…#183)

## Summary
Fixes #165 (High).

`notifySubscribers` iterated the live `subscribers` array while
unsubscribe `splice`s it, so a self-detaching watcher caused the next
subscriber to be silently skipped for that notification cycle.

## Fix
Iterate a snapshot (`[...subscribers]`), mirroring the existing
`$onAction` listener-snapshot guard in the same file.

## Verification
- Regression test with the exact issue repro (subscriber A
self-unsubscribes, subscriber B must still fire); fails without the fix,
passes with it.
- `bun test tests/store.test.ts`: 95 pass / 0 fail. `tsc --noEmit`
clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

…ng (#186)

## Summary
Fixes #167 (Medium; High where templates can carry untrusted content).

The DOM-backed `evaluateSSR` (active whenever a global/configured
`DOMParser` exists) had two problems:
1. It fell back to `new Function(...keys, `return (${expr});`)` for any
non-trivial expression — `unsafe-eval` on a path whose sibling
`expression.ts` was written specifically to avoid it.
2. Its dot-notation fast-lane didn't call `isPrototypePollutionKey`, so
`constructor.constructor` walked the prototype chain and returned the
`Function` constructor.

## Fix
`evaluateSSR` now delegates to the shared, CSP-safe `evaluateExpression`
(Pratt parser in `expression.ts`) already used by the pure renderer.
This removes the `new Function` fallback and the proto-lookup gap in one
step, and unifies evaluator behaviour across both backends. The dead
`unwrap`/`isSignal`/`isComputed` imports are dropped (unwrapping lives
in the shared evaluator).

## Verification
- New test: `constructor.constructor` on the DOM backend yields no
`Function` (fails on the old code, passes now).
- New test: complex arithmetic (`a + b`) still evaluates via the safe
parser.
- Grep confirms no `new Function` remains in `src/ssr`.
- Full suite: 2988 pass / 0 fail. `tsc --noEmit` + eslint clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

…literals (#190)

## Summary
Fixes #170 (Medium; build-breaking).

`scanStringLiteral` returned `i + 1` unconditionally and never verified
the closing quote, so an unterminated literal (`<p bq-text="'oops">`)
was copied verbatim and `compileExpression` returned `{ ok: true }` with
a broken body. Because `emitModule` writes every expression into **one**
module, a single malformed entry throws at import time and takes down
*all* precompiled expressions in that file — with no per-expression
runtime fallback. Malformed numeric literals (`1ex`) hit the same class
of bug via `scanNumericLiteral`.

## Fix
- `scanStringLiteral` throws `Bail('unterminated string literal')` when
it reaches end-of-input without the matching quote.
- Scanned numeric runs are validated against a numeric-literal regex
(decimal/hex/octal/binary with `_` separators); invalid runs throw
`Bail('invalid numeric literal')`.

Both bails route through the existing `try/catch` in `compileExpression`
to `{ ok: false, reason }`, so the expression cleanly falls back to the
runtime evaluator instead of poisoning the module.

## Verification
- New tests: unterminated `'oops` / `"unclosed` / `greeting + 'tail`
bail; escaped-quote strings still compile; `1ex`/`1e`/`0xG1` bail while
`1`, `1.5`, `0xFF`, `1e3`, `1_000`, `.5`, `0b1010` still compile. Both
new tests fail on the pre-fix code.
- View suites (compiler/view/stable/1-14): all pass. `tsc --noEmit`
clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

## Summary
Fixes #171 (Medium).

`createTrustedHtml` / `getTrustedTypesPolicy` existed but **no DOM-write
path called them** — they were only re-exported. So under an enforced
`require-trusted-types-for 'script'` CSP, every `innerHTML
=`/`insertAdjacentHTML` in
`dom.ts`/`collection.ts`/`element.ts`/directives threw (framework fails
closed but non-functional), and the documented "Trusted Types / CSP
compliance" property was simply absent.

## Fix
New `trustedHtmlForSink(rawHtml)` in `security/trusted-types.ts`:
returns a `TrustedHTML` when a policy is active (so the write satisfies
enforced TT), otherwise the sanitized string — sanitizing exactly once.
All **sanitized** sinks now route through it:
- `core/dom.ts`: `setHtml`, `createElementFromHtml`, `insertContent`
- `core/collection.ts`: `Collection.html()`, `insertAll()`
- `view/directives`: `bq-html` (sanitized branch), `bq-html-safe`
- `element.ts` `html()` inherits it via `setHtml`

The explicit `htmlUnsafe()` / `sanitize: false` escape hatches are
deliberately left as raw writes (bypassing sanitization is their
documented purpose). The `sanitizeHtml` JSDoc is corrected to describe
actual behavior (returns a branded string; the framework's sinks wrap it
for TT).

## Verification
- New test proves the **positive path**: with a mock TT policy installed
(fresh module instance to avoid cached-policy leakage),
`trustedHtmlForSink` invokes `policy.createHTML` and returns the branded
`TrustedHTML`.
- New test for the **fallback path**: returns a sanitized, sink-safe
string in a non-TT environment.
- Existing sink sanitization tests still pass (behavior unchanged
without TT).
- Full suite: 2988 pass / 0 fail. `tsc --noEmit` + eslint clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

#192)

## Summary
Fixes #172 (Medium; correctness / resource exhaustion).

`useFetch` kept a single shared `currentAbortController` and overwrote
it on every `execute()`. When executions overlap (a `watch` refresh
racing a manual `refresh()`/`execute()`), the earlier in-flight fetch
was **never aborted** — its result was discarded by the `executionId`
guard, but the request kept consuming network/CPU, and `state.abort()`
could only cancel the most recent controller. Rapid `watch` churn piled
up un-cancellable requests.

## Fix
`execute()` aborts the previous controller
(`currentAbortController?.abort()`) before creating the new one. The
superseded request is cancelled immediately. The existing `finally`
cleanup already only nulls the controller when it's still the current
one, so no cross-execution clobbering.

## Verification
- New test: two overlapping executions; the first request's
`AbortSignal` becomes `aborted`, the second stays live. Fails without
the fix.
- Reactive/http/network/concurrency suites: 335 pass / 0 fail. `tsc
--noEmit` clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

## Summary
Fixes #173 (Medium; memory leaks).

Three composables created long-lived reactive primitives with no
disposal path, leaking whenever created outside an active `effectScope`.

## Fixes
- **`deferred()`** — created an internal `effect` (and its scheduled
timer/idle callback) but returned only `readonly(mirror)`, no disposer.
Now returns `ReadonlySignalHandle<T> & { dispose() }`; `dispose()` stops
the effect (its cleanup cancels any pending timer) and disposes the
mirror. Scope-managed behavior when inside a scope is unchanged.
- **`persistedSignal()`** — the persistence `effect` auto-registered
with the ambient scope, so `scope.stop()` silently stopped persistence
while the returned signal kept living, and there was no other way to
stop it. Persistence now runs in a **detached** scope tied to the
signal's own `dispose()`: an ambient `scope.stop()` no longer affects
it, and `signal.dispose()` stops persistence.
- **`effectScope(detached?)`** — new optional param (mirrors Vue's
`effectScope(true)`): when `true` the scope isn't auto-collected by an
enclosing scope. Additive, backward-compatible.

(The third sub-point in the issue — module-scope `computed()` retention
— is a documented must-dispose contract; `computed` already exposes
`dispose()`. This PR addresses the two composables that had *no*
disposal path at all.)

## Verification
- `deferred`: new test asserts source changes stop flowing after
`dispose()`.
- `persistedSignal`: new tests assert persistence survives an ambient
`scope.stop()` and stops after `signal.dispose()`. Both new persist
tests + the deferred test fail on the pre-fix code.
- Full suite: 2989 pass / 0 fail. `tsc --noEmit` + eslint clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

…#194)

## Summary
Fixes #174 (Low; contract violation + minor info-shape leak).

`interpolate` and the ICU `arg`/`select`/`plural` sites used the `in`
operator (and `resolveKey` walked key segments without a guard), which
resolves inherited `Object.prototype` members. A placeholder or key
matching `toString`/`valueOf`/`constructor`/`__proto__`/… was treated as
present even when `params`/`messages` didn't own it, substituting the
inherited value (e.g. `Hello {toString}` → the native function source)
instead of leaving the literal `{name}` intact.

## Fix
All lookup sites use `Object.prototype.hasOwnProperty.call(...)`:
- `translate.ts`: `interpolate` placeholder check + defensive guard in
`resolveKey`
- `icu.ts`: shared `hasParam()` helper used by the `arg`, `select`, and
`plural` cases

## Verification
- New tests: `{toString}`/`{constructor}` placeholders left intact; real
params still substitute; `resolveKey` returns `undefined` for inherited
names; ICU `arg`/`select` unaffected by inherited names. All three fail
on the pre-fix code.
- i18n suites: 110 pass / 0 fail. `tsc --noEmit` clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

## Summary
Fixes #175 (Low; robustness).

The store's `deepClone` assigned via bracket notation over
`Object.keys`, so a state object with an own enumerable `__proto__` key
(e.g. from `JSON.parse('{"__proto__":{…}}')`) triggered the `__proto__`
setter and reassigned the **clone's** prototype instead of copying a
data property, corrupting the object `$patchDeep` operates on. Contained
(no global `Object.prototype` pollution) but a fidelity bug.

## Fix
`deepClone` skips prototype-pollution keys via the shared
`isPrototypePollutionKey` helper from `core/utils/object.ts` (already
used by `merge`).

## Verification
- New test: cloning a `JSON.parse`'d
`{"__proto__":{polluted:true},"safe":1}` yields a clone whose prototype
is still `Object.prototype`, preserves `safe`, and does not pollute
`{}`. Fails on the pre-fix code.
- Store suite: 95 pass / 0 fail. `tsc --noEmit` clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

## Summary
Fixes #177 (Low; correctness — not exploitable).

`titleTemplate` was applied with `state.titleTemplate.replace(/%s/g,
state.title)`. Because the title is the **replacement string**, special
replacement patterns (`$&`, `$1`, `` $` ``, `$'`) in the title were
interpreted by `String.prototype.replace` and mangled the output — e.g.
a page titled `Q&A $& more` rendered incorrectly.

## Fix
Use a replacer **function** (`() => state.title`) so the title is
inserted literally. Output is still `escapeText`'d as before.

## Verification
- New test: a title containing `$&` renders literally under a `%s |
Acme` template. Fails on the pre-fix code.
- ssr-runtime suite: 107 pass / 0 fail. `tsc --noEmit` clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

## Summary
Fixes #179 (Low; defense-in-depth).

DOM-clobbering protection only stripped `id`/`name` values whose exact
value was in a ~30-entry reserved list, and the classic duplicate-id
HTMLCollection vector (`<a id=x></a><a id=x name=y>`) passed unchanged.
The list was also missing many high-value targets (`attributes`,
`nodeName`, `getElementById`, `defaultView`, `implementation`, …).

## Fix
- **Expanded `RESERVED_IDS`** with the missing
global/document/node/traversal targets.
- **Duplicate-id stripping** in `sanitize-core.ts`: the first occurrence
of an id is kept; later elements sharing it have their `id` dropped, so
named access resolves to a single node.
- Documented that the `id`/`name` denylist is defense-in-depth, not a
complete guarantee — fully untrusted content should drop `id`/`name`
entirely.

## Verification
- New tests: duplicate `id="x"` reduced to one occurrence; several
newly-added reserved ids (`attributes`, `getElementById`, `defaultView`,
`implementation`) are stripped. Both fail on the pre-fix code.
- security/core/view suites: all pass. `tsc --noEmit` clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

#200)

## Summary
Fixes #180 (Low; correctness — silent no-op).

`bq-on` decided "bare function reference vs. call" by testing whether
the expression string contained `(`. This misfires on expressions where
the paren is not the top-level call:

```html
<button bq-on:click="items.find(x => x).handler">
```

was treated as a full expression, evaluated once, and the returned
`handler` was **never invoked** — the click silently did nothing.

## Fix
Both `bq-on` sinks (`on.ts` and `on-modifiers.ts`) now share
`runOnExpression`: always evaluate the expression via `evaluateRaw`, and
if the result is a function, invoke it with the event; otherwise the
evaluation itself was the side effect (`count.value++`,
`handleClick($event)`). The string heuristic is removed. (`this` remains
unbound for a function resolved from a member chain — use an explicit
call when the receiver matters, as before.)

## Verification
- New tests: a handler resolved from `items.find(matcher).handler` now
fires; a bare `onClick` reference is invoked with the event. The
inner-paren case is exactly what silently no-op'd on the pre-fix code.
- Existing bq-on tests (bare ref, `handleClick($event)`,
`count.value++`/`--`/`+=`) still pass.
- view suites: 119 pass / 0 fail. `tsc --noEmit` + eslint clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

#201)

## Summary
Fixes #181 (Low; authz footgun by omission).

Action/HTML routes received `options.middlewares`; the JSON loader
endpoints received a **separate** `options.dataMiddlewares`. A developer
who protects mutations with `middlewares: [auth]` but forgets
`dataMiddlewares` exposed every route's `load()` output as
**unauthenticated JSON** at `${dataPath}<route>` — the loader mirrors
the same data an authenticated page renders, so this is a plausible
authorization bypass introduced by omission.

## Fix
`dataMiddlewares` now defaults to `middlewares` when unset
(`options.dataMiddlewares ?? options.middlewares`). Pass
`dataMiddlewares: []` to explicitly opt loader routes out of the action
chain. Documented on the option.

## Verification
- New tests: with `middlewares: [auth]` and no `dataMiddlewares`, the
generated GET loader route inherits `[auth]`; with an explicit
`dataMiddlewares: []` it opts out. The default-inheritance test fails on
the pre-fix code.
- server suites: all pass. `tsc --noEmit` clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

## Summary
Fixes #168 (Medium hardening).

`evaluate`/`evaluateRaw` run `new Function('$ctx', 'with($ctx){ return
(expr); }')`. The proxy `has` trap returned `prop in target`, so
inherited `Object.prototype` members resolved from the context and
`constructor.constructor('…')()` reached the `Function` constructor —
arbitrary code execution wherever `bq-*` attributes carry untrusted
content.

## Fix
The issue's suggested own-keys-only `has` trap is necessary but **not
sufficient**: once the proxy declines `constructor`, `with` resolution
falls through to the enclosing global scope, where the global object
inherits `constructor` from `Object.prototype` and exposes
`Function`/`eval`/`globalThis`. A bare `Function('…')()` escapes the
same way.

So the evaluator now **shadows** a denylist (`constructor`, `__proto__`,
`prototype`, `Function`, `eval`, `globalThis`, `global`, `window`,
`self`, `top`, `parent`): `has` reports them present (so they never fall
through to the global scope) and `get` resolves them to `undefined`
unless the context legitimately owns that property. Member access on the
resulting `undefined` throws → `undefined`. Both the lazy (`evaluate`)
and raw (`evaluateRaw`) paths are covered.

Legitimate templates are unaffected: own context props (including ones
shadowing a dangerous name), arithmetic, and method calls on context
*values* (e.g. `name.toUpperCase()`) all still work.

## Verification
- Tests: `constructor.constructor(…)()` on both `evaluate` and
`evaluateRaw`, bare `Function(…)()` and `eval(…)`, plus positive cases
(own props, method calls, own-prop shadowing a global name). The exploit
tests fail on the pre-fix code.
- Full suite: 2993 pass / 0 fail. `tsc --noEmit` + eslint clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <[email protected]>

## Summary
Fixes #176 (Low; CSS injection — no HTML breakout).

The DOM-free `setStyle` concatenated `bq-style` property names and
values into the inline `style` attribute with no CSS-level validation.
Attribute escaping prevents HTML breakout, but an untrusted style value
like `x;} body{display:none` injected extra declarations/rules
(UI-redress/clickjacking, exfiltration via `background: url(...)`).

## Fix
`setStyle` (pure renderer) now drops any declaration whose property name
is not a valid CSS identifier (`--custom` or kebab-case) or whose value
contains injection characters (`;`, `{`, `}`, `<`). The DOM-backed
renderer was already safe — it writes via
`CSSStyleDeclaration.setProperty`, which rejects malformed values.

## Verification
- New tests across both backends: a malicious `width: 'x;}
body{display:none'` is dropped; safe declarations (`color`, `marginTop`)
pass through. The malicious case fails on the pre-fix pure renderer.
- SSR suites: all pass. `tsc --noEmit` clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Jonas Pfalzgraf <[email protected]>
Co-authored-by: Claude Fable 5 <[email protected]>

…ll (#198)

## Summary
Fixes #178 (Low; correctness).

With `{ leading: true, trailing: true }`, a **single** call
double-invoked: the leading branch invoked with `preservePending =
trailing` (keeping `pendingArgs`), then `trailingTrigger` saw
`pendingArgs` still set and invoked again. One call → two invocations.

## Fix
The leading invoke now clears `pendingArgs`. A subsequent call within
the window re-sets `pendingArgs` (the leading branch is skipped once
`leadingDone`), so the trailing edge still fires — but only when the
function was called more than once, matching lodash semantics.

## Verification
- Existing multi-call test (`fn(1); fn(2); fn(3)` → `[1, 3]`) still
passes.
- Rewrote the single-call test that previously codified the bug: `fn(1)`
now yields `[1]`, not `[1, 1]`. It fails on the pre-fix code.
- function/utils/core suites: all pass. `tsc --noEmit` clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

## Summary
Fixes #169 (Medium; direct credential-theft impact).

The session-id cookie (the sole bearer credential) and the CSRF secret
cookie (embeds the raw secret in signed mode) both defaulted to **no
`Secure`** flag. On any plaintext-HTTP hop — an HTTP→HTTPS redirect, a
misconfigured proxy — a network MITM could read them and hijack the
session or forge matching CSRF tokens. `sameSite: 'lax'` does not
compensate.

## Fix
Both middlewares now default `secure: true` with an explicit opt-out for
local HTTP dev:
```ts
secure: options.cookie?.secure ?? true
```
Placed after the `...options.cookie` spread so a user's explicit
`secure: false` still wins. Session (`session.ts`, including the
destroy/expire path via shared `baseCookie`) and CSRF (`csrf.ts`) are
covered. Doc comments updated.

## Verification
- Strengthened the existing "secure-by-default" session test (it never
actually asserted `Secure`) + new opt-out test.
- New CSRF tests: `Secure` present by default, absent when `secure:
false`.
- `bun test` server suites: all pass. `tsc --noEmit` clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <[email protected]>

## Summary
Fixes #164 (High).

`bq-bind` wrote runtime data to any attribute with no validation:
- `<a bq-bind:href="link">` with `link =
"javascript:alert(document.cookie)"` → clickable script execution
- `<div bq-bind:onclick="h">` → registered a live inline handler
- `<iframe bq-bind:srcdoc="msg">` (client **and** both SSR backends) →
attribute-encoding is decoded by the browser and parsed as a full HTML
document → script execution

## Fix
New shared guard
[`src/security/bind-guard.ts`](src/security/bind-guard.ts)
(`checkBoundAttribute`), reused by all three sinks (client directive,
pure SSR renderer, legacy DOM SSR renderer):
- **`on*` names**: never written; client logs a warning
- **`srcdoc`**: treated as an HTML sink — sanitized via `sanitizeHtml`
(client) / `sanitizeHtmlForSSR` (SSR)
- **URL attributes** (`href", `src`, `xlink:href`, `formaction`,
`action`, `poster`, `background`, `cite`, `data`) + `srcset`: values
with dangerous protocols (after control-char/zero-width normalization)
are dropped

Boolean/null semantics of `bq-bind` are unchanged; safe values pass
through as before.

## Verification
- New client tests (href-drop + re-set on safe value, onclick never
written, srcdoc sanitized) and SSR tests across both backends (href,
onclick, srcdoc, safe-URL passthrough).
- Confirmed 5 of the new tests fail without the src changes.
- Full suite: 2997 pass / 0 fail. `tsc --noEmit` + eslint clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Jonas Pfalzgraf <[email protected]>
Co-authored-by: Claude Fable 5 <[email protected]>

- @typescript-eslint/eslint-plugin and @typescript-eslint/parser upgraded to ^8.63.0
- eslint upgraded to ^10.6.0
- prettier upgraded to ^3.9.4
- typedoc upgraded to ^0.28.20
- vite upgraded to ^8.1.3

Security-and-correctness patch closing a full-codebase audit (issues
#162–#181). No breaking changes, no module status transitions.

- package.json: 1.15.0 → 1.15.1
- CHANGELOG.md: new [1.15.1] section (Security + Fixed) and TOC entry
- docs: new release-notes/1.15.1 page, nav + index entries
- docs/guide/security.md: document the new trustedHtmlForSink() helper

Co-Authored-By: Claude Fable 5 <[email protected]>