feat(bazel): standalone building block authority

[Jess Sullivan (Jesssullivan)]

Sync to 0.2.2, standalone authority. Part of TIN-652. Validated: typecheck:✓ build:✓ publint:✓

[linear]

TIN-652 Building Block Promotion Program — Stage 0 Pre-Triage & Repeatable Model

Problem

66 Bazel registry modules exist at 0.1.0 seed state — empty integrity hashes, zero inter-module deps, monorepo strip_prefix sources. 23 standalone repos have MODULE.bazel but no flake.nix; 2 (auth-pg, auth-redis) have flake.nix but no MODULE.bazel. Consumers hand-roll auth, scheduling, content, and identity code instead of consuming building blocks. Auth case study: ~40-50% re-implementation per consumer.

Pre-Triage Scan Results (Stage 0) — Complete

Package Health (monorepo scan 2026-04-26)

• 57 packages in tinyland.dev/packages/ (excluding templates)
• All 57 have tests — excellent hygiene
• Actual versions: 0.2.2 (registry claims 0.1.0 — registry is 2 versions behind)
• 47 of 57 are leaf packages (zero internal tummycrypt deps) — easy standalone extraction
• Dependency graph is shallow — max depth 2, no deep transitive chains

Consumer Import Matrix (2026-04-26)

External consumer ranking:

Rank	Package	Ext Consumers	Repos
1	tinyland-auth-pg	3	elders, scheduling-kit (J), scheduling-kit (ti)
2	tinyvectors	2	elders, jesssullivan.github.io
2	vite-plugin-skeleton-colors	2	elders, jesssullivan.github.io
2	tinyland-auth	2	elders, tinyland.dev
5	vite-plugin-a11y	1	jesssullivan.github.io
5	scheduling-kit	1	scheduling-bridge
7	41 other packages	0	tinyland.dev workspace-only

Key findings:

• 41 of 57 packages have zero external consumers (workspace-only)
• MassageIthaca has zero tummycrypt deps (hand-rolls everything)
• auth-pg version skew: elders ^0.2.1, scheduling-kit forks ^0.1.1
• 6 of 11 scanned repos have zero tummycrypt deps

Scope

Repeatable triage-and-promotion model: per-package triage → edge-finding → gap classification → 8-stage promotion pipeline → GloriousFlywheel CI/cache integration.

Wave Execution Strategy

• Wave 1 (weeks 1-2): Auth cluster — tinyland-auth, auth-pg, auth-redis, rate-limit, security
• Wave 2 (weeks 3-4): Foundation — types, schemas, content-types, composables, stores, server-config, server-utils
• Wave 3 (weeks 5-6): Content/CMS — content, content-loader, blog-loader, event-loader, forms
• Wave 4 (weeks 7-8): Observability — otel, logging, tracing, metrics, grafana, prometheus
• Wave 5 (weeks 9-10): Remaining (many may get CONSOLIDATE/DEFER verdicts given 0 external consumers)

Pre-Triage Deliverables (Stage 0)

• Package health scan: 57 packages, all tested, 47 leaf nodes, versions at 0.2.2
• Consumer import matrix: auth-pg feat(bazel): standalone building block authority #1 (3 consumers), auth/tinyvectors/skeleton-colors tied fix(bazel): use module-scoped npm extension repo #2 (2 each)
• Priority queue: auth-pg → auth → tinyvectors → skeleton-colors → a11y → scheduling-kit → 41 workspace-only
• Deprecate tummycrypt_TEMPLATE and tummycrypt_TEMPLATE_SVELTE

Reference

Plan: .claude/plans/glowing-wandering-bunny.md in elders.tinyland.dev
Children: TIN-653 (auth), TIN-654 (auth-pg), TIN-655 (auth-redis), TIN-656 (rate-limit), TIN-657 (security)
Related: TIN-89, TIN-165, TIN-640, TIN-639, TIN-402, TIN-641, TIN-127, TIN-464

[greptile-apps]

Greptile Summary

This PR promotes @tummycrypt/tinyland-event-loader to a fully standalone Bazel workspace at version 0.2.2, replacing monorepo-inherited toolchain config (//packages:tsconfig_base, root MODULE.bazel deps) with self-contained equivalents in MODULE.bazel, tsconfig.json, and pnpm-workspace.yaml, and adds GitHub Actions workflows for CI and publishing.

Confidence Score: 5/5

Safe to merge; all findings are P2 style suggestions with no runtime or publish-pipeline impact.

No P0 or P1 issues found. The two inline comments are style/best-practice suggestions (moduleResolution choice and DOM lib inclusion in tsconfig) that do not affect the build, published output, or CI pipeline as validated by the author.

tsconfig.json for the moduleResolution and lib choices; package.json for the previously flagged provenance removal.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	New CI workflow using reusable template pinned at a full commit SHA; dry_run: true hardcoded, which is correct for non-publishing CI runs.
.github/workflows/publish.yml	New publish workflow triggered on GitHub release or manual dispatch; has id-token: write for provenance but package.json removed provenance: true (noted in previous review).
MODULE.bazel	Version bumped to 0.2.2; promoted to standalone by inlining Node toolchain, pnpm, npm, and TypeScript extension setup previously inherited from the monorepo root.
BUILD.bazel	Removed //packages:tsconfig_base dependency (now standalone), disabled source maps, bumped package version to 0.2.2.
package.json	Version bumped to 0.2.2, test script changed to vitest run, prepublishOnly now runs publint, provenance: true removed from publishConfig (previously flagged), no trailing newline.
tsconfig.json	Replaced monorepo extends with inline options; moduleResolution: "bundler" and DOM libs may be surprising for a Node.js-only published package.
flake.nix	New Nix flake dev shell with pnpm_10 or pnpm fallback — valid Nix attribute-or-fallback pattern.
pnpm-workspace.yaml	Minimal workspace config restricting native builds to esbuild only; appropriate for a standalone package.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push / PR to main] -->|ci.yml| B[js-bazel-package reusable workflow]
    C[GitHub Release published] -->|publish.yml| D[js-bazel-package reusable workflow]
    E[workflow_dispatch dry_run?] -->|publish.yml| D

    B --> F[typecheck · test · build · publint]
    F --> G[Bazel: //:pkg //:test]
    G --> H[dry_run=true → no publish]

    D --> I[typecheck · test · build · publint]
    I --> J[Bazel: //:pkg //:test]
    J -->|release event| K[npm publish to registry.npmjs.org]
    J -->|workflow_dispatch dry_run=true| L[skip publish]

Loading

_{Reviews (2): Last reviewed commit: "fix(bazel): align source map outputs wit..." | Re-trigger Greptile}