GolemUI v1.5.1: strict CSP and file upload fixes

GolemUI v1.5.1 is out. It is a patch release on top of v1.5.0 with no new widgets and no API changes.

A page with a strict policy such as style-src 'self' blocks every inline style attribute. Several widgets computed styles at render time and wrote them as style attributes, either as plain strings or through Lit’s styleMap, which also sets the attribute on its first render. Under that policy the virtualized lists in the dropdowns lost their heights and offsets, the flex and grid layouts lost their gaps, and the auto-growing textarea and markdown editor stopped growing.

Those widgets now go through a small directive that writes every style through the CSSOM, which a strict policy allows. The checkbox tick is drawn with a clip-path instead of an inline SVG data: URI, so your policy does not need img-src data: either. And the lint for the published packages now rejects any import of Lit’s styleMap.

This release covers client-side rendering. The directive also runs while hydrating, so styles the browser blocked in server-rendered markup are applied again once the form resumes.

Two fixes for the widgets that shipped in 1.5.0:

• Multi File Upload kept the error of a failed removal on screen after the user picked a new file. Picking a file now gives the progress bar to the new upload, and the file whose removal failed goes back to being a plain pill.
• Both widgets still show a value restored with status: "uploading" as failed with interruptedMessage, but they no longer rewrite the stored value when they mount. No change fires until the user removes the file.

We also wrote down who cleans up files on your server. uploadService.remove runs only when the user removes a file, or when the single-file widget replaces its file with a new pick. A deleted repeater row, a field hidden by a state, setData or an abandoned form all leave the file where it is, because the widget cannot know which of those makes it unwanted. Treat every upload as provisional and reconcile your storage against the submitted value. The File Upload page has the details, and the MCP server and the agent skill now say the same.

• @golemui/gui-components now exports themes/clay.css, so the @import '@golemui/gui-components/themes/clay.css' line from the theming guide resolves.
• @golemui/core no longer lists subscript as a peer dependency. The bundle has always included it, so you never had to install it. ts.data.json, whose types appear in the public declarations, is now a regular dependency instead of being bundled.
• @golemui/gui-mcp declares @golemui/dx, which it needs to type-check DX forms.
• The starter templates import the @golemui/gui-components stylesheet but did not declare the package, so they failed to install with package managers stricter than npm. They declare it now. They also handle a failed widget preload at startup, type their form configs and wire the submit button. The install commands in these docs list @golemui/gui-components too.
• The GolemUI agent skill sometimes picked the TypeScript DX API or the JSON API on its own. Now the agent asks you which one to use before it writes a form.

There are no code changes for existing forms. Bump every @golemui/* package to 1.5.1 together, as always. If you use pnpm or Yarn Plug’n’Play and import GolemUI’s CSS, add @golemui/gui-components to your dependencies.

The full list of changes is in the changelog.