From c124b052bf12b8e4c94c1eedb1487313cabf82d1 Mon Sep 17 00:00:00 2001
From: oxura <grozafroza44@gmail.com>
Date: Tue, 20 Oct 2026 11:28:31 -0300
Subject: [PATCH] Classify inline modules using HTML character and whitespace
 rules

HTMLRewriter keeps character references in attributes, so an encoded
"mod&#117;le" was skipped, and trim() strips NBSP, so a non-module type
ran. Decode the ASCII references that can spell "module" and trim only
HTML whitespace.

Closes #1767

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 bend2/main.ts                   | 10 ++++++-
 tests/io/html_script_types.bend | 12 +++++++++
 tests/io/html_script_types.js   | 47 +++++++++++++++++++++++++++++++++
 3 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100644 tests/io/html_script_types.bend
 create mode 100644 tests/io/html_script_types.js

diff --git a/bend2/main.ts b/bend2/main.ts
index 5419cdfa3..ab83c5ad9 100755
--- a/bend2/main.ts
+++ b/bend2/main.ts
@@ -505,9 +505,17 @@ function cli_base(what?: string): void {
 }
 
 // An inline module script; an empty svg <script/> can't have content.
+// HTMLRewriter keeps character references in attributes. Only ASCII
+// references and HTML whitespace can turn a type into "module"; NBSP cannot.
 function is_inline_module(el: HTMLRewriterTypes.Element): boolean {
+  const type = el.getAttribute("type")?.replace(
+    /&#(?:[xX]([\da-fA-F]+)|(\d+));?|&(Tab|NewLine);/g, (t, hex, dec, ws) => {
+      if (ws) return ws === "Tab" ? "\t" : "\n";
+      const n = parseInt(hex ?? dec, hex === undefined ? 10 : 16);
+      return n < 128 ? String.fromCharCode(n) : t;
+    });
   return el.canHaveContent && !el.hasAttribute("src")
-    && el.getAttribute("type")?.trim().toLowerCase() === "module";
+    && type?.replace(/^[\t\n\f\r ]+|[\t\n\f\r ]+$/g, "").toLowerCase() === "module";
 }
 
 // cli_bundle builds a page. Bun skips inline module scripts (#1400), so the
diff --git a/tests/io/html_script_types.bend b/tests/io/html_script_types.bend
new file mode 100644
index 000000000..5b81bbc66
--- /dev/null
+++ b/tests/io/html_script_types.bend
@@ -0,0 +1,12 @@
+# HTML character references and ASCII whitespace determine which scripts run.
+import Base
+
+def HTML.script_types() -> IO(U32):
+  import "./html_script_types.js"
+
+def main() -> IO(Unit):
+  do IO<Unit>:
+    result : U32 <- HTML.script_types()
+    IO.print(U32.show(result))
+
+#|0
diff --git a/tests/io/html_script_types.js b/tests/io/html_script_types.js
new file mode 100644
index 000000000..eccee14c2
--- /dev/null
+++ b/tests/io/html_script_types.js
@@ -0,0 +1,47 @@
+function html_script_types() {
+  const fs = require("node:fs");
+  const path = require("node:path");
+  const child = require("node:child_process");
+  const dir = fs.mkdtempSync(path.join(process.cwd(), ".bend-html-types-"));
+  const options = { encoding: "utf8", timeout: 6000,
+    env: { ...process.env, HOME: dir, BEND_ORIGIN: "http://127.0.0.1:9",
+      BEND_NO_TELEMETRY: "1" },
+  };
+  try {
+    fs.writeFileSync(path.join(dir, "lib.bend"), "import Base\ndef value() -> U32:\n  42\n");
+    const cases = [
+      ["module", "42\n"],
+      ["mod&#117;le", "42\n"],
+      ["&#x6d;odule", "42\n"],
+      ["&Tab;MODULE&NewLine;", "42\n"],
+      ["\u00a0module", ""],
+      ["&#160;module", ""],
+      ["&tab;module", ""],
+    ];
+    for (const [i, [type, expected]] of cases.entries()) {
+      const page = path.join(dir, "index.html");
+      const out = path.join(dir, "out" + i);
+      fs.writeFileSync(page, `<script type="${type}">import lib from './lib.bend'; console.log(lib.value());</script>`);
+      const built = child.spawnSync(process.execPath,
+        [path.resolve("bend2/main.ts"), page, "-o", out], options);
+      if (built.status !== 0) return 1;
+      const entries = [];
+      new HTMLRewriter().on("script", { element(el) {
+        const src = el.getAttribute("src");
+        if (src !== null) entries.push(path.resolve(out, src));
+      }}).transform(fs.readFileSync(path.join(out, "index.html"), "utf8"));
+      let output = "";
+      for (const entry of entries) {
+        const run = child.spawnSync(process.execPath, [entry], options);
+        if (run.status !== 0) return 2;
+        output += run.stdout;
+      }
+      if (output !== expected) return 3 + i;
+    }
+    return 0;
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+io_eff(CID(HTML.script_types), html_script_types);