fix(next-plugin): isolate coordinator sessions and enforce complete CSS

.changepacks/changepack_log_bun_plugin_build.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "packages/bun-plugin/package.json": "Patch"
+  },
+  "note": "Bun plugin works with Bun.build: `DevupUI()` (from `@devup-ui/bun-plugin/register`) serves the generated stylesheet to the bundler's CSS loader once every other module is loaded, so the build emits a CSS output with the styles of the whole bundle instead of an empty module; class names are short there and readable under the runtime (`debug` option). Files importing the packages Devup UI takes the place of (`@emotion/react`, `@emotion/styled`, `styled-components`, `@vanilla-extract/css`), `@stylexjs/stylex`, or a subpath or re-export of these or `@devup-ui/react`, are compiled instead of skipped",
+  "date": "2026-09-30T00:00:00.000Z"
+}

.changepacks/changepack_log_coordinator_port_isolation.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "packages/next-plugin/package.json": "Patch"
+  },
+  "note": "Isolate the coordinator port file per owning process when another live next dev/build holds it, record the owner pid, and report port, pid and recovery when the coordinator is missing or unreachable",
+  "date": "2026-10-02T12:41:12.3693972Z"
+}

.changepacks/changepack_log_css_snapshot.json

@@ -0,0 +1,9 @@
+{
+  "changes": {
+    "packages/webpack-plugin/package.json": "Patch",
+    "packages/rsbuild-plugin/package.json": "Patch",
+    "packages/plugin-utils/package.json": "Patch"
+  },
+  "note": "Webpack and Rsbuild builds hold every style in their stylesheets: a stylesheet module is built on its first import, so styles extracted later (the global styles of files webpack or Rsbuild reached late, often outside `src`) were missing from the output. The files the entries reach under `src` are now extracted before the build, the shared base on disk is kept current, and when a stylesheet still changed during the build it is compiled once more, writing only the complete result. Rsbuild serves each stylesheet from the current sheet instead of a module-wide string kept only when it grew, which left edits that shortened the CSS and later builds in the same process stale. plugin-utils adds computeReachableFiles",
+  "date": "2026-09-30T00:00:00.000Z"
+}

.changepacks/changepack_log_deterministic_numbering.json

@@ -0,0 +1,13 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch",
+    "packages/plugin-utils/package.json": "Patch",
+    "packages/vite-plugin/package.json": "Patch",
+    "packages/webpack-plugin/package.json": "Patch",
+    "packages/rsbuild-plugin/package.json": "Patch",
+    "packages/next-plugin/package.json": "Patch",
+    "packages/bun-plugin/package.json": "Patch"
+  },
+  "note": "Class names and file numbers no longer depend on the order files are processed in. Every plugin walks the files it can extract (the project's source and the included packages) before the first transform and numbers them in path order (a file collapsed into a bucket is numbered as the bucket, and only files that mention the package, StyleX or an aliased package take numbers) through the new seedFileMap, so identical builds give identical class prefixes, CSS file names and output hashes; in development, files that appear later are numbered after the existing ones. Styles are given class names in a fixed order, not the order of a hash set. The exported class, file and canonical maps are canonical JSON (sorted keys). Stylesheet evaluation (vanilla-extract) refuses Math.random(), Date.now(), new Date() and Date(), which differ between builds, with a build error; fixed dates such as new Date(0) are unchanged. resetBuildState starts a build from its own options: the prefix, atom hoisting, routes, buckets, names, numbers and styles an earlier build in the process left are cleared, and the prefix is set on every setup even when it is absent. Engine snapshots from concurrent transforms are written one after another per file, so an older snapshot is never written last. File lists are ordered by code point rather than the locale",
+  "date": "2026-10-01T00:00:00.000Z"
+}

.changepacks/changepack_log_next_coordinator.json

@@ -0,0 +1,8 @@
+{
+  "changes": {
+    "packages/next-plugin/package.json": "Patch",
+    "packages/plugin-utils/package.json": "Patch"
+  },
+  "note": "Isolate Next.js extraction engines and coordinator sessions, deterministically plan root and src App/Pages routes with modern source extensions and absolute output exclusions, watch inherited themes and removals, and persist atomic checkpoints. Prepare reached MDX source generations with the installed compiler, shared prepared resolution, immutable plans and complete reported dependency evidence. Refresh affected sources, validate inputs before CSS finalization and keep private restart proofs. Adopt ordinary inputs, completion plans and watch paths in one durable transaction with synchronous publication, exact predecessor compensation and quarantine on failed restoration; preserve legacy callers and cancellation. Capture dev CSS inside the mutation queue and validate production inputs at every publication. Unsupported extensions, pending or conflicting input ownership, stale bytes, failed compensation and unproven bindings fail located. Production re-extraction still accepts only identical rendered CSS; full MDX lifecycle and native receipt wiring remain integration requirements.",
+  "date": "2026-10-01T00:00:00.000Z"
+}

.changepacks/changepack_log_plugin_core.json

@@ -0,0 +1,13 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch",
+    "packages/plugin-utils/package.json": "Patch",
+    "packages/vite-plugin/package.json": "Patch",
+    "packages/webpack-plugin/package.json": "Patch",
+    "packages/rsbuild-plugin/package.json": "Patch",
+    "packages/bun-plugin/package.json": "Patch",
+    "packages/next-plugin/package.json": "Patch"
+  },
+  "note": "Use bundler project roots and active export conditions for build-time module resolution, resolve inherited tsconfig paths and dotted module specifiers, transform modern modules and compiled MDX, match included packages literally, and refresh empty theme declarations. Skip unrequested source maps, surface resolver faults before stylesheet mutation, and report WASM panic locations. Malformed or cyclic configuration, resolver failures, requested graph/prewarm failures and disabled Rsbuild shared splitting now stop builds with context; optional numbering fallback warns about its deterministic impact. Bun defaults to compact names and retains imported build-time dependency watch edges.",
+  "date": "2026-10-01T00:00:00.000Z"
+}

.changepacks/changepack_log_plugin_core_ci.json

@@ -0,0 +1,10 @@
+{
+  "changes": {
+    "packages/plugin-utils/package.json": "Patch",
+    "packages/vite-plugin/package.json": "Patch",
+    "packages/webpack-plugin/package.json": "Patch",
+    "packages/rsbuild-plugin/package.json": "Patch"
+  },
+  "note": "Keep raw MDX out of static import graphs unless the caller compiles MDX before extraction, preserving Next production prewarm behavior while MDX-aware plugins opt in. Normalize Webpack inline-loader entry resources before filesystem lookup and skip virtual or pitch-only entries without swallowing real I/O failures. Isolate watched-config regression diagnostics while preserving the prior theme on invalid configuration. No new build-error category is introduced.",
+  "date": "2026-10-01T00:00:00.000Z"
+}

.changepacks/changepack_log_plugin_core_mdx.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch"
+  },
+  "note": "Extract compiled MDX with its real source filename, including JSX-preserving alias imports and exact static computations. Raw or invalid MDX and unsupported extraction extensions now produce located build errors instead of untransformed styling placeholders.",
+  "date": "2026-10-01T00:00:00.000Z"
+}

bindings/devup-ui-wasm/README.md

@@ -1,85 +1,75 @@
-<div align="center">
+# @devup-ui/wasm
 
-  <h1><code>wasm-pack-template</code></h1>
+Build-time CSS extraction bindings used by the Devup UI bundler plugins.
 
-<strong>A template for kick starting a Rust and WebAssembly project using <a href="https://github.com/rustwasm/wasm-pack">wasm-pack</a>.</strong>
+## Extraction boundaries
 
-  <p>
-    <a href="https://travis-ci.org/rustwasm/wasm-pack-template"><img src="https://img.shields.io/travis/rustwasm/wasm-pack-template.svg?style=flat-square" alt="Build Status" /></a>
-  </p>
+`codeExtract` generates a source map. `codeExtractWithoutSourceMap` skips map
+generation, including when a module resolver is installed; its `map` getter is
+`undefined`. Both functions return transformed source and watched dependencies.
 
-  <h3>
-    <a href="https://rustwasm.github.io/docs/wasm-pack/tutorials/npm-browser-packages/index.html">Tutorial</a>
-    <span> | </span>
-    <a href="https://discordapp.com/channels/442252698964721669/443151097398296587">Chat</a>
-  </h3>
+`setModuleResolver` accepts a synchronous `(specifier, importer)` callback.
+Return `{ path: string, code: string }` for a resolved module. `null` and
+`undefined` mean ordinary unresolved imports. Thrown exceptions, property-getter
+and reflection failures, and missing/non-string fields instead fail extraction:
 
-<sub>Built with 🦀🕸 by <a href="https://rustwasm.github.io/">The Rust and WebAssembly Working Group</a></sub>
-
-</div>
-
-## About
-
-[**📚 Read this template tutorial! 📚**][template-docs]
-
-This template is designed for compiling Rust libraries into WebAssembly and
-publishing the resulting package to NPM.
-
-Be sure to check out [other `wasm-pack` tutorials online][tutorials] for other
-templates and usages of `wasm-pack`.
+```text
+/src/App.tsx:1:1: module resolver cannot use `./tokens` at build time: original cause
+```
 
-[tutorials]: https://rustwasm.github.io/docs/wasm-pack/tutorials/index.html
-[template-docs]: https://rustwasm.github.io/docs/wasm-pack/tutorials/npm-browser-packages/index.html
+The importer includes transitive importers. The resolver contract does not
+provide an import span, so this boundary reports `1:1` rather than guessing a
+position from source text. The first resolver fault takes precedence over the
+extractor's unresolved-module fallback and is checked **before** sheet updates.
+The previous stylesheet contribution therefore survives a failed re-extraction.
+Class/file numbering performed inside extraction is not rolled back.
 
-## 🚴 Usage
+## Panic diagnostics
 
-### 🐑 Use `cargo generate` to Clone this Template
+WASM initialization installs this binding's own `std::panic::set_hook`, with no
+additional dependency or feature flag. It reports Rust's panic payload and
+`file:line:column` location to `console.error` before the trap. A failing host
+console does not replace the original panic. This is diagnostic reporting, not
+panic recovery: with `panic=abort`, a panic still traps and the instance should
+be discarded. Normal resolver/configuration failures use fallible JS errors.
 
-[Learn more about `cargo generate` here.](https://github.com/ashleygwilliams/cargo-generate)
+Owned binding code does not unwrap user input or explicitly panic. Sheet mutex
+poisoning is recovered, and no resolver callback is called while holding a sheet
+lock or a thread-local resolver borrow. Panics originating in downstream crates
+remain outside this binding's recovery contract.
 
-```
-cargo generate --git https://github.com/rustwasm/wasm-pack-template.git --name my-project
-cd my-project
-```
+## Verification
 
-### 🛠️ Build with `wasm-pack build`
+From the repository root:
 
-```
-wasm-pack build
+```sh
+cargo test -p devup-ui-wasm boundary_ -- --nocapture
 ```
 
-### 🔬 Test in Headless Browsers with `wasm-pack test`
+After rebuilding `pkg` with this package's `bun run build`, run from the
+repository root:
 
-```
-wasm-pack test --headless --firefox
+```sh
+node bindings/devup-ui-wasm/boundary-regressions.mjs
 ```
 
-### 🎁 Publish to NPM with `wasm-pack publish`
-
-```
-wasm-pack publish
+This standalone runner loads the real generated JS and WASM, outside Bun's
+coverage mocks. It exercises both extraction exports, map skipping with and
+without resolution, unresolved null/undefined, valid resolved dependencies,
+callback exceptions, getters, proxy reflection, malformed fields and hostile
+exception objects. Every fault case verifies the previous sheet is unchanged.
+Native tests cover every branch of the internal fault-precedence helper.
+
+The same JS runner also uses the installed `@mdx-js/mdx` compiler, resolved through
+`@mdx-js/loader` in `apps/landing` (no added dependency). Both default `_jsx`
+output and `jsx: true` output are extracted under real `.mdx` and `.md` filenames.
+It checks CSS, the relevance gate, source-map filename identity and rejection of
+raw Markdown. Compiled MDX is parsed as JSX JavaScript, not TSX. Its source-map
+coordinates refer to compiler output; bundler integrations must compose input
+maps to recover Markdown positions, or identify diagnostics as compiled MDX.
+
+Focused native MDX verification:
+
+```sh
+cargo test -p extractor mdx_ -- --nocapture
 ```
-
-## 🔋 Batteries Included
-
-- [`wasm-bindgen`](https://github.com/rustwasm/wasm-bindgen) for communicating
-  between WebAssembly and JavaScript.
-- [`console_error_panic_hook`](https://github.com/rustwasm/console_error_panic_hook)
-  for logging panic messages to the developer console.
-- `LICENSE-APACHE` and `LICENSE-MIT`: most Rust projects are licensed this way, so these are included for you
-
-## License
-
-Licensed under either of
-
-- Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
-- MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
-
-at your option.
-
-### Contribution
-
-Unless you explicitly state otherwise, any contribution intentionally
-submitted for inclusion in the work by you, as defined in the Apache-2.0
-license, shall be dual licensed as above, without any additional terms or
-conditions.