WildflowerJS v1.4.0

The headline is cross-field validation rules. Per-input validation cannot say "the return date must be on or after departure" or "provide a pickup point or an address," because those are facts about the form as a whole. Declare them in a rules: block on the component and they run on the same validation pass as everything else: same submit gate, same invalid class, same data-error-for plumbing. The rule's name is its user-facing message, so rules read as plain language, and both check: and when: take the same two forms, a CSP-safe expression string or a function bound to the component.

Also in this release:

• Retry and optimistic writes for data queries — an opt-in retry: N re-runs a failed fetch on a doubling curve before the failure ever reaches error or syncError, and rows on screen are never wiped while the ladder runs. getQuery(name).patch(data) writes local data through the same choke point as a fetch, making optimistic adds, edits, and deletes one call.
• CSP-safe expressions compile to closures — the evaluator now compiles each parsed expression once into a tree of plain closures instead of re-walking the syntax tree on every evaluation. Per-call overhead against the standard path drops from 46x to under 3x. Strict-CSP pages get this automatically, and cross-field rules evaluate through the same path in every build.
• Pool API corrections — getItemFromEvent resolves pool entities, so a delegated handler on a pool container works the way it does for list rows, and add() / push() accept multiple objects instead of silently dropping every argument after the first.
• Two new dev-mode diagnostics — data-expect warns when incoming query rows drift from a declared shape, and a data-query with no component ancestor is no longer a silent no-op. Both are compiled out of production.
• Fixes — a form's data-action no longer double-fires as a click handler, a bug present since 1.3.0. Full details in the changelog.

Published through npm trusted publishing: built, tested, and published by CI from this repository, with Sigstore-signed SLSA provenance generated automatically. No publish token exists. Verify with npm audit signatures.