@stacksjs/stx 0.2.160 → 0.2.162

package/dist/expressions.d.ts

@@ -106,6 +106,24 @@ export declare function usesSignalsInScript(template: string): boolean;
  * attributes and surrounding HTML are left alone.
  */
 export declare function interpolateScriptExpressions(scriptBody: string, context: Record<string, any>): string;
+/**
+ * Interpolate expressions in a `<script>` tag's ATTRIBUTES.
+ *
+ * Attributes are HTML, not JavaScript, so they get HTML rules rather than the
+ * JSON-stringifying rules {@link interpolateScriptExpressions} applies to a
+ * body: `data-id="{{ id }}"` must become `data-id="7"`, never `data-id=""7""`.
+ *
+ * This is the only channel a module island has for server data. A module
+ * script is emitted verbatim — no IIFE, no server-data bridge — so
+ * `<script type="module" data-session="{{ id }}">` was the documented way to
+ * pass a value in, and it shipped the literal text `{{ id }}` to the browser.
+ * The failure is silent: the markup looks right, and only the code reading
+ * `dataset.session` sees a mustache.
+ *
+ * Unresolvable expressions are left untouched, matching the "preserve for the
+ * client" semantics used everywhere else.
+ */
+export declare function interpolateScriptAttributes(attrs: string, context: Record<string, any>): string;
 /**
  * Options for {@link interpolateScriptsInTemplate}.
  */
@@ -123,8 +141,9 @@ export interface InterpolateScriptsOptions {
  * skipping any script that opts out via `data-raw`, `type="application/json"`,
  * or a `src=` attribute (external scripts don't have inline content to template).
  *
- * Each matched script has its body passed through {@link interpolateScriptExpressions}.
- * Attributes and tag structure are never modified.
+ * Each matched script has its body passed through {@link interpolateScriptExpressions}
+ * and its attributes through {@link interpolateScriptAttributes}. Tag structure
+ * is otherwise untouched.
  */
 export declare function interpolateScriptsInTemplate(template: string, context: Record<string, any>, options?: InterpolateScriptsOptions): string;
 /**

package/dist/expressions.js

@@ -325,22 +325,51 @@ export function interpolateScriptExpressions(scriptBody, context) {
   });
   return output;
 }
+export function interpolateScriptAttributes(attrs, context) {
+  if (!attrs.includes("{"))
+    return attrs;
+  let output = attrs;
+  output = output.replace(/\{!!([\s\S]*?)!!\}/g, (match, expr) => {
+    try {
+      const value = evaluateExpression(expr, context);
+      if (value === void 0)
+        return match;
+      return value === null ? "" : String(value);
+    } catch {
+      return match;
+    }
+  });
+  output = output.replace(/\{\{([\s\S]*?)\}\}/g, (match, expr) => {
+    const trimmed = expr.trim();
+    if (/^__[A-Z_]+__$/.test(trimmed))
+      return match;
+    try {
+      const value = evaluateExpression(expr, context);
+      if (value === void 0)
+        return match;
+      if (value === null)
+        return "";
+      return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+    } catch {
+      return match;
+    }
+  });
+  return output;
+}
 export function interpolateScriptsInTemplate(template, context, options = {}) {
   const { output, scripts } = stashScriptElements(template), interpolatedScripts = scripts.map((full) => {
     const match = full.match(/^<script\b([^>]*)>([\s\S]*?)<\/script\s*>$/i), opening = full.match(/^<script\b[^>]*>/i), closingStart = full.search(/<\/script\s*>$/i);
     if (!match || !opening || closingStart === -1)
       return full;
     const attrs = match[1], body = match[2];
-    if (/\bsrc\s*=/.test(attrs))
-      return full;
     if (/\bdata-raw\b/.test(attrs))
       return full;
-    if (/\btype\s*=\s*["']application\/json["']/.test(attrs))
-      return full;
     if (options.skipServer && /\bserver\b/.test(attrs))
       return full;
-    const interpolated = interpolateScriptExpressions(body, context);
-    return opening[0] + interpolated + full.slice(closingStart);
+    const openTag = `<script${interpolateScriptAttributes(attrs, context)}>`;
+    if (/\bsrc\s*=/.test(attrs) || /\btype\s*=\s*["']application\/json["']/.test(attrs))
+      return openTag + body + full.slice(closingStart);
+    return openTag + interpolateScriptExpressions(body, context) + full.slice(closingStart);
   });
   return restoreStashedScripts(output, interpolatedScripts);
 }