@askrjs/askr 0.0.70 → 0.0.71

package/dist/router/index.js

@@ -1,7 +1,9 @@
-import { C as lazy, a as resolveDeferredValues, b as Outlet, i as isDeferred, l as createRouteRegistry, m as resolveRouteRequest, n as Resolve, r as defer, s as routeData, y as currentAuth } from "../deferred-zHtUheIQ.js";
+import { C as lazy, a as resolveDeferredValues, b as Outlet, i as isDeferred, l as createRouteRegistry, m as resolveRouteRequest, n as Resolve, r as defer, s as routeData, y as currentAuth } from "../deferred-Cr58yIQD.js";
 import { jsx } from "../jsx-runtime.js";
-import { a as route, i as page, n as group, r as index, t as fallback } from "../authoring-uaJ556aG.js";
-import { _ as currentRoute, a as serializeRouteMeta, c as getCurrentHref, d as parseTargetUrl, h as syncRegisteredRouteSnapshot, i as resolveRouteMeta, l as getRegisteredAppsSnapshot, m as syncAppRegistrationLocation, n as navigate, p as setCurrentRouteLocation, r as reconcileRouteMeta, s as saveScrollPosition, u as getWindowHref } from "../navigate-BTPrVhqI.js";
+import { a as isSafeHref } from "../csp-nonce-CwSRP3Jl.js";
+import { a as route, i as page, n as group, r as index, t as fallback } from "../authoring-CXmUcaCe.js";
+import { n as onRouteChange, t as currentRoute } from "../activity-C2tPn9Fr.js";
+import { a as serializeRouteMeta, c as getCurrentHref, d as parseTargetUrl, h as syncRegisteredRouteSnapshot, i as resolveRouteMeta, l as getRegisteredAppsSnapshot, m as syncAppRegistrationLocation, n as navigate, p as setCurrentRouteLocation, r as reconcileRouteMeta, s as saveScrollPosition, u as getWindowHref } from "../navigate-CuGQzS_Y.js";
 import { o as mergeProps } from "../compose-ref-Cc_YkUpM.js";
 import { t as applyInteractionPolicy } from "../interactions-w7gQN4ha.js";
 //#region src/router/route-query.ts
@@ -162,22 +164,31 @@ function isSameOriginNavigableHref(href) {
 * - Keyboard handling automatic
 * - Composable via mergeProps
 */
-function Link({ href: suppliedHref, to, class: className, children, rel, target, "aria-current": ariaCurrent, "aria-label": ariaLabel, ...rest }) {
+function Link({ href: suppliedHref, to, class: className, children, rel, target, "aria-current": ariaCurrent, "aria-label": ariaLabel, onPress, onClick, ...rest }) {
 	const href = to?.href ?? suppliedHref;
 	if (!href) throw new Error("Link requires href or to.");
+	if (!isSafeHref(href)) throw new TypeError("Link href uses an unsafe URL scheme.");
+	const handleNavigation = (e) => {
+		if (e.defaultPrevented) return;
+		const event = e;
+		if ((event.button ?? 0) !== 0 || event.ctrlKey || event.metaKey || event.shiftKey || event.altKey) return;
+		if (target || !isSameOriginNavigableHref(href)) return;
+		event.preventDefault();
+		navigate(href);
+	};
+	const interaction = applyInteractionPolicy({
+		isNative: true,
+		disabled: false,
+		onPress: handleNavigation
+	});
+	const consumerActivation = (e) => {
+		onPress?.(e);
+		onClick?.(e);
+	};
 	return /* @__PURE__ */ jsx("a", {
-		...mergeProps(rest, {
-			...applyInteractionPolicy({
-				isNative: true,
-				disabled: false,
-				onPress: (e) => {
-					const event = e;
-					if ((event.button ?? 0) !== 0 || event.ctrlKey || event.metaKey || event.shiftKey || event.altKey) return;
-					if (target || !isSameOriginNavigableHref(href)) return;
-					event.preventDefault();
-					navigate(href);
-				}
-			}),
+		...mergeProps(interaction, {
+			...rest,
+			onClick: consumerActivation,
 			href,
 			class: className,
 			rel,
@@ -189,4 +200,4 @@ function Link({ href: suppliedHref, to, class: className, children, rel, target,
 	});
 }
 //#endregion
-export { Link, Outlet, Resolve, allow, createRouteRegistry, currentAuth, currentRoute, defer, deny, fallback, forbidden, group, index, isDeferred, lazy, navigate, notFound, page, reconcileRouteMeta, redirect, resolveDeferredValues, resolveRouteMeta, resolveRouteRequest, route, routeData, serializeRouteMeta, to, unauthorized, updateRouteQuery };
+export { Link, Outlet, Resolve, allow, createRouteRegistry, currentAuth, currentRoute, defer, deny, fallback, forbidden, group, index, isDeferred, lazy, navigate, notFound, onRouteChange, page, reconcileRouteMeta, redirect, resolveDeferredValues, resolveRouteMeta, resolveRouteRequest, route, routeData, serializeRouteMeta, to, unauthorized, updateRouteQuery };

package/dist/{router-C0XQA62W.d.ts → router-C3vENhUh.d.ts}

@@ -1,6 +1,6 @@
 import { c as RenderableChild } from "./control-DO-iBEtV.js";
 import { D as QueryPrefetchContext, u as CoreTelemetry } from "./index-Bki2rqcr.js";
-import { t as ActionDescriptor } from "./index-DSClfSoC.js";
+import { t as ActionDescriptor } from "./index-DxYJPVC4.js";
 import { AuthContext, AuthRequirement } from "@askrjs/auth";
 import { InferSchema, ObjectSchema } from "@askrjs/schema";
 //#region src/common/router.d.ts

package/dist/{selector-DueeR6Oz.js → selector-DEfqO1rA.js}

@@ -261,6 +261,14 @@ function getOrCreateSelectorHook(instance, hookIndex, source, equals) {
 	store.set(hookIndex, created);
 	return created;
 }
+/**
+* Creates a render-scoped predicate for keyed membership in reactive list rows.
+*
+* Use this when a `<For>` child needs to compare each stable item with a
+* changing selected value. Unlike a plain closure capture, the predicate
+* subscribes the affected rows and updates them without rebuilding the list.
+* Must be called during component render.
+*/
 function selector(source, equals = Object.is) {
 	markReadableUsage(source);
 	const instance = getCurrentInstance();

package/dist/ssg/index.d.ts

@@ -1,5 +1,5 @@
 import { d as DocumentRenderContext, f as DocumentRenderer, u as DocumentRenderArgs } from "../control-DO-iBEtV.js";
-import { D as RoutePathParams, N as RouteRegistry, O as RoutePolicy, T as RouteOptions, y as RouteHandler } from "../router-C0XQA62W.js";
+import { D as RoutePathParams, N as RouteRegistry, O as RoutePolicy, T as RouteOptions, y as RouteHandler } from "../router-C3vENhUh.js";
 import { AuthRequirement } from "@askrjs/auth";
 import "node:fs/promises";
 //#region src/ssg/types.d.ts
@@ -105,6 +105,13 @@ interface RouteRenderResult {
   written: boolean;
   /** Error message if rendering failed */
   error?: string;
+  /** Original exception preserved for programmatic diagnostics. */
+  errorCause?: unknown;
+  /** Route and phase context for the original exception. */
+  errorContext?: {
+    route: string;
+    phase: 'load' | 'render' | 'write';
+  };
 }
 /** Overall result from SSG generation */
 interface SSGResult {

package/dist/ssg/index.js

@@ -1,14 +1,18 @@
 import "../access-ePqdQqkV.js";
-import { S as getRenderHandler, a as resolveDeferredValues, l as createRouteRegistry, u as bindResolvedRouteData } from "../deferred-zHtUheIQ.js";
-import { a as route } from "../authoring-uaJ556aG.js";
+import { S as getRenderHandler, a as resolveDeferredValues, l as createRouteRegistry, u as bindResolvedRouteData } from "../deferred-Cr58yIQD.js";
+import { a as route } from "../authoring-CXmUcaCe.js";
 import { n as renderDocument } from "../ssr-CbQO5xd3.js";
-import { n as renderToString } from "../ssr-vE-KUgDV.js";
+import { n as renderToString } from "../ssr-BSUA9Y64.js";
 import * as fs from "node:fs/promises";
 import * as pathModule from "node:path";
 import * as os from "node:os";
 import * as fsSync from "node:fs";
 //#region src/ssg/route-utils.ts
+function assertSafeRoutePath(pathStr) {
+	if (!pathStr.startsWith("/") || pathStr.startsWith("//") || pathStr.includes("\\") || pathStr.includes("\0") || pathStr.split("/").some((segment) => segment === "." || segment === "..")) throw new Error(`SSG route path must be an absolute URL path without dot segments or backslashes: ${pathStr}`);
+}
 function getOutputFilePath(pathStr) {
+	assertSafeRoutePath(pathStr);
 	if (pathStr === "/") return "index.html";
 	return `${pathStr.replace(/^\/|\/$/g, "")}/index.html`;
 }
@@ -153,6 +157,7 @@ async function batchRenderRoutes(routes, options = {}) {
 		const baseData = resolvedData.hasData ? resolvedData.data : void 0;
 		const resourceCount = resolvedData.hasData && baseData ? Object.keys(baseData).length : 0;
 		const mergedHandler = route$2.handler;
+		let phase = route$2.loader ? "load" : "render";
 		try {
 			let routeData;
 			let hasRouteData = false;
@@ -182,11 +187,13 @@ async function batchRenderRoutes(routes, options = {}) {
 				hasRouteData = true;
 			}
 			const renderedHandler = hasRouteData ? bindResolvedRouteData(mergedHandler, routeData) : mergedHandler;
+			const registry = hasRouteData || !sharedRegistry ? createRouteRegistry(() => {
+				route(route$2.path, renderedHandler, { namespace: route$2.namespace });
+			}) : sharedRegistry;
+			phase = "render";
 			const html = renderToString({
 				url,
-				registry: hasRouteData || !sharedRegistry ? createRouteRegistry(() => {
-					route(route$2.path, renderedHandler, { namespace: route$2.namespace });
-				}) : sharedRegistry,
+				registry,
 				seed,
 				data: baseData,
 				document: document === void 0 ? void 0 : ({ appHtml }) => renderDocument(document, {
@@ -231,7 +238,12 @@ async function batchRenderRoutes(routes, options = {}) {
 				status: "error",
 				reason: "full",
 				written: false,
-				error: error instanceof Error ? error.message : String(error)
+				error: error instanceof Error ? error.message : String(error),
+				errorCause: error,
+				errorContext: {
+					route: url,
+					phase
+				}
 			};
 		}
 	};
@@ -247,6 +259,15 @@ async function batchRenderRoutes(routes, options = {}) {
 	return results;
 }
 //#endregion
+//#region src/ssg/output-path.ts
+function resolveSsgOutputPath(outputDir, filePath) {
+	const root = pathModule.resolve(outputDir);
+	const candidate = pathModule.resolve(root, filePath);
+	const relative = pathModule.relative(root, candidate);
+	if (!relative || relative === ".." || relative.startsWith(`..${pathModule.sep}`) || pathModule.isAbsolute(relative)) throw new Error(`SSG output path must stay inside outputDir: ${filePath}`);
+	return candidate;
+}
+//#endregion
 //#region src/ssg/write-static-files.ts
 /**
 * File I/O for Static Site Generation
@@ -262,17 +283,22 @@ async function writeStaticFiles(results, outputDir, options = {}, fileOperations
 	await fileOperations.mkdir(outputDir, { recursive: true });
 	for (const result of results) {
 		if (result.status !== "removed") continue;
-		const fullPath = pathModule.join(outputDir, result.filePath);
+		const fullPath = resolveSsgOutputPath(outputDir, result.filePath);
 		if (fsSync.existsSync(fullPath)) {
 			await fileOperations.rm(fullPath, { force: true });
 			await pruneEmptyDirs(pathModule.dirname(fullPath), outputDir, fileOperations);
 		}
 	}
 	const pendingWrites = [];
+	const reportedErrors = /* @__PURE__ */ new Set();
 	for (let index = 0; index < results.length; index += 1) {
 		const result = results[index];
 		if (result.status === "error") {
-			console.warn(`Skipping failed route: ${result.path} - ${result.error}`);
+			const diagnostic = `Skipping failed route: ${result.path} - ${result.error}`;
+			if (!reportedErrors.has(diagnostic)) {
+				reportedErrors.add(diagnostic);
+				console.warn(diagnostic);
+			}
 			continue;
 		}
 		if (result.status === "success" && result.written) pendingWrites.push(result);
@@ -280,7 +306,7 @@ async function writeStaticFiles(results, outputDir, options = {}, fileOperations
 	const directories = [];
 	const seenDirectories = /* @__PURE__ */ new Set();
 	for (const result of pendingWrites) {
-		const dir = pathModule.dirname(pathModule.join(outputDir, result.filePath));
+		const dir = pathModule.dirname(resolveSsgOutputPath(outputDir, result.filePath));
 		if (!seenDirectories.has(dir)) {
 			seenDirectories.add(dir);
 			directories.push(dir);
@@ -295,7 +321,7 @@ async function writeStaticFiles(results, outputDir, options = {}, fileOperations
 			nextIndex += 1;
 			if (current >= pendingWrites.length) return;
 			const result = pendingWrites[current];
-			const fullPath = pathModule.join(outputDir, result.filePath);
+			const fullPath = resolveSsgOutputPath(outputDir, result.filePath);
 			const tempPath = pathModule.join(pathModule.dirname(fullPath), `.${pathModule.basename(fullPath)}.askr-${process.pid}-${current}.tmp`);
 			try {
 				await fileOperations.writeFile(tempPath, result.html, "utf8");
@@ -310,11 +336,12 @@ async function writeStaticFiles(results, outputDir, options = {}, fileOperations
 async function pruneEmptyDirs(startDir, rootDir, fileOperations) {
 	let current = startDir;
 	const normalizedRoot = pathModule.resolve(rootDir);
-	while (current.startsWith(normalizedRoot)) {
+	while (pathModule.resolve(current) !== normalizedRoot) {
+		const relative = pathModule.relative(normalizedRoot, current);
+		if (relative === ".." || relative.startsWith(`..${pathModule.sep}`) || pathModule.isAbsolute(relative)) break;
 		if (!fsSync.existsSync(current)) break;
 		if ((await fileOperations.readdir(current)).length > 0) break;
 		await fileOperations.rmdir(current);
-		if (pathModule.resolve(current) === normalizedRoot) break;
 		current = pathModule.dirname(current);
 	}
 }
@@ -418,7 +445,7 @@ function hashHtml(html) {
 	return (hash >>> 0).toString(16).padStart(8, "0");
 }
 function getIncrementalManifestPath(outputDir) {
-	return pathModule.join(outputDir, MANIFEST_DIR, MANIFEST_FILE);
+	return resolveSsgOutputPath(outputDir, pathModule.join(MANIFEST_DIR, MANIFEST_FILE));
 }
 function readIncrementalManifest(outputDir, seed) {
 	const manifestPath = getIncrementalManifestPath(outputDir);
@@ -427,7 +454,7 @@ function readIncrementalManifest(outputDir, seed) {
 		const raw = fsSync.readFileSync(manifestPath, "utf8");
 		const parsed = JSON.parse(raw);
 		if (parsed.schemaVersion !== 1 || parsed.seed !== seed || !Array.isArray(parsed.routes)) return null;
-		const routes = parsed.routes.filter((entry) => !!entry && typeof entry.routeId === "string" && typeof entry.path === "string" && typeof entry.filePath === "string" && Array.isArray(entry.invalidationKeys) && (entry.htmlHash === null || typeof entry.htmlHash === "string") && (entry.lastStatus === "success" || entry.lastStatus === "error"));
+		const routes = parsed.routes.filter((entry) => !!entry && typeof entry.routeId === "string" && typeof entry.path === "string" && typeof entry.filePath === "string" && isContainedManifestFilePath(outputDir, entry.filePath) && Array.isArray(entry.invalidationKeys) && (entry.htmlHash === null || typeof entry.htmlHash === "string") && (entry.lastStatus === "success" || entry.lastStatus === "error"));
 		if (routes.length !== parsed.routes.length) return null;
 		return {
 			schemaVersion: 1,
@@ -439,13 +466,22 @@ function readIncrementalManifest(outputDir, seed) {
 		return null;
 	}
 }
+function isContainedManifestFilePath(outputDir, filePath) {
+	try {
+		resolveSsgOutputPath(outputDir, filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
 async function writeIncrementalManifest(manifest, outputDir) {
+	if (!manifest.routes.every((entry) => isContainedManifestFilePath(outputDir, entry.filePath))) throw new Error("SSG manifest contains a path outside outputDir.");
 	const manifestPath = getIncrementalManifestPath(outputDir);
 	await fs.mkdir(pathModule.dirname(manifestPath), { recursive: true });
 	await fs.writeFile(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
 }
 function getExistingOutputFileSize(outputDir, filePath) {
-	const fullPath = pathModule.join(outputDir, filePath);
+	const fullPath = resolveSsgOutputPath(outputDir, filePath);
 	if (!fsSync.existsSync(fullPath)) return 0;
 	try {
 		return fsSync.statSync(fullPath).size;
@@ -454,7 +490,7 @@ function getExistingOutputFileSize(outputDir, filePath) {
 	}
 }
 function outputFileExists(outputDir, filePath) {
-	return fsSync.existsSync(pathModule.join(outputDir, filePath));
+	return fsSync.existsSync(resolveSsgOutputPath(outputDir, filePath));
 }
 //#endregion
 //#region src/ssg/generation-plan.ts

package/dist/ssr/index.d.ts

@@ -1,7 +1,7 @@
 import { c as RenderableChild, d as DocumentRenderContext, f as DocumentRenderer, p as SSRData, u as DocumentRenderArgs } from "../control-DO-iBEtV.js";
 import { r as JSXElement, s as Props } from "../jsx-Dvr2SGRG.js";
 import { D as QueryPrefetchContext, n as ServerQueryRegistry, u as CoreTelemetry, v as DataRuntime } from "../index-Bki2rqcr.js";
-import { A as RouteRecord, L as RouteRequestResult, N as RouteRegistry, a as AccessRedirectDecision, f as Route, p as RouteAuthOptions, r as AccessDenyDecision, y as RouteHandler } from "../router-C0XQA62W.js";
+import { A as RouteRecord, L as RouteRequestResult, N as RouteRegistry, a as AccessRedirectDecision, f as Route, p as RouteAuthOptions, r as AccessDenyDecision, y as RouteHandler } from "../router-C3vENhUh.js";
 import { AuthContext } from "@askrjs/auth";
 //#region src/common/page-render-envelope.d.ts
 declare const PAGE_RENDER_ENVELOPE_VERSION: 1;
@@ -19,6 +19,19 @@ interface DeferredBoundaryRegistration {
   fulfilled(value: unknown): RenderableChild;
   rejected(error: unknown): RenderableChild;
 }
+interface SSRPortalHostRegistration {
+  token: string;
+  automatic: boolean;
+}
+interface SSRPortalSlot {
+  hasValue: boolean;
+  value: RenderableChild | undefined;
+  hosts: SSRPortalHostRegistration[];
+}
+interface SSRPortalState {
+  slots: Map<object, SSRPortalSlot>;
+  nextHostId: number;
+}
 //#endregion
 //#region src/common/ssr-errors.d.ts
 /**
@@ -49,6 +62,7 @@ interface RenderContext {
   renderData: PageRenderEnvelope | null;
   hydrationData: PageRenderEnvelope | null;
   deferredBoundaries: DeferredBoundaryRegistration[];
+  ssrPortals: SSRPortalState;
   cspNonce?: string;
 }
 declare function createRenderContext(seed?: number, opts?: {

package/dist/ssr/index.js

@@ -1,3 +1,3 @@
 import { u as SSRDataMissingError } from "../render-context-Clw3rFiO.js";
-import { a as renderResolvedToStringSync, c as createRenderContext, d as withRenderContextAsync, i as renderRouteRequestToString, l as getRenderContext, n as renderToString, o as renderToStringSync, r as renderRouteRequest, s as resolveRequest, t as renderToStream, u as withRenderContext } from "../ssr-vE-KUgDV.js";
+import { a as renderResolvedToStringSync, c as createRenderContext, d as withRenderContextAsync, i as renderRouteRequestToString, l as getRenderContext, n as renderToString, o as renderToStringSync, r as renderRouteRequest, s as resolveRequest, t as renderToStream, u as withRenderContext } from "../ssr-BSUA9Y64.js";
 export { SSRDataMissingError, createRenderContext, getRenderContext, renderResolvedToStringSync, renderRouteRequest, renderRouteRequestToString, renderToStream, renderToString, renderToStringSync, resolveRequest, withRenderContext, withRenderContextAsync };

package/dist/{ssr-vE-KUgDV.js → ssr-BSUA9Y64.js}

@@ -7,15 +7,15 @@ import { f as getCurrentComponentInstance, w as setCurrentComponentInstance } fr
 import { t as cleanupComponent } from "./component-cleanup-1ZFoLLHt.js";
 import { p as isPromiseLike } from "./lifecycle-batch-COgl8jMS.js";
 import { g as evaluateShowState, h as evaluateCaseState, i as evaluateForState, o as rollbackForStateTransaction, r as commitForStateTransaction } from "./for-internal-BtK9Htl0.js";
-import { _ as isPageRenderEnvelope, g as isEmptyPageRenderEnvelope, h as createPageRenderEnvelope, i as isDeferred, l as createRouteRegistry, m as resolveRouteRequest, t as DEFERRED_BOUNDARY } from "./deferred-zHtUheIQ.js";
+import { _ as isPageRenderEnvelope, g as isEmptyPageRenderEnvelope, h as createPageRenderEnvelope, i as isDeferred, l as createRouteRegistry, m as resolveRouteRequest, t as DEFERRED_BOUNDARY } from "./deferred-Cr58yIQD.js";
 import { c as stopRenderPhase$1, o as startRenderPhase$1, t as configureRenderContextProvider, u as SSRDataMissingError } from "./render-context-Clw3rFiO.js";
-import { a as disposeDefaultPortalScope, t as DefaultPortal } from "./portal-D7TC986A.js";
-import { t as getPublicAttributeName } from "./attr-names-CjhzmHOn.js";
-import { r as validateCspNonce, t as CspNonceScope } from "./csp-nonce-HGZ0vbqT.js";
-import { t as createDataRuntime } from "./data-runtime-SJ1BSUvk.js";
-import { c as withTelemetry, i as dehydrateDataRuntime, t as createQueryPrefetchContext } from "./query-registry-CQIT4mXr.js";
-import { a as resolveRouteFromRoutes, t as _resolveRouteMatchFromRoutes } from "./route-matching-DLBWDeXX.js";
-import { a as route } from "./authoring-uaJ556aG.js";
+import { a as resolveRouteFromRoutes, t as _resolveRouteMatchFromRoutes } from "./route-matching-M-f1VQRu.js";
+import { a as disposeDefaultPortalScope, o as SSR_PORTAL_HOST, t as DefaultPortal } from "./portal-wY3j0vvp.js";
+import { n as getPublicAttributeName, t as sanitizeCssValue } from "./css-BuPaTOfe.js";
+import { a as isSafeHref, r as validateCspNonce, t as CspNonceScope } from "./csp-nonce-CwSRP3Jl.js";
+import { t as createDataRuntime } from "./data-runtime-rpV6-3XW.js";
+import { c as withTelemetry, i as dehydrateDataRuntime, t as createQueryPrefetchContext } from "./query-registry-Bu_cuMch.js";
+import { a as route } from "./authoring-CXmUcaCe.js";
 import { n as renderDocument, t as SSR_RENDER_DATA_ATTR } from "./ssr-CbQO5xd3.js";
 //#region src/ssr/escape.ts
 /**
@@ -42,51 +42,6 @@ const VOID_ELEMENTS = /* @__PURE__ */ new Set([
 ]);
 const escapeCache = /* @__PURE__ */ new Map();
 const MAX_CACHE_SIZE = 256;
-const CSS_UNSAFE_RE = /[{}<>\\]/g;
-const CSS_URI_SCHEME_RE = /(?:^|[\s(,])([a-z][a-z0-9+.-]*):/i;
-const CSS_FUNCTION_NAME_RE = /([a-z-][a-z0-9-]*)\s*\(/gi;
-const CSS_ALLOWED_FUNCTIONS = /* @__PURE__ */ new Set([
-	"var",
-	"calc",
-	"min",
-	"max",
-	"clamp",
-	"rgb",
-	"rgba",
-	"hsl",
-	"hsla",
-	"lab",
-	"lch",
-	"oklab",
-	"oklch",
-	"color",
-	"color-mix",
-	"translate",
-	"translatex",
-	"translatey",
-	"translatez",
-	"scale",
-	"scalex",
-	"scaley",
-	"scalez",
-	"rotate",
-	"rotatex",
-	"rotatey",
-	"rotatez",
-	"skew",
-	"skewx",
-	"skewy",
-	"matrix",
-	"matrix3d",
-	"linear-gradient",
-	"radial-gradient",
-	"conic-gradient",
-	"repeating-linear-gradient",
-	"repeating-radial-gradient",
-	"repeating-conic-gradient",
-	"cubic-bezier",
-	"steps"
-]);
 const STYLE_PROP_CACHE = /* @__PURE__ */ new Map();
 const MAX_STYLE_PROP_CACHE_SIZE = 512;
 function toKebabCached(prop) {
@@ -178,19 +133,7 @@ function escapeAttr(value) {
 	return lastIndex === 0 ? value : escaped + value.slice(lastIndex);
 }
 /**
-* Escape CSS value to prevent injection attacks.
-* Removes characters that could break out of CSS context.
-*/
-function escapeCssValue(value) {
-	const str = String(value);
-	if (CSS_URI_SCHEME_RE.test(str)) return "";
-	if (str.includes("(")) {
-		for (const match of str.matchAll(CSS_FUNCTION_NAME_RE)) if (!CSS_ALLOWED_FUNCTIONS.has(match[1].toLowerCase())) return "";
-	}
-	return str.replace(CSS_UNSAFE_RE, "");
-}
-/**
-* Convert style object to CSS string with value escaping
+* Convert a style object to a CSS string, omitting unsafe values.
 * Optimized to avoid Object.entries allocation
 */
 function styleObjToCss(value) {
@@ -201,7 +144,7 @@ function styleObjToCss(value) {
 		const v = styleObj[k];
 		if (v === null || v === void 0 || v === false) continue;
 		const prop = toKebabCached(k);
-		const safeValue = escapeCssValue(String(v));
+		const safeValue = sanitizeCssValue(String(v));
 		if (safeValue) result += `${prop}:${safeValue};`;
 	}
 	return result || null;
@@ -264,6 +207,10 @@ function createRenderContext(seed = 12345, opts = {}) {
 		renderData: envelope,
 		hydrationData: envelope,
 		deferredBoundaries: [],
+		ssrPortals: {
+			slots: /* @__PURE__ */ new Map(),
+			nextHostId: 0
+		},
 		cspNonce: opts.cspNonce
 	};
 }
@@ -310,13 +257,7 @@ async function getAsyncRenderContextAccessor() {
 async function withRenderContextAsync(ctx, fn) {
 	const accessor = await getAsyncRenderContextAccessor();
 	if (accessor) return accessor.run(ctx, () => Promise.resolve(fn()));
-	const previous = fallbackStack;
-	fallbackStack = ctx;
-	try {
-		return await fn();
-	} finally {
-		fallbackStack = previous;
-	}
+	throw new Error(FALLBACK_ASYNC_CONTEXT_ERROR);
 }
 /**
 * Get the current render context.
@@ -833,6 +774,7 @@ function renderAttrsDirect(props, sink) {
 		}
 		if (value === false || value === null || value === void 0) continue;
 		const strValue = String(value);
+		if (attrName.toLowerCase() === "href" && !isSafeHref(strValue)) continue;
 		sink.write(" ");
 		sink.write(attrName);
 		sink.write("=\"");
@@ -867,6 +809,7 @@ function renderAttrs(props, opts) {
 		else if (value === false || value === null || value === void 0) continue;
 		else {
 			const strValue = String(value);
+			if (attrName.toLowerCase() === "href" && !isSafeHref(strValue)) continue;
 			attrParts.push(` ${attrName}="${getEscapedAttrValue(strValue)}"`);
 		}
 	}
@@ -969,6 +912,47 @@ function renderRenderableSync(value, ctx) {
 	if (value && typeof value === "object" && "type" in value) return renderNodeSync(value, ctx);
 	return "";
 }
+function resolveSSRPortals(html, ctx) {
+	let resolved = html;
+	const renderedHosts = /* @__PURE__ */ new Set();
+	for (;;) {
+		let foundHost = false;
+		for (const slot of ctx.ssrPortals.slots.values()) {
+			const explicitHosts = slot.hosts.filter((host) => !host.automatic);
+			const activeHosts = explicitHosts.length > 0 ? new Set(explicitHosts.map((host) => host.token)) : new Set(slot.hosts.map((host) => host.token));
+			for (const host of slot.hosts) {
+				if (renderedHosts.has(host.token)) continue;
+				foundHost = true;
+				const content = activeHosts.has(host.token) && slot.hasValue ? renderRenderableSync(slot.value, ctx) : "";
+				resolved = resolved.replace(host.token, () => content);
+				renderedHosts.add(host.token);
+			}
+		}
+		if (!foundHost) return resolved;
+	}
+}
+var SSRPortalSink = class {
+	constructor(sink) {
+		this.sink = sink;
+		this.bufferedChunks = null;
+	}
+	write(html) {
+		if (!html) return;
+		if (this.bufferedChunks) {
+			this.bufferedChunks.push(html);
+			return;
+		}
+		this.sink.write(html);
+	}
+	writePortalHost(token) {
+		this.bufferedChunks ??= [];
+		this.bufferedChunks.push(token);
+	}
+	flush(ctx) {
+		if (!this.bufferedChunks) return;
+		this.sink.write(resolveSSRPortals(this.bufferedChunks.join(""), ctx));
+	}
+};
 function renderChildSync(child, ctx) {
 	return renderRenderableSync(child, ctx);
 }
@@ -1037,6 +1021,7 @@ function renderNodeSync(node, ctx) {
 	const { type, props } = node;
 	if (typeof type === "function") return renderRenderableSync(inheritRenderableKey(node, executeComponentSync(type, props, ctx, getVNodeContextFrame(node) ?? null)), ctx);
 	if (typeof type === "symbol") {
+		if (type === SSR_PORTAL_HOST) return String(props?.token ?? "");
 		if (type === Fragment) return renderChildrenSync(getRenderableChildren(node), ctx);
 		if (type === __CONTROL_BOUNDARY__) return renderControlChildrenSync(node, ctx);
 		if (type === DEFERRED_BOUNDARY) return renderDeferredBoundarySync(node, ctx);
@@ -1076,6 +1061,13 @@ function renderNodeSyncToSink(node, sink, ctx) {
 		return;
 	}
 	if (typeof type === "symbol") {
+		if (type === SSR_PORTAL_HOST) {
+			const token = String(props?.token ?? "");
+			const portalSink = sink;
+			if (portalSink.writePortalHost) portalSink.writePortalHost(token);
+			else sink.write(token);
+			return;
+		}
 		if (type === Fragment) {
 			renderChildrenSyncToSink(getRenderableChildren(node), sink, ctx);
 			return;
@@ -1182,9 +1174,8 @@ function renderToStringSync(component, props, options) {
 			if (!node) throw new Error("renderToStringSync: wrapped component returned empty");
 			const sink = new StringSink();
 			renderNodeSyncToSink(node, sink, ctx);
-			sink.write(serializeHydrationRenderData(ctx.hydrationData ?? void 0, ctx.dataRuntime));
 			sink.end();
-			return sink.toString();
+			return resolveSSRPortals(sink.toString(), ctx) + serializeHydrationRenderData(ctx.hydrationData ?? void 0, ctx.dataRuntime);
 		} finally {
 			try {
 				stopRenderPhase();
@@ -1199,10 +1190,13 @@ function renderSSRRouteAppToSink(input) {
 	withRenderContext(ctx, () => {
 		startRenderPhase(ctx.renderData);
 		try {
-			renderRenderableSyncToSink(executeComponentSync(ctx.cspNonce === void 0 ? route.handler : () => CspNonceScope({
+			const app = executeComponentSync(ctx.cspNonce === void 0 ? route.handler : () => CspNonceScope({
 				value: ctx.cspNonce,
 				children: () => route.handler(params)
-			}), params, ctx), sink, ctx);
+			}), params, ctx);
+			const appSink = new SSRPortalSink(sink);
+			renderRenderableSyncToSink(wrapWithDefaultPortal(app), appSink, ctx);
+			appSink.flush(ctx);
 			if (ctx.deferredBoundaries.length === 0) sink.write(serializeHydrationRenderData(ctx.hydrationData ?? data, ctx.dataRuntime));
 		} finally {
 			try {

package/dist/testing/index.d.ts

@@ -1,5 +1,38 @@
+import { s as ComponentFunction } from "../control-DO-iBEtV.js";
 import { C as Query, k as QueryStaleReason } from "../index-Bki2rqcr.js";
-import { N as RouteRegistry, x as RouteMatch } from "../router-C0XQA62W.js";
+import { N as RouteRegistry, p as RouteAuthOptions, x as RouteMatch } from "../router-C3vENhUh.js";
+//#region src/testing/render.d.ts
+interface RenderOptions {
+  /**
+   * Existing element to own for the duration of the render. When omitted, the
+   * harness appends a managed `<div>` to `document.body`.
+   */
+  container?: HTMLElement;
+  /** Surface lifecycle cleanup errors during unmount. */
+  cleanupStrict?: boolean;
+}
+interface RouteRenderOptions extends RenderOptions {
+  registry: RouteRegistry;
+  /** Initial path, query, and hash for the routed render. */
+  url?: string;
+  auth?: RouteAuthOptions;
+}
+type DispatchEventInit = EventInit | UIEventInit | FocusEventInit | MouseEventInit | WheelEventInit | KeyboardEventInit | InputEventInit | CompositionEventInit | PointerEventInit | TouchEventInit | DragEventInit;
+interface RenderResult {
+  readonly container: HTMLElement;
+  readonly root: HTMLElement;
+  flush(): void;
+  dispatch(target: EventTarget, event: Event | string, init?: DispatchEventInit): boolean;
+  unmount(): void;
+  cleanup(): void;
+}
+declare function flush(): void;
+declare function dispatch(target: EventTarget, event: Event | string, init?: DispatchEventInit): boolean;
+declare function cleanup(target: RenderResult | HTMLElement): void;
+declare function render(component: ComponentFunction, options?: RenderOptions): RenderResult;
+declare function mount(component: ComponentFunction, options?: RenderOptions): RenderResult;
+declare function renderRoute(options: RouteRenderOptions): Promise<RenderResult>;
+//#endregion
 //#region src/testing/index.d.ts
 type MockRefresh = () => void | Promise<void>;
 interface MockQueryOptions {
@@ -47,4 +80,4 @@ declare function createInvalidationRecorder(): InvalidationRecorder;
 declare function matchRoute(path: string, options: MatchRouteOptions): RouteMatch | null;
 declare function getRouteWarnings(options: MatchRouteOptions): RoutePatternWarning[];
 //#endregion
-export { InvalidationRecord, InvalidationRecorder, MockQueryOptions, MockRefresh, RoutePatternWarning, createInvalidationRecorder, getRouteWarnings, matchRoute, mockQuery, queryState };
+export { InvalidationRecord, InvalidationRecorder, MockQueryOptions, MockRefresh, type RenderOptions, type RenderResult, RoutePatternWarning, type RouteRenderOptions, cleanup, createInvalidationRecorder, dispatch, flush, getRouteWarnings, matchRoute, mockQuery, mount, queryState, render, renderRoute };