@shortwind/cli 0.1.0-beta.1 → 0.1.0-beta.11

package/dist/{bench-NKKDz3ld.js → bench-oy9aPOvX.js}

@@ -1,15 +1,15 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { applyEdits, modify, parse } from "jsonc-parser";
-import { buildRegistry, isReservedRecipeName, parseRecipeFile, renderSkillMarkdown } from "@shortwind/core";
+import { PLACEHOLDER_SHA, RECIPE_SHA_HEX_LENGTH, buildRegistry, isReservedRecipeName, normalizeRecipeBody, parseRecipeFile, renderSkillMarkdown } from "@shortwind/core";
 import { createHash } from "node:crypto";
-import { fileURLToPath } from "node:url";
 import { glob } from "tinyglobby";
 import chokidar from "chokidar";
 import { Tiktoken } from "js-tiktoken/lite";
 import cl100k_base from "js-tiktoken/ranks/cl100k_base";
-import { loadRegistryFromDir, transformContent } from "@shortwind/tailwind";
+import { loadRegistryFromDir, modeForFile, transformContent } from "@shortwind/tailwind";
 //#region src/fingerprint.ts
 const HEADER_PATTERN = /^\/\*\s*shortwind:\s+(\S+)@(\S+)\s+sha:([^\s*]+)(?:\s+—\s+DO NOT EDIT THIS LINE)?\s*\*\/\s*$/;
 function extractHeader(source) {
@@ -26,12 +26,19 @@ function bodyAfterHeader(source) {
 	const eol = source.indexOf("\n");
 	return eol === -1 ? "" : source.slice(eol + 1);
 }
-function normalizeBody(body) {
-	return body.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n").map((line) => line.replace(/[\t ]+$/, "")).join("\n");
-}
 function computeBodySha(source) {
-	const normalized = normalizeBody(bodyAfterHeader(source));
-	return createHash("sha256").update(normalized).digest("hex").slice(0, 6);
+	const normalized = normalizeRecipeBody(bodyAfterHeader(source));
+	return createHash("sha256").update(normalized).digest("hex").slice(0, RECIPE_SHA_HEX_LENGTH);
+}
+function isLegacyFingerprint(sha) {
+	return sha !== PLACEHOLDER_SHA && sha.length < RECIPE_SHA_HEX_LENGTH && /^[0-9a-f]+$/.test(sha);
+}
+function verifyFetchedFamily(source, family) {
+	const header = extractHeader(source);
+	if (!header || header.sha === PLACEHOLDER_SHA) return;
+	if (header.family !== family) throw new Error(`integrity check failed for "${family}": registry returned a recipe sealed as "${header.family}" — wrong family or a tampered/corrupted response`);
+	const actual = computeBodySha(source);
+	if (header.sha !== actual) throw new Error(`integrity check failed for "${family}": header sha ${header.sha} does not match content sha ${actual} — the registry response was tampered with or corrupted in transit`);
 }
 function buildHeaderLine(family, version, sha) {
 	return `/* shortwind: ${family}@${version} sha:${sha} — DO NOT EDIT THIS LINE */`;
@@ -51,13 +58,20 @@ function sealRecipeFile(source, family, version) {
 }
 //#endregion
 //#region src/detect.ts
+function parsePackageJson(pkgPath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(pkgPath, "utf8"));
+	} catch (err) {
+		throw new Error(`${pkgPath}: invalid JSON — ${err.message}`);
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+	return parsed;
+}
 function detectProject(cwd) {
 	const pkgPath = path.join(cwd, "package.json");
 	const hasPackageJson = existsSync(pkgPath);
-	const pkg = hasPackageJson ? JSON.parse(readFileSync(pkgPath, "utf8")) : {
-		dependencies: {},
-		devDependencies: {}
-	};
+	const pkg = hasPackageJson ? parsePackageJson(pkgPath) : {};
 	const deps = {
 		...pkg.dependencies ?? {},
 		...pkg.devDependencies ?? {}
@@ -113,9 +127,64 @@ function assertValidFamilyName(family) {
 	if (!FAMILY_RE.test(family)) throw new Error(`invalid family name: ${JSON.stringify(family)} (must match ${FAMILY_RE})`);
 }
 function createRegistrySource(origin) {
-	if (origin.startsWith("http://") || origin.startsWith("https://")) return httpSource(origin);
+	if (origin.startsWith("http://")) {
+		console.warn(`[shortwind] registry origin ${origin} uses plaintext http:// — recipe content is unauthenticated and tamperable in transit; prefer https://`);
+		return httpSource(origin);
+	}
+	if (origin.startsWith("https://")) return httpSource(origin);
 	return fileSource(origin);
 }
+async function resolveSource(origin) {
+	if (origin && origin !== "bundled:@shortwind/catalog") return createRegistrySource(origin);
+	return defaultCatalogSource();
+}
+const CATALOG_PACKAGE = "@shortwind/catalog";
+const NPM_TIMEOUT_MS = 3e3;
+const FETCH_TIMEOUT_MS = 1e4;
+async function defaultCatalogSource() {
+	try {
+		const cdn = httpSource(`https://cdn.jsdelivr.net/npm/${CATALOG_PACKAGE}@${await resolveCatalogVersion()}/dist/registry`);
+		await cdn.loadPresets();
+		return cdn;
+	} catch {
+		return bundledSource();
+	}
+}
+async function resolveCatalogVersion() {
+	const res = await fetch(`https://registry.npmjs.org/${CATALOG_PACKAGE}`, {
+		signal: AbortSignal.timeout(NPM_TIMEOUT_MS),
+		headers: { accept: "application/vnd.npm.install-v1+json" }
+	});
+	if (!res.ok) throw new Error(`npm: ${res.status}`);
+	const tags = (await res.json())["dist-tags"] ?? {};
+	const version = tags["latest"] ?? tags["beta"];
+	if (!version) throw new Error("no published catalog version");
+	return version;
+}
+const BUNDLED_ORIGIN = "bundled:@shortwind/catalog";
+function bundledSource() {
+	let cache = null;
+	const load = () => {
+		cache ??= import("./catalog.generated-DRttebfK.js");
+		return cache;
+	};
+	return {
+		origin: BUNDLED_ORIGIN,
+		async loadPresets() {
+			return (await load()).CATALOG_PRESETS;
+		},
+		async loadFamily(family) {
+			assertValidFamilyName(family);
+			const { CATALOG_RECIPES } = await load();
+			const css = CATALOG_RECIPES[family];
+			if (css === void 0) throw new Error(`unknown family: ${family}`);
+			return css;
+		},
+		async listAllFamilies() {
+			return [...(await load()).CATALOG_FAMILIES];
+		}
+	};
+}
 function fileSource(origin) {
 	const root = origin.startsWith("file://") ? fileURLToPath(origin) : origin;
 	return {
@@ -136,21 +205,26 @@ function fileSource(origin) {
 }
 function httpSource(origin) {
 	const base = origin.replace(/\/+$/, "");
+	const get = (url) => fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+	let presetsCache = null;
 	return {
 		origin,
-		async loadPresets() {
-			const res = await fetch(`${base}/presets.json`);
-			if (!res.ok) throw new Error(`presets.json: ${res.status} ${res.statusText}`);
-			return await res.json();
+		loadPresets() {
+			presetsCache ??= (async () => {
+				const res = await get(`${base}/presets.json`);
+				if (!res.ok) throw new Error(`presets.json: ${res.status} ${res.statusText}`);
+				return await res.json();
+			})();
+			return presetsCache;
 		},
 		async loadFamily(family) {
 			assertValidFamilyName(family);
-			const res = await fetch(`${base}/recipes/${family}.css`);
+			const res = await get(`${base}/recipes/${family}.css`);
 			if (!res.ok) throw new Error(`${family}.css: ${res.status} ${res.statusText}`);
 			return res.text();
 		},
 		async listAllFamilies() {
-			const res = await fetch(`${base}/index.json`);
+			const res = await get(`${base}/index.json`);
 			if (!res.ok) throw new Error(`index.json: ${res.status} ${res.statusText}`);
 			return (await res.json()).families.filter((name) => FAMILY_RE.test(name));
 		}
@@ -341,6 +415,21 @@ async function scaffoldTheme(cwd) {
 		action: "created"
 	};
 }
+const THEME_COLOR_TOKENS = new Set([...THEME_BLOCK.matchAll(/--color-([\w-]+)\s*:/g)].map((m) => m[1] ?? ""));
+const COLOR_UTILITY_RE = /^(?:bg|text|border|ring|outline|fill|stroke|divide|accent|caret|decoration|shadow|from|via|to|placeholder)-(.+)$/;
+function referencedThemeTokens(flattened) {
+	const out = /* @__PURE__ */ new Set();
+	for (const utilities of Object.values(flattened)) for (const raw of utilities) {
+		const m = (raw.split(":").pop() ?? raw).match(COLOR_UTILITY_RE);
+		if (!m) continue;
+		const name = (m[1] ?? "").replace(/\/.*$/, "");
+		if (THEME_COLOR_TOKENS.has(name)) out.add(name);
+	}
+	return [...out].sort();
+}
+function findMissingThemeTokens(css, flattened) {
+	return referencedThemeTokens(flattened).filter((name) => !new RegExp(`--(?:color-)?${name}\\s*:`).test(css));
+}
 function isTailwindV4(cwd) {
 	try {
 		const pkg = JSON.parse(readFileSync(path.join(cwd, "package.json"), "utf8"));
@@ -371,7 +460,7 @@ async function wireBundler(cwd, bundler) {
 	if (bundler === "next") return {
 		configPath: null,
 		action: "manual",
-		snippet: `import { withShortwind } from "@shortwind/next";\n// wrap your Next config: export default withShortwind(nextConfig);`,
+		snippet: `import { withShortwind } from "@shortwind/next";\n// withShortwind is curried — wrap your Next config:\n//   export default withShortwind()(nextConfig);`,
 		reason: "Next config wiring is manual"
 	};
 	if (bundler === "astro") return {
@@ -423,17 +512,61 @@ function addImport(source, line) {
 	return source.slice(0, lastEnd) + `\n${line}` + source.slice(lastEnd);
 }
 //#endregion
+//#region src/agents-file.ts
+const MARKER = "skills/shortwind/SKILL.md";
+function line(skillRel) {
+	return `For UI, prefer Shortwind \`@recipe\` class names (e.g. \`@card\`, \`@btn-primary\`, \`@row\`) over raw Tailwind where a recipe fits — full catalog in \`${skillRel}\`.`;
+}
+const CANDIDATES = ["AGENTS.md", "CLAUDE.md"];
+async function wireAgentsInstructions(cwd, skillPath) {
+	const pointer = line(path.relative(cwd, skillPath).split(path.sep).join("/"));
+	let touched = null;
+	for (const name of CANDIDATES) {
+		const file = path.join(cwd, name);
+		if (!existsSync(file)) continue;
+		const current = await readFile(file, "utf8");
+		if (current.includes(MARKER)) {
+			touched ??= {
+				path: file,
+				action: "skipped"
+			};
+			continue;
+		}
+		await writeFile(file, current + (current.endsWith("\n\n") ? "" : current.endsWith("\n") ? "\n" : "\n\n") + pointer + "\n");
+		return {
+			path: file,
+			action: "appended"
+		};
+	}
+	if (touched) return touched;
+	const target = path.join(cwd, "AGENTS.md");
+	await writeFile(target, `# AGENTS.md\n\n${pointer}\n`);
+	return {
+		path: target,
+		action: "created"
+	};
+}
+//#endregion
 //#region src/init.ts
-const DEFAULT_REGISTRY = "https://shortwind.dev/registry";
+const DEFAULT_REGISTRY = BUNDLED_ORIGIN;
 async function init(options) {
 	const cwd = path.resolve(options.cwd);
-	const registry = options.registry ?? "https://shortwind.dev/registry";
-	const source = createRegistrySource(registry);
+	const registry = options.registry ?? DEFAULT_REGISTRY;
+	const source = await resolveSource(registry);
 	const shape = detectProject(cwd);
 	const families = await resolveFamilies(options.preset, source);
 	const pkgs = pickPackages(shape.bundler);
+	const version = cliVersion();
+	const specs = version ? pkgs.map((p) => `${p}@${version}`) : pkgs;
 	const installer = options.installPackages ?? defaultInstall;
-	if (pkgs.length > 0) await installer(shape.packageManager, pkgs, cwd);
+	let installOk = true;
+	let installError = null;
+	if (specs.length > 0) try {
+		await installer(shape.packageManager, specs, cwd);
+	} catch (err) {
+		installOk = false;
+		installError = err instanceof Error ? err.message : String(err);
+	}
 	const recipesDir = path.join(cwd, "recipes");
 	const { installed, skipped } = await copyRecipes(source, families, recipesDir);
 	await updateLockfile(recipesDir, registry, installed);
@@ -447,9 +580,12 @@ async function init(options) {
 	const huskyPath = path.join(cwd, ".husky", "pre-commit");
 	await installHuskyHook(huskyPath);
 	const skillPath = path.join(cwd, "skills", "shortwind", "SKILL.md");
-	await writeSkillMd(skillPath, recipesDir, families);
+	const skillRegistry = await writeSkillMd(skillPath, recipesDir, families);
 	const theme = await scaffoldTheme(cwd);
+	let missingThemeTokens = [];
+	if (theme.action === "skipped" && theme.themePath && skillRegistry) missingThemeTokens = findMissingThemeTokens(await readFile(theme.themePath, "utf8"), skillRegistry.flattened);
 	const bundlerConfig = await wireBundler(cwd, shape.bundler);
+	const agentsFile = await wireAgentsInstructions(cwd, skillPath);
 	return {
 		packageManager: shape.packageManager,
 		preset: options.preset,
@@ -464,15 +600,28 @@ async function init(options) {
 		skillPath,
 		themePath: theme.themePath,
 		themeAction: theme.action,
+		missingThemeTokens,
 		bundlerConfigPath: bundlerConfig.configPath,
 		bundlerConfigAction: bundlerConfig.action,
-		...bundlerConfig.snippet ? { bundlerConfigSnippet: bundlerConfig.snippet } : {}
+		...bundlerConfig.snippet ? { bundlerConfigSnippet: bundlerConfig.snippet } : {},
+		agentsFilePath: agentsFile.path,
+		agentsFileAction: agentsFile.action,
+		installOk,
+		installError
 	};
 }
 async function resolveFamilies(preset, source) {
 	if (preset === "none") return [];
 	return resolvePresetFamilies(preset, await source.loadPresets(), await source.listAllFamilies());
 }
+function cliVersion() {
+	try {
+		const pkgUrl = new URL("../package.json", import.meta.url);
+		return JSON.parse(readFileSync(fileURLToPath(pkgUrl), "utf8")).version ?? null;
+	} catch {
+		return null;
+	}
+}
 function pickPackages(bundler) {
 	const base = ["@shortwind/tailwind"];
 	switch (bundler) {
@@ -544,6 +693,7 @@ async function copyRecipes(source, families, recipesDir) {
 			continue;
 		}
 		const body = await source.loadFamily(family);
+		verifyFetchedFamily(body, family);
 		await writeFile(target, rewriteHeaderSha(body, computeBodySha(body)));
 		installed.push(family);
 	}
@@ -562,8 +712,14 @@ async function writeConfig(configPath, next) {
 		await writeFile(configPath, JSON.stringify(desired, null, 2) + "\n");
 		return;
 	}
+	let current;
+	try {
+		current = JSON.parse(await readFile(configPath, "utf8"));
+	} catch (err) {
+		throw new Error(`${configPath}: invalid JSON — ${err.message}`);
+	}
 	const merged = {
-		...JSON.parse(await readFile(configPath, "utf8")),
+		...current !== null && typeof current === "object" && !Array.isArray(current) ? current : {},
 		...desired
 	};
 	await writeFile(configPath, JSON.stringify(merged, null, 2) + "\n");
@@ -595,9 +751,9 @@ async function installHuskyHook(huskyPath) {
 	await writeFile(huskyPath, current.endsWith("\n") ? current + HUSKY_LINE + "\n" : current + "\nnpx shortwind build\n", { mode: 493 });
 }
 async function writeSkillMd(skillPath, recipesDir, families) {
-	await mkdir(path.dirname(skillPath), { recursive: true });
 	const allRecipes = [];
 	const guidance = {};
+	const problems = [];
 	for (const family of families) {
 		const filePath = path.join(recipesDir, `${family}.css`);
 		if (!existsSync(filePath)) continue;
@@ -605,23 +761,34 @@ async function writeSkillMd(skillPath, recipesDir, families) {
 		if (parsed.ok) {
 			allRecipes.push(...parsed.value.recipes);
 			if (parsed.value.guidance) guidance[family] = parsed.value.guidance;
-		}
+		} else problems.push(`${family}.css: ${parsed.errors.map((e) => e.message).join("; ")}`);
 	}
-	let registry = {
-		families: {},
-		flattened: {}
-	};
 	const resolved = buildRegistry(allRecipes, { guidance });
-	if (resolved.ok) registry = resolved.value;
-	await writeFile(skillPath, renderSkillMarkdown(registry, { order: families }));
+	if (problems.length > 0 || !resolved.ok) {
+		const all = resolved.ok ? problems : [...problems, ...resolved.errors.map((e) => e.message)];
+		console.warn(`[shortwind] SKILL.md not generated — recipe errors:\n  ${all.join("\n  ")}`);
+		return null;
+	}
+	await mkdir(path.dirname(skillPath), { recursive: true });
+	await writeFile(skillPath, renderSkillMarkdown(resolved.value, { order: families }));
+	return resolved.value;
 }
 //#endregion
 //#region src/project.ts
 const DEFAULT_CONFIG = {
-	registry: "https://shortwind.dev/registry",
+	registry: BUNDLED_ORIGIN,
 	recipesDir: "recipes",
 	outputPath: "skills/shortwind/SKILL.md"
 };
+function assertConfigString(value, field, configPath) {
+	if (typeof value !== "string") throw new Error(`${configPath}: "${field}" must be a string`);
+	return value;
+}
+function assertWithinCwd(cwd, value, field, configPath) {
+	const rel = path.relative(cwd, path.resolve(cwd, value));
+	if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`${configPath}: "${field}" (${JSON.stringify(value)}) must be a path inside the project directory`);
+	return value;
+}
 async function readConfig(cwd) {
 	const configPath = path.join(cwd, "shortwind.config.json");
 	if (!existsSync(configPath)) return DEFAULT_CONFIG;
@@ -632,10 +799,16 @@ async function readConfig(cwd) {
 	} catch (err) {
 		throw new Error(`${configPath}: invalid JSON — ${err.message}`);
 	}
-	return {
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${configPath}: expected a JSON object`);
+	const merged = {
 		...DEFAULT_CONFIG,
 		...parsed
 	};
+	return {
+		registry: assertConfigString(merged.registry, "registry", configPath),
+		recipesDir: assertWithinCwd(cwd, assertConfigString(merged.recipesDir, "recipesDir", configPath), "recipesDir", configPath),
+		outputPath: assertWithinCwd(cwd, assertConfigString(merged.outputPath, "outputPath", configPath), "outputPath", configPath)
+	};
 }
 function installedFamilies(recipesDir) {
 	if (!existsSync(recipesDir)) return [];
@@ -655,24 +828,25 @@ async function regenerateSkillMd(cwd, config) {
 	const recipesDir = path.join(cwd, config.recipesDir);
 	const families = installedFamilies(recipesDir);
 	const skillPath = path.join(cwd, config.outputPath);
-	const { mkdir } = await import("node:fs/promises");
-	await mkdir(path.dirname(skillPath), { recursive: true });
 	const allRecipes = [];
 	const guidance = {};
+	const problems = [];
 	for (const family of families) {
 		const parsed = parseRecipeFile(readFileSync(path.join(recipesDir, `${family}.css`), "utf8"), `${family}.css`);
 		if (parsed.ok) {
 			allRecipes.push(...parsed.value.recipes);
 			if (parsed.value.guidance) guidance[family] = parsed.value.guidance;
-		}
+		} else problems.push(`${family}.css: ${parsed.errors.map((e) => e.message).join("; ")}`);
 	}
-	let registry = {
-		families: {},
-		flattened: {}
-	};
 	const resolved = buildRegistry(allRecipes, { guidance });
-	if (resolved.ok) registry = resolved.value;
-	await writeFile(skillPath, renderSkillMarkdown(registry, { order: families }));
+	if (problems.length > 0 || !resolved.ok) {
+		const all = resolved.ok ? problems : [...problems, ...resolved.errors.map((e) => e.message)];
+		console.warn(`[shortwind] SKILL.md not regenerated — fix these recipe errors first:\n  ${all.join("\n  ")}\n  ${path.relative(cwd, skillPath)} left unchanged.`);
+		return skillPath;
+	}
+	const { mkdir } = await import("node:fs/promises");
+	await mkdir(path.dirname(skillPath), { recursive: true });
+	await writeFile(skillPath, renderSkillMarkdown(resolved.value, { order: families }));
 	return skillPath;
 }
 /**
@@ -698,7 +872,7 @@ async function add(options) {
 	const cwd = path.resolve(options.cwd);
 	const config = await readConfig(cwd);
 	const registry = options.registry ?? config.registry;
-	const source = createRegistrySource(registry);
+	const source = await resolveSource(registry);
 	const recipesDir = path.join(cwd, config.recipesDir);
 	await mkdir(recipesDir, { recursive: true });
 	const lock = await readLockfile(recipesDir);
@@ -706,6 +880,7 @@ async function add(options) {
 	const requested = options.all ? await source.listAllFamilies() : options.families;
 	if (options.all && options.as) throw new Error("--as cannot be combined with --all");
 	if (options.as && requested.length !== 1) throw new Error("--as requires exactly one family argument");
+	if (options.as !== void 0) assertValidFamilyName(options.as);
 	const added = [];
 	const skipped = [];
 	const overwritten = [];
@@ -720,6 +895,7 @@ async function add(options) {
 			continue;
 		}
 		const sourceCss = await source.loadFamily(family);
+		verifyFetchedFamily(sourceCss, family);
 		const renamed = options.as ? renameFamilyInSource(sourceCss, family, options.as) : sourceCss;
 		const sha = computeBodySha(renamed);
 		const finalCss = rewriteHeaderSha(renamed, sha);
@@ -854,11 +1030,55 @@ async function newFamily(options) {
 	};
 }
 //#endregion
+//#region src/commands/reseal.ts
+async function reseal(options) {
+	const cwd = path.resolve(options.cwd);
+	const config = await readConfig(cwd);
+	const recipesDir = path.join(cwd, config.recipesDir);
+	const families = options.families && options.families.length > 0 ? options.families : installedFamilies(recipesDir);
+	const lock = await readLockfile(recipesDir);
+	const resealed = [];
+	const unchanged = [];
+	const notFound = [];
+	const noHeader = [];
+	for (const family of families) {
+		const file = path.join(recipesDir, `${family}.css`);
+		if (!existsSync(file)) {
+			notFound.push(family);
+			continue;
+		}
+		const source = readFileSync(file, "utf8");
+		const header = extractHeader(source);
+		if (!header) {
+			noHeader.push(family);
+			continue;
+		}
+		const sha = computeBodySha(source);
+		if (sha === header.sha && lock.families[family]?.sha === sha) {
+			unchanged.push(family);
+			continue;
+		}
+		await writeFile(file, rewriteHeaderSha(source, sha));
+		lock.families[family] = {
+			version: header.version,
+			sha
+		};
+		resealed.push(family);
+	}
+	await writeLockfile(recipesDir, lock);
+	return {
+		resealed,
+		unchanged,
+		notFound,
+		noHeader
+	};
+}
+//#endregion
 //#region src/commands/preset.ts
 async function preset(options) {
 	const cwd = path.resolve(options.cwd);
 	const config = await readConfig(cwd);
-	const source = createRegistrySource(options.registry ?? config.registry);
+	const source = await resolveSource(options.registry ?? config.registry);
 	if (options.name === "none") throw new Error("Use `shortwind remove` to uninstall families; preset 'none' is for `init` only.");
 	const presets = await source.loadPresets();
 	const all = await source.listAllFamilies();
@@ -887,7 +1107,7 @@ async function ls(options) {
 	});
 	let available = [];
 	if (!options.installedOnly) {
-		const source = createRegistrySource(options.registry ?? config.registry);
+		const source = await resolveSource(options.registry ?? config.registry);
 		try {
 			available = await source.listAllFamilies();
 		} catch {
@@ -1021,6 +1241,12 @@ async function dev(options) {
 		timer = setTimeout(() => void runBuild(false), debounceMs);
 	};
 	watcher.on("add", schedule).on("change", schedule).on("unlink", schedule);
+	watcher.on("error", (err) => {
+		status({
+			kind: "error",
+			message: err instanceof Error ? err.message : String(err)
+		});
+	});
 	let stopped = false;
 	const stop = async () => {
 		if (stopped) return;
@@ -1061,7 +1287,7 @@ async function upgrade(options) {
 	const cwd = path.resolve(options.cwd);
 	const config = await readConfig(cwd);
 	const registry = options.registry ?? config.registry;
-	const source = options.source ?? createRegistrySource(registry);
+	const source = options.source ?? await resolveSource(registry);
 	const recipesDir = path.join(cwd, config.recipesDir);
 	const installed = installedFamilies(recipesDir);
 	const targets = options.families && options.families.length > 0 ? options.families : installed;
@@ -1090,6 +1316,7 @@ async function upgrade(options) {
 		let incomingBody;
 		try {
 			incomingBody = await source.loadFamily(family);
+			verifyFetchedFamily(incomingBody, family);
 		} catch (err) {
 			errors.push({
 				family,
@@ -1111,7 +1338,9 @@ async function upgrade(options) {
 		const recordedSha = localHeader?.sha ?? "";
 		const actualSha = computeBodySha(localBody);
 		const lockedVersion = lock.families[family]?.version ?? localHeader?.version ?? "";
-		const isTouched = recordedSha !== "" && recordedSha !== actualSha;
+		const recordedIsLegacy = isLegacyFingerprint(recordedSha);
+		if (recordedIsLegacy) console.warn(`[shortwind] ${family}.css uses an older fingerprint format — run \`shortwind reseal\` to upgrade its seal (the recipe body is unchanged).`);
+		const isTouched = recordedSha !== "" && recordedSha !== actualSha && !recordedIsLegacy;
 		if ((isTouched ? "touched" : lockedVersion === incomingVersion ? "unchanged" : "pristine") === "unchanged" && !isTouched) {
 			outcomes.push({
 				family,
@@ -1208,8 +1437,9 @@ async function upgrade(options) {
 		skillPath
 	};
 }
+let atomicWriteSeq = 0;
 async function atomicWrite(filePath, body) {
-	const tmp = filePath + ".tmp";
+	const tmp = `${filePath}.${process.pid}.${atomicWriteSeq++}.tmp`;
 	const fh = await open(tmp, "w");
 	try {
 		await fh.writeFile(body);
@@ -1243,13 +1473,24 @@ async function verify(options) {
 			continue;
 		}
 		const actual = computeBodySha(source);
-		if (header.sha !== actual) issues.push({
-			family,
-			kind: "header-tampered",
-			file: filePath,
-			recorded: header.sha,
-			actual
-		});
+		if (header.sha !== actual) {
+			if (isLegacyFingerprint(header.sha)) {
+				issues.push({
+					family,
+					kind: "legacy-fingerprint",
+					file: filePath,
+					recorded: header.sha
+				});
+				continue;
+			}
+			issues.push({
+				family,
+				kind: "header-tampered",
+				file: filePath,
+				recorded: header.sha,
+				actual
+			});
+		}
 		const locked = lock.families[family];
 		if (!locked) issues.push({
 			family,
@@ -1479,7 +1720,7 @@ async function lint(options) {
 			for (const token of u.tokens) {
 				if (!token.value.startsWith("@")) continue;
 				const name = token.value.slice(1);
-				if (registry.flattened[name]) usedRecipes.add(name);
+				if (Object.hasOwn(registry.flattened, name)) usedRecipes.add(name);
 				else if (enabledRules.has("recipe/unknown")) findings.push({
 					rule: "recipe/unknown",
 					severity: "error",
@@ -1669,7 +1910,7 @@ function checkUsageSuffixOrder(file, tokens, registry) {
 	for (const token of tokens) {
 		if (!token.value.startsWith("@")) continue;
 		const name = token.value.slice(1);
-		if (!registry.flattened[name]) continue;
+		if (!Object.hasOwn(registry.flattened, name)) continue;
 		const meta = recipeMeta(name, familyForRecipe(registry, name));
 		if (!meta.badOrder) continue;
 		findings.push({
@@ -1688,7 +1929,7 @@ function checkConflictingIntent(file, tokens, registry) {
 	for (const token of tokens) {
 		if (!token.value.startsWith("@")) continue;
 		const name = token.value.slice(1);
-		if (!registry.flattened[name]) continue;
+		if (!Object.hasOwn(registry.flattened, name)) continue;
 		const meta = recipeMeta(name, familyForRecipe(registry, name));
 		if (!meta.intent) continue;
 		const familyIntents = byFamily.get(meta.family) ?? /* @__PURE__ */ new Map();
@@ -1722,7 +1963,7 @@ function checkSiblingOverlap(file, tokens, registry) {
 	for (const token of tokens) {
 		if (!token.value.startsWith("@")) continue;
 		const name = token.value.slice(1);
-		if (!registry.flattened[name]) continue;
+		if (!Object.hasOwn(registry.flattened, name)) continue;
 		const family = familyForRecipe(registry, name) ?? name.split("-")[0] ?? name;
 		const arr = byFamily.get(family) ?? [];
 		arr.push({
@@ -1766,6 +2007,7 @@ function checkDynamicClass(file, dynamicTokens) {
 const CLASS_ATTR_STR_RE = /\b(?:class|className)\s*=\s*(["'])([^"']*)\1/g;
 const CLASS_ATTR_BRACE_RE = /\b(?:class|className)\s*=\s*\{/g;
 const STRING_LITERAL_RE = /(["'`])((?:\\.|(?!\1)[^\\])*)\1/g;
+const CALL_EXPANDER_RE = /\b(?:cva|tv)\s*\(/g;
 function extractClassUsages(source) {
 	const usages = [];
 	for (const m of source.matchAll(CLASS_ATTR_STR_RE)) {
@@ -1804,6 +2046,28 @@ function extractClassUsages(source) {
 			});
 		}
 	}
+	for (const m of source.matchAll(CALL_EXPANDER_RE)) {
+		const openParen = (m.index ?? 0) + m[0].length - 1;
+		const close = findMatchingDelimiter(source, openParen, "(", ")");
+		if (close === -1) continue;
+		const inner = source.slice(openParen + 1, close);
+		for (const sm of inner.matchAll(STRING_LITERAL_RE)) {
+			const value = sm[2] ?? "";
+			if (value.length === 0) continue;
+			const literalStart = openParen + 1 + (sm.index ?? 0);
+			const valueStart = literalStart + 1;
+			const { tokens, dynamicTokens } = tokenizeClassString(source, value, valueStart);
+			if (!tokens.some((t) => t.value.startsWith("@")) && dynamicTokens.length === 0) continue;
+			usages.push({
+				fileOffset: literalStart,
+				valueStart,
+				raw: value,
+				tokens,
+				dynamicTokens,
+				fixable: false
+			});
+		}
+	}
 	return usages;
 }
 function tokenizeClassString(source, value, valueStart) {
@@ -1838,6 +2102,23 @@ function tokenizeClassString(source, value, valueStart) {
 	};
 }
 function findMatchingBrace(source, openIdx) {
+	return findMatchingDelimiter(source, openIdx, "{", "}");
+}
+function spliceRedundantTokens(raw, isRedundant) {
+	const pieces = raw.split(/(\s+)/);
+	const drop = new Array(pieces.length).fill(false);
+	for (let i = 0; i < pieces.length; i++) {
+		const piece = pieces[i] ?? "";
+		if (piece.length === 0 || /^\s+$/.test(piece)) continue;
+		if (piece.startsWith("@") || piece.includes("${")) continue;
+		if (!isRedundant(piece)) continue;
+		drop[i] = true;
+		if (i > 0 && /^\s+$/.test(pieces[i - 1] ?? "")) drop[i - 1] = true;
+		else if (/^\s+$/.test(pieces[i + 1] ?? "")) drop[i + 1] = true;
+	}
+	return pieces.filter((_, i) => !drop[i]).join("");
+}
+function findMatchingDelimiter(source, openIdx, open, close) {
 	let depth = 1;
 	let i = openIdx + 1;
 	while (i < source.length && depth > 0) {
@@ -1883,8 +2164,8 @@ function findMatchingBrace(source, openIdx) {
 			}
 			continue;
 		}
-		if (ch === "{") depth++;
-		else if (ch === "}") depth--;
+		if (ch === open) depth++;
+		else if (ch === close) depth--;
 		i++;
 	}
 	return depth === 0 ? i - 1 : -1;
@@ -1916,25 +2197,18 @@ function checkRedundantUtility(file, source, registry, applyFix) {
 			for (const t of exp) expansions.add(t);
 		}
 		if (expansions.size === 0) continue;
-		const kept = [];
-		for (const tok of usage.tokens) {
-			if (!tok.value.startsWith("@") && expansions.has(tok.value)) {
-				findings.push({
-					rule: "recipe/no-redundant-utility",
-					severity: "info",
-					file,
-					line: tok.line,
-					column: tok.column,
-					message: `${tok.value} is already included by a recipe on this element`
-				});
-				continue;
-			}
-			kept.push(tok.value);
-		}
+		for (const tok of usage.tokens) if (!tok.value.startsWith("@") && expansions.has(tok.value)) findings.push({
+			rule: "recipe/no-redundant-utility",
+			severity: "info",
+			file,
+			line: tok.line,
+			column: tok.column,
+			message: `${tok.value} is already included by a recipe on this element`
+		});
 		if (fixed !== null && usage.fixable) {
 			if (usage.valueStart < cursor) continue;
 			fixed += source.slice(cursor, usage.valueStart);
-			fixed += kept.join(" ");
+			fixed += spliceRedundantTokens(usage.raw, (t) => expansions.has(t));
 			cursor = usage.valueStart + usage.raw.length;
 		}
 	}
@@ -2001,7 +2275,7 @@ async function bench(options) {
 		expandedLlmTokens: 0
 	};
 	for (const { filename, content } of filesToBench) {
-		const expanded = transformContent(content, registry, { mode: filename.endsWith(".html") ? "html" : "jsx" });
+		const expanded = transformContent(content, registry, { mode: modeForFile(filename) });
 		const compactUsages = extractClassUsages(content);
 		const expandedUsages = extractClassUsages(expanded);
 		const fileResult = {
@@ -2108,6 +2382,6 @@ function formatBenchTable(result) {
 	return lines.join("\n");
 }
 //#endregion
-export { extractHeader as A, readLockfile as C, detectProject as D, resolvePresetFamilies as E, rewriteHeaderSha as M, sealRecipeFile as N, buildHeaderLine as O, init as S, createRegistrySource as T, newFamily as _, formatFindingsText as a, renameFamilyInSource as b, UpgradeError as c, BuildError as d, build as f, NewFamilyError as g, preset as h, extractClassUsages as i, normalizeBody as j, computeBodySha as k, upgrade as l, ls as m, formatBenchTable as n, lint as o, formatLsText as p, ALL_RULES as r, verify as s, bench as t, dev as u, remove as v, writeLockfile as w, DEFAULT_REGISTRY as x, add as y };
+export { buildHeaderLine as A, cliVersion as C, createRegistrySource as D, writeLockfile as E, verifyFetchedFamily as F, extractHeader as M, rewriteHeaderSha as N, resolvePresetFamilies as O, sealRecipeFile as P, DEFAULT_REGISTRY as S, readLockfile as T, NewFamilyError as _, formatFindingsText as a, add as b, UpgradeError as c, BuildError as d, build as f, reseal as g, preset as h, extractClassUsages as i, computeBodySha as j, detectProject as k, upgrade as l, ls as m, formatBenchTable as n, lint as o, formatLsText as p, ALL_RULES as r, verify as s, bench as t, dev as u, newFamily as v, init as w, renameFamilyInSource as x, remove as y };
 
-//# sourceMappingURL=bench-NKKDz3ld.js.map
+//# sourceMappingURL=bench-oy9aPOvX.js.map