@lionrapid/core 0.5.0 → 0.6.1

package/dist/browser/lionrapid.iife.dev.js

@@ -31,6 +31,7 @@ var LionRapid = (() => {
     ExcludeFilter: () => ExcludeFilter,
     HTMLSerializer: () => HTMLSerializer,
     HandlerChain: () => HandlerChain,
+    LOCALE_TAG_REGEX: () => LOCALE_TAG_REGEX,
     LionRapidBuilder: () => LionRapidBuilder,
     LionRapidCore: () => LionRapidCore,
     LocalStorageRepository: () => LocalStorageRepository,
@@ -41,6 +42,9 @@ var LionRapid = (() => {
     MissingTranslationQueue: () => MissingTranslationQueue,
     NetworkError: () => NetworkError,
     NetworkRepository: () => NetworkRepository,
+    SAFE_ATTRS: () => SAFE_ATTRS,
+    SAFE_STYLE_PROPS: () => SAFE_STYLE_PROPS,
+    SAFE_TAGS: () => SAFE_TAGS,
     ServerError: () => ServerError,
     StaticRepository: () => StaticRepository,
     TranslationError: () => TranslationError,
@@ -49,19 +53,33 @@ var LionRapid = (() => {
     VERSION: () => VERSION,
     VOID_TAGS: () => VOID_TAGS,
     createPackageLogger: () => createPackageLogger,
+    escapeHtml: () => escapeHtml,
     extractTagName: () => extractTagName,
     generateAutoKey: () => generateAutoKey,
     isClientError: () => isClientError,
     isRetryableError: () => isRetryableError,
     isTranslationError: () => isTranslationError,
+    localeDir: () => localeDir,
     logger: () => logger,
+    matchLocale: () => matchLocale,
     md5: () => md5,
     measure: () => measure,
+    normalizeLocale: () => normalizeLocale,
+    parseAcceptLanguage: () => parseAcceptLanguage,
     parseKeyPath: () => parseKeyPath,
     prepareTranslationRequest: () => prepareTranslationRequest,
+    primarySubtag: () => primarySubtag,
     readRawStyle: () => readRawStyle,
+    replaceBlockInners: () => replaceBlockInners,
     resolveNestedKey: () => resolveNestedKey,
-    serializeOpeningTag: () => serializeOpeningTag
+    sanitizeContentUnit: () => sanitizeContentUnit,
+    sanitizeElement: () => sanitizeElement,
+    sanitizeOpeningTag: () => sanitizeOpeningTag,
+    sanitizeStyle: () => sanitizeStyle,
+    sanitizeStyleSheetText: () => sanitizeStyleSheetText,
+    sanitizeUrl: () => sanitizeUrl,
+    serializeOpeningTag: () => serializeOpeningTag,
+    splitBlocks: () => splitBlocks
   });
 
   // src/config/logger.config.ts
@@ -411,6 +429,57 @@ var LionRapid = (() => {
     };
   };
 
+  // src/utils/locale.ts
+  var LOCALE_TAG_REGEX = /^[a-z]{2,3}(?:-[a-z0-9]{2,4})*$/i;
+  var RTL_LANGUAGES = /* @__PURE__ */ new Set(["ar", "fa", "he", "ur", "yi"]);
+  function primarySubtag(tag) {
+    return tag.split("-")[0].toLowerCase();
+  }
+  function normalizeLocale(tag) {
+    const trimmed = tag.trim();
+    if (!trimmed) return trimmed;
+    const [lang, ...rest] = trimmed.split("-");
+    const out = [lang.toLowerCase()];
+    for (const sub of rest) {
+      if (sub.length === 4) {
+        out.push(sub[0].toUpperCase() + sub.slice(1).toLowerCase());
+      } else if (sub.length === 2) {
+        out.push(sub.toUpperCase());
+      } else {
+        out.push(sub.toLowerCase());
+      }
+    }
+    return out.join("-");
+  }
+  function matchLocale(requested, available, fallback) {
+    if (available.length === 0) return fallback;
+    const avail = available.map((raw) => ({
+      raw,
+      lower: normalizeLocale(raw).toLowerCase()
+    }));
+    for (const req of requested) {
+      if (!req) continue;
+      const reqLower = normalizeLocale(req).toLowerCase();
+      const exact = avail.find((a) => a.lower === reqLower);
+      if (exact) return exact.raw;
+      const primary = primarySubtag(req);
+      const byPrimary = avail.find((a) => a.lower === primary);
+      if (byPrimary) return byPrimary.raw;
+    }
+    return fallback;
+  }
+  function parseAcceptLanguage(header) {
+    return header.split(",").map((part) => {
+      const [tag, ...params] = part.trim().split(";");
+      const qParam = params.find((p) => p.trim().startsWith("q="));
+      const q = qParam ? parseFloat(qParam.trim().slice(2)) : 1;
+      return { tag: tag.trim(), q: Number.isNaN(q) ? 0 : q };
+    }).filter((x) => x.tag.length > 0 && x.tag !== "*").sort((a, b) => b.q - a.q).map((x) => x.tag);
+  }
+  function localeDir(tag) {
+    return RTL_LANGUAGES.has(primarySubtag(tag)) ? "rtl" : "ltr";
+  }
+
   // src/base/event-emitter.ts
   var EventEmitter = class {
     constructor() {
@@ -699,7 +768,7 @@ var LionRapid = (() => {
         complete: () => {
           this.emit("language:change:success", {
             context: this.createContext(requestId, [...baseTrace, "complete"]),
-            payload: { oldLocale, newLocale }
+            payload: { oldLocale, newLocale, dir: localeDir(newLocale) }
           });
         },
         error: (error) => {
@@ -1109,12 +1178,11 @@ var LionRapid = (() => {
   }
 
   // src/utils/context-utils.ts
-  function createTranslationContext(parsedKey, currentLocale, defaultNamespace, fallbackLocale) {
+  function createTranslationContext(parsedKey, currentLocale, defaultNamespace) {
     const effectiveNamespace = parsedKey.hasExplicitNamespace ? parsedKey.namespace : defaultNamespace;
     return {
       locale: currentLocale,
-      namespace: effectiveNamespace,
-      fallbackLocale: fallbackLocale || currentLocale
+      namespace: effectiveNamespace
     };
   }
 
@@ -1231,7 +1299,7 @@ var LionRapid = (() => {
   }
 
   // src/utils/translation-flow.ts
-  function prepareTranslationRequest(key, currentLocale, defaultValueOrParams, paramsOrDefaultValue, defaultNamespace, fallbackLocale) {
+  function prepareTranslationRequest(key, currentLocale, defaultValueOrParams, paramsOrDefaultValue, defaultNamespace) {
     const startTime = performance.now();
     const { defaultValue, params } = parseTranslationParams(
       defaultValueOrParams,
@@ -1241,8 +1309,7 @@ var LionRapid = (() => {
     const context = createTranslationContext(
       parsedKey,
       currentLocale,
-      defaultNamespace,
-      fallbackLocale
+      defaultNamespace
     );
     const individualCacheKey = createIndividualCacheKey(
       context.locale,
@@ -1264,7 +1331,6 @@ var LionRapid = (() => {
       locale: currentLocale,
       namespace: context.namespace,
       // ✅ Use effective namespace (explicit or default)
-      fallbackLocale,
       individualCacheKey,
       // ✅ Ready-to-use cache key
       namespaceCacheKey,
@@ -2380,6 +2446,183 @@ var LionRapid = (() => {
     }
   };
 
+  // src/content/sanitizer/HTMLSanitizer.ts
+  var SAFE_TAGS = /* @__PURE__ */ new Set([
+    "a",
+    "abbr",
+    "b",
+    "bdi",
+    "bdo",
+    "br",
+    "cite",
+    "code",
+    "del",
+    "dfn",
+    "em",
+    "i",
+    "img",
+    "ins",
+    "kbd",
+    "mark",
+    "q",
+    "s",
+    "samp",
+    "small",
+    "span",
+    "strong",
+    "sub",
+    "sup",
+    "time",
+    "u",
+    "var",
+    "wbr"
+  ]);
+  var SAFE_ATTRS = /* @__PURE__ */ new Set([
+    "alt",
+    "cite",
+    "class",
+    "datetime",
+    "dir",
+    "height",
+    "href",
+    "id",
+    "lang",
+    "loading",
+    "rel",
+    "role",
+    "src",
+    "target",
+    "title",
+    "width"
+  ]);
+  var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "cite"]);
+  var SAFE_STYLE_PROPS = /* @__PURE__ */ new Set([
+    "color",
+    "background-color",
+    "font-family",
+    "font-size",
+    "font-style",
+    "font-weight",
+    "letter-spacing",
+    "line-height",
+    "text-decoration",
+    "text-decoration-color",
+    "text-decoration-line",
+    "text-decoration-style",
+    "text-transform",
+    "vertical-align",
+    "white-space",
+    "word-spacing"
+  ]);
+  var DANGEROUS_CSS_VALUE = /url\s*\(|expression\s*\(|image-set\s*\(|element\s*\(|paint\s*\(|javascript:|\\|[<>{}@]/i;
+  var SAFE_SCHEMES = /* @__PURE__ */ new Set(["http", "https", "mailto", "tel"]);
+  var NAMED_ENTITIES = {
+    amp: "&",
+    lt: "<",
+    gt: ">",
+    quot: '"',
+    apos: "'",
+    nbsp: "\xA0",
+    colon: ":",
+    semi: ";",
+    sol: "/",
+    bsol: "\\",
+    Tab: "	",
+    NewLine: "\n"
+  };
+  function decodeEntities2(value) {
+    return value.replace(
+      /&(?:#[xX]([0-9a-fA-F]+);?|#(\d+);?|([a-zA-Z]+);)/g,
+      (full, hex, dec, name) => {
+        if (hex) return String.fromCodePoint(parseInt(hex, 16));
+        if (dec) return String.fromCodePoint(parseInt(dec, 10));
+        return NAMED_ENTITIES[name] ?? full;
+      }
+    );
+  }
+  function escapeHtml(text) {
+    return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+  }
+  function sanitizeUrl(value) {
+    const decoded = decodeEntities2(value);
+    const probe = decoded.replace(/[\u0000-\u0020\u007f]/g, "").toLowerCase();
+    const scheme = /^([a-z][a-z0-9+.-]*):/.exec(probe);
+    if (!scheme) return value;
+    return SAFE_SCHEMES.has(scheme[1]) ? value : null;
+  }
+  function sanitizeStyle(value) {
+    return filterCssDeclarations(value, true);
+  }
+  function sanitizeCssDeclarations(value) {
+    return filterCssDeclarations(value, false);
+  }
+  function filterCssDeclarations(value, requirePropAllowlist) {
+    const decoded = decodeEntities2(value);
+    const kept = [];
+    for (const declaration of decoded.split(";")) {
+      const colon = declaration.indexOf(":");
+      if (colon === -1) continue;
+      const prop = declaration.slice(0, colon).trim().toLowerCase();
+      const val = declaration.slice(colon + 1).trim();
+      if (!/^[a-z-]+$/.test(prop)) continue;
+      if (requirePropAllowlist && !SAFE_STYLE_PROPS.has(prop)) continue;
+      if (val === "" || DANGEROUS_CSS_VALUE.test(val)) continue;
+      kept.push(`${prop}: ${val}`);
+    }
+    return kept.length > 0 ? kept.join("; ") : null;
+  }
+  var ATTR_PATTERN = /([^\s=/>"']+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]*)))?/g;
+  function sanitizeOpeningTag(rawOpen) {
+    if (!rawOpen.startsWith("<")) return null;
+    const tagName = extractTagName(rawOpen);
+    if (!/^[a-z][a-z0-9-]*$/.test(tagName) || !SAFE_TAGS.has(tagName)) {
+      return null;
+    }
+    const end = rawOpen.endsWith("/>") ? rawOpen.length - 2 : rawOpen.endsWith(">") ? rawOpen.length - 1 : rawOpen.length;
+    const attrSource = rawOpen.slice(1 + tagName.length, end);
+    const attrs = {};
+    for (const match of attrSource.matchAll(ATTR_PATTERN)) {
+      const name = match[1].toLowerCase();
+      const value = match[2] ?? match[3] ?? match[4] ?? "";
+      if (name in attrs) continue;
+      if (name === "style") {
+        const cleanStyle = sanitizeStyle(value);
+        if (cleanStyle !== null) attrs[name] = cleanStyle;
+        continue;
+      }
+      const allowed = SAFE_ATTRS.has(name) || /^data-[a-z0-9-]*$/.test(name) || /^aria-[a-z0-9-]*$/.test(name);
+      if (!allowed) continue;
+      if (URL_ATTRS.has(name)) {
+        if (sanitizeUrl(value) === null) continue;
+      }
+      attrs[name] = value;
+    }
+    return serializeOpeningTag(tagName, attrs);
+  }
+  function sanitizeContentUnit(unit) {
+    let changed = false;
+    const styles = {};
+    for (const [index, styleList] of Object.entries(unit.styles)) {
+      const raw = readRawStyle(styleList);
+      if (raw === null) {
+        styles[index] = styleList;
+        continue;
+      }
+      const safe = sanitizeOpeningTag(raw);
+      if (safe === null) {
+        changed = true;
+        const rest = styleList.filter((s) => !s.startsWith("raw:"));
+        if (rest.length > 0) styles[index] = rest;
+      } else if (safe === raw) {
+        styles[index] = styleList;
+      } else {
+        changed = true;
+        styles[index] = styleList.map((s) => s.startsWith("raw:") ? `raw:${safe}` : s);
+      }
+    }
+    return changed ? { text: unit.text, styles } : unit;
+  }
+
   // src/content/serializer/HTMLSerializer.ts
   var HTMLSerializer = class {
     serialize(unit) {
@@ -2389,24 +2632,25 @@ var LionRapid = (() => {
       let lastIndex = 0;
       let match;
       while ((match = tagPattern.exec(text)) !== null) {
-        result += text.slice(lastIndex, match.index);
+        result += escapeHtml(text.slice(lastIndex, match.index));
         const [fullMatch, closingSlash, indexStr] = match;
         const styleList = styles[indexStr] ?? [];
         const rawOpen = readRawStyle(styleList);
-        if (rawOpen) {
+        const safeOpen = rawOpen === null ? null : sanitizeOpeningTag(rawOpen);
+        if (rawOpen && safeOpen !== null) {
           const tagName = extractTagName(rawOpen);
           const isVoid = VOID_TAGS.has(tagName);
           if (closingSlash) {
             if (!isVoid) result += `</${tagName}>`;
           } else {
-            result += rawOpen;
+            result += safeOpen;
           }
         } else {
           result += fullMatch;
         }
         lastIndex = match.index + fullMatch.length;
       }
-      result += text.slice(lastIndex);
+      result += escapeHtml(text.slice(lastIndex));
       return result;
     }
   };
@@ -2645,10 +2889,9 @@ var LionRapid = (() => {
   var INDEXED_TAG_REGEX = /<\/?[0-9]+\/?>/;
   var HTML_TAG_REGEX = /<[a-z][a-z0-9]*(?:\s+[^>]*)?\/?>/i;
   var LionRapidCore = class {
-    constructor(eventEmitter, handlerChain, defaultLocale = "en", fallbackLocale = "en", defaultNamespace) {
+    constructor(eventEmitter, handlerChain, defaultLocale = "en", defaultNamespace) {
       __publicField(this, "handlerChain");
       __publicField(this, "currentLocale");
-      __publicField(this, "fallbackLocale");
       __publicField(this, "defaultNamespace");
       __publicField(this, "pendingTranslations", /* @__PURE__ */ new Map());
       __publicField(this, "bus");
@@ -2656,6 +2899,7 @@ var LionRapid = (() => {
       // 🔥 EMBEDDED: Core integration maps
       __publicField(this, "formatters", /* @__PURE__ */ new Map());
       __publicField(this, "processors", /* @__PURE__ */ new Map());
+      __publicField(this, "warnedNoInterpolate", false);
       // 📡 EVENT-DRIVEN: Just track for cleanup
       __publicField(this, "eventPlugins", /* @__PURE__ */ new Set());
       // 📦 CONTENT: Parser and serializer for ContentUnit processing
@@ -2666,7 +2910,6 @@ var LionRapid = (() => {
       this.bus = eventEmitter;
       this.handlerChain = handlerChain;
       this.currentLocale = defaultLocale;
-      this.fallbackLocale = fallbackLocale;
       this.defaultNamespace = defaultNamespace;
       this.cache = new CacheManager(
         this.handlerChain,
@@ -2731,8 +2974,7 @@ var LionRapid = (() => {
         this.currentLocale,
         firstArg,
         secondArg,
-        this.defaultNamespace,
-        this.fallbackLocale
+        this.defaultNamespace
       );
       logger.debug(`Translation requested: ${request.cleanKey}`);
       const translateBus = this.bus.translation(request);
@@ -2782,8 +3024,7 @@ var LionRapid = (() => {
         this.currentLocale,
         firstArg,
         secondArg,
-        this.defaultNamespace,
-        this.fallbackLocale
+        this.defaultNamespace
       );
       logger.debug(`HTML translation requested: ${request.cleanKey}`);
       const translateBus = this.bus.translation(request);
@@ -2951,6 +3192,11 @@ var LionRapid = (() => {
             resolvedLocale,
             resolvedKey
           );
+        } else if (!this.warnedNoInterpolate && params && Object.keys(params).length > 0 && processedValue.includes("{")) {
+          this.warnedNoInterpolate = true;
+          console.warn(
+            "[LionRapid] Translation params were passed but no interpolate formatter is registered \u2014 {placeholders} render literally. Install @lionrapid/formatters and add .use(coreFormattersPlugin) to the builder."
+          );
         }
         if (this.processors.size > 0) {
           for (const [name, processor] of this.processors.entries()) {
@@ -2991,8 +3237,7 @@ var LionRapid = (() => {
         this.currentLocale,
         params,
         defaultValue,
-        this.defaultNamespace,
-        this.fallbackLocale
+        this.defaultNamespace
       );
       const syncResult = this.handlerChain.handleSync(request);
       const rawValue = syncResult && syncResult.status === 200 ? syncResult.value : request.parsedDefaultValue || request.cleanKey;
@@ -3113,8 +3358,7 @@ var LionRapid = (() => {
         this.currentLocale,
         void 0,
         void 0,
-        this.defaultNamespace,
-        this.fallbackLocale
+        this.defaultNamespace
       );
       return this.handlerChain.isCached(request);
     }
@@ -3535,6 +3779,9 @@ var LionRapid = (() => {
   };
 
   // src/builder.ts
+  function isLoudPreloadFailure(error) {
+    return !(error instanceof TranslationNotFoundError || error instanceof TranslationLockedError);
+  }
   var LionRapidBuilder = class _LionRapidBuilder {
     constructor(config) {
       __publicField(this, "config");
@@ -3545,7 +3792,6 @@ var LionRapid = (() => {
       __publicField(this, "syncQueue", null);
       this.config = {
         defaultLocale: config.defaultLocale || "en",
-        fallbackLocale: config.fallbackLocale || "en",
         namespace: config.namespace || "app"
       };
     }
@@ -3646,7 +3892,6 @@ var LionRapid = (() => {
         eventEmitter,
         handlerChain,
         this.config.defaultLocale,
-        this.config.fallbackLocale,
         this.config.namespace
       );
       for (const plugin of this.plugins) {
@@ -3677,7 +3922,17 @@ var LionRapid = (() => {
       logger.debug("Preload targets", {
         namespaces: eagerPreloads.map((c) => `${c.locale}:${c.namespace}`)
       });
+      let warnedLoudly = false;
+      const warnLoudlyOnce = (namespaceKey, error) => {
+        if (!isLoudPreloadFailure(error) || warnedLoudly) return;
+        warnedLoudly = true;
+        console.warn(
+          `[LionRapid] Could not load translations for ${namespaceKey} \u2014 the page stays untranslated until the server is reachable.`,
+          error
+        );
+      };
       const promises = eagerPreloads.map(async (preloadConfig) => {
+        const namespaceKey = `${preloadConfig.locale}:${preloadConfig.namespace}`;
         try {
           const result = await networkHandler.loadNamespace(
             preloadConfig.locale,
@@ -3686,19 +3941,19 @@ var LionRapid = (() => {
           if (result && result.data && result.status === 200) {
             const context = {
               locale: preloadConfig.locale,
-              namespace: preloadConfig.namespace,
-              fallbackLocale: this.config.fallbackLocale
+              namespace: preloadConfig.namespace
             };
             await handlerChain.saveNamespaceToHandlers(result.data, context);
-            logger.debug(
-              `Preloaded: ${preloadConfig.locale}:${preloadConfig.namespace}`
-            );
+            logger.debug(`Preloaded: ${namespaceKey}`);
+            return;
+          }
+          if (result?.error) {
+            warnLoudlyOnce(namespaceKey, result.error);
+            logger.warn(`Preload failed: ${namespaceKey}`, result.error);
           }
         } catch (error) {
-          logger.warn(
-            `Preload failed: ${preloadConfig.locale}:${preloadConfig.namespace}`,
-            error
-          );
+          warnLoudlyOnce(namespaceKey, error);
+          logger.warn(`Preload failed: ${namespaceKey}`, error);
         }
       });
       await Promise.allSettled(promises);
@@ -3712,8 +3967,16 @@ var LionRapid = (() => {
       __publicField(this, "name", "NetworkRepository");
       __publicField(this, "type", "network");
       __publicField(this, "config", {});
-      /** Cached version (opaque string from server) per namespace key "locale:namespace" */
-      __publicField(this, "namespaceVersions", /* @__PURE__ */ new Map());
+      /**
+       * Namespace snapshot per key "locale:namespace": the server version TOGETHER
+       * with the payload it describes, persisted as ONE localStorage entry.
+       *
+       * Canonical 304 contract (same as edge KV bundle + WP transient cache):
+       * never claim freshness you can't back. If-None-Match is only sent when the
+       * snapshot is in hand; a 304 answers with that snapshot's payload; version
+       * and payload can never desync because they live and die together.
+       */
+      __publicField(this, "namespaceSnapshots", /* @__PURE__ */ new Map());
       /**
        * Default endpoint templates with placeholder support
        * Placeholders: :key, :locale, :namespace
@@ -3826,36 +4089,50 @@ var LionRapid = (() => {
         logger.debug("API base URL is not set");
         throw new NetworkError("API base URL is not set");
       }
+      try {
+        return await this.fetchNamespaceRaw(locale, namespace);
+      } catch (error) {
+        this.handleCaughtError(error);
+      }
+    }
+    /**
+     * Shared namespace fetch with the canonical 304 contract:
+     * - If-None-Match is sent ONLY when a snapshot (version + payload) is in hand.
+     * - 304 answers with that snapshot's payload — never with "nothing".
+     * - A 304 with no snapshot (server/proxy surprise) refetches unconditionally.
+     * - A 200 stores version + payload atomically before either is trusted.
+     */
+    async fetchNamespaceRaw(locale, namespace, allowConditional = true) {
       const url = this.buildUrl("getNamespace", { locale, namespace });
       logger.debug(`API GET Namespace: ${url}`);
       const namespaceKey = `${locale}:${namespace}`;
-      try {
-        const extraHeaders = {};
-        const cachedVersion = this.getVersion(namespaceKey);
-        if (cachedVersion) {
-          extraHeaders["If-None-Match"] = `W/"${cachedVersion}"`;
-        }
-        const response = await this.makeRequest(url, "GET", void 0, extraHeaders);
-        if (response.status === 304) {
-          logger.debug(`Namespace ${namespaceKey}: 304 Not Modified`);
-          return null;
-        }
-        if (!response.ok) {
-          this.handleHttpError(response, namespaceKey);
-        }
-        const data = await response.json();
-        logger.debug("API response data:", data);
-        if (!data.translations) {
-          throw new TranslationNotFoundError(namespaceKey);
-        }
-        const version = data.meta?.version != null ? String(data.meta.version) : null;
-        if (version) {
-          this.setVersion(namespaceKey, version);
+      const snapshot = allowConditional ? this.getSnapshot(namespaceKey) : void 0;
+      const extraHeaders = {};
+      if (snapshot) {
+        extraHeaders["If-None-Match"] = `W/"${snapshot.version}"`;
+      }
+      const response = await this.makeRequest(url, "GET", void 0, extraHeaders);
+      if (response.status === 304) {
+        if (snapshot) {
+          logger.debug(`Namespace ${namespaceKey}: 304 Not Modified (snapshot served)`);
+          return snapshot.translations;
         }
-        return data.translations;
-      } catch (error) {
-        this.handleCaughtError(error);
+        logger.debug(`Namespace ${namespaceKey}: unexpected 304 with no snapshot \u2014 refetching`);
+        return this.fetchNamespaceRaw(locale, namespace, false);
+      }
+      if (!response.ok) {
+        this.handleHttpError(response, namespaceKey);
       }
+      const data = await response.json();
+      logger.debug("API response data:", data);
+      if (!data.translations) {
+        throw new TranslationNotFoundError(namespaceKey);
+      }
+      const version = data.meta?.version != null ? String(data.meta.version) : null;
+      if (version) {
+        this.setSnapshot(namespaceKey, { version, translations: data.translations });
+      }
+      return data.translations;
     }
     /**
      * Save translation to API (if supported)
@@ -3940,33 +4217,8 @@ var LionRapid = (() => {
         logger.debug("API base URL is not set");
         throw new NetworkError("API base URL is not set");
       }
-      const url = this.buildUrl("getNamespace", { locale, namespace });
-      logger.debug(`API GET Namespace ContentUnits: ${url}`);
-      const namespaceKey = `${locale}:${namespace}`;
       try {
-        const extraHeaders = {};
-        const cachedVersion = this.getVersion(namespaceKey);
-        if (cachedVersion) {
-          extraHeaders["If-None-Match"] = `W/"${cachedVersion}"`;
-        }
-        const response = await this.makeRequest(url, "GET", void 0, extraHeaders);
-        if (response.status === 304) {
-          logger.debug(`Namespace ContentUnits ${namespaceKey}: 304 Not Modified`);
-          return null;
-        }
-        if (!response.ok) {
-          this.handleHttpError(response, namespaceKey);
-        }
-        const data = await response.json();
-        logger.debug("API response data:", data);
-        if (!data.translations) {
-          throw new TranslationNotFoundError(namespaceKey);
-        }
-        const version = data.meta?.version != null ? String(data.meta.version) : null;
-        if (version) {
-          this.setVersion(namespaceKey, version);
-        }
-        return data.translations;
+        return await this.fetchNamespaceRaw(locale, namespace);
       } catch (error) {
         this.handleCaughtError(error);
       }
@@ -4076,25 +4328,37 @@ var LionRapid = (() => {
     getConfig() {
       return this.config;
     }
-    /** Read persisted version from localStorage, falling back to in-memory map */
-    getVersion(namespaceKey) {
-      const mem = this.namespaceVersions.get(namespaceKey);
+    /** Read a persisted snapshot (version + payload), falling back to memory.
+     *  Legacy bare-version entries and corrupt snapshots are deleted on sight —
+     *  a version without its payload must never drive a conditional request. */
+    getSnapshot(namespaceKey) {
+      const mem = this.namespaceSnapshots.get(namespaceKey);
       if (mem) return mem;
       try {
-        const stored = localStorage.getItem(_NetworkRepository.VERSION_PREFIX + namespaceKey);
-        if (stored) {
-          this.namespaceVersions.set(namespaceKey, stored);
-          return stored;
+        localStorage.removeItem(_NetworkRepository.LEGACY_VERSION_PREFIX + namespaceKey);
+        const raw = localStorage.getItem(_NetworkRepository.SNAPSHOT_PREFIX + namespaceKey);
+        if (raw) {
+          const parsed = JSON.parse(raw);
+          if (parsed && typeof parsed.version === "string" && parsed.version.length > 0 && parsed.translations && typeof parsed.translations === "object") {
+            this.namespaceSnapshots.set(namespaceKey, parsed);
+            return parsed;
+          }
+          localStorage.removeItem(_NetworkRepository.SNAPSHOT_PREFIX + namespaceKey);
         }
       } catch {
       }
       return void 0;
     }
-    /** Persist version to both in-memory map and localStorage */
-    setVersion(namespaceKey, version) {
-      this.namespaceVersions.set(namespaceKey, version);
+    /** Persist version + payload as ONE entry (memory + localStorage). On quota
+     *  failure the previous stored snapshot stays — still a consistent pair. */
+    setSnapshot(namespaceKey, snapshot) {
+      this.namespaceSnapshots.set(namespaceKey, snapshot);
       try {
-        localStorage.setItem(_NetworkRepository.VERSION_PREFIX + namespaceKey, version);
+        localStorage.setItem(
+          _NetworkRepository.SNAPSHOT_PREFIX + namespaceKey,
+          JSON.stringify(snapshot)
+        );
+        localStorage.removeItem(_NetworkRepository.LEGACY_VERSION_PREFIX + namespaceKey);
       } catch {
       }
     }
@@ -4183,8 +4447,11 @@ var LionRapid = (() => {
       }
     }
   };
-  /** localStorage key prefix for persisted versions */
-  __publicField(_NetworkRepository, "VERSION_PREFIX", "lionrapid:v:");
+  /** localStorage key prefix for persisted snapshots (version + payload) */
+  __publicField(_NetworkRepository, "SNAPSHOT_PREFIX", "lionrapid:ns:");
+  /** Legacy bare-version prefix — a version WITHOUT its payload is exactly the
+   *  desync the snapshot store exists to prevent; entries are deleted on sight. */
+  __publicField(_NetworkRepository, "LEGACY_VERSION_PREFIX", "lionrapid:v:");
   var NetworkRepository = _NetworkRepository;
 
   // src/content/validator/ContentValidator.ts
@@ -4340,6 +4607,159 @@ var LionRapid = (() => {
     }
   };
 
+  // src/content/splitter/BlockSplitter.ts
+  var BLOCK_TAGS = /* @__PURE__ */ new Set([
+    "title",
+    "p",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "li",
+    "td",
+    "th",
+    "label",
+    "button",
+    "figcaption",
+    "dt",
+    "dd",
+    "summary",
+    "caption"
+  ]);
+  var INLINE_BLOCK_TAGS = /* @__PURE__ */ new Set(["a"]);
+  var SKIP_TAGS = /* @__PURE__ */ new Set([
+    "script",
+    "style",
+    "code",
+    "pre",
+    "textarea",
+    "noscript",
+    "svg"
+  ]);
+  var TAG_REGEX = /<(\/?)([a-zA-Z][a-zA-Z0-9]*)((?:\s+[a-zA-Z][a-zA-Z0-9-]*(?:=(?:"[^"]*"|'[^']*'|[^\s>]*))?)*)\s*(\/?)>/g;
+  function hasNoTranslateAttr(attrsString) {
+    if (attrsString.includes("data-no-translate")) return true;
+    return /translate\s*=\s*["']no["']/.test(attrsString);
+  }
+  function containsBlockTag(innerHTML) {
+    TAG_REGEX.lastIndex = 0;
+    let match;
+    while ((match = TAG_REGEX.exec(innerHTML)) !== null) {
+      const [, closingSlash, tagName, , selfClosingSlash] = match;
+      if (!closingSlash && !selfClosingSlash && BLOCK_TAGS.has(tagName.toLowerCase())) {
+        return true;
+      }
+    }
+    return false;
+  }
+  function findCloseTag(html, pos, tagName) {
+    const lowerTag = tagName.toLowerCase();
+    let depth = 1;
+    TAG_REGEX.lastIndex = pos;
+    let match;
+    while ((match = TAG_REGEX.exec(html)) !== null) {
+      const [, closingSlash, matchedTag, , selfClosingSlash] = match;
+      if (matchedTag.toLowerCase() !== lowerTag) continue;
+      if (closingSlash) {
+        depth--;
+        if (depth === 0) return match.index;
+      } else if (!selfClosingSlash) {
+        depth++;
+      }
+    }
+    return -1;
+  }
+  function splitBlocks(html) {
+    const blocks = [];
+    let pos = 0;
+    let skipDepth = 0;
+    let iter = 0;
+    const maxIter = 1e5;
+    const noTranslateEnds = [];
+    while (pos < html.length && iter < maxIter) {
+      iter++;
+      const ltPos = html.indexOf("<", pos);
+      if (ltPos === -1) break;
+      if (html.startsWith("<!--", ltPos)) {
+        const commentEnd = html.indexOf("-->", ltPos + 4);
+        if (commentEnd === -1) break;
+        pos = commentEnd + 3;
+        continue;
+      }
+      TAG_REGEX.lastIndex = ltPos;
+      const match = TAG_REGEX.exec(html);
+      if (!match || match.index !== ltPos) {
+        pos = ltPos + 1;
+        continue;
+      }
+      const [fullMatch, closingSlash, tagName, attrsString, selfClosingSlash] = match;
+      const tag = tagName.toLowerCase();
+      const afterMatch = match.index + fullMatch.length;
+      if (SKIP_TAGS.has(tag)) {
+        if (closingSlash) {
+          if (skipDepth > 0) skipDepth--;
+        } else if (!selfClosingSlash) {
+          skipDepth++;
+        }
+        pos = afterMatch;
+        continue;
+      }
+      if (skipDepth > 0) {
+        pos = afterMatch;
+        continue;
+      }
+      while (noTranslateEnds.length && pos >= noTranslateEnds[noTranslateEnds.length - 1]) {
+        noTranslateEnds.pop();
+      }
+      if (!closingSlash && !selfClosingSlash && hasNoTranslateAttr(attrsString)) {
+        const regionEnd = findCloseTag(html, afterMatch, tagName);
+        if (regionEnd !== -1) {
+          noTranslateEnds.push(regionEnd);
+        }
+      }
+      if (noTranslateEnds.length > 0) {
+        pos = afterMatch;
+        continue;
+      }
+      if ((BLOCK_TAGS.has(tag) || INLINE_BLOCK_TAGS.has(tag)) && !closingSlash && !selfClosingSlash) {
+        const closeTagStart = findCloseTag(html, afterMatch, tagName);
+        if (closeTagStart === -1) {
+          pos = afterMatch;
+          continue;
+        }
+        const innerHTML = html.slice(afterMatch, closeTagStart);
+        if (containsBlockTag(innerHTML)) {
+          pos = afterMatch;
+          continue;
+        }
+        blocks.push({
+          tag,
+          openTag: fullMatch,
+          attrs: attrsString,
+          inner: innerHTML,
+          innerStart: afterMatch,
+          innerEnd: closeTagStart
+        });
+        TAG_REGEX.lastIndex = closeTagStart;
+        const closeMatch = TAG_REGEX.exec(html);
+        pos = closeMatch ? closeMatch.index + closeMatch[0].length : closeTagStart + 1;
+        continue;
+      }
+      pos = afterMatch;
+    }
+    return { blocks };
+  }
+  function replaceBlockInners(html, replacements) {
+    const ordered = [...replacements].sort((a, b) => b.block.innerStart - a.block.innerStart);
+    let result = html;
+    for (const { block, inner } of ordered) {
+      result = result.slice(0, block.innerStart) + inner + result.slice(block.innerEnd);
+    }
+    return result;
+  }
+
   // src/browser/md5.ts
   function safeAdd(x, y) {
     const lsw = (x & 65535) + (y & 65535);
@@ -4545,6 +4965,75 @@ var LionRapid = (() => {
     }
   };
 
+  // src/browser/sanitizer.ts
+  var REMOVE_TAGS = /* @__PURE__ */ new Set([
+    "script",
+    "iframe",
+    "frame",
+    "frameset",
+    "object",
+    "embed",
+    "applet",
+    "base",
+    "meta",
+    "link",
+    "template",
+    "portal"
+  ]);
+  var URL_ATTRS2 = /* @__PURE__ */ new Set([
+    "href",
+    "src",
+    "action",
+    "formaction",
+    "poster",
+    "data",
+    "xlink:href"
+  ]);
+  function sanitizeElement(root) {
+    const all = [root, ...Array.from(root.querySelectorAll("*"))];
+    for (const el of all) {
+      const tag = el.tagName.toLowerCase();
+      if (REMOVE_TAGS.has(tag)) {
+        el.remove();
+        continue;
+      }
+      for (const name of el.getAttributeNames()) {
+        const lower = name.toLowerCase();
+        if (lower.startsWith("on") || lower === "srcdoc") {
+          el.removeAttribute(name);
+          continue;
+        }
+        if (URL_ATTRS2.has(lower)) {
+          if (sanitizeUrl(el.getAttribute(name) ?? "") === null) {
+            el.removeAttribute(name);
+          }
+          continue;
+        }
+        if (lower === "style") {
+          const clean = sanitizeCssDeclarations(el.getAttribute(name) ?? "");
+          if (clean === null) el.removeAttribute(name);
+          else el.setAttribute(name, clean);
+        }
+      }
+    }
+  }
+  function sanitizeStyleSheetText(css, baseHref) {
+    let out = css.replace(/@import[^;]*(;|$)/gi, "");
+    out = out.replace(
+      /url\(\s*(['"]?)([^'")]*)\1\s*\)/gi,
+      (full, _quote, target) => {
+        try {
+          const resolved = new URL(target, baseHref);
+          if (resolved.protocol === "data:") return full;
+          if (resolved.origin === new URL(baseHref).origin) return full;
+        } catch {
+        }
+        return 'url("")';
+      }
+    );
+    return out.replace(/expression\s*\(/gi, "blocked(");
+  }
+
   // src/browser/storage/localstorage-repository.ts
   var STORAGE_PREFIX = "lionrapid:";
   var VERSION_KEY = `${STORAGE_PREFIX}version`;