@ape-egg/vibe-compiler 4.3.25 → 4.3.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ape-egg/vibe-compiler",
-  "version": "4.3.25",
+  "version": "4.3.26",
   "type": "module",
   "description": "Optional Rust compiler for Vibe — pre-renders, inlines components, and optimizes iterations. The runtime never needs it.",
   "homepage": "https://vibe.korte.kim",

package/src/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "vibe-compiler"
-version = "4.3.25"
+version = "4.3.26"
 edition = "2021"
 description = "Vibe framework compiler - compiles Vibe source files into optimized output"
 authors = ["Kim Korte"]

package/src/compiler/compile.rs

@@ -1,7 +1,6 @@
 use std::fs;
 use std::path::{Path, PathBuf};
-use std::process::Command;
-use std::time::Instant;
+use std::time::{Duration, Instant, SystemTime};
 use std::collections::{BTreeMap, HashSet, HashMap};
 use thiserror::Error;
 use colored::Colorize;
@@ -39,17 +38,39 @@ fn manifest_url_path(relative_path: &str, root: Option<&str>) -> String {
         .join("/")
 }
 
-/// Write via a same-directory temp file + rename, so no reader — the dev
-/// server, the browser, another compiler process — can ever observe a
-/// partially-written file. Rename is atomic on POSIX; the temp name carries the
-/// pid so two processes writing the same target never share a temp file.
-pub(crate) fn atomic_write(path: &Path, contents: &str) -> std::io::Result<()> {
+/// Overwrite the output file in place. A temp file + rename would keep a torn
+/// file from ever being read, but the temp file itself vanishes mid-build, and
+/// a dev server that lists the output and then stats each entry (wrangler dev)
+/// dies on the one that is gone. A torn read is fixed by the next reload.
+///
+/// A file that shares its bytes with another path — a hard link into a package
+/// manager's cache, as bun installs, or a symlink — is replaced through a
+/// rename instead, since writing through it would rewrite that other path too.
+pub(crate) fn write_in_place(path: &Path, contents: impl AsRef<[u8]>) -> std::io::Result<()> {
+    if !shares_bytes(path) {
+        return fs::write(path, contents);
+    }
     let file_name = path.file_name().and_then(|n| n.to_str()).unwrap_or("out");
     let tmp = path.with_file_name(format!(".{}.{}.vibe-tmp", file_name, std::process::id()));
     fs::write(&tmp, contents)?;
     fs::rename(&tmp, path)
 }
 
+fn copy_in_place(src: &Path, dest: &Path) -> std::io::Result<()> {
+    write_in_place(dest, fs::read(src)?)
+}
+
+#[cfg(unix)]
+fn shares_bytes(path: &Path) -> bool {
+    use std::os::unix::fs::MetadataExt;
+    fs::symlink_metadata(path).is_ok_and(|meta| meta.file_type().is_symlink() || meta.nlink() > 1)
+}
+
+#[cfg(not(unix))]
+fn shares_bytes(path: &Path) -> bool {
+    fs::symlink_metadata(path).is_ok_and(|meta| meta.file_type().is_symlink())
+}
+
 // =============================================================================
 // MIRROR_MODE: Copy asset files from source to output as-is, preserving
 // directory structure. HTML files are compiled separately.
@@ -326,10 +347,8 @@ pub enum CompileError {
     },
     #[error("Parse error: {0}")]
     ParseError(#[from] crate::parser::html::ParseError),
-    #[error("Failed to execute command: {0}")]
-    CommandError(String),
-    #[error("Package manager not found")]
-    PackageManagerNotFound,
+    #[error("Failed to copy packages: {0}")]
+    ModulesError(String),
     #[error("Component name '{component_name}' in '{file_path}' conflicts with reserved element. Component filenames cannot match standard HTML elements (case-insensitive). Use PascalCase (e.g., 'Nav.html' instead of 'nav.html') to avoid conflicts.")]
     ReservedComponentName {
         component_name: String,
@@ -351,7 +370,6 @@ pub struct CompileStats {
     pub components_time_ms: f64,
     pub validation_time_ms: Option<f64>,
     pub node_modules_time_ms: Option<f64>,
-    pub package_manager: Option<String>,
     pub node_modules_copied_as_is: bool,
     pub components_as_is: bool,
 }
@@ -630,6 +648,8 @@ pub struct Compiler {
     /// disk read-back — so a concurrent writer rewriting the output directory
     /// (e.g. a second compiler) can't feed a torn read into a manifest.
     compiled_html: HashMap<PathBuf, String>,
+    /// When the last full compile began; output older than it is stale.
+    build_start: SystemTime,
 }
 
 impl Compiler {
@@ -642,6 +662,7 @@ impl Compiler {
             unique_components: HashSet::new(),
             component_cache: HashMap::new(),
             compiled_html: HashMap::new(),
+            build_start: SystemTime::now(),
         }
     }
 
@@ -683,7 +704,6 @@ impl Compiler {
             components_time_ms: 0.0,
             validation_time_ms: None,
             node_modules_time_ms: None,
-            package_manager: None,
             node_modules_copied_as_is: false,
             components_as_is: self.config.components_as_is,
         };
@@ -727,18 +747,10 @@ impl Compiler {
             println!("  HTML validation completed successfully");
         }
 
-        // Clean output directory if not in no-clean mode
-        if !self.config.no_clean && self.config.output.exists() {
-            if self.verbose {
-                println!("  Cleaning output directory: {}", self.config.output.display());
-            }
-            fs::remove_dir_all(&self.config.output).map_err(|e| {
-                CompileError::WriteError {
-                    path: self.config.output.display().to_string(),
-                    source: e,
-                }
-            })?;
-        }
+        // Output is overwritten in place and stale files are removed only at
+        // the end (remove_stale_output), so a dev server reading the output
+        // never sees it emptied.
+        self.build_start = SystemTime::now();
 
         // Create output directory
         if !self.config.output.exists() {
@@ -814,31 +826,16 @@ impl Compiler {
             }
         }
 
-        // Handle node_modules after successful compilation
+        // Packages after successful compilation
         if self.config.working_dir.join("node_modules").exists() {
+            let nm_start = Instant::now();
             if self.config.node_modules_as_is {
-                // Copy node_modules as-is (no install, just copy)
-                let nm_start = Instant::now();
-                self.copy_node_modules_as_is()?;
-                stats.node_modules_time_ms = Some(nm_start.elapsed().as_secs_f64() * 1000.0);
-                stats.node_modules_copied_as_is = true;
-
-                if self.verbose {
-                    println!("\n  Copied node_modules as-is");
-                }
+                copy_dir_recursive(&self.config.working_dir.join("node_modules"), &self.config.modules_path())?;
             } else {
-                // Use production-only strategy (runs install commands)
-                let pkg_manager = detect_package_manager(&self.config.working_dir).ok();
-                stats.package_manager = pkg_manager.clone();
-
-                let nm_start = Instant::now();
-                self.copy_production_node_modules()?;
-                stats.node_modules_time_ms = Some(nm_start.elapsed().as_secs_f64() * 1000.0);
-
-                if self.verbose {
-                    println!("  Copied production dependencies");
-                }
+                self.copy_production_modules()?;
             }
+            stats.node_modules_time_ms = Some(nm_start.elapsed().as_secs_f64() * 1000.0);
+            stats.node_modules_copied_as_is = self.config.node_modules_as_is;
         }
 
         Ok(stats)
@@ -862,7 +859,6 @@ impl Compiler {
             components_time_ms: 0.0,
             validation_time_ms: None,
             node_modules_time_ms: None,
-            package_manager: None,
             node_modules_copied_as_is: false,
             components_as_is: self.config.components_as_is,
         };
@@ -945,7 +941,6 @@ impl Compiler {
             components_time_ms: 0.0,
             validation_time_ms: None,
             node_modules_time_ms: None,
-            package_manager: None,
             node_modules_copied_as_is: false,
             components_as_is: self.config.components_as_is,
         };
@@ -1118,7 +1113,7 @@ impl Compiler {
             manifest_json
         );
 
-        atomic_write(&manifest_path, &manifest_js)
+        write_in_place(&manifest_path, &manifest_js)
             .map_err(|e| format!("Failed to write manifest: {}", e))?;
 
         // Stamp the compiled HTML with initial state values for FOUC prevention:
@@ -1143,7 +1138,7 @@ impl Compiler {
             let stamped = stamper.stamp_html(html.to_string())
                 .map_err(|e| format!("Failed to stamp HTML: {}", e))?;
 
-            atomic_write(html_path, &stamped)
+            write_in_place(html_path, &stamped)
                 .map_err(|e| format!("Failed to write stamped HTML: {}", e))?;
         }
 
@@ -1512,7 +1507,7 @@ impl Compiler {
 
         // Write to output
         let output_path = self.get_output_path(path, relative_path)?;
-        atomic_write(&output_path, &output).map_err(|e| CompileError::WriteError {
+        write_in_place(&output_path, &output).map_err(|e| CompileError::WriteError {
             path: output_path.display().to_string(),
             source: e,
         })?;
@@ -1693,7 +1688,7 @@ impl Compiler {
                     CompileError::CreateDirError(parent.display().to_string())
                 })?;
             }
-            atomic_write(&fragment_path, &page.fragment).map_err(|e| CompileError::WriteError {
+            write_in_place(&fragment_path, &page.fragment).map_err(|e| CompileError::WriteError {
                 path: fragment_path.display().to_string(),
                 source: e,
             })?;
@@ -1798,7 +1793,7 @@ impl Compiler {
         };
         let shell_html = inject_vibe_css(shell_html, self.config.disable_vibe_css);
         let shell_path = self.config.output.join("index.html");
-        atomic_write(&shell_path, &shell_html).map_err(|e| CompileError::WriteError {
+        write_in_place(&shell_path, &shell_html).map_err(|e| CompileError::WriteError {
             path: shell_path.display().to_string(),
             source: e,
         })?;
@@ -1913,7 +1908,7 @@ impl Compiler {
     fn copy_file(&self, path: &Path, relative_path: &str) -> Result<(), CompileError> {
         let output_path = self.get_output_path(path, relative_path)?;
 
-        fs::copy(path, &output_path).map_err(|e| CompileError::WriteError {
+        copy_in_place(path, &output_path).map_err(|e| CompileError::WriteError {
             path: output_path.display().to_string(),
             source: e,
         })?;
@@ -1928,9 +1923,7 @@ impl Compiler {
     /// components_as_is — are served from that mirror at request time. Watch
     /// mode calls this for every changed component so the mirror tracks edits
     /// and deletions even when no page inlines the component (zero graph
-    /// dependents). Writes are atomic (same tmp+rename as compiled pages) so a
-    /// runtime fetch mid-copy never sees a torn file. Returns how many files
-    /// were copied.
+    /// dependents). Returns how many files were copied.
     pub fn mirror_component_files(&self, files: &[PathBuf]) -> Result<usize, CompileError> {
         let mut copied = 0;
         for path in files {
@@ -1947,7 +1940,7 @@ impl Compiler {
                     path: path.display().to_string(),
                     source: e,
                 })?;
-                atomic_write(&output_path, &contents).map_err(|e| CompileError::WriteError {
+                write_in_place(&output_path, &contents).map_err(|e| CompileError::WriteError {
                     path: output_path.display().to_string(),
                     source: e,
                 })?;
@@ -2494,120 +2487,96 @@ impl Compiler {
         Ok(())
     }
 
-    /// Copy node_modules as-is to output
-    fn copy_node_modules_as_is(&self) -> Result<(), CompileError> {
-        let src = self.config.working_dir.join("node_modules");
-        let dest = self.config.output.join("node_modules");
-
-        // Remove existing node_modules in output if it exists
-        if dest.exists() {
-            fs::remove_dir_all(&dest).map_err(|e| CompileError::WriteError {
-                path: dest.display().to_string(),
-                source: e,
-            })?;
-        }
-
-        // Copy recursively
-        copy_dir_recursive(&src, &dest)?;
-
-        Ok(())
-    }
-
-    /// Install production dependencies directly into output directory
-    fn copy_production_node_modules(&self) -> Result<(), CompileError> {
-        let pkg_manager = detect_package_manager(&self.config.working_dir)?;
-
-        if self.verbose {
-            println!("\n  Detected package manager: {}", pkg_manager);
-            println!("  Installing production dependencies to output...");
-        }
-
-        // 1. Copy package.json to output directory
-        let package_json_src = self.config.working_dir.join("package.json");
-        let package_json_dest = self.config.output.join("package.json");
-
-        fs::copy(&package_json_src, &package_json_dest).map_err(|e| CompileError::WriteError {
-            path: package_json_dest.display().to_string(),
-            source: e,
-        })?;
-
-        // 2. Copy lockfile if it exists (needed for reproducible installs)
-        let lockfile_name = match pkg_manager.as_str() {
-            "bun" if self.config.working_dir.join("bun.lock").exists() => "bun.lock",
-            "bun" => "bun.lockb",
-            "pnpm" => "pnpm-lock.yaml",
-            "yarn" => "yarn.lock",
-            "npm" => "package-lock.json",
-            _ => "",
-        };
-
-        if !lockfile_name.is_empty() {
-            let lockfile_src = self.config.working_dir.join(lockfile_name);
-            let lockfile_dest = self.config.output.join(lockfile_name);
-            if lockfile_src.exists() {
-                fs::copy(&lockfile_src, &lockfile_dest).ok();
+    /// Remove whatever the last full compile did not write, then the folders it
+    /// left empty. Run once the build is done — manifests included — so a
+    /// file disappears only when it is stale. File times come from the
+    /// kernel's coarse clock, which trails SystemTime::now(), hence the margin.
+    pub fn remove_stale_output(&self) -> Result<usize, CompileError> {
+        if self.config.no_clean {
+            return Ok(0);
+        }
+        remove_older_than(&self.config.output, self.build_start - Duration::from_secs(1))
+    }
+
+    /// Copy every production dependency, and theirs, from the project's own
+    /// node_modules into the modules folder of the output. Written over what is
+    /// there, never through a temp tree, so the output never loses a file.
+    /// A `modules` folder other than node_modules holds each package under its
+    /// bare name (`modules/vibe`, not `modules/@ape-egg/vibe`): some static
+    /// hosts (Cloudflare) redirect any path holding `@`.
+    fn copy_production_modules(&self) -> Result<(), CompileError> {
+        let installed = self.config.working_dir.join("node_modules");
+        let bare = self.config.modules != "node_modules";
+        let mut pending = dependency_names(&self.config.working_dir.join("package.json"))?;
+        let mut copied: HashMap<String, String> = HashMap::new();
+        while let Some(name) = pending.pop() {
+            let src = installed.join(&name);
+            // A dependency missing at the top level is nested inside its dependent, and copied with it
+            if copied.contains_key(&name) || !src.exists() {
+                continue;
             }
+            let folder = if bare { name.rsplit('/').next().unwrap_or(&name).to_string() } else { name.clone() };
+            if let Some((other, _)) = copied.iter().find(|(_, f)| **f == folder) {
+                return Err(CompileError::ModulesError(format!(
+                    "\"{}\" and \"{}\" both land in {}/{} — bare package names must be unique in \"modules\"",
+                    other, name, self.config.modules, folder
+                )));
+            }
+            copy_dir_recursive(&src, &self.config.modules_path().join(&folder))?;
+            pending.extend(dependency_names(&src.join("package.json"))?);
+            copied.insert(name, folder);
         }
-
-        // 3. Install production dependencies directly in output directory
-        run_command(&pkg_manager, &["install", "--production"], &self.config.output)?;
-
-        // 4. Cleanup: remove package.json and lockfile from output
-        fs::remove_file(&package_json_dest).ok();
-        if !lockfile_name.is_empty() {
-            let lockfile_dest = self.config.output.join(lockfile_name);
-            fs::remove_file(&lockfile_dest).ok();
-        }
-
-        if self.verbose {
-            println!("  Installed production dependencies to output");
-        }
-
         Ok(())
     }
 }
 
-/// Detect package manager from lockfiles
-fn detect_package_manager(dir: &Path) -> Result<String, CompileError> {
-    if dir.join("bun.lockb").exists() || dir.join("bun.lock").exists() {
-        return Ok("bun".to_string());
-    }
-    if dir.join("pnpm-lock.yaml").exists() {
-        return Ok("pnpm".to_string());
-    }
-    if dir.join("yarn.lock").exists() {
-        return Ok("yarn".to_string());
-    }
-    if dir.join("package-lock.json").exists() {
-        return Ok("npm".to_string());
+/// Remove every file under `dir` last written before `cutoff`, and every
+/// folder that leaves empty. Returns how many files went.
+fn remove_older_than(dir: &Path, cutoff: SystemTime) -> Result<usize, CompileError> {
+    let read_error = |e| CompileError::ReadError { path: dir.display().to_string(), source: e };
+    let write_error = |path: &Path, e| CompileError::WriteError { path: path.display().to_string(), source: e };
+    let mut removed = 0;
+    for entry in fs::read_dir(dir).map_err(read_error)? {
+        let entry = entry.map_err(read_error)?;
+        let path = entry.path();
+        let meta = entry.metadata().map_err(read_error)?;
+        if meta.is_dir() {
+            removed += remove_older_than(&path, cutoff)?;
+            if fs::read_dir(&path).map_err(read_error)?.next().is_none() {
+                fs::remove_dir(&path).map_err(|e| write_error(&path, e))?;
+            }
+        } else if meta.modified().map_err(read_error)? < cutoff {
+            fs::remove_file(&path).map_err(|e| write_error(&path, e))?;
+            removed += 1;
+        }
     }
-
-    Err(CompileError::PackageManagerNotFound)
+    Ok(removed)
 }
 
-/// Run a package manager command
-fn run_command(pkg_manager: &str, args: &[&str], cwd: &Path) -> Result<(), CompileError> {
-    let output = Command::new(pkg_manager)
-        .args(args)
-        .current_dir(cwd)
-        .output()
-        .map_err(|e| CompileError::CommandError(format!("{} not found: {}", pkg_manager, e)))?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        return Err(CompileError::CommandError(format!(
-            "{} {} failed: {}",
-            pkg_manager,
-            args.join(" "),
-            stderr
-        )));
-    }
-
-    Ok(())
+/// Names under `dependencies`, `optionalDependencies` and `peerDependencies`
+fn dependency_names(package_json: &Path) -> Result<Vec<String>, CompileError> {
+    let content = fs::read_to_string(package_json).map_err(|e| CompileError::ReadError {
+        path: package_json.display().to_string(),
+        source: e,
+    })?;
+    let package: Value = serde_json::from_str(&content)
+        .map_err(|e| CompileError::ModulesError(format!("{}: {}", package_json.display(), e)))?;
+    Ok(["dependencies", "optionalDependencies", "peerDependencies"]
+        .iter()
+        .filter_map(|key| package.get(key).and_then(Value::as_object))
+        .flat_map(|deps| deps.keys().cloned())
+        .collect())
 }
 
 /// Recursively copy a directory
 fn copy_dir_recursive(src: &Path, dest: &Path) -> Result<(), CompileError> {
+    // Copying into a symlinked folder would write into the folder it points at
+    if fs::symlink_metadata(dest).is_ok_and(|meta| meta.file_type().is_symlink()) {
+        fs::remove_file(dest).map_err(|e| CompileError::WriteError {
+            path: dest.display().to_string(),
+            source: e,
+        })?;
+    }
     if !dest.exists() {
         fs::create_dir_all(dest).map_err(|_| CompileError::CreateDirError(dest.display().to_string()))?;
     }
@@ -2635,7 +2604,7 @@ fn copy_dir_recursive(src: &Path, dest: &Path) -> Result<(), CompileError> {
             }
             copy_dir_recursive(&path, &dest_path)?;
         } else {
-            fs::copy(&path, &dest_path).map_err(|e| CompileError::WriteError {
+            copy_in_place(&path, &dest_path).map_err(|e| CompileError::WriteError {
                 path: dest_path.display().to_string(),
                 source: e,
             })?;
@@ -2790,17 +2759,16 @@ mod tests {
     }
 
     #[test]
-    fn atomic_write_replaces_content_without_leaving_tmp_files() {
-        let dir = std::env::temp_dir().join("vibe_atomic_write_test");
+    fn write_in_place_replaces_content_without_leaving_tmp_files() {
+        let dir = std::env::temp_dir().join("vibe_write_in_place_test");
         let _ = fs::remove_dir_all(&dir);
         fs::create_dir_all(&dir).unwrap();
         let target = dir.join("page.html");
 
-        atomic_write(&target, "first").unwrap();
+        write_in_place(&target, "first").unwrap();
         assert_eq!(fs::read_to_string(&target).unwrap(), "first");
 
-        // Overwriting an existing file goes through the same tmp+rename path.
-        atomic_write(&target, "second, longer content").unwrap();
+        write_in_place(&target, "second, longer content").unwrap();
         assert_eq!(fs::read_to_string(&target).unwrap(), "second, longer content");
 
         let leftovers: Vec<String> = fs::read_dir(&dir)
@@ -2812,6 +2780,30 @@ mod tests {
         assert!(leftovers.is_empty(), "temp artifacts left behind: {leftovers:?}");
     }
 
+    // bun installs packages as hard links into its cache, and an output built
+    // by an install holds more of them. Copying a package over such an output
+    // once truncated the cached package, and every project linked to it.
+    #[test]
+    fn copy_in_place_never_writes_through_a_hard_link() {
+        let dir = std::env::temp_dir().join("vibe_copy_in_place_test");
+        let _ = fs::remove_dir_all(&dir);
+        fs::create_dir_all(&dir).unwrap();
+        let (cache, installed, output) = (dir.join("cache.js"), dir.join("installed.js"), dir.join("output.js"));
+        fs::write(&cache, "cached").unwrap();
+        fs::hard_link(&cache, &installed).unwrap();
+        fs::hard_link(&cache, &output).unwrap();
+
+        copy_in_place(&installed, &output).unwrap();
+        assert_eq!(fs::read_to_string(&cache).unwrap(), "cached");
+        assert_eq!(fs::read_to_string(&output).unwrap(), "cached");
+
+        write_in_place(&installed, "newer").unwrap();
+        assert_eq!(fs::read_to_string(&cache).unwrap(), "cached");
+        assert_eq!(fs::read_to_string(&installed).unwrap(), "newer");
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
     // A minimal on-disk project: source with one page carrying a distinctive
     // binding, empty components dir, output dir sibling. Returns (config, page
     // source path, compiled page output path, manifest path).
@@ -2881,6 +2873,7 @@ mod tests {
             reserved_elements: Vec::new(),
             skip_files: Vec::new(),
             node_modules_as_is: false,
+            modules: "node_modules".to_string(),
             components_as_is: true,
             runtime_as_is: false,
             iterations_as_is: false,
@@ -2970,6 +2963,7 @@ mod tests {
             reserved_elements: Vec::new(),
             skip_files: Vec::new(),
             node_modules_as_is: false,
+            modules: "node_modules".to_string(),
             components_as_is: false,
             runtime_as_is: false,
             iterations_as_is: false,
@@ -3083,6 +3077,7 @@ mod tests {
             reserved_elements: Vec::new(),
             skip_files: Vec::new(),
             node_modules_as_is: false,
+            modules: "node_modules".to_string(),
             components_as_is: false,
             runtime_as_is: false,
             iterations_as_is: false,
@@ -3155,6 +3150,7 @@ mod tests {
             reserved_elements: Vec::new(),
             skip_files: Vec::new(),
             node_modules_as_is: false,
+            modules: "node_modules".to_string(),
             components_as_is: false,
             runtime_as_is: false,
             iterations_as_is: false,

package/src/compiler/value_stamper.rs

@@ -1,35 +1,20 @@
 use regex::{Regex, Captures};
 use serde_json::{Map, Value};
 use rquickjs::{Context, Runtime};
-use std::collections::{HashMap, HashSet};
-
-/// Render a primitive state value the way an evaluated `@[expr]` would print it:
-/// strings/numbers/bools as their text, null as empty. Mirrors `eval_with_state`.
-fn primitive_to_text(value: &Value) -> String {
-    match value {
-        Value::String(s) => s.clone(),
-        Value::Number(n) => n.to_string(),
-        Value::Bool(b) => b.to_string(),
-        Value::Null => String::new(),
-        // Constants are primitive-only (see reassignment_analyzer); fall back safely.
-        other => other.to_string(),
-    }
-}
+use std::collections::HashSet;
 
 use crate::constants::{NON_REACTIVE_ELEMENTS, VALUE_ATTRS, DEHYDRATE_ATTR, NAMEBIND_ATTR, DEFER_ATTR_PREFIX};
+use crate::parser::html::decode_entities;
 
-
-pub struct ValueStamper<'a> {
-    state: &'a Value,
+pub struct ValueStamper {
+    /// Stamp state plus the global keys reassignment analysis proved constant.
+    /// A dynamic global is never in here, so any expression reading one throws
+    /// a ReferenceError in QuickJS and its binding stays live for the runtime.
+    state: Value,
     binding_regex: Regex,
     _runtime: Runtime, // Must be kept alive for context to work
     context: Context,
     components_as_is: bool,
-    /// Global state keys proven constant by reassignment analysis, mapped to the
-    /// text they stamp to. Only an `@[key]` binding whose expression is EXACTLY
-    /// one of these keys is stamped from here — never a compound expression — so
-    /// there is no risk of a dynamic operand leaking into the value.
-    constant_texts: HashMap<String, String>,
     /// Selective mode (the SPA shell): unresolvable state is runtime-owned, so
     /// unresolved attribute markers are kept instead of stripped and a
     /// conditional whose expression reads an unknown root stays raw (both
@@ -37,47 +22,46 @@ pub struct ValueStamper<'a> {
     selective: bool,
 }
 
-impl<'a> ValueStamper<'a> {
-    pub fn new(state: &'a Value, components_as_is: bool) -> Result<Self, String> {
+impl ValueStamper {
+    pub fn new(state: &Value, components_as_is: bool) -> Result<Self, String> {
         Self::with_constants(state, components_as_is, &Map::new())
     }
 
     pub fn with_constants(
-        state: &'a Value,
+        state: &Value,
         components_as_is: bool,
         constants: &Map<String, Value>,
     ) -> Result<Self, String> {
+        let mut state = state.clone();
+        state.as_object_mut().expect("stamp state is an object").extend(constants.clone());
+
         let runtime = Runtime::new().map_err(|e| format!("Failed to create QuickJS runtime: {:?}", e))?;
         let context = Context::full(&runtime).map_err(|e| format!("Failed to create QuickJS context: {:?}", e))?;
 
         // Set up state ONCE when creating the stamper (not per expression)
         context.with(|ctx| -> Result<(), String> {
-            let state_str = serde_json::to_string(state)
+            let state_str = serde_json::to_string(&state)
                 .map_err(|e| format!("Failed to serialize state: {}", e))?;
             // Expose state both as bare globals (via Object.assign) and as a
             // persistent `$` global carrying the runtime `unsafe` helper, so a
             // `@[$.unsafe(expr)]` binding stamps its trusted string raw at build
-            // time — mirroring the runtime, where `$.unsafe` marks raw HTML.
+            // time — mirroring the runtime, where `$.unsafe` wraps it in RawHtml.
             ctx.eval::<(), _>(format!(
-                "const $ = {}; Object.assign(globalThis, $); $.unsafe = (s) => s; globalThis.$ = $",
+                "const $ = {}; Object.assign(globalThis, $); \
+                 globalThis.RawHtml = class {{ constructor(html) {{ this.html = html == null ? '' : String(html) }} }}; \
+                 $.unsafe = (html) => new RawHtml(html); globalThis.$ = $",
                 state_str
             ))
                 .map_err(|e| format!("Failed to set up state in QuickJS: {:?}", e))?;
             Ok(())
         })?;
 
-        let constant_texts = constants
-            .iter()
-            .map(|(key, value)| (key.clone(), primitive_to_text(value)))
-            .collect();
-
         Ok(Self {
             state,
             binding_regex: Regex::new(r"@\[((?:[^\[\]]|\[[^\]]*\])+)\]").unwrap(),
             _runtime: runtime,
             context,
             components_as_is,
-            constant_texts,
             selective: false,
         })
     }
@@ -107,12 +91,40 @@ impl<'a> ValueStamper<'a> {
         // Then, render conditionals (resolve if/else branches)
         let html = self.render_conditionals(html)?;
 
+        // Stamp bindings only in regions that are NOT in skip_regions
+        let (mut result, unresolved) = self.stamp_bindings_tracked(&html, &self.skip_regions(&html));
+
+        // Clean up attributes that still contain unresolved markers. Selective
+        // mode keeps them: an unresolved marker there is runtime-owned state
+        // (the outlet's `src="@[page.src]"`), not an absent iteration property.
+        if !self.selective {
+            result = self.cleanup_unresolved_attributes(result, &unresolved);
+        }
+
+        // Restore vibe-dehydrate content from placeholders
+        for (i, content) in dehydrate_placeholders.iter().enumerate() {
+            let placeholder = format!("<!--VIBE_DEHYDRATE_PLACEHOLDER_{}-->", i);
+            result = result.replace(&placeholder, content);
+        }
+
+        // Finally, clean up boolean-like attributes with falsy values
+        // When components_as_is is true, skip cleanup inside component elements.
+        // Regions are measured again on the stamped HTML: stamping changes
+        // lengths, so the pre-stamp offsets point at the wrong attributes.
+        let skip_regions = self.skip_regions(&result);
+        Ok(self.cleanup_boolean_attributes(result, &skip_regions))
+    }
+
+    /// Byte ranges of the regions stamping and cleanup leave untouched:
+    /// non-reactive elements, vibe-dehydrate templates and, when
+    /// components_as_is is true, component elements.
+    fn skip_regions(&self, html: &str) -> Vec<(usize, usize)> {
         // Find all NON_REACTIVE_ELEMENT regions to skip
         let mut skip_regions: Vec<(usize, usize)> = Vec::new();
 
         for element_type in NON_REACTIVE_ELEMENTS {
             let regex = Regex::new(&format!(r"(?s)<{}[^>]*>.*?</{}>", element_type, element_type)).unwrap();
-            for mat in regex.find_iter(&html) {
+            for mat in regex.find_iter(html) {
                 skip_regions.push((mat.start(), mat.end()));
             }
         }
@@ -120,7 +132,7 @@ impl<'a> ValueStamper<'a> {
         // Skip elements with vibe-dehydrate attribute (content should not be processed)
         // This is a secondary protection in case placeholders aren't used
         let dehydrate_regex = Regex::new(&format!(r"(?s)<template[^>]*\s{}[^>]*>.*?</template>", DEHYDRATE_ATTR)).unwrap();
-        for mat in dehydrate_regex.find_iter(&html) {
+        for mat in dehydrate_regex.find_iter(html) {
             skip_regions.push((mat.start(), mat.end()));
         }
 
@@ -129,55 +141,40 @@ impl<'a> ValueStamper<'a> {
         if self.components_as_is {
             // Match <component ...>...</component>
             let component_regex = Regex::new(r"(?s)<component[^>]*>.*?</component>").unwrap();
-            for mat in component_regex.find_iter(&html) {
+            for mat in component_regex.find_iter(html) {
                 skip_regions.push((mat.start(), mat.end()));
             }
 
             // Match <div class="component" ...>...</div>
             let div_component_regex = Regex::new(r#"(?s)<div\s+class="component"[^>]*>.*?</div>"#).unwrap();
-            for mat in div_component_regex.find_iter(&html) {
+            for mat in div_component_regex.find_iter(html) {
                 skip_regions.push((mat.start(), mat.end()));
             }
         }
 
         // Sort and merge overlapping regions
         skip_regions.sort_by_key(|r| r.0);
-
-        // Stamp bindings only in regions that are NOT in skip_regions
-        let (mut result, unresolved) = self.stamp_bindings_tracked(&html, &skip_regions);
-
-        // Clean up attributes that still contain unresolved markers. Selective
-        // mode keeps them: an unresolved marker there is runtime-owned state
-        // (the outlet's `src="@[page.src]"`), not an absent iteration property.
-        if !self.selective {
-            result = self.cleanup_unresolved_attributes(result, &unresolved);
-        }
-
-        // Restore vibe-dehydrate content from placeholders
-        for (i, content) in dehydrate_placeholders.iter().enumerate() {
-            let placeholder = format!("<!--VIBE_DEHYDRATE_PLACEHOLDER_{}-->", i);
-            result = result.replace(&placeholder, content);
-        }
-
-        // Finally, clean up boolean-like attributes with falsy values
-        // When components_as_is is true, skip cleanup inside component elements
-        Ok(self.cleanup_boolean_attributes(result, &skip_regions))
+        skip_regions
     }
 
     /// Evaluate a JavaScript expression with the current state
     fn eval_expression(&self, expr: &str) -> Option<String> {
-        self.eval_with_state(expr, self.state)
+        self.eval_with_state(expr, &self.state)
     }
 
     /// Evaluate a JavaScript expression with custom state (for nested iterations)
+    /// into the HTML it stamps: escaped text, or the raw markup of `$.unsafe`.
     fn eval_with_state(&self, expr: &str, _state: &Value) -> Option<String> {
         // State is already set up in the context during new(), just evaluate the expression
         self.context.with(|ctx| -> Option<String> {
-            // Evaluate expression and convert to string
             let result: rquickjs::Value = ctx.eval(expr).ok()?;
+            let raw_html: rquickjs::Value = ctx.globals().get("RawHtml").ok()?;
+            if let Some(raw) = result.as_object().filter(|o| o.is_instance_of(&raw_html)) {
+                return raw.get("html").ok();
+            }
 
             // Convert result to string
-            if result.is_string() {
+            let text = if result.is_string() {
                 result.as_string().and_then(|s| s.to_string().ok())
             } else if result.is_number() {
                 result.as_number().map(|n| n.to_string())
@@ -191,7 +188,8 @@ impl<'a> ValueStamper<'a> {
                 // For objects/arrays, convert to JSON
                 ctx.json_stringify(result).ok()
                     .and_then(|v| v.and_then(|s| s.to_string().ok()))
-            }
+            };
+            text.map(|text| escape_html(&text))
         })
     }
 
@@ -301,7 +299,7 @@ impl<'a> ValueStamper<'a> {
 
         context.with(|ctx| -> Option<Vec<Value>> {
             // Set state properties in global scope
-            let state_str = serde_json::to_string(self.state).ok()?;
+            let state_str = serde_json::to_string(&self.state).ok()?;
             ctx.eval::<(), _>(format!("const $ = {}; Object.assign(globalThis, $)", state_str)).ok()?;
 
             // Evaluate path to get array
@@ -683,14 +681,10 @@ impl<'a> ValueStamper<'a> {
                 result.push_str(binding_match.as_str());
             } else {
                 let caps = self.binding_regex.captures(binding_match.as_str()).unwrap();
-                let expr = &caps[1];
-                // A bare reference to a proven-constant global key (`@[version]`)
-                // stamps its build-time value. Any compound expression falls
-                // through to normal evaluation, where dynamic globals stay absent
-                // and the binding is left live for the runtime.
-                if let Some(text) = self.constant_texts.get(expr.trim()) {
-                    result.push_str(text);
-                } else if let Some(stamped) = self.eval_expression(expr) {
+                // The HTML is serialized, so `=>` in a text binding reads `=&gt;`
+                // and `"` in an attribute binding reads `&quot;` — decode back to
+                // the JS the runtime evaluates.
+                if let Some(stamped) = self.eval_expression(&decode_entities(&caps[1])) {
                     result.push_str(&stamped);
                 } else {
                     unresolved.push(result.len());
@@ -791,6 +785,10 @@ impl<'a> ValueStamper<'a> {
     }
 }
 
+fn escape_html(text: &str) -> String {
+    text.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;")
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -888,6 +886,16 @@ mod tests {
         assert_eq!(result, "<p><em>x</em></p>");
     }
 
+    #[test]
+    fn stamp_escapes_quotes_and_angle_brackets() {
+        let state = json!({ "snippet": r#"<component src="/card.html"></component> & more"# });
+        let stamper = ValueStamper::new(&state, false).unwrap();
+        let html = String::from(r#"<copy-button data-value="@[snippet]">@[snippet]</copy-button>"#);
+        let result = stamper.stamp_html(html).unwrap();
+        let escaped = "&lt;component src=&quot;/card.html&quot;&gt;&lt;/component&gt; &amp; more";
+        assert_eq!(result, format!(r#"<copy-button data-value="{escaped}">{escaped}</copy-button>"#));
+    }
+
     #[test]
     fn stamp_attribute_binding() {
         let state = json!({ "firstName": "John" });
@@ -1051,5 +1059,41 @@ mod tests {
         let result = stamper.stamp_html("<x>@[version + suffix]</x>".to_string()).unwrap();
         assert!(!result.contains("0.1.5"), "constant leaked into compound: {result}");
     }
+
+    #[test]
+    fn compound_expression_over_constants_is_stamped_from_serialized_html() {
+        // An inlined component's `@[name.split…]` with `name="@[team]"` arrives
+        // as `@[(team).split…]`, its `=>` serialized to `=&gt;`.
+        let state = json!({});
+        let consts = constants(&[("team", json!("Ada Lovelace"))]);
+        let stamper = ValueStamper::with_constants(&state, false, &consts).unwrap();
+        let result = stamper
+            .stamp_html("<avatar-circle>@[(team).split(' ').map(part =&gt; part[0]).join('')]</avatar-circle>".to_string())
+            .unwrap();
+        assert_eq!(result, "<avatar-circle>AL</avatar-circle>");
+    }
+
+    #[test]
+    fn cleanup_measures_skip_regions_after_a_binding_shrinks() {
+        // The avatar's binding stamps 52 bytes down to `AL`, pulling the hint
+        // box back into where the `<pre>` sat before stamping — cleanup must
+        // still see its attributes as outside the `<pre>`.
+        let state = json!({ "gone": false, "secondary": "" });
+        let consts = constants(&[("team", json!("Ada Lovelace"))]);
+        let stamper = ValueStamper::with_constants(&state, false, &consts).unwrap();
+        let result = stamper
+            .stamp_html(
+                "<avatar-circle>@[(team).split(' ').map(part =&gt; part[0]).join('')]</avatar-circle>\
+                 <pre>npm install @ape-egg/vibe --save-dev</pre>\
+                 <hint-box gone=\"@[gone]\"><button secondary=\"@[secondary]\">Go</button></hint-box>"
+                    .to_string(),
+            )
+            .unwrap();
+        assert_eq!(
+            result,
+            "<avatar-circle>AL</avatar-circle><pre>npm install @ape-egg/vibe --save-dev</pre>\
+             <hint-box><button secondary>Go</button></hint-box>"
+        );
+    }
 }
 

package/src/compiler/watcher.rs

@@ -471,6 +471,10 @@ pub fn watch(config: Config, verbose: bool, launcher: Option<u32>) -> std::resul
                 }
             }
 
+            if let Err(e) = compiler.remove_stale_output() {
+                eprintln!("\n{}: Removing stale output failed: {}", "Warning".yellow(), e);
+            }
+
             // Show success headline
             println!("\n{}", "Initial compilation complete!".green().bold());
             println!();
@@ -525,8 +529,8 @@ pub fn watch(config: Config, verbose: bool, launcher: Option<u32>) -> std::resul
             if let Some(nm_time) = stats.node_modules_time_ms {
                 if stats.node_modules_copied_as_is {
                     println!("* copied node_modules in {:.0}ms", nm_time);
-                } else if let Some(ref pkg_manager) = stats.package_manager {
-                    println!("* {} install in {:.0}ms", pkg_manager, nm_time);
+                } else {
+                    println!("* copied dependencies in {:.0}ms", nm_time);
                 }
             }
 
@@ -879,7 +883,6 @@ pub fn watch(config: Config, verbose: bool, launcher: Option<u32>) -> std::resul
                             components_time_ms: 0.0,
                             validation_time_ms: None,
                             node_modules_time_ms: None,
-                            package_manager: None,
                             node_modules_copied_as_is: false,
                             components_as_is: config.components_as_is,
                         };

package/src/config.rs

@@ -38,6 +38,8 @@ pub struct VibeCompilerConfig {
     pub skip_files: Vec<String>,
     #[serde(default)]
     pub node_modules_as_is: bool,
+    #[serde(default = "default_modules")]
+    pub modules: String,
     #[serde(default)]
     pub components_as_is: bool,
     #[serde(default)]
@@ -73,6 +75,7 @@ fn default_output() -> String { "./compiled".to_string() }
 fn default_components() -> String { "components".to_string() }
 fn default_pages() -> String { "pages".to_string() }
 fn default_assets() -> String { "assets".to_string() }
+fn default_modules() -> String { "node_modules".to_string() }
 
 /// Get list of standard HTML5 elements + "component"
 /// Component names matching these are reserved and not allowed
@@ -118,6 +121,7 @@ impl Default for VibeCompilerConfig {
             reserved_elements: vec![],
             skip_files: vec![],
             node_modules_as_is: false,
+            modules: default_modules(),
             components_as_is: false,
             runtime_as_is: false,
             iterations_as_is: false,
@@ -145,6 +149,7 @@ pub struct Config {
     pub reserved_elements: Vec<String>,
     pub skip_files: Vec<String>,
     pub node_modules_as_is: bool,
+    pub modules: String,
     pub components_as_is: bool,
     pub runtime_as_is: bool,
     pub iterations_as_is: bool,
@@ -208,6 +213,7 @@ impl Config {
             reserved_elements,
             skip_files,
             node_modules_as_is: config.node_modules_as_is,
+            modules: config.modules,
             components_as_is: config.components_as_is,
             runtime_as_is: config.runtime_as_is,
             iterations_as_is: config.iterations_as_is,
@@ -219,6 +225,10 @@ impl Config {
         }
     }
 
+    pub fn modules_path(&self) -> PathBuf {
+        self.output.join(&self.modules)
+    }
+
     pub fn components_path(&self) -> PathBuf {
         self.source.join(&self.components)
     }

package/src/main.rs

@@ -242,6 +242,7 @@ fn main() {
         println!("  {}: {}", format!("{:<16}", "elementsAsIs").cyan(), format_bool_with_flag(config.elements_as_is, overrides.elements_as_is, original_elements_as_is));
         println!("  {}: {}", format!("{:<16}", "iterationsAsIs").cyan(), format_bool_with_flag(config.iterations_as_is, overrides.iterations_as_is, original_iterations_as_is));
         println!("  {}: {}", format!("{:<16}", "minify").cyan(), format_bool_with_flag(config.minify, overrides.minify, original_minify));
+        println!("  {}: {}", format!("{:<16}", "modules").cyan(), format_value_no_flag(&config.modules));
         println!("  {}: {}", format!("{:<16}", "nodeModulesAsIs").cyan(), format_bool_with_flag(config.node_modules_as_is, overrides.node_modules_as_is, original_node_modules_as_is));
         println!("  {}: {}", format!("{:<16}", "output").cyan(), format_value_no_flag(&config._output_str));
         println!("  {}: {}", format!("{:<16}", "pages").cyan(), format_value_no_flag(&config.pages));
@@ -291,6 +292,10 @@ fn main() {
                 }
             }
 
+            if let Err(e) = compiler.remove_stale_output() {
+                eprintln!("\n{}: Removing stale output failed: {}", "Warning".yellow(), e);
+            }
+
             // Show success headline
             println!("\n{}", format!("Compilation successful! (v{}) ✅", env!("CARGO_PKG_VERSION")).green().bold());
             println!();
@@ -345,8 +350,8 @@ fn main() {
             if let Some(nm_time) = stats.node_modules_time_ms {
                 if stats.node_modules_copied_as_is {
                     println!("* copied node_modules in {:.0}ms", nm_time);
-                } else if let Some(ref pkg_manager) = stats.package_manager {
-                    println!("* {} install in {:.0}ms", pkg_manager, nm_time);
+                } else {
+                    println!("* copied dependencies in {:.0}ms", nm_time);
                 }
             }
 

package/src/parser/html.rs

@@ -681,7 +681,7 @@ fn escape_attr_value(value: &str) -> String {
         .replace('\'', "'")
 }
 
-fn decode_entities(value: &str) -> String {
+pub(crate) fn decode_entities(value: &str) -> String {
     value
         .replace(""", "\"")
         .replace(""", "\"")