Local assets and dependencies

Public CSS, JavaScript, fonts, icons, and images must be served from the tinymash installation. Do not load runtime assets from a CDN.

Themes declare root-relative asset URLs in their manifest. Plugins register local CSS and JavaScript through the plugin runtime. Keep filenames below an extension-specific public directory and avoid selectors or globals that can affect unrelated themes, plugins, or admin pages.

Bundle only the assets the extension uses. A theme does not need JavaScript by default, and a small plugin should not introduce a frontend framework for one control.

Check every library, font, icon set, and bundled image before distribution. Officially shipped or listed extensions and their assets must be compatible with AGPL-3.0-or-later. Preserve required copyright and attribution notices.

Composer packages belong in the deployed vendor/ tree. A normal packaged installation does not need Composer at runtime. Avoid exposing package-specific types across the extension boundary when a tinymash service already owns the contract.

Remote data services are different from runtime assets. A plugin may call an approved remote API from an explicit refresh, queue, or housekeeping path, but visitor rendering should use saved data when the plugin's contract is cache-based.