fix(router): stop executing data scripts on a fragment swap

packages/router/src/client.tsmodified+16-0

Changes to packages/router/src/client.ts

		⋯502 linesShow the 502 lines above this hunk@@ -503,6 +503,22 @@ else {
503	503	var fragCrosswindHrefs=[];
504	504	var fragCrosswindCSS=null;
505	505	var cleanFrag=html.replace(new RegExp('<scr'+'ipt\\\\b([^>]*)>([\\\\s\\\\S]*?)<\\\\/scr'+'ipt>','gi'),function(m,attrs,code){
	506	+ // A data block is not code, and everything below this line assumes it
	507	+ // is: the body gets stashed in fragScripts, re-emitted as a pending
	508	+ // placeholder, then wrapped in braces and executed. Wrapping a JSON
	509	+ // object in braces reparses it as a labelled block, so its first ':'
	510	+ // is a SyntaxError on every single fragment swap
	511	+ // (stacksjs/stx#1801). @structuredData renders at its call site,
	512	+ // which inside a layout is @section('content') — i.e. in the routed
	513	+ // container — so the natural way to write it hit this.
	514	+ //
	515	+ // Left exactly as found rather than stripped: crawlers read
	516	+ // structured data wherever it sits, and the browser will not execute
	517	+ // a non-JS type anyway. Mirrors prepareRoutedBodyScripts' notion of
	518	+ // executable, which this path never had.
	519	+ var typeMatch=attrs.match(/\\btype\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))/i);
	520	+ var scriptType=((typeMatch&&(typeMatch[1]||typeMatch[2]||typeMatch[3]))||'').trim().toLowerCase();
	521	+ if(scriptType&&scriptType!=='text/javascript'&&scriptType!=='application/javascript'&&scriptType!=='module')return m;
506	522	if(code&&code.trim()&&!isSignalsRuntimeScript({hasAttribute:function(name){return name==='data-stx-runtime'&&attrs.indexOf('data-stx-runtime')!==-1}},code)){
507	523	var slot='fragment-'+(++fragScriptId);
508	524	var scoped=/(?:^|\\s)data-stx-scoped(?:\\s|=|$)/i.test(attrs);