Fix code quality violations and exclude Manifest from checks

Document application modes (development/debug/production)
Add global file drop handler, order column normalization, SPA hash fix
Serve CDN assets via /_vendor/ URLs instead of merging into bundles
Add production minification with license preservation
Improve JSON formatting for debugging and production optimization
Add CDN asset caching with CSS URL inlining for production builds
Add three-mode system (development, debug, production)
Update Manifest CLAUDE.md to reflect helper class architecture
Refactor Manifest.php into helper classes for better organization
Pre-manifest-refactor checkpoint: Add app_mode documentation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

node_modules/postcss-normalize-url/src/index.js

@@ -1,7 +1,7 @@
 'use strict';
 const path = require('path');
 const valueParser = require('postcss-value-parser');
-const normalize = require('normalize-url');
+const normalize = require('./normalize.js');
 
 const multiline = /\\[\r\n]/;
 // eslint-disable-next-line no-useless-escape
@@ -27,16 +27,15 @@ function isAbsolute(url) {
 
 /**
  * @param {string} url
- * @param {normalize.Options} options
  * @return {string}
  */
-function convert(url, options) {
+function convert(url) {
   if (isAbsolute(url) || url.startsWith('//')) {
     let normalizedURL;
 
     try {
-      normalizedURL = normalize(url, options);
-    } catch (e) {
+      normalizedURL = normalize(url);
+    } catch {
       normalizedURL = url;
     }
 
@@ -74,10 +73,9 @@ function transformNamespace(rule) {
 
 /**
  * @param {import('postcss').Declaration} decl
- * @param {normalize.Options} opts
  * @return {void}
  */
-function transformDecl(decl, opts) {
+function transformDecl(decl) {
   decl.value = valueParser(decl.value)
     .walk((node) => {
       if (node.type !== 'function' || node.value.toLowerCase() !== 'url') {
@@ -107,7 +105,7 @@ function transformDecl(decl, opts) {
       }
 
       if (!/^.+-extension:\//i.test(url.value)) {
-        url.value = convert(url.value, opts);
+        url.value = convert(url.value);
       }
 
       if (escapeChars.test(url.value) && url.type === 'string') {
@@ -126,32 +124,18 @@ function transformDecl(decl, opts) {
     .toString();
 }
 
-/** @typedef {normalize.Options} Options */
 /**
- * @type {import('postcss').PluginCreator<Options>}
- * @param {Options} opts
+ * @type {import('postcss').PluginCreator<void>}
  * @return {import('postcss').Plugin}
  */
-function pluginCreator(opts) {
-  opts = Object.assign(
-    {},
-    {
-      normalizeProtocol: false,
-      sortQueryParameters: false,
-      stripHash: false,
-      stripWWW: false,
-      stripTextFragment: false,
-    },
-    opts
-  );
-
+function pluginCreator() {
   return {
     postcssPlugin: 'postcss-normalize-url',
 
     OnceExit(css) {
       css.walk((node) => {
         if (node.type === 'decl') {
-          return transformDecl(node, opts);
+          return transformDecl(node);
         } else if (
           node.type === 'atrule' &&
           node.name.toLowerCase() === 'namespace'

node_modules/postcss-normalize-url/src/normalize.js

@@ -0,0 +1,153 @@
+'use strict';
+/* Derived from normalize-url https://github.com/sindresorhus/normalize-url/main/index.js by Sindre Sorhus */
+
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URIs
+const DATA_URL_DEFAULT_MIME_TYPE = 'text/plain';
+const DATA_URL_DEFAULT_CHARSET = 'us-ascii';
+
+const supportedProtocols = new Set(['https:', 'http:', 'file:']);
+
+/**
+ * @param {string} urlString
+ * @return {boolean} */
+function hasCustomProtocol(urlString) {
+  try {
+    const { protocol } = new URL(urlString);
+    return protocol.endsWith(':') && !supportedProtocols.has(protocol);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {string} urlString
+ * @return {string} */
+function normalizeDataURL(urlString) {
+  const match = /^data:(?<type>[^,]*?),(?<data>[^#]*?)(?:#(?<hash>.*))?$/.exec(
+    urlString
+  );
+
+  if (!match) {
+    throw new Error(`Invalid URL: ${urlString}`);
+  }
+
+  let { type, data, hash } =
+    /** @type {{type: string, data: string, hash: string}} */ (match.groups);
+  const mediaType = type.split(';');
+
+  let isBase64 = false;
+  if (mediaType[mediaType.length - 1] === 'base64') {
+    mediaType.pop();
+    isBase64 = true;
+  }
+
+  // Lowercase MIME type
+  const mimeType = mediaType.shift()?.toLowerCase() ?? '';
+  const attributes = mediaType
+    .map(
+      /** @type {(string: string) => string} */ (attribute) => {
+        let [key, value = ''] = attribute
+          .split('=')
+          .map(
+            /** @type {(string: string) => string} */ (string) => string.trim()
+          );
+
+        // Lowercase `charset`
+        if (key === 'charset') {
+          value = value.toLowerCase();
+
+          if (value === DATA_URL_DEFAULT_CHARSET) {
+            return '';
+          }
+        }
+
+        return `${key}${value ? `=${value}` : ''}`;
+      }
+    )
+    .filter(Boolean);
+
+  const normalizedMediaType = [...attributes];
+
+  if (isBase64) {
+    normalizedMediaType.push('base64');
+  }
+
+  if (
+    normalizedMediaType.length > 0 ||
+    (mimeType && mimeType !== DATA_URL_DEFAULT_MIME_TYPE)
+  ) {
+    normalizedMediaType.unshift(mimeType);
+  }
+
+  return `data:${normalizedMediaType.join(';')},${
+    isBase64 ? data.trim() : data
+  }${hash ? `#${hash}` : ''}`;
+}
+
+/**
+ * @param {string} urlString
+ * @return {string}
+ */
+function normalizeUrl(urlString) {
+  urlString = urlString.trim();
+
+  // Data URL
+  if (/^data:/i.test(urlString)) {
+    return normalizeDataURL(urlString);
+  }
+
+  if (hasCustomProtocol(urlString)) {
+    return urlString;
+  }
+
+  const hasRelativeProtocol = urlString.startsWith('//');
+  const isRelativeUrl = !hasRelativeProtocol && /^\.*\//.test(urlString);
+
+  // Prepend protocol
+  if (!isRelativeUrl) {
+    urlString = urlString.replace(/^(?!(?:\w+:)?\/\/)|^\/\//, 'http:');
+  }
+
+  const urlObject = new URL(urlString);
+
+  // Remove duplicate slashes if not preceded by a protocol
+  if (urlObject.pathname) {
+    urlObject.pathname = urlObject.pathname.replace(
+      /(?<!\b[a-z][a-z\d+\-.]{1,50}:)\/{2,}/g,
+      '/'
+    );
+  }
+
+  // Decode URI octets
+  if (urlObject.pathname) {
+    try {
+      urlObject.pathname = decodeURI(urlObject.pathname);
+    } catch {
+      /* Do nothing */
+    }
+  }
+
+  if (urlObject.hostname) {
+    // Remove trailing dot
+    urlObject.hostname = urlObject.hostname.replace(/\.$/, '');
+  }
+
+  urlObject.pathname = urlObject.pathname.replace(/\/$/, '');
+
+  // Take advantage of many of the Node `url` normalizations
+  urlString = urlObject.toString();
+
+  // Remove ending `/`
+  if (urlObject.pathname === '/' && urlObject.hash === '') {
+    urlString = urlString.replace(/\/$/, '');
+  }
+
+  // Restore relative protocol
+  if (hasRelativeProtocol) {
+    urlString = urlString.replace(/^http:\/\//, '//');
+  }
+
+  return urlString;
+}
+
+module.exports = normalizeUrl;