@vobs/vite-plugin 1.1.0 → 1.2.0

package/dist/html-component.cjs

@@ -0,0 +1,138 @@
+'use strict';
+
+var parse5 = require('parse5');
+
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var blockedTags = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "base", "meta", "link", "style"]);
+var blockedAttributes = /^(?:on[a-z]+|srcdoc|style)$/iu;
+var urlAttributes = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "poster", "xlink:href"]);
+var safeProtocols = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
+var directivePattern = /^data-vobs-(text|slot|on|bind|prop)(?:-(.+))?$/iu;
+var safePropertyNames = /* @__PURE__ */ new Set([
+  "value",
+  "checked",
+  "selected",
+  "disabled",
+  "multiple",
+  "readonly",
+  "required",
+  "autofocus",
+  "hidden",
+  "tabindex"
+]);
+function compileHtmlComponent(source, options = {}) {
+  const fragment = parse5.parseFragment(source);
+  const body = compileChildren(fragment, options.filename ?? "component.html");
+  const result = body.length === 1 ? body[0] : `createFragment((parent, anchor) => {${body.map((code) => `insertBefore(parent, ${code}, anchor);`).join("")}})`;
+  return `import { addEventListener, bindAttribute, bindProperty, bindText, createElement, createFragment, createText, insertBefore, insertDynamic, setAttribute } from '@vobs/vobs';
+function resolveHtmlSlot(value) { const resolved = typeof value === 'function' ? value() : value; if (resolved === undefined || resolved === null || resolved === false) return null; if (typeof resolved === 'string' || typeof resolved === 'number') return createText(String(resolved)); if (Array.isArray(resolved)) return createFragment((parent, anchor) => { for (const item of resolved) { const child = resolveHtmlSlot(item); if (child) insertBefore(parent, child, anchor); } }); return resolved; }
+function sanitizeHtmlAttribute(name, value) { const stringValue = String(value ?? ''); if (!['href', 'src', 'action', 'formaction', 'poster', 'xlink:href'].includes(name.toLowerCase())) return stringValue; const normalized = stringValue.trim().toLowerCase(); if (normalized.startsWith('#') || normalized.startsWith('/') || normalized.startsWith('./') || normalized.startsWith('../')) return stringValue; try { const protocol = new URL(normalized, 'https://vobs.invalid/').protocol; return ['http:', 'https:', 'mailto:', 'tel:'].includes(protocol) ? stringValue : ''; } catch { return ''; } }
+export default function HtmlComponent(props = {}) { return ${result ?? "createFragment(() => {})"}; }`;
+}
+__name(compileHtmlComponent, "compileHtmlComponent");
+function compileChildren(parent, filename) {
+  return parent.childNodes.flatMap((node) => compileNode(node, filename));
+}
+__name(compileChildren, "compileChildren");
+function compileNode(node, filename) {
+  if (node.nodeName === "#text") {
+    const value = node.value;
+    return value ? [`createText(${JSON.stringify(value)})`] : [];
+  }
+  if (node.nodeName === "#comment") return [];
+  if (node.nodeName !== "#document-fragment" && !isElement(node)) return [];
+  if (isElement(node)) {
+    const tag = node.tagName.toLowerCase();
+    if (blockedTags.has(tag)) throw new Error(`Vobs HTML component: \u7981\u6B62\u4F7F\u7528 <${tag}> (${filename})`);
+    const children = compileChildren(node, filename);
+    const statements = [`const element = createElement(${JSON.stringify(tag)})`];
+    const dynamicText = [];
+    for (const attribute of node.attrs) {
+      const name = attribute.name.toLowerCase();
+      const value = attribute.value;
+      const directive = parseDirective(name, value, filename);
+      if (directive) {
+        if (directive.kind === "text") {
+          dynamicText.push(directive.prop);
+        } else if (directive.kind === "slot") {
+          statements.push(`insertDynamic(element, null, () => resolveHtmlSlot(props[${JSON.stringify(directive.prop)}]))`);
+        } else if (directive.kind === "event") {
+          statements.push(`addEventListener(element, ${JSON.stringify(directive.name)}, (event) => { const handler = props[${JSON.stringify(directive.prop)}]; if (typeof handler === 'function') handler(event); })`);
+        } else if (directive.kind === "attribute") {
+          statements.push(`bindAttribute(element, ${JSON.stringify(directive.name)}, () => sanitizeHtmlAttribute(${JSON.stringify(directive.name)}, props[${JSON.stringify(directive.prop)}] ?? ''))`);
+        } else if (directive.kind === "property") {
+          statements.push(`bindProperty(element, ${JSON.stringify(directive.name)}, () => props[${JSON.stringify(directive.prop)}])`);
+        }
+        continue;
+      }
+      if (blockedAttributes.test(name)) throw new Error(`Vobs HTML component: \u7981\u6B62\u4F7F\u7528\u5371\u9669\u5C5E\u6027 ${attribute.name} (${filename})`);
+      if (urlAttributes.has(name) && !isSafeUrl(value)) {
+        throw new Error(`Vobs HTML component: \u7981\u6B62\u4F7F\u7528\u5371\u9669 URL \u5C5E\u6027 ${attribute.name} (${filename})`);
+      }
+      statements.push(`setAttribute(element, ${JSON.stringify(attribute.name)}, ${JSON.stringify(value)})`);
+    }
+    if (dynamicText.length > 1) throw new Error(`Vobs HTML component: \u4E00\u4E2A\u5143\u7D20\u53EA\u80FD\u4F7F\u7528\u4E00\u4E2A data-vobs-text \u6307\u4EE4 (${filename})`);
+    if (dynamicText.length === 1) {
+      const text = 'createText("")';
+      statements.push(`const text = ${text}`);
+      statements.push("insertBefore(element, text, null)");
+      statements.push(`bindText(text, () => props[${JSON.stringify(dynamicText[0])}] ?? '')`);
+    } else {
+      for (const child of children) statements.push(`insertBefore(element, ${child}, null)`);
+    }
+    statements.push("return element");
+    return [`(() => {${statements.join(";")};})()`];
+  }
+  return compileChildren(node, filename);
+}
+__name(compileNode, "compileNode");
+function isElement(node) {
+  return !node.nodeName.startsWith("#");
+}
+__name(isElement, "isElement");
+function isSafeUrl(value) {
+  const normalized = value.trim().toLowerCase();
+  if (normalized.startsWith("#") || normalized.startsWith("/") || normalized.startsWith("./") || normalized.startsWith("../")) return true;
+  try {
+    return safeProtocols.has(new URL(normalized, "https://vobs.invalid/").protocol);
+  } catch {
+    return false;
+  }
+}
+__name(isSafeUrl, "isSafeUrl");
+function parseDirective(name, value, filename) {
+  const match = directivePattern.exec(name);
+  if (!match) return null;
+  const kind = match[1].toLowerCase();
+  const namePart = match[2];
+  const prop = value.trim();
+  if (!prop || !/^[A-Za-z_$][\w$]*$/u.test(prop)) {
+    throw new Error(`Vobs HTML component: ${name} \u5FC5\u987B\u5F15\u7528\u6709\u6548\u7684 props \u540D\u79F0 (${filename})`);
+  }
+  if (kind === "text" || kind === "slot") {
+    if (namePart) throw new Error(`Vobs HTML component: ${name} \u4E0D\u63A5\u53D7\u989D\u5916\u540D\u79F0 (${filename})`);
+    return { kind, prop };
+  }
+  if (!namePart || !/^[a-z][a-z0-9:-]*$/iu.test(namePart)) {
+    throw new Error(`Vobs HTML component: ${name} \u5FC5\u987B\u5305\u542B\u6709\u6548\u540D\u79F0 (${filename})`);
+  }
+  if (kind === "on") return { kind: "event", name: namePart.toLowerCase(), prop };
+  if (kind === "bind") {
+    if (namePart.toLowerCase() === "style") throw new Error(`Vobs HTML component: \u4E0D\u5141\u8BB8\u52A8\u6001\u7ED1\u5B9A style (${filename})`);
+    return { kind: "attribute", name: namePart, prop };
+  }
+  if (!safePropertyNames.has(namePart.toLowerCase())) {
+    throw new Error(`Vobs HTML component: \u4E0D\u5141\u8BB8\u52A8\u6001\u7ED1\u5B9A property ${namePart} (${filename})`);
+  }
+  return { kind: "property", name: normalizePropertyName(namePart), prop };
+}
+__name(parseDirective, "parseDirective");
+function normalizePropertyName(name) {
+  return name.toLowerCase() === "readonly" ? "readOnly" : name.toLowerCase() === "tabindex" ? "tabIndex" : name;
+}
+__name(normalizePropertyName, "normalizePropertyName");
+
+exports.compileHtmlComponent = compileHtmlComponent;
+//# sourceMappingURL=html-component.cjs.map
+//# sourceMappingURL=html-component.cjs.map

package/dist/html-component.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/html-component.ts"],"names":["parseFragment"],"mappings":";;;;;;AAMA,IAAM,WAAA,mBAAc,IAAI,GAAA,CAAI,CAAC,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAC,CAAA;AACpG,IAAM,iBAAA,GAAoB,+BAAA;AAC1B,IAAM,aAAA,mBAAgB,IAAI,GAAA,CAAI,CAAC,MAAA,EAAQ,OAAO,QAAA,EAAU,YAAA,EAAc,QAAA,EAAU,YAAY,CAAC,CAAA;AAC7F,IAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,SAAS,QAAA,EAAU,SAAA,EAAW,MAAM,CAAC,CAAA;AACpE,IAAM,gBAAA,GAAmB,kDAAA;AACzB,IAAM,iBAAA,uBAAwB,GAAA,CAAI;AAAA,EAChC,OAAA;AAAA,EAAS,SAAA;AAAA,EAAW,UAAA;AAAA,EAAY,UAAA;AAAA,EAAY,UAAA;AAAA,EAAY,UAAA;AAAA,EAAY,UAAA;AAAA,EACpE,WAAA;AAAA,EAAa,QAAA;AAAA,EAAU;AACzB,CAAC,CAAA;AAOM,SAAS,oBAAA,CAAqB,MAAA,EAAgB,OAAA,GAAgC,EAAC,EAAW;AAC/F,EAAA,MAAM,QAAA,GAAWA,qBAAc,MAAM,CAAA;AACrC,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,QAAA,EAAU,OAAA,CAAQ,YAAY,gBAAgB,CAAA;AAC3E,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA,KAAW,CAAA,GAAI,IAAA,CAAK,CAAC,CAAA,GAAI,CAAA,oCAAA,EAAuC,IAAA,CAAK,GAAA,CAAI,UAAQ,CAAA,qBAAA,EAAwB,IAAI,YAAY,CAAA,CAAE,IAAA,CAAK,EAAE,CAAC,CAAA,EAAA,CAAA;AAEvJ,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA,2DAAA,EAAgzC,UAAU,0BAA0B,CAAA,GAAA,CAAA;AAC71C;AANgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAQhB,SAAS,eAAA,CAAgB,QAA4C,QAAA,EAA4B;AAC/F,EAAA,OAAO,OAAO,UAAA,CAAW,OAAA,CAAQ,UAAQ,WAAA,CAAY,IAAA,EAAM,QAAQ,CAAC,CAAA;AACtE;AAFS,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AAIT,SAAS,WAAA,CAAY,MAAgB,QAAA,EAA4B;AAC/D,EAAA,IAAI,IAAA,CAAK,aAAa,OAAA,EAAS;AAC7B,IAAA,MAAM,QAAS,IAAA,CAA2C,KAAA;AAC1D,IAAA,OAAO,KAAA,GAAQ,CAAC,CAAA,WAAA,EAAc,IAAA,CAAK,UAAU,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA,GAAI,EAAC;AAAA,EAC7D;AAEA,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,UAAA,EAAY,OAAO,EAAC;AAC1C,EAAA,IAAI,IAAA,CAAK,aAAa,oBAAA,IAAwB,CAAC,UAAU,IAAI,CAAA,SAAU,EAAC;AAExE,EAAA,IAAI,SAAA,CAAU,IAAI,CAAA,EAAG;AACnB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,WAAA,EAAY;AACrC,IAAA,IAAI,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,+CAAA,EAA8B,GAAG,CAAA,GAAA,EAAM,QAAQ,CAAA,CAAA,CAAG,CAAA;AAE5F,IAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,IAAA,EAAM,QAAQ,CAAA;AAC/C,IAAA,MAAM,aAAa,CAAC,CAAA,8BAAA,EAAiC,KAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,CAAG,CAAA;AAC3E,IAAA,MAAM,cAAc,EAAC;AACrB,IAAA,KAAA,MAAW,SAAA,IAAa,KAAK,KAAA,EAAO;AAClC,MAAA,MAAM,IAAA,GAAO,SAAA,CAAU,IAAA,CAAK,WAAA,EAAY;AACxC,MAAA,MAAM,QAAQ,SAAA,CAAU,KAAA;AACxB,MAAA,MAAM,SAAA,GAAY,cAAA,CAAe,IAAA,EAAM,KAAA,EAAO,QAAQ,CAAA;AACtD,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,IAAI,SAAA,CAAU,SAAS,MAAA,EAAQ;AAC7B,UAAA,WAAA,CAAY,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QACjC,CAAA,MAAA,IAAW,SAAA,CAAU,IAAA,KAAS,MAAA,EAAQ;AACpC,UAAA,UAAA,CAAW,KAAK,CAAA,yDAAA,EAA4D,IAAA,CAAK,UAAU,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,CAAK,CAAA;AAAA,QACjH,CAAA,MAAA,IAAW,SAAA,CAAU,IAAA,KAAS,OAAA,EAAS;AACrC,UAAA,UAAA,CAAW,IAAA,CAAK,CAAA,0BAAA,EAA6B,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,qCAAA,EAAwC,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,wDAAA,CAA0D,CAAA;AAAA,QAC7M,CAAA,MAAA,IAAW,SAAA,CAAU,IAAA,KAAS,WAAA,EAAa;AACzC,UAAA,UAAA,CAAW,KAAK,CAAA,uBAAA,EAA0B,IAAA,CAAK,UAAU,SAAA,CAAU,IAAI,CAAC,CAAA,8BAAA,EAAiC,IAAA,CAAK,UAAU,SAAA,CAAU,IAAI,CAAC,CAAA,QAAA,EAAW,IAAA,CAAK,UAAU,SAAA,CAAU,IAAI,CAAC,CAAA,SAAA,CAAW,CAAA;AAAA,QAC7L,CAAA,MAAA,IAAW,SAAA,CAAU,IAAA,KAAS,UAAA,EAAY;AACxC,UAAA,UAAA,CAAW,IAAA,CAAK,CAAA,sBAAA,EAAyB,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,cAAA,EAAiB,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,QAC5H;AACA,QAAA;AAAA,MACF;AACA,MAAA,IAAI,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,sEAAA,EAAiC,SAAA,CAAU,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAA,CAAG,CAAA;AACjH,MAAA,IAAI,cAAc,GAAA,CAAI,IAAI,KAAK,CAAC,SAAA,CAAU,KAAK,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2EAAA,EAAsC,UAAU,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,MACtF;AACA,MAAA,UAAA,CAAW,IAAA,CAAK,CAAA,sBAAA,EAAyB,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,EAAA,EAAK,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IACtG;AACA,IAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,+GAAA,EAAsD,QAAQ,CAAA,CAAA,CAAG,CAAA;AAC7G,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAA,GAAO,gBAAA;AACb,MAAA,UAAA,CAAW,IAAA,CAAK,CAAA,aAAA,EAAgB,IAAI,CAAA,CAAE,CAAA;AACtC,MAAA,UAAA,CAAW,KAAK,mCAAmC,CAAA;AACnD,MAAA,UAAA,CAAW,IAAA,CAAK,8BAA8B,IAAA,CAAK,SAAA,CAAU,YAAY,CAAC,CAAC,CAAC,CAAA,QAAA,CAAU,CAAA;AAAA,IACxF,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,SAAS,QAAA,EAAU,UAAA,CAAW,IAAA,CAAK,CAAA,sBAAA,EAAyB,KAAK,CAAA,OAAA,CAAS,CAAA;AAAA,IACvF;AACA,IAAA,UAAA,CAAW,KAAK,gBAAgB,CAAA;AAChC,IAAA,OAAO,CAAC,CAAA,QAAA,EAAW,UAAA,CAAW,IAAA,CAAK,GAAG,CAAC,CAAA,KAAA,CAAO,CAAA;AAAA,EAChD;AAEA,EAAA,OAAO,eAAA,CAAgB,MAA8B,QAAQ,CAAA;AAC/D;AAtDS,MAAA,CAAA,WAAA,EAAA,aAAA,CAAA;AAwDT,SAAS,UAAU,IAAA,EAAqC;AACtD,EAAA,OAAO,CAAC,IAAA,CAAK,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA;AACtC;AAFS,MAAA,CAAA,SAAA,EAAA,WAAA,CAAA;AAIT,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,IAAI,WAAW,UAAA,CAAW,GAAG,CAAA,IAAK,UAAA,CAAW,WAAW,GAAG,CAAA,IAAK,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA,IAAK,UAAA,CAAW,UAAA,CAAW,KAAK,GAAG,OAAO,IAAA;AACpI,EAAA,IAAI;AACF,IAAA,OAAO,cAAc,GAAA,CAAI,IAAI,IAAI,UAAA,EAAY,uBAAuB,EAAE,QAAQ,CAAA;AAAA,EAChF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AARS,MAAA,CAAA,SAAA,EAAA,WAAA,CAAA;AAcT,SAAS,cAAA,CAAe,IAAA,EAAc,KAAA,EAAe,QAAA,EAAwC;AAC3F,EAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAA;AACxC,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,CAAE,WAAA,EAAY;AAClC,EAAA,MAAM,QAAA,GAAW,MAAM,CAAC,CAAA;AACxB,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,EAAK;AACxB,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,qBAAA,CAAsB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC9C,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,IAAI,CAAA,gEAAA,EAAsB,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,IAAA,KAAS,MAAA,IAAU,IAAA,KAAS,MAAA,EAAQ;AACtC,IAAA,IAAI,QAAA,QAAgB,IAAI,KAAA,CAAM,wBAAwB,IAAI,CAAA,6CAAA,EAAa,QAAQ,CAAA,CAAA,CAAG,CAAA;AAClF,IAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,EACtB;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,sBAAA,CAAuB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,IAAI,CAAA,mDAAA,EAAc,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,EACvE;AACA,EAAA,IAAI,IAAA,KAAS,IAAA,EAAM,OAAO,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,QAAA,CAAS,WAAA,EAAY,EAAG,IAAA,EAAK;AAC9E,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,IAAI,QAAA,CAAS,aAAY,KAAM,OAAA,QAAe,IAAI,KAAA,CAAM,CAAA,uEAAA,EAAuC,QAAQ,CAAA,CAAA,CAAG,CAAA;AAC1G,IAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,UAAU,IAAA,EAAK;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yEAAA,EAAyC,QAAQ,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,qBAAA,CAAsB,QAAQ,GAAG,IAAA,EAAK;AACzE;AAzBS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AA2BT,SAAS,sBAAsB,IAAA,EAAsB;AACnD,EAAA,OAAO,IAAA,CAAK,aAAY,KAAM,UAAA,GAAa,aAAa,IAAA,CAAK,WAAA,EAAY,KAAM,UAAA,GAAa,UAAA,GAAa,IAAA;AAC3G;AAFS,MAAA,CAAA,qBAAA,EAAA,uBAAA,CAAA","file":"html-component.cjs","sourcesContent":["import { parseFragment, type DefaultTreeAdapterMap, type DefaultTreeAdapterTypes } from 'parse5'\n\ntype HtmlNode = DefaultTreeAdapterTypes.Node\ntype HtmlDocumentFragment = DefaultTreeAdapterTypes.DocumentFragment\ntype HtmlElement = DefaultTreeAdapterTypes.Element\n\nconst blockedTags = new Set(['script', 'iframe', 'object', 'embed', 'base', 'meta', 'link', 'style'])\nconst blockedAttributes = /^(?:on[a-z]+|srcdoc|style)$/iu\nconst urlAttributes = new Set(['href', 'src', 'action', 'formaction', 'poster', 'xlink:href'])\nconst safeProtocols = new Set(['http:', 'https:', 'mailto:', 'tel:'])\nconst directivePattern = /^data-vobs-(text|slot|on|bind|prop)(?:-(.+))?$/iu\nconst safePropertyNames = new Set([\n  'value', 'checked', 'selected', 'disabled', 'multiple', 'readonly', 'required',\n  'autofocus', 'hidden', 'tabindex'\n])\n\nexport interface HtmlComponentOptions {\n  readonly filename?: string\n}\n\n/** Converts a trusted static HTML fragment to Vobs runtime node creation code. */\nexport function compileHtmlComponent(source: string, options: HtmlComponentOptions = {}): string {\n  const fragment = parseFragment(source)\n  const body = compileChildren(fragment, options.filename ?? 'component.html')\n  const result = body.length === 1 ? body[0] : `createFragment((parent, anchor) => {${body.map(code => `insertBefore(parent, ${code}, anchor);`).join('')}})`\n\n  return `import { addEventListener, bindAttribute, bindProperty, bindText, createElement, createFragment, createText, insertBefore, insertDynamic, setAttribute } from '@vobs/vobs';\\nfunction resolveHtmlSlot(value) { const resolved = typeof value === 'function' ? value() : value; if (resolved === undefined || resolved === null || resolved === false) return null; if (typeof resolved === 'string' || typeof resolved === 'number') return createText(String(resolved)); if (Array.isArray(resolved)) return createFragment((parent, anchor) => { for (const item of resolved) { const child = resolveHtmlSlot(item); if (child) insertBefore(parent, child, anchor); } }); return resolved; }\\nfunction sanitizeHtmlAttribute(name, value) { const stringValue = String(value ?? ''); if (!['href', 'src', 'action', 'formaction', 'poster', 'xlink:href'].includes(name.toLowerCase())) return stringValue; const normalized = stringValue.trim().toLowerCase(); if (normalized.startsWith('#') || normalized.startsWith('/') || normalized.startsWith('./') || normalized.startsWith('../')) return stringValue; try { const protocol = new URL(normalized, 'https://vobs.invalid/').protocol; return ['http:', 'https:', 'mailto:', 'tel:'].includes(protocol) ? stringValue : ''; } catch { return ''; } }\\nexport default function HtmlComponent(props = {}) { return ${result ?? \"createFragment(() => {})\"}; }`\n}\n\nfunction compileChildren(parent: HtmlDocumentFragment | HtmlElement, filename: string): string[] {\n  return parent.childNodes.flatMap(node => compileNode(node, filename))\n}\n\nfunction compileNode(node: HtmlNode, filename: string): string[] {\n  if (node.nodeName === '#text') {\n    const value = (node as DefaultTreeAdapterMap['textNode']).value\n    return value ? [`createText(${JSON.stringify(value)})`] : []\n  }\n\n  if (node.nodeName === '#comment') return []\n  if (node.nodeName !== '#document-fragment' && !isElement(node)) return []\n\n  if (isElement(node)) {\n    const tag = node.tagName.toLowerCase()\n    if (blockedTags.has(tag)) throw new Error(`Vobs HTML component: 禁止使用 <${tag}> (${filename})`)\n\n    const children = compileChildren(node, filename)\n    const statements = [`const element = createElement(${JSON.stringify(tag)})`]\n    const dynamicText = [] as string[]\n    for (const attribute of node.attrs) {\n      const name = attribute.name.toLowerCase()\n      const value = attribute.value\n      const directive = parseDirective(name, value, filename)\n      if (directive) {\n        if (directive.kind === 'text') {\n          dynamicText.push(directive.prop)\n        } else if (directive.kind === 'slot') {\n          statements.push(`insertDynamic(element, null, () => resolveHtmlSlot(props[${JSON.stringify(directive.prop)}]))`)\n        } else if (directive.kind === 'event') {\n          statements.push(`addEventListener(element, ${JSON.stringify(directive.name)}, (event) => { const handler = props[${JSON.stringify(directive.prop)}]; if (typeof handler === 'function') handler(event); })`)\n        } else if (directive.kind === 'attribute') {\n          statements.push(`bindAttribute(element, ${JSON.stringify(directive.name)}, () => sanitizeHtmlAttribute(${JSON.stringify(directive.name)}, props[${JSON.stringify(directive.prop)}] ?? ''))`)\n        } else if (directive.kind === 'property') {\n          statements.push(`bindProperty(element, ${JSON.stringify(directive.name)}, () => props[${JSON.stringify(directive.prop)}])`)\n        }\n        continue\n      }\n      if (blockedAttributes.test(name)) throw new Error(`Vobs HTML component: 禁止使用危险属性 ${attribute.name} (${filename})`)\n      if (urlAttributes.has(name) && !isSafeUrl(value)) {\n        throw new Error(`Vobs HTML component: 禁止使用危险 URL 属性 ${attribute.name} (${filename})`)\n      }\n      statements.push(`setAttribute(element, ${JSON.stringify(attribute.name)}, ${JSON.stringify(value)})`)\n    }\n    if (dynamicText.length > 1) throw new Error(`Vobs HTML component: 一个元素只能使用一个 data-vobs-text 指令 (${filename})`)\n    if (dynamicText.length === 1) {\n      const text = 'createText(\"\")'\n      statements.push(`const text = ${text}`)\n      statements.push('insertBefore(element, text, null)')\n      statements.push(`bindText(text, () => props[${JSON.stringify(dynamicText[0])}] ?? '')`)\n    } else {\n      for (const child of children) statements.push(`insertBefore(element, ${child}, null)`)\n    }\n    statements.push('return element')\n    return [`(() => {${statements.join(';')};})()`]\n  }\n\n  return compileChildren(node as HtmlDocumentFragment, filename)\n}\n\nfunction isElement(node: HtmlNode): node is HtmlElement {\n  return !node.nodeName.startsWith('#')\n}\n\nfunction isSafeUrl(value: string): boolean {\n  const normalized = value.trim().toLowerCase()\n  if (normalized.startsWith('#') || normalized.startsWith('/') || normalized.startsWith('./') || normalized.startsWith('../')) return true\n  try {\n    return safeProtocols.has(new URL(normalized, 'https://vobs.invalid/').protocol)\n  } catch {\n    return false\n  }\n}\n\ntype HtmlDirective =\n  | { readonly kind: 'text' | 'slot'; readonly prop: string }\n  | { readonly kind: 'event' | 'attribute' | 'property'; readonly name: string; readonly prop: string }\n\nfunction parseDirective(name: string, value: string, filename: string): HtmlDirective | null {\n  const match = directivePattern.exec(name)\n  if (!match) return null\n  const kind = match[1].toLowerCase()\n  const namePart = match[2]\n  const prop = value.trim()\n  if (!prop || !/^[A-Za-z_$][\\w$]*$/u.test(prop)) {\n    throw new Error(`Vobs HTML component: ${name} 必须引用有效的 props 名称 (${filename})`)\n  }\n  if (kind === 'text' || kind === 'slot') {\n    if (namePart) throw new Error(`Vobs HTML component: ${name} 不接受额外名称 (${filename})`)\n    return { kind, prop }\n  }\n  if (!namePart || !/^[a-z][a-z0-9:-]*$/iu.test(namePart)) {\n    throw new Error(`Vobs HTML component: ${name} 必须包含有效名称 (${filename})`)\n  }\n  if (kind === 'on') return { kind: 'event', name: namePart.toLowerCase(), prop }\n  if (kind === 'bind') {\n    if (namePart.toLowerCase() === 'style') throw new Error(`Vobs HTML component: 不允许动态绑定 style (${filename})`)\n    return { kind: 'attribute', name: namePart, prop }\n  }\n  if (!safePropertyNames.has(namePart.toLowerCase())) {\n    throw new Error(`Vobs HTML component: 不允许动态绑定 property ${namePart} (${filename})`)\n  }\n  return { kind: 'property', name: normalizePropertyName(namePart), prop }\n}\n\nfunction normalizePropertyName(name: string): string {\n  return name.toLowerCase() === 'readonly' ? 'readOnly' : name.toLowerCase() === 'tabindex' ? 'tabIndex' : name\n}\n"]}

package/dist/html-component.d.cts

@@ -0,0 +1,7 @@
+interface HtmlComponentOptions {
+    readonly filename?: string;
+}
+/** Converts a trusted static HTML fragment to Vobs runtime node creation code. */
+declare function compileHtmlComponent(source: string, options?: HtmlComponentOptions): string;
+
+export { type HtmlComponentOptions, compileHtmlComponent };

package/dist/html-component.d.ts

@@ -0,0 +1,7 @@
+interface HtmlComponentOptions {
+    readonly filename?: string;
+}
+/** Converts a trusted static HTML fragment to Vobs runtime node creation code. */
+declare function compileHtmlComponent(source: string, options?: HtmlComponentOptions): string;
+
+export { type HtmlComponentOptions, compileHtmlComponent };

package/dist/html-component.js

@@ -0,0 +1,136 @@
+import { parseFragment } from 'parse5';
+
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var blockedTags = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "base", "meta", "link", "style"]);
+var blockedAttributes = /^(?:on[a-z]+|srcdoc|style)$/iu;
+var urlAttributes = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "poster", "xlink:href"]);
+var safeProtocols = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
+var directivePattern = /^data-vobs-(text|slot|on|bind|prop)(?:-(.+))?$/iu;
+var safePropertyNames = /* @__PURE__ */ new Set([
+  "value",
+  "checked",
+  "selected",
+  "disabled",
+  "multiple",
+  "readonly",
+  "required",
+  "autofocus",
+  "hidden",
+  "tabindex"
+]);
+function compileHtmlComponent(source, options = {}) {
+  const fragment = parseFragment(source);
+  const body = compileChildren(fragment, options.filename ?? "component.html");
+  const result = body.length === 1 ? body[0] : `createFragment((parent, anchor) => {${body.map((code) => `insertBefore(parent, ${code}, anchor);`).join("")}})`;
+  return `import { addEventListener, bindAttribute, bindProperty, bindText, createElement, createFragment, createText, insertBefore, insertDynamic, setAttribute } from '@vobs/vobs';
+function resolveHtmlSlot(value) { const resolved = typeof value === 'function' ? value() : value; if (resolved === undefined || resolved === null || resolved === false) return null; if (typeof resolved === 'string' || typeof resolved === 'number') return createText(String(resolved)); if (Array.isArray(resolved)) return createFragment((parent, anchor) => { for (const item of resolved) { const child = resolveHtmlSlot(item); if (child) insertBefore(parent, child, anchor); } }); return resolved; }
+function sanitizeHtmlAttribute(name, value) { const stringValue = String(value ?? ''); if (!['href', 'src', 'action', 'formaction', 'poster', 'xlink:href'].includes(name.toLowerCase())) return stringValue; const normalized = stringValue.trim().toLowerCase(); if (normalized.startsWith('#') || normalized.startsWith('/') || normalized.startsWith('./') || normalized.startsWith('../')) return stringValue; try { const protocol = new URL(normalized, 'https://vobs.invalid/').protocol; return ['http:', 'https:', 'mailto:', 'tel:'].includes(protocol) ? stringValue : ''; } catch { return ''; } }
+export default function HtmlComponent(props = {}) { return ${result ?? "createFragment(() => {})"}; }`;
+}
+__name(compileHtmlComponent, "compileHtmlComponent");
+function compileChildren(parent, filename) {
+  return parent.childNodes.flatMap((node) => compileNode(node, filename));
+}
+__name(compileChildren, "compileChildren");
+function compileNode(node, filename) {
+  if (node.nodeName === "#text") {
+    const value = node.value;
+    return value ? [`createText(${JSON.stringify(value)})`] : [];
+  }
+  if (node.nodeName === "#comment") return [];
+  if (node.nodeName !== "#document-fragment" && !isElement(node)) return [];
+  if (isElement(node)) {
+    const tag = node.tagName.toLowerCase();
+    if (blockedTags.has(tag)) throw new Error(`Vobs HTML component: \u7981\u6B62\u4F7F\u7528 <${tag}> (${filename})`);
+    const children = compileChildren(node, filename);
+    const statements = [`const element = createElement(${JSON.stringify(tag)})`];
+    const dynamicText = [];
+    for (const attribute of node.attrs) {
+      const name = attribute.name.toLowerCase();
+      const value = attribute.value;
+      const directive = parseDirective(name, value, filename);
+      if (directive) {
+        if (directive.kind === "text") {
+          dynamicText.push(directive.prop);
+        } else if (directive.kind === "slot") {
+          statements.push(`insertDynamic(element, null, () => resolveHtmlSlot(props[${JSON.stringify(directive.prop)}]))`);
+        } else if (directive.kind === "event") {
+          statements.push(`addEventListener(element, ${JSON.stringify(directive.name)}, (event) => { const handler = props[${JSON.stringify(directive.prop)}]; if (typeof handler === 'function') handler(event); })`);
+        } else if (directive.kind === "attribute") {
+          statements.push(`bindAttribute(element, ${JSON.stringify(directive.name)}, () => sanitizeHtmlAttribute(${JSON.stringify(directive.name)}, props[${JSON.stringify(directive.prop)}] ?? ''))`);
+        } else if (directive.kind === "property") {
+          statements.push(`bindProperty(element, ${JSON.stringify(directive.name)}, () => props[${JSON.stringify(directive.prop)}])`);
+        }
+        continue;
+      }
+      if (blockedAttributes.test(name)) throw new Error(`Vobs HTML component: \u7981\u6B62\u4F7F\u7528\u5371\u9669\u5C5E\u6027 ${attribute.name} (${filename})`);
+      if (urlAttributes.has(name) && !isSafeUrl(value)) {
+        throw new Error(`Vobs HTML component: \u7981\u6B62\u4F7F\u7528\u5371\u9669 URL \u5C5E\u6027 ${attribute.name} (${filename})`);
+      }
+      statements.push(`setAttribute(element, ${JSON.stringify(attribute.name)}, ${JSON.stringify(value)})`);
+    }
+    if (dynamicText.length > 1) throw new Error(`Vobs HTML component: \u4E00\u4E2A\u5143\u7D20\u53EA\u80FD\u4F7F\u7528\u4E00\u4E2A data-vobs-text \u6307\u4EE4 (${filename})`);
+    if (dynamicText.length === 1) {
+      const text = 'createText("")';
+      statements.push(`const text = ${text}`);
+      statements.push("insertBefore(element, text, null)");
+      statements.push(`bindText(text, () => props[${JSON.stringify(dynamicText[0])}] ?? '')`);
+    } else {
+      for (const child of children) statements.push(`insertBefore(element, ${child}, null)`);
+    }
+    statements.push("return element");
+    return [`(() => {${statements.join(";")};})()`];
+  }
+  return compileChildren(node, filename);
+}
+__name(compileNode, "compileNode");
+function isElement(node) {
+  return !node.nodeName.startsWith("#");
+}
+__name(isElement, "isElement");
+function isSafeUrl(value) {
+  const normalized = value.trim().toLowerCase();
+  if (normalized.startsWith("#") || normalized.startsWith("/") || normalized.startsWith("./") || normalized.startsWith("../")) return true;
+  try {
+    return safeProtocols.has(new URL(normalized, "https://vobs.invalid/").protocol);
+  } catch {
+    return false;
+  }
+}
+__name(isSafeUrl, "isSafeUrl");
+function parseDirective(name, value, filename) {
+  const match = directivePattern.exec(name);
+  if (!match) return null;
+  const kind = match[1].toLowerCase();
+  const namePart = match[2];
+  const prop = value.trim();
+  if (!prop || !/^[A-Za-z_$][\w$]*$/u.test(prop)) {
+    throw new Error(`Vobs HTML component: ${name} \u5FC5\u987B\u5F15\u7528\u6709\u6548\u7684 props \u540D\u79F0 (${filename})`);
+  }
+  if (kind === "text" || kind === "slot") {
+    if (namePart) throw new Error(`Vobs HTML component: ${name} \u4E0D\u63A5\u53D7\u989D\u5916\u540D\u79F0 (${filename})`);
+    return { kind, prop };
+  }
+  if (!namePart || !/^[a-z][a-z0-9:-]*$/iu.test(namePart)) {
+    throw new Error(`Vobs HTML component: ${name} \u5FC5\u987B\u5305\u542B\u6709\u6548\u540D\u79F0 (${filename})`);
+  }
+  if (kind === "on") return { kind: "event", name: namePart.toLowerCase(), prop };
+  if (kind === "bind") {
+    if (namePart.toLowerCase() === "style") throw new Error(`Vobs HTML component: \u4E0D\u5141\u8BB8\u52A8\u6001\u7ED1\u5B9A style (${filename})`);
+    return { kind: "attribute", name: namePart, prop };
+  }
+  if (!safePropertyNames.has(namePart.toLowerCase())) {
+    throw new Error(`Vobs HTML component: \u4E0D\u5141\u8BB8\u52A8\u6001\u7ED1\u5B9A property ${namePart} (${filename})`);
+  }
+  return { kind: "property", name: normalizePropertyName(namePart), prop };
+}
+__name(parseDirective, "parseDirective");
+function normalizePropertyName(name) {
+  return name.toLowerCase() === "readonly" ? "readOnly" : name.toLowerCase() === "tabindex" ? "tabIndex" : name;
+}
+__name(normalizePropertyName, "normalizePropertyName");
+
+export { compileHtmlComponent };
+//# sourceMappingURL=html-component.js.map
+//# sourceMappingURL=html-component.js.map

package/dist/html-component.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/html-component.ts"],"names":[],"mappings":";;;;AAMA,IAAM,WAAA,mBAAc,IAAI,GAAA,CAAI,CAAC,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAC,CAAA;AACpG,IAAM,iBAAA,GAAoB,+BAAA;AAC1B,IAAM,aAAA,mBAAgB,IAAI,GAAA,CAAI,CAAC,MAAA,EAAQ,OAAO,QAAA,EAAU,YAAA,EAAc,QAAA,EAAU,YAAY,CAAC,CAAA;AAC7F,IAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,SAAS,QAAA,EAAU,SAAA,EAAW,MAAM,CAAC,CAAA;AACpE,IAAM,gBAAA,GAAmB,kDAAA;AACzB,IAAM,iBAAA,uBAAwB,GAAA,CAAI;AAAA,EAChC,OAAA;AAAA,EAAS,SAAA;AAAA,EAAW,UAAA;AAAA,EAAY,UAAA;AAAA,EAAY,UAAA;AAAA,EAAY,UAAA;AAAA,EAAY,UAAA;AAAA,EACpE,WAAA;AAAA,EAAa,QAAA;AAAA,EAAU;AACzB,CAAC,CAAA;AAOM,SAAS,oBAAA,CAAqB,MAAA,EAAgB,OAAA,GAAgC,EAAC,EAAW;AAC/F,EAAA,MAAM,QAAA,GAAW,cAAc,MAAM,CAAA;AACrC,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,QAAA,EAAU,OAAA,CAAQ,YAAY,gBAAgB,CAAA;AAC3E,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA,KAAW,CAAA,GAAI,IAAA,CAAK,CAAC,CAAA,GAAI,CAAA,oCAAA,EAAuC,IAAA,CAAK,GAAA,CAAI,UAAQ,CAAA,qBAAA,EAAwB,IAAI,YAAY,CAAA,CAAE,IAAA,CAAK,EAAE,CAAC,CAAA,EAAA,CAAA;AAEvJ,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA,2DAAA,EAAgzC,UAAU,0BAA0B,CAAA,GAAA,CAAA;AAC71C;AANgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAQhB,SAAS,eAAA,CAAgB,QAA4C,QAAA,EAA4B;AAC/F,EAAA,OAAO,OAAO,UAAA,CAAW,OAAA,CAAQ,UAAQ,WAAA,CAAY,IAAA,EAAM,QAAQ,CAAC,CAAA;AACtE;AAFS,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AAIT,SAAS,WAAA,CAAY,MAAgB,QAAA,EAA4B;AAC/D,EAAA,IAAI,IAAA,CAAK,aAAa,OAAA,EAAS;AAC7B,IAAA,MAAM,QAAS,IAAA,CAA2C,KAAA;AAC1D,IAAA,OAAO,KAAA,GAAQ,CAAC,CAAA,WAAA,EAAc,IAAA,CAAK,UAAU,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA,GAAI,EAAC;AAAA,EAC7D;AAEA,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,UAAA,EAAY,OAAO,EAAC;AAC1C,EAAA,IAAI,IAAA,CAAK,aAAa,oBAAA,IAAwB,CAAC,UAAU,IAAI,CAAA,SAAU,EAAC;AAExE,EAAA,IAAI,SAAA,CAAU,IAAI,CAAA,EAAG;AACnB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,WAAA,EAAY;AACrC,IAAA,IAAI,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,+CAAA,EAA8B,GAAG,CAAA,GAAA,EAAM,QAAQ,CAAA,CAAA,CAAG,CAAA;AAE5F,IAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,IAAA,EAAM,QAAQ,CAAA;AAC/C,IAAA,MAAM,aAAa,CAAC,CAAA,8BAAA,EAAiC,KAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,CAAG,CAAA;AAC3E,IAAA,MAAM,cAAc,EAAC;AACrB,IAAA,KAAA,MAAW,SAAA,IAAa,KAAK,KAAA,EAAO;AAClC,MAAA,MAAM,IAAA,GAAO,SAAA,CAAU,IAAA,CAAK,WAAA,EAAY;AACxC,MAAA,MAAM,QAAQ,SAAA,CAAU,KAAA;AACxB,MAAA,MAAM,SAAA,GAAY,cAAA,CAAe,IAAA,EAAM,KAAA,EAAO,QAAQ,CAAA;AACtD,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,IAAI,SAAA,CAAU,SAAS,MAAA,EAAQ;AAC7B,UAAA,WAAA,CAAY,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QACjC,CAAA,MAAA,IAAW,SAAA,CAAU,IAAA,KAAS,MAAA,EAAQ;AACpC,UAAA,UAAA,CAAW,KAAK,CAAA,yDAAA,EAA4D,IAAA,CAAK,UAAU,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,CAAK,CAAA;AAAA,QACjH,CAAA,MAAA,IAAW,SAAA,CAAU,IAAA,KAAS,OAAA,EAAS;AACrC,UAAA,UAAA,CAAW,IAAA,CAAK,CAAA,0BAAA,EAA6B,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,qCAAA,EAAwC,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,wDAAA,CAA0D,CAAA;AAAA,QAC7M,CAAA,MAAA,IAAW,SAAA,CAAU,IAAA,KAAS,WAAA,EAAa;AACzC,UAAA,UAAA,CAAW,KAAK,CAAA,uBAAA,EAA0B,IAAA,CAAK,UAAU,SAAA,CAAU,IAAI,CAAC,CAAA,8BAAA,EAAiC,IAAA,CAAK,UAAU,SAAA,CAAU,IAAI,CAAC,CAAA,QAAA,EAAW,IAAA,CAAK,UAAU,SAAA,CAAU,IAAI,CAAC,CAAA,SAAA,CAAW,CAAA;AAAA,QAC7L,CAAA,MAAA,IAAW,SAAA,CAAU,IAAA,KAAS,UAAA,EAAY;AACxC,UAAA,UAAA,CAAW,IAAA,CAAK,CAAA,sBAAA,EAAyB,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,cAAA,EAAiB,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,QAC5H;AACA,QAAA;AAAA,MACF;AACA,MAAA,IAAI,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,sEAAA,EAAiC,SAAA,CAAU,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAA,CAAG,CAAA;AACjH,MAAA,IAAI,cAAc,GAAA,CAAI,IAAI,KAAK,CAAC,SAAA,CAAU,KAAK,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2EAAA,EAAsC,UAAU,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,MACtF;AACA,MAAA,UAAA,CAAW,IAAA,CAAK,CAAA,sBAAA,EAAyB,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,IAAI,CAAC,CAAA,EAAA,EAAK,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IACtG;AACA,IAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,+GAAA,EAAsD,QAAQ,CAAA,CAAA,CAAG,CAAA;AAC7G,IAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAA,GAAO,gBAAA;AACb,MAAA,UAAA,CAAW,IAAA,CAAK,CAAA,aAAA,EAAgB,IAAI,CAAA,CAAE,CAAA;AACtC,MAAA,UAAA,CAAW,KAAK,mCAAmC,CAAA;AACnD,MAAA,UAAA,CAAW,IAAA,CAAK,8BAA8B,IAAA,CAAK,SAAA,CAAU,YAAY,CAAC,CAAC,CAAC,CAAA,QAAA,CAAU,CAAA;AAAA,IACxF,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,SAAS,QAAA,EAAU,UAAA,CAAW,IAAA,CAAK,CAAA,sBAAA,EAAyB,KAAK,CAAA,OAAA,CAAS,CAAA;AAAA,IACvF;AACA,IAAA,UAAA,CAAW,KAAK,gBAAgB,CAAA;AAChC,IAAA,OAAO,CAAC,CAAA,QAAA,EAAW,UAAA,CAAW,IAAA,CAAK,GAAG,CAAC,CAAA,KAAA,CAAO,CAAA;AAAA,EAChD;AAEA,EAAA,OAAO,eAAA,CAAgB,MAA8B,QAAQ,CAAA;AAC/D;AAtDS,MAAA,CAAA,WAAA,EAAA,aAAA,CAAA;AAwDT,SAAS,UAAU,IAAA,EAAqC;AACtD,EAAA,OAAO,CAAC,IAAA,CAAK,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA;AACtC;AAFS,MAAA,CAAA,SAAA,EAAA,WAAA,CAAA;AAIT,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,IAAI,WAAW,UAAA,CAAW,GAAG,CAAA,IAAK,UAAA,CAAW,WAAW,GAAG,CAAA,IAAK,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA,IAAK,UAAA,CAAW,UAAA,CAAW,KAAK,GAAG,OAAO,IAAA;AACpI,EAAA,IAAI;AACF,IAAA,OAAO,cAAc,GAAA,CAAI,IAAI,IAAI,UAAA,EAAY,uBAAuB,EAAE,QAAQ,CAAA;AAAA,EAChF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AARS,MAAA,CAAA,SAAA,EAAA,WAAA,CAAA;AAcT,SAAS,cAAA,CAAe,IAAA,EAAc,KAAA,EAAe,QAAA,EAAwC;AAC3F,EAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAA;AACxC,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,CAAE,WAAA,EAAY;AAClC,EAAA,MAAM,QAAA,GAAW,MAAM,CAAC,CAAA;AACxB,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,EAAK;AACxB,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,qBAAA,CAAsB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC9C,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,IAAI,CAAA,gEAAA,EAAsB,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,IAAA,KAAS,MAAA,IAAU,IAAA,KAAS,MAAA,EAAQ;AACtC,IAAA,IAAI,QAAA,QAAgB,IAAI,KAAA,CAAM,wBAAwB,IAAI,CAAA,6CAAA,EAAa,QAAQ,CAAA,CAAA,CAAG,CAAA;AAClF,IAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,EACtB;AACA,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,sBAAA,CAAuB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,IAAI,CAAA,mDAAA,EAAc,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,EACvE;AACA,EAAA,IAAI,IAAA,KAAS,IAAA,EAAM,OAAO,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,QAAA,CAAS,WAAA,EAAY,EAAG,IAAA,EAAK;AAC9E,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,IAAI,QAAA,CAAS,aAAY,KAAM,OAAA,QAAe,IAAI,KAAA,CAAM,CAAA,uEAAA,EAAuC,QAAQ,CAAA,CAAA,CAAG,CAAA;AAC1G,IAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,UAAU,IAAA,EAAK;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yEAAA,EAAyC,QAAQ,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,MAAM,qBAAA,CAAsB,QAAQ,GAAG,IAAA,EAAK;AACzE;AAzBS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AA2BT,SAAS,sBAAsB,IAAA,EAAsB;AACnD,EAAA,OAAO,IAAA,CAAK,aAAY,KAAM,UAAA,GAAa,aAAa,IAAA,CAAK,WAAA,EAAY,KAAM,UAAA,GAAa,UAAA,GAAa,IAAA;AAC3G;AAFS,MAAA,CAAA,qBAAA,EAAA,uBAAA,CAAA","file":"html-component.js","sourcesContent":["import { parseFragment, type DefaultTreeAdapterMap, type DefaultTreeAdapterTypes } from 'parse5'\n\ntype HtmlNode = DefaultTreeAdapterTypes.Node\ntype HtmlDocumentFragment = DefaultTreeAdapterTypes.DocumentFragment\ntype HtmlElement = DefaultTreeAdapterTypes.Element\n\nconst blockedTags = new Set(['script', 'iframe', 'object', 'embed', 'base', 'meta', 'link', 'style'])\nconst blockedAttributes = /^(?:on[a-z]+|srcdoc|style)$/iu\nconst urlAttributes = new Set(['href', 'src', 'action', 'formaction', 'poster', 'xlink:href'])\nconst safeProtocols = new Set(['http:', 'https:', 'mailto:', 'tel:'])\nconst directivePattern = /^data-vobs-(text|slot|on|bind|prop)(?:-(.+))?$/iu\nconst safePropertyNames = new Set([\n  'value', 'checked', 'selected', 'disabled', 'multiple', 'readonly', 'required',\n  'autofocus', 'hidden', 'tabindex'\n])\n\nexport interface HtmlComponentOptions {\n  readonly filename?: string\n}\n\n/** Converts a trusted static HTML fragment to Vobs runtime node creation code. */\nexport function compileHtmlComponent(source: string, options: HtmlComponentOptions = {}): string {\n  const fragment = parseFragment(source)\n  const body = compileChildren(fragment, options.filename ?? 'component.html')\n  const result = body.length === 1 ? body[0] : `createFragment((parent, anchor) => {${body.map(code => `insertBefore(parent, ${code}, anchor);`).join('')}})`\n\n  return `import { addEventListener, bindAttribute, bindProperty, bindText, createElement, createFragment, createText, insertBefore, insertDynamic, setAttribute } from '@vobs/vobs';\\nfunction resolveHtmlSlot(value) { const resolved = typeof value === 'function' ? value() : value; if (resolved === undefined || resolved === null || resolved === false) return null; if (typeof resolved === 'string' || typeof resolved === 'number') return createText(String(resolved)); if (Array.isArray(resolved)) return createFragment((parent, anchor) => { for (const item of resolved) { const child = resolveHtmlSlot(item); if (child) insertBefore(parent, child, anchor); } }); return resolved; }\\nfunction sanitizeHtmlAttribute(name, value) { const stringValue = String(value ?? ''); if (!['href', 'src', 'action', 'formaction', 'poster', 'xlink:href'].includes(name.toLowerCase())) return stringValue; const normalized = stringValue.trim().toLowerCase(); if (normalized.startsWith('#') || normalized.startsWith('/') || normalized.startsWith('./') || normalized.startsWith('../')) return stringValue; try { const protocol = new URL(normalized, 'https://vobs.invalid/').protocol; return ['http:', 'https:', 'mailto:', 'tel:'].includes(protocol) ? stringValue : ''; } catch { return ''; } }\\nexport default function HtmlComponent(props = {}) { return ${result ?? \"createFragment(() => {})\"}; }`\n}\n\nfunction compileChildren(parent: HtmlDocumentFragment | HtmlElement, filename: string): string[] {\n  return parent.childNodes.flatMap(node => compileNode(node, filename))\n}\n\nfunction compileNode(node: HtmlNode, filename: string): string[] {\n  if (node.nodeName === '#text') {\n    const value = (node as DefaultTreeAdapterMap['textNode']).value\n    return value ? [`createText(${JSON.stringify(value)})`] : []\n  }\n\n  if (node.nodeName === '#comment') return []\n  if (node.nodeName !== '#document-fragment' && !isElement(node)) return []\n\n  if (isElement(node)) {\n    const tag = node.tagName.toLowerCase()\n    if (blockedTags.has(tag)) throw new Error(`Vobs HTML component: 禁止使用 <${tag}> (${filename})`)\n\n    const children = compileChildren(node, filename)\n    const statements = [`const element = createElement(${JSON.stringify(tag)})`]\n    const dynamicText = [] as string[]\n    for (const attribute of node.attrs) {\n      const name = attribute.name.toLowerCase()\n      const value = attribute.value\n      const directive = parseDirective(name, value, filename)\n      if (directive) {\n        if (directive.kind === 'text') {\n          dynamicText.push(directive.prop)\n        } else if (directive.kind === 'slot') {\n          statements.push(`insertDynamic(element, null, () => resolveHtmlSlot(props[${JSON.stringify(directive.prop)}]))`)\n        } else if (directive.kind === 'event') {\n          statements.push(`addEventListener(element, ${JSON.stringify(directive.name)}, (event) => { const handler = props[${JSON.stringify(directive.prop)}]; if (typeof handler === 'function') handler(event); })`)\n        } else if (directive.kind === 'attribute') {\n          statements.push(`bindAttribute(element, ${JSON.stringify(directive.name)}, () => sanitizeHtmlAttribute(${JSON.stringify(directive.name)}, props[${JSON.stringify(directive.prop)}] ?? ''))`)\n        } else if (directive.kind === 'property') {\n          statements.push(`bindProperty(element, ${JSON.stringify(directive.name)}, () => props[${JSON.stringify(directive.prop)}])`)\n        }\n        continue\n      }\n      if (blockedAttributes.test(name)) throw new Error(`Vobs HTML component: 禁止使用危险属性 ${attribute.name} (${filename})`)\n      if (urlAttributes.has(name) && !isSafeUrl(value)) {\n        throw new Error(`Vobs HTML component: 禁止使用危险 URL 属性 ${attribute.name} (${filename})`)\n      }\n      statements.push(`setAttribute(element, ${JSON.stringify(attribute.name)}, ${JSON.stringify(value)})`)\n    }\n    if (dynamicText.length > 1) throw new Error(`Vobs HTML component: 一个元素只能使用一个 data-vobs-text 指令 (${filename})`)\n    if (dynamicText.length === 1) {\n      const text = 'createText(\"\")'\n      statements.push(`const text = ${text}`)\n      statements.push('insertBefore(element, text, null)')\n      statements.push(`bindText(text, () => props[${JSON.stringify(dynamicText[0])}] ?? '')`)\n    } else {\n      for (const child of children) statements.push(`insertBefore(element, ${child}, null)`)\n    }\n    statements.push('return element')\n    return [`(() => {${statements.join(';')};})()`]\n  }\n\n  return compileChildren(node as HtmlDocumentFragment, filename)\n}\n\nfunction isElement(node: HtmlNode): node is HtmlElement {\n  return !node.nodeName.startsWith('#')\n}\n\nfunction isSafeUrl(value: string): boolean {\n  const normalized = value.trim().toLowerCase()\n  if (normalized.startsWith('#') || normalized.startsWith('/') || normalized.startsWith('./') || normalized.startsWith('../')) return true\n  try {\n    return safeProtocols.has(new URL(normalized, 'https://vobs.invalid/').protocol)\n  } catch {\n    return false\n  }\n}\n\ntype HtmlDirective =\n  | { readonly kind: 'text' | 'slot'; readonly prop: string }\n  | { readonly kind: 'event' | 'attribute' | 'property'; readonly name: string; readonly prop: string }\n\nfunction parseDirective(name: string, value: string, filename: string): HtmlDirective | null {\n  const match = directivePattern.exec(name)\n  if (!match) return null\n  const kind = match[1].toLowerCase()\n  const namePart = match[2]\n  const prop = value.trim()\n  if (!prop || !/^[A-Za-z_$][\\w$]*$/u.test(prop)) {\n    throw new Error(`Vobs HTML component: ${name} 必须引用有效的 props 名称 (${filename})`)\n  }\n  if (kind === 'text' || kind === 'slot') {\n    if (namePart) throw new Error(`Vobs HTML component: ${name} 不接受额外名称 (${filename})`)\n    return { kind, prop }\n  }\n  if (!namePart || !/^[a-z][a-z0-9:-]*$/iu.test(namePart)) {\n    throw new Error(`Vobs HTML component: ${name} 必须包含有效名称 (${filename})`)\n  }\n  if (kind === 'on') return { kind: 'event', name: namePart.toLowerCase(), prop }\n  if (kind === 'bind') {\n    if (namePart.toLowerCase() === 'style') throw new Error(`Vobs HTML component: 不允许动态绑定 style (${filename})`)\n    return { kind: 'attribute', name: namePart, prop }\n  }\n  if (!safePropertyNames.has(namePart.toLowerCase())) {\n    throw new Error(`Vobs HTML component: 不允许动态绑定 property ${namePart} (${filename})`)\n  }\n  return { kind: 'property', name: normalizePropertyName(namePart), prop }\n}\n\nfunction normalizePropertyName(name: string): string {\n  return name.toLowerCase() === 'readonly' ? 'readOnly' : name.toLowerCase() === 'tabindex' ? 'tabIndex' : name\n}\n"]}