Release v1.0.2 — eight-locale localization, Open VSX links, CI

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Every path is owned by the maintainer, so each pull request — including the ones
+# Dependabot opens — automatically requests a review rather than sitting unnoticed.
+#
+# This is the GitHub account handle, which is unchanged. The publisher's DISPLAY
+# name is WinterNova5; every id, URL, and handle still reads ElecTreeFrying, and
+# that is correct — do not "fix" it here.
+* @ElecTreeFrying

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,130 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+**electreefrying.git@gmail.com**.
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][mozilla].
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.
+
+[homepage]: https://www.contributor-covenant.org
+[mozilla]: https://github.com/mozilla/diversity

.github/CONTRIBUTING.md

@@ -0,0 +1,82 @@
+# Contributing
+
+Thanks for wanting to help. Bug reports and feature requests are very welcome — but
+please read the next section before you open a pull request, because this repository
+works differently from most snippet extensions.
+
+## ⚠️ The snippets are generated, and the generator is not in this repository
+
+Every file under `snippets/`, all of `reference.md`, and the README's `## Snippets`
+section are **build artifacts**. They are produced from the `@nativescript/core`
+TypeScript types by a generator under `tools/` — and `tools/` is deliberately not
+committed, so a fresh clone does not contain it.
+
+Two consequences, and they are the whole reason this section is first:
+
+1. **Hand-editing a snippet file is futile.** The next generator run overwrites it
+   wholesale. A PR that edits `snippets/**/*.json`, `reference.md`, or the README's
+   `## Snippets` block cannot be merged as-is, no matter how correct the change is.
+2. **You cannot regenerate them yourself.** `npm run generate`, `npm run validate`,
+   and `npm run check` all live in `tools/`, so they will not run from a clone.
+
+**So: to change a snippet, open an issue instead of a PR.** Describe the element, the
+flavor(s), and what the expansion should be. That is genuinely the fastest path — the
+change gets made in the generator's curated data and regenerated, which is the only
+way it will survive.
+
+This is not a brush-off. Snippet issues are the most useful reports this project gets.
+
+## What you *can* edit directly
+
+These are hand-maintained and normal PRs are welcome:
+
+- `README.md` — **everything except** the `## Snippets` section
+- [`SPEC.md`](../SPEC.md) — the user-facing contract
+- [`SUPPORT.md`](../SUPPORT.md)
+- `CHANGELOG.md`, `LICENSE.md`
+- `package.json` — metadata, categories, keywords
+- Anything under `.github/`
+
+## What CI checks
+
+There is no build and no test framework — the published artifact is `package.json`
+plus declarative JSON, and no code executes at runtime. CI verifies the one thing it
+can from a clone: that every file `contributes.snippets` points at exists and parses
+as valid JSON. The deeper structural and fidelity gates live in `tools/` and run
+locally before a release.
+
+## Testing a snippet by hand
+
+Press <kbd>F5</kbd> to open an Extension Development Host, open a file of the matching
+language, and type the prefix.
+
+| Flavor | Language ID(s) |
+|---|---|
+| Angular | `html` |
+| Core | `xml` |
+| Vue | `vue` |
+| React | `typescriptreact`, `javascriptreact` |
+| Svelte | `svelte` |
+
+All prefixes start with `ns-`. Per element there is `ns-<name>` (bare tag),
+`ns-<name>-prop` (properties as tab stops), and `ns-<name>-comp` (properties, events,
+and a doc comment).
+
+If a snippet does not appear, the language ID is almost always the reason — check the
+one in the status bar against the table above.
+
+## Code style
+
+- **LF line endings**, enforced by `.gitattributes`. Snippet JSON is LF with 2-space
+  indent; a CRLF re-save produces an enormous phantom diff.
+- Do not bump `version` in `package.json` — releases own that.
+
+[`CLAUDE.md`](../CLAUDE.md) documents the generation pipeline in full, if you want the
+complete picture.
+
+## Reporting bugs
+
+Use the issue templates. [`SUPPORT.md`](../SUPPORT.md) covers the known limitations —
+including why gesture snippets behave differently in Vue than in Svelte.
+
+For **security** problems, do not open an issue — see [`SECURITY.md`](SECURITY.md).

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,40 @@
+<!--
+Thanks for contributing! Nothing here is mandatory — delete any section that
+doesn't apply. The checklist exists to catch the things CI can't.
+-->
+
+## What this changes
+
+<!-- One or two sentences. Which prefixes or flavors behave differently after this PR? -->
+
+## Why
+
+<!-- The problem being solved. Link an issue with "Closes #123" if there is one. -->
+
+## How to verify
+
+<!--
+Press F5 to open an Extension Development Host, open a file of the matching
+language, type the prefix, and confirm the expansion.
+-->
+
+---
+
+## Checklist
+
+- [ ] **`snippets/**/*.json` and `reference.md` were not hand-edited.** Both are
+      build artifacts, regenerated wholesale — a hand-edit is silently overwritten.
+      Change the generator or its curated data instead, then regenerate.
+- [ ] The README's `## Snippets` section was not hand-edited either; it is rewritten
+      in place between that heading and the next `## ` heading.
+- [ ] If `package.json` display strings changed — `package.nls.json` **and all eight
+      locale files** were updated together. A key missing from one locale silently
+      falls back to English there.
+- [ ] Snippet prefixes, bodies, and descriptions stay English. They are typed
+      identifiers, not display text.
+- [ ] Links added to `README.md` or `CHANGELOG.md` are **absolute URLs**. Both ship
+      inside the VSIX, where relative paths do not resolve.
+- [ ] No AI attribution anywhere in the commits or this description — no
+      `Co-Authored-By: Claude`, no "Generated with", no 🤖.
+- [ ] Line endings are LF (enforced by `.gitattributes`).
+- [ ] `version` in `package.json` was **not** hand-bumped — `vsce publish` owns that.

.github/SECURITY.md

@@ -0,0 +1,66 @@
+# Security Policy
+
+## Supported versions
+
+Only the **latest published version** of NativeScript Snippets receives security
+fixes. Older versions are never patched in place — a fix ships as a new release to
+both registries:
+
+- [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=ElecTreeFrying.nativescript-angular-html-snippets)
+- [Open VSX](https://open-vsx.org/extension/ElecTreeFrying/nativescript-angular-html-snippets)
+
+If you are reporting against an older version, please confirm the problem still
+reproduces on the latest one first.
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for a security problem.** A public report tells
+everyone about the weakness before there is a fix available.
+
+Email **electreefrying.git@gmail.com** with:
+
+- what the problem is, and roughly how severe you think it is
+- the extension version, your VS Code (or Cursor / VSCodium / Windsurf) version, and your OS
+- steps to reproduce, or a proof of concept
+- whether you would like to be credited in the release notes, and under what name
+
+You can expect an acknowledgement as soon as I can manage it — usually within a week.
+If the report is confirmed, I will let you know the fix timeline and tell you when the
+patched version is live on both registries. If I conclude it is not a vulnerability,
+I will explain why rather than going quiet.
+
+This is a solo-maintained project, so please be patient with response times. There is
+no bug bounty.
+
+## Scope
+
+The attack surface here is unusually small, and it is worth being explicit about why.
+This extension **ships no executable code at all** — no `main`, no `activationEvents`,
+no bundle. The published artifact is `package.json` plus declarative snippet JSON
+under `snippets/`. Nothing runs; VS Code reads the snippet definitions and expands
+them on request. There are no runtime dependencies, no network requests, and no
+telemetry.
+
+**In scope:**
+
+- Snippet content that VS Code's snippet engine would treat as something other than
+  literal text — a variable, a command, or a shell transform smuggled through a
+  `${...}` construct
+- A malformed snippet file that crashes or hangs the editor
+- Anything in the published `package.json` that grants the extension more capability
+  than a snippets extension should have
+
+**Out of scope:**
+
+- Vulnerabilities in VS Code itself — report those to
+  [Microsoft](https://github.com/microsoft/vscode/security/policy)
+- Snippets that expand to *wrong* or outdated NativeScript markup — ordinary bugs,
+  please open a normal issue
+- The local generator under `tools/`. It is developer tooling, is not committed, and
+  is not part of any published release
+
+## Disclosure
+
+Please give me a reasonable window to ship a fix before disclosing publicly. Once the
+patched version is live on both registries, you are welcome to write about it — and
+I will credit you in the release notes if you would like.

.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+
+updates:
+  # This extension ships no runtime dependency — the published artifact is
+  # package.json + snippets/. Everything in package.json is dev tooling for the
+  # local generator, @nativescript/core chief among it: a bump there is the
+  # upstream signal that the shipped snippets may be stale and want a
+  # regenerate + re-verify pass locally.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: chore
+      include: scope
+    # Wait a week before proposing a freshly published version. Malicious or
+    # broken npm releases are typically caught and yanked inside that window.
+    cooldown:
+      default-days: 7
+
+  # The actions pinned in .github/workflows/
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: chore
+    cooldown:
+      default-days: 7