@stacksjs/stx 0.2.336 → 0.2.338

package/dist/expressions.js

@@ -4,6 +4,7 @@ import { stripCommentsAndLiterals } from "./strip-literals.js";
 import { createSafeFunction, getExpressionSafetyRule, safeEvaluate } from "./safe-evaluator.js";
 import { createDetailedErrorMessage } from "./utils.js";
 import { createPlaceholder } from "./placeholder.js";
+import { neutralizeTemplateSyntax } from "./template-syntax-escape.js";
 import { maskAtElementPosition, matchScriptElement, matchStyleElement, restoreStashedScripts, stashScriptElements } from "./html-masking.js";
 import { importsSignalDeclarations } from "./imported-signals.js";
 const customFilters = {}, translateRegexCache = new Map;
@@ -236,15 +237,63 @@ export function clearCustomFilters() {
   for (const key of Object.keys(customFilters))
     delete customFilters[key];
 }
+export function findMustacheEnd(input, openIndex, braces = 2) {
+  let depth = 0, quote = null;
+  for (let i = openIndex + braces;i < input.length; i++) {
+    const character = input[i];
+    if (quote) {
+      if (character === "\\") {
+        i++;
+        continue;
+      }
+      if (character === quote)
+        quote = null;
+      continue;
+    }
+    if (character === '"' || character === "'" || character === "`") {
+      quote = character;
+      continue;
+    }
+    if (character === "{") {
+      depth++;
+      continue;
+    }
+    if (character === "}") {
+      if (depth > 0) {
+        depth--;
+        continue;
+      }
+      let run = 0;
+      while (input[i + run] === "}")
+        run++;
+      if (run >= braces)
+        return i;
+    }
+  }
+  return -1;
+}
+export function replaceInterpolations(input, replacer, braces = 2) {
+  const opener = "{".repeat(braces);
+  if (!input.includes(opener))
+    return input;
+  let output = "", cursor = 0;
+  for (;; ) {
+    const open = input.indexOf(opener, cursor);
+    if (open === -1)
+      break;
+    const close = findMustacheEnd(input, open, braces);
+    if (close === -1)
+      break;
+    output += input.slice(cursor, open) + replacer(input.slice(open, close + braces), input.slice(open + braces, close), open);
+    cursor = close + braces;
+  }
+  return cursor === 0 ? input : output + input.slice(cursor);
+}
 export function escapeHtml(unsafe) {
   return unsafe.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 export function escapeHtmlValue(unsafe) {
-  return escapeHtml(unsafe).replace(/\{{2,}/g, (match) => joinBraces(match.length)).replace(/\{(?=!)/g, `&#123;${WORD_JOINER}`);
-}
-const WORD_JOINER = "&#8288;";
-function joinBraces(length) {
-  return Array.from({ length }, () => "&#123;").join(WORD_JOINER);
+  return neutralizeTemplateSyntax(escapeHtml(unsafe));
 }
 export function usesSignalsInScript(template, filePath) {
   const { scripts } = stashScriptElements(template);
@@ -333,7 +382,7 @@ export function interpolateScriptExpressions(scriptBody, context) {
       return match;
     }
   });
-  output = output.replace(/\{\{([\s\S]*?)\}\}/g, (match, expr) => {
+  output = replaceInterpolations(output, (match, expr) => {
     const trimmed = expr.trim();
     if (/^__[A-Z_]+__$/.test(trimmed))
       return match;
@@ -362,7 +411,7 @@ export function interpolateScriptAttributes(attrs, context) {
       return match;
     }
   });
-  output = output.replace(/\{\{([\s\S]*?)\}\}/g, (match, expr) => {
+  output = replaceInterpolations(output, (match, expr) => {
     const trimmed = expr.trim();
     if (/^__[A-Z_]+__$/.test(trimmed))
       return match;
@@ -372,7 +421,7 @@ export function interpolateScriptAttributes(attrs, context) {
         return match;
       if (value === null)
         return "";
-      return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+      return escapeHtmlValue(String(value));
     } catch {
       return match;
     }
@@ -412,7 +461,7 @@ export function processExpressions(template, context, filePath) {
   const scriptBlocks = [];
   output = maskInto(output, matchScriptElement, scriptBlocks, (n) => `<!--__STX_SCRIPT_EXPR_${n}__-->`);
   const hasSignals = context?.__stx_signals_gate === !0 || usesSignalsInScript(template), clientSignalNames = new Set(Array.isArray(context?.__stx_client_signal_names) ? context.__stx_client_signal_names : []), preservedClientExpressions = new Set(Array.isArray(context?.__stx_preserved_client_expressions) ? context.__stx_preserved_client_expressions : []);
-  output = output.replace(/\{\{\{([\s\S]*?)\}\}\}/g, (match, expr, offset) => {
+  output = replaceInterpolations(output, (match, expr, offset) => {
     try {
       const value = evaluateExpression(expr, context, !1, (r) => warnRejectedExpression(r, match, filePath, template));
       return value !== void 0 && value !== null ? String(value) : "";
@@ -420,7 +469,7 @@ export function processExpressions(template, context, filePath) {
       const msg = error instanceof Error ? error.message : String(error);
       return createDetailedErrorMessage("Expression", `Error evaluating: {{{ ${expr.trim()}}}}: ${msg}`, filePath, template, offset, match);
     }
-  });
+  }, 3);
   output = output.replace(/\{!!([\s\S]*?)!!\}/g, (match, expr, offset) => {
     try {
       const value = evaluateExpression(expr, context, !1, (r) => warnRejectedExpression(r, match, filePath, template));
@@ -436,7 +485,7 @@ export function processExpressions(template, context, filePath) {
   });
   output = maskInto(output, matchScriptElement, scriptBlocks, (n) => `<!--__STX_SCRIPT_EXPR_${n}__-->`);
   output = maskInto(output, styleMatcher, styleBlocks, (n) => `<!--__STX_STYLE_${n}__-->`);
-  output = output.replace(/\{\{([\s\S]*?)\}\}/g, (match, expr, offset) => {
+  output = replaceInterpolations(output, (match, expr, offset) => {
     const trimmedExpr = expr.trim();
     if (preservedClientExpressions.has(trimmedExpr))
       return match;

package/dist/includes.js

@@ -707,6 +707,10 @@ export async function processIncludes(template, context, filePath, options, depe
       let processedContent = processLoops(workingContent, includeContext, includeFilePath, void 0, !0);
       processedContent = processConditionals(processedContent, includeContext, includeFilePath);
       processedContent = reportDeferredLoopWarnings(processedContent);
+      const { processMetaDirectives, processSeoDirective, processStructuredData } = await import("./seo.js");
+      processedContent = processMetaDirectives(processedContent, includeContext, includeFilePath, options);
+      processedContent = processStructuredData(processedContent, includeContext, includeFilePath);
+      processedContent = processSeoDirective(processedContent, includeContext, includeFilePath, options);
       processedContent = processExpressions(processedContent, includeContext, includeFilePath);
       if (preservedStyle)
         processedContent += `

package/dist/loops.js

@@ -493,6 +493,16 @@ export function processLoops(template, context, filePath, options, deferWarnings
               });
             else
               itemContext[itemName] = item;
+          } else if (itemName.startsWith("{") && itemName.endsWith("}")) {
+            const fields = itemName.slice(1, -1).split(",").map((field) => field.trim()).filter(Boolean);
+            if (item !== null && typeof item === "object")
+              fields.forEach((field) => {
+                const separator = field.indexOf(":"), property = (separator === -1 ? field : field.slice(0, separator)).trim(), alias = separator === -1 ? property : field.slice(separator + 1).trim();
+                if (property && alias)
+                  itemContext[alias] = item[property];
+              });
+            else
+              itemContext[itemName] = item;
           } else
             itemContext[itemName] = item;
           if (indexName)

package/dist/pwa.js

@@ -1,6 +1,6 @@
 // @bun
-import{Pk as wq,Qk as dq,Rk as Cq,Sk as mq,Tk as gq}from"./chunk-kw98dfza.js";import{$k as vq,Uk as S,Vk as Tq,Wk as _q,Xk as z,Yk as D,Zk as P,_k as kq,al as w,bl as Iq,cl as d,dl as Hq,el as Oq,fl as Mq}from"./chunk-zsnrcbw1.js";import{jw as Aq,kw as bq,lw as Sq,mw as zq,nw as Dq,ow as Pq}from"./chunk-q569zmrr.js";import{sw as N}from"./chunk-hyfjnn7g.js";import p from"fs";import E from"path";import C from"fs";import L from"path";var k=[72,96,128,144,152,192,384,512],v=[120,152,167,180],I=[16,32];async function H(G,B){let q={success:!0,generatedFiles:[],errors:[],warnings:[]},K=G.pwa?.icons;if(!K?.src)return q.errors.push("No source icon specified in pwa.icons.src"),q.success=!1,q;let Y=L.isAbsolute(K.src)?K.src:L.resolve(process.cwd(),K.src);if(!await Bun.file(Y).exists())return q.errors.push(`Source icon not found: ${Y}`),q.success=!1,q;let Q=L.resolve(B,K.outputDir||"pwa-icons");try{C.mkdirSync(Q,{recursive:!0})}catch{return q.errors.push(`Failed to create output directory: ${Q}`),q.success=!1,q}let X=K.sizes||k,j=K.generateWebP??!0,J=K.generateAppleIcons??!0;try{let y;try{y=await import("sharp")}catch{return q.errors.push(`sharp is not installed. Install it with: bun add sharp
-Icon generation requires the sharp package for image processing.`),q.success=!1,q}let R=await y.default(Y).metadata();if(R.width&&R.width<512)q.warnings.push(`Source icon is ${R.width}x${R.height}. Recommend using at least 512x512 for best quality.`);for(let $ of X){let x=L.join(Q,`icon-${$}x${$}.png`);if(await y.default(Y).resize($,$,{fit:"contain",background:{r:0,g:0,b:0,alpha:0}}).png().toFile(x),q.generatedFiles.push(x),j){let F=L.join(Q,`icon-${$}x${$}.webp`);await y.default(Y).resize($,$,{fit:"contain",background:{r:0,g:0,b:0,alpha:0}}).webp({quality:90}).toFile(F),q.generatedFiles.push(F)}}if(J){for(let x of v){let F=L.join(Q,`apple-touch-icon-${x}x${x}.png`);await y.default(Y).resize(x,x,{fit:"contain",background:{r:255,g:255,b:255,alpha:1}}).png().toFile(F),q.generatedFiles.push(F)}let $=L.join(Q,"apple-touch-icon.png");await y.default(Y).resize(180,180,{fit:"contain",background:{r:255,g:255,b:255,alpha:1}}).png().toFile($),q.generatedFiles.push($)}for(let $ of I){let x=L.join(Q,`favicon-${$}x${$}.png`);await y.default(Y).resize($,$,{fit:"contain",background:{r:0,g:0,b:0,alpha:0}}).png().toFile(x),q.generatedFiles.push(x)}let U=512,T=L.join(Q,`icon-maskable-${U}x${U}.png`),Z=Math.floor(U*0.1),_=U-Z*2;await y.default(Y).resize(_,_,{fit:"contain",background:{r:0,g:0,b:0,alpha:0}}).extend({top:Z,bottom:Z,left:Z,right:Z,background:{r:255,g:255,b:255,alpha:1}}).png().toFile(T),q.generatedFiles.push(T)}catch(y){let V=y instanceof Error?y.message:String(y);q.errors.push(`Icon generation failed: ${V}`),q.success=!1}return q}function n(G){let B=G.sizes||k,q=G.outputDir?`/${G.outputDir}`:"/pwa-icons",K=G.generateWebP??!0,Y=G.generateAppleIcons??!0,Q=[];for(let X of B)if(Q.push(`${q}/icon-${X}x${X}.png`),K)Q.push(`${q}/icon-${X}x${X}.webp`);if(Y){Q.push(`${q}/apple-touch-icon.png`);for(let X of v)Q.push(`${q}/apple-touch-icon-${X}x${X}.png`)}for(let X of I)Q.push(`${q}/favicon-${X}x${X}.png`);return Q.push(`${q}/icon-maskable-512x512.png`),Q}async function O(){try{return await import("sharp"),!0}catch{return!1}}function m(G,B,q,K){let Y=[],Q=K.join(" ");for(let X of G)if(Y.push({src:`${B}/icon-${X}x${X}.png`,sizes:`${X}x${X}`,type:"image/png",purpose:Q}),q)Y.push({src:`${B}/icon-${X}x${X}.webp`,sizes:`${X}x${X}`,type:"image/webp",purpose:Q});return Y}function g(G){return G.map((B)=>({name:B.name,short_name:B.shortName,description:B.description,url:B.url,icons:B.icons?.map((q)=>({src:q.src,sizes:q.sizes,type:q.type}))}))}function h(G){let B=G.pwa?.shareTarget;if(!B?.enabled)return;let q={action:B.action||"/share",method:B.method||"POST",enctype:B.enctype||"multipart/form-data",params:{title:B.params?.title||"title",text:B.params?.text||"text",url:B.params?.url||"url"}};if(B.acceptFiles&&B.acceptFiles.length>0)q.params.files=B.acceptFiles.map((K)=>({name:K.name,accept:K.accept}));return q}function c(G){let B=G.pwa?.fileHandlers;if(!B?.enabled||!B.accept)return;let q=[{action:B.action||"/",accept:B.accept,launch_type:B.launchType||"single-client"}];if(B.icons)q[0].icons=B.icons.map((K)=>({src:K.src,sizes:K.sizes,type:K.type}));return q}function l(G){let B=G.pwa?.protocolHandlers;if(!B||B.length===0)return;return B.map((q)=>({protocol:q.protocol,url:q.url}))}function u(G){let B=G.pwa;if(!B?.enabled||!B.manifest)return null;let{manifest:q,icons:K}=B,Y=K?.sizes||[72,96,128,144,152,192,384,512],Q=K?.outputDir?`/${K.outputDir}`:"/pwa-icons",X=K?.generateWebP??!0,j=K?.purpose||["any","maskable"],J={name:q.name,short_name:q.shortName||q.name,description:q.description,start_url:q.startUrl||"/",display:q.display||"standalone",display_override:q.displayOverride,orientation:q.orientation,theme_color:q.themeColor,background_color:q.backgroundColor,scope:q.scope||"/",lang:q.lang,dir:q.dir,id:q.id,categories:q.categories,icons:m(Y,Q,X,j)};if(q.shortcuts&&q.shortcuts.length>0)J.shortcuts=g(q.shortcuts);if(q.screenshots&&q.screenshots.length>0)J.screenshots=q.screenshots.map((U)=>({src:U.src,sizes:U.sizes,type:U.type,label:U.label,form_factor:U.platform}));let y=h(G);if(y)J.share_target=y;let V=c(G);if(V)J.file_handlers=V;let R=l(G);if(R)J.protocol_handlers=R;if(q.launchHandler)J.launch_handler={client_mode:q.launchHandler};if(q.handleLinks)J.handle_links=q.handleLinks;if(q.edgeSidePanel?.enabled)J.edge_side_panel={preferred_width:q.edgeSidePanel.preferredWidth};return J}function M(G){let B=u(G);if(!B)return"";let q=JSON.parse(JSON.stringify(B));return JSON.stringify(q,null,2)}function i(G,B){return{...B,...G,shortcuts:G.shortcuts||B.shortcuts,screenshots:G.screenshots||B.screenshots,categories:G.categories||B.categories}}function s(G){let B=[],q=G.pwa;if(!q?.enabled)return B;let K=q.manifest;if(!K)return B.push("PWA manifest configuration is missing"),B;if(!K.name)B.push("Manifest name is required");let Y=["fullscreen","standalone","minimal-ui","browser"];if(K.display&&!Y.includes(K.display))B.push(`Invalid display mode: ${K.display}. Must be one of: ${Y.join(", ")}`);let Q=["any","natural","landscape","landscape-primary","landscape-secondary","portrait","portrait-primary","portrait-secondary"];if(K.orientation&&!Q.includes(K.orientation))B.push(`Invalid orientation: ${K.orientation}`);let X=/^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6})$/;if(K.themeColor&&!X.test(K.themeColor))B.push(`Invalid theme color: ${K.themeColor}. Must be a valid hex color.`);if(K.backgroundColor&&!X.test(K.backgroundColor))B.push(`Invalid background color: ${K.backgroundColor}. Must be a valid hex color.`);if(q.shareTarget?.enabled){if(!q.shareTarget.action)B.push("Share target action URL is required")}if(q.fileHandlers?.enabled){if(!q.fileHandlers.accept||Object.keys(q.fileHandlers.accept).length===0)B.push("File handlers must specify accepted MIME types")}if(q.protocolHandlers)for(let j of q.protocolHandlers){if(!j.protocol)B.push("Protocol handler missing protocol");if(!j.url||!j.url.includes("%s"))B.push(`Protocol handler URL must contain %s placeholder: ${j.protocol}`)}return B}import A from"path";async function b(G){let B=G.pwa?.offline;if(!B?.enabled)return"";if(B.page){let q=A.isAbsolute(B.page)?B.page:A.resolve(process.cwd(),B.page);if(await Bun.file(q).exists())try{let{processDirectives:K}=await import("./chunk-63yfp05p.js"),Y=await Bun.file(q).text();return await K(Y,{},q,G,new Set)}catch(K){console.warn(`[PWA] Failed to process custom offline page: ${K}`)}else console.warn(`[PWA] Custom offline page not found: ${q}`)}return f(G)}function f(G){let B=G.pwa?.offline,q=G.pwa?.manifest,K=B?.fallbackTitle||"You are offline",Y=B?.fallbackMessage||"Please check your internet connection and try again.",Q=q?.themeColor||"#4f46e5",X=q?.shortName||q?.name||"App";return`<!DOCTYPE html>
+import{Ek as wq,Fk as dq,Gk as Cq,Hk as mq,Ik as gq}from"./chunk-9btdax2s.js";import{Jk as S,Kk as Tq,Lk as _q,Mk as z,Nk as D,Ok as P,Pk as kq,Qk as vq,Rk as w,Sk as Iq,Tk as d,Uk as Hq,Vk as Oq,Wk as Mq}from"./chunk-3cjvqa0s.js";import{kw as Aq,lw as bq,mw as Sq,nw as zq,ow as Dq,pw as Pq}from"./chunk-wb90259a.js";import{tw as N}from"./chunk-5g6rprcy.js";import p from"fs";import E from"path";import C from"fs";import L from"path";var k=[72,96,128,144,152,192,384,512],v=[120,152,167,180],I=[16,32];async function H(G,B){let q={success:!0,generatedFiles:[],errors:[],warnings:[]},K=G.pwa?.icons;if(!K?.src)return q.errors.push("No source icon specified in pwa.icons.src"),q.success=!1,q;let Y=L.isAbsolute(K.src)?K.src:L.resolve(process.cwd(),K.src);if(!await Bun.file(Y).exists())return q.errors.push(`Source icon not found: ${Y}`),q.success=!1,q;let Q=L.resolve(B,K.outputDir||"pwa-icons");try{C.mkdirSync(Q,{recursive:!0})}catch{return q.errors.push(`Failed to create output directory: ${Q}`),q.success=!1,q}let X=K.sizes||k,j=K.generateWebP??!0,J=K.generateAppleIcons??!0;try{let y;try{y=await import("sharp")}catch{return q.errors.push(`sharp is not installed. Install it with: bun add sharp
+Icon generation requires the sharp package for image processing.`),q.success=!1,q}let R=await y.default(Y).metadata();if(R.width&&R.width<512)q.warnings.push(`Source icon is ${R.width}x${R.height}. Recommend using at least 512x512 for best quality.`);for(let $ of X){let x=L.join(Q,`icon-${$}x${$}.png`);if(await y.default(Y).resize($,$,{fit:"contain",background:{r:0,g:0,b:0,alpha:0}}).png().toFile(x),q.generatedFiles.push(x),j){let F=L.join(Q,`icon-${$}x${$}.webp`);await y.default(Y).resize($,$,{fit:"contain",background:{r:0,g:0,b:0,alpha:0}}).webp({quality:90}).toFile(F),q.generatedFiles.push(F)}}if(J){for(let x of v){let F=L.join(Q,`apple-touch-icon-${x}x${x}.png`);await y.default(Y).resize(x,x,{fit:"contain",background:{r:255,g:255,b:255,alpha:1}}).png().toFile(F),q.generatedFiles.push(F)}let $=L.join(Q,"apple-touch-icon.png");await y.default(Y).resize(180,180,{fit:"contain",background:{r:255,g:255,b:255,alpha:1}}).png().toFile($),q.generatedFiles.push($)}for(let $ of I){let x=L.join(Q,`favicon-${$}x${$}.png`);await y.default(Y).resize($,$,{fit:"contain",background:{r:0,g:0,b:0,alpha:0}}).png().toFile(x),q.generatedFiles.push(x)}let U=512,T=L.join(Q,`icon-maskable-${U}x${U}.png`),Z=Math.floor(U*0.1),_=U-Z*2;await y.default(Y).resize(_,_,{fit:"contain",background:{r:0,g:0,b:0,alpha:0}}).extend({top:Z,bottom:Z,left:Z,right:Z,background:{r:255,g:255,b:255,alpha:1}}).png().toFile(T),q.generatedFiles.push(T)}catch(y){let V=y instanceof Error?y.message:String(y);q.errors.push(`Icon generation failed: ${V}`),q.success=!1}return q}function n(G){let B=G.sizes||k,q=G.outputDir?`/${G.outputDir}`:"/pwa-icons",K=G.generateWebP??!0,Y=G.generateAppleIcons??!0,Q=[];for(let X of B)if(Q.push(`${q}/icon-${X}x${X}.png`),K)Q.push(`${q}/icon-${X}x${X}.webp`);if(Y){Q.push(`${q}/apple-touch-icon.png`);for(let X of v)Q.push(`${q}/apple-touch-icon-${X}x${X}.png`)}for(let X of I)Q.push(`${q}/favicon-${X}x${X}.png`);return Q.push(`${q}/icon-maskable-512x512.png`),Q}async function O(){try{return await import("sharp"),!0}catch{return!1}}function m(G,B,q,K){let Y=[],Q=K.join(" ");for(let X of G)if(Y.push({src:`${B}/icon-${X}x${X}.png`,sizes:`${X}x${X}`,type:"image/png",purpose:Q}),q)Y.push({src:`${B}/icon-${X}x${X}.webp`,sizes:`${X}x${X}`,type:"image/webp",purpose:Q});return Y}function g(G){return G.map((B)=>({name:B.name,short_name:B.shortName,description:B.description,url:B.url,icons:B.icons?.map((q)=>({src:q.src,sizes:q.sizes,type:q.type}))}))}function h(G){let B=G.pwa?.shareTarget;if(!B?.enabled)return;let q={action:B.action||"/share",method:B.method||"POST",enctype:B.enctype||"multipart/form-data",params:{title:B.params?.title||"title",text:B.params?.text||"text",url:B.params?.url||"url"}};if(B.acceptFiles&&B.acceptFiles.length>0)q.params.files=B.acceptFiles.map((K)=>({name:K.name,accept:K.accept}));return q}function c(G){let B=G.pwa?.fileHandlers;if(!B?.enabled||!B.accept)return;let q=[{action:B.action||"/",accept:B.accept,launch_type:B.launchType||"single-client"}];if(B.icons)q[0].icons=B.icons.map((K)=>({src:K.src,sizes:K.sizes,type:K.type}));return q}function l(G){let B=G.pwa?.protocolHandlers;if(!B||B.length===0)return;return B.map((q)=>({protocol:q.protocol,url:q.url}))}function u(G){let B=G.pwa;if(!B?.enabled||!B.manifest)return null;let{manifest:q,icons:K}=B,Y=K?.sizes||[72,96,128,144,152,192,384,512],Q=K?.outputDir?`/${K.outputDir}`:"/pwa-icons",X=K?.generateWebP??!0,j=K?.purpose||["any","maskable"],J={name:q.name,short_name:q.shortName||q.name,description:q.description,start_url:q.startUrl||"/",display:q.display||"standalone",display_override:q.displayOverride,orientation:q.orientation,theme_color:q.themeColor,background_color:q.backgroundColor,scope:q.scope||"/",lang:q.lang,dir:q.dir,id:q.id,categories:q.categories,icons:m(Y,Q,X,j)};if(q.shortcuts&&q.shortcuts.length>0)J.shortcuts=g(q.shortcuts);if(q.screenshots&&q.screenshots.length>0)J.screenshots=q.screenshots.map((U)=>({src:U.src,sizes:U.sizes,type:U.type,label:U.label,form_factor:U.platform}));let y=h(G);if(y)J.share_target=y;let V=c(G);if(V)J.file_handlers=V;let R=l(G);if(R)J.protocol_handlers=R;if(q.launchHandler)J.launch_handler={client_mode:q.launchHandler};if(q.handleLinks)J.handle_links=q.handleLinks;if(q.edgeSidePanel?.enabled)J.edge_side_panel={preferred_width:q.edgeSidePanel.preferredWidth};return J}function M(G){let B=u(G);if(!B)return"";let q=JSON.parse(JSON.stringify(B));return JSON.stringify(q,null,2)}function i(G,B){return{...B,...G,shortcuts:G.shortcuts||B.shortcuts,screenshots:G.screenshots||B.screenshots,categories:G.categories||B.categories}}function s(G){let B=[],q=G.pwa;if(!q?.enabled)return B;let K=q.manifest;if(!K)return B.push("PWA manifest configuration is missing"),B;if(!K.name)B.push("Manifest name is required");let Y=["fullscreen","standalone","minimal-ui","browser"];if(K.display&&!Y.includes(K.display))B.push(`Invalid display mode: ${K.display}. Must be one of: ${Y.join(", ")}`);let Q=["any","natural","landscape","landscape-primary","landscape-secondary","portrait","portrait-primary","portrait-secondary"];if(K.orientation&&!Q.includes(K.orientation))B.push(`Invalid orientation: ${K.orientation}`);let X=/^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6})$/;if(K.themeColor&&!X.test(K.themeColor))B.push(`Invalid theme color: ${K.themeColor}. Must be a valid hex color.`);if(K.backgroundColor&&!X.test(K.backgroundColor))B.push(`Invalid background color: ${K.backgroundColor}. Must be a valid hex color.`);if(q.shareTarget?.enabled){if(!q.shareTarget.action)B.push("Share target action URL is required")}if(q.fileHandlers?.enabled){if(!q.fileHandlers.accept||Object.keys(q.fileHandlers.accept).length===0)B.push("File handlers must specify accepted MIME types")}if(q.protocolHandlers)for(let j of q.protocolHandlers){if(!j.protocol)B.push("Protocol handler missing protocol");if(!j.url||!j.url.includes("%s"))B.push(`Protocol handler URL must contain %s placeholder: ${j.protocol}`)}return B}import A from"path";async function b(G){let B=G.pwa?.offline;if(!B?.enabled)return"";if(B.page){let q=A.isAbsolute(B.page)?B.page:A.resolve(process.cwd(),B.page);if(await Bun.file(q).exists())try{let{processDirectives:K}=await import("./chunk-x01sw9wy.js"),Y=await Bun.file(q).text();return await K(Y,{},q,G,new Set)}catch(K){console.warn(`[PWA] Failed to process custom offline page: ${K}`)}else console.warn(`[PWA] Custom offline page not found: ${q}`)}return f(G)}function f(G){let B=G.pwa?.offline,q=G.pwa?.manifest,K=B?.fallbackTitle||"You are offline",Y=B?.fallbackMessage||"Please check your internet connection and try again.",Q=q?.themeColor||"#4f46e5",X=q?.shortName||q?.name||"App";return`<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">

package/dist/server-components.js

@@ -1,3 +1,4 @@
+import { neutralizeTemplateSyntax } from "./template-syntax-escape.js";
 const componentRegistry = new Map, componentCache = new Map;
 export function registerServerComponent(component) {
   componentRegistry.set(component.name, {
@@ -285,7 +286,7 @@ function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
 }
 function escapeHtmlValue(str) {
-  return escapeHtml(str).replace(/\{{2,}/g, (match) => Array.from({ length: match.length }, () => "&#123;").join("&#8288;")).replace(/\{(?=!)/g, "&#123;&#8288;");
+  return neutralizeTemplateSyntax(escapeHtml(str));
 }
 export const serverComponentDirective = {
   name: "serverComponent",

package/dist/signals.js

@@ -4053,24 +4053,23 @@ catch (e) {
     // Helper to hide empty state
     const hideEmpty = () => {
       if (emptyElement) {
-        disposeSubtreeEffects(emptyElement);
+        // A string @empty renders a text node, which has no subtree to dispose.
+        if (emptyElement.nodeType === 1) disposeSubtreeEffects(emptyElement);
         emptyElement.remove();
         emptyElement = null;
       }
     };
 
-    // Map of key \u2192 item signal. When a keyed item is reused and its data
-    // changes, we update the signal \u2014 all bindings (:text, :if, :class)
-    // that track it automatically re-evaluate.
-    const itemSignalMap = new Map();
-
     // Helper: create DOM element(s) for a single list item.
-    // The item is wrapped in a signal so bindings track it reactively.
+    // The item is wrapped in a signal so bindings track it reactively. The pair
+    // rides on the returned group, so reuse always reaches the signals the
+    // bindings of THAT row actually read. A Map from key to signals could not:
+    // two rows sharing a key overwrote each other in it, and the row that
+    // reused the surviving entry was then bound to a signal nothing updated.
     const createItemElements = (item, index, key) => {
       const itemSignal = state(item);
       itemSignal._isStxLoopItem = true;
       const indexSignal = state(index);
-      if (key) itemSignalMap.set(key, { item: itemSignal, index: indexSignal });
 
       const itemScope = { ...globalHelpers, ...passedScope, ...(capturedScope || {}) };
       itemScope[itemName] = itemSignal;
@@ -4098,6 +4097,7 @@ catch (e) {
         });
       }
       remapForComponentScopes(elements);
+      elements.__stx_signals = { item: itemSignal, index: indexSignal };
       return elements;
     };
 
@@ -4210,10 +4210,16 @@ catch (e) {
         clearRenderedItems();
         if (emptyExpr) {
           const emptyContent = evalLazy(emptyExpr);
+          // Held in the same slot the @for-empty template uses, so hideEmpty
+          // takes it away when the list fills and a second empty render
+          // replaces it instead of stacking another one. It used to go into
+          // currentElements, which teardown does not walk -- it walks
+          // currentGroups -- so the text stayed in the document forever: an
+          // empty list that filled read "Nothing herea".
+          hideEmpty();
           if (emptyContent && typeof emptyContent === 'string') {
-            const textNode = document.createTextNode(emptyContent);
-            parent.insertBefore(textNode, placeholder);
-            currentElements.push(textNode);
+            emptyElement = document.createTextNode(emptyContent);
+            parent.insertBefore(emptyElement, placeholder);
           }
         } else if (emptyTemplate) {
           showEmpty();
@@ -4247,7 +4253,15 @@ catch (e) {
       // Build new element list, reusing existing DOM nodes by key
       const newElements = [];
       const newGroups = [];
-      const usedKeys = new Set();
+      // Keys seen in THIS pass, for the duplicate warning only. Reuse is decided
+      // by whether a group under the key is still unconsumed, not by whether the
+      // key has been seen: gating it on the key made every duplicate occurrence
+      // build a NEW group, while the removal pass below skipped the key as used
+      // and left the old ones in the document. The list grew by one row on every
+      // update, without bound, and the first duplicate stayed bound to a signal
+      // the reconciliation never wrote to.
+      const seenKeys = new Set();
+      let warnedDuplicateKey = false;
 
       // Minimal-move reconciliation.
       //
@@ -4274,7 +4288,13 @@ catch (e) {
         const key = newKeys[i];
         const existing = oldKeyMap.get(key);
 
-        if (existing && existing.length > 0 && !usedKeys.has(key)) {
+        if (seenKeys.has(key) && !warnedDuplicateKey) {
+          warnedDuplicateKey = true;
+          console.warn('[STX] :for has more than one item with the key ' + key + '. Rows are matched in order, so give each item a key of its own.');
+        }
+        seenKeys.add(key);
+
+        if (existing && existing.length > 0) {
           // Reuse this item's nodes \u2014 move the whole group into position, in
           // order, so a multi-node row stays contiguous and correctly ordered.
           // A structural directive may intentionally have detached one of the
@@ -4298,11 +4318,10 @@ catch (e) {
           }
           newElements.push(...group);
           newGroups.push(group);
-          usedKeys.add(key);
           // Update the item signal so bindings re-evaluate with new data.
           // This is the fix for #1669 \u2014 without this, reused elements show
           // stale data because the old bindings captured the old item via closure.
-          const signals = itemSignalMap.get(key);
+          const signals = group.__stx_signals;
           if (signals) {
             signals.item.set(list[i]);
             signals.index.set(i);
@@ -4341,8 +4360,12 @@ catch (e) {
       // Remove old elements whose keys are no longer in the list.
       // Dispose any scopes registered inside removed items before the
       // remove() call (#1727).
-      for (const [key, groups] of oldKeyMap) {
-        if (!usedKeys.has(key)) {
+      // Whatever is still in here was not consumed above -- either the key left
+      // the list, or the list now has fewer rows under that key than it did.
+      // The test used to be "this key was never used", which could not see the
+      // second case, so a duplicate key's leftover rows stayed on screen.
+      for (const groups of oldKeyMap.values()) {
+        if (groups.length > 0) {
           // In a transition group, run the leave animation and let it remove the
           // node; otherwise remove immediately. Scopes are disposed up-front
           // either way (their destroy hooks shouldn't wait on a CSS transition).
@@ -4367,7 +4390,8 @@ catch (e) {
               removeGroup(group);
             }
           });
-          itemSignalMap.delete(key);
+          // The row's signals went with its group, so there is no key-indexed
+          // map left to prune here.
         }
       }
 
@@ -4461,9 +4485,27 @@ catch (e) {
       // branch rendered blank the moment the markup was well-formed enough to
       // survive as a real <template> (the #1784 markup fix). See #1784.
       b.isTemplate = b.el.tagName === 'TEMPLATE';
-      b.nodes = b.isTemplate
-        ? Array.prototype.slice.call(b.el.content.cloneNode(true).childNodes)
-        : [b.el];
+      // A template branch renders CLONES, re-cloned on every show, and marks
+      // where they end -- the same contract the single-template :if got in
+      // #1955. Its content was cloned once here and that one node set was
+      // toggled in and out, which broke two ways as soon as the branch held a
+      // structural directive: a :for inside it replaces its own source element
+      // with a placeholder comment and renders rows as SIBLINGS, so hiding
+      // removed neither (the rows were never in this list, and the source node
+      // it did hold was already detached, so the parentNode guard skipped it)
+      // and both branches stayed on screen at once. Re-showing then re-inserted
+      // that source element, painting the literal text of its interpolations.
+      // An element branch still owns exactly the node it was bound to: whatever
+      // a directive inside it renders is inside that element.
+      // Snapshot the content BEFORE anything processes it, and clone each show
+      // from the snapshot rather than from the live template. A nested :for
+      // does not leave content pristine -- processing moves its row source out
+      // and the attributes it consumed (x-model, :id) do not come back -- so a
+      // second clone taken from the element would arrive already stripped, with
+      // no binding and no way to acquire one.
+      b.pristine = b.isTemplate ? b.el.content.cloneNode(true) : null;
+      b.nodes = b.isTemplate ? [] : [b.el];
+      b.endMarker = null;
       b.el.remove();
       b.childrenProcessed = false;
     });
@@ -4547,17 +4589,53 @@ catch (e2) {
       // components under reactive conditionals (#1737). Permanent disposal is
       // still handled by bindFor (item removal) and cleanupContainer (SPA nav).
       if (currentIdx !== -1) {
-        chain[currentIdx].el.__stx_chain_active = false;
-        chain[currentIdx].nodes.forEach(function (n) {
-          if (!n.parentNode) return;
-          // Detached nodes are out of reach of a DOM walk, so a row removed
-          // while this branch is hidden could not dispose the effects it was
-          // processed with (#1954). Same registry the single-element :if uses.
-          var host = n.parentNode;
-          if (!host.__stx_detached_if) host.__stx_detached_if = new Set();
-          host.__stx_detached_if.add(n);
-          host.removeChild(n);
-        });
+        var gone = chain[currentIdx];
+        gone.el.__stx_chain_active = false;
+
+        if (gone.isTemplate) {
+          // Everything this branch rendered goes, not just the clones it owns:
+          // a nested :for or :if renders siblings of its own that no clone list
+          // contains. The marker bounds the range, so a sibling that belongs to
+          // a later branch or to ordinary markup is never touched.
+          if (gone.endMarker && gone.endMarker.parentNode) {
+            var host = gone.endMarker.parentNode;
+            var doomed = gone.placeholder.nextSibling;
+            while (doomed && doomed !== gone.endMarker) {
+              var nextDoomed = doomed.nextSibling;
+              disposeSubtreeEffects(doomed);
+              host.removeChild(doomed);
+              doomed = nextDoomed;
+            }
+            gone.endMarker.remove();
+            gone.endMarker = null;
+          }
+          gone.nodes.forEach(function (n) {
+            if (!n.parentNode) return;
+            disposeSubtreeEffects(n);
+            n.parentNode.removeChild(n);
+          });
+          // The next show clones afresh and processes again, so these effects
+          // are finished with; leaving them bound only accumulates work (#1954).
+          if (typeof gone.el.__stx_chain_disposers === 'function') {
+            try { gone.el.__stx_chain_disposers(); }
+catch (e) { /* a disposer of its own is not this branch's problem */ }
+            gone.el.__stx_chain_disposers = null;
+          }
+          gone.nodes = [];
+          gone.childrenProcessed = false;
+        }
+        else {
+          gone.nodes.forEach(function (n) {
+            if (!n.parentNode) return;
+            // Detached nodes are out of reach of a DOM walk, so a row removed
+            // while this branch is hidden could not dispose the effects it was
+            // processed with (#1954). Same registry the single-element :if uses.
+            var host = n.parentNode;
+            if (!host.__stx_detached_if) host.__stx_detached_if = new Set();
+            host.__stx_detached_if.add(n);
+            host.removeChild(n);
+          });
+        }
       }
 
       // Insert + process the newly-picked branch.
@@ -4567,11 +4645,19 @@ catch (e2) {
         // Insert this branch's node(s) before the placeholder's next sibling.
         // The anchor is captured once so the nodes stack in source order.
         var anchor = pick.placeholder.nextSibling;
+        var pickHost = pick.placeholder.parentNode;
+        if (pick.isTemplate && pick.nodes.length === 0)
+          pick.nodes = Array.prototype.slice.call(pick.pristine.cloneNode(true).childNodes);
         pick.nodes.forEach(function (n) {
-          var host = pick.placeholder.parentNode;
-          if (host.__stx_detached_if) host.__stx_detached_if.delete(n);
-          host.insertBefore(n, anchor);
+          if (pickHost.__stx_detached_if) pickHost.__stx_detached_if.delete(n);
+          pickHost.insertBefore(n, anchor);
         });
+        // Bound AFTER the clones, so hiding can remove whatever a structural
+        // directive inside the branch renders as their sibling.
+        if (pick.isTemplate) {
+          if (!pick.endMarker) pick.endMarker = document.createComment('stx-if-chain-end');
+          pickHost.insertBefore(pick.endMarker, anchor);
+        }
         pick.el.__stx_shown_at = performance.now();
         if (!pick.childrenProcessed) {
           pick.childrenProcessed = true;

package/dist/slots.js

@@ -65,6 +65,88 @@ function findTagEnd(content, startIndex) {
   }
   return -1;
 }
+function findMatchingElementClose(content, tagName, startIndex) {
+  const wanted = tagName.toLowerCase();
+  let depth = 1, cursor = startIndex;
+  while (cursor < content.length) {
+    const tagStart = content.indexOf("<", cursor);
+    if (tagStart === -1)
+      return -1;
+    if (content.startsWith("<!--", tagStart)) {
+      const commentEnd = content.indexOf("-->", tagStart + 4);
+      cursor = commentEnd === -1 ? content.length : commentEnd + 3;
+      continue;
+    }
+    const tagEnd = findTagEnd(content, tagStart + 1);
+    if (tagEnd === -1)
+      return -1;
+    const tag = content.slice(tagStart, tagEnd), tagMatch = tag.match(/^<\s*(\/?)\s*([a-zA-Z][\w-]*)/);
+    if (tagMatch && tagMatch[2].toLowerCase() === wanted) {
+      if (tagMatch[1] === "/") {
+        depth--;
+        if (depth === 0)
+          return tagEnd;
+      } else if (!/\/\s*>$/.test(tag))
+        depth++;
+    }
+    cursor = tagEnd;
+  }
+  return -1;
+}
+function findDirectSlotAttrElements(content) {
+  const found = [], stack = [], slotAttrPattern = /\bslot\s*=\s*(?:"([^"]+)"|'([^']+)')/i;
+  let cursor = 0;
+  while (cursor < content.length) {
+    const tagStart = content.indexOf("<", cursor);
+    if (tagStart === -1)
+      break;
+    if (content.startsWith("<!--", tagStart)) {
+      const commentEnd = content.indexOf("-->", tagStart + 4);
+      cursor = commentEnd === -1 ? content.length : commentEnd + 3;
+      continue;
+    }
+    const tagEnd = findTagEnd(content, tagStart + 1);
+    if (tagEnd === -1)
+      break;
+    const tag = content.slice(tagStart, tagEnd), tagMatch = tag.match(/^<\s*(\/?)\s*([a-zA-Z][\w-]*)/);
+    if (!tagMatch) {
+      cursor = tagEnd;
+      continue;
+    }
+    const tagName = tagMatch[2].toLowerCase();
+    if (tagMatch[1] === "/") {
+      const matchingIndex = stack.lastIndexOf(tagName);
+      if (matchingIndex !== -1)
+        stack.splice(matchingIndex);
+      cursor = tagEnd;
+      continue;
+    }
+    const selfClosing = /\/\s*>$/.test(tag), slotMatch = stack.length === 0 ? tag.match(slotAttrPattern) : null;
+    if (slotMatch) {
+      const slotName = slotMatch[1] || slotMatch[2], openTag = tag.replace(slotAttrPattern, "").replace(/\s+(?=\/?>$)/, "").replace(/\s{2,}/g, " "), closeEnd = selfClosing || VOID_ELEMENTS.has(tagName) ? -1 : findMatchingElementClose(content, tagName, tagEnd);
+      if (closeEnd === -1) {
+        found.push({ start: tagStart, end: tagEnd, slotName, element: openTag });
+        cursor = tagEnd;
+      } else {
+        found.push({ start: tagStart, end: closeEnd, slotName, element: openTag + content.slice(tagEnd, closeEnd) });
+        cursor = closeEnd;
+      }
+      continue;
+    }
+    if (!selfClosing && !VOID_ELEMENTS.has(tagName)) {
+      stack.push(tagName);
+      if (tagName === "script" || tagName === "style") {
+        const rawClose = content.toLowerCase().indexOf(`</${tagName}>`, tagEnd);
+        if (rawClose !== -1) {
+          cursor = rawClose;
+          continue;
+        }
+      }
+    }
+    cursor = tagEnd;
+  }
+  return found;
+}
 function findDirectNamedSlotTemplates(content) {
   const slots = [], stack = [], slotOpenPattern = /^<template\s+(?:#([a-zA-Z][\w-]*)|v-slot:([a-zA-Z][\w-]*)|slot="([a-zA-Z][\w-]*)")(?:\s*=\s*"([^"]*)")?[^>]*>$/i;
   let cursor = 0;
@@ -141,24 +223,16 @@ export function parseSlots(childContent) {
   slotsToRemove.sort((a, b) => b.start - a.start);
   for (const slot of slotsToRemove)
     workingContent = workingContent.slice(0, slot.start) + workingContent.slice(slot.end);
-  const slotAttrElements = [], pairedSlotAttrRegex = /<([a-zA-Z][a-zA-Z0-9-]*)\b([^>]*?)\bslot="([^"]+)"([^>]*)>([\s\S]*?)<\/\1>/gi;
-  let slotAttrMatch;
-  while ((slotAttrMatch = pairedSlotAttrRegex.exec(workingContent)) !== null) {
-    const [fullMatch, tag, before, slotName, after, inner] = slotAttrMatch, cleanBefore = before.replace(/\s*slot="[^"]*"\s*/, " ").trimEnd(), cleanAfter = after.replace(/\s*slot="[^"]*"\s*/, " ").trimEnd(), attrs = (cleanBefore + cleanAfter).trim(), element = `<${tag}${attrs ? " " + attrs : ""}>${inner}</${tag}>`;
-    slotAttrElements.push({ start: slotAttrMatch.index, end: slotAttrMatch.index + fullMatch.length, slotName, element });
-  }
-  const selfClosingSlotAttrRegex = /<([a-zA-Z][a-zA-Z0-9-]*)\b([^>]*?)\bslot="([^"]+)"([^>]*?)\/>/gi;
-  while ((slotAttrMatch = selfClosingSlotAttrRegex.exec(workingContent)) !== null) {
-    const [fullMatch, tag, before, slotName, after] = slotAttrMatch, cleanBefore = before.replace(/\s*slot="[^"]*"\s*/, " ").trimEnd(), cleanAfter = after.replace(/\s*slot="[^"]*"\s*/, " ").trimEnd(), attrs = (cleanBefore + cleanAfter).trim(), element = `<${tag}${attrs ? " " + attrs : ""} />`;
-    slotAttrElements.push({ start: slotAttrMatch.index, end: slotAttrMatch.index + fullMatch.length, slotName, element });
-  }
-  slotAttrElements.sort((a, b) => b.start - a.start);
+  const slotAttrElements = findDirectSlotAttrElements(workingContent);
   for (const item of slotAttrElements) {
     const existing = result.named.get(item.slotName);
     if (existing)
       existing.content += item.element;
     else
       result.named.set(item.slotName, { name: item.slotName, content: item.element });
+  }
+  for (let i = slotAttrElements.length - 1;i >= 0; i--) {
+    const item = slotAttrElements[i];
     workingContent = workingContent.slice(0, item.start) + workingContent.slice(item.end);
   }
   result.default = workingContent.trim();