@barefootjs/jsx 0.18.4 → 0.18.7

package/src/adapters/dangerous-inner-html.ts

@@ -0,0 +1,186 @@
+/**
+ * Shared `dangerouslySetInnerHTML={{ __html: expr }}` recognition + policy
+ * (#2207). Single place every template adapter calls from `renderElement`,
+ * so the injection-safety-relevant policy — "only a compile-time string
+ * literal is lowered; anything else refuses loudly" — lives in exactly one
+ * reviewable spot instead of being re-derived independently in 8 adapters.
+ *
+ * Scope, deliberately narrow for v1 (see #2207 / #2215 for the follow-up):
+ * a static literal is spliced directly into the adapter's OWN template
+ * source as trusted text (same trust domain as hand-writing the HTML into
+ * the template) — never routed through a `|safe`/`|raw`/`{!! !!}`-style
+ * runtime raw-output primitive, which would reopen a template-source
+ * injection surface for no benefit (the value is already fully known at
+ * compile time). A DYNAMIC value (signal, prop, a template literal WITH a
+ * substitution, local const, anything non-literal) is refused with
+ * `BF101` — a no-substitution template literal is NOT dynamic; the parser
+ * normalizes it to the same `{kind:'literal', literalType:'string'}` shape
+ * as a plain string literal, so it's treated identically (see
+ * `staticHtmlLiteral` below). Hono/CSR already support it (the client
+ * drives a `createEffect`-based `el.innerHTML = …`
+ * assignment — see `ir-to-client-js/emit-reactive.ts`), so this is a
+ * template-adapter-only gap, tracked separately (#2215) rather than folded
+ * into this literal-only cut.
+ */
+
+import type { CompilerError, IRAttribute, IRElement, SourceLocation } from '../types.ts'
+import { parseExpression, type ParsedExpr } from '../expression-parser.ts'
+
+const DANGEROUS_INNER_HTML_ATTR = 'dangerouslySetInnerHTML'
+
+export function isDangerousInnerHtmlAttr(attr: IRAttribute): boolean {
+  return attr.name === DANGEROUS_INNER_HTML_ATTR
+}
+
+export type DangerousInnerHtmlResolution =
+  | { kind: 'static'; html: string }
+  | { kind: 'dynamic'; expr: string; loc: SourceLocation }
+
+/**
+ * Resolve `element`'s `dangerouslySetInnerHTML` attribute, if present.
+ * Returns `null` when the attribute is absent (the overwhelmingly common
+ * case — callers should treat `null` as "render this element normally") —
+ * or when it carries `/* @client *\/` (Fable review, #2217): a `clientOnly`
+ * attr is already deferred to hydrate by every adapter's `renderAttributes`
+ * (`if (attr.clientOnly) continue`, unrelated to this module), which is
+ * itself a working escape hatch for a dynamic `__html` — the client's
+ * `createEffect`-driven `el.innerHTML = …` assignment (`emit-reactive.ts`)
+ * runs regardless of what SSR does. Treating `clientOnly` as "render this
+ * element normally" here (rather than refusing with BF101) preserves that
+ * escape hatch instead of regressing it.
+ * A present-but-non-`expression` value (e.g. a bare boolean/spread — not a
+ * shape `{ __html }` can ever legitimately take) is treated as `dynamic`
+ * so it refuses rather than silently doing nothing.
+ */
+export function resolveDangerousInnerHtml(element: IRElement): DangerousInnerHtmlResolution | null {
+  const attr = element.attrs.find(isDangerousInnerHtmlAttr)
+  if (!attr) return null
+  if (attr.clientOnly) return null
+  if (attr.value.kind !== 'expression') {
+    return { kind: 'dynamic', expr: '', loc: attr.loc }
+  }
+  const parsed = attr.value.parsed ?? parseExpression(attr.value.expr.trim())
+  const html = staticHtmlLiteral(parsed)
+  if (html !== null) return { kind: 'static', html }
+  return { kind: 'dynamic', expr: attr.value.expr, loc: attr.loc }
+}
+
+/**
+ * `{ __html: '<b>bold</b>' }` → the literal string, nothing else. Exactly
+ * one property, key `__html` (identifier or string form — `{ __html: … }`
+ * and `{ '__html': … }` are equivalent JS), non-shorthand (`{ __html }`
+ * would read a variable, not a literal), value a compile-time STRING
+ * LITERAL `ParsedExpr` (`{kind:'literal', literalType:'string'}`) — which
+ * a no-substitution template literal (`` `<b>bold</b>` ``) already parses
+ * to, so it's accepted the same as a quoted string. A template literal
+ * WITH a substitution, a local `const`, string concatenation, or any other
+ * non-literal shape all fall through to `null` — no const-folding, no
+ * partial evaluation. Widening this is a single-place change here,
+ * deliberately not attempted in v1 (#2207).
+ */
+function staticHtmlLiteral(parsed: ParsedExpr): string | null {
+  if (parsed.kind !== 'object-literal') return null
+  if (parsed.properties.length !== 1) return null
+  const [prop] = parsed.properties
+  if (prop.shorthand) return null
+  if (prop.key !== '__html') return null
+  if (prop.value.kind !== 'literal' || prop.value.literalType !== 'string') return null
+  return prop.value.value as string
+}
+
+/**
+ * Per-adapter template-metacharacter guard for the STATIC-literal path.
+ * The literal is spliced into the adapter's own template source as plain
+ * text — safe against HTML injection (it's the developer's own compile-time
+ * string, same trust boundary as writing the HTML by hand), but NOT
+ * automatically safe against TEMPLATE-source injection: a literal
+ * containing `{{ … }}` (Go/Jinja/minijinja/Twig), `<% … %>` (ERB/
+ * Mojolicious), `{!! !!}`/`@directive`/`<?php`/`<x-…>` (Blade — the last is
+ * Laravel's component-tag syntax, on by default; see below), or `<: … :>`
+ * (Xslate) would be interpreted as a live template construct instead of
+ * inert text once spliced in. Mojolicious and Xslate also support
+ * whole-line "line code" (a line starting with `%`/`:`, possibly indented —
+ * `\s` covers the same whitespace class Mojo::Template/Xslate strip),
+ * checked with `m`. Refuses (via {@link dangerousInnerHtmlDiagnostic})
+ * rather than escaping — escaping a supposedly-raw-HTML literal would
+ * silently corrupt the developer's own markup, which is worse than a loud
+ * compile-time refusal.
+ *
+ * Blade's `<x-…>`/`</x-…>`: this project's `BladeBackend` constructs a
+ * plain `Illuminate\View\Compilers\BladeCompiler`, whose component-tag
+ * compiler (`$compilesComponentTags = true` by default) resolves and
+ * renders a live Blade component for `<x-foo>` — NOT template-substitution,
+ * full component-class/view resolution (Fable review, #2217). This is the
+ * single sharpest case of "not inert text once spliced" in the whole guard
+ * table, sharper than a bare `{{ }}` interpolation.
+ *
+ * Go's `html/template` context-aware escaper is a DOCUMENTED caveat, not a
+ * guarded case: it parses the spliced literal to pick escaping contexts for
+ * SUBSEQUENT `{{ }}` actions in the same template, so malformed markup (an
+ * unclosed `<script>`/`<style>`) can produce a template `Parse` error or
+ * mis-contexted escaping of later actions — output corruption, never
+ * injection, and no different from hand-writing the same malformed HTML
+ * into the template (this module's stated trust domain). The `{{` guard
+ * below still catches the actual injection vector (a literal containing a
+ * live action).
+ */
+const TEMPLATE_METACHAR_PATTERNS: Readonly<Record<string, RegExp>> = {
+  blade: /\{\{|\{!!|<\?|@\w|<\/?\s*x[-:]/,
+  erb: /<%/,
+  'go-template': /\{\{/,
+  jinja: /\{\{|\{%|\{#/,
+  minijinja: /\{\{|\{%|\{#/,
+  mojolicious: /<%|^\s*%/m,
+  twig: /\{\{|\{%|\{#/,
+  xslate: /<:|^\s*:/m,
+}
+
+/**
+ * `null` when `html` is safe to splice as-is into `adapterId`'s template
+ * source; otherwise a human-readable reason naming the offending adapter's
+ * metacharacter family (or the missing-guard case below), for the refusal
+ * message.
+ *
+ * FAILS CLOSED for an `adapterId` with no entry in
+ * {@link TEMPLATE_METACHAR_PATTERNS} (Fable review, #2217): a 9th template
+ * adapter added later — e.g. by following the repo's own `add-adapter`
+ * playbook, which will tell it to wire the same
+ * `resolveDangerousInnerHtml`/`dangerousInnerHtmlMetacharViolation` calls
+ * every existing adapter does — must not silently get an unguarded splice
+ * just because nobody remembered to extend this table. Refusing loudly is
+ * the safe default; only the 8 adapters actually verified against their
+ * own template compiler's syntax get to skip the refusal.
+ */
+export function dangerousInnerHtmlMetacharViolation(html: string, adapterId: string): string | null {
+  const pattern = TEMPLATE_METACHAR_PATTERNS[adapterId]
+  if (!pattern) {
+    return `no template-metacharacter guard is defined for adapter '${adapterId}' — refusing rather than splicing unguarded`
+  }
+  if (!pattern.test(html)) return null
+  return `the literal HTML contains a sequence ${adapterId}'s own template compiler would interpret (not inert text once spliced into the template)`
+}
+
+/**
+ * Purpose-built `BF101` for a `dangerouslySetInnerHTML` value this adapter
+ * can't lower — either genuinely dynamic (not a literal) or a static
+ * literal that fails the metachar guard above. Named `reason` so both
+ * refusal paths funnel through the same message shape rather than growing
+ * two near-identical adapter-side error strings.
+ */
+export function dangerousInnerHtmlDiagnostic(
+  expr: string,
+  loc: SourceLocation,
+  reason?: string,
+): CompilerError {
+  const detail = reason ? ` — ${reason}.` : ''
+  return {
+    code: 'BF101',
+    severity: 'error',
+    message: `dangerouslySetInnerHTML requires a compile-time string literal __html value on template adapters (e.g. { __html: '...' })${expr ? `: ${expr.trim()}` : ''}${detail}`,
+    loc,
+    suggestion: {
+      message:
+        'Dynamic or signal-derived HTML for dangerouslySetInnerHTML is only supported on Hono/CSR today (tracked separately: https://github.com/piconic-ai/barefootjs/issues/2215). Use an inline string literal, or defer it to the client with /* @client */ (e.g. dangerouslySetInnerHTML={/* @client */ { __html: expr }}) so hydration sets it instead of SSR.',
+    },
+  }
+}

package/src/adapters/loop-bound-names.ts

@@ -0,0 +1,80 @@
+/**
+ * Every name a `.map()`/`.filter()` loop callback binds as its item or
+ * index parameter, anywhere in a component's IR tree (#2212 review
+ * finding). `isStringTypedOperand`'s identifier arm resolves a bare
+ * identifier against `collectStringValueNames`'s flat, scope-BLIND
+ * `Set<string>` — so a loop callback whose param happens to reuse a
+ * string prop's name (`items.map((name) => ... 1 + name ...)`, where the
+ * component also has a string `name` prop) would otherwise be
+ * misdetected as string-typed, silently lowering a NUMERIC `+` to the
+ * adapter's string-concat operator instead of leaving it numeric — wrong
+ * rendered output, not a refusal. Subtracting every loop-bound name from
+ * the string-name set (in each adapter's `collectStringValueNames`) is a
+ * coarse but SAFE mitigation: a name used as a loop param anywhere in the
+ * component never gets string-concat treatment anywhere in the
+ * component, even at a non-shadowed use site outside that loop — which
+ * degrades to the ALREADY-accepted residual (`+` falls back to numeric,
+ * same as before #2212 for an unresolvable operand) rather than ever
+ * producing silently-wrong output.
+ */
+
+import type { ComponentIR, IRNode } from '../types.ts'
+
+export function collectLoopBoundNames(ir: ComponentIR): Set<string> {
+  const names = new Set<string>()
+  const visit = (node: IRNode | null | undefined): void => {
+    if (!node) return
+    switch (node.type) {
+      case 'element':
+      case 'component':
+      case 'fragment':
+      case 'provider':
+        for (const child of node.children) visit(child)
+        break
+      case 'async':
+        visit(node.fallback)
+        for (const child of node.children) visit(child)
+        break
+      case 'loop':
+        names.add(node.param)
+        if (node.index) names.add(node.index)
+        // A destructured callback param (`.map(({ name }) => ...)`) binds
+        // its extracted names via `paramBindings`, not `param` itself
+        // (`param` holds the raw pattern text there) — adapters that lower
+        // the destructure to a `{% set name = __bf_item.name %}`-style
+        // local (#2087) leave `name` reachable as a bare identifier in the
+        // body, so it needs the same exclusion as a plain loop param.
+        for (const binding of node.paramBindings ?? []) names.add(binding.name)
+        // A `.filter(pred).map(cb)` chain's filter predicate is emitted
+        // through the same binary/string-name machinery, using its OWN
+        // param (which may differ from the map callback's `param`) before
+        // any rename to the loop param happens.
+        if (node.filterPredicate) names.add(node.filterPredicate.param)
+        for (const child of node.children) visit(child)
+        if (node.childComponent) {
+          for (const child of node.childComponent.children) visit(child)
+        }
+        for (const nested of node.nestedComponents ?? []) {
+          for (const child of nested.children) visit(child)
+        }
+        for (const frag of node.flatMapCallback?.fragments ?? []) {
+          visit(frag.ir)
+        }
+        break
+      case 'conditional':
+        visit(node.whenTrue)
+        visit(node.whenFalse)
+        break
+      case 'if-statement':
+        visit(node.consequent)
+        if (node.alternate) visit(node.alternate)
+        break
+      case 'text':
+      case 'expression':
+      case 'slot':
+        break
+    }
+  }
+  visit(ir.root)
+  return names
+}

package/src/adapters/parsed-expr-emitter.ts

@@ -67,11 +67,14 @@ export type ArrayMethod =
   | 'toLowerCase'
   | 'toUpperCase'
   | 'trim'
+  | 'trimStart'
+  | 'trimEnd'
   | 'toFixed'
   | 'split'
   | 'startsWith'
   | 'endsWith'
   | 'replace'
+  | 'replaceAll'
   | 'repeat'
   | 'padStart'
   | 'padEnd'
@@ -111,10 +114,16 @@ export interface ParsedExprEmitter {
   identifier(name: string): string
   literal(value: string | number | boolean | null, literalType: LiteralType): string
   call(callee: ParsedExpr, args: ParsedExpr[], emit: (e: ParsedExpr) => string): string
+  // `optional` is true for a `?.`-written access (`user?.name`); see the
+  // `ParsedExpr` `member` variant's docstring in `expression-parser.ts`
+  // for the single-hop caveat. Every adapter's `member()` implementation
+  // that doesn't need it (its lowering is already null-safe) is free to
+  // ignore the parameter.
   member(
     object: ParsedExpr,
     property: string,
     computed: boolean,
+    optional: boolean,
     emit: (e: ParsedExpr) => string,
   ): string
   // Element access with a non-literal index (`arr[index]`). The index
@@ -219,6 +228,15 @@ export function isStringTypedOperand(expr: ParsedExpr, isStringName: (n: string)
   if (expr.kind === 'member' && expr.object.kind === 'identifier' && expr.object.name === 'props') {
     return isStringName(expr.property)
   }
+  // A bare identifier (#2212): a destructured prop param or a same-file
+  // local const, string-typed per the caller's `isStringName` set — each
+  // adapter's `collectStringValueNames` already tracks `propsParams`, so a
+  // component's own `{ a, b }: { a: string; b: string }` destructure was
+  // only unreachable here for lack of this arm; extending
+  // `collectStringValueNames` to also walk `ir.metadata.localConstants`
+  // (adapter-side change) closes the "two same-file string consts" shape
+  // the same way.
+  if (expr.kind === 'identifier') return isStringName(expr.name)
   if (expr.kind === 'binary' && expr.op === '+') {
     return isStringTypedOperand(expr.left, isStringName) || isStringTypedOperand(expr.right, isStringName)
   }
@@ -288,7 +306,7 @@ export function emitParsedExpr(expr: ParsedExpr, emitter: ParsedExprEmitter): st
       return emitter.call(expr.callee, expr.args, emit)
     }
     case 'member':
-      return emitter.member(expr.object, expr.property, expr.computed, emit)
+      return emitter.member(expr.object, expr.property, expr.computed, expr.optional, emit)
     case 'index-access':
       return emitter.indexAccess(expr.object, expr.index, emit)
     case 'binary':

package/src/analyzer.ts

@@ -50,6 +50,11 @@ export function needsTypeBasedDetection(source: string): boolean {
   if (REACTIVE_BRAND_PACKAGES.some(pkg => source.includes(pkg))) return true
   // BF023/BF024 nullable-key check needs getTypeAtLocation() on the key expression.
   if (/\.map\s*\(/.test(source)) return true
+  // createSelector's returned accessor is Reactive<>-branded like a library
+  // accessor above — a selector call outside any `.map()` (no loop in the
+  // file at all) would otherwise skip the TypeChecker entirely and miss the
+  // brand.
+  if (source.includes('createSelector')) return true
   return false
 }
 
@@ -1828,6 +1833,7 @@ function collectLocalDeclarations(root: ts.Node): Set<string> {
 // and are emitted by the compiler for 'use client' components.
 const CLIENT_EXPORTS = new Set([
   'createSignal', 'createEffect', 'createDisposableEffect', 'createMemo',
+  'createSelector',
   'createRoot', 'onCleanup', 'onMount', 'untrack', 'batch', 'splitProps',
   'forwardProps', 'unwrap', '__slot',
   'createContext', 'useContext', 'provideContext',

package/src/expression-parser.ts

@@ -25,7 +25,21 @@ export type ParsedExpr =
   // canonical form in `value`.
   | { kind: 'literal'; value: string | number | boolean | null; literalType: 'string' | 'number' | 'boolean' | 'null'; raw?: string }
   | { kind: 'call'; callee: ParsedExpr; args: ParsedExpr[] }
-  | { kind: 'member'; object: ParsedExpr; property: string; computed: boolean }
+  // `optional` is true for a `?.`-written access (`user?.name`,
+  // `arr?.[0]`) — the ONE hop that was actually optional-chained in JS
+  // source; a plain `.`/`[]` access is `false`. Adapters whose member
+  // lowering is already null-safe by construction (e.g. Jinja's `[]`
+  // subscript swallows a `None` receiver, Blade's `data_get` helper)
+  // ignore this field entirely; Go and ERB (whose native `.` access
+  // panics/raises on a nil/undefined receiver) route an `optional: true`
+  // access through a defensive form (`bf_get`, Ruby `&.`) instead. NOTE:
+  // this does NOT reproduce JS's whole-chain short-circuit for a
+  // MULTI-hop chain (`a?.b.c` also guards `.c` in JS once `a` is
+  // nullish) — only the single hop written with `?.` is marked; a
+  // following plain `.c` on a possibly-nullish `a?.b` is a known,
+  // untracked limitation on Go/ERB (not exercised by the current
+  // `optional-chaining-prop` fixture, which is single-hop only).
+  | { kind: 'member'; object: ParsedExpr; property: string; computed: boolean; optional: boolean }
   // Element access with a NON-literal index (`selected()[index]`,
   // `rows[i + 1]`). A literal-index access (`arr[0]`, `obj['key']`)
   // stays a `member` (computed) since the key is statically known and
@@ -88,11 +102,14 @@ export type ParsedExpr =
         | 'toLowerCase'
         | 'toUpperCase'
         | 'trim'
+        | 'trimStart'
+        | 'trimEnd'
         | 'toFixed'
         | 'split'
         | 'startsWith'
         | 'endsWith'
         | 'replace'
+        | 'replaceAll'
         | 'repeat'
         | 'padStart'
         | 'padEnd'
@@ -345,18 +362,17 @@ const UNSUPPORTED_METHODS = new Set([
   // `startsWith` / `endsWith` are no longer here — both lower via the
   // `array-method` IR + `bf_starts_with` / `bf_ends_with` (Go) and
   // `bf->starts_with` / `bf->ends_with` (Mojo). See #1448 Tier B.
-  // `replace` is no longer here — the string-pattern form lowers via
-  // the `array-method` IR + `bf_replace` (Go) / `bf->replace` (Mojo);
-  // the regex-pattern form is refused at the parse arm below (it would
-  // need the per-adapter regex-flavour decision). `replaceAll` stays
-  // refused. See #1448 Tier B.
+  // `replace` / `replaceAll` are no longer here — the string-pattern
+  // form of each lowers via the `array-method` IR + `bf_replace` /
+  // `bf_replace_all` (Go) / `bf->replace` / `bf->replace_all` (Mojo);
+  // the regex-pattern form of EITHER is refused at the parse arm below
+  // (it would need the per-adapter regex-flavour decision).
   // `repeat` is no longer here — `String.prototype.repeat(n)` lowers via
   // the `array-method` IR + `bf_repeat` (Go) / `bf->repeat` (Mojo).
   // See #1448 Tier B.
   // `padStart` / `padEnd` are no longer here — both lower via the
   // `array-method` IR + `bf_pad_start` / `bf_pad_end` (Go) and
   // `bf->pad_start` / `bf->pad_end` (Mojo). See #1448 Tier B.
-  'replaceAll',
   'charAt', 'charCodeAt', 'codePointAt', 'normalize',
   'substring', 'substr', 'match', 'matchAll', 'search',
 ])
@@ -882,6 +898,16 @@ function convertNode(node: ts.Node, raw: string): ParsedExpr {
       if (callee.property === 'trim') {
         return { kind: 'array-method', method: 'trim', object: callee.object, args }
       }
+      // `.trimStart()` / `.trimEnd()` — the one-sided siblings of
+      // `.trim()` (#2183 follow-up). No array equivalent exists, so
+      // there's no receiver-type ambiguity to resolve (unlike `.slice`);
+      // each is a dedicated `array-method` variant (matching the
+      // `padStart`/`padEnd` precedent — separate members, not a shared
+      // member with a `side` flag) lowering to its own runtime helper
+      // per adapter, not `.trim()` with a flag.
+      if (callee.property === 'trimStart' || callee.property === 'trimEnd') {
+        return { kind: 'array-method', method: callee.property, object: callee.object, args }
+      }
       // `.toFixed(digits?)` — Number → fixed-decimal string. The digit
       // count (default 0) travels as the single arg; all adapters route
       // through a `to_fixed` runtime helper (Perl) / `fmt.Sprintf` (Go)
@@ -954,19 +980,25 @@ function convertNode(node: ts.Node, raw: string): ParsedExpr {
       // refused: `isSupported` maps a regex-pattern `.replace` to the
       // deferred-form BF101 reason — the Perl `s///` vs Go
       // `regexp.ReplaceAllString` flavour gap is the open design
-      // question in #1448. `replaceAll` stays refused entirely.
+      // question in #1448. `.replaceAll(pattern, replacement)` shares
+      // this arm (#2182 follow-up): same arity/regex/object-literal
+      // gates, only the `method` tag and its runtime helper differ —
+      // `bf_replace_all` (Go, `strings.ReplaceAll`) / `bf->replace_all`
+      // (Mojo) replace EVERY occurrence, where `.replace`'s helpers
+      // replace only the first.
       //
       // Full JS arity: a third+ argument is ignored (the adapter reads
       // only the pattern + replacement). The one- and zero-argument
       // forms are refused: JS coerces the missing replacement (and
       // pattern) to the literal string "undefined", a degenerate result
       // (mirrors the `.includes()` / `.startsWith()` zero-arg refusal).
-      if (callee.property === 'replace') {
+      if (callee.property === 'replace' || callee.property === 'replaceAll') {
+        const method = callee.property
         if (args.length < 2) {
           return {
             kind: 'unsupported',
             raw,
-            reason: `\`.replace(${args.length === 0 ? '' : 'pattern'})\` needs both a pattern and a replacement — JS coerces the missing argument to the string "undefined", a degenerate result. Pass both arguments, or pre-compute the value before the template.`,
+            reason: `\`.${method}(${args.length === 0 ? '' : 'pattern'})\` needs both a pattern and a replacement — JS coerces the missing argument to the string "undefined", a degenerate result. Pass both arguments, or pre-compute the value before the template.`,
           }
         }
         // A regex-literal pattern is the deferred form (the Perl `s///`
@@ -980,7 +1012,7 @@ function convertNode(node: ts.Node, raw: string): ParsedExpr {
         // any template use with the deferred-form reason.
         const patternNode = node.arguments[0]
         if (patternNode && ts.isRegularExpressionLiteral(patternNode)) {
-          return { kind: 'array-method', method: 'replace', object: callee.object, args }
+          return { kind: 'array-method', method, object: callee.object, args }
         }
         // Treat an object-literal argument like `unsupported` — a `.replace`
         // with an object pattern/replacement isn't lowerable, same as before
@@ -995,7 +1027,7 @@ function convertNode(node: ts.Node, raw: string): ParsedExpr {
           const reason = badArg.kind === 'unsupported' ? badArg.reason : 'Unsupported syntax: ObjectLiteralExpression'
           return { kind: 'unsupported', raw, reason }
         }
-        return { kind: 'array-method', method: 'replace', object: callee.object, args }
+        return { kind: 'array-method', method, object: callee.object, args }
       }
       // `.repeat(n)` — string → string (the receiver concatenated `n`
       // times). Go uses `bf_repeat` (`strings.Repeat`, clamping a
@@ -1072,7 +1104,7 @@ function convertNode(node: ts.Node, raw: string): ParsedExpr {
     const property = node.name.text
 
     // Return as normal member - filter.length is handled in adapter
-    return { kind: 'member', object, property, computed: false }
+    return { kind: 'member', object, property, computed: false, optional: !!node.questionDotToken }
   }
 
   // Element access: items[0], obj['key']
@@ -1088,10 +1120,10 @@ function convertNode(node: ts.Node, raw: string): ParsedExpr {
     }
     // For simple number/string access, store as property
     if (ts.isNumericLiteral(argNode)) {
-      return { kind: 'member', object, property: argNode.text, computed: true }
+      return { kind: 'member', object, property: argNode.text, computed: true, optional: !!node.questionDotToken }
     }
     if (ts.isStringLiteral(argNode)) {
-      return { kind: 'member', object, property: argNode.text, computed: true }
+      return { kind: 'member', object, property: argNode.text, computed: true, optional: !!node.questionDotToken }
     }
     // Variable / expression index (`selected()[index]`, `rows[i + 1]`):
     // carry the index as its own ParsedExpr so the adapter can lower it
@@ -2063,7 +2095,7 @@ function substituteDestructuredFields(
         // one-hop chain identical to the pre-#1530 shape.
         let node: ParsedExpr = { kind: 'identifier', name: syntheticParam }
         for (const segment of entry.path) {
-          node = { kind: 'member', object: node, property: segment, computed: false }
+          node = { kind: 'member', object: node, property: segment, computed: false, optional: false }
         }
         // Default value (#1531): wrap the accessor in `?? <default>` so
         // a missing field falls back to the user-supplied literal /
@@ -2088,9 +2120,10 @@ function substituteDestructuredFields(
             object: { kind: 'identifier', name: syntheticParam },
             property: e.property,
             computed: false,
+            optional: e.optional,
           }
         }
-        return { kind: 'member', object: walk(e.object), property: e.property, computed: e.computed }
+        return { kind: 'member', object: walk(e.object), property: e.property, computed: e.computed, optional: e.optional }
       case 'index-access':
         return { kind: 'index-access', object: walk(e.object), index: walk(e.index) }
       case 'binary':
@@ -2236,15 +2269,16 @@ function checkSupport(expr: ParsedExpr): SupportResult {
     }
 
     case 'array-method': {
-      // A regex-pattern `.replace` is carried structurally (a `regex` first
-      // arg) but is the deferred form (#1448) — no template language lowers it.
-      // Refuse with the dedicated reason rather than the generic standalone-regex
-      // message, preserving the diagnostic the parser used to emit directly.
-      if (expr.method === 'replace' && expr.args[0]?.kind === 'regex') {
+      // A regex-pattern `.replace` / `.replaceAll` is carried structurally
+      // (a `regex` first arg) but is the deferred form (#1448) — no
+      // template language lowers it. Refuse with the dedicated reason
+      // rather than the generic standalone-regex message, preserving the
+      // diagnostic the parser used to emit directly.
+      if ((expr.method === 'replace' || expr.method === 'replaceAll') && expr.args[0]?.kind === 'regex') {
         return {
           supported: false,
           reason:
-            'String.prototype.replace supports only a string pattern + string replacement (the regex form is deferred); use a string pattern or wrap the expression in /* @client */',
+            `String.prototype.${expr.method} supports only a string pattern + string replacement (the regex form is deferred); use a string pattern or wrap the expression in /* @client */`,
         }
       }
       const objSupport = checkSupport(expr.object)
@@ -2893,7 +2927,7 @@ function inlineBinding(
       case 'call':
         return { kind: 'call', callee: walk(e.callee, enclosing), args: e.args.map(a => walk(a, enclosing)) }
       case 'member':
-        return { kind: 'member', object: walk(e.object, enclosing), property: e.property, computed: e.computed }
+        return { kind: 'member', object: walk(e.object, enclosing), property: e.property, computed: e.computed, optional: e.optional }
       case 'index-access':
         return { kind: 'index-access', object: walk(e.object, enclosing), index: walk(e.index, enclosing) }
       case 'binary':
@@ -3281,7 +3315,7 @@ export function materializeGetterCalls(expr: ParsedExpr, names: ReadonlySet<stri
         alternate: rw(expr.alternate),
       }
     case 'member':
-      return { kind: 'member', object: rw(expr.object), property: expr.property, computed: expr.computed }
+      return { kind: 'member', object: rw(expr.object), property: expr.property, computed: expr.computed, optional: expr.optional }
     case 'index-access':
       return { kind: 'index-access', object: rw(expr.object), index: rw(expr.index) }
     case 'template-literal':

package/src/index.ts

@@ -49,6 +49,7 @@ export type {
   ParamInfo,
   PropertyInfo,
   MemoInfo,
+  ConstantInfo,
   TypeInfo,
   TypeDefinition,
   SourceLocation,
@@ -87,6 +88,9 @@ export type { JsxAdapterConfig } from './adapters/jsx-adapter.ts'
 export { rewriteImportsForTemplate } from './adapters/template-imports.ts'
 export { emitParsedExpr, groupBinaryOperand, isStringTypedOperand, isStringConcatBinary } from './adapters/parsed-expr-emitter.ts'
 export type { ParsedExprEmitter, HigherOrderMethod, ArrayMethod, SortMethod, LiteralType } from './adapters/parsed-expr-emitter.ts'
+export { collectLoopBoundNames } from './adapters/loop-bound-names.ts'
+export { evaluateSignalInit, tryEvaluateSignalInit, type SignalInitEvalResult } from './signal-init-eval.ts'
+export { evaluateStaticLiteral, isFullyStaticLiteral, resolveStaticLoopSource } from './static-literal.ts'
 export { importsSearchParams, searchParamsLocalNames, envSignalLocalNames, envSignalReaderFor, ENV_SIGNAL_READERS, queryHrefLocalNames, matchSearchParamsMethodCall } from './adapters/env-signal.ts'
 export type { EnvSignalReader } from './adapters/env-signal.ts'
 export { matchQueryHrefCall, queryHrefArgs, type QueryHrefCall, type QueryHrefTriple } from './query-href-lowering.ts'
@@ -116,6 +120,13 @@ export { emitIRNode } from './adapters/ir-node-emitter.ts'
 export type { IRNodeEmitter, EmitIRNode } from './adapters/ir-node-emitter.ts'
 export { emitAttrValue } from './adapters/attr-value-emitter.ts'
 export type { AttrValueEmitter } from './adapters/attr-value-emitter.ts'
+export {
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+} from './adapters/dangerous-inner-html.ts'
+export type { DangerousInnerHtmlResolution } from './adapters/dangerous-inner-html.ts'
 
 // Client JS Generator
 export { generateClientJs, generateClientJsWithSourceMap, analyzeClientNeeds } from './ir-to-client-js/index.ts'
@@ -272,15 +283,20 @@ export interface BuildOptions {
    *   - `'treeshake'` (default) — bundle only the runtime exports this
    *     project's compiled client JS actually imports, plus a small
    *     always-kept public mount API (`render`, `hydrate`, etc.).
+   *   - `'treeshake-exact'` — same collection, but without the always-kept
+   *     set. Smaller output; a hand-written page script the CLI never
+   *     compiles must list any runtime names it calls directly in
+   *     `runtimeKeep`, or they're silently dropped.
    *   - `'full'` — copy the entire prebuilt runtime bundle verbatim.
    * See `@barefootjs/cli`'s `runtime-treeshake.ts` for the collector and
    * `ALWAYS_KEEP_RUNTIME_EXPORTS` for the always-kept names.
    */
-  runtimeBundle?: 'treeshake' | 'full'
+  runtimeBundle?: 'treeshake' | 'treeshake-exact' | 'full'
   /**
    * Extra `@barefootjs/client*` export names to force-keep in `barefoot.js`
-   * under `runtimeBundle: 'treeshake'` — for names only ever referenced
-   * from hand-written page scripts the CLI never compiles.
+   * under `runtimeBundle: 'treeshake'` or `'treeshake-exact'` — for names
+   * only ever referenced from hand-written page scripts the CLI never
+   * compiles.
    */
   runtimeKeep?: string[]
 }