@jesscss/plugin-js 2.0.0-alpha.7 → 2.0.0-alpha.9

package/README.md

@@ -1,6 +1,50 @@
 # @jesscss/plugin-js
 
-Jess plugin that enables JavaScript/TypeScript module imports.
+**Import bridge for JavaScript/TypeScript modules in stylesheets — a seed of the
+JavaScript-execution / CSS-in-JS story.**
 
-This package checks for a usable Deno runtime before executing non-`@jesscss/fns`
-modules. It is intended to be auto-loaded by `jess` when installed.
+This plugin lets a stylesheet pull in JavaScript/TypeScript modules
+(`.js`, `.mjs`, `.cjs`, `.ts`, `.mts`, `.cts`) — the mechanism behind `@use` /
+`@-from` script imports and legacy Less `@plugin` loading. When installed, it is
+auto-loaded by `jess`.
+
+## Sandboxed execution
+
+`plugin-js` does **not** run untrusted module code in your Node process. Before
+executing anything, it checks for a usable **Deno** runtime (`deno --version`)
+and runs the module in a Deno subprocess behind a permission broker:
+
+- **read** is limited to `node_modules` (and an optional `jsReadRoot`),
+- **net** is denied unless you opt in (`allowHttp`, optionally scoped to
+  `allowNetHosts`),
+- **env / write / run / ffi / sys** are denied outright.
+
+Values cross the boundary through a small typed bridge (dimensions, colors,
+quoted strings, lists, detached rules, …). Built-in `@jesscss/fns` modules are
+trusted and imported directly, without the worker. If no Deno binary is found,
+the plugin fails with a clear message instead of falling back to unsandboxed
+execution.
+
+## Why it exists — the convergence angle
+
+One of the four tools [Jess](https://github.com/jesscss/jess) aims to converge is
+**CSS-in-JS**: running real JavaScript inside stylesheets so styles can be
+dynamic without leaving CSS files. This plugin — together with
+[`@jesscss/plugin-node-modules`](../jess-plugin-node-modules), which resolves the
+packages — is a seed of that story.
+
+That convergence is **roadmap — being proven through the alpha, not claimed as
+done.** Legacy Less `@plugin` is supported for compatibility but deprecated in
+favor of `@-from` / `@-use`.
+
+## Status
+
+**Alpha.** Part of Jess. Requires a Deno runtime for script execution. The
+programmatic plugin/compiler API is **not yet stabilized** — the `jess` CLI is
+the documented public surface for the alpha. Watch the
+[docs site](https://jesscss.github.io/) for the API once it settles.
+
+- Project overview & positioning: <https://github.com/jesscss/jess#readme>
+- Docs: <https://jesscss.github.io/> (currently pre-alpha content)
+- Issues: <https://github.com/jesscss/jess/issues>
+- License: MIT

package/lib/bridge.d.ts

@@ -16,17 +16,12 @@ export type JsBridgeValue = {
     kind: 'color';
     rgb: [number, number, number];
     alpha?: number;
-    format?: string;
 } | {
     __jessBridge: true;
     kind: 'quoted';
     value: string;
     quote?: '"' | '\'';
     escaped?: boolean;
-} | {
-    __jessBridge: true;
-    kind: 'keyword';
-    value: string;
 } | {
     __jessBridge: true;
     kind: 'anonymous';
@@ -35,17 +30,17 @@ export type JsBridgeValue = {
     __jessBridge: true;
     kind: 'list';
     items: JsBridgeValue[];
-    separator?: ',' | ';' | '/';
+    separator: ',' | '/' | ';';
 } | {
     __jessBridge: true;
-    kind: 'sequence';
+    kind: 'expression';
     items: JsBridgeValue[];
 } | {
     __jessBridge: true;
-    kind: 'detached';
+    kind: 'mixin';
     rules: JsBridgeDeclaration[];
 };
 export declare function encodeBridgeValue(value: unknown): unknown;
 export declare function decodeBridgeValue(value: unknown): unknown;
-export declare function encodeBridgeArgs(args: unknown[]): unknown[];
+export declare function encodeBridgeArgs(args: readonly unknown[]): unknown[];
 //# sourceMappingURL=bridge.d.ts.map

package/lib/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,aAAa,GACrB;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;CAAE,GACxE;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrG;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5F;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;CAAE,GACzF;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE,GAChE;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AAqC3E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAmEzD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA+BzD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAE3D"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,aAAa,GACrB;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;CAAE,GACxE;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5F;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;CAAE,GACxF;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE,GAClE;IAAE,YAAY,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AAiGxE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA8BzD;AAqCD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE,CAEpE"}

package/lib/index.cjs

@@ -33,100 +33,198 @@ let node_path = require("node:path");
 node_path = __toESM(node_path);
 let node_url = require("node:url");
 let node_child_process = require("node:child_process");
+let _jesscss_core_value = require("@jesscss/core/value");
 //#region src/bridge.ts
-const isBridgeValue = (value) => typeof value === "object" && value !== null && value.__jessBridge === true && typeof value.kind === "string";
-const colorFormatFromString = (value) => {
-	if (!value) return;
-	if (value in _jesscss_core.ColorFormat) return _jesscss_core.ColorFormat[value];
-	if (Object.values(_jesscss_core.ColorFormat).includes(value)) return value;
-};
+const isRecord = (value) => typeof value === "object" && value !== null;
+const isBridgeValue = (value) => isRecord(value) && value.__jessBridge === true && typeof value.kind === "string";
+const isValueObj = (value) => isRecord(value) && typeof value.type === "string" && typeof value.bytes === "string";
+const isDetached = (value) => isRecord(value) && value.type === "DetachedRuleset" && Array.isArray(value.rules);
 function encodeBridgeChildValue(value) {
 	const encoded = encodeBridgeValue(value);
 	if (isBridgeValue(encoded)) return encoded;
 	return {
 		__jessBridge: true,
 		kind: "scalar",
-		value: typeof encoded === "string" || typeof encoded === "number" || typeof encoded === "boolean" ? encoded : String(encoded)
+		value: String(encoded)
 	};
 }
+function encodeFacadeValue(value) {
+	switch (value.type) {
+		case "Dimension": return typeof value.value === "number" ? {
+			__jessBridge: true,
+			kind: "dimension",
+			value: value.value,
+			unit: typeof value.unit === "string" ? value.unit : void 0
+		} : void 0;
+		case "Color": return Array.isArray(value.rgb) && value.rgb.length === 3 ? {
+			__jessBridge: true,
+			kind: "color",
+			rgb: [
+				value.rgb[0],
+				value.rgb[1],
+				value.rgb[2]
+			],
+			alpha: typeof value.alpha === "number" ? value.alpha : void 0
+		} : void 0;
+		case "Quoted": return typeof value.value === "string" ? {
+			__jessBridge: true,
+			kind: "quoted",
+			value: value.value,
+			quote: value.quote === "'" ? "'" : "\"",
+			escaped: value.escaped === true
+		} : void 0;
+		case "Anonymous":
+		case "Keyword": return typeof value.value === "string" ? {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.value
+		} : void 0;
+		case "Expression": return Array.isArray(value.value) ? {
+			__jessBridge: true,
+			kind: "expression",
+			items: value.value.map(encodeBridgeChildValue)
+		} : void 0;
+		case "Value": return Array.isArray(value.value) ? {
+			__jessBridge: true,
+			kind: "list",
+			items: value.value.map(encodeBridgeChildValue),
+			separator: value.separator === "/" || value.separator === ";" ? value.separator : ","
+		} : void 0;
+		case "Mixin": {
+			const ruleset = value.ruleset;
+			if (!isRecord(ruleset) || !Array.isArray(ruleset.rules)) return;
+			const rules = [];
+			for (const rule of ruleset.rules) {
+				if (!isRecord(rule)) continue;
+				if (rule.type === "Declaration" && typeof rule.name === "string") rules.push({
+					name: rule.name,
+					value: encodeBridgeChildValue(rule.value)
+				});
+			}
+			return {
+				__jessBridge: true,
+				kind: "mixin",
+				rules
+			};
+		}
+		default: return;
+	}
+}
 function encodeBridgeValue(value) {
-	if (value instanceof _jesscss_core.Dimension) return {
-		__jessBridge: true,
-		kind: "dimension",
-		value: value.number,
-		unit: value.unit
-	};
-	if (value instanceof _jesscss_core.Color) return {
-		__jessBridge: true,
-		kind: "color",
-		rgb: value.rgb,
-		alpha: value.alpha,
-		format: value.options.format === void 0 ? void 0 : _jesscss_core.ColorFormat[value.options.format]
-	};
-	if (value instanceof _jesscss_core.Quoted) return {
+	if (Array.isArray(value)) return {
 		__jessBridge: true,
-		kind: "quoted",
-		value: String(value.value),
-		quote: value.quote,
-		escaped: value.escaped
+		kind: "expression",
+		items: value.map(encodeBridgeChildValue)
 	};
-	if (value instanceof _jesscss_core.Any) return {
-		__jessBridge: true,
-		kind: value.role === "keyword" ? "keyword" : "anonymous",
-		value: value.value
-	};
-	if (value instanceof _jesscss_core.List) return {
-		__jessBridge: true,
-		kind: "list",
-		items: value.value.map(encodeBridgeChildValue),
-		separator: value.options.sep
-	};
-	if (value instanceof _jesscss_core.Sequence) return {
-		__jessBridge: true,
-		kind: "sequence",
-		items: value.value.map(encodeBridgeChildValue)
-	};
-	if (value instanceof _jesscss_core.Rules) {
-		const rules = [];
-		for (const rule of value.rules ?? []) if (rule instanceof _jesscss_core.Declaration && typeof rule.name === "string") rules.push({
-			name: rule.name,
-			value: encodeBridgeChildValue(rule.value)
-		});
-		return {
+	if (isValueObj(value)) switch (value.type) {
+		case "Dimension": return {
+			__jessBridge: true,
+			kind: "dimension",
+			value: value.number,
+			unit: value.unit
+		};
+		case "Color": return {
+			__jessBridge: true,
+			kind: "color",
+			rgb: [
+				value.rgb[0],
+				value.rgb[1],
+				value.rgb[2]
+			],
+			alpha: value.alpha
+		};
+		case "Quoted": return {
+			__jessBridge: true,
+			kind: "quoted",
+			value: value.value,
+			quote: value.quote === "'" ? "'" : "\"",
+			escaped: value.escaped
+		};
+		case "List": return value.sep === "," || value.sep === "/" ? {
+			__jessBridge: true,
+			kind: "list",
+			items: value.value.map(encodeBridgeChildValue),
+			separator: value.sep
+		} : {
 			__jessBridge: true,
-			kind: "detached",
-			rules
+			kind: "anonymous",
+			value: value.bytes
+		};
+		case "Block": return {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
+		};
+		default: return {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
 		};
 	}
+	if (isDetached(value)) return {
+		__jessBridge: true,
+		kind: "mixin",
+		rules: value.rules.map((rule) => ({
+			name: rule.name,
+			value: encodeBridgeChildValue(rule.value)
+		}))
+	};
+	if (isRecord(value)) return encodeFacadeValue(value) ?? value;
 	return value;
 }
-function decodeBridgeValue(value) {
-	if (!isBridgeValue(value)) return value;
+function decodeValue(value) {
 	switch (value.kind) {
-		case "scalar": return new _jesscss_core.Any(String(value.value));
-		case "dimension": return new _jesscss_core.Dimension({
-			number: value.value,
-			unit: value.unit
-		});
-		case "color": return new _jesscss_core.Color({
-			rgb: value.rgb,
-			alpha: value.alpha
-		}, { format: colorFormatFromString(value.format) });
-		case "quoted": return new _jesscss_core.Quoted(value.value, {
-			quote: value.quote,
-			escaped: value.escaped
-		});
-		case "keyword": return new _jesscss_core.Any(value.value, { role: "keyword" });
-		case "anonymous": return new _jesscss_core.Any(value.value);
-		case "list": return new _jesscss_core.List(value.items.map((item) => decodeBridgeValue(item)), { sep: value.separator });
-		case "sequence": return new _jesscss_core.Sequence(value.items.map((item) => decodeBridgeValue(item)));
+		case "scalar": return (0, _jesscss_core_value.makeKeyword)(String(value.value));
+		case "dimension": return (0, _jesscss_core_value.makeDimension)(value.value, value.unit ?? "");
+		case "color": return (0, _jesscss_core_value.makeColorRgb)(value.rgb, value.alpha ?? 1, _jesscss_core_value.RGB);
+		case "quoted": return (0, _jesscss_core_value.makeQuoted)(value.value, value.quote ?? "\"", value.escaped === true);
+		case "anonymous": return (0, _jesscss_core_value.makeKeyword)(value.value);
+		case "expression": return value.items.map(decodeValue);
+		case "list": return (0, _jesscss_core_value.makeList)(value.items.map(decodeValue), value.separator === ";" ? "," : value.separator);
+		case "mixin": return (0, _jesscss_core_value.makeKeyword)("");
 	}
 }
+function decodeMixin(value) {
+	const nil = {
+		type: "Nil",
+		value: ""
+	};
+	const mixin = {
+		type: "Mixin",
+		name: nil,
+		args: nil,
+		ruleset: { rules: value.rules.map((rule) => ({
+			type: "Declaration",
+			name: rule.name,
+			value: decodeValue(rule.value),
+			eval() {
+				return this;
+			}
+		})) },
+		eval() {
+			return mixin;
+		}
+	};
+	return mixin;
+}
+function decodeBridgeValue(value) {
+	if (!isBridgeValue(value)) return value;
+	return value.kind === "mixin" ? decodeMixin(value) : decodeValue(value);
+}
 function encodeBridgeArgs(args) {
 	return args.map(encodeBridgeValue);
 }
 //#endregion
 //#region src/index.ts
+/**
+* Child-process stdio streams are typed as bare `Writable`/`Readable`, which do
+* not declare `unref`, but the underlying pipe sockets expose it at runtime.
+* The optional structural member lets any stream be passed without an unsafe
+* cast; the runtime `?.` guard covers streams that genuinely lack the method.
+*/
+const unrefStream = (stream) => {
+	if (typeof stream === "object" && stream !== null && "unref" in stream && typeof stream.unref === "function") stream.unref();
+};
 const SCRIPT_EXTENSIONS = new Set([
 	".js",
 	".mjs",
@@ -144,6 +242,33 @@ const RUNTIME_MISSING_MESSAGE = [
 const BOOT_TIMEOUT_MS = 8e3;
 const REQUEST_TIMEOUT_MS = 1e4;
 const IDLE_SHUTDOWN_MS = 5e3;
+/**
+* Environment variables that inject a Node.js debugger/inspector bootloader
+* into child processes (VS Code / Cursor "Auto Attach", `node --inspect`, etc.).
+*
+* These must never leak into the sandboxed Deno worker: the injected bootloader
+* tries to read the environment, the Jess Deno sandbox denies `env` permission,
+* and the worker never signals ready — producing a spurious
+* "Timed out waiting for Deno worker startup" failure. Deno does not use any of
+* these vars, so stripping them is safe.
+*/
+const DEBUG_ENV_KEY_RE = /^(NODE_OPTIONS|NODE_INSPECT|VSCODE_INSPECTOR_OPTIONS)/i;
+const DEBUG_ENV_VALUE_RE = /js-debug|bootloader/i;
+/**
+* Returns a copy of `env` with Node debugger/inspector-attach variables removed,
+* so a spawned Deno subprocess starts regardless of the parent's debug env.
+* The Deno permission sandbox is untouched; this only stops leaking the debugger
+* into it.
+*/
+const sanitizeSpawnEnv = (env = process.env) => {
+	const clean = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (DEBUG_ENV_KEY_RE.test(key)) continue;
+		if (typeof value === "string" && DEBUG_ENV_VALUE_RE.test(value)) continue;
+		clean[key] = value;
+	}
+	return clean;
+};
 const isPathInside = (candidatePath, rootPath) => {
 	const rel = node_path.relative(rootPath, candidatePath);
 	return rel === "" || !rel.startsWith("..") && !node_path.isAbsolute(rel);
@@ -227,7 +352,10 @@ var JsPlugin = class JsPlugin extends _jesscss_core.AbstractPlugin {
 		this.idleTimer.unref?.();
 	}
 	ensureRuntimeAvailable() {
-		if ((0, node_child_process.spawnSync)(this.opts.denoCommand ?? "deno", ["--version"], { stdio: "ignore" }).status !== 0) throw new Error(RUNTIME_MISSING_MESSAGE);
+		if ((0, node_child_process.spawnSync)(this.opts.denoCommand ?? "deno", ["--version"], {
+			stdio: "ignore",
+			env: sanitizeSpawnEnv(process.env)
+		}).status !== 0) throw new Error(RUNTIME_MISSING_MESSAGE);
 	}
 	ensureRuntime() {
 		if (this.runtimeState.status === "ready") {
@@ -354,15 +482,15 @@ var JsPlugin = class JsPlugin extends _jesscss_core.AbstractPlugin {
 				"pipe"
 			],
 			env: {
-				...process.env,
+				...sanitizeSpawnEnv(process.env),
 				DENO_PERMISSION_BROKER_PATH: socketPath
 			}
 		});
 		this.worker = child;
 		child.unref();
-		child.stdin.unref?.();
-		child.stdout.unref?.();
-		child.stderr.unref?.();
+		unrefStream(child.stdin);
+		unrefStream(child.stdout);
+		unrefStream(child.stderr);
 		child.stdout.setEncoding("utf8");
 		child.stderr.setEncoding("utf8");
 		child.stdout.on("data", (chunk) => this.onWorkerStdout(chunk));
@@ -548,7 +676,7 @@ var JsPlugin = class JsPlugin extends _jesscss_core.AbstractPlugin {
 	* @deprecated Less `@plugin` is deprecated. Prefer `@-from` for
 	* ESM-style script imports or `@-use` for Sass-module-style namespace imports.
 	*/
-	async importLessPlugin(absoluteFilePath) {
+	async importLessPlugin(absoluteFilePath, options = null) {
 		const ext = node_path.extname(absoluteFilePath);
 		if (!SCRIPT_EXTENSIONS.has(ext)) throw new Error(`Plugin "${this.name}" cannot import Less plugin "${absoluteFilePath}"`);
 		this.assertAllowedPath(absoluteFilePath);
@@ -556,7 +684,8 @@ var JsPlugin = class JsPlugin extends _jesscss_core.AbstractPlugin {
 		const modulePath = node_path.resolve(absoluteFilePath);
 		const loadResult = await this.callWorker({
 			type: "loadLessPlugin",
-			modulePath
+			modulePath,
+			options
 		});
 		if (!loadResult.ok) throw new Error(loadResult.error);
 		const functions = {};
@@ -564,6 +693,7 @@ var JsPlugin = class JsPlugin extends _jesscss_core.AbstractPlugin {
 			const invokeResult = await this.callWorker({
 				type: "invokeLessPluginFunction",
 				modulePath,
+				options,
 				functionName,
 				args: encodeBridgeArgs(args)
 			});
@@ -572,6 +702,10 @@ var JsPlugin = class JsPlugin extends _jesscss_core.AbstractPlugin {
 		};
 		return { functions };
 	}
+	/** Context-facing executable-plugin capability used by the direct AST path. */
+	async importPlugin(absoluteFilePath, options = null) {
+		return this.importLessPlugin(absoluteFilePath, options);
+	}
 };
 /**
 * Global flag set when @jesscss/plugin-js is loaded.
@@ -587,3 +721,4 @@ exports.JESS_PLUGIN_JS_GLOBAL = JESS_PLUGIN_JS_GLOBAL;
 exports.JsPlugin = JsPlugin;
 exports.__toESM = __toESM;
 exports.default = jsPlugin;
+exports.sanitizeSpawnEnv = sanitizeSpawnEnv;

package/lib/index.d.ts

@@ -14,6 +14,13 @@ export interface JsPluginOptions extends JavaScriptSandboxConfig {
      */
     runtimeApi?: 'module' | 'less';
 }
+/**
+ * Returns a copy of `env` with Node debugger/inspector-attach variables removed,
+ * so a spawned Deno subprocess starts regardless of the parent's debug env.
+ * The Deno permission sandbox is untouched; this only stops leaking the debugger
+ * into it.
+ */
+export declare const sanitizeSpawnEnv: (env?: NodeJS.ProcessEnv) => NodeJS.ProcessEnv;
 export declare class JsPlugin extends AbstractPlugin {
     opts: JsPluginOptions;
     private static cleanupRegistered;
@@ -56,7 +63,11 @@ export declare class JsPlugin extends AbstractPlugin {
      * @deprecated Less `@plugin` is deprecated. Prefer `@-from` for
      * ESM-style script imports or `@-use` for Sass-module-style namespace imports.
      */
-    importLessPlugin(absoluteFilePath: string): Promise<{
+    importLessPlugin(absoluteFilePath: string, options?: string | null): Promise<{
+        functions: Record<string, (...args: unknown[]) => Promise<unknown>>;
+    }>;
+    /** Context-facing executable-plugin capability used by the direct AST path. */
+    importPlugin(absoluteFilePath: string, options?: string | null): Promise<{
         functions: Record<string, (...args: unknown[]) => Promise<unknown>>;
     }>;
 }

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,cAAc,EACf,MAAM,eAAe,CAAC;AAQvB,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,eAAgB,SAAQ,uBAAuB;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAChC;AA8GD,qBAAa,QAAS,SAAQ,cAAc;IAoBvB,IAAI,EAAE,eAAe;IAnBxC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAS;IACzC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAuB;IACnD,IAAI,SAAQ;IACZ,mBAAmB,WAAiC;IACpD,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAAyB;IAC7C,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,OAAO,CAIV;IAEL,OAAO,CAAC,SAAS,CAA6B;gBAE3B,IAAI,GAAE,eAAoB;IAM7C,OAAO;IAIP,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAkBrC,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,sBAAsB;IAU9B,OAAO,CAAC,aAAa;IA4BrB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,mBAAmB;YA0Bb,WAAW;IA8CzB,OAAO,CAAC,WAAW;YAwFL,YAAY;IAW1B,OAAO,CAAC,cAAc;IAiCtB,OAAO,CAAC,gBAAgB;YAQV,UAAU;IAwBxB,OAAO,CAAC,QAAQ;IA0BhB,OAAO;IAMP,OAAO,CAAC,iBAAiB;IAgBnB,MAAM,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IA+CpE;;;;;OAKG;IACG,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;CA6BnI;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAOpE,QAAA,MAAM,QAAQ,UAAY,eAAe,aAEtB,CAAC;AAEpB,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,cAAc,EACf,MAAM,eAAe,CAAC;AAyBvB,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,eAAgB,SAAQ,uBAAuB;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAChC;AAmCD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAK,MAAM,CAAC,UAAwB,KACnC,MAAM,CAAC,UAYT,CAAC;AA0FF,qBAAa,QAAS,SAAQ,cAAc;IAoBvB,IAAI,EAAE,eAAe;IAnBxC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAS;IACzC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAuB;IACnD,IAAI,SAAQ;IACZ,mBAAmB,WAAiC;IACpD,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAAyB;IAC7C,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,OAAO,CAIV;IAEL,OAAO,CAAC,SAAS,CAA6B;gBAE3B,IAAI,GAAE,eAAoB;IAM7C,OAAO;IAIP,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAkBrC,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,aAAa;IA4BrB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,mBAAmB;YA0Bb,WAAW;IA8CzB,OAAO,CAAC,WAAW;YAwFL,YAAY;IAW1B,OAAO,CAAC,cAAc;IAiCtB,OAAO,CAAC,gBAAgB;YAQV,UAAU;IAwBxB,OAAO,CAAC,QAAQ;IA0BhB,OAAO;IAMP,OAAO,CAAC,iBAAiB;IAgBnB,MAAM,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IA+CpE;;;;;OAKG;IACG,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IA+BjK,+EAA+E;IACzE,YAAY,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;CAG9J;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAOpE,QAAA,MAAM,QAAQ,UAAY,eAAe,aAEtB,CAAC;AAEpB,eAAe,QAAQ,CAAC"}

package/lib/index.js

@@ -1,103 +1,201 @@
-import { AbstractPlugin, Any, Color, ColorFormat, Declaration, Dimension, List, Quoted, Rules, Sequence } from "@jesscss/core";
+import { AbstractPlugin } from "@jesscss/core";
 import * as fs from "node:fs";
 import * as net from "node:net";
 import * as path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
+import { RGB, makeColorRgb, makeDimension, makeKeyword, makeList, makeQuoted } from "@jesscss/core/value";
 //#region src/bridge.ts
-const isBridgeValue = (value) => typeof value === "object" && value !== null && value.__jessBridge === true && typeof value.kind === "string";
-const colorFormatFromString = (value) => {
-	if (!value) return;
-	if (value in ColorFormat) return ColorFormat[value];
-	if (Object.values(ColorFormat).includes(value)) return value;
-};
+const isRecord = (value) => typeof value === "object" && value !== null;
+const isBridgeValue = (value) => isRecord(value) && value.__jessBridge === true && typeof value.kind === "string";
+const isValueObj = (value) => isRecord(value) && typeof value.type === "string" && typeof value.bytes === "string";
+const isDetached = (value) => isRecord(value) && value.type === "DetachedRuleset" && Array.isArray(value.rules);
 function encodeBridgeChildValue(value) {
 	const encoded = encodeBridgeValue(value);
 	if (isBridgeValue(encoded)) return encoded;
 	return {
 		__jessBridge: true,
 		kind: "scalar",
-		value: typeof encoded === "string" || typeof encoded === "number" || typeof encoded === "boolean" ? encoded : String(encoded)
+		value: String(encoded)
 	};
 }
+function encodeFacadeValue(value) {
+	switch (value.type) {
+		case "Dimension": return typeof value.value === "number" ? {
+			__jessBridge: true,
+			kind: "dimension",
+			value: value.value,
+			unit: typeof value.unit === "string" ? value.unit : void 0
+		} : void 0;
+		case "Color": return Array.isArray(value.rgb) && value.rgb.length === 3 ? {
+			__jessBridge: true,
+			kind: "color",
+			rgb: [
+				value.rgb[0],
+				value.rgb[1],
+				value.rgb[2]
+			],
+			alpha: typeof value.alpha === "number" ? value.alpha : void 0
+		} : void 0;
+		case "Quoted": return typeof value.value === "string" ? {
+			__jessBridge: true,
+			kind: "quoted",
+			value: value.value,
+			quote: value.quote === "'" ? "'" : "\"",
+			escaped: value.escaped === true
+		} : void 0;
+		case "Anonymous":
+		case "Keyword": return typeof value.value === "string" ? {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.value
+		} : void 0;
+		case "Expression": return Array.isArray(value.value) ? {
+			__jessBridge: true,
+			kind: "expression",
+			items: value.value.map(encodeBridgeChildValue)
+		} : void 0;
+		case "Value": return Array.isArray(value.value) ? {
+			__jessBridge: true,
+			kind: "list",
+			items: value.value.map(encodeBridgeChildValue),
+			separator: value.separator === "/" || value.separator === ";" ? value.separator : ","
+		} : void 0;
+		case "Mixin": {
+			const ruleset = value.ruleset;
+			if (!isRecord(ruleset) || !Array.isArray(ruleset.rules)) return;
+			const rules = [];
+			for (const rule of ruleset.rules) {
+				if (!isRecord(rule)) continue;
+				if (rule.type === "Declaration" && typeof rule.name === "string") rules.push({
+					name: rule.name,
+					value: encodeBridgeChildValue(rule.value)
+				});
+			}
+			return {
+				__jessBridge: true,
+				kind: "mixin",
+				rules
+			};
+		}
+		default: return;
+	}
+}
 function encodeBridgeValue(value) {
-	if (value instanceof Dimension) return {
-		__jessBridge: true,
-		kind: "dimension",
-		value: value.number,
-		unit: value.unit
-	};
-	if (value instanceof Color) return {
-		__jessBridge: true,
-		kind: "color",
-		rgb: value.rgb,
-		alpha: value.alpha,
-		format: value.options.format === void 0 ? void 0 : ColorFormat[value.options.format]
-	};
-	if (value instanceof Quoted) return {
+	if (Array.isArray(value)) return {
 		__jessBridge: true,
-		kind: "quoted",
-		value: String(value.value),
-		quote: value.quote,
-		escaped: value.escaped
+		kind: "expression",
+		items: value.map(encodeBridgeChildValue)
 	};
-	if (value instanceof Any) return {
-		__jessBridge: true,
-		kind: value.role === "keyword" ? "keyword" : "anonymous",
-		value: value.value
-	};
-	if (value instanceof List) return {
-		__jessBridge: true,
-		kind: "list",
-		items: value.value.map(encodeBridgeChildValue),
-		separator: value.options.sep
-	};
-	if (value instanceof Sequence) return {
-		__jessBridge: true,
-		kind: "sequence",
-		items: value.value.map(encodeBridgeChildValue)
-	};
-	if (value instanceof Rules) {
-		const rules = [];
-		for (const rule of value.rules ?? []) if (rule instanceof Declaration && typeof rule.name === "string") rules.push({
-			name: rule.name,
-			value: encodeBridgeChildValue(rule.value)
-		});
-		return {
+	if (isValueObj(value)) switch (value.type) {
+		case "Dimension": return {
+			__jessBridge: true,
+			kind: "dimension",
+			value: value.number,
+			unit: value.unit
+		};
+		case "Color": return {
+			__jessBridge: true,
+			kind: "color",
+			rgb: [
+				value.rgb[0],
+				value.rgb[1],
+				value.rgb[2]
+			],
+			alpha: value.alpha
+		};
+		case "Quoted": return {
+			__jessBridge: true,
+			kind: "quoted",
+			value: value.value,
+			quote: value.quote === "'" ? "'" : "\"",
+			escaped: value.escaped
+		};
+		case "List": return value.sep === "," || value.sep === "/" ? {
+			__jessBridge: true,
+			kind: "list",
+			items: value.value.map(encodeBridgeChildValue),
+			separator: value.sep
+		} : {
 			__jessBridge: true,
-			kind: "detached",
-			rules
+			kind: "anonymous",
+			value: value.bytes
+		};
+		case "Block": return {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
+		};
+		default: return {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
 		};
 	}
+	if (isDetached(value)) return {
+		__jessBridge: true,
+		kind: "mixin",
+		rules: value.rules.map((rule) => ({
+			name: rule.name,
+			value: encodeBridgeChildValue(rule.value)
+		}))
+	};
+	if (isRecord(value)) return encodeFacadeValue(value) ?? value;
 	return value;
 }
-function decodeBridgeValue(value) {
-	if (!isBridgeValue(value)) return value;
+function decodeValue(value) {
 	switch (value.kind) {
-		case "scalar": return new Any(String(value.value));
-		case "dimension": return new Dimension({
-			number: value.value,
-			unit: value.unit
-		});
-		case "color": return new Color({
-			rgb: value.rgb,
-			alpha: value.alpha
-		}, { format: colorFormatFromString(value.format) });
-		case "quoted": return new Quoted(value.value, {
-			quote: value.quote,
-			escaped: value.escaped
-		});
-		case "keyword": return new Any(value.value, { role: "keyword" });
-		case "anonymous": return new Any(value.value);
-		case "list": return new List(value.items.map((item) => decodeBridgeValue(item)), { sep: value.separator });
-		case "sequence": return new Sequence(value.items.map((item) => decodeBridgeValue(item)));
+		case "scalar": return makeKeyword(String(value.value));
+		case "dimension": return makeDimension(value.value, value.unit ?? "");
+		case "color": return makeColorRgb(value.rgb, value.alpha ?? 1, RGB);
+		case "quoted": return makeQuoted(value.value, value.quote ?? "\"", value.escaped === true);
+		case "anonymous": return makeKeyword(value.value);
+		case "expression": return value.items.map(decodeValue);
+		case "list": return makeList(value.items.map(decodeValue), value.separator === ";" ? "," : value.separator);
+		case "mixin": return makeKeyword("");
 	}
 }
+function decodeMixin(value) {
+	const nil = {
+		type: "Nil",
+		value: ""
+	};
+	const mixin = {
+		type: "Mixin",
+		name: nil,
+		args: nil,
+		ruleset: { rules: value.rules.map((rule) => ({
+			type: "Declaration",
+			name: rule.name,
+			value: decodeValue(rule.value),
+			eval() {
+				return this;
+			}
+		})) },
+		eval() {
+			return mixin;
+		}
+	};
+	return mixin;
+}
+function decodeBridgeValue(value) {
+	if (!isBridgeValue(value)) return value;
+	return value.kind === "mixin" ? decodeMixin(value) : decodeValue(value);
+}
 function encodeBridgeArgs(args) {
 	return args.map(encodeBridgeValue);
 }
 //#endregion
 //#region src/index.ts
+/**
+* Child-process stdio streams are typed as bare `Writable`/`Readable`, which do
+* not declare `unref`, but the underlying pipe sockets expose it at runtime.
+* The optional structural member lets any stream be passed without an unsafe
+* cast; the runtime `?.` guard covers streams that genuinely lack the method.
+*/
+const unrefStream = (stream) => {
+	if (typeof stream === "object" && stream !== null && "unref" in stream && typeof stream.unref === "function") stream.unref();
+};
 const SCRIPT_EXTENSIONS = new Set([
 	".js",
 	".mjs",
@@ -115,6 +213,33 @@ const RUNTIME_MISSING_MESSAGE = [
 const BOOT_TIMEOUT_MS = 8e3;
 const REQUEST_TIMEOUT_MS = 1e4;
 const IDLE_SHUTDOWN_MS = 5e3;
+/**
+* Environment variables that inject a Node.js debugger/inspector bootloader
+* into child processes (VS Code / Cursor "Auto Attach", `node --inspect`, etc.).
+*
+* These must never leak into the sandboxed Deno worker: the injected bootloader
+* tries to read the environment, the Jess Deno sandbox denies `env` permission,
+* and the worker never signals ready — producing a spurious
+* "Timed out waiting for Deno worker startup" failure. Deno does not use any of
+* these vars, so stripping them is safe.
+*/
+const DEBUG_ENV_KEY_RE = /^(NODE_OPTIONS|NODE_INSPECT|VSCODE_INSPECTOR_OPTIONS)/i;
+const DEBUG_ENV_VALUE_RE = /js-debug|bootloader/i;
+/**
+* Returns a copy of `env` with Node debugger/inspector-attach variables removed,
+* so a spawned Deno subprocess starts regardless of the parent's debug env.
+* The Deno permission sandbox is untouched; this only stops leaking the debugger
+* into it.
+*/
+const sanitizeSpawnEnv = (env = process.env) => {
+	const clean = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (DEBUG_ENV_KEY_RE.test(key)) continue;
+		if (typeof value === "string" && DEBUG_ENV_VALUE_RE.test(value)) continue;
+		clean[key] = value;
+	}
+	return clean;
+};
 const isPathInside = (candidatePath, rootPath) => {
 	const rel = path.relative(rootPath, candidatePath);
 	return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
@@ -198,7 +323,10 @@ var JsPlugin = class JsPlugin extends AbstractPlugin {
 		this.idleTimer.unref?.();
 	}
 	ensureRuntimeAvailable() {
-		if (spawnSync(this.opts.denoCommand ?? "deno", ["--version"], { stdio: "ignore" }).status !== 0) throw new Error(RUNTIME_MISSING_MESSAGE);
+		if (spawnSync(this.opts.denoCommand ?? "deno", ["--version"], {
+			stdio: "ignore",
+			env: sanitizeSpawnEnv(process.env)
+		}).status !== 0) throw new Error(RUNTIME_MISSING_MESSAGE);
 	}
 	ensureRuntime() {
 		if (this.runtimeState.status === "ready") {
@@ -325,15 +453,15 @@ var JsPlugin = class JsPlugin extends AbstractPlugin {
 				"pipe"
 			],
 			env: {
-				...process.env,
+				...sanitizeSpawnEnv(process.env),
 				DENO_PERMISSION_BROKER_PATH: socketPath
 			}
 		});
 		this.worker = child;
 		child.unref();
-		child.stdin.unref?.();
-		child.stdout.unref?.();
-		child.stderr.unref?.();
+		unrefStream(child.stdin);
+		unrefStream(child.stdout);
+		unrefStream(child.stderr);
 		child.stdout.setEncoding("utf8");
 		child.stderr.setEncoding("utf8");
 		child.stdout.on("data", (chunk) => this.onWorkerStdout(chunk));
@@ -519,7 +647,7 @@ var JsPlugin = class JsPlugin extends AbstractPlugin {
 	* @deprecated Less `@plugin` is deprecated. Prefer `@-from` for
 	* ESM-style script imports or `@-use` for Sass-module-style namespace imports.
 	*/
-	async importLessPlugin(absoluteFilePath) {
+	async importLessPlugin(absoluteFilePath, options = null) {
 		const ext = path.extname(absoluteFilePath);
 		if (!SCRIPT_EXTENSIONS.has(ext)) throw new Error(`Plugin "${this.name}" cannot import Less plugin "${absoluteFilePath}"`);
 		this.assertAllowedPath(absoluteFilePath);
@@ -527,7 +655,8 @@ var JsPlugin = class JsPlugin extends AbstractPlugin {
 		const modulePath = path.resolve(absoluteFilePath);
 		const loadResult = await this.callWorker({
 			type: "loadLessPlugin",
-			modulePath
+			modulePath,
+			options
 		});
 		if (!loadResult.ok) throw new Error(loadResult.error);
 		const functions = {};
@@ -535,6 +664,7 @@ var JsPlugin = class JsPlugin extends AbstractPlugin {
 			const invokeResult = await this.callWorker({
 				type: "invokeLessPluginFunction",
 				modulePath,
+				options,
 				functionName,
 				args: encodeBridgeArgs(args)
 			});
@@ -543,6 +673,10 @@ var JsPlugin = class JsPlugin extends AbstractPlugin {
 		};
 		return { functions };
 	}
+	/** Context-facing executable-plugin capability used by the direct AST path. */
+	async importPlugin(absoluteFilePath, options = null) {
+		return this.importLessPlugin(absoluteFilePath, options);
+	}
 };
 /**
 * Global flag set when @jesscss/plugin-js is loaded.
@@ -554,4 +688,4 @@ const jsPlugin = ((opts) => {
 	return new JsPlugin(opts);
 });
 //#endregion
-export { JESS_PLUGIN_JS_GLOBAL, JsPlugin, jsPlugin as default };
+export { JESS_PLUGIN_JS_GLOBAL, JsPlugin, jsPlugin as default, sanitizeSpawnEnv };

package/lib/runtime-worker.cjs

@@ -78,8 +78,17 @@ var Declaration = class {
 		return `${this.name}: ${v}`;
 	}
 };
-var DetachedRuleset = class {
-	type = "DetachedRuleset";
+var Nil = class {
+	type = "Nil";
+	value = "";
+	eval() {
+		return this;
+	}
+};
+var Mixin = class {
+	type = "Mixin";
+	name = new Nil();
+	args = new Nil();
 	ruleset;
 	constructor(rules) {
 		this.ruleset = { rules };
@@ -115,10 +124,11 @@ const lessFacade = {
 		Anonymous,
 		Color,
 		Declaration,
-		DetachedRuleset,
 		Dimension,
 		Expression,
 		Keyword,
+		Mixin,
+		Nil,
 		Quoted,
 		Value
 	},
@@ -150,11 +160,10 @@ const decodeBridgeValue = (value) => {
 		case "dimension": return new Dimension(value.value, value.unit ?? "");
 		case "color": return new Color(value.rgb, value.alpha ?? 1);
 		case "quoted": return new Quoted(value.quote ?? "\"", value.value, value.escaped === true);
-		case "keyword": return new Keyword(value.value);
 		case "anonymous": return new Anonymous(value.value);
 		case "list": return new Value((value.items ?? []).map(decodeBridgeValue), value.separator ?? ",");
-		case "sequence": return new Expression((value.items ?? []).map(decodeBridgeValue));
-		case "detached": return new DetachedRuleset((value.rules ?? []).map((decl) => {
+		case "expression": return new Expression((value.items ?? []).map(decodeBridgeValue));
+		case "mixin": return new Mixin((value.rules ?? []).map((decl) => {
 			const decoded = decodeBridgeValue(decl.value);
 			const cssText = decoded?.toCSS ? decoded.toCSS() : String(decoded);
 			return new Declaration(decl.name, new Anonymous(cssText));
@@ -191,21 +200,29 @@ const encodeBridgeValue = (value) => {
 		quote: value.quote,
 		escaped: value.escaped
 	};
-	if (value instanceof Keyword) return {
+	if (value instanceof Keyword || value instanceof Anonymous) return {
 		__jessBridge: true,
-		kind: "keyword",
+		kind: "anonymous",
 		value: String(value.value)
 	};
-	if (value instanceof Anonymous) return {
+	if (value instanceof Expression) return {
 		__jessBridge: true,
-		kind: "anonymous",
-		value: String(value.value)
+		kind: "expression",
+		items: value.value.map(encodeBridgeChildValue)
 	};
-	if (value instanceof Value || value instanceof Expression) return {
+	if (value instanceof Value) return {
 		__jessBridge: true,
-		kind: value instanceof Expression ? "sequence" : "list",
+		kind: "list",
 		items: value.value.map(encodeBridgeChildValue),
-		separator: value instanceof Expression ? void 0 : value.separator
+		separator: value.separator === "/" || value.separator === ";" ? value.separator : ","
+	};
+	if (value instanceof Mixin) return {
+		__jessBridge: true,
+		kind: "mixin",
+		rules: value.ruleset.rules.filter((rule) => rule instanceof Declaration && typeof rule.name === "string").map((rule) => ({
+			name: rule.name,
+			value: encodeBridgeChildValue(rule.value)
+		}))
 	};
 	return value;
 };
@@ -243,7 +260,7 @@ const loadModule = async (modulePath) => {
 	}
 	return exports;
 };
-const createLegacyLessPluginRuntime = (modulePath) => {
+const createLegacyLessPluginRuntime = (modulePath, options) => {
 	const localFunctions = /* @__PURE__ */ new Map();
 	const functions = {
 		add(name, fn) {
@@ -280,7 +297,9 @@ const createLegacyLessPluginRuntime = (modulePath) => {
 				return plugin;
 			}
 		})() : plugin;
+		if (candidate && options != null && typeof candidate.setOptions === "function") candidate.setOptions(options);
 		if (candidate && typeof candidate.install === "function") candidate.install(less, manager, functions);
+		if (candidate && options != null && typeof candidate.setOptions === "function") candidate.setOptions(options);
 	};
 	const require = (specifier) => {
 		throw new Error(`Less @plugin require("${specifier}") is not supported in the Deno sandbox yet.`);
@@ -298,11 +317,13 @@ const createLegacyLessPluginRuntime = (modulePath) => {
 		fileInfo: { filename: modulePath }
 	};
 };
-const loadLessPlugin = async (modulePath) => {
-	let functions = lessPluginFunctionCache.get(modulePath);
+const lessPluginCacheKey = (modulePath, options) => `${modulePath}\u0000${options ?? ""}`;
+const loadLessPlugin = async (modulePath, options = null) => {
+	const cacheKey = lessPluginCacheKey(modulePath, options);
+	let functions = lessPluginFunctionCache.get(cacheKey);
 	if (functions) return Array.from(functions.keys());
 	const source = await Deno.readTextFile(modulePath);
-	const runtime = createLegacyLessPluginRuntime(modulePath);
+	const runtime = createLegacyLessPluginRuntime(modulePath, options);
 	const module = { exports: runtime.exports };
 	new Function("module", "exports", "require", "registerPlugin", "functions", "tree", "less", "fileInfo", "process", source)(module, module.exports, runtime.require, runtime.registerPlugin, runtime.functions, lessFacade.tree, {
 		...lessFacade,
@@ -311,14 +332,15 @@ const loadLessPlugin = async (modulePath) => {
 	const exported = module.exports?.default ?? module.exports;
 	if (typeof exported === "function" || exported && typeof exported.install === "function") runtime.registerPlugin(exported);
 	functions = runtime.localFunctions;
-	lessPluginFunctionCache.set(modulePath, functions);
+	lessPluginFunctionCache.set(cacheKey, functions);
 	return Array.from(functions.keys());
 };
-const invokeLessPluginFunction = async (modulePath, functionName, args) => {
-	let functions = lessPluginFunctionCache.get(modulePath);
+const invokeLessPluginFunction = async (modulePath, functionName, args, options = null) => {
+	const cacheKey = lessPluginCacheKey(modulePath, options);
+	let functions = lessPluginFunctionCache.get(cacheKey);
 	if (!functions) {
-		await loadLessPlugin(modulePath);
-		functions = lessPluginFunctionCache.get(modulePath);
+		await loadLessPlugin(modulePath, options);
+		functions = lessPluginFunctionCache.get(cacheKey);
 	}
 	const fn = functions?.get(String(functionName).toLowerCase());
 	if (typeof fn !== "function") throw new Error(`Less @plugin function "${functionName}" is not registered.`);
@@ -357,7 +379,7 @@ const handleRequest = async (req) => {
 			return;
 		}
 		if (req.type === "loadLessPlugin") {
-			const functions = await loadLessPlugin(req.modulePath);
+			const functions = await loadLessPlugin(req.modulePath, req.options ?? null);
 			send({
 				id: req.id,
 				ok: true,
@@ -366,7 +388,7 @@ const handleRequest = async (req) => {
 			return;
 		}
 		if (req.type === "invokeLessPluginFunction") {
-			const value = await invokeLessPluginFunction(req.modulePath, req.functionName, req.args ?? []);
+			const value = await invokeLessPluginFunction(req.modulePath, req.functionName, req.args ?? [], req.options ?? null);
 			send({
 				id: req.id,
 				ok: true,

package/lib/runtime-worker.js

@@ -76,8 +76,17 @@ var Declaration = class {
 		return `${this.name}: ${v}`;
 	}
 };
-var DetachedRuleset = class {
-	type = "DetachedRuleset";
+var Nil = class {
+	type = "Nil";
+	value = "";
+	eval() {
+		return this;
+	}
+};
+var Mixin = class {
+	type = "Mixin";
+	name = new Nil();
+	args = new Nil();
 	ruleset;
 	constructor(rules) {
 		this.ruleset = { rules };
@@ -113,10 +122,11 @@ const lessFacade = {
 		Anonymous,
 		Color,
 		Declaration,
-		DetachedRuleset,
 		Dimension,
 		Expression,
 		Keyword,
+		Mixin,
+		Nil,
 		Quoted,
 		Value
 	},
@@ -148,11 +158,10 @@ const decodeBridgeValue = (value) => {
 		case "dimension": return new Dimension(value.value, value.unit ?? "");
 		case "color": return new Color(value.rgb, value.alpha ?? 1);
 		case "quoted": return new Quoted(value.quote ?? "\"", value.value, value.escaped === true);
-		case "keyword": return new Keyword(value.value);
 		case "anonymous": return new Anonymous(value.value);
 		case "list": return new Value((value.items ?? []).map(decodeBridgeValue), value.separator ?? ",");
-		case "sequence": return new Expression((value.items ?? []).map(decodeBridgeValue));
-		case "detached": return new DetachedRuleset((value.rules ?? []).map((decl) => {
+		case "expression": return new Expression((value.items ?? []).map(decodeBridgeValue));
+		case "mixin": return new Mixin((value.rules ?? []).map((decl) => {
 			const decoded = decodeBridgeValue(decl.value);
 			const cssText = decoded?.toCSS ? decoded.toCSS() : String(decoded);
 			return new Declaration(decl.name, new Anonymous(cssText));
@@ -189,21 +198,29 @@ const encodeBridgeValue = (value) => {
 		quote: value.quote,
 		escaped: value.escaped
 	};
-	if (value instanceof Keyword) return {
+	if (value instanceof Keyword || value instanceof Anonymous) return {
 		__jessBridge: true,
-		kind: "keyword",
+		kind: "anonymous",
 		value: String(value.value)
 	};
-	if (value instanceof Anonymous) return {
+	if (value instanceof Expression) return {
 		__jessBridge: true,
-		kind: "anonymous",
-		value: String(value.value)
+		kind: "expression",
+		items: value.value.map(encodeBridgeChildValue)
 	};
-	if (value instanceof Value || value instanceof Expression) return {
+	if (value instanceof Value) return {
 		__jessBridge: true,
-		kind: value instanceof Expression ? "sequence" : "list",
+		kind: "list",
 		items: value.value.map(encodeBridgeChildValue),
-		separator: value instanceof Expression ? void 0 : value.separator
+		separator: value.separator === "/" || value.separator === ";" ? value.separator : ","
+	};
+	if (value instanceof Mixin) return {
+		__jessBridge: true,
+		kind: "mixin",
+		rules: value.ruleset.rules.filter((rule) => rule instanceof Declaration && typeof rule.name === "string").map((rule) => ({
+			name: rule.name,
+			value: encodeBridgeChildValue(rule.value)
+		}))
 	};
 	return value;
 };
@@ -241,7 +258,7 @@ const loadModule = async (modulePath) => {
 	}
 	return exports;
 };
-const createLegacyLessPluginRuntime = (modulePath) => {
+const createLegacyLessPluginRuntime = (modulePath, options) => {
 	const localFunctions = /* @__PURE__ */ new Map();
 	const functions = {
 		add(name, fn) {
@@ -278,7 +295,9 @@ const createLegacyLessPluginRuntime = (modulePath) => {
 				return plugin;
 			}
 		})() : plugin;
+		if (candidate && options != null && typeof candidate.setOptions === "function") candidate.setOptions(options);
 		if (candidate && typeof candidate.install === "function") candidate.install(less, manager, functions);
+		if (candidate && options != null && typeof candidate.setOptions === "function") candidate.setOptions(options);
 	};
 	const require = (specifier) => {
 		throw new Error(`Less @plugin require("${specifier}") is not supported in the Deno sandbox yet.`);
@@ -296,11 +315,13 @@ const createLegacyLessPluginRuntime = (modulePath) => {
 		fileInfo: { filename: modulePath }
 	};
 };
-const loadLessPlugin = async (modulePath) => {
-	let functions = lessPluginFunctionCache.get(modulePath);
+const lessPluginCacheKey = (modulePath, options) => `${modulePath}\u0000${options ?? ""}`;
+const loadLessPlugin = async (modulePath, options = null) => {
+	const cacheKey = lessPluginCacheKey(modulePath, options);
+	let functions = lessPluginFunctionCache.get(cacheKey);
 	if (functions) return Array.from(functions.keys());
 	const source = await Deno.readTextFile(modulePath);
-	const runtime = createLegacyLessPluginRuntime(modulePath);
+	const runtime = createLegacyLessPluginRuntime(modulePath, options);
 	const module = { exports: runtime.exports };
 	new Function("module", "exports", "require", "registerPlugin", "functions", "tree", "less", "fileInfo", "process", source)(module, module.exports, runtime.require, runtime.registerPlugin, runtime.functions, lessFacade.tree, {
 		...lessFacade,
@@ -309,14 +330,15 @@ const loadLessPlugin = async (modulePath) => {
 	const exported = module.exports?.default ?? module.exports;
 	if (typeof exported === "function" || exported && typeof exported.install === "function") runtime.registerPlugin(exported);
 	functions = runtime.localFunctions;
-	lessPluginFunctionCache.set(modulePath, functions);
+	lessPluginFunctionCache.set(cacheKey, functions);
 	return Array.from(functions.keys());
 };
-const invokeLessPluginFunction = async (modulePath, functionName, args) => {
-	let functions = lessPluginFunctionCache.get(modulePath);
+const invokeLessPluginFunction = async (modulePath, functionName, args, options = null) => {
+	const cacheKey = lessPluginCacheKey(modulePath, options);
+	let functions = lessPluginFunctionCache.get(cacheKey);
 	if (!functions) {
-		await loadLessPlugin(modulePath);
-		functions = lessPluginFunctionCache.get(modulePath);
+		await loadLessPlugin(modulePath, options);
+		functions = lessPluginFunctionCache.get(cacheKey);
 	}
 	const fn = functions?.get(String(functionName).toLowerCase());
 	if (typeof fn !== "function") throw new Error(`Less @plugin function "${functionName}" is not registered.`);
@@ -355,7 +377,7 @@ const handleRequest = async (req) => {
 			return;
 		}
 		if (req.type === "loadLessPlugin") {
-			const functions = await loadLessPlugin(req.modulePath);
+			const functions = await loadLessPlugin(req.modulePath, req.options ?? null);
 			send({
 				id: req.id,
 				ok: true,
@@ -364,7 +386,7 @@ const handleRequest = async (req) => {
 			return;
 		}
 		if (req.type === "invokeLessPluginFunction") {
-			const value = await invokeLessPluginFunction(req.modulePath, req.functionName, req.args ?? []);
+			const value = await invokeLessPluginFunction(req.modulePath, req.functionName, req.args ?? [], req.options ?? null);
 			send({
 				id: req.id,
 				ok: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jesscss/plugin-js",
-  "version": "2.0.0-alpha.7",
+  "version": "2.0.0-alpha.9",
   "description": "Jess plugin for JavaScript/TypeScript module imports with Deno runtime checks",
   "main": "lib/index.cjs",
   "types": "lib/index.d.ts",
@@ -18,7 +18,7 @@
   ],
   "dependencies": {
     "deno": "^2.6.8",
-    "@jesscss/core": "2.0.0-alpha.7"
+    "@jesscss/core": "2.0.0-alpha.9"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",