@getforma/core 0.9.0 → 1.0.0

package/dist/runtime-hardened.js

@@ -1,4 +1,4 @@
-import { signal, computed, effect, startBatch, endBatch, setActiveSub } from 'alien-signals';
+import { signal, computed, effect, setActiveSub, startBatch, endBatch } from 'alien-signals';
 
 // src/reactive/signal.ts
 function applySignalSet(s, v, equals) {
@@ -888,7 +888,7 @@ var UNSAFE_METHOD_NAMES = /* @__PURE__ */ new Set([
   "eval",
   "Function"
 ]);
-var BLOCKED_METHOD_REGEXES = (() => {
+(() => {
   const result = [];
   for (const name of UNSAFE_METHOD_NAMES) {
     const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -902,44 +902,6 @@ var BLOCKED_METHOD_REGEXES = (() => {
   }
   return result;
 })();
-function findBlockedMethod(expr) {
-  let cleaned = expr.replace(/\/\*[\s\S]*?\*\//g, "");
-  cleaned = cleaned.replace(/\/\/[^\n]*/g, "");
-  cleaned = cleaned.replace(/\s*\.\s*/g, ".");
-  for (const { name, dotRe, bracketRe } of BLOCKED_METHOD_REGEXES) {
-    if (dotRe.test(cleaned)) return name;
-    if (bracketRe.test(cleaned)) return name;
-  }
-  if (cleaned.includes("[")) {
-    const bracketContents = extractBracketContents(cleaned);
-    for (const content of bracketContents) {
-      if (!content.includes("+")) continue;
-      const fragments = content.match(/['"`]([^'"`]*?)['"`]/g);
-      if (!fragments) continue;
-      const joined = fragments.map((f) => f.slice(1, -1)).join("");
-      if (UNSAFE_METHOD_NAMES.has(joined)) return joined;
-    }
-  }
-  return null;
-}
-function extractBracketContents(expr) {
-  const results = [];
-  let depth = 0;
-  let start = -1;
-  for (let i = 0; i < expr.length; i++) {
-    if (expr[i] === "[") {
-      if (depth === 0) start = i + 1;
-      depth++;
-    } else if (expr[i] === "]") {
-      depth--;
-      if (depth === 0 && start >= 0) {
-        results.push(expr.slice(start, i));
-        start = -1;
-      }
-    }
-  }
-  return results;
-}
 var TEXT_BINDING_SYM = /* @__PURE__ */ Symbol.for("forma-text-binding-cache");
 function toTextValue(value2) {
   if (value2 == null) return "";
@@ -1943,40 +1905,13 @@ function buildEvaluator(expr, scope) {
     cache.set(cleaned, cspFn);
     return cspFn;
   }
-  if (!_allowUnsafeEval) {
+  {
     dbg("buildEvaluator: blocked unsafe eval fallback for expression:", cleaned);
     reportDiagnostic("expression-unsupported", cleaned, cspExpressionHint(cleaned));
     const blocked = () => void 0;
     cache.set(cleaned, blocked);
     return blocked;
   }
-  const blockedMethod = findBlockedMethod(cleaned);
-  if (blockedMethod) {
-    const msg = `Blocked unsafe method "${blockedMethod}" in expression`;
-    reportDiagnostic("expression-unsupported", cleaned, msg);
-    throw new Error(`[FormaJS] ${msg}: ${cleaned}`);
-  }
-  try {
-    const fn = new Function("__scope", `with(__scope) { return (${cleaned}); }`);
-    const proxy = new Proxy(/* @__PURE__ */ Object.create(null), {
-      has(_, key) {
-        return key in scope.getters;
-      },
-      get(_, key) {
-        if (UNSAFE_METHOD_NAMES.has(key)) return void 0;
-        const g = scope.getters[key];
-        return g ? g() : void 0;
-      }
-    });
-    const unsafe = () => fn(proxy);
-    cache.set(cleaned, unsafe);
-    return unsafe;
-  } catch {
-    reportDiagnostic("expression-unsupported", cleaned, "Expression too complex for CSP-safe mode. Enable unsafe-eval via FormaRuntime.unsafeEval = true, or use the standard (non-hardened) build.");
-    const failed = () => void 0;
-    cache.set(cleaned, failed);
-    return failed;
-  }
 }
 function parseHandler(expr, scope) {
   const normalized = expr.trim().replace(/;+$/g, "").trim();
@@ -2094,7 +2029,7 @@ function buildHandler(expr, scope) {
     cache.set(cleaned, result);
     return result;
   }
-  if (!_allowUnsafeEval) {
+  {
     dbg("buildHandler: blocked unsafe eval fallback for expression:", cleaned);
     reportDiagnostic("handler-unsupported", cleaned, cspExpressionHint(cleaned));
     const result = {
@@ -2105,49 +2040,6 @@ function buildHandler(expr, scope) {
     cache.set(cleaned, result);
     return result;
   }
-  const blockedMethod = findBlockedMethod(cleaned);
-  if (blockedMethod) {
-    const msg = `Blocked unsafe method "${blockedMethod}" in handler`;
-    reportDiagnostic("handler-unsupported", cleaned, msg);
-    throw new Error(`[FormaJS] ${msg}: ${cleaned}`);
-  }
-  try {
-    const fn = new Function("__scope", "$event", "event", `with(__scope) { ${cleaned} }`);
-    const proxy = new Proxy(/* @__PURE__ */ Object.create(null), {
-      has(_, key) {
-        if (key === "$event" || key === "event") return false;
-        return key in scope.getters || key in scope.setters;
-      },
-      get(_, key) {
-        if (UNSAFE_METHOD_NAMES.has(key)) return void 0;
-        const g = scope.getters[key];
-        return g ? g() : void 0;
-      },
-      set(_, key, value2) {
-        const s = scope.setters[key];
-        if (s) s(value2);
-        return true;
-      }
-    });
-    const unsafeHandler = (e) => {
-      batch(() => fn(proxy, e, e));
-    };
-    const result = {
-      handler: unsafeHandler,
-      supported: true
-    };
-    cache.set(cleaned, result);
-    return result;
-  } catch {
-    reportDiagnostic("handler-unsupported", cleaned, "Expression too complex for CSP-safe mode. Enable unsafe-eval via FormaRuntime.unsafeEval = true, or use the standard (non-hardened) build.");
-    const result = {
-      handler: () => {
-      },
-      supported: false
-    };
-    cache.set(cleaned, result);
-    return result;
-  }
 }
 var FORBIDDEN_STATE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function parseState(raw) {