viterex_addon-3.5.8.zip

Fixed

• stubs/stylelint.config.js: every Tailwind @apply failed the lint.
  stylelint-config-standard enables at-rule-prelude-no-invalid, which
  cannot parse a utility list (@apply flex gap-2) and reported
  Invalid prelude … for at-rule "@apply" on each one. The scaffolded config
  now ignores @apply for that rule (keeping the upstream media ignore),
  like it already does for at-rule-no-unknown and at-rule-no-deprecated.
  Existing projects: re-run "Install stubs", or add
  "at-rule-prelude-no-invalid": [true, { ignoreAtRules: ["media", "apply"] }]
  to the rules of your stylelint.config.js by hand.

viterex_addon-3.5.7.zip

Fixed

• stubs/.gitignore.example: vendor/ and .tools/ matched at every
  depth. The unanchored patterns also ignored nested directories such as a
  project-local addon's committed src/addons/<addon>/vendor. They are now
  anchored to the project root (/vendor/, /.tools/). Existing projects
  keep their old lines — "Install stubs" only appends the new ones, so remove
  the unanchored vendor/ / .tools/ entries by hand if they bite.

viterex_addon-3.5.6.zip

Fixed

• stubs/style.css: a glob inside a CSS comment closed it early. The
  commented-out @source "../../fragments/**/*.php"; contains */ (inside
  **/), so the comment ended after /** and left stray tokens in the
  scaffolded stylesheet. The hint now suggests the directory form
  @source "../../fragments";, which Tailwind scans recursively.

viterex_addon-3.5.5.zip

Fixed

• Scaffolded Tailwind @source globs were silently dead. The stub's
  @source "/src/…" paths resolve as absolute filesystem paths and matched
  nothing — Tailwind's default whole-project heuristic scan carried every
  project unnoticed, and also tokenized docs/markdown prose into bogus class
  candidates (spurious tailwind-clamp warnings at build time, e.g.
  clamp-[text,…]). The stub now uses @import "tailwindcss" source(none)
  with stylesheet-relative globs (incl. src/assets/js for Alpine class
  getters), making scanning explicit-only and deterministic.

viterex_addon-3.5.4.zip

Fixed

• Shipped stubs/biome.jsonc broke biome in user projects. Biome's tree-wide config discovery found the stub under src/addons/viterex_addon/stubs/ as a second root config and aborted before checking anything — and since the scaffolded lint script is biome check && stylelint …, stylelint never ran either. The stub now ships as biome.jsonc.stub (invisible to discovery) and is renamed to biome.jsonc at install time. Same treatment for stylelint.config.js, which stylelint's per-file upward config lookup could pick up for stub files.
• Lint/format script globs scoped to the assets source dir. The package.json stub's stylelint/prettier globs were **/* — in a real install they matched core, addon, and vendored files (26k foreign errors in a reported project). They now carry a __VITEREX_ASSETS_SOURCE_DIR__ token replaced with the configured assets_source_dir at scaffold time.

Changed

• Scaffolded biome + stylelint configs understand Tailwind 4 (@theme, @utility, @variant, --value()/--modifier() …), exclude core/addon/vendored/generated paths in both classic and modern layouts, and exclude machine-managed manifests (composer.json, package.json) from the format gate. Known smells in the massif starter libs are downgraded to warnings so they surface without gating.
• Stub vite.config.js and style.css now pass the scaffolded lint gate.

Upgrade note for existing projects: your scaffolded biome.jsonc / stylelint.config.js / package.json are kept as-is; apply the new excludes and scoped globs manually or re-install stubs with overwrite.

viterex_addon-3.5.3.zip

Fixed

Stale host_url (http://localhost) in structure.json after a seeded install (Vite dev server answering with Access-Control-Allow-Origin: http://localhost). The 3.5.2 fix regenerated the file on every cache clear, but Config::getHostUrl() read the domain from rex_yrewrite::getDomains() — static state built at boot from yrewrite's cached config.php. When the database is seeded after that cache was generated (create-viterex: package:install → seed → cache:clear), the CLI cache-clear process still saw zero domains and wrote localhost; only the next cache clear picked up the domain — and a dev server started in between kept the wrong CORS origin until restarted.

getHostUrl() now queries the rex_yrewrite_domain table directly (source of truth, always current), normalizing rows the same way yrewrite does (new pure helper Config::hostUrlFromDomainRows(), unit-tested).

viterex_addon-3.5.2.zip

Fixed

Bogus host_url (http://.) in structure.json (Vite dev server answering with Access-Control-Allow-Origin: http://.). Two defects, both fixed:

• Config::getHostUrl() used rex_yrewrite::getDefaultDomain(), which returns yrewrite's synthetic catch-all (host null), not the configured domain. Its URL is built from $_SERVER, so any CLI context — console commands, an installer running package:install — produced http://.. getHostUrl() now picks the first real yrewrite domain (host set) and only then falls back to $_SERVER.
• structure.json was only written on addon install and on saving the settings page, so yrewrite domains configured afterwards (e.g. an installer seeding the database after package:install) never reached the file. It is now regenerated on every cache clear (CACHE_DELETED extension point, LATE so yrewrite rebuilds its own data first) — a plain bin/console cache:clear or the dev badge's cache-clear button self-heals a stale host_url.

viterex_addon-3.5.1.zip

Fixed

• One-request fatal during addon update (Class "Ynamite\ViteRex\Csp" not found in Badge.php): the old version's badge OUTPUT_FILTER closure lazy-loads the new Badge.php after files are swapped, before the autoloader knows about lib/Csp.php. install.php now eagerly requires Csp so the late-firing closure resolves it. Takes effect for updates to this release and later.

viterex_addon-3.5.0.zip

Added

• CSP nonce support. Every tag ViteRex emits — <script type="module">, <link rel="stylesheet">, and the relevant <link rel="modulepreload"> / <link rel="preload" as="style"> tags, plus the dev badge — now carries the per-request nonce from rex_response::getNonce() (core ≥5.15.0, with a bin2hex(random_bytes(16)) fallback on older cores). A project-defined strict CSP (script-src 'self' 'nonce-…'; style-src 'self' 'nonce-…') now works with ViteRex assets out of the box. Stamping is always-on (a stray nonce is inert without a CSP) and requires no configuration. New Ynamite\ViteRex\Csp helper (nonce(), attr()). ViteRex deliberately does not build or send the CSP header — the policy is page-global and remains the project's responsibility. Dev/HMR remains best-effort (Vite injects its own runtime tags ViteRex cannot reach); production is fully clean.

viterex_addon-3.4.2.zip

Version 3.4.2

• Remove unused imports from boot.php

Full Changelog: 3.4.1...3.4.2