@ztd-me/frontend-checks 0.1.0 → 0.1.1

package/README.md

@@ -1,15 +1,15 @@
 # @ztd-me/frontend-checks
 
-Native CSS and Playwright accessibility checks. Requires Node >=22.14 and Playwright Test ^1.62.0. Version `0.1.0` is prepared for public npm publication through automatic staging and owner 2FA promotion. See [publishing](docs/publishing.md) and [CLI integration](https://github.com/zeithrold/tools/blob/main/docs/frontend-tooling.md). Consumers retain `@ztd-me/eslint@0.1.1` and its strict standards.
+Native CSS and Playwright accessibility checks. Requires Node >=22.14 and Playwright Test ^1.62.0. Version `0.1.1` is the patch candidate for Tailwind block custom variants; it requires automatic staging, owner 2FA promotion and fresh registry verification before consumers install it. See [publishing](docs/publishing.md) and [CLI integration](https://github.com/zeithrold/tools/blob/main/docs/frontend-tooling.md). Consumers retain `@ztd-me/eslint@0.1.1` and its strict standards.
 
 After promotion and verified public installation:
 
 ```sh
-pnpm add -D --save-exact @ztd-me/frontend-checks@0.1.0 @playwright/test@1.62.0
+pnpm add -D --save-exact @ztd-me/frontend-checks@0.1.1 @playwright/test@1.62.0
 pnpm exec playwright install chromium
 ```
 
-Retain the consuming project's release-age, trust and build policy. Wait if a newly promoted release is not yet eligible. The `0.0.0-stage` placeholder for a new package is not a usable helper release.
+Tools verification and the three consumer projects have user approval for `minimumReleaseAgeExclude: ['@ztd-me/*']`. Preserve other packages' age gates, integrity checks, no-downgrade and build policy. No scope trust exemption is granted. The `0.0.0-stage` placeholder for a new package is not a usable helper release.
 
 ## CSS
 
@@ -28,7 +28,7 @@ pnpm exec ztd-css ./css-check.config.mjs
 
 The config module is reviewed project code and executes during import. `checkCss(options)` is also exported from `@ztd-me/frontend-checks/css`. Every supplied glob must match; missing files and syntax/configuration errors fail. JSON findings print to stdout; a nonzero exit fails the gate. Under `zt check`, the CLI also writes `css.json` to `ZT_ARTIFACTS_DIR`.
 
-Stylelint 17.15 / standard 40 provide native CSS validation; only documented Tailwind directives and `--alpha`/`--spacing` functions receive syntax allowances. Undefined `var()` references fail across the supplied files/declaration sources, even with fallbacks. Exact runtime-generated variables can be declared in `externalCustomProperties`; document their owner in the project contract. Imports are not resolved automatically. Neither Sass/Less nor embedded Vue styles are parsed by this CSS-only entrypoint.
+Stylelint 17.15 / standard 40 provide native CSS validation; only documented Tailwind directives and `--alpha`/`--spacing` functions receive syntax allowances. The nesting-scoping rule remains enabled, with an exact `custom-variant` at-rule allowance for Tailwind-provided utility roots. Root/media nesting outside that directive still fails. See [variant compatibility](docs/tailwind-variants.md). Undefined `var()` references fail across the supplied files/declaration sources, even with fallbacks. Exact runtime-generated variables can be declared in `externalCustomProperties`; document their owner in the project contract. Imports are not resolved automatically. Neither Sass/Less nor embedded Vue styles are parsed by this CSS-only entrypoint.
 
 Hex, named and CSS color-function paint literals outside custom-property definitions fail. Token definitions retain each project's values. `transparent`, `currentColor`, inheritance and URLs are allowed. This check covers declarations, not Tailwind arbitrary-value classes, inline JS styles or every possible CSS color expression. An inventory definition is not proof of cascade/theme availability; render the relevant states. No autofix rewrites token values.
 
@@ -71,4 +71,4 @@ pnpm exec playwright install chromium
 pnpm run check
 ```
 
-Tests execute native CSS parsing/lint, real Chromium Axe/keyboard/dialog behavior, a deliberate accessibility failure, typed imports, fresh tarball installation/CLI use, and stage authorization/duplicate guards. The workspace keeps release-age/trust policy and only the previously approved exact ESLint 0.1.1 / semver 6.3.1 exceptions. Fresh consumers use strict 24-hour release age with no exceptions. After promotion, `test:registry` verifies registry integrity against the reviewed tarball and repeats consumer import/type/CLI/browser checks; a metadata lookup alone is insufficient.
+Tests execute native CSS parsing/lint, real Chromium Axe/keyboard/dialog behavior, a deliberate accessibility failure, typed imports, fresh tarball installation/CLI use, and stage authorization/duplicate guards. The workspace uses the authorized `@ztd-me/*` age exclusion and retains the existing exact `semver@6.3.1` trust exception. Fresh consumers retain strict 24-hour release age for other packages and no-downgrade for all packages. `test:registry` verifies registry integrity against the original reviewed release tarball and repeats consumer import/type/CLI/browser pass/failure checks; metadata alone is insufficient. Source documentation updates do not overwrite an already published version.

package/docs/publishing.md

@@ -1,6 +1,8 @@
 # Public stage-only release
 
-`@ztd-me/frontend-checks@0.1.0` is prepared for authorized public publication. `.github/workflows/publish-frontend.yml` runs automatically on relevant pushes to `main`. It uses pnpm 11.22.0, frozen installation, strict lint, declarations, CSS fixtures, Chromium tests and fresh packed-consumer checks on Node 22 and 24. The Node 24 job packs the tested bytes and records the immutable source SHA and checksums. A separate job verifies those checksums and source identity before staging that exact tarball. It never directly publishes or promotes a version.
+`@ztd-me/frontend-checks@0.1.0` is published from source `3f9a3a7d33befc5a954ba1e86d3aa6d72e2c762f`. Its [automatic staging run](https://github.com/zeithrold/tools/actions/runs/36995178595) created stage `bc4c19ac-2c8b-4525-88f0-e0ec1e333903`; owner promotion made the exact verified tarball public. SHA-256 is `a3b7209f90746bf71c1b5b4ef69910a70ff747acc394696a778996f69efcb87c`.
+
+`.github/workflows/publish-frontend.yml` runs automatically on relevant pushes to `main`. It uses pnpm 11.22.0, frozen installation, strict lint, declarations, CSS fixtures, Chromium tests and fresh packed-consumer checks on Node 22 and 24. The Node 24 job packs the tested bytes and records the immutable source SHA and checksums. A separate job verifies those checksums and source identity before staging that exact tarball. It never directly publishes or promotes a version. Documentation/policy changes without a version bump verify and skip the public version rather than republishing it.
 
 The existing repository `NPM_TOKEN` secret is the authorized route. It must permit Read and write (stage only) for this package under `@ztd-me`, with Bypass 2FA disabled. Its actual scope for this new package cannot be inferred from its success publishing ESLint. If permission is missing, the package owner must supply the narrowly authorized access; the workflow fails without creating credentials or expanding rights. Organization administration rights alone do not grant package publication rights. The token is bound to the registry in memory in the stage step only; installation, checks and packing receive no token.
 
@@ -26,7 +28,7 @@ pnpm run test:registry 0.1.0 /path/to/verified/package.tgz
 
 The script checks the exact public package/version and registry SHA-512 integrity against the reviewed tarball, then creates a fresh pnpm consumer. It installs the exact registry version, reruns frozen installation, imports both `/css` and `/playwright`, invokes `ztd-css`, checks TypeScript declarations with strict settings and executes a deliberately failing browser Axe scan that must retain the violation evidence. Browser infrastructure errors cannot satisfy that assertion.
 
-The consumer uses `minimumReleaseAge: 1440`, `minimumReleaseAgeStrict: true` and `trustPolicy: no-downgrade` without exceptions. A newly promoted release may require waiting 24 hours before this check is eligible. Wait and retry if the policy blocks it; do not lower policy or add an exception to force publication verification. Consumers retain their own approved policies and pin the verified version:
+The user authorizes `minimumReleaseAgeExclude: ['@ztd-me/*']` in tools verification and the three consumer projects. The consumer retains `minimumReleaseAge: 1440`, `minimumReleaseAgeStrict: true`, pruning and `trustPolicy: no-downgrade`. Other packages still wait 24 hours. Scope packages keep integrity/trust checks; no scope-wide trust exclusion is authorized. Preserve the existing exact `semver@6.3.1` trust exception wherever the ESLint graph needs it. Pin the verified registry version:
 
 ```sh
 pnpm add -D --save-exact @ztd-me/frontend-checks@0.1.0 @playwright/test@1.62.0

package/docs/tailwind-variants.md

@@ -0,0 +1,21 @@
+# Tailwind block variant compatibility
+
+The 0.1.1 patch candidate fixes the valid Tailwind 4.3.3 system-dark variant rejected by frontend-checks 0.1.0:
+
+```css
+@custom-variant dark {
+  :root[data-frontend-mode="dark"] & { @slot; }
+
+  @media (prefers-color-scheme: dark) {
+    :root[data-frontend-mode="system"] & { @slot; }
+  }
+}
+```
+
+Tailwind substitutes each utility selector for `&`. The native compiler produces the expected explicit-dark selector and system-mode media branch. Stylelint 17.15.0/standard 40.0.0 instead reports two missing-scoping-root findings because this precompiled directive is not native CSS nesting.
+
+The fix keeps `nesting-selector-no-missing-scoping-root` enabled and uses its supported secondary option `ignoreAtRules: ['custom-variant']`. It does not ignore files, media blocks, arbitrary at-rules or other findings. Tests require root/media `&` outside custom variants to fail and preserve native invalid-property findings plus semantic literal-color and undefined-token checks. Both direct and nested-media variant roots pass. The packed CLI consumer includes the exact source variant, and native Tailwind 4.3.3 compilation is an independent regression check. This is not a claim that the source CSS checker accepts every generated utility naming convention or validates the complete Tailwind language.
+
+The CSS API/config shape and Playwright exports are unchanged. Keep release-age, integrity, no-downgrade and existing build restrictions. This fix requires a new 0.1.1 release; changing tools source cannot repair consumers locked to published 0.1.0. The owner merges, the existing automatic workflow stages the candidate, and the owner approves it with npm 2FA. Verify the promoted exact version against its reviewed tarball using `scripts/registry-smoke.mjs` before updating final consumer locks. Staging alone is insufficient.
+
+Reference: [Stylelint's native ignoreAtRules option](https://stylelint.io/user-guide/rules/nesting-selector-no-missing-scoping-root/#ignoreatrules).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ztd-me/frontend-checks",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "license": "UNLICENSED",
   "description": "Native CSS and Playwright accessibility checks for zt frontend profiles",
@@ -27,22 +27,23 @@
   ],
   "dependencies": {
     "@axe-core/playwright": "4.13.0",
+    "color-name": "2.0.0",
     "fast-glob": "3.3.3",
     "postcss": "8.5.27",
     "postcss-value-parser": "4.2.0",
     "stylelint": "17.15.0",
-    "stylelint-config-standard": "40.0.0",
-    "color-name": "2.0.0"
+    "stylelint-config-standard": "40.0.0"
   },
   "peerDependencies": {
     "@playwright/test": "^1.62.0"
   },
   "devDependencies": {
-    "@types/node": "24.12.0",
     "@playwright/test": "1.62.0",
+    "@types/node": "24.12.0",
+    "@ztd-me/eslint": "0.1.1",
     "eslint": "10.11.0",
-    "typescript": "6.0.3",
-    "@ztd-me/eslint": "0.1.1"
+    "tailwindcss": "4.3.3",
+    "typescript": "6.0.3"
   },
   "repository": {
     "type": "git",

package/src/css-config.mjs

@@ -24,6 +24,10 @@ export const cssConfig = {
         ],
       },
     ],
+    'nesting-selector-no-missing-scoping-root': [
+      true,
+      { ignoreAtRules: ['custom-variant'] },
+    ],
     'function-no-unknown': [
       true,
       { ignoreFunctions: ['--alpha', '--spacing'] },