@getforma/core 0.3.1 → 0.6.1

package/dist/runtime-hardened.cjs

@@ -19,7 +19,6 @@ function createSignal(initialValue) {
   const setter = (v) => applySignalSet(s, v);
   return [getter, setter];
 }
-var createValueSignal = createSignal;
 function internalEffect(fn) {
   const dispose = alienSignals.effect(fn);
   return dispose;
@@ -852,12 +851,11 @@ var RE_TOGGLE = /^(\w+)\s*=\s*!(\w+)$/;
 var RE_ASSIGN = /^(\w+)\s*=\s*(.+)$/;
 var RE_COMPOUND = /^(\w+)\s*(\+=|-=|\*=|\/=)\s*(.+)$/;
 var RE_IF_PREFIX = /^if\b/;
-var RE_UNQUOTED_KEYS = /(\w+)\s*:/g;
 var RE_COMPUTED = /^(\w+)\s*=\s*(.+)$/;
 var RE_FETCH = /^(.+?)(?:→|->)\s*(\S+)(.*)$/;
 var RE_FETCH_METHOD = /^(GET|POST|PUT|PATCH|DELETE)\s+(.+)$/i;
 var RE_STRIP_ITEM_BRACES = /^\{item\.?|\}$/g;
-var RE_EVENT_REF = /\bevent\b|\$event\b/;
+var RE_EVENT_REF = /\bevent\s*[.([]|\$event\b/;
 var RE_REFETCH_CALL = /^\$refetch\(\s*['"]([^'"]+)['"]\s*\)$/;
 var TRANSITION_STATE_SYM = /* @__PURE__ */ Symbol.for("forma-transition-state");
 var EXPRESSION_CACHE_MAX = 2048;
@@ -872,6 +870,14 @@ function cacheExpression(key, factory) {
 var scopeExpressionCache = /* @__PURE__ */ new WeakMap();
 var scopeHandlerCache = /* @__PURE__ */ new WeakMap();
 var compiledTemplateCache = /* @__PURE__ */ new Map();
+var COMPILED_TEMPLATE_CACHE_MAX = 2048;
+function cacheCompiledTemplate(key, template) {
+  if (compiledTemplateCache.size >= COMPILED_TEMPLATE_CACHE_MAX) {
+    const first = compiledTemplateCache.keys().next().value;
+    if (first !== void 0) compiledTemplateCache.delete(first);
+  }
+  compiledTemplateCache.set(key, template);
+}
 var UNSAFE_METHOD_NAMES = /* @__PURE__ */ new Set([
   "constructor",
   "__proto__",
@@ -880,7 +886,8 @@ var UNSAFE_METHOD_NAMES = /* @__PURE__ */ new Set([
   "__defineSetter__",
   "__lookupGetter__",
   "__lookupSetter__",
-  "eval"
+  "eval",
+  "Function"
 ]);
 var BLOCKED_METHOD_REGEXES = (() => {
   const result = [];
@@ -904,8 +911,36 @@ function findBlockedMethod(expr) {
     if (dotRe.test(cleaned)) return name;
     if (bracketRe.test(cleaned)) return name;
   }
+  if (cleaned.includes("[")) {
+    const bracketContents = extractBracketContents(cleaned);
+    for (const content of bracketContents) {
+      if (!content.includes("+")) continue;
+      const fragments = content.match(/['"`]([^'"`]*?)['"`]/g);
+      if (!fragments) continue;
+      const joined = fragments.map((f) => f.slice(1, -1)).join("");
+      if (UNSAFE_METHOD_NAMES.has(joined)) return joined;
+    }
+  }
   return null;
 }
+function extractBracketContents(expr) {
+  const results = [];
+  let depth = 0;
+  let start = -1;
+  for (let i = 0; i < expr.length; i++) {
+    if (expr[i] === "[") {
+      if (depth === 0) start = i + 1;
+      depth++;
+    } else if (expr[i] === "]") {
+      depth--;
+      if (depth === 0 && start >= 0) {
+        results.push(expr.slice(start, i));
+        start = -1;
+      }
+    }
+  }
+  return results;
+}
 var TEXT_BINDING_SYM = /* @__PURE__ */ Symbol.for("forma-text-binding-cache");
 function toTextValue(value2) {
   if (value2 == null) return "";
@@ -1241,7 +1276,7 @@ function compileTemplate(text) {
     dynamics,
     hasItemRef: dynamics.length > 0
   };
-  compiledTemplateCache.set(text, result);
+  cacheCompiledTemplate(text, result);
   return result;
 }
 var templateTexts = /* @__PURE__ */ new WeakMap();
@@ -1929,6 +1964,7 @@ function buildEvaluator(expr, scope) {
         return key in scope.getters;
       },
       get(_, key) {
+        if (UNSAFE_METHOD_NAMES.has(key)) return void 0;
         const g = scope.getters[key];
         return g ? g() : void 0;
       }
@@ -2084,6 +2120,7 @@ function buildHandler(expr, scope) {
         return key in scope.getters || key in scope.setters;
       },
       get(_, key) {
+        if (UNSAFE_METHOD_NAMES.has(key)) return void 0;
         const g = scope.getters[key];
         return g ? g() : void 0;
       },
@@ -2119,11 +2156,10 @@ function parseState(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    try {
-      parsed = JSON.parse(raw.replace(RE_UNQUOTED_KEYS, '"$1":'));
-    } catch {
-      return {};
+    if (_debug) {
+      dbg("parseState: Invalid JSON in data-forma-state \u2014 use valid JSON with quoted keys. Got:", raw.slice(0, 200));
     }
+    return {};
   }
   for (const key of FORBIDDEN_STATE_KEYS) {
     if (key in parsed) delete parsed[key];
@@ -2143,7 +2179,7 @@ function initScope(stateEl) {
   const getters = {};
   const setters = {};
   for (const [key, initial] of Object.entries(state)) {
-    const [get, set] = createValueSignal(initial);
+    const [get, set] = createSignal(initial);
     getters[key] = get;
     setters[key] = set;
   }
@@ -2151,6 +2187,18 @@ function initScope(stateEl) {
   return { getters, setters };
 }
 function bindElement(el, scope, disposers) {
+  const elMagics = {
+    $el: el,
+    $dispatch: (name, detail) => {
+      el.dispatchEvent(new CustomEvent(name, {
+        bubbles: true,
+        composed: true,
+        // crosses Shadow DOM boundaries (important for <forma-stage>)
+        detail
+      }));
+    }
+  };
+  scope = createChildScope(scope, elMagics);
   const known = getDirectives(el);
   const computedAttr = !known || known.has("data-computed") ? el.getAttribute("data-computed") : null;
   if (computedAttr) {
@@ -2530,16 +2578,16 @@ function bindElement(el, scope, disposers) {
         else if (k === "error") errorTarget = v;
         else if (k === "poll") interval = parseInt(v ?? "0", 10);
       }
-      const [getTarget, setTarget] = createValueSignal(null);
+      const [getTarget, setTarget] = createSignal(null);
       scope.getters[target] = getTarget;
       scope.setters[target] = setTarget;
       if (loadingTarget) {
-        const [gl, sl] = createValueSignal(false);
+        const [gl, sl] = createSignal(false);
         scope.getters[loadingTarget] = gl;
         scope.setters[loadingTarget] = sl;
       }
       if (errorTarget) {
-        const [ge, se] = createValueSignal(null);
+        const [ge, se] = createSignal(null);
         scope.getters[errorTarget] = ge;
         scope.setters[errorTarget] = se;
       }