fix: update bundle set to optimal/optimal-components/optimal-utilities/full

[jackgranatowski]

Summary

• Root cause: The framework dropped slashed.essential.css and replaced the three-bundle set (essential, optimal, full) with four bundles: optimal, optimal-components, optimal-utilities, full. The plugin had not been updated, so the updater was trying to download a non-existent asset and the settings allowed an invalid bundle value.
• Backward compat: get_css_bundle() transparently migrates any stored 'essential' → 'optimal' at read time; no user action or page-save required.
• Descriptions: All bundle descriptions (admin picker, readme.txt, dev scripts) rewritten to accurately reflect what each bundle actually contains, including honest caveats about incomplete/stub layers in 0.x.

Files changed

File	Change
includes/class-settings.php	ALLOWED_BUNDLES updated; 'essential' → 'optimal' migration added
includes/class-framework-updater.php	BUNDLES download list updated
includes/class-admin.php	Bundle picker replaced with 4-card 2×2 grid; descriptions rewritten
readme.txt	CSS bundles section rewritten
scripts/sync-plugin-dist.js	BUNDLES list updated
scripts/update-framework.js	BUNDLES list + JSDoc comment updated
scripts/verify-sync.js	DIST_BUNDLES list + comment updated

Test plan

• Existing install with 'essential' stored in options → loads slashed.optimal.css without any settings save
• Bundle picker shows all four options with correct labels and descriptions
• One-click updater downloads all four bundles successfully
• scripts/verify-sync.js passes against a synced dist/
• No reference to slashed.essential.css remains anywhere in the plugin

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

@jackgranatowski, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 1 minute and 17 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5442781a-d7e3-4371-ac38-801fe34ae79b

📥 Commits

Reviewing files that changed from the base of the PR and between cbf66a4 and d94a990.

⛔ Files ignored due to path filters (2)

• SLASHED-for-WP/dist/slashed.optimal-components.css is excluded by !**/dist/**
• SLASHED-for-WP/dist/slashed.optimal-utilities.css is excluded by !**/dist/**

📒 Files selected for processing (13)

• SLASHED-for-WP/includes/class-admin.php
• SLASHED-for-WP/includes/class-framework-updater.php
• SLASHED-for-WP/includes/class-rest-controller.php
• SLASHED-for-WP/includes/class-settings.php
• SLASHED-for-WP/includes/class-token-store.php
• SLASHED-for-WP/integrations/bricks/slashed-bricks.php
• SLASHED-for-WP/integrations/gutenberg/slashed-gutenberg.php
• SLASHED-for-WP/license.txt
• SLASHED-for-WP/readme.txt
• phpstan-bootstrap.php
• scripts/sync-plugin-dist.js
• scripts/update-framework.js
• scripts/verify-sync.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/plugin-bundles-update-pfvz15

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Fix plugin to use new 4-bundle framework set (drop 'essential')
🐞 Bug fix 📝 Documentation ⚙️ Configuration changes 🕐 20-40 Minutes

Description

• Replace deprecated 'essential' bundle with the new 4-bundle framework set.
• Transparently migrate stored 'essential' → 'optimal' without requiring a settings save.
• Update admin UI, readme, and dev scripts to match the new bundle semantics.

Diagram

graph TD
A["Admin settings UI"] --> B["Slashed_Admin"] --> C["Slashed_Settings"] --> D[(WP_options)]
B --> E["Framework_Updater"] --> F{{GitHub_Releases}}
E --> G["Plugin dist/*.css"]
H["CSS_Loader"] --> C --> D
H --> G
subgraph Legend
  direction LR
  _svc["Module/Class"] ~~~ _db[("Storage")] ~~~ _ext{{"External"}}
end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. One-time migration on plugin upgrade/activation

• ➕ Guarantees the stored option value is rewritten once (no repeated read-time mapping).
• ➕ Centralizes migrations in a single upgrade routine.
• ➖ Requires reliable upgrade hook/version tracking; migrations may be missed if hooks don’t run as expected.
• ➖ Still needs defensive read-time handling for edge cases (imports, partial updates).

2. Keep supporting 'essential' as an alias indefinitely

• ➕ Zero migration logic; older stored values continue to work.
• ➖ Allows persisting an invalid/non-existent bundle; increases long-term confusion and support burden.
• ➖ Doesn’t fix the updater trying to fetch removed assets unless separately handled.

Recommendation: Keep the current approach: enforce the new allowed bundle set everywhere, and migrate legacy 'essential' → 'optimal' at read time (plus on save/setters). It’s the most robust against partially-upgraded installs and prevents re-storing invalid values, while keeping user impact near zero.

Files changed (7) +60 / -40

Bug fix (3) +46 / -26

class-admin.phpUpdate bundle picker UI to 4-bundle 2×2 grid with revised copy +31/-24

Update bundle picker UI to 4-bundle 2×2 grid with revised copy

• Replaces the old 3-option bundle picker with a 4-card grid (Optimal / Optimal+Components / Optimal+Utilities / Full). Updates per-bundle descriptions to reflect current framework layering and 0.x caveats, and tweaks small UI details (grid columns, checkmark glyph).

SLASHED-for-WP/includes/class-admin.php

class-framework-updater.phpDownload the new 4-bundle set during framework updates +1/-1

Download the new 4-bundle set during framework updates

• Updates the updater’s bundle list so one-click updates fetch the four current release assets instead of the removed essential bundle. This prevents update failures when attempting to download non-existent files.

SLASHED-for-WP/includes/class-framework-updater.php

class-settings.phpValidate new bundle set and migrate legacy 'essential' to 'optimal' +14/-1

Validate new bundle set and migrate legacy 'essential' to 'optimal'

• Replaces the allowed bundle list with the new four-bundle set and adds a transparent migration so stored 'essential' values resolve to 'optimal'. Also migrates on save/setter paths to ensure the legacy value is not re-persisted.

SLASHED-for-WP/includes/class-settings.php

Documentation (1) +5 / -5

readme.txtRewrite CSS bundle documentation for the new 4-bundle model +5/-5

Rewrite CSS bundle documentation for the new 4-bundle model

• Updates the readme’s CSS bundles section to describe Optimal, Optimal+Components, Optimal+Utilities, and Full accurately. Clarifies that all four bundles ship locally and are also available via CDN pinning.

SLASHED-for-WP/readme.txt

Other (3) +9 / -9

sync-plugin-dist.jsSync script now copies all 4 local bundle files +3/-3

Sync script now copies all 4 local bundle files

• Updates the bundle list and comments so build artifact syncing copies optimal, optimal-components, optimal-utilities, and full into the plugin dist/ directory.

scripts/sync-plugin-dist.js

update-framework.jsFramework update script downloads the 4-bundle set +3/-3

Framework update script downloads the 4-bundle set

• Updates the download bundle list and inline documentation to match the new framework release asset set, ensuring local plugin dist/ is populated with the correct files.

scripts/update-framework.js

verify-sync.jsVerify script expects 4 dist bundles and fixes header comment escaping +3/-3

Verify script expects 4 dist bundles and fixes header comment escaping

• Updates verification to check four dist bundle headers for a consistent framework version and adjusts the DIST_BUNDLES list accordingly. Also corrects the JSDoc example comment to avoid prematurely terminating the block comment.

scripts/verify-sync.js

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Bundle allowlist mismatch ✓ Resolved 🐞 Bug ≡ Correctness

Description

The REST /settings endpoint (and token import) still validates css_bundle against
Slashed_Token_Store::ALLOWED_CSS_BUNDLES (essential/optimal/full), so the new bundle IDs
(optimal-components/optimal-utilities) enabled by this PR are rejected in those flows. Standalone
Bricks/Gutenberg bundle resolution also uses the legacy allowlists, preventing the new bundle IDs
from being selected/served in standalone mode.

Code

SLASHED-for-WP/includes/class-settings.php[33]

+	const ALLOWED_BUNDLES = array( 'optimal', 'optimal-components', 'optimal-utilities', 'full' );

Relevance

⭐⭐⭐ High

Team often fixes REST/settings allowlist mismatches; REST controller correctness work merged in PRs
#28 and #69.

PR-#28
PR-#69

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The canonical settings allowlist now includes the two new bundle IDs, but REST validation and
standalone integration code still use legacy allowlists that only include essential/optimal/full,
which would reject the new values.

SLASHED-for-WP/includes/class-settings.php[31-35]
SLASHED-for-WP/includes/class-token-store.php[44-48]
SLASHED-for-WP/includes/class-rest-controller.php[165-181]
SLASHED-for-WP/includes/class-rest-controller.php[557-567]
SLASHED-for-WP/integrations/bricks/slashed-bricks.php[55-72]
SLASHED-for-WP/integrations/gutenberg/slashed-gutenberg.php[28-36]
SLASHED-for-WP/integrations/gutenberg/slashed-gutenberg.php[76-85]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`Slashed_Settings` now allows `optimal-components` and `optimal-utilities`, but other validators still enforce the legacy bundle set. This causes inconsistent behavior: the admin/settings layer can store or display new values, while REST settings save/import (and standalone integrations) reject them.

## Issue Context
There are multiple independent allowlists/validators for `css_bundle`:
- Canonical: `Slashed_Settings::ALLOWED_BUNDLES`
- Legacy: `Slashed_Token_Store::ALLOWED_CSS_BUNDLES`
- Standalone Gutenberg: `SLASHED_GUTENBERG_ALLOWED_BUNDLES`

## Fix Focus Areas
- SLASHED-for-WP/includes/class-token-store.php[44-48]
- SLASHED-for-WP/includes/class-rest-controller.php[165-181]
- SLASHED-for-WP/includes/class-rest-controller.php[557-567]
- SLASHED-for-WP/integrations/bricks/slashed-bricks.php[63-72]
- SLASHED-for-WP/integrations/gutenberg/slashed-gutenberg.php[35-35]
- SLASHED-for-WP/integrations/gutenberg/slashed-gutenberg.php[76-85]
- phpstan-bootstrap.php[28-28]

## Implementation notes
- Update `Slashed_Token_Store::ALLOWED_CSS_BUNDLES` to the new 4-bundle set, and migrate `essential`→`optimal` on read/write paths used in standalone mode.
- Update REST controller validation to accept the new bundle IDs (prefer referencing `Slashed_Settings::ALLOWED_BUNDLES` when the class exists).
- Update `SLASHED_GUTENBERG_ALLOWED_BUNDLES` (and phpstan bootstrap) to match the new bundle IDs, and add the same legacy migration if needed.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. License bundle list stale ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

readme.txt now states all four bundles ship locally, but license.txt still lists only the legacy
three CSS files (including slashed.essential.css). This leaves third-party license disclosure
metadata out of sync with the new bundle set described in this PR.

Code

SLASHED-for-WP/readme.txt[R92-97]

+* **Optimal** (recommended) — the full core layer: design tokens, CSS reset, base element styles, themes (light & dark mode), layout primitives, macro-classes, interaction states, motion, accessibility, and print — plus classless form styling.
+* **Optimal + Components** — Optimal plus the component token and style layers (8 component slots reserved; class definitions ship incrementally in upcoming 0.x releases).
+* **Optimal + Utilities** — Optimal plus the utilities layer slot (reserved; SLASHED ships no utility classes in 0.x).
+* **Full** — all layers: Optimal, Components, and Utilities combined.

-Two more variants (Optimal + Components, Optimal + Utilities) are available via CDN. The plugin bundles Essential, Optimal, and Full locally; all variants are reachable over CDN, where you can pin any published release tag.
+All four bundles ship locally with the plugin (kept up to date by the one-click updater in settings) and are also reachable via CDN, where you can pin any published release tag.

Relevance

⭐⭐⭐ High

They maintain license.txt third‑party disclosures; license.txt was introduced/curated for WP.org in
PR #47.

PR-#47

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

readme.txt claims four local bundles; verify-sync expects four bundle files; but license.txt still
enumerates only three legacy bundle filenames, indicating repo metadata hasn’t been updated to match
the new bundle set.

SLASHED-for-WP/readme.txt[88-97]
scripts/verify-sync.js[31-101]
SLASHED-for-WP/license.txt[347-352]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The plugin’s `license.txt` “THIRD-PARTY LICENSES” section enumerates bundled framework CSS files, but it hasn’t been updated to reflect the new 4-bundle set described in readme.txt and expected by tooling.

## Issue Context
This is release hygiene/compliance metadata: the license manifest should accurately reflect which third-party artifacts are bundled.

## Fix Focus Areas
- SLASHED-for-WP/license.txt[347-352]
- SLASHED-for-WP/readme.txt[88-97]
- scripts/verify-sync.js[31-101]

## Implementation notes
- If the plugin will ship `slashed.optimal-components.css` and `slashed.optimal-utilities.css` locally, add them to `license.txt` and remove `slashed.essential.css` if it’s no longer shipped.
- If `slashed.essential.css` is intentionally retained for backward compatibility, clarify that in docs and keep it listed (and consider whether it should still be distributed/updated).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---