@getvitops/generator 4.0.0 → 5.0.0

package/CHANGELOG.md

@@ -1,5 +1,389 @@
 # @getvitops/generator
 
+## 5.0.0
+
+### Major Changes
+
+- **Dangling token references are now a build failure.** `validate()` resolves every `var(--…)` a
+  config authors — in `patterns.defaults` / `radii` / `groups` / `items.*.{base,overrides,states}`,
+  `typography.roles` and `shadows` — against the tokens that config actually emits. A reference to a
+  token that does not exist used to validate, generate, minify and ship, then resolve to nothing in
+  the browser: one downstream config shipped a `.cta` whose `color` fell back to `inherit` on a brand
+  fill (unreadable text on every filled button), and two of its four dead references had been dead for
+  several releases with nothing ever reporting them.
+
+  The check is deliberately anchored to the namespaces the generator owns — `--color-*`, `--shadow-*`,
+  `--z-tier-*`, `--surface-glass`, `--overlay` — the same discipline `vitops lint` follows. A pattern
+  may legitimately reference a framework token from `@getvitops/core` or a hook of your own, and
+  enumerating "every valid token" would make those false positives. A reference carrying a fallback
+  (`var(--x, 0.25rem)`) is never flagged: that is you saying what happens when the token is absent.
+  Errors name the config path and suggest the nearest token that does exist.
+
+  Two related diagnostics ship with it:
+  - **Pre-1.0 colour-grammar references are reported as one rename table**, not as a dozen separate
+    "no such token" errors — the shape the 3.0 flat-config detector uses, applied to the 1.0 colour
+    change. It is built from your own role names, and it says to apply the renames _simultaneously_,
+    because several of them rotate (`--surface-bg` → `--color-bg-surface-muted`,
+    `--surface-bg-bold` → `--color-bg-surface`) and sequential replacement compounds them.
+  - **A surface-shaped role declared chromatic now warns.** A bare hue string is shorthand for
+    `kind: "chromatic"`, which emits no bare `--color-bg-<role>` and no `.bg-<role>` — so writing
+    `"surface": "ink"` silently removed `--color-bg-surface` and the 36 references the framework's own
+    CSS makes to it. Relatedly, `--surface-glass`, `--overlay` and `.glass` are no longer emitted when
+    `surface` is chromatic: they read `--color-bg-surface`, so emitting them pointed at nothing.
+
+  **`vitops lint --fix` is now the migration tool.** It reads `var(--…)` out of CSS and `<style>`
+  blocks (not just `class` attributes) and rewrites pre-1.0 token references in a **single pass**, so
+  the rotating renames cannot compound. Nothing else is rewritten — every other finding it reports is
+  a judgement call. Run it after a major bump.
+
+  **`--help` works on every subcommand.** `vitops lint --help` used to exit non-zero with
+  `Unknown option '--help'`; every leaf subcommand parsed its own argv strictly and none declared the
+  option. It is now answered before dispatch, so no command can forget it, and a drift guard fails the
+  build if a command has no documented options. (`validate`'s options were genuinely undocumented and
+  now are.)
+
+  **The Astro integration reads `site.tracking` and `site.legal.cookieConsent`.** These drive the
+  generated cookie notice, while `vitops({ consent, tracking })` drove the runtime — two hand-synced
+  declarations of the same fact with nothing comparing them, so a site could ship a notice naming
+  categories its banner never offered, or disclosing an `_ac` cookie no capture script ever wrote, and
+  the build was clean. The config blocks are now defaults (as `css` / `fonts` / `favicon` / `ads`
+  already were) and a genuine contradiction — `true` against `false` on the same fact — **fails the
+  build**, naming both sides. An absent option is not a contradiction; it just takes the config's
+  value.
+
+  Also fixed, each from a downstream report:
+  - **`@getvitops/astro/tracking`** re-exports `@getvitops/utils/tracking` (plus `TRACKING_ENDPOINT`),
+    so the documented conversion flow works with one install. Under strict pnpm app code cannot
+    resolve a transitive dependency, and the obvious workaround — importing the same symbols from the
+    package index — is the one that drags the integration's Node builtins toward a Worker bundle. This
+    entry and `./routes` are both clean.
+  - **`createConversionRoute`'s example was broken on every supported Astro.** It read the binding off
+    `locals.runtime.env`, removed in Astro v6, while the package peers on `>= 7` — and because the
+    throw precedes the response, Astro re-reads the request and reports a misleading "Body has already
+    been used". It also called a `toNotifyContext()` helper that does not exist. The example now uses
+    `import { env } from 'cloudflare:workers'` and a plain `NotifyContext`.
+  - **`/api/track` is exported as `TRACKING_ENDPOINT`**, and the integration warns at build when
+    tracking is on and no route answers it. It was a bare literal inside the inlined capture script:
+    name the route file anything else and every `tel:` beacon 404s, conversions vanish, and nothing
+    errors anywhere.
+  - **`describeEvent` no longer reports "from Unknown"** for forms that don't have a field literally
+    named `name`. It now falls back through `first_name`/`last_name`, `full_name`, and finally the
+    email address.
+  - **`sendEmail` takes `timeoutMs` (default 10s).** `binding.send()` had no deadline, so one hung
+    attempt hung the request that produced it — indefinitely, in the one module otherwise built on
+    always saying why. A timeout is retried, like any other transient failure.
+  - **`vitops search notify` warns when the sitemap's URLs aren't on the configured origin.** A 404
+    fails loudly; a well-formed sitemap belonging to someone else did not — a route collision served a
+    valid document listing another site's pages and the run reported a healthy submission. Surfaces at
+    `--dry`.
+  - **`require()` warns when the page has no `<wc-consent>`.** The demand can never be granted, so
+    whatever waited on it never runs — silently. Hit by rendering `<Tracking />` on pages where
+    `<CookieConsent />` wasn't.
+  - **`vitops agents` no longer writes a path it guessed.** It used to warn and then write "tokens
+    live in `design-system.json`" into a project whose tokens are in `company.json`, with the four
+    emitted `vitops generate` commands hard-coded to match — copy-paste-broken in exactly the projects
+    that most need the block to be right. It now finds the config by shape, interpolates the resolved
+    path into every emitted command, and fails rather than guessing when there is nothing to name.
+  - **`vitops search setup --dry` and `vitops ads setup --dry` run without credentials.** A dry run
+    that mutates nothing should not demand the token to mutate; with none set it plans from scratch
+    and says so. (`--check` still needs them — drift is a comparison against live state.) Both now
+    also mention that the Cloudflare token needs `Zone:Read` alongside `Zone:DNS:Edit` — the
+    zone-by-name lookup uses it, and its absence read as "the zone isn't in this account".
+  - **`vitops legal` names the files it wrote and flags new ones.** Enabling `cookieConsent` silently
+    produced a `cookie-notice` document that then needs a page, a route, a link and a `policyUrl`; the
+    command said only "3 files". The review reminder is also printed on the stdout path, where it was
+    missing entirely.
+  - **`vitops init` writes a versioned `$schema`** — `./node_modules/@getvitops/generator/schema.json`,
+    following wrangler — instead of an unpinned unpkg URL that resolved to whatever was newest, so an
+    editor validated a pinned project against a schema it wasn't built with.
+  - **`favicon.backgroundColor` and `favicon.name` are described accurately.** `backgroundColor` is
+    not manifest-only: it fills the opaque `apple-touch-icon.png` and `icon-mask.png`, which are
+    written whether or not a manifest is. `name` documents that it and `themeColor` **together** are
+    what make a site installable. The missing-background warning now also fires for a dark opaque mark,
+    not only a transparent source — `apple-touch-icon` insets the logo and fills the surround either
+    way.
+
+- **The framework now says out loud which patterns are foundational, and reports it when you
+  reach past them.** From repeated downstream reports: sites were inventing a `.wrap` class and
+  using it everywhere instead of `.centered`, and `.subgrid` — the class for any set of cards —
+  was going essentially unused. Neither failure is visible in a build: every class involved is
+  real, nothing errors, and the page renders.
+
+  **`.subgrid` was missing from the generated class reference entirely.** So was `.cluster`, and
+  so was `.region`. `vitops docs classes` is the doc an agent is told to fetch for "which class
+  do I apply", and the framework's answer for a set of cards was not in it — which is most of why
+  it never got used. All three are now documented, along with `grid-auto`, and the reference opens
+  with a **Foundations** section that states the six substitutions as
+  _temptation → what to write instead_ rather than as a vocabulary list. The same table is now in
+  the shipped agent skill and in the `@getvitops/create` template's `AGENTS.md`, because a pointer
+  to a doc only helps someone who already suspects there is something to look up. (`css`/`bricks`
+  and `tailwind` alike — this is documentation and the `TIERS` manifest, not emitted CSS.)
+
+  **`vitops lint` gained three reuse rules and a markup pass.** The existing `.centered` rule only
+  fired when the hand-written CSS already referenced `--width-measure`, which is precisely the
+  author who was never going to hand-roll a container. It now also catches a page-scale
+  `max-width` (≥ 48rem, or a `ch` reading measure) with auto margins, and a
+  container-shaped class name — `wrap`, `wrapper`, `container`, `inner`, `shell`, … — carrying any
+  width cap at all. Reading the cap out of `min()` / `clamp()` too. New rules report a
+  hand-written `repeat()` grid as `.subgrid` (or `.grid-auto`), and a new **markup** pass reports a
+  repeated card set laid out without either — a loop that renders a card, or three or more cards
+  written out. That last one is the only check that can see this drift at all, since a card list
+  built from utility classes contains no bad class and no hand-written CSS.
+
+  All of these are `suggestion` severity, so they do not fail your build unless you pass
+  `--strict`. They found five real instances in this repo's own docs site.
+
+  **`vitops lint [files...]`** now takes explicit paths instead of scanning `--src`, so it can be
+  wired into a pre-commit hook — `vp`'s `staged` key appends the staged files to whatever it runs,
+  and a command that refused positionals could not be put in the one place the feedback lands at
+  the moment the code is written. Unreadable and non-source paths are skipped rather than fatal. The
+  `@getvitops/create` emdash template wires it up with `--strict` and adds a `lint:design` script.
+
+  **Two answers for "the whole card is a link", because one cannot exist.** Reported downstream:
+  agents dislike the `<li>` wrapper when a card is a link and write `<li><a class="card">` instead.
+  That shape is **wrong in a way that renders fine**, which is why it survives review — the `<li>`
+  is the grid item, so the anchor is an ordinary block inside it and the tranches within the anchor
+  never reach the parent's shared row lines. The alignment `.subgrid` exists for silently does not
+  happen, and the anchor does not fill the cell either. Putting the anchor in the grid's place
+  (`<ul><a></ul>`) is invalid HTML, so there was genuinely no correct shape to reach for.
+
+  There are now two, and they trade against each other because **no CSS-only technique can make a
+  whole card clickable and leave its text selectable** — a transparent overlay necessarily receives
+  the pointer-drag:
+
+  | Want                                     | Use                                         |
+  | ---------------------------------------- | ------------------------------------------- |
+  | zero JS, whole card clickable            | `.stretched-link` — **text not selectable** |
+  | selectable text **and** a clickable card | `<Cards>` / `<wc-cards>` — needs JS         |
+
+  `.stretched-link` goes on a link inside the card; its `::after` covers the card.
+  **`<wc-cards>` is a new tier-2 element** that adds no overlay and instead tells a click apart from
+  the end of a drag, so text selection survives. Its fallback is the card's own link, fully usable
+  with no JS, and the pointer cursor is applied by the element — so the affordance never appears
+  without the behaviour. `<Cards>` emits it for you. They are alternatives, never layered: with an
+  overlay present the JS has nothing to do, and `vitops lint` reports the combination. (All formats
+  — pattern partials, deliberately not `utilities.css`, which the tailwind format skips on the
+  invariant that everything left in it is a name Tailwind ships itself.)
+
+  ### Breaking
+  - **`<Subgrid />` renders its slot verbatim — author the `<li>` items yourself.**
+
+    ```diff
+      <Subgrid>
+    -   <article class="card">…</article>
+    +   <li class="card subgrid-card">…</li>
+      </Subgrid>
+    ```
+
+    It used to parse the slotted HTML and rebuild each child as an `<li>`, carrying over only
+    `class` and `style`. That existed solely because a `<ul>` may contain nothing else, and it cost
+    more than it bought: the child's tag was discarded, `id`/`data-*`/`aria-*` were silently
+    dropped, and `href` could not survive at all. Nothing is copied now, so nothing is lost. `as`
+    picks the container (`ul` by default, `ol`, `div`), and all other props are forwarded — they
+    were previously discarded, including `role`.
+
+  - **`<Subgrid />` and `<Tree />` now emit `role="list"`,** as does the Bricks `sitenav` element.
+    `list-style: none` stops Safari + VoiceOver announcing a `<ul>` as a list, so every marker-less
+    framework list was silently losing the semantics its `<ul>` was chosen for. If you hand-write
+    `.subgrid`, `.list`, `.facet-list`, `.nav-items`, `.collapse-menu` or `.tree` markup, add
+    `role="list"` yourself — the framework cannot add it to markup it does not render, and each
+    partial now says so at the `list-style` reset.
+  - **`<Cards />` no longer adds `class="card"` to slotted children,** because it no longer parses
+    them. Write the class on the item. It now emits `<wc-cards>` around a `<Subgrid>`, which is what
+    makes the whole card clickable — and like `<Tree />`, **it emits its own element, so do not wrap
+    it in `<wc-cards>` yourself.** It also previously passed a `role="list"` that `<Subgrid>` silently
+    discarded, so that never took effect.
+  - **`.subgrid-card` now sets `position: relative`**, so `stretched-link` inside it needs no extra
+    class. If you were absolutely positioning a descendant of a `.subgrid-card` against an ancestor
+    _outside_ that card, it will now resolve against the card. Move the positioning context
+    explicitly. (`css`/`bricks`/`tailwind` — the pattern partial is inlined into all three.) Not
+    reachable by `vitops lint --fix`: the fix depends on which ancestor you meant, which the
+    linter cannot know.
+
+  ### Fixed
+  - **`packages/generator/src/docs.ts` contained a literal NUL byte** (`CODE_SLOT`, written as the
+    raw character rather than an escape). libmagic classified the file as `data` rather than text, so
+    grep and ripgrep treated the largest doc emitter in the repo as **binary and silently skipped
+    it** — every search for a string in it returned nothing, with no error. It is now written as the `\u0000` escape.
+    Behaviour is identical; the file is searchable.
+  - **`.grid-auto` is documented.** It was a real framework class for auto-fit card grids with no
+    entry in the class reference, so the honest alternative to `subgrid` was as invisible as
+    `subgrid` itself.
+  - **`.raised` replaces the advice to use `.relative` above a `stretched-link` overlay**, which
+    could not work: a positioned element at `z-index: auto` does not rise above an explicit
+    `z-index` regardless of DOM order, so a second link or button in the card stayed underneath and
+    unclickable. `.raised` sets both, against the same `--z-tier-raised` token the overlay now uses
+    instead of a hard-coded `1`.
+
+### Patch Changes
+
+- **Astro and Bricks are documented as the same tier, because they are.** Both are platform
+  wrappers that generate HTML from the classes and elements of tiers 1 and 2 — siblings chosen by
+  which platform you are on, not steps in a ladder. No project uses both, and neither outranks the
+  other.
+
+  They were published as tier 3 and **tier 4**, in `vitops docs components`, the shipped agent
+  skill and the docs site. The cause was a projection axis being read as a hierarchy: `Tier` has
+  four keys (`css` `wc` `astro` `bricks`) because there are four tables to render, and the tier
+  number was being derived from that key order — so the last key became "tier 4". The advice next
+  to it inherited the error, telling readers to "use the highest-**numbered** tier your stack has",
+  which reads as Bricks outranking Astro.
+
+  Nothing about which patterns each tier provides has changed; this is the numbering and the prose
+  around it. `Tier` keeps its four keys — that part was never wrong — and now says in its own type
+  docs why four keys are three levels, so the next renderer cannot repeat the derivation.
+
+- Updated dependencies
+  - @getvitops/utils@5.0.0
+
+## 4.1.0
+
+### Minor Changes
+
+- 2c890c0: Link a site to its ad properties: `site.ads`, `vitops ads`, and `<Ads />`.
+
+  `vitops search` covers the whole Search Console relationship. Nothing covered the equivalent one
+  with ad platforms, and a site's ad accounts had nowhere to live — so a Meta pixel pasted into a
+  template was invisible to the rest of the toolchain. It set `_fbp` on a site whose generated cookie
+  notice never mentioned it, whose consent gate never cleared it on revoke, and — for LinkedIn and
+  Pinterest — whose attribution never captured the click ID at all, so every conversion from those
+  platforms arrived indistinguishable from organic traffic.
+
+  **New `site.ads` block**, keyed by platform (`google`, `meta`, `linkedin`, `reddit`, `tiktok`,
+  `microsoft`, `pinterest`, `snapchat`):
+
+  ```jsonc
+  {
+    "site": {
+      "ads": {
+        "meta": { "pixelId": "123456789", "domainVerification": "abc123" },
+        "google": {
+          "accountId": "123-456-7890",
+          "pixelId": "AW-987654321",
+          "conversionLabel": "xyz",
+        },
+      },
+    },
+  }
+  ```
+
+  **`vitops ads setup`** ensures each platform's domain-verification DNS record. Only four platforms
+  verify a domain at all — Meta, TikTok, Pinterest and Snapchat, by apex DNS TXT — and that record is
+  the one thing created for you (in Cloudflare, via `CLOUDFLARE_API_TOKEN`; created only, never edited
+  or deleted). Google Ads, LinkedIn, Reddit and Microsoft Ads have no domain verification: linking
+  there is the tag and the account id, and the run says so rather than skipping in silence. No
+  platform Marketing API is called — Meta's needs a system-user token and Google's an approved
+  developer token with your own account on the line — so the final "Verify" click is surfaced as a
+  reminder. `--dry` prints the plan, `--check` reports drift and exits non-zero.
+
+  **It asks for what the config is missing.** A verification token does not exist until someone
+  fetches it from the platform UI, so a first run prompts for it, naming the exact UI path, folds the
+  answer into the plan and writes it to your config. The token is not a secret — it is published in
+  DNS, and the platform fetching it back is the ownership proof, exactly like the IndexNow key.
+  Prompting requires a TTY: with `--dry`, `--check`, `--no-prompt`, or in CI, you get a named error
+  instead and the run never hangs. `--no-write` keeps the answer out of the config.
+
+  **`vitops ads tags`** prints each pixel as an inert, consent-gated `<script>` — `type="text/plain"`
+  with the library URL on `data-src`, so an undecided visitor's page issues no third-party request.
+  For Bricks, WordPress, Eleventy: any stack without the Astro integration.
+
+  **`vitops ads lint`** reports the gaps that are invisible at runtime: a click ID the platform stamps
+  that attribution does not capture, a pixel while `site.tracking` is off, a property with no tag id.
+
+  **`<Ads />` in `@getvitops/astro`**, a sibling of `<Analytics />` rather than part of it — ad
+  properties come from the site config, state their own consent category (`marketing` by default,
+  rather than being derived), and switch per environment on their own
+  (`environments.<env>.ads`, defaulting to `analytics`, then true, so a preview deployment can send
+  pageviews without firing conversion pixels). Both components now render through one `<GatedTags />`,
+  so the inert markup has a single implementation.
+
+  **Your cookie notice now discloses every configured pixel** — name, cookies and opt-out — from the
+  same table that writes `data-consent-cookies`, so the notice and the revoke cannot disagree. If you
+  add `site.ads` to a config whose privacy policy or cookie notice you have already published,
+  re-generate and re-read them.
+
+  `li_fat_id` (LinkedIn) and `epik` (Pinterest) join the click-ID capture vocabulary; a site running
+  either platform starts attributing conversions it previously recorded as organic.
+
+- e764090: Separate where a processor stores information from whose law can reach it.
+
+  A processor carried one optional `country`, and the privacy policy flat-deduped it into a single
+  sentence. That conflated two facts a disclosure has to keep apart — **where the data rests** and
+  **which jurisdiction can compel access** — and privacy law turns on the second: the OPC's concern
+  is foreign _access_, not merely foreign storage.
+
+  Ordinary arrangements were inexpressible. Azure is data-resident in Canada and US-controlled;
+  Zoho can serve mail from a Canadian datacentre and telemetry from the US while being headquartered
+  in India; a Microsoft 365 tenant can be Canadian with its identity data in the US. For all of
+  them every available option was wrong: `country: "Canada"` rendered the incoherent _"outside of
+  Canada, including Canada"_, naming the operator's country asserted storage that wasn't happening,
+  and omitting it dropped the processor from the disclosure **silently**.
+
+  **New on a processor:**
+
+  ```jsonc
+  {
+    "name": "Zoho",
+    "purpose": "receiving and storing email sent to us",
+    "storage": [
+      { "country": "Canada", "scope": "mail and productivity data" },
+      { "country": "the United States", "scope": "analytics and telemetry" },
+    ],
+    "operatorCountry": "India",
+  }
+  ```
+
+  - `storage[]` — where information rests, each entry optionally `scope`d to a category. The scope
+    is what makes "Canadian tenant, identity data in the US" sayable.
+  - `operatorCountry` — the jurisdiction that can compel the provider to produce it. Gets its own
+    sentence: _"…established in, or controlled from, jurisdictions outside of Canada, including
+    India. Personal information those providers handle on our behalf may be subject to the laws of
+    those jurisdictions even when it is stored in Canada."_
+  - `country` still works, as shorthand asserting **both** facts — which is what it always
+    asserted, since the sentence it fed claimed storage and legal reach in one breath.
+
+  **Combining `country` with either explicit field is rejected** by `vitops validate`. Whether the
+  shorthand narrows the explicit fact or adds to it are two readings that make contradictory legal
+  claims, so neither is guessed.
+
+  A country in the policy's own jurisdiction is no longer treated as a transfer, which is the
+  `country: "Canada"` fix. Comparison ignores case and a leading "the".
+
+  ### This changes text you have already published
+
+  **Cloudflare, Cloudflare Turnstile, Vercel and Netlify now assert operator jurisdiction and no
+  storage.** They previously claimed `the United States` into a sentence saying "stored or processed
+  in" — a claim about the wrong fact. Cloudflare is anycast: a request from Toronto is answered from
+  a Toronto PoP, and Workers/R2 have residency controls the config cannot see.
+
+  So a site whose only foreign element is its host or Turnstile **stops claiming foreign storage**
+  and instead discloses foreign legal reach. That is a retraction in the direction of accuracy, and
+  it deserves a re-read. **If you pin a US region, say so** — declare a processor with
+  `storage: [{ country: "the United States" }]`. This generalises the rule the provider table
+  already applied to Matomo: "we don't know" is a fact.
+
+  **Everything else renders identically.** Google Analytics, Tag Manager, Clarity, Plausible,
+  Matomo Cloud and any processor you declared with `country` produce the same words as before,
+  because the shorthand expands to both facts and the operator sentence is suppressed when it would
+  only restate a country already disclosed as storage. The one cosmetic change: the closing
+  "subject to access requests…" sentence is now its own paragraph, since it is shared by both
+  clauses.
+
+  **A processor with no location at all is now reported** on stderr by `vitops legal`, naming the
+  document it will be missing from. It cannot appear in a transfer disclosure — there is nothing
+  true to say — but it used to vanish in silence, which is the failure that looks tidy. It is not a
+  validation error: a bare `{ name, purpose }` is still valid.
+
+  New exports from `@getvitops/generator`: `processorsMissingLocation`, `JURISDICTION_COUNTRIES`,
+  and the `ProcessorStorage` type. `PolicyVars` gains `jurisdictionCountry`, `storageCountries`,
+  `scopedStorage` and `operatorCountries`; `countries` is **deprecated but retained**, and still
+  names every country it ever named, so a custom template keeps rendering what it rendered.
+
+### Patch Changes
+
+- Updated dependencies [2c890c0]
+  - @getvitops/utils@4.1.0
+
 ## 4.0.0
 
 ### Major Changes

package/assets/bricks/elements/sitenav.php

@@ -203,7 +203,10 @@ class Vitops_Element_Sitenav extends \Bricks\Element {
 		}
 
 		$list_class = $top ? 'sitenav__list' : 'sitenav__submenu';
-		$html       = '<ul class="' . $list_class . '">';
+		// `role="list"` restores what `list-style: none` takes away: Safari + VoiceOver
+		// stop announcing a marker-less <ul> as a list, so the reset silently costs the
+		// semantics the <ul> was chosen for. Both classes set it (sitenav.css).
+		$html = '<ul class="' . $list_class . '" role="list">';
 
 		foreach ( $by_parent[ $parent_id ] as $item ) {
 			$id          = (int) $item->ID;

package/assets/css/index.css

@@ -16,6 +16,9 @@
 @import './patterns/cluster.css';
 @import './patterns/grouped.css';
 @import './patterns/subgrid.css';
+/* After subgrid: `.subgrid-card` is the usual card and this sets the `<wc-cards>`
+   host plus the upgraded-card affordance. */
+@import './patterns/card.css';
 @import './patterns/masonry.css';
 @import './patterns/media.css';
 @import './patterns/separator.css';

package/assets/css/patterns/anchor-link.css

@@ -100,3 +100,70 @@ a[target='_blank'].link--external::after {
   color: var(--color-text-surface);
   border-radius: var(--br-control, 0.375rem);
 }
+
+/* ── stretched-link — the whole card is a link ──
+   One link inside a container covers it, so the entire card is clickable while the
+   accessible name stays on real text. `.subgrid-card` already carries the
+   `position: relative` this resolves against; on a bare `.card`, add `relative`.
+
+     <li class="card subgrid-card">
+       <p class="font-eyebrow">Service</p>
+       <p class="font-heading"><a class="link stretched-link" href="/x">Title</a></p>
+       <p>Blurb…</p>
+     </li>
+
+   WHY THIS RATHER THAN MAKING THE ANCHOR THE CARD. `<li><a class="card">` is the
+   shape that gets reached for, and it is wrong in a way that renders fine: the LI is
+   the grid item, so the anchor is an ordinary block inside it — its tranches never
+   land on the parent's shared row lines, and the alignment `.subgrid` exists for
+   silently does not happen. (Nor does an inline anchor fill the cell.) Putting the
+   anchor in the grid's place instead means `<ul><a></ul>`, which is invalid.
+
+   THE COST, AND THE ALTERNATIVE. The overlay receives the pointer-drag over
+   everything it covers, so **the card's text can no longer be selected**. That is
+   inherent to the technique, not a bug to fix here — any transparent layer over text
+   takes the drag. Where selectable text matters, use `<wc-cards>`
+   (src/web-components/WCCards.ts) instead: no overlay, and JS tells a click apart
+   from the end of a drag. The two are alternatives, never layered — with this
+   overlay present, that element has nothing left to do.
+
+   It lives HERE, in a pattern partial, and not in `utilities.css`: that file is in
+   the generator's TAILWIND_SKIP on the stated invariant that everything left in it
+   is a TW_CLASH name Tailwind ships itself. `stretched-link` is ours, so putting it
+   there would emit it in css/bricks and silently not in tailwind — the exact
+   cross-format hole `format-parity.test.ts` exists to catch.
+
+   Another interactive element inside the same card must sit above the overlay: give
+   it `.raised`, NOT `.relative`. A positioned element at `z-index: auto` does not
+   rise above an explicit z-index no matter its DOM order, so `.relative` alone left
+   the control underneath and unclickable. ── */
+.stretched-link::after {
+  content: '';
+  position: absolute;
+  /* Covers the nearest positioned ancestor, which is the card. */
+  inset: 0;
+  /* The shared z-scale rather than a bare 1, so `.raised` can be defined in terms of
+     the same token instead of guessing a number that beats it. */
+  z-index: var(--z-tier-raised);
+  border-radius: inherit;
+}
+
+/* ── raised — lift content above a `.stretched-link` overlay ──
+   For the second link, the button, or the text you want selectable inside a card
+   whose whole area is otherwise clickable.
+
+   It carries `position: relative` AND a z-index, and both are required: z-index has
+   no effect on a static element, and a positioned element at `z-index: auto` does not
+   rise above an explicit z-index regardless of DOM order. That second half is why
+   telling people to use `.relative` here did not work.
+
+   Defined against the same token as the overlay, so the two cannot drift apart the
+   way two hand-picked numbers would.
+
+   Here rather than in `utilities.css` for the reason given above `.stretched-link`:
+   that file is in TAILWIND_SKIP on the invariant that everything left in it is a name
+   Tailwind ships itself, and Tailwind has no `raised`. ── */
+.raised {
+  position: relative;
+  z-index: calc(var(--z-tier-raised) + 1);
+}

package/assets/css/patterns/card.css

@@ -0,0 +1,35 @@
+/**
+ * Card — the `<wc-cards>` host and the marker its enhancement applies.
+ *
+ * The `.card` pattern itself is CONFIG-GENERATED (`patterns.items.card` in
+ * design-system.json), so its border, padding, background and shadow are not here.
+ * This partial holds only what the framework owns: the custom element's box, and the
+ * affordance for a card the element has taken over.
+ */
+
+/* ── wc-cards — the whole-card click enhancement (src/web-components/WCCards.ts) ──
+   A custom element defaults to `display: inline`, and this one wraps a block
+   container — a `<ul class="subgrid">` in the documented shape — so an inline box
+   around a block child is exactly the KNOWN GAP recorded in `js/elements.ts`.
+
+   `block`, matched to the content it wraps, following the one precedent:
+   `patterns/tree.css` declares `wc-tree { display: block }` around a
+   `<ul class="tree">`. Deliberately NOT `display: contents`, whose support has been
+   uneven — the accessibility tree in particular — and this is not a place to depend
+   on it.
+
+   The cost of a real box: where the grid is nested in a parent flex/grid, `wc-cards`
+   rather than the `<ul>` becomes the item. Restyle the element in that case; it
+   carries no other styling to lose. ── */
+wc-cards {
+  display: block;
+}
+
+/* ── The card the element has taken over ──
+   Written by `WCCards` at upgrade, and only onto cards it found a link in — so the
+   pointer cursor cannot appear on a card with nothing to click, and cannot appear at
+   all when `elements.js` never loads. That is the point of stamping it from JS
+   rather than authoring it: the affordance and the behaviour arrive together. ── */
+[data-card-link] {
+  cursor: pointer;
+}

package/assets/css/patterns/list.css

@@ -11,6 +11,10 @@
   --_ds: var(--ds-list, var(--ds-list-group, var(--ds-default)));
   --_fs: var(--fs-list, var(--fs-list-group, var(--fs-default)));
 
+  /* Markerless — so ADD `role="list"` to the element. Safari + VoiceOver stop
+     announcing a marker-less <ul> as a list, so this reset silently costs the
+     semantics the <ul> was chosen for. Nothing in the framework emits this markup,
+     so only the author can restore it. */
   list-style: none;
   margin: 0;
   padding: var(--_p);
@@ -75,6 +79,10 @@
 }
 
 .facet-list {
+  /* Markerless — so ADD `role="list"` to the element. Safari + VoiceOver stop
+     announcing a marker-less <ul> as a list, so this reset silently costs the
+     semantics the <ul> was chosen for. Nothing in the framework emits this markup,
+     so only the author can restore it. */
   list-style: none;
   margin: 0;
   padding: 0;

package/assets/css/patterns/nav.css

@@ -30,6 +30,10 @@ nav:has(> .nav-items) {
   display: flex;
   flex-direction: column;
   gap: 1.5rem;
+  /* Markerless — so ADD `role="list"` to the element. Safari + VoiceOver stop
+     announcing a marker-less <ul> as a list, so this reset silently costs the
+     semantics the <ul> was chosen for. Nothing in the framework emits this markup,
+     so only the author can restore it. */
   list-style: none;
   padding: 0;
   margin: 0;
@@ -99,6 +103,10 @@ nav:has(> .nav-items) {
 }
 
 .collapse-menu {
+  /* Markerless — so ADD `role="list"` to the element. Safari + VoiceOver stop
+     announcing a marker-less <ul> as a list, so this reset silently costs the
+     semantics the <ul> was chosen for. Nothing in the framework emits this markup,
+     so only the author can restore it. */
   list-style: none;
   padding-inline-start: 1.5rem;
   margin-block-start: 0.5rem;

package/assets/css/patterns/subgrid.css

@@ -63,7 +63,12 @@
   }
 
   /* Markerless when it's a list — a subgrid of cards is a list of things, and
-     the markers would sit in the gutter. */
+     the markers would sit in the gutter.
+
+     ADD `role="list"` to the element. Safari + VoiceOver stop announcing a
+     marker-less <ul> as a list, so this reset silently costs the semantics the <ul>
+     was chosen for — "3 items" becomes nothing at all. `<Subgrid>` does it for you;
+     hand-written markup must say it. */
   &:is(ul, ol) {
     list-style: none;
     margin: 0;
@@ -111,6 +116,16 @@
   display: grid;
   grid-template-rows: subgrid;
   grid-row: span var(--_card-rows);
+  /* The containing block for a `.stretched-link` inside it (utilities.css), so a
+     whole-card link needs no extra class here. Costs nothing otherwise.
+
+     This is the framework's answer to "the card IS a link", and the shape it
+     replaces is wrong in a way that looks fine: `<li><a class="card">` makes the
+     LI the grid item, so the anchor is an ordinary block and the tranches inside
+     it never land on the shared row lines — the alignment subgrid exists for
+     silently does not happen, and the anchor doesn't fill the cell either. Keep
+     the card as the grid item and stretch a link inside it. */
+  position: relative;
   padding: var(--_card-padding);
   border: var(--b-card, var(--b-card-group, var(--b-default)));
   border-radius: var(--br-card, var(--br-card-group, var(--br-default)));

package/assets/css/utilities.css

@@ -272,3 +272,15 @@
 .text-pretty {
   text-wrap: pretty;
 }
+
+/* ── position — a containing block for anything absolutely positioned inside, e.g.
+   a `.stretched-link` overlay on a bare `.card` (`.subgrid-card` already has one).
+   `relative` is in TW_CLASH: Tailwind ships it natively, so the tailwind format
+   drops this copy.
+
+   To lift content ABOVE a stretched-link overlay this is not enough — see `.raised`
+   in patterns/anchor-link.css, which has to live there because Tailwind has no
+   equivalent name and this file is in TAILWIND_SKIP. ── */
+.relative {
+  position: relative;
+}