@stacksjs/stx 0.2.95 → 0.2.97

package/dist/errors/sanitizer.js

@@ -1,2 +1,181 @@
-// @bun
-import"../chunk-xv34zbp4.js";import T from"path";var W={isValidFilePath(B,q){let j=B.replace(/\\/g,"/");if(j.includes("\x00"))return!1;if(j.includes("../")||j.includes("..\\")||j===".."||j.startsWith("../")||j.endsWith("/..")||j.includes("/..\\")||j.includes("\\../"))return!1;if(/^[a-z][a-z0-9+.-]*:/i.test(j))return!1;if(j.startsWith("/")){if(["/etc/","/root/","/var/","/usr/","/bin/","/sbin/","/proc/","/sys/","/dev/","/boot/","/home/","/private/","/Library/","/System/"].some((J)=>j===J.slice(0,-1)||j.startsWith(J)))return!1}if(/^[a-z]:/i.test(j)){if(["Windows/","Windows\\","System32/","System32\\","Program Files/","Program Files\\"].some((J)=>j.includes(J)))return!1}if(q){let I=T.resolve(q,B),J=T.resolve(q);if(!I.startsWith(J+T.sep)&&I!==J)return!1}return!0},isValidVariableName(B){return/^[a-z_$]\w*$/i.test(B)},isValidDirectiveName(B){return/^[a-z][\w-]*$/i.test(B)},isSafeContent(B){return![/<script[^>]*>[\s\S]*?<\/script>/i,/javascript:/i,/data:text\/html/i,/vbscript:/i,/on\w+\s*=/i].some((j)=>j.test(B))}};function Y(B){let q={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"};return B.replace(/[&<>"']/g,(j)=>q[j]||j)}function U(B,q={}){let{allowHtml:j=!1,maxLength:G=1e4,allowSpecialChars:I=!0,customSanitizer:J}=q,K=[],F=B,M=!1;if(J){let N=J(F);if(N!==F)F=N,M=!0}if(F.includes("\x00"))F=F.replace(/\0/g,""),M=!0,K.push("Null bytes removed from parameter");if(F.length>G)F=F.substring(0,G),M=!0,K.push(`Parameter truncated to ${G} characters`);if(!j&&/<[^>]+>/.test(F))F=Y(F),M=!0,K.push("HTML content was escaped");let X=[{pattern:/javascript:/gi,replacement:"",name:"javascript: URI"},{pattern:/vbscript:/gi,replacement:"",name:"vbscript: URI"},{pattern:/data:text\/html/gi,replacement:"",name:"data:text/html URI"}];for(let{pattern:N,replacement:Q,name:O}of X)if(N.test(F))F=F.replace(N,Q),M=!0,K.push(`Removed ${O} from parameter`);if(!I){let N=F;if(F=F.split("").filter((Q)=>{let O=Q.charCodeAt(0);return O>=32&&O!==127}).join(""),F!==N)M=!0,K.push("Control characters removed")}return{value:F,modified:M,warnings:K}}function $(B,q){let j=B.replace(/\0/g,"");j=j.replace(/\\/g,"/"),j=j.replace(/^[a-z][a-z0-9+.-]*:/i,"");while(j.includes("../")||j.includes("./"))j=j.replace(/\.\.\//g,"").replace(/\.\//g,"");if(!W.isValidFilePath(j,q))return null;return j}function A(B){let q=[],j=B.trim(),G=j!==B,I=[{pattern:/\beval\s*\(/gi,name:"eval()"},{pattern:/\bFunction\s*\(/gi,name:"Function()"},{pattern:/\bsetTimeout\s*\(/gi,name:"setTimeout()"},{pattern:/\bsetInterval\s*\(/gi,name:"setInterval()"},{pattern:/\bimport\s*\(/gi,name:"dynamic import()"},{pattern:/\brequire\s*\(/gi,name:"require()"},{pattern:/\b__proto__\b/gi,name:"__proto__"},{pattern:/\bconstructor\b/gi,name:"constructor"},{pattern:/\bprototype\b/gi,name:"prototype"}];for(let{pattern:J,name:K}of I)if(J.test(j))q.push(`Potentially dangerous pattern detected: ${K}`);if(j.includes("\x00"))j=j.replace(/\0/g,""),G=!0,q.push("Null bytes removed from expression");return{value:j,modified:G,warnings:q}}function C(B,q={}){return B.map((j)=>U(j,q))}function Z(B){let q={};for(let[j,G]of Object.entries(B)){if(!W.isValidVariableName(j))continue;if(typeof G==="string"){let I=U(G);q[j]=I.value}else if(Array.isArray(G))q[j]=G.map((I)=>typeof I==="string"?U(I).value:I);else if(typeof G==="object"&&G!==null)q[j]=Z(G);else q[j]=G}return q}export{W as validators,$ as sanitizeFilePath,A as sanitizeExpression,C as sanitizeDirectiveParams,U as sanitizeDirectiveParam,Z as sanitizeComponentProps};
+import path from "node:path";
+export const validators = {
+  isValidFilePath(filePath, allowedDir) {
+    const normalizedPath = filePath.replace(/\\/g, "/");
+    if (normalizedPath.includes("\x00"))
+      return !1;
+    if (normalizedPath.includes("../") || normalizedPath.includes("..\\") || normalizedPath === ".." || normalizedPath.startsWith("../") || normalizedPath.endsWith("/..") || normalizedPath.includes("/..\\") || normalizedPath.includes("\\../"))
+      return !1;
+    if (/^[a-z][a-z0-9+.-]*:/i.test(normalizedPath))
+      return !1;
+    if (normalizedPath.startsWith("/")) {
+      if ([
+        "/etc/",
+        "/root/",
+        "/var/",
+        "/usr/",
+        "/bin/",
+        "/sbin/",
+        "/proc/",
+        "/sys/",
+        "/dev/",
+        "/boot/",
+        "/home/",
+        "/private/",
+        "/Library/",
+        "/System/"
+      ].some((p) => normalizedPath === p.slice(0, -1) || normalizedPath.startsWith(p)))
+        return !1;
+    }
+    if (/^[a-z]:/i.test(normalizedPath)) {
+      if ([
+        "Windows/",
+        "Windows\\",
+        "System32/",
+        "System32\\",
+        "Program Files/",
+        "Program Files\\"
+      ].some((p) => normalizedPath.includes(p)))
+        return !1;
+    }
+    if (allowedDir) {
+      const resolvedPath = path.resolve(allowedDir, filePath), normalizedAllowedDir = path.resolve(allowedDir);
+      if (!resolvedPath.startsWith(normalizedAllowedDir + path.sep) && resolvedPath !== normalizedAllowedDir)
+        return !1;
+    }
+    return !0;
+  },
+  isValidVariableName(name) {
+    return /^[a-z_$]\w*$/i.test(name);
+  },
+  isValidDirectiveName(name) {
+    return /^[a-z][\w-]*$/i.test(name);
+  },
+  isSafeContent(content) {
+    return ![
+      /<script[^>]*>[\s\S]*?<\/script>/i,
+      /javascript:/i,
+      /data:text\/html/i,
+      /vbscript:/i,
+      /on\w+\s*=/i
+    ].some((pattern) => pattern.test(content));
+  }
+};
+function escapeHtml(str) {
+  const htmlEntities = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;"
+  };
+  return str.replace(/[&<>"']/g, (char) => htmlEntities[char] || char);
+}
+export function sanitizeDirectiveParam(param, options = {}) {
+  const {
+    allowHtml = !1,
+    maxLength = 1e4,
+    allowSpecialChars = !0,
+    customSanitizer
+  } = options, warnings = [];
+  let value = param, modified = !1;
+  if (customSanitizer) {
+    const customResult = customSanitizer(value);
+    if (customResult !== value) {
+      value = customResult;
+      modified = !0;
+    }
+  }
+  if (value.includes("\x00")) {
+    value = value.replace(/\0/g, "");
+    modified = !0;
+    warnings.push("Null bytes removed from parameter");
+  }
+  if (value.length > maxLength) {
+    value = value.substring(0, maxLength);
+    modified = !0;
+    warnings.push(`Parameter truncated to ${maxLength} characters`);
+  }
+  if (!allowHtml && /<[^>]+>/.test(value)) {
+    value = escapeHtml(value);
+    modified = !0;
+    warnings.push("HTML content was escaped");
+  }
+  const dangerousPatterns = [
+    { pattern: /javascript:/gi, replacement: "", name: "javascript: URI" },
+    { pattern: /vbscript:/gi, replacement: "", name: "vbscript: URI" },
+    { pattern: /data:text\/html/gi, replacement: "", name: "data:text/html URI" }
+  ];
+  for (const { pattern, replacement, name } of dangerousPatterns)
+    if (pattern.test(value)) {
+      value = value.replace(pattern, replacement);
+      modified = !0;
+      warnings.push(`Removed ${name} from parameter`);
+    }
+  if (!allowSpecialChars) {
+    const originalValue = value;
+    value = value.split("").filter((char) => {
+      const code = char.charCodeAt(0);
+      return code >= 32 && code !== 127;
+    }).join("");
+    if (value !== originalValue) {
+      modified = !0;
+      warnings.push("Control characters removed");
+    }
+  }
+  return { value, modified, warnings };
+}
+export function sanitizeFilePath(filePath, baseDir) {
+  let sanitized = filePath.replace(/\0/g, "");
+  sanitized = sanitized.replace(/\\/g, "/");
+  sanitized = sanitized.replace(/^[a-z][a-z0-9+.-]*:/i, "");
+  while (sanitized.includes("../") || sanitized.includes("./"))
+    sanitized = sanitized.replace(/\.\.\//g, "").replace(/\.\//g, "");
+  if (!validators.isValidFilePath(sanitized, baseDir))
+    return null;
+  return sanitized;
+}
+export function sanitizeExpression(expr) {
+  const warnings = [];
+  let value = expr.trim(), modified = value !== expr;
+  const dangerousExprPatterns = [
+    { pattern: /\beval\s*\(/gi, name: "eval()" },
+    { pattern: /\bFunction\s*\(/gi, name: "Function()" },
+    { pattern: /\bsetTimeout\s*\(/gi, name: "setTimeout()" },
+    { pattern: /\bsetInterval\s*\(/gi, name: "setInterval()" },
+    { pattern: /\bimport\s*\(/gi, name: "dynamic import()" },
+    { pattern: /\brequire\s*\(/gi, name: "require()" },
+    { pattern: /\b__proto__\b/gi, name: "__proto__" },
+    { pattern: /\bconstructor\b/gi, name: "constructor" },
+    { pattern: /\bprototype\b/gi, name: "prototype" }
+  ];
+  for (const { pattern, name } of dangerousExprPatterns)
+    if (pattern.test(value))
+      warnings.push(`Potentially dangerous pattern detected: ${name}`);
+  if (value.includes("\x00")) {
+    value = value.replace(/\0/g, "");
+    modified = !0;
+    warnings.push("Null bytes removed from expression");
+  }
+  return { value, modified, warnings };
+}
+export function sanitizeDirectiveParams(params, options = {}) {
+  return params.map((param) => sanitizeDirectiveParam(param, options));
+}
+export function sanitizeComponentProps(props) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(props)) {
+    if (!validators.isValidVariableName(key))
+      continue;
+    if (typeof value === "string") {
+      const result = sanitizeDirectiveParam(value);
+      sanitized[key] = result.value;
+    } else if (Array.isArray(value))
+      sanitized[key] = value.map((item) => typeof item === "string" ? sanitizeDirectiveParam(item).value : item);
+    else if (typeof value === "object" && value !== null)
+      sanitized[key] = sanitizeComponentProps(value);
+    else
+      sanitized[key] = value;
+  }
+  return sanitized;
+}

package/dist/errors/types.js

@@ -1,2 +1,86 @@
-// @bun
-import{Ay as c,By as d,Cy as e,Dy as f,Ey as g,Fy as h,Gy as i,Hy as j,yy as a,zy as b}from"../chunk-fjk3x41y.js";import"../chunk-5shey2e4.js";import"../chunk-27zsyhrd.js";import"../chunk-xv34zbp4.js";export{c as resetErrorConfig,b as getErrorConfig,d as formatFilePath,a as configureErrorHandling,j as StxValidationError,f as StxSyntaxError,h as StxSecurityError,g as StxRuntimeError,i as StxFileError,e as StxError};
+import path from "node:path";
+import { isDevelopment } from "../env.js";
+import { ErrorCodes } from "./codes.js";
+const defaultErrorConfig = {
+  showRelativePaths: !1,
+  enableAutoRecovery: isDevelopment(),
+  logRecoveryWarnings: !0
+};
+let currentErrorConfig = { ...defaultErrorConfig };
+export function configureErrorHandling(config) {
+  currentErrorConfig = { ...currentErrorConfig, ...config };
+}
+export function getErrorConfig() {
+  return { ...currentErrorConfig };
+}
+export function resetErrorConfig() {
+  currentErrorConfig = { ...defaultErrorConfig };
+}
+export function formatFilePath(filePath) {
+  if (!currentErrorConfig.showRelativePaths || !filePath)
+    return filePath;
+  const baseDir = currentErrorConfig.baseDir || process.cwd();
+  try {
+    const relativePath = path.relative(baseDir, filePath);
+    return relativePath.startsWith("..") ? filePath : relativePath;
+  } catch {
+    return filePath;
+  }
+}
+
+export class StxError extends Error {
+  code;
+  filePath;
+  line;
+  column;
+  context;
+  numericCode;
+  constructor(message, code, filePath, line, column, context, numericCode) {
+    super(message);
+    this.code = code;
+    this.filePath = filePath;
+    this.line = line;
+    this.column = column;
+    this.context = context;
+    this.name = "StxError";
+    this.numericCode = numericCode || ErrorCodes.EVALUATION_ERROR;
+    if (this.filePath)
+      this.filePath = formatFilePath(this.filePath);
+  }
+}
+
+export class StxSyntaxError extends StxError {
+  constructor(message, filePath, line, column, context, numericCode) {
+    super(message, "stx_SYNTAX_ERROR", filePath, line, column, context, numericCode || ErrorCodes.INVALID_DIRECTIVE_SYNTAX);
+    this.name = "StxSyntaxError";
+  }
+}
+
+export class StxRuntimeError extends StxError {
+  constructor(message, filePath, line, column, context, numericCode) {
+    super(message, "stx_RUNTIME_ERROR", filePath, line, column, context, numericCode || ErrorCodes.EVALUATION_ERROR);
+    this.name = "StxRuntimeError";
+  }
+}
+
+export class StxSecurityError extends StxError {
+  constructor(message, filePath, line, column, context, numericCode) {
+    super(message, "stx_SECURITY_ERROR", filePath, line, column, context, numericCode || ErrorCodes.UNSAFE_EXPRESSION);
+    this.name = "StxSecurityError";
+  }
+}
+
+export class StxFileError extends StxError {
+  constructor(message, filePath, line, column, context, numericCode) {
+    super(message, "stx_FILE_ERROR", filePath, line, column, context, numericCode || ErrorCodes.FILE_NOT_FOUND);
+    this.name = "StxFileError";
+  }
+}
+
+export class StxValidationError extends StxError {
+  isFatal = !0;
+  constructor(message, filePath, line, column, context, numericCode) {
+    super(message, "stx_VALIDATION_ERROR", filePath, line, column, context, numericCode || ErrorCodes.DOM_API_VIOLATION);
+    this.name = "StxValidationError";
+  }
+}

package/dist/events.js

@@ -1,2 +1,382 @@
-// @bun
-import{Kv as a,Lv as b,Mv as c}from"./chunk-7gd339hd.js";import"./chunk-xv34zbp4.js";export{b as processEventDirectives,c as hasEventDirectives,a as extractAndProcessEvents};
+const DOM_EVENTS = new Set([
+  "click",
+  "dblclick",
+  "mousedown",
+  "mouseup",
+  "mousemove",
+  "mouseenter",
+  "mouseleave",
+  "mouseover",
+  "mouseout",
+  "contextmenu",
+  "wheel",
+  "keydown",
+  "keyup",
+  "keypress",
+  "submit",
+  "reset",
+  "change",
+  "input",
+  "focus",
+  "blur",
+  "focusin",
+  "focusout",
+  "select",
+  "invalid",
+  "touchstart",
+  "touchend",
+  "touchmove",
+  "touchcancel",
+  "drag",
+  "dragstart",
+  "dragend",
+  "dragenter",
+  "dragleave",
+  "dragover",
+  "drop",
+  "scroll",
+  "resize",
+  "load",
+  "error",
+  "abort",
+  "animationstart",
+  "animationend",
+  "animationiteration",
+  "transitionstart",
+  "transitionend",
+  "transitionrun",
+  "transitioncancel",
+  "mounted",
+  "unmounted"
+]), KEY_ALIASES = {
+  enter: "Enter",
+  tab: "Tab",
+  delete: "Delete",
+  backspace: "Backspace",
+  esc: "Escape",
+  escape: "Escape",
+  space: " ",
+  up: "ArrowUp",
+  down: "ArrowDown",
+  left: "ArrowLeft",
+  right: "ArrowRight",
+  home: "Home",
+  end: "End",
+  pageup: "PageUp",
+  pagedown: "PageDown"
+}, SYSTEM_KEYS = new Set(["ctrl", "alt", "shift", "meta"]), MOUSE_BUTTONS = {
+  left: 0,
+  middle: 1,
+  right: 2
+};
+function parseModifiers(parts) {
+  const modifiers = {
+    prevent: !1,
+    stop: !1,
+    once: !1,
+    capture: !1,
+    self: !1,
+    passive: !1,
+    keys: [],
+    systemKeys: [],
+    mouse: null,
+    debounce: null,
+    throttle: null
+  };
+  for (const part of parts) {
+    const lowerPart = part.toLowerCase();
+    if (lowerPart === "prevent")
+      modifiers.prevent = !0;
+    else if (lowerPart === "stop")
+      modifiers.stop = !0;
+    else if (lowerPart === "once")
+      modifiers.once = !0;
+    else if (lowerPart === "capture")
+      modifiers.capture = !0;
+    else if (lowerPart === "self")
+      modifiers.self = !0;
+    else if (lowerPart === "passive")
+      modifiers.passive = !0;
+    else if (SYSTEM_KEYS.has(lowerPart))
+      modifiers.systemKeys.push(lowerPart);
+    else if (lowerPart in MOUSE_BUTTONS)
+      modifiers.mouse = lowerPart;
+    else if (lowerPart in KEY_ALIASES || /^[a-z]$/.test(lowerPart))
+      modifiers.keys.push(KEY_ALIASES[lowerPart] || lowerPart.toUpperCase());
+    else if (lowerPart.startsWith("debounce")) {
+      const match = lowerPart.match(/debounce(?:\.(\d+))?/);
+      modifiers.debounce = match?.[1] ? Number.parseInt(match[1], 10) : 300;
+    } else if (lowerPart.startsWith("throttle")) {
+      const match = lowerPart.match(/throttle(?:\.(\d+))?/);
+      modifiers.throttle = match?.[1] ? Number.parseInt(match[1], 10) : 300;
+    }
+  }
+  return modifiers;
+}
+function findElementsWithEvents(template) {
+  const elements = [];
+  let idCounter = 0;
+  const tagRegex = /<([a-z][a-z0-9-]*)\s+([^>]*@[a-z][^>]*)>/gi;
+  let match;
+  while ((match = tagRegex.exec(template)) !== null) {
+    const [fullMatch, _tagName, attributesStr] = match, startIndex = match.index, endIndex = startIndex + fullMatch.length, elementId = `__stx_evt_${idCounter++}`, events = [], doubleQuoteRegex = /@([a-z][a-z0-9.]*)\s*=\s*"([^"]*)"/gi;
+    let attrMatch;
+    while ((attrMatch = doubleQuoteRegex.exec(attributesStr)) !== null) {
+      const [, eventWithModifiers, handler] = attrMatch, parts = eventWithModifiers.split("."), eventName = parts[0];
+      if (!DOM_EVENTS.has(eventName))
+        continue;
+      events.push({
+        attribute: `@${eventWithModifiers}`,
+        event: eventName,
+        handler,
+        modifiers: parseModifiers(parts.slice(1)),
+        elementId
+      });
+    }
+    const singleQuoteRegex = /@([a-z][a-z0-9.]*)\s*=\s*'([^']*)'/gi;
+    while ((attrMatch = singleQuoteRegex.exec(attributesStr)) !== null) {
+      const [, eventWithModifiers, handler] = attrMatch, parts = eventWithModifiers.split("."), eventName = parts[0];
+      if (!DOM_EVENTS.has(eventName))
+        continue;
+      events.push({
+        attribute: `@${eventWithModifiers}`,
+        event: eventName,
+        handler,
+        modifiers: parseModifiers(parts.slice(1)),
+        elementId
+      });
+    }
+    if (events.length > 0)
+      elements.push({
+        originalTag: fullMatch,
+        elementId,
+        events,
+        startIndex,
+        endIndex
+      });
+  }
+  return elements;
+}
+function generateModifierChecks(event) {
+  const checks = [], { modifiers } = event;
+  if (modifiers.self)
+    checks.push("if ($event.target !== $el) return");
+  for (const key of modifiers.systemKeys)
+    checks.push(`if (!$event.${key}Key) return`);
+  if (modifiers.keys.length > 0) {
+    const keyChecks = modifiers.keys.map((k) => `$event.key === '${k}'`).join(" || ");
+    checks.push(`if (!(${keyChecks})) return`);
+  }
+  if (modifiers.mouse !== null) {
+    const button = MOUSE_BUTTONS[modifiers.mouse];
+    checks.push(`if ($event.button !== ${button}) return`);
+  }
+  if (modifiers.prevent)
+    checks.push("$event.preventDefault()");
+  if (modifiers.stop)
+    checks.push("$event.stopPropagation()");
+  return checks.join("; ");
+}
+function wrapHandler(handler, modifiers) {
+  let wrapped = handler;
+  if (modifiers.debounce !== null)
+    wrapped = `__stx_debounce(() => { ${wrapped} }, ${modifiers.debounce})`;
+  else if (modifiers.throttle !== null)
+    wrapped = `__stx_throttle(() => { ${wrapped} }, ${modifiers.throttle})`;
+  return wrapped;
+}
+function generateEventListener(event) {
+  const { modifiers } = event, elementId = event.elementId.replace(/\\/g, "\\\\").replace(/'/g, "\\'"), checks = generateModifierChecks(event), handler = wrapHandler(event.handler, modifiers), options = [];
+  if (modifiers.once)
+    options.push("once: true");
+  if (modifiers.capture)
+    options.push("capture: true");
+  if (modifiers.passive)
+    options.push("passive: true");
+  const optionsStr = options.length > 0 ? `, { ${options.join(", ")} }` : "", escapedHandler = handler.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+  if (event.event === "mounted")
+    return `
+  (function() {
+    var $el = document.getElementById('${elementId}');
+    if (!$el) return;
+    // Run mounted handler immediately (DOM is ready)
+    var scope = $el.closest('[data-stx-scope]');
+    if (scope && scope.__stx_execute) {
+      scope.__stx_execute('${escapedHandler}', null, $el);
+    }
+else {
+      __stx_runHandler('${escapedHandler}', null, $el);
+    }
+  })();`;
+  if (event.event === "unmounted")
+    return `
+  (function() {
+    var $el = document.getElementById('${elementId}');
+    if (!$el) return;
+    // Set up MutationObserver to detect removal
+    var observer = new MutationObserver(function(mutations) {
+      for (var m of mutations) {
+        for (var node of m.removedNodes) {
+          if (node === $el || (node.contains && node.contains($el))) {
+            observer.disconnect();
+            var scope = $el.closest('[data-stx-scope]');
+            if (scope && scope.__stx_execute) {
+              scope.__stx_execute('${escapedHandler}', null, $el);
+            }
+else {
+              __stx_runHandler('${escapedHandler}', null, $el);
+            }
+            return;
+          }
+        }
+      }
+    });
+    observer.observe(document.body, { childList: true, subtree: true });
+    // Store observer for cleanup
+    $el.__stx_unmount_observer = observer;
+  })();`;
+  return `
+  (function() {
+    var $el = document.getElementById('${elementId}');
+    if (!$el) return;
+    // eslint-disable-next-line pickier/no-unused-vars
+    $el.addEventListener('${event.event}', function($event) {
+      ${checks ? checks + ";" : ""}
+      // Find the closest reactive scope and execute within its context
+      var scope = $el.closest('[data-stx-scope]');
+      if (scope && scope.__stx_execute) {
+        scope.__stx_execute('${escapedHandler}', $event, $el);
+      }
+else {
+        // Fallback for non-reactive context (entity-safe; decoded + run in memory)
+        __stx_runHandler('${escapedHandler}', $event, $el);
+      }
+    }${optionsStr});
+  })();`;
+}
+function generateRuntimeScript(elements) {
+  if (elements.length === 0)
+    return "";
+  return `
+<script data-stx-events>
+(function() {
+  'use strict';
+
+  // Utility functions
+  function __stx_debounce(fn, delay) {
+    var timeout;
+    return function() {
+      var args = arguments;
+      var ctx = this;
+      clearTimeout(timeout);
+      timeout = setTimeout(function() { fn.apply(ctx, args); }, delay);
+    };
+  }
+
+  function __stx_throttle(fn, delay) {
+    var last = 0;
+    return function() {
+      var now = Date.now();
+      if (now - last >= delay) {
+        last = now;
+        fn.apply(this, arguments);
+      }
+    };
+  }
+
+  // Non-reactive fallback runner. The handler is embedded HTML-entity-encoded so
+  // the surrounding <script> can never contain raw markup (e.g. </script>); we
+  // decode it to JS only in memory here, then run it with $event/$el in scope.
+  function __stx_runHandler(h, $event, $el) {
+    var code = h
+      .replace(/&lt;/g, '<')
+      .replace(/&gt;/g, '>')
+      .replace(/&quot;/g, '"')
+      .replace(/&#39;/g, "'")
+      .replace(/&#x27;/g, "'")
+      .replace(/&amp;/g, '&');
+    try {
+      // eslint-disable-next-line no-new-func
+      (new Function('$event', '$el', code)).call($el, $event, $el);
+    }
+    catch (e) {
+      if (typeof console !== 'undefined') console.error('[stx] event handler error:', e);
+    }
+  }
+
+  // Event listeners
+  ${elements.flatMap((el) => el.events).map(generateEventListener).join(`
+`)}
+})();
+</script>`;
+}
+export function extractAndProcessEvents(template) {
+  const elements = findElementsWithEvents(template);
+  if (elements.length === 0)
+    return { template, bindings: [] };
+  let output = template;
+  const allBindings = [];
+  for (let i = elements.length - 1;i >= 0; i--) {
+    const element = elements[i];
+    let newTag = element.originalTag;
+    if (!newTag.includes(" id="))
+      newTag = newTag.replace(/^<([a-z][a-z0-9-]*)/, `<$1 id="${element.elementId}"`);
+    else {
+      const idMatch = newTag.match(/id=["']([^"']+)["']/);
+      if (idMatch)
+        for (const evt of element.events)
+          evt.elementId = idMatch[1];
+    }
+    for (const evt of element.events) {
+      const escapedAttr = evt.attribute.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), doubleQuotePattern = new RegExp(`\\s*${escapedAttr}\\s*=\\s*"[^"]*"`, "g"), singleQuotePattern = new RegExp(`\\s*${escapedAttr}\\s*=\\s*'[^']*'`, "g");
+      newTag = newTag.replace(doubleQuotePattern, "");
+      newTag = newTag.replace(singleQuotePattern, "");
+    }
+    output = output.slice(0, element.startIndex) + newTag + output.slice(element.endIndex);
+    allBindings.push(...element.events);
+  }
+  return { template: output, bindings: allBindings };
+}
+export function processEventDirectives(template, context, _filePath) {
+  if (/\b(?:state|derived|effect)\s*(?:<[^<>()]*>)?\s*\(/.test(template) || /@(?:model|show|for|if)\s*=/.test(template) || /data-stx(?:-auto)?(?![-\w])/.test(template))
+    return template;
+  if (context.__stx_sfc_mode) {
+    if (/x-data\s*=\s*["']/.test(template))
+      return template;
+    const { template: processed, bindings } = extractAndProcessEvents(template), existing = context.__stx_event_bindings || [];
+    context.__stx_event_bindings = [...existing, ...bindings];
+    return processed;
+  }
+  const elements = findElementsWithEvents(template);
+  if (elements.length === 0)
+    return template;
+  let output = template;
+  for (let i = elements.length - 1;i >= 0; i--) {
+    const element = elements[i];
+    let newTag = element.originalTag;
+    if (!newTag.includes(" id="))
+      newTag = newTag.replace(/^<([a-z][a-z0-9-]*)/, `<$1 id="${element.elementId}"`);
+    else {
+      const idMatch = newTag.match(/id=["']([^"']+)["']/);
+      if (idMatch)
+        for (const evt of element.events)
+          evt.elementId = idMatch[1];
+    }
+    for (const evt of element.events) {
+      const escapedAttr = evt.attribute.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), doubleQuotePattern = new RegExp(`\\s*${escapedAttr}\\s*=\\s*"[^"]*"`, "g"), singleQuotePattern = new RegExp(`\\s*${escapedAttr}\\s*=\\s*'[^']*'`, "g");
+      newTag = newTag.replace(doubleQuotePattern, "");
+      newTag = newTag.replace(singleQuotePattern, "");
+    }
+    output = output.slice(0, element.startIndex) + newTag + output.slice(element.endIndex);
+  }
+  const script = generateRuntimeScript(elements), bodyIdx = output.lastIndexOf("</body>");
+  if (bodyIdx !== -1)
+    output = output.slice(0, bodyIdx) + script + `
+` + output.slice(bodyIdx);
+  else
+    output += script;
+  return output;
+}
+export function hasEventDirectives(template) {
+  return /@[a-z]+(?:\.[a-z]+)*\s*=\s*["'][^"']*["']/i.test(template);
+}