Version bump 0.28.0

Author: tolyo

dist/angular-runtime.js

@@ -66,7 +66,7 @@ class AngularRuntime extends EventTarget {
                 this.$t[token] = token;
             });
         }
-        if (runtimeOptions.attachToWindow) {
+        if (!runtimeOptions.subapp) {
             window.angular = this;
         }
         if (runtimeOptions.registerBuiltins) {
@@ -412,14 +412,12 @@ function normalizeRuntimeOptions(options) {
     if (typeof options === "boolean") {
         return {
             subapp: options,
-            attachToWindow: !options,
             registerBuiltins: true,
         };
     }
     const subapp = options.subapp ?? false;
     return {
         subapp,
-        attachToWindow: options.attachToWindow ?? !subapp,
         registerBuiltins: options.registerBuiltins ?? true,
     };
 }

dist/angular-ts.esm.js

@@ -1,4 +1,4 @@
-/* Version: 0.27.0 - May 23, 2026 17:00:12 */
+/* Version: 0.28.0 - May 23, 2026 23:51:48 */
 /**
  * Canonical token names for the built-in injectables exposed by the core `ng`
  * module.
@@ -2987,7 +2987,7 @@ class AngularRuntime extends EventTarget {
         /** @internal */
         this._bootsrappedModules = [];
         /** AngularTS version string replaced at build time. */
-        this.version = "0.27.0";
+        this.version = "0.28.0";
         /** Retrieve the controller instance cached on a compiled DOM element. */
         this.getController = getController;
         /** Retrieve the injector cached on a bootstrapped DOM element. */
@@ -3011,7 +3011,7 @@ class AngularRuntime extends EventTarget {
                 this.$t[token] = token;
             });
         }
-        if (runtimeOptions.attachToWindow) {
+        if (!runtimeOptions.subapp) {
             window.angular = this;
         }
         if (runtimeOptions.registerBuiltins) {
@@ -3357,14 +3357,12 @@ function normalizeRuntimeOptions(options) {
     if (typeof options === "boolean") {
         return {
             subapp: options,
-            attachToWindow: !options,
             registerBuiltins: true,
         };
     }
     const subapp = options.subapp ?? false;
     return {
         subapp,
-        attachToWindow: options.attachToWindow ?? !subapp,
         registerBuiltins: options.registerBuiltins ?? true,
     };
 }
@@ -6843,6 +6841,7 @@ const ngEventDirectives = EVENT_NAMES.reduce((directives, eventName) => {
         createEventDirectiveFactory(eventName);
     return directives;
 }, {});
+ngEventDirectives.ngClick;
 /**
  * Creates a directive that evaluates an expression when the element event fires.
  */
@@ -32473,6 +32472,11 @@ class WebSocketProvider {
 const WASM_SCOPE_IMPORT_NAMESPACE = "angular_ts";
 const textEncoder = new TextEncoder();
 const textDecoder = new TextDecoder();
+const UNSAFE_SCOPE_PATH_KEYS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype",
+]);
 /**
  * Host-side wrapper around one AngularTS scope exposed to Wasm clients.
  *
@@ -32927,6 +32931,9 @@ function readScopePath(scope, path) {
         return scope;
     }
     const keys = scopePathKeys(path);
+    if (!isSafeScopePath(keys)) {
+        return undefined;
+    }
     let current = scope;
     for (let i = 0, l = keys.length; i < l; i++) {
         if (current === null || current === undefined) {
@@ -32938,7 +32945,7 @@ function readScopePath(scope, path) {
 }
 function writeScopePath(scope, path, value) {
     const keys = scopePathKeys(path);
-    if (keys.length === 0) {
+    if (keys.length === 0 || !isSafeScopePath(keys)) {
         return false;
     }
     let current = scope;
@@ -32958,7 +32965,7 @@ function writeScopePath(scope, path, value) {
 }
 function deleteScopePath(scope, path) {
     const keys = scopePathKeys(path);
-    if (keys.length === 0) {
+    if (keys.length === 0 || !isSafeScopePath(keys)) {
         return false;
     }
     let current = scope;
@@ -32974,6 +32981,9 @@ function deleteScopePath(scope, path) {
 function scopePathKeys(path) {
     return path.split(".").filter(Boolean);
 }
+function isSafeScopePath(keys) {
+    return keys.every((key) => !UNSAFE_SCOPE_PATH_KEYS.has(key));
+}
 
 /**
  * Runtime identity and DOM globals.
@@ -33321,17 +33331,16 @@ function normalizeServiceRegistrations(services) {
 }
 
 /**
- * Creates a side-effect-free AngularTS runtime with no built-in modules.
+ * Creates an AngularTS runtime with no built-in modules.
  */
 function createAngularBare(options = {}) {
     return new AngularRuntime({
-        attachToWindow: false,
         registerBuiltins: false,
         ...options,
     });
 }
 /**
- * Creates a side-effect-free AngularTS runtime with a custom `ng` module.
+ * Creates an AngularTS runtime with a custom `ng` module.
  */
 function createAngularCustom(options = {}) {
     const angular = createAngularBare(options);

dist/angular-ts.umd.js

@@ -1,4 +1,4 @@
-/* Version: 0.27.0 - May 23, 2026 17:00:09 */
+/* Version: 0.28.0 - May 23, 2026 23:51:44 */
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
     typeof define === 'function' && define.amd ? define(['exports'], factory) :
@@ -2993,7 +2993,7 @@
             /** @internal */
             this._bootsrappedModules = [];
             /** AngularTS version string replaced at build time. */
-            this.version = "0.27.0";
+            this.version = "0.28.0";
             /** Retrieve the controller instance cached on a compiled DOM element. */
             this.getController = getController;
             /** Retrieve the injector cached on a bootstrapped DOM element. */
@@ -3017,7 +3017,7 @@
                     this.$t[token] = token;
                 });
             }
-            if (runtimeOptions.attachToWindow) {
+            if (!runtimeOptions.subapp) {
                 window.angular = this;
             }
             if (runtimeOptions.registerBuiltins) {
@@ -3363,14 +3363,12 @@
         if (typeof options === "boolean") {
             return {
                 subapp: options,
-                attachToWindow: !options,
                 registerBuiltins: true,
             };
         }
         const subapp = options.subapp ?? false;
         return {
             subapp,
-            attachToWindow: options.attachToWindow ?? !subapp,
             registerBuiltins: options.registerBuiltins ?? true,
         };
     }
@@ -6849,6 +6847,7 @@
             createEventDirectiveFactory(eventName);
         return directives;
     }, {});
+    ngEventDirectives.ngClick;
     /**
      * Creates a directive that evaluates an expression when the element event fires.
      */
@@ -32479,6 +32478,11 @@
     const WASM_SCOPE_IMPORT_NAMESPACE = "angular_ts";
     const textEncoder = new TextEncoder();
     const textDecoder = new TextDecoder();
+    const UNSAFE_SCOPE_PATH_KEYS = new Set([
+        "__proto__",
+        "constructor",
+        "prototype",
+    ]);
     /**
      * Host-side wrapper around one AngularTS scope exposed to Wasm clients.
      *
@@ -32933,6 +32937,9 @@
             return scope;
         }
         const keys = scopePathKeys(path);
+        if (!isSafeScopePath(keys)) {
+            return undefined;
+        }
         let current = scope;
         for (let i = 0, l = keys.length; i < l; i++) {
             if (current === null || current === undefined) {
@@ -32944,7 +32951,7 @@
     }
     function writeScopePath(scope, path, value) {
         const keys = scopePathKeys(path);
-        if (keys.length === 0) {
+        if (keys.length === 0 || !isSafeScopePath(keys)) {
             return false;
         }
         let current = scope;
@@ -32964,7 +32971,7 @@
     }
     function deleteScopePath(scope, path) {
         const keys = scopePathKeys(path);
-        if (keys.length === 0) {
+        if (keys.length === 0 || !isSafeScopePath(keys)) {
             return false;
         }
         let current = scope;
@@ -32980,6 +32987,9 @@
     function scopePathKeys(path) {
         return path.split(".").filter(Boolean);
     }
+    function isSafeScopePath(keys) {
+        return keys.every((key) => !UNSAFE_SCOPE_PATH_KEYS.has(key));
+    }
 
     /**
      * Runtime identity and DOM globals.
@@ -33327,17 +33337,16 @@
     }
 
     /**
-     * Creates a side-effect-free AngularTS runtime with no built-in modules.
+     * Creates an AngularTS runtime with no built-in modules.
      */
     function createAngularBare(options = {}) {
         return new AngularRuntime({
-            attachToWindow: false,
             registerBuiltins: false,
             ...options,
         });
     }
     /**
-     * Creates a side-effect-free AngularTS runtime with a custom `ng` module.
+     * Creates an AngularTS runtime with a custom `ng` module.
      */
     function createAngularCustom(options = {}) {
         const angular = createAngularBare(options);

dist/angular-ts.umd.min.js

@@ -52,6 +52,7 @@ const ngEventDirectives = EVENT_NAMES.reduce((directives, eventName) => {
         createEventDirectiveFactory(eventName);
     return directives;
 }, {});
+const ngClickDirective = ngEventDirectives.ngClick;
 /**
  * Creates a directive that evaluates an expression when the element event fires.
  */
@@ -109,4 +110,4 @@ function createWindowEventDirective($parse, $exceptionHandler, $window, directiv
     };
 }
 
-export { createEventDirective, createWindowEventDirective, ngEventDirectives };
+export { createEventDirective, createWindowEventDirective, ngClickDirective, ngEventDirectives };

dist/angular-ts.umd.min.js.gz

@@ -1,8 +1,8 @@
 /**
  * @externs
- * Public externs for AngularTS 0.27.0 applications compiled with Google Closure.
+ * Public externs for AngularTS 0.28.0 applications compiled with Google Closure.
  *
- * Version-pinned to @angular-wave/angular.ts 0.27.0; regenerate
+ * Version-pinned to @angular-wave/angular.ts 0.28.0; regenerate
  * this file when updating the public ng namespace.
  *
  * This file is generated from src/namespace.ts by
@@ -3297,17 +3297,11 @@ ng.AngularElementOptions.prototype.elementModule;
 ng.AngularElementOptions.prototype.component;
 
 /**
- * Treat this instance as a sub-application. Sub-applications do not attach to `window.angular` by default.
+ * Treat this instance as a sub-application.
  * @type {(boolean|undefined)}
  */
 ng.AngularElementOptions.prototype.subapp;
 
-/**
- * Assign the runtime instance to `window.angular`. Defaults to `true` for root apps and `false` for sub-applications.
- * @type {(boolean|undefined)}
- */
-ng.AngularElementOptions.prototype.attachToWindow;
-
 /**
  * Register the configured built-in `ng` module during construction. Custom builds should pass `false` and register their own `ng` module.
  * @type {(boolean|undefined)}

dist/angular-ts.umd.min.js.map

@@ -3,17 +3,16 @@ import { registerCustomNgModule } from './custom-ng.js';
 export { coreProviders } from './custom-ng.js';
 
 /**
- * Creates a side-effect-free AngularTS runtime with no built-in modules.
+ * Creates an AngularTS runtime with no built-in modules.
  */
 function createAngularBare(options = {}) {
     return new AngularRuntime({
-        attachToWindow: false,
         registerBuiltins: false,
         ...options,
     });
 }
 /**
- * Creates a side-effect-free AngularTS runtime with a custom `ng` module.
+ * Creates an AngularTS runtime with a custom `ng` module.
  */
 function createAngularCustom(options = {}) {
     const angular = createAngularBare(options);

dist/directive/events/events.js

@@ -6,8 +6,8 @@ import { WebComponentProvider } from '../services/web-component/web-component.js
 /**
  * Defines a standalone AngularTS-backed custom element.
  *
- * The helper creates a side-effect-free custom runtime, installs the
- * `$webComponent` provider, creates a small application module, and eagerly
+ * The helper creates a custom runtime, installs the `$webComponent` provider,
+ * creates a small application module, and eagerly
  * builds an injector so the native custom element can be consumed by any host
  * framework without calling `angular.bootstrap`.
  */
@@ -29,17 +29,7 @@ function defineAngularElement(name, options) {
     const appModule = angular.module(elementModuleName, elementModule?.requires ?? []);
     elementModule?.configure?.(appModule, angular);
     appModule.appComponent(name, component);
-    const previousAngular = window.angular;
-    window.angular = angular;
-    let injector;
-    try {
-        injector = angular.injector([ngModuleName, elementModuleName]);
-    }
-    finally {
-        if (!runtimeOptions.attachToWindow) {
-            window.angular = previousAngular;
-        }
-    }
+    const injector = angular.injector([ngModuleName, elementModuleName]);
     angular.$rootScope = injector.get(_rootScope);
     const element = customElements.get(name);
     if (!element) {
@@ -58,7 +48,6 @@ function defineAngularElement(name, options) {
 const createAngularElement = defineAngularElement;
 function createAngularElementRuntime(options) {
     const angular = new AngularRuntime({
-        attachToWindow: false,
         registerBuiltins: false,
         ...options,
     });