@getforma/core 0.9.0 → 1.0.0

package/dist/resource-Cd0cGOxS.d.ts

@@ -0,0 +1,62 @@
+import { S as SignalGetter } from './signal-YlS1kgfh.js';
+
+/**
+ * Forma Reactive - Resource
+ *
+ * Async data fetching primitive with reactive loading/error state.
+ * Tracks a source signal and refetches when it changes.
+ *
+ * SolidJS equivalent: createResource
+ * React equivalent: use() + Suspense (React 19), or useSWR/react-query
+ */
+
+interface Resource<T> {
+    /** The resolved data (or undefined while loading). */
+    (): T | undefined;
+    /** True while the fetcher is running. */
+    loading: SignalGetter<boolean>;
+    /** The error if the fetcher rejected (or undefined). */
+    error: SignalGetter<unknown>;
+    /** Manually refetch with the current source value. */
+    refetch: () => void;
+    /** Manually set the data (overrides fetcher result). */
+    mutate: (value: T | undefined) => void;
+}
+interface ResourceOptions<T> {
+    /** Initial value before first fetch resolves. */
+    initialValue?: T;
+}
+/**
+ * Create an async resource that fetches data reactively.
+ *
+ * When `source` changes, the fetcher re-runs automatically.
+ * Provides reactive `loading` and `error` signals.
+ *
+ * ```ts
+ * const [userId, setUserId] = createSignal(1);
+ *
+ * const user = createResource(
+ *   userId,                                    // source signal
+ *   (id) => fetch(`/api/users/${id}`).then(r => r.json()), // fetcher
+ * );
+ *
+ * internalEffect(() => {
+ *   if (user.loading()) console.log('Loading...');
+ *   else if (user.error()) console.log('Error:', user.error());
+ *   else console.log('User:', user());
+ * });
+ *
+ * setUserId(2); // automatically refetches
+ * ```
+ *
+ * Without a source signal (static fetch):
+ * ```ts
+ * const posts = createResource(
+ *   () => true,  // constant source — fetches once
+ *   () => fetch('/api/posts').then(r => r.json()),
+ * );
+ * ```
+ */
+declare function createResource<T, S = true>(source: SignalGetter<S>, fetcher: (source: S) => Promise<T>, options?: ResourceOptions<T>): Resource<T>;
+
+export { type Resource as R, type ResourceOptions as a, createResource as c };

package/dist/resource-DK98lW5e.d.cts

@@ -0,0 +1,62 @@
+import { S as SignalGetter } from './signal-YlS1kgfh.cjs';
+
+/**
+ * Forma Reactive - Resource
+ *
+ * Async data fetching primitive with reactive loading/error state.
+ * Tracks a source signal and refetches when it changes.
+ *
+ * SolidJS equivalent: createResource
+ * React equivalent: use() + Suspense (React 19), or useSWR/react-query
+ */
+
+interface Resource<T> {
+    /** The resolved data (or undefined while loading). */
+    (): T | undefined;
+    /** True while the fetcher is running. */
+    loading: SignalGetter<boolean>;
+    /** The error if the fetcher rejected (or undefined). */
+    error: SignalGetter<unknown>;
+    /** Manually refetch with the current source value. */
+    refetch: () => void;
+    /** Manually set the data (overrides fetcher result). */
+    mutate: (value: T | undefined) => void;
+}
+interface ResourceOptions<T> {
+    /** Initial value before first fetch resolves. */
+    initialValue?: T;
+}
+/**
+ * Create an async resource that fetches data reactively.
+ *
+ * When `source` changes, the fetcher re-runs automatically.
+ * Provides reactive `loading` and `error` signals.
+ *
+ * ```ts
+ * const [userId, setUserId] = createSignal(1);
+ *
+ * const user = createResource(
+ *   userId,                                    // source signal
+ *   (id) => fetch(`/api/users/${id}`).then(r => r.json()), // fetcher
+ * );
+ *
+ * internalEffect(() => {
+ *   if (user.loading()) console.log('Loading...');
+ *   else if (user.error()) console.log('Error:', user.error());
+ *   else console.log('User:', user());
+ * });
+ *
+ * setUserId(2); // automatically refetches
+ * ```
+ *
+ * Without a source signal (static fetch):
+ * ```ts
+ * const posts = createResource(
+ *   () => true,  // constant source — fetches once
+ *   () => fetch('/api/posts').then(r => r.json()),
+ * );
+ * ```
+ */
+declare function createResource<T, S = true>(source: SignalGetter<S>, fetcher: (source: S) => Promise<T>, options?: ResourceOptions<T>): Resource<T>;
+
+export { type Resource as R, type ResourceOptions as a, createResource as c };

package/dist/runtime-hardened.cjs

@@ -890,7 +890,7 @@ var UNSAFE_METHOD_NAMES = /* @__PURE__ */ new Set([
   "eval",
   "Function"
 ]);
-var BLOCKED_METHOD_REGEXES = (() => {
+(() => {
   const result = [];
   for (const name of UNSAFE_METHOD_NAMES) {
     const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -904,44 +904,6 @@ var BLOCKED_METHOD_REGEXES = (() => {
   }
   return result;
 })();
-function findBlockedMethod(expr) {
-  let cleaned = expr.replace(/\/\*[\s\S]*?\*\//g, "");
-  cleaned = cleaned.replace(/\/\/[^\n]*/g, "");
-  cleaned = cleaned.replace(/\s*\.\s*/g, ".");
-  for (const { name, dotRe, bracketRe } of BLOCKED_METHOD_REGEXES) {
-    if (dotRe.test(cleaned)) return name;
-    if (bracketRe.test(cleaned)) return name;
-  }
-  if (cleaned.includes("[")) {
-    const bracketContents = extractBracketContents(cleaned);
-    for (const content of bracketContents) {
-      if (!content.includes("+")) continue;
-      const fragments = content.match(/['"`]([^'"`]*?)['"`]/g);
-      if (!fragments) continue;
-      const joined = fragments.map((f) => f.slice(1, -1)).join("");
-      if (UNSAFE_METHOD_NAMES.has(joined)) return joined;
-    }
-  }
-  return null;
-}
-function extractBracketContents(expr) {
-  const results = [];
-  let depth = 0;
-  let start = -1;
-  for (let i = 0; i < expr.length; i++) {
-    if (expr[i] === "[") {
-      if (depth === 0) start = i + 1;
-      depth++;
-    } else if (expr[i] === "]") {
-      depth--;
-      if (depth === 0 && start >= 0) {
-        results.push(expr.slice(start, i));
-        start = -1;
-      }
-    }
-  }
-  return results;
-}
 var TEXT_BINDING_SYM = /* @__PURE__ */ Symbol.for("forma-text-binding-cache");
 function toTextValue(value2) {
   if (value2 == null) return "";
@@ -1945,40 +1907,13 @@ function buildEvaluator(expr, scope) {
     cache.set(cleaned, cspFn);
     return cspFn;
   }
-  if (!_allowUnsafeEval) {
+  {
     dbg("buildEvaluator: blocked unsafe eval fallback for expression:", cleaned);
     reportDiagnostic("expression-unsupported", cleaned, cspExpressionHint(cleaned));
     const blocked = () => void 0;
     cache.set(cleaned, blocked);
     return blocked;
   }
-  const blockedMethod = findBlockedMethod(cleaned);
-  if (blockedMethod) {
-    const msg = `Blocked unsafe method "${blockedMethod}" in expression`;
-    reportDiagnostic("expression-unsupported", cleaned, msg);
-    throw new Error(`[FormaJS] ${msg}: ${cleaned}`);
-  }
-  try {
-    const fn = new Function("__scope", `with(__scope) { return (${cleaned}); }`);
-    const proxy = new Proxy(/* @__PURE__ */ Object.create(null), {
-      has(_, key) {
-        return key in scope.getters;
-      },
-      get(_, key) {
-        if (UNSAFE_METHOD_NAMES.has(key)) return void 0;
-        const g = scope.getters[key];
-        return g ? g() : void 0;
-      }
-    });
-    const unsafe = () => fn(proxy);
-    cache.set(cleaned, unsafe);
-    return unsafe;
-  } catch {
-    reportDiagnostic("expression-unsupported", cleaned, "Expression too complex for CSP-safe mode. Enable unsafe-eval via FormaRuntime.unsafeEval = true, or use the standard (non-hardened) build.");
-    const failed = () => void 0;
-    cache.set(cleaned, failed);
-    return failed;
-  }
 }
 function parseHandler(expr, scope) {
   const normalized = expr.trim().replace(/;+$/g, "").trim();
@@ -2096,7 +2031,7 @@ function buildHandler(expr, scope) {
     cache.set(cleaned, result);
     return result;
   }
-  if (!_allowUnsafeEval) {
+  {
     dbg("buildHandler: blocked unsafe eval fallback for expression:", cleaned);
     reportDiagnostic("handler-unsupported", cleaned, cspExpressionHint(cleaned));
     const result = {
@@ -2107,49 +2042,6 @@ function buildHandler(expr, scope) {
     cache.set(cleaned, result);
     return result;
   }
-  const blockedMethod = findBlockedMethod(cleaned);
-  if (blockedMethod) {
-    const msg = `Blocked unsafe method "${blockedMethod}" in handler`;
-    reportDiagnostic("handler-unsupported", cleaned, msg);
-    throw new Error(`[FormaJS] ${msg}: ${cleaned}`);
-  }
-  try {
-    const fn = new Function("__scope", "$event", "event", `with(__scope) { ${cleaned} }`);
-    const proxy = new Proxy(/* @__PURE__ */ Object.create(null), {
-      has(_, key) {
-        if (key === "$event" || key === "event") return false;
-        return key in scope.getters || key in scope.setters;
-      },
-      get(_, key) {
-        if (UNSAFE_METHOD_NAMES.has(key)) return void 0;
-        const g = scope.getters[key];
-        return g ? g() : void 0;
-      },
-      set(_, key, value2) {
-        const s = scope.setters[key];
-        if (s) s(value2);
-        return true;
-      }
-    });
-    const unsafeHandler = (e) => {
-      batch(() => fn(proxy, e, e));
-    };
-    const result = {
-      handler: unsafeHandler,
-      supported: true
-    };
-    cache.set(cleaned, result);
-    return result;
-  } catch {
-    reportDiagnostic("handler-unsupported", cleaned, "Expression too complex for CSP-safe mode. Enable unsafe-eval via FormaRuntime.unsafeEval = true, or use the standard (non-hardened) build.");
-    const result = {
-      handler: () => {
-      },
-      supported: false
-    };
-    cache.set(cleaned, result);
-    return result;
-  }
 }
 var FORBIDDEN_STATE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function parseState(raw) {