@barefootjs/xslate 0.18.5 → 0.19.0

package/dist/adapter/index.js

@@ -187308,7 +187308,13 @@ import {
   queryHrefArgs,
   isValidHelperId,
   sortComparatorFromArrow as sortComparatorFromArrow2,
-  isLowerableLoopDestructure
+  isLowerableLoopDestructure,
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+  resolveStaticLoopSource,
+  collectLoopBoundNames as collectLoopBoundNames2
 } from "@barefootjs/jsx";
 
 // src/adapter/boolean-result.ts
@@ -187624,6 +187630,39 @@ function renderFlatMethod(recv, depth, emit) {
   return `$bf.flat(${recv}, ${d})`;
 }
 
+// src/adapter/lib/static-value.ts
+function staticValueToKolon(value) {
+  if (value === null || value === undefined)
+    return "nil";
+  if (typeof value === "boolean")
+    return null;
+  if (typeof value === "number")
+    return String(value);
+  if (typeof value === "string")
+    return `'${escapeKolonSingleQuoted(value)}'`;
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const el of value) {
+      const serialized = staticValueToKolon(el);
+      if (serialized === null)
+        return null;
+      items.push(serialized);
+    }
+    return `[${items.join(", ")}]`;
+  }
+  if (typeof value === "object") {
+    const entries = [];
+    for (const [key, val] of Object.entries(value)) {
+      const serialized = staticValueToKolon(val);
+      if (serialized === null)
+        return null;
+      entries.push(`${kolonHashKey(key)} => ${serialized}`);
+    }
+    return `{ ${entries.join(", ")} }`;
+  }
+  return null;
+}
+
 // src/adapter/expr/emitters.ts
 import {
   groupBinaryOperand,
@@ -188167,6 +188206,9 @@ function generateDerivedMemoSeed(ctx, ir) {
 ` : "";
 }
 
+// src/adapter/props/prop-classes.ts
+import { collectLoopBoundNames } from "@barefootjs/jsx";
+
 // src/adapter/value/parsed-literal.ts
 import { evalStringArrayJoin } from "@barefootjs/jsx";
 function isStringTypeInfo(type2) {
@@ -188184,7 +188226,7 @@ function collectBooleanTypedProps(ir) {
   return new Set(ir.metadata.propsParams.filter((prop) => prop.type?.primitive === "boolean" || prop.type?.raw === "boolean").map((prop) => prop.name));
 }
 function collectNullableOptionalProps(ir) {
-  return new Set(ir.metadata.propsParams.filter((p) => p.defaultValue === undefined && !p.isRest && p.type?.kind !== "primitive").map((p) => p.name));
+  return new Set(ir.metadata.propsParams.filter((p) => p.defaultValue === undefined && !p.isRest && (p.type?.kind !== "primitive" || p.optional)).map((p) => p.name));
 }
 function collectStringValueNames(ir) {
   const names = new Set;
@@ -188197,6 +188239,12 @@ function collectStringValueNames(ir) {
     if (isStringTypeInfo(p.type))
       names.add(p.name);
   }
+  for (const c of ir.metadata.localConstants) {
+    if (isStringTypeInfo(c.type ?? undefined) || isBareStringLiteral(c.value))
+      names.add(c.name);
+  }
+  for (const bound of collectLoopBoundNames(ir))
+    names.delete(bound);
   return names;
 }
 
@@ -188232,6 +188280,7 @@ class XslateAdapter extends BaseAdapter {
   _searchParamsLocals = new Set;
   _loweringMatchers = [];
   localConstants = [];
+  staticLoopSourceBoundNames = new Set;
   nullableOptionalProps = new Set;
   constructor(options = {}) {
     super();
@@ -188247,6 +188296,7 @@ class XslateAdapter extends BaseAdapter {
     this.propsParams = ir.metadata.propsParams.map((p) => ({ name: p.name }));
     this.booleanTypedProps = collectBooleanTypedProps(ir);
     this.localConstants = ir.metadata.localConstants ?? [];
+    this.staticLoopSourceBoundNames = collectLoopBoundNames2(ir);
     this.nullableOptionalProps = collectNullableOptionalProps(ir);
     this.stringValueNames = collectStringValueNames(ir);
     this.moduleStringConsts = collectModuleStringConsts(ir.metadata.localConstants);
@@ -188363,7 +188413,8 @@ class XslateAdapter extends BaseAdapter {
   renderElement(element) {
     const tag = element.tag;
     const attrs = this.renderAttributes(element);
-    const children = this.renderChildren(element.children);
+    const dangerousHtml = this.renderDangerousInnerHtml(element);
+    const children = dangerousHtml !== null ? dangerousHtml : this.renderChildren(element.children);
     let hydrationAttrs = "";
     if (element.needsScope) {
       hydrationAttrs += ` ${this.renderScopeMarker("")}`;
@@ -188398,6 +188449,22 @@ class XslateAdapter extends BaseAdapter {
     }
     return `<${tag}${attrs}${hydrationAttrs}>${children}</${tag}>`;
   }
+  renderDangerousInnerHtml(element) {
+    const resolution = resolveDangerousInnerHtml(element);
+    if (!resolution)
+      return null;
+    if (resolution.kind === "dynamic") {
+      this.errors.push(dangerousInnerHtmlDiagnostic(resolution.expr, resolution.loc));
+      return "";
+    }
+    const violation = dangerousInnerHtmlMetacharViolation(resolution.html, this.name);
+    if (violation) {
+      const attr = element.attrs.find(isDangerousInnerHtmlAttr);
+      this.errors.push(dangerousInnerHtmlDiagnostic(`{ __html: ${JSON.stringify(resolution.html)} }`, attr.loc, violation));
+      return "";
+    }
+    return resolution.html;
+  }
   renderExpression(expr) {
     if (expr.clientOnly) {
       if (expr.slotId) {
@@ -188405,7 +188472,7 @@ class XslateAdapter extends BaseAdapter {
       }
       return "";
     }
-    const perlExpr = this.convertExpressionToKolon(expr.expr);
+    const perlExpr = this.convertExpressionToKolon(expr.expr, expr.parsed);
     if (expr.slotId) {
       return `<: $bf.text_start("${expr.slotId}") | mark_raw :><: ${perlExpr} :><: $bf.text_end() | mark_raw :>`;
     }
@@ -188497,8 +188564,12 @@ ${whenTrue}
         }
       });
     }
+    const staticItems = resolveStaticLoopSource(loop.arrayParsed, this.localConstants, {
+      isNameShadowed: (name) => this.staticLoopSourceBoundNames.has(name)
+    });
+    const staticArray = staticItems !== null ? staticValueToKolon(staticItems) : null;
     const arrayName = loop.array.trim();
-    if (/^[A-Za-z_$][\w$]*$/.test(arrayName)) {
+    if (staticArray === null && /^[A-Za-z_$][\w$]*$/.test(arrayName)) {
       const arrayConst = (this.localConstants ?? []).find((c) => c.name === arrayName);
       if (arrayConst && !arrayConst.isModule && this._resolveLiteralConst(arrayName) === null) {
         this.errors.push({
@@ -188512,7 +188583,7 @@ ${whenTrue}
         });
       }
     }
-    const rawArray = this.convertExpressionToKolon(loop.array);
+    const rawArray = staticArray ?? this.convertExpressionToKolon(loop.array);
     let array = rawArray;
     if (loop.sortComparator) {
       const sort = loop.sortComparator;
@@ -188825,6 +188896,8 @@ ${name}="<: ${val} :>"
     for (const attr of element.attrs) {
       if (attr.clientOnly)
         continue;
+      if (isDangerousInnerHtmlAttr(attr))
+        continue;
       let attrName;
       if (attr.name === "className")
         attrName = "class";
@@ -189008,6 +189081,8 @@ Options:
     return this.booleanTypedProps.has(bare);
   }
   _resolveLiteralConst(name) {
+    if (this.staticLoopSourceBoundNames.has(name))
+      return null;
     const c = (this.localConstants ?? []).find((lc) => lc.name === name);
     if (c?.value === undefined)
       return null;
@@ -189020,6 +189095,8 @@ Options:
     return null;
   }
   _resolveStaticRecordLiteral(objectName, key) {
+    if (this.staticLoopSourceBoundNames.has(objectName))
+      return null;
     const hit = lookupStaticRecordLiteral(objectName, key, this.localConstants);
     if (!hit)
       return null;

package/dist/adapter/lib/static-value.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Serialize a compile-time-evaluated JS value (`@barefootjs/jsx`'s
+ * `evaluateStaticLiteral`/`resolveStaticLoopSource`, #2208) into a native
+ * Text::Xslate (Kolon) literal. Used to inline a fully-static loop source
+ * (an inline array literal, or a function-scope local const with a static
+ * initializer) directly in a `for EXPR -> $item { ... }` header, rather
+ * than requiring a bound template variable.
+ *
+ * Booleans deliberately return `null` (defer to the caller's BF101
+ * refusal) rather than baking a `1`/absent-value stand-in — Kolon has no
+ * native boolean literal in this position, and guessing one would diverge
+ * from JS's `String(true) === "true"` at render.
+ *
+ * Returns `null` for a value this adapter can't represent as a literal —
+ * the caller falls back to its existing BF101 refusal instead of guessing.
+ */
+export declare function staticValueToKolon(value: unknown): string | null;
+//# sourceMappingURL=static-value.d.ts.map

package/dist/adapter/lib/static-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-value.d.ts","sourceRoot":"","sources":["../../../src/adapter/lib/static-value.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAwBhE"}

package/dist/adapter/props/prop-classes.d.ts

@@ -6,7 +6,7 @@
  * prop/name sets the adapter consults during lowering. Mirror of the Go
  * adapter's `props/prop-types.ts`. No adapter instance state.
  */
-import type { ComponentIR } from '@barefootjs/jsx';
+import { type ComponentIR } from '@barefootjs/jsx';
 /**
  * Props whose declared TS type is boolean — a bare binding of one
  * (`data-active={props.isActive}`) must stringify as JS `String(boolean)`
@@ -15,18 +15,37 @@ import type { ComponentIR } from '@barefootjs/jsx';
  */
 export declare function collectBooleanTypedProps(ir: ComponentIR): Set<string>;
 /**
- * Bare references to optional, no-default, non-primitive props (e.g.
- * textarea's `rows`) are `undef` when omitted → `defined`-guarded in
+ * Bare references to presence-uncertain no-default props (non-primitive
+ * typed OR declared optional, #2259 — e.g. textarea's `rows`) are
+ * `undef` when omitted → `defined`-guarded in
  * `emitExpression`. See the `nullableOptionalProps` field docstring.
  */
 export declare function collectNullableOptionalProps(ir: ComponentIR): Set<string>;
 /**
- * String-typed signals and props. A signal is string-typed when its inferred
- * type is `string` (or, defensively, when its initial value is a bare string
- * literal); a prop when its annotated type is `string`. In the Mojo adapter
- * this drives `eq`/`ne` selection for string equality; the Kolon emitters
- * don't consume the distinction (Kolon's `==`/`!=` compare strings and numbers
- * correctly), so this set is carried for parity with the Mojo adapter.
+ * String-typed signals, props, and same-file local consts (#2212). A
+ * signal is string-typed when its inferred type is `string` (or,
+ * defensively, when its initial value is a bare string literal); a prop
+ * when its annotated type is `string`; a local const the same way. Consumed
+ * by `isStringConcatBinary`/`isStringTypedOperand` (`@barefootjs/jsx`) to
+ * pick Kolon's `~` over JS `+`'s numeric fallback (#2163, #2212) —
+ * including now for a bare identifier operand, not just a prop/getter/
+ * literal. In the Mojo adapter this ALSO drives `eq`/`ne` selection for
+ * string equality; the Kolon emitters don't consume that distinction
+ * (Kolon's `==`/`!=` compare strings and numbers correctly), so that half
+ * of this set is carried only for parity with the Mojo adapter.
+ *
+ * Excludes any name bound as a `.map()`/`.filter()` loop callback's item
+ * or index parameter ANYWHERE in the component (Fable review, #2212): the
+ * lookup below is a flat, scope-blind `Set<string>` with no notion of a
+ * loop param shadowing an outer string-typed binding of the same name
+ * (`items.map((name) => 1 + name)` inside a component that also has a
+ * string `name` prop) — left unguarded, that shadowed `name` would be
+ * misdetected as string-typed and `1 + name` would silently lower to `~`
+ * instead of staying numeric `+`. Subtracting loop-bound names is coarse
+ * (it also suppresses a genuinely non-shadowed same-named string
+ * elsewhere in the component) but safe: the suppressed case just falls
+ * back to today's numeric `+` — the same, already-accepted residual as an
+ * unresolvable operand — never silently-wrong output.
  */
 export declare function collectStringValueNames(ir: ComponentIR): Set<string>;
 //# sourceMappingURL=prop-classes.d.ts.map

package/dist/adapter/props/prop-classes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prop-classes.d.ts","sourceRoot":"","sources":["../../../src/adapter/props/prop-classes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAGlD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAMrE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAWzE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAWpE"}
+{"version":3,"file":"prop-classes.d.ts","sourceRoot":"","sources":["../../../src/adapter/props/prop-classes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAGzE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAMrE;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAWzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAepE"}

package/dist/adapter/xslate-adapter.d.ts

@@ -104,6 +104,16 @@ export declare class XslateAdapter extends BaseAdapter implements IRNodeEmitter<
      * const (`const sizeAttrs = size ? {…} : {}`) to its initializer text.
      */
     private localConstants;
+    /**
+     * Every name a `.map()`/`.filter()` loop callback binds as its item/index
+     * parameter anywhere in the component (#2208 fable review). A static
+     * loop-SOURCE name (e.g. a function-scope `const items = [...]`) must
+     * never resolve through `resolveStaticLoopSource` at a use site where a
+     * DIFFERENT, enclosing loop's own callback param shadows it — same
+     * shadowing hazard, and same coarse-but-safe mitigation, as #2212's
+     * `collectLoopBoundNames` use in `collectStringValueNames`.
+     */
+    private staticLoopSourceBoundNames;
     /**
      * Optional, no-default props that are `undef` when the caller omits them.
      * Their bare-reference attribute emission is guarded with Kolon `defined` so
@@ -154,6 +164,13 @@ export declare class XslateAdapter extends BaseAdapter implements IRNodeEmitter<
     private providerObjectLiteralKolon;
     emitAsync(node: IRAsync, _ctx: XslateRenderCtx, _emit: EmitIRNode<XslateRenderCtx>): string;
     renderElement(element: IRElement): string;
+    /**
+     * `dangerouslySetInnerHTML={{ __html: '...' }}` (#2207) — see the Blade
+     * adapter's identical helper for the full rationale. `null` means the
+     * attribute is absent (caller falls through to normal `renderChildren`);
+     * a non-`null` string (possibly `''`) replaces the children outright.
+     */
+    private renderDangerousInnerHtml;
     renderExpression(expr: IRExpression): string;
     renderConditional(cond: IRConditional): string;
     private renderNodeOrNull;
@@ -311,8 +328,32 @@ export declare class XslateAdapter extends BaseAdapter implements IRNodeEmitter<
      * single-quoted string literal (`const totalPages = 5`, #1897
      * pagination) — function-scope consts never reach the per-render
      * stash, so a bare `$totalPages` renders empty.
+     *
+     * The lookup is a flat name match with no notion of AST scope, so a
+     * name that any loop callback binds as its item/index param never
+     * inlines (#2221) — the occurrence may be the loop's own (shadowing)
+     * binding, and substituting the outer const's value there renders every
+     * iteration with the same hard-coded literal. Coarse (a genuinely
+     * non-shadowed same-named const elsewhere in the component also stops
+     * inlining, falling back to the bare identifier) but safe — the same
+     * trade-off as #2212's `collectLoopBoundNames` use in
+     * `collectStringValueNames`.
      */
     private _resolveLiteralConst;
+    /**
+     * Resolve `IDENT.key` where `IDENT` is a module-scope object-literal const
+     * (`variantClasses.ghost`, #1896/#1897) to the looked-up scalar.
+     *
+     * The lookup is a flat name match on `objectName` with no notion of AST
+     * scope, so an enclosing loop callback's own param of the same name
+     * (`.map((cfg) => <li>{cfg.x}</li>)` shadowing a module `const cfg = {…}`)
+     * still resolved to the OUTER const's member value at every iteration
+     * (#2237) — the sibling hazard to #2221's `_resolveLiteralConst`. Same
+     * coarse-but-safe `staticLoopSourceBoundNames` guard: any name a loop
+     * binds anywhere in the component never inlines, falling back to the bare
+     * `$cfg.x` member expression (which an Xslate `: for` loop binds
+     * correctly at the shadowed occurrences).
+     */
     private _resolveStaticRecordLiteral;
     private _resolveModuleStringConst;
     private _recordExprBF101;

package/dist/adapter/xslate-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xslate-adapter.d.ts","sourceRoot":"","sources":["../../src/adapter/xslate-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,MAAM,EACN,SAAS,EACT,MAAM,EACN,YAAY,EACZ,aAAa,EACb,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,aAAa,EACb,UAAU,EACV,OAAO,EAKP,yBAAyB,EAG1B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAE3B,KAAK,aAAa,EAClB,KAAK,UAAU,EAyBhB,MAAM,iBAAiB,CAAA;AAMxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AA4BrD,YAAY,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AA2C1D,qBAAa,aAAc,SAAQ,WAAY,YAAW,aAAa,CAAC,eAAe,CAAC;IACtF,IAAI,SAAW;IACf,SAAS,SAAQ;IACjB,qBAAqB,UAAO;IAG5B,kBAAkB,EAAG,cAAc,CAAS;IAE5C;;;;;OAKG;IACH,kBAAkB,EAAE,yBAAyB,CAA4B;IAEzE,OAAO,CAAC,aAAa,CAAa;IAClC;;;uCAGmC;IACnC,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAAI;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,iBAAiB,CAAyB;IAClD;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB,CAAyB;IAEjD;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB,CAAiC;IAE3D;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB,CAAyB;IAEpD;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB,CAAwB;IAEjD;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAAmC;IAEzD;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB,CAAyB;IAEtD,YAAY,OAAO,GAAE,oBAAyB,EAM7C;IAED,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,aAAa,CA6EzE;IAMD,OAAO,CAAC,2BAA2B;IAyBnC;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/B;IAMD,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAE9F;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI7B;IAED,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAEzC;IAED,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAEtG;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAExF;IAED,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAElG;IAED,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAEhG;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7B;IAED,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAEtG;IAED,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAehG;IAED,uEAAuE;IACvE,OAAO,CAAC,kBAAkB;IAiB1B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,0BAA0B;IAclC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAE1F;IAMD,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAoCxC;IAMD,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAe3C;IAMD,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAuC7C;IAED,OAAO,CAAC,gBAAgB;IAOxB;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAcnC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiP/B;IAMD;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAmCpC;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,2BAA2B;IAUnC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;IAiBpC,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAgGzC;IAED,OAAO,CAAC,sBAAsB,CAAI;IAElC;+DAC2D;IAC3D,OAAO,CAAC,kBAAkB,CAAI;IAE9B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,iBAAiB;IA0BzB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,UAAU;IAWT,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAQ1C;IAMD;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAsJlC;IAED;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAmB3B,8EAA8E;IAC9E,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,gBAAgB;IA8BxB,iBAAiB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAIjD;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvC;IAMD;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,kCAAkC;IAwB1C;;;;OAIG;IACH,OAAO,CAAC,iCAAiC;IAmBzC;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAuBvC;;;;;;;OAOG;IACH,OAAO,KAAK,OAAO,GAUlB;IAED;;;;;OAKG;IACH,OAAO,KAAK,SAAS,GAQpB;IAED,sEAAsE;IACtE,OAAO,KAAK,OAAO,GAElB;IAED,OAAO,CAAC,wBAAwB;IAyEhC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAI/B;oEACgE;IAChE,OAAO,CAAC,kBAAkB;IAI1B;;;;;OAKG;IACH;;;;;OAKG;IACH;;;;;OAKG;IACH;;;;OAIG;IACH,8BAA8B,CAC5B,IAAI,EAAE,MAAM,GACX;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAgBlD;IAED,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAO3C;IAED;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,2BAA2B;IAQnC,OAAO,CAAC,yBAAyB;IASjC,OAAO,CAAC,gBAAgB;IAcxB,iFAAiF;IACjF,OAAO,CAAC,4BAA4B;CAGrC;AAED,eAAO,MAAM,aAAa,eAAsB,CAAA"}
+{"version":3,"file":"xslate-adapter.d.ts","sourceRoot":"","sources":["../../src/adapter/xslate-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,MAAM,EACN,SAAS,EACT,MAAM,EACN,YAAY,EACZ,aAAa,EACb,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,aAAa,EACb,UAAU,EACV,OAAO,EAKP,yBAAyB,EAG1B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAE3B,KAAK,aAAa,EAClB,KAAK,UAAU,EA+BhB,MAAM,iBAAiB,CAAA;AAMxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AA6BrD,YAAY,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AA2C1D,qBAAa,aAAc,SAAQ,WAAY,YAAW,aAAa,CAAC,eAAe,CAAC;IACtF,IAAI,SAAW;IACf,SAAS,SAAQ;IACjB,qBAAqB,UAAO;IAG5B,kBAAkB,EAAG,cAAc,CAAS;IAE5C;;;;;OAKG;IACH,kBAAkB,EAAE,yBAAyB,CAA4B;IAEzE,OAAO,CAAC,aAAa,CAAa;IAClC;;;uCAGmC;IACnC,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAAI;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,iBAAiB,CAAyB;IAClD;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB,CAAyB;IAEjD;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB,CAAiC;IAE3D;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB,CAAyB;IAEpD;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB,CAAwB;IAEjD;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAAmC;IAEzD;;;;;;;;OAQG;IACH,OAAO,CAAC,0BAA0B,CAAyB;IAE3D;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB,CAAyB;IAEtD,YAAY,OAAO,GAAE,oBAAyB,EAM7C;IAED,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,aAAa,CA8EzE;IAMD,OAAO,CAAC,2BAA2B;IAyBnC;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/B;IAMD,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAE9F;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI7B;IAED,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAEzC;IAED,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAEtG;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAExF;IAED,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAElG;IAED,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAEhG;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7B;IAED,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAEtG;IAED,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAehG;IAED,uEAAuE;IACvE,OAAO,CAAC,kBAAkB;IAiB1B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,0BAA0B;IAclC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,MAAM,CAE1F;IAMD,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAqCxC;IAED;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAoBhC,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAoB3C;IAMD,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAuC7C;IAED,OAAO,CAAC,gBAAgB;IAOxB;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAcnC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoQ/B;IAMD;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAmCpC;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,2BAA2B;IAUnC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;IAiBpC,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAgGzC;IAED,OAAO,CAAC,sBAAsB,CAAI;IAElC;+DAC2D;IAC3D,OAAO,CAAC,kBAAkB,CAAI;IAE9B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,iBAAiB;IA0BzB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,UAAU;IAWT,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAQ1C;IAMD;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAsJlC;IAED;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAmB3B,8EAA8E;IAC9E,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,gBAAgB;IAoCxB,iBAAiB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAIjD;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvC;IAMD;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,kCAAkC;IAwB1C;;;;OAIG;IACH,OAAO,CAAC,iCAAiC;IAmBzC;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAuBvC;;;;;;;OAOG;IACH,OAAO,KAAK,OAAO,GAUlB;IAED;;;;;OAKG;IACH,OAAO,KAAK,SAAS,GAQpB;IAED,sEAAsE;IACtE,OAAO,KAAK,OAAO,GAElB;IAED,OAAO,CAAC,wBAAwB;IAyEhC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAI/B;oEACgE;IAChE,OAAO,CAAC,kBAAkB;IAI1B;;;;;OAKG;IACH;;;;;OAKG;IACH;;;;;OAKG;IACH;;;;OAIG;IACH,8BAA8B,CAC5B,IAAI,EAAE,MAAM,GACX;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAgBlD;IAED,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAO3C;IAED;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,yBAAyB;IASjC,OAAO,CAAC,gBAAgB;IAcxB,iFAAiF;IACjF,OAAO,CAAC,4BAA4B;CAGrC;AAED,eAAO,MAAM,aAAa,eAAsB,CAAA"}

package/dist/build.js

@@ -187308,7 +187308,13 @@ import {
   queryHrefArgs,
   isValidHelperId,
   sortComparatorFromArrow as sortComparatorFromArrow2,
-  isLowerableLoopDestructure
+  isLowerableLoopDestructure,
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+  resolveStaticLoopSource,
+  collectLoopBoundNames as collectLoopBoundNames2
 } from "@barefootjs/jsx";
 
 // src/adapter/boolean-result.ts
@@ -187624,6 +187630,39 @@ function renderFlatMethod(recv, depth, emit) {
   return `$bf.flat(${recv}, ${d})`;
 }
 
+// src/adapter/lib/static-value.ts
+function staticValueToKolon(value) {
+  if (value === null || value === undefined)
+    return "nil";
+  if (typeof value === "boolean")
+    return null;
+  if (typeof value === "number")
+    return String(value);
+  if (typeof value === "string")
+    return `'${escapeKolonSingleQuoted(value)}'`;
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const el of value) {
+      const serialized = staticValueToKolon(el);
+      if (serialized === null)
+        return null;
+      items.push(serialized);
+    }
+    return `[${items.join(", ")}]`;
+  }
+  if (typeof value === "object") {
+    const entries = [];
+    for (const [key, val] of Object.entries(value)) {
+      const serialized = staticValueToKolon(val);
+      if (serialized === null)
+        return null;
+      entries.push(`${kolonHashKey(key)} => ${serialized}`);
+    }
+    return `{ ${entries.join(", ")} }`;
+  }
+  return null;
+}
+
 // src/adapter/expr/emitters.ts
 import {
   groupBinaryOperand,
@@ -188167,6 +188206,9 @@ function generateDerivedMemoSeed(ctx, ir) {
 ` : "";
 }
 
+// src/adapter/props/prop-classes.ts
+import { collectLoopBoundNames } from "@barefootjs/jsx";
+
 // src/adapter/value/parsed-literal.ts
 import { evalStringArrayJoin } from "@barefootjs/jsx";
 function isStringTypeInfo(type2) {
@@ -188184,7 +188226,7 @@ function collectBooleanTypedProps(ir) {
   return new Set(ir.metadata.propsParams.filter((prop) => prop.type?.primitive === "boolean" || prop.type?.raw === "boolean").map((prop) => prop.name));
 }
 function collectNullableOptionalProps(ir) {
-  return new Set(ir.metadata.propsParams.filter((p) => p.defaultValue === undefined && !p.isRest && p.type?.kind !== "primitive").map((p) => p.name));
+  return new Set(ir.metadata.propsParams.filter((p) => p.defaultValue === undefined && !p.isRest && (p.type?.kind !== "primitive" || p.optional)).map((p) => p.name));
 }
 function collectStringValueNames(ir) {
   const names = new Set;
@@ -188197,6 +188239,12 @@ function collectStringValueNames(ir) {
     if (isStringTypeInfo(p.type))
       names.add(p.name);
   }
+  for (const c of ir.metadata.localConstants) {
+    if (isStringTypeInfo(c.type ?? undefined) || isBareStringLiteral(c.value))
+      names.add(c.name);
+  }
+  for (const bound of collectLoopBoundNames(ir))
+    names.delete(bound);
   return names;
 }
 
@@ -188232,6 +188280,7 @@ class XslateAdapter extends BaseAdapter {
   _searchParamsLocals = new Set;
   _loweringMatchers = [];
   localConstants = [];
+  staticLoopSourceBoundNames = new Set;
   nullableOptionalProps = new Set;
   constructor(options = {}) {
     super();
@@ -188247,6 +188296,7 @@ class XslateAdapter extends BaseAdapter {
     this.propsParams = ir.metadata.propsParams.map((p) => ({ name: p.name }));
     this.booleanTypedProps = collectBooleanTypedProps(ir);
     this.localConstants = ir.metadata.localConstants ?? [];
+    this.staticLoopSourceBoundNames = collectLoopBoundNames2(ir);
     this.nullableOptionalProps = collectNullableOptionalProps(ir);
     this.stringValueNames = collectStringValueNames(ir);
     this.moduleStringConsts = collectModuleStringConsts(ir.metadata.localConstants);
@@ -188363,7 +188413,8 @@ class XslateAdapter extends BaseAdapter {
   renderElement(element) {
     const tag = element.tag;
     const attrs = this.renderAttributes(element);
-    const children = this.renderChildren(element.children);
+    const dangerousHtml = this.renderDangerousInnerHtml(element);
+    const children = dangerousHtml !== null ? dangerousHtml : this.renderChildren(element.children);
     let hydrationAttrs = "";
     if (element.needsScope) {
       hydrationAttrs += ` ${this.renderScopeMarker("")}`;
@@ -188398,6 +188449,22 @@ class XslateAdapter extends BaseAdapter {
     }
     return `<${tag}${attrs}${hydrationAttrs}>${children}</${tag}>`;
   }
+  renderDangerousInnerHtml(element) {
+    const resolution = resolveDangerousInnerHtml(element);
+    if (!resolution)
+      return null;
+    if (resolution.kind === "dynamic") {
+      this.errors.push(dangerousInnerHtmlDiagnostic(resolution.expr, resolution.loc));
+      return "";
+    }
+    const violation = dangerousInnerHtmlMetacharViolation(resolution.html, this.name);
+    if (violation) {
+      const attr = element.attrs.find(isDangerousInnerHtmlAttr);
+      this.errors.push(dangerousInnerHtmlDiagnostic(`{ __html: ${JSON.stringify(resolution.html)} }`, attr.loc, violation));
+      return "";
+    }
+    return resolution.html;
+  }
   renderExpression(expr) {
     if (expr.clientOnly) {
       if (expr.slotId) {
@@ -188405,7 +188472,7 @@ class XslateAdapter extends BaseAdapter {
       }
       return "";
     }
-    const perlExpr = this.convertExpressionToKolon(expr.expr);
+    const perlExpr = this.convertExpressionToKolon(expr.expr, expr.parsed);
     if (expr.slotId) {
       return `<: $bf.text_start("${expr.slotId}") | mark_raw :><: ${perlExpr} :><: $bf.text_end() | mark_raw :>`;
     }
@@ -188497,8 +188564,12 @@ ${whenTrue}
         }
       });
     }
+    const staticItems = resolveStaticLoopSource(loop.arrayParsed, this.localConstants, {
+      isNameShadowed: (name) => this.staticLoopSourceBoundNames.has(name)
+    });
+    const staticArray = staticItems !== null ? staticValueToKolon(staticItems) : null;
     const arrayName = loop.array.trim();
-    if (/^[A-Za-z_$][\w$]*$/.test(arrayName)) {
+    if (staticArray === null && /^[A-Za-z_$][\w$]*$/.test(arrayName)) {
       const arrayConst = (this.localConstants ?? []).find((c) => c.name === arrayName);
       if (arrayConst && !arrayConst.isModule && this._resolveLiteralConst(arrayName) === null) {
         this.errors.push({
@@ -188512,7 +188583,7 @@ ${whenTrue}
         });
       }
     }
-    const rawArray = this.convertExpressionToKolon(loop.array);
+    const rawArray = staticArray ?? this.convertExpressionToKolon(loop.array);
     let array = rawArray;
     if (loop.sortComparator) {
       const sort = loop.sortComparator;
@@ -188825,6 +188896,8 @@ ${name}="<: ${val} :>"
     for (const attr of element.attrs) {
       if (attr.clientOnly)
         continue;
+      if (isDangerousInnerHtmlAttr(attr))
+        continue;
       let attrName;
       if (attr.name === "className")
         attrName = "class";
@@ -189008,6 +189081,8 @@ Options:
     return this.booleanTypedProps.has(bare);
   }
   _resolveLiteralConst(name) {
+    if (this.staticLoopSourceBoundNames.has(name))
+      return null;
     const c = (this.localConstants ?? []).find((lc) => lc.name === name);
     if (c?.value === undefined)
       return null;
@@ -189020,6 +189095,8 @@ Options:
     return null;
   }
   _resolveStaticRecordLiteral(objectName, key) {
+    if (this.staticLoopSourceBoundNames.has(objectName))
+      return null;
     const hit = lookupStaticRecordLiteral(objectName, key, this.localConstants);
     if (!hit)
       return null;

package/dist/conformance-pins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance-pins.d.ts","sourceRoot":"","sources":["../src/conformance-pins.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtD,eAAO,MAAM,eAAe,EAAE,eA2G7B,CAAA"}
+{"version":3,"file":"conformance-pins.d.ts","sourceRoot":"","sources":["../src/conformance-pins.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtD,eAAO,MAAM,eAAe,EAAE,eAyG7B,CAAA"}