@vielzeug/ore 26.11.9 → 26.11.11

package/dist/utils/dom.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"dom.cjs","names":["isReactive","ORE_ERRORS","require_errors","_vielzeug_ripple","resolveMaybeReactive","value","UNSAFE_CSS_CHARS","sanitizeCssToken","runAll","i","fns","removeNodes","node","nodes","createReplaceableSlot","cleanups","fn","next","URL_ATTRS","DANGEROUS_SCHEME_RE","URL_REMOVE_RE","URL_TRIM_RE","normalizeUrlForSchemeCheck","isDangerousUrl","attrWritePlans","ATTR_WRITE_PLAN_LIMIT","getAttrWritePlan","cached","name","lowerName","plan","setAttr","el","val","strVal","listen","listener","handler","options","toKebab","str","c","cssDeclarationName","cssDeclarationValue","resolved","resolveClassTokens","tokens","key","record","token","isStructuredValue"],"sources":["../../src/utils/dom.ts"],"sourcesContent":["/**\n * Low-level DOM utilities used throughout the runtime and binding layers.\n */\n\nimport { isReactive, type Readable } from '@vielzeug/ripple';\n\nimport { warn } from '../_dev';\nimport { ORE_ERRORS } from '../errors';\n\n/**\n * A value that may be a plain value, a reactive signal, or a getter function :\n * the shape `when()`, `each()`, `classMap()`, and `bind()` accept.\n * Exported so consumers can annotate their own composable parameters with it.\n */\nexport type MaybeReactive<T> = T | Readable<T> | (() => T);\n\n/**\n * Resolves a value that may be a plain value, a getter function, or a reactive\n * signal: the one shared three-way branch used by `classMap`/`styleMap`/`bind()`.\n */\nexport const resolveMaybeReactive = <T>(value: MaybeReactive<T>): T =>\n  typeof value === 'function' ? (value as () => T)() : isReactive(value) ? value.value : value;\n\n/**\n * Characters that can break out of a CSS declaration in an inline style value or property name.\n * Semicolons end the current declaration; braces are meaningful in stylesheet rules but not\n * inline style values, and signal an injection attempt there.\n */\nexport const UNSAFE_CSS_CHARS = /[;{}]/g;\n\nexport const sanitizeCssToken = (value: string): string => value.replace(UNSAFE_CSS_CHARS, '');\n\nexport const runAll = (fns: (() => void)[]): void => {\n  for (let i = fns.length - 1; i >= 0; i--) fns[i]?.();\n};\n\nexport const removeNodes = (nodes: Node[]): void => {\n  for (const node of nodes) {\n    (node as ChildNode).remove();\n  }\n};\n\n/**\n * Tracks \"whatever is currently rendered in one spot\": a list of live DOM nodes plus the\n * cleanup functions that were registered while mounting them. `clear()` tears both down and\n * resets to empty, ready for the next render.\n *\n * Every directive/binding that swaps its rendered content when a reactive source changes\n * (`when()`, `unsafeHtml()`, `each()`'s empty-list fallback, `applyHtmlBinding()`) needs exactly this\n * bookkeeping: this is the one shared implementation instead of four independently-maintained\n * `currentNodes`/`currentCleanups` variable pairs.\n */\nexport type ReplaceableSlot = {\n  /** Tears down every registered cleanup and removes every tracked node, then resets to empty. */\n  clear(): void;\n  /** Currently tracked nodes: read after mounting to know what's live. */\n  readonly nodes: Node[];\n  /** Pass as the `registerCleanup` callback to whatever mounts the next render. */\n  registerCleanup(fn: () => void): void;\n  /** Replace the tracked node list (call once mounting the next render is complete). */\n  setNodes(nodes: Node[]): void;\n};\n\nexport const createReplaceableSlot = (): ReplaceableSlot => {\n  let nodes: Node[] = [];\n  let cleanups: (() => void)[] = [];\n\n  return {\n    clear() {\n      runAll(cleanups);\n      removeNodes(nodes);\n      cleanups = [];\n      nodes = [];\n    },\n    get nodes() {\n      return nodes;\n    },\n    registerCleanup(fn) {\n      cleanups.push(fn);\n    },\n    setNodes(next) {\n      nodes = next;\n    },\n  };\n};\n\n/**\n * HTML attributes that accept URLs. Values bound to these attributes are\n * checked for dangerous schemes before being set.\n *\n * `srcdoc` is deliberately excluded: it holds raw HTML (not a URL), so scheme\n * checking doesn't apply: it's blocked unconditionally below, alongside `on*`.\n */\nconst URL_ATTRS = new Set([\n  'action',\n  'cite',\n  'codebase',\n  'data',\n  'formaction',\n  'href',\n  'manifest',\n  'ping',\n  'poster',\n  'src',\n  'xlink:href',\n]);\n\n/**\n * Schemes that execute JavaScript or can embed arbitrary HTML. Blocked\n * unconditionally in URL-accepting attributes.\n * Covers: javascript:, vbscript:, blob:, and data: variants that carry HTML/XML\n * or script-capable SVG. Plain data: image URIs (e.g. data:image/png) are\n * intentionally allowed.\n */\nconst DANGEROUS_SCHEME_RE =\n  /^\\s*(?:(?:javascript|vbscript|blob):|data:(?:[^,]*\\/(?:html|svg\\+xml)|application\\/(?:xhtml|xml)))/i;\n\n/**\n * Control characters and spaces, normalized away before the scheme check to\n * mirror the WHATWG URL parser browsers use when resolving URL attributes: it\n * removes every ASCII tab/LF/CR anywhere in the input and trims C0 controls and\n * spaces from both ends. So `java\\tscript:alert(1)` executes even though the raw\n * string does not start with `javascript:`. Testing the normalized form closes\n * that gap while leaving benign URLs (e.g. one with an internal space) untouched.\n */\nconst URL_REMOVE_RE = /[\\t\\n\\r]/g;\nconst URL_TRIM_RE = /^[\\s\\p{C}]+|[\\s\\p{C}]+$/gu;\n\nconst normalizeUrlForSchemeCheck = (value: string): string => value.replace(URL_REMOVE_RE, '').replace(URL_TRIM_RE, '');\n\nconst isDangerousUrl = (value: string): boolean => DANGEROUS_SCHEME_RE.test(normalizeUrlForSchemeCheck(value));\n\n/**\n * The name-only classification `setAttr` branches on. Attribute names repeat\n * constantly on hot update paths (a template binds `class`/`href`/... once and\n * writes them on every signal change), so the regex/toLowerCase/set-lookup\n * pass runs once per name and every write just reads the cached plan.\n */\ntype AttrWritePlan = {\n  event: boolean;\n  srcdoc: boolean;\n  url: boolean;\n};\n\nconst attrWritePlans = new Map<string, AttrWritePlan>();\nconst ATTR_WRITE_PLAN_LIMIT = 512;\n\nconst getAttrWritePlan = (name: string): AttrWritePlan => {\n  const cached = attrWritePlans.get(name);\n\n  if (cached) return cached;\n\n  const lowerName = name.toLowerCase();\n  const plan: AttrWritePlan = {\n    event: /^on[a-z]/i.test(name),\n    srcdoc: lowerName === 'srcdoc',\n    url: URL_ATTRS.has(lowerName),\n  };\n\n  if (attrWritePlans.size >= ATTR_WRITE_PLAN_LIMIT) attrWritePlans.clear();\n\n  attrWritePlans.set(name, plan);\n\n  return plan;\n};\n\nexport const setAttr = (el: Element, name: string, val: unknown): void => {\n  const plan = getAttrWritePlan(name);\n\n  if (plan.event) {\n    warn(\n      `Blocked setAttribute(\"${name}\", ...): inline event handler attributes are not supported. Use @${name.slice(2)} binding syntax instead.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  if (plan.srcdoc) {\n    warn(\n      `Blocked setAttribute(\"srcdoc\", ...): \"srcdoc\" holds raw HTML, not a URL, and is not supported via attribute binding. Sanitize untrusted content, then use unsafeHtml() if HTML injection is required.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  if (val == null || val === false) {\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  const strVal = val === true ? 'true' : String(val);\n\n  if (plan.url && isDangerousUrl(strVal)) {\n    warn(\n      `Blocked dangerous URL scheme in attribute \"${name}\". Only safe URLs are permitted in URL-accepting attributes.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  el.setAttribute(name, strVal);\n};\n\nexport const listen = (\n  el: EventTarget | null | undefined,\n  name: string,\n  handler: EventListener,\n  options?: AddEventListenerOptions,\n): (() => void) => {\n  if (!el) {\n    warn(ORE_ERRORS.listenNullTarget(name));\n\n    return () => {};\n  }\n\n  const listener: EventListener = handler;\n\n  el.addEventListener(name, listener, options);\n\n  return () => el.removeEventListener(name, listener, options);\n};\n\nexport const toKebab = (str: string): string => str.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`);\n\n/**\n * Normalize a CSS property name for use in a declaration (camelCase → kebab-case,\n * injection characters stripped). Custom properties (`--*`) are case-sensitive, so\n * they skip the kebab conversion. Shared by `styleMap()` (template side) and\n * `bind({ style })` (host side) so both sanitize identically.\n */\nexport const cssDeclarationName = (name: string): string =>\n  sanitizeCssToken(name.startsWith('--') ? name : toKebab(name));\n\n/**\n * Resolve a style value to its declaration text ('' for null/false/empty).\n * Shared by `styleMap()` and `bind({ style })`.\n */\nexport const cssDeclarationValue = (value: unknown): string => {\n  const resolved = resolveMaybeReactive(value as MaybeReactive<string | number | null | undefined | false>);\n\n  if (resolved == null || resolved === false) return '';\n\n  return sanitizeCssToken(String(resolved));\n};\n\n/**\n * Resolve a class map to the set of active class tokens: keys with truthy\n * (possibly reactive) values, whitespace stripped from each key (spaces would\n * inject extra class tokens). Shared by `classMap()` (joins the set into a\n * class attribute) and `bind({ class })` (diffs the set against classList).\n */\nexport const resolveClassTokens = (record: Record<string, MaybeReactive<boolean>>): Set<string> => {\n  const tokens = new Set<string>();\n\n  for (const [key, value] of Object.entries(record)) {\n    if (!resolveMaybeReactive(value)) continue;\n\n    const token = key.replace(/\\s+/g, '');\n\n    if (token) tokens.add(token);\n  }\n\n  return tokens;\n};\n\nexport const isStructuredValue = (value: unknown): value is object =>\n  Array.isArray(value) || (typeof value === 'object' && value !== null);\n"],"mappings":"A,0FAoBA,IAAaI,EAA2B,GACtC,OAAOC,GAAU,WAAcA,EAAkB,GAAA,EAAIL,EAAAA,WAAAA,CAAWK,CAAK,EAAIA,EAAM,MAAQA,EAO5EC,EAAmB,SAEnBC,EAAoB,GAA0BF,EAAM,QAAQC,EAAkB,EAAE,EAEhFE,EAAU,GAA8B,CACnD,IAAK,IAAIC,EAAIC,EAAI,OAAS,EAAGD,GAAK,EAAG,IAAKC,EAAID,EAAE,GAAG,CACrD,EAEaE,EAAe,GAAwB,CAClD,IAAK,IAAMC,KAAQC,EACjBD,EAAoB,OAAO,CAE/B,EAuBaE,MAA+C,CAC1D,IAAID,EAAgB,CAAC,EACjBE,EAA2B,CAAC,EAEhC,MAAO,CACL,OAAQ,CACNP,EAAOO,CAAQ,EACfJ,EAAYE,CAAK,EACjB,EAAW,CAAC,EACZ,EAAQ,CAAC,CACX,EACA,IAAI,OAAQ,CACV,OAAOA,CACT,EACA,gBAAgB,EAAI,CAClBE,EAAS,KAAKC,CAAE,CAClB,EACA,SAAS,EAAM,CACb,EAAQC,CACV,CACF,CACF,EASMC,EAAY,IAAI,IAAI,CACxB,SACA,OACA,WACA,OACA,aACA,OACA,WACA,OACA,SACA,MACA,YACF,CAAC,EASKC,EACJ,sGAUIC,EAAgB,YAChBC,EAAc,4BAEdC,EAA8B,GAA0BjB,EAAM,QAAQe,EAAe,EAAE,CAAC,CAAC,QAAQC,EAAa,EAAE,EAEhHE,EAAkB,GAA2BJ,EAAoB,KAAKG,EAA2BjB,CAAK,CAAC,EAcvGmB,EAAiB,IAAI,IACrBC,EAAwB,IAExBC,EAAoB,GAAgC,CACxD,IAAMC,EAASH,EAAe,IAAII,CAAI,EAEtC,GAAID,EAAQ,OAAOA,EAEnB,IAAME,EAAYD,EAAK,YAAY,EAC7BE,EAAsB,CAC1B,MAAO,YAAY,KAAKF,CAAI,EAC5B,OAAQC,IAAc,SACtB,IAAKX,EAAU,IAAIW,CAAS,CAC9B,EAMA,OAJIL,EAAe,MAAQC,GAAuBD,EAAe,MAAM,EAEvEA,EAAe,IAAII,EAAME,CAAI,EAEtBA,CACT,EAEaC,GAAW,EAAa,EAAc,IAAuB,CACxE,IAAMD,EAAOJ,EAAiBE,CAAI,EAElC,GAAIE,EAAK,MAAO,CAEZ,GAAyBF,EAAzB,EAAiGA,EAAK,MAAM,CAAC,EAA7G,EAEFI,EAAG,gBAAgBJ,CAAI,EAEvB,MACF,CAWA,GATIE,EAAK,QASLG,GAAO,MAAQA,IAAQ,GAAO,CAChCD,EAAG,gBAAgBJ,CAAI,EAEvB,MACF,CAEA,IAAMM,EAASD,IAAQ,GAAO,OAAS,OAAOA,CAAG,EAE7CH,EAAK,KAAOP,EAAeW,CAAM,GAEjC,GAA8CN,EAA9C,EAEFI,EAAG,gBAAgBJ,CAAI,GAKzBI,EAAG,aAAaJ,EAAMM,CAAM,CAC9B,EAEaC,GACX,EACA,EACA,EACA,IACiB,CACjB,GAAI,CAACH,EAGH,OAFK/B,EAAAA,WAAW,iBAAiB2B,CAAI,MAExB,CAAC,EAGhB,IAAMQ,EAA0BC,EAIhC,OAFAL,EAAG,iBAAiBJ,EAAMQ,EAAUE,CAAO,MAE9BN,EAAG,oBAAoBJ,EAAMQ,EAAUE,CAAO,CAC7D,EAEaC,EAAW,GAAwBC,EAAI,QAAQ,SAAW,GAAM,IAAIC,EAAE,YAAY,GAAG,EAQrFC,EAAsB,GACjCnC,EAAiBqB,EAAK,WAAW,IAAI,EAAIA,EAAOW,EAAQX,CAAI,CAAC,EAMlDe,EAAuB,GAA2B,CAC7D,IAAMC,EAAWxC,EAAqBC,CAAkE,EAIxG,OAFIuC,GAAY,MAAQA,IAAa,GAAc,GAE5CrC,EAAiB,OAAOqC,CAAQ,CAAC,CAC1C,EAQaC,EAAsB,GAAgE,CACjG,IAAMC,EAAS,IAAI,IAEnB,IAAK,GAAM,CAACC,EAAK1C,KAAU,OAAO,QAAQ2C,CAAM,EAAG,CACjD,GAAI,CAAC5C,EAAqBC,CAAK,EAAG,SAElC,IAAM4C,EAAQF,EAAI,QAAQ,OAAQ,EAAE,EAEhCE,GAAOH,EAAO,IAAIG,CAAK,CAC7B,CAEA,OAAOH,CACT,EAEaI,EAAqB,GAChC,MAAM,QAAQ7C,CAAK,GAAM,OAAOA,GAAU,YAAYA,E"}
+{"version":3,"file":"dom.cjs","names":["isReactive","createScope","ORE_ERRORS","require_errors","_vielzeug_ripple","resolveMaybeReactive","value","UNSAFE_CSS_CHARS","sanitizeCssToken","removeNodes","node","nodes","createReplaceableSlot","scope","clear","next","fn","error","nextNodes","URL_ATTRS","DANGEROUS_SCHEME_RE","URL_REMOVE_RE","URL_TRIM_RE","normalizeUrlForSchemeCheck","isDangerousUrl","attrWritePlans","ATTR_WRITE_PLAN_LIMIT","getAttrWritePlan","cached","name","lowerName","plan","setAttr","el","val","strVal","listen","listener","handler","options","toKebab","str","c","cssDeclarationName","cssDeclarationValue","resolved","resolveClassTokens","tokens","key","record","token","isStructuredValue"],"sources":["../../src/utils/dom.ts"],"sourcesContent":["/**\n * Low-level DOM utilities used throughout the runtime and binding layers.\n */\n\nimport { createScope, isReactive, type Readable, type Scope } from '@vielzeug/ripple';\n\nimport { warn } from '../_dev';\nimport { ORE_ERRORS } from '../errors';\n\n/**\n * A value that may be a plain value, a reactive signal, or a getter function :\n * the shape `when()`, `each()`, `classMap()`, and `bind()` accept.\n * Exported so consumers can annotate their own composable parameters with it.\n */\nexport type MaybeReactive<T> = T | Readable<T> | (() => T);\n\n/**\n * Resolves a value that may be a plain value, a getter function, or a reactive\n * signal: the one shared three-way branch used by `classMap`/`styleMap`/`bind()`.\n */\nexport const resolveMaybeReactive = <T>(value: MaybeReactive<T>): T =>\n  typeof value === 'function' ? (value as () => T)() : isReactive(value) ? value.value : value;\n\n/**\n * Characters that can break out of a CSS declaration in an inline style value or property name.\n * Semicolons end the current declaration; braces are meaningful in stylesheet rules but not\n * inline style values, and signal an injection attempt there.\n */\nexport const UNSAFE_CSS_CHARS = /[;{}]/g;\n\nexport const sanitizeCssToken = (value: string): string => value.replace(UNSAFE_CSS_CHARS, '');\n\nexport const removeNodes = (nodes: Node[]): void => {\n  for (const node of nodes) {\n    (node as ChildNode).remove();\n  }\n};\n\n/**\n * Tracks \"whatever is currently rendered in one spot\": a list of live DOM nodes plus the\n * ripple scope that owns the effects and `onCleanup` callbacks registered while mounting\n * them. `clear()` disposes that scope and removes the nodes.\n *\n * Every directive/binding that swaps its rendered content when a reactive source changes\n * (`when()`, `unsafeHtml()`, `applyHtmlBinding()`) mounts the next render inside `render()`,\n * so nested effects belong to this slot rather than to whichever effect happens to be\n * running. `scope.run()` clears the transient effect-run owner.\n */\nexport type ReplaceableSlot = {\n  /** Dispose the current render scope and remove every tracked node. */\n  clear(): void;\n  /** Currently tracked nodes. */\n  readonly nodes: Node[];\n  /**\n   * Dispose the previous render, then run `fn` inside a fresh scope. Call\n   * `setNodes` from `fn` once mounting finishes.\n   */\n  render<T>(fn: () => T): T;\n  /** Replace the tracked node list (call once mounting the next render is complete). */\n  setNodes(nodes: Node[]): void;\n};\n\nexport const createReplaceableSlot = (): ReplaceableSlot => {\n  let nodes: Node[] = [];\n  let scope: Scope | null = null;\n\n  const clear = (): void => {\n    scope?.dispose();\n    scope = null;\n    removeNodes(nodes);\n    nodes = [];\n  };\n\n  return {\n    clear,\n    get nodes() {\n      return nodes;\n    },\n    render(fn) {\n      clear();\n\n      const next = createScope();\n\n      scope = next;\n\n      try {\n        return next.run(fn);\n      } catch (error) {\n        next.dispose();\n        scope = null;\n        throw error;\n      }\n    },\n    setNodes(nextNodes) {\n      nodes = nextNodes;\n    },\n  };\n};\n\n/**\n * HTML attributes that accept URLs. Values bound to these attributes are\n * checked for dangerous schemes before being set.\n *\n * `srcdoc` is deliberately excluded: it holds raw HTML (not a URL), so scheme\n * checking doesn't apply: it's blocked unconditionally below, alongside `on*`.\n */\nconst URL_ATTRS = new Set([\n  'action',\n  'cite',\n  'codebase',\n  'data',\n  'formaction',\n  'href',\n  'manifest',\n  'ping',\n  'poster',\n  'src',\n  'xlink:href',\n]);\n\n/**\n * Schemes that execute JavaScript or can embed arbitrary HTML. Blocked\n * unconditionally in URL-accepting attributes.\n * Covers: javascript:, vbscript:, blob:, and data: variants that carry HTML/XML\n * or script-capable SVG. Plain data: image URIs (e.g. data:image/png) are\n * intentionally allowed.\n */\nconst DANGEROUS_SCHEME_RE =\n  /^\\s*(?:(?:javascript|vbscript|blob):|data:(?:[^,]*\\/(?:html|svg\\+xml)|application\\/(?:xhtml|xml)))/i;\n\n/**\n * Control characters and spaces, normalized away before the scheme check to\n * mirror the WHATWG URL parser browsers use when resolving URL attributes: it\n * removes every ASCII tab/LF/CR anywhere in the input and trims C0 controls and\n * spaces from both ends. So `java\\tscript:alert(1)` executes even though the raw\n * string does not start with `javascript:`. Testing the normalized form closes\n * that gap while leaving benign URLs (e.g. one with an internal space) untouched.\n */\nconst URL_REMOVE_RE = /[\\t\\n\\r]/g;\nconst URL_TRIM_RE = /^[\\s\\p{C}]+|[\\s\\p{C}]+$/gu;\n\nconst normalizeUrlForSchemeCheck = (value: string): string => value.replace(URL_REMOVE_RE, '').replace(URL_TRIM_RE, '');\n\nconst isDangerousUrl = (value: string): boolean => DANGEROUS_SCHEME_RE.test(normalizeUrlForSchemeCheck(value));\n\n/**\n * The name-only classification `setAttr` branches on. Attribute names repeat\n * constantly on hot update paths (a template binds `class`/`href`/... once and\n * writes them on every signal change), so the regex/toLowerCase/set-lookup\n * pass runs once per name and every write just reads the cached plan.\n */\ntype AttrWritePlan = {\n  event: boolean;\n  srcdoc: boolean;\n  url: boolean;\n};\n\nconst attrWritePlans = new Map<string, AttrWritePlan>();\nconst ATTR_WRITE_PLAN_LIMIT = 512;\n\nconst getAttrWritePlan = (name: string): AttrWritePlan => {\n  const cached = attrWritePlans.get(name);\n\n  if (cached) return cached;\n\n  const lowerName = name.toLowerCase();\n  const plan: AttrWritePlan = {\n    event: /^on[a-z]/i.test(name),\n    srcdoc: lowerName === 'srcdoc',\n    url: URL_ATTRS.has(lowerName),\n  };\n\n  if (attrWritePlans.size >= ATTR_WRITE_PLAN_LIMIT) attrWritePlans.clear();\n\n  attrWritePlans.set(name, plan);\n\n  return plan;\n};\n\nexport const setAttr = (el: Element, name: string, val: unknown): void => {\n  const plan = getAttrWritePlan(name);\n\n  if (plan.event) {\n    warn(\n      `Blocked setAttribute(\"${name}\", ...): inline event handler attributes are not supported. Use @${name.slice(2)} binding syntax instead.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  if (plan.srcdoc) {\n    warn(\n      `Blocked setAttribute(\"srcdoc\", ...): \"srcdoc\" holds raw HTML, not a URL, and is not supported via attribute binding. Sanitize untrusted content, then use unsafeHtml() if HTML injection is required.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  if (val == null || val === false) {\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  const strVal = val === true ? 'true' : String(val);\n\n  if (plan.url && isDangerousUrl(strVal)) {\n    warn(\n      `Blocked dangerous URL scheme in attribute \"${name}\". Only safe URLs are permitted in URL-accepting attributes.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  el.setAttribute(name, strVal);\n};\n\nexport const listen = (\n  el: EventTarget | null | undefined,\n  name: string,\n  handler: EventListener,\n  options?: AddEventListenerOptions,\n): (() => void) => {\n  if (!el) {\n    warn(ORE_ERRORS.listenNullTarget(name));\n\n    return () => {};\n  }\n\n  const listener: EventListener = handler;\n\n  el.addEventListener(name, listener, options);\n\n  return () => el.removeEventListener(name, listener, options);\n};\n\nexport const toKebab = (str: string): string => str.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`);\n\n/**\n * Normalize a CSS property name for use in a declaration (camelCase → kebab-case,\n * injection characters stripped). Custom properties (`--*`) are case-sensitive, so\n * they skip the kebab conversion. Shared by `styleMap()` (template side) and\n * `bind({ style })` (host side) so both sanitize identically.\n */\nexport const cssDeclarationName = (name: string): string =>\n  sanitizeCssToken(name.startsWith('--') ? name : toKebab(name));\n\n/**\n * Resolve a style value to its declaration text ('' for null/false/empty).\n * Shared by `styleMap()` and `bind({ style })`.\n */\nexport const cssDeclarationValue = (value: unknown): string => {\n  const resolved = resolveMaybeReactive(value as MaybeReactive<string | number | null | undefined | false>);\n\n  if (resolved == null || resolved === false) return '';\n\n  return sanitizeCssToken(String(resolved));\n};\n\n/**\n * Resolve a class map to the set of active class tokens: keys with truthy\n * (possibly reactive) values, whitespace stripped from each key (spaces would\n * inject extra class tokens). Shared by `classMap()` (joins the set into a\n * class attribute) and `bind({ class })` (diffs the set against classList).\n */\nexport const resolveClassTokens = (record: Record<string, MaybeReactive<boolean>>): Set<string> => {\n  const tokens = new Set<string>();\n\n  for (const [key, value] of Object.entries(record)) {\n    if (!resolveMaybeReactive(value)) continue;\n\n    const token = key.replace(/\\s+/g, '');\n\n    if (token) tokens.add(token);\n  }\n\n  return tokens;\n};\n\nexport const isStructuredValue = (value: unknown): value is object =>\n  Array.isArray(value) || (typeof value === 'object' && value !== null);\n"],"mappings":"A,0FAoBA,IAAaK,EAA2B,GACtC,OAAOC,GAAU,WAAcA,EAAkB,GAAA,EAAIN,EAAAA,WAAAA,CAAWM,CAAK,EAAIA,EAAM,MAAQA,EAO5EC,EAAmB,SAEnBC,EAAoB,GAA0BF,EAAM,QAAQC,EAAkB,EAAE,EAEhFE,EAAe,GAAwB,CAClD,IAAK,IAAMC,KAAQC,EACjBD,EAAoB,OAAO,CAE/B,EA0BaE,MAA+C,CAC1D,IAAID,EAAgB,CAAC,EACjBE,EAAsB,KAEpBC,MAAoB,CACxBD,GAAO,QAAQ,EACf,EAAQ,KACRJ,EAAYE,CAAK,EACjB,EAAQ,CAAC,CACX,EAEA,MAAO,CACL,QACA,IAAI,OAAQ,CACV,OAAOA,CACT,EACA,OAAO,EAAI,CACTG,EAAM,EAEN,IAAMC,GAAA,EAAOd,EAAAA,YAAAA,CAAY,EAEzB,EAAQc,EAER,GAAI,CACF,OAAOA,EAAK,IAAIC,CAAE,CACpB,OAASC,EAAO,CAGd,MAFAF,EAAK,QAAQ,EACb,EAAQ,KACFE,CACR,CACF,EACA,SAAS,EAAW,CAClB,EAAQC,CACV,CACF,CACF,EASMC,EAAY,IAAI,IAAI,CACxB,SACA,OACA,WACA,OACA,aACA,OACA,WACA,OACA,SACA,MACA,YACF,CAAC,EASKC,EACJ,sGAUIC,EAAgB,YAChBC,EAAc,4BAEdC,EAA8B,GAA0BjB,EAAM,QAAQe,EAAe,EAAE,CAAC,CAAC,QAAQC,EAAa,EAAE,EAEhHE,EAAkB,GAA2BJ,EAAoB,KAAKG,EAA2BjB,CAAK,CAAC,EAcvGmB,EAAiB,IAAI,IACrBC,EAAwB,IAExBC,EAAoB,GAAgC,CACxD,IAAMC,EAASH,EAAe,IAAII,CAAI,EAEtC,GAAID,EAAQ,OAAOA,EAEnB,IAAME,EAAYD,EAAK,YAAY,EAC7BE,EAAsB,CAC1B,MAAO,YAAY,KAAKF,CAAI,EAC5B,OAAQC,IAAc,SACtB,IAAKX,EAAU,IAAIW,CAAS,CAC9B,EAMA,OAJIL,EAAe,MAAQC,GAAuBD,EAAe,MAAM,EAEvEA,EAAe,IAAII,EAAME,CAAI,EAEtBA,CACT,EAEaC,GAAW,EAAa,EAAc,IAAuB,CACxE,IAAMD,EAAOJ,EAAiBE,CAAI,EAElC,GAAIE,EAAK,MAAO,CAEZ,GAAyBF,EAAzB,EAAiGA,EAAK,MAAM,CAAC,EAA7G,EAEFI,EAAG,gBAAgBJ,CAAI,EAEvB,MACF,CAWA,GATIE,EAAK,QASLG,GAAO,MAAQA,IAAQ,GAAO,CAChCD,EAAG,gBAAgBJ,CAAI,EAEvB,MACF,CAEA,IAAMM,EAASD,IAAQ,GAAO,OAAS,OAAOA,CAAG,EAE7CH,EAAK,KAAOP,EAAeW,CAAM,GAEjC,GAA8CN,EAA9C,EAEFI,EAAG,gBAAgBJ,CAAI,GAKzBI,EAAG,aAAaJ,EAAMM,CAAM,CAC9B,EAEaC,GACX,EACA,EACA,EACA,IACiB,CACjB,GAAI,CAACH,EAGH,OAFK/B,EAAAA,WAAW,iBAAiB2B,CAAI,MAExB,CAAC,EAGhB,IAAMQ,EAA0BC,EAIhC,OAFAL,EAAG,iBAAiBJ,EAAMQ,EAAUE,CAAO,MAE9BN,EAAG,oBAAoBJ,EAAMQ,EAAUE,CAAO,CAC7D,EAEaC,EAAW,GAAwBC,EAAI,QAAQ,SAAW,GAAM,IAAIC,EAAE,YAAY,GAAG,EAQrFC,EAAsB,GACjCnC,EAAiBqB,EAAK,WAAW,IAAI,EAAIA,EAAOW,EAAQX,CAAI,CAAC,EAMlDe,EAAuB,GAA2B,CAC7D,IAAMC,EAAWxC,EAAqBC,CAAkE,EAIxG,OAFIuC,GAAY,MAAQA,IAAa,GAAc,GAE5CrC,EAAiB,OAAOqC,CAAQ,CAAC,CAC1C,EAQaC,EAAsB,GAAgE,CACjG,IAAMC,EAAS,IAAI,IAEnB,IAAK,GAAM,CAACC,EAAK1C,KAAU,OAAO,QAAQ2C,CAAM,EAAG,CACjD,GAAI,CAAC5C,EAAqBC,CAAK,EAAG,SAElC,IAAM4C,EAAQF,EAAI,QAAQ,OAAQ,EAAE,EAEhCE,GAAOH,EAAO,IAAIG,CAAK,CAC7B,CAEA,OAAOH,CACT,EAEaI,EAAqB,GAChC,MAAM,QAAQ7C,CAAK,GAAM,OAAOA,GAAU,YAAYA,E"}

package/dist/utils/dom.d.ts

@@ -20,25 +20,27 @@ export declare const resolveMaybeReactive: <T>(value: MaybeReactive<T>) => T;
  */
 export declare const UNSAFE_CSS_CHARS: RegExp;
 export declare const sanitizeCssToken: (value: string) => string;
-export declare const runAll: (fns: (() => void)[]) => void;
 export declare const removeNodes: (nodes: Node[]) => void;
 /**
  * Tracks "whatever is currently rendered in one spot": a list of live DOM nodes plus the
- * cleanup functions that were registered while mounting them. `clear()` tears both down and
- * resets to empty, ready for the next render.
+ * ripple scope that owns the effects and `onCleanup` callbacks registered while mounting
+ * them. `clear()` disposes that scope and removes the nodes.
  *
  * Every directive/binding that swaps its rendered content when a reactive source changes
- * (`when()`, `unsafeHtml()`, `each()`'s empty-list fallback, `applyHtmlBinding()`) needs exactly this
- * bookkeeping: this is the one shared implementation instead of four independently-maintained
- * `currentNodes`/`currentCleanups` variable pairs.
+ * (`when()`, `unsafeHtml()`, `applyHtmlBinding()`) mounts the next render inside `render()`,
+ * so nested effects belong to this slot rather than to whichever effect happens to be
+ * running. `scope.run()` clears the transient effect-run owner.
  */
 export type ReplaceableSlot = {
-    /** Tears down every registered cleanup and removes every tracked node, then resets to empty. */
+    /** Dispose the current render scope and remove every tracked node. */
     clear(): void;
-    /** Currently tracked nodes: read after mounting to know what's live. */
+    /** Currently tracked nodes. */
     readonly nodes: Node[];
-    /** Pass as the `registerCleanup` callback to whatever mounts the next render. */
-    registerCleanup(fn: () => void): void;
+    /**
+     * Dispose the previous render, then run `fn` inside a fresh scope. Call
+     * `setNodes` from `fn` once mounting finishes.
+     */
+    render<T>(fn: () => T): T;
     /** Replace the tracked node list (call once mounting the next render is complete). */
     setNodes(nodes: Node[]): void;
 };

package/dist/utils/dom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dom.d.ts","sourceRoot":"","sources":["../../src/utils/dom.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK7D;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,OAAO,aAAa,CAAC,CAAC,CAAC,KAAG,CAC4B,CAAC;AAE/F;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAW,CAAC;AAEzC,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,MAA6C,CAAC;AAE/F,eAAO,MAAM,MAAM,GAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,KAAG,IAE5C,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,OAAO,IAAI,EAAE,KAAG,IAI3C,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,gGAAgG;IAChG,KAAK,IAAI,IAAI,CAAC;IACd,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACvB,iFAAiF;IACjF,eAAe,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IACtC,sFAAsF;IACtF,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,qBAAqB,QAAO,eAqBxC,CAAC;AAkFF,eAAO,MAAM,OAAO,GAAI,IAAI,OAAO,EAAE,MAAM,MAAM,EAAE,KAAK,OAAO,KAAG,IAuCjE,CAAC;AAEF,eAAO,MAAM,MAAM,GACjB,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS,EAClC,MAAM,MAAM,EACZ,SAAS,aAAa,EACtB,UAAU,uBAAuB,KAChC,CAAC,MAAM,IAAI,CAYb,CAAC;AAEF,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAA6D,CAAC;AAEpG;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MACc,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,OAAO,KAAG,MAMpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,KAAG,GAAG,CAAC,MAAM,CAY7F,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MACW,CAAC"}
+{"version":3,"file":"dom.d.ts","sourceRoot":"","sources":["../../src/utils/dom.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAA2B,KAAK,QAAQ,EAAc,MAAM,kBAAkB,CAAC;AAKtF;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,OAAO,aAAa,CAAC,CAAC,CAAC,KAAG,CAC4B,CAAC;AAE/F;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAW,CAAC;AAEzC,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,MAA6C,CAAC;AAE/F,eAAO,MAAM,WAAW,GAAI,OAAO,IAAI,EAAE,KAAG,IAI3C,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,sEAAsE;IACtE,KAAK,IAAI,IAAI,CAAC;IACd,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,qBAAqB,QAAO,eAmCxC,CAAC;AAkFF,eAAO,MAAM,OAAO,GAAI,IAAI,OAAO,EAAE,MAAM,MAAM,EAAE,KAAK,OAAO,KAAG,IAuCjE,CAAC;AAEF,eAAO,MAAM,MAAM,GACjB,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS,EAClC,MAAM,MAAM,EACZ,SAAS,aAAa,EACtB,UAAU,uBAAuB,KAChC,CAAC,MAAM,IAAI,CAYb,CAAC;AAEF,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAA6D,CAAC;AAEpG;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MACc,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,OAAO,KAAG,MAMpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,KAAG,GAAG,CAAC,MAAM,CAY7F,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MACW,CAAC"}

package/dist/utils/dom.js

@@ -1,2 +1,2 @@
-import"../_dev.js";import{ORE_ERRORS as e}from"../errors.js";import{isReactive as t}from"@vielzeug/ripple";var n=e=>typeof e==`function`?e():t(e)?e.value:e,r=/[;{}]/g,i=e=>e.replace(r,``),a=e=>{for(let t=e.length-1;t>=0;t--)e[t]?.()},o=e=>{for(let t of e)t.remove()},s=()=>{let e=[],t=[];return{clear(){a(t),o(e),t=[],e=[]},get nodes(){return e},registerCleanup(e){t.push(e)},setNodes(t){e=t}}},c=/* @__PURE__ */ new Set([`action`,`cite`,`codebase`,`data`,`formaction`,`href`,`manifest`,`ping`,`poster`,`src`,`xlink:href`]),l=/^\s*(?:(?:javascript|vbscript|blob):|data:(?:[^,]*\/(?:html|svg\+xml)|application\/(?:xhtml|xml)))/i,u=/[\t\n\r]/g,d=/^[\s\p{C}]+|[\s\p{C}]+$/gu,f=e=>e.replace(u,``).replace(d,``),p=e=>l.test(f(e)),m=/* @__PURE__ */ new Map,h=512,g=e=>{let t=m.get(e);if(t)return t;let n=e.toLowerCase(),r={event:/^on[a-z]/i.test(e),srcdoc:n===`srcdoc`,url:c.has(n)};return m.size>=h&&m.clear(),m.set(e,r),r},_=(e,t,n)=>{let r=g(t);if(r.event){`${t}${t.slice(2)}`,e.removeAttribute(t);return}if(r.srcdoc||n==null||n===!1){e.removeAttribute(t);return}let i=n===!0?`true`:String(n);r.url&&p(i)?(`${t}`,e.removeAttribute(t)):e.setAttribute(t,i)},v=(t,n,r,i)=>{if(!t)return e.listenNullTarget(n),()=>{};let a=r;return t.addEventListener(n,a,i),()=>t.removeEventListener(n,a,i)},y=e=>e.replace(/[A-Z]/g,e=>`-${e.toLowerCase()}`),b=e=>i(e.startsWith(`--`)?e:y(e)),x=e=>{let t=n(e);return t==null||t===!1?``:i(String(t))},S=e=>{let t=/* @__PURE__ */ new Set;for(let[r,i]of Object.entries(e)){if(!n(i))continue;let e=r.replace(/\s+/g,``);e&&t.add(e)}return t},C=e=>Array.isArray(e)||typeof e==`object`&&!!e;export{r as UNSAFE_CSS_CHARS,s as createReplaceableSlot,b as cssDeclarationName,x as cssDeclarationValue,C as isStructuredValue,v as listen,o as removeNodes,S as resolveClassTokens,n as resolveMaybeReactive,a as runAll,i as sanitizeCssToken,_ as setAttr,y as toKebab};
+import"../_dev.js";import{ORE_ERRORS as e}from"../errors.js";import{createScope as t,isReactive as n}from"@vielzeug/ripple";var r=e=>typeof e==`function`?e():n(e)?e.value:e,i=/[;{}]/g,a=e=>e.replace(i,``),o=e=>{for(let t of e)t.remove()},s=()=>{let e=[],n=null,r=()=>{n?.dispose(),n=null,o(e),e=[]};return{clear:r,get nodes(){return e},render(e){r();let i=t();n=i;try{return i.run(e)}catch(e){throw i.dispose(),n=null,e}},setNodes(t){e=t}}},c=/* @__PURE__ */ new Set([`action`,`cite`,`codebase`,`data`,`formaction`,`href`,`manifest`,`ping`,`poster`,`src`,`xlink:href`]),l=/^\s*(?:(?:javascript|vbscript|blob):|data:(?:[^,]*\/(?:html|svg\+xml)|application\/(?:xhtml|xml)))/i,u=/[\t\n\r]/g,d=/^[\s\p{C}]+|[\s\p{C}]+$/gu,f=e=>e.replace(u,``).replace(d,``),p=e=>l.test(f(e)),m=/* @__PURE__ */ new Map,h=512,g=e=>{let t=m.get(e);if(t)return t;let n=e.toLowerCase(),r={event:/^on[a-z]/i.test(e),srcdoc:n===`srcdoc`,url:c.has(n)};return m.size>=h&&m.clear(),m.set(e,r),r},_=(e,t,n)=>{let r=g(t);if(r.event){`${t}${t.slice(2)}`,e.removeAttribute(t);return}if(r.srcdoc||n==null||n===!1){e.removeAttribute(t);return}let i=n===!0?`true`:String(n);r.url&&p(i)?(`${t}`,e.removeAttribute(t)):e.setAttribute(t,i)},v=(t,n,r,i)=>{if(!t)return e.listenNullTarget(n),()=>{};let a=r;return t.addEventListener(n,a,i),()=>t.removeEventListener(n,a,i)},y=e=>e.replace(/[A-Z]/g,e=>`-${e.toLowerCase()}`),b=e=>a(e.startsWith(`--`)?e:y(e)),x=e=>{let t=r(e);return t==null||t===!1?``:a(String(t))},S=e=>{let t=/* @__PURE__ */ new Set;for(let[n,i]of Object.entries(e)){if(!r(i))continue;let e=n.replace(/\s+/g,``);e&&t.add(e)}return t},C=e=>Array.isArray(e)||typeof e==`object`&&!!e;export{i as UNSAFE_CSS_CHARS,s as createReplaceableSlot,b as cssDeclarationName,x as cssDeclarationValue,C as isStructuredValue,v as listen,o as removeNodes,S as resolveClassTokens,r as resolveMaybeReactive,a as sanitizeCssToken,_ as setAttr,y as toKebab};
 //# sourceMappingURL=dom.js.map

package/dist/utils/dom.js.map

@@ -1 +1 @@
-{"version":3,"file":"dom.js","names":["resolveMaybeReactive","value","isReactive","UNSAFE_CSS_CHARS","sanitizeCssToken","runAll","i","fns","removeNodes","node","nodes","createReplaceableSlot","cleanups","fn","next","URL_ATTRS","DANGEROUS_SCHEME_RE","URL_REMOVE_RE","URL_TRIM_RE","normalizeUrlForSchemeCheck","isDangerousUrl","attrWritePlans","ATTR_WRITE_PLAN_LIMIT","getAttrWritePlan","cached","name","lowerName","plan","setAttr","el","val","strVal","listen","ORE_ERRORS","listener","handler","options","toKebab","str","c","cssDeclarationName","cssDeclarationValue","resolved","resolveClassTokens","tokens","key","record","token","isStructuredValue"],"sources":["../../src/utils/dom.ts"],"sourcesContent":["/**\n * Low-level DOM utilities used throughout the runtime and binding layers.\n */\n\nimport { isReactive, type Readable } from '@vielzeug/ripple';\n\nimport { warn } from '../_dev';\nimport { ORE_ERRORS } from '../errors';\n\n/**\n * A value that may be a plain value, a reactive signal, or a getter function :\n * the shape `when()`, `each()`, `classMap()`, and `bind()` accept.\n * Exported so consumers can annotate their own composable parameters with it.\n */\nexport type MaybeReactive<T> = T | Readable<T> | (() => T);\n\n/**\n * Resolves a value that may be a plain value, a getter function, or a reactive\n * signal: the one shared three-way branch used by `classMap`/`styleMap`/`bind()`.\n */\nexport const resolveMaybeReactive = <T>(value: MaybeReactive<T>): T =>\n  typeof value === 'function' ? (value as () => T)() : isReactive(value) ? value.value : value;\n\n/**\n * Characters that can break out of a CSS declaration in an inline style value or property name.\n * Semicolons end the current declaration; braces are meaningful in stylesheet rules but not\n * inline style values, and signal an injection attempt there.\n */\nexport const UNSAFE_CSS_CHARS = /[;{}]/g;\n\nexport const sanitizeCssToken = (value: string): string => value.replace(UNSAFE_CSS_CHARS, '');\n\nexport const runAll = (fns: (() => void)[]): void => {\n  for (let i = fns.length - 1; i >= 0; i--) fns[i]?.();\n};\n\nexport const removeNodes = (nodes: Node[]): void => {\n  for (const node of nodes) {\n    (node as ChildNode).remove();\n  }\n};\n\n/**\n * Tracks \"whatever is currently rendered in one spot\": a list of live DOM nodes plus the\n * cleanup functions that were registered while mounting them. `clear()` tears both down and\n * resets to empty, ready for the next render.\n *\n * Every directive/binding that swaps its rendered content when a reactive source changes\n * (`when()`, `unsafeHtml()`, `each()`'s empty-list fallback, `applyHtmlBinding()`) needs exactly this\n * bookkeeping: this is the one shared implementation instead of four independently-maintained\n * `currentNodes`/`currentCleanups` variable pairs.\n */\nexport type ReplaceableSlot = {\n  /** Tears down every registered cleanup and removes every tracked node, then resets to empty. */\n  clear(): void;\n  /** Currently tracked nodes: read after mounting to know what's live. */\n  readonly nodes: Node[];\n  /** Pass as the `registerCleanup` callback to whatever mounts the next render. */\n  registerCleanup(fn: () => void): void;\n  /** Replace the tracked node list (call once mounting the next render is complete). */\n  setNodes(nodes: Node[]): void;\n};\n\nexport const createReplaceableSlot = (): ReplaceableSlot => {\n  let nodes: Node[] = [];\n  let cleanups: (() => void)[] = [];\n\n  return {\n    clear() {\n      runAll(cleanups);\n      removeNodes(nodes);\n      cleanups = [];\n      nodes = [];\n    },\n    get nodes() {\n      return nodes;\n    },\n    registerCleanup(fn) {\n      cleanups.push(fn);\n    },\n    setNodes(next) {\n      nodes = next;\n    },\n  };\n};\n\n/**\n * HTML attributes that accept URLs. Values bound to these attributes are\n * checked for dangerous schemes before being set.\n *\n * `srcdoc` is deliberately excluded: it holds raw HTML (not a URL), so scheme\n * checking doesn't apply: it's blocked unconditionally below, alongside `on*`.\n */\nconst URL_ATTRS = new Set([\n  'action',\n  'cite',\n  'codebase',\n  'data',\n  'formaction',\n  'href',\n  'manifest',\n  'ping',\n  'poster',\n  'src',\n  'xlink:href',\n]);\n\n/**\n * Schemes that execute JavaScript or can embed arbitrary HTML. Blocked\n * unconditionally in URL-accepting attributes.\n * Covers: javascript:, vbscript:, blob:, and data: variants that carry HTML/XML\n * or script-capable SVG. Plain data: image URIs (e.g. data:image/png) are\n * intentionally allowed.\n */\nconst DANGEROUS_SCHEME_RE =\n  /^\\s*(?:(?:javascript|vbscript|blob):|data:(?:[^,]*\\/(?:html|svg\\+xml)|application\\/(?:xhtml|xml)))/i;\n\n/**\n * Control characters and spaces, normalized away before the scheme check to\n * mirror the WHATWG URL parser browsers use when resolving URL attributes: it\n * removes every ASCII tab/LF/CR anywhere in the input and trims C0 controls and\n * spaces from both ends. So `java\\tscript:alert(1)` executes even though the raw\n * string does not start with `javascript:`. Testing the normalized form closes\n * that gap while leaving benign URLs (e.g. one with an internal space) untouched.\n */\nconst URL_REMOVE_RE = /[\\t\\n\\r]/g;\nconst URL_TRIM_RE = /^[\\s\\p{C}]+|[\\s\\p{C}]+$/gu;\n\nconst normalizeUrlForSchemeCheck = (value: string): string => value.replace(URL_REMOVE_RE, '').replace(URL_TRIM_RE, '');\n\nconst isDangerousUrl = (value: string): boolean => DANGEROUS_SCHEME_RE.test(normalizeUrlForSchemeCheck(value));\n\n/**\n * The name-only classification `setAttr` branches on. Attribute names repeat\n * constantly on hot update paths (a template binds `class`/`href`/... once and\n * writes them on every signal change), so the regex/toLowerCase/set-lookup\n * pass runs once per name and every write just reads the cached plan.\n */\ntype AttrWritePlan = {\n  event: boolean;\n  srcdoc: boolean;\n  url: boolean;\n};\n\nconst attrWritePlans = new Map<string, AttrWritePlan>();\nconst ATTR_WRITE_PLAN_LIMIT = 512;\n\nconst getAttrWritePlan = (name: string): AttrWritePlan => {\n  const cached = attrWritePlans.get(name);\n\n  if (cached) return cached;\n\n  const lowerName = name.toLowerCase();\n  const plan: AttrWritePlan = {\n    event: /^on[a-z]/i.test(name),\n    srcdoc: lowerName === 'srcdoc',\n    url: URL_ATTRS.has(lowerName),\n  };\n\n  if (attrWritePlans.size >= ATTR_WRITE_PLAN_LIMIT) attrWritePlans.clear();\n\n  attrWritePlans.set(name, plan);\n\n  return plan;\n};\n\nexport const setAttr = (el: Element, name: string, val: unknown): void => {\n  const plan = getAttrWritePlan(name);\n\n  if (plan.event) {\n    warn(\n      `Blocked setAttribute(\"${name}\", ...): inline event handler attributes are not supported. Use @${name.slice(2)} binding syntax instead.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  if (plan.srcdoc) {\n    warn(\n      `Blocked setAttribute(\"srcdoc\", ...): \"srcdoc\" holds raw HTML, not a URL, and is not supported via attribute binding. Sanitize untrusted content, then use unsafeHtml() if HTML injection is required.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  if (val == null || val === false) {\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  const strVal = val === true ? 'true' : String(val);\n\n  if (plan.url && isDangerousUrl(strVal)) {\n    warn(\n      `Blocked dangerous URL scheme in attribute \"${name}\". Only safe URLs are permitted in URL-accepting attributes.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  el.setAttribute(name, strVal);\n};\n\nexport const listen = (\n  el: EventTarget | null | undefined,\n  name: string,\n  handler: EventListener,\n  options?: AddEventListenerOptions,\n): (() => void) => {\n  if (!el) {\n    warn(ORE_ERRORS.listenNullTarget(name));\n\n    return () => {};\n  }\n\n  const listener: EventListener = handler;\n\n  el.addEventListener(name, listener, options);\n\n  return () => el.removeEventListener(name, listener, options);\n};\n\nexport const toKebab = (str: string): string => str.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`);\n\n/**\n * Normalize a CSS property name for use in a declaration (camelCase → kebab-case,\n * injection characters stripped). Custom properties (`--*`) are case-sensitive, so\n * they skip the kebab conversion. Shared by `styleMap()` (template side) and\n * `bind({ style })` (host side) so both sanitize identically.\n */\nexport const cssDeclarationName = (name: string): string =>\n  sanitizeCssToken(name.startsWith('--') ? name : toKebab(name));\n\n/**\n * Resolve a style value to its declaration text ('' for null/false/empty).\n * Shared by `styleMap()` and `bind({ style })`.\n */\nexport const cssDeclarationValue = (value: unknown): string => {\n  const resolved = resolveMaybeReactive(value as MaybeReactive<string | number | null | undefined | false>);\n\n  if (resolved == null || resolved === false) return '';\n\n  return sanitizeCssToken(String(resolved));\n};\n\n/**\n * Resolve a class map to the set of active class tokens: keys with truthy\n * (possibly reactive) values, whitespace stripped from each key (spaces would\n * inject extra class tokens). Shared by `classMap()` (joins the set into a\n * class attribute) and `bind({ class })` (diffs the set against classList).\n */\nexport const resolveClassTokens = (record: Record<string, MaybeReactive<boolean>>): Set<string> => {\n  const tokens = new Set<string>();\n\n  for (const [key, value] of Object.entries(record)) {\n    if (!resolveMaybeReactive(value)) continue;\n\n    const token = key.replace(/\\s+/g, '');\n\n    if (token) tokens.add(token);\n  }\n\n  return tokens;\n};\n\nexport const isStructuredValue = (value: unknown): value is object =>\n  Array.isArray(value) || (typeof value === 'object' && value !== null);\n"],"mappings":"A,2GAoBA,IAAaA,EAA2B,GACtC,OAAOC,GAAU,WAAcA,EAAkB,EAAIC,EAAWD,CAAK,EAAIA,EAAM,MAAQA,EAO5EE,EAAmB,SAEnBC,EAAoB,GAA0BH,EAAM,QAAQE,EAAkB,EAAE,EAEhFE,EAAU,GAA8B,CACnD,IAAK,IAAIC,EAAIC,EAAI,OAAS,EAAGD,GAAK,EAAG,IAAKC,EAAID,EAAE,GAAG,CACrD,EAEaE,EAAe,GAAwB,CAClD,IAAK,IAAMC,KAAQC,EACjBD,EAAoB,OAAO,CAE/B,EAuBaE,MAA+C,CAC1D,IAAID,EAAgB,CAAC,EACjBE,EAA2B,CAAC,EAEhC,MAAO,CACL,OAAQ,CACNP,EAAOO,CAAQ,EACfJ,EAAYE,CAAK,EACjB,EAAW,CAAC,EACZ,EAAQ,CAAC,CACX,EACA,IAAI,OAAQ,CACV,OAAOA,CACT,EACA,gBAAgB,EAAI,CAClBE,EAAS,KAAKC,CAAE,CAClB,EACA,SAAS,EAAM,CACb,EAAQC,CACV,CACF,CACF,EASMC,kBAAY,IAAI,IAAI,CACxB,SACA,OACA,WACA,OACA,aACA,OACA,WACA,OACA,SACA,MACA,YACF,CAAC,EASKC,EACJ,sGAUIC,EAAgB,YAChBC,EAAc,4BAEdC,EAA8B,GAA0BlB,EAAM,QAAQgB,EAAe,EAAE,CAAC,CAAC,QAAQC,EAAa,EAAE,EAEhHE,EAAkB,GAA2BJ,EAAoB,KAAKG,EAA2BlB,CAAK,CAAC,EAcvGoB,kBAAiB,IAAI,IACrBC,EAAwB,IAExBC,EAAoB,GAAgC,CACxD,IAAMC,EAASH,EAAe,IAAII,CAAI,EAEtC,GAAID,EAAQ,OAAOA,EAEnB,IAAME,EAAYD,EAAK,YAAY,EAC7BE,EAAsB,CAC1B,MAAO,YAAY,KAAKF,CAAI,EAC5B,OAAQC,IAAc,SACtB,IAAKX,EAAU,IAAIW,CAAS,CAC9B,EAMA,OAJIL,EAAe,MAAQC,GAAuBD,EAAe,MAAM,EAEvEA,EAAe,IAAII,EAAME,CAAI,EAEtBA,CACT,EAEaC,GAAW,EAAa,EAAc,IAAuB,CACxE,IAAMD,EAAOJ,EAAiBE,CAAI,EAElC,GAAIE,EAAK,MAAO,CAEZ,GAAyBF,EAAzB,EAAiGA,EAAK,MAAM,CAAC,EAA7G,EAEFI,EAAG,gBAAgBJ,CAAI,EAEvB,MACF,CAWA,GATIE,EAAK,QASLG,GAAO,MAAQA,IAAQ,GAAO,CAChCD,EAAG,gBAAgBJ,CAAI,EAEvB,MACF,CAEA,IAAMM,EAASD,IAAQ,GAAO,OAAS,OAAOA,CAAG,EAE7CH,EAAK,KAAOP,EAAeW,CAAM,GAEjC,GAA8CN,EAA9C,EAEFI,EAAG,gBAAgBJ,CAAI,GAKzBI,EAAG,aAAaJ,EAAMM,CAAM,CAC9B,EAEaC,GACX,EACA,EACA,EACA,IACiB,CACjB,GAAI,CAACH,EAGH,OAFKI,EAAW,iBAAiBR,CAAI,MAExB,CAAC,EAGhB,IAAMS,EAA0BC,EAIhC,OAFAN,EAAG,iBAAiBJ,EAAMS,EAAUE,CAAO,MAE9BP,EAAG,oBAAoBJ,EAAMS,EAAUE,CAAO,CAC7D,EAEaC,EAAW,GAAwBC,EAAI,QAAQ,SAAW,GAAM,IAAIC,EAAE,YAAY,GAAG,EAQrFC,EAAsB,GACjCpC,EAAiBqB,EAAK,WAAW,IAAI,EAAIA,EAAOY,EAAQZ,CAAI,CAAC,EAMlDgB,EAAuB,GAA2B,CAC7D,IAAMC,EAAW1C,EAAqBC,CAAkE,EAIxG,OAFIyC,GAAY,MAAQA,IAAa,GAAc,GAE5CtC,EAAiB,OAAOsC,CAAQ,CAAC,CAC1C,EAQaC,EAAsB,GAAgE,CACjG,IAAMC,kBAAS,IAAI,IAEnB,IAAK,GAAM,CAACC,EAAK5C,KAAU,OAAO,QAAQ6C,CAAM,EAAG,CACjD,GAAI,CAAC9C,EAAqBC,CAAK,EAAG,SAElC,IAAM8C,EAAQF,EAAI,QAAQ,OAAQ,EAAE,EAEhCE,GAAOH,EAAO,IAAIG,CAAK,CAC7B,CAEA,OAAOH,CACT,EAEaI,EAAqB,GAChC,MAAM,QAAQ/C,CAAK,GAAM,OAAOA,GAAU,YAAYA,E"}
+{"version":3,"file":"dom.js","names":["resolveMaybeReactive","value","isReactive","UNSAFE_CSS_CHARS","sanitizeCssToken","removeNodes","node","nodes","createReplaceableSlot","scope","clear","next","createScope","fn","error","nextNodes","URL_ATTRS","DANGEROUS_SCHEME_RE","URL_REMOVE_RE","URL_TRIM_RE","normalizeUrlForSchemeCheck","isDangerousUrl","attrWritePlans","ATTR_WRITE_PLAN_LIMIT","getAttrWritePlan","cached","name","lowerName","plan","setAttr","el","val","strVal","listen","ORE_ERRORS","listener","handler","options","toKebab","str","c","cssDeclarationName","cssDeclarationValue","resolved","resolveClassTokens","tokens","key","record","token","isStructuredValue"],"sources":["../../src/utils/dom.ts"],"sourcesContent":["/**\n * Low-level DOM utilities used throughout the runtime and binding layers.\n */\n\nimport { createScope, isReactive, type Readable, type Scope } from '@vielzeug/ripple';\n\nimport { warn } from '../_dev';\nimport { ORE_ERRORS } from '../errors';\n\n/**\n * A value that may be a plain value, a reactive signal, or a getter function :\n * the shape `when()`, `each()`, `classMap()`, and `bind()` accept.\n * Exported so consumers can annotate their own composable parameters with it.\n */\nexport type MaybeReactive<T> = T | Readable<T> | (() => T);\n\n/**\n * Resolves a value that may be a plain value, a getter function, or a reactive\n * signal: the one shared three-way branch used by `classMap`/`styleMap`/`bind()`.\n */\nexport const resolveMaybeReactive = <T>(value: MaybeReactive<T>): T =>\n  typeof value === 'function' ? (value as () => T)() : isReactive(value) ? value.value : value;\n\n/**\n * Characters that can break out of a CSS declaration in an inline style value or property name.\n * Semicolons end the current declaration; braces are meaningful in stylesheet rules but not\n * inline style values, and signal an injection attempt there.\n */\nexport const UNSAFE_CSS_CHARS = /[;{}]/g;\n\nexport const sanitizeCssToken = (value: string): string => value.replace(UNSAFE_CSS_CHARS, '');\n\nexport const removeNodes = (nodes: Node[]): void => {\n  for (const node of nodes) {\n    (node as ChildNode).remove();\n  }\n};\n\n/**\n * Tracks \"whatever is currently rendered in one spot\": a list of live DOM nodes plus the\n * ripple scope that owns the effects and `onCleanup` callbacks registered while mounting\n * them. `clear()` disposes that scope and removes the nodes.\n *\n * Every directive/binding that swaps its rendered content when a reactive source changes\n * (`when()`, `unsafeHtml()`, `applyHtmlBinding()`) mounts the next render inside `render()`,\n * so nested effects belong to this slot rather than to whichever effect happens to be\n * running. `scope.run()` clears the transient effect-run owner.\n */\nexport type ReplaceableSlot = {\n  /** Dispose the current render scope and remove every tracked node. */\n  clear(): void;\n  /** Currently tracked nodes. */\n  readonly nodes: Node[];\n  /**\n   * Dispose the previous render, then run `fn` inside a fresh scope. Call\n   * `setNodes` from `fn` once mounting finishes.\n   */\n  render<T>(fn: () => T): T;\n  /** Replace the tracked node list (call once mounting the next render is complete). */\n  setNodes(nodes: Node[]): void;\n};\n\nexport const createReplaceableSlot = (): ReplaceableSlot => {\n  let nodes: Node[] = [];\n  let scope: Scope | null = null;\n\n  const clear = (): void => {\n    scope?.dispose();\n    scope = null;\n    removeNodes(nodes);\n    nodes = [];\n  };\n\n  return {\n    clear,\n    get nodes() {\n      return nodes;\n    },\n    render(fn) {\n      clear();\n\n      const next = createScope();\n\n      scope = next;\n\n      try {\n        return next.run(fn);\n      } catch (error) {\n        next.dispose();\n        scope = null;\n        throw error;\n      }\n    },\n    setNodes(nextNodes) {\n      nodes = nextNodes;\n    },\n  };\n};\n\n/**\n * HTML attributes that accept URLs. Values bound to these attributes are\n * checked for dangerous schemes before being set.\n *\n * `srcdoc` is deliberately excluded: it holds raw HTML (not a URL), so scheme\n * checking doesn't apply: it's blocked unconditionally below, alongside `on*`.\n */\nconst URL_ATTRS = new Set([\n  'action',\n  'cite',\n  'codebase',\n  'data',\n  'formaction',\n  'href',\n  'manifest',\n  'ping',\n  'poster',\n  'src',\n  'xlink:href',\n]);\n\n/**\n * Schemes that execute JavaScript or can embed arbitrary HTML. Blocked\n * unconditionally in URL-accepting attributes.\n * Covers: javascript:, vbscript:, blob:, and data: variants that carry HTML/XML\n * or script-capable SVG. Plain data: image URIs (e.g. data:image/png) are\n * intentionally allowed.\n */\nconst DANGEROUS_SCHEME_RE =\n  /^\\s*(?:(?:javascript|vbscript|blob):|data:(?:[^,]*\\/(?:html|svg\\+xml)|application\\/(?:xhtml|xml)))/i;\n\n/**\n * Control characters and spaces, normalized away before the scheme check to\n * mirror the WHATWG URL parser browsers use when resolving URL attributes: it\n * removes every ASCII tab/LF/CR anywhere in the input and trims C0 controls and\n * spaces from both ends. So `java\\tscript:alert(1)` executes even though the raw\n * string does not start with `javascript:`. Testing the normalized form closes\n * that gap while leaving benign URLs (e.g. one with an internal space) untouched.\n */\nconst URL_REMOVE_RE = /[\\t\\n\\r]/g;\nconst URL_TRIM_RE = /^[\\s\\p{C}]+|[\\s\\p{C}]+$/gu;\n\nconst normalizeUrlForSchemeCheck = (value: string): string => value.replace(URL_REMOVE_RE, '').replace(URL_TRIM_RE, '');\n\nconst isDangerousUrl = (value: string): boolean => DANGEROUS_SCHEME_RE.test(normalizeUrlForSchemeCheck(value));\n\n/**\n * The name-only classification `setAttr` branches on. Attribute names repeat\n * constantly on hot update paths (a template binds `class`/`href`/... once and\n * writes them on every signal change), so the regex/toLowerCase/set-lookup\n * pass runs once per name and every write just reads the cached plan.\n */\ntype AttrWritePlan = {\n  event: boolean;\n  srcdoc: boolean;\n  url: boolean;\n};\n\nconst attrWritePlans = new Map<string, AttrWritePlan>();\nconst ATTR_WRITE_PLAN_LIMIT = 512;\n\nconst getAttrWritePlan = (name: string): AttrWritePlan => {\n  const cached = attrWritePlans.get(name);\n\n  if (cached) return cached;\n\n  const lowerName = name.toLowerCase();\n  const plan: AttrWritePlan = {\n    event: /^on[a-z]/i.test(name),\n    srcdoc: lowerName === 'srcdoc',\n    url: URL_ATTRS.has(lowerName),\n  };\n\n  if (attrWritePlans.size >= ATTR_WRITE_PLAN_LIMIT) attrWritePlans.clear();\n\n  attrWritePlans.set(name, plan);\n\n  return plan;\n};\n\nexport const setAttr = (el: Element, name: string, val: unknown): void => {\n  const plan = getAttrWritePlan(name);\n\n  if (plan.event) {\n    warn(\n      `Blocked setAttribute(\"${name}\", ...): inline event handler attributes are not supported. Use @${name.slice(2)} binding syntax instead.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  if (plan.srcdoc) {\n    warn(\n      `Blocked setAttribute(\"srcdoc\", ...): \"srcdoc\" holds raw HTML, not a URL, and is not supported via attribute binding. Sanitize untrusted content, then use unsafeHtml() if HTML injection is required.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  if (val == null || val === false) {\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  const strVal = val === true ? 'true' : String(val);\n\n  if (plan.url && isDangerousUrl(strVal)) {\n    warn(\n      `Blocked dangerous URL scheme in attribute \"${name}\". Only safe URLs are permitted in URL-accepting attributes.`,\n    );\n    el.removeAttribute(name);\n\n    return;\n  }\n\n  el.setAttribute(name, strVal);\n};\n\nexport const listen = (\n  el: EventTarget | null | undefined,\n  name: string,\n  handler: EventListener,\n  options?: AddEventListenerOptions,\n): (() => void) => {\n  if (!el) {\n    warn(ORE_ERRORS.listenNullTarget(name));\n\n    return () => {};\n  }\n\n  const listener: EventListener = handler;\n\n  el.addEventListener(name, listener, options);\n\n  return () => el.removeEventListener(name, listener, options);\n};\n\nexport const toKebab = (str: string): string => str.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`);\n\n/**\n * Normalize a CSS property name for use in a declaration (camelCase → kebab-case,\n * injection characters stripped). Custom properties (`--*`) are case-sensitive, so\n * they skip the kebab conversion. Shared by `styleMap()` (template side) and\n * `bind({ style })` (host side) so both sanitize identically.\n */\nexport const cssDeclarationName = (name: string): string =>\n  sanitizeCssToken(name.startsWith('--') ? name : toKebab(name));\n\n/**\n * Resolve a style value to its declaration text ('' for null/false/empty).\n * Shared by `styleMap()` and `bind({ style })`.\n */\nexport const cssDeclarationValue = (value: unknown): string => {\n  const resolved = resolveMaybeReactive(value as MaybeReactive<string | number | null | undefined | false>);\n\n  if (resolved == null || resolved === false) return '';\n\n  return sanitizeCssToken(String(resolved));\n};\n\n/**\n * Resolve a class map to the set of active class tokens: keys with truthy\n * (possibly reactive) values, whitespace stripped from each key (spaces would\n * inject extra class tokens). Shared by `classMap()` (joins the set into a\n * class attribute) and `bind({ class })` (diffs the set against classList).\n */\nexport const resolveClassTokens = (record: Record<string, MaybeReactive<boolean>>): Set<string> => {\n  const tokens = new Set<string>();\n\n  for (const [key, value] of Object.entries(record)) {\n    if (!resolveMaybeReactive(value)) continue;\n\n    const token = key.replace(/\\s+/g, '');\n\n    if (token) tokens.add(token);\n  }\n\n  return tokens;\n};\n\nexport const isStructuredValue = (value: unknown): value is object =>\n  Array.isArray(value) || (typeof value === 'object' && value !== null);\n"],"mappings":"A,4HAoBA,IAAaA,EAA2B,GACtC,OAAOC,GAAU,WAAcA,EAAkB,EAAIC,EAAWD,CAAK,EAAIA,EAAM,MAAQA,EAO5EE,EAAmB,SAEnBC,EAAoB,GAA0BH,EAAM,QAAQE,EAAkB,EAAE,EAEhFE,EAAe,GAAwB,CAClD,IAAK,IAAMC,KAAQC,EACjBD,EAAoB,OAAO,CAE/B,EA0BaE,MAA+C,CAC1D,IAAID,EAAgB,CAAC,EACjBE,EAAsB,KAEpBC,MAAoB,CACxBD,GAAO,QAAQ,EACf,EAAQ,KACRJ,EAAYE,CAAK,EACjB,EAAQ,CAAC,CACX,EAEA,MAAO,CACL,QACA,IAAI,OAAQ,CACV,OAAOA,CACT,EACA,OAAO,EAAI,CACTG,EAAM,EAEN,IAAMC,EAAOC,EAAY,EAEzB,EAAQD,EAER,GAAI,CACF,OAAOA,EAAK,IAAIE,CAAE,CACpB,OAASC,EAAO,CAGd,MAFAH,EAAK,QAAQ,EACb,EAAQ,KACFG,CACR,CACF,EACA,SAAS,EAAW,CAClB,EAAQC,CACV,CACF,CACF,EASMC,kBAAY,IAAI,IAAI,CACxB,SACA,OACA,WACA,OACA,aACA,OACA,WACA,OACA,SACA,MACA,YACF,CAAC,EASKC,EACJ,sGAUIC,EAAgB,YAChBC,EAAc,4BAEdC,EAA8B,GAA0BnB,EAAM,QAAQiB,EAAe,EAAE,CAAC,CAAC,QAAQC,EAAa,EAAE,EAEhHE,EAAkB,GAA2BJ,EAAoB,KAAKG,EAA2BnB,CAAK,CAAC,EAcvGqB,kBAAiB,IAAI,IACrBC,EAAwB,IAExBC,EAAoB,GAAgC,CACxD,IAAMC,EAASH,EAAe,IAAII,CAAI,EAEtC,GAAID,EAAQ,OAAOA,EAEnB,IAAME,EAAYD,EAAK,YAAY,EAC7BE,EAAsB,CAC1B,MAAO,YAAY,KAAKF,CAAI,EAC5B,OAAQC,IAAc,SACtB,IAAKX,EAAU,IAAIW,CAAS,CAC9B,EAMA,OAJIL,EAAe,MAAQC,GAAuBD,EAAe,MAAM,EAEvEA,EAAe,IAAII,EAAME,CAAI,EAEtBA,CACT,EAEaC,GAAW,EAAa,EAAc,IAAuB,CACxE,IAAMD,EAAOJ,EAAiBE,CAAI,EAElC,GAAIE,EAAK,MAAO,CAEZ,GAAyBF,EAAzB,EAAiGA,EAAK,MAAM,CAAC,EAA7G,EAEFI,EAAG,gBAAgBJ,CAAI,EAEvB,MACF,CAWA,GATIE,EAAK,QASLG,GAAO,MAAQA,IAAQ,GAAO,CAChCD,EAAG,gBAAgBJ,CAAI,EAEvB,MACF,CAEA,IAAMM,EAASD,IAAQ,GAAO,OAAS,OAAOA,CAAG,EAE7CH,EAAK,KAAOP,EAAeW,CAAM,GAEjC,GAA8CN,EAA9C,EAEFI,EAAG,gBAAgBJ,CAAI,GAKzBI,EAAG,aAAaJ,EAAMM,CAAM,CAC9B,EAEaC,GACX,EACA,EACA,EACA,IACiB,CACjB,GAAI,CAACH,EAGH,OAFKI,EAAW,iBAAiBR,CAAI,MAExB,CAAC,EAGhB,IAAMS,EAA0BC,EAIhC,OAFAN,EAAG,iBAAiBJ,EAAMS,EAAUE,CAAO,MAE9BP,EAAG,oBAAoBJ,EAAMS,EAAUE,CAAO,CAC7D,EAEaC,EAAW,GAAwBC,EAAI,QAAQ,SAAW,GAAM,IAAIC,EAAE,YAAY,GAAG,EAQrFC,EAAsB,GACjCrC,EAAiBsB,EAAK,WAAW,IAAI,EAAIA,EAAOY,EAAQZ,CAAI,CAAC,EAMlDgB,EAAuB,GAA2B,CAC7D,IAAMC,EAAW3C,EAAqBC,CAAkE,EAIxG,OAFI0C,GAAY,MAAQA,IAAa,GAAc,GAE5CvC,EAAiB,OAAOuC,CAAQ,CAAC,CAC1C,EAQaC,EAAsB,GAAgE,CACjG,IAAMC,kBAAS,IAAI,IAEnB,IAAK,GAAM,CAACC,EAAK7C,KAAU,OAAO,QAAQ8C,CAAM,EAAG,CACjD,GAAI,CAAC/C,EAAqBC,CAAK,EAAG,SAElC,IAAM+C,EAAQF,EAAI,QAAQ,OAAQ,EAAE,EAEhCE,GAAOH,EAAO,IAAIG,CAAK,CAC7B,CAEA,OAAOH,CACT,EAEaI,EAAqB,GAChC,MAAM,QAAQhD,CAAK,GAAM,OAAOA,GAAU,YAAYA,E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vielzeug/ore",
-  "version": "26.11.9",
+  "version": "26.11.11",
   "description": "Functional web-component authoring on top of ripple",
   "repository": {
     "type": "git",
@@ -54,8 +54,8 @@
     "test:types": "tsc -p tsconfig.json --noEmit"
   },
   "peerDependencies": {
-    "@vielzeug/assay": "^26.11.9",
-    "@vielzeug/ripple": "^26.11.9"
+    "@vielzeug/assay": "^26.11.11",
+    "@vielzeug/ripple": "^26.11.11"
   },
   "peerDependenciesMeta": {
     "@vielzeug/assay": {
@@ -64,8 +64,8 @@
   },
   "devDependencies": {
     "@types/node": "^26.6.6",
-    "@vielzeug/assay": "26.11.9",
-    "@vielzeug/ripple": "26.11.9",
+    "@vielzeug/assay": "26.11.11",
+    "@vielzeug/ripple": "26.11.11",
     "axe-core": "^4.14.0",
     "jsdom": "^31.0.0",
     "typescript": "^6.0.3",

package/dist/directives/live.cjs

@@ -1,2 +0,0 @@
-var e=require("../utils/brand.cjs").makeBrand(`ore:live`),t=t=>e.stamp({source:t}),n=e.is;exports.isLiveBinding=n,exports.live=t;
-//# sourceMappingURL=live.cjs.map

package/dist/directives/live.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"live.cjs","names":["makeBrand","liveBrand","live","isLiveBinding"],"sources":["../../src/directives/live.ts"],"sourcesContent":["import type { Readable } from '@vielzeug/ripple';\n\nimport { makeBrand } from '../utils/brand';\n\n/**\n * A per-binding marker produced by `live()`. Wraps the source signal: the\n * \"live\" flag belongs to this one binding site, never to the signal itself,\n * so other bindings of the same signal are unaffected.\n *\n * @example\n * html`<input value=\"${live(model)}\" />`\n */\nexport type LiveBinding<T> = { readonly source: Readable<T> };\n\nconst liveBrand = makeBrand<LiveBinding<unknown>>('ore:live');\n\n/**\n * Marks one attribute binding as \"live\" so stale app-state writes never clobber\n * in-progress user input at that binding site.\n *\n * For form controls: if the current DOM value diverges from the last write made\n * by this binding, subsequent app-state writes are silently dropped until the\n * DOM value matches the incoming value or no prior write has been recorded.\n */\nexport const live = <T>(source: Readable<T>): LiveBinding<T> => liveBrand.stamp({ source }) as LiveBinding<T>;\n\nexport const isLiveBinding = liveBrand.is;\n"],"mappings":"AAcA,IAAMC,E,4BAAYD,CAAAA,CAAAA,UAAgC,UAAU,EAU/CE,EAAW,GAAwCD,EAAU,MAAM,CAAE,QAAO,CAAC,EAE7EE,EAAgBF,EAAU,G"}

package/dist/directives/live.d.ts

@@ -1,23 +0,0 @@
-import type { Readable } from '@vielzeug/ripple';
-/**
- * A per-binding marker produced by `live()`. Wraps the source signal: the
- * "live" flag belongs to this one binding site, never to the signal itself,
- * so other bindings of the same signal are unaffected.
- *
- * @example
- * html`<input value="${live(model)}" />`
- */
-export type LiveBinding<T> = {
-    readonly source: Readable<T>;
-};
-/**
- * Marks one attribute binding as "live" so stale app-state writes never clobber
- * in-progress user input at that binding site.
- *
- * For form controls: if the current DOM value diverges from the last write made
- * by this binding, subsequent app-state writes are silently dropped until the
- * DOM value matches the incoming value or no prior write has been recorded.
- */
-export declare const live: <T>(source: Readable<T>) => LiveBinding<T>;
-export declare const isLiveBinding: (value: unknown) => value is LiveBinding<unknown>;
-//# sourceMappingURL=live.d.ts.map

package/dist/directives/live.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../src/directives/live.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAIjD;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;CAAE,CAAC;AAI9D;;;;;;;GAOG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAAC,KAAG,WAAW,CAAC,CAAC,CAAkD,CAAC;AAE9G,eAAO,MAAM,aAAa,mDAAe,CAAC"}

package/dist/directives/live.js

@@ -1,2 +0,0 @@
-import{makeBrand as e}from"../utils/brand.js";var t=e(`ore:live`),n=e=>t.stamp({source:e}),r=t.is;export{r as isLiveBinding,n as live};
-//# sourceMappingURL=live.js.map

package/dist/directives/live.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"live.js","names":["liveBrand","makeBrand","live","isLiveBinding"],"sources":["../../src/directives/live.ts"],"sourcesContent":["import type { Readable } from '@vielzeug/ripple';\n\nimport { makeBrand } from '../utils/brand';\n\n/**\n * A per-binding marker produced by `live()`. Wraps the source signal: the\n * \"live\" flag belongs to this one binding site, never to the signal itself,\n * so other bindings of the same signal are unaffected.\n *\n * @example\n * html`<input value=\"${live(model)}\" />`\n */\nexport type LiveBinding<T> = { readonly source: Readable<T> };\n\nconst liveBrand = makeBrand<LiveBinding<unknown>>('ore:live');\n\n/**\n * Marks one attribute binding as \"live\" so stale app-state writes never clobber\n * in-progress user input at that binding site.\n *\n * For form controls: if the current DOM value diverges from the last write made\n * by this binding, subsequent app-state writes are silently dropped until the\n * DOM value matches the incoming value or no prior write has been recorded.\n */\nexport const live = <T>(source: Readable<T>): LiveBinding<T> => liveBrand.stamp({ source }) as LiveBinding<T>;\n\nexport const isLiveBinding = liveBrand.is;\n"],"mappings":"A,8CAcA,IAAMA,EAAYC,EAAgC,UAAU,EAU/CC,EAAW,GAAwCF,EAAU,MAAM,CAAE,QAAO,CAAC,EAE7EG,EAAgBH,EAAU,G"}