@barefootjs/client 0.5.2 → 0.5.3

package/dist/runtime/apply-rest-attrs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-rest-attrs.d.ts","sourceRoot":"","sources":["../../src/runtime/apply-rest-attrs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,OAAO,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EAAE,GACpB,IAAI,CA4DN"}
+{"version":3,"file":"apply-rest-attrs.d.ts","sourceRoot":"","sources":["../../src/runtime/apply-rest-attrs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,OAAO,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EAAE,GACpB,IAAI,CAkEN"}

package/dist/runtime/branch-slot.d.ts

@@ -1,22 +1,2 @@
-/**
- * Branch-template slot helper (#1213).
- *
- * Conditional `template()` arrows interpolate Child-position expressions
- * via `${expr}`. When `expr` evaluates to a live `Node` (e.g. the result
- * of `_p.renderNode(node())` returning an `HTMLElement` from
- * `createComponent`), the surrounding template literal coerces it via
- * `Object.prototype.toString`, producing `"[object HTMLDivElement]"` and
- * destroying the live node identity on hydration.
- *
- * `__bfSlot` intercepts the value before stringification: if it's a
- * `Node`, it stashes the node into the closure-scoped `slots` array and
- * returns a unique marker comment. The `insert()` runtime then walks the
- * parsed fragment for those markers and splices the original node back
- * in by identity (no `cloneNode`), preserving event listeners and signal
- * bindings.
- *
- * Non-node values fall through to `String(value)` for the existing
- * inline-string path.
- */
 export declare function __bfSlot(value: unknown, slots: Node[]): string;
 //# sourceMappingURL=branch-slot.d.ts.map

package/dist/runtime/branch-slot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch-slot.d.ts","sourceRoot":"","sources":["../../src/runtime/branch-slot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAW9D"}
+{"version":3,"file":"branch-slot.d.ts","sourceRoot":"","sources":["../../src/runtime/branch-slot.ts"],"names":[],"mappings":"AA2BA,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAW9D"}

package/dist/runtime/component.d.ts

@@ -81,6 +81,28 @@ export declare function renderChild(name: string, props: Record<string, unknown>
  * back to ">" in the DOM attribute value, preserving CSS matching.
  */
 export declare function escapeAttrGt(html: string): string;
+/**
+ * HTML-escape a single attribute *value* before it is concatenated into a
+ * client-rendered template string. Matches the SSR adapters' attribute
+ * escaping (Hono's `escapeToBuffer`: `& " ' < >`) so client-rendered DOM
+ * is byte-identical to the server-rendered form and metacharacter-bearing
+ * values (UnoCSS `[class*="size-"]`, `has-[>svg]`, …) don't corrupt
+ * attribute parsing when the template is inserted via `innerHTML`. `&` is
+ * replaced first so the emitted entities aren't themselves re-escaped.
+ */
+export declare function escapeAttr(value: unknown): string;
+/**
+ * HTML-escape interpolated **text content** before it is concatenated into
+ * a client-rendered template string (the `<!--bf:sN-->…<!--/-->` text
+ * slots). The HTML spec only requires `& < >` in text, but the SSR
+ * adapters (Hono) escape text with the same set as attribute values
+ * (`& " ' < >`), and the fixture-hydrate / CSR-conformance layer requires
+ * byte-parity with the server-rendered output — so this delegates to
+ * `escapeAttr`. Kept as a distinct export so generated code reads
+ * `escapeText(...)` at text sites (self-documenting) and so the two
+ * contexts can diverge later without touching call sites.
+ */
+export declare function escapeText(value: unknown): string;
 /**
  * Parse an HTML string into a DocumentFragment, safely escaping ">" in
  * attribute values. All code that sets innerHTML on dynamic HTML should

package/dist/runtime/component.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"component.d.ts","sourceRoot":"","sources":["../../src/runtime/component.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAS3C,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAExD;AAWD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,YAAY,EAChC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EACrB,IAAI,CAAC,EAAE,uBAAuB,GAC7B,WAAW,CAyIb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAE3F;AAuBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAE7G;AAGD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CAiDR;AA+DD;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,gBAAgB,CAcjF"}
+{"version":3,"file":"component.d.ts","sourceRoot":"","sources":["../../src/runtime/component.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAS3C,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAExD;AAWD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,YAAY,EAChC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EACrB,IAAI,CAAC,EAAE,uBAAuB,GAC7B,WAAW,CAyIb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAE3F;AAuBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAE7G;AAGD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CAiDR;AA+DD;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEjD;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,gBAAgB,CAcjF"}

package/dist/runtime/index.d.ts

@@ -10,7 +10,7 @@ export { reconcileElements, getLoopChildren, getLoopNodes } from './reconcile-el
 export { qsaItem, upsertChildItem } from './qsa-item';
 export { mapArray, mapArrayAnchored } from './map-array';
 export { registerTemplate, getTemplate, hasTemplate, type TemplateFn } from './template';
-export { createComponent, renderChild, getPropsUpdateFn, getComponentProps, parseHTML, } from './component';
+export { createComponent, renderChild, getPropsUpdateFn, getComponentProps, parseHTML, escapeAttr, escapeText, } from './component';
 export { applyRestAttrs } from './apply-rest-attrs';
 export { spreadAttrs } from './spread-attrs';
 export { styleToCss } from './style';

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,UAAU,EACV,UAAU,EACV,SAAS,EACT,OAAO,EACP,OAAO,EACP,KAAK,EACL,KAAK,QAAQ,EACb,KAAK,MAAM,EACX,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAIlC,OAAO,EACL,aAAa,EACb,UAAU,EACV,cAAc,EACd,eAAe,EACf,KAAK,OAAO,GACb,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,eAAe,EACf,wBAAwB,EACxB,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,cAAc,GACpB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAGxD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAGxF,OAAO,EACL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,GACV,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAGpC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxF,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAGpD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGlD,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAGjC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGvD,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,UAAU,EACV,UAAU,EACV,SAAS,EACT,OAAO,EACP,OAAO,EACP,KAAK,EACL,KAAK,QAAQ,EACb,KAAK,MAAM,EACX,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAIlC,OAAO,EACL,aAAa,EACb,UAAU,EACV,cAAc,EACd,eAAe,EACf,KAAK,OAAO,GACb,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,eAAe,EACf,wBAAwB,EACxB,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,cAAc,GACpB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAGxD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAGxF,OAAO,EACL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,UAAU,GACX,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAGpC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxF,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAGpD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGlD,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAGjC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGvD,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA"}

package/dist/runtime/index.js

@@ -248,6 +248,8 @@ function classifyDOMProp(key) {
     return { kind: "skip", attrName: key };
   if (key === "ref")
     return { kind: "ref", attrName: key };
+  if (key === "dangerouslySetInnerHTML")
+    return { kind: "innerHTML", attrName: key };
   if (isEventProp(key))
     return { kind: "event", attrName: key };
   const attrName = toHTMLAttrNameRuntime(key);
@@ -1104,6 +1106,12 @@ function unwrapPropsForTemplate(props) {
 function escapeAttrGt(html) {
   return html.replace(/"[^"]*"/g, (match) => match.replace(/>/g, ">"));
 }
+function escapeAttr(value) {
+  return String(value).replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function escapeText(value) {
+  return escapeAttr(value);
+}
 var SVG_NS = "http://www.w3.org/2000/svg";
 function parseHTML(html, parent) {
   const tpl = document.createElement("template");
@@ -1932,7 +1940,10 @@ function applyRestAttrs(el, source, excludeKeys) {
   createEffect2(() => {
     for (const { key, c } of attrEntries) {
       const value = source[key];
-      if (value != null && value !== false) {
+      if (c.kind === "innerHTML") {
+        const html = value;
+        el.innerHTML = html != null && html.__html != null ? String(html.__html) : "";
+      } else if (value != null && value !== false) {
         if (c.kind === "property" && c.attrName === "value" && "value" in el) {
           const strVal = String(value);
           if (el.value !== strVal)
@@ -1975,6 +1986,8 @@ function spreadAttrs(obj) {
     const c = classifyDOMProp(key);
     if (c.kind === "event" || c.kind === "skip" || c.kind === "ref")
       continue;
+    if (c.kind === "innerHTML")
+      continue;
     if (c.kind === "style") {
       const css = styleToCss(value);
       if (css != null)
@@ -2251,7 +2264,7 @@ function __bfSlot(value, slots) {
   if (Array.isArray(value)) {
     return value.map((v) => __bfSlot(v, slots)).join("");
   }
-  return String(value);
+  return escapeText(value);
 }
 // src/runtime/dynamic-text.ts
 var END_MARKER = "/";
@@ -2445,6 +2458,8 @@ export {
   findSiblingSlot,
   findScope,
   find,
+  escapeText,
+  escapeAttr,
   cssEscape,
   createSignal2 as createSignal,
   createRoot2 as createRoot,

package/dist/runtime/spread-attrs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spread-attrs.d.ts","sourceRoot":"","sources":["../../src/runtime/spread-attrs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAmBhE"}
+{"version":3,"file":"spread-attrs.d.ts","sourceRoot":"","sources":["../../src/runtime/spread-attrs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAyBhE"}

package/dist/runtime/standalone.js

@@ -439,6 +439,8 @@ function classifyDOMProp(key) {
     return { kind: "skip", attrName: key };
   if (key === "ref")
     return { kind: "ref", attrName: key };
+  if (key === "dangerouslySetInnerHTML")
+    return { kind: "innerHTML", attrName: key };
   if (isEventProp(key))
     return { kind: "event", attrName: key };
   const attrName = toHTMLAttrNameRuntime(key);
@@ -1294,6 +1296,12 @@ function unwrapPropsForTemplate(props) {
 function escapeAttrGt(html) {
   return html.replace(/"[^"]*"/g, (match) => match.replace(/>/g, ">"));
 }
+function escapeAttr(value) {
+  return String(value).replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function escapeText(value) {
+  return escapeAttr(value);
+}
 var SVG_NS = "http://www.w3.org/2000/svg";
 function parseHTML(html, parent) {
   const tpl = document.createElement("template");
@@ -2118,7 +2126,10 @@ function applyRestAttrs(el, source, excludeKeys) {
   createEffect(() => {
     for (const { key, c } of attrEntries) {
       const value = source[key];
-      if (value != null && value !== false) {
+      if (c.kind === "innerHTML") {
+        const html = value;
+        el.innerHTML = html != null && html.__html != null ? String(html.__html) : "";
+      } else if (value != null && value !== false) {
         if (c.kind === "property" && c.attrName === "value" && "value" in el) {
           const strVal = String(value);
           if (el.value !== strVal)
@@ -2161,6 +2172,8 @@ function spreadAttrs(obj) {
     const c = classifyDOMProp(key);
     if (c.kind === "event" || c.kind === "skip" || c.kind === "ref")
       continue;
+    if (c.kind === "innerHTML")
+      continue;
     if (c.kind === "style") {
       const css = styleToCss(value);
       if (css != null)
@@ -2436,7 +2449,7 @@ function __bfSlot(value, slots) {
   if (Array.isArray(value)) {
     return value.map((v) => __bfSlot(v, slots)).join("");
   }
-  return String(value);
+  return escapeText(value);
 }
 // src/runtime/dynamic-text.ts
 var END_MARKER = "/";
@@ -2630,6 +2643,8 @@ export {
   findSiblingSlot,
   findScope,
   find,
+  escapeText,
+  escapeAttr,
   cssEscape,
   createSignal,
   createRoot,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@barefootjs/client",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "BarefootJS client package: reactive primitives (SSR-safe) plus browser runtime under the `/runtime` subpath (compiler target)",
   "type": "module",
   "main": "./dist/index.js",
@@ -55,7 +55,7 @@
     "directory": "packages/client"
   },
   "dependencies": {
-    "@barefootjs/shared": "0.5.2"
+    "@barefootjs/shared": "0.5.3"
   },
   "peerDependencies": {
     "@barefootjs/jsx": ">=0.2.0"

package/src/runtime/apply-rest-attrs.ts

@@ -64,7 +64,13 @@ export function applyRestAttrs(
     for (const { key, c } of attrEntries) {
       const value = source[key]
 
-      if (value != null && value !== false) {
+      if (c.kind === 'innerHTML') {
+        // `dangerouslySetInnerHTML={{ __html }}` arriving via a rest object —
+        // set the element's raw innerHTML (the escape hatch), never an
+        // attribute. Reactive: re-runs when `source` changes.
+        const html = value as { __html?: unknown } | null | undefined
+        el.innerHTML = html != null && html.__html != null ? String(html.__html) : ''
+      } else if (value != null && value !== false) {
         if (c.kind === 'property' && c.attrName === 'value' && 'value' in el) {
           const strVal = String(value)
           if ((el as HTMLInputElement).value !== strVal) (el as HTMLInputElement).value = strVal

package/src/runtime/branch-slot.ts

@@ -15,9 +15,16 @@
  * in by identity (no `cloneNode`), preserving event listeners and signal
  * bindings.
  *
- * Non-node values fall through to `String(value)` for the existing
- * inline-string path.
+ * Non-node values fall through to the inline-string path, HTML-escaped
+ * (#1694 follow-up) so a branch-template text value containing `< / &`
+ * surfaces as text — not markup — and matches the SSR-rendered bytes.
+ * Escaping happens here, on the string path only, so the `<!--bf-slot:N-->`
+ * markers returned for live `Node` values are left intact for `insert()`
+ * to splice. (Doing it here rather than wrapping the whole `__bfSlot(...)`
+ * call in `escapeText` is what lets the marker path stay raw.)
  */
+import { escapeText } from './component'
+
 export function __bfSlot(value: unknown, slots: Node[]): string {
   if (value == null || value === false || value === true) return ''
   if (typeof Node !== 'undefined' && value instanceof Node) {
@@ -28,5 +35,5 @@ export function __bfSlot(value: unknown, slots: Node[]): string {
   if (Array.isArray(value)) {
     return value.map((v) => __bfSlot(v, slots)).join('')
   }
-  return String(value)
+  return escapeText(value)
 }

package/src/runtime/component.ts

@@ -400,6 +400,39 @@ export function escapeAttrGt(html: string): string {
   return html.replace(/"[^"]*"/g, match => match.replace(/>/g, '>'))
 }
 
+/**
+ * HTML-escape a single attribute *value* before it is concatenated into a
+ * client-rendered template string. Matches the SSR adapters' attribute
+ * escaping (Hono's `escapeToBuffer`: `& " ' < >`) so client-rendered DOM
+ * is byte-identical to the server-rendered form and metacharacter-bearing
+ * values (UnoCSS `[class*="size-"]`, `has-[>svg]`, …) don't corrupt
+ * attribute parsing when the template is inserted via `innerHTML`. `&` is
+ * replaced first so the emitted entities aren't themselves re-escaped.
+ */
+export function escapeAttr(value: unknown): string {
+  return String(value)
+    .replace(/&/g, '&amp;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+}
+
+/**
+ * HTML-escape interpolated **text content** before it is concatenated into
+ * a client-rendered template string (the `<!--bf:sN-->…<!--/-->` text
+ * slots). The HTML spec only requires `& < >` in text, but the SSR
+ * adapters (Hono) escape text with the same set as attribute values
+ * (`& " ' < >`), and the fixture-hydrate / CSR-conformance layer requires
+ * byte-parity with the server-rendered output — so this delegates to
+ * `escapeAttr`. Kept as a distinct export so generated code reads
+ * `escapeText(...)` at text sites (self-documenting) and so the two
+ * contexts can diverge later without touching call sites.
+ */
+export function escapeText(value: unknown): string {
+  return escapeAttr(value)
+}
+
 const SVG_NS = 'http://www.w3.org/2000/svg'
 
 /**

package/src/runtime/index.ts

@@ -68,6 +68,8 @@ export {
   getPropsUpdateFn,
   getComponentProps,
   parseHTML,
+  escapeAttr,
+  escapeText,
 } from './component'
 
 // Spread props helpers

package/src/runtime/spread-attrs.ts

@@ -23,6 +23,12 @@ export function spreadAttrs(obj: Record<string, unknown>): string {
     if (value == null || value === false) continue
     const c = classifyDOMProp(key)
     if (c.kind === 'event' || c.kind === 'skip' || c.kind === 'ref') continue
+    // `dangerouslySetInnerHTML` is not an attribute — its `{ __html }` is the
+    // element's content, which this attribute-string builder can't emit. Skip
+    // it so a spread carrying it never serialises a bogus
+    // `dangerouslySetInnerHTML="[object Object]"`. (Content is set by the
+    // template for an explicit attr, or by `applyRestAttrs` for a rest object.)
+    if (c.kind === 'innerHTML') continue
     if (c.kind === 'style') {
       const css = styleToCss(value)
       if (css != null) parts.push(`style="${css}"`)