@alltuner/vibetuner 10.21.0 → 10.22.0

package/htmx-csp.js

@@ -1,3 +1,4 @@
-// ABOUTME: Re-exports the htmx hx-csp extension via @alltuner/vibetuner/htmx/csp
-// ABOUTME: so scaffolded projects don't need a direct htmx.org dep to enable it.
+// ABOUTME: Re-exports the htmx hx-csp extension via @alltuner/vibetuner/htmx/csp and
+// ABOUTME: enables safeEval, so hx-on:/hx-live stay CSP-safe without unsafe-eval.
+import "./htmx-safeeval.js";
 import "htmx.org/dist/ext/hx-csp.js";

package/htmx-safeeval.js

@@ -0,0 +1,9 @@
+// ABOUTME: Turns on htmx safeEval before the hx-csp extension registers, so hx-csp
+// ABOUTME: evaluates hx-on:/hx-live via nonce-based script injection, not new Function().
+import htmx from "htmx.org";
+
+// hx-csp reads htmx.config.safeEval synchronously in its init (which runs the
+// moment the extension module evaluates), so this must be set first. Keeping it
+// in its own module lets htmx-csp.js import it ahead of the extension regardless
+// of how config.js orders the framework imports.
+htmx.config.safeEval = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alltuner/vibetuner",
-  "version": "10.21.0",
+  "version": "10.22.0",
   "description": "Blessed JavaScript/frontend build dependencies for production-ready Vibetuner projects",
   "keywords": [
     "tailwindcss",
@@ -34,7 +34,7 @@
     "tailwindcss": "./bin/tailwindcss.js"
   },
   "dependencies": {
-    "@alltuner/vibetuner-jinja": "10.21.0",
+    "@alltuner/vibetuner-jinja": "10.22.0",
     "daisyui": "^5.5.19",
     "htmx.org": "4.0.0-beta4",
     "tailwindcss": "^4.3.0",