fix(extractor): preserve JavaScript semantics across values and element calls

.changepacks/changepack_log_constant_read_work.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch"
+  },
+  "note": "Avoid cloning unreferenced constant initializers and defer initialization analysis until constant reads need it. Extraction output and build errors are unchanged.",
+  "date": "2026-10-24T00:00:00.000Z"
+}

.changepacks/changepack_log_extraction_coverage.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch"
+  },
+  "note": "Add regression coverage for extraction safety, property pruning and source-order behavior; remove unreachable post-flatten spread handling and consolidate unknown property-shape rejection. Extraction output and build errors are unchanged.",
+  "date": "2026-10-24T00:00:00.000Z"
+}

.changepacks/changepack_log_js_semantics.json

@@ -0,0 +1,9 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch",
+    "packages/components/package.json": "Patch",
+    "packages/reset-css/package.json": "Patch"
+  },
+  "note": "Keep unknown element-prop spreads wholly as native pass-through data: their keys never select, replace or remove separately authored styles, regardless of order. Preserve fully known ordinary spread composition, canonical aliases, source-ordered once-only values and native className/style merging without spread-key styling variables, fallbacks or conversion code. Preserve exact imported enum and Math values including negative zero, lexical constants, binding-aware CommonJS require, React createElement calls, type-only imports, and compiled reset CSS tests. Retain located errors for intrinsically unreadable explicit styles, runtime styleOrder, unmovable lazy logical suspension, whole Devup UI namespaces escaping to runtime, and immediate lexical temporal-dead-zone reads. Native Emotion css spread restrictions and separate styled css overlap restrictions remain unchanged.",
+  "date": "2026-10-01T00:00:00.000Z"
+}

.changepacks/changepack_log_jsx_call_spread.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch"
+  },
+  "note": "Attach extracted classes and authored CSS variables to jsx, jsxs and jsxDEV props wrapped in parentheses, as const or satisfies. Preserve source evaluation order, responsive and conditional styleOrder output, native className/style merging and whole unknown-spread pass-through. Syntax wrappers do not introduce spread replacement diagnostics or a styling runtime.",
+  "date": "2026-10-12T00:00:00.000Z"
+}

.changepacks/changepack_log_refresh_dependencies_20261102.json

@@ -0,0 +1,12 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch",
+    "packages/components/package.json": "Patch",
+    "packages/eslint-plugin/package.json": "Patch",
+    "packages/react/package.json": "Patch",
+    "packages/rsbuild-plugin/package.json": "Patch",
+    "packages/vite-plugin/package.json": "Patch"
+  },
+  "note": "Refresh dependencies, including Oxc 0.156, wasm-bindgen 0.2.130, parse5 8.1 and Rsbuild 2.3. Preserve the React 18 compatibility fixture while updating its build tooling.",
+  "date": "2026-11-02T00:00:00.000Z"
+}

.github/workflows/publish.yml

@@ -189,7 +189,7 @@ jobs:
           const file = join(process.env.SIZE_ROOT, 'metadata.json')
           const metadata = side === 'base' ? {
             jobId: `${process.env.GITHUB_RUN_ID}/${process.env.GITHUB_RUN_ATTEMPT}/${process.env.GITHUB_JOB}`,
-            buildCommand: 'cargo metadata --locked --format-version 1 > /dev/null && wasm-pack build --mode no-install --release --target nodejs --out-dir ./pkg --out-name index --locked && node script.js',
+            buildCommand: '(cd ../.. && bun install --frozen-lockfile --ignore-scripts) && cargo metadata --locked --format-version 1 > /dev/null && wasm-pack build --mode no-install --release --target nodejs --out-dir ./pkg --out-name index --locked && node script.js',
           } : JSON.parse(readFileSync(file, 'utf8'))
           const sha = side === 'base' ? process.env.BASE_SHA : process.env.CANDIDATE_SHA
           metadata[side] = {
@@ -204,6 +204,10 @@ jobs:
           for side in base candidate; do
             stage="$side"
             (
+              (
+                cd "$SIZE_ROOT/$side"
+                bun install --frozen-lockfile --ignore-scripts
+              )
               WASM_BINDGEN_VERSION="$(bun resolve-wasm-bindgen.js "$SIZE_ROOT/$side/Cargo.lock")"
               export WASM_BINDGEN_VERSION
               bindgen_root="$SIZE_ROOT/abi-tools/$WASM_BINDGEN_VERSION"