) and a toast error hook for log mirroring.
+
+### Features
+
+- mountShell gains an onRoute(routeKey, sub) callback and a refreshCurrent() helper; toast errors can be mirrored via setToastErrorHook().
+
+## 0.2.0
+
+The framework lands: design tokens, base styles, app shell, and UI primitives as zero-build vanilla CSS and ES modules; embeddable Go module; conformance checker CLI.
+
+<details>
+<summary>Context</summary>
+
+0.0.1 was a name reservation across registries. 0.1.0 was tagged but never published anywhere: a release-tooling failure caused the CI gate to fail, all registry jobs were skipped, and the v0.1.0 tag was subsequently removed. 0.2.0 is therefore the first release that actually ships the framework: npm carries the browser assets (vanilla CSS and native ES modules, zero build step), PyPI carries the same assets plus the `tinymoon check` conformance checker CLI, and the Go module wraps the assets in an embed.FS for server-side embedding. All three targets are versioned together.
+
+</details>
+
+### Features
+
+- README now leads with the project philosophy: zero-build vanilla web framework, strict by design.
+- Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.
+- ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.
+- Interactive gallery documenting every token and primitive.
+- Go module exposing the assets as an embed.FS and http.Handler.
+- npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.
+- `tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.
+
+### Fixes
+
+- Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).
+
+## 0.1.0
+
+### Features
+
+- README now leads with the project philosophy: zero-build vanilla web framework, strict by design.
+- Design tokens, base styles, app shell, and UI primitives shipped as plain CSS, with vendored fonts.
+- ES-module UI primitives: app shell with hash router, modals, toasts, tooltips, custom select, context menus, popovers, controls, settings store, and mini-wiki builder.
+- Interactive gallery documenting every token and primitive.
+- Go module exposing the assets as an embed.FS and http.Handler.
+- npm package exports the ES modules; the PyPI wheel ships the assets, exposed via `tinymoon.assets_path()`.
+- `tinymoon check` conformance checker: scans HTML/CSS/JS for external URLs, native controls, title attributes, rounded corners, and off-token colors; hard CI gate, no bypass flags.
+
+### Fixes
+
+- Icon set trimmed to framework/UI staples (audio-transport icons removed); new `registerIcons()` extension point for consumer icons (hard error on name collision). package.json now declares an `exports` map locking the documented entry points (`tinymoon` and `tinymoon/assets/*`).
+
+## 0.0.1
+
+Initial placeholder release reserving the tinymoon name on npm and PyPI.
+
+### Features
+
+- Initial name-reservation placeholder release for npm and PyPI.

tinymoon-0.3.0/CLAUDE.md

@@ -0,0 +1,21 @@
+# CLAUDE.md
+
+These rules are mandatory for every AI session working in this repo. They derive from the project philosophy in `README.md` and are not negotiable.
+
+## Shipped assets (the framework itself — HTML/CSS/JS/fonts)
+
+- Keep shipped assets pure vanilla: native ES modules and plain CSS only. Never introduce a build step, bundler, transpiler, minifier, or preprocessor for shipped assets. Never add a runtime dependency.
+- Never load anything from the network at runtime: no CDNs, no external fonts, scripts, styles, or images. Vendor everything into the repo.
+- Never use native browser controls (checkbox, radio, select, file input, dialog) or `title=` attributes in framework HTML/JS. Use the framework's own primitives.
+- `border-radius` is `0` everywhere. The identity constants — three-font system, mono-for-data, glow language, 100–180ms motion timing, grain — are non-negotiable. Never add options that disable them.
+- Route all colors, spacing, and typography through design tokens. Never hardcode palette values in CSS or in canvas-rendering JS. Add or derive a token instead.
+
+## Tooling side (checker CLI, tests, dev scripts)
+
+- Dev-time tooling and own-ecosystem dependencies are permitted for the tooling side only — never for shipped assets.
+- Enforce with hard errors: conformance checks block and exit non-zero. Never add warn-and-continue behavior, `--skip`, `--ignore`, or any bypass flag for a guardrail.
+
+## General
+
+- Never reference other private projects by name in any file in this repo.
+- This repo is rlsbl-managed: follow the standard changelog and release discipline. Never push manually.