@barefootjs/jinja 0.18.5 → 0.18.7

package/dist/adapter/index.js

@@ -187308,7 +187308,13 @@ import {
   prepareLoweringMatchers,
   queryHrefArgs,
   isValidHelperId,
-  sortComparatorFromArrow as sortComparatorFromArrow2
+  sortComparatorFromArrow as sortComparatorFromArrow2,
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+  resolveStaticLoopSource,
+  collectLoopBoundNames
 } from "@barefootjs/jsx";
 
 // src/adapter/boolean-result.ts
@@ -187699,6 +187705,39 @@ function renderFlatMethod(recv, depth, emit) {
   return `bf.flat(${recv}, ${d})`;
 }
 
+// src/adapter/lib/static-value.ts
+function staticValueToJinja(value) {
+  if (value === null || value === undefined)
+    return "none";
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "number")
+    return String(value);
+  if (typeof value === "string")
+    return `'${escapeJinjaSingleQuoted(value)}'`;
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const el of value) {
+      const serialized = staticValueToJinja(el);
+      if (serialized === null)
+        return null;
+      items.push(serialized);
+    }
+    return `[${items.join(", ")}]`;
+  }
+  if (typeof value === "object") {
+    const entries = [];
+    for (const [key, val] of Object.entries(value)) {
+      const serialized = staticValueToJinja(val);
+      if (serialized === null)
+        return null;
+      entries.push(`${jinjaHashKey(key)}: ${serialized}`);
+    }
+    return `{${entries.join(", ")}}`;
+  }
+  return null;
+}
+
 // src/adapter/expr/emitters.ts
 import {
   groupBinaryOperand,
@@ -188281,6 +188320,7 @@ class JinjaAdapter extends BaseAdapter {
   _searchParamsLocals = new Set;
   _loweringMatchers = [];
   localConstants = [];
+  staticLoopSourceBoundNames = new Set;
   nullableOptionalProps = new Set;
   constructor(options = {}) {
     super();
@@ -188296,6 +188336,7 @@ class JinjaAdapter extends BaseAdapter {
     this.propsParams = ir.metadata.propsParams.map((p) => ({ name: p.name }));
     this.booleanTypedProps = collectBooleanTypedProps(ir);
     this.localConstants = ir.metadata.localConstants ?? [];
+    this.staticLoopSourceBoundNames = collectLoopBoundNames(ir);
     this.nullableOptionalProps = collectNullableOptionalProps(ir);
     this.stringValueNames = collectStringValueNames(ir);
     this.moduleStringConsts = collectModuleStringConsts(ir.metadata.localConstants);
@@ -188417,7 +188458,8 @@ class JinjaAdapter extends BaseAdapter {
   renderElement(element) {
     const tag = element.tag;
     const attrs = this.renderAttributes(element);
-    const children = this.renderChildren(element.children);
+    const dangerousHtml = this.renderDangerousInnerHtml(element);
+    const children = dangerousHtml !== null ? dangerousHtml : this.renderChildren(element.children);
     let hydrationAttrs = "";
     if (element.needsScope) {
       hydrationAttrs += ` ${this.renderScopeMarker("")}`;
@@ -188452,6 +188494,22 @@ class JinjaAdapter extends BaseAdapter {
     }
     return `<${tag}${attrs}${hydrationAttrs}>${children}</${tag}>`;
   }
+  renderDangerousInnerHtml(element) {
+    const resolution = resolveDangerousInnerHtml(element);
+    if (!resolution)
+      return null;
+    if (resolution.kind === "dynamic") {
+      this.errors.push(dangerousInnerHtmlDiagnostic(resolution.expr, resolution.loc));
+      return "";
+    }
+    const violation = dangerousInnerHtmlMetacharViolation(resolution.html, this.name);
+    if (violation) {
+      const attr = element.attrs.find(isDangerousInnerHtmlAttr);
+      this.errors.push(dangerousInnerHtmlDiagnostic(`{ __html: ${JSON.stringify(resolution.html)} }`, attr.loc, violation));
+      return "";
+    }
+    return resolution.html;
+  }
   renderExpression(expr) {
     if (expr.clientOnly) {
       if (expr.slotId) {
@@ -188459,7 +188517,7 @@ class JinjaAdapter extends BaseAdapter {
       }
       return "";
     }
-    const jinjaExpr = `bf.string(${this.convertExpressionToJinja(expr.expr)})`;
+    const jinjaExpr = `bf.string(${this.convertExpressionToJinja(expr.expr, expr.parsed)})`;
     if (expr.slotId) {
       return `{{ bf.text_start("${expr.slotId}") | safe }}{{ ${jinjaExpr} }}{{ bf.text_end() | safe }}`;
     }
@@ -188551,8 +188609,12 @@ ${whenTrue}
         }
       });
     }
+    const staticItems = resolveStaticLoopSource(loop.arrayParsed, this.localConstants, {
+      isNameShadowed: (name) => this.staticLoopSourceBoundNames.has(name)
+    });
+    const staticArray = staticItems !== null ? staticValueToJinja(staticItems) : null;
     const arrayName = loop.array.trim();
-    if (/^[A-Za-z_$][\w$]*$/.test(arrayName)) {
+    if (staticArray === null && /^[A-Za-z_$][\w$]*$/.test(arrayName)) {
       const arrayConst = (this.localConstants ?? []).find((c) => c.name === arrayName);
       if (arrayConst && !arrayConst.isModule && this._resolveLiteralConst(arrayName) === null) {
         this.errors.push({
@@ -188566,7 +188628,7 @@ ${whenTrue}
         });
       }
     }
-    const rawArray = this.convertExpressionToJinja(loop.array);
+    const rawArray = staticArray ?? this.convertExpressionToJinja(loop.array);
     let array = rawArray;
     if (loop.sortComparator) {
       const sort = loop.sortComparator;
@@ -188878,6 +188940,8 @@ ${name}="{{ bf.string(${val}) }}"
     for (const attr of element.attrs) {
       if (attr.clientOnly)
         continue;
+      if (isDangerousInnerHtmlAttr(attr))
+        continue;
       let attrName;
       if (attr.name === "className")
         attrName = "class";
@@ -189077,6 +189141,8 @@ Options:
     return isBooleanResultExpr(expr) || isAriaBooleanAttr(name) || this.isBooleanTypedPropRef(expr);
   }
   _resolveLiteralConst(name) {
+    if (this.staticLoopSourceBoundNames.has(name))
+      return null;
     const c = (this.localConstants ?? []).find((lc) => lc.name === name);
     if (c?.value === undefined)
       return null;
@@ -189089,6 +189155,8 @@ Options:
     return null;
   }
   _resolveStaticRecordLiteral(objectName, key) {
+    if (this.staticLoopSourceBoundNames.has(objectName))
+      return null;
     const hit = lookupStaticRecordLiteral(objectName, key, this.localConstants);
     if (!hit)
       return null;

package/dist/adapter/jinja-adapter.d.ts

@@ -168,6 +168,16 @@ export declare class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<J
      * const (`const sizeAttrs = size ? {…} : {}`) to its initializer text.
      */
     private localConstants;
+    /**
+     * Every name a `.map()`/`.filter()` loop callback binds as its item/index
+     * parameter anywhere in the component (#2208 fable review). A static
+     * loop-SOURCE name (e.g. a function-scope `const items = [...]`) must
+     * never resolve through `resolveStaticLoopSource` at a use site where a
+     * DIFFERENT, enclosing loop's own callback param shadows it — same
+     * shadowing hazard, and same coarse-but-safe mitigation, as #2212's
+     * `collectLoopBoundNames` use in `collectStringValueNames`.
+     */
+    private staticLoopSourceBoundNames;
     /**
      * Optional, no-default props that are `None` when the caller omits them.
      * Their bare-reference attribute emission is guarded with a Jinja
@@ -219,6 +229,13 @@ export declare class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<J
     private providerObjectLiteralJinja;
     emitAsync(node: IRAsync, _ctx: JinjaRenderCtx, _emit: EmitIRNode<JinjaRenderCtx>): string;
     renderElement(element: IRElement): string;
+    /**
+     * `dangerouslySetInnerHTML={{ __html: '...' }}` (#2207) — see the Blade
+     * adapter's identical helper for the full rationale. `null` means the
+     * attribute is absent (caller falls through to normal `renderChildren`);
+     * a non-`null` string (possibly `''`) replaces the children outright.
+     */
+    private renderDangerousInnerHtml;
     renderExpression(expr: IRExpression): string;
     renderConditional(cond: IRConditional): string;
     private renderNodeOrNull;
@@ -390,8 +407,32 @@ export declare class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<J
      * single-quoted string literal (`const totalPages = 5`, #1897
      * pagination) — function-scope consts never reach the per-render
      * context, so a bare reference would resolve to Undefined.
+     *
+     * The lookup is a flat name match with no notion of AST scope, so a
+     * name that any loop callback binds as its item/index param never
+     * inlines (#2221) — the occurrence may be the loop's own (shadowing)
+     * binding, and substituting the outer const's value there renders every
+     * iteration with the same hard-coded literal. Coarse (a genuinely
+     * non-shadowed same-named const elsewhere in the component also stops
+     * inlining, falling back to the bare identifier) but safe — the same
+     * trade-off as #2212's `collectLoopBoundNames` use in
+     * `collectStringValueNames`.
      */
     private _resolveLiteralConst;
+    /**
+     * Resolve `IDENT.key` where `IDENT` is a module-scope object-literal const
+     * (`variantClasses.ghost`, #1896/#1897) to the looked-up scalar.
+     *
+     * The lookup is a flat name match on `objectName` with no notion of AST
+     * scope, so an enclosing loop callback's own param of the same name
+     * (`.map((cfg) => <li>{cfg.x}</li>)` shadowing a module `const cfg = {…}`)
+     * still resolved to the OUTER const's member value at every iteration
+     * (#2237) — the sibling hazard to #2221's `_resolveLiteralConst`. Same
+     * coarse-but-safe `staticLoopSourceBoundNames` guard: any name a loop
+     * binds anywhere in the component never inlines, falling back to the bare
+     * `cfg['x']` member expression (which a Jinja for-loop binds correctly
+     * at the shadowed occurrences).
+     */
     private _resolveStaticRecordLiteral;
     private _resolveModuleStringConst;
     private _recordExprBF101;

package/dist/adapter/jinja-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jinja-adapter.d.ts","sourceRoot":"","sources":["../../src/adapter/jinja-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,MAAM,EACN,SAAS,EACT,MAAM,EACN,YAAY,EACZ,aAAa,EACb,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,aAAa,EACb,UAAU,EACV,OAAO,EAKP,yBAAyB,EAE1B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAE3B,KAAK,aAAa,EAClB,KAAK,UAAU,EAyBhB,MAAM,iBAAiB,CAAA;AAKxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAiCpD,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAEzD,qBAAa,YAAa,SAAQ,WAAY,YAAW,aAAa,CAAC,cAAc,CAAC;IACpF,IAAI,SAAU;IACd,SAAS,SAAW;IACpB,qBAAqB,UAAO;IAG5B,kBAAkB,EAAG,cAAc,CAAS;IAE5C;;;;;OAKG;IACH,kBAAkB,EAAE,yBAAyB,CAA2B;IAExE,OAAO,CAAC,aAAa,CAAa;IAClC;;;uCAGmC;IACnC,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAAI;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,iBAAiB,CAAyB;IAClD;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB,CAAyB;IAEjD;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAAiC;IAE3D;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB,CAAyB;IAEpD;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB,CAAwB;IAEjD;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAAmC;IAEzD;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB,CAAyB;IAEtD,YAAY,OAAO,GAAE,mBAAwB,EAM5C;IAED,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,aAAa,CA4EzE;IAMD,OAAO,CAAC,2BAA2B;IAyBnC;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/B;IAMD,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAE5F;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI7B;IAED,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAEzC;IAED,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAEpG;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAEtF;IAED,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAEhG;IAED,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAE9F;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7B;IAED,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAEpG;IAED,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAe9F;IAED,uEAAuE;IACvE,OAAO,CAAC,kBAAkB;IAmB1B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,0BAA0B;IAYlC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAExF;IAMD,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAoCxC;IAMD,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAiB3C;IAMD,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAuC7C;IAED,OAAO,CAAC,gBAAgB;IAOxB;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAcnC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAmP/B;IAMD;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAoCpC;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,2BAA2B;IAUnC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,4BAA4B;IAiBpC,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAoGzC;IAED,OAAO,CAAC,sBAAsB,CAAI;IAElC;+DAC2D;IAC3D,OAAO,CAAC,kBAAkB,CAAI;IAE9B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,iBAAiB;IA0BzB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,UAAU;IAYT,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAQ1C;IAMD;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CA0JlC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAmB3B,8EAA8E;IAC9E,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,gBAAgB;IA8BxB,iBAAiB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAIjD;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvC;IAMD;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,kCAAkC;IA8B1C;;;;;OAKG;IACH,OAAO,CAAC,iCAAiC;IAmBzC;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAuBvC;;;;;;;OAOG;IACH,OAAO,KAAK,OAAO,GASlB;IAED;;;;;OAKG;IACH,OAAO,KAAK,SAAS,GASpB;IAED,sEAAsE;IACtE,OAAO,KAAK,OAAO,GAKlB;IAED,OAAO,CAAC,wBAAwB;IAyEhC;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAK/B;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAI/B;;gFAE4E;IAC5E,OAAO,CAAC,kBAAkB;IAI1B;;;;OAIG;IACH,8BAA8B,CAC5B,IAAI,EAAE,MAAM,GACX;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAgBlD;IAED,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAO3C;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,2BAA2B;IAQnC,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,gBAAgB;IAcxB,iFAAiF;IACjF,OAAO,CAAC,4BAA4B;CAGrC;AAED,eAAO,MAAM,YAAY,cAAqB,CAAA"}
+{"version":3,"file":"jinja-adapter.d.ts","sourceRoot":"","sources":["../../src/adapter/jinja-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,MAAM,EACN,SAAS,EACT,MAAM,EACN,YAAY,EACZ,aAAa,EACb,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,aAAa,EACb,UAAU,EACV,OAAO,EAKP,yBAAyB,EAE1B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAE3B,KAAK,aAAa,EAClB,KAAK,UAAU,EA+BhB,MAAM,iBAAiB,CAAA;AAKxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAkCpD,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAEzD,qBAAa,YAAa,SAAQ,WAAY,YAAW,aAAa,CAAC,cAAc,CAAC;IACpF,IAAI,SAAU;IACd,SAAS,SAAW;IACpB,qBAAqB,UAAO;IAG5B,kBAAkB,EAAG,cAAc,CAAS;IAE5C;;;;;OAKG;IACH,kBAAkB,EAAE,yBAAyB,CAA2B;IAExE,OAAO,CAAC,aAAa,CAAa;IAClC;;;uCAGmC;IACnC,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAAI;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,iBAAiB,CAAyB;IAClD;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB,CAAyB;IAEjD;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAAiC;IAE3D;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB,CAAyB;IAEpD;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB,CAAwB;IAEjD;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAAmC;IAEzD;;;;;;;;OAQG;IACH,OAAO,CAAC,0BAA0B,CAAyB;IAE3D;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB,CAAyB;IAEtD,YAAY,OAAO,GAAE,mBAAwB,EAM5C;IAED,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,aAAa,CA6EzE;IAMD,OAAO,CAAC,2BAA2B;IAyBnC;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/B;IAMD,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAE5F;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI7B;IAED,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAEzC;IAED,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAEpG;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAEtF;IAED,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAEhG;IAED,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAE9F;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7B;IAED,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAEpG;IAED,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAe9F;IAED,uEAAuE;IACvE,OAAO,CAAC,kBAAkB;IAmB1B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,0BAA0B;IAYlC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,GAAG,MAAM,CAExF;IAMD,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAqCxC;IAED;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAoBhC,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAqB3C;IAMD,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAuC7C;IAED,OAAO,CAAC,gBAAgB;IAOxB;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAcnC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAsQ/B;IAMD;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAoCpC;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,2BAA2B;IAUnC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,4BAA4B;IAiBpC,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAoGzC;IAED,OAAO,CAAC,sBAAsB,CAAI;IAElC;+DAC2D;IAC3D,OAAO,CAAC,kBAAkB,CAAI;IAE9B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,iBAAiB;IA0BzB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,UAAU;IAYT,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAQ1C;IAMD;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CA0JlC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAmB3B,8EAA8E;IAC9E,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,gBAAgB;IAoCxB,iBAAiB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAIjD;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvC;IAMD;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,kCAAkC;IA8B1C;;;;;OAKG;IACH,OAAO,CAAC,iCAAiC;IAmBzC;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAuBvC;;;;;;;OAOG;IACH,OAAO,KAAK,OAAO,GASlB;IAED;;;;;OAKG;IACH,OAAO,KAAK,SAAS,GASpB;IAED,sEAAsE;IACtE,OAAO,KAAK,OAAO,GAKlB;IAED,OAAO,CAAC,wBAAwB;IAyEhC;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAK/B;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAI/B;;gFAE4E;IAC5E,OAAO,CAAC,kBAAkB;IAI1B;;;;OAIG;IACH,8BAA8B,CAC5B,IAAI,EAAE,MAAM,GACX;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAgBlD;IAED,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAO3C;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,gBAAgB;IAcxB,iFAAiF;IACjF,OAAO,CAAC,4BAA4B;CAGrC;AAED,eAAO,MAAM,YAAY,cAAqB,CAAA"}

package/dist/adapter/lib/static-value.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Serialize a compile-time-evaluated JS value (`@barefootjs/jsx`'s
+ * `evaluateStaticLiteral`/`resolveStaticLoopSource`, #2208) into a native
+ * Jinja2 literal. Used to inline a fully-static loop source (an inline
+ * array literal, or a function-scope local const with a static
+ * initializer) directly in a `{% for %}` header, rather than requiring a
+ * bound template variable.
+ *
+ * Returns `null` for a value this adapter can't represent as a literal
+ * (e.g. `undefined` reads for a missing object key are still representable
+ * as `none`, but anything else falls back to the caller's existing BF101
+ * refusal instead of guessing).
+ */
+export declare function staticValueToJinja(value: unknown): string | null;
+//# sourceMappingURL=static-value.d.ts.map

package/dist/adapter/lib/static-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-value.d.ts","sourceRoot":"","sources":["../../../src/adapter/lib/static-value.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAwBhE"}

package/dist/build.js

@@ -187308,7 +187308,13 @@ import {
   prepareLoweringMatchers,
   queryHrefArgs,
   isValidHelperId,
-  sortComparatorFromArrow as sortComparatorFromArrow2
+  sortComparatorFromArrow as sortComparatorFromArrow2,
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+  resolveStaticLoopSource,
+  collectLoopBoundNames
 } from "@barefootjs/jsx";
 
 // src/adapter/boolean-result.ts
@@ -187699,6 +187705,39 @@ function renderFlatMethod(recv, depth, emit) {
   return `bf.flat(${recv}, ${d})`;
 }
 
+// src/adapter/lib/static-value.ts
+function staticValueToJinja(value) {
+  if (value === null || value === undefined)
+    return "none";
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "number")
+    return String(value);
+  if (typeof value === "string")
+    return `'${escapeJinjaSingleQuoted(value)}'`;
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const el of value) {
+      const serialized = staticValueToJinja(el);
+      if (serialized === null)
+        return null;
+      items.push(serialized);
+    }
+    return `[${items.join(", ")}]`;
+  }
+  if (typeof value === "object") {
+    const entries = [];
+    for (const [key, val] of Object.entries(value)) {
+      const serialized = staticValueToJinja(val);
+      if (serialized === null)
+        return null;
+      entries.push(`${jinjaHashKey(key)}: ${serialized}`);
+    }
+    return `{${entries.join(", ")}}`;
+  }
+  return null;
+}
+
 // src/adapter/expr/emitters.ts
 import {
   groupBinaryOperand,
@@ -188281,6 +188320,7 @@ class JinjaAdapter extends BaseAdapter {
   _searchParamsLocals = new Set;
   _loweringMatchers = [];
   localConstants = [];
+  staticLoopSourceBoundNames = new Set;
   nullableOptionalProps = new Set;
   constructor(options = {}) {
     super();
@@ -188296,6 +188336,7 @@ class JinjaAdapter extends BaseAdapter {
     this.propsParams = ir.metadata.propsParams.map((p) => ({ name: p.name }));
     this.booleanTypedProps = collectBooleanTypedProps(ir);
     this.localConstants = ir.metadata.localConstants ?? [];
+    this.staticLoopSourceBoundNames = collectLoopBoundNames(ir);
     this.nullableOptionalProps = collectNullableOptionalProps(ir);
     this.stringValueNames = collectStringValueNames(ir);
     this.moduleStringConsts = collectModuleStringConsts(ir.metadata.localConstants);
@@ -188417,7 +188458,8 @@ class JinjaAdapter extends BaseAdapter {
   renderElement(element) {
     const tag = element.tag;
     const attrs = this.renderAttributes(element);
-    const children = this.renderChildren(element.children);
+    const dangerousHtml = this.renderDangerousInnerHtml(element);
+    const children = dangerousHtml !== null ? dangerousHtml : this.renderChildren(element.children);
     let hydrationAttrs = "";
     if (element.needsScope) {
       hydrationAttrs += ` ${this.renderScopeMarker("")}`;
@@ -188452,6 +188494,22 @@ class JinjaAdapter extends BaseAdapter {
     }
     return `<${tag}${attrs}${hydrationAttrs}>${children}</${tag}>`;
   }
+  renderDangerousInnerHtml(element) {
+    const resolution = resolveDangerousInnerHtml(element);
+    if (!resolution)
+      return null;
+    if (resolution.kind === "dynamic") {
+      this.errors.push(dangerousInnerHtmlDiagnostic(resolution.expr, resolution.loc));
+      return "";
+    }
+    const violation = dangerousInnerHtmlMetacharViolation(resolution.html, this.name);
+    if (violation) {
+      const attr = element.attrs.find(isDangerousInnerHtmlAttr);
+      this.errors.push(dangerousInnerHtmlDiagnostic(`{ __html: ${JSON.stringify(resolution.html)} }`, attr.loc, violation));
+      return "";
+    }
+    return resolution.html;
+  }
   renderExpression(expr) {
     if (expr.clientOnly) {
       if (expr.slotId) {
@@ -188459,7 +188517,7 @@ class JinjaAdapter extends BaseAdapter {
       }
       return "";
     }
-    const jinjaExpr = `bf.string(${this.convertExpressionToJinja(expr.expr)})`;
+    const jinjaExpr = `bf.string(${this.convertExpressionToJinja(expr.expr, expr.parsed)})`;
     if (expr.slotId) {
       return `{{ bf.text_start("${expr.slotId}") | safe }}{{ ${jinjaExpr} }}{{ bf.text_end() | safe }}`;
     }
@@ -188551,8 +188609,12 @@ ${whenTrue}
         }
       });
     }
+    const staticItems = resolveStaticLoopSource(loop.arrayParsed, this.localConstants, {
+      isNameShadowed: (name) => this.staticLoopSourceBoundNames.has(name)
+    });
+    const staticArray = staticItems !== null ? staticValueToJinja(staticItems) : null;
     const arrayName = loop.array.trim();
-    if (/^[A-Za-z_$][\w$]*$/.test(arrayName)) {
+    if (staticArray === null && /^[A-Za-z_$][\w$]*$/.test(arrayName)) {
       const arrayConst = (this.localConstants ?? []).find((c) => c.name === arrayName);
       if (arrayConst && !arrayConst.isModule && this._resolveLiteralConst(arrayName) === null) {
         this.errors.push({
@@ -188566,7 +188628,7 @@ ${whenTrue}
         });
       }
     }
-    const rawArray = this.convertExpressionToJinja(loop.array);
+    const rawArray = staticArray ?? this.convertExpressionToJinja(loop.array);
     let array = rawArray;
     if (loop.sortComparator) {
       const sort = loop.sortComparator;
@@ -188878,6 +188940,8 @@ ${name}="{{ bf.string(${val}) }}"
     for (const attr of element.attrs) {
       if (attr.clientOnly)
         continue;
+      if (isDangerousInnerHtmlAttr(attr))
+        continue;
       let attrName;
       if (attr.name === "className")
         attrName = "class";
@@ -189077,6 +189141,8 @@ Options:
     return isBooleanResultExpr(expr) || isAriaBooleanAttr(name) || this.isBooleanTypedPropRef(expr);
   }
   _resolveLiteralConst(name) {
+    if (this.staticLoopSourceBoundNames.has(name))
+      return null;
     const c = (this.localConstants ?? []).find((lc) => lc.name === name);
     if (c?.value === undefined)
       return null;
@@ -189089,6 +189155,8 @@ Options:
     return null;
   }
   _resolveStaticRecordLiteral(objectName, key) {
+    if (this.staticLoopSourceBoundNames.has(objectName))
+      return null;
     const hit = lookupStaticRecordLiteral(objectName, key, this.localConstants);
     if (!hit)
       return null;

package/dist/conformance-pins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance-pins.d.ts","sourceRoot":"","sources":["../src/conformance-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtD,eAAO,MAAM,eAAe,EAAE,eA8F7B,CAAA"}
+{"version":3,"file":"conformance-pins.d.ts","sourceRoot":"","sources":["../src/conformance-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtD,eAAO,MAAM,eAAe,EAAE,eA6F7B,CAAA"}

package/dist/index.js

@@ -187308,7 +187308,13 @@ import {
   prepareLoweringMatchers,
   queryHrefArgs,
   isValidHelperId,
-  sortComparatorFromArrow as sortComparatorFromArrow2
+  sortComparatorFromArrow as sortComparatorFromArrow2,
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+  resolveStaticLoopSource,
+  collectLoopBoundNames
 } from "@barefootjs/jsx";
 
 // src/adapter/boolean-result.ts
@@ -187699,6 +187705,39 @@ function renderFlatMethod(recv, depth, emit) {
   return `bf.flat(${recv}, ${d})`;
 }
 
+// src/adapter/lib/static-value.ts
+function staticValueToJinja(value) {
+  if (value === null || value === undefined)
+    return "none";
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "number")
+    return String(value);
+  if (typeof value === "string")
+    return `'${escapeJinjaSingleQuoted(value)}'`;
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const el of value) {
+      const serialized = staticValueToJinja(el);
+      if (serialized === null)
+        return null;
+      items.push(serialized);
+    }
+    return `[${items.join(", ")}]`;
+  }
+  if (typeof value === "object") {
+    const entries = [];
+    for (const [key, val] of Object.entries(value)) {
+      const serialized = staticValueToJinja(val);
+      if (serialized === null)
+        return null;
+      entries.push(`${jinjaHashKey(key)}: ${serialized}`);
+    }
+    return `{${entries.join(", ")}}`;
+  }
+  return null;
+}
+
 // src/adapter/expr/emitters.ts
 import {
   groupBinaryOperand,
@@ -188281,6 +188320,7 @@ class JinjaAdapter extends BaseAdapter {
   _searchParamsLocals = new Set;
   _loweringMatchers = [];
   localConstants = [];
+  staticLoopSourceBoundNames = new Set;
   nullableOptionalProps = new Set;
   constructor(options = {}) {
     super();
@@ -188296,6 +188336,7 @@ class JinjaAdapter extends BaseAdapter {
     this.propsParams = ir.metadata.propsParams.map((p) => ({ name: p.name }));
     this.booleanTypedProps = collectBooleanTypedProps(ir);
     this.localConstants = ir.metadata.localConstants ?? [];
+    this.staticLoopSourceBoundNames = collectLoopBoundNames(ir);
     this.nullableOptionalProps = collectNullableOptionalProps(ir);
     this.stringValueNames = collectStringValueNames(ir);
     this.moduleStringConsts = collectModuleStringConsts(ir.metadata.localConstants);
@@ -188417,7 +188458,8 @@ class JinjaAdapter extends BaseAdapter {
   renderElement(element) {
     const tag = element.tag;
     const attrs = this.renderAttributes(element);
-    const children = this.renderChildren(element.children);
+    const dangerousHtml = this.renderDangerousInnerHtml(element);
+    const children = dangerousHtml !== null ? dangerousHtml : this.renderChildren(element.children);
     let hydrationAttrs = "";
     if (element.needsScope) {
       hydrationAttrs += ` ${this.renderScopeMarker("")}`;
@@ -188452,6 +188494,22 @@ class JinjaAdapter extends BaseAdapter {
     }
     return `<${tag}${attrs}${hydrationAttrs}>${children}</${tag}>`;
   }
+  renderDangerousInnerHtml(element) {
+    const resolution = resolveDangerousInnerHtml(element);
+    if (!resolution)
+      return null;
+    if (resolution.kind === "dynamic") {
+      this.errors.push(dangerousInnerHtmlDiagnostic(resolution.expr, resolution.loc));
+      return "";
+    }
+    const violation = dangerousInnerHtmlMetacharViolation(resolution.html, this.name);
+    if (violation) {
+      const attr = element.attrs.find(isDangerousInnerHtmlAttr);
+      this.errors.push(dangerousInnerHtmlDiagnostic(`{ __html: ${JSON.stringify(resolution.html)} }`, attr.loc, violation));
+      return "";
+    }
+    return resolution.html;
+  }
   renderExpression(expr) {
     if (expr.clientOnly) {
       if (expr.slotId) {
@@ -188459,7 +188517,7 @@ class JinjaAdapter extends BaseAdapter {
       }
       return "";
     }
-    const jinjaExpr = `bf.string(${this.convertExpressionToJinja(expr.expr)})`;
+    const jinjaExpr = `bf.string(${this.convertExpressionToJinja(expr.expr, expr.parsed)})`;
     if (expr.slotId) {
       return `{{ bf.text_start("${expr.slotId}") | safe }}{{ ${jinjaExpr} }}{{ bf.text_end() | safe }}`;
     }
@@ -188551,8 +188609,12 @@ ${whenTrue}
         }
       });
     }
+    const staticItems = resolveStaticLoopSource(loop.arrayParsed, this.localConstants, {
+      isNameShadowed: (name) => this.staticLoopSourceBoundNames.has(name)
+    });
+    const staticArray = staticItems !== null ? staticValueToJinja(staticItems) : null;
     const arrayName = loop.array.trim();
-    if (/^[A-Za-z_$][\w$]*$/.test(arrayName)) {
+    if (staticArray === null && /^[A-Za-z_$][\w$]*$/.test(arrayName)) {
       const arrayConst = (this.localConstants ?? []).find((c) => c.name === arrayName);
       if (arrayConst && !arrayConst.isModule && this._resolveLiteralConst(arrayName) === null) {
         this.errors.push({
@@ -188566,7 +188628,7 @@ ${whenTrue}
         });
       }
     }
-    const rawArray = this.convertExpressionToJinja(loop.array);
+    const rawArray = staticArray ?? this.convertExpressionToJinja(loop.array);
     let array = rawArray;
     if (loop.sortComparator) {
       const sort = loop.sortComparator;
@@ -188878,6 +188940,8 @@ ${name}="{{ bf.string(${val}) }}"
     for (const attr of element.attrs) {
       if (attr.clientOnly)
         continue;
+      if (isDangerousInnerHtmlAttr(attr))
+        continue;
       let attrName;
       if (attr.name === "className")
         attrName = "class";
@@ -189077,6 +189141,8 @@ Options:
     return isBooleanResultExpr(expr) || isAriaBooleanAttr(name) || this.isBooleanTypedPropRef(expr);
   }
   _resolveLiteralConst(name) {
+    if (this.staticLoopSourceBoundNames.has(name))
+      return null;
     const c = (this.localConstants ?? []).find((lc) => lc.name === name);
     if (c?.value === undefined)
       return null;
@@ -189089,6 +189155,8 @@ Options:
     return null;
   }
   _resolveStaticRecordLiteral(objectName, key) {
+    if (this.staticLoopSourceBoundNames.has(objectName))
+      return null;
     const hit = lookupStaticRecordLiteral(objectName, key, this.localConstants);
     if (!hit)
       return null;
@@ -189126,14 +189194,10 @@ Options:
 var jinjaAdapter = new JinjaAdapter;
 // src/conformance-pins.ts
 var conformancePins = {
-  "static-array-children": [{ code: "BF103", severity: "error" }],
-  "todo-app": [{ code: "BF103", severity: "error" }],
-  "todo-app-ssr": [{ code: "BF103", severity: "error" }],
   "static-array-from-props": [
     { code: "BF101", severity: "error", issue: "https://github.com/piconic-ai/barefootjs/issues/2087" }
   ],
   "static-array-from-props-with-component": [
-    { code: "BF103", severity: "error" },
     { code: "BF101", severity: "error", issue: "https://github.com/piconic-ai/barefootjs/issues/2087" }
   ],
   "filter-nested-callback-predicate": [
@@ -189142,8 +189206,7 @@ var conformancePins = {
   "filter-nested-find-predicate": [
     { code: "BF101", severity: "error", issue: "https://github.com/piconic-ai/barefootjs/issues/2038" }
   ],
-  "array-map-function-reference": [{ code: "BF101", severity: "error" }],
-  "dangerous-inner-html": [{ code: "BF101", severity: "error" }]
+  "dangerous-inner-html-dynamic": [{ code: "BF101", severity: "error", issue: "https://github.com/piconic-ai/barefootjs/issues/2215" }]
 };
 // src/render-divergences.ts
 var renderDivergences = {};

package/dist/render-divergences.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-divergences.d.ts","sourceRoot":"","sources":["../src/render-divergences.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAExD,eAAO,MAAM,iBAAiB,EAAE,iBAAsB,CAAA"}
+{"version":3,"file":"render-divergences.d.ts","sourceRoot":"","sources":["../src/render-divergences.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAExD,eAAO,MAAM,iBAAiB,EAAE,iBAK/B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@barefootjs/jinja",
-  "version": "0.18.5",
+  "version": "0.18.7",
   "description": "Jinja2 adapter for BarefootJS — compiles IR to .jinja templates and ships the Python BarefootJS rendering runtime; runs under any Python web framework (Flask, etc.)",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,14 +53,14 @@
     "directory": "packages/adapter-jinja"
   },
   "dependencies": {
-    "@barefootjs/shared": "0.18.5"
+    "@barefootjs/shared": "0.18.7"
   },
   "peerDependencies": {
     "@barefootjs/jsx": ">=0.2.0"
   },
   "devDependencies": {
     "@barefootjs/adapter-tests": "0.1.0",
-    "@barefootjs/jsx": "0.18.5",
+    "@barefootjs/jsx": "0.18.7",
     "typescript": "^5.0.0"
   }
 }

package/src/__tests__/jinja-adapter-unit.test.ts

@@ -409,3 +409,123 @@ export function Parent() {
 // `filter-nested-find-predicate` (BF101 via `expectedDiagnostics`) and
 // `filter-nested-callback-predicate-client` (the `/* @client */` suppression
 // twin, which must render clean).
+
+// #2221: `_resolveLiteralConst` is a flat name lookup against
+// `ir.metadata.localConstants` with no notion of AST scope — it used to
+// substitute an outer const's literal value even at an occurrence that is
+// actually an enclosing loop callback's own (shadowing) parameter, so every
+// iteration rendered the same hard-coded literal. Guarded with the same
+// coarse `collectLoopBoundNames` exclusion as #2212: any name a loop binds
+// anywhere in the component never inlines, falling back to the bare
+// identifier. SSR-only tests for the same #2222 reason as the #2212
+// describe below.
+describe('JinjaAdapter - const inlining vs loop-param shadowing (#2221)', () => {
+  test('a loop param shadowing an outer literal const emits the identifier, not the const value', () => {
+    const { template } = compileAndGenerate(`
+function Widget() {
+  const label: string = 'x'
+  return <ul>{[2, 5].map((label) => <li key={label}>{1 + label}</li>)}</ul>
+}
+`)
+    // The loop body must reference the per-iteration loop var...
+    expect(template).toContain('1 + label')
+    // ...never the outer const's hard-coded value.
+    expect(template).not.toContain("1 + 'x'")
+  })
+
+  test('a numeric const shadowed by a loop param emits the identifier too', () => {
+    const { template } = compileAndGenerate(`
+function Widget() {
+  const count = 7
+  return <ul>{[2, 5].map((count) => <li key={count}>{1 + count}</li>)}</ul>
+}
+`)
+    expect(template).toContain('1 + count')
+    expect(template).not.toContain('1 + 7')
+  })
+
+  test('a literal const NOT shadowed by any loop still inlines (#1897 pin)', () => {
+    const { template } = compileAndGenerate(`
+function Widget({ values }: { values: number[] }) {
+  const totalPages = 5
+  return <div>
+    <p>Page 1 of {1 + totalPages}</p>
+    <ul>{values.map((v) => <li key={v}>{v}</li>)}</ul>
+  </div>
+}
+`)
+    expect(template).toContain('1 + 5')
+  })
+
+  // The accepted coarse-exclusion trade-off (same as #2212): a name that is
+  // loop-bound ANYWHERE in the component never inlines, even at a genuinely
+  // non-shadowed occurrence outside the loop — the bare identifier is
+  // emitted instead of the value.
+  test('a const referenced outside the loop whose name is loop-bound elsewhere falls back to the identifier (accepted trade-off)', () => {
+    const { template } = compileAndGenerate(`
+function Widget({ values }: { values: number[] }) {
+  const label: string = 'x'
+  return <div>
+    <p>{1 + label}</p>
+    <ul>{values.map((label) => <li key={label}>{2 + label}</li>)}</ul>
+  </div>
+}
+`)
+    expect(template).not.toContain("1 + 'x'")
+    expect(template).toContain('2 + label')
+  })
+})
+
+// #2237: `_resolveStaticRecordLiteral` (`IDENT.key` on a module-scope
+// object-literal const, e.g. `variantClasses.ghost` — #1896/#1897) is a
+// flat name lookup on `objectName` with no notion of AST scope, the
+// record-literal sibling of #2221's `_resolveLiteralConst` bug. It used to
+// substitute the outer const's member value even at an occurrence that is
+// actually an enclosing loop callback's own (shadowing) parameter, so every
+// iteration rendered the same hard-coded literal instead of the per-item
+// value. Guarded with the same coarse `staticLoopSourceBoundNames`
+// exclusion as #2221: any name a loop binds anywhere in the component
+// never inlines, falling back to the bare `cfg['x']` member expression.
+describe('JinjaAdapter - record-literal member lookup vs loop-param shadowing (#2237)', () => {
+  test('a loop param shadowing an outer module object const emits the member access, not the outer literal', () => {
+    const { template } = compileAndGenerate(`
+const cfg = { x: 'outer-lit' }
+function Widget({ rows }: { rows: { x: string }[] }) {
+  return <ul>{rows.map((cfg) => <li key={cfg.x}>{cfg.x}</li>)}</ul>
+}
+`)
+    // The loop body must reference the per-iteration member access...
+    expect(template).toContain("bf.string(cfg['x'])")
+    // ...never the outer const's hard-coded value.
+    expect(template).not.toContain("bf.string('outer-lit')")
+  })
+
+  test('a module object const NOT shadowed by any loop still inlines (variantClasses.ghost shape, #1896/#1897 pin)', () => {
+    const { template } = compileAndGenerate(`
+const variantClasses = { solid: 'bg-solid', ghost: 'bg-ghost' }
+function Widget({ variant }: { variant: 'solid' | 'ghost' }) {
+  return <div>{variantClasses.ghost}</div>
+}
+`)
+    expect(template).toContain("bf.string('bg-ghost')")
+  })
+
+  // The accepted coarse-exclusion trade-off (same as #2221/#2212): an
+  // object name that is loop-bound ANYWHERE in the component never
+  // inlines its member lookups, even at a genuinely non-shadowed
+  // occurrence outside the loop — the bare member expression is emitted
+  // instead of the value.
+  test('a record member referenced outside the loop whose object name is loop-bound elsewhere falls back to the member expression (accepted trade-off)', () => {
+    const { template } = compileAndGenerate(`
+const cfg = { x: 'outer-lit' }
+function Widget({ rows }: { rows: { x: string }[] }) {
+  return <div>
+    <p>{cfg.x}</p>
+    <ul>{rows.map((cfg) => <li key={cfg.x}>{cfg.x}</li>)}</ul>
+  </div>
+}
+`)
+    expect(template).not.toContain("bf.string('outer-lit')")
+    expect(template).toContain("bf.string(cfg['x'])")
+  })
+})

package/src/adapter/jinja-adapter.ts

@@ -140,6 +140,12 @@ import {
   queryHrefArgs,
   isValidHelperId,
   sortComparatorFromArrow,
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+  resolveStaticLoopSource,
+  collectLoopBoundNames,
 } from '@barefootjs/jsx'
 import { isAriaBooleanAttr, isBooleanResultExpr, isExplicitStringCall } from './boolean-result.ts'
 import type { ParsedExpr, LoweringMatcher } from '@barefootjs/jsx'
@@ -158,6 +164,7 @@ import {
   collectRootScopeNodes,
 } from './lib/ir-scope.ts'
 import { renderSortMethod, renderSortEval } from './expr/array-method.ts'
+import { staticValueToJinja } from './lib/static-value.ts'
 import { JinjaFilterEmitter, JinjaTopLevelEmitter, truthyTest } from './expr/emitters.ts'
 import type { JinjaEmitContext, JinjaSpreadContext, JinjaMemoContext } from './emit-context.ts'
 import {
@@ -266,6 +273,17 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
    */
   private localConstants: IRMetadata['localConstants'] = []
 
+  /**
+   * Every name a `.map()`/`.filter()` loop callback binds as its item/index
+   * parameter anywhere in the component (#2208 fable review). A static
+   * loop-SOURCE name (e.g. a function-scope `const items = [...]`) must
+   * never resolve through `resolveStaticLoopSource` at a use site where a
+   * DIFFERENT, enclosing loop's own callback param shadows it — same
+   * shadowing hazard, and same coarse-but-safe mitigation, as #2212's
+   * `collectLoopBoundNames` use in `collectStringValueNames`.
+   */
+  private staticLoopSourceBoundNames: Set<string> = new Set()
+
   /**
    * Optional, no-default props that are `None` when the caller omits them.
    * Their bare-reference attribute emission is guarded with a Jinja
@@ -298,6 +316,7 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
     // ("True"/"False") (#1897, pagination's data-active).
     this.booleanTypedProps = collectBooleanTypedProps(ir)
     this.localConstants = ir.metadata.localConstants ?? []
+    this.staticLoopSourceBoundNames = collectLoopBoundNames(ir)
     this.nullableOptionalProps = collectNullableOptionalProps(ir)
     this.stringValueNames = collectStringValueNames(ir)
     this.moduleStringConsts = collectModuleStringConsts(ir.metadata.localConstants)
@@ -520,7 +539,8 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
   renderElement(element: IRElement): string {
     const tag = element.tag
     const attrs = this.renderAttributes(element)
-    const children = this.renderChildren(element.children)
+    const dangerousHtml = this.renderDangerousInnerHtml(element)
+    const children = dangerousHtml !== null ? dangerousHtml : this.renderChildren(element.children)
 
     let hydrationAttrs = ''
     if (element.needsScope) {
@@ -555,6 +575,28 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
     return `<${tag}${attrs}${hydrationAttrs}>${children}</${tag}>`
   }
 
+  /**
+   * `dangerouslySetInnerHTML={{ __html: '...' }}` (#2207) — see the Blade
+   * adapter's identical helper for the full rationale. `null` means the
+   * attribute is absent (caller falls through to normal `renderChildren`);
+   * a non-`null` string (possibly `''`) replaces the children outright.
+   */
+  private renderDangerousInnerHtml(element: IRElement): string | null {
+    const resolution = resolveDangerousInnerHtml(element)
+    if (!resolution) return null
+    if (resolution.kind === 'dynamic') {
+      this.errors.push(dangerousInnerHtmlDiagnostic(resolution.expr, resolution.loc))
+      return ''
+    }
+    const violation = dangerousInnerHtmlMetacharViolation(resolution.html, this.name)
+    if (violation) {
+      const attr = element.attrs.find(isDangerousInnerHtmlAttr)!
+      this.errors.push(dangerousInnerHtmlDiagnostic(`{ __html: ${JSON.stringify(resolution.html)} }`, attr.loc, violation))
+      return ''
+    }
+    return resolution.html
+  }
+
   // ===========================================================================
   // Expression Rendering
   // ===========================================================================
@@ -568,8 +610,12 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
     }
 
     // Text-position interpolation of a possibly-non-string value — see the
-    // file header, divergence 2.
-    const jinjaExpr = `bf.string(${this.convertExpressionToJinja(expr.expr)})`
+    // file header, divergence 2. Thread the IR-carried `.parsed` tree
+    // through (mirrors go-template's `convertExpressionToGo(expr.expr,
+    // classify, expr.parsed)`) so a resolved bare-identifier
+    // `.map`/`.filter`/… callback (`resolveCallbackMethodFunctionReferences`,
+    // #2206) isn't lost to a fresh, unresolved re-parse of the raw string.
+    const jinjaExpr = `bf.string(${this.convertExpressionToJinja(expr.expr, expr.parsed)})`
 
     if (expr.slotId) {
       return `{{ bf.text_start("${expr.slotId}") | safe }}{{ ${jinjaExpr} }}{{ bf.text_end() | safe }}`
@@ -716,8 +762,27 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
     // test corpus only because the widened destructure gate (#2087 Phase
     // A/B) no longer refuses this fixture's `([emoji, users]) => ...`
     // param first.
+    // #2208: a loop source that is a fully-static array literal — either
+    // inline (`[{ label: 'Alpha' }, ...].map(...)`) or a bare identifier
+    // bound to a FUNCTION-scope local const whose initializer has no
+    // prop/signal/function-call dependency — inlines as a native Jinja
+    // list/dict literal below, the same way a module-scope const's value
+    // is already seeded. A runtime-computed local (#2069, e.g.
+    // `Object.entries(props.tags).filter(...)`) still refuses below.
+    // `isNameShadowed` guards a DIFFERENT, enclosing loop's own callback
+    // param shadowing this identifier (fable review) — never resolve the
+    // static const in that case. `rawArray` then falls through to the
+    // bare identifier expression below, same as before #2208 — which
+    // still trips the pre-existing BF101 gate for an unresolvable local
+    // const reference (a loud, conservative refusal, not a silent wrong
+    // value).
+    const staticItems = resolveStaticLoopSource(loop.arrayParsed, this.localConstants, {
+      isNameShadowed: name => this.staticLoopSourceBoundNames.has(name),
+    })
+    const staticArray = staticItems !== null ? staticValueToJinja(staticItems) : null
+
     const arrayName = loop.array.trim()
-    if (/^[A-Za-z_$][\w$]*$/.test(arrayName)) {
+    if (staticArray === null && /^[A-Za-z_$][\w$]*$/.test(arrayName)) {
       const arrayConst = (this.localConstants ?? []).find(c => c.name === arrayName)
       if (arrayConst && !arrayConst.isModule && this._resolveLiteralConst(arrayName) === null) {
         this.errors.push({
@@ -733,7 +798,7 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
       }
     }
 
-    const rawArray = this.convertExpressionToJinja(loop.array)
+    const rawArray = staticArray ?? this.convertExpressionToJinja(loop.array)
     // Apply sort if present: wrap the loop array in the shared `bf.sort`
     // helper, binding the sorted result to a per-iteration local so the
     // helper runs once.
@@ -1385,6 +1450,12 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
       // the unsupported-expression lowering is never reached for a deferred
       // predicate (no BF101 / BF102). #1966
       if (attr.clientOnly) continue
+      // `dangerouslySetInnerHTML` never renders as an HTML attribute — it's
+      // handled by `renderDangerousInnerHtml` instead, which replaces the
+      // element's children. Skip it here so its `{ __html: ... }` object
+      // literal never reaches the generic object-literal BF101 refusal
+      // (which would double-report alongside the purpose-built one).
+      if (isDangerousInnerHtmlAttr(attr)) continue
       // Rewrite JSX special-prop names to their HTML-attribute counterparts.
       let attrName: string
       if (attr.name === 'className') attrName = 'class'
@@ -1749,8 +1820,19 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
    * single-quoted string literal (`const totalPages = 5`, #1897
    * pagination) — function-scope consts never reach the per-render
    * context, so a bare reference would resolve to Undefined.
+   *
+   * The lookup is a flat name match with no notion of AST scope, so a
+   * name that any loop callback binds as its item/index param never
+   * inlines (#2221) — the occurrence may be the loop's own (shadowing)
+   * binding, and substituting the outer const's value there renders every
+   * iteration with the same hard-coded literal. Coarse (a genuinely
+   * non-shadowed same-named const elsewhere in the component also stops
+   * inlining, falling back to the bare identifier) but safe — the same
+   * trade-off as #2212's `collectLoopBoundNames` use in
+   * `collectStringValueNames`.
    */
   private _resolveLiteralConst(name: string): string | null {
+    if (this.staticLoopSourceBoundNames.has(name)) return null
     const c = (this.localConstants ?? []).find(lc => lc.name === name)
     if (c?.value === undefined) return null
     const v = c.value.trim()
@@ -1760,7 +1842,22 @@ export class JinjaAdapter extends BaseAdapter implements IRNodeEmitter<JinjaRend
     return null
   }
 
+  /**
+   * Resolve `IDENT.key` where `IDENT` is a module-scope object-literal const
+   * (`variantClasses.ghost`, #1896/#1897) to the looked-up scalar.
+   *
+   * The lookup is a flat name match on `objectName` with no notion of AST
+   * scope, so an enclosing loop callback's own param of the same name
+   * (`.map((cfg) => <li>{cfg.x}</li>)` shadowing a module `const cfg = {…}`)
+   * still resolved to the OUTER const's member value at every iteration
+   * (#2237) — the sibling hazard to #2221's `_resolveLiteralConst`. Same
+   * coarse-but-safe `staticLoopSourceBoundNames` guard: any name a loop
+   * binds anywhere in the component never inlines, falling back to the bare
+   * `cfg['x']` member expression (which a Jinja for-loop binds correctly
+   * at the shadowed occurrences).
+   */
   private _resolveStaticRecordLiteral(objectName: string, key: string): string | null {
+    if (this.staticLoopSourceBoundNames.has(objectName)) return null
     const hit = lookupStaticRecordLiteral(objectName, key, this.localConstants)
     if (!hit) return null
     return hit.kind === 'number'

package/src/adapter/lib/static-value.ts

@@ -0,0 +1,41 @@
+/**
+ * Serialize a compile-time-evaluated JS value (`@barefootjs/jsx`'s
+ * `evaluateStaticLiteral`/`resolveStaticLoopSource`, #2208) into a native
+ * Jinja2 literal. Used to inline a fully-static loop source (an inline
+ * array literal, or a function-scope local const with a static
+ * initializer) directly in a `{% for %}` header, rather than requiring a
+ * bound template variable.
+ *
+ * Returns `null` for a value this adapter can't represent as a literal
+ * (e.g. `undefined` reads for a missing object key are still representable
+ * as `none`, but anything else falls back to the caller's existing BF101
+ * refusal instead of guessing).
+ */
+
+import { escapeJinjaSingleQuoted, jinjaHashKey } from './jinja-naming.ts'
+
+export function staticValueToJinja(value: unknown): string | null {
+  if (value === null || value === undefined) return 'none'
+  if (typeof value === 'boolean') return value ? 'true' : 'false'
+  if (typeof value === 'number') return String(value)
+  if (typeof value === 'string') return `'${escapeJinjaSingleQuoted(value)}'`
+  if (Array.isArray(value)) {
+    const items: string[] = []
+    for (const el of value) {
+      const serialized = staticValueToJinja(el)
+      if (serialized === null) return null
+      items.push(serialized)
+    }
+    return `[${items.join(', ')}]`
+  }
+  if (typeof value === 'object') {
+    const entries: string[] = []
+    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
+      const serialized = staticValueToJinja(val)
+      if (serialized === null) return null
+      entries.push(`${jinjaHashKey(key)}: ${serialized}`)
+    }
+    return `{${entries.join(', ')}}`
+  }
+  return null
+}

package/src/conformance-pins.ts

@@ -11,15 +11,17 @@
 import type { ConformancePins } from '@barefootjs/jsx'
 
 export const conformancePins: ConformancePins = {
-  // Sibling-imported child component in a loop body: emits a
-  // cross-template call needing separate registration. BF103 makes
-  // the requirement loud (same as xslate).
-  'static-array-children': [{ code: 'BF103', severity: 'error' }],
-  // TodoApp / TodoAppSSR import `TodoItem` from a sibling file and
-  // call it inside a keyed `.map`. Same BF103 (imported child in
-  // `.map`) as xslate.
-  'todo-app': [{ code: 'BF103', severity: 'error' }],
-  'todo-app-ssr': [{ code: 'BF103', severity: 'error' }],
+  // `todo-app` / `todo-app-ssr` no longer pinned (#2205) — the conformance
+  // harness now passes `siblingTemplatesRegistered: true` for fixtures with
+  // sibling `components`, matching `bf build`'s real semantics, so the
+  // BF103 loop-body cross-template check no longer fires spuriously. (Both
+  // fixtures are still skipped on this adapter via `render-divergences.ts`
+  // — #2209 — for an unrelated signal-seeding gap.)
+  // `static-array-children` no longer pinned (#2208) — `items`'s
+  // array-literal initializer is now recognized as fully-static
+  // (`resolveStaticLoopSource`) and inlined as a native Jinja list/dict
+  // literal in the `{% for %}` header, the same way a module-scope const's
+  // value is already seeded.
   // #2087 Phase A/B widened the destructure gate (`isLowerableLoopDestructure`)
   // to admit array-index / nested-path fixed bindings, so the
   // `([emoji, users]) => ...` / `([id, t]) => ...` params in these two
@@ -44,10 +46,10 @@ export const conformancePins: ConformancePins = {
   'static-array-from-props': [
     { code: 'BF101', severity: 'error', issue: 'https://github.com/piconic-ai/barefootjs/issues/2087' },
   ],
-  // Both BF103 (imported child) and BF101 (unresolvable computed loop
-  // array, see above) fire.
+  // BF101 (unresolvable computed loop array, see above) fires; BF103
+  // (imported child in the loop body) no longer does now that the
+  // conformance harness passes `siblingTemplatesRegistered: true` (#2205).
   'static-array-from-props-with-component': [
-    { code: 'BF103', severity: 'error' },
     { code: 'BF101', severity: 'error', issue: 'https://github.com/piconic-ai/barefootjs/issues/2087' },
   ],
   // Rest-destructure / structured-path `.map()` callbacks (#2087 Phase B):
@@ -91,17 +93,14 @@ export const conformancePins: ConformancePins = {
   // / etc. via the same evaluator-JSON mechanism as `.filter` / `.every` /
   // `.some`, so they render. Only the NESTED-in-a-predicate form above is
   // refused (#2038).
-  // #2073 follow-up (same as xslate): a function-reference `.map(format)`
-  // callback has no arrow body to serialize — not a CALLBACK_METHODS shape
-  // (`asCallbackMethodCall` requires an arrow argument) — so the shared
-  // `isSupported`'s `UNSUPPORTED_METHODS` gate refuses it with the generic
-  // "Expression not supported" BF101 rather than emitting a broken
-  // template.
-  'array-map-function-reference': [{ code: 'BF101', severity: 'error' }],
-  // Edge-case sweep (Priority 12): `dangerouslySetInnerHTML` requires a
-  // deliberate raw-HTML (unescaped) output affordance in the target
-  // template language. No lowering exists yet, so the compiler refuses
-  // the shape loudly instead of emitting entity-escaped markup that
-  // silently renders tags as text.
-  'dangerous-inner-html': [{ code: 'BF101', severity: 'error' }],
+  // `array-map-function-reference` no longer pinned — a bare-identifier
+  // `.map(format)` callback now resolves one hop to its declaration
+  // (`resolveCallbackMethodFunctionReferences`, #2206), the same mechanism
+  // #2090 established for `.sort(fnref)`.
+  // `dangerous-inner-html` no longer pinned — a compile-time string-literal
+  // `dangerouslySetInnerHTML={{ __html: '...' }}` is spliced directly into
+  // the template as trusted raw text (`resolveDangerousInnerHtml`, #2207).
+  // A dynamic/signal-derived value still refuses with BF101 — see the
+  // `dangerous-inner-html-dynamic` fixture/pin below (tracked: #2215).
+  'dangerous-inner-html-dynamic': [{ code: 'BF101', severity: 'error', issue: 'https://github.com/piconic-ai/barefootjs/issues/2215' }],
 }

package/src/render-divergences.ts

@@ -14,4 +14,9 @@
 
 import type { RenderDivergences } from '@barefootjs/jsx'
 
-export const renderDivergences: RenderDivergences = {}
+export const renderDivergences: RenderDivergences = {
+  // `todo-app` / `todo-app-ssr` no longer diverge (#2209) — the shared
+  // `evaluateSignalInit` (`@barefootjs/jsx`, sandboxed real-JS evaluation
+  // instead of a fixed regex-shape catalogue) now correctly seeds `todos`
+  // from `(props.initialTodos ?? []).map(t => ({ ...t, editing: false }))`.
+}

package/src/test-render.ts

@@ -16,7 +16,7 @@
  * generated render script (Python, not Perl) and its literal syntax differ.
  */
 
-import { compileJSX, extractSsrDefaults, importsSearchParams } from '@barefootjs/jsx'
+import { compileJSX, extractSsrDefaults, importsSearchParams, evaluateSignalInit, tryEvaluateSignalInit } from '@barefootjs/jsx'
 import type { ComponentIR } from '@barefootjs/jsx'
 import { mkdir, rm } from 'node:fs/promises'
 import { resolve } from 'node:path'
@@ -125,8 +125,15 @@ export async function renderJinjaComponent(options: RenderOptions): Promise<stri
     }
   }
 
-  // Compile parent source.
-  const result = compileJSX(source, 'component.tsx', { adapter, outputIR: true })
+  // Compile parent source. `siblingTemplatesRegistered: Boolean(components)`
+  // matches this harness's real behavior — every sibling child template is registered
+  // alongside the parent before rendering, so a loop-body cross-template
+  // call resolves at render time (#2205).
+  const result = compileJSX(source, 'component.tsx', {
+    adapter,
+    outputIR: true,
+    siblingTemplatesRegistered: Boolean(components),
+  })
 
   const errors = result.errors.filter(e => e.severity === 'error')
   if (errors.length > 0) {
@@ -461,9 +468,9 @@ function buildPythonProps(
   for (const param of ir.metadata.propsParams) {
     if (props && param.name in props) continue
     if (param.defaultValue) {
-      const pyValue = jsToPyValue(param.defaultValue)
-      if (pyValue !== null) {
-        entries.push(`${pyStr(param.name)}: ${pyValue}`)
+      const result = tryEvaluateSignalInit(param.defaultValue.trim(), props)
+      if (result.ok) {
+        entries.push(`${pyStr(param.name)}: ${toPyLiteral(result.value)}`)
         continue
       }
     }
@@ -539,119 +546,6 @@ function buildPythonProps(
   return `{${entries.join(', ')}}`
 }
 
-/**
- * Evaluate a signal initializer expression using provided props.
- * Handles: props.initial ?? 0, props.value, literal values.
- */
-export function evaluateSignalInit(
-  expr: string,
-  props?: Record<string, unknown>,
-): unknown {
-  const nullishMatch = expr.match(/^props\.(\w+)\s*\?\?\s*(.+)$/)
-  if (nullishMatch) {
-    const propName = nullishMatch[1]
-    const defaultExpr = nullishMatch[2].trim()
-    if (props && propName in props) return props[propName]
-    return parseLiteral(defaultExpr)
-  }
-
-  const propsMatch = expr.match(/^props\.(\w+)$/)
-  if (propsMatch) {
-    if (props && propsMatch[1] in props) return props[propsMatch[1]]
-    return null
-  }
-
-  return parseLiteral(expr)
-}
-
-function parseLiteral(expr: string): unknown {
-  if (/^-?\d+(\.\d+)?$/.test(expr)) return Number(expr)
-  if (expr === 'true') return true
-  if (expr === 'false') return false
-  if (expr === '[]') return []
-
-  {
-    const t = expr.trim()
-    if (t.startsWith('[') && t.endsWith(']')) {
-      const inner = t.slice(1, -1).trim()
-      if (!inner) return []
-      const out: unknown[] = []
-      for (const seg of splitTopLevelCommas(inner)) {
-        if (!seg.trim()) continue
-        const parsed = parseLiteral(seg.trim())
-        if (parsed === null && seg.trim() !== 'null') return null
-        out.push(parsed)
-      }
-      return out
-    }
-  }
-
-  const stringMatch = expr.match(/^(['"])(.*)\1$/s)
-  if (stringMatch) return unescapeJsString(stringMatch[2])
-
-  const trimmed = expr.trim()
-  if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
-    const inner = trimmed.slice(1, -1).trim()
-    if (!inner) return {}
-    const obj: Record<string, unknown> = {}
-    for (const pair of splitTopLevelCommas(inner)) {
-      if (!pair.trim()) continue
-      const colonIdx = pair.indexOf(':')
-      if (colonIdx < 0) return null
-      let key = pair.slice(0, colonIdx).trim()
-      const val = pair.slice(colonIdx + 1).trim()
-      const keyMatch = key.match(/^(['"])(.*)\1$/s)
-      if (keyMatch) key = unescapeJsString(keyMatch[2])
-      const parsedVal = parseLiteral(val)
-      if (parsedVal === null && val !== 'null') return null
-      obj[key] = parsedVal
-    }
-    return obj
-  }
-  return null
-}
-
-function splitTopLevelCommas(inner: string): string[] {
-  const segments: string[] = []
-  let depth = 0
-  let start = 0
-  let quote: string | null = null
-  for (let i = 0; i < inner.length; i++) {
-    const c = inner[i]
-    if (quote) {
-      if (c === quote) {
-        let backslashes = 0
-        for (let j = i - 1; j >= 0 && inner[j] === '\\'; j--) backslashes++
-        if (backslashes % 2 === 0) quote = null
-      }
-      continue
-    }
-    if (c === '"' || c === "'") {
-      quote = c
-      continue
-    }
-    if (c === '{' || c === '[') depth++
-    else if (c === '}' || c === ']') depth--
-    else if (c === ',' && depth === 0) {
-      segments.push(inner.slice(start, i))
-      start = i + 1
-    }
-  }
-  segments.push(inner.slice(start))
-  return segments
-}
-
-function unescapeJsString(s: string): string {
-  return s.replace(/\\(.)/g, (_, c) => {
-    switch (c) {
-      case 'n': return '\n'
-      case 'r': return '\r'
-      case 't': return '\t'
-      case '0': return '\0'
-      default: return c
-    }
-  })
-}
 
 /**
  * Python string literal for arbitrary text, via `JSON.stringify`. JSON's
@@ -689,26 +583,3 @@ function toPyLiteral(value: unknown): string {
   return 'None'
 }
 
-/**
- * Convert a JS literal value to a Python literal.
- * Handles: numbers, strings, booleans, empty arrays, props.xxx ?? default.
- */
-function jsToPyValue(jsValue: string): string | null {
-  const v = jsValue.trim()
-
-  if (/^-?\d+(\.\d+)?$/.test(v)) return v
-  // A JS string literal (single- or double-quoted) is, character-for-character,
-  // ALSO a valid Python string literal for the common escape sequences both
-  // languages share — pass it through verbatim rather than re-quoting.
-  if (/^['"].*['"]$/.test(v)) return v
-  if (v === 'true') return 'True'
-  if (v === 'false') return 'False'
-  if (v === '[]') return '[]'
-
-  const nullishMatch = v.match(/\?\?\s*(.+)$/)
-  if (nullishMatch) return jsToPyValue(nullishMatch[1])
-
-  if (v.startsWith('props.')) return 'None'
-
-  return null
-}