@shortwind/cli 0.1.0-beta.0 → 0.1.0-beta.10

package/dist/{bench-a_9WmuOE.js → bench-BGTQAha8.js}

@@ -1,15 +1,15 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { applyEdits, modify, parse } from "jsonc-parser";
-import { buildRegistry, parseRecipeFile, renderSkillMarkdown } from "@shortwind/core";
+import { PLACEHOLDER_SHA, RECIPE_SHA_HEX_LENGTH, buildRegistry, isReservedRecipeName, normalizeRecipeBody, parseRecipeFile, renderSkillMarkdown } from "@shortwind/core";
 import { createHash } from "node:crypto";
-import { fileURLToPath } from "node:url";
-import chokidar from "chokidar";
 import { glob } from "tinyglobby";
+import chokidar from "chokidar";
 import { Tiktoken } from "js-tiktoken/lite";
 import cl100k_base from "js-tiktoken/ranks/cl100k_base";
-import { loadRegistryFromDir, transformContent } from "@shortwind/tailwind";
+import { loadRegistryFromDir, modeForFile, transformContent } from "@shortwind/tailwind";
 //#region src/fingerprint.ts
 const HEADER_PATTERN = /^\/\*\s*shortwind:\s+(\S+)@(\S+)\s+sha:([^\s*]+)(?:\s+—\s+DO NOT EDIT THIS LINE)?\s*\*\/\s*$/;
 function extractHeader(source) {
@@ -26,12 +26,19 @@ function bodyAfterHeader(source) {
 	const eol = source.indexOf("\n");
 	return eol === -1 ? "" : source.slice(eol + 1);
 }
-function normalizeBody(body) {
-	return body.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n").map((line) => line.replace(/[\t ]+$/, "")).join("\n");
-}
 function computeBodySha(source) {
-	const normalized = normalizeBody(bodyAfterHeader(source));
-	return createHash("sha256").update(normalized).digest("hex").slice(0, 6);
+	const normalized = normalizeRecipeBody(bodyAfterHeader(source));
+	return createHash("sha256").update(normalized).digest("hex").slice(0, RECIPE_SHA_HEX_LENGTH);
+}
+function isLegacyFingerprint(sha) {
+	return sha !== PLACEHOLDER_SHA && sha.length < RECIPE_SHA_HEX_LENGTH && /^[0-9a-f]+$/.test(sha);
+}
+function verifyFetchedFamily(source, family) {
+	const header = extractHeader(source);
+	if (!header || header.sha === PLACEHOLDER_SHA) return;
+	if (header.family !== family) throw new Error(`integrity check failed for "${family}": registry returned a recipe sealed as "${header.family}" — wrong family or a tampered/corrupted response`);
+	const actual = computeBodySha(source);
+	if (header.sha !== actual) throw new Error(`integrity check failed for "${family}": header sha ${header.sha} does not match content sha ${actual} — the registry response was tampered with or corrupted in transit`);
 }
 function buildHeaderLine(family, version, sha) {
 	return `/* shortwind: ${family}@${version} sha:${sha} — DO NOT EDIT THIS LINE */`;
@@ -51,13 +58,20 @@ function sealRecipeFile(source, family, version) {
 }
 //#endregion
 //#region src/detect.ts
+function parsePackageJson(pkgPath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(pkgPath, "utf8"));
+	} catch (err) {
+		throw new Error(`${pkgPath}: invalid JSON — ${err.message}`);
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+	return parsed;
+}
 function detectProject(cwd) {
 	const pkgPath = path.join(cwd, "package.json");
 	const hasPackageJson = existsSync(pkgPath);
-	const pkg = hasPackageJson ? JSON.parse(readFileSync(pkgPath, "utf8")) : {
-		dependencies: {},
-		devDependencies: {}
-	};
+	const pkg = hasPackageJson ? parsePackageJson(pkgPath) : {};
 	const deps = {
 		...pkg.dependencies ?? {},
 		...pkg.devDependencies ?? {}
@@ -113,9 +127,64 @@ function assertValidFamilyName(family) {
 	if (!FAMILY_RE.test(family)) throw new Error(`invalid family name: ${JSON.stringify(family)} (must match ${FAMILY_RE})`);
 }
 function createRegistrySource(origin) {
-	if (origin.startsWith("http://") || origin.startsWith("https://")) return httpSource(origin);
+	if (origin.startsWith("http://")) {
+		console.warn(`[shortwind] registry origin ${origin} uses plaintext http:// — recipe content is unauthenticated and tamperable in transit; prefer https://`);
+		return httpSource(origin);
+	}
+	if (origin.startsWith("https://")) return httpSource(origin);
 	return fileSource(origin);
 }
+async function resolveSource(origin) {
+	if (origin && origin !== "bundled:@shortwind/catalog") return createRegistrySource(origin);
+	return defaultCatalogSource();
+}
+const CATALOG_PACKAGE = "@shortwind/catalog";
+const NPM_TIMEOUT_MS = 3e3;
+const FETCH_TIMEOUT_MS = 1e4;
+async function defaultCatalogSource() {
+	try {
+		const cdn = httpSource(`https://cdn.jsdelivr.net/npm/${CATALOG_PACKAGE}@${await resolveCatalogVersion()}/dist/registry`);
+		await cdn.loadPresets();
+		return cdn;
+	} catch {
+		return bundledSource();
+	}
+}
+async function resolveCatalogVersion() {
+	const res = await fetch(`https://registry.npmjs.org/${CATALOG_PACKAGE}`, {
+		signal: AbortSignal.timeout(NPM_TIMEOUT_MS),
+		headers: { accept: "application/vnd.npm.install-v1+json" }
+	});
+	if (!res.ok) throw new Error(`npm: ${res.status}`);
+	const tags = (await res.json())["dist-tags"] ?? {};
+	const version = tags["latest"] ?? tags["beta"];
+	if (!version) throw new Error("no published catalog version");
+	return version;
+}
+const BUNDLED_ORIGIN = "bundled:@shortwind/catalog";
+function bundledSource() {
+	let cache = null;
+	const load = () => {
+		cache ??= import("./catalog.generated-B_ds7MPV.js");
+		return cache;
+	};
+	return {
+		origin: BUNDLED_ORIGIN,
+		async loadPresets() {
+			return (await load()).CATALOG_PRESETS;
+		},
+		async loadFamily(family) {
+			assertValidFamilyName(family);
+			const { CATALOG_RECIPES } = await load();
+			const css = CATALOG_RECIPES[family];
+			if (css === void 0) throw new Error(`unknown family: ${family}`);
+			return css;
+		},
+		async listAllFamilies() {
+			return [...(await load()).CATALOG_FAMILIES];
+		}
+	};
+}
 function fileSource(origin) {
 	const root = origin.startsWith("file://") ? fileURLToPath(origin) : origin;
 	return {
@@ -136,21 +205,26 @@ function fileSource(origin) {
 }
 function httpSource(origin) {
 	const base = origin.replace(/\/+$/, "");
+	const get = (url) => fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+	let presetsCache = null;
 	return {
 		origin,
-		async loadPresets() {
-			const res = await fetch(`${base}/presets.json`);
-			if (!res.ok) throw new Error(`presets.json: ${res.status} ${res.statusText}`);
-			return await res.json();
+		loadPresets() {
+			presetsCache ??= (async () => {
+				const res = await get(`${base}/presets.json`);
+				if (!res.ok) throw new Error(`presets.json: ${res.status} ${res.statusText}`);
+				return await res.json();
+			})();
+			return presetsCache;
 		},
 		async loadFamily(family) {
 			assertValidFamilyName(family);
-			const res = await fetch(`${base}/recipes/${family}.css`);
+			const res = await get(`${base}/recipes/${family}.css`);
 			if (!res.ok) throw new Error(`${family}.css: ${res.status} ${res.statusText}`);
 			return res.text();
 		},
 		async listAllFamilies() {
-			const res = await fetch(`${base}/index.json`);
+			const res = await get(`${base}/index.json`);
 			if (!res.ok) throw new Error(`index.json: ${res.status} ${res.statusText}`);
 			return (await res.json()).families.filter((name) => FAMILY_RE.test(name));
 		}
@@ -207,18 +281,277 @@ async function writeLockfile(recipesDir, lock) {
 	};
 	await writeFile(lockPath(recipesDir), JSON.stringify(sorted, null, 2) + "\n");
 }
+const THEME_BLOCK = `/* shortwind:theme — default tokens for the recipe catalog. Edit freely. */
+@custom-variant dark (&:is(.dark *));
+
+:root {
+  --radius: 0.625rem;
+  --background: oklch(1 0 0);
+  --foreground: oklch(0.145 0 0);
+  --card: oklch(1 0 0);
+  --card-foreground: oklch(0.145 0 0);
+  --popover: oklch(1 0 0);
+  --popover-foreground: oklch(0.145 0 0);
+  --primary: oklch(0.205 0 0);
+  --primary-foreground: oklch(0.985 0 0);
+  --secondary: oklch(0.97 0 0);
+  --secondary-foreground: oklch(0.205 0 0);
+  --muted: oklch(0.97 0 0);
+  --muted-foreground: oklch(0.556 0 0);
+  --accent: oklch(0.97 0 0);
+  --accent-foreground: oklch(0.205 0 0);
+  --destructive: oklch(0.577 0.245 27.325);
+  --destructive-foreground: oklch(0.985 0 0);
+  --border: oklch(0.922 0 0);
+  --input: oklch(0.922 0 0);
+  --ring: oklch(0.708 0 0);
+}
+
+.dark {
+  --background: oklch(0.145 0 0);
+  --foreground: oklch(0.985 0 0);
+  --card: oklch(0.205 0 0);
+  --card-foreground: oklch(0.985 0 0);
+  --popover: oklch(0.205 0 0);
+  --popover-foreground: oklch(0.985 0 0);
+  --primary: oklch(0.922 0 0);
+  --primary-foreground: oklch(0.205 0 0);
+  --secondary: oklch(0.269 0 0);
+  --secondary-foreground: oklch(0.985 0 0);
+  --muted: oklch(0.269 0 0);
+  --muted-foreground: oklch(0.708 0 0);
+  --accent: oklch(0.269 0 0);
+  --accent-foreground: oklch(0.985 0 0);
+  --destructive: oklch(0.704 0.191 22.216);
+  --destructive-foreground: oklch(0.985 0 0);
+  --border: oklch(1 0 0 / 10%);
+  --input: oklch(1 0 0 / 15%);
+  --ring: oklch(0.556 0 0);
+}
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --color-card: var(--card);
+  --color-card-foreground: var(--card-foreground);
+  --color-popover: var(--popover);
+  --color-popover-foreground: var(--popover-foreground);
+  --color-primary: var(--primary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-secondary: var(--secondary);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-muted: var(--muted);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-accent: var(--accent);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-destructive: var(--destructive);
+  --color-destructive-foreground: var(--destructive-foreground);
+  --color-border: var(--border);
+  --color-input: var(--input);
+  --color-ring: var(--ring);
+  --radius-sm: calc(var(--radius) - 4px);
+  --radius-md: calc(var(--radius) - 2px);
+  --radius-lg: var(--radius);
+  --radius-xl: calc(var(--radius) + 4px);
+}
+
+@layer base {
+  body {
+    @apply bg-background text-foreground;
+  }
+}
+/* end shortwind theme */
+`;
+const TAILWIND_IMPORT_RE = /@import\s+["']tailwindcss["'][^;\n]*;?/;
+async function scaffoldTheme(cwd) {
+	const cssFiles = await glob(["**/*.css"], {
+		cwd,
+		absolute: true,
+		onlyFiles: true,
+		ignore: [
+			"**/node_modules/**",
+			"**/dist/**",
+			"**/.next/**",
+			"**/.output/**",
+			"recipes/**"
+		]
+	});
+	for (const file of cssFiles) {
+		const source = await readFile(file, "utf8");
+		if (!TAILWIND_IMPORT_RE.test(source)) continue;
+		if (source.includes("/* shortwind:theme")) return {
+			themePath: file,
+			action: "skipped",
+			reason: "already scaffolded"
+		};
+		if (/--background\s*:/.test(source) || /@theme\b/.test(source)) return {
+			themePath: file,
+			action: "skipped",
+			reason: "project already defines a theme"
+		};
+		const m = source.match(TAILWIND_IMPORT_RE);
+		const at = (m.index ?? 0) + m[0].length;
+		await writeFile(file, source.slice(0, at) + "\n\n" + THEME_BLOCK + source.slice(at));
+		return {
+			themePath: file,
+			action: "injected"
+		};
+	}
+	if (!isTailwindV4(cwd)) return {
+		themePath: null,
+		action: "skipped",
+		reason: "no Tailwind v4 CSS entry found"
+	};
+	const target = path.join(cwd, "src", "index.css");
+	if (existsSync(target)) return {
+		themePath: target,
+		action: "skipped",
+		reason: "src/index.css exists without a tailwindcss import"
+	};
+	await mkdir(path.dirname(target), { recursive: true });
+	await writeFile(target, `@import "tailwindcss";\n\n${THEME_BLOCK}`);
+	return {
+		themePath: target,
+		action: "created"
+	};
+}
+function isTailwindV4(cwd) {
+	try {
+		const pkg = JSON.parse(readFileSync(path.join(cwd, "package.json"), "utf8"));
+		const m = (pkg.devDependencies?.["tailwindcss"] ?? pkg.dependencies?.["tailwindcss"] ?? "").match(/(\d+)/);
+		return m ? Number(m[1]) >= 4 : false;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/bundler-config.ts
+const VITE_CONFIGS = [
+	"vite.config.ts",
+	"vite.config.mts",
+	"vite.config.cts",
+	"vite.config.js",
+	"vite.config.mjs",
+	"vite.config.cjs"
+];
+const VITE_SNIPPET = [
+	`import { shortwind } from "@shortwind/vite";`,
+	`// add shortwind() to the Vite plugins array — it runs in the pre phase,`,
+	`// before Tailwind's scan:`,
+	`//   plugins: [shortwind(), tailwindcss(), react()]`
+].join("\n");
+async function wireBundler(cwd, bundler) {
+	if (bundler === "vite") return wireVite(cwd);
+	if (bundler === "next") return {
+		configPath: null,
+		action: "manual",
+		snippet: `import { withShortwind } from "@shortwind/next";\n// wrap your Next config: export default withShortwind(nextConfig);`,
+		reason: "Next config wiring is manual"
+	};
+	if (bundler === "astro") return {
+		configPath: null,
+		action: "manual",
+		snippet: `import shortwind from "@shortwind/astro";\n// add to integrations: integrations: [shortwind()]`,
+		reason: "Astro config wiring is manual"
+	};
+	return {
+		configPath: null,
+		action: "skipped",
+		reason: "no supported bundler detected"
+	};
+}
+async function wireVite(cwd) {
+	const configPath = VITE_CONFIGS.map((f) => path.join(cwd, f)).find((p) => existsSync(p));
+	if (!configPath) return {
+		configPath: null,
+		action: "manual",
+		snippet: VITE_SNIPPET,
+		reason: "no vite config found"
+	};
+	const source = await readFile(configPath, "utf8");
+	if (/@shortwind\/vite/.test(source)) return {
+		configPath,
+		action: "skipped",
+		reason: "plugin already wired"
+	};
+	const pluginsMatch = source.match(/plugins\s*:\s*\[/);
+	if (!pluginsMatch) return {
+		configPath,
+		action: "manual",
+		snippet: VITE_SNIPPET,
+		reason: "no plugins array found"
+	};
+	const withImport = addImport(source, `import { shortwind } from "@shortwind/vite";`);
+	const at = withImport.indexOf(pluginsMatch[0]) + pluginsMatch[0].length;
+	await writeFile(configPath, withImport.slice(0, at) + "shortwind(), " + withImport.slice(at));
+	return {
+		configPath,
+		action: "patched"
+	};
+}
+function addImport(source, line) {
+	const importRe = /^[ \t]*import[\s\S]*?from\s+["'][^"']+["'];?[ \t]*$/gm;
+	let lastEnd = -1;
+	for (const m of source.matchAll(importRe)) lastEnd = (m.index ?? 0) + m[0].length;
+	if (lastEnd === -1) return `${line}\n${source}`;
+	return source.slice(0, lastEnd) + `\n${line}` + source.slice(lastEnd);
+}
+//#endregion
+//#region src/agents-file.ts
+const MARKER = "skills/shortwind/SKILL.md";
+function line(skillRel) {
+	return `For UI, prefer Shortwind \`@recipe\` class names (e.g. \`@card\`, \`@btn-primary\`, \`@row\`) over raw Tailwind where a recipe fits — full catalog in \`${skillRel}\`.`;
+}
+const CANDIDATES = ["AGENTS.md", "CLAUDE.md"];
+async function wireAgentsInstructions(cwd, skillPath) {
+	const pointer = line(path.relative(cwd, skillPath).split(path.sep).join("/"));
+	let touched = null;
+	for (const name of CANDIDATES) {
+		const file = path.join(cwd, name);
+		if (!existsSync(file)) continue;
+		const current = await readFile(file, "utf8");
+		if (current.includes(MARKER)) {
+			touched ??= {
+				path: file,
+				action: "skipped"
+			};
+			continue;
+		}
+		await writeFile(file, current + (current.endsWith("\n\n") ? "" : current.endsWith("\n") ? "\n" : "\n\n") + pointer + "\n");
+		return {
+			path: file,
+			action: "appended"
+		};
+	}
+	if (touched) return touched;
+	const target = path.join(cwd, "AGENTS.md");
+	await writeFile(target, `# AGENTS.md\n\n${pointer}\n`);
+	return {
+		path: target,
+		action: "created"
+	};
+}
 //#endregion
 //#region src/init.ts
-const DEFAULT_REGISTRY = "https://shortwind.dev/registry";
+const DEFAULT_REGISTRY = BUNDLED_ORIGIN;
 async function init(options) {
 	const cwd = path.resolve(options.cwd);
-	const registry = options.registry ?? "https://shortwind.dev/registry";
-	const source = createRegistrySource(registry);
+	const registry = options.registry ?? DEFAULT_REGISTRY;
+	const source = await resolveSource(registry);
 	const shape = detectProject(cwd);
 	const families = await resolveFamilies(options.preset, source);
 	const pkgs = pickPackages(shape.bundler);
+	const version = cliVersion();
+	const specs = version ? pkgs.map((p) => `${p}@${version}`) : pkgs;
 	const installer = options.installPackages ?? defaultInstall;
-	if (pkgs.length > 0) await installer(shape.packageManager, pkgs, cwd);
+	let installOk = true;
+	let installError = null;
+	if (specs.length > 0) try {
+		await installer(shape.packageManager, specs, cwd);
+	} catch (err) {
+		installOk = false;
+		installError = err instanceof Error ? err.message : String(err);
+	}
 	const recipesDir = path.join(cwd, "recipes");
 	const { installed, skipped } = await copyRecipes(source, families, recipesDir);
 	await updateLockfile(recipesDir, registry, installed);
@@ -233,6 +566,9 @@ async function init(options) {
 	await installHuskyHook(huskyPath);
 	const skillPath = path.join(cwd, "skills", "shortwind", "SKILL.md");
 	await writeSkillMd(skillPath, recipesDir, families);
+	const theme = await scaffoldTheme(cwd);
+	const bundlerConfig = await wireBundler(cwd, shape.bundler);
+	const agentsFile = await wireAgentsInstructions(cwd, skillPath);
 	return {
 		packageManager: shape.packageManager,
 		preset: options.preset,
@@ -244,13 +580,30 @@ async function init(options) {
 		configPath,
 		vscodePath,
 		huskyPath,
-		skillPath
+		skillPath,
+		themePath: theme.themePath,
+		themeAction: theme.action,
+		bundlerConfigPath: bundlerConfig.configPath,
+		bundlerConfigAction: bundlerConfig.action,
+		...bundlerConfig.snippet ? { bundlerConfigSnippet: bundlerConfig.snippet } : {},
+		agentsFilePath: agentsFile.path,
+		agentsFileAction: agentsFile.action,
+		installOk,
+		installError
 	};
 }
 async function resolveFamilies(preset, source) {
 	if (preset === "none") return [];
 	return resolvePresetFamilies(preset, await source.loadPresets(), await source.listAllFamilies());
 }
+function cliVersion() {
+	try {
+		const pkgUrl = new URL("../package.json", import.meta.url);
+		return JSON.parse(readFileSync(fileURLToPath(pkgUrl), "utf8")).version ?? null;
+	} catch {
+		return null;
+	}
+}
 function pickPackages(bundler) {
 	const base = ["@shortwind/tailwind"];
 	switch (bundler) {
@@ -322,6 +675,7 @@ async function copyRecipes(source, families, recipesDir) {
 			continue;
 		}
 		const body = await source.loadFamily(family);
+		verifyFetchedFamily(body, family);
 		await writeFile(target, rewriteHeaderSha(body, computeBodySha(body)));
 		installed.push(family);
 	}
@@ -340,8 +694,14 @@ async function writeConfig(configPath, next) {
 		await writeFile(configPath, JSON.stringify(desired, null, 2) + "\n");
 		return;
 	}
+	let current;
+	try {
+		current = JSON.parse(await readFile(configPath, "utf8"));
+	} catch (err) {
+		throw new Error(`${configPath}: invalid JSON — ${err.message}`);
+	}
 	const merged = {
-		...JSON.parse(await readFile(configPath, "utf8")),
+		...current !== null && typeof current === "object" && !Array.isArray(current) ? current : {},
 		...desired
 	};
 	await writeFile(configPath, JSON.stringify(merged, null, 2) + "\n");
@@ -373,9 +733,9 @@ async function installHuskyHook(huskyPath) {
 	await writeFile(huskyPath, current.endsWith("\n") ? current + HUSKY_LINE + "\n" : current + "\nnpx shortwind build\n", { mode: 493 });
 }
 async function writeSkillMd(skillPath, recipesDir, families) {
-	await mkdir(path.dirname(skillPath), { recursive: true });
 	const allRecipes = [];
 	const guidance = {};
+	const problems = [];
 	for (const family of families) {
 		const filePath = path.join(recipesDir, `${family}.css`);
 		if (!existsSync(filePath)) continue;
@@ -383,23 +743,33 @@ async function writeSkillMd(skillPath, recipesDir, families) {
 		if (parsed.ok) {
 			allRecipes.push(...parsed.value.recipes);
 			if (parsed.value.guidance) guidance[family] = parsed.value.guidance;
-		}
+		} else problems.push(`${family}.css: ${parsed.errors.map((e) => e.message).join("; ")}`);
 	}
-	let registry = {
-		families: {},
-		flattened: {}
-	};
 	const resolved = buildRegistry(allRecipes, { guidance });
-	if (resolved.ok) registry = resolved.value;
-	await writeFile(skillPath, renderSkillMarkdown(registry, { order: families }));
+	if (problems.length > 0 || !resolved.ok) {
+		const all = resolved.ok ? problems : [...problems, ...resolved.errors.map((e) => e.message)];
+		console.warn(`[shortwind] SKILL.md not generated — recipe errors:\n  ${all.join("\n  ")}`);
+		return;
+	}
+	await mkdir(path.dirname(skillPath), { recursive: true });
+	await writeFile(skillPath, renderSkillMarkdown(resolved.value, { order: families }));
 }
 //#endregion
 //#region src/project.ts
 const DEFAULT_CONFIG = {
-	registry: "https://shortwind.dev/registry",
+	registry: BUNDLED_ORIGIN,
 	recipesDir: "recipes",
 	outputPath: "skills/shortwind/SKILL.md"
 };
+function assertConfigString(value, field, configPath) {
+	if (typeof value !== "string") throw new Error(`${configPath}: "${field}" must be a string`);
+	return value;
+}
+function assertWithinCwd(cwd, value, field, configPath) {
+	const rel = path.relative(cwd, path.resolve(cwd, value));
+	if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`${configPath}: "${field}" (${JSON.stringify(value)}) must be a path inside the project directory`);
+	return value;
+}
 async function readConfig(cwd) {
 	const configPath = path.join(cwd, "shortwind.config.json");
 	if (!existsSync(configPath)) return DEFAULT_CONFIG;
@@ -410,10 +780,16 @@ async function readConfig(cwd) {
 	} catch (err) {
 		throw new Error(`${configPath}: invalid JSON — ${err.message}`);
 	}
-	return {
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${configPath}: expected a JSON object`);
+	const merged = {
 		...DEFAULT_CONFIG,
 		...parsed
 	};
+	return {
+		registry: assertConfigString(merged.registry, "registry", configPath),
+		recipesDir: assertWithinCwd(cwd, assertConfigString(merged.recipesDir, "recipesDir", configPath), "recipesDir", configPath),
+		outputPath: assertWithinCwd(cwd, assertConfigString(merged.outputPath, "outputPath", configPath), "outputPath", configPath)
+	};
 }
 function installedFamilies(recipesDir) {
 	if (!existsSync(recipesDir)) return [];
@@ -433,24 +809,25 @@ async function regenerateSkillMd(cwd, config) {
 	const recipesDir = path.join(cwd, config.recipesDir);
 	const families = installedFamilies(recipesDir);
 	const skillPath = path.join(cwd, config.outputPath);
-	const { mkdir } = await import("node:fs/promises");
-	await mkdir(path.dirname(skillPath), { recursive: true });
 	const allRecipes = [];
 	const guidance = {};
+	const problems = [];
 	for (const family of families) {
 		const parsed = parseRecipeFile(readFileSync(path.join(recipesDir, `${family}.css`), "utf8"), `${family}.css`);
 		if (parsed.ok) {
 			allRecipes.push(...parsed.value.recipes);
 			if (parsed.value.guidance) guidance[family] = parsed.value.guidance;
-		}
+		} else problems.push(`${family}.css: ${parsed.errors.map((e) => e.message).join("; ")}`);
 	}
-	let registry = {
-		families: {},
-		flattened: {}
-	};
 	const resolved = buildRegistry(allRecipes, { guidance });
-	if (resolved.ok) registry = resolved.value;
-	await writeFile(skillPath, renderSkillMarkdown(registry, { order: families }));
+	if (problems.length > 0 || !resolved.ok) {
+		const all = resolved.ok ? problems : [...problems, ...resolved.errors.map((e) => e.message)];
+		console.warn(`[shortwind] SKILL.md not regenerated — fix these recipe errors first:\n  ${all.join("\n  ")}\n  ${path.relative(cwd, skillPath)} left unchanged.`);
+		return skillPath;
+	}
+	const { mkdir } = await import("node:fs/promises");
+	await mkdir(path.dirname(skillPath), { recursive: true });
+	await writeFile(skillPath, renderSkillMarkdown(resolved.value, { order: families }));
 	return skillPath;
 }
 /**
@@ -476,7 +853,7 @@ async function add(options) {
 	const cwd = path.resolve(options.cwd);
 	const config = await readConfig(cwd);
 	const registry = options.registry ?? config.registry;
-	const source = createRegistrySource(registry);
+	const source = await resolveSource(registry);
 	const recipesDir = path.join(cwd, config.recipesDir);
 	await mkdir(recipesDir, { recursive: true });
 	const lock = await readLockfile(recipesDir);
@@ -484,6 +861,7 @@ async function add(options) {
 	const requested = options.all ? await source.listAllFamilies() : options.families;
 	if (options.all && options.as) throw new Error("--as cannot be combined with --all");
 	if (options.as && requested.length !== 1) throw new Error("--as requires exactly one family argument");
+	if (options.as !== void 0) assertValidFamilyName(options.as);
 	const added = [];
 	const skipped = [];
 	const overwritten = [];
@@ -498,6 +876,7 @@ async function add(options) {
 			continue;
 		}
 		const sourceCss = await source.loadFamily(family);
+		verifyFetchedFamily(sourceCss, family);
 		const renamed = options.as ? renameFamilyInSource(sourceCss, family, options.as) : sourceCss;
 		const sha = computeBodySha(renamed);
 		const finalCss = rewriteHeaderSha(renamed, sha);
@@ -595,11 +974,92 @@ function collectBrokenDependents(recipesDir, removedRecipeNames) {
 	return out;
 }
 //#endregion
+//#region src/commands/new.ts
+var NewFamilyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "NewFamilyError";
+	}
+};
+function template(family) {
+	return [
+		`/* shortwind: ${family}@0.0.1 sha:000000 */`,
+		``,
+		`/* @guide`,
+		`   TODO: one or two lines on when to reach for these recipes, and which`,
+		`   easy-to-confuse name to prefer. */`,
+		``,
+		`/* TODO: describe this recipe. */`,
+		`@recipe ${family} {`,
+		`  p-4`,
+		`}`,
+		``
+	].join("\n");
+}
+async function newFamily(options) {
+	assertValidFamilyName(options.family);
+	const cwd = path.resolve(options.cwd);
+	const config = await readConfig(cwd);
+	const recipesDir = path.join(cwd, config.recipesDir);
+	const familyPath = path.join(recipesDir, `${options.family}.css`);
+	if (existsSync(familyPath) && !options.force) throw new NewFamilyError(`${path.join(config.recipesDir, `${options.family}.css`)} already exists (use --force to overwrite)`);
+	await mkdir(recipesDir, { recursive: true });
+	await writeFile(familyPath, template(options.family));
+	return {
+		familyPath,
+		skillPath: await regenerateSkillMd(cwd, config)
+	};
+}
+//#endregion
+//#region src/commands/reseal.ts
+async function reseal(options) {
+	const cwd = path.resolve(options.cwd);
+	const config = await readConfig(cwd);
+	const recipesDir = path.join(cwd, config.recipesDir);
+	const families = options.families && options.families.length > 0 ? options.families : installedFamilies(recipesDir);
+	const lock = await readLockfile(recipesDir);
+	const resealed = [];
+	const unchanged = [];
+	const notFound = [];
+	const noHeader = [];
+	for (const family of families) {
+		const file = path.join(recipesDir, `${family}.css`);
+		if (!existsSync(file)) {
+			notFound.push(family);
+			continue;
+		}
+		const source = readFileSync(file, "utf8");
+		const header = extractHeader(source);
+		if (!header) {
+			noHeader.push(family);
+			continue;
+		}
+		const sha = computeBodySha(source);
+		if (sha === header.sha && lock.families[family]?.sha === sha) {
+			unchanged.push(family);
+			continue;
+		}
+		await writeFile(file, rewriteHeaderSha(source, sha));
+		lock.families[family] = {
+			version: header.version,
+			sha
+		};
+		resealed.push(family);
+	}
+	await writeLockfile(recipesDir, lock);
+	return {
+		resealed,
+		unchanged,
+		notFound,
+		noHeader
+	};
+}
+//#endregion
 //#region src/commands/preset.ts
 async function preset(options) {
 	const cwd = path.resolve(options.cwd);
 	const config = await readConfig(cwd);
-	const source = createRegistrySource(options.registry ?? config.registry);
+	const source = await resolveSource(options.registry ?? config.registry);
 	if (options.name === "none") throw new Error("Use `shortwind remove` to uninstall families; preset 'none' is for `init` only.");
 	const presets = await source.loadPresets();
 	const all = await source.listAllFamilies();
@@ -628,7 +1088,7 @@ async function ls(options) {
 	});
 	let available = [];
 	if (!options.installedOnly) {
-		const source = createRegistrySource(options.registry ?? config.registry);
+		const source = await resolveSource(options.registry ?? config.registry);
 		try {
 			available = await source.listAllFamilies();
 		} catch {
@@ -762,6 +1222,12 @@ async function dev(options) {
 		timer = setTimeout(() => void runBuild(false), debounceMs);
 	};
 	watcher.on("add", schedule).on("change", schedule).on("unlink", schedule);
+	watcher.on("error", (err) => {
+		status({
+			kind: "error",
+			message: err instanceof Error ? err.message : String(err)
+		});
+	});
 	let stopped = false;
 	const stop = async () => {
 		if (stopped) return;
@@ -802,7 +1268,7 @@ async function upgrade(options) {
 	const cwd = path.resolve(options.cwd);
 	const config = await readConfig(cwd);
 	const registry = options.registry ?? config.registry;
-	const source = options.source ?? createRegistrySource(registry);
+	const source = options.source ?? await resolveSource(registry);
 	const recipesDir = path.join(cwd, config.recipesDir);
 	const installed = installedFamilies(recipesDir);
 	const targets = options.families && options.families.length > 0 ? options.families : installed;
@@ -831,6 +1297,7 @@ async function upgrade(options) {
 		let incomingBody;
 		try {
 			incomingBody = await source.loadFamily(family);
+			verifyFetchedFamily(incomingBody, family);
 		} catch (err) {
 			errors.push({
 				family,
@@ -852,7 +1319,9 @@ async function upgrade(options) {
 		const recordedSha = localHeader?.sha ?? "";
 		const actualSha = computeBodySha(localBody);
 		const lockedVersion = lock.families[family]?.version ?? localHeader?.version ?? "";
-		const isTouched = recordedSha !== "" && recordedSha !== actualSha;
+		const recordedIsLegacy = isLegacyFingerprint(recordedSha);
+		if (recordedIsLegacy) console.warn(`[shortwind] ${family}.css uses an older fingerprint format — run \`shortwind reseal\` to upgrade its seal (the recipe body is unchanged).`);
+		const isTouched = recordedSha !== "" && recordedSha !== actualSha && !recordedIsLegacy;
 		if ((isTouched ? "touched" : lockedVersion === incomingVersion ? "unchanged" : "pristine") === "unchanged" && !isTouched) {
 			outcomes.push({
 				family,
@@ -949,8 +1418,9 @@ async function upgrade(options) {
 		skillPath
 	};
 }
+let atomicWriteSeq = 0;
 async function atomicWrite(filePath, body) {
-	const tmp = filePath + ".tmp";
+	const tmp = `${filePath}.${process.pid}.${atomicWriteSeq++}.tmp`;
 	const fh = await open(tmp, "w");
 	try {
 		await fh.writeFile(body);
@@ -984,13 +1454,24 @@ async function verify(options) {
 			continue;
 		}
 		const actual = computeBodySha(source);
-		if (header.sha !== actual) issues.push({
-			family,
-			kind: "header-tampered",
-			file: filePath,
-			recorded: header.sha,
-			actual
-		});
+		if (header.sha !== actual) {
+			if (isLegacyFingerprint(header.sha)) {
+				issues.push({
+					family,
+					kind: "legacy-fingerprint",
+					file: filePath,
+					recorded: header.sha
+				});
+				continue;
+			}
+			issues.push({
+				family,
+				kind: "header-tampered",
+				file: filePath,
+				recorded: header.sha,
+				actual
+			});
+		}
 		const locked = lock.families[family];
 		if (!locked) issues.push({
 			family,
@@ -1038,7 +1519,7 @@ const DEFAULT_RECIPES_CSS = {
 	"navigation.css": "/* shortwind: navigation@0.0.1 sha:000000 */\n\n/* @guide\n   @nav is the container; links are @nav-link with @nav-link-active for the\n   current page. Tabs mirror that pair: @tab and @tab-active. Use @breadcrumb\n   for trail navigation. Active and inactive are separate recipes — swap the\n   whole class rather than combining them.\n*/\n\n/* Top-level nav container. */\n@recipe nav {\n  flex items-center gap-1\n}\n\n/* Inactive nav link with hover/focus states. */\n@recipe nav-link {\n  inline-flex items-center gap-2 rounded-md px-3 py-1.5 text-sm font-medium text-muted-foreground transition-colors hover:bg-muted hover:text-foreground focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring\n}\n\n/* Active nav link. */\n@recipe nav-link-active {\n  inline-flex items-center gap-2 rounded-md bg-muted px-3 py-1.5 text-sm font-medium text-foreground focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring\n}\n\n/* Breadcrumb trail container. */\n@recipe breadcrumb {\n  flex items-center gap-1.5 text-sm text-muted-foreground\n}\n\n/* Inactive tab control. */\n@recipe tab {\n  inline-flex items-center gap-2 border-b-2 border-transparent px-3 py-2 text-sm font-medium text-muted-foreground transition-colors hover:border-border hover:text-foreground focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring\n}\n\n/* Active tab control. */\n@recipe tab-active {\n  inline-flex items-center gap-2 border-b-2 border-primary px-3 py-2 text-sm font-medium text-primary focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring\n}\n",
 	"progress.css": "/* shortwind: progress@0.0.1 sha:000000 */\n\n/* @guide\n   A bar is two pieces: @progress-track (the background) wrapping @progress-bar\n   (the fill). For an indeterminate state use @spinner instead — it's a\n   standalone loader, not a bar.\n*/\n\n/* Progress bar track (background). */\n@recipe progress-track {\n  h-2 w-full overflow-hidden rounded-full bg-muted\n}\n\n/* Progress bar fill. */\n@recipe progress-bar {\n  h-full rounded-full bg-primary transition-all\n}\n\n/* Indeterminate loading spinner. */\n@recipe spinner {\n  inline-block h-4 w-4 animate-spin rounded-full border-2 border-border border-t-primary\n}\n",
 	"skeleton.css": "/* shortwind: skeleton@0.0.1 sha:000000 */\n\n/* @guide\n   Match the skeleton to the shape it stands in for: @skeleton (block),\n   @skeleton-text (a text line), @skeleton-circle (avatar/icon). Size block and\n   text skeletons with raw width/height utilities.\n*/\n\n/* Default rectangular skeleton placeholder. */\n@recipe skeleton {\n  animate-pulse rounded-md bg-muted\n}\n\n/* Single-line text skeleton. */\n@recipe skeleton-text {\n  h-4 w-full animate-pulse rounded bg-muted\n}\n\n/* Circular skeleton (avatar/icon). */\n@recipe skeleton-circle {\n  h-10 w-10 animate-pulse rounded-full bg-muted\n}\n",
-	"surface.css": "/* shortwind: surface@0.0.1 sha:000000 */\n\n/* @guide\n   @surface / @surface-muted / @surface-accent set a background+foreground pair\n   for a region — one per section. @container (or @container-tight for prose)\n   centers and width-caps content; there is no @container-lg, set a different cap\n   with max-w-* yourself. @divider-h and @divider-v are hairline rules.\n*/\n\n/* Default page/section surface. */\n@recipe surface {\n  bg-background text-foreground\n}\n\n/* Muted surface — secondary background. */\n@recipe surface-muted {\n  bg-muted text-foreground\n}\n\n/* Accent surface — soft brand background. */\n@recipe surface-accent {\n  bg-accent text-accent-foreground\n}\n\n/* Standard content container with max width. */\n@recipe container {\n  mx-auto w-full max-w-6xl px-4 sm:px-6 lg:px-8\n}\n\n/* Narrow content container for prose. */\n@recipe container-tight {\n  mx-auto w-full max-w-3xl px-4 sm:px-6\n}\n\n/* Horizontal divider line. */\n@recipe divider-h {\n  shrink-0 h-px w-full bg-border\n}\n\n/* Vertical divider line. */\n@recipe divider-v {\n  shrink-0 h-full w-px bg-border\n}\n",
+	"surface.css": "/* shortwind: surface@0.0.1 sha:000000 */\n\n/* @guide\n   @surface / @surface-muted / @surface-accent set a background+foreground pair\n   for a region — one per section. @wrapper (or @wrapper-tight for prose)\n   centers and width-caps content; there is no @wrapper-lg, set a different cap\n   with max-w-* yourself. (Note: @container is reserved for Tailwind's\n   container-query utility, so the content wrapper is @wrapper.) @divider-h and\n   @divider-v are hairline rules.\n*/\n\n/* Default page/section surface. */\n@recipe surface {\n  bg-background text-foreground\n}\n\n/* Muted surface — secondary background. */\n@recipe surface-muted {\n  bg-muted text-foreground\n}\n\n/* Accent surface — soft brand background. */\n@recipe surface-accent {\n  bg-accent text-accent-foreground\n}\n\n/* Centered content wrapper with a max width. */\n@recipe wrapper {\n  mx-auto w-full max-w-6xl px-4 sm:px-6 lg:px-8\n}\n\n/* Narrow content wrapper for prose. */\n@recipe wrapper-tight {\n  mx-auto w-full max-w-3xl px-4 sm:px-6\n}\n\n/* Horizontal divider line. */\n@recipe divider-h {\n  shrink-0 h-px w-full bg-border\n}\n\n/* Vertical divider line. */\n@recipe divider-v {\n  shrink-0 h-full w-px bg-border\n}\n",
 	"table.css": "/* shortwind: table@0.0.1 sha:000000 */\n\n/* @guide\n   Wrap the table in @table-container for horizontal overflow, then put @table\n   (or @table-zebra for striped rows) on the <table>. Cells are @th (header) and\n   @td (body); add @tr-hover to a <tr> for row highlighting.\n*/\n\n/* Scroll container for a wide table — keeps overflow horizontal. */\n@recipe table-container {\n  w-full overflow-x-auto rounded-md border border-border\n}\n\n/* Data table base. */\n@recipe table {\n  w-full border-collapse text-left text-sm text-foreground\n}\n\n/* Table header cell. */\n@recipe th {\n  border-b border-border px-3 py-2 text-xs font-semibold uppercase tracking-wide text-muted-foreground\n}\n\n/* Table body cell. */\n@recipe td {\n  border-b border-border px-3 py-2\n}\n\n/* Row hover state. */\n@recipe tr-hover {\n  transition-colors hover:bg-muted\n}\n\n/* Table with zebra striping on alternating rows. */\n@recipe table-zebra {\n  w-full border-collapse text-left text-sm text-foreground [&_tbody_tr:nth-child(odd)]:bg-muted\n}\n",
 	"text.css": "/* shortwind: text@0.0.1 sha:000000 */\n\n/* @guide\n   Headings are sized by weight, not HTML level: @heading-xl/lg/md/sm — there\n   is no @h1..@h6. Body copy: @body (default), @lead (intro paragraphs), @muted\n   (secondary), @caption (fine print). Use @label for form labels and @link for\n   inline links. Don't append a -text suffix: it's @body not @body-text, @muted\n   not @muted-text, @link not @link-text.\n*/\n\n/* Top-level page heading. */\n@recipe heading-xl {\n  text-4xl font-bold tracking-tight text-foreground\n}\n\n/* Large section heading. */\n@recipe heading-lg {\n  text-2xl font-semibold tracking-tight text-foreground\n}\n\n/* Medium heading. */\n@recipe heading-md {\n  text-xl font-semibold text-foreground\n}\n\n/* Small heading. */\n@recipe heading-sm {\n  text-base font-semibold text-foreground\n}\n\n/* Default body text. */\n@recipe body {\n  text-sm leading-6 text-foreground\n}\n\n/* Lead paragraph — larger body copy for hero/intro sections. */\n@recipe lead {\n  text-lg leading-relaxed text-muted-foreground\n}\n\n/* Muted secondary text. */\n@recipe muted {\n  text-sm text-muted-foreground\n}\n\n/* Form label text. */\n@recipe label {\n  text-sm font-medium text-foreground\n}\n\n/* Caption — small supporting text. */\n@recipe caption {\n  text-xs text-muted-foreground\n}\n\n/* Inline link with hover/focus states. */\n@recipe link {\n  text-primary underline-offset-2 hover:underline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring\n}\n",
 	"tooltip.css": "/* shortwind: tooltip@0.0.1 sha:000000 */\n\n/* @guide\n   @tooltip is the floating label bubble — it styles appearance only, so pair it\n   with your own positioning.\n*/\n\n/* Floating tooltip bubble. */\n@recipe tooltip {\n  pointer-events-none z-50 rounded-md bg-foreground px-2 py-1 text-xs font-medium text-background shadow-md\n}\n"
@@ -1162,7 +1643,7 @@ const CORPUS_FILES = {
             <div className="h-8 w-8 rounded-full bg-primary/20" />
           </div>
         </header>
-        <main className="@container @stack-lg py-8">
+        <main className="@wrapper @stack-lg py-8">
           <div className="@grid-3">
             <div className="@card-elevated">Card 1</div>
             <div className="@card-elevated">Card 2</div>
@@ -1186,7 +1667,8 @@ const ALL_RULES = [
 	"recipe/bad-suffix-order",
 	"recipe/conflicting-intent",
 	"recipe/dynamic-class",
-	"recipe/no-sibling-overlap"
+	"recipe/no-sibling-overlap",
+	"recipe/reserved-name"
 ];
 const DEFAULT_CONTENT = ["src/**/*.{html,js,jsx,ts,tsx,vue,svelte,astro,md,mdx}"];
 async function lint(options) {
@@ -1198,6 +1680,7 @@ async function lint(options) {
 	const { registry, parseFindings } = loadRegistry(recipesDir, enabledRules);
 	findings.push(...parseFindings);
 	findings.push(...checkRecipeNames(registry, recipesDir, enabledRules));
+	findings.push(...checkReservedNames(registry, recipesDir, enabledRules));
 	const files = await glob(options.content ?? DEFAULT_CONTENT, {
 		cwd,
 		absolute: true,
@@ -1218,7 +1701,7 @@ async function lint(options) {
 			for (const token of u.tokens) {
 				if (!token.value.startsWith("@")) continue;
 				const name = token.value.slice(1);
-				if (registry.flattened[name]) usedRecipes.add(name);
+				if (Object.hasOwn(registry.flattened, name)) usedRecipes.add(name);
 				else if (enabledRules.has("recipe/unknown")) findings.push({
 					rule: "recipe/unknown",
 					severity: "error",
@@ -1387,12 +1870,28 @@ function checkRecipeNames(registry, recipesDir, enabledRules) {
 	}
 	return findings;
 }
+function checkReservedNames(registry, recipesDir, enabledRules) {
+	if (!enabledRules.has("recipe/reserved-name")) return [];
+	const findings = [];
+	for (const recipes of Object.values(registry.families)) for (const recipe of recipes) {
+		if (!isReservedRecipeName(recipe.name)) continue;
+		findings.push({
+			rule: "recipe/reserved-name",
+			severity: "error",
+			file: path.join(recipesDir, recipe.sourceFile),
+			line: recipe.sourceLine,
+			column: 1,
+			message: `recipe @${recipe.name} collides with a reserved Tailwind @-utility; rename it`
+		});
+	}
+	return findings;
+}
 function checkUsageSuffixOrder(file, tokens, registry) {
 	const findings = [];
 	for (const token of tokens) {
 		if (!token.value.startsWith("@")) continue;
 		const name = token.value.slice(1);
-		if (!registry.flattened[name]) continue;
+		if (!Object.hasOwn(registry.flattened, name)) continue;
 		const meta = recipeMeta(name, familyForRecipe(registry, name));
 		if (!meta.badOrder) continue;
 		findings.push({
@@ -1411,7 +1910,7 @@ function checkConflictingIntent(file, tokens, registry) {
 	for (const token of tokens) {
 		if (!token.value.startsWith("@")) continue;
 		const name = token.value.slice(1);
-		if (!registry.flattened[name]) continue;
+		if (!Object.hasOwn(registry.flattened, name)) continue;
 		const meta = recipeMeta(name, familyForRecipe(registry, name));
 		if (!meta.intent) continue;
 		const familyIntents = byFamily.get(meta.family) ?? /* @__PURE__ */ new Map();
@@ -1445,7 +1944,7 @@ function checkSiblingOverlap(file, tokens, registry) {
 	for (const token of tokens) {
 		if (!token.value.startsWith("@")) continue;
 		const name = token.value.slice(1);
-		if (!registry.flattened[name]) continue;
+		if (!Object.hasOwn(registry.flattened, name)) continue;
 		const family = familyForRecipe(registry, name) ?? name.split("-")[0] ?? name;
 		const arr = byFamily.get(family) ?? [];
 		arr.push({
@@ -1489,6 +1988,7 @@ function checkDynamicClass(file, dynamicTokens) {
 const CLASS_ATTR_STR_RE = /\b(?:class|className)\s*=\s*(["'])([^"']*)\1/g;
 const CLASS_ATTR_BRACE_RE = /\b(?:class|className)\s*=\s*\{/g;
 const STRING_LITERAL_RE = /(["'`])((?:\\.|(?!\1)[^\\])*)\1/g;
+const CALL_EXPANDER_RE = /\b(?:cva|tv)\s*\(/g;
 function extractClassUsages(source) {
 	const usages = [];
 	for (const m of source.matchAll(CLASS_ATTR_STR_RE)) {
@@ -1527,6 +2027,28 @@ function extractClassUsages(source) {
 			});
 		}
 	}
+	for (const m of source.matchAll(CALL_EXPANDER_RE)) {
+		const openParen = (m.index ?? 0) + m[0].length - 1;
+		const close = findMatchingDelimiter(source, openParen, "(", ")");
+		if (close === -1) continue;
+		const inner = source.slice(openParen + 1, close);
+		for (const sm of inner.matchAll(STRING_LITERAL_RE)) {
+			const value = sm[2] ?? "";
+			if (value.length === 0) continue;
+			const literalStart = openParen + 1 + (sm.index ?? 0);
+			const valueStart = literalStart + 1;
+			const { tokens, dynamicTokens } = tokenizeClassString(source, value, valueStart);
+			if (!tokens.some((t) => t.value.startsWith("@")) && dynamicTokens.length === 0) continue;
+			usages.push({
+				fileOffset: literalStart,
+				valueStart,
+				raw: value,
+				tokens,
+				dynamicTokens,
+				fixable: false
+			});
+		}
+	}
 	return usages;
 }
 function tokenizeClassString(source, value, valueStart) {
@@ -1561,6 +2083,23 @@ function tokenizeClassString(source, value, valueStart) {
 	};
 }
 function findMatchingBrace(source, openIdx) {
+	return findMatchingDelimiter(source, openIdx, "{", "}");
+}
+function spliceRedundantTokens(raw, isRedundant) {
+	const pieces = raw.split(/(\s+)/);
+	const drop = new Array(pieces.length).fill(false);
+	for (let i = 0; i < pieces.length; i++) {
+		const piece = pieces[i] ?? "";
+		if (piece.length === 0 || /^\s+$/.test(piece)) continue;
+		if (piece.startsWith("@") || piece.includes("${")) continue;
+		if (!isRedundant(piece)) continue;
+		drop[i] = true;
+		if (i > 0 && /^\s+$/.test(pieces[i - 1] ?? "")) drop[i - 1] = true;
+		else if (/^\s+$/.test(pieces[i + 1] ?? "")) drop[i + 1] = true;
+	}
+	return pieces.filter((_, i) => !drop[i]).join("");
+}
+function findMatchingDelimiter(source, openIdx, open, close) {
 	let depth = 1;
 	let i = openIdx + 1;
 	while (i < source.length && depth > 0) {
@@ -1606,8 +2145,8 @@ function findMatchingBrace(source, openIdx) {
 			}
 			continue;
 		}
-		if (ch === "{") depth++;
-		else if (ch === "}") depth--;
+		if (ch === open) depth++;
+		else if (ch === close) depth--;
 		i++;
 	}
 	return depth === 0 ? i - 1 : -1;
@@ -1639,25 +2178,18 @@ function checkRedundantUtility(file, source, registry, applyFix) {
 			for (const t of exp) expansions.add(t);
 		}
 		if (expansions.size === 0) continue;
-		const kept = [];
-		for (const tok of usage.tokens) {
-			if (!tok.value.startsWith("@") && expansions.has(tok.value)) {
-				findings.push({
-					rule: "recipe/no-redundant-utility",
-					severity: "info",
-					file,
-					line: tok.line,
-					column: tok.column,
-					message: `${tok.value} is already included by a recipe on this element`
-				});
-				continue;
-			}
-			kept.push(tok.value);
-		}
+		for (const tok of usage.tokens) if (!tok.value.startsWith("@") && expansions.has(tok.value)) findings.push({
+			rule: "recipe/no-redundant-utility",
+			severity: "info",
+			file,
+			line: tok.line,
+			column: tok.column,
+			message: `${tok.value} is already included by a recipe on this element`
+		});
 		if (fixed !== null && usage.fixable) {
 			if (usage.valueStart < cursor) continue;
 			fixed += source.slice(cursor, usage.valueStart);
-			fixed += kept.join(" ");
+			fixed += spliceRedundantTokens(usage.raw, (t) => expansions.has(t));
 			cursor = usage.valueStart + usage.raw.length;
 		}
 	}
@@ -1724,7 +2256,7 @@ async function bench(options) {
 		expandedLlmTokens: 0
 	};
 	for (const { filename, content } of filesToBench) {
-		const expanded = transformContent(content, registry, { mode: filename.endsWith(".html") ? "html" : "jsx" });
+		const expanded = transformContent(content, registry, { mode: modeForFile(filename) });
 		const compactUsages = extractClassUsages(content);
 		const expandedUsages = extractClassUsages(expanded);
 		const fileResult = {
@@ -1831,6 +2363,6 @@ function formatBenchTable(result) {
 	return lines.join("\n");
 }
 //#endregion
-export { rewriteHeaderSha as A, createRegistrySource as C, computeBodySha as D, buildHeaderLine as E, extractHeader as O, writeLockfile as S, detectProject as T, add as _, formatFindingsText as a, init as b, UpgradeError as c, BuildError as d, build as f, remove as g, preset as h, extractClassUsages as i, sealRecipeFile as j, normalizeBody as k, upgrade as l, ls as m, formatBenchTable as n, lint as o, formatLsText as p, ALL_RULES as r, verify as s, bench as t, dev as u, renameFamilyInSource as v, resolvePresetFamilies as w, readLockfile as x, DEFAULT_REGISTRY as y };
+export { buildHeaderLine as A, cliVersion as C, createRegistrySource as D, writeLockfile as E, verifyFetchedFamily as F, extractHeader as M, rewriteHeaderSha as N, resolvePresetFamilies as O, sealRecipeFile as P, DEFAULT_REGISTRY as S, readLockfile as T, NewFamilyError as _, formatFindingsText as a, add as b, UpgradeError as c, BuildError as d, build as f, reseal as g, preset as h, extractClassUsages as i, computeBodySha as j, detectProject as k, upgrade as l, ls as m, formatBenchTable as n, lint as o, formatLsText as p, ALL_RULES as r, verify as s, bench as t, dev as u, newFamily as v, init as w, renameFamilyInSource as x, remove as y };
 
-//# sourceMappingURL=bench-a_9WmuOE.js.map
+//# sourceMappingURL=bench-BGTQAha8.js.map