laghu 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -0,0 +1,66 @@
+# Changelog
+
+All notable changes to laghu are recorded here. Versioning follows
+semver: patch for fixes, minor for backwards-compatible additions,
+major for breaking changes.
+
+## [Unreleased]
+
+## [1.1.0]
+
+Security baseline (breaking only for attack patterns):
+
+- Default HTML sanitizer: `data-html` and swaps strip scripts,
+  frames, event-handler attributes, and scriptable URLs out of the
+  box. Override with `Laghu.sanitize` (DOMPurify recommended for
+  untrusted content).
+- URL policy: `data-bind:href/src/action/...` refuses
+  `javascript:`, `data:text/html`, and `vbscript:` values.
+- Prototype pollution guards in path reads, writes, and action
+  strings (`__proto__`, `constructor`, `prototype` blocked).
+- `DEV` now defaults off (`__LAGHU_DEV__ === true` enables). Error
+  visibility moves to events that always fire: `laghu:error`,
+  `laghu:request-error`, `laghu:unknown-action`.
+
+Reliability:
+
+- One throwing binding no longer kills the page; failures report
+  `laghu:error` and the scan continues.
+- Effects unsubscribe on stop and prune stale deps on re-run;
+  nested effects compose through a stack.
+- Swapped content keeps the requesting element's actions;
+  `morph:outer` forwards its mode.
+- Fetch overlap uses a controller set (correct `queue:all`),
+  `data-timeout` aborts hung requests, GET arrays repeat params,
+  `+json` content types merge, failures record `state.$error`
+  with `data-pending` on the element.
+- `onUnmount` setup hooks now run on disconnect.
+- Row scopes own their variables; keyed lists use item-relative
+  `data-key` and rebind only on identity change; the observer
+  treats intra-batch moves as moves, not removals.
+
+Expressions (still no `new Function`, still CSP-safe):
+
+- Ternary (`a ? b : c`), arithmetic (`+ - * / %` with precedence),
+  parenthesized groups, calls with evaluated arguments,
+  bracket indexes (`list[0]`, `map["key"]`).
+- Plain kebab-case action names stay literal; hyphens mean
+  subtraction only inside larger expressions.
+
+New API:
+
+- `Laghu.computed(fn)`, `Laghu.watch(scope, expr, cb)`,
+  `Laghu.persist(name, opts)` (localStorage, versioned).
+- `LaghuRouter` opt-in plugin (`dist/router.min.js`): hash routes
+  with params, guards, notfound, programmatic navigate.
+- Late-added state keys wake readers (miss tracking); `$error`
+  seeded at hydrate.
+
+Docs: full JSDoc with examples on all public API, TSDoc
+declarations, 17-section README with linked contents.
+
+## [1.0.0]
+
+Initial release: zero-build IIFE core, Light-DOM components, Proxy
+reactivity, HTML-first templates, JSON/HTML fetch, morph plugin,
+9 examples, 2 demo apps, 5-way benchmark.

package/README.md

@@ -27,6 +27,7 @@ Contents:
 - [15. Checking your setup](#15-checking-your-setup)
 - [16. Troubleshooting](#16-troubleshooting)
 - [17. Project files](#17-project-files)
+- [18. Roadmap (explicit non-goals included)](#18-roadmap-explicit-non-goals-included)
 
 ## 1. When to use laghu
 
@@ -84,14 +85,29 @@ like `github.com/.../blob/...` serves HTML, and
 `raw.githubusercontent.com` serves plain text, which browsers refuse
 to run as a script.
 
-Use jsDelivr instead. It serves GitHub files with the correct
-JavaScript content type:
+Use jsDelivr instead. It serves files with the correct
+JavaScript content type. Two flavors, pick one per page:
+
+npm package (preferred, versioned by the registry):
+
+```html
+<script src="https://cdn.jsdelivr.net/npm/laghu@1.0.0/dist/laghu.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/laghu@1.0.0/dist/morph.min.js"></script>
+```
+
+GitHub release files (works without any registry):
 
 ```html
 <script src="https://cdn.jsdelivr.net/gh/prosubodh/laghu@v1.0.0/dist/laghu.min.js"></script>
 <script src="https://cdn.jsdelivr.net/gh/prosubodh/laghu@v1.0.0/dist/morph.min.js"></script>
 ```
 
+With a bundler or Node tooling:
+
+```sh
+npm install laghu
+```
+
 Rules for production pages:
 
 - Always pin a version (`@v1.0.0`). Never use `@master`, because
@@ -167,8 +183,9 @@ One-way text binding. Same behavior, two spellings. Sets
 ### data-html
 
 Renders a value as HTML. Explicit opt-in because HTML parsing is an
-XSS risk. Content passes through the sanitize hook (see
-`Laghu.sanitize`). Prefer `data-bind` unless you trust the source.
+XSS risk. Content passes through the baseline sanitizer, replaceable
+with `Laghu.sanitize` (DOMPurify for untrusted sources). Prefer
+`data-bind` unless you trust the source.
 
 ```html
 <div data-html="post.body"></div>
@@ -352,6 +369,43 @@ Fetch companions:
 - `data-headers`: extra headers as JSON.
 - `data-indicator="#spin"`: element shown while the request flies.
 - `data-disable`: disables the element while its request flies.
+- `data-timeout="5000"`: aborts hung requests (milliseconds);
+  timeouts report `laghu:request-error` with `timeout: true`.
+- `data-pending`: set on the element during flight (style hooks
+  like `[data-pending] { opacity: .5; }`).
+- `state.$error`:fetch failures record `{ status }` or `{ message,
+  timeout }` here (null when healthy). Bind it directly:
+  `<span data-bind="$error.status"></span>`.
+
+### Hash routing (router plugin)
+
+For pages with a handful of views, load `router.min.js` after the
+core and declare hash routes. Past about five guarded routes, use
+a real router; this one stays small on purpose.
+
+```html
+<script src="laghu.min.js"></script>
+<script src="router.min.js"></script>
+<div id="view"></div>
+<script>
+  LaghuRouter.route({
+    target: '#view',
+    scope: state,
+    routes: [
+      { path: '/', render: function () { return '<h1>Home</h1>'; } },
+      { path: '/user/:id', render: function (p) { return '<h1>User ' + p.id + '</h1>'; } }
+    ],
+    notfound: function () { return '<h1>Missing</h1>'; },
+    beforeEach: function (to) { return true; }
+  });
+  LaghuRouter.navigate('/user/42');
+</script>
+```
+
+Links are plain anchors (`href="#/user/42"`); hash changes drive
+renders, params decode automatically, guards cancel by returning
+false, and rendered fragments hydrate with the scope and actions
+you pass in.
 
 ### data-trigger
 
@@ -451,34 +505,51 @@ trigger. Nested objects wrap on first read.
 ### Laghu.effect(fn)
 
 Runs `fn` now and again whenever state it read changes. Returns a
-stop function. One effect per binding is the normal pattern.
+stop function that fully unsubscribes. Subscriptions refresh every
+run, so untaken branches release. Nested effects compose; a throwing
+run reports `laghu:error` and the page survives. One effect per
+binding is the normal pattern.
 
 ### Laghu.eval(scope, expr)
 
 Reads one expression without `new Function` (CSP-safe). Supports
-paths, literals, `!`, comparisons, `&&`, `||`, and no-argument
-calls like `reset()`.
+dotted paths, bracket indexes (`list[0]`, `map["k"]`), literals,
+`!` and unary `-`, arithmetic (`+ - * / %`), comparisons, `&&`,
+`||`, ternary (`a ? b : c`), parenthesized groups, and calls with
+evaluated arguments like `total(qty)`. Anything else is undefined.
+
+State keys must be valid identifiers (camelCase): a hyphen means
+subtraction inside expressions. Action names are exempt; exact
+action lookup runs before expression parsing, so
+`data-click="my-action"` stays literal.
 
 ### Laghu.get(scope, path) and Laghu.set(scope, path, val)
 
 Dotted path access with scope-chain lookup. `$store.name.key`
-reaches global stores.
+reaches global stores. Segments `__proto__`, `constructor`, and
+`prototype` are refused on read and write. Late-added keys wake
+readers: bindings on keys that do not exist yet update when the
+keys appear. Writes follow the chain to the owning scope.
 
 ### Laghu.parseTrigger(spec, el)
 
 Parses `data-trigger` text into a modifier object. Useful for
 testing and custom wiring.
 
-### Laghu.swap(target, html, mode, scope)
+### Laghu.swap(target, html, mode, scope, actions)
 
 Swaps HTML and hydrates the result. See modes in section 5.
 Dispatches `laghu:before-swap` and `laghu:after-swap`, preserves
-`data-preserve` nodes, restores focus and caret.
+`data-preserve` nodes, restores focus and caret. The optional
+`actions` map wires handlers in the new content; fetch swaps reuse
+the requesting element's actions automatically.
 
 ### Laghu.sanitize(fn)
 
-Replaces the HTML pass-through used by `data-html` and swaps.
-Install a real sanitizer when rendering server HTML:
+Replaces the HTML pass-through used by `data-html` and swaps. The
+default is a baseline cleaner (scripts, frames, event handlers,
+scriptable URLs stripped), not a policy. Install a real sanitizer
+when rendering untrusted HTML:
 
 ```js
 Laghu.sanitize(function (h) { return DOMPurify.sanitize(h); });
@@ -498,6 +569,32 @@ Laghu.store('cart').n++;
 <span data-bind="$store.cart.n"></span>
 ```
 
+### Laghu.computed(fn)
+
+Derived value kept fresh by an effect. Call the getter inside
+bindings or other effects to subscribe.
+
+```js
+var total = Laghu.computed(function () { return state.price * state.qty; });
+Laghu.effect(function () { el.textContent = total(); });
+```
+
+### Laghu.watch(scope, expr, cb)
+
+Calls back with `(next, prev)` whenever an expression's value
+changes. Reads without subscribing the caller's own effect.
+Returns the stop function.
+
+### Laghu.persist(name, opts)
+
+Persists a named store to localStorage (debounced) with versioned
+restore. Mismatched versions reseed instead of loading.
+
+```js
+Laghu.store('cart', { n: 0 });
+Laghu.persist('cart', { key: 'cart:v1', version: 1 });
+```
+
 ### Laghu.directive(name, fn)
 
 Registers `data-name`. The function receives `{ el, get, effect,
@@ -535,7 +632,9 @@ replacing. `opts.mode` is `inner` (default) or `outer`.
 
 ## 7. Events reference
 
-All names are CustomEvents. Listen with `addEventListener`:
+All names are CustomEvents, and all of them bubble, so one listener
+on a section or on document observes every child. Listen with
+`addEventListener`:
 
 - `laghu:before-request`: cancelable, `detail` has `url`, `method`.
   Call `preventDefault()` to stop the fetch (for confirm dialogs).
@@ -653,14 +752,30 @@ laghu runs under strict CSP with no `unsafe-eval` and no
 `unsafe-inline`:
 
 - No `new Function`, no `eval`, no string `setTimeout`. Expressions
-  use a small built-in reader (paths, literals, `!`, comparisons,
-  `&&`, `||`, no-argument calls).
+  use a small built-in reader (paths, indexes, literals, `!`,
+  arithmetic, comparisons, `&&`, `||`, ternary, calls with args).
 - No inline handlers. All listeners attach with
   `addEventListener` from `data-*` attributes.
-- Ship laghu as an external file with a Subresource Integrity hash.
+- Ship laghu as an external file with a Subresource Integrity hash
+  (`node scripts/sri.mjs` prints them for release notes).
 - `data-scope` takes JSON only, for the same no-eval reason.
-- `data-html` and swaps accept HTML by design. Point
-  `Laghu.sanitize` at DOMPurify when content comes from a server.
+
+No-eval is not the whole of web security. The rest of the posture:
+
+- `data-html` and swaps pass a baseline sanitizer (scripts, frames,
+  event-handler attributes, scriptable URLs stripped). It is a
+  floor: point `Laghu.sanitize` at DOMPurify for untrusted content,
+  and set `script-src-attr 'none'` in your policy for defense in
+  depth.
+- Attribute bindings refuse `javascript:`, `data:text/html`, and
+  `vbscript:` URLs on navigation and loading attributes.
+- State paths refuse `__proto__`, `constructor`, and `prototype`
+  segments on read and write, including inside action strings.
+- Runtime failures dispatch `laghu:error` (bindings, directives,
+  init, unmount) and `laghu:request-error` (fetch) in every
+  environment; consoles stay quiet unless you enable dev mode.
+- See `SECURITY.md` for reporting, supported versions, and the
+  audit-backed regression list.
 
 ## 12. Loading flash and SEO notes
 
@@ -684,13 +799,28 @@ never run.
 
 Measured after minification:
 
-- Core `dist/laghu.min.js`: about 21kB raw, 6.8kB gzip, 6.1kB brotli.
+- Core `dist/laghu.min.js`: about 27.5kB raw, 9.2kB gzip, 8.2kB brotli.
 - Morph `dist/morph.min.js`: about 2.3kB raw, 1kB gzip.
+- Router `dist/router.min.js`: about 1.7kB raw, 0.9kB gzip.
 - Budgets enforced by `node scripts/size.mjs`: core at or under
-  7.5kB gzip, morph at or under 3kB gzip.
+  10kB gzip, morph at or under 3kB gzip, router at or under
+  2.5kB gzip.
+
+The core grew from 7.1kB to 9.2kB for two consensus items: the
+security baseline (default sanitizer, URL policy, pollution
+guards, error isolation, effect unsubscribe) and the expression
+grammar (ternary, arithmetic, argued calls, indexing). Both are
+audited-in requirements, not creep: the budget moved openly, and
+the total stays under half of htmx alone (~16kB gzip).
 
 For scale: htmx alone is about 16kB gzip, Alpine with a few plugins
 is 12 to 15kB. laghu core plus morph stays under half of either.
+End-to-end proof lives in `bench/RESULTS.md`: the same TicTacToe in
+laghu, vanilla, React, Vue, and Angular, measured in headless
+Chromium. laghu ships 3 to 10 times less JavaScript than the
+frameworks, holds the lowest heap of the four, and ties them on
+interaction latency (all sub-millisecond); vanilla remains the
+floor, as zero abstraction must.
 
 ## 14. Worked examples
 
@@ -699,8 +829,23 @@ See the `examples/` folder. Each file opens directly from disk.
 - `counter.html`: one component, one binding, one action.
 - `todo.html`: island with `data-model` input, keyed `data-for`
   list, checkbox models, `data-show` counter.
+- `model.html`: every two-way input type (text, number, single
+  checkbox, checkbox group, radio, single select, multi select,
+  textarea) with live mirrors and reset.
+- `triggers.html`: throttle, once, interval, load, init, change
+  write-through, and prevented form submit.
+- `swaps.html`: every swap mode, the swap event log,
+  `data-preserve`, and a morph swap that keeps typing and focus.
+- `components.html`: two independent instances, attribute sync,
+  mount and unmount observation, removal and restore.
+- `store.html`: two islands sharing one `$store` counter and name.
+- `directives.html`: custom ticker and autofocus directives,
+  template removal running directive cleanup, class binding.
 - `fetch.html`: JSON button plus morph list swap (needs a server
-  for the URLs, or swap in the stub URLs for local JSON files).
+  for the URLs, or swap in local JSON files).
+
+`test/examples.mjs` boots every file above and drives it: 48
+assertions, all passing alongside the suites below.
 
 ## 15. Checking your setup
 
@@ -708,13 +853,18 @@ See the `examples/` folder. Each file opens directly from disk.
 npm install
 npx tsc --noEmit -p jsconfig.json
 node scripts/size.mjs
-node test/run.mjs
+node scripts/sri.mjs
+npm test
 ```
 
-37 tests cover: counter increments, text and attribute bindings,
-conditionals, keyed reorder reuse, two-way inputs, attribute sync,
-triggers, JSON merge, all swap modes, morph focus preservation,
-stores, directives with cleanup, and unknown-action warnings.
+154 tests cover (71 in `test/run.mjs` plus 48 in
+`test/examples.mjs`, 23 in `test/apps.mjs`, 12 in
+`test/router.mjs`): counter increments, text and attribute
+bindings, conditionals, keyed reorder reuse, two-way inputs,
+attribute sync, triggers, JSON merge, all swap modes, morph focus
+preservation, stores, directives with cleanup, unknown-action
+warnings, every shipped example page driven end to end, both demo
+apps played to completion, and the router contract.
 
 Releasing a new version (publishes to npm through CI):
 
@@ -758,14 +908,46 @@ Request never fires with `changed`: the input value never differed.
 morph warns and falls back: `morph.min.js` is not loaded. Add the
 script tag after the core.
 
+`data-click="my-action"` does nothing: check the actions map first;
+exact names win before expression parsing. `data-bind="a-b"` on the
+other hand always subtracts; rename the key to camelCase.
+
+New key renders blank: bindings subscribe to keys that appear later,
+but prefer declaring the full shape up front so first paint is
+complete.
+
 ## 17. Project files
 
 - `src/laghu.js`: core source with full JSDoc, loaded directly in
   development.
 - `src/morph.js`: opt-in morph plugin source with full JSDoc.
-- `dist/laghu.min.js`, `dist/morph.min.js`: minified builds.
+- `src/router.js`: opt-in hash router plugin with full JSDoc.
+- `dist/laghu.min.js`, `dist/morph.min.js`, `dist/router.min.js`:
+  minified builds.
 - `dist/laghu.d.ts`: TypeScript declarations for consumers.
-- `test/run.mjs`: jsdom suite, 37 assertions.
+- `test/run.mjs`: jsdom suite, 71 assertions including security
+  regressions.
+- `test/examples.mjs`: boots every example page and drives it, 48 assertions.
+- `test/apps.mjs`: plays both demo apps to completion, 23 assertions.
+- `test/router.mjs`: router contract, 12 assertions.
 - `scripts/size.mjs`: minifies and enforces gzip budgets.
-- `examples/`: three pages opening from disk.
+- `scripts/sri.mjs`: prints SRI hashes for release notes.
+- `examples/`: nine pages opening from disk.
+- `apps/`: full demo projects with the prescribed structure.
+- `bench/`: five-way benchmark harness and results.
+- `CHANGELOG.md`, `SECURITY.md`, `CONTRIBUTING.md`: release,
+  security, and contribution contracts.
 - `jsconfig.json`: strict `checkJs` config used by editors and CI.
+
+## 18. Roadmap (explicit non-goals included)
+
+Next, in order: declarative validation (`data-validate` with
+schemas), transitions (`data-transition`), async fallback templates
+for fetch, icon and Tailwind interop recipes (`data-icon`,
+class merging), then docs site, real-browser matrix, and devtools.
+
+Deliberately out of scope: JSX or any compiler toolchain, VDOM
+diffing in core, built-in auth/i18n/charts/offline-sync, a Node
+SSR server, full SPA parity. laghu owns small interactive pages
+and embeds; it graduates users to bigger tools with documented
+boundaries instead of cloning them badly.

package/SECURITY.md

@@ -0,0 +1,45 @@
+# Security policy
+
+## Supported versions
+
+Only the latest minor release receives security fixes. The
+published provenance attests every release build on GitHub Actions;
+prefer registry installs over copying files.
+
+| Version | Supported |
+| ------- | --------- |
+| 1.1.x   | yes       |
+| 1.0.x   | no        |
+
+## Reporting a vulnerability
+
+Open a private security advisory on GitHub, or email the
+maintainer through the profile listed on the repo. Include a
+minimal reproduction (HTML plus state or response payload). Expect
+an acknowledgement within 72 hours and a fix or mitigation plan
+within 14 days. Do not open public issues for unpatched holes.
+
+## Threat model and defaults
+
+- `data-html` and HTML swaps pass a baseline sanitizer (scripts,
+  frames, event handlers, scriptable URLs stripped). It is a
+  floor: render untrusted content only behind DOMPurify via
+  `Laghu.sanitize`, and serve a Content Security Policy that also
+  sets `script-src-attr 'none'`.
+- Attribute bindings refuse `javascript:`, `data:text/html`, and
+  `vbscript:` URLs on navigation and loading attributes.
+- State paths reject `__proto__`, `constructor`, and `prototype`
+  segments on read and write, including inside action strings.
+- Expressions never use `new Function` or `eval`, so
+  `script-src 'self'` holds without `unsafe-eval`. That covers
+  code injection through expressions, not XSS through HTML: those
+  are separate layers, configure both.
+- Fetch sends JSON with same-origin default credentials; set
+  `data-headers` and CORS server-side for cross-origin APIs.
+
+## Audits
+
+Dependency and secret scanning run in CI. XSS and pollution
+vectors from past audits live as regression tests in
+`test/run.mjs` (block 7). Re-run `npm test` before every release;
+the publish workflow refuses dirty trees and mismatched tags.

package/dist/laghu.d.ts

@@ -44,7 +44,7 @@ export interface DirectiveContext {
 
 /** Full public surface available as window.Laghu. */
 export interface LaghuAPI {
-  /** Release string, for example "1.0.0". */
+  /** Release string, for example "1.1.0". */
   version: string;
   /**
    * Register a Light-DOM custom element.
@@ -52,18 +52,19 @@ export interface LaghuAPI {
    * @param setup Factory returning fresh state, actions, and options.
    */
   define(tag: string, setup: () => SetupResult): any;
-  /** Make a plain object or array reactive. Primitives pass through. */
+  /** Make a plain object or array reactive. Primitives pass through. Re-wraps return the same proxy. */
   reactive<T extends object>(obj: T): T;
   /**
-   * Run fn now and again on dependency change.
+   * Run fn now and again on dependency change. Subscriptions refresh
+   * per run; stop() unsubscribes fully. Never throws out.
    * @returns Stop function that unsubscribes the effect.
    */
   effect(fn: () => void): () => void;
-  /** Evaluate a small CSP-safe expression against a scope. */
+  /** Evaluate a CSP-safe expression: paths, indexes, literals, arithmetic, comparisons, ternary, calls. */
   eval(scope: any, expr: string): any;
-  /** Read a dotted path (or $store.name.key) without throwing. */
+  /** Read a dotted path (or $store.name.key) without throwing. Prototype segments blocked. */
   get(scope: any, path: string): any;
-  /** Write a dotted path, creating intermediate objects. */
+  /** Write a dotted path, creating intermediate objects. Prototype segments refused. */
   set(scope: any, path: string, val: any): void;
   /** Parse data-trigger text into a TriggerSpec. */
   parseTrigger(spec: string, el: Element): TriggerSpec;
@@ -71,11 +72,12 @@ export interface LaghuAPI {
    * Swap HTML into target, hydrate the result, preserve focus.
    * @param swap One of inner, outer, text, append, prepend, beforebegin,
    * afterend, delete, none, morph:inner, morph:outer.
+   * @param actions Named actions for handlers in the new content.
    */
-  swap(target: Element, html: string, swap: string, scope: any): void;
+  swap(target: Element, html: string, swap: string, scope: any, actions?: Record<string, Function>): void;
   /** FOUC guard CSS string. Inject it or copy the rule. */
   css: string;
-  /** Replace the HTML pass-through used by data-html and swaps. */
+  /** Replace the HTML pass-through used by data-html and swaps. Defaults to a baseline sanitizer. */
   sanitize(fn: (html: string) => string): void;
   /**
    * Scan root, wire all bindings, return the reactive state.
@@ -86,6 +88,12 @@ export interface LaghuAPI {
   destroyTree(root: Element): void;
   /** Create (with init) or fetch (without) a named global reactive store. */
   store(name: string, init?: any): any;
+  /** Derived value kept fresh; call the getter inside bindings or effects to subscribe. */
+  computed(fn: () => any): () => any;
+  /** Call back with (next, prev) when an expression's value changes. Returns the stop function. */
+  watch(scope: any, expr: string, cb: (next: any, prev: any) => void): () => void;
+  /** Persist a named store to localStorage (debounced) with versioned restore. */
+  persist(name: string, opts?: { key?: string; version?: number; debounce?: number }): any;
   /**
    * Register a data-name directive. Return a cleanup function optionally.
    * @example
@@ -104,6 +112,22 @@ declare global {
       morphEl(a: Element, b: Element): void;
       version: string;
     };
+    LaghuRouter?: {
+      route(opts: {
+        target?: string;
+        scope?: any;
+        actions?: Record<string, Function>;
+        routes?: Array<{ path: string; render: (params: Record<string, string>, to: any) => string }>;
+        notfound?: (to: any) => string;
+        beforeEach?: (to: any, from: any) => boolean | void;
+        afterEach?: (to: any, from: any) => void;
+      }): () => void;
+      compile(pattern: string): (path: string) => Record<string, string> | null;
+      current(): { path: string; params: Record<string, string> };
+      navigate(path: string): void;
+      afterEach(fn: (to: any, from: any) => void): void;
+      version: string;
+    };
     __LAGHU_DEV__?: boolean;
   }
 }