v0.5.0

The augmentation release: forms, data display, state, realtime, and app-chrome primitive families; an isolation-boundary model (tm-embed, vendor quarantine) and expanded conformance enforcement; per-tier size budgets with subpath exports and typed barrels.

Context

A coordinated framework build-out driven by real consumer needs: the widget families (inputs, slider, table, virtual list, tree, filters, feed, charts, drawer, palette, view factory), the L2 state story (store/bind/reconcile), realtime transports, the identity-surface doctrine with loads-vs-navigations re-scoping, the tm-embed boundary and hash-pinned vendor quarantine, the native-control ban expansion now that every replacement factory ships, portable conformance artifacts for non-Python consumers, and the package restructure into budgeted tiers (core frozen, widgets/state/chrome/controls tiers, five stylesheets, tokens.json). Validated end-to-end against a real consumer migration before release.

Breaking

• Native-control ban expanded. tinymoon check and the runtime auditor now reject native <textarea> and native <input> of every type that has a shipped replacement: text/password/email/url/search/tel (use createInput), range (createSlider), number (createNumber), time (createTimePicker), date (createDatePicker), alongside checkbox/radio/file and <select>/<dialog> as before. A bare typeless <input> also fires (it defaults to text). type="hidden" and type="color" stay legal. Consumer code using these raw natives now fails the checker -- migrate to the named factories.

Features

• Command palette, shortcuts, lazy mounting, async-state blocks. New tinymoon/chrome modules: a fuzzy command palette (opt-in via installPalette), a keyboard-shortcut binder, IntersectionObserver-gated lazy mounting, and loading/empty/error state blocks with a renderAsync helper.
• Toast action button. toast(msg, kind, {action: {label, onClick}}) adds one action button that keeps the toast on screen until the action is taken or it is dismissed; acting dismisses.
• Tri-state theme. Theme now supports "system" (follows the OS light/dark preference and re-resolves live when it changes), alongside explicit light/dark. Adds a cycleTheme(store) helper and a THEME_BOOT_SNIPPET inline no-flash boot script.
• Documentation. New README and wiki sections cover the tinymoon/chrome barrel (async-state blocks, lazyMount, shortcuts, command palette), the toast action button, and the tri-state theme with its no-flash boot snippet.
• Shell views. New createView(render) view factory, an eager-route flag to bypass lazy mounting, and shell.announce() for live-region route announcements.
• Drawer primitive. New openDrawer() overlay primitive plus swipe-to-close on the shell mobile navigation drawer.
• Tab panels. createTabPanels composes an APG tab bar with lazily-mounted panels.
• Grid layout. createGrid CSS-first preset layout primitive.
• Icon button. iconButton — a stateful topbar icon button instance.
• Data-display widgets, part 2. New primitives: keyboard-navigable tree, filter bar with chips, load-more, breadcrumbs, sparkline, chart container, and activity feed.
• Data-display widgets. New data-display barrel: badge, createStat/renderStats, sortable createTable, and windowed createVirtualList, with their stylesheet.
• Status color token. New --gold warn/caution status color with contrast-checked pairs in both themes.
• Realtime, net, and format helpers. tinymoon/extras gains realtime (SSE/WebSocket with backoff), net ApiError/auth/options, and fmtTime/relativeTime/liveRelativeTime formatters.
• Settings subscriptions. settings.subscribe(key, cb) (or null for all keys) with store-contract parity.
• State layer. New tinymoon/state barrel with an L2 state layer: store, bind, and reconcile.
• Number stepper. createNumber wraps a native input[type=number] with stepper buttons.
• Time picker. createTimePicker — a 24-hour HH:MM picker with locale-aware display.
• Combobox and multi-select. New createCombobox and createMultiSelect typeahead primitives.
• Accordion. createAccordion — grid-rows animated disclosure panels.
• New icons. plus, minus, and clock icons for steppers and the time picker.
• Form controls. Styled-native createInput, createTextarea, createField, and createSlider.
• Embed isolation. createEmbed isolation-boundary primitive with iframe and shadow-DOM modes.
• Vendor quarantine. Conformance checker gains a hash-pinned vendor quarantine (unpinned-vendor rule) for sanctioned third-party code.
• Dialog ban. Conformance checker now statically flags consumer <dialog> as a banned native control.
• External-URL rule. The external-url check now treats <a>/<area> href as navigation rather than a resource load, so hyperlinks are no longer flagged.
• Conformance artifacts. Committed rules.json, test corpus, and expectations.json plus a generator, enabling cross-language conformance consumption.
• Token export artifact. Committed assets/tokens.json plus its generator, so consumers can read design tokens as data.
• Subpath exports. Per-module subpath exports for every shipped JS module.
• TypeScript types for subpaths. types field and per-export types conditions wired into package.json.
• TypeScript declarations. Type declarations for the tinymoon/extras barrel.
• Documentation. README documents the Phase 6A primitives and the chrome-js tier.
• Documentation. README documents the state and data-display widgets barrels and names all budget tiers.
• Documentation. README documents the Phase 3B control primitives and the controls-js tier.
• Documentation. README documents the createInput, createTextarea, createField, and createSlider primitives.
• Documentation. New README section on running conformance from non-Python CI (portable artifacts, Go worked example, full-scan CLI path).
• Documentation. README documents subpath imports, the TypeScript types stance, and the per-tier size promise.
• Documentation. README documents the vendored third-party code quarantine mechanism.
• Documentation. README documents widgets.css as the optional fifth data-display stylesheet.
• Documentation. README notes the static <dialog> ban and the framework openModal exemption.
• Documentation. README documents copyButton and kebabButton as sanctioned one-shot utilities.
• setPageSub is now exported from the core barrel (import { setPageSub } from "tinymoon"), alongside announce. Views that do not go through createView can set the shell's topbar page-subtitle without reaching into the DOM.
• Table row and cell class hooks. createTable gains rowClass(row) and per-column cellClass(value, row) — return a class string to tint whole rows or individual cells from your own data. Classes are appended to the framework's own tr/td classes (never replacing them) and re-applied on every setRows().
• Seek slider variant. createSlider({variant: "seek"}) is an invisible position scrubber for laying over app-drawn visuals (waveform/timeline canvases): the track and thumb go visually transparent while the full-area hit target, focus-visible outline, and slider ARIA stay intact. Your app draws the visuals underneath; the seek slider only scrubs.

Fixes

• Light theme. The accent highlight color is no longer illegible against the accent -- link and active-state highlights now stay clearly distinguishable in the light theme.
• Fix. The mobile hamburger now opens the drawer, the drawer closes on Escape, and the icon button has an accessible name.
• Fix. Small (10px) stat and table labels now use --text-dim to keep 4.5:1 contrast when grain-composited.
• Fix. The time picker popover is now positioned in viewport coordinates and hidden when closed.
• Fix. The hidden native input behind createFileInput now has an accessible name.
• Fix. A focus-shown hovercard now stays glued to its trigger when focus scrolls it into view.