@stacksjs/stx 0.2.339 → 0.2.340

package/dist/ssg.js

@@ -1,5 +1,5 @@
 // @bun
-import{uk as Uq,vk as Iq,zk as Fq}from"./chunk-fa2mg49t.js";import{Ak as Eq,Bk as Tq,Ck as Dq}from"./chunk-axqfm9b4.js";import{$k as Aq,Xk as _q,_k as zq}from"./chunk-wdvee4kr.js";import"./chunk-156j37tv.js";import"./chunk-mjf3xmxn.js";import{Jp as P,Om as Oq,io as l,lo as Hq,rr as n}from"./chunk-vafj091j.js";import"./chunk-d7zxg9bp.js";import"./chunk-t00ga194.js";import"./chunk-hrdd26r4.js";import"./chunk-7r79j1hs.js";import"./chunk-ay336sqb.js";import{ht as Xq}from"./chunk-pswhshrp.js";import{mt as d}from"./chunk-vaggjvsm.js";import"./chunk-q9ckfwhh.js";import"./chunk-zfz3s2gd.js";import"./chunk-k3dtvay1.js";import{Tt as Bq}from"./chunk-aved735s.js";import"./chunk-799s9mwc.js";import"./chunk-7r80apc5.js";import"./chunk-2tjk867y.js";import"./chunk-t8ctvjqe.js";import"./chunk-deqnt1w5.js";import{$v as jq,Zv as Yq,_v as Vq,aw as Gq,bw as Lq,cw as Nq}from"./chunk-d6yyzpsv.js";import"./chunk-wb90259a.js";import{tw as y}from"./chunk-5g6rprcy.js";import O from"fs";import j from"path";import{createHash as xq}from"crypto";function yq(q){try{return new Bun.Transpiler({loader:"js",minifyWhitespace:!0}).transformSync(q).replace(/\}(var |let |const |function )/g,"};$1").trim()}catch{return q}}var Pq=/<script\s+type="stx\/island"\s+data-stx-island="([^"]+)"([^>]*)>([\s\S]*?)<\/script>/g;function Cq(q){return Bun.hash(q).toString(16)}function Qq(q,Z={}){if(!q.includes('type="stx/island"'))return{html:q,chunks:[]};let $=new Map,Q=q.replace(Pq,(J,W,z,A)=>{let G=A.trim();if(!G)return J;if(/\bdata-stx-src=/.test(z))return J;if(Z.minify)G=yq(G);let X=Cq(G);if(!$.has(X))$.set(X,G);let B=Z.integrity?` data-stx-integrity="sha384-${xq("sha384").update(G).digest("base64")}"`:"";return`<script type="stx/island" data-stx-island="${W}" data-stx-src="/_stx/islands/${X}.js"${B}${z}></script>`}),K=Array.from($,([J,W])=>({hash:J,code:W}));return{html:Q,chunks:K}}var gq=new Set(["visible","idle"]);function Zq(q){if(!q.includes("data-stx-src="))return q;let Z=new Map,$=/data-stx-scope="([^"]+)"[^>]*?stx-hydrate="([^"]+)"/g,Q;while((Q=$.exec(q))!==null)Z.set(Q[1],Q[2]);let K=new Set,J=/data-stx-island="([^"]+)"[^>]*?data-stx-src="([^"]+)"/g,W;while((W=J.exec(q))!==null)if(gq.has(Z.get(W[1])||""))K.add(W[2]);let z=q.lastIndexOf("</head>");if(K.size===0||z===-1)return q;let A=Array.from(K).filter((G)=>!q.includes(`rel="prefetch" href="${G}"`)).map((G)=>`<link rel="prefetch" href="${G}" as="script">`).join("");if(!A)return q;return q.slice(0,z)+A+q.slice(z)}var fq=["STX_SITE_URL","SITE_URL","URL","VERCEL_URL","CF_PAGES_URL"];function h(q){let Z=q.trim();if(!Z)return null;let $=/^https?:\/\//i.test(Z)?Z:`https://${Z}`;try{return new URL($).origin+new URL($).pathname.replace(/\/$/,"")}catch{return null}}function mq(q){for(let Z of fq){let $=q[Z];if(!$)continue;let Q=h($);if(Q)return{url:Q,source:"env",via:Z}}return null}function $q(q){if(!q||typeof q!=="object")return null;let Z=q,$=Z.site?.url??Z.url??Z.app?.url;return typeof $==="string"?h($):null}async function dq(q){let{existsSync:Z}=await import("fs"),$=await import("path");for(let Q of["site.config.ts","site.config.js",".config/site.config.ts"]){let K=$.resolve(q,Q);if(!Z(K))continue;try{let J=await import(K),W=$q(J.default??J);if(W)return W}catch{}}return null}async function Kq(q={}){let Z=q.cwd??process.cwd(),$=q.env??process.env;if(q.explicit){let W=h(q.explicit);if(W)return{url:W,source:"option"}}let Q=$q(q.stxConfig);if(Q)return{url:Q,source:"stx.config",via:"site.url"};let K=await dq(Z);if(K)return{url:K,source:"site.config",via:"url"};let J=mq($);if(J)return J;return{url:"http://localhost",source:"fallback"}}function Wq(){return["No site URL configured \u2014 sitemap.xml and robots.txt will point at http://localhost.","  Set one in stx.config.ts (site: { url: 'https://example.com' }), in site.config.ts,","  via --domain, or with SITE_URL in the build environment."].join(`
+import{uk as Uq,vk as Iq,zk as Fq}from"./chunk-fa2mg49t.js";import{Ak as Eq,Bk as Tq,Ck as Dq}from"./chunk-axqfm9b4.js";import{$k as Aq,Xk as _q,_k as zq}from"./chunk-r5kr6jk4.js";import"./chunk-f476c9fb.js";import"./chunk-mjf3xmxn.js";import{Jp as P,Om as Oq,io as l,lo as Hq,rr as n}from"./chunk-d964bsxm.js";import"./chunk-d7zxg9bp.js";import"./chunk-t00ga194.js";import"./chunk-hrdd26r4.js";import"./chunk-7r79j1hs.js";import"./chunk-ay336sqb.js";import{ht as Xq}from"./chunk-3agx4hyd.js";import{mt as d}from"./chunk-vaggjvsm.js";import"./chunk-q9ckfwhh.js";import"./chunk-shtg7kah.js";import"./chunk-k3dtvay1.js";import{Tt as Bq}from"./chunk-aved735s.js";import"./chunk-799s9mwc.js";import"./chunk-7r80apc5.js";import"./chunk-2tjk867y.js";import"./chunk-t8ctvjqe.js";import"./chunk-deqnt1w5.js";import{$v as jq,Zv as Yq,_v as Vq,aw as Gq,bw as Lq,cw as Nq}from"./chunk-d6yyzpsv.js";import"./chunk-wb90259a.js";import{tw as y}from"./chunk-5g6rprcy.js";import O from"fs";import j from"path";import{createHash as xq}from"crypto";function yq(q){try{return new Bun.Transpiler({loader:"js",minifyWhitespace:!0}).transformSync(q).replace(/\}(var |let |const |function )/g,"};$1").trim()}catch{return q}}var Pq=/<script\s+type="stx\/island"\s+data-stx-island="([^"]+)"([^>]*)>([\s\S]*?)<\/script>/g;function Cq(q){return Bun.hash(q).toString(16)}function Qq(q,Z={}){if(!q.includes('type="stx/island"'))return{html:q,chunks:[]};let $=new Map,Q=q.replace(Pq,(J,W,z,A)=>{let G=A.trim();if(!G)return J;if(/\bdata-stx-src=/.test(z))return J;if(Z.minify)G=yq(G);let X=Cq(G);if(!$.has(X))$.set(X,G);let B=Z.integrity?` data-stx-integrity="sha384-${xq("sha384").update(G).digest("base64")}"`:"";return`<script type="stx/island" data-stx-island="${W}" data-stx-src="/_stx/islands/${X}.js"${B}${z}></script>`}),K=Array.from($,([J,W])=>({hash:J,code:W}));return{html:Q,chunks:K}}var gq=new Set(["visible","idle"]);function Zq(q){if(!q.includes("data-stx-src="))return q;let Z=new Map,$=/data-stx-scope="([^"]+)"[^>]*?stx-hydrate="([^"]+)"/g,Q;while((Q=$.exec(q))!==null)Z.set(Q[1],Q[2]);let K=new Set,J=/data-stx-island="([^"]+)"[^>]*?data-stx-src="([^"]+)"/g,W;while((W=J.exec(q))!==null)if(gq.has(Z.get(W[1])||""))K.add(W[2]);let z=q.lastIndexOf("</head>");if(K.size===0||z===-1)return q;let A=Array.from(K).filter((G)=>!q.includes(`rel="prefetch" href="${G}"`)).map((G)=>`<link rel="prefetch" href="${G}" as="script">`).join("");if(!A)return q;return q.slice(0,z)+A+q.slice(z)}var fq=["STX_SITE_URL","SITE_URL","URL","VERCEL_URL","CF_PAGES_URL"];function h(q){let Z=q.trim();if(!Z)return null;let $=/^https?:\/\//i.test(Z)?Z:`https://${Z}`;try{return new URL($).origin+new URL($).pathname.replace(/\/$/,"")}catch{return null}}function mq(q){for(let Z of fq){let $=q[Z];if(!$)continue;let Q=h($);if(Q)return{url:Q,source:"env",via:Z}}return null}function $q(q){if(!q||typeof q!=="object")return null;let Z=q,$=Z.site?.url??Z.url??Z.app?.url;return typeof $==="string"?h($):null}async function dq(q){let{existsSync:Z}=await import("fs"),$=await import("path");for(let Q of["site.config.ts","site.config.js",".config/site.config.ts"]){let K=$.resolve(q,Q);if(!Z(K))continue;try{let J=await import(K),W=$q(J.default??J);if(W)return W}catch{}}return null}async function Kq(q={}){let Z=q.cwd??process.cwd(),$=q.env??process.env;if(q.explicit){let W=h(q.explicit);if(W)return{url:W,source:"option"}}let Q=$q(q.stxConfig);if(Q)return{url:Q,source:"stx.config",via:"site.url"};let K=await dq(Z);if(K)return{url:K,source:"site.config",via:"url"};let J=mq($);if(J)return J;return{url:"http://localhost",source:"fallback"}}function Wq(){return["No site URL configured \u2014 sitemap.xml and robots.txt will point at http://localhost.","  Set one in stx.config.ts (site: { url: 'https://example.com' }), in site.config.ts,","  via --domain, or with SITE_URL in the build environment."].join(`
 `)}class wq{cacheDir;cache=new Map;loaded=!1;salt;constructor(q,Z=""){this.cacheDir=q,this.salt=Z}async load(){if(this.loaded)return;let q=j.join(this.cacheDir,"build-cache.json");if(await Bun.file(q).exists())try{let Z=JSON.parse(await Bun.file(q).text());for(let[$,Q]of Object.entries(Z))this.cache.set($,Q)}catch{}this.loaded=!0}async save(){await O.promises.mkdir(this.cacheDir,{recursive:!0});let q=j.join(this.cacheDir,"build-cache.json"),Z={};for(let[$,Q]of this.cache)Z[$]=Q;await Bun.write(q,JSON.stringify(Z))}getHash(q,Z){let $=O.statSync(q),Q=`${this.salt}|${q}:${$.mtimeMs}`;for(let J of Z)if(O.existsSync(J)){let W=O.statSync(J);Q+=`:${J}:${W.mtimeMs}`}let K=0;for(let J=0;J<Q.length;J++){let W=Q.charCodeAt(J);K=(K<<5)-K+W,K=K&K}return Math.abs(K).toString(36)}get(q,Z){let $=this.cache.get(q);if(!$)return null;let Q=this.getHash(Z,$.dependencies??[]);if($.hash!==Q)return this.cache.delete(q),null;return $.html}set(q,Z,$,Q){let K=this.getHash(Z,$);this.cache.set(q,{hash:K,html:Q,generatedAt:Date.now(),dependencies:$})}}class Rq{cacheDir;constructor(q){this.cacheDir=q}getFilePath(q){let Z=q.replace(/[^a-zA-Z0-9]/g,"_")+".json";return j.join(this.cacheDir,"isr",Z)}async get(q){let Z=this.getFilePath(q);if(!await Bun.file(Z).exists())return null;try{return JSON.parse(await Bun.file(Z).text())}catch{return null}}async set(q,Z){let $=this.getFilePath(q);await O.promises.mkdir(j.dirname($),{recursive:!0}),await Bun.write($,JSON.stringify(Z))}async invalidate(q){let Z=this.getFilePath(q);if(await Bun.file(Z).exists())await O.promises.unlink(Z)}async invalidatePattern(q){let Z=j.join(this.cacheDir,"isr");if(!O.existsSync(Z))return;let $=await O.promises.readdir(Z);for(let Q of $){let K=Q.replace(/_/g,"/").replace(".json","");if(q.test(K))await O.promises.unlink(j.join(Z,Q))}}async needsRevalidation(q){let Z=await this.get(q);if(!Z)return!0;return Date.now()>Z.revalidateAfter}}async function pq(q){try{let $=(await Bun.file(q).text()).match(/<script\s+server\b[^>]*>([\s\S]*?)<\/script>/i);if(!$)return null;let Q=$[1];if(!Q.includes("getStaticPaths"))return null;let K=Q.match(/(?:export\s+)?(?:async\s+)?function\s+getStaticPaths\s*\([^)]*\)\s*\{([\s\S]*?)\n[\t ]*\}/);if(!K)return null;return await Function(`
       return (async function getStaticPaths() {
         ${K[1]}
@@ -41,7 +41,7 @@ ${q.map((Q)=>{let K=new URL(Q.loc,Z).href,J=`  <url>
 ${$.join(`
 `)}
   </channel>
-</rss>`}async function aq(q={}){let Z=Date.now();Aq();let $=await n(process.cwd()),Q=$.build||{},K=await Kq({explicit:q.domain||Q.domain,stxConfig:$});if(K.source==="fallback"&&(q.sitemap??Q.sitemap??!0))console.warn(Wq());let J={router:q.router??$?.router??{},pagesDir:q.pagesDir||Q.pagesDir||"pages",outputDir:q.outputDir||Q.outputDir||"dist",baseUrl:q.baseUrl||Q.baseUrl||"/",domain:K.url,revalidate:q.revalidate??Q.revalidate??!1,sitemap:q.sitemap??Q.sitemap??!0,sitemapExclude:q.sitemapExclude||Q.sitemapExclude||[],robots:q.robots??Q.robots??!0,rss:q.rss??Q.rss??!1,concurrency:q.concurrency||Q.concurrency||10,cache:q.cache??Q.cache??!0,cacheDir:q.cacheDir||Q.cacheDir||d(process.cwd(),"ssg-cache"),contentLoaders:q.contentLoaders||[],hooks:q.hooks||{},minify:q.minify??Q.minify??!0,generate404:q.generate404??Q.generate404??!0,publicDir:q.publicDir||Q.publicDir||"public",trailingSlash:q.trailingSlash??Q.trailingSlash??!1,cleanOutput:q.cleanOutput??Q.cleanOutput??!0,cacheSalt:q.cacheSalt??"",partialsDir:q.partialsDir||$?.partialsDir||"",componentsDir:q.componentsDir||$?.componentsDir||"",failOnIncludeError:q.failOnIncludeError??!0,chunkIslands:q.chunkIslands===!0,prefetchIslands:q.prefetchIslands===!0,integrityIslands:q.integrityIslands===!0},W={totalPages:0,successCount:0,failedCount:0,cachedCount:0,buildTime:0,pages:[],errors:[]},z=new Set,A=0,G={},X={};await J.hooks.onBuildStart?.();try{if(J.cleanOutput&&O.existsSync(J.outputDir))await O.promises.rm(J.outputDir,{recursive:!0});await O.promises.mkdir(J.outputDir,{recursive:!0});let L=J.cacheSalt;if(!L){let{resolveUserCssConfig:Y,fingerprintConfig:N}=await import("./chunk-sntjqyqq.js");try{L=N(await Y(process.cwd()))}catch{}}let{prepareImageDelivery:_}=await import("./chunk-97ej3abh.js"),F=await _(J.publicDir,J.outputDir);if(F.count>0)console.log(`Optimized ${F.count} image(s) for responsive delivery`),L=[L,F.fingerprint].filter(Boolean).join(":");let C=new wq(J.cacheDir,L);if(J.cache)await C.load();try{let{generateCss:Y}=await import("./chunk-sntjqyqq.js");await Y('<div class="bg-black"></div>')}catch{}Yq();let kq=$?.routeMiddleware?.dir||"middleware";await jq(process.cwd(),kq);let p=Vq();if(p.length>0)console.log(`Loaded ${p.length} middleware: ${p.join(", ")}`);let bq=$?.routeMiddleware?.global||[];Fq($?.layoutsDir,d(process.cwd()));let i=l(".",{pagesDir:J.pagesDir,pagesDirs:$?._layerPageDirs});console.log(`Found ${i.length} routes`);let g=[];for(let Y of i){let N=await uq(Y);for(let H of N)g.push({route:Y,url:H.url,params:H.params,props:H.props,revalidate:H.revalidate??J.revalidate})}W.totalPages=g.length,console.log(`Generating ${W.totalPages} pages...`);let b=[],s=[];for(let Y=0;Y<g.length;Y+=J.concurrency)s.push(g.slice(Y,Y+J.concurrency));for(let Y of s)await Promise.all(Y.map(async(N)=>{let{route:H,url:V,params:S,props:Sq,revalidate:a}=N;try{await J.hooks.onPageStart?.(V);let w=await Bun.file(H.filePath).text(),R=JJ(w),vq=R?.middleware?Array.isArray(R.middleware)?R.middleware:[R.middleware]:[],t=[...bq,...vq];if(t.length>0){let D=Gq(V,S,R||{}),M=Lq(D,null,void 0,{isServer:!0}),E=await Nq(t,M);if(E.redirect){let U=typeof E.redirect==="string"?E.redirect:E.redirect.path||E.redirect,x=QJ(String(U),V),k=ZJ(V,J);await O.promises.mkdir(j.dirname(k),{recursive:!0}),await Bun.write(k,x),W.successCount++,W.pages.push({route:V,outputPath:k,size:Buffer.byteLength(x),cached:!1}),b.push({loc:V,lastmod:new Date().toISOString()}),console.log(`  \u21B3 ${V} \u2192 redirect to ${U}`);return}if(E.abort){let U=typeof E.abort==="string"?E.abort:E.abort?.error?.message||"aborted";console.warn(`  \u21B3 ${V} \u2014 middleware aborted: ${U}`);return}}let e=w.match(/definePageMeta\s*\(\s*\{[\s\S]*?validate\s*:\s*((?:\([^)]*\)|[^,}])*(?:\{[\s\S]*?\})?)/m);if(e)try{if(!await Function("route",`
+</rss>`}async function aq(q={}){let Z=Date.now();Aq();let $=await n(process.cwd()),Q=$.build||{},K=await Kq({explicit:q.domain||Q.domain,stxConfig:$});if(K.source==="fallback"&&(q.sitemap??Q.sitemap??!0))console.warn(Wq());let J={router:q.router??$?.router??{},pagesDir:q.pagesDir||Q.pagesDir||"pages",outputDir:q.outputDir||Q.outputDir||"dist",baseUrl:q.baseUrl||Q.baseUrl||"/",domain:K.url,revalidate:q.revalidate??Q.revalidate??!1,sitemap:q.sitemap??Q.sitemap??!0,sitemapExclude:q.sitemapExclude||Q.sitemapExclude||[],robots:q.robots??Q.robots??!0,rss:q.rss??Q.rss??!1,concurrency:q.concurrency||Q.concurrency||10,cache:q.cache??Q.cache??!0,cacheDir:q.cacheDir||Q.cacheDir||d(process.cwd(),"ssg-cache"),contentLoaders:q.contentLoaders||[],hooks:q.hooks||{},minify:q.minify??Q.minify??!0,generate404:q.generate404??Q.generate404??!0,publicDir:q.publicDir||Q.publicDir||"public",trailingSlash:q.trailingSlash??Q.trailingSlash??!1,cleanOutput:q.cleanOutput??Q.cleanOutput??!0,cacheSalt:q.cacheSalt??"",partialsDir:q.partialsDir||$?.partialsDir||"",componentsDir:q.componentsDir||$?.componentsDir||"",failOnIncludeError:q.failOnIncludeError??!0,chunkIslands:q.chunkIslands===!0,prefetchIslands:q.prefetchIslands===!0,integrityIslands:q.integrityIslands===!0},W={totalPages:0,successCount:0,failedCount:0,cachedCount:0,buildTime:0,pages:[],errors:[]},z=new Set,A=0,G={},X={};await J.hooks.onBuildStart?.();try{if(J.cleanOutput&&O.existsSync(J.outputDir))await O.promises.rm(J.outputDir,{recursive:!0});await O.promises.mkdir(J.outputDir,{recursive:!0});let L=J.cacheSalt;if(!L){let{resolveUserCssConfig:Y,fingerprintConfig:N}=await import("./chunk-7xjm1zqa.js");try{L=N(await Y(process.cwd()))}catch{}}let{prepareImageDelivery:_}=await import("./chunk-97ej3abh.js"),F=await _(J.publicDir,J.outputDir);if(F.count>0)console.log(`Optimized ${F.count} image(s) for responsive delivery`),L=[L,F.fingerprint].filter(Boolean).join(":");let C=new wq(J.cacheDir,L);if(J.cache)await C.load();try{let{generateCss:Y}=await import("./chunk-7xjm1zqa.js");await Y('<div class="bg-black"></div>')}catch{}Yq();let kq=$?.routeMiddleware?.dir||"middleware";await jq(process.cwd(),kq);let p=Vq();if(p.length>0)console.log(`Loaded ${p.length} middleware: ${p.join(", ")}`);let bq=$?.routeMiddleware?.global||[];Fq($?.layoutsDir,d(process.cwd()));let i=l(".",{pagesDir:J.pagesDir,pagesDirs:$?._layerPageDirs});console.log(`Found ${i.length} routes`);let g=[];for(let Y of i){let N=await uq(Y);for(let H of N)g.push({route:Y,url:H.url,params:H.params,props:H.props,revalidate:H.revalidate??J.revalidate})}W.totalPages=g.length,console.log(`Generating ${W.totalPages} pages...`);let b=[],s=[];for(let Y=0;Y<g.length;Y+=J.concurrency)s.push(g.slice(Y,Y+J.concurrency));for(let Y of s)await Promise.all(Y.map(async(N)=>{let{route:H,url:V,params:S,props:Sq,revalidate:a}=N;try{await J.hooks.onPageStart?.(V);let w=await Bun.file(H.filePath).text(),R=JJ(w),vq=R?.middleware?Array.isArray(R.middleware)?R.middleware:[R.middleware]:[],t=[...bq,...vq];if(t.length>0){let D=Gq(V,S,R||{}),M=Lq(D,null,void 0,{isServer:!0}),E=await Nq(t,M);if(E.redirect){let U=typeof E.redirect==="string"?E.redirect:E.redirect.path||E.redirect,x=QJ(String(U),V),k=ZJ(V,J);await O.promises.mkdir(j.dirname(k),{recursive:!0}),await Bun.write(k,x),W.successCount++,W.pages.push({route:V,outputPath:k,size:Buffer.byteLength(x),cached:!1}),b.push({loc:V,lastmod:new Date().toISOString()}),console.log(`  \u21B3 ${V} \u2192 redirect to ${U}`);return}if(E.abort){let U=typeof E.abort==="string"?E.abort:E.abort?.error?.message||"aborted";console.warn(`  \u21B3 ${V} \u2014 middleware aborted: ${U}`);return}}let e=w.match(/definePageMeta\s*\(\s*\{[\s\S]*?validate\s*:\s*((?:\([^)]*\)|[^,}])*(?:\{[\s\S]*?\})?)/m);if(e)try{if(!await Function("route",`
                 const validate = ${e[1]};
                 return validate(route);
               `)({params:S})){console.warn(`Validation failed for ${V}, skipping...`);return}}catch{}let I=null,qq=!1;if(J.cache){if(I=C.get(V,H.filePath),I)qq=!0,W.cachedCount++}if(!I){let D=await Mq(H,S,Sq,J,$);if(I=D.html,J.failOnIncludeError&&D.includeFailures.length>0)throw Error(`${D.includeFailures.length} include(s) failed to resolve, so this page would have shipped with an error banner where the markup should be:

package/dist/url-safety.d.ts

@@ -0,0 +1,67 @@
+/**
+ * A substituted value cannot introduce a URL scheme the page did not ask for.
+ *
+ * `{{ }}` escapes HTML, which stops a value closing its attribute or opening a
+ * tag -- and says nothing about what the attribute means. `javascript:alert(1)`
+ * contains no character escaping touches, so
+ * `<a href="{{ url }}">` with a stored URL ran script on click, from a value a
+ * person typed. The same goes for `vbscript:` (old Edge, still shipped in
+ * Windows-embedded browsers) and for `data:text/html`, which navigates to a
+ * document the attacker wrote, on the page's own origin in some browsers.
+ *
+ * What is *not* here matters as much:
+ *
+ * - **Only the scheme position.** `href="/search?q={{ term }}"` is left alone:
+ *   a scheme can only be at the start of a URL, so a value substituted after
+ *   anything else cannot introduce one.
+ * - **Only URL attributes.** `title="{{ text }}"` keeps every byte. A value is
+ *   rewritten only where the browser would resolve it as a URL.
+ * - **`{!! !!}` is untouched**, as it is for HTML: the raw form is how a
+ *   template says it vouches for the value, and a sanitizer with no way out is
+ *   one people work around.
+ * - **`data:image/...` still loads**, which `<StxImage>`'s own blur placeholder
+ *   needs; only the data URLs that carry a document are refused.
+ *
+ * Refused values are prefixed rather than emptied, the way Angular does it: the
+ * value stays visible in the DOM and in view-source, so the person debugging it
+ * sees what was blocked instead of an attribute that mysteriously went away,
+ * and `unsafe:javascript:alert(1)` is an unknown scheme, so a click does
+ * nothing.
+ */
+/** What a refused value is rewritten to, so it is inert but still readable. */
+export declare const UNSAFE_URL_PREFIX = "unsafe:";
+/** Which policy an attribute name gets, or null when it holds no URL. */
+export declare function urlAttributeKind(name: string): 'navigable' | 'fetched' | null;
+/** Whether this value would introduce a scheme the attribute must not follow. */
+export declare function isDangerousUrl(value: string, kind?: 'navigable' | 'fetched'): boolean;
+/** The value as it may be written, refused ones prefixed to make them inert. */
+export declare function sanitizeUrlValue(value: string, kind?: 'navigable' | 'fetched'): string;
+/**
+ * The attribute a substitution at the end of `before` is landing in the scheme
+ * position of, or null.
+ *
+ * `before` is everything already written, so its tail says where the next
+ * characters go: inside an open quoted attribute value, with nothing before
+ * them in that value. Anything already written into the value means the
+ * substitution cannot be the scheme, and an unquoted value is not matched --
+ * the interpolation passes write quoted attributes.
+ */
+export declare function urlSchemePosition(before: string): 'navigable' | 'fetched' | null;
+/**
+ * The tail of the already-written output that a scheme check needs.
+ *
+ * A page can hold hundreds of substitutions, and slicing the whole output at
+ * each one is quadratic -- one of the compile budgets in
+ * scripts/performance-budgets.ts is what would notice. Only the enclosing tag's
+ * last attribute matters, so a window is enough.
+ */
+export declare function schemeWindow(output: string, offset: number, span?: number): string;
+/**
+ * Decide the final text for a value that was just substituted: `escaped` as it
+ * is, or prefixed when it landed in the scheme position of a URL attribute and
+ * introduces a scheme that attribute must not follow.
+ *
+ * The decision reads the raw value, not the escaped one, so it is testing what
+ * the browser will resolve rather than what the HTML escape happened to leave.
+ */
+export declare function sanitizeSubstitutedUrl(before: string, raw: string, escaped?: string): string;

package/dist/url-safety.js

@@ -0,0 +1,40 @@
+export const UNSAFE_URL_PREFIX = "unsafe:";
+const NAVIGABLE = "href|xlink:href|action|formaction|ping|cite|manifest|data|to", FETCHED = "src|srcset|poster|background", SCRIPT_SCHEME = /^(?:javascript|vbscript|livescript|mocha|view-source):/, DOCUMENT_DATA = /^data:(?:text\/html|text\/xml|application\/xhtml\+xml|application\/xml|image\/svg\+xml)/, FETCHED_DATA = /^data:(?:text\/html|application\/xhtml\+xml)/, STRIPPED = new RegExp("[\\u0000-\\u0020\\u00A0\\u1680\\u2000-\\u200F\\u2028\\u2029\\u202F\\u205F\\u3000\\uFEFF]+", "g");
+function normalizeScheme(value) {
+  return value.replace(STRIPPED, "").toLowerCase();
+}
+export function urlAttributeKind(name) {
+  const lower = name.toLowerCase();
+  if (new RegExp(`^(?:${NAVIGABLE})$`).test(lower))
+    return "navigable";
+  if (new RegExp(`^(?:${FETCHED})$`).test(lower))
+    return "fetched";
+  return null;
+}
+export function isDangerousUrl(value, kind = "navigable") {
+  const normalized = normalizeScheme(value);
+  if (SCRIPT_SCHEME.test(normalized))
+    return !0;
+  return kind === "navigable" ? DOCUMENT_DATA.test(normalized) : FETCHED_DATA.test(normalized);
+}
+export function sanitizeUrlValue(value, kind = "navigable") {
+  return isDangerousUrl(value, kind) ? UNSAFE_URL_PREFIX + value : value;
+}
+export function urlSchemePosition(before) {
+  const open = before.match(/(?:^|[\s"'`/])([A-Za-z][\w:-]*)\s*=\s*(["'])([^"']*)$/);
+  if (!open)
+    return null;
+  if (open[3].trim() !== "")
+    return null;
+  return urlAttributeKind(open[1]);
+}
+export function schemeWindow(output, offset, span = 256) {
+  if (offset <= span)
+    return output.slice(0, offset);
+  const window = output.slice(offset - span, offset), boundary = window.search(/[\s"'`/]/);
+  return boundary === -1 ? "" : window.slice(boundary);
+}
+export function sanitizeSubstitutedUrl(before, raw, escaped = raw) {
+  const kind = urlSchemePosition(before);
+  return kind && isDangerousUrl(raw, kind) ? UNSAFE_URL_PREFIX + escaped : escaped;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/stx",
   "type": "module",
-  "version": "0.2.339",
+  "version": "0.2.340",
   "description": "A performant UI Framework. Powered by Bun.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",
@@ -117,12 +117,12 @@
   "dependencies": {
     "@stacksjs/ts-css": "^0.3.2",
     "@stacksjs/clapp": "^0.2.16",
-    "@stacksjs/desktop": "0.2.339",
-    "@stacksjs/sanitizer": "0.2.339",
+    "@stacksjs/desktop": "0.2.340",
+    "@stacksjs/sanitizer": "0.2.340",
     "@stacksjs/ts-i18n": "^0.1.11",
-    "bun-plugin-stx": "0.2.339",
+    "bun-plugin-stx": "0.2.340",
     "bunfig": "^0.15.19",
-    "stx-router": "0.2.339",
+    "stx-router": "0.2.340",
     "ts-broadcasting": "^0.0.10",
     "ts-images": "^0.2.22",
     "ts-syntax-highlighter": "^0.2.1"