@getforma/core 1.0.9 → 1.1.0

package/dist/runtime.cjs

@@ -1,8 +1,9 @@
 'use strict';
 
-var chunkT33QUD2Y_cjs = require('./chunk-T33QUD2Y.cjs');
-var chunk6FW5E54W_cjs = require('./chunk-6FW5E54W.cjs');
-var chunkQLPCVK7C_cjs = require('./chunk-QLPCVK7C.cjs');
+var chunkJRQNDXX7_cjs = require('./chunk-JRQNDXX7.cjs');
+var chunk263HW3KN_cjs = require('./chunk-263HW3KN.cjs');
+var chunk2Y5US35K_cjs = require('./chunk-2Y5US35K.cjs');
+var chunkW7OUWVRA_cjs = require('./chunk-W7OUWVRA.cjs');
 
 // src/dom/reconcile.ts
 function getBindTargets(el) {
@@ -335,6 +336,11 @@ function createReconciler(config) {
 }
 
 // src/runtime.ts
+function isUnsafeAttrBinding(name, value) {
+  if (chunk263HW3KN_cjs.isEventHandlerAttr(name)) return true;
+  if (chunk263HW3KN_cjs.isUrlAttr(name) && chunk263HW3KN_cjs.isDangerousUrl(value)) return true;
+  return false;
+}
 var _refetchRegistry = /* @__PURE__ */ new Map();
 function $refetch(id) {
   const fn = _refetchRegistry.get(id);
@@ -968,7 +974,7 @@ function parseIfHandler(expr, scope) {
   }
   if (rest.length > 0) return null;
   return (e) => {
-    chunk6FW5E54W_cjs.batch(() => {
+    chunk2Y5US35K_cjs.batch(() => {
       if (condExpr()) thenHandler(e);
       else elseHandler?.(e);
     });
@@ -1337,7 +1343,12 @@ function cloneAttributeTemplates(el, item) {
       if (attr.value.includes("{item")) {
         const compiled = compileTemplate(attr.value);
         entries.push({ attr: attr.name, compiled });
-        node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+        const value = evaluateCompiledTemplate(compiled, item);
+        if (isUnsafeAttrBinding(attr.name, value)) {
+          node.removeAttribute(attr.name);
+        } else {
+          node.setAttribute(attr.name, value);
+        }
       }
     }
     if (entries.length > 0) {
@@ -1717,7 +1728,7 @@ function parseHandler(expr, scope) {
     const handlers = stmts.map((s) => parseHandler(s, scope));
     if (handlers.every((h) => h !== null)) {
       return (e) => {
-        chunk6FW5E54W_cjs.batch(() => {
+        chunk2Y5US35K_cjs.batch(() => {
           for (const h of handlers) h(e);
         });
       };
@@ -1730,7 +1741,7 @@ function parseHandler(expr, scope) {
     const name = incrMatch[1];
     const op = incrMatch[2];
     return () => {
-      chunk6FW5E54W_cjs.batch(() => {
+      chunk2Y5US35K_cjs.batch(() => {
         const val = scope.getters[name]?.() ?? 0;
         scope.setters[name]?.(op === "++" ? val + 1 : val - 1);
       });
@@ -1741,7 +1752,7 @@ function parseHandler(expr, scope) {
     const op = preIncrMatch[1];
     const name = preIncrMatch[2];
     return () => {
-      chunk6FW5E54W_cjs.batch(() => {
+      chunk2Y5US35K_cjs.batch(() => {
         const val = scope.getters[name]?.() ?? 0;
         scope.setters[name]?.(op === "++" ? val + 1 : val - 1);
       });
@@ -1751,7 +1762,7 @@ function parseHandler(expr, scope) {
   if (toggleMatch && toggleMatch[1] === toggleMatch[2]) {
     const name = toggleMatch[1];
     return () => {
-      chunk6FW5E54W_cjs.batch(() => {
+      chunk2Y5US35K_cjs.batch(() => {
         scope.setters[name]?.(!scope.getters[name]?.());
       });
     };
@@ -1763,7 +1774,7 @@ function parseHandler(expr, scope) {
     if (valExpr) {
       if (_debug) dbg(`parseHandler: assignment "${name} = ..." \u2014 setter exists:`, !!scope.setters[name], ", getter exists:", !!scope.getters[name]);
       return () => {
-        chunk6FW5E54W_cjs.batch(() => {
+        chunk2Y5US35K_cjs.batch(() => {
           const val = valExpr();
           if (_debug) dbg(`SETTER: ${name} = ${val} (was: ${scope.getters[name]?.()})`);
           scope.setters[name]?.(val);
@@ -1778,7 +1789,7 @@ function parseHandler(expr, scope) {
     const valExpr = parseExpression(compoundMatch[3].trim(), scope);
     if (valExpr) {
       return () => {
-        chunk6FW5E54W_cjs.batch(() => {
+        chunk2Y5US35K_cjs.batch(() => {
           const current = scope.getters[name]?.() ?? 0;
           const val = valExpr();
           switch (op) {
@@ -1859,7 +1870,7 @@ function buildHandler(expr, scope) {
       }
     });
     const unsafeHandler = (e) => {
-      chunk6FW5E54W_cjs.batch(() => fn(proxy, e, e));
+      chunk2Y5US35K_cjs.batch(() => fn(proxy, e, e));
     };
     const result = {
       handler: unsafeHandler,
@@ -1907,7 +1918,7 @@ function initScope(stateEl) {
   const getters = {};
   const setters = {};
   for (const [key, initial] of Object.entries(state)) {
-    const [get, set] = chunkQLPCVK7C_cjs.createSignal(initial);
+    const [get, set] = chunkW7OUWVRA_cjs.createSignal(initial);
     getters[key] = get;
     setters[key] = set;
   }
@@ -2019,7 +2030,7 @@ function bindElement(el, scope, disposers) {
         const prevGetter = scope.getters[name];
         delete scope.getters[name];
         const evaluate = buildEvaluator(`{${expr}}`, scope);
-        const getter = chunkQLPCVK7C_cjs.createComputed(evaluate);
+        const getter = chunkW7OUWVRA_cjs.createComputed(evaluate);
         scope.getters[name] = getter;
         if (!prevGetter) {
           delete scope.setters[name];
@@ -2030,7 +2041,7 @@ function bindElement(el, scope, disposers) {
   const textExpr = !known || known.has("data-text") ? el.getAttribute("data-text") : null;
   if (textExpr) {
     const evaluate = buildEvaluator(textExpr, scope);
-    const dispose = chunk6FW5E54W_cjs.internalEffect(() => {
+    const dispose = chunk2Y5US35K_cjs.internalEffect(() => {
       setElementTextFast(el, toTextValue(evaluate()));
     });
     disposers.push(dispose);
@@ -2045,7 +2056,7 @@ function bindElement(el, scope, disposers) {
       dbg(`bindElement: data-show="${showExpr}" on <${tag}${cls}>`);
     }
     let initialized = false;
-    const dispose = chunk6FW5E54W_cjs.internalEffect(() => {
+    const dispose = chunk2Y5US35K_cjs.internalEffect(() => {
       const visible = !!evaluate();
       if (_debug) dbg(`data-show effect: "${showExpr}" \u2192 ${visible}`);
       applyShowVisibility(el, visible, transition, !initialized);
@@ -2064,7 +2075,7 @@ function bindElement(el, scope, disposers) {
     const parent = el.parentNode;
     let inserted = true;
     let initialized = false;
-    const dispose = chunk6FW5E54W_cjs.internalEffect(() => {
+    const dispose = chunk2Y5US35K_cjs.internalEffect(() => {
       const show = !!evaluate();
       if (show && !inserted) {
         clearTransitionState(el);
@@ -2103,7 +2114,7 @@ function bindElement(el, scope, disposers) {
     const setter = scope.setters[prop];
     if (getter && setter) {
       const input = el;
-      const dispose = chunk6FW5E54W_cjs.internalEffect(() => {
+      const dispose = chunk2Y5US35K_cjs.internalEffect(() => {
         const val = getter();
         if (input.type === "checkbox") {
           input.checked = !!val;
@@ -2167,19 +2178,24 @@ function bindElement(el, scope, disposers) {
     } else if (name.startsWith("data-class:")) {
       const cls = name.slice(11);
       const evaluate = buildEvaluator(attr.value, scope);
-      const dispose = chunk6FW5E54W_cjs.internalEffect(() => {
+      const dispose = chunk2Y5US35K_cjs.internalEffect(() => {
         el.classList.toggle(cls, !!evaluate());
       });
       disposers.push(dispose);
     } else if (name.startsWith("data-bind:")) {
       const attrName = name.slice(10);
       const evaluate = buildEvaluator(attr.value, scope);
-      const dispose = chunk6FW5E54W_cjs.internalEffect(() => {
+      const dispose = chunk2Y5US35K_cjs.internalEffect(() => {
         const val = evaluate();
         if (val == null || val === false) {
           el.removeAttribute(attrName);
         } else {
-          el.setAttribute(attrName, String(val));
+          const str = String(val);
+          if (isUnsafeAttrBinding(attrName, str)) {
+            el.removeAttribute(attrName);
+          } else {
+            el.setAttribute(attrName, str);
+          }
         }
       });
       disposers.push(dispose);
@@ -2197,7 +2213,7 @@ function bindElement(el, scope, disposers) {
         if (saved !== null) setter(JSON.parse(saved));
       } catch {
       }
-      const dispose = chunk6FW5E54W_cjs.internalEffect(() => {
+      const dispose = chunk2Y5US35K_cjs.internalEffect(() => {
         try {
           localStorage.setItem(key, JSON.stringify(getter()));
         } catch {
@@ -2284,7 +2300,7 @@ function bindElement(el, scope, disposers) {
           });
         }
       } : void 0;
-      const dispose = chunk6FW5E54W_cjs.internalEffect(() => {
+      const dispose = chunk2Y5US35K_cjs.internalEffect(() => {
         const rawItems = evaluate();
         if (!Array.isArray(rawItems)) {
           for (const n of oldNodes) {
@@ -2305,7 +2321,7 @@ function bindElement(el, scope, disposers) {
         }
         const prevNodes = new Set(oldNodes);
         if (keyProp) {
-          const result = chunkT33QUD2Y_cjs.reconcileList(
+          const result = chunkJRQNDXX7_cjs.reconcileList(
             el,
             oldItems,
             rawItems,
@@ -2335,7 +2351,7 @@ function bindElement(el, scope, disposers) {
         } else {
           const wrapped = rawItems.map((item, i) => ({ __idx: i, __item: item }));
           const oldWrapped = oldItems;
-          const result = chunkT33QUD2Y_cjs.reconcileList(
+          const result = chunkJRQNDXX7_cjs.reconcileList(
             el,
             oldWrapped,
             wrapped,
@@ -2384,16 +2400,16 @@ function bindElement(el, scope, disposers) {
         else if (k === "error") errorTarget = v;
         else if (k === "poll") interval = parseInt(v ?? "0", 10);
       }
-      const [getTarget, setTarget] = chunkQLPCVK7C_cjs.createSignal(null);
+      const [getTarget, setTarget] = chunkW7OUWVRA_cjs.createSignal(null);
       scope.getters[target] = getTarget;
       scope.setters[target] = setTarget;
       if (loadingTarget) {
-        const [gl, sl] = chunkQLPCVK7C_cjs.createSignal(false);
+        const [gl, sl] = chunkW7OUWVRA_cjs.createSignal(false);
         scope.getters[loadingTarget] = gl;
         scope.setters[loadingTarget] = sl;
       }
       if (errorTarget) {
-        const [ge, se] = chunkQLPCVK7C_cjs.createSignal(null);
+        const [ge, se] = chunkW7OUWVRA_cjs.createSignal(null);
         scope.getters[errorTarget] = ge;
         scope.setters[errorTarget] = se;
       }
@@ -2722,7 +2738,7 @@ function getScopes() {
 function setScopeValue(element, key, value) {
   const scope = element.__formaScope;
   if (!scope?.setters[key]) return;
-  chunk6FW5E54W_cjs.batch(() => {
+  chunk2Y5US35K_cjs.batch(() => {
     scope.setters[key](value);
   });
 }
@@ -2731,7 +2747,7 @@ function resetScope(element) {
   const initialJSON = element.__formaInitialState;
   if (!scope || !initialJSON) return;
   const initial = parseState(initialJSON);
-  chunk6FW5E54W_cjs.batch(() => {
+  chunk2Y5US35K_cjs.batch(() => {
     for (const [key, val] of Object.entries(initial)) {
       scope.setters[key]?.(val);
     }
@@ -2761,7 +2777,7 @@ function getReconciler() {
           }
         }
       },
-      batch: chunk6FW5E54W_cjs.batch
+      batch: chunk2Y5US35K_cjs.batch
     });
   }
   return _reconciler;