@barocss/server 0.8.2 → 0.10.0

package/README.md

@@ -1,5 +1,7 @@
 # @barocss/server
 
+> **Rendering untrusted class strings (AI output, CMS, users)?** See the [security guide](../../apps/barocss-docs/docs/guide/security.md).
+
 [![npm version](https://img.shields.io/npm/v/@barocss/server.svg)](https://www.npmjs.com/package/@barocss/server)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.0+-blue.svg)](https://www.typescriptlang.org/)
@@ -95,8 +97,8 @@ const config = {
   theme: { extend: {                        // your own theme: literal values, not var(--build-vars)
     colors: { brand: '#2563eb' },
     spacing: { gutter: '1.5rem' },          // named spacing: p-gutter
-    borderRadius: { lg: '0.75rem' },        // override existing keys; new radius/font names go in utilities
-    fontFamily: { sans: ['Inter', 'sans-serif'] },
+    borderRadius: { lg: '0.75rem', card: '1.25rem' }, // override rounded-lg; new keys work too: rounded-card
+    fontFamily: { sans: ['Inter', 'sans-serif'], display: ['Fraunces', 'serif'] }, // font-display
   } },
   utilities: { 'max-w-app': { 'max-width': '48rem', 'margin-inline': 'auto' } }, // static @utility rules; `@utility name-*` unsupported
 };

package/dist/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@barocss/kit");var t=`data-barocss-ssr`,n={amp:`&`,lt:`<`,gt:`>`,quot:`"`,apos:`'`,nbsp:`\xA0`,colon:`:`,sol:`/`,lsqb:`[`,rsqb:`]`,num:`#`,percnt:`%`,lpar:`(`,rpar:`)`,comma:`,`,period:`.`,excl:`!`,tab:`	`,newline:`
-`};function r(e){return e.includes(`&`)?e.replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi,(e,t)=>{if(t[0]===`#`){let n=t[1]===`x`||t[1]===`X`?parseInt(t.slice(2),16):parseInt(t.slice(1),10);return n>0&&n<=1114111?String.fromCodePoint(n):e}return n[t.toLowerCase()]??e}):e}var i=/<[a-zA-Z][^\s/>]*/g,a=/\s+([^\s"'>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?|\s*\//y,o=/\s*>/y;function s(e){let t=e.toLowerCase(),n=/<!--|<(script|style)\b/g,r=``,i=0,a;for(;a=n.exec(t);){r+=e.slice(i,a.index)+` `;let o;if(a[1]){let e=t.indexOf(`</`+a[1],a.index+a[0].length);o=e<0?-1:t.indexOf(`>`,e),o>=0&&(o+=1)}else{let e=t.indexOf(`-->`,a.index+4);o=e<0?-1:e+3}if(o<0)return r;i=n.lastIndex=o}return r+e.slice(i)}function c(e){let t=s(e),n=new Set;for(i.lastIndex=0;i.exec(t);){let e=i.lastIndex,s,c=[];for(a.lastIndex=e;(s=a.exec(t))&&s[0];a.lastIndex=e)e=a.lastIndex,s[1]?.toLowerCase()===`class`&&c.push(s[2]??s[3]??s[4]??``);if(o.lastIndex=e,!o.test(t)){i.lastIndex=e;continue}i.lastIndex=o.lastIndex;for(let e of c)for(let t of r(e).split(/\s+/))t&&n.add(t)}return[...n]}function l(e){return e.replace(/\\([0-9a-fA-F]{1,6})\s?|\\(.)/g,(e,t,n)=>t?String.fromCodePoint(parseInt(t,16)):n)}function u(e){let t=[],n=0,r=0;for(let i=0;i<e.length;i++){let a=e[i];a===`\\`?i++:a===`(`||a===`[`?n++:a===`)`||a===`]`?n--:a===`,`&&n===0&&(t.push(e.slice(r,i)),r=i+1)}return t.push(e.slice(r)),t}var d=/^\s*(?::(?:where|is)\(\s*)?\.((?:\\[0-9a-fA-F]{1,6}\s?|\\.|[\w-]|[^\x00-\x7F])+)/,f=/(^|[\s,(]):(root|host)\b/;function p(e){let t={classes:new Set,vars:new Set,properties:new Set,keyframes:new Set,layerStatement:!1},n=[],r=``,i=e=>{if(n.some(e=>f.test(e)))for(let n of e.matchAll(/(?:^|;)\s*(--[\w-]+)\s*:/g))t.vars.add(n[1])};for(let a=0;a<e.length;a++){let o=e[a];if(o===`/`&&e[a+1]===`*`){let t=e.indexOf(`*/`,a+2);a=t<0?e.length:t+1;continue}if(o===`"`||o===`'`){let t=a+1;for(;t<e.length&&e[t]!==o;)t+=e[t]===`\\`?2:1;r+=e.slice(a,t+1),a=t;continue}if(o===`\\`){r+=e.slice(a,a+2),a++;continue}if(o===`{`){let e=r.lastIndexOf(`;`);e>=0&&i(r.slice(0,e+1));let a=r.slice(e+1).trim();r=``,n.push(a);let o=/^@([\w-]+)\s*([\s\S]*)$/.exec(a);if(o){let e=o[1].toLowerCase();e===`property`?t.properties.add(o[2].trim()):e.endsWith(`keyframes`)&&t.keyframes.add(o[2].trim().replace(/^["']|["']$/g,``))}else if(!a.startsWith(`&`))for(let e of u(a)){let n=d.exec(e);n&&t.classes.add(l(n[1]))}continue}if(o===`}`){i(r),r=``,n.pop();continue}if(o===`;`&&n.length===0){/^\s*@layer\b/.test(r)&&(t.layerStatement=!0),r=``;continue}r+=o}return t}function m(e,n={}){return`<style ${t}${n.nonce?` nonce="${n.nonce.replace(/[&"<>]/g,e=>`&#${e.charCodeAt(0)};`)}"`:``}>${e.replace(/<\/(style)/gi,`<\\/$1`)}</style>`}var h=e=>[...e.matchAll(/var\((--[\w-]+)/g)].map(e=>e[1]),g=class{constructor(e={},t={}){this.classCache=new Map,this.themeDefs=null,this.skipCache=new Map,this.cacheSize=Math.max(0,t.cacheSize??1e4),this.setConfig(e)}setConfig(t){this.context=(0,e.createContext)(t),this.classCache.clear(),this.themeDefs=null}parseClass(t){return(0,e.parseClassToAst)(t,this.context)}generateCss(e){return this.sheet(e.split(/\s+/).filter(Boolean))}generateCssForHtml(e,t={}){let n=typeof e==`string`?c(e):[...new Set(e.flatMap(e=>e.split(/\s+/)).filter(Boolean))],r=t.skip;if(r===void 0)return this.sheet(n);if(typeof r==`string`){let e=this.skipDefs(r);return this.sheet(n.filter(t=>!e.classes.has(t)),e)}let i=r instanceof Set?r:new Set(r);return this.sheet(n.filter(e=>!i.has(e)))}skipDefs(e){let t=this.skipCache.get(e);return t||(this.skipCache.size>=4&&this.skipCache.delete(this.skipCache.keys().next().value),this.skipCache.set(e,t=p(e))),t}sheet(e,t){let n=e.map(e=>this.entryFor(e)),r=this.uniqueRoots(n.flatMap(e=>e.roots));t&&(r=r.filter(({css:e,dedupeKey:n})=>{if(n.startsWith(`--`))return!t.properties.has(n);let r=/^\s*@(?:-[\w]+-)?keyframes\s+([^\s{]+)/.exec(e)?.[1];return!r||!t.keyframes.has(r)}));let i=this.sortRules(n.filter(e=>e.css)),a=[...r.flatMap(e=>e.refs),...i.flatMap(e=>e.refs)],o=this.themeVarsBlock(a,t?.vars);return[...o?[o]:[],...r.map(e=>e.css),...i.map(e=>e.css)].join(`
-`)}entryFor(t){let n=this.classCache.get(t);if(n)return this.classCache.delete(t),this.classCache.set(t,n),n;let r={css:``,key:null,refs:[],roots:[]},i=[];try{i=(0,e.generateCssRules)(t,this.context)}catch(n){(0,e.isDebug)()&&console.warn(`[barocss/server] class generation failed:`,t,n)}for(let{css:e,rootCssList:t}of i){e&&(r.css=e);for(let e of t){if(!e)continue;let t=/^\s*@property\s+(--[\w-]+)/.exec(e)?.[1]??e;r.roots.push({css:e,dedupeKey:t,refs:h(e)})}}return r.css&&(r.key=(0,e.ruleSortKey)(r.css),r.refs=h(r.css)),this.cacheSize>0&&(this.classCache.size>=this.cacheSize&&this.classCache.delete(this.classCache.keys().next().value),this.classCache.set(t,r)),r}generateCssForClasses(e){return e.map(e=>({className:e,css:this.generateCss(e)}))}uniqueRoots(e){let t=new Set;return e.filter(({dedupeKey:e})=>!t.has(e)&&!!t.add(e))}sortRules(t){return t.map((e,t)=>({entry:e,i:t})).sort((t,n)=>(0,e.compareKeys)(t.entry.key,n.entry.key)||t.i-n.i).map(({entry:e})=>e)}themeVarsBlock(e,t){let n=e;if(n.length===0)return``;let r=this.themeDefs;if(!r){r=this.themeDefs=new Map;for(let e of this.context.themeToCssVars().matchAll(/^\s*(--[\w-]+):\s*(.+);$/gm))r.set(e[1],e[2])}let i=new Map;for(;n.length;){let e=n.pop(),a=r.get(e);a===void 0||i.has(e)||t?.has(e)||(i.set(e,a),n.push(...h(a)))}return i.size===0?``:`:root,:host {
+`};function r(e){return e.includes(`&`)?e.replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi,(e,t)=>{if(t[0]===`#`){let n=t[1]===`x`||t[1]===`X`?parseInt(t.slice(2),16):parseInt(t.slice(1),10);return n>0&&n<=1114111?String.fromCodePoint(n):e}return n[t.toLowerCase()]??e}):e}var i=/[ \t\n\f\r]+/,a=/<[a-zA-Z][^\s/>]*/g,o=/\s+([^\s"'>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?|\s*\//y,s=/\s*>/y;function c(e){let t=e.toLowerCase(),n=/<!--|<(script|style)\b/g,r=``,i=0,a;for(;a=n.exec(t);){r+=e.slice(i,a.index)+` `;let o;if(a[1]){let e=t.indexOf(`</`+a[1],a.index+a[0].length);o=e<0?-1:t.indexOf(`>`,e),o>=0&&(o+=1)}else{let e=t.indexOf(`-->`,a.index+4);o=e<0?-1:e+3}if(o<0)return r;i=n.lastIndex=o}return r+e.slice(i)}function l(e){let t=c(e),n=new Set;for(a.lastIndex=0;a.exec(t);){let e=a.lastIndex,c,l=[];for(o.lastIndex=e;(c=o.exec(t))&&c[0];o.lastIndex=e)e=o.lastIndex,c[1]?.toLowerCase()===`class`&&l.push(c[2]??c[3]??c[4]??``);if(s.lastIndex=e,!s.test(t)){a.lastIndex=e;continue}a.lastIndex=s.lastIndex;for(let e of l)for(let t of r(e).split(i))t&&n.add(t)}return[...n]}function u(e){return e.replace(/\\([0-9a-fA-F]{1,6})\s?|\\(.)/g,(e,t,n)=>t?String.fromCodePoint(parseInt(t,16)):n)}function d(e){let t=[],n=0,r=0;for(let i=0;i<e.length;i++){let a=e[i];a===`\\`?i++:a===`(`||a===`[`?n++:a===`)`||a===`]`?n--:a===`,`&&n===0&&(t.push(e.slice(r,i)),r=i+1)}return t.push(e.slice(r)),t}var f=/^\s*(?::(?:where|is)\(\s*)?\.((?:\\[0-9a-fA-F]{1,6}\s?|\\.|[\w-]|[^\x00-\x7F])+)/,p=/(^|[\s,(]):(root|host)\b/;function m(e){let t={classes:new Set,vars:new Set,properties:new Set,keyframes:new Set,layerStatement:!1},n=[],r=``,i=e=>{if(n.some(e=>p.test(e)))for(let n of e.matchAll(/(?:^|;)\s*(--[\w-]+)\s*:/g))t.vars.add(n[1])};for(let a=0;a<e.length;a++){let o=e[a];if(o===`/`&&e[a+1]===`*`){let t=e.indexOf(`*/`,a+2);a=t<0?e.length:t+1;continue}if(o===`"`||o===`'`){let t=a+1;for(;t<e.length&&e[t]!==o;)t+=e[t]===`\\`?2:1;r+=e.slice(a,t+1),a=t;continue}if(o===`\\`){r+=e.slice(a,a+2),a++;continue}if(o===`{`){let e=r.lastIndexOf(`;`);e>=0&&i(r.slice(0,e+1));let a=r.slice(e+1).trim();r=``,n.push(a);let o=/^@([\w-]+)\s*([\s\S]*)$/.exec(a);if(o){let e=o[1].toLowerCase();e===`property`?t.properties.add(o[2].trim()):e.endsWith(`keyframes`)&&t.keyframes.add(o[2].trim().replace(/^["']|["']$/g,``))}else if(!a.startsWith(`&`))for(let e of d(a)){let n=f.exec(e);n&&t.classes.add(u(n[1]))}continue}if(o===`}`){i(r),r=``,n.pop();continue}if(o===`;`&&n.length===0){/^\s*@layer\b/.test(r)&&(t.layerStatement=!0),r=``;continue}r+=o}return t}function h(e,n={}){return`<style ${t}${n.nonce?` nonce="${n.nonce.replace(/[&"<>]/g,e=>`&#${e.charCodeAt(0)};`)}"`:``}>${e.replace(/<\/(style)/gi,`<\\/$1`)}</style>`}var g=e=>[...e.matchAll(/var\((--[\w-]+)/g)].map(e=>e[1]),_=class{constructor(e={},t={}){this.classCache=new Map,this.themeDefs=null,this.skipCache=new Map,this.cacheSize=Math.max(0,t.cacheSize??1e4),this.setConfig(e)}setConfig(t){this.context=(0,e.createContext)(t),this.classCache.clear(),this.themeDefs=null}parseClass(t){return(0,e.parseClassToAst)(t,this.context)}generateCss(e){return this.sheet(e.split(i).filter(Boolean))}generateCssForHtml(e,t={}){let n=typeof e==`string`?l(e):[...new Set(e.flatMap(e=>e.split(i)).filter(Boolean))],r=t.skip;if(r===void 0)return this.sheet(n);if(typeof r==`string`){let e=this.skipDefs(r);return this.sheet(n.filter(t=>!e.classes.has(t)),e)}let a=r instanceof Set?r:new Set(r);return this.sheet(n.filter(e=>!a.has(e)))}skipDefs(e){let t=this.skipCache.get(e);return t||(this.skipCache.size>=4&&this.skipCache.delete(this.skipCache.keys().next().value),this.skipCache.set(e,t=m(e))),t}sheet(e,t){let n=e.map(e=>this.entryFor(e)),r=this.uniqueRoots(n.flatMap(e=>e.roots));t&&(r=r.filter(({css:e,dedupeKey:n})=>{if(n.startsWith(`--`))return!t.properties.has(n);let r=/^\s*@(?:-[\w]+-)?keyframes\s+([^\s{]+)/.exec(e)?.[1];return!r||!t.keyframes.has(r)}));let i=this.sortRules(n.filter(e=>e.css)),a=[...r.flatMap(e=>e.refs),...i.flatMap(e=>e.refs)],o=this.themeVarsBlock(a,t?.vars);return[...o?[o]:[],...r.map(e=>e.css),...i.map(e=>e.css)].join(`
+`)}entryFor(t){let n=this.classCache.get(t);if(n)return this.classCache.delete(t),this.classCache.set(t,n),n;let r={css:``,key:null,refs:[],roots:[]},i=[];try{i=(0,e.generateCssRules)(t,this.context)}catch(n){(0,e.isDebug)()&&console.warn(`[barocss/server] class generation failed:`,t,n)}for(let{css:e,rootCssList:t}of i){e&&(r.css=e);for(let e of t){if(!e)continue;let t=/^\s*@property\s+(--[\w-]+)/.exec(e)?.[1]??e;r.roots.push({css:e,dedupeKey:t,refs:g(e)})}}return r.css&&(r.key=(0,e.ruleSortKey)(r.css),r.refs=g(r.css)),this.cacheSize>0&&(this.classCache.size>=this.cacheSize&&this.classCache.delete(this.classCache.keys().next().value),this.classCache.set(t,r)),r}generateCssForClasses(e){return e.map(e=>({className:e,css:this.generateCss(e)}))}uniqueRoots(e){let t=new Set;return e.filter(({dedupeKey:e})=>!t.has(e)&&!!t.add(e))}sortRules(t){return t.map((e,t)=>({entry:e,i:t})).sort((t,n)=>(0,e.compareKeys)(t.entry.key,n.entry.key)||t.i-n.i).map(({entry:e})=>e)}themeVarsBlock(e,t){let n=e;if(n.length===0)return``;let r=this.themeDefs;if(!r){r=this.themeDefs=new Map;for(let e of this.context.themeToCssVars().matchAll(/^\s*(--[\w-]+):\s*(.+);$/gm))r.set(e[1],e[2])}let i=new Map;for(;n.length;){let e=n.pop(),a=r.get(e);a===void 0||i.has(e)||t?.has(e)||(i.set(e,a),n.push(...g(a)))}return i.size===0?``:`:root,:host {
 `+[...i].map(([e,t])=>`  ${e}: ${t};`).join(`
 `)+`
-}`}};exports.SSR_STYLE_ATTRIBUTE=t,exports.ServerRuntime=g,exports.ssrStyleTag=m;
+}`}};exports.SSR_STYLE_ATTRIBUTE=t,exports.ServerRuntime=_,exports.ssrStyleTag=h;

package/dist/index.d.cts

@@ -40,7 +40,8 @@ export declare class ServerRuntime {
      * page's build CSS already provides. `htmlOrClasses` is HTML (classes are read from `class`
      * attributes; `<script>`/`<style>` contents and comments ignored) or a class list. Stateless per
      * call: it returns this request's delta, never classes emitted for earlier requests. Wrap the result
-     * with `ssrStyleTag()` so `@barocss/browser` adopts it.
+     * with `ssrStyleTag()` so `@barocss/browser` adopts it; under a strict CSP pass the response nonce,
+     * `ssrStyleTag(css, { nonce })` (#347), and give the browser runtime the same `nonce`.
      */
     generateCssForHtml(htmlOrClasses: string | string[], opts?: GenerateCssForHtmlOptions): string;
     /** Parsed build CSS, memoised by text (a server passes the same build CSS on every request). */

package/dist/index.d.ts

@@ -40,7 +40,8 @@ export declare class ServerRuntime {
      * page's build CSS already provides. `htmlOrClasses` is HTML (classes are read from `class`
      * attributes; `<script>`/`<style>` contents and comments ignored) or a class list. Stateless per
      * call: it returns this request's delta, never classes emitted for earlier requests. Wrap the result
-     * with `ssrStyleTag()` so `@barocss/browser` adopts it.
+     * with `ssrStyleTag()` so `@barocss/browser` adopts it; under a strict CSP pass the response nonce,
+     * `ssrStyleTag(css, { nonce })` (#347), and give the browser runtime the same `nonce`.
      */
     generateCssForHtml(htmlOrClasses: string | string[], opts?: GenerateCssForHtmlOptions): string;
     /** Parsed build CSS, memoised by text (a server passes the same build CSS on every request). */

package/dist/index.es.js

@@ -30,8 +30,8 @@ function c(e) {
 		return s[t.toLowerCase()] ?? e;
 	}) : e;
 }
-var l = /<[a-zA-Z][^\s/>]*/g, u = /\s+([^\s"'>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?|\s*\//y, d = /\s*>/y;
-function f(e) {
+var l = /[ \t\n\f\r]+/, u = /<[a-zA-Z][^\s/>]*/g, d = /\s+([^\s"'>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?|\s*\//y, f = /\s*>/y;
+function p(e) {
 	let t = e.toLowerCase(), n = /<!--|<(script|style)\b/g, r = "", i = 0, a;
 	for (; a = n.exec(t);) {
 		r += e.slice(i, a.index) + " ";
@@ -48,24 +48,24 @@ function f(e) {
 	}
 	return r + e.slice(i);
 }
-function p(e) {
-	let t = f(e), n = /* @__PURE__ */ new Set();
-	for (l.lastIndex = 0; l.exec(t);) {
-		let e = l.lastIndex, r, i = [];
-		for (u.lastIndex = e; (r = u.exec(t)) && r[0]; u.lastIndex = e) e = u.lastIndex, r[1]?.toLowerCase() === "class" && i.push(r[2] ?? r[3] ?? r[4] ?? "");
-		if (d.lastIndex = e, !d.test(t)) {
-			l.lastIndex = e;
+function m(e) {
+	let t = p(e), n = /* @__PURE__ */ new Set();
+	for (u.lastIndex = 0; u.exec(t);) {
+		let e = u.lastIndex, r, i = [];
+		for (d.lastIndex = e; (r = d.exec(t)) && r[0]; d.lastIndex = e) e = d.lastIndex, r[1]?.toLowerCase() === "class" && i.push(r[2] ?? r[3] ?? r[4] ?? "");
+		if (f.lastIndex = e, !f.test(t)) {
+			u.lastIndex = e;
 			continue;
 		}
-		l.lastIndex = d.lastIndex;
-		for (let e of i) for (let t of c(e).split(/\s+/)) t && n.add(t);
+		u.lastIndex = f.lastIndex;
+		for (let e of i) for (let t of c(e).split(l)) t && n.add(t);
 	}
 	return [...n];
 }
-function m(e) {
+function h(e) {
 	return e.replace(/\\([0-9a-fA-F]{1,6})\s?|\\(.)/g, (e, t, n) => t ? String.fromCodePoint(parseInt(t, 16)) : n);
 }
-function h(e) {
+function g(e) {
 	let t = [], n = 0, r = 0;
 	for (let i = 0; i < e.length; i++) {
 		let a = e[i];
@@ -73,8 +73,8 @@ function h(e) {
 	}
 	return t.push(e.slice(r)), t;
 }
-var g = /^\s*(?::(?:where|is)\(\s*)?\.((?:\\[0-9a-fA-F]{1,6}\s?|\\.|[\w-]|[^\x00-\x7F])+)/, _ = /(^|[\s,(]):(root|host)\b/;
-function v(e) {
+var _ = /^\s*(?::(?:where|is)\(\s*)?\.((?:\\[0-9a-fA-F]{1,6}\s?|\\.|[\w-]|[^\x00-\x7F])+)/, v = /(^|[\s,(]):(root|host)\b/;
+function y(e) {
 	let t = {
 		classes: /* @__PURE__ */ new Set(),
 		vars: /* @__PURE__ */ new Set(),
@@ -82,7 +82,7 @@ function v(e) {
 		keyframes: /* @__PURE__ */ new Set(),
 		layerStatement: !1
 	}, n = [], r = "", i = (e) => {
-		if (n.some((e) => _.test(e))) for (let n of e.matchAll(/(?:^|;)\s*(--[\w-]+)\s*:/g)) t.vars.add(n[1]);
+		if (n.some((e) => v.test(e))) for (let n of e.matchAll(/(?:^|;)\s*(--[\w-]+)\s*:/g)) t.vars.add(n[1]);
 	};
 	for (let a = 0; a < e.length; a++) {
 		let o = e[a];
@@ -110,9 +110,9 @@ function v(e) {
 			if (o) {
 				let e = o[1].toLowerCase();
 				e === "property" ? t.properties.add(o[2].trim()) : e.endsWith("keyframes") && t.keyframes.add(o[2].trim().replace(/^["']|["']$/g, ""));
-			} else if (!a.startsWith("&")) for (let e of h(a)) {
-				let n = g.exec(e);
-				n && t.classes.add(m(n[1]));
+			} else if (!a.startsWith("&")) for (let e of g(a)) {
+				let n = _.exec(e);
+				n && t.classes.add(h(n[1]));
 			}
 			continue;
 		}
@@ -128,12 +128,12 @@ function v(e) {
 	}
 	return t;
 }
-function y(e, t = {}) {
+function b(e, t = {}) {
 	return `<style ${o}${t.nonce ? ` nonce="${t.nonce.replace(/[&"<>]/g, (e) => `&#${e.charCodeAt(0)};`)}"` : ""}>${e.replace(/<\/(style)/gi, "<\\/$1")}</style>`;
 }
 //#endregion
 //#region src/index.ts
-var b = (e) => [...e.matchAll(/var\((--[\w-]+)/g)].map((e) => e[1]), x = class {
+var x = (e) => [...e.matchAll(/var\((--[\w-]+)/g)].map((e) => e[1]), S = class {
 	constructor(e = {}, t = {}) {
 		this.classCache = /* @__PURE__ */ new Map(), this.themeDefs = null, this.skipCache = /* @__PURE__ */ new Map(), this.cacheSize = Math.max(0, t.cacheSize ?? 1e4), this.setConfig(e);
 	}
@@ -144,10 +144,10 @@ var b = (e) => [...e.matchAll(/var\((--[\w-]+)/g)].map((e) => e[1]), x = class {
 		return i(e, this.context);
 	}
 	generateCss(e) {
-		return this.sheet(e.split(/\s+/).filter(Boolean));
+		return this.sheet(e.split(l).filter(Boolean));
 	}
 	generateCssForHtml(e, t = {}) {
-		let n = typeof e == "string" ? p(e) : [...new Set(e.flatMap((e) => e.split(/\s+/)).filter(Boolean))], r = t.skip;
+		let n = typeof e == "string" ? m(e) : [...new Set(e.flatMap((e) => e.split(l)).filter(Boolean))], r = t.skip;
 		if (r === void 0) return this.sheet(n);
 		if (typeof r == "string") {
 			let e = this.skipDefs(r);
@@ -158,7 +158,7 @@ var b = (e) => [...e.matchAll(/var\((--[\w-]+)/g)].map((e) => e[1]), x = class {
 	}
 	skipDefs(e) {
 		let t = this.skipCache.get(e);
-		return t || (this.skipCache.size >= 4 && this.skipCache.delete(this.skipCache.keys().next().value), this.skipCache.set(e, t = v(e))), t;
+		return t || (this.skipCache.size >= 4 && this.skipCache.delete(this.skipCache.keys().next().value), this.skipCache.set(e, t = y(e))), t;
 	}
 	sheet(e, t) {
 		let n = e.map((e) => this.entryFor(e)), r = this.uniqueRoots(n.flatMap((e) => e.roots));
@@ -196,11 +196,11 @@ var b = (e) => [...e.matchAll(/var\((--[\w-]+)/g)].map((e) => e[1]), x = class {
 				i.roots.push({
 					css: e,
 					dedupeKey: t,
-					refs: b(e)
+					refs: x(e)
 				});
 			}
 		}
-		return i.css && (i.key = a(i.css), i.refs = b(i.css)), this.cacheSize > 0 && (this.classCache.size >= this.cacheSize && this.classCache.delete(this.classCache.keys().next().value), this.classCache.set(e, i)), i;
+		return i.css && (i.key = a(i.css), i.refs = x(i.css)), this.cacheSize > 0 && (this.classCache.size >= this.cacheSize && this.classCache.delete(this.classCache.keys().next().value), this.classCache.set(e, i)), i;
 	}
 	generateCssForClasses(e) {
 		return e.map((e) => ({
@@ -229,10 +229,10 @@ var b = (e) => [...e.matchAll(/var\((--[\w-]+)/g)].map((e) => e[1]), x = class {
 		let i = /* @__PURE__ */ new Map();
 		for (; n.length;) {
 			let e = n.pop(), a = r.get(e);
-			a === void 0 || i.has(e) || t?.has(e) || (i.set(e, a), n.push(...b(a)));
+			a === void 0 || i.has(e) || t?.has(e) || (i.set(e, a), n.push(...x(a)));
 		}
 		return i.size === 0 ? "" : ":root,:host {\n" + [...i].map(([e, t]) => `  ${e}: ${t};`).join("\n") + "\n}";
 	}
 };
 //#endregion
-export { o as SSR_STYLE_ATTRIBUTE, x as ServerRuntime, y as ssrStyleTag };
+export { o as SSR_STYLE_ATTRIBUTE, S as ServerRuntime, b as ssrStyleTag };

package/dist/ssr.d.cts

@@ -7,6 +7,7 @@
 export declare const SSR_STYLE_ATTRIBUTE = "data-barocss-ssr";
 /** Decode the HTML character references an attribute value may contain. */
 export declare function decodeHtmlEntities(s: string): string;
+export declare const CLASS_SEPARATOR: RegExp;
 /**
  * Class names from every `class` attribute in `html`, first-seen order, deduplicated. Handles double,
  * single and unquoted values, any whitespace and character references; ignores comments and the

package/dist/ssr.d.ts

@@ -7,6 +7,7 @@
 export declare const SSR_STYLE_ATTRIBUTE = "data-barocss-ssr";
 /** Decode the HTML character references an attribute value may contain. */
 export declare function decodeHtmlEntities(s: string): string;
+export declare const CLASS_SEPARATOR: RegExp;
 /**
  * Class names from every `class` attribute in `html`, first-seen order, deduplicated. Handles double,
  * single and unquoted values, any whitespace and character references; ignores comments and the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@barocss/server",
-  "version": "0.8.2",
+  "version": "0.10.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/barocss/barocss.git",
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "jsdom": "^26.1.0",
-    "@barocss/kit": "0.8.2"
+    "@barocss/kit": "0.10.0"
   },
   "devDependencies": {
     "vite": "^8.3.1",