@nanobpm/urban 0.75.0 → 0.75.1

package/dist/runtime/core/modules/surfaces.js

@@ -38,7 +38,7 @@ form .field input[type=checkbox],form .field input[type=radio]{width:auto}
 <h1>Task inbox</h1><ul id="tasks"><li>loading…</li></ul>
 <div id="form"></div>
 <script>
-const BASE=location.pathname.replace(/\/+$/,'');
+const BASE=location.pathname.replace(/[/]+$/,'');
 const tasksEl=document.getElementById('tasks');
 const formEl=document.getElementById('form');
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nanobpm/urban",
-	"version": "0.75.0",
+	"version": "0.75.1",
 	"description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/runtime/core/modules/surfaces.test.ts

@@ -163,6 +163,24 @@ test("inbox page renders the client-side form fetch + renderer", async () => {
   assert.ok(!/const\s+variables\s*=\s*\{\}/.test(rendered), "client must not collect untrusted keys into a plain {} object");
 });
 
+test("inbox client script parses — no template-literal backslash collapse", async () => {
+  const { page } = inboxRoutes(fakeEngine);
+  const rendered = String((await call(page)).body);
+  // Extract every inline <script> body and assert each parses. A backslash-bearing regex
+  // written inside the page's template literal (e.g. `/\/+$/`) collapses to `//…` at emit
+  // time, turning the rest of the statement into a line comment and breaking the parse
+  // (issue #433). `new Function(body)` throws on any such SyntaxError.
+  const scripts = rendered
+    .split("<script>")
+    .slice(1)
+    .map((chunk) => chunk.split("</scr" + "ipt>")[0]);
+  assert.ok(scripts.length > 0, "inbox page has at least one inline script");
+  for (const body of scripts) {
+    assert.ok(!body.includes("//+$/"), "trailing-slash-strip regex collapsed to a line comment");
+    assert.doesNotThrow(() => new Function(body), "inline client script must parse");
+  }
+});
+
 test("/api/tasks surfaces the resolved form linkage", async () => {
   let seenFilter: unknown;
   const engine: EngineClient = {

package/src/runtime/core/modules/surfaces.ts

@@ -50,7 +50,7 @@ form .field input[type=checkbox],form .field input[type=radio]{width:auto}
 <h1>Task inbox</h1><ul id="tasks"><li>loading…</li></ul>
 <div id="form"></div>
 <script>
-const BASE=location.pathname.replace(/\/+$/,'');
+const BASE=location.pathname.replace(/[/]+$/,'');
 const tasksEl=document.getElementById('tasks');
 const formEl=document.getElementById('form');