@getforma/core 0.3.1 → 0.8.1

package/dist/runtime-hardened.cjs

@@ -3,23 +3,23 @@
 var alienSignals = require('alien-signals');
 
 // src/reactive/signal.ts
-function applySignalSet(s, v) {
+function applySignalSet(s, v, equals) {
   if (typeof v !== "function") {
     s(v);
     return;
   }
-  alienSignals.pauseTracking();
+  const prevSub = alienSignals.setActiveSub(void 0);
   const prev = s();
-  alienSignals.resumeTracking();
-  s(v(prev));
+  alienSignals.setActiveSub(prevSub);
+  const next = v(prev);
+  s(next);
 }
-function createSignal(initialValue) {
+function createSignal(initialValue, options) {
   const s = alienSignals.signal(initialValue);
   const getter = s;
   const setter = (v) => applySignalSet(s, v);
   return [getter, setter];
 }
-var createValueSignal = createSignal;
 function internalEffect(fn) {
   const dispose = alienSignals.effect(fn);
   return dispose;
@@ -852,12 +852,11 @@ var RE_TOGGLE = /^(\w+)\s*=\s*!(\w+)$/;
 var RE_ASSIGN = /^(\w+)\s*=\s*(.+)$/;
 var RE_COMPOUND = /^(\w+)\s*(\+=|-=|\*=|\/=)\s*(.+)$/;
 var RE_IF_PREFIX = /^if\b/;
-var RE_UNQUOTED_KEYS = /(\w+)\s*:/g;
 var RE_COMPUTED = /^(\w+)\s*=\s*(.+)$/;
 var RE_FETCH = /^(.+?)(?:→|->)\s*(\S+)(.*)$/;
 var RE_FETCH_METHOD = /^(GET|POST|PUT|PATCH|DELETE)\s+(.+)$/i;
 var RE_STRIP_ITEM_BRACES = /^\{item\.?|\}$/g;
-var RE_EVENT_REF = /\bevent\b|\$event\b/;
+var RE_EVENT_REF = /\bevent\s*[.([]|\$event\b/;
 var RE_REFETCH_CALL = /^\$refetch\(\s*['"]([^'"]+)['"]\s*\)$/;
 var TRANSITION_STATE_SYM = /* @__PURE__ */ Symbol.for("forma-transition-state");
 var EXPRESSION_CACHE_MAX = 2048;
@@ -872,6 +871,14 @@ function cacheExpression(key, factory) {
 var scopeExpressionCache = /* @__PURE__ */ new WeakMap();
 var scopeHandlerCache = /* @__PURE__ */ new WeakMap();
 var compiledTemplateCache = /* @__PURE__ */ new Map();
+var COMPILED_TEMPLATE_CACHE_MAX = 2048;
+function cacheCompiledTemplate(key, template) {
+  if (compiledTemplateCache.size >= COMPILED_TEMPLATE_CACHE_MAX) {
+    const first = compiledTemplateCache.keys().next().value;
+    if (first !== void 0) compiledTemplateCache.delete(first);
+  }
+  compiledTemplateCache.set(key, template);
+}
 var UNSAFE_METHOD_NAMES = /* @__PURE__ */ new Set([
   "constructor",
   "__proto__",
@@ -880,7 +887,8 @@ var UNSAFE_METHOD_NAMES = /* @__PURE__ */ new Set([
   "__defineSetter__",
   "__lookupGetter__",
   "__lookupSetter__",
-  "eval"
+  "eval",
+  "Function"
 ]);
 var BLOCKED_METHOD_REGEXES = (() => {
   const result = [];
@@ -904,8 +912,36 @@ function findBlockedMethod(expr) {
     if (dotRe.test(cleaned)) return name;
     if (bracketRe.test(cleaned)) return name;
   }
+  if (cleaned.includes("[")) {
+    const bracketContents = extractBracketContents(cleaned);
+    for (const content of bracketContents) {
+      if (!content.includes("+")) continue;
+      const fragments = content.match(/['"`]([^'"`]*?)['"`]/g);
+      if (!fragments) continue;
+      const joined = fragments.map((f) => f.slice(1, -1)).join("");
+      if (UNSAFE_METHOD_NAMES.has(joined)) return joined;
+    }
+  }
   return null;
 }
+function extractBracketContents(expr) {
+  const results = [];
+  let depth = 0;
+  let start = -1;
+  for (let i = 0; i < expr.length; i++) {
+    if (expr[i] === "[") {
+      if (depth === 0) start = i + 1;
+      depth++;
+    } else if (expr[i] === "]") {
+      depth--;
+      if (depth === 0 && start >= 0) {
+        results.push(expr.slice(start, i));
+        start = -1;
+      }
+    }
+  }
+  return results;
+}
 var TEXT_BINDING_SYM = /* @__PURE__ */ Symbol.for("forma-text-binding-cache");
 function toTextValue(value2) {
   if (value2 == null) return "";
@@ -1241,7 +1277,7 @@ function compileTemplate(text) {
     dynamics,
     hasItemRef: dynamics.length > 0
   };
-  compiledTemplateCache.set(text, result);
+  cacheCompiledTemplate(text, result);
   return result;
 }
 var templateTexts = /* @__PURE__ */ new WeakMap();
@@ -1778,14 +1814,6 @@ function parseExpressionUncached(expr, scope) {
       return () => left() ?? right();
     }
   }
-  const andMatch = expr.match(RE_AND);
-  if (andMatch) {
-    const left = parseExpression(andMatch[1].trim(), scope);
-    const right = parseExpression(andMatch[2].trim(), scope);
-    if (left && right) {
-      return () => left() && right();
-    }
-  }
   const orMatch = expr.match(RE_OR);
   if (orMatch) {
     const left = parseExpression(orMatch[1].trim(), scope);
@@ -1794,6 +1822,14 @@ function parseExpressionUncached(expr, scope) {
       return () => left() || right();
     }
   }
+  const andMatch = expr.match(RE_AND);
+  if (andMatch) {
+    const left = parseExpression(andMatch[1].trim(), scope);
+    const right = parseExpression(andMatch[2].trim(), scope);
+    if (left && right) {
+      return () => left() && right();
+    }
+  }
   const compMatch = expr.match(RE_COMPARISON);
   if (compMatch) {
     const left = parseExpression(compMatch[1].trim(), scope);
@@ -1823,6 +1859,19 @@ function parseExpressionUncached(expr, scope) {
       };
     }
   }
+  const addMatch = expr.match(RE_ADD);
+  if (addMatch) {
+    const left = parseExpression(addMatch[1].trim(), scope);
+    const right = parseExpression(addMatch[3].trim(), scope);
+    if (left && right) {
+      const op = addMatch[2];
+      return () => {
+        const l = left(), r = right();
+        if (op === "+") return l + r;
+        return l - r;
+      };
+    }
+  }
   const mulMatch = expr.match(RE_MUL);
   if (mulMatch) {
     const left = parseExpression(mulMatch[1].trim(), scope);
@@ -1842,19 +1891,6 @@ function parseExpressionUncached(expr, scope) {
       };
     }
   }
-  const addMatch = expr.match(RE_ADD);
-  if (addMatch) {
-    const left = parseExpression(addMatch[1].trim(), scope);
-    const right = parseExpression(addMatch[3].trim(), scope);
-    if (left && right) {
-      const op = addMatch[2];
-      return () => {
-        const l = left(), r = right();
-        if (op === "+") return l + r;
-        return l - r;
-      };
-    }
-  }
   const tmplMatch = expr.match(RE_TEMPLATE_LIT);
   if (tmplMatch) {
     const raw = tmplMatch[1];
@@ -1929,6 +1965,7 @@ function buildEvaluator(expr, scope) {
         return key in scope.getters;
       },
       get(_, key) {
+        if (UNSAFE_METHOD_NAMES.has(key)) return void 0;
         const g = scope.getters[key];
         return g ? g() : void 0;
       }
@@ -2084,6 +2121,7 @@ function buildHandler(expr, scope) {
         return key in scope.getters || key in scope.setters;
       },
       get(_, key) {
+        if (UNSAFE_METHOD_NAMES.has(key)) return void 0;
         const g = scope.getters[key];
         return g ? g() : void 0;
       },
@@ -2119,11 +2157,10 @@ function parseState(raw) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    try {
-      parsed = JSON.parse(raw.replace(RE_UNQUOTED_KEYS, '"$1":'));
-    } catch {
-      return {};
+    if (_debug) {
+      dbg("parseState: Invalid JSON in data-forma-state \u2014 use valid JSON with quoted keys. Got:", raw.slice(0, 200));
     }
+    return {};
   }
   for (const key of FORBIDDEN_STATE_KEYS) {
     if (key in parsed) delete parsed[key];
@@ -2143,14 +2180,104 @@ function initScope(stateEl) {
   const getters = {};
   const setters = {};
   for (const [key, initial] of Object.entries(state)) {
-    const [get, set] = createValueSignal(initial);
+    const [get, set] = createSignal(initial);
     getters[key] = get;
     setters[key] = set;
   }
   getters["$refetch"] = () => $refetch;
   return { getters, setters };
 }
+var SAFE_EL_PROPS = /* @__PURE__ */ new Set([
+  // Identity & attributes
+  "id",
+  "className",
+  "tagName",
+  "nodeName",
+  "getAttribute",
+  "setAttribute",
+  "removeAttribute",
+  "hasAttribute",
+  "toggleAttribute",
+  "dataset",
+  "classList",
+  // Content
+  "textContent",
+  "innerText",
+  // Form elements
+  "value",
+  "checked",
+  "disabled",
+  "selected",
+  "type",
+  "name",
+  "placeholder",
+  "readOnly",
+  "required",
+  "min",
+  "max",
+  "step",
+  "pattern",
+  // Dimensions & position
+  "getBoundingClientRect",
+  "offsetWidth",
+  "offsetHeight",
+  "offsetTop",
+  "offsetLeft",
+  "clientWidth",
+  "clientHeight",
+  "scrollWidth",
+  "scrollHeight",
+  "scrollTop",
+  "scrollLeft",
+  // Style
+  "style",
+  "hidden",
+  // Focus & interaction
+  "focus",
+  "blur",
+  "click",
+  "scrollIntoView",
+  "scrollTo",
+  // Traversal (safe — returns elements, not window/document)
+  "closest",
+  "matches",
+  "querySelector",
+  "querySelectorAll",
+  "children",
+  "childElementCount",
+  "firstElementChild",
+  "lastElementChild",
+  "nextElementSibling",
+  "previousElementSibling"
+]);
+function createSafeElProxy(el) {
+  return new Proxy(el, {
+    get(target, prop) {
+      if (typeof prop === "symbol") return Reflect.get(target, prop);
+      if (!SAFE_EL_PROPS.has(prop)) return void 0;
+      const val = Reflect.get(target, prop);
+      return typeof val === "function" ? val.bind(target) : val;
+    },
+    set(target, prop, value2) {
+      if (typeof prop === "symbol") return false;
+      if (!SAFE_EL_PROPS.has(prop)) return false;
+      return Reflect.set(target, prop, value2);
+    }
+  });
+}
 function bindElement(el, scope, disposers) {
+  const elMagics = {
+    $el: createSafeElProxy(el),
+    $dispatch: (name, detail) => {
+      el.dispatchEvent(new CustomEvent(name, {
+        bubbles: true,
+        composed: true,
+        // crosses Shadow DOM boundaries (important for <forma-stage>)
+        detail
+      }));
+    }
+  };
+  scope = createChildScope(scope, elMagics);
   const known = getDirectives(el);
   const computedAttr = !known || known.has("data-computed") ? el.getAttribute("data-computed") : null;
   if (computedAttr) {
@@ -2530,16 +2657,16 @@ function bindElement(el, scope, disposers) {
         else if (k === "error") errorTarget = v;
         else if (k === "poll") interval = parseInt(v ?? "0", 10);
       }
-      const [getTarget, setTarget] = createValueSignal(null);
+      const [getTarget, setTarget] = createSignal(null);
       scope.getters[target] = getTarget;
       scope.setters[target] = setTarget;
       if (loadingTarget) {
-        const [gl, sl] = createValueSignal(false);
+        const [gl, sl] = createSignal(false);
         scope.getters[loadingTarget] = gl;
         scope.setters[loadingTarget] = sl;
       }
       if (errorTarget) {
-        const [ge, se] = createValueSignal(null);
+        const [ge, se] = createSignal(null);
         scope.getters[errorTarget] = ge;
         scope.setters[errorTarget] = se;
       }