Releases for SDX

- Security: preflight validation requires create access; SafeHtml is a real sanitizer; dev-server PID/log files moved to private://; sdx:exec cannot leave node_modules/.bin
- Structured dialog and AJAX payloads render on Vue and Svelte sites; the Svelte app boots from the generated entry again
- sdx_svelte hooks are thin adapters over the shared core stores, matching Vue

- sdx_router: components arriving via soft navigation hydrate again - script tags are injected with their type, so ES-module chunks no longer crash ("Cannot use import statement outside a module") or get silently skipped
- sdx:build refuses to run against a stale sdx.lock with an actionable message, before any npm process runs
- The generated build package.json can no longer contain unpinned ("*") dependencies (fixes the ERESOLVE against @vitejs/plugin-react 6 on fresh installs)

- Installing/uninstalling SDX modules no longer touches the npm registry - resolution
moved entirely to drush sdx:resolve; module installs work fully offline
- New status report row warns while sdx.lock is out of date
- Cold dependency resolves fetch registry documents concurrently: seconds instead of
minutes, and the DB connection stays active throughout (closes the remaining
"MySQL server has gone away" window)

- Opt-in per-page asset scoping: owner-scoped CSS, conditional mount runtime, adaptive chunking
- SSR watch mode (incremental rebuilds + hot module reload) and renderer emit for out-of-process sidecars
- DRAST page payloads are now cacheable; per-session data moved to a placeholdered session envelope
- Component browser-URL map is per-mount instead of a full table (new sdx.expose_url opt-in)
- Build-artifact URLs are fingerprinted, ending stale-runtime hydration failures (React #418)
- Multi-framework fixes: Vue/Svelte builds work, SSR build no longer crashes, mounts no longer cross frameworks
- Drush cleanup: dependency commands renamed to sdx:deps:*, duplicate sdx:doctor/sdx:list resolved
- React CDN fallback is now opt-in, logged, and version-safe; vendor build failures fail loud
- pnpm 11 compatibility; sdx:resolve is lockfile-aware and heals broken workspaces
- sdx:test collects colocated specs, scoped to SDX providers, and exits non-zero on failures

Changed

• Dropped the treeshake: false Rollup override in the centralized Vite config. preserveEntrySignatures: 'strict' (the line right below) already protects entry exports, so tree-shaking is now on.

Fixed

SDX 1.0.0-alpha7 ships three runtime composition primitives for sites composing multiple SDX bundles into one page.

Cross-bundle state: sharedSingleton(key, factory) in @sdx/runtime collapses per-bundle module-level constants to a single document-scoped instance. Use it when bundles need referential identity for a shared registry, queue, or controller.

Fixed

SDX 1.0.0-alpha3 introduces framework-agnostic hook cores under @sdx/core/*, a native dialog system replacing jQuery UI, preprocessor-agnostic SSR builds, and shared-chunk CSS auto-attachment. One breaking change: HtmlFragment now emits the marker class flatten instead of sdx-flatten.