v0.7.0

Consumer-driven patch wave: vendored-framework recognition by hash identity, fenced code blocks in doc markdown, put/patch/del net helpers, table row event hooks, 2+1/1+2 grid presets, a WCAG-verified danger button, and a Python-side theme boot snippet — plus checker false-positive fixes and a hard error for a silent route misconfiguration.

Context

every item traces to frictions reported by the four real consumer migrations completed on 0.6.1; the vendored-identity mechanism extends the provenance doctrine so no-backend consumers can vendor the framework without quarantining it; the danger-button ladder exists because the naive red fill fails WCAG in dark theme (measured).

Features

• createLoadMore now has a load() method. Programmatically trigger the first (or next) page without synthesizing a button click.
• createGrid gains 2+1 and 1+2 presets. Asymmetric 3-slot layouts — a row of two above one full-width cell, and its mirror — that collapse to a single column on narrow screens.
• createTable gains onRowClick and onRowHover. Event-delegated row hooks — onRowClick(row, index, event) and onRowHover(row | null, index, event) — that survive setRows() re-renders and never fire for the header or the "more rows" note.
• net gains put, patch, and del. JSON mutation verbs mirroring post() exactly — ApiError on non-OK, the pre-throw onError hook, the auth-header hook, merged headers, and the abort signal; del sends no body.
• renderDocMd now supports fenced code blocks. Triple-backtick blocks render verbatim into <pre><code> (an info string like ```js is accepted and ignored; no syntax highlighting). Tables and blockquotes remain out of scope; the inline renderMiniMd dialect is unchanged.
• createSwitch now has a get() method. Read the switch's current on/off state directly, matching createCheckbox/createRadio.
• createFileInput now has an open() method. Programmatically open the native file picker, the same as clicking the styled trigger.
• Vendored tinymoon assets now pass the checker by identity. A file whose bytes sha256-match a packaged framework asset is recognized as framework-own wherever a consumer serves it from (no quarantine needed); editing it breaks the match and it is scanned normally.
• New .btn.danger button variant. A destructive-action button — solid red fill with a white label — backed by a new red token ladder (--red-solid, --red-solid-hi, --on-red, --red-glow) that clears WCAG AA (4.5:1) contrast in both themes.
• The PyPI package now exports THEME_BOOT_SNIPPET. from tinymoon import THEME_BOOT_SNIPPET gives Python servers the same pre-paint theme script as the JS export (kept byte-for-byte identical by a sync test), so a server-rendered page can inline it without importing the JS module.
• New consumption docs. README now covers typed consumption when serving assets yourself (install tinymoon as a devDependency purely for types), the vendored-asset identity story, badges as one-shot elements (mutate or replace, no update API), and the fixed-height virtual-list constraint; index.d.ts annotates each barrel export's real subpath module.

Fixes

• A route view that is a plain object now hard-errors instead of rendering nothing. Passing a built view object where mountShell expects a factory previously failed silently; it now throws a message naming the fix (wrap it: () => view).
• Two checker false positives fixed for consumers. HTML numeric character references (', ’) are no longer flagged as raw #RGB colors; and the plain-object .title false positive is now documented with its bracket-notation workaround (obj["title"] = x). Genuine hex colors and real element.title writes are still detected.