@getforma/core 0.3.0 → 0.3.1

package/dist/runtime.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkVP5EOGM5_cjs = require('./chunk-VP5EOGM5.cjs');
+var chunkTSQ7AKFT_cjs = require('./chunk-TSQ7AKFT.cjs');
 var chunkFPSLC62A_cjs = require('./chunk-FPSLC62A.cjs');
 
 // src/dom/reconcile.ts
@@ -481,6 +481,7 @@ if (buildUnsafeEvalMode) {
   _unsafeEvalMode = buildUnsafeEvalMode;
   if (_unsafeEvalMode === "locked-off") _allowUnsafeEval = false;
   if (_unsafeEvalMode === "locked-on") _allowUnsafeEval = true;
+  if (_unsafeEvalMode === "mutable") _allowUnsafeEval = true;
 }
 var runtimeConfig = readRuntimeConfig();
 var configUnsafeMode = runtimeConfig.lockUnsafeEval ? "locked-off" : runtimeConfig.unsafeEvalMode;
@@ -558,7 +559,6 @@ var RE_STRING_DOUBLE = /^"[^"]*"$/;
 var RE_NUMBER = /^-?\d+(\.\d+)?$/;
 var RE_IDENTIFIER = /^[a-zA-Z_$]\w*$/;
 var RE_DOT_ACCESS = /^(\w+)\.(\w+)$/;
-var RE_DEEP_DOT = /^(\w+)\.(\w+)\.(\w+)(?:\.(\w+))?$/;
 var RE_BRACKET = /^(\w+)\[(\d+|'[^']*'|"[^"]*")\]$/;
 var RE_TERNARY = /^(.+?)\s*\?\s*(.+?)\s*:\s*(.+)$/;
 var RE_NULLISH = /^(.+?)\s*\?\?\s*(.+)$/;
@@ -569,7 +569,6 @@ var RE_MUL = /^(.+?)\s*([*/%])\s*(.+)$/;
 var RE_ADD = /^(.+?)\s*([+-])\s*(.+)$/;
 var RE_TEMPLATE_LIT = /^`([^`]*)`$/;
 var RE_TEMPLATE_INTERP = /\$\{([^}]+)\}/g;
-var RE_METHOD_CALL = /^(\w+)\.(\w+)\((.*)\)$/;
 var RE_GROUP_METHOD_CALL = /^\((.+)\)\.(\w+)\((.*)\)$/;
 var RE_STRIP_BRACES = /^\{|\}$/g;
 var RE_DIGIT_ONLY = /^\d+$/;
@@ -584,6 +583,7 @@ var RE_COMPUTED = /^(\w+)\s*=\s*(.+)$/;
 var RE_FETCH = /^(.+?)(?:→|->)\s*(\S+)(.*)$/;
 var RE_FETCH_METHOD = /^(GET|POST|PUT|PATCH|DELETE)\s+(.+)$/i;
 var RE_STRIP_ITEM_BRACES = /^\{item\.?|\}$/g;
+var RE_EVENT_REF = /\bevent\b|\$event\b/;
 var RE_REFETCH_CALL = /^\$refetch\(\s*['"]([^'"]+)['"]\s*\)$/;
 var TRANSITION_STATE_SYM = /* @__PURE__ */ Symbol.for("forma-transition-state");
 var EXPRESSION_CACHE_MAX = 2048;
@@ -598,7 +598,40 @@ function cacheExpression(key, factory) {
 var scopeExpressionCache = /* @__PURE__ */ new WeakMap();
 var scopeHandlerCache = /* @__PURE__ */ new WeakMap();
 var compiledTemplateCache = /* @__PURE__ */ new Map();
-var UNSAFE_METHOD_NAMES = /* @__PURE__ */ new Set(["constructor", "__proto__", "prototype"]);
+var UNSAFE_METHOD_NAMES = /* @__PURE__ */ new Set([
+  "constructor",
+  "__proto__",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__",
+  "eval"
+]);
+var BLOCKED_METHOD_REGEXES = (() => {
+  const result = [];
+  for (const name of UNSAFE_METHOD_NAMES) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    result.push({
+      name,
+      // Match as property access (.name) or bare identifier at start
+      dotRe: new RegExp(`(?:^|\\.)${escaped}(?:\\s*\\(|\\s*$|[^\\w$])`, "m"),
+      // Match bracket access with single quotes, double quotes, or backticks
+      bracketRe: new RegExp(`\\[\\s*(?:'${escaped}'|"${escaped}"|\`` + escaped + `\`)\\s*\\]`)
+    });
+  }
+  return result;
+})();
+function findBlockedMethod(expr) {
+  let cleaned = expr.replace(/\/\*[\s\S]*?\*\//g, "");
+  cleaned = cleaned.replace(/\/\/[^\n]*/g, "");
+  cleaned = cleaned.replace(/\s*\.\s*/g, ".");
+  for (const { name, dotRe, bracketRe } of BLOCKED_METHOD_REGEXES) {
+    if (dotRe.test(cleaned)) return name;
+    if (bracketRe.test(cleaned)) return name;
+  }
+  return null;
+}
 var TEXT_BINDING_SYM = /* @__PURE__ */ Symbol.for("forma-text-binding-cache");
 function toTextValue(value) {
   if (value == null) return "";
@@ -873,6 +906,7 @@ function consumeStatement(raw) {
 function parseIfHandler(expr, scope) {
   const input = expr.trim();
   if (!RE_IF_PREFIX.test(input)) return null;
+  if (RE_EVENT_REF.test(input)) return null;
   let idx = 2;
   while (idx < input.length && /\s/.test(input[idx])) idx++;
   if (input[idx] !== "(") return null;
@@ -897,7 +931,7 @@ function parseIfHandler(expr, scope) {
   }
   if (rest.length > 0) return null;
   return (e) => {
-    chunkVP5EOGM5_cjs.batch(() => {
+    chunkTSQ7AKFT_cjs.batch(() => {
       if (condExpr()) thenHandler(e);
       else elseHandler?.(e);
     });
@@ -1274,6 +1308,68 @@ function cloneAttributeTemplates(el, item) {
     }
   }
 }
+function parseChainedAccess(expr, scope) {
+  let pos = 0;
+  const identMatch = expr.match(/^[a-zA-Z_$]\w*/);
+  if (!identMatch) return null;
+  const rootName = identMatch[0];
+  pos = rootName.length;
+  if (pos >= expr.length) return null;
+  if (expr[pos] !== "." && !(expr[pos] === "?" && expr[pos + 1] === ".")) return null;
+  const steps = [];
+  while (pos < expr.length) {
+    let optional = false;
+    if (expr[pos] === "?" && expr[pos + 1] === ".") {
+      optional = true;
+      pos += 2;
+    } else if (expr[pos] === ".") {
+      pos += 1;
+    } else {
+      return null;
+    }
+    const nameMatch = expr.slice(pos).match(/^\w+/);
+    if (!nameMatch) return null;
+    const name = nameMatch[0];
+    pos += name.length;
+    if (UNSAFE_METHOD_NAMES.has(name)) return () => void 0;
+    if (pos < expr.length && expr[pos] === "(") {
+      const balanced = readBalancedSegment(expr, pos, "(", ")");
+      if (!balanced) return null;
+      const argsRaw = balanced.inner.trim();
+      const argFns = [];
+      for (const arg of splitCallArgs(argsRaw)) {
+        const parsed = parseExpression(arg, scope);
+        if (!parsed) return null;
+        argFns.push(parsed);
+      }
+      steps.push({ type: "call", name, optional, argFns });
+      pos = balanced.end + 1;
+    } else {
+      steps.push({ type: "prop", name, optional });
+    }
+  }
+  if (pos !== expr.length) return null;
+  if (steps.length === 0) return null;
+  const rootExpr = rootName === "Math" ? (() => Math) : (() => scope.getters[rootName]?.());
+  return () => {
+    let val = rootExpr();
+    for (const step of steps) {
+      if (val == null) {
+        if (step.optional) return void 0;
+        return void 0;
+      }
+      if (step.type === "prop") {
+        val = val[step.name];
+      } else {
+        const method = val[step.name];
+        if (typeof method !== "function") return void 0;
+        const args = step.argFns.map((fn) => fn());
+        val = method.apply(val, args);
+      }
+    }
+    return val;
+  };
+}
 function parseExpression(expr, scope) {
   const cachedFactory = expressionCache.get(expr);
   if (cachedFactory) return cachedFactory(scope);
@@ -1324,24 +1420,9 @@ function parseExpressionUncached(expr, scope) {
   if (RE_IDENTIFIER.test(expr)) {
     return () => scope.getters[expr]?.();
   }
-  const dotMatch = expr.match(RE_DOT_ACCESS);
-  if (dotMatch) {
-    const p1 = dotMatch[1], p2 = dotMatch[2];
-    return () => {
-      const obj = scope.getters[p1]?.();
-      return obj?.[p2];
-    };
-  }
-  const deepDotMatch = expr.match(RE_DEEP_DOT);
-  if (deepDotMatch) {
-    const p1 = deepDotMatch[1], p2 = deepDotMatch[2], p3 = deepDotMatch[3], p4 = deepDotMatch[4];
-    return () => {
-      let val = scope.getters[p1]?.();
-      val = val?.[p2];
-      val = val?.[p3];
-      if (p4) val = val?.[p4];
-      return val;
-    };
+  {
+    const chainResult = parseChainedAccess(expr, scope);
+    if (chainResult) return chainResult;
   }
   const groupedCallMatch = expr.match(RE_GROUP_METHOD_CALL);
   if (groupedCallMatch) {
@@ -1365,28 +1446,6 @@ function parseExpressionUncached(expr, scope) {
       return method.apply(base, args);
     };
   }
-  const callMatch = expr.match(RE_METHOD_CALL);
-  if (callMatch) {
-    const baseName = callMatch[1];
-    const methodName = callMatch[2];
-    const argsRaw = callMatch[3].trim();
-    if (UNSAFE_METHOD_NAMES.has(methodName)) return () => void 0;
-    const baseExpr = baseName === "Math" ? (() => Math) : parseExpression(baseName, scope);
-    if (!baseExpr) return null;
-    const argFns = [];
-    for (const arg of splitCallArgs(argsRaw)) {
-      const parsed = parseExpression(arg, scope);
-      if (!parsed) return null;
-      argFns.push(parsed);
-    }
-    return () => {
-      const base = baseExpr();
-      const method = base?.[methodName];
-      if (typeof method !== "function") return void 0;
-      const args = argFns.map((fn) => fn());
-      return method.apply(base, args);
-    };
-  }
   if (expr.startsWith("!")) {
     const inner = parseExpression(expr.slice(1).trim(), scope);
     if (inner) return () => !inner();
@@ -1405,6 +1464,29 @@ function parseExpressionUncached(expr, scope) {
       return () => objExpr()?.[key];
     }
   }
+  if (expr.startsWith("[")) {
+    const balanced = readBalancedSegment(expr, 0, "[", "]");
+    if (balanced && balanced.end === expr.length - 1) {
+      const inner = balanced.inner.trim();
+      if (inner === "") {
+        return () => [];
+      }
+      const elements = splitCallArgs(inner);
+      const elementFns = [];
+      let allParsed = true;
+      for (const el of elements) {
+        const parsed = parseExpression(el.trim(), scope);
+        if (!parsed) {
+          allParsed = false;
+          break;
+        }
+        elementFns.push(parsed);
+      }
+      if (allParsed) {
+        return () => elementFns.map((fn) => fn());
+      }
+    }
+  }
   const ternaryMatch = expr.match(RE_TERNARY);
   if (ternaryMatch) {
     const cond = parseExpression(ternaryMatch[1].trim(), scope);
@@ -1534,6 +1616,15 @@ function getScopeCache(cache, scope) {
   }
   return scoped;
 }
+function cspExpressionHint(expr) {
+  if (expr.includes("...")) {
+    return `Unsupported expression in CSP-safe mode: spread syntax detected. Use .concat() instead, or enable unsafe-eval via setUnsafeEval(true).`;
+  }
+  if (expr.includes("=>")) {
+    return `Unsupported expression in CSP-safe mode: arrow function detected. Extract logic to a data-computed attribute, or enable unsafe-eval via setUnsafeEval(true).`;
+  }
+  return `Unsupported expression in CSP-safe mode. Simplify the expression or enable unsafe-eval via setUnsafeEval(true).`;
+}
 function buildEvaluator(expr, scope) {
   const cleaned = expr.replace(RE_STRIP_BRACES, "").trim();
   const cache = getScopeCache(scopeExpressionCache, scope);
@@ -1546,11 +1637,17 @@ function buildEvaluator(expr, scope) {
   }
   if (!_allowUnsafeEval) {
     dbg("buildEvaluator: blocked unsafe eval fallback for expression:", cleaned);
-    reportDiagnostic("expression-unsupported", cleaned, "Unsupported expression in CSP-safe mode");
+    reportDiagnostic("expression-unsupported", cleaned, cspExpressionHint(cleaned));
     const blocked = () => void 0;
     cache.set(cleaned, blocked);
     return blocked;
   }
+  const blockedMethod = findBlockedMethod(cleaned);
+  if (blockedMethod) {
+    const msg = `Blocked unsafe method "${blockedMethod}" in expression`;
+    reportDiagnostic("expression-unsupported", cleaned, msg);
+    throw new Error(`[FormaJS] ${msg}: ${cleaned}`);
+  }
   try {
     const fn = new Function("__scope", `with(__scope) { return (${cleaned}); }`);
     const proxy = new Proxy(/* @__PURE__ */ Object.create(null), {
@@ -1566,7 +1663,7 @@ function buildEvaluator(expr, scope) {
     cache.set(cleaned, unsafe);
     return unsafe;
   } catch {
-    reportDiagnostic("expression-unsupported", cleaned, "Expression failed to compile");
+    reportDiagnostic("expression-unsupported", cleaned, "Expression too complex for CSP-safe mode. Enable unsafe-eval via FormaRuntime.unsafeEval = true, or use the standard (non-hardened) build.");
     const failed = () => void 0;
     cache.set(cleaned, failed);
     return failed;
@@ -1582,7 +1679,7 @@ function parseHandler(expr, scope) {
     const handlers = stmts.map((s) => parseHandler(s, scope));
     if (handlers.every((h) => h !== null)) {
       return (e) => {
-        chunkVP5EOGM5_cjs.batch(() => {
+        chunkTSQ7AKFT_cjs.batch(() => {
           for (const h of handlers) h(e);
         });
       };
@@ -1595,7 +1692,7 @@ function parseHandler(expr, scope) {
     const name = incrMatch[1];
     const op = incrMatch[2];
     return () => {
-      chunkVP5EOGM5_cjs.batch(() => {
+      chunkTSQ7AKFT_cjs.batch(() => {
         const val = scope.getters[name]?.() ?? 0;
         scope.setters[name]?.(op === "++" ? val + 1 : val - 1);
       });
@@ -1606,7 +1703,7 @@ function parseHandler(expr, scope) {
     const op = preIncrMatch[1];
     const name = preIncrMatch[2];
     return () => {
-      chunkVP5EOGM5_cjs.batch(() => {
+      chunkTSQ7AKFT_cjs.batch(() => {
         const val = scope.getters[name]?.() ?? 0;
         scope.setters[name]?.(op === "++" ? val + 1 : val - 1);
       });
@@ -1616,7 +1713,7 @@ function parseHandler(expr, scope) {
   if (toggleMatch && toggleMatch[1] === toggleMatch[2]) {
     const name = toggleMatch[1];
     return () => {
-      chunkVP5EOGM5_cjs.batch(() => {
+      chunkTSQ7AKFT_cjs.batch(() => {
         scope.setters[name]?.(!scope.getters[name]?.());
       });
     };
@@ -1628,7 +1725,7 @@ function parseHandler(expr, scope) {
     if (valExpr) {
       if (_debug) dbg(`parseHandler: assignment "${name} = ..." \u2014 setter exists:`, !!scope.setters[name], ", getter exists:", !!scope.getters[name]);
       return () => {
-        chunkVP5EOGM5_cjs.batch(() => {
+        chunkTSQ7AKFT_cjs.batch(() => {
           const val = valExpr();
           if (_debug) dbg(`SETTER: ${name} = ${val} (was: ${scope.getters[name]?.()})`);
           scope.setters[name]?.(val);
@@ -1643,7 +1740,7 @@ function parseHandler(expr, scope) {
     const valExpr = parseExpression(compoundMatch[3].trim(), scope);
     if (valExpr) {
       return () => {
-        chunkVP5EOGM5_cjs.batch(() => {
+        chunkTSQ7AKFT_cjs.batch(() => {
           const current = scope.getters[name]?.() ?? 0;
           const val = valExpr();
           switch (op) {
@@ -1672,7 +1769,13 @@ function parseHandler(expr, scope) {
   return null;
 }
 function buildHandler(expr, scope) {
-  const cleaned = expr.replace(RE_STRIP_BRACES, "").trim();
+  let cleaned = expr.trim();
+  if (cleaned.startsWith("{")) {
+    const seg = readBalancedSegment(cleaned, 0, "{", "}");
+    if (seg && seg.end === cleaned.length - 1) {
+      cleaned = seg.inner.trim();
+    }
+  }
   const cache = getScopeCache(scopeHandlerCache, scope);
   const cached = cache.get(cleaned);
   if (cached) return cached;
@@ -1684,7 +1787,7 @@ function buildHandler(expr, scope) {
   }
   if (!_allowUnsafeEval) {
     dbg("buildHandler: blocked unsafe eval fallback for expression:", cleaned);
-    reportDiagnostic("handler-unsupported", cleaned, "Unsupported handler in CSP-safe mode");
+    reportDiagnostic("handler-unsupported", cleaned, cspExpressionHint(cleaned));
     const result = {
       handler: () => {
       },
@@ -1693,6 +1796,12 @@ function buildHandler(expr, scope) {
     cache.set(cleaned, result);
     return result;
   }
+  const blockedMethod = findBlockedMethod(cleaned);
+  if (blockedMethod) {
+    const msg = `Blocked unsafe method "${blockedMethod}" in handler`;
+    reportDiagnostic("handler-unsupported", cleaned, msg);
+    throw new Error(`[FormaJS] ${msg}: ${cleaned}`);
+  }
   try {
     const fn = new Function("__scope", "$event", "event", `with(__scope) { ${cleaned} }`);
     const proxy = new Proxy(/* @__PURE__ */ Object.create(null), {
@@ -1711,7 +1820,7 @@ function buildHandler(expr, scope) {
       }
     });
     const unsafeHandler = (e) => {
-      chunkVP5EOGM5_cjs.batch(() => fn(proxy, e, e));
+      chunkTSQ7AKFT_cjs.batch(() => fn(proxy, e, e));
     };
     const result = {
       handler: unsafeHandler,
@@ -1720,7 +1829,7 @@ function buildHandler(expr, scope) {
     cache.set(cleaned, result);
     return result;
   } catch {
-    reportDiagnostic("handler-unsupported", cleaned, "Handler failed to compile");
+    reportDiagnostic("handler-unsupported", cleaned, "Expression too complex for CSP-safe mode. Enable unsafe-eval via FormaRuntime.unsafeEval = true, or use the standard (non-hardened) build.");
     const result = {
       handler: () => {
       },
@@ -1730,16 +1839,22 @@ function buildHandler(expr, scope) {
     return result;
   }
 }
+var FORBIDDEN_STATE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function parseState(raw) {
+  let parsed;
   try {
-    return JSON.parse(raw);
+    parsed = JSON.parse(raw);
   } catch {
     try {
-      return JSON.parse(raw.replace(RE_UNQUOTED_KEYS, '"$1":'));
+      parsed = JSON.parse(raw.replace(RE_UNQUOTED_KEYS, '"$1":'));
     } catch {
       return {};
     }
   }
+  for (const key of FORBIDDEN_STATE_KEYS) {
+    if (key in parsed) delete parsed[key];
+  }
+  return parsed;
 }
 function initScope(stateEl) {
   const raw = stateEl.getAttribute("data-forma-state") ?? "{}";
@@ -1787,7 +1902,7 @@ function bindElement(el, scope, disposers) {
   const textExpr = !known || known.has("data-text") ? el.getAttribute("data-text") : null;
   if (textExpr) {
     const evaluate = buildEvaluator(textExpr, scope);
-    const dispose = chunkVP5EOGM5_cjs.internalEffect(() => {
+    const dispose = chunkTSQ7AKFT_cjs.internalEffect(() => {
       setElementTextFast(el, toTextValue(evaluate()));
     });
     disposers.push(dispose);
@@ -1802,7 +1917,7 @@ function bindElement(el, scope, disposers) {
       dbg(`bindElement: data-show="${showExpr}" on <${tag}${cls}>`);
     }
     let initialized = false;
-    const dispose = chunkVP5EOGM5_cjs.internalEffect(() => {
+    const dispose = chunkTSQ7AKFT_cjs.internalEffect(() => {
       const visible = !!evaluate();
       if (_debug) dbg(`data-show effect: "${showExpr}" \u2192 ${visible}`);
       applyShowVisibility(el, visible, transition, !initialized);
@@ -1821,7 +1936,7 @@ function bindElement(el, scope, disposers) {
     const parent = el.parentNode;
     let inserted = true;
     let initialized = false;
-    const dispose = chunkVP5EOGM5_cjs.internalEffect(() => {
+    const dispose = chunkTSQ7AKFT_cjs.internalEffect(() => {
       const show = !!evaluate();
       if (show && !inserted) {
         clearTransitionState(el);
@@ -1860,7 +1975,7 @@ function bindElement(el, scope, disposers) {
     const setter = scope.setters[prop];
     if (getter && setter) {
       const input = el;
-      const dispose = chunkVP5EOGM5_cjs.internalEffect(() => {
+      const dispose = chunkTSQ7AKFT_cjs.internalEffect(() => {
         const val = getter();
         if (input.type === "checkbox") {
           input.checked = !!val;
@@ -1924,14 +2039,14 @@ function bindElement(el, scope, disposers) {
     } else if (name.startsWith("data-class:")) {
       const cls = name.slice(11);
       const evaluate = buildEvaluator(attr.value, scope);
-      const dispose = chunkVP5EOGM5_cjs.internalEffect(() => {
+      const dispose = chunkTSQ7AKFT_cjs.internalEffect(() => {
         el.classList.toggle(cls, !!evaluate());
       });
       disposers.push(dispose);
     } else if (name.startsWith("data-bind:")) {
       const attrName = name.slice(10);
       const evaluate = buildEvaluator(attr.value, scope);
-      const dispose = chunkVP5EOGM5_cjs.internalEffect(() => {
+      const dispose = chunkTSQ7AKFT_cjs.internalEffect(() => {
         const val = evaluate();
         if (val == null || val === false) {
           el.removeAttribute(attrName);
@@ -1954,7 +2069,7 @@ function bindElement(el, scope, disposers) {
         if (saved !== null) setter(JSON.parse(saved));
       } catch {
       }
-      const dispose = chunkVP5EOGM5_cjs.internalEffect(() => {
+      const dispose = chunkTSQ7AKFT_cjs.internalEffect(() => {
         try {
           localStorage.setItem(key, JSON.stringify(getter()));
         } catch {
@@ -2041,7 +2156,7 @@ function bindElement(el, scope, disposers) {
           });
         }
       } : void 0;
-      const dispose = chunkVP5EOGM5_cjs.internalEffect(() => {
+      const dispose = chunkTSQ7AKFT_cjs.internalEffect(() => {
         const rawItems = evaluate();
         if (!Array.isArray(rawItems)) {
           for (const n of oldNodes) {
@@ -2062,7 +2177,7 @@ function bindElement(el, scope, disposers) {
         }
         const prevNodes = new Set(oldNodes);
         if (keyProp) {
-          const result = chunkVP5EOGM5_cjs.reconcileList(
+          const result = chunkTSQ7AKFT_cjs.reconcileList(
             el,
             oldItems,
             rawItems,
@@ -2092,7 +2207,7 @@ function bindElement(el, scope, disposers) {
         } else {
           const wrapped = rawItems.map((item, i) => ({ __idx: i, __item: item }));
           const oldWrapped = oldItems;
-          const result = chunkVP5EOGM5_cjs.reconcileList(
+          const result = chunkTSQ7AKFT_cjs.reconcileList(
             el,
             oldWrapped,
             wrapped,
@@ -2409,6 +2524,7 @@ function setUnsafeEvalMode(mode) {
   _unsafeEvalMode = mode;
   if (mode === "locked-off") _allowUnsafeEval = false;
   if (mode === "locked-on") _allowUnsafeEval = true;
+  if (mode === "mutable") _allowUnsafeEval = true;
   scopeExpressionCache = /* @__PURE__ */ new WeakMap();
   scopeHandlerCache = /* @__PURE__ */ new WeakMap();
 }
@@ -2461,7 +2577,7 @@ function getScopes() {
 function setScopeValue(element, key, value) {
   const scope = element.__formaScope;
   if (!scope?.setters[key]) return;
-  chunkVP5EOGM5_cjs.batch(() => {
+  chunkTSQ7AKFT_cjs.batch(() => {
     scope.setters[key](value);
   });
 }
@@ -2470,7 +2586,7 @@ function resetScope(element) {
   const initialJSON = element.__formaInitialState;
   if (!scope || !initialJSON) return;
   const initial = parseState(initialJSON);
-  chunkVP5EOGM5_cjs.batch(() => {
+  chunkTSQ7AKFT_cjs.batch(() => {
     for (const [key, val] of Object.entries(initial)) {
       scope.setters[key]?.(val);
     }
@@ -2500,7 +2616,7 @@ function getReconciler() {
           }
         }
       },
-      batch: chunkVP5EOGM5_cjs.batch
+      batch: chunkTSQ7AKFT_cjs.batch
     });
   }
   return _reconciler;