@getforma/core 1.0.9 → 1.1.0

package/dist/formajs-runtime.global.js

@@ -348,6 +348,33 @@ var FormaRuntime = (() => {
     }
     return effectOper.bind(e);
   }
+  function trigger(fn) {
+    const sub = {
+      deps: void 0,
+      depsTail: void 0,
+      flags: 2
+    };
+    const prevSub = setActiveSub(sub);
+    try {
+      fn();
+    } finally {
+      activeSub = prevSub;
+      let link2 = sub.deps;
+      while (link2 !== void 0) {
+        const dep = link2.dep;
+        link2 = unlink(link2, sub);
+        const subs = dep.subs;
+        if (subs !== void 0) {
+          sub.flags = 0;
+          propagate(subs);
+          shallowPropagate(subs);
+        }
+      }
+      if (!batchDepth) {
+        flush();
+      }
+    }
+  }
   function updateComputed(c) {
     ++cycle;
     c.depsTail = void 0;
@@ -478,16 +505,41 @@ var FormaRuntime = (() => {
     }
   }
 
+  // src/reactive/dev.ts
+  function isDev() {
+    if (typeof process !== "undefined") {
+      return process.env?.NODE_ENV !== "production";
+    }
+    return typeof __FORMA_DEV__ !== "undefined" ? !!__FORMA_DEV__ : false;
+  }
+  var __DEV__ = isDev();
+  var _errorHandlers = /* @__PURE__ */ new Set();
+  function reportError(error, source) {
+    for (const handler of _errorHandlers) {
+      try {
+        handler(error, source ? { source } : {});
+      } catch {
+      }
+    }
+    if (isDev()) {
+      console.error(`[forma] ${source ?? "Unknown"} error:`, error);
+    }
+  }
+
   // src/reactive/signal.ts
+  var signalNames = /* @__PURE__ */ new WeakMap();
   function applySignalSet(s, v, equals) {
     if (typeof v !== "function") {
-      if (equals) {
-        const prevSub2 = setActiveSub(void 0);
-        const prev2 = s();
-        setActiveSub(prevSub2);
-        if (equals(prev2, v)) return;
+      if (!equals) {
+        s(v);
+        return;
       }
+      const prevSub2 = setActiveSub(void 0);
+      const prev2 = s();
+      setActiveSub(prevSub2);
+      if (equals(prev2, v)) return;
       s(v);
+      if (Object.is(prev2, v)) forceNotify(s);
       return;
     }
     const prevSub = setActiveSub(void 0);
@@ -496,24 +548,33 @@ var FormaRuntime = (() => {
     const next = v(prev);
     if (equals && equals(prev, next)) return;
     s(next);
+    if (equals && Object.is(prev, next)) forceNotify(s);
+  }
+  function forceNotify(s) {
+    trigger(() => {
+      s();
+    });
   }
   function createSignal(initialValue, options) {
     const s = signal(initialValue);
     const getter = s;
+    if (__DEV__ && options?.name) {
+      signalNames.set(getter, options.name);
+    }
     const eq = options?.equals;
     const setter = (v) => applySignalSet(s, v, eq);
     return [getter, setter];
   }
 
   // src/reactive/root.ts
-  var currentRoot = null;
+  var currentOwner = null;
   function registerDisposer(dispose) {
-    if (currentRoot) {
-      currentRoot.disposers.push(dispose);
+    if (currentOwner) {
+      currentOwner.disposers.push(dispose);
     }
   }
   function hasActiveRoot() {
-    return currentRoot !== null;
+    return currentOwner !== null;
   }
 
   // src/reactive/effect.ts
@@ -529,8 +590,35 @@ var FormaRuntime = (() => {
   }
 
   // src/reactive/computed.ts
+  var ERR = /* @__PURE__ */ Symbol("formaComputedError");
+  function isErrBox(v) {
+    return typeof v === "object" && v !== null && ERR in v;
+  }
   function createComputed(fn) {
-    return computed(fn);
+    let errored = false;
+    let error;
+    let lastGood;
+    const raw = computed(() => {
+      try {
+        const v = fn(lastGood);
+        errored = false;
+        error = void 0;
+        lastGood = v;
+        return v;
+      } catch (e) {
+        errored = true;
+        error = e;
+        reportError(e, "computed");
+        return { [ERR]: e };
+      }
+    });
+    const reader = () => {
+      const v = raw();
+      if (errored || isErrBox(v)) throw error;
+      return v;
+    };
+    Object.defineProperty(reader, "name", { value: raw.name, configurable: true });
+    return reader;
   }
 
   // src/reactive/batch.ts
@@ -1116,7 +1204,35 @@ var FormaRuntime = (() => {
     };
   }
 
+  // src/security/url-safety.ts
+  var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+  var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+  var URL_ATTRS = /* @__PURE__ */ new Set([
+    "href",
+    "src",
+    "action",
+    "formaction",
+    "xlink:href",
+    "poster",
+    "background"
+  ]);
+  function isUrlAttr(name) {
+    return URL_ATTRS.has(name.toLowerCase());
+  }
+  function isDangerousUrl(value2) {
+    const normalized = value2.replace(URL_IGNORED_CHARS_RE, "");
+    return DANGEROUS_SCHEME_RE.test(normalized);
+  }
+  function isEventHandlerAttr(name) {
+    return /^on/i.test(name);
+  }
+
   // src/runtime.ts
+  function isUnsafeAttrBinding(name, value2) {
+    if (isEventHandlerAttr(name)) return true;
+    if (isUrlAttr(name) && isDangerousUrl(value2)) return true;
+    return false;
+  }
   var _refetchRegistry = /* @__PURE__ */ new Map();
   function $refetch(id) {
     const fn = _refetchRegistry.get(id);
@@ -2120,7 +2236,12 @@ var FormaRuntime = (() => {
         if (attr.value.includes("{item")) {
           const compiled = compileTemplate(attr.value);
           entries.push({ attr: attr.name, compiled });
-          node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+          const value2 = evaluateCompiledTemplate(compiled, item);
+          if (isUnsafeAttrBinding(attr.name, value2)) {
+            node.removeAttribute(attr.name);
+          } else {
+            node.setAttribute(attr.name, value2);
+          }
         }
       }
       if (entries.length > 0) {
@@ -2962,7 +3083,12 @@ var FormaRuntime = (() => {
           if (val == null || val === false) {
             el.removeAttribute(attrName);
           } else {
-            el.setAttribute(attrName, String(val));
+            const str = String(val);
+            if (isUnsafeAttrBinding(attrName, str)) {
+              el.removeAttribute(attrName);
+            } else {
+              el.setAttribute(attrName, str);
+            }
           }
         });
         disposers.push(dispose);