@csszyx/dynamic 0.9.10 → 0.10.1

package/dist/index.d.mts

@@ -28,6 +28,51 @@ interface CSSManifest {
     mangleMap?: Record<string, string>;
 }
 
+/**
+ * Purify an UNTRUSTED sz object before it reaches the runtime CSS pipeline.
+ *
+ * csszyx's `dynamic()` / `useSz` accept sz objects that an app may build from
+ * untrusted data (a JSON-driven UI, a CMS schema). Such input controls both the
+ * KEYS and the VALUES of the object, which opens three holes the rest of the
+ * stack only partially closes: an unknown key produces dead CSS or, via a key
+ * like `__proto__`, pollutes the prototype; an unsafe value injects an extra CSS
+ * declaration (UI redress / exfil) into the same rule; deep nesting overflows
+ * the stack. `purifySz` is the opt-in boundary that drops all three.
+ *
+ * It is allowlist-based: only keys the compiler actually understands
+ * (`SZ_KEY_CATEGORY`, generated from the compiler tables) and valid variant keys
+ * survive; every string value must pass {@link isSafeCssValue}; forbidden keys
+ * are skipped; depth is bounded by the shared `MAX_SZ_DEPTH`. In `strict` mode
+ * (default) it additionally drops values carrying `url()` / `image-set()` /
+ * `@import` / `expression()` — vectors the authored-path emitter intentionally
+ * allows but which are exfil/legacy risks for untrusted input.
+ *
+ * Pure, framework-agnostic. Compiled/authored sz does NOT need this — it is for
+ * the untrusted runtime boundary only.
+ */
+
+/** Options controlling `purifySz` strictness and drop reporting. */
+interface PurifySzOptions {
+    /**
+     * When true (default), also reject values containing `url()`/`image-set()`/
+     * `@import`/`expression()`. These are legitimate for AUTHORED sz but are
+     * exfiltration / legacy vectors when the value is attacker-controlled.
+     */
+    strict?: boolean;
+    /** Called for each dropped key/value with its dotted path and a reason. */
+    onDrop?: (path: string, reason: string) => void;
+}
+/**
+ * Return a cleaned copy of `sz` safe to pass to `dynamic()` / `useSz` from
+ * untrusted input. Drops unknown keys, unsafe values, and prototype-polluting
+ * keys; bounds nesting depth. See {@link PurifySzOptions}.
+ *
+ * @param sz - the untrusted sz object.
+ * @param options - strictness + drop reporting.
+ * @returns a new sz object containing only allowed keys and safe values.
+ */
+declare function purifySz(sz: SzObject, options?: PurifySzOptions): SzObject;
+
 /**
  * @csszyx/dynamic — Runtime CSS injection with delta check.
  *
@@ -88,5 +133,5 @@ declare function preloadManifest(url?: string): Promise<void>;
  */
 declare function cleanup(): void;
 
-export { cleanup, dynamic, preloadManifest };
-export type { CSSManifest, Tier };
+export { cleanup, dynamic, preloadManifest, purifySz };
+export type { CSSManifest, PurifySzOptions, Tier };

package/dist/index.mjs

@@ -1,2 +1,2 @@
 import '@csszyx/compiler/browser';
-export { a as cleanup, d as dynamic, b as preloadManifest } from './shared/dynamic.DJAOP9e8.mjs';
+export { a as cleanup, d as dynamic, b as preloadManifest, e as purifySz } from './shared/dynamic.CZNnPnjy.mjs';

package/dist/react.mjs

@@ -1,5 +1,5 @@
 import { createContext, useEffect, createElement, useContext, useCallback } from 'react';
-import { d as dynamic, p as preloadManifest, c as cleanup, r as resetManifest, s as setManifestUrl } from './shared/dynamic.DJAOP9e8.mjs';
+import { d as dynamic, p as preloadManifest, c as cleanup, r as resetManifest, s as setManifestUrl } from './shared/dynamic.CZNnPnjy.mjs';
 import '@csszyx/compiler/browser';
 
 const CsszyxContext = createContext({

package/dist/shared/{dynamic.DJAOP9e8.mjs → dynamic.CZNnPnjy.mjs}

@@ -1,5 +1,83 @@
-import { transform } from '@csszyx/compiler/browser';
+import { MAX_SZ_DEPTH, SzDepthError, isForbiddenSzKey, KNOWN_VARIANTS, getVariantPrefix, SPECIAL_VARIANTS, transform } from '@csszyx/compiler/browser';
 
+function isSafeCssValue(value) {
+  let quote = null;
+  let parenDepth = 0;
+  for (let i = 0; i < value.length; i++) {
+    const ch = value[i];
+    if (value.charCodeAt(i) < 32) {
+      return false;
+    }
+    if (quote !== null) {
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (ch === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    switch (ch) {
+      case '"':
+      case "'":
+        quote = ch;
+        break;
+      case "(":
+        parenDepth++;
+        break;
+      case ")":
+        if (parenDepth > 0) {
+          parenDepth--;
+        }
+        break;
+      case "{":
+      case "}":
+      case "<":
+      case ">":
+        return false;
+      case ";":
+        if (parenDepth === 0) {
+          return false;
+        }
+        break;
+    }
+  }
+  return quote === null && parenDepth === 0;
+}
+function isSafeCssPropertyName(name) {
+  return /^(?:--[\w-]+|-?[a-z][a-z0-9-]*)$/i.test(name);
+}
+function isUtilityArbitrarySafe(utility) {
+  const open = utility.indexOf("[");
+  if (open === -1) {
+    return true;
+  }
+  const close = utility.lastIndexOf("]");
+  if (close <= open) {
+    return true;
+  }
+  const inner = utility.slice(open + 1, close);
+  if (utility.charCodeAt(0) === 91 && utility.charCodeAt(utility.length - 1) === 93 && inner.includes(":")) {
+    const colon = inner.indexOf(":");
+    return isSafeCssPropertyName(inner.slice(0, colon)) && isSafeCssValue(inner.slice(colon + 1));
+  }
+  return isSafeCssValue(inner);
+}
+
+let warnedUnsafeArbitrary = false;
+function warnUnsafeArbitrary(utility) {
+  if (warnedUnsafeArbitrary) {
+    return;
+  }
+  if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") {
+    return;
+  }
+  warnedUnsafeArbitrary = true;
+  console.warn(
+    `[csszyx] dropped an arbitrary value that could inject CSS: "${utility}". Arbitrary values from untrusted data are not emitted at runtime.`
+  );
+}
 const BREAKPOINTS = {
   sm: "40rem",
   md: "48rem",
@@ -553,6 +631,10 @@ function parseVariants(cls) {
   return { tier, pseudoSuffix, selectorPrefix, utility };
 }
 function generateDeclarations(utility) {
+  if (!isUtilityArbitrarySafe(utility)) {
+    warnUnsafeArbitrary(utility);
+    return "";
+  }
   if (utility in KEYWORD_RULES) {
     return KEYWORD_RULES[utility];
   }
@@ -1110,6 +1192,421 @@ function resetManifest() {
 
 const isServer = typeof document === "undefined";
 
+const SZ_KEY_CATEGORY = /* @__PURE__ */ new Map([
+  ["accent", "COLOR"],
+  ["align", "PASSTHROUGH"],
+  ["animate", "PASSTHROUGH"],
+  ["animationDelay", "DURATION"],
+  ["appearance", "PASSTHROUGH"],
+  ["aspect", "PASSTHROUGH"],
+  ["autoCols", "PASSTHROUGH"],
+  ["autoRows", "PASSTHROUGH"],
+  ["backdropBlur", "PASSTHROUGH"],
+  ["backdropBrightness", "UNITLESS"],
+  ["backdropContrast", "UNITLESS"],
+  ["backdropFilter", "PASSTHROUGH"],
+  ["backdropGrayscale", "PASSTHROUGH"],
+  ["backdropHueRotate", "UNITLESS"],
+  ["backdropInvert", "PASSTHROUGH"],
+  ["backdropOpacity", "UNITLESS"],
+  ["backdropSaturate", "UNITLESS"],
+  ["backdropSepia", "PASSTHROUGH"],
+  ["backface", "PASSTHROUGH"],
+  ["basis", "SPACING"],
+  ["bg", "COLOR"],
+  ["bgAttach", "PASSTHROUGH"],
+  ["bgBlend", "PASSTHROUGH"],
+  ["bgClip", "PASSTHROUGH"],
+  ["bgImg", "PASSTHROUGH"],
+  ["bgOrigin", "PASSTHROUGH"],
+  ["bgPos", "PASSTHROUGH"],
+  ["bgRepeat", "PASSTHROUGH"],
+  ["bgSize", "PASSTHROUGH"],
+  ["blockSize", "SPACING"],
+  ["blur", "PASSTHROUGH"],
+  ["border", "UNITLESS"],
+  ["borderB", "UNITLESS"],
+  ["borderBColor", "PASSTHROUGH"],
+  ["borderBe", "UNITLESS"],
+  ["borderBs", "UNITLESS"],
+  ["borderCollapse", "PASSTHROUGH"],
+  ["borderColor", "COLOR"],
+  ["borderE", "UNITLESS"],
+  ["borderL", "UNITLESS"],
+  ["borderLColor", "PASSTHROUGH"],
+  ["borderR", "UNITLESS"],
+  ["borderRColor", "PASSTHROUGH"],
+  ["borderS", "UNITLESS"],
+  ["borderSpacing", "SPACING"],
+  ["borderSpacingX", "SPACING"],
+  ["borderSpacingY", "SPACING"],
+  ["borderStyle", "PASSTHROUGH"],
+  ["borderT", "UNITLESS"],
+  ["borderTColor", "PASSTHROUGH"],
+  ["borderX", "UNITLESS"],
+  ["borderXColor", "PASSTHROUGH"],
+  ["borderY", "UNITLESS"],
+  ["borderYColor", "PASSTHROUGH"],
+  ["bottom", "SPACING"],
+  ["box", "PASSTHROUGH"],
+  ["boxDecoration", "PASSTHROUGH"],
+  ["break", "PASSTHROUGH"],
+  ["breakAfter", "PASSTHROUGH"],
+  ["breakBefore", "PASSTHROUGH"],
+  ["breakInside", "PASSTHROUGH"],
+  ["brightness", "UNITLESS"],
+  ["caption", "PASSTHROUGH"],
+  ["caret", "COLOR"],
+  ["clear", "PASSTHROUGH"],
+  ["col", "UNITLESS"],
+  ["colEnd", "UNITLESS"],
+  ["colSpan", "UNITLESS"],
+  ["colStart", "UNITLESS"],
+  ["color", "COLOR"],
+  ["columns", "UNITLESS"],
+  ["container", "PASSTHROUGH"],
+  ["content", "PASSTHROUGH"],
+  ["contrast", "UNITLESS"],
+  ["cursor", "PASSTHROUGH"],
+  ["decoration", "PASSTHROUGH"],
+  ["decorationColor", "COLOR"],
+  ["decorationStyle", "PASSTHROUGH"],
+  ["decorationThickness", "UNITLESS"],
+  ["delay", "DURATION"],
+  ["diagonalFractions", "PASSTHROUGH"],
+  ["display", "PASSTHROUGH"],
+  ["divideColor", "COLOR"],
+  ["divideStyle", "PASSTHROUGH"],
+  ["divideX", "PASSTHROUGH"],
+  ["divideXReverse", "PASSTHROUGH"],
+  ["divideY", "PASSTHROUGH"],
+  ["divideYReverse", "PASSTHROUGH"],
+  ["dropShadow", "PASSTHROUGH"],
+  ["dropShadowColor", "COLOR"],
+  ["duration", "DURATION"],
+  ["ease", "PASSTHROUGH"],
+  ["end", "SPACING"],
+  ["fieldSizing", "PASSTHROUGH"],
+  ["fill", "COLOR"],
+  ["filter", "PASSTHROUGH"],
+  ["flex", "PASSTHROUGH"],
+  ["flexDir", "PASSTHROUGH"],
+  ["flexWrap", "PASSTHROUGH"],
+  ["float", "PASSTHROUGH"],
+  ["fontFamily", "PASSTHROUGH"],
+  ["fontFeatures", "PASSTHROUGH"],
+  ["fontSmoothing", "PASSTHROUGH"],
+  ["fontStretch", "PASSTHROUGH"],
+  ["fontStyle", "PASSTHROUGH"],
+  ["forcedColorAdjust", "PASSTHROUGH"],
+  ["from", "COLOR"],
+  ["gap", "SPACING"],
+  ["gapX", "SPACING"],
+  ["gapY", "SPACING"],
+  ["grayscale", "PASSTHROUGH"],
+  ["gridCols", "UNITLESS"],
+  ["gridFlow", "PASSTHROUGH"],
+  ["gridRows", "UNITLESS"],
+  ["grow", "UNITLESS"],
+  ["h", "SPACING"],
+  ["hueRotate", "UNITLESS"],
+  ["hyphens", "PASSTHROUGH"],
+  ["indent", "SPACING"],
+  ["inlineSize", "SPACING"],
+  ["inset", "SPACING"],
+  ["insetBe", "SPACING"],
+  ["insetBs", "SPACING"],
+  ["insetE", "SPACING"],
+  ["insetRing", "PASSTHROUGH"],
+  ["insetRingColor", "PASSTHROUGH"],
+  ["insetS", "SPACING"],
+  ["insetShadow", "PASSTHROUGH"],
+  ["insetShadowColor", "PASSTHROUGH"],
+  ["insetX", "SPACING"],
+  ["insetY", "SPACING"],
+  ["invert", "PASSTHROUGH"],
+  ["isolation", "PASSTHROUGH"],
+  ["items", "PASSTHROUGH"],
+  ["justify", "PASSTHROUGH"],
+  ["justifyItems", "PASSTHROUGH"],
+  ["justifySelf", "PASSTHROUGH"],
+  ["leading", "UNITLESS"],
+  ["left", "SPACING"],
+  ["lineClamp", "UNITLESS"],
+  ["liningNums", "PASSTHROUGH"],
+  ["list", "PASSTHROUGH"],
+  ["listImg", "PASSTHROUGH"],
+  ["listPos", "PASSTHROUGH"],
+  ["m", "SPACING"],
+  ["mask", "PASSTHROUGH"],
+  ["maskClip", "PASSTHROUGH"],
+  ["maskFrom", "COLOR"],
+  ["maskOrigin", "PASSTHROUGH"],
+  ["maskPos", "PASSTHROUGH"],
+  ["maskRepeat", "PASSTHROUGH"],
+  ["maskShape", "PASSTHROUGH"],
+  ["maskSize", "PASSTHROUGH"],
+  ["maskTo", "COLOR"],
+  ["maskVia", "COLOR"],
+  ["maxBlockSize", "SPACING"],
+  ["maxH", "SPACING"],
+  ["maxInlineSize", "SPACING"],
+  ["maxW", "SPACING"],
+  ["mb", "SPACING"],
+  ["mbe", "SPACING"],
+  ["mbs", "SPACING"],
+  ["me", "SPACING"],
+  ["minBlockSize", "SPACING"],
+  ["minH", "SPACING"],
+  ["minInlineSize", "SPACING"],
+  ["minW", "SPACING"],
+  ["mixBlend", "PASSTHROUGH"],
+  ["ml", "SPACING"],
+  ["mr", "SPACING"],
+  ["ms", "SPACING"],
+  ["mt", "SPACING"],
+  ["mx", "SPACING"],
+  ["my", "SPACING"],
+  ["notSrOnly", "PASSTHROUGH"],
+  ["objectFit", "PASSTHROUGH"],
+  ["objectPos", "PASSTHROUGH"],
+  ["oldstyleNums", "PASSTHROUGH"],
+  ["opacity", "UNITLESS"],
+  ["order", "UNITLESS"],
+  ["ordinal", "PASSTHROUGH"],
+  ["origin", "PASSTHROUGH"],
+  ["outline", "UNITLESS"],
+  ["outlineColor", "COLOR"],
+  ["outlineOffset", "SPACING"],
+  ["outlineStyle", "PASSTHROUGH"],
+  ["overflow", "PASSTHROUGH"],
+  ["overflowX", "PASSTHROUGH"],
+  ["overflowY", "PASSTHROUGH"],
+  ["overscroll", "PASSTHROUGH"],
+  ["overscrollX", "PASSTHROUGH"],
+  ["overscrollY", "PASSTHROUGH"],
+  ["p", "SPACING"],
+  ["pb", "SPACING"],
+  ["pbe", "SPACING"],
+  ["pbs", "SPACING"],
+  ["pe", "SPACING"],
+  ["perspective", "PASSTHROUGH"],
+  ["perspectiveOrigin", "PASSTHROUGH"],
+  ["pl", "SPACING"],
+  ["placeContent", "PASSTHROUGH"],
+  ["placeItems", "PASSTHROUGH"],
+  ["placeSelf", "PASSTHROUGH"],
+  ["pointerEvents", "PASSTHROUGH"],
+  ["position", "PASSTHROUGH"],
+  ["pr", "SPACING"],
+  ["proportionalNums", "PASSTHROUGH"],
+  ["prose", "PASSTHROUGH"],
+  ["proseInvert", "PASSTHROUGH"],
+  ["ps", "SPACING"],
+  ["pt", "SPACING"],
+  ["px", "SPACING"],
+  ["py", "SPACING"],
+  ["resize", "PASSTHROUGH"],
+  ["right", "SPACING"],
+  ["ring", "UNITLESS"],
+  ["ringColor", "COLOR"],
+  ["ringOffset", "SPACING"],
+  ["ringOffsetColor", "COLOR"],
+  ["rotate", "ANGLE"],
+  ["rotateX", "PASSTHROUGH"],
+  ["rotateY", "PASSTHROUGH"],
+  ["rotateZ", "PASSTHROUGH"],
+  ["rounded", "PASSTHROUGH"],
+  ["roundedB", "PASSTHROUGH"],
+  ["roundedBl", "PASSTHROUGH"],
+  ["roundedBr", "PASSTHROUGH"],
+  ["roundedE", "PASSTHROUGH"],
+  ["roundedEe", "PASSTHROUGH"],
+  ["roundedEs", "PASSTHROUGH"],
+  ["roundedL", "PASSTHROUGH"],
+  ["roundedR", "PASSTHROUGH"],
+  ["roundedS", "PASSTHROUGH"],
+  ["roundedSe", "PASSTHROUGH"],
+  ["roundedSs", "PASSTHROUGH"],
+  ["roundedT", "PASSTHROUGH"],
+  ["roundedTl", "PASSTHROUGH"],
+  ["roundedTr", "PASSTHROUGH"],
+  ["row", "UNITLESS"],
+  ["rowEnd", "UNITLESS"],
+  ["rowSpan", "UNITLESS"],
+  ["rowStart", "UNITLESS"],
+  ["saturate", "UNITLESS"],
+  ["scale", "UNITLESS"],
+  ["scaleX", "UNITLESS"],
+  ["scaleY", "UNITLESS"],
+  ["scaleZ", "PASSTHROUGH"],
+  ["scheme", "PASSTHROUGH"],
+  ["scroll", "PASSTHROUGH"],
+  ["scrollM", "SPACING"],
+  ["scrollMb", "SPACING"],
+  ["scrollMbe", "SPACING"],
+  ["scrollMbs", "SPACING"],
+  ["scrollMe", "SPACING"],
+  ["scrollMl", "SPACING"],
+  ["scrollMr", "SPACING"],
+  ["scrollMs", "SPACING"],
+  ["scrollMt", "SPACING"],
+  ["scrollMx", "SPACING"],
+  ["scrollMy", "SPACING"],
+  ["scrollP", "SPACING"],
+  ["scrollPb", "SPACING"],
+  ["scrollPbe", "SPACING"],
+  ["scrollPbs", "SPACING"],
+  ["scrollPe", "SPACING"],
+  ["scrollPl", "SPACING"],
+  ["scrollPr", "SPACING"],
+  ["scrollPs", "SPACING"],
+  ["scrollPt", "SPACING"],
+  ["scrollPx", "SPACING"],
+  ["scrollPy", "SPACING"],
+  ["scrollbar", "PASSTHROUGH"],
+  ["scrollbarGutter", "PASSTHROUGH"],
+  ["scrollbarThumb", "COLOR"],
+  ["scrollbarTrack", "COLOR"],
+  ["select", "PASSTHROUGH"],
+  ["self", "PASSTHROUGH"],
+  ["sepia", "PASSTHROUGH"],
+  ["shadow", "PASSTHROUGH"],
+  ["shadowColor", "COLOR"],
+  ["shrink", "UNITLESS"],
+  ["size", "SPACING"],
+  ["skewX", "ANGLE"],
+  ["skewY", "ANGLE"],
+  ["slashedZero", "PASSTHROUGH"],
+  ["snapAlign", "PASSTHROUGH"],
+  ["snapStop", "PASSTHROUGH"],
+  ["snapType", "PASSTHROUGH"],
+  ["spaceX", "SPACING"],
+  ["spaceXReverse", "PASSTHROUGH"],
+  ["spaceY", "SPACING"],
+  ["spaceYReverse", "PASSTHROUGH"],
+  ["srOnly", "PASSTHROUGH"],
+  ["stackedFractions", "PASSTHROUGH"],
+  ["start", "SPACING"],
+  ["stroke", "COLOR"],
+  ["strokeWidth", "UNITLESS"],
+  ["tabSize", "UNITLESS"],
+  ["tableLayout", "PASSTHROUGH"],
+  ["tabularNums", "PASSTHROUGH"],
+  ["text", "PASSTHROUGH"],
+  ["textAlign", "PASSTHROUGH"],
+  ["textOverflow", "PASSTHROUGH"],
+  ["textShadow", "PASSTHROUGH"],
+  ["textShadowColor", "COLOR"],
+  ["textTransform", "PASSTHROUGH"],
+  ["textWrap", "PASSTHROUGH"],
+  ["to", "COLOR"],
+  ["top", "SPACING"],
+  ["touch", "PASSTHROUGH"],
+  ["tracking", "PASSTHROUGH"],
+  ["transform", "PASSTHROUGH"],
+  ["transformStyle", "PASSTHROUGH"],
+  ["transition", "PASSTHROUGH"],
+  ["transitionBehavior", "PASSTHROUGH"],
+  ["translate", "PASSTHROUGH"],
+  ["translateX", "SPACING"],
+  ["translateY", "SPACING"],
+  ["translateZ", "PASSTHROUGH"],
+  ["truncate", "PASSTHROUGH"],
+  ["underlineOffset", "SPACING"],
+  ["via", "COLOR"],
+  ["visibility", "PASSTHROUGH"],
+  ["w", "SPACING"],
+  ["weight", "PASSTHROUGH"],
+  ["whitespace", "PASSTHROUGH"],
+  ["willChange", "PASSTHROUGH"],
+  ["wrap", "PASSTHROUGH"],
+  ["z", "UNITLESS"],
+  ["zoom", "UNITLESS"]
+]);
+
+const DANGEROUS_VALUE_RE = /url\s*\(|image-set\s*\(|@import|expression\s*\(/i;
+function isVariantKey(key) {
+  if (KNOWN_VARIANTS.has(key) || KNOWN_VARIANTS.has(getVariantPrefix(key))) {
+    return true;
+  }
+  if (SPECIAL_VARIANTS.has(key) || SPECIAL_VARIANTS.has(getVariantPrefix(key))) {
+    return true;
+  }
+  if (key.startsWith("@")) return true;
+  if (key.startsWith("[") && key.endsWith("]")) return true;
+  if (/^(?:group|peer)-/.test(key)) return true;
+  if (/^[a-z][a-z-]*-\[.*\]$/.test(key)) return true;
+  return false;
+}
+function isValueSafe(value, strict) {
+  if (!isSafeCssValue(value)) return false;
+  if (strict && DANGEROUS_VALUE_RE.test(value)) return false;
+  return true;
+}
+const DROP = /* @__PURE__ */ Symbol("drop");
+function purifyValue(value, strict, onDrop, path, depth) {
+  if (typeof value === "string") {
+    if (isValueSafe(value, strict)) return value;
+    onDrop?.(path, "unsafe-value");
+    return DROP;
+  }
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  if (depth >= MAX_SZ_DEPTH) throw new SzDepthError();
+  if (Array.isArray(value)) {
+    const out = [];
+    for (let i = 0; i < value.length; i++) {
+      const cleaned = purifyValue(
+        value[i],
+        strict,
+        onDrop,
+        `${path}[${i}]`,
+        depth + 1
+      );
+      if (cleaned !== DROP) out.push(cleaned);
+    }
+    return out;
+  }
+  return sanitizeObject(value, strict, onDrop, path, depth + 1, false);
+}
+function sanitizeObject(input, strict, onDrop, path, depth, applyKeyAllowlist) {
+  if (depth > MAX_SZ_DEPTH) throw new SzDepthError();
+  const out = {};
+  for (const [key, value] of Object.entries(input)) {
+    const keyPath = path ? `${path}.${key}` : key;
+    if (isForbiddenSzKey(key)) {
+      onDrop?.(keyPath, "forbidden-key");
+      continue;
+    }
+    if (applyKeyAllowlist && !SZ_KEY_CATEGORY.has(key)) {
+      if (isVariantKey(key) && value !== null && typeof value === "object" && !Array.isArray(value)) {
+        const cleaned2 = sanitizeObject(
+          value,
+          strict,
+          onDrop,
+          keyPath,
+          depth + 1,
+          true
+        );
+        if (Object.keys(cleaned2).length > 0) out[key] = cleaned2;
+        continue;
+      }
+      onDrop?.(keyPath, "unknown-key");
+      continue;
+    }
+    const cleaned = purifyValue(value, strict, onDrop, keyPath, depth);
+    if (cleaned !== DROP) out[key] = cleaned;
+  }
+  return out;
+}
+function purifySz(sz, options = {}) {
+  if (!sz || typeof sz !== "object" || Array.isArray(sz)) return {};
+  const strict = options.strict ?? true;
+  return sanitizeObject(sz, strict, options.onDrop, "", 0, true);
+}
+
 function dynamic(szProps) {
   const { className } = transform(szProps);
   if (!className) {
@@ -1146,4 +1643,4 @@ function cleanup() {
   resetManifest();
 }
 
-export { cleanup as a, preloadManifest as b, cleanup$1 as c, dynamic as d, preloadManifest$1 as p, resetManifest as r, setManifestUrl as s };
+export { cleanup as a, preloadManifest as b, cleanup$1 as c, dynamic as d, purifySz as e, preloadManifest$1 as p, resetManifest as r, setManifestUrl as s };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@csszyx/dynamic",
-  "version": "0.9.10",
+  "version": "0.10.1",
   "description": "Runtime CSS injection engine for @csszyx — injects only CSS not already in the pre-built stylesheet",
   "type": "module",
   "repository": {
@@ -38,10 +38,10 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@csszyx/compiler": "0.9.10"
+    "@csszyx/compiler": "0.10.1"
   },
   "peerDependencies": {
-    "react": ">=18.0.0"
+    "react": ">=17.0.0"
   },
   "peerDependenciesMeta": {
     "react": {