@ultimat3/ui 23.0.0 → 24.0.0

package/src/components/file-input-view.ts

@@ -106,22 +106,41 @@ export interface FileTarget {
   files: FileList | null;
 }
 
+/** Builds the `FileList` an input's `files` accepts — the one constructor the DOM offers for it. */
+export type FileListOf<TFile extends FileCandidate> = (files: readonly TFile[]) => FileList;
+
+function dataTransferList<TFile extends FileCandidate>(files: readonly TFile[]): FileList {
+  const transfer = new DataTransfer();
+  for (const one of files) transfer.items.add(one as unknown as File);
+  return transfer.files;
+}
+
 /**
- * Hand a drop's files to the real `<input>`, so a dropped file behaves exactly like a picked one.
+ * Make the real `<input>` hold exactly the files the control ACCEPTED, so the form posts what the
+ * control showed and nothing it refused.
  *
- * Without this a `<Dropzone name="avatar" required>` inside a `<form>` shows the accepted file and
- * then refuses to submit: `onSelect` fired, but `input.files` is still empty, so `required` blocks
- * on "Please select a file" and a submit that got past it would post no file at all. Native form
- * participation is what the `name`/`required` props promise. `files` is assignable from a
- * `DataTransfer`'s own `FileList` in every current engine — that is the supported way to do this.
+ * A drop never reaches the input on its own: without this a `<Dropzone name="avatar" required>`
+ * shows the accepted file and then refuses to submit. And handing it the whole drop posted the
+ * files `accept` / `maxBytes` / `maxFiles` turned away — `accept` is a hint to the picker, never a
+ * filter on `files`. So a `drop` with something accepted is adopted as the accepted list, and a
+ * drop with nothing accepted leaves an earlier pick alone, as a refused drop should. A `pick`
+ * already set `files` itself; it is narrowed only when it refused something — to an empty list if
+ * it refused everything, because the refused file is the one the form would otherwise post. A list
+ * is BUILT (`listOf`, a `DataTransfer` in a browser) only when something was refused.
  */
-export function adoptDroppedFiles(
+export function adoptAcceptedFiles<TFile extends FileCandidate>(
   input: FileTarget | undefined,
-  dropped: FileList | null | undefined,
+  offered: FileList | null | undefined,
+  selection: FileSelection<TFile>,
+  origin: 'drop' | 'pick',
+  listOf: FileListOf<TFile> = dataTransferList,
 ): void {
-  // An empty drop must not CLEAR a previous pick: the browser does not, and neither does this.
-  if (input === undefined || dropped === null || dropped === undefined || dropped.length === 0) {
-    return;
+  if (input === undefined) return;
+  if (origin === 'drop' && selection.accepted.length === 0) return;
+  if (selection.rejected.length > 0) {
+    input.files = listOf(selection.accepted);
+  } else if (origin === 'drop' && offered !== null && offered !== undefined) {
+    // Nothing refused: the drop's own list, which needs no constructor at all.
+    input.files = offered;
   }
-  input.files = dropped;
 }

package/src/components/link-target.ts

@@ -19,7 +19,27 @@ export interface LinkTarget {
 export function linkTarget(href: string, declaredExternal?: boolean | undefined): LinkTarget {
   const safe = safeUrl(href, 'href');
   if (safe === null) return { href: undefined, external: false };
-  return { href: safe, external: declaredExternal === true || /^https?:\/\//.test(safe) };
+  return { href: safe, external: declaredExternal === true || namesAnotherOrigin(safe) };
+}
+
+/** An origin no real link can name: whatever resolves AWAY from it carried its own authority. */
+const SENTINEL_ORIGIN = 'http://link-target.invalid';
+
+/**
+ * Decided the way a browser resolves the href, not by its spelling: `//cdn.test`, `HTTPS://…` and
+ * a leading space all leave the page's origin, and a regex over the raw string read each of them
+ * as internal — no `noopener`, no external hint. A value the parser refuses is treated as external,
+ * because the hardening is the safe side of a wrong guess.
+ */
+function namesAnotherOrigin(href: string): boolean {
+  try {
+    const url = new URL(href, `${SENTINEL_ORIGIN}/`);
+    return (
+      (url.protocol === 'http:' || url.protocol === 'https:') && url.origin !== SENTINEL_ORIGIN
+    );
+  } catch {
+    return true;
+  }
 }
 
 /**

package/src/components/meter-view.ts

@@ -11,3 +11,16 @@ export function meterShare(value: number, max: number): number {
 export function meterWidth(share: number): string {
   return (share * 100).toFixed(1);
 }
+
+/**
+ * The `aria-valuenow` / `aria-valuemax` pair, from the SAME rule as the fill: a meter that draws
+ * full must not speak "7 of 4". With no usable maximum the bar is empty, and so is the range it
+ * speaks — 0 of 1, because `aria-valuemax` must stay above `aria-valuemin`.
+ */
+export function meterAria(
+  value: number,
+  max: number,
+): { readonly now: number; readonly max: number } {
+  if (!Number.isFinite(max) || max <= 0) return { now: 0, max: 1 };
+  return { now: Number.isFinite(value) ? Math.min(max, Math.max(0, value)) : 0, max };
+}

package/src/components/qr-matrix.ts

@@ -75,28 +75,15 @@ function drawAlignmentPattern(matrix: Matrix, centerRow: number, centerCol: numb
 function drawFunctionPatterns(matrix: Matrix, version: number): void {
   const size = matrix.size;
 
-  // Three finder patterns, each an 8x8 area (7x7 pattern plus a light separator ring); only the
-  // 7x7 pattern is drawn as dark/light above, so the surrounding separator is drawn explicitly.
+  // Three finder patterns. `drawFinderPattern`'s outermost ring (`dist === 4`) IS the light
+  // separator, clipped to the matrix — drawing a second ring one further out would claim row and
+  // column 8, the format strip and two timing modules.
   const corners: readonly (readonly [number, number])[] = [
     [3, 3],
     [3, size - 4],
     [size - 4, 3],
   ];
   for (const [row, col] of corners) drawFinderPattern(matrix, row, col);
-  // Separators: the light ring one module beyond each finder pattern, clipped to the matrix.
-  for (const [row, col] of corners) {
-    for (let d = -4; d <= 4; d++) {
-      for (const [r, c] of [
-        [row + d, col - 5],
-        [row + d, col + 5],
-        [row - 5, col + d],
-        [row + 5, col + d],
-      ] as const) {
-        if (r >= 0 && c >= 0 && r < size && c < size && !matrix.isSet(r, c))
-          matrix.set(r, c, false);
-      }
-    }
-  }
 
   // Timing patterns: row 6 and column 6, alternating dark/light, skipping cells the finder
   // patterns already claimed.
@@ -107,11 +94,14 @@ function drawFunctionPatterns(matrix: Matrix, version: number): void {
   }
 
   // Alignment pattern(s): every (row, col) pair from this version's coordinate list, except the
-  // one that overlaps the top-left finder pattern.
+  // three that would land on a finder pattern — (first, first), (first, last) and (last, first).
   const positions = ALIGNMENT_POSITIONS[version - 1] ?? [];
+  const first = positions[0];
+  const last = positions[positions.length - 1];
   for (const row of positions) {
     for (const col of positions) {
-      if (row === 6 && col === 6) continue;
+      if (row === first && (col === first || col === last)) continue;
+      if (row === last && col === first) continue;
       drawAlignmentPattern(matrix, row, col);
     }
   }
@@ -158,10 +148,11 @@ function drawFormatInfo(matrix: Matrix, maskPattern: number): void {
   matrix.set(8, 7, bit(8));
   for (let i = 9; i <= 14; i++) matrix.set(8, 14 - i, bit(i));
 
-  // The mirrored copy: bits 0-7 along row `size-1` down to `size-8` in column 8, bits 8-14 up
-  // column `size-1` down to `size-15` in row 8.
-  for (let i = 0; i <= 7; i++) matrix.set(size - 1 - i, 8, bit(i));
-  for (let i = 8; i <= 14; i++) matrix.set(8, size - 15 + i, bit(i));
+  // The second copy: bits 0-7 along row 8 from column `size-1` leftwards to `size-8`, bits 8-14
+  // down column 8 from row `size-7` to `size-1` — one short of the fixed dark module at
+  // (`size-8`, 8), which belongs to no format copy.
+  for (let i = 0; i <= 7; i++) matrix.set(8, size - 1 - i, bit(i));
+  for (let i = 8; i <= 14; i++) matrix.set(size - 15 + i, 8, bit(i));
 }
 
 /** Whether mask `pattern` (0-7, ISO 18004 §8.8.1) flips the module at `(row, col)`. */
@@ -198,11 +189,13 @@ function drawData(matrix: Matrix, codewords: readonly number[], pattern: number)
   let bitIndex = 0;
   let upward = true;
   for (let colPair = size - 1; colPair > 0; colPair -= 2) {
+    // The vertical timing column carries no data, so the strip that would straddle it moves one
+    // module left — which is also what makes column 0 the last strip's left half.
+    if (colPair === 6) colPair = 5;
     for (let count = 0; count < size; count++) {
       const row = upward ? size - 1 - count : count;
       for (let colOffset = 0; colOffset < 2; colOffset++) {
         const col = colPair - colOffset;
-        if (col === 6) continue; // the vertical timing column carries no data
         if (matrix.isSet(row, col)) continue;
         const bit = bits[bitIndex] ?? false;
         bitIndex++;

package/src/components/qr-reader.ts

@@ -0,0 +1,187 @@
+// TEST-ONLY: an independent QR reader for versions 1-3, byte mode, level M — written from ISO
+// 18004's layout, sharing no code with `qr-encode.ts`/`qr-matrix.ts`, so a placement defect in
+// the encoder cannot be mirrored here. Never exported from `index.ts`.
+
+/** The eight published level-M format strings (ISO 18004 Table C.1), indexed by mask pattern —
+ *  a table, not a BCH computation, so the reader does not share the encoder's arithmetic. */
+const LEVEL_M_FORMAT: readonly number[] = [
+  0b101010000010010, 0b101000100100101, 0b101111001111100, 0b101101101001011, 0b100010111111001,
+  0b100000011001110, 0b100111110010111, 0b100101010100000,
+];
+
+/** Total and data codewords per version, level M (ISO 18004 Table 9). */
+const CODEWORDS: ReadonlyMap<number, { readonly total: number; readonly data: number }> = new Map([
+  [1, { total: 26, data: 16 }],
+  [2, { total: 44, data: 28 }],
+  [3, { total: 70, data: 44 }],
+]);
+
+export interface QrReading {
+  readonly version: number;
+  readonly mask: number;
+  readonly codewords: readonly number[];
+  readonly text: string;
+  /** Every place the symbol departs from the standard's fixed layout, as `what@row,col`. */
+  readonly layoutFaults: readonly string[];
+}
+
+type Grid = readonly (readonly boolean[])[];
+
+const at = (grid: Grid, row: number, col: number): boolean => grid[row]?.[col] === true;
+
+export function isFunctionModule(size: number, row: number, col: number): boolean {
+  const inCorner = (r0: number, c0: number): boolean =>
+    row >= r0 && row < r0 + 8 && col >= c0 && col < c0 + 8;
+  if (inCorner(0, 0) || inCorner(0, size - 8) || inCorner(size - 8, 0)) return true;
+  if (row === 6 || col === 6) return true;
+  if (row === 8 && (col <= 8 || col >= size - 8)) return true;
+  if (col === 8 && (row <= 8 || row >= size - 8)) return true;
+  // Versions 2-3 have exactly one alignment pattern, centred 7 modules in from the far corner.
+  if (size > 21 && Math.abs(row - (size - 7)) <= 2 && Math.abs(col - (size - 7)) <= 2) return true;
+  return false;
+}
+
+function finderFaults(grid: Grid, size: number): string[] {
+  const faults: string[] = [];
+  for (const [r0, c0] of [
+    [0, 0],
+    [0, size - 7],
+    [size - 7, 0],
+  ] as const) {
+    for (let dr = -1; dr <= 7; dr++) {
+      for (let dc = -1; dc <= 7; dc++) {
+        const row = r0 + dr;
+        const col = c0 + dc;
+        if (row < 0 || col < 0 || row >= size || col >= size) continue;
+        const ring = Math.max(Math.abs(dr - 3), Math.abs(dc - 3));
+        const dark = ring <= 1 || ring === 3;
+        if (at(grid, row, col) !== dark) faults.push(`finder@${row},${col}`);
+      }
+    }
+  }
+  return faults;
+}
+
+function fixedFaults(grid: Grid, size: number): string[] {
+  const faults = finderFaults(grid, size);
+  for (let i = 8; i < size - 8; i++) {
+    if (at(grid, 6, i) !== (i % 2 === 0)) faults.push(`timing@6,${i}`);
+    if (at(grid, i, 6) !== (i % 2 === 0)) faults.push(`timing@${i},6`);
+  }
+  if (size > 21) {
+    const centre = size - 7;
+    for (let dr = -2; dr <= 2; dr++) {
+      for (let dc = -2; dc <= 2; dc++) {
+        const dark = Math.max(Math.abs(dr), Math.abs(dc)) !== 1;
+        if (at(grid, centre + dr, centre + dc) !== dark) {
+          faults.push(`alignment@${centre + dr},${centre + dc}`);
+        }
+      }
+    }
+  }
+  if (!at(grid, size - 8, 8)) faults.push(`dark-module@${size - 8},8`);
+  return faults;
+}
+
+type Cell = readonly [number, number];
+
+/** The cells of both format copies, bit 14 first; positions straight from ISO 18004 Figure 25. */
+export function formatCells(size: number): readonly [readonly Cell[], readonly Cell[]] {
+  const first: Cell[] = [];
+  for (let col = 0; col <= 8; col++) if (col !== 6) first.push([8, col]);
+  for (let row = 7; row >= 0; row--) if (row !== 6) first.push([row, 8]);
+  const second: Cell[] = [];
+  for (let row = size - 1; row >= size - 7; row--) second.push([row, 8]);
+  for (let col = size - 8; col < size; col++) second.push([8, col]);
+  return [first, second];
+}
+
+function formatCopies(grid: Grid, size: number): readonly [number, number] {
+  const read = (cells: readonly Cell[]): number =>
+    cells.reduce((acc, [row, col]) => (acc << 1) | (at(grid, row, col) ? 1 : 0), 0);
+  const [first, second] = formatCells(size);
+  return [read(first), read(second)];
+}
+
+function maskFlips(mask: number, row: number, col: number): boolean {
+  const formulas: readonly ((i: number, j: number) => boolean)[] = [
+    (i, j) => (i + j) % 2 === 0,
+    (i) => i % 2 === 0,
+    (_i, j) => j % 3 === 0,
+    (i, j) => (i + j) % 3 === 0,
+    (i, j) => (Math.floor(i / 2) + Math.floor(j / 3)) % 2 === 0,
+    (i, j) => ((i * j) % 2) + ((i * j) % 3) === 0,
+    (i, j) => (((i * j) % 2) + ((i * j) % 3)) % 2 === 0,
+    (i, j) => (((i * j) % 3) + ((i + j) % 2)) % 2 === 0,
+  ];
+  return formulas[mask]?.(row, col) === true;
+}
+
+function readCodewords(grid: Grid, size: number, mask: number, count: number): number[] {
+  const bits: number[] = [];
+  // Two-column strips from the right edge; the strip that would straddle the vertical timing
+  // column moves one left, so column 6 is never read and column 0 always is.
+  const strips: number[] = [];
+  for (let right = size - 1; right >= 1; right -= 2) strips.push(right > 6 ? right : right - 1);
+  strips.forEach((right, index) => {
+    const upward = index % 2 === 0;
+    for (let step = 0; step < size; step++) {
+      const row = upward ? size - 1 - step : step;
+      for (const col of [right, right - 1]) {
+        if (isFunctionModule(size, row, col)) continue;
+        bits.push(at(grid, row, col) !== maskFlips(mask, row, col) ? 1 : 0);
+      }
+    }
+  });
+  const words: number[] = [];
+  for (let i = 0; i < count; i++) {
+    words.push(bits.slice(i * 8, i * 8 + 8).reduce((acc, bit) => (acc << 1) | bit, 0));
+  }
+  return words;
+}
+
+/** Reed-Solomon syndromes over GF(256)/0x11d: all zero exactly when no codeword is corrupt. */
+export function syndromesZero(codewords: readonly number[], eccCount: number): boolean {
+  const exp: number[] = [];
+  let x = 1;
+  for (let i = 0; i < 255; i++) {
+    exp.push(x);
+    x = x & 0x80 ? ((x << 1) ^ 0x11d) & 0xff : x << 1;
+  }
+  const log = new Map<number, number>(exp.map((v, i) => [v, i]));
+  const mul = (a: number, b: number): number =>
+    a === 0 || b === 0 ? 0 : (exp[((log.get(a) ?? 0) + (log.get(b) ?? 0)) % 255] ?? 0);
+  for (let k = 0; k < eccCount; k++) {
+    let s = 0;
+    for (const word of codewords) s = mul(s, exp[k] ?? 1) ^ word;
+    if (s !== 0) return false;
+  }
+  return true;
+}
+
+/** Reads `grid` as a QR symbol. Never throws: a symbol that does not read is `text: ''` plus
+ *  whatever faults explain why. */
+export function readQr(grid: Grid): QrReading {
+  const size = grid.length;
+  const version = (size - 17) / 4;
+  const faults = fixedFaults(grid, size);
+  const [first, second] = formatCopies(grid, size);
+  if (first !== second) faults.push('format-copies-differ');
+  const mask = LEVEL_M_FORMAT.indexOf(first);
+  if (mask < 0) faults.push('format-not-level-m');
+  const total = CODEWORDS.get(version)?.total ?? 0;
+  const codewords = mask < 0 ? [] : readCodewords(grid, size, mask, total);
+  const dataCount = CODEWORDS.get(version)?.data ?? 0;
+  if (codewords.length === 0 || !syndromesZero(codewords, total - dataCount)) {
+    return { version, mask, codewords, text: '', layoutFaults: [...faults, 'reed-solomon'] };
+  }
+  const bits = codewords
+    .slice(0, dataCount)
+    .flatMap((word) => Array.from({ length: 8 }, (_, i) => (word >>> (7 - i)) & 1));
+  const field = (start: number, length: number): number =>
+    bits.slice(start, start + length).reduce((acc, bit) => (acc << 1) | bit, 0);
+  if (field(0, 4) !== 0b0100) return { version, mask, codewords, text: '', layoutFaults: faults };
+  const length = field(4, 8);
+  const bytes = Uint8Array.from({ length }, (_, i) => field(12 + i * 8, 8));
+  return { version, mask, codewords, text: new TextDecoder().decode(bytes), layoutFaults: faults };
+}

package/src/components/relative-time-view.ts

@@ -27,16 +27,23 @@ const THRESHOLDS: readonly Threshold[] = [
   { unit: 'second', ms: 1000 },
 ];
 
+const unitMs = (index: number): number => (THRESHOLDS[index] as Threshold).ms;
+const roundIn = (delta: number, index: number): number => Math.round(delta / unitMs(index));
+
 export function relativeTimeText(options: RelativeTimeOptions): string {
   const target = toDate(options.value).getTime();
   const base = options.now === undefined ? Date.now() : toDate(options.now).getTime();
   const delta = target - base;
   const magnitude = Math.abs(delta);
 
-  const threshold =
-    THRESHOLDS.find((candidate) => magnitude >= candidate.ms) ??
-    (THRESHOLDS[THRESHOLDS.length - 1] as Threshold);
-  const value = Math.round(delta / threshold.ms);
+  let index = THRESHOLDS.findIndex((candidate) => magnitude >= candidate.ms);
+  if (index < 0) index = THRESHOLDS.length - 1;
+  // Promote AFTER rounding: 59.6 minutes rounds to 60, and "60 minutes ago" is "1 hour ago".
+  while (index > 0 && Math.abs(roundIn(delta, index)) * unitMs(index) >= unitMs(index - 1)) {
+    index -= 1;
+  }
+  const threshold = THRESHOLDS[index] as Threshold;
+  const value = roundIn(delta, index);
 
   const formatter = new Intl.RelativeTimeFormat(options.locale, {
     numeric: options.numeric ?? 'auto',

package/src/form/form-binding.ts

@@ -148,15 +148,16 @@ export function createFormBinding<TValues, TResult>(
     // has already changed, on the one screen where the user is watching for exactly that.
     publish({ status: 'submitting', ...NO_FORM_ERRORS, result: undefined, issues: [] });
 
-    const schema = options.schema;
-    if (schema !== undefined) {
-      // The result's `value` is read by nothing. Deliberately: the parse below is the browser's
-      // opinion, and the only thing this file wants from it is which paths to complain about.
-      const local = issuesFromValidation(await schema['~standard'].validate(values));
-      if (local.length > 0) return failed(local);
-    }
-
     try {
+      // Inside the `try`: a validate that throws or rejects is a failed submit, never a `submit()`
+      // that rejects with the state left at `submitting` and the control refusing every retry.
+      const schema = options.schema;
+      if (schema !== undefined) {
+        // The result's `value` is read by nothing. Deliberately: the parse below is the browser's
+        // opinion, and the only thing this file wants from it is which paths to complain about.
+        const local = issuesFromValidation(await schema['~standard'].validate(values));
+        if (local.length > 0) return failed(local);
+      }
       const result = await options.submit(values);
       // The server accepted what the form held, so there is nothing left to lose. `touched` stays:
       // the user has still visited those fields, and a hint that vanishes on save is a flicker.

package/src/icons/build-icons.ts

@@ -11,7 +11,17 @@ import { invalidIconDataError, runtimeMissingError } from '../errors';
 /** Pinned: a floating version would silently redraw icons under an app that never asked. */
 export const LUCIDE_VERSION = '1.31.0';
 
-export const LUCIDE_ICON_NODES_URL = `https://cdn.jsdelivr.net/npm/lucide-static@${LUCIDE_VERSION}/icon-nodes.json`;
+/** Where one pinned version's node table lives. */
+export const iconNodesUrl = (version: string): string =>
+  `https://cdn.jsdelivr.net/npm/lucide-static@${version}/icon-nodes.json`;
+
+export const LUCIDE_ICON_NODES_URL = iconNodesUrl(LUCIDE_VERSION);
+
+/** The registry's answer for the newest published `lucide-static` — what `--bump` pins to. */
+export const LUCIDE_LATEST_URL = 'https://registry.npmjs.org/lucide-static/latest';
+
+/** The tail of every cause about data the PIN published: why re-running alone cannot help. */
+const PIN_REPEATS = `lucide-static@${LUCIDE_VERSION} is the pin that published it, so a re-run against the same pin repeats this; \`--bump\` raises LUCIDE_VERSION in packages/ui/src/icons/build-icons.ts to the latest release and regenerates`;
 
 export const GLYPHS_DIR = new URL('./glyphs/', import.meta.url).pathname;
 
@@ -27,7 +37,7 @@ export function identifierFor(name: string): string {
  * the network, so its shape is an assumption until it is checked.
  */
 export function parseIconNodes(text: string): ReadonlyMap<string, IconGlyph> {
-  const parsed: unknown = JSON.parse(text);
+  const parsed = parseJson(text);
   // `typeof [] === 'object'`, and an array of icons is a different upstream format, not this one.
   if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
     throw invalidIconDataError(
@@ -42,8 +52,8 @@ export function parseIconNodes(text: string): ReadonlyMap<string, IconGlyph> {
     // writes, so `../../index` is a delete plus an overwrite of a hand-written module.
     if (!SAFE_ICON_NAME.test(name)) {
       throw invalidIconDataError(
-        `carries ${renderCauseValue(name)} as an icon name, which is not the kebab-case shape every Lucide icon uses; the name becomes a file path and an exported identifier, so it cannot be escaped. lucide-static@${LUCIDE_VERSION} is the pin that published it, so a re-run against the same pin repeats this`,
-        'bun run --filter @ultimat3/ui icons   # after raising LUCIDE_VERSION in packages/ui/src/icons/build-icons.ts',
+        `carries ${renderCauseValue(name)} as an icon name, which is not the kebab-case shape every Lucide icon uses; the name becomes a file path and an exported identifier, so it cannot be escaped. ${PIN_REPEATS}`,
+        'bun run --filter @ultimat3/ui icons --bump',
       );
     }
     out.set(name, toGlyph(name, value));
@@ -51,6 +61,29 @@ export function parseIconNodes(text: string): ReadonlyMap<string, IconGlyph> {
   return out;
 }
 
+/** The body as JSON, or the same coded refusal a wrong shape gets — never a bare `SyntaxError`. */
+function parseJson(text: string): unknown {
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw invalidIconDataError(
+      `is not JSON (${renderCauseValue(text.slice(0, 80))}…); ${LUCIDE_ICON_NODES_URL} served an error page or a truncated body`,
+      'bun run --filter @ultimat3/ui icons',
+    );
+  }
+}
+
+/** A node that is not `[tag, attrs?]` with an object for attrs — refused, never skipped. */
+function malformedNode(name: string, node: unknown): ReturnType<typeof invalidIconDataError> {
+  return invalidIconDataError(
+    `for the icon "${name}" carries ${renderCauseValue(node)} where a [tag, attributes] node belongs; skipping it would write a partial glyph. ${PIN_REPEATS}`,
+    'bun run --filter @ultimat3/ui icons --bump',
+  );
+}
+
+const isAttrs = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value);
+
 /**
  * An icon name, as characters: lowercase kebab-case, no leading, trailing or doubled hyphen. The
  * same allowlist-over-a-sink shape as `SAFE_ATTR_VALUE`, one layer up — the name is interpolated
@@ -68,10 +101,13 @@ export const SAFE_ATTR_VALUE = /^[\w\s.,+-]*$/;
 
 function toGlyph(name: string, value: unknown): IconGlyph {
   const glyph: (readonly [string, Readonly<Record<string, string>>])[] = [];
-  for (const node of Array.isArray(value) ? (value as unknown[]) : []) {
-    if (!Array.isArray(node) || typeof node[0] !== 'string') continue;
+  if (!Array.isArray(value)) throw malformedNode(name, value);
+  for (const node of value as unknown[]) {
+    if (!Array.isArray(node) || typeof node[0] !== 'string') throw malformedNode(name, node);
+    const rawAttrs: unknown = node[1] ?? {};
+    if (!isAttrs(rawAttrs)) throw malformedNode(name, node);
     const attrs: Record<string, string> = {};
-    for (const [key, item] of Object.entries((node[1] ?? {}) as Record<string, unknown>)) {
+    for (const [key, item] of Object.entries(rawAttrs)) {
       // Upstream keys an element for its diff tooling; it is not an SVG attribute.
       if (key === 'key') continue;
       const text = String(item);
@@ -82,8 +118,8 @@ function toGlyph(name: string, value: unknown): IconGlyph {
       // no legitimate Lucide artwork.
       if (!SAFE_ATTR_VALUE.test(text)) {
         throw invalidIconDataError(
-          `for the icon "${name}" carries ${renderCauseValue(text)} as "${key}", which is not glyph geometry; lucide-static@${LUCIDE_VERSION} is the pin that published it, so a re-run against the same pin repeats this`,
-          'bun run --filter @ultimat3/ui icons   # after raising LUCIDE_VERSION in packages/ui/src/icons/build-icons.ts',
+          `for the icon "${name}" carries ${renderCauseValue(text)} as "${key}", which is not glyph geometry; ${PIN_REPEATS}`,
+          'bun run --filter @ultimat3/ui icons --bump',
         );
       }
       attrs[key] = text;
@@ -95,8 +131,8 @@ function toGlyph(name: string, value: unknown): IconGlyph {
   iconElements(glyph);
   if (glyph.length === 0) {
     throw invalidIconDataError(
-      `for the icon "${name}" carries no renderable node data; lucide-static@${LUCIDE_VERSION} is the pin that published it, so a re-run against the same pin repeats this`,
-      'bun run --filter @ultimat3/ui icons   # after raising LUCIDE_VERSION in packages/ui/src/icons/build-icons.ts',
+      `for the icon "${name}" carries no renderable node data; ${PIN_REPEATS}`,
+      'bun run --filter @ultimat3/ui icons --bump',
     );
   }
   return glyph;
@@ -136,23 +172,24 @@ export function moduleSource(name: string, glyph: IconGlyph): string {
 async function format(): Promise<void> {
   const biome = new URL('../../../../node_modules/.bin/biome', import.meta.url).pathname;
   if (!(await Bun.file(biome).exists())) {
-    throw runtimeMissingError('the biome binary', 'bun install, then re-run this generator');
+    throw runtimeMissingError('the biome binary', 'bun install');
   }
-  const result = Bun.spawnSync([biome, 'format', '--write', GLYPHS_DIR]);
+  // A formatter over one directory of generated files; a wedged one is the refusal below.
+  const result = Bun.spawnSync([biome, 'format', '--write', GLYPHS_DIR], { timeout: 60_000 });
   if (result.exitCode !== 0) {
     throw runtimeMissingError(
       'a successful `biome format` over the generated glyphs',
-      `run: ${biome} format --write ${GLYPHS_DIR}`,
+      'bunx biome format --write packages/ui/src/icons/glyphs',
     );
   }
 }
 
-export async function buildIcons(): Promise<number> {
-  const response = await fetch(LUCIDE_ICON_NODES_URL);
+export async function buildIcons(version: string = LUCIDE_VERSION): Promise<number> {
+  const response = await fetch(iconNodesUrl(version));
   if (!response.ok) {
     throw runtimeMissingError(
-      `lucide-static@${LUCIDE_VERSION} icon data (HTTP ${response.status})`,
-      `check network access to ${LUCIDE_ICON_NODES_URL}, then re-run: bun run --filter @ultimat3/ui icons`,
+      `lucide-static@${version} icon data (HTTP ${response.status} from ${iconNodesUrl(version)})`,
+      'bun run --filter @ultimat3/ui icons',
     );
   }
   const glyphs = parseIconNodes(await response.text());
@@ -165,8 +202,47 @@ export async function buildIcons(): Promise<number> {
   return glyphs.size;
 }
 
+/** A plain `major.minor.patch` — the only shape allowed into a TypeScript string literal here. */
+const SEMVER = /^\d+\.\d+\.\d+$/;
+
+/** `source` with its `LUCIDE_VERSION` line moved to `version`. Pure; refuses rather than guesses. */
+export function withPin(source: string, version: string): string {
+  if (!SEMVER.test(version)) {
+    throw invalidIconDataError(
+      `answered ${renderCauseValue(version)} as the latest lucide-static version, which is not plain semver; ${LUCIDE_LATEST_URL} served something else`,
+      'bun run --filter @ultimat3/ui icons --bump',
+    );
+  }
+  const pin = /^export const LUCIDE_VERSION = '[^']*';$/m;
+  if (!pin.test(source)) {
+    throw invalidIconDataError(
+      'has no `export const LUCIDE_VERSION = …` line in packages/ui/src/icons/build-icons.ts to move',
+      'git checkout -- packages/ui/src/icons/build-icons.ts',
+    );
+  }
+  return source.replace(pin, `export const LUCIDE_VERSION = '${version}';`);
+}
+
+/** Moves the pin to the registry's latest release, in this very file, and answers the version. */
+async function bumpPin(): Promise<string> {
+  const response = await fetch(LUCIDE_LATEST_URL);
+  if (!response.ok) {
+    throw runtimeMissingError(
+      `the latest lucide-static version (HTTP ${response.status} from ${LUCIDE_LATEST_URL})`,
+      'bun run --filter @ultimat3/ui icons --bump',
+    );
+  }
+  const body: unknown = await response.json();
+  const version =
+    typeof body === 'object' && body !== null && 'version' in body ? String(body.version) : '';
+  const file = new URL(import.meta.url).pathname;
+  await Bun.write(file, withPin(await Bun.file(file).text(), version));
+  return version;
+}
+
 if (import.meta.main) {
-  const count = await buildIcons();
-  const json = { ok: true, icons: count, lucide: LUCIDE_VERSION, dir: GLYPHS_DIR };
+  const version = Bun.argv.includes('--bump') ? await bumpPin() : LUCIDE_VERSION;
+  const count = await buildIcons(version);
+  const json = { ok: true, icons: count, lucide: version, dir: GLYPHS_DIR };
   console.log(Bun.argv.includes('--json') ? JSON.stringify(json) : `${count} icon modules written`);
 }

package/src/index.ts

@@ -312,12 +312,6 @@ export {
   useUi,
 } from './theme/context';
 export { INERT_SOLID_RUNTIME } from './theme/inert-runtime';
-export {
-  THEME_INLINE_SCRIPT,
-  themeInlineScriptCspSource,
-  themeInlineScriptHash,
-  themeInlineScriptTag,
-} from './theme/inline-script';
 export type { UiProviderProps } from './theme/provider';
 export { UiProvider } from './theme/provider';
 // The slot is its own module so that registering a runtime does not drag `errors.ts` — and with it
@@ -330,6 +324,7 @@ export type { ThemeEnv } from './theme/theme';
 export {
   browserThemeEnv,
   clearTheme,
+  defaultTheme,
   initTheme,
   isTheme,
   osTheme,
@@ -337,6 +332,7 @@ export {
   setTheme,
   storedTheme,
   THEME_ATTRIBUTE,
+  THEME_DEFAULT_ATTRIBUTE,
   THEME_MEDIA_QUERY,
   THEME_STORAGE_KEY,
   toggleTheme,