@lionrapid/core 0.5.0 → 0.6.0

package/dist/browser/lionrapid.esm.js

@@ -349,6 +349,57 @@ var measure = (name) => {
   };
 };
 
+// src/utils/locale.ts
+var LOCALE_TAG_REGEX = /^[a-z]{2,3}(?:-[a-z0-9]{2,4})*$/i;
+var RTL_LANGUAGES = /* @__PURE__ */ new Set(["ar", "fa", "he", "ur", "yi"]);
+function primarySubtag(tag) {
+  return tag.split("-")[0].toLowerCase();
+}
+function normalizeLocale(tag) {
+  const trimmed = tag.trim();
+  if (!trimmed) return trimmed;
+  const [lang, ...rest] = trimmed.split("-");
+  const out = [lang.toLowerCase()];
+  for (const sub of rest) {
+    if (sub.length === 4) {
+      out.push(sub[0].toUpperCase() + sub.slice(1).toLowerCase());
+    } else if (sub.length === 2) {
+      out.push(sub.toUpperCase());
+    } else {
+      out.push(sub.toLowerCase());
+    }
+  }
+  return out.join("-");
+}
+function matchLocale(requested, available, fallback) {
+  if (available.length === 0) return fallback;
+  const avail = available.map((raw) => ({
+    raw,
+    lower: normalizeLocale(raw).toLowerCase()
+  }));
+  for (const req of requested) {
+    if (!req) continue;
+    const reqLower = normalizeLocale(req).toLowerCase();
+    const exact = avail.find((a) => a.lower === reqLower);
+    if (exact) return exact.raw;
+    const primary = primarySubtag(req);
+    const byPrimary = avail.find((a) => a.lower === primary);
+    if (byPrimary) return byPrimary.raw;
+  }
+  return fallback;
+}
+function parseAcceptLanguage(header) {
+  return header.split(",").map((part) => {
+    const [tag, ...params] = part.trim().split(";");
+    const qParam = params.find((p) => p.trim().startsWith("q="));
+    const q = qParam ? parseFloat(qParam.trim().slice(2)) : 1;
+    return { tag: tag.trim(), q: Number.isNaN(q) ? 0 : q };
+  }).filter((x) => x.tag.length > 0 && x.tag !== "*").sort((a, b) => b.q - a.q).map((x) => x.tag);
+}
+function localeDir(tag) {
+  return RTL_LANGUAGES.has(primarySubtag(tag)) ? "rtl" : "ltr";
+}
+
 // src/base/event-emitter.ts
 var EventEmitter = class {
   constructor() {
@@ -637,7 +688,7 @@ var EventEmitter = class {
       complete: () => {
         this.emit("language:change:success", {
           context: this.createContext(requestId, [...baseTrace, "complete"]),
-          payload: { oldLocale, newLocale }
+          payload: { oldLocale, newLocale, dir: localeDir(newLocale) }
         });
       },
       error: (error) => {
@@ -1047,12 +1098,11 @@ function parseNamespaceKey(key) {
 }
 
 // src/utils/context-utils.ts
-function createTranslationContext(parsedKey, currentLocale, defaultNamespace, fallbackLocale) {
+function createTranslationContext(parsedKey, currentLocale, defaultNamespace) {
   const effectiveNamespace = parsedKey.hasExplicitNamespace ? parsedKey.namespace : defaultNamespace;
   return {
     locale: currentLocale,
-    namespace: effectiveNamespace,
-    fallbackLocale: fallbackLocale || currentLocale
+    namespace: effectiveNamespace
   };
 }
 
@@ -1169,7 +1219,7 @@ function flattenTranslations(translations, prefix = "", locale, namespace) {
 }
 
 // src/utils/translation-flow.ts
-function prepareTranslationRequest(key, currentLocale, defaultValueOrParams, paramsOrDefaultValue, defaultNamespace, fallbackLocale) {
+function prepareTranslationRequest(key, currentLocale, defaultValueOrParams, paramsOrDefaultValue, defaultNamespace) {
   const startTime = performance.now();
   const { defaultValue, params } = parseTranslationParams(
     defaultValueOrParams,
@@ -1179,8 +1229,7 @@ function prepareTranslationRequest(key, currentLocale, defaultValueOrParams, par
   const context = createTranslationContext(
     parsedKey,
     currentLocale,
-    defaultNamespace,
-    fallbackLocale
+    defaultNamespace
   );
   const individualCacheKey = createIndividualCacheKey(
     context.locale,
@@ -1202,7 +1251,6 @@ function prepareTranslationRequest(key, currentLocale, defaultValueOrParams, par
     locale: currentLocale,
     namespace: context.namespace,
     // ✅ Use effective namespace (explicit or default)
-    fallbackLocale,
     individualCacheKey,
     // ✅ Ready-to-use cache key
     namespaceCacheKey,
@@ -2318,6 +2366,183 @@ var MarkupParser = class {
   }
 };
 
+// src/content/sanitizer/HTMLSanitizer.ts
+var SAFE_TAGS = /* @__PURE__ */ new Set([
+  "a",
+  "abbr",
+  "b",
+  "bdi",
+  "bdo",
+  "br",
+  "cite",
+  "code",
+  "del",
+  "dfn",
+  "em",
+  "i",
+  "img",
+  "ins",
+  "kbd",
+  "mark",
+  "q",
+  "s",
+  "samp",
+  "small",
+  "span",
+  "strong",
+  "sub",
+  "sup",
+  "time",
+  "u",
+  "var",
+  "wbr"
+]);
+var SAFE_ATTRS = /* @__PURE__ */ new Set([
+  "alt",
+  "cite",
+  "class",
+  "datetime",
+  "dir",
+  "height",
+  "href",
+  "id",
+  "lang",
+  "loading",
+  "rel",
+  "role",
+  "src",
+  "target",
+  "title",
+  "width"
+]);
+var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "cite"]);
+var SAFE_STYLE_PROPS = /* @__PURE__ */ new Set([
+  "color",
+  "background-color",
+  "font-family",
+  "font-size",
+  "font-style",
+  "font-weight",
+  "letter-spacing",
+  "line-height",
+  "text-decoration",
+  "text-decoration-color",
+  "text-decoration-line",
+  "text-decoration-style",
+  "text-transform",
+  "vertical-align",
+  "white-space",
+  "word-spacing"
+]);
+var DANGEROUS_CSS_VALUE = /url\s*\(|expression\s*\(|image-set\s*\(|element\s*\(|paint\s*\(|javascript:|\\|[<>{}@]/i;
+var SAFE_SCHEMES = /* @__PURE__ */ new Set(["http", "https", "mailto", "tel"]);
+var NAMED_ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: "\xA0",
+  colon: ":",
+  semi: ";",
+  sol: "/",
+  bsol: "\\",
+  Tab: "	",
+  NewLine: "\n"
+};
+function decodeEntities2(value) {
+  return value.replace(
+    /&(?:#[xX]([0-9a-fA-F]+);?|#(\d+);?|([a-zA-Z]+);)/g,
+    (full, hex, dec, name) => {
+      if (hex) return String.fromCodePoint(parseInt(hex, 16));
+      if (dec) return String.fromCodePoint(parseInt(dec, 10));
+      return NAMED_ENTITIES[name] ?? full;
+    }
+  );
+}
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function sanitizeUrl(value) {
+  const decoded = decodeEntities2(value);
+  const probe = decoded.replace(/[\u0000-\u0020\u007f]/g, "").toLowerCase();
+  const scheme = /^([a-z][a-z0-9+.-]*):/.exec(probe);
+  if (!scheme) return value;
+  return SAFE_SCHEMES.has(scheme[1]) ? value : null;
+}
+function sanitizeStyle(value) {
+  return filterCssDeclarations(value, true);
+}
+function sanitizeCssDeclarations(value) {
+  return filterCssDeclarations(value, false);
+}
+function filterCssDeclarations(value, requirePropAllowlist) {
+  const decoded = decodeEntities2(value);
+  const kept = [];
+  for (const declaration of decoded.split(";")) {
+    const colon = declaration.indexOf(":");
+    if (colon === -1) continue;
+    const prop = declaration.slice(0, colon).trim().toLowerCase();
+    const val = declaration.slice(colon + 1).trim();
+    if (!/^[a-z-]+$/.test(prop)) continue;
+    if (requirePropAllowlist && !SAFE_STYLE_PROPS.has(prop)) continue;
+    if (val === "" || DANGEROUS_CSS_VALUE.test(val)) continue;
+    kept.push(`${prop}: ${val}`);
+  }
+  return kept.length > 0 ? kept.join("; ") : null;
+}
+var ATTR_PATTERN = /([^\s=/>"']+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]*)))?/g;
+function sanitizeOpeningTag(rawOpen) {
+  if (!rawOpen.startsWith("<")) return null;
+  const tagName = extractTagName(rawOpen);
+  if (!/^[a-z][a-z0-9-]*$/.test(tagName) || !SAFE_TAGS.has(tagName)) {
+    return null;
+  }
+  const end = rawOpen.endsWith("/>") ? rawOpen.length - 2 : rawOpen.endsWith(">") ? rawOpen.length - 1 : rawOpen.length;
+  const attrSource = rawOpen.slice(1 + tagName.length, end);
+  const attrs = {};
+  for (const match of attrSource.matchAll(ATTR_PATTERN)) {
+    const name = match[1].toLowerCase();
+    const value = match[2] ?? match[3] ?? match[4] ?? "";
+    if (name in attrs) continue;
+    if (name === "style") {
+      const cleanStyle = sanitizeStyle(value);
+      if (cleanStyle !== null) attrs[name] = cleanStyle;
+      continue;
+    }
+    const allowed = SAFE_ATTRS.has(name) || /^data-[a-z0-9-]*$/.test(name) || /^aria-[a-z0-9-]*$/.test(name);
+    if (!allowed) continue;
+    if (URL_ATTRS.has(name)) {
+      if (sanitizeUrl(value) === null) continue;
+    }
+    attrs[name] = value;
+  }
+  return serializeOpeningTag(tagName, attrs);
+}
+function sanitizeContentUnit(unit) {
+  let changed = false;
+  const styles = {};
+  for (const [index, styleList] of Object.entries(unit.styles)) {
+    const raw = readRawStyle(styleList);
+    if (raw === null) {
+      styles[index] = styleList;
+      continue;
+    }
+    const safe = sanitizeOpeningTag(raw);
+    if (safe === null) {
+      changed = true;
+      const rest = styleList.filter((s) => !s.startsWith("raw:"));
+      if (rest.length > 0) styles[index] = rest;
+    } else if (safe === raw) {
+      styles[index] = styleList;
+    } else {
+      changed = true;
+      styles[index] = styleList.map((s) => s.startsWith("raw:") ? `raw:${safe}` : s);
+    }
+  }
+  return changed ? { text: unit.text, styles } : unit;
+}
+
 // src/content/serializer/HTMLSerializer.ts
 var HTMLSerializer = class {
   serialize(unit) {
@@ -2327,24 +2552,25 @@ var HTMLSerializer = class {
     let lastIndex = 0;
     let match;
     while ((match = tagPattern.exec(text)) !== null) {
-      result += text.slice(lastIndex, match.index);
+      result += escapeHtml(text.slice(lastIndex, match.index));
       const [fullMatch, closingSlash, indexStr] = match;
       const styleList = styles[indexStr] ?? [];
       const rawOpen = readRawStyle(styleList);
-      if (rawOpen) {
+      const safeOpen = rawOpen === null ? null : sanitizeOpeningTag(rawOpen);
+      if (rawOpen && safeOpen !== null) {
         const tagName = extractTagName(rawOpen);
         const isVoid = VOID_TAGS.has(tagName);
         if (closingSlash) {
           if (!isVoid) result += `</${tagName}>`;
         } else {
-          result += rawOpen;
+          result += safeOpen;
         }
       } else {
         result += fullMatch;
       }
       lastIndex = match.index + fullMatch.length;
     }
-    result += text.slice(lastIndex);
+    result += escapeHtml(text.slice(lastIndex));
     return result;
   }
 };
@@ -2583,10 +2809,9 @@ var CacheManager = class {
 var INDEXED_TAG_REGEX = /<\/?[0-9]+\/?>/;
 var HTML_TAG_REGEX = /<[a-z][a-z0-9]*(?:\s+[^>]*)?\/?>/i;
 var LionRapidCore = class {
-  constructor(eventEmitter, handlerChain, defaultLocale = "en", fallbackLocale = "en", defaultNamespace) {
+  constructor(eventEmitter, handlerChain, defaultLocale = "en", defaultNamespace) {
     __publicField(this, "handlerChain");
     __publicField(this, "currentLocale");
-    __publicField(this, "fallbackLocale");
     __publicField(this, "defaultNamespace");
     __publicField(this, "pendingTranslations", /* @__PURE__ */ new Map());
     __publicField(this, "bus");
@@ -2604,7 +2829,6 @@ var LionRapidCore = class {
     this.bus = eventEmitter;
     this.handlerChain = handlerChain;
     this.currentLocale = defaultLocale;
-    this.fallbackLocale = fallbackLocale;
     this.defaultNamespace = defaultNamespace;
     this.cache = new CacheManager(
       this.handlerChain,
@@ -2669,8 +2893,7 @@ var LionRapidCore = class {
       this.currentLocale,
       firstArg,
       secondArg,
-      this.defaultNamespace,
-      this.fallbackLocale
+      this.defaultNamespace
     );
     logger.debug(`Translation requested: ${request.cleanKey}`);
     const translateBus = this.bus.translation(request);
@@ -2720,8 +2943,7 @@ var LionRapidCore = class {
       this.currentLocale,
       firstArg,
       secondArg,
-      this.defaultNamespace,
-      this.fallbackLocale
+      this.defaultNamespace
     );
     logger.debug(`HTML translation requested: ${request.cleanKey}`);
     const translateBus = this.bus.translation(request);
@@ -2929,8 +3151,7 @@ var LionRapidCore = class {
       this.currentLocale,
       params,
       defaultValue,
-      this.defaultNamespace,
-      this.fallbackLocale
+      this.defaultNamespace
     );
     const syncResult = this.handlerChain.handleSync(request);
     const rawValue = syncResult && syncResult.status === 200 ? syncResult.value : request.parsedDefaultValue || request.cleanKey;
@@ -3051,8 +3272,7 @@ var LionRapidCore = class {
       this.currentLocale,
       void 0,
       void 0,
-      this.defaultNamespace,
-      this.fallbackLocale
+      this.defaultNamespace
     );
     return this.handlerChain.isCached(request);
   }
@@ -3473,6 +3693,9 @@ var MissingTranslationQueue = class {
 };
 
 // src/builder.ts
+function isLoudPreloadFailure(error) {
+  return !(error instanceof TranslationNotFoundError || error instanceof TranslationLockedError);
+}
 var LionRapidBuilder = class _LionRapidBuilder {
   constructor(config) {
     __publicField(this, "config");
@@ -3483,7 +3706,6 @@ var LionRapidBuilder = class _LionRapidBuilder {
     __publicField(this, "syncQueue", null);
     this.config = {
       defaultLocale: config.defaultLocale || "en",
-      fallbackLocale: config.fallbackLocale || "en",
       namespace: config.namespace || "app"
     };
   }
@@ -3584,7 +3806,6 @@ var LionRapidBuilder = class _LionRapidBuilder {
       eventEmitter,
       handlerChain,
       this.config.defaultLocale,
-      this.config.fallbackLocale,
       this.config.namespace
     );
     for (const plugin of this.plugins) {
@@ -3615,7 +3836,17 @@ var LionRapidBuilder = class _LionRapidBuilder {
     logger.debug("Preload targets", {
       namespaces: eagerPreloads.map((c) => `${c.locale}:${c.namespace}`)
     });
+    let warnedLoudly = false;
+    const warnLoudlyOnce = (namespaceKey, error) => {
+      if (!isLoudPreloadFailure(error) || warnedLoudly) return;
+      warnedLoudly = true;
+      console.warn(
+        `[LionRapid] Could not load translations for ${namespaceKey} \u2014 the page stays untranslated until the server is reachable.`,
+        error
+      );
+    };
     const promises = eagerPreloads.map(async (preloadConfig) => {
+      const namespaceKey = `${preloadConfig.locale}:${preloadConfig.namespace}`;
       try {
         const result = await networkHandler.loadNamespace(
           preloadConfig.locale,
@@ -3624,19 +3855,19 @@ var LionRapidBuilder = class _LionRapidBuilder {
         if (result && result.data && result.status === 200) {
           const context = {
             locale: preloadConfig.locale,
-            namespace: preloadConfig.namespace,
-            fallbackLocale: this.config.fallbackLocale
+            namespace: preloadConfig.namespace
           };
           await handlerChain.saveNamespaceToHandlers(result.data, context);
-          logger.debug(
-            `Preloaded: ${preloadConfig.locale}:${preloadConfig.namespace}`
-          );
+          logger.debug(`Preloaded: ${namespaceKey}`);
+          return;
+        }
+        if (result?.error) {
+          warnLoudlyOnce(namespaceKey, result.error);
+          logger.warn(`Preload failed: ${namespaceKey}`, result.error);
         }
       } catch (error) {
-        logger.warn(
-          `Preload failed: ${preloadConfig.locale}:${preloadConfig.namespace}`,
-          error
-        );
+        warnLoudlyOnce(namespaceKey, error);
+        logger.warn(`Preload failed: ${namespaceKey}`, error);
       }
     });
     await Promise.allSettled(promises);
@@ -3650,8 +3881,16 @@ var _NetworkRepository = class _NetworkRepository {
     __publicField(this, "name", "NetworkRepository");
     __publicField(this, "type", "network");
     __publicField(this, "config", {});
-    /** Cached version (opaque string from server) per namespace key "locale:namespace" */
-    __publicField(this, "namespaceVersions", /* @__PURE__ */ new Map());
+    /**
+     * Namespace snapshot per key "locale:namespace": the server version TOGETHER
+     * with the payload it describes, persisted as ONE localStorage entry.
+     *
+     * Canonical 304 contract (same as edge KV bundle + WP transient cache):
+     * never claim freshness you can't back. If-None-Match is only sent when the
+     * snapshot is in hand; a 304 answers with that snapshot's payload; version
+     * and payload can never desync because they live and die together.
+     */
+    __publicField(this, "namespaceSnapshots", /* @__PURE__ */ new Map());
     /**
      * Default endpoint templates with placeholder support
      * Placeholders: :key, :locale, :namespace
@@ -3764,36 +4003,50 @@ var _NetworkRepository = class _NetworkRepository {
       logger.debug("API base URL is not set");
       throw new NetworkError("API base URL is not set");
     }
+    try {
+      return await this.fetchNamespaceRaw(locale, namespace);
+    } catch (error) {
+      this.handleCaughtError(error);
+    }
+  }
+  /**
+   * Shared namespace fetch with the canonical 304 contract:
+   * - If-None-Match is sent ONLY when a snapshot (version + payload) is in hand.
+   * - 304 answers with that snapshot's payload — never with "nothing".
+   * - A 304 with no snapshot (server/proxy surprise) refetches unconditionally.
+   * - A 200 stores version + payload atomically before either is trusted.
+   */
+  async fetchNamespaceRaw(locale, namespace, allowConditional = true) {
     const url = this.buildUrl("getNamespace", { locale, namespace });
     logger.debug(`API GET Namespace: ${url}`);
     const namespaceKey = `${locale}:${namespace}`;
-    try {
-      const extraHeaders = {};
-      const cachedVersion = this.getVersion(namespaceKey);
-      if (cachedVersion) {
-        extraHeaders["If-None-Match"] = `W/"${cachedVersion}"`;
-      }
-      const response = await this.makeRequest(url, "GET", void 0, extraHeaders);
-      if (response.status === 304) {
-        logger.debug(`Namespace ${namespaceKey}: 304 Not Modified`);
-        return null;
-      }
-      if (!response.ok) {
-        this.handleHttpError(response, namespaceKey);
-      }
-      const data = await response.json();
-      logger.debug("API response data:", data);
-      if (!data.translations) {
-        throw new TranslationNotFoundError(namespaceKey);
-      }
-      const version = data.meta?.version != null ? String(data.meta.version) : null;
-      if (version) {
-        this.setVersion(namespaceKey, version);
+    const snapshot = allowConditional ? this.getSnapshot(namespaceKey) : void 0;
+    const extraHeaders = {};
+    if (snapshot) {
+      extraHeaders["If-None-Match"] = `W/"${snapshot.version}"`;
+    }
+    const response = await this.makeRequest(url, "GET", void 0, extraHeaders);
+    if (response.status === 304) {
+      if (snapshot) {
+        logger.debug(`Namespace ${namespaceKey}: 304 Not Modified (snapshot served)`);
+        return snapshot.translations;
       }
-      return data.translations;
-    } catch (error) {
-      this.handleCaughtError(error);
+      logger.debug(`Namespace ${namespaceKey}: unexpected 304 with no snapshot \u2014 refetching`);
+      return this.fetchNamespaceRaw(locale, namespace, false);
+    }
+    if (!response.ok) {
+      this.handleHttpError(response, namespaceKey);
+    }
+    const data = await response.json();
+    logger.debug("API response data:", data);
+    if (!data.translations) {
+      throw new TranslationNotFoundError(namespaceKey);
     }
+    const version = data.meta?.version != null ? String(data.meta.version) : null;
+    if (version) {
+      this.setSnapshot(namespaceKey, { version, translations: data.translations });
+    }
+    return data.translations;
   }
   /**
    * Save translation to API (if supported)
@@ -3878,33 +4131,8 @@ var _NetworkRepository = class _NetworkRepository {
       logger.debug("API base URL is not set");
       throw new NetworkError("API base URL is not set");
     }
-    const url = this.buildUrl("getNamespace", { locale, namespace });
-    logger.debug(`API GET Namespace ContentUnits: ${url}`);
-    const namespaceKey = `${locale}:${namespace}`;
     try {
-      const extraHeaders = {};
-      const cachedVersion = this.getVersion(namespaceKey);
-      if (cachedVersion) {
-        extraHeaders["If-None-Match"] = `W/"${cachedVersion}"`;
-      }
-      const response = await this.makeRequest(url, "GET", void 0, extraHeaders);
-      if (response.status === 304) {
-        logger.debug(`Namespace ContentUnits ${namespaceKey}: 304 Not Modified`);
-        return null;
-      }
-      if (!response.ok) {
-        this.handleHttpError(response, namespaceKey);
-      }
-      const data = await response.json();
-      logger.debug("API response data:", data);
-      if (!data.translations) {
-        throw new TranslationNotFoundError(namespaceKey);
-      }
-      const version = data.meta?.version != null ? String(data.meta.version) : null;
-      if (version) {
-        this.setVersion(namespaceKey, version);
-      }
-      return data.translations;
+      return await this.fetchNamespaceRaw(locale, namespace);
     } catch (error) {
       this.handleCaughtError(error);
     }
@@ -4014,25 +4242,37 @@ var _NetworkRepository = class _NetworkRepository {
   getConfig() {
     return this.config;
   }
-  /** Read persisted version from localStorage, falling back to in-memory map */
-  getVersion(namespaceKey) {
-    const mem = this.namespaceVersions.get(namespaceKey);
+  /** Read a persisted snapshot (version + payload), falling back to memory.
+   *  Legacy bare-version entries and corrupt snapshots are deleted on sight —
+   *  a version without its payload must never drive a conditional request. */
+  getSnapshot(namespaceKey) {
+    const mem = this.namespaceSnapshots.get(namespaceKey);
     if (mem) return mem;
     try {
-      const stored = localStorage.getItem(_NetworkRepository.VERSION_PREFIX + namespaceKey);
-      if (stored) {
-        this.namespaceVersions.set(namespaceKey, stored);
-        return stored;
+      localStorage.removeItem(_NetworkRepository.LEGACY_VERSION_PREFIX + namespaceKey);
+      const raw = localStorage.getItem(_NetworkRepository.SNAPSHOT_PREFIX + namespaceKey);
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed.version === "string" && parsed.version.length > 0 && parsed.translations && typeof parsed.translations === "object") {
+          this.namespaceSnapshots.set(namespaceKey, parsed);
+          return parsed;
+        }
+        localStorage.removeItem(_NetworkRepository.SNAPSHOT_PREFIX + namespaceKey);
       }
     } catch {
     }
     return void 0;
   }
-  /** Persist version to both in-memory map and localStorage */
-  setVersion(namespaceKey, version) {
-    this.namespaceVersions.set(namespaceKey, version);
+  /** Persist version + payload as ONE entry (memory + localStorage). On quota
+   *  failure the previous stored snapshot stays — still a consistent pair. */
+  setSnapshot(namespaceKey, snapshot) {
+    this.namespaceSnapshots.set(namespaceKey, snapshot);
     try {
-      localStorage.setItem(_NetworkRepository.VERSION_PREFIX + namespaceKey, version);
+      localStorage.setItem(
+        _NetworkRepository.SNAPSHOT_PREFIX + namespaceKey,
+        JSON.stringify(snapshot)
+      );
+      localStorage.removeItem(_NetworkRepository.LEGACY_VERSION_PREFIX + namespaceKey);
     } catch {
     }
   }
@@ -4121,8 +4361,11 @@ var _NetworkRepository = class _NetworkRepository {
     }
   }
 };
-/** localStorage key prefix for persisted versions */
-__publicField(_NetworkRepository, "VERSION_PREFIX", "lionrapid:v:");
+/** localStorage key prefix for persisted snapshots (version + payload) */
+__publicField(_NetworkRepository, "SNAPSHOT_PREFIX", "lionrapid:ns:");
+/** Legacy bare-version prefix — a version WITHOUT its payload is exactly the
+ *  desync the snapshot store exists to prevent; entries are deleted on sight. */
+__publicField(_NetworkRepository, "LEGACY_VERSION_PREFIX", "lionrapid:v:");
 var NetworkRepository = _NetworkRepository;
 
 // src/content/validator/ContentValidator.ts
@@ -4278,6 +4521,159 @@ var ContentValidator = class {
   }
 };
 
+// src/content/splitter/BlockSplitter.ts
+var BLOCK_TAGS = /* @__PURE__ */ new Set([
+  "title",
+  "p",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "li",
+  "td",
+  "th",
+  "label",
+  "button",
+  "figcaption",
+  "dt",
+  "dd",
+  "summary",
+  "caption"
+]);
+var INLINE_BLOCK_TAGS = /* @__PURE__ */ new Set(["a"]);
+var SKIP_TAGS = /* @__PURE__ */ new Set([
+  "script",
+  "style",
+  "code",
+  "pre",
+  "textarea",
+  "noscript",
+  "svg"
+]);
+var TAG_REGEX = /<(\/?)([a-zA-Z][a-zA-Z0-9]*)((?:\s+[a-zA-Z][a-zA-Z0-9-]*(?:=(?:"[^"]*"|'[^']*'|[^\s>]*))?)*)\s*(\/?)>/g;
+function hasNoTranslateAttr(attrsString) {
+  if (attrsString.includes("data-no-translate")) return true;
+  return /translate\s*=\s*["']no["']/.test(attrsString);
+}
+function containsBlockTag(innerHTML) {
+  TAG_REGEX.lastIndex = 0;
+  let match;
+  while ((match = TAG_REGEX.exec(innerHTML)) !== null) {
+    const [, closingSlash, tagName, , selfClosingSlash] = match;
+    if (!closingSlash && !selfClosingSlash && BLOCK_TAGS.has(tagName.toLowerCase())) {
+      return true;
+    }
+  }
+  return false;
+}
+function findCloseTag(html, pos, tagName) {
+  const lowerTag = tagName.toLowerCase();
+  let depth = 1;
+  TAG_REGEX.lastIndex = pos;
+  let match;
+  while ((match = TAG_REGEX.exec(html)) !== null) {
+    const [, closingSlash, matchedTag, , selfClosingSlash] = match;
+    if (matchedTag.toLowerCase() !== lowerTag) continue;
+    if (closingSlash) {
+      depth--;
+      if (depth === 0) return match.index;
+    } else if (!selfClosingSlash) {
+      depth++;
+    }
+  }
+  return -1;
+}
+function splitBlocks(html) {
+  const blocks = [];
+  let pos = 0;
+  let skipDepth = 0;
+  let iter = 0;
+  const maxIter = 1e5;
+  const noTranslateEnds = [];
+  while (pos < html.length && iter < maxIter) {
+    iter++;
+    const ltPos = html.indexOf("<", pos);
+    if (ltPos === -1) break;
+    if (html.startsWith("<!--", ltPos)) {
+      const commentEnd = html.indexOf("-->", ltPos + 4);
+      if (commentEnd === -1) break;
+      pos = commentEnd + 3;
+      continue;
+    }
+    TAG_REGEX.lastIndex = ltPos;
+    const match = TAG_REGEX.exec(html);
+    if (!match || match.index !== ltPos) {
+      pos = ltPos + 1;
+      continue;
+    }
+    const [fullMatch, closingSlash, tagName, attrsString, selfClosingSlash] = match;
+    const tag = tagName.toLowerCase();
+    const afterMatch = match.index + fullMatch.length;
+    if (SKIP_TAGS.has(tag)) {
+      if (closingSlash) {
+        if (skipDepth > 0) skipDepth--;
+      } else if (!selfClosingSlash) {
+        skipDepth++;
+      }
+      pos = afterMatch;
+      continue;
+    }
+    if (skipDepth > 0) {
+      pos = afterMatch;
+      continue;
+    }
+    while (noTranslateEnds.length && pos >= noTranslateEnds[noTranslateEnds.length - 1]) {
+      noTranslateEnds.pop();
+    }
+    if (!closingSlash && !selfClosingSlash && hasNoTranslateAttr(attrsString)) {
+      const regionEnd = findCloseTag(html, afterMatch, tagName);
+      if (regionEnd !== -1) {
+        noTranslateEnds.push(regionEnd);
+      }
+    }
+    if (noTranslateEnds.length > 0) {
+      pos = afterMatch;
+      continue;
+    }
+    if ((BLOCK_TAGS.has(tag) || INLINE_BLOCK_TAGS.has(tag)) && !closingSlash && !selfClosingSlash) {
+      const closeTagStart = findCloseTag(html, afterMatch, tagName);
+      if (closeTagStart === -1) {
+        pos = afterMatch;
+        continue;
+      }
+      const innerHTML = html.slice(afterMatch, closeTagStart);
+      if (containsBlockTag(innerHTML)) {
+        pos = afterMatch;
+        continue;
+      }
+      blocks.push({
+        tag,
+        openTag: fullMatch,
+        attrs: attrsString,
+        inner: innerHTML,
+        innerStart: afterMatch,
+        innerEnd: closeTagStart
+      });
+      TAG_REGEX.lastIndex = closeTagStart;
+      const closeMatch = TAG_REGEX.exec(html);
+      pos = closeMatch ? closeMatch.index + closeMatch[0].length : closeTagStart + 1;
+      continue;
+    }
+    pos = afterMatch;
+  }
+  return { blocks };
+}
+function replaceBlockInners(html, replacements) {
+  const ordered = [...replacements].sort((a, b) => b.block.innerStart - a.block.innerStart);
+  let result = html;
+  for (const { block, inner } of ordered) {
+    result = result.slice(0, block.innerStart) + inner + result.slice(block.innerEnd);
+  }
+  return result;
+}
+
 // src/browser/md5.ts
 function safeAdd(x, y) {
   const lsw = (x & 65535) + (y & 65535);
@@ -4483,6 +4879,75 @@ var ExcludeFilter = class {
   }
 };
 
+// src/browser/sanitizer.ts
+var REMOVE_TAGS = /* @__PURE__ */ new Set([
+  "script",
+  "iframe",
+  "frame",
+  "frameset",
+  "object",
+  "embed",
+  "applet",
+  "base",
+  "meta",
+  "link",
+  "template",
+  "portal"
+]);
+var URL_ATTRS2 = /* @__PURE__ */ new Set([
+  "href",
+  "src",
+  "action",
+  "formaction",
+  "poster",
+  "data",
+  "xlink:href"
+]);
+function sanitizeElement(root) {
+  const all = [root, ...Array.from(root.querySelectorAll("*"))];
+  for (const el of all) {
+    const tag = el.tagName.toLowerCase();
+    if (REMOVE_TAGS.has(tag)) {
+      el.remove();
+      continue;
+    }
+    for (const name of el.getAttributeNames()) {
+      const lower = name.toLowerCase();
+      if (lower.startsWith("on") || lower === "srcdoc") {
+        el.removeAttribute(name);
+        continue;
+      }
+      if (URL_ATTRS2.has(lower)) {
+        if (sanitizeUrl(el.getAttribute(name) ?? "") === null) {
+          el.removeAttribute(name);
+        }
+        continue;
+      }
+      if (lower === "style") {
+        const clean = sanitizeCssDeclarations(el.getAttribute(name) ?? "");
+        if (clean === null) el.removeAttribute(name);
+        else el.setAttribute(name, clean);
+      }
+    }
+  }
+}
+function sanitizeStyleSheetText(css, baseHref) {
+  let out = css.replace(/@import[^;]*(;|$)/gi, "");
+  out = out.replace(
+    /url\(\s*(['"]?)([^'")]*)\1\s*\)/gi,
+    (full, _quote, target) => {
+      try {
+        const resolved = new URL(target, baseHref);
+        if (resolved.protocol === "data:") return full;
+        if (resolved.origin === new URL(baseHref).origin) return full;
+      } catch {
+      }
+      return 'url("")';
+    }
+  );
+  return out.replace(/expression\s*\(/gi, "blocked(");
+}
+
 // src/browser/storage/localstorage-repository.ts
 var STORAGE_PREFIX = "lionrapid:";
 var VERSION_KEY = `${STORAGE_PREFIX}version`;
@@ -4886,6 +5351,7 @@ export {
   ExcludeFilter,
   HTMLSerializer,
   HandlerChain,
+  LOCALE_TAG_REGEX,
   LionRapidBuilder,
   LionRapidCore,
   LocalStorageRepository,
@@ -4896,6 +5362,9 @@ export {
   MissingTranslationQueue,
   NetworkError,
   NetworkRepository,
+  SAFE_ATTRS,
+  SAFE_STYLE_PROPS,
+  SAFE_TAGS,
   ServerError,
   StaticRepository,
   TranslationError,
@@ -4904,18 +5373,32 @@ export {
   VERSION,
   VOID_TAGS,
   createPackageLogger,
+  escapeHtml,
   extractTagName,
   generateAutoKey,
   isClientError,
   isRetryableError,
   isTranslationError,
+  localeDir,
   logger,
+  matchLocale,
   md5,
   measure,
+  normalizeLocale,
+  parseAcceptLanguage,
   parseKeyPath,
   prepareTranslationRequest,
+  primarySubtag,
   readRawStyle,
+  replaceBlockInners,
   resolveNestedKey,
-  serializeOpeningTag
+  sanitizeContentUnit,
+  sanitizeElement,
+  sanitizeOpeningTag,
+  sanitizeStyle,
+  sanitizeStyleSheetText,
+  sanitizeUrl,
+  serializeOpeningTag,
+  splitBlocks
 };
 //# sourceMappingURL=lionrapid.esm.js.map