@csszyx/unplugin 0.14.5 → 0.15.1

package/dist/shared/{unplugin.RGzhYt-D.cjs → unplugin.8KYddE6x.cjs}

@@ -13,10 +13,10 @@ const svelteAdapter = require('@csszyx/svelte-adapter');
 const types = require('@csszyx/types');
 const vueAdapter = require('@csszyx/vue-adapter');
 const unplugin$1 = require('unplugin');
-const transformCache = require('./unplugin.VtXstzEh.cjs');
+const safelistSource = require('./unplugin.DDSWQJYX.cjs');
+const transformCache = require('./unplugin.BzF0V2kw.cjs');
 const cssMangler = require('../css-mangler.cjs');
-const themeGroupsFile = require('./unplugin.D8BxOOkA.cjs');
-const htmlEscape = require('./unplugin.BkRah5Ot.cjs');
+const themeGroupsFile = require('./unplugin.J6ue_lRJ.cjs');
 const node_zlib = require('node:zlib');
 const postcss = require('postcss');
 const valueParser = require('postcss-value-parser');
@@ -37,7 +37,9 @@ function _interopNamespaceCompat(e) {
 }
 
 const fs__namespace = /*#__PURE__*/_interopNamespaceCompat(fs);
+const fs__default = /*#__PURE__*/_interopDefaultCompat(fs);
 const path__namespace = /*#__PURE__*/_interopNamespaceCompat(path);
+const path__default = /*#__PURE__*/_interopDefaultCompat(path);
 const postcss__default = /*#__PURE__*/_interopDefaultCompat(postcss);
 const valueParser__default = /*#__PURE__*/_interopDefaultCompat(valueParser);
 
@@ -168,7 +170,7 @@ function scanGlobalVarCss(css, options = {}) {
     filePath,
     definitions,
     references,
-    registered: htmlEscape.sortStrings(registered),
+    registered: safelistSource.sortStrings(registered),
     thirdParty: isThirdPartyCssPath(filePath)
   };
 }
@@ -187,7 +189,7 @@ function extractVarReferences(value) {
   for (const match of value.matchAll(VAR_REFERENCE_RE)) {
     references.add(match[1]);
   }
-  return htmlEscape.sortStrings(references);
+  return safelistSource.sortStrings(references);
 }
 function isThirdPartyCssPath(filePath) {
   return filePath.split(/[\\/]/).includes("node_modules");
@@ -228,7 +230,7 @@ function planGlobalVarAliases(input) {
     entries.push({
       original,
       alias,
-      scopes: htmlEscape.sortStrings(
+      scopes: safelistSource.sortStrings(
         new Set((definitions.get(original) ?? []).map((definition) => definition.scopeId))
       )
     });
@@ -263,7 +265,7 @@ function collectCandidates(input, definitions) {
       }
     }
   }
-  return htmlEscape.sortStrings(candidates);
+  return safelistSource.sortStrings(candidates);
 }
 function validateCandidates(candidates, definitions, reserved, aliasPrefix) {
   const diagnostics = [];
@@ -541,8 +543,8 @@ function createRSCModuleRecord(code, id) {
 }
 function deleteRSCModuleRecord(records, id) {
   const normalized = normalizeModuleId(id);
-  const clean = transformCache.normalizePathSeparators(id.split("?")[0] ?? id);
-  const resolved = transformCache.normalizePathSeparators(path__namespace.resolve(clean));
+  const clean = safelistSource.normalizePathSeparators(id.split("?")[0] ?? id);
+  const resolved = safelistSource.normalizePathSeparators(path__namespace.resolve(clean));
   pruneRSCModulePathCaches(/* @__PURE__ */ new Set([normalized, resolved, clean]));
   let deleted = records.delete(normalized);
   if (resolved !== normalized) {
@@ -588,7 +590,7 @@ const APP_ROUTER_ENTRIES = /* @__PURE__ */ new Set([
   "route"
 ]);
 function isNextAppRouterEntry(id) {
-  const clean = transformCache.normalizePathSeparators(id.split("?")[0] ?? id);
+  const clean = safelistSource.normalizePathSeparators(id.split("?")[0] ?? id);
   if (!clean.includes("/app/") && !clean.startsWith("app/")) return false;
   const basename = clean.split("/").pop() ?? "";
   const dotIdx = basename.indexOf(".");
@@ -943,9 +945,9 @@ function normalizeModuleId(id) {
   }
   let normalized;
   try {
-    normalized = transformCache.normalizePathSeparators(fs__namespace.realpathSync.native(clean));
+    normalized = safelistSource.normalizePathSeparators(fs__namespace.realpathSync.native(clean));
   } catch {
-    normalized = transformCache.normalizePathSeparators(path__namespace.resolve(clean));
+    normalized = safelistSource.normalizePathSeparators(path__namespace.resolve(clean));
   }
   normalizedModuleIdCache.set(clean, normalized);
   return normalized;
@@ -991,7 +993,7 @@ function resolveLocalModule(importer, source) {
 }
 function pruneRSCModulePathCaches(moduleIds) {
   for (const [key, value] of normalizedModuleIdCache) {
-    const normalizedKey = transformCache.normalizePathSeparators(key);
+    const normalizedKey = safelistSource.normalizePathSeparators(key);
     if (moduleIds.has(value) || moduleIds.has(normalizedKey)) {
       normalizedModuleIdCache.delete(key);
     }
@@ -1619,10 +1621,10 @@ An unread option is silent, so whatever you configured it for is not happening.`
 const GLOB_MAGIC_RE = /[*?[\]{}]/;
 const DEFAULT_IGNORED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".turbo", "dist", "build"]);
 function normalizeFileId(id) {
-  return transformCache.normalizePathSeparators(id.split(/[?#]/, 1)[0]);
+  return safelistSource.normalizePathSeparators(id.split(/[?#]/, 1)[0]);
 }
 function normalizeRoot(rootDir) {
-  return transformCache.normalizePathSeparators(path__namespace.resolve(rootDir));
+  return safelistSource.normalizePathSeparators(path__namespace.resolve(rootDir));
 }
 function hasGlobMagic(pattern) {
   return GLOB_MAGIC_RE.test(pattern);
@@ -1631,7 +1633,7 @@ function escapeRegExp(ch) {
   return /[|\\{}()[\]^$+?.]/.test(ch) ? `\\${ch}` : ch;
 }
 function globToRegExp(pattern) {
-  const normalized = transformCache.normalizePathSeparators(pattern);
+  const normalized = safelistSource.normalizePathSeparators(pattern);
   let out = "^";
   for (let i = 0; i < normalized.length; i++) {
     const ch = normalized[i];
@@ -1654,7 +1656,7 @@ function globToRegExp(pattern) {
 function relativeToRoot(file, rootDir) {
   const root = normalizeRoot(rootDir);
   const normalizedFile = normalizeFileId(file);
-  return transformCache.normalizePathSeparators(path__namespace.posix.relative(root, normalizedFile));
+  return safelistSource.normalizePathSeparators(path__namespace.posix.relative(root, normalizedFile));
 }
 function matchesPattern(id, pattern, rootDir) {
   const file = normalizeFileId(id);
@@ -1663,7 +1665,7 @@ function matchesPattern(id, pattern, rootDir) {
     pattern.lastIndex = 0;
     return pattern.test(file) || pattern.test(relative);
   }
-  const normalizedPattern = transformCache.normalizePathSeparators(pattern);
+  const normalizedPattern = safelistSource.normalizePathSeparators(pattern);
   if (hasGlobMagic(normalizedPattern)) {
     const re = globToRegExp(normalizedPattern);
     return re.test(file) || re.test(relative);
@@ -1727,18 +1729,36 @@ function expandFilePatterns(rootDir, patterns) {
       }
     }
   }
-  return htmlEscape.sortStrings(files);
+  return safelistSource.sortStrings(files);
+}
+
+const BACKSLASH = String.fromCodePoint(92);
+function unicodeEscape(hexadecimal) {
+  return `${BACKSLASH}u${hexadecimal}`;
+}
+function replaceEveryLiteral(value, search, replacement) {
+  return value.replaceAll(search, () => replacement);
+}
+function escapeSingleQuotedString(value) {
+  let escaped = replaceEveryLiteral(value, BACKSLASH, BACKSLASH.repeat(2));
+  escaped = replaceEveryLiteral(escaped, "'", `${BACKSLASH}'`);
+  escaped = replaceEveryLiteral(escaped, "\r", `${BACKSLASH}r`);
+  return replaceEveryLiteral(escaped, "\n", `${BACKSLASH}n`);
+}
+function escapeDoubleQuotedString(value) {
+  const escaped = replaceEveryLiteral(value, BACKSLASH, BACKSLASH.repeat(2));
+  return replaceEveryLiteral(escaped, '"', `${BACKSLASH}"`);
 }
 
 const LINE_SEPARATOR$1 = String.fromCodePoint(8232);
 const PARAGRAPH_SEPARATOR$1 = String.fromCodePoint(8233);
 function safeJsonForScriptTag(value, prettyPrint = false) {
   const json = prettyPrint ? JSON.stringify(value, null, 2) : JSON.stringify(value);
-  let escaped = htmlEscape.replaceEveryLiteral(json, "<", htmlEscape.unicodeEscape("003C"));
-  escaped = htmlEscape.replaceEveryLiteral(escaped, ">", htmlEscape.unicodeEscape("003E"));
-  escaped = htmlEscape.replaceEveryLiteral(escaped, "&", htmlEscape.unicodeEscape("0026"));
-  escaped = htmlEscape.replaceEveryLiteral(escaped, LINE_SEPARATOR$1, htmlEscape.unicodeEscape("2028"));
-  return htmlEscape.replaceEveryLiteral(escaped, PARAGRAPH_SEPARATOR$1, htmlEscape.unicodeEscape("2029"));
+  let escaped = replaceEveryLiteral(json, "<", unicodeEscape("003C"));
+  escaped = replaceEveryLiteral(escaped, ">", unicodeEscape("003E"));
+  escaped = replaceEveryLiteral(escaped, "&", unicodeEscape("0026"));
+  escaped = replaceEveryLiteral(escaped, LINE_SEPARATOR$1, unicodeEscape("2028"));
+  return replaceEveryLiteral(escaped, PARAGRAPH_SEPARATOR$1, unicodeEscape("2029"));
 }
 function injectHtmlOpeningAttr(html, attr) {
   const lower = html.toLowerCase();
@@ -1764,31 +1784,22 @@ function injectChecksum(html, checksum, minify = false) {
   const attrName = minify ? "data-sz-cs" : "data-sz-checksum";
   return injectHtmlOpeningAttr(html, ` ${attrName}="${checksum}"`);
 }
-function injectMangleMapScript(html, mangleMap, options = {}) {
-  const {
-    prettyPrint = false,
-    varMangleMap = {},
-    globalVarAliasPrefix = types.CSSZYX_GLOBAL_ALIAS_PREFIX,
-    installRuntimeObject = true
-  } = options;
-  const checksumMap = createHydrationMangleMap(mangleMap, varMangleMap);
-  const jsonContent = safeJsonForScriptTag(checksumMap, prettyPrint);
-  const varMapContent = safeJsonForScriptTag(varMangleMap);
-  const reuseChecksumPayload = Object.keys(varMangleMap).length === 0;
-  const classMapExpr = reuseChecksumPayload ? '(function(){var e=document.getElementById("__CSSZYX_MANGLE_MAP__");return e?JSON.parse(e.textContent):{}})()' : safeJsonForScriptTag(mangleMap);
-  const scriptTag = `<script id="__CSSZYX_MANGLE_MAP__" type="application/json">${jsonContent}<\/script>`;
-  const prefixContent = safeJsonForScriptTag(globalVarAliasPrefix);
-  const debugScript = `<script>(function(){var m=${classMapExpr};var vm=${varMapContent};var gp=${prefixContent};var r={};var vr={};for(var k in m)r[m[k]]=k;for(var vk in vm){var vv=vm[vk];var vs=Array.isArray(vv)?vv:[vv];for(var vi=0;vi<vs.length;vi++)(vr[vs[vi]]||(vr[vs[vi]]=[])).push(vk)}var cs=document.documentElement.getAttribute("data-sz-checksum")||"";window.__csszyx={mangleMap:m,varMangleMap:vm,checksum:cs,decode:function(c){return r[c]},encode:function(c){return m[c]},decodeVar:function(v){return vr[v]||[]},encodeVar:function(v){return vm[v]},decodeGlobalVar:function(v){var a=vr[v]||[];return v.indexOf(gp)===0?a[0]:void 0},decodeAll:function(el){return(el.className||"").split(" ").map(function(c){return r[c]||c})}}})()<\/script>`;
-  const combined = installRuntimeObject ? `${scriptTag}
-${debugScript}` : scriptTag;
+function withScriptTag(html, scriptTag) {
   if (html.includes("</head>")) {
-    return html.replace("</head>", `${combined}
+    return html.replace("</head>", `${scriptTag}
 </head>`);
-  } else if (html.includes("</html>")) {
-    return html.replace("</html>", `${combined}
+  }
+  if (html.includes("</html>")) {
+    return html.replace("</html>", `${scriptTag}
 </html>`);
   }
-  return html + combined;
+  return html + scriptTag;
+}
+function injectMangleMapScript(html, mangleMap, options = {}) {
+  const { prettyPrint = false, varMangleMap = {} } = options;
+  const checksumMap = createHydrationMangleMap(mangleMap, varMangleMap);
+  const scriptTag = `<script id="__CSSZYX_MANGLE_MAP__" type="application/json">${safeJsonForScriptTag(checksumMap, prettyPrint)}<\/script>`;
+  return withScriptTag(html, scriptTag);
 }
 function injectMangleMapAttribute(html, mangleMap, minify = false, varMangleMap = {}) {
   const attrName = minify ? "data-sz-m" : "data-sz-map";
@@ -1835,7 +1846,7 @@ function buildRecoveryManifest(tokens, options) {
   const stripped = options.production === true;
   const strippedDevOnlyPaths = [];
   const sorted = {};
-  const sortedKeys = htmlEscape.sortStrings(tokens.keys());
+  const sortedKeys = safelistSource.sortStrings(tokens.keys());
   for (const key of sortedKeys) {
     const data = tokens.get(key);
     if (!data) {
@@ -1862,27 +1873,97 @@ function injectRecoveryManifest(html, manifest) {
   }
   const json = JSON.stringify(manifest);
   const scriptTag = `<script id="__SZ_RECOVERY_MANIFEST__" type="application/json">${json}<\/script>`;
-  if (html.includes("</head>")) {
-    return html.replace("</head>", `${scriptTag}
-</head>`);
-  } else if (html.includes("</html>")) {
-    return html.replace("</html>", `${scriptTag}
-</html>`);
-  }
-  return html + scriptTag;
+  return withScriptTag(html, scriptTag);
 }
 
 const LINE_SEPARATOR = String.fromCodePoint(8232);
 const PARAGRAPH_SEPARATOR = String.fromCodePoint(8233);
 function escapeJsonForInlineScript(json) {
-  let escaped = htmlEscape.replaceEveryLiteral(json, "`", htmlEscape.unicodeEscape("0060"));
-  escaped = htmlEscape.replaceEveryLiteral(escaped, "$", htmlEscape.unicodeEscape("0024"));
-  escaped = htmlEscape.replaceEveryLiteral(escaped, "<", htmlEscape.unicodeEscape("003c"));
-  escaped = htmlEscape.replaceEveryLiteral(escaped, LINE_SEPARATOR, htmlEscape.unicodeEscape("2028"));
-  return htmlEscape.replaceEveryLiteral(escaped, PARAGRAPH_SEPARATOR, htmlEscape.unicodeEscape("2029"));
+  let escaped = replaceEveryLiteral(json, "`", unicodeEscape("0060"));
+  escaped = replaceEveryLiteral(escaped, "$", unicodeEscape("0024"));
+  escaped = replaceEveryLiteral(escaped, "<", unicodeEscape("003c"));
+  escaped = replaceEveryLiteral(escaped, LINE_SEPARATOR, unicodeEscape("2028"));
+  return replaceEveryLiteral(escaped, PARAGRAPH_SEPARATOR, unicodeEscape("2029"));
+}
+function escapeJsonForStringLiteral(json) {
+  let escaped = replaceEveryLiteral(json, "\\", unicodeEscape("005c"));
+  for (const [character, code] of [
+    ['"', "0022"],
+    ["'", "0027"],
+    ["`", "0060"],
+    ["$", "0024"],
+    ["<", "003c"],
+    [">", "003e"],
+    [LINE_SEPARATOR, "2028"],
+    [PARAGRAPH_SEPARATOR, "2029"]
+  ]) {
+    escaped = replaceEveryLiteral(escaped, character, unicodeEscape(code));
+  }
+  return escaped;
 }
 function escapeForDoubleQuotedString(value) {
-  return htmlEscape.escapeDoubleQuotedString(value);
+  return escapeDoubleQuotedString(value);
+}
+
+function createLazyAggregate(build, initial) {
+  const entries = /* @__PURE__ */ new Map();
+  let current = initial;
+  let dirty = false;
+  return {
+    entries,
+    set(key, entry) {
+      entries.set(key, entry);
+      dirty = true;
+    },
+    delete(key) {
+      if (entries.delete(key)) dirty = true;
+    },
+    get() {
+      if (dirty) {
+        current = build(entries);
+        dirty = false;
+      }
+      return current;
+    }
+  };
+}
+
+function needsRuntimeMangleRegistration(manglingEnabled, mangleMap) {
+  if (!manglingEnabled) return false;
+  return Object.keys(mangleMap).length > 0;
+}
+function removedMangleMapDeliveryMessage() {
+  return "[csszyx] production.mangleMapDelivery has been removed and is ignored. The runtime mangle map is always registered from inside the JS bundle now, on every lane, so the built HTML never carries an executable inline <script> and a strict script-src 'self' policy needs no exception. Delete the option. (`window.__csszyx` is now opt-in through `production.mangleDebugGlobal`.)";
+}
+
+const MANGLE_RUNTIME_FILE = "mangle-runtime.mjs";
+function ensureMangleRuntimeFile(outputDir, globalVarAliasPrefix, exposeDebugGlobal) {
+  const target = path__default.join(outputDir, MANGLE_RUNTIME_FILE);
+  const staging = `${target}.${process.pid}.tmp`;
+  try {
+    fs__default.mkdirSync(outputDir, { recursive: true });
+    fs__default.writeFileSync(
+      staging,
+      themeGroupsFile.createMangleRuntimeModule(globalVarAliasPrefix, exposeDebugGlobal),
+      "utf8"
+    );
+    fs__default.renameSync(staging, target);
+    return target;
+  } catch {
+    try {
+      fs__default.rmSync(staging, { force: true });
+    } catch {
+    }
+    return null;
+  }
+}
+function applyMangleRuntimeEntry(compiler, context, file, onRegistered) {
+  const EntryPlugin = compiler.webpack?.EntryPlugin;
+  if (EntryPlugin === void 0) {
+    return;
+  }
+  new EntryPlugin(context, file, { name: void 0 }).apply(compiler);
+  onRegistered();
 }
 
 function createMangleSizeAccount() {
@@ -1920,7 +2001,7 @@ function recordCodePair(account, before, after) {
   account.codeGzAfter += gzipBytes(after);
 }
 function computeMangleSizeVerdict(account, mapPayload) {
-  const channels = htmlEscape.sortStrings(account.channels);
+  const channels = safelistSource.sortStrings(account.channels);
   const mapCost = gzipBytes(mapPayload) * channels.length;
   const cssSaving = account.cssGzBefore - account.cssGzAfter;
   const codeSaving = account.codeGzBefore - account.codeGzAfter;
@@ -1932,7 +2013,7 @@ function mangleSizeMessage(verdict) {
   const cssPart = verdict.cssSaving >= 0 ? `the mangled CSS saves ${verdict.cssSaving} B` : `the mangled CSS COSTS ${-verdict.cssSaving} B (short tokens compress worse than the names they replaced)`;
   const codePart = verdict.codeSaving >= 0 ? `the shortened classes in code save ${verdict.codeSaving} B` : `the shortened classes in code COST ${-verdict.codeSaving} B`;
   const channelPart = verdict.channels.length > 1 ? `${verdict.channels.join(" + ")} (${verdict.channels.length} copies)` : verdict.channels[0];
-  return `[csszyx] production.mangle is making this build BIGGER: +${verdict.net} B gzipped. The runtime mangle map costs ${verdict.mapCost} B via ${channelPart}, while ${cssPart} and ${codePart}. Mangling is a name-obfuscation feature; over a compressed response it does not reduce payload, because utility class names compress far better than the map they need. If you enabled it for size, set \`production.mangle: false\`. If you enabled it to hide class names, this is the expected price and you can ignore this. Narrowing \`production.mangleMapDelivery\` removes a map copy when only one channel is needed.`;
+  return `[csszyx] production.mangle is making this build BIGGER: +${verdict.net} B gzipped. The runtime mangle map costs ${verdict.mapCost} B via ${channelPart}, while ${cssPart} and ${codePart}. Mangling is a name-obfuscation feature; over a compressed response it does not reduce payload, because utility class names compress far better than the map they need. If you enabled it for size, set \`production.mangle: false\`. If you enabled it to hide class names, this is the expected price and you can ignore this. Two copies is not a misconfiguration: the bundle carries the map the runtime reads, and the HTML carries the same census for the hydration checksum.`;
 }
 
 function isParserMode(value) {
@@ -1993,10 +2074,10 @@ function isSameFileVersion(before, after) {
 function generateThemeDts(opts) {
   const { theme, sourceFiles } = opts;
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const withoutCarriageReturns = htmlEscape.replaceEveryLiteral(sourceFiles.join(", "), "\r", " ");
-  const sources = htmlEscape.replaceEveryLiteral(withoutCarriageReturns, "\n", " ");
-  const toUnion = (tokens) => tokens.map((t) => `'${htmlEscape.escapeSingleQuotedString(t)}'`).join(" | ");
-  const quoteKey = (key) => /^[a-z_$][\w$]*$/i.test(key) ? key : `'${htmlEscape.escapeSingleQuotedString(key)}'`;
+  const withoutCarriageReturns = replaceEveryLiteral(sourceFiles.join(", "), "\r", " ");
+  const sources = replaceEveryLiteral(withoutCarriageReturns, "\n", " ");
+  const toUnion = (tokens) => tokens.map((t) => `'${escapeSingleQuotedString(t)}'`).join(" | ");
+  const quoteKey = (key) => /^[a-z_$][\w$]*$/i.test(key) ? key : `'${escapeSingleQuotedString(key)}'`;
   const entries = [];
   if (theme.colors.length > 0) {
     entries.push(`        colors: ${toUnion(theme.colors)};`);
@@ -2099,13 +2180,14 @@ function findOpeningTag(source, tag) {
   }
 }
 const _warnedClassNameAuthors = /* @__PURE__ */ new Set();
+const _warnedSafelistWriteFailures = /* @__PURE__ */ new Set();
 let _hasWarnedTsConfig = false;
 let _hasWarnedTransformCacheVersion = false;
 let _hasWarnedNativeFallback = false;
 const _loggedActiveParsers = /* @__PURE__ */ new Set();
-const requireFromHere = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('shared/unplugin.RGzhYt-D.cjs', document.baseURI).href)));
+const requireFromHere = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('shared/unplugin.8KYddE6x.cjs', document.baseURI).href)));
 const PLUGIN_VERSION = findPackageVersionFromFile(
-  node_url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('shared/unplugin.RGzhYt-D.cjs', document.baseURI).href))),
+  node_url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('shared/unplugin.8KYddE6x.cjs', document.baseURI).href))),
   UNKNOWN_PACKAGE_VERSION
 );
 const COMPILER_VERSION = findPackageVersionFromModule("@csszyx/compiler", UNKNOWN_PACKAGE_VERSION);
@@ -2133,41 +2215,6 @@ function resolveNativeCacheIdentity() {
 }
 const BENCH_TRACE_ENABLED = process.env.CSSZYX_BENCH_TRACE === "1";
 const BENCH_TRACE_FILE = process.env.CSSZYX_BENCH_TRACE_FILE;
-function appendTailwindSourceDirective(code, relPath) {
-  const directive = `@source "${relPath}";`;
-  if (code.includes(directive)) {
-    return null;
-  }
-  const separator = code.length === 0 || code.endsWith("\n") ? "" : "\n";
-  return `${code}${separator}${directive}
-`;
-}
-function stripCssBlockComments(code) {
-  const SLASH = 47;
-  const STAR = 42;
-  let out = "";
-  let last = 0;
-  let i = 0;
-  const n = code.length;
-  while (i < n) {
-    if (code.codePointAt(i) === SLASH && code.codePointAt(i + 1) === STAR) {
-      out += code.slice(last, i);
-      i += 2;
-      while (i < n && !(code.codePointAt(i) === STAR && code.codePointAt(i + 1) === SLASH)) {
-        i++;
-      }
-      i += 2;
-      last = i;
-    } else {
-      i++;
-    }
-  }
-  return out + code.slice(last);
-}
-function cssImportsTailwind(code) {
-  const withoutBlockComments = stripCssBlockComments(code);
-  return /@import\s+["']tailwindcss(?:\/[^"']*)?["']/.test(withoutBlockComments);
-}
 function hasInjectableTailwindCandidate(classes) {
   for (const c of classes) {
     if (c.length >= 2 && /^[a-z]/.test(c)) {
@@ -2231,7 +2278,7 @@ function tailwindImportScopesContent(css) {
   return false;
 }
 function cssHasContentScope(code) {
-  const s = stripCssBlockComments(code);
+  const s = safelistSource.stripCssBlockComments(code);
   return tailwindImportScopesContent(s) || /@source\s+not\b/.test(s);
 }
 function isMonorepoPackage(root) {
@@ -2291,7 +2338,7 @@ function emitMissingCssFallback(quiet, message, id, emit) {
   ${message}`);
 }
 function normalizeForMatch(p) {
-  const n = transformCache.normalizePathSeparators(p);
+  const n = safelistSource.normalizePathSeparators(p);
   return n.length > 1 && n.endsWith("/") ? n.slice(0, -1) : n;
 }
 function findJsxExpressionEnd(code, bodyStart) {
@@ -2418,15 +2465,6 @@ function watchModeMangleMessage() {
 function realContentHashDisabledMessage() {
   return "[csszyx] optimization.realContentHash is off while production.mangle is on. csszyx mangles assets after webpack computes their content hashes, and realContentHash is what recomputes those hashes from the final bytes. Without it, two builds that differ only by mangling emit the same filenames with different contents and caches keep serving the old file.";
 }
-function computeSafelistRelPath(rootDir, safelistFilename, cssId) {
-  const safelistPath = transformCache.normalizePathSeparators(path__namespace.join(rootDir, safelistFilename));
-  const cssDir = transformCache.normalizePathSeparators(path__namespace.dirname(cssId));
-  let relPath = path__namespace.posix.relative(cssDir, safelistPath);
-  if (!relPath.startsWith(".")) {
-    relPath = `./${relPath}`;
-  }
-  return relPath;
-}
 function cssVariableEntries(result) {
   const entries = [];
   for (const [original, value] of result.cssVariableMap ?? []) {
@@ -2447,7 +2485,6 @@ function recordFileVarMangleEntries(state, filename, entries) {
   } else {
     state.varMangleEntriesByFile.set(normalizedFilename, entries);
   }
-  state.varMangleMap = buildVarMangleMap(state.varMangleEntriesByFile);
 }
 function shouldTrackGlobalVarSources(config) {
   return config?.enabled === true;
@@ -2682,7 +2719,6 @@ function recordFileCSSVariableMetrics(state, filename, code) {
       state.cssVarMetricsByFile.delete(normalizedFilename);
     }
   }
-  state.cssVarMetrics = buildCSSVariableMetrics(state.cssVarMetricsByFile);
 }
 function collectCSSVariableMetrics(code) {
   const componentUses = /* @__PURE__ */ new Map();
@@ -2843,9 +2879,20 @@ function findPackageVersionFromFile(file, fallback) {
   }
 }
 function normalizeSourceFilename(filename) {
-  return transformCache.normalizePathSeparators(filename);
+  return safelistSource.normalizePathSeparators(filename);
 }
 const SCRIPT_ID_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
+const STYLESHEET_FILE_EXTENSIONS = [
+  ".css",
+  ".pcss",
+  ".postcss",
+  ".scss",
+  ".sass",
+  ".less",
+  ".styl",
+  ".stylus",
+  ".sss"
+];
 const SOURCE_MODULE_EXTENSIONS = [...SCRIPT_ID_EXTENSIONS, ".cts", ".mts", ".cjs", ".mjs"];
 function matchesScriptExtension(id, extensions) {
   return extensions.some((ext) => id.endsWith(ext) || id.includes(`${ext}?`));
@@ -3115,20 +3162,18 @@ function createCsszyxPlugins(options = {}) {
   let specifierAliases = [];
   const mangleReserved = new Set(options.production?.mangleExclude ?? []);
   let mangleMapFrozen = false;
+  let prescanSawServerModule = false;
+  let skipRscRecords = false;
+  let lastPrescanCacheMisses = 0;
   let frozenOwnedClasses = /* @__PURE__ */ new Set();
   let frozenAuthoredClasses = /* @__PURE__ */ new Set();
   let cssRewrittenInTransform = false;
   let projectCssFiles = [];
   const transformMangledSources = /* @__PURE__ */ new Set();
   const transformExternalClasses = /* @__PURE__ */ new Set();
-  const mangleMapDelivery = options.production?.mangleMapDelivery ?? "both";
-  if (!["both", "html", "bundle"].includes(mangleMapDelivery)) {
-    throw new Error(
-      `[csszyx] production.mangleMapDelivery must be 'both', 'html' or 'bundle'; got ${JSON.stringify(mangleMapDelivery)}.`
-    );
+  if (options.production?.mangleMapDelivery !== void 0) {
+    console.warn(removedMangleMapDeliveryMessage());
   }
-  const deliverMapInHtml = mangleMapDelivery !== "bundle";
-  const deliverMapInBundle = mangleMapDelivery !== "html";
   const sizeAccount = createMangleSizeAccount();
   const astBudgetOverride = options.build?.astBudgetLimit;
   const prescanAstBudget = astBudgetOverride ?? 5e5;
@@ -3139,7 +3184,6 @@ function createCsszyxPlugins(options = {}) {
   const globalVarMangleConfig = options.production?.mangleGlobalVars;
   const globalVarSourceTrackingEnabled = shouldTrackGlobalVarSources(globalVarMangleConfig);
   const globalVarAliasPrefix = globalVarMangleConfig?.aliasPrefix ?? types.CSSZYX_GLOBAL_ALIAS_PREFIX;
-  const encodedGlobalVarAliasPrefix = encodeURIComponent(globalVarAliasPrefix);
   const earlyGlobalVarAliasEntries = createEarlyGlobalVarAliasEntries(
     globalVarMangleConfig,
     globalVarAliasPrefix
@@ -3194,12 +3238,21 @@ function createCsszyxPlugins(options = {}) {
   const transformMemoryCache = /* @__PURE__ */ new Map();
   let transformMemoryCacheCodeChars = 0;
   const prescanResultHandoff = /* @__PURE__ */ new Map();
+  const varMangleEntries = createLazyAggregate(
+    buildVarMangleMap,
+    Object.fromEntries(earlyGlobalVarAliasEntries)
+  );
+  const cssVarMetricTotals = createLazyAggregate(
+    buildCSSVariableMetrics,
+    emptyCSSVariableMetrics()
+  );
   const state = {
     classes: /* @__PURE__ */ new Set(),
     parsedTheme: null,
     scanCssTheme: null,
     autoThemeCssFiles: [],
     sawTailwindEntry: false,
+    tailwindEntryFiles: /* @__PURE__ */ new Set(),
     sawAnyCss: false,
     tailwindWarningEmitted: false,
     tailwindEntryScoped: false,
@@ -3213,10 +3266,14 @@ function createCsszyxPlugins(options = {}) {
     ownedClasses: /* @__PURE__ */ new Set(),
     authoredClasses: /* @__PURE__ */ new Set(),
     mangleMap: {},
-    varMangleEntriesByFile: /* @__PURE__ */ new Map(),
-    varMangleMap: Object.fromEntries(earlyGlobalVarAliasEntries),
-    cssVarMetricsByFile: /* @__PURE__ */ new Map(),
-    cssVarMetrics: emptyCSSVariableMetrics(),
+    varMangleEntriesByFile: varMangleEntries,
+    get varMangleMap() {
+      return varMangleEntries.get();
+    },
+    cssVarMetricsByFile: cssVarMetricTotals,
+    get cssVarMetrics() {
+      return cssVarMetricTotals.get();
+    },
     checksum: "",
     finalized: false,
     rootDir: process.cwd(),
@@ -3228,7 +3285,7 @@ function createCsszyxPlugins(options = {}) {
   if (earlyGlobalVarAliasEntries.length > 0) {
     state.varMangleEntriesByFile.set(GLOBAL_VAR_ALIAS_MAP_OWNER, earlyGlobalVarAliasEntries);
   }
-  const SAFELIST_FILENAME = "csszyx-classes.html";
+  const SAFELIST_FILENAME = safelistSource.SAFELIST_FILE;
   const SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
     ".tsx",
     ".jsx",
@@ -3381,6 +3438,7 @@ function createCsszyxPlugins(options = {}) {
       );
       if (cached) return cached;
     }
+    lastPrescanCacheMisses++;
     const execution = runConfiguredParser(source, effectiveFilename, compilerOptions);
     if (cacheEnabled && cacheKey && execution.cacheable) {
       transformCache.writeTransformCache(cacheRoot, cacheInput, execution.result, cacheKey);
@@ -3467,6 +3525,7 @@ function createCsszyxPlugins(options = {}) {
     if (cacheEnabled) evictTransformCacheOnce();
     compiler.ensureRustTransformAvailable();
     const misses = collectRustPrescanMisses(batchable, compilerOptions, cacheRoot, results);
+    lastPrescanCacheMisses += misses.length;
     if (misses.length > 0) {
       try {
         runRustPrescanBatch(misses, compilerOptions, cacheRoot, results);
@@ -3610,12 +3669,7 @@ function createCsszyxPlugins(options = {}) {
       return;
     }
     const safelistPath = path__namespace.join(state.rootDir, SAFELIST_FILENAME);
-    const classNames = Array.from(classes);
-    const classList = htmlEscape.escapeHtmlAttribute(classNames.join(" "));
-    const content = `<!-- Auto-generated by csszyx \u2014 DO NOT EDIT -->
-<!-- Tailwind CSS scans this file for class name detection -->
-<div class="${classList}"><div class="${classList}">x</div><div class="${classList}">x</div></div>
-` + htmlEscape.renderTailwindScannerCandidates(classNames);
+    const content = safelistSource.renderSafelistFile(Array.from(classes));
     try {
       let existing = "";
       try {
@@ -3626,9 +3680,18 @@ function createCsszyxPlugins(options = {}) {
         }
       }
       if (existing !== content) {
-        fs__namespace.writeFileSync(safelistPath, content);
+        safelistSource.atomicWriteFileSync(safelistPath, content);
+        safelistSource.removeLegacySafelists(state.rootDir, console.warn);
       }
-    } catch {
+    } catch (error) {
+      if (_warnedSafelistWriteFailures.has(safelistPath)) {
+        return;
+      }
+      _warnedSafelistWriteFailures.add(safelistPath);
+      const reason = error instanceof Error ? error.message : String(error);
+      console.warn(
+        `[csszyx] could not write the generated safelist to ${safelistPath}: ${reason}. Tailwind scans that file for the classes csszyx found, so the CSS it generates will be missing them. Check that the directory exists and is writable.`
+      );
     }
   }
   function recordPackagesSkipIfSz(filePath) {
@@ -3680,15 +3743,15 @@ function createCsszyxPlugins(options = {}) {
   function refreshSzvRegistryEntry(filePath, content) {
     if (!shouldProcessSource(filePath)) return;
     if (content === null) {
-      szvCrossModuleRegistry.delete(transformCache.normalizePathSeparators(filePath));
-      szvCrossModuleForwards.delete(transformCache.normalizePathSeparators(filePath));
+      szvCrossModuleRegistry.delete(safelistSource.normalizePathSeparators(filePath));
+      szvCrossModuleForwards.delete(safelistSource.normalizePathSeparators(filePath));
       return;
     }
     transformCache.recordSzvRegistryFile(szvCrossModuleRegistry, filePath, content);
     transformCache.recordCrossModuleForwards(szvCrossModuleForwards, filePath, content);
     if (importedStaticSzEnabled) {
       transformCache.recordSzObjectRegistryFile(szvCrossModuleRegistry, filePath, content);
-      szObjectProvidersExamined.add(transformCache.normalizePathSeparators(filePath));
+      szObjectProvidersExamined.add(safelistSource.normalizePathSeparators(filePath));
       recordProvidersDemandedBy(filePath, content);
     }
   }
@@ -3711,7 +3774,7 @@ function createCsszyxPlugins(options = {}) {
     for (const specifier of queue) {
       const providerPath = transformCache.resolveProviderPathWith(specifier, transformCache.isReadableProviderFile);
       if (providerPath === void 0) continue;
-      const key = transformCache.normalizePathSeparators(providerPath);
+      const key = safelistSource.normalizePathSeparators(providerPath);
       if (!szObjectProvidersExamined.has(key)) {
         szObjectProvidersExamined.add(key);
         readAndRecordSzObjectProvider(providerPath);
@@ -3735,14 +3798,14 @@ function createCsszyxPlugins(options = {}) {
     for (const specifier of queue) {
       const providerPath = transformCache.resolveProviderPath(seenSourcePaths, specifier);
       if (providerPath === void 0) continue;
-      szObjectProvidersExamined.add(transformCache.normalizePathSeparators(providerPath));
+      szObjectProvidersExamined.add(safelistSource.normalizePathSeparators(providerPath));
       readAndRecordSzObjectProvider(providerPath);
       enqueueForwardedProviders(providerPath, queue, queued);
     }
   }
   function enqueueForwardedProviders(providerPath, queue, queued) {
     const directory = path__namespace.dirname(providerPath);
-    for (const forward of szvCrossModuleForwards.get(transformCache.normalizePathSeparators(providerPath)) ?? []) {
+    for (const forward of szvCrossModuleForwards.get(safelistSource.normalizePathSeparators(providerPath)) ?? []) {
       for (const base of transformCache.specifierBases(forward.specifier, directory, specifierAliases)) {
         if (queued.has(base)) continue;
         queued.add(base);
@@ -3766,6 +3829,7 @@ function createCsszyxPlugins(options = {}) {
     szvCrossModuleRegistry.clear();
     szvCrossModuleForwards.clear();
     szObjectProvidersExamined.clear();
+    prescanSawServerModule = false;
     const prescanStarted = node_perf_hooks.performance.now();
     const discoveredClasses = /* @__PURE__ */ new Set();
     const rawDiscoveredClasses = /* @__PURE__ */ new Set();
@@ -3784,9 +3848,12 @@ function createCsszyxPlugins(options = {}) {
         return;
       }
       recordAuthoredClasses(content);
+      if (!prescanSawServerModule && isRSCServerModule(content, filePath)) {
+        prescanSawServerModule = true;
+      }
       recordSzvRegistryEntries(filePath, content);
       transformCache.recordCrossModuleForwards(szvCrossModuleForwards, filePath, content);
-      seenSourcePaths.add(transformCache.normalizePathSeparators(filePath));
+      seenSourcePaths.add(safelistSource.normalizePathSeparators(filePath));
       if (fileMayContainSafelistableSz(content)) {
         prescanSources.push({ filePath, content });
         recordSzObjectDemand(filePath, content);
@@ -3823,6 +3890,7 @@ function createCsszyxPlugins(options = {}) {
         }
       }
     }
+    const walkStarted = node_perf_hooks.performance.now();
     scanDir(state.rootDir);
     const normRoot = normalizeForMatch(state.rootDir);
     for (const sourceDir of compileSourceDirs) {
@@ -3831,7 +3899,20 @@ function createCsszyxPlugins(options = {}) {
       }
       scanDir(sourceDir);
     }
+    traceBenchTiming(
+      `prescan:walk files=${seenSourcePaths.size} sz=${prescanSources.length}`,
+      state.rootDir,
+      node_perf_hooks.performance.now() - walkStarted
+    );
+    const demandStarted = node_perf_hooks.performance.now();
     recordDemandedSzObjectProviders(seenSourcePaths, szObjectDemand);
+    traceBenchTiming(
+      `prescan:demand providers=${szObjectProvidersExamined.size}`,
+      state.rootDir,
+      node_perf_hooks.performance.now() - demandStarted
+    );
+    const batchStarted = node_perf_hooks.performance.now();
+    lastPrescanCacheMisses = 0;
     const prescanContentByPath = new Map(
       prescanSources.map((file) => [file.filePath, file.content])
     );
@@ -3844,12 +3925,23 @@ function createCsszyxPlugins(options = {}) {
         rawDiscoveredClasses
       );
     }
+    traceBenchTiming(
+      `prescan:batch files=${prescanSources.length} misses=${lastPrescanCacheMisses}`,
+      state.rootDir,
+      node_perf_hooks.performance.now() - batchStarted
+    );
     for (const cls of discoveredClasses) {
       addSafelistClass(cls);
       state.ownedClasses.add(cls);
     }
     const safelistClasses = /* @__PURE__ */ new Set([...discoveredClasses, ...rawDiscoveredClasses]);
+    const safelistStarted = node_perf_hooks.performance.now();
     writeSafelistFile(safelistClasses);
+    traceBenchTiming(
+      `prescan:safelist classes=${safelistClasses.size}`,
+      state.rootDir,
+      node_perf_hooks.performance.now() - safelistStarted
+    );
     traceBenchTiming("prescan", state.rootDir, node_perf_hooks.performance.now() - prescanStarted);
   }
   function collectPrescanResult(result, filePath, discoveredClasses, rawDiscoveredClasses) {
@@ -4028,6 +4120,12 @@ function createCsszyxPlugins(options = {}) {
       result = result.split(themeGroupsFile.CHECKSUM_PLACEHOLDER).join(state.checksum);
     }
     const isEvalWrapped = result.includes("eval(") && result.includes("sourceURL=webpack");
+    if (result.includes(themeGroupsFile.CENSUS_PLACEHOLDER)) {
+      const census = safeJsonForScriptTag(
+        createHydrationMangleMap(state.mangleMap, state.varMangleMap)
+      );
+      result = result.split(themeGroupsFile.CENSUS_PLACEHOLDER).join(escapeJsonForStringLiteral(census));
+    }
     if (result.includes(themeGroupsFile.MANGLE_MAP_PLACEHOLDER)) {
       const jsonMap = escapeJsonForInlineScript(JSON.stringify(state.mangleMap));
       const escapedMap = isEvalWrapped ? escapeForDoubleQuotedString(jsonMap) : jsonMap;
@@ -4057,14 +4155,84 @@ function createCsszyxPlugins(options = {}) {
       usesBoolClass: false
     };
   }
+  function recordUntransformedHotFile(file, content) {
+    trackGlobalVarSourceFile(file, content);
+    recordFileVarMangleEntries(state, file, []);
+    recordFileCSSVariableMetrics(state, file, null);
+  }
+  function discoverHotFileClasses(file, watcher) {
+    if (!shouldProcessSource(file)) {
+      return;
+    }
+    let fileContent, result;
+    try {
+      fileContent = fs__namespace.readFileSync(file, "utf-8");
+    } catch {
+      refreshSzvRegistryEntry(file, null);
+      return;
+    }
+    refreshSzvRegistryEntry(file, fileContent);
+    if (!fileContent.includes("sz=") && !fileContent.includes("szs=") && !/\bsz\s*:\s*["'{]/.test(fileContent)) {
+      recordUntransformedHotFile(file, fileContent);
+      return;
+    }
+    try {
+      const hmrTransformStarted = node_perf_hooks.performance.now();
+      result = transformConfiguredSource(fileContent, file);
+      traceBenchTiming("handle-hot-update", file, node_perf_hooks.performance.now() - hmrTransformStarted);
+    } catch {
+      recordUntransformedHotFile(file, fileContent);
+      return;
+    }
+    if (!result.transformed) {
+      recordUntransformedHotFile(file, fileContent);
+      return;
+    }
+    recordHotTransformResult(file, fileContent, result, watcher);
+  }
+  function recordHotTransformResult(file, fileContent, result, watcher) {
+    const sizeBefore = state.classes.size;
+    trackGlobalVarSourceFile(file, fileContent);
+    for (const cls of result.classes) {
+      addSafelistClass(cls);
+      state.ownedClasses.add(cls);
+    }
+    recordFileVarMangleEntries(state, file, cssVariableEntries(result));
+    recordFileCSSVariableMetrics(state, file, result.code);
+    for (const [token, data] of result.recoveryTokens) {
+      state.recoveryTokens.set(token, data);
+    }
+    if (state.classes.size > sizeBefore) {
+      writeSafelistFile(state.classes);
+      const safelistPath = path__namespace.join(state.rootDir, SAFELIST_FILENAME);
+      watcher.emit("change", safelistPath);
+    }
+  }
+  function tailwindEntryModules(moduleGraph) {
+    const modules = [];
+    for (const file of state.tailwindEntryFiles) {
+      const found = moduleGraph.getModulesByFile(file);
+      if (found) modules.push(...found);
+    }
+    return modules;
+  }
   function transformTailwindCssEntry(code, id) {
     state.sawAnyCss = true;
-    if (!cssImportsTailwind(code)) return null;
+    const [cssFile] = id.split("?");
+    const legacy = safelistSource.findLegacySourceDirective(code, cssFile);
+    if (legacy !== null) {
+      throw new Error(safelistSource.legacySourceMessage(cssFile, legacy.target));
+    }
+    if (!safelistSource.cssImportsTailwind(code)) return null;
     state.sawTailwindEntry = true;
+    const [entryFile] = id.split("?");
+    if (STYLESHEET_FILE_EXTENSIONS.some((ext) => entryFile.endsWith(ext))) {
+      state.tailwindEntryFiles.add(entryFile);
+    }
     if (cssHasContentScope(code)) state.tailwindEntryScoped = true;
     if (!hasInjectableTailwindCandidate(state.classes)) return null;
-    const relPath = computeSafelistRelPath(state.rootDir, SAFELIST_FILENAME, id);
-    const transformed = appendTailwindSourceDirective(code, relPath);
+    const relPath = safelistSource.computeSafelistRelPath(state.rootDir, SAFELIST_FILENAME, id);
+    const transformed = safelistSource.appendTailwindSourceDirective(code, relPath);
     return transformed === null ? null : { code: transformed, map: null };
   }
   function reportTransformDiagnostics(result, id, warn) {
@@ -4132,16 +4300,16 @@ function createCsszyxPlugins(options = {}) {
     if (!code.includes("<html") || !/(?:layout|Root|Document|app)\.tsx?$/i.test(id)) {
       return null;
     }
-    let transformedCode = code;
     const attrName = options.production?.minify ? "data-sz-cs" : "data-sz-checksum";
-    const htmlTag = findOpeningTag(transformedCode, "html");
-    if (htmlTag) {
-      transformedCode = `${transformedCode.slice(0, htmlTag.close)} ${attrName}="${themeGroupsFile.CHECKSUM_PLACEHOLDER}"${transformedCode.slice(htmlTag.close)}`;
+    const htmlTag = findOpeningTag(code, "html");
+    if (!htmlTag) {
+      return code;
     }
-    const debugScript = `<script dangerouslySetInnerHTML={{__html: \`(function(){var m=${themeGroupsFile.MANGLE_MAP_PLACEHOLDER};var vm=${themeGroupsFile.VAR_MANGLE_MAP_PLACEHOLDER};var gp=decodeURIComponent(${escapeJsonForInlineScript(JSON.stringify(encodedGlobalVarAliasPrefix))});var r={};var vr={};for(var k in m)r[m[k]]=k;for(var vk in vm){var vv=vm[vk];var vs=Array.isArray(vv)?vv:[vv];for(var vi=0;vi<vs.length;vi++)(vr[vs[vi]]||(vr[vs[vi]]=[])).push(vk)}window.__csszyx={mangleMap:m,varMangleMap:vm,checksum:"${themeGroupsFile.CHECKSUM_PLACEHOLDER}",decode:function(c){return r[c]},encode:function(c){return m[c]},decodeVar:function(v){return vr[v]||[]},encodeVar:function(v){return vm[v]},decodeGlobalVar:function(v){var a=vr[v]||[];return v.indexOf(gp)===0?a[0]:void 0},decodeAll:function(el){return(el.className||"").split(" ").map(function(c){return r[c]||c})}}})()\`}} />`;
+    let transformedCode = `${code.slice(0, htmlTag.close)} ${attrName}="${themeGroupsFile.CHECKSUM_PLACEHOLDER}"${code.slice(htmlTag.close)}`;
+    const censusTag = `<script id="__CSSZYX_MANGLE_MAP__" type="application/json" dangerouslySetInnerHTML={{__html: \`${themeGroupsFile.CENSUS_PLACEHOLDER}\`}} />`;
     const bodyTag = findOpeningTag(transformedCode, "body");
     if (bodyTag) {
-      transformedCode = `${transformedCode.slice(0, bodyTag.close + 1)}${debugScript}${transformedCode.slice(bodyTag.close + 1)}`;
+      transformedCode = `${transformedCode.slice(0, bodyTag.close + 1)}${censusTag}${transformedCode.slice(bodyTag.close + 1)}`;
     }
     return transformedCode;
   }
@@ -4207,12 +4375,22 @@ ${transformedCode}`;
     if (activeFramework !== "vite" && activeFramework !== "rollup") {
       return null;
     }
-    if (!manglingEnabled || !deliverMapInBundle || !shouldProcessSource(id) || !MANGLE_RUNTIME_CONSUMER_RE.test(transformedCode) || transformedCode.includes(themeGroupsFile.MANGLE_RUNTIME_VIRTUAL_ID)) {
+    if (!manglingEnabled || !shouldProcessSource(id) || !MANGLE_RUNTIME_CONSUMER_RE.test(transformedCode) || transformedCode.includes(themeGroupsFile.MANGLE_RUNTIME_VIRTUAL_ID)) {
       return null;
     }
     return insertRuntimeImport(transformedCode, `import '${themeGroupsFile.MANGLE_RUNTIME_VIRTUAL_ID}';
 `);
   }
+  function applyWebpackMangleRuntimeEntry(compiler) {
+    const root = compiler.context;
+    const file = ensureMangleRuntimeFile(
+      path__namespace.join(root, ".csszyx"),
+      globalVarAliasPrefix,
+      options.production?.mangleDebugGlobal === true
+    );
+    if (file === null) return;
+    applyMangleRuntimeEntry(compiler, root, file, () => sizeAccount.channels.add("bundle"));
+  }
   function collectPreTransformClasses(output) {
     if (!output.transformed && !output.code.includes("class=") && !output.code.includes("className=")) {
       return null;
@@ -4278,7 +4456,10 @@ ${transformedCode}`;
         }
         if (id === themeGroupsFile.RESOLVED_MANGLE_RUNTIME_VIRTUAL_ID) {
           sizeAccount.channels.add("bundle");
-          return themeGroupsFile.createMangleRuntimeModule(globalVarAliasPrefix);
+          return themeGroupsFile.createMangleRuntimeModule(
+            globalVarAliasPrefix,
+            options.production?.mangleDebugGlobal === true
+          );
         }
         if (id === themeGroupsFile.RESOLVED_THEME_GROUPS_VIRTUAL_ID) {
           return themeGroupsFile.createThemeGroupsModule(themeGroupTokens());
@@ -4356,8 +4537,10 @@ ${transformedCode}`;
         }
         if (matchesScriptExtension(id, SCRIPT_ID_EXTENSIONS)) {
           assertNoRSCBoundaryViolation(output.code, id);
-          const record = createRSCModuleRecord(output.code, id);
-          state.rscModules.set(record.id, record);
+          if (!skipRscRecords) {
+            const record = createRSCModuleRecord(output.code, id);
+            state.rscModules.set(record.id, record);
+          }
         }
         return collectPreTransformClasses(output);
       },
@@ -4434,10 +4617,8 @@ ${transformedCode}`;
         if (compiler.options?.mode === "development") {
           manglingEnabled = false;
         }
-        if (manglingEnabled && mangleMapDelivery !== "both") {
-          console.warn(
-            `[csszyx] production.mangleMapDelivery: '${mangleMapDelivery}' has no effect on the webpack lane \u2014 map delivery only narrows on vite/rollup builds.`
-          );
+        if (manglingEnabled) {
+          applyWebpackMangleRuntimeEntry(compiler);
         }
         compiler.hooks.beforeCompile.tap("csszyx:prescan", () => {
           announceActiveParser();
@@ -4496,6 +4677,7 @@ ${transformedCode}`;
           }
           evictTransformCacheOnce();
           prescanAndWriteClasses();
+          skipRscRecords = config.command === "build" && !config.build?.watch && !prescanSawServerModule;
           state.scanCssTheme = runThemeScan(root, options.build?.scanCss) ?? state.scanCssTheme;
           runAutoThemeScan(root);
           if (config.command === "build") {
@@ -4509,11 +4691,36 @@ ${transformedCode}`;
         },
         /**
          * Vite HMR hook: re-runs theme scan when a watched CSS file changes,
-         * and incrementally updates csszyx-classes.html when a source file gains new sz classes.
-         * @param ctx - HMR context containing the changed file
+         * and incrementally updates the safelist when a source file gains new sz classes.
+         *
+         * `hotUpdate` rather than `handleHotUpdate` because the safelist
+         * can arrive as a CREATE. `writeSafelistFile` returns early on an
+         * empty class set, so a project with no `sz` at prescan has no
+         * safelist file, and the first `sz` edit makes one. Vite routes a
+         * create to `hotUpdate` only — its `handleHotUpdate` branch runs
+         * for `type === 'update'` and nothing else — so the legacy hook
+         * left that one event to `@tailwindcss/vite`, which answers a
+         * scanned file whose only modules are asset nodes with an
+         * unaddressed `full-reload`.
+         *
+         * @param this - Vite's plugin context for the pass being run.
+         * @param this.environment - The environment this pass belongs to,
+         * absent when a host calls the hook without one.
+         * @param this.environment.name - `client` for the pass that owns
+         * the page; `ssr` and any custom environment follow it.
+         * @param this.environment.moduleGraph - That environment's own
+         * graph, the one Vite replaces with this hook's answer.
+         * @param ctx - HMR context: the changed file, why it changed, and
+         * the dev server.
+         * @returns The modules a safelist write affects, so Vite hot-updates
+         * the stylesheet instead of reloading the page; undefined otherwise,
+         * which leaves Vite's own handling in place.
          */
-        handleHotUpdate(ctx) {
-          prescanResultHandoff.clear();
+        hotUpdate(ctx) {
+          const isClientPass = (this.environment?.name ?? "client") === "client";
+          if (isClientPass) {
+            prescanResultHandoff.clear();
+          }
           const scanCss = options.build?.scanCss;
           const reloadThemeGroupsModule = () => {
             const themeGroupsModule = ctx.server.moduleGraph.getModuleById(
@@ -4523,7 +4730,7 @@ ${transformedCode}`;
               ctx.server.moduleGraph.invalidateModule(themeGroupsModule);
             }
           };
-          if (ctx.file.endsWith(".css")) {
+          if (isClientPass && ctx.file.endsWith(".css")) {
             const root = ctx.server.config.root || process.cwd();
             const before = themeGroupsFile.createThemeGroupsModule(themeGroupTokens());
             if (scanCss && matchesAnyPattern(ctx.file, scanCss, root)) {
@@ -4535,59 +4742,13 @@ ${transformedCode}`;
               ctx.server.ws.send({ type: "full-reload" });
             }
           }
-          if (!shouldProcessSource(ctx.file)) {
-            return;
-          }
-          let fileContent, result;
-          try {
-            fileContent = fs__namespace.readFileSync(ctx.file, "utf-8");
-          } catch {
-            refreshSzvRegistryEntry(ctx.file, null);
-            return;
-          }
-          refreshSzvRegistryEntry(ctx.file, fileContent);
-          if (!fileContent.includes("sz=") && !fileContent.includes("szs=") && !/\bsz\s*:\s*["'{]/.test(fileContent)) {
-            trackGlobalVarSourceFile(ctx.file, fileContent);
-            recordFileVarMangleEntries(state, ctx.file, []);
-            recordFileCSSVariableMetrics(state, ctx.file, null);
-            return;
-          }
-          try {
-            const hmrTransformStarted = node_perf_hooks.performance.now();
-            result = transformConfiguredSource(fileContent, ctx.file);
-            traceBenchTiming(
-              "handle-hot-update",
-              ctx.file,
-              node_perf_hooks.performance.now() - hmrTransformStarted
+          if (safelistSource.normalizePathSeparators(ctx.file) === safelistSource.normalizePathSeparators(path__namespace.join(state.rootDir, SAFELIST_FILENAME))) {
+            return tailwindEntryModules(
+              this.environment?.moduleGraph ?? ctx.server.environments.client.moduleGraph
             );
-          } catch {
-            trackGlobalVarSourceFile(ctx.file, fileContent);
-            recordFileVarMangleEntries(state, ctx.file, []);
-            recordFileCSSVariableMetrics(state, ctx.file, null);
-            return;
-          }
-          if (!result.transformed) {
-            trackGlobalVarSourceFile(ctx.file, fileContent);
-            recordFileVarMangleEntries(state, ctx.file, []);
-            recordFileCSSVariableMetrics(state, ctx.file, null);
-            return;
-          }
-          const sizeBefore = state.classes.size;
-          trackGlobalVarSourceFile(ctx.file, fileContent);
-          for (const cls of result.classes) {
-            addSafelistClass(cls);
-            state.ownedClasses.add(cls);
-          }
-          recordFileVarMangleEntries(state, ctx.file, cssVariableEntries(result));
-          recordFileCSSVariableMetrics(state, ctx.file, result.code);
-          for (const [token, data] of result.recoveryTokens) {
-            state.recoveryTokens.set(token, data);
-          }
-          if (state.classes.size > sizeBefore) {
-            writeSafelistFile(state.classes);
-            const safelistPath = path__namespace.join(state.rootDir, SAFELIST_FILENAME);
-            ctx.server.watcher.emit("change", safelistPath);
           }
+          if (isClientPass) discoverHotFileClasses(ctx.file, ctx.server.watcher);
+          return void 0;
         },
         transformIndexHtml: {
           order: "pre",
@@ -4601,13 +4762,11 @@ ${transformedCode}`;
             finalizeMangleMap();
             const injectedMangleMap = manglingEnabled ? state.mangleMap : {};
             let result = transformIndexHtml(html, injectedMangleMap, state.checksum, {
-              // Always 'script'; the checksum itself is injected by
-              // injectHydrationData regardless of this mode.
+              // Always 'script' — the inert JSON census; the
+              // checksum attribute is injected regardless.
               mode: "script",
               minify: process.env.NODE_ENV === "production",
-              varMangleMap: state.varMangleMap,
-              globalVarAliasPrefix,
-              installRuntimeObject: deliverMapInHtml
+              varMangleMap: state.varMangleMap
             });
             if (manglingEnabled) {
               sizeAccount.channels.add("html");
@@ -4628,6 +4787,18 @@ ${transformedCode}`;
               }
               result = injectRecoveryManifest(result, manifest);
             }
+            if (needsRuntimeMangleRegistration(manglingEnabled, injectedMangleMap)) {
+              return {
+                html: result,
+                tags: [
+                  {
+                    tag: "script",
+                    attrs: { type: "module", src: themeGroupsFile.MANGLE_RUNTIME_VIRTUAL_ID },
+                    injectTo: "head-prepend"
+                  }
+                ]
+              };
+            }
             return result;
           }
         }
@@ -4980,17 +5151,14 @@ const esbuildPlugin = (options = {}) => {
 };
 
 exports.allocateMangleTokens = allocateMangleTokens;
-exports.appendTailwindSourceDirective = appendTailwindSourceDirective;
 exports.assertNoRSCBoundaryViolation = assertNoRSCBoundaryViolation;
 exports.assertNoRSCGraphViolation = assertNoRSCGraphViolation;
 exports.collectMangleHybridHazards = collectMangleHybridHazards;
-exports.computeSafelistRelPath = computeSafelistRelPath;
 exports.createGlobalVarAliasValidationOptions = createGlobalVarAliasValidationOptions;
 exports.createGlobalVarMapAssetSource = createGlobalVarMapAssetSource;
 exports.createGlobalVarScanCacheKey = createGlobalVarScanCacheKey;
 exports.createRSCModuleRecord = createRSCModuleRecord;
 exports.cssHasContentScope = cssHasContentScope;
-exports.cssImportsTailwind = cssImportsTailwind;
 exports.deleteRSCModuleRecord = deleteRSCModuleRecord;
 exports.emitMissingCssFallback = emitMissingCssFallback;
 exports.esbuildPlugin = esbuildPlugin;