@ape-egg/vibe-compiler 4.3.25 → 4.3.27

package/src/compiler/value_stamper.rs

@@ -1,35 +1,20 @@
 use regex::{Regex, Captures};
 use serde_json::{Map, Value};
 use rquickjs::{Context, Runtime};
-use std::collections::{HashMap, HashSet};
-
-/// Render a primitive state value the way an evaluated `@[expr]` would print it:
-/// strings/numbers/bools as their text, null as empty. Mirrors `eval_with_state`.
-fn primitive_to_text(value: &Value) -> String {
-    match value {
-        Value::String(s) => s.clone(),
-        Value::Number(n) => n.to_string(),
-        Value::Bool(b) => b.to_string(),
-        Value::Null => String::new(),
-        // Constants are primitive-only (see reassignment_analyzer); fall back safely.
-        other => other.to_string(),
-    }
-}
+use std::collections::HashSet;
 
 use crate::constants::{NON_REACTIVE_ELEMENTS, VALUE_ATTRS, DEHYDRATE_ATTR, NAMEBIND_ATTR, DEFER_ATTR_PREFIX};
+use crate::parser::html::decode_entities;
 
-
-pub struct ValueStamper<'a> {
-    state: &'a Value,
+pub struct ValueStamper {
+    /// Stamp state plus the global keys reassignment analysis proved constant.
+    /// A dynamic global is never in here, so any expression reading one throws
+    /// a ReferenceError in QuickJS and its binding stays live for the runtime.
+    state: Value,
     binding_regex: Regex,
     _runtime: Runtime, // Must be kept alive for context to work
     context: Context,
     components_as_is: bool,
-    /// Global state keys proven constant by reassignment analysis, mapped to the
-    /// text they stamp to. Only an `@[key]` binding whose expression is EXACTLY
-    /// one of these keys is stamped from here — never a compound expression — so
-    /// there is no risk of a dynamic operand leaking into the value.
-    constant_texts: HashMap<String, String>,
     /// Selective mode (the SPA shell): unresolvable state is runtime-owned, so
     /// unresolved attribute markers are kept instead of stripped and a
     /// conditional whose expression reads an unknown root stays raw (both
@@ -37,47 +22,46 @@ pub struct ValueStamper<'a> {
     selective: bool,
 }
 
-impl<'a> ValueStamper<'a> {
-    pub fn new(state: &'a Value, components_as_is: bool) -> Result<Self, String> {
+impl ValueStamper {
+    pub fn new(state: &Value, components_as_is: bool) -> Result<Self, String> {
         Self::with_constants(state, components_as_is, &Map::new())
     }
 
     pub fn with_constants(
-        state: &'a Value,
+        state: &Value,
         components_as_is: bool,
         constants: &Map<String, Value>,
     ) -> Result<Self, String> {
+        let mut state = state.clone();
+        state.as_object_mut().expect("stamp state is an object").extend(constants.clone());
+
         let runtime = Runtime::new().map_err(|e| format!("Failed to create QuickJS runtime: {:?}", e))?;
         let context = Context::full(&runtime).map_err(|e| format!("Failed to create QuickJS context: {:?}", e))?;
 
         // Set up state ONCE when creating the stamper (not per expression)
         context.with(|ctx| -> Result<(), String> {
-            let state_str = serde_json::to_string(state)
+            let state_str = serde_json::to_string(&state)
                 .map_err(|e| format!("Failed to serialize state: {}", e))?;
             // Expose state both as bare globals (via Object.assign) and as a
             // persistent `$` global carrying the runtime `unsafe` helper, so a
             // `@[$.unsafe(expr)]` binding stamps its trusted string raw at build
-            // time — mirroring the runtime, where `$.unsafe` marks raw HTML.
+            // time — mirroring the runtime, where `$.unsafe` wraps it in RawHtml.
             ctx.eval::<(), _>(format!(
-                "const $ = {}; Object.assign(globalThis, $); $.unsafe = (s) => s; globalThis.$ = $",
+                "const $ = {}; Object.assign(globalThis, $); \
+                 globalThis.RawHtml = class {{ constructor(html) {{ this.html = html == null ? '' : String(html) }} }}; \
+                 $.unsafe = (html) => new RawHtml(html); globalThis.$ = $",
                 state_str
             ))
                 .map_err(|e| format!("Failed to set up state in QuickJS: {:?}", e))?;
             Ok(())
         })?;
 
-        let constant_texts = constants
-            .iter()
-            .map(|(key, value)| (key.clone(), primitive_to_text(value)))
-            .collect();
-
         Ok(Self {
             state,
             binding_regex: Regex::new(r"@\[((?:[^\[\]]|\[[^\]]*\])+)\]").unwrap(),
             _runtime: runtime,
             context,
             components_as_is,
-            constant_texts,
             selective: false,
         })
     }
@@ -107,12 +91,40 @@ impl<'a> ValueStamper<'a> {
         // Then, render conditionals (resolve if/else branches)
         let html = self.render_conditionals(html)?;
 
+        // Stamp bindings only in regions that are NOT in skip_regions
+        let (mut result, unresolved) = self.stamp_bindings_tracked(&html, &self.skip_regions(&html));
+
+        // Clean up attributes that still contain unresolved markers. Selective
+        // mode keeps them: an unresolved marker there is runtime-owned state
+        // (the outlet's `src="@[page.src]"`), not an absent iteration property.
+        if !self.selective {
+            result = self.cleanup_unresolved_attributes(result, &unresolved);
+        }
+
+        // Restore vibe-dehydrate content from placeholders
+        for (i, content) in dehydrate_placeholders.iter().enumerate() {
+            let placeholder = format!("<!--VIBE_DEHYDRATE_PLACEHOLDER_{}-->", i);
+            result = result.replace(&placeholder, content);
+        }
+
+        // Finally, clean up boolean-like attributes with falsy values
+        // When components_as_is is true, skip cleanup inside component elements.
+        // Regions are measured again on the stamped HTML: stamping changes
+        // lengths, so the pre-stamp offsets point at the wrong attributes.
+        let skip_regions = self.skip_regions(&result);
+        Ok(self.cleanup_boolean_attributes(result, &skip_regions))
+    }
+
+    /// Byte ranges of the regions stamping and cleanup leave untouched:
+    /// non-reactive elements, vibe-dehydrate templates and, when
+    /// components_as_is is true, component elements.
+    fn skip_regions(&self, html: &str) -> Vec<(usize, usize)> {
         // Find all NON_REACTIVE_ELEMENT regions to skip
         let mut skip_regions: Vec<(usize, usize)> = Vec::new();
 
         for element_type in NON_REACTIVE_ELEMENTS {
             let regex = Regex::new(&format!(r"(?s)<{}[^>]*>.*?</{}>", element_type, element_type)).unwrap();
-            for mat in regex.find_iter(&html) {
+            for mat in regex.find_iter(html) {
                 skip_regions.push((mat.start(), mat.end()));
             }
         }
@@ -120,7 +132,7 @@ impl<'a> ValueStamper<'a> {
         // Skip elements with vibe-dehydrate attribute (content should not be processed)
         // This is a secondary protection in case placeholders aren't used
         let dehydrate_regex = Regex::new(&format!(r"(?s)<template[^>]*\s{}[^>]*>.*?</template>", DEHYDRATE_ATTR)).unwrap();
-        for mat in dehydrate_regex.find_iter(&html) {
+        for mat in dehydrate_regex.find_iter(html) {
             skip_regions.push((mat.start(), mat.end()));
         }
 
@@ -129,55 +141,40 @@ impl<'a> ValueStamper<'a> {
         if self.components_as_is {
             // Match <component ...>...</component>
             let component_regex = Regex::new(r"(?s)<component[^>]*>.*?</component>").unwrap();
-            for mat in component_regex.find_iter(&html) {
+            for mat in component_regex.find_iter(html) {
                 skip_regions.push((mat.start(), mat.end()));
             }
 
             // Match <div class="component" ...>...</div>
             let div_component_regex = Regex::new(r#"(?s)<div\s+class="component"[^>]*>.*?</div>"#).unwrap();
-            for mat in div_component_regex.find_iter(&html) {
+            for mat in div_component_regex.find_iter(html) {
                 skip_regions.push((mat.start(), mat.end()));
             }
         }
 
         // Sort and merge overlapping regions
         skip_regions.sort_by_key(|r| r.0);
-
-        // Stamp bindings only in regions that are NOT in skip_regions
-        let (mut result, unresolved) = self.stamp_bindings_tracked(&html, &skip_regions);
-
-        // Clean up attributes that still contain unresolved markers. Selective
-        // mode keeps them: an unresolved marker there is runtime-owned state
-        // (the outlet's `src="@[page.src]"`), not an absent iteration property.
-        if !self.selective {
-            result = self.cleanup_unresolved_attributes(result, &unresolved);
-        }
-
-        // Restore vibe-dehydrate content from placeholders
-        for (i, content) in dehydrate_placeholders.iter().enumerate() {
-            let placeholder = format!("<!--VIBE_DEHYDRATE_PLACEHOLDER_{}-->", i);
-            result = result.replace(&placeholder, content);
-        }
-
-        // Finally, clean up boolean-like attributes with falsy values
-        // When components_as_is is true, skip cleanup inside component elements
-        Ok(self.cleanup_boolean_attributes(result, &skip_regions))
+        skip_regions
     }
 
     /// Evaluate a JavaScript expression with the current state
     fn eval_expression(&self, expr: &str) -> Option<String> {
-        self.eval_with_state(expr, self.state)
+        self.eval_with_state(expr, &self.state)
     }
 
     /// Evaluate a JavaScript expression with custom state (for nested iterations)
+    /// into the HTML it stamps: escaped text, or the raw markup of `$.unsafe`.
     fn eval_with_state(&self, expr: &str, _state: &Value) -> Option<String> {
         // State is already set up in the context during new(), just evaluate the expression
         self.context.with(|ctx| -> Option<String> {
-            // Evaluate expression and convert to string
             let result: rquickjs::Value = ctx.eval(expr).ok()?;
+            let raw_html: rquickjs::Value = ctx.globals().get("RawHtml").ok()?;
+            if let Some(raw) = result.as_object().filter(|o| o.is_instance_of(&raw_html)) {
+                return raw.get("html").ok();
+            }
 
             // Convert result to string
-            if result.is_string() {
+            let text = if result.is_string() {
                 result.as_string().and_then(|s| s.to_string().ok())
             } else if result.is_number() {
                 result.as_number().map(|n| n.to_string())
@@ -191,7 +188,8 @@ impl<'a> ValueStamper<'a> {
                 // For objects/arrays, convert to JSON
                 ctx.json_stringify(result).ok()
                     .and_then(|v| v.and_then(|s| s.to_string().ok()))
-            }
+            };
+            text.map(|text| escape_html(&text))
         })
     }
 
@@ -301,7 +299,7 @@ impl<'a> ValueStamper<'a> {
 
         context.with(|ctx| -> Option<Vec<Value>> {
             // Set state properties in global scope
-            let state_str = serde_json::to_string(self.state).ok()?;
+            let state_str = serde_json::to_string(&self.state).ok()?;
             ctx.eval::<(), _>(format!("const $ = {}; Object.assign(globalThis, $)", state_str)).ok()?;
 
             // Evaluate path to get array
@@ -683,14 +681,10 @@ impl<'a> ValueStamper<'a> {
                 result.push_str(binding_match.as_str());
             } else {
                 let caps = self.binding_regex.captures(binding_match.as_str()).unwrap();
-                let expr = &caps[1];
-                // A bare reference to a proven-constant global key (`@[version]`)
-                // stamps its build-time value. Any compound expression falls
-                // through to normal evaluation, where dynamic globals stay absent
-                // and the binding is left live for the runtime.
-                if let Some(text) = self.constant_texts.get(expr.trim()) {
-                    result.push_str(text);
-                } else if let Some(stamped) = self.eval_expression(expr) {
+                // The HTML is serialized, so `=>` in a text binding reads `=&gt;`
+                // and `"` in an attribute binding reads `&quot;` — decode back to
+                // the JS the runtime evaluates.
+                if let Some(stamped) = self.eval_expression(&decode_entities(&caps[1])) {
                     result.push_str(&stamped);
                 } else {
                     unresolved.push(result.len());
@@ -791,6 +785,10 @@ impl<'a> ValueStamper<'a> {
     }
 }
 
+fn escape_html(text: &str) -> String {
+    text.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;")
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -888,6 +886,16 @@ mod tests {
         assert_eq!(result, "<p><em>x</em></p>");
     }
 
+    #[test]
+    fn stamp_escapes_quotes_and_angle_brackets() {
+        let state = json!({ "snippet": r#"<component src="/card.html"></component> & more"# });
+        let stamper = ValueStamper::new(&state, false).unwrap();
+        let html = String::from(r#"<copy-button data-value="@[snippet]">@[snippet]</copy-button>"#);
+        let result = stamper.stamp_html(html).unwrap();
+        let escaped = "&lt;component src=&quot;/card.html&quot;&gt;&lt;/component&gt; &amp; more";
+        assert_eq!(result, format!(r#"<copy-button data-value="{escaped}">{escaped}</copy-button>"#));
+    }
+
     #[test]
     fn stamp_attribute_binding() {
         let state = json!({ "firstName": "John" });
@@ -1051,5 +1059,41 @@ mod tests {
         let result = stamper.stamp_html("<x>@[version + suffix]</x>".to_string()).unwrap();
         assert!(!result.contains("0.1.5"), "constant leaked into compound: {result}");
     }
+
+    #[test]
+    fn compound_expression_over_constants_is_stamped_from_serialized_html() {
+        // An inlined component's `@[name.split…]` with `name="@[team]"` arrives
+        // as `@[(team).split…]`, its `=>` serialized to `=&gt;`.
+        let state = json!({});
+        let consts = constants(&[("team", json!("Ada Lovelace"))]);
+        let stamper = ValueStamper::with_constants(&state, false, &consts).unwrap();
+        let result = stamper
+            .stamp_html("<avatar-circle>@[(team).split(' ').map(part =&gt; part[0]).join('')]</avatar-circle>".to_string())
+            .unwrap();
+        assert_eq!(result, "<avatar-circle>AL</avatar-circle>");
+    }
+
+    #[test]
+    fn cleanup_measures_skip_regions_after_a_binding_shrinks() {
+        // The avatar's binding stamps 52 bytes down to `AL`, pulling the hint
+        // box back into where the `<pre>` sat before stamping — cleanup must
+        // still see its attributes as outside the `<pre>`.
+        let state = json!({ "gone": false, "secondary": "" });
+        let consts = constants(&[("team", json!("Ada Lovelace"))]);
+        let stamper = ValueStamper::with_constants(&state, false, &consts).unwrap();
+        let result = stamper
+            .stamp_html(
+                "<avatar-circle>@[(team).split(' ').map(part =&gt; part[0]).join('')]</avatar-circle>\
+                 <pre>npm install @ape-egg/vibe --save-dev</pre>\
+                 <hint-box gone=\"@[gone]\"><button secondary=\"@[secondary]\">Go</button></hint-box>"
+                    .to_string(),
+            )
+            .unwrap();
+        assert_eq!(
+            result,
+            "<avatar-circle>AL</avatar-circle><pre>npm install @ape-egg/vibe --save-dev</pre>\
+             <hint-box><button secondary>Go</button></hint-box>"
+        );
+    }
 }
 

package/src/compiler/watcher.rs

@@ -471,6 +471,10 @@ pub fn watch(config: Config, verbose: bool, launcher: Option<u32>) -> std::resul
                 }
             }
 
+            if let Err(e) = compiler.remove_stale_output() {
+                eprintln!("\n{}: Removing stale output failed: {}", "Warning".yellow(), e);
+            }
+
             // Show success headline
             println!("\n{}", "Initial compilation complete!".green().bold());
             println!();
@@ -525,8 +529,8 @@ pub fn watch(config: Config, verbose: bool, launcher: Option<u32>) -> std::resul
             if let Some(nm_time) = stats.node_modules_time_ms {
                 if stats.node_modules_copied_as_is {
                     println!("* copied node_modules in {:.0}ms", nm_time);
-                } else if let Some(ref pkg_manager) = stats.package_manager {
-                    println!("* {} install in {:.0}ms", pkg_manager, nm_time);
+                } else {
+                    println!("* copied dependencies in {:.0}ms", nm_time);
                 }
             }
 
@@ -879,7 +883,6 @@ pub fn watch(config: Config, verbose: bool, launcher: Option<u32>) -> std::resul
                             components_time_ms: 0.0,
                             validation_time_ms: None,
                             node_modules_time_ms: None,
-                            package_manager: None,
                             node_modules_copied_as_is: false,
                             components_as_is: config.components_as_is,
                         };

package/src/config.rs

@@ -38,6 +38,8 @@ pub struct VibeCompilerConfig {
     pub skip_files: Vec<String>,
     #[serde(default)]
     pub node_modules_as_is: bool,
+    #[serde(default = "default_modules")]
+    pub modules: String,
     #[serde(default)]
     pub components_as_is: bool,
     #[serde(default)]
@@ -73,6 +75,7 @@ fn default_output() -> String { "./compiled".to_string() }
 fn default_components() -> String { "components".to_string() }
 fn default_pages() -> String { "pages".to_string() }
 fn default_assets() -> String { "assets".to_string() }
+fn default_modules() -> String { "node_modules".to_string() }
 
 /// Get list of standard HTML5 elements + "component"
 /// Component names matching these are reserved and not allowed
@@ -118,6 +121,7 @@ impl Default for VibeCompilerConfig {
             reserved_elements: vec![],
             skip_files: vec![],
             node_modules_as_is: false,
+            modules: default_modules(),
             components_as_is: false,
             runtime_as_is: false,
             iterations_as_is: false,
@@ -145,6 +149,7 @@ pub struct Config {
     pub reserved_elements: Vec<String>,
     pub skip_files: Vec<String>,
     pub node_modules_as_is: bool,
+    pub modules: String,
     pub components_as_is: bool,
     pub runtime_as_is: bool,
     pub iterations_as_is: bool,
@@ -208,6 +213,7 @@ impl Config {
             reserved_elements,
             skip_files,
             node_modules_as_is: config.node_modules_as_is,
+            modules: config.modules,
             components_as_is: config.components_as_is,
             runtime_as_is: config.runtime_as_is,
             iterations_as_is: config.iterations_as_is,
@@ -219,6 +225,10 @@ impl Config {
         }
     }
 
+    pub fn modules_path(&self) -> PathBuf {
+        self.output.join(&self.modules)
+    }
+
     pub fn components_path(&self) -> PathBuf {
         self.source.join(&self.components)
     }

package/src/main.rs

@@ -242,6 +242,7 @@ fn main() {
         println!("  {}: {}", format!("{:<16}", "elementsAsIs").cyan(), format_bool_with_flag(config.elements_as_is, overrides.elements_as_is, original_elements_as_is));
         println!("  {}: {}", format!("{:<16}", "iterationsAsIs").cyan(), format_bool_with_flag(config.iterations_as_is, overrides.iterations_as_is, original_iterations_as_is));
         println!("  {}: {}", format!("{:<16}", "minify").cyan(), format_bool_with_flag(config.minify, overrides.minify, original_minify));
+        println!("  {}: {}", format!("{:<16}", "modules").cyan(), format_value_no_flag(&config.modules));
         println!("  {}: {}", format!("{:<16}", "nodeModulesAsIs").cyan(), format_bool_with_flag(config.node_modules_as_is, overrides.node_modules_as_is, original_node_modules_as_is));
         println!("  {}: {}", format!("{:<16}", "output").cyan(), format_value_no_flag(&config._output_str));
         println!("  {}: {}", format!("{:<16}", "pages").cyan(), format_value_no_flag(&config.pages));
@@ -291,6 +292,10 @@ fn main() {
                 }
             }
 
+            if let Err(e) = compiler.remove_stale_output() {
+                eprintln!("\n{}: Removing stale output failed: {}", "Warning".yellow(), e);
+            }
+
             // Show success headline
             println!("\n{}", format!("Compilation successful! (v{}) ✅", env!("CARGO_PKG_VERSION")).green().bold());
             println!();
@@ -345,8 +350,8 @@ fn main() {
             if let Some(nm_time) = stats.node_modules_time_ms {
                 if stats.node_modules_copied_as_is {
                     println!("* copied node_modules in {:.0}ms", nm_time);
-                } else if let Some(ref pkg_manager) = stats.package_manager {
-                    println!("* {} install in {:.0}ms", pkg_manager, nm_time);
+                } else {
+                    println!("* copied dependencies in {:.0}ms", nm_time);
                 }
             }
 

package/src/parser/html.rs

@@ -681,7 +681,7 @@ fn escape_attr_value(value: &str) -> String {
         .replace('\'', "'")
 }
 
-fn decode_entities(value: &str) -> String {
+pub(crate) fn decode_entities(value: &str) -> String {
     value
         .replace(""", "\"")
         .replace(""", "\"")