django-tailwind-cli 4.6.2__tar.gz → 4.8.0__tar.gz

{django_tailwind_cli-4.6.2 → django_tailwind_cli-4.8.0}/.github/workflows/release.yml

@@ -21,11 +21,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: "3.x"
     - name: Install pypa/build
@@ -67,8 +67,11 @@ jobs:
     name: >-
       Publish Python 🐍 distribution 📦 to PyPI
     if: startsWith(github.ref, 'refs/tags/')  # only publish to PyPI on tag pushes
+    # TestPyPI first: the upload to PyPI cannot be undone, so a broken artifact
+    # has to fail somewhere reversible before it gets there.
     needs:
     - build
+    - publish-to-testpypi
     runs-on: ubuntu-latest
     environment:
       name: pypi
@@ -82,7 +85,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to PyPI
-      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1.14
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1.14
 
   github-release:
     name: >-
@@ -107,7 +110,7 @@ jobs:
       with:
         name: release-notes
     - name: Sign the dists with Sigstore
-      uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
+      uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0
       with:
         inputs: >-
           ./dist/*.tar.gz
@@ -156,7 +159,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to TestPyPI
-      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1.14
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1.14
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true

django_tailwind_cli-4.8.0/.github/workflows/test.yml

@@ -0,0 +1,193 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    # pre-commit pins its hook environments to 3.10 (default_language_version),
+    # and the linters only ever need one interpreter.
+    env:
+      MISE_PYTHON_VERSION: "3.10"
+      # tmux only exists for the optional `mise run dev` session, which CI never starts. Disabling
+      # beats limiting install_args, because `mise run` would auto-install it again.
+      MISE_DISABLE_TOOLS: tmux
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up mise
+        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        with:
+          install: true
+          cache: true
+          # Distinct from the test jobs: this one also installs pre-commit, so
+          # sharing their key would hand them a cache missing a tool. The
+          # version belongs in the key too, or bumping it later restores a
+          # cache holding the old interpreter and never re-saves.
+          cache_key: "lint-{{default}}-{{env.MISE_PYTHON_VERSION}}"
+
+      - name: Cache pre-commit hooks
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
+          restore-keys: pre-commit-${{ runner.os }}-
+
+      - name: Cache uv downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-lint-${{ hashFiles('uv.lock') }}
+          restore-keys: uv-${{ runner.os }}-lint-
+
+      # basedpyright resolves imports through .venv (see [tool.pyright] in
+      # pyproject.toml). Without this step it reports every import as missing,
+      # which is why the original pre-commit job was dropped back in 2022.
+      # --locked, unlike `mise run bootstrap`: a uv.lock that has drifted from
+      # pyproject.toml should fail the job, not be silently re-resolved into
+      # something uv-secure then audits instead of the committed lock.
+      - name: Install dependencies
+        run: uv sync --all-extras --locked
+
+      # uv-secure audits uv.lock against the published advisories, so a new one
+      # can turn an unrelated pull request red. That is deliberate: it is how we
+      # hear about it. Fix the lock rather than skipping the hook.
+      - name: Run pre-commit
+        run: mise run lint
+
+  build:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
+
+    # Job-scoped so every step resolves the same interpreter, not just the
+    # install step. Prereleases are aliased in mise.toml, so "3.15" resolves.
+    env:
+      MISE_PYTHON_VERSION: ${{ matrix.python-version }}
+      # pre-commit too, unlike the lint job: this one never runs it.
+      MISE_DISABLE_TOOLS: pre-commit,tmux
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up mise
+        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        with:
+          install: true
+          cache: true
+          # The default key ignores MISE_PYTHON_VERSION, so all six jobs would
+          # share one entry holding a single Python.
+          cache_key: "{{default}}-{{env.MISE_PYTHON_VERSION}}"
+
+      - name: Cache uv downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('uv.lock') }}
+          restore-keys: uv-${{ runner.os }}-${{ matrix.python-version }}-
+
+      - name: Test with tox
+        run: mise run test-all
+
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+
+    # The tox matrix runs pytest without --cov, so the fail_under floor in
+    # pyproject.toml would otherwise be a local convention nothing enforces.
+    # One interpreter is enough: the floor is about the suite, not the matrix.
+    env:
+      MISE_PYTHON_VERSION: "3.13"
+      MISE_DISABLE_TOOLS: pre-commit,tmux
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up mise
+        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        with:
+          install: true
+          cache: true
+          cache_key: "coverage-{{default}}-{{env.MISE_PYTHON_VERSION}}"
+
+      - name: Cache uv downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-coverage-${{ hashFiles('uv.lock') }}
+          restore-keys: uv-${{ runner.os }}-coverage-
+
+      - name: Install dependencies
+        run: uv sync --all-extras --locked
+
+      - name: Run the suite with coverage
+        run: mise run test
+
+  docs:
+    name: Docs
+    runs-on: ubuntu-latest
+
+    # Sphinx reports a missing reference or an unresolvable include as a warning and publishes
+    # anyway, so a plain build would pass on exactly the failures worth catching. -W is the point
+    # of this job; conf.py suppresses the one warning class Pygments cannot help with.
+    env:
+      MISE_PYTHON_VERSION: "3.13"
+      MISE_DISABLE_TOOLS: pre-commit,tmux
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up mise
+        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        with:
+          install: true
+          cache: true
+          cache_key: "docs-{{default}}-{{env.MISE_PYTHON_VERSION}}"
+
+      - name: Cache uv downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-docs-${{ hashFiles('docs/requirements.txt') }}
+          restore-keys: uv-${{ runner.os }}-docs-
+
+      - name: Build the docs
+        run: mise run build-docs
+
+  zizmor:
+    name: Audit workflows (zizmor)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read # zizmor-action reads workflow definitions
+      security-events: write # upload SARIF results to code scanning
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

{django_tailwind_cli-4.6.2 → django_tailwind_cli-4.8.0}/.gitignore

@@ -78,9 +78,11 @@ docs/_build/
 # macOS
 .DS_Store
 
-# AI tool configs
-CLAUDE.md
-AGENTS.md
+# Local tool config
+mise.local.toml
+
+# Local agent and tracker state (AGENTS.md and CLAUDE.md are tracked)
+CLAUDE.local.md
 .claude/
 .beans.yml
 .beans/

django_tailwind_cli-4.8.0/.mise/tasks/dev

@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+#MISE description="tmux dev session: agent, test watcher and a free shell"
+# raw: without it mise sits between the terminal and tmux, and tmux won't attach without a tty.
+#MISE raw=true
+# ------------------------------------------------------------
+#  dev — 3-pane tmux session for django-tailwind-cli
+#
+#    +----------------+----------------+
+#    |                | test-watch     |
+#    |     claude     +----------------+
+#    |   --continue   | shell          |
+#    +----------------+----------------+
+#
+#  Verbs: stop, restart, status. Bare `mise run dev` starts or attaches.
+# ------------------------------------------------------------
+set -euo pipefail
+
+PROJECT_DIR="${MISE_PROJECT_ROOT:-$PWD}"
+SELF="$PROJECT_DIR/.mise/tasks/dev"
+SESSION="${TAILWIND_TMUX_SESSION:-tailwind-cli}"
+# One tmux server per project instead of the shared per-user one. Two reasons, both observed: a session
+# destroyed in one project could drop the client into another project's session (with
+# `detach-on-destroy off`, which is the default in this user's ~/.tmux.conf), and `kill-server` was global.
+# Named after the project, so `tmux -L tailwind-cli ls` reaches it from a plain shell.
+SERVER="${TAILWIND_TMUX_SERVER:-tailwind-cli}"
+tm() { tmux -L "$SERVER" "$@"; }
+# `exec` needs a program, not a shell function, so the three exec lines below spell tmux out. The wrapper
+# stays for everything else: every other call must reach this socket and no other.
+
+session_exists() { tm has-session -t "=$SESSION" 2>/dev/null; }
+
+# start(), restart() and exec_attach() all refuse a foreign server the same way, so it is said once.
+refuse_foreign_tmux() {
+  echo "This shell is inside another tmux server (${TMUX%%,*})."
+  echo "Detach there first (prefix d), then run 'mise run dev' again."
+}
+
+# Whether this shell sits inside *our* server. A session on a different server can neither be switched to
+# nor be the one restart() is about to kill, and `$TMUX` names the socket the same way tmux reports it
+# (measured: both are the resolved absolute path).
+in_our_server() {
+  [[ -n "${TMUX:-}" && "${TMUX%%,*}" == "$(tm display-message -p '#{socket_path}' 2>/dev/null)" ]]
+}
+
+in_foreign_tmux() { [[ -n "${TMUX:-}" ]] && ! in_our_server; }
+
+# Which panes hold services is recorded at start (@service-panes), not guessed here:
+# the watcher runs through mise and uv, so the pane reports "uv" rather than ptw, and pane titles
+# get rewritten by anything that emits an OSC title sequence.
+service_panes() {
+  local ids
+  ids="$(tm show-options -t "$SESSION" -v @service-panes 2>/dev/null || true)"
+  [[ -z "$ids" ]] && return 0
+  tm list-panes -s -t "=$SESSION" -F '#{pane_id} #{pane_current_command}' |
+    awk -v ids=" $ids " 'index(ids, " " $1 " ") && $2 !~ /^-?(zsh|bash|fish|sh)$/ { print $1 }'
+}
+
+start() {
+  if session_exists; then
+    exec_attach
+  fi
+
+  # Refuse *before* building anything. exec_attach would refuse too, but only after the session and its
+  # services are up — leaving a started session behind and still exiting non-zero.
+  if in_foreign_tmux; then
+    refuse_foreign_tmux
+    return 1
+  fi
+
+  local main rtop rbot
+  main="$(tm new-session -d -s "$SESSION" -n dev -c "$PROJECT_DIR" \
+    -x "$(tput cols 2>/dev/null || echo 200)" \
+    -y "$(tput lines 2>/dev/null || echo 50)" \
+    -P -F '#{pane_id}')"
+  rtop="$(tm split-window -h -t "$main" -c "$PROJECT_DIR" -P -F '#{pane_id}')"
+  rbot="$(tm split-window -v -t "$rtop" -c "$PROJECT_DIR" -P -F '#{pane_id}')"
+  tm set-window-option -t "$SESSION:dev" main-pane-width 50%
+  tm select-layout -t "$SESSION:dev" main-vertical
+
+  tm select-pane -t "$main" -T "claude"
+  tm select-pane -t "$rtop" -T "test-watch"
+  tm select-pane -t "$rbot" -T "shell"
+
+  # So a key binding can stop whichever dev session it is in: run-shell -b '#{@dev-stop}'
+  # Independent of the per-project server: ending this session must return the terminal to its shell,
+  # never move it into whatever else the server holds.
+  tm set-option -t "$SESSION" detach-on-destroy on
+  # Quoted: the documented consumer is `run-shell -b '#{@dev-stop}'`, which hands the string to
+  # /bin/sh, so an unquoted checkout path with a space in it would not resolve.
+  tm set-option -t "$SESSION" @dev-stop "'$SELF' stop"
+  tm set-option -t "$SESSION" @service-panes "$rtop"
+
+  # send-keys, not a pane command: real interactive shell, and the pane survives the exit.
+  # `|| claude` because --continue exits non-zero when this directory has no conversation yet --
+  # a fresh clone, or a project whose sessions live under a different CLAUDE_CONFIG_DIR. The
+  # trade-off: leaving claude with a non-zero status starts it once more.
+  tm send-keys -t "$main" 'claude --continue || claude' C-m
+  tm send-keys -t "$rtop" 'mise run test-watch' C-m
+
+  tm select-pane -t "$main"
+  exec_attach
+}
+
+exec_attach() {
+  # Inside this project's own server switching still works — another window, say.
+  if in_our_server; then
+    exec tmux -L "$SERVER" switch-client -t "=$SESSION"
+  fi
+  # From a different project's server it cannot: switch-client does not cross servers, and a nested
+  # attach would double every key binding. Ask for a detach rather than producing that.
+  # Not in_foreign_tmux: the branch above already exec'd when the server was ours, so reaching this
+  # line is itself the "not ours" half of that predicate.
+  if [[ -n "${TMUX:-}" ]]; then
+    refuse_foreign_tmux
+    return 1
+  fi
+  # Escape hatch: ITERM_CC=0 mise run dev
+  if [[ "${TERM_PROGRAM:-}" == "iTerm.app" && "${ITERM_CC:-1}" == "1" ]]; then
+    exec tmux -L "$SERVER" -CC attach -t "=$SESSION"
+  fi
+  exec tmux -L "$SERVER" attach -t "=$SESSION"
+}
+
+stop() {
+  if ! session_exists; then
+    echo "Session '$SESSION' is not running."
+    return 0
+  fi
+
+  local pane i
+  for pane in $(service_panes); do
+    tm send-keys -t "$pane" C-c
+  done
+  for i in $(seq 200); do
+    [[ -z "$(service_panes)" ]] && break
+    sleep 0.05
+  done
+
+  tm kill-session -t "=$SESSION"
+  echo "Session '$SESSION' stopped."
+  # No pkill counterpart here: pytest is a child of ptw and dies with it. Measured after every
+  # stop in this session — nothing survived the pane.
+}
+
+restart() {
+  # Refuse before stop() runs, not after: start() has this same guard, but by the time it refuses
+  # the session is already dead — restart from a foreign server destroyed it and rebuilt nothing.
+  if in_foreign_tmux; then
+    refuse_foreign_tmux
+    return 1
+  fi
+  # kill-session would SIGHUP this very shell before start() runs.
+  # `in_our_server` is not decoration: from a plain shell `#S` still reports our session (measured),
+  # so the name comparison on its own would refuse every restart from a normal terminal.
+  if in_our_server && [[ "$(tm display-message -p '#S')" == "$SESSION" ]]; then
+    echo "Run restart from outside '$SESSION' — stopping it kills this shell."
+    return 1
+  fi
+  stop
+  start
+}
+
+case "${1:-}" in
+stop) stop ;;
+restart) restart ;;
+status) session_exists && echo "running" || echo "stopped" ;;
+*) start ;;
+esac

{django_tailwind_cli-4.6.2 → django_tailwind_cli-4.8.0}/CHANGELOG.md

@@ -1,6 +1,77 @@
 # Changelog
 
-## Unreleased
+## 4.8.0 (2026-08-30)
+
+### 💥 Dependencies
+- **`django-typer` replaced by `django-click`**, which drops `typer` from the dependency tree entirely. django-typer caps `typer<0.26.0`, `click<8.5` and `django<6.2`; django-click requires only `click>=7.1` with no upper bound, so those caps no longer reach into your environment. The nine subcommands, their options and the `runserver` passthrough are unchanged, `call_command` still accepts options both as keywords and as strings, and `CommandError` still reaches a programmatic caller. Help text is now rendered by click rather than by typer's markdown mode, so backticks in `--help` appear literally.
+- **`call_command("tailwind", ..., verbosity=0)` no longer raises `TypeError`.** Django's own command options were rejected by the command group, which made the command unusable from a script that passes them — as deploy scripts and other packages' test suites routinely do. `stdout` and `stderr` are honoured rather than merely accepted, so a caller can capture the output.
+- **An option meant for another subcommand is refused instead of ignored.** `call_command("tailwind", "config", verbose=True)` used to run and do nothing with `verbose`; it now raises `TypeError`, as Django does for an option a command does not have.
+- **`--skip-checks` and `--force-color` work again**, on the group and on every subcommand, as they do for any other Django management command.
+- **`manage.py tailwind` with no subcommand exits 2** rather than 1, click's code for a usage error. It still prints the help text.
+- **`manage.py tailwind --version` reports this package's version**, not Django's.
+
+### 🎯 New Features
+- **A source CSS inside `STATICFILES_DIRS` is reported by the system check `django_tailwind_cli.W001`** instead of failing on deploy. Such a file is collected by `collectstatic`, and a manifest storage backend then cannot resolve the `@import "tailwindcss";` it contains. It stays a warning, not an error — without a manifest backend the file is merely published alongside the build output — and `SILENCED_SYSTEM_CHECKS` turns it off.
+- **Hand edits to the managed `source.css` no longer vanish silently**: the command says what it is about to replace, keeps your version as `source.css.bak`, and points at `TAILWIND_CLI_SRC_CSS` as the way to own the file. Toggling DaisyUI or a changed set of auto-`@source`d apps does not trip it — only content this library could not have written does.
+
+### 🐛 Bug Fixes
+- **`TAILWIND_CLI_CSS_MAP` works end to end**: the source CSS was written for the first entry only and `tailwind setup` built only that one, so a multi-entry project came out of setup with one stylesheet and the next `build` failed on the missing second input. Both iterate every entry now.
+- **Two `TAILWIND_CLI_CSS_MAP` entries writing one output file are rejected** instead of quietly building only one of them: the first build wrote the file, the freshness check then found the second entry up to date, and it was reported as built without ever having run. Different spellings of the same path (`./out.css` next to `out.css`) count as the same destination.
+- **A missing setting reads as a configuration error, not an unexpected one**: `get_config` raises `ConfigurationError` now, so `STATICFILES_DIRS is empty` arrives with the `STATICFILES_DIRS = [BASE_DIR / 'assets']` hint and one line of output instead of `❌ Unexpected error` and a traceback. It subclasses `ValueError`, so code calling `get_config()` directly and catching one is unaffected. Through a management command it arrives as a `CommandError`, as every other command failure does.
+- **`tailwind setup` uses the same code as `tailwind build`**: it wrote the source CSS and ran the first build with its own copies, so it ignored `TAILWIND_CLI_AUTO_SOURCE_EXTERNAL_APPS` and `TAILWIND_CLI_AUTOMATIC_MINIFY`, never wrote the managed directory's `.gitignore`, ran the build from the shell's working directory rather than `BASE_DIR`, and exited 0 after reporting that the build had failed. In exchange it now brings an existing `source.css` to the state a build expects rather than leaving it alone — announced, and with a `.css.bak`.
+- **An `@source` line you added yourself is no longer deleted in silence**: the check for "did we write this file" accepted any `@source` directive as its own, so widening template discovery by hand in the managed `source.css` lost the line on the next build, with no warning and no backup. Position decides now — the library only ever writes `@source` below its own generated comment.
+- **Command errors are reported the way they were meant to be**: the error decorator sat above `@app.command`, so typer registered the undecorated function and none of it ever ran. A failing command showed a bare traceback instead of the message and the suggested fix. It now prints the hint to stderr and lets the failure continue: a user error as a `CommandError`, which Django renders and a caller using `call_command` can catch, and a bug with its traceback intact. A failing Tailwind build called `sys.exit` and bypassed all of this; it raises now too.
+- **A `TAILWIND_CLI_PATH` pointing straight at a binary no longer ignores `TAILWIND_CLI_VERSION`**: that filename carries no version, so a bump used to reuse the old binary in silence. `build`, `watch` and `runserver` read the version from the binary now and warn on a mismatch rather than replacing a file you placed there. A managed download is unaffected: its version is in its filename. `download_cli` still replaces a binary you supplied — that is what it was asked to do — but names the file first.
+- **A CLI binary that appears mid-process is seen again**: an existence check was cached for five seconds behind a module-level dict, so with `TAILWIND_CLI_AUTOMATIC_DOWNLOAD = False` a build right after placing the binary still reported it missing. The cache served one call site and is gone.
+- **`tailwind runserver` says when there is no `manage.py` at `BASE_DIR`** instead of starting both subprocesses and reporting that the server is up, only for it to die a moment later with a bare exit code. Layouts that keep `manage.py` elsewhere are pointed at running the two halves separately.
+- **`TAILWIND_CLI_SRC_CSS` expands a leading `~`**, as `TAILWIND_CLI_PATH` already did. It used to become a directory named `~` below `BASE_DIR`. `TAILWIND_CLI_CSS_MAP` sources go through the same resolution now.
+- **A prefixed `STATICFILES_DIRS` entry may be a list**, not only a tuple. Django's own `FileSystemFinder` accepts both; `STATICFILES_DIRS[0]` in list form raised a `TypeError` before reaching any Tailwind code.
+- **The HTTP layer closes the error it catches.** `urllib`'s `HTTPError` is the response object and
+  owns an open file handle — one it allocates itself when the server sent no body. All three places
+  that wrapped it kept it alive through the exception chain without closing it, which Python 3.14
+  reports as `ResourceWarning: Implicitly cleaning up <HTTPError ...>` on a failed download or
+  version lookup.
+
+### 🛠️ Developer Experience
+- **CI builds the docs with warnings as errors**: Sphinx reports a missing reference or an unresolvable include as a warning and publishes anyway, so a plain build would pass on exactly the failures worth catching. `mise run build-docs` runs the same check locally.
+- **One download stub for the whole suite**: `tests/helpers.py` holds `write_fake_cli`, replacing 29 copies of the same fixture across four test modules. Net −290 lines.
+- **Coverage has a floor**: the suite fails below 90%, and branch coverage is on, so both sides of a condition count. A `coverage` job in CI enforces it — the tox matrix runs pytest without `--cov`, so the floor would otherwise have been a local convention.
+- **TestPyPI is a gate for the PyPI release again**: `publish-to-pypi` waits for `publish-to-testpypi` instead of running beside it, so a broken artifact fails somewhere reversible first. The TestPyPI step already sets `skip-existing`, so a re-run does not block on an already-published version.
+- **Shared test fixtures moved into `tests/conftest.py`**: `bypass_autoreload` and `fake_project_settings` replace four copies of the autoreload bypass and three copies of the settings setup. Modules opt in with `@pytest.mark.usefixtures(...)`.
+- **The linters run in CI again**: a `lint` job runs the full pre-commit suite (ruff, basedpyright, uv-secure, the upgrade hooks) on every pull request. It had been dropped in 2022 because pyright could not resolve imports without the project venv, which `mise run bootstrap` now provides.
+
+### 🔧 Technical Improvements
+- **No subprocess during template rendering**: with `TAILWIND_CLI_USE_SYSTEM_BINARY` and a pinned version, the version check ran inside `get_config()`, which `{% tailwind_css %}` calls on every render — so the first request of every worker process executed `tailwindcss --help`. It runs on the command path now.
+- **License metadata uses the SPDX form**: `license = "MIT"` plus `license-files`, so PyPI shows `MIT` instead of the whole licence text pasted into the metadata field. The `License :: OSI Approved` classifier is gone, which PyPI rejects alongside an SPDX expression.
+- **`_validate_css_settings` reads settings the way the rest of `config.py` does**, through `getattr(..., None)` rather than `hasattr` plus a second read. No behaviour change; the two idioms were verified to agree for an unset, `None`, empty and populated setting alike.
+- **The test suite no longer reaches the network**: `tests/conftest.py` fails any test that resolves a hostname, isolates the version cache per test, and answers the release lookup from a fixture. Until now the suite overwrote the machine-wide version cache that `manage.py tailwind` itself reads, and one setup test downloaded a real Tailwind binary into the source tree on every new version.
+
+### 📚 Documentation
+- **`docs/development.md` is `docs/workflow.md`**, titled "Daily Workflow". It documents using the package day to day, not contributing to it, and sat next to "Contributing" in the sidebar saying otherwise.
+- **The base template page shows the shipped file**, included rather than transcribed. The hand-copied version had drifted from `tailwind_cli/base.html`.
+- **The README command table lists all nine subcommands**: `optimize`, `download_cli` and `remove_cli` were missing, although the table reads as the full list and `troubleshoot` points users at `download_cli`.
+- **`CONTRIBUTING.md`**: development setup, test commands, commit and changelog conventions, and what makes an issue or pull request easy to act on. Linked from the README and published in the docs.
+- **`AGENTS.md` is tracked**: the repository conventions coding agents need live in the repo now instead of an ignored local file. `CLAUDE.md` is a one-line pointer at it.
+- **WhiteNoise page**: a sample configuration and the two traps that only show up on deploy — a `collectstatic` that runs before `tailwind build` fails at render time, not at build time, and a source CSS inside `STATICFILES_DIRS` breaks `collectstatic` outright.
+- **`troubleshoot` covers the deployment failure**: a `collectstatic` that runs before `tailwind build` leaves the manifest without an entry, and the guide now carries that error string and the fix. `setup` spells out the ordering too.
+- **DaisyUI is explained once**: the "Configuration Patterns" section pointed at the setting entry's explanation instead of repeating it, keeping only the manual-configuration and theme examples that the entry does not cover.
+- **`template_tags.md` showed `/static/css/styles.css`**, a path no configuration produces. It is `css/tailwind.css`.
+- **Cross-references to settings resolve again**: `myst_heading_anchors` was never enabled, so every `settings.md#tailwind_cli_…` link in the docs pointed at a fragment that does not exist. Three links had been broken since they were written.
+
+## 4.7.0 (2026-08-15)
+
+### 🎯 New Features
+- **Django 6.1 support**: added to the test matrix and the trove classifiers.
+
+### 🛠️ Developer Experience
+- **Switch dev tooling from `just` to `mise`**: Python 3.10–3.15, `uv`, and `pre-commit` are now pinned in `mise.toml`. Local tasks run via `mise run …`; CI uses `jdx/mise-action`.
+
+### 📚 Documentation
+- **Plainer README**: dropped the emoji headings and marketing register, and merged the overlapping feature sections into one. Same coverage, ~20% shorter.
+- **Accurate `tailwind setup` help**: `--help` no longer calls the command interactive. It lists the eight checks it actually runs and notes that it prompts for nothing.
+
+### 🔧 Technical Improvements
+- **Dependency refresh**: clears the advisories `uv-secure` flagged in the old lock. `pytest-django` 4.14 renamed `SettingsWrapper` to `Settings`, so the dev floor moved to 4.14.
 
 ## 4.6.2 (2026-05-14)
 

django_tailwind_cli-4.8.0/CONTRIBUTING.md

@@ -0,0 +1,142 @@
+# Contributing
+
+Contributions are welcome — bug reports, documentation fixes, and pull requests alike. This project
+follows the
+[Django Commons Code of Conduct](https://github.com/django-commons/membership/blob/main/CODE_OF_CONDUCT.md).
+
+## Before you open an issue or a pull request
+
+This project is maintained in spare time. Some weeks are quiet, some weeks the queue is longer than
+the time available for it. A few expectations keep that workable:
+
+- **One topic per issue, one change per pull request.** Small and focused gets handled quickly.
+  A submission that bundles four unrelated things waits until there is time for all four.
+- **Write it so it can be understood on the first read.** What you did, what you expected, what
+  happened instead. An unclear report gets closed rather than investigated — reconstructing the
+  missing half costs more time than the fix does.
+- **AI-assisted work is fine, unreviewed AI output is not.** You are the author of what you submit.
+  If you cannot explain every line of it, it is not ready.
+- **A quick answer is not an invitation.** A first issue fixed within the hour was well written,
+  not proof of spare capacity waiting for the next five.
+- **The subject line does most of the work.** Say what is broken, not that something is.
+
+If you are unsure whether something warrants an issue, ask first: open a
+[discussion](https://github.com/django-commons/django-tailwind-cli/discussions) or mail
+<oliver@andrich.me>. Questions about direction are welcome and cheaper than a rejected pull request.
+
+## Reporting a bug
+
+Run the diagnostics and paste their output — they cover most of what would otherwise be a round of
+questions:
+
+```bash
+python manage.py tailwind config        # resolved paths and settings
+python manage.py tailwind troubleshoot  # common misconfigurations
+python manage.py tailwind build --verbose
+```
+
+Add your OS, your Python and Django versions, the steps to reproduce, and the full traceback if
+there is one.
+
+## Development setup
+
+The only prerequisite is [mise](https://mise.jdx.dev/); it provisions Python 3.10–3.15, `uv`, and
+`pre-commit` from `mise.toml`.
+
+```bash
+git clone git@github.com:django-commons/django-tailwind-cli.git
+cd django-tailwind-cli
+
+mise install
+mise run bootstrap
+```
+
+## Tests and checks
+
+```bash
+mise run test        # pytest with coverage on the default interpreter
+mise run test-all    # the full Python/Django matrix via tox
+mise run lint        # pre-commit: ruff, basedpyright, uv-secure, upgrade hooks
+```
+
+`mise run test` and `mise run lint` both have to pass before a pull request is ready. `test-all`
+takes a while; CI runs the matrix on every pull request, so running it locally is optional unless
+you are touching something version-specific.
+
+One of the lint hooks, `uv-secure`, checks the lock file against published security advisories. If
+it fails on a dependency your change never touched, a new advisory appeared and the lock needs a
+bump — mention it in the pull request instead of working around it.
+
+## An optional dev session
+
+`mise run dev` opens a three-pane tmux session — `claude --continue` on the left, `pytest-watcher`
+running the suite on every save top right, a shell bottom right — on a tmux server of its own named
+after the project, so stopping it can never disturb another project's session.
+
+```bash
+mise run dev            # start, or attach if it is already running
+mise run dev stop       # shut it down
+mise run dev restart    # from outside the session
+mise run dev status
+```
+
+Entirely optional — nothing in the project depends on it. The watcher is also available on its own
+as `mise run test-watch`; it runs without coverage so the feedback stays fast, and `mise run test`
+remains the command that enforces it.
+
+## Commit messages
+
+[Conventional Commits](https://www.conventionalcommits.org/) in English, with a scope:
+
+```
+feat(management): add purge command for cleaning CSS
+fix(config): handle prefixed staticfile directories
+chore(deps): bump django-click to 2.5.0
+```
+
+Use the scope that names the area you touched. `config`, `management`, `build`, `watch`,
+`runserver`, `download`, `http`, `docs`, `tests`, `ci`, and `deps` are the common ones; `git log`
+shows the rest.
+
+Keep the message short — a title plus one or two sentences on the *why*. The diff already shows
+what changed, and test counts or coverage numbers belong in the pull request, not in the history.
+
+Commit under your own name and without bot co-author trailers. Whatever tools you used, the change
+is yours.
+
+## Changelog
+
+User-facing changes get an entry in `CHANGELOG.md` under `## Unreleased`, in one of the categories
+the file already uses (Breaking Changes, New Features, Bug Fixes, Developer Experience, and so on).
+One or two bullets, focused on what the change means for users rather than on how it was
+implemented. Internal refactorings that nobody notices from the outside do not need one.
+
+## Releases
+
+**The major version tracks Tailwind CSS, not this package's own compatibility.** `4.x` supports
+Tailwind 4.x, and the major only moves when Tailwind's does. A change that would be a major
+elsewhere under semver — a dropped dependency, a different exit code — goes into a minor here and
+is called out in the changelog instead.
+
+Releasing is a tag. `[tool.hatch.version]` reads the version from git, so `v4.8.0` *is* the
+version. Pushing the tag starts the release rather than finishing it: the workflow builds, uploads
+to TestPyPI, and then waits — the `pypi` environment requires a reviewer, so PyPI publishing needs
+an admin to approve it in the GitHub UI. Do not push a tag and walk away.
+
+Rename `## Unreleased` to `## 4.8.0 (YYYY-MM-DD)` before tagging. The release workflow extracts
+that section for the GitHub release notes and fails if it cannot find one, which blocks the whole
+release rather than shipping empty notes.
+
+## Pull requests
+
+Fork the repository and work on a feature branch. Add tests for new behaviour and update the
+documentation when the change is user-facing — `docs/` is published to
+[Read the Docs](https://django-tailwind-cli.rtfd.io/), and the README is its landing page. New code
+carries type hints; `basedpyright` runs in strict mode. CI runs the same pre-commit hooks that
+`mise run lint` runs, so checking locally first saves you a red pipeline.
+
+## License
+
+By contributing you agree that your contribution is licensed under the
+[MIT license](https://github.com/django-commons/django-tailwind-cli/blob/main/LICENSE) of this
+project.