@barefootjs/blade 0.18.4 → 0.18.7

package/src/adapter/blade-adapter.ts

@@ -289,10 +289,16 @@ import {
   queryHrefArgs,
   sortComparatorFromArrow,
   isValidHelperId,
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+  resolveStaticLoopSource,
+  collectLoopBoundNames,
 } from '@barefootjs/jsx'
 import { isAriaBooleanAttr, isBooleanResultExpr, isExplicitStringCall } from './boolean-result.ts'
 import type { ParsedExpr, LoweringMatcher } from '@barefootjs/jsx'
-import { BF_SLOT, BF_COND, BF_REGION } from '@barefootjs/shared'
+import { BF_SLOT, BF_COND, BF_REGION, escapeHtml } from '@barefootjs/shared'
 
 import type { BladeRenderCtx } from './lib/types.ts'
 import { BLADE_PRIMITIVE_EMIT_MAP } from './lib/constants.ts'
@@ -308,6 +314,7 @@ import {
   collectRootScopeNodes,
 } from './lib/ir-scope.ts'
 import { renderSortMethod, renderSortEval } from './expr/array-method.ts'
+import { staticValueToBlade } from './lib/static-value.ts'
 import { BladeFilterEmitter, BladeTopLevelEmitter, truthyTest } from './expr/emitters.ts'
 import type { BladeEmitContext, BladeSpreadContext, BladeMemoContext } from './emit-context.ts'
 import {
@@ -356,6 +363,14 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
   private options: Required<BladeAdapterOptions>
   private errors: CompilerError[] = []
   private inLoop: boolean = false
+  /**
+   * `IRLoop.depth` of the loop currently being rendered (save/restore
+   * around `renderChildren(loop.children)`, mirroring `inLoop` above).
+   * `renderAttributes` reads this to derive the `key` → `data-key`/
+   * `data-key-N` suffix — the depth is IR-computed (jsx-to-ir.ts), not
+   * re-derived here (#2168 nested-loop-outer-binding).
+   */
+  private currentLoopKeyDepth = 0
   /**
    * SolidJS-style props identifier (`function(props: P)`) and the
    * analyzer-extracted prop names. Stashed at `generate()` entry so the
@@ -409,6 +424,17 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
    */
   private localConstants: IRMetadata['localConstants'] = []
 
+  /**
+   * Every name a `.map()`/`.filter()` loop callback binds as its item/index
+   * parameter anywhere in the component (#2208 fable review). A static
+   * loop-SOURCE name (e.g. a function-scope `const items = [...]`) must
+   * never resolve through `resolveStaticLoopSource` at a use site where a
+   * DIFFERENT, enclosing loop's own callback param shadows it — same
+   * shadowing hazard, and same coarse-but-safe mitigation, as #2212's
+   * `collectLoopBoundNames` use in `collectStringValueNames`.
+   */
+  private staticLoopSourceBoundNames: Set<string> = new Set()
+
   /**
    * Optional, no-default props that are `None` when the caller omits them.
    * Their bare-reference attribute emission is guarded with a Blade
@@ -441,6 +467,7 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
     // ("1"/"") (#1897, pagination's data-active).
     this.booleanTypedProps = collectBooleanTypedProps(ir)
     this.localConstants = ir.metadata.localConstants ?? []
+    this.staticLoopSourceBoundNames = collectLoopBoundNames(ir)
     this.nullableOptionalProps = collectNullableOptionalProps(ir)
     this.stringValueNames = collectStringValueNames(ir)
     this.moduleStringConsts = collectModuleStringConsts(ir.metadata.localConstants)
@@ -550,7 +577,9 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
   }
 
   emitText(node: IRText): string {
-    return node.value
+    // IRText carries the entity-DECODED value (Phase 1 decodes JSX
+    // character references); re-escape for direct HTML emission.
+    return escapeHtml(node.value)
   }
 
   emitExpression(node: IRExpression): string {
@@ -659,7 +688,8 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
   renderElement(element: IRElement): string {
     const tag = element.tag
     const attrs = this.renderAttributes(element)
-    const children = this.renderChildren(element.children)
+    const dangerousHtml = this.renderDangerousInnerHtml(element)
+    const children = dangerousHtml !== null ? dangerousHtml : this.renderChildren(element.children)
 
     let hydrationAttrs = ''
     if (element.needsScope) {
@@ -694,6 +724,35 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
     return `<${tag}${attrs}${hydrationAttrs}>${children}</${tag}>`
   }
 
+  /**
+   * `dangerouslySetInnerHTML={{ __html: '...' }}` (#2207) — replaces the
+   * element's normal children with a compile-time-literal raw-HTML string,
+   * spliced directly as template text (never through a `{!! !!}`-style
+   * runtime raw-output primitive: the value is already fully known at
+   * compile time, so no runtime escape hatch is needed, and using one would
+   * reopen a template-source injection surface for no benefit). Returns
+   * `null` when the attribute is absent (caller falls through to normal
+   * `renderChildren`); a non-`null` string (possibly `''`) means the caller
+   * must use it as-is instead — including the dynamic/guard-violation
+   * refusal cases, where the empty string is safe filler for a compile that
+   * fails anyway.
+   */
+  private renderDangerousInnerHtml(element: IRElement): string | null {
+    const resolution = resolveDangerousInnerHtml(element)
+    if (!resolution) return null
+    if (resolution.kind === 'dynamic') {
+      this.errors.push(dangerousInnerHtmlDiagnostic(resolution.expr, resolution.loc))
+      return ''
+    }
+    const violation = dangerousInnerHtmlMetacharViolation(resolution.html, this.name)
+    if (violation) {
+      const attr = element.attrs.find(isDangerousInnerHtmlAttr)!
+      this.errors.push(dangerousInnerHtmlDiagnostic(`{ __html: ${JSON.stringify(resolution.html)} }`, attr.loc, violation))
+      return ''
+    }
+    return resolution.html
+  }
+
   // ===========================================================================
   // Expression Rendering
   // ===========================================================================
@@ -707,8 +766,13 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
     }
 
     // Text-position interpolation of a possibly-non-string value — see the
-    // file header, "Stringification" (carried unchanged from Twig).
-    const bladeExpr = `$bf->string(${this.convertExpressionToBlade(expr.expr)})`
+    // file header, "Stringification" (carried unchanged from Twig). Thread
+    // the IR-carried `.parsed` tree through (mirrors go-template's
+    // `convertExpressionToGo(expr.expr, classify, expr.parsed)`) so a
+    // resolved bare-identifier `.map`/`.filter`/… callback
+    // (`resolveCallbackMethodFunctionReferences`, #2206) isn't lost to a
+    // fresh, unresolved re-parse of the raw string.
+    const bladeExpr = `$bf->string(${this.convertExpressionToBlade(expr.expr, expr.parsed)})`
 
     if (expr.slotId) {
       return `{!! $bf->text_start("${expr.slotId}") !!}{!! e(${bladeExpr}) !!}{!! $bf->text_end() !!}`
@@ -853,8 +917,27 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
     // corpus only because the widened destructure gate (#2087 Phase A/B)
     // no longer refuses this fixture's `([emoji, users]) => ...` param
     // first. Same policy and shape as the Jinja / ERB adapters' check.
+    // #2208: a loop source that is a fully-static array literal — either
+    // inline (`[{ label: 'Alpha' }, ...].map(...)`) or a bare identifier
+    // bound to a FUNCTION-scope local const whose initializer has no
+    // prop/signal/function-call dependency — inlines as a native PHP
+    // array literal below, the same way a module-scope const's value is
+    // already seeded. A runtime-computed local (#2069, e.g.
+    // `Object.entries(props.tags).filter(...)`) still refuses below.
+    // `isNameShadowed` guards a DIFFERENT, enclosing loop's own callback
+    // param shadowing this identifier (fable review) — never resolve the
+    // static const in that case. `rawArray` then falls through to the
+    // bare identifier expression below, same as before #2208 — which
+    // still trips the pre-existing BF101 gate for an unresolvable local
+    // const reference (a loud, conservative refusal, not a silent wrong
+    // value).
+    const staticItems = resolveStaticLoopSource(loop.arrayParsed, this.localConstants, {
+      isNameShadowed: name => this.staticLoopSourceBoundNames.has(name),
+    })
+    const staticArray = staticItems !== null ? staticValueToBlade(staticItems) : null
+
     const arrayName = loop.array.trim()
-    if (/^[A-Za-z_$][\w$]*$/.test(arrayName)) {
+    if (staticArray === null && /^[A-Za-z_$][\w$]*$/.test(arrayName)) {
       const arrayConst = (this.localConstants ?? []).find(c => c.name === arrayName)
       if (arrayConst && !arrayConst.isModule && this._resolveLiteralConst(arrayName) === null) {
         this.errors.push({
@@ -870,7 +953,7 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
       }
     }
 
-    const rawArray = this.convertExpressionToBlade(loop.array)
+    const rawArray = staticArray ?? this.convertExpressionToBlade(loop.array)
     // Apply sort if present: wrap the loop array in the shared `$bf->sort`
     // helper, binding the sorted result to a per-iteration local so the
     // helper runs once.
@@ -922,7 +1005,11 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
     //     other than member-access / spread (already refused by the gate)
     //     can't observe a sibling field the pattern destructured explicitly.
     const indexLocalLines: string[] = []
-    if (loop.iterationShape === 'keys') {
+    if (loop.objectIteration) {
+      // `key`/`value` bind directly in the `@foreach` header (see below)
+      // via `$bf->entries`/`$bf->keys`/`$bf->values` — no derived
+      // `$loop->index` local needed, unlike the array `iterationShape` cases.
+    } else if (loop.iterationShape === 'keys') {
       indexLocalLines.push(`@php(${bladeVar(param)} = $loop->index)`)
     } else if (loop.index) {
       indexLocalLines.push(`@php(${bladeVar(loop.index)} = $loop->index)`)
@@ -950,10 +1037,13 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
 
     const prevInLoop = this.inLoop
     this.inLoop = true
+    const prevLoopKeyDepth = this.currentLoopKeyDepth
+    this.currentLoopKeyDepth = loop.depth
     // Re-render children now that inLoop is set (so nested components use the
     // loop-child naming convention). renderedChildren above was computed with
     // the previous flag; recompute under the loop flag.
     const childrenUnderLoop = this.renderChildren(loop.children)
+    this.currentLoopKeyDepth = prevLoopKeyDepth
     this.inLoop = prevInLoop
     void renderedChildren
 
@@ -973,7 +1063,23 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
     // See this file's header, divergence 2: raw PHP `foreach` over a
     // null/undefined array raises, unlike Twig's `strict_variables: false`
     // tolerance — the `?? []` guard restores that same tolerance uniformly.
-    lines.push(`@foreach((${array} ?? []) as ${bladeVar(loopVar)})`)
+    //
+    // `objectIteration` (#2168 object-entries-map): PHP's native `foreach`
+    // CAN iterate a `stdClass` object's public properties directly (unlike
+    // Twig's `for` tag, which needs `Traversable`) — but this still routes
+    // through `$bf->entries`/`$bf->keys`/`$bf->values` for the same
+    // defensive non-object guard Twig needs and for a single source of
+    // truth on "is this a JS object" (`isJsObject`, `BarefootJS.php`); the
+    // `(array)` cast those methods do preserves the object's own insertion
+    // order either way.
+    const forHeader = loop.objectIteration === 'entries'
+      ? `@foreach($bf->entries(${array} ?? []) as ${bladeVar(loop.index ?? param)} => ${bladeVar(param)})`
+      : loop.objectIteration === 'keys'
+        ? `@foreach($bf->keys(${array} ?? []) as ${bladeVar(param)})`
+        : loop.objectIteration === 'values'
+          ? `@foreach($bf->values(${array} ?? []) as ${bladeVar(param)})`
+          : `@foreach((${array} ?? []) as ${bladeVar(loopVar)})`
+    lines.push(forHeader)
     for (const il of indexLocalLines) lines.push(il)
 
     // Handle filter().map() pattern by wrapping children in if-condition
@@ -1114,11 +1220,37 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
     type Segment = { kind: 'entries'; parts: string[] } | { kind: 'spread'; expr: string }
     const segments: Segment[] = [{ kind: 'entries', parts: [] }]
     const currentEntries = () => this.componentPropSegmentEntries(segments)
+    // Named JSX-valued props OTHER than the reserved `children`
+    // (`header={<strong>Title</strong>}`, #2168 jsx-element-prop) each get
+    // their own output-buffering capture, prepended to the final returned
+    // string below — same mechanism as the reserved children capture,
+    // just keyed by the prop's own name instead of `children`.
+    const namedSlotCaptures: string[] = []
 
     for (const p of comp.props) {
       // Skip callback props (onXxx) and `ref` — both are client-only for
       // SSR (Hono renders neither; the client JS wires them at hydration).
       if ((p.name.match(/^on[A-Z]/) || p.name === 'ref') && p.value.kind === 'expression') continue
+      if (p.value.kind === 'jsx-children' && p.name !== 'children') {
+        const prevInLoop = this.inLoop
+        this.inLoop = false
+        const slotBody = this.renderChildren(p.value.children)
+        this.inLoop = prevInLoop
+        // Purely counter-based — NOT derived from `p.name` or `comp.slotId`.
+        // A JSX prop name can contain characters (`data-slot`) `bladeIdent`
+        // doesn't sanitize (it only guards reserved words), producing an
+        // invalid PHP variable name; `comp.slotId` alone would also collide
+        // across two named-slot props on the same component invocation
+        // (unlike the reserved children slot, there's only ever one of
+        // those per invocation).
+        const captureVar = bladeVar(`bf_prop_${this.childrenCaptureCounter++}`)
+        namedSlotCaptures.push(
+          `@php(ob_start())\n${slotBody}\n` +
+          `@php(${captureVar} = $bf->backend->mark_raw(preg_replace('/\\n\\z/', '', ob_get_clean(), 1)))`,
+        )
+        currentEntries().push(`${bladeHashKey(p.name)} => ${captureVar}`)
+        continue
+      }
       if (p.value.kind === 'spread') {
         const trimmed = p.value.expr.trim()
         // SolidJS-style props identifier (`function(props: P)`) has no
@@ -1193,6 +1325,7 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
       currentEntries().push(`${bladeHashKey('children')} => ${captureVar}`)
       const dict = this.combineComponentPropSegments(segments)
       return (
+        namedSlotCaptures.join('') +
         `@php(ob_start())\n${childrenBody}\n` +
         `@php(${captureVar} = $bf->backend->mark_raw(preg_replace('/\\n\\z/', '', ob_get_clean(), 1)))` +
         `{!! $bf->render_child('${tplName}', ${dict}) !!}`
@@ -1201,7 +1334,7 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
 
     const isEmpty = segments.every(s => s.kind === 'entries' && s.parts.length === 0)
     const dictEntries = isEmpty ? '' : `, ${this.combineComponentPropSegments(segments)}`
-    return `{!! $bf->render_child('${tplName}'${dictEntries}) !!}`
+    return `${namedSlotCaptures.join('')}{!! $bf->render_child('${tplName}'${dictEntries}) !!}`
   }
 
   private childrenCaptureCounter = 0
@@ -1291,7 +1424,7 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
    * AttrValue lowering for intrinsic-element attributes (Blade).
    */
   private readonly elementAttrEmitter: AttrValueEmitter = {
-    emitLiteral: (value, name) => `${name}="${value.value}"`,
+    emitLiteral: (value, name) => `${name}="${escapeHtml(value.value)}"`,
     emitExpression: (value, name) => {
       // `style={{ … }}` object literal → a CSS string with dynamic values
       // interpolated, instead of refusing the bare object with BF101 (#1322).
@@ -1494,10 +1627,19 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
       // the unsupported-expression lowering is never reached for a deferred
       // predicate (no BF101 / BF102). #1966
       if (attr.clientOnly) continue
+      // `dangerouslySetInnerHTML` never renders as an HTML attribute — it's
+      // handled by `renderDangerousInnerHtml` instead, which replaces the
+      // element's children. Skip it here so its `{ __html: ... }` object
+      // literal never reaches `refuseUnsupportedAttrExpression`'s generic
+      // BF101 (which would double-report alongside the purpose-built one).
+      if (isDangerousInnerHtmlAttr(attr)) continue
       // Rewrite JSX special-prop names to their HTML-attribute counterparts.
       let attrName: string
       if (attr.name === 'className') attrName = 'class'
-      else if (attr.name === 'key') attrName = 'data-key'
+      else if (attr.name === 'key') {
+        const depth = this.currentLoopKeyDepth
+        attrName = depth > 0 ? `data-key-${depth}` : 'data-key'
+      }
       else attrName = attr.name
       const lowered = emitAttrValue(attr.value, this.elementAttrEmitter, attrName)
       if (lowered) parts.push(lowered)
@@ -1861,8 +2003,19 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
    * single-quoted string literal (`const totalPages = 5`, #1897
    * pagination) — function-scope consts never reach the per-render
    * context, so a bare reference would resolve to an undefined variable.
+   *
+   * The lookup is a flat name match with no notion of AST scope, so a
+   * name that any loop callback binds as its item/index param never
+   * inlines (#2221) — the occurrence may be the loop's own (shadowing)
+   * binding, and substituting the outer const's value there renders every
+   * iteration with the same hard-coded literal. Coarse (a genuinely
+   * non-shadowed same-named const elsewhere in the component also stops
+   * inlining, falling back to the bare identifier) but safe — the same
+   * trade-off as #2212's `collectLoopBoundNames` use in
+   * `collectStringValueNames`.
    */
   private _resolveLiteralConst(name: string): string | null {
+    if (this.staticLoopSourceBoundNames.has(name)) return null
     const c = (this.localConstants ?? []).find(lc => lc.name === name)
     if (c?.value === undefined) return null
     const v = c.value.trim()
@@ -1872,7 +2025,22 @@ export class BladeAdapter extends BaseAdapter implements IRNodeEmitter<BladeRend
     return null
   }
 
+  /**
+   * Resolve `IDENT.key` where `IDENT` is a module-scope object-literal const
+   * (`variantClasses.ghost`, #1896/#1897) to the looked-up scalar.
+   *
+   * The lookup is a flat name match on `objectName` with no notion of AST
+   * scope, so an enclosing loop callback's own param of the same name
+   * (`.map((cfg) => <li>{cfg.x}</li>)` shadowing a module `const cfg = {…}`)
+   * still resolved to the OUTER const's member value at every iteration
+   * (#2237) — the sibling hazard to #2221's `_resolveLiteralConst`. Same
+   * coarse-but-safe `staticLoopSourceBoundNames` guard: any name a loop
+   * binds anywhere in the component never inlines, falling back to the bare
+   * `data_get($cfg, 'x')` member expression (which a Blade `@foreach`
+   * binds correctly at the shadowed occurrences).
+   */
   private _resolveStaticRecordLiteral(objectName: string, key: string): string | null {
+    if (this.staticLoopSourceBoundNames.has(objectName)) return null
     const hit = lookupStaticRecordLiteral(objectName, key, this.localConstants)
     if (!hit) return null
     return hit.kind === 'number'

package/src/adapter/expr/array-method.ts

@@ -90,6 +90,15 @@ export function renderArrayMethod(
       const recv = emit(object)
       return `$bf->trim(${recv})`
     }
+    case 'trimStart':
+    case 'trimEnd': {
+      // `.trimStart()` / `.trimEnd()` — the one-sided siblings of
+      // `.trim()` (#2183 follow-up). Dedicated `$bf->trim_start` /
+      // `$bf->trim_end` helpers, not `$bf->trim` with a flag.
+      const fn = method === 'trimStart' ? 'trim_start' : 'trim_end'
+      const recv = emit(object)
+      return `$bf->${fn}(${recv})`
+    }
     case 'toFixed': {
       // `.toFixed(digits?)` — `$bf->to_fixed` mirrors JS rounding +
       // zero-padding (default 0 digits). #1897.
@@ -125,6 +134,16 @@ export function renderArrayMethod(
       const newS = emit(args[1])
       return `$bf->replace(${recv}, ${oldS}, ${newS})`
     }
+    case 'replaceAll': {
+      // `.replaceAll(old, new)` — string-pattern form, EVERY occurrence,
+      // via the dedicated `$bf->replace_all` helper (not `$bf->replace`
+      // with a flag) — the regex-pattern form is refused upstream at
+      // the parser, same as `.replace`. See #2182.
+      const recv = emit(object)
+      const oldS = emit(args[0])
+      const newS = emit(args[1])
+      return `$bf->replace_all(${recv}, ${oldS}, ${newS})`
+    }
     case 'repeat': {
       const recv = emit(object)
       const count = args.length === 0 ? '0' : emit(args[0])

package/src/adapter/expr/emitters.ts

@@ -176,7 +176,7 @@ export class BladeFilterEmitter implements ParsedExprEmitter {
     return String(value)
   }
 
-  member(object: ParsedExpr, property: string, _computed: boolean, emit: (e: ParsedExpr) => string): string {
+  member(object: ParsedExpr, property: string, _computed: boolean, _optional: boolean, emit: (e: ParsedExpr) => string): string {
     // `.length` — route through `$bf->length` (handles both array element
     // count and string char count, JS-compatibly).
     if (property === 'length') {
@@ -346,7 +346,7 @@ export class BladeTopLevelEmitter implements ParsedExprEmitter {
     return String(value)
   }
 
-  member(object: ParsedExpr, property: string, _computed: boolean, emit: (e: ParsedExpr) => string): string {
+  member(object: ParsedExpr, property: string, _computed: boolean, _optional: boolean, emit: (e: ParsedExpr) => string): string {
     // `props.x` flattens to the bare context var the SSR caller binds each
     // prop to (props arrive as individual top-level context entries, not a
     // nested `props` hash).

package/src/adapter/lib/constants.ts

@@ -22,6 +22,9 @@ export const BLADE_TEMPLATE_PRIMITIVES: Record<string, PrimitiveSpec> = {
   'Math.floor':     { arity: 1, emit: (args) => `$bf->floor(${args[0]})` },
   'Math.ceil':      { arity: 1, emit: (args) => `$bf->ceil(${args[0]})` },
   'Math.round':     { arity: 1, emit: (args) => `$bf->round(${args[0]})` },
+  'Math.min':       { arity: 2, emit: (args) => `$bf->min(${args[0]}, ${args[1]})` },
+  'Math.max':       { arity: 2, emit: (args) => `$bf->max(${args[0]}, ${args[1]})` },
+  'Math.abs':       { arity: 1, emit: (args) => `$bf->abs(${args[0]})` },
 }
 
 /**

package/src/adapter/lib/static-value.ts

@@ -0,0 +1,39 @@
+/**
+ * Serialize a compile-time-evaluated JS value (`@barefootjs/jsx`'s
+ * `evaluateStaticLiteral`/`resolveStaticLoopSource`, #2208) into a native
+ * PHP literal. Used to inline a fully-static loop source (an inline array
+ * literal, or a function-scope local const with a static initializer)
+ * directly in a `@foreach` header, rather than requiring a bound template
+ * variable.
+ *
+ * Returns `null` for a value this adapter can't represent as a literal —
+ * the caller falls back to its existing BF101 refusal instead of guessing.
+ */
+
+import { escapeBladeSingleQuoted, bladeHashKey } from './blade-naming.ts'
+
+export function staticValueToBlade(value: unknown): string | null {
+  if (value === null || value === undefined) return 'null'
+  if (typeof value === 'boolean') return value ? 'true' : 'false'
+  if (typeof value === 'number') return String(value)
+  if (typeof value === 'string') return `'${escapeBladeSingleQuoted(value)}'`
+  if (Array.isArray(value)) {
+    const items: string[] = []
+    for (const el of value) {
+      const serialized = staticValueToBlade(el)
+      if (serialized === null) return null
+      items.push(serialized)
+    }
+    return `[${items.join(', ')}]`
+  }
+  if (typeof value === 'object') {
+    const entries: string[] = []
+    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
+      const serialized = staticValueToBlade(val)
+      if (serialized === null) return null
+      entries.push(`${bladeHashKey(key)} => ${serialized}`)
+    }
+    return `[${entries.join(', ')}]`
+  }
+  return null
+}

package/src/adapter/props/prop-classes.ts

@@ -6,7 +6,7 @@
  * sets the adapter consults during lowering. No adapter instance state.
  */
 
-import type { ComponentIR } from '@barefootjs/jsx'
+import { collectLoopBoundNames, type ComponentIR } from '@barefootjs/jsx'
 import { isStringTypeInfo, isBareStringLiteral } from '../value/parsed-literal.ts'
 
 /**
@@ -43,14 +43,31 @@ export function collectNullableOptionalProps(ir: ComponentIR): Set<string> {
 }
 
 /**
- * String-typed signals and props. A signal is string-typed when its inferred
- * type is `string` (or, defensively, when its initial value is a bare string
- * literal); a prop when its annotated type is `string`. In the Mojo adapter
- * this drives `eq`/`ne` selection for string equality; the Blade emitters
- * don't consume the distinction — `===`/`!==` ALWAYS route through
- * `bf.eq`/`bf.neq` regardless of operand type (see
- * `expr/emitters.ts`'s file header, divergence 4) — so this set is carried
- * only for parity with the Perl-family adapters.
+ * String-typed signals, props, and same-file local consts (#2212). A
+ * signal is string-typed when its inferred type is `string` (or,
+ * defensively, when its initial value is a bare string literal); a prop
+ * when its annotated type is `string`; a local const the same way. Consumed
+ * by `isStringConcatBinary`/`isStringTypedOperand` (`@barefootjs/jsx`) to
+ * pick `.` over JS `+`'s numeric fallback (#2163, #2212) — including now
+ * for a bare identifier operand, not just a prop/getter/literal. In the
+ * Mojo adapter this ALSO drives `eq`/`ne` selection for string equality;
+ * the Blade emitters don't consume the distinction there — `===`/`!==`
+ * ALWAYS route through `bf.eq`/`bf.neq` regardless of operand type (see
+ * `expr/emitters.ts`'s file header, divergence 4) — so that half of this
+ * set is carried only for parity with the Perl-family adapters.
+ *
+ * Excludes any name bound as a `.map()`/`.filter()` loop callback's item
+ * or index parameter ANYWHERE in the component (Fable review, #2212): the
+ * lookup below is a flat, scope-blind `Set<string>` with no notion of a
+ * loop param shadowing an outer string-typed binding of the same name
+ * (`items.map((name) => 1 + name)` inside a component that also has a
+ * string `name` prop) — left unguarded, that shadowed `name` would be
+ * misdetected as string-typed and `1 + name` would silently lower to `.`
+ * instead of staying numeric `+`. Subtracting loop-bound names is coarse
+ * (it also suppresses a genuinely non-shadowed same-named string
+ * elsewhere in the component) but safe: the suppressed case just falls
+ * back to today's numeric `+` — the same, already-accepted residual as an
+ * unresolvable operand — never silently-wrong output.
  */
 export function collectStringValueNames(ir: ComponentIR): Set<string> {
   const names = new Set<string>()
@@ -62,5 +79,9 @@ export function collectStringValueNames(ir: ComponentIR): Set<string> {
   for (const p of ir.metadata.propsParams) {
     if (isStringTypeInfo(p.type)) names.add(p.name)
   }
+  for (const c of ir.metadata.localConstants) {
+    if (isStringTypeInfo(c.type ?? undefined) || isBareStringLiteral(c.value)) names.add(c.name)
+  }
+  for (const bound of collectLoopBoundNames(ir)) names.delete(bound)
   return names
 }

package/src/conformance-pins.ts

@@ -11,15 +11,17 @@
 import type { ConformancePins } from '@barefootjs/jsx'
 
 export const conformancePins: ConformancePins = {
-  // Sibling-imported child component in a loop body: emits a
-  // cross-template call needing separate registration. BF103 makes
-  // the requirement loud (same as Jinja).
-  'static-array-children': [{ code: 'BF103', severity: 'error' }],
-  // TodoApp / TodoAppSSR import `TodoItem` from a sibling file and
-  // call it inside a keyed `.map`. Same BF103 (imported child in
-  // `.map`) as Jinja.
-  'todo-app': [{ code: 'BF103', severity: 'error' }],
-  'todo-app-ssr': [{ code: 'BF103', severity: 'error' }],
+  // `todo-app` / `todo-app-ssr` no longer pinned (#2205) — the conformance
+  // harness now passes `siblingTemplatesRegistered: true` for fixtures with
+  // sibling `components`, matching `bf build`'s real semantics, so the
+  // BF103 loop-body cross-template check no longer fires spuriously. (Both
+  // fixtures are still skipped on this adapter via `render-divergences.ts`
+  // — #2209 — for an unrelated signal-seeding gap.)
+  // `static-array-children` no longer pinned (#2208) — `items`'s
+  // array-literal initializer is now recognized as fully-static
+  // (`resolveStaticLoopSource`) and inlined as a native PHP array literal
+  // in the `@foreach` header, the same way a module-scope const's value is
+  // already seeded.
   // The `([emoji, users]) => …` array-destructure param itself now lowers
   // (#2087 Phase B — see the destructure comment below), but the loop
   // ARRAY is a function-scope computed const (`const entries =
@@ -28,12 +30,10 @@ export const conformancePins: ConformancePins = {
   // check and policy as Jinja / ERB) instead of silently iterating zero
   // times over an unbound name.
   'static-array-from-props': [{ code: 'BF101', severity: 'error' }],
-  // Both BF103 (imported child) and BF101 (computed local-const loop
-  // array, as above) fire.
-  'static-array-from-props-with-component': [
-    { code: 'BF103', severity: 'error' },
-    { code: 'BF101', severity: 'error' },
-  ],
+  // BF101 (computed local-const loop array, as above) fires; BF103
+  // (imported child in the loop body) no longer does now that the
+  // conformance harness passes `siblingTemplatesRegistered: true` (#2205).
+  'static-array-from-props-with-component': [{ code: 'BF101', severity: 'error' }],
   // #2087 Phase B: every `.map()` destructure shape in the shared corpus
   // now lowers on Blade via an `@php(...)` local built from the binding's
   // structured `segments` path (`bladeLoopBindingAccessor` in
@@ -76,22 +76,14 @@ export const conformancePins: ConformancePins = {
   // / etc. via the same evaluator-JSON mechanism as `.filter` / `.every` /
   // `.some`, so they render. Only the NESTED-in-a-predicate form above is
   // refused (#2038).
-  // #2073 follow-up (same as Jinja): a function-reference `.map(format)`
-  // callback has no arrow body to serialize — not a CALLBACK_METHODS shape
-  // (`asCallbackMethodCall` requires an arrow argument) — so the shared
-  // `isSupported`'s `UNSUPPORTED_METHODS` gate refuses it with the generic
-  // "Expression not supported" BF101 rather than emitting a broken
-  // template.
-  'array-map-function-reference': [{ code: 'BF101', severity: 'error' }],
-  // Edge-case sweep (Priority 12): `dangerouslySetInnerHTML` requires a
-  // deliberate raw-HTML (unescaped) output affordance in the target
-  // template language. No lowering exists yet, so the compiler refuses
-  // the shape loudly instead of emitting entity-escaped markup that
-  // silently renders tags as text.
-  'dangerous-inner-html': [{ code: 'BF101', severity: 'error' }],
-  // Edge-case sweep (Priority 12): `.replaceAll` has no lowering yet —
-  // only first-occurrence `.replace` is wired to the runtime helpers.
-  // Refused with BF101 rather than reusing the first-only lowering,
-  // which would silently change semantics.
-  'string-replaceall': [{ code: 'BF101', severity: 'error' }],
+  // `array-map-function-reference` no longer pinned — a bare-identifier
+  // `.map(format)` callback now resolves one hop to its declaration
+  // (`resolveCallbackMethodFunctionReferences`, #2206), the same mechanism
+  // #2090 established for `.sort(fnref)`.
+  // `dangerous-inner-html` no longer pinned — a compile-time string-literal
+  // `dangerouslySetInnerHTML={{ __html: '...' }}` is spliced directly into
+  // the template as trusted raw text (`resolveDangerousInnerHtml`, #2207).
+  // A dynamic/signal-derived value still refuses with BF101 — see the
+  // `dangerous-inner-html-dynamic` fixture/pin below (tracked: #2215).
+  'dangerous-inner-html-dynamic': [{ code: 'BF101', severity: 'error', issue: 'https://github.com/piconic-ai/barefootjs/issues/2215' }],
 }

package/src/render-divergences.ts

@@ -15,20 +15,8 @@
 import type { RenderDivergences } from '@barefootjs/jsx'
 
 export const renderDivergences: RenderDivergences = {
-  'html-entity-text':
-    '`©` in JSX literal text: Hono decodes to `©`, this adapter re-emits the raw entity — same DOM, different bytes',
-  'math-methods':
-    'Math.min/max/abs over a signal render empty (only Math.floor is in the template-primitive registry)',
-  'static-attr-escape':
-    'static attribute values are not HTML-escaped (`title="Fish & Chips"` emitted raw; Hono escapes)',
-  'object-entries-map':
-    '`Object.entries(prop).map(([k, v]) => …)` renders an EMPTY list — the object-shaped prop silently produces zero iterations',
-  'nested-loop-outer-binding':
-    'nested-loop inner items carry `data-key` where the reference emits the depth-suffixed `data-key-1`',
-  'jsx-element-prop':
-    'a JSX element passed as a NON-children prop renders an empty slot — the element value is silently dropped',
-  'string-slice':
-    '`.slice()` on a STRING renders empty (array-slice helper misfires on strings)',
-  'string-trim-sided':
-    '`.trimStart()` / `.trimEnd()` render empty (no lowering)',
+  // `todo-app` / `todo-app-ssr` no longer diverge (#2209) — the shared
+  // `evaluateSignalInit` (`@barefootjs/jsx`, sandboxed real-JS evaluation
+  // instead of a fixed regex-shape catalogue) now correctly seeds `todos`
+  // from `(props.initialTodos ?? []).map(t => ({ ...t, editing: false }))`.
 }