@barefootjs/mojolicious 0.18.5 → 0.18.7

package/lib/Mojolicious/Plugin/BarefootJS/DevReload.pm

@@ -1,5 +1,5 @@
 package Mojolicious::Plugin::BarefootJS::DevReload;
-our $VERSION = "0.18.4";
+our $VERSION = "0.18.5";
 use Mojo::Base 'Mojolicious::Plugin', -signatures;
 
 =head1 NAME

package/lib/Mojolicious/Plugin/BarefootJS.pm

@@ -1,5 +1,5 @@
 package Mojolicious::Plugin::BarefootJS;
-our $VERSION = "0.18.4";
+our $VERSION = "0.18.5";
 use Mojo::Base 'Mojolicious::Plugin', -signatures;
 
 use Mojo::File qw(path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@barefootjs/mojolicious",
-  "version": "0.18.5",
+  "version": "0.18.7",
   "description": "Mojolicious EP template adapter for BarefootJS - generates .html.ep files from IR",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,7 +52,7 @@
     "directory": "packages/adapter-mojolicious"
   },
   "dependencies": {
-    "@barefootjs/shared": "0.18.5"
+    "@barefootjs/shared": "0.18.7"
   },
   "peerDependencies": {
     "@barefootjs/jsx": ">=0.2.0",
@@ -60,6 +60,6 @@
   },
   "devDependencies": {
     "@barefootjs/adapter-tests": "0.1.0",
-    "@barefootjs/jsx": "0.18.5"
+    "@barefootjs/jsx": "0.18.7"
   }
 }

package/src/__tests__/mojo-adapter.test.ts

@@ -195,6 +195,166 @@ function Box({ other }: { other?: object }) {
   })
 })
 
+// #2221: same class of hazard as the Twig-family `_resolveLiteralConst`
+// flat-lookup bug, but this adapter's story is different. `resolveLiteralConst`
+// / `resolveStaticRecordLiteral` (mojo-adapter.ts) already guard against it —
+// they consult `loopBoundNames`, a LIVE ref-counted map that
+// `renderLoop` populates/depopulates as it descends/ascends into each loop
+// body (#1749), not a static whole-component set like the Twig family's
+// `collectLoopBoundNames(ir)`. That makes the guard scope-PRECISE rather
+// than coarse: a name loop-bound only inside one loop still inlines fine
+// at a genuinely separate, non-shadowed occurrence elsewhere in the
+// component (see the third test below) — the Twig-family's documented
+// coarse trade-off (a same-named const anywhere else in the component also
+// stops inlining) does not apply here. So no `staticLoopSourceBoundNames`
+// field was added; the existing live tracking already covers this call
+// site and is strictly more precise.
+//
+// The ONE actual gap found: `emitSpread`'s bare-identifier local-const
+// spread resolution (mojo-adapter.ts, the `this.localConstants.find(...)`
+// call keyed by `trimmed`, `{...attrs}` → `{ … }` hashref, #checkbox/icon)
+// read `this.localConstants` directly with no `loopBoundNames` guard at
+// all — a loop param named the same as an outer conditional-object const
+// (`.map((attrs) => <li {...attrs} />)` shadowing `const attrs = cond ?
+// {…} : {}`) incorrectly forwarded the outer object's literal hashref
+// instead of falling through to the per-iteration `$attrs` value. Fixed
+// with the same `loopBoundNames` guard as the other two call sites.
+//
+// Not covered here (upstream, shared-compiler hazard, out of this
+// package's scope): `key={label}` shadowed by an enclosing loop param of
+// the same name is folded to the OUTER const's literal at IR-generation
+// time (`tryResolveIdentifierAsTemplateLiteral` → `findLocalConst` in
+// `packages/jsx/src/jsx-to-ir.ts`), before any adapter runs — so this
+// adapter (and every other adapter, including Hono's native JSX
+// re-emission) still renders a `key`/`data-key` value shadowed this way
+// as the outer literal, unconditionally, every iteration.
+describe('MojoAdapter - const inlining vs loop-param shadowing (#2221)', () => {
+  test('a loop param shadowing an outer literal const emits the identifier, not the const value', () => {
+    const { template } = compileAndGenerate(`
+function Widget() {
+  const label: string = 'x'
+  return <ul>{[2, 5].map((label) => <li key={label}>{1 + label}</li>)}</ul>
+}
+`)
+    expect(template).toContain('1 + $label')
+    expect(template).not.toContain("1 + 'x'")
+  })
+
+  test('a numeric const shadowed by a loop param emits the identifier too', () => {
+    const { template } = compileAndGenerate(`
+function Widget() {
+  const count = 7
+  return <ul>{[2, 5].map((count) => <li key={count}>{1 + count}</li>)}</ul>
+}
+`)
+    expect(template).toContain('1 + $count')
+    expect(template).not.toContain('1 + 7')
+  })
+
+  test('a literal const NOT shadowed by any loop still inlines (#1897 pin)', () => {
+    const { template } = compileAndGenerate(`
+function Widget({ values }: { values: number[] }) {
+  const totalPages = 5
+  return <div>
+    <p>Page 1 of {1 + totalPages}</p>
+    <ul>{values.map((v) => <li key={v}>{v}</li>)}</ul>
+  </div>
+}
+`)
+    expect(template).toContain('1 + 5')
+  })
+
+  // Unlike the Twig-family's coarse-but-safe `collectLoopBoundNames(ir)`
+  // exclusion, this adapter's LIVE `loopBoundNames` tracking is scoped to
+  // the actual render position: a name loop-bound ONLY inside the `.map`
+  // callback still inlines correctly at a separate, non-shadowed
+  // occurrence outside the loop — no accepted trade-off here.
+  test('a const referenced outside the loop whose name is loop-bound elsewhere still inlines (more precise than Twig family)', () => {
+    const { template } = compileAndGenerate(`
+function Widget({ values }: { values: number[] }) {
+  const label: string = 'x'
+  return <div>
+    <p>{1 + label}</p>
+    <ul>{values.map((label) => <li key={label}>{2 + label}</li>)}</ul>
+  </div>
+}
+`)
+    expect(template).toContain("1 + 'x'")
+    expect(template).toContain('2 + $label')
+  })
+
+  // The actual gap this issue found in this adapter: `emitSpread`'s
+  // bare-identifier local-const resolution (`{...attrs}` → the outer
+  // conditional object's hashref) had no `loopBoundNames` guard.
+  test('a loop param shadowing an outer conditional-object const spread emits the loop var, not the outer hashref', () => {
+    const { template } = compileAndGenerate(`
+function Widget({ items }: { items: object[] }) {
+  const attrs = true ? { 'data-on': 'outer' } : {}
+  return <ul>{items.map((attrs) => <li {...attrs} />)}</ul>
+}
+`)
+    expect(template).toContain('bf->spread_attrs($attrs)')
+    expect(template).not.toContain("'data-on' => 'outer'")
+  })
+})
+
+// #2237: the record-literal sibling of #2221's `resolveLiteralConst` bug —
+// `resolveStaticRecordLiteral` (`IDENT.key` on a module-scope object-literal
+// const, e.g. `variantClasses.ghost` — #1896/#1897) is confirmed reproducible
+// on the Twig-family adapters (flat `objectName` lookup with no notion of AST
+// scope, so an enclosing loop callback's own param of the same name resolved
+// to the OUTER const's member value at every iteration). This adapter's
+// `resolveStaticRecordLiteral` already guards against it (mojo-adapter.ts:
+// `if (this.loopBoundNames?.has?.(objectName)) return null`) — the same LIVE,
+// ref-counted `loopBoundNames` map `resolveLiteralConst` consults (#1749),
+// scope-precise rather than the Twig family's coarse whole-component set.
+// Pinned here (mirroring the #2221 scope-precision pin above) rather than
+// fixed, since no code change was needed.
+describe('MojoAdapter - record-literal member lookup vs loop-param shadowing (#2237)', () => {
+  test('a loop param shadowing an outer module object const emits the member access, not the outer literal', () => {
+    const { template } = compileAndGenerate(`
+const cfg = { x: 'outer-lit' }
+function Widget({ rows }: { rows: { x: string }[] }) {
+  return <ul>{rows.map((cfg) => <li key={cfg.x}>{cfg.x}</li>)}</ul>
+}
+`)
+    // The loop body must reference the per-iteration member access...
+    expect(template).toContain('$cfg->{x}')
+    // ...never the outer const's hard-coded value.
+    expect(template).not.toContain("'outer-lit'")
+  })
+
+  test('a module object const NOT shadowed by any loop still inlines (variantClasses.ghost shape, #1896/#1897 pin)', () => {
+    const { template } = compileAndGenerate(`
+const variantClasses = { solid: 'bg-solid', ghost: 'bg-ghost' }
+function Widget({ variant }: { variant: 'solid' | 'ghost' }) {
+  return <div>{variantClasses.ghost}</div>
+}
+`)
+    expect(template).toContain("'bg-ghost'")
+  })
+
+  // Unlike the Twig-family's coarse-but-safe `staticLoopSourceBoundNames`
+  // exclusion, this adapter's LIVE `loopBoundNames` tracking is scoped to
+  // the actual render position: an object name loop-bound ONLY inside the
+  // `.map` callback still inlines its member lookup correctly at a
+  // separate, non-shadowed occurrence outside the loop — no accepted
+  // trade-off here.
+  test('an object name loop-bound only inside the loop still inlines its member lookup outside it (more precise than Twig family)', () => {
+    const { template } = compileAndGenerate(`
+const cfg = { x: 'outer-lit' }
+function Widget({ rows }: { rows: { x: string }[] }) {
+  return <div>
+    <p>{cfg.x}</p>
+    <ul>{rows.map((cfg) => <li key={cfg.x}>{cfg.x}</li>)}</ul>
+  </div>
+}
+`)
+    expect(template).toContain("<p><%= 'outer-lit' %></p>")
+    expect(template).toContain('$cfg->{x}')
+  })
+})
+
 describe('MojoAdapter - Record<staticKeys,scalar>[propKey] spread value (#checkbox icon)', () => {
   // `const sizeMap: Record<IconSize, number> = { sm: 16, ... }` indexed by
   // a prop inside a conditional-spread object value lowers to an inline
@@ -1406,7 +1566,7 @@ describe('MojoAdapter - #1448 Tier C .flat(depth?)', () => {
   function emitFlat(expr: string): string {
     const a = new MojoAdapter()
     const ir = compileToIR(`
-function C({ rows }: { rows: number[][] }) {
+function C({ rows }: { rows: { x: string }[][] }) {
   return <div>{${expr}}</div>
 }
 export { C }
@@ -1526,9 +1686,10 @@ export { C }
     expect(t).toContain(`"property":"name"`)
   })
 
-  // The function-reference `.map(format)` BF101 refusal is now covered
-  // cross-adapter by the `array-map-function-reference` shared fixture's
-  // `expectedDiagnostics` entry above.
+  // The function-reference `.map(format)` case is now covered cross-adapter
+  // by the `array-map-function-reference` shared fixture — `format` resolves
+  // to its declaration (#2206) and the fixture compiles clean rather than
+  // refusing with BF101.
 })
 
 describe('MojoAdapter - #1448 Tier C .flatMap(field projection)', () => {

package/src/adapter/lib/static-value.ts

@@ -0,0 +1,47 @@
+/**
+ * Serialize a compile-time-evaluated JS value (`@barefootjs/jsx`'s
+ * `evaluateStaticLiteral`/`resolveStaticLoopSource`, #2208) into a native
+ * Perl literal. Used to inline a fully-static loop source (an inline array
+ * literal, or a function-scope local const with a static initializer)
+ * directly in the loop-bound expression, rather than requiring a bound
+ * template variable.
+ *
+ * Booleans deliberately return `null` (defer to the caller's BF101
+ * refusal) rather than baking `1`/`''` — Perl has no boolean literal, and
+ * that would diverge from JS's `String(true) === "true"` at render.
+ *
+ * Returns `null` for a value this adapter can't represent as a literal —
+ * the caller falls back to its existing BF101 refusal instead of guessing.
+ */
+
+import { perlHashKey } from './perl-naming.ts'
+
+function escapePerlSingleQuote(s: string): string {
+  return s.replace(/\\/g, '\\\\').replace(/'/g, "\\'")
+}
+
+export function staticValueToPerl(value: unknown): string | null {
+  if (value === null || value === undefined) return 'undef'
+  if (typeof value === 'boolean') return null
+  if (typeof value === 'number') return String(value)
+  if (typeof value === 'string') return `'${escapePerlSingleQuote(value)}'`
+  if (Array.isArray(value)) {
+    const items: string[] = []
+    for (const el of value) {
+      const serialized = staticValueToPerl(el)
+      if (serialized === null) return null
+      items.push(serialized)
+    }
+    return `[${items.join(', ')}]`
+  }
+  if (typeof value === 'object') {
+    const entries: string[] = []
+    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
+      const serialized = staticValueToPerl(val)
+      if (serialized === null) return null
+      entries.push(`${perlHashKey(key)} => ${serialized}`)
+    }
+    return `{ ${entries.join(', ')} }`
+  }
+  return null
+}

package/src/adapter/mojo-adapter.ts

@@ -59,6 +59,11 @@ import {
   isValidHelperId,
   sortComparatorFromArrow,
   isLowerableLoopDestructure,
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+  resolveStaticLoopSource,
 } from '@barefootjs/jsx'
 import { isAriaBooleanAttr, isBooleanResultExpr } from './boolean-result.ts'
 import type { ParsedExpr, LoweringMatcher } from '@barefootjs/jsx'
@@ -72,6 +77,7 @@ import {
   collectRootScopeNodes,
 } from './lib/ir-scope.ts'
 import { renderSortMethod, renderSortEval } from './expr/array-method.ts'
+import { staticValueToPerl } from './lib/static-value.ts'
 import { MojoFilterEmitter, MojoTopLevelEmitter } from './expr/emitters.ts'
 import type { MojoEmitContext, MojoSpreadContext, MojoMemoContext } from './emit-context.ts'
 import {
@@ -415,6 +421,14 @@ export class MojoAdapter extends BaseAdapter implements IRNodeEmitter<MojoRender
    * quoted string literal (`const totalPages = 5`, #1897 pagination) —
    * function-scope consts never reach the per-render stash, so a bare
    * `$totalPages` faults under strict mode.
+   *
+   * The `loopBoundNames` guard also covers the #2221 hazard (a loop
+   * callback's own param shadowing this outer const's name): unlike the
+   * Twig-family adapters' coarse, whole-component `collectLoopBoundNames(ir)`
+   * static set, this adapter's `loopBoundNames` is a LIVE ref-counted map
+   * `renderLoop` populates/depopulates as it descends/ascends into each
+   * loop body (#1749) — so it's already scope-precise for this call site;
+   * no separate `staticLoopSourceBoundNames`-style field is needed here.
    */
   private resolveLiteralConst(name: string): string | null {
     if (this.loopBoundNames?.has?.(name)) return null
@@ -617,7 +631,8 @@ export class MojoAdapter extends BaseAdapter implements IRNodeEmitter<MojoRender
   renderElement(element: IRElement): string {
     const tag = element.tag
     const attrs = this.renderAttributes(element)
-    const children = this.renderChildren(element.children)
+    const dangerousHtml = this.renderDangerousInnerHtml(element)
+    const children = dangerousHtml !== null ? dangerousHtml : this.renderChildren(element.children)
 
     let hydrationAttrs = ''
     if (element.needsScope) {
@@ -653,6 +668,28 @@ export class MojoAdapter extends BaseAdapter implements IRNodeEmitter<MojoRender
     return `<${tag}${attrs}${hydrationAttrs}>${children}</${tag}>`
   }
 
+  /**
+   * `dangerouslySetInnerHTML={{ __html: '...' }}` (#2207) — see the Blade
+   * adapter's identical helper for the full rationale. `null` means the
+   * attribute is absent (caller falls through to normal `renderChildren`);
+   * a non-`null` string (possibly `''`) replaces the children outright.
+   */
+  private renderDangerousInnerHtml(element: IRElement): string | null {
+    const resolution = resolveDangerousInnerHtml(element)
+    if (!resolution) return null
+    if (resolution.kind === 'dynamic') {
+      this.errors.push(dangerousInnerHtmlDiagnostic(resolution.expr, resolution.loc))
+      return ''
+    }
+    const violation = dangerousInnerHtmlMetacharViolation(resolution.html, this.name)
+    if (violation) {
+      const attr = element.attrs.find(isDangerousInnerHtmlAttr)!
+      this.errors.push(dangerousInnerHtmlDiagnostic(`{ __html: ${JSON.stringify(resolution.html)} }`, attr.loc, violation))
+      return ''
+    }
+    return resolution.html
+  }
+
   // ===========================================================================
   // Expression Rendering
   // ===========================================================================
@@ -665,7 +702,12 @@ export class MojoAdapter extends BaseAdapter implements IRNodeEmitter<MojoRender
       return ''
     }
 
-    const perlExpr = this.convertExpressionToPerl(expr.expr)
+    // Thread the IR-carried `.parsed` tree through (mirrors go-template's
+    // `convertExpressionToGo(expr.expr, classify, expr.parsed)`) so a
+    // resolved bare-identifier `.map`/`.filter`/… callback
+    // (`resolveCallbackMethodFunctionReferences`, #2206) isn't lost to a
+    // fresh, unresolved re-parse of the raw string.
+    const perlExpr = this.convertExpressionToPerl(expr.expr, expr.parsed)
 
     if (expr.slotId) {
       return `<%== bf->text_start("${expr.slotId}") %><%= ${perlExpr} %><%== bf->text_end %>`
@@ -810,8 +852,24 @@ export class MojoAdapter extends BaseAdapter implements IRNodeEmitter<MojoRender
     // reachable in this adapter's test corpus only because the widened
     // destructure gate (#2087 Phase A/B) no longer refuses this fixture's
     // `([emoji, users]) => ...` param first.
+    // #2208: a loop source that is a fully-static array literal — either
+    // inline (`[{ label: 'Alpha' }, ...].map(...)`) or a bare identifier
+    // bound to a FUNCTION-scope local const whose initializer has no
+    // prop/signal/function-call dependency — inlines as a native Perl
+    // arrayref/hashref literal below, the same way a module-scope const's
+    // value is already seeded. A runtime-computed local (#2069, e.g.
+    // `Object.entries(props.tags).filter(...)`) still refuses below.
+    // `isNameShadowed` guards a DIFFERENT, enclosing loop's own callback
+    // param shadowing this identifier (fable review) — reuses the same
+    // live `loopBoundNames` ref-counted tracking `resolveModuleStringConst`
+    // already consults for this hazard class (#1749).
+    const staticItems = resolveStaticLoopSource(loop.arrayParsed, this.localConstants, {
+      isNameShadowed: name => this.loopBoundNames.has(name),
+    })
+    const staticArray = staticItems !== null ? staticValueToPerl(staticItems) : null
+
     const arrayName = loop.array.trim()
-    if (/^[A-Za-z_$][\w$]*$/.test(arrayName)) {
+    if (staticArray === null && /^[A-Za-z_$][\w$]*$/.test(arrayName)) {
       const arrayConst = (this.localConstants ?? []).find(c => c.name === arrayName)
       if (arrayConst && !arrayConst.isModule && this.resolveLiteralConst(arrayName) === null) {
         this.errors.push({
@@ -827,7 +885,7 @@ export class MojoAdapter extends BaseAdapter implements IRNodeEmitter<MojoRender
       }
     }
 
-    const rawArray = this.convertExpressionToPerl(loop.array)
+    const rawArray = staticArray ?? this.convertExpressionToPerl(loop.array)
     // Apply sort if present (#1448 Tier B): wrap the loop array in the
     // shared sort helper. The same `renderSortEval` / `renderSortMethod`
     // pair feeds both this loop-chain hoist and the emitter's
@@ -1411,7 +1469,15 @@ export class MojoAdapter extends BaseAdapter implements IRNodeEmitter<MojoRender
       // initializer text and route through the same conditional-spread
       // lowering. Only function-scope (`!isModule`) consts whose value is
       // NOT itself a bare identifier (loop guard) are considered.
-      if (/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(trimmed)) {
+      //
+      // `loopBoundNames` guard (#2221): an enclosing `.map()` callback's
+      // own param can shadow this outer const's name (`.map((sizeAttrs)
+      // => <li {...sizeAttrs} />)`) — without the guard this forwarded
+      // the OUTER const's hashref at every iteration instead of the
+      // per-item `$sizeAttrs` value. Same live ref-counted map
+      // `resolveLiteralConst` / `resolveStaticRecordLiteral` already
+      // consult for this hazard class (#1749).
+      if (/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(trimmed) && !this.loopBoundNames.has(trimmed)) {
         const localConst = this.localConstants.find(
           c => c.name === trimmed && !c.isModule,
         )
@@ -1488,6 +1554,12 @@ export class MojoAdapter extends BaseAdapter implements IRNodeEmitter<MojoRender
       // the unsupported-expression lowering is never reached for a deferred
       // predicate (no BF101 / BF102). #1966
       if (attr.clientOnly) continue
+      // `dangerouslySetInnerHTML` never renders as an HTML attribute — it's
+      // handled by `renderDangerousInnerHtml` instead, which replaces the
+      // element's children. Skip it here so its `{ __html: ... }` object
+      // literal never reaches the generic object-literal BF101 refusal
+      // (which would double-report alongside the purpose-built one).
+      if (isDangerousInnerHtmlAttr(attr)) continue
       // Rewrite JSX special-prop names to their HTML-attribute
       // counterparts (#1475). `className` → `class` was already
       // wired in; the `key` → `data-key` rewrite matches the

package/src/adapter/props/prop-classes.ts

@@ -7,7 +7,7 @@
  * adapter's `props/prop-types.ts`. No adapter instance state.
  */
 
-import type { ComponentIR } from '@barefootjs/jsx'
+import { collectLoopBoundNames, type ComponentIR } from '@barefootjs/jsx'
 import { isStringTypeInfo, isBareStringLiteral } from '../value/parsed-literal.ts'
 
 /**
@@ -67,11 +67,28 @@ export function collectNullableOptionalProps(ir: ComponentIR): Set<string> {
 }
 
 /**
- * String-typed signals and props, so equality comparisons against them lower
- * to `eq`/`ne` (#1672). A signal is string-typed when its inferred type is
- * `string` (the analyzer infers this from a string-literal initial value) or,
- * defensively, when its initial value is a bare string literal; a prop when
- * its annotated type is `string`.
+ * String-typed signals, props, and same-file local consts, so equality
+ * comparisons against them lower to `eq`/`ne` (#1672) and `+` concatenation
+ * against them lowers to Perl's `.` instead of numeric `+` (#2163, #2212 —
+ * `isStringConcatBinary`/`isStringTypedOperand` in `@barefootjs/jsx`, which
+ * now also recognizes a bare identifier operand, not just a prop/getter/
+ * literal). A signal is string-typed when its inferred type is `string`
+ * (the analyzer infers this from a string-literal initial value) or,
+ * defensively, when its initial value is a bare string literal; a prop or
+ * local const when its annotated (or inferred) type is `string`.
+ *
+ * Excludes any name bound as a `.map()`/`.filter()` loop callback's item
+ * or index parameter ANYWHERE in the component (Fable review, #2212): the
+ * lookup below is a flat, scope-blind `Set<string>` with no notion of a
+ * loop param shadowing an outer string-typed binding of the same name
+ * (`items.map((name) => 1 + name)` inside a component that also has a
+ * string `name` prop) — left unguarded, that shadowed `name` would be
+ * misdetected as string-typed and `1 + name` would silently lower to `.`
+ * instead of staying numeric `+`. Subtracting loop-bound names is coarse
+ * (it also suppresses a genuinely non-shadowed same-named string
+ * elsewhere in the component) but safe: the suppressed case just falls
+ * back to today's numeric `+` — the same, already-accepted residual as an
+ * unresolvable operand — never silently-wrong output.
  */
 export function collectStringValueNames(ir: ComponentIR): Set<string> {
   const names = new Set<string>()
@@ -83,5 +100,9 @@ export function collectStringValueNames(ir: ComponentIR): Set<string> {
   for (const p of ir.metadata.propsParams) {
     if (isStringTypeInfo(p.type)) names.add(p.name)
   }
+  for (const c of ir.metadata.localConstants) {
+    if (isStringTypeInfo(c.type ?? undefined) || isBareStringLiteral(c.value)) names.add(c.name)
+  }
+  for (const bound of collectLoopBoundNames(ir)) names.delete(bound)
   return names
 }

package/src/conformance-pins.ts

@@ -9,17 +9,17 @@
 import type { ConformancePins } from '@barefootjs/jsx'
 
 export const conformancePins: ConformancePins = {
-  // Sibling-imported child component in a loop body: Mojo emits
-  // a cross-template call that needs separate registration. BF103
-  // makes the requirement loud. (The barefoot CLI passes
-  // `siblingTemplatesRegistered: true` so CLI builds suppress it.)
-  'static-array-children': [{ code: 'BF103', severity: 'error' }],
-  // TodoApp / TodoAppSSR import `TodoItem` from a sibling file and
-  // call it inside a keyed `.map`. Same BF103 surface as the
-  // synthetic `static-array-children` above — pinned at adapter
-  // level so the shared-component corpus stays adapter-neutral.
-  'todo-app': [{ code: 'BF103', severity: 'error' }],
-  'todo-app-ssr': [{ code: 'BF103', severity: 'error' }],
+  // `todo-app` / `todo-app-ssr` no longer pinned (#2205) — the conformance
+  // harness now passes `siblingTemplatesRegistered: true` for fixtures with
+  // sibling `components`, matching `bf build`'s real semantics, so the
+  // BF103 loop-body cross-template check no longer fires spuriously. (Both
+  // fixtures are still skipped on this adapter via `render-divergences.ts`
+  // — #2209 — for an unrelated signal-seeding gap.)
+  // `static-array-children` no longer pinned (#2208) — `items`'s
+  // array-literal initializer is now recognized as fully-static
+  // (`resolveStaticLoopSource`) and inlined as a native Perl
+  // arrayref/hashref literal in the loop-bound expression, the same way a
+  // module-scope const's value is already seeded.
   // `([emoji, users]) => ...` / `([id, t]) => ...` are plain array-index
   // (tuple) destructures, no rest — #2087 Phase B's `segments`-walking
   // accessor lowers both to `$__bf_item->[0]` / `$__bf_item->[1]` `my`
@@ -32,12 +32,11 @@ export const conformancePins: ConformancePins = {
   // check in `renderLoop`. This was always true; it was simply
   // unreachable before because BF104 refused the destructure shape first.
   'static-array-from-props': [{ code: 'BF101', severity: 'error' }],
-  // Both BF103 (sibling-imported `<Tag>` child component) and the BF101
-  // above fire; BF104 no longer does (see above).
-  'static-array-from-props-with-component': [
-    { code: 'BF103', severity: 'error' },
-    { code: 'BF101', severity: 'error' },
-  ],
+  // The BF101 above fires; BF104 no longer does (see above), and BF103
+  // (sibling-imported `<Tag>` child component in the loop body) no longer
+  // does either now that the conformance harness passes
+  // `siblingTemplatesRegistered: true` (#2205).
+  'static-array-from-props-with-component': [{ code: 'BF101', severity: 'error' }],
   // #1310 / #2087: rest destructure in .map() callback. All four shapes
   // now lower via #2087 Phase B's `segments`-walking accessor:
   //   - object-rest read via member access (`rest-destructure-object-in-map`):
@@ -130,15 +129,14 @@ export const conformancePins: ConformancePins = {
   // runtime `bf->find` / `find_index` / `find_last` / `find_last_index` helpers
   // (per-element coderef predicate), matching Xslate. `.join` was never
   // pinned (handled by `renderArrayMethod`'s `case 'join'`).
-  // #2073 follow-up: a function-reference `.map(format)` callback has no
-  // arrow body to serialize — not a CALLBACK_METHODS shape — so the
-  // UNSUPPORTED_METHODS gate refuses it with BF101 rather than emitting
-  // a broken template.
-  'array-map-function-reference': [{ code: 'BF101', severity: 'error' }],
-  // Edge-case sweep (Priority 12): `dangerouslySetInnerHTML` requires a
-  // deliberate raw-HTML (unescaped) output affordance in the target
-  // template language. No lowering exists yet, so the compiler refuses
-  // the shape loudly instead of emitting entity-escaped markup that
-  // silently renders tags as text.
-  'dangerous-inner-html': [{ code: 'BF101', severity: 'error' }],
+  // `array-map-function-reference` no longer pinned — a bare-identifier
+  // `.map(format)` callback now resolves one hop to its declaration
+  // (`resolveCallbackMethodFunctionReferences`, #2206), the same mechanism
+  // #2090 established for `.sort(fnref)`.
+  // `dangerous-inner-html` no longer pinned — a compile-time string-literal
+  // `dangerouslySetInnerHTML={{ __html: '...' }}` is spliced directly into
+  // the template as trusted raw text (`resolveDangerousInnerHtml`, #2207).
+  // A dynamic/signal-derived value still refuses with BF101 — see the
+  // `dangerous-inner-html-dynamic` fixture/pin below (tracked: #2215).
+  'dangerous-inner-html-dynamic': [{ code: 'BF101', severity: 'error', issue: 'https://github.com/piconic-ai/barefootjs/issues/2215' }],
 }

package/src/render-divergences.ts

@@ -14,4 +14,9 @@
 
 import type { RenderDivergences } from '@barefootjs/jsx'
 
-export const renderDivergences: RenderDivergences = {}
+export const renderDivergences: RenderDivergences = {
+  // `todo-app` / `todo-app-ssr` no longer diverge (#2209) — the shared
+  // `evaluateSignalInit` (`@barefootjs/jsx`, sandboxed real-JS evaluation
+  // instead of a fixed regex-shape catalogue) now correctly seeds `todos`
+  // from `(props.initialTodos ?? []).map(t => ({ ...t, editing: false }))`.
+}