@barefootjs/jsx 0.33.3 → 0.33.6

package/src/ir-to-client-js/plan/build-static-array-child-init.ts

@@ -20,7 +20,7 @@
 import type { IRLoopChildComponent, MapCallbackPreamble } from '../../types.ts'
 import type { ClientJsContext, NestedLoop, TopLevelLoop } from '../types.ts'
 import { quotePropName, varSlotId, attrValueToString, buildLoopChildIndexExpr } from '../utils.ts'
-import { irChildrenToJsExpr, renderPreamble, irToHtmlTemplate } from '../html-template.ts'
+import { jsxChildrenPropGetterExpr, renderPreamble, irToHtmlTemplate } from '../html-template.ts'
 
 /**
  * Render a loop preamble for the static-array init context. Static `forEach`
@@ -232,7 +232,12 @@ function buildStaticPropsExpr(props: readonly LoopChildCompProp[]): PropsExpr {
       case 'boolean-attr':
         return `${quotePropName(p.name)}: true`
       case 'jsx-children':
-        return `get ${quotePropName(p.name)}() { return ${irChildrenToJsExpr(p.value.children)} }`
+        // Brand via the shared door (#2651/#2702) — see
+        // `jsxChildrenPropGetterExpr`'s docstring. A named jsx-children
+        // prop on a component instantiated inside a static-array `.map()`
+        // loop used to reach its getter unbranded (pullfrog review, PR
+        // #2820).
+        return `get ${quotePropName(p.name)}() { return ${jsxChildrenPropGetterExpr(p.value.children, p.name)} }`
       case 'expression':
       case 'template':
       case 'spread':

package/src/ir-to-client-js/rewrite-props-object.ts

@@ -26,6 +26,18 @@
 import ts from 'typescript'
 import { PROPS_PARAM } from './utils.ts'
 import { identifierPattern } from '../identifier-pattern.ts'
+import type { BindingScope } from '../scope/binding-scope.ts'
+
+export interface PropsObjectRewriteOptions {
+  /**
+   * SHADOW GUARD (CLAUDE.md's `BindingScope` distinction — `isBound()`,
+   * not `valueBoundNames()`): a `.map(props => ...)` row whose callback
+   * PARAMETER happens to be named the same as the outer `propsObjectName`
+   * must not have that parameter rewritten to `_p` — it shadows the outer
+   * props object inside its own row, same as any other bound name would.
+   */
+  enclosingScope?: BindingScope
+}
 
 /**
  * Rename every value-position reference to `propsObjectName` — and,
@@ -64,11 +76,13 @@ export function rewritePropsObjectRef(
   code: string,
   propsObjectName: string | null,
   restPropsName: string | null = null,
+  opts?: PropsObjectRewriteOptions,
 ): string {
   let result = code
   const seen = new Set<string>()
   for (const srcPropsName of [propsObjectName ?? 'props', restPropsName]) {
     if (srcPropsName === null || srcPropsName === PROPS_PARAM || seen.has(srcPropsName)) continue
+    if (opts?.enclosingScope?.isBound(srcPropsName)) continue
     seen.add(srcPropsName)
     result = rewriteOneName(result, srcPropsName)
   }

package/src/jsx-to-ir.ts

@@ -40,7 +40,7 @@ import {
 } from './types.ts'
 import { type AnalyzerContext, type MultiReturnJsxInfo, getSourceLocation, collectReactiveGetterNames } from './analyzer-context.ts'
 import { parseExpression, isSupported, parseBlockBody, foldBlockToExpr, predicateTernaryToLogical, tsNodeToParsedExpr, sortComparatorFromArrow, stringifyParsedExpr, cssKebabCase, CALLBACK_METHODS, type ParsedExpr } from './expression-parser.ts'
-import type { IRLoopSort, FunctionInfo } from './types.ts'
+import type { IRLoopSort, FunctionInfo, ConstantInfo } from './types.ts'
 import { formatParamWithType } from './module-exports.ts'
 import { createError, ErrorCodes, internalInvariant } from './errors.ts'
 import { CLIENT_BUILTIN_SOURCE, isClientBuiltinName, type ClientBuiltinTag } from './builtins.ts'
@@ -49,7 +49,7 @@ import {
   rewriteBarePropRefs as rewriteBarePropRefsCore,
   collectAstPropRefs,
 } from './prop-rewrite.ts'
-import { buildPropAliasMap, resolveRestSpreadOriginCore } from './props-binding.ts'
+import { boundPropLocalNames, buildPropAliasMap, resolveAliasOrigin, resolveRestSpreadOriginCore } from './props-binding.ts'
 import { resolveFreeRefs, isNameBound as isNameBoundInEnv, type BindingEnvironment } from './free-refs.ts'
 import { computeFileScope } from './ir-to-client-js/component-scope.ts'
 import { createTemplateAwareStringProtector } from './ir-to-client-js/html-template.ts'
@@ -73,6 +73,7 @@ import { identifierPattern, identifierCallPattern } from './identifier-pattern.t
 interface ReactivityPatterns {
   signals: { getter: string; pattern: RegExp }[]
   memos: { name: string; pattern: RegExp }[]
+  /** For regex `props.<key>` detection only — for exact-name binding checks read `TransformContext.boundPropNames` instead (#2835). */
   props: { name: string; pattern: RegExp }[]
   constants: { name: string; value: string | undefined; pattern: RegExp }[]
 }
@@ -85,6 +86,14 @@ interface TransformContext {
   isRoot: boolean
   insideComponentChildren: boolean
   patterns: ReactivityPatterns
+  /**
+   * Local names actually bound by the props parameter (#2835) — unlike
+   * `patterns.props`, which for a whole `(props: Props)` parameter holds
+   * every TYPE-MEMBER name (needed so its regex `pattern` still matches
+   * `props.<key>` accesses), this is empty in that shape since none of
+   * those names are local bindings a shadow check could ever see.
+   */
+  boundPropNames: ReadonlySet<string>
   /** Shortcut for analyzer.getJS(node) */
   getJS(node: ts.Node): string
   /** getJS + rewrite destructured prop refs for client JS templates (#807) */
@@ -93,8 +102,20 @@ interface TransformContext {
   _reactiveGetterNames?: Set<string>
   /** Cached set of module-scope @client signal/memo names. */
   _moduleClientSignalNames?: Set<string>
-  /** Cached `localConstants` index for `forwardsCallerRestProps`'s alias walk */
-  _restSpreadConstantValues?: ReadonlyMap<string, string | undefined>
+  /**
+   * Cached `localConstants` index (name → value text), shared by every
+   * `resolveAliasOrigin` walk in this file — `forwardsCallerRestProps`'s
+   * rest/props-spread alias walk and `isArrayExprDirectPropRef`'s
+   * direct-prop-array alias walk (#2724).
+   */
+  _constantValuesByName?: ReadonlyMap<string, string | undefined>
+  /**
+   * Cached `localConstants` index (name → full `ConstantInfo`), for
+   * lookups that need more than the value text — e.g.
+   * `isArrayExprDirectPropRef` reading a constant's structured `.parsed`
+   * to recognize `const arr = props.items` (#2724).
+   */
+  _constantsByName?: ReadonlyMap<string, ConstantInfo>
   /** Cached set of destructured prop names for AST-based rewriting */
   _destructuredPropNames?: Set<string> | null
   /**
@@ -668,6 +689,10 @@ function getDestructuredPropAliases(ctx: TransformContext): Map<string, string>
 }
 
 function createTransformContext(analyzer: AnalyzerContext): TransformContext {
+  // Shared by `patterns.props` (regex matching) and `boundPropNames`
+  // (exact-name binding checks, #2835) so both agree on which prop
+  // params are in play — `children` excluded from both the same way.
+  const propsParamsForMatching = analyzer.propsParams.filter(p => p.name !== 'children')
   return {
     analyzer,
     sourceFile: analyzer.sourceFile,
@@ -681,6 +706,7 @@ function createTransformContext(analyzer: AnalyzerContext): TransformContext {
     insideComponentChildren: false,
     scope: BindingScope.EMPTY,
     loopDepth: 0,
+    boundPropNames: boundPropLocalNames({ propsParams: propsParamsForMatching, propsObjectName: analyzer.propsObjectName }),
     patterns: {
       signals: analyzer.signals.map(s => ({
         getter: s.getter,
@@ -690,9 +716,7 @@ function createTransformContext(analyzer: AnalyzerContext): TransformContext {
         name: m.name,
         pattern: identifierCallPattern(m.name),
       })),
-      props: analyzer.propsParams
-        .filter(p => p.name !== 'children')
-        .map(p => ({ name: p.name, pattern: identifierPattern(p.name) })),
+      props: propsParamsForMatching.map(p => ({ name: p.name, pattern: identifierPattern(p.name) })),
       constants: analyzer.localConstants.map(c => ({
         name: c.name,
         value: c.value,
@@ -3793,6 +3817,19 @@ function extractLoopKey(node: IRNode): string | null {
     if (b === null) return null
     return normalizeKeyExpr(a) === normalizeKeyExpr(b) ? a : null
   }
+  if (node.type === 'fragment') {
+    // #2763: a `.map()` body returning a fragment (`<><li key={..}/><li/></>`)
+    // reads the key off its FIRST element, not first node — same "first
+    // element, not first node" rule as `IRElement.keyAttr`'s docstring and
+    // `markCarrierIn`'s relay case, skipping whitespace-only text the way
+    // `branchHasNoElement` does. Recursing through `extractLoopKey` (rather
+    // than requiring `type === 'element'` directly) lets a nested
+    // conditional/fragment first child resolve too.
+    const first = node.children.find(
+      (c) => !(c.type === 'text' && typeof c.value === 'string' && !c.value.trim())
+    )
+    return first ? extractLoopKey(first) : null
+  }
   return null
 }
 
@@ -4108,7 +4145,7 @@ function leafIsWirelessElement(el: ts.JsxElement | ts.JsxSelfClosingElement): bo
         if (ts.isJsxSpreadAttribute(attr)) { ok = false; return }
         if (ts.isJsxAttribute(attr)) {
           const name = attr.name.getText()
-          if (/^on[A-Z]/.test(name)) { ok = false; return }
+          if (isEventHandlerAttrName(name)) { ok = false; return }
         }
       }
     }
@@ -4206,12 +4243,12 @@ function tagLoopItemRootComponents(nodes: readonly IRNode[]): void {
  *
  * Deliberately does NOT remove the literal `key` entry from `.attrs`: the
  * CSR/client-JS codegen path (`ir-to-client-js/html-template.ts`'s
- * `a.name === 'key' ? keyAttrName(loopDepth) : ...`) already reads it
- * directly and is not part of #2753's 16-site duplication — it derives the
- * same name from the same `keyAttrName()` single source of truth, just at a
- * different phase (client-template bake time, not SSR emit time). Adapters
- * skip the raw `key` attr in their generic `renderAttributes` loop instead
- * (Hono's own JSX runtime already drops it silently either way).
+ * `resolvedKeyAttrName` helper, #2763) reads it back off `.attrs` too, but
+ * only emits `data-key` when THIS field — `node.keyAttr` — is actually set;
+ * a raw `key` attribute the SSR side didn't recognize as a row key (e.g. a
+ * fragment-bodied row before #2763's fix) no longer gets baked client-side
+ * either. Adapters skip the raw `key` attr in their generic `renderAttributes`
+ * loop instead (Hono's own JSX runtime already drops it silently either way).
  *
  * `component` bodies are left untouched: a `<Comp key={x}/>` row root's key
  * is a PROP (`renderComponentProps`'s own `data-key` prop-forwarding), not
@@ -4226,6 +4263,16 @@ function applyLoopKeyAttr(node: IRNode, name: string, value: string): void {
   if (node.type === 'conditional') {
     applyLoopKeyAttr(node.whenTrue, name, value)
     applyLoopKeyAttr(node.whenFalse, name, value)
+    return
+  }
+  if (node.type === 'fragment') {
+    // Write-side twin of `extractLoopKey`'s fragment case: stamp the SAME
+    // first-real-child this key was read from, not every child, matching
+    // the "first element, not first node" rule.
+    const first = node.children.find(
+      (c) => !(c.type === 'text' && typeof c.value === 'string' && !c.value.trim())
+    )
+    if (first) applyLoopKeyAttr(first, name, value)
   }
 }
 
@@ -4667,7 +4714,7 @@ function transformMapCall(
           // the conditional — the same carrier the single-return path uses. A
           // JS-runtime adapter (and the browser under /* @client */) runs it
           // verbatim.
-          preamble = preambleFromValueStatements(pre, ctx)
+          preamble = preambleFromValueStatements(pre, ctx, body.statements)
 
           // Stage 2 of spec/callback-fidelity.md, narrowed by #2447. This used
           // to refuse EVERY branch preamble on a DSL target, on the premise
@@ -4874,7 +4921,7 @@ function transformMapCall(
             valueStmts.push(stmt)
           }
           if (valueStmts.length > 0) {
-            preamble = preambleFromValueStatements(valueStmts, ctx)
+            preamble = preambleFromValueStatements(valueStmts, ctx, body.statements)
 
             // #2447. A DSL adapter cannot execute `preamble.segments` (JS
             // text), so it lowers `declarations` — one per-row local each —
@@ -5456,8 +5503,8 @@ function buildFlatMapCallback(
     // Template variant per segment, like buildPreambleSegments: the hydrate
     // registration template is module scope (`template: (_p) => ...`), so a
     // bare destructured-prop reference must rewrite to `_p.xxx` there —
-    // `applyPropsRewrite` can't do it (destructured components have no props
-    // object name).
+    // `rewritePropsObjectRef` can't do it (destructured components have no
+    // props object name to rewrite from).
     const tpl = rewriteBarePropRefs(piece.js, body, ctx)
     return tpl !== undefined && tpl !== piece.js
       ? { kind: 'js', text: piece.js, templateText: tpl }
@@ -5844,6 +5891,7 @@ function computePreambleReactiveNames(
 function preambleFromValueStatements(
   statements: readonly ts.Statement[],
   ctx: TransformContext,
+  bodyStatements: readonly ts.Statement[],
 ): MapCallbackPreamble {
   const segments: PreambleSegment[] = []
   const typedParts: string[] = []
@@ -5865,7 +5913,7 @@ function preambleFromValueStatements(
     declaredNames: [...declared],
     // Value-only preambles accumulate no JSX, so no child needs the array join.
     builderNames: [],
-    declarations: neutralPreambleDeclarations(statements, ctx) ?? undefined,
+    declarations: neutralPreambleDeclarations(statements, ctx, bodyStatements) ?? undefined,
     reactiveNames: reactiveNames.size > 0 ? [...reactiveNames] : undefined,
   }
 }
@@ -5882,6 +5930,7 @@ function preambleFromValueStatements(
 function neutralPreambleDeclarations(
   statements: readonly ts.Statement[],
   ctx: TransformContext,
+  bodyStatements: readonly ts.Statement[],
 ): PreambleValueDeclaration[] | null {
   const out: PreambleValueDeclaration[] = []
   for (const stmt of statements) {
@@ -5893,6 +5942,20 @@ function neutralPreambleDeclarations(
       // no adapter has a single per-row local form for that.
       if (!ts.isIdentifier(decl.name)) return null
       if (!decl.initializer) return null
+      // #2797: a function-valued local (an event handler hoisted out of the
+      // JSX attribute position, e.g. `const handleClick = () => {...}`) has
+      // no template-expression form on any backend — no DSL here has a
+      // callable value. But every adapter's own SSR component-prop builder
+      // already skips an event-handler prop (`isEventHandlerAttrName`)
+      // outright, so a name read ONLY that way needs no SSR representation
+      // at all — elide the declaration instead of refusing the whole
+      // preamble. The client-JS preamble (`segments`, not `declarations`)
+      // still carries the real closure; this only concerns what the DSL
+      // SSR template sees.
+      if (isFunctionLiteral(decl.initializer)) {
+        if (everyReadIsEventHandlerPropValue(decl.name.text, bodyStatements)) continue
+        return null
+      }
       const valueParsed = tsNodeToParsedExpr(decl.initializer)
       // The same subset gate every other DSL-lowered expression passes
       // through. An adapter that additionally cannot emit a supported shape
@@ -5907,7 +5970,74 @@ function neutralPreambleDeclarations(
       })
     }
   }
-  return out.length > 0 ? out : null
+  // Not `out.length > 0 ? out : null` — an all-elided preamble legitimately
+  // has zero declarations to emit (see MapCallbackPreamble.declarations'
+  // docstring); `[]` is what tells the Phase-1 gate "fully declared."
+  return out
+}
+
+/** `const x = () => {...}` / `const x = function () {...}` — a callable value, never a template-expression shape. */
+function isFunctionLiteral(node: ts.Expression): boolean {
+  return ts.isArrowFunction(node) || ts.isFunctionExpression(node)
+}
+
+/**
+ * Whether every read of `name` in `bodyStatements`, other than its own
+ * binding site, sits inside an event-handler `JsxAttribute`'s
+ * (`onClick`/`onInput`/...) value — i.e. `name={<ident>}` where the
+ * attribute's own name passes {@link isEventHandlerAttrName}, the exact
+ * predicate every DSL adapter's own SSR prop-builder already uses to skip an
+ * event-handler prop (e.g. `packages/adapter-jinja/src/adapter/
+ * jinja-adapter.ts`'s `renderComponent`, `packages/adapter-go-template/...`'s
+ * `prop.isEventHandler` check).
+ *
+ * Walks the raw preamble+return syntax rather than the already-built row IR
+ * (`children`) deliberately: `neutralPreambleDeclarations` runs on the
+ * PREAMBLE statements specifically, and the IR built from the return
+ * expression doesn't retain a per-occurrence link back to which SOURCE
+ * identifier fed a given `IREvent`/`IRProp` — re-deriving from syntax here
+ * keeps the safety check self-contained rather than threading that link
+ * through the IR builder for one caller.
+ *
+ * Conservative: a property-access name (`x.name`), a nested declaration's own
+ * binding, or any other read shape (a text/attr expression, a NON-event
+ * child prop, a call) fails this and falls through to the ordinary refusal —
+ * this only widens the shapes that are SAFE to elide, never narrows what was
+ * already accepted. Uses `ts.forEachChild`'s own short-circuit (a truthy
+ * return stops the walk) rather than a separate mutable flag.
+ */
+function everyReadIsEventHandlerPropValue(name: string, bodyStatements: readonly ts.Statement[]): boolean {
+  const findDisallowedRead = (node: ts.Node): true | undefined => {
+    if (ts.isIdentifier(node) && node.text === name) {
+      const isBindingName = ts.isVariableDeclaration(node.parent) && node.parent.name === node
+      const isPropertyName = ts.isPropertyAccessExpression(node.parent) && node.parent.name === node
+      if (!isBindingName && !isPropertyName) {
+        const jsxExpr = node.parent
+        const attr = jsxExpr.parent
+        const isEventHandlerAttrValue =
+          ts.isJsxExpression(jsxExpr) &&
+          ts.isJsxAttribute(attr) &&
+          attr.initializer === jsxExpr &&
+          ts.isIdentifier(attr.name) &&
+          isEventHandlerAttrName(attr.name.text)
+        if (!isEventHandlerAttrValue) return true
+      }
+    }
+    return ts.forEachChild(node, findDisallowedRead)
+  }
+  return !bodyStatements.some(findDisallowedRead)
+}
+
+/**
+ * Whether a JSX attribute name is an event handler (`onClick`, `onInput`,
+ * ...) rather than a plain attribute/prop. Shared by every site in this file
+ * that needs the same call: native-element attribute extraction (routes into
+ * `IREvent`, never rendered HTML), the preamble-verbatim-leaf wiring guard,
+ * and {@link everyReadIsEventHandlerPropValue}'s elision safety check — one
+ * decision, one implementation, per CLAUDE.md.
+ */
+function isEventHandlerAttrName(name: string): boolean {
+  return /^on[A-Z]/.test(name)
 }
 
 /** Drop the trailing separator space from the final js segment. */
@@ -6261,7 +6391,7 @@ function processAttributes(
     // they're wired up at hydration time (delegated event registration) and
     // must not leak into rendered HTML. The DOM event name is lowercase
     // (`click`, not `Click`), so strip the `on` prefix and downcase.
-    if (/^on[A-Z]/.test(rawName)) {
+    if (isEventHandlerAttrName(rawName)) {
       if (attr.initializer && ts.isJsxExpression(attr.initializer) && attr.initializer.expression) {
         const eventName = rawName.slice(2).toLowerCase()
         reportJsxBranchLocalInCallback(attr.initializer.expression, ctx)
@@ -7287,10 +7417,7 @@ function expressionWrapsJsx(node: ts.Expression): boolean {
  * Refuse a component prop whose initializer is a ternary/array literally
  * wrapping JSX (#2667) — see `expressionWrapsJsx`'s docstring and the call
  * site above for why this can't fall through to the plain `expression`
- * AttrValue path (raw JSX syntax would splice into the emitted client
- * JS) and why the fragment-wrap escape is NOT offered here (BF021 message
- * below explains the unsoundness inline; see #2667's tracking issue for
- * the full door-inventory finding).
+ * AttrValue path (raw JSX syntax would splice into the emitted client JS).
  */
 function reportNakedJsxWrapperProp(
   ctx: TransformContext,
@@ -7305,15 +7432,21 @@ function reportNakedJsxWrapperProp(
         `Prop '${propName}' is ${shape} wrapping JSX (${jsxExpr.getText(ctx.sourceFile)}). ` +
         `This shape is not compiled — only a JSX element/fragment given DIRECTLY as the prop value is.`,
       suggestion: {
-        message:
-          `Move the conditional/array out of the prop position: compute it in a local ` +
-          `const and pass it as the component's children instead of a named prop ` +
-          `(e.g. const ${propName} = ${jsxExpr.getText(ctx.sourceFile)}; <Comp>{${propName}}</Comp>). ` +
-          `Wrapping the ternary/array in a fragment at the prop position ` +
-          `(${propName}={<>{${jsxExpr.getText(ctx.sourceFile)}}</>}) is NOT a safe escape here: it compiles, ` +
-          `but the child's own reactive prop getter receives the branch's HTML unbranded and re-escapes it as ` +
-          `text on the child's very next reactive run, corrupting the DOM (a narrower gap #2651's door ` +
-          `inventory left open — tracked separately).`,
+        message: ts.isConditionalExpression(jsxExpr)
+          ? `Move the conditional out of the prop position: compute it in a local const and pass it as ` +
+            `the component's children instead of a named prop ` +
+            `(e.g. const ${propName} = ${jsxExpr.getText(ctx.sourceFile)}; <Comp>{${propName}}</Comp>). ` +
+            `Wrapping the ternary in a fragment at the prop position ` +
+            `(${propName}={<>{${jsxExpr.getText(ctx.sourceFile)}}</>}) is also a safe escape (#2702): the ` +
+            `compiler brands each JSX branch individually, so the child's reactive prop getter unwraps it ` +
+            `correctly instead of re-escaping it as text.`
+          : `Move the array out of the prop position: compute it in a local const and pass it as the ` +
+            `component's children instead of a named prop ` +
+            `(e.g. const ${propName} = ${jsxExpr.getText(ctx.sourceFile)}; <Comp>{${propName}}</Comp>). ` +
+            `Wrapping the array in a fragment at the prop position is NOT a safe escape here: it compiles, ` +
+            `but flattens to more than one part, which the child's reactive prop getter has no branding ` +
+            `contract for (a multi-part jsx-children shape, tracked separately from #2702's single-` +
+            `conditional fix).`,
         escape: [{ kind: 'rewrite' }],
       },
     }),
@@ -7368,14 +7501,13 @@ function processComponentProps(
       // plain `expression` path below, which stringifies the initializer's
       // SOURCE TEXT — literal JSX syntax spliced into the emitted client
       // JS (invalid at runtime; the #2651 door inventory's discovery).
-      // Refuse loudly instead of guessing a lowering: the fragment-wrap
-      // escape this diagnostic once considered recommending turns out to
-      // be unsound for the same shape (`isSingleElementJsxChildren`'s
-      // docstring in `ir-to-client-js/collect-elements.ts` — a
-      // conditional-in-fragment reaches `initChild`'s getter UNbranded,
-      // corrupting the child's DOM the moment its own reactive effect
-      // first reads the prop), so only the children-passthrough escape is
-      // offered.
+      // Refuse loudly instead of guessing a lowering. The fragment-wrap
+      // escape IS safe for the ternary shape (#2702: `jsxChildrenPropGetterExpr`,
+      // `ir-to-client-js/html-template.ts`, brands each JSX branch after the
+      // fragment hoists the conditional) — `reportNakedJsxWrapperProp`
+      // offers it for that case. It stays unsafe for the array-literal
+      // shape (a multi-part jsx-children value has no branding contract),
+      // so only the children-passthrough escape is offered there.
       if (
         (ts.isConditionalExpression(jsxExpr) || ts.isArrayLiteralExpression(jsxExpr)) &&
         expressionWrapsJsx(jsxExpr)
@@ -7738,31 +7870,152 @@ function checkBareSignalOrMemoIdentifier(
  * Structural AST check: is the array expression a direct prop reference?
  *
  * Returns true only when arrayExpr is:
- * (a) An Identifier that is a destructured prop binding (e.g. `toggleItems`)
- * (b) A PropertyAccessExpression rooted at the props object (e.g. `props.items`)
+ * (a) An Identifier that is a destructured prop binding (e.g. `toggleItems`),
+ *     OR reaches one through a bare `x = y` local-alias-hop chain (e.g.
+ *     `const toggleItems__alias = toggleItems`, any number of hops, `const`
+ *     or `let`, #2724 — see `propAliasHopCandidates`'s docstring for why
+ *     `let` stays eligible)
+ * (b) A PropertyAccessExpression rooted at the props object (e.g. `props.items`),
+ *     OR one whose object reaches the props object through the same kind of
+ *     alias-hop chain as (a) (e.g. `const p = props; p.items`, #2724 review)
  *
  * Unlike the regex-based `isPropsReference`, this avoids false positives from
  * unrelated identifiers that happen to share a prop name (e.g. `state.items`
- * when `items` is also a prop).
+ * when `items` is also a prop) — the alias-hop walk only ever follows a
+ * constant's own bare-identifier value text or its structured `.parsed`
+ * shape, never a substring/regex match against arbitrary expression text.
+ * `propAliasHopCandidates` additionally restricts which constants are
+ * eligible hop sources (see its docstring). A name that merely COLLIDES
+ * with a prop's name without being bound to it (a module constant sharing a
+ * whole-`props`-object type's member name) is excluded by the terminal
+ * (`isDirectPropBindingName` reads `ctx.boundPropNames`, not the wider
+ * `ctx.patterns.props` — #2835).
+ *
+ * This is more than a "prop reference somewhere in the expression" check
+ * (`isPropsReference`'s regex semantics): the return value also feeds
+ * `IRLoop.isPropDerivedArray`, which the Go adapter uses to decide whether a
+ * nested component's field is literally the loop's prop-sourced data — a
+ * false positive there would misclassify DSL-adapter codegen, not just add
+ * one extra `mapArray`. So the alias walk stays structural (AST-derived
+ * `ConstantInfo.parsed`), not a second regex-based implementation of
+ * `isPropsReference`/`isSignalOrMemoReference`'s chain walk.
  */
 function isArrayExprDirectPropRef(arrayExpr: ts.Expression, ctx: TransformContext): boolean {
-  const propNames = new Set(ctx.patterns.props.map(p => p.name))
   const propsObjName = ctx.analyzer.propsObjectName
 
   if (ts.isIdentifier(arrayExpr)) {
-    return propNames.has(arrayExpr.text)
+    return resolveAliasOrigin(propAliasHopCandidates(ctx), arrayExpr.text, name => (isDirectPropBindingName(name, ctx) ? true : null)) === true
   }
 
   if (ts.isPropertyAccessExpression(arrayExpr) && propsObjName) {
     const obj = arrayExpr.expression
-    if (ts.isIdentifier(obj) && obj.text === propsObjName) {
-      return true
+    if (ts.isIdentifier(obj)) {
+      return resolveAliasOrigin(propAliasHopCandidates(ctx), obj.text, name => (name === propsObjName ? true : null)) === true
     }
   }
 
   return false
 }
 
+/**
+ * Does the local name `name` itself directly denote a prop — either a
+ * destructured prop binding, or a local constant whose value is a bare
+ * `<propsObjName>.<key>` member access (`const arr = props.items`)? The
+ * alias-hop walk in `isArrayExprDirectPropRef` calls this at every hop; it
+ * never inspects arbitrary expression text itself, only a single constant's
+ * name (against the destructured-prop set) or its own structured `.parsed`
+ * (against the props-object shape) — same "structural, not regex" guarantee
+ * `isArrayExprDirectPropRef`'s docstring makes.
+ *
+ * Shadow-guarded FIRST (pullfrog review finding): `propAliasHopCandidates`
+ * only keeps a shadowed name out of the map `resolveAliasOrigin` hops
+ * INTO — it does nothing for `name` itself on the very first call, which
+ * reads the separate, shadow-unaware `constantsByName(ctx)` index directly.
+ * Without this guard, `rows.map((list, ri) => list.map(...))`'s inner
+ * `list` — an arbitrary row value with no relation to props — would
+ * resolve via an unrelated, shadowed outer `const list = props.entries`
+ * the moment that outer constant's OWN value happens to be a
+ * member-access-on-props shape, defeating the shadow guard entirely
+ * (`propAliasHopCandidates`'s own `rows.map((list) => list.map(...))`
+ * docstring example, just with a member-access-valued outer const instead
+ * of an identifier-valued one — confirmed to reach real Go `isPropDerived`
+ * codegen the same way, since Go's BF101 gate explicitly skips a
+ * scope-bound array name).
+ *
+ * Reads `ctx.boundPropNames`, not `ctx.patterns.props` (#2835): for a whole
+ * `(props: Props)` parameter, `patterns.props` holds every TYPE-MEMBER name
+ * (needed so its regex still matches `props.<key>`) rather than local
+ * bindings, so a same-named module const was matching here as if it were
+ * the prop itself.
+ */
+function isDirectPropBindingName(name: string, ctx: TransformContext): boolean {
+  if (ctx.scope.isBound(name)) return false
+  if (ctx.boundPropNames.has(name)) return true
+  const propsObjName = ctx.analyzer.propsObjectName
+  if (!propsObjName) return false
+  const parsed = constantsByName(ctx).get(name)?.parsed
+  return !!parsed && parsed.kind === 'member' && !parsed.computed && parsed.object.kind === 'identifier' && parsed.object.name === propsObjName
+}
+
+/**
+ * `constantValuesByName(ctx)`, narrowed to the constants an alias-hop walk
+ * may legitimately continue into when resolving whether a loop's array (or
+ * a property access's object) ultimately denotes a prop (#2724 review
+ * finding — a second pass after the initial fix landed found two false
+ * positives the unrestricted map let through):
+ *
+ * - Never a MODULE-scope constant (`isModule`) — a module constant cannot,
+ *   by definition, be an alias of any one component instance's props, so
+ *   hopping into one can only ever be a coincidental name match. Same
+ *   exclusion `resolveGetterAliases` (csr-substitute.ts, #2778) already
+ *   makes for its own alias-hop walk.
+ * - Never a name currently SHADOWED by an active loop/callback binding
+ *   (`ctx.scope.isBound`) — `rows.map((list) => list.map(...))`'s inner
+ *   `list` must resolve to the OUTER LOOP'S ROW VALUE, never an unrelated
+ *   outer-scope `const list = someProp` the row happens to shadow. Same
+ *   shadow-guard shape as `tryResolveTemplateSpanFromConst`'s guard
+ *   (#2222-family) — `isBound()` (all binding sources), not
+ *   `valueBoundNames()`: this is that guard's consumer class, not the
+ *   reactivity/slot-ID classifier one (`BindingScope.valueBoundNames`'s
+ *   docstring, #2482 Stage 1a Commit 2). This map only half-delivers that
+ *   guarantee — it stops `resolveAliasOrigin` from hopping INTO a shadowed
+ *   name's value, but the FIRST call (`name` itself, before any hop) goes
+ *   straight to the terminal (`isDirectPropBindingName`), which has its own
+ *   matching `ctx.scope.isBound` check for exactly this reason (pullfrog
+ *   review finding on this PR — a shadowed outer const whose OWN value is a
+ *   member-access-on-props shape resolved as prop-derived on the very first
+ *   hop, before this map's filter ever applied).
+ *
+ * `let` is deliberately NOT excluded, despite being reassignable — this was
+ * tried during review and reverted (second review pass): `isStaticArray`
+ * (jsx-to-ir.ts's derivation) treats "not recognized as prop-derived" as
+ * STATIC, not dynamic, so excluding `let` doesn't move a `let`-aliased prop
+ * array to the safe/over-reconciling side — it reproduces #2724's exact
+ * silent-divergence shape (the array silently stays on the static
+ * `qsaChildScopes` path, so a CSR-only mount never wires up the row's
+ * child). A `let` reassigned before use could in principle make this hop
+ * resolve against a stale declaration-time value — but that only risks the
+ * SAFE direction (an extra `mapArray` on a loop that turns out not to be
+ * prop-derived after all), matching this file's existing `hasCalls`
+ * over-reconciliation-is-cheap philosophy, and Go's `renderLoop` BF101 gate
+ * independently refuses any bare-identifier loop array that resolves to a
+ * non-module local variable (`let` or `const` alike) before
+ * `isPropDerivedArray` would ever drive real Go codegen off it.
+ *
+ * A NARROWED VIEW, not a change to `constantValuesByName` itself — that
+ * function is also `forwardsCallerRestProps`'s rest/props-spread alias
+ * walk, whose existing (wider) hop set this deliberately leaves alone.
+ */
+function propAliasHopCandidates(ctx: TransformContext): ReadonlyMap<string, string | undefined> {
+  const bound = ctx.scope.boundNames()
+  const candidates = new Map<string, string | undefined>()
+  for (const constant of ctx.analyzer.localConstants) {
+    if (constant.isModule || bound.has(constant.name)) continue
+    if (!candidates.has(constant.name)) candidates.set(constant.name, constant.value)
+  }
+  return candidates
+}
+
 /**
  * Check if array expression is a signal or memo getter call.
  * Used to determine if a loop needs mapArray for dynamic DOM updates.
@@ -7940,7 +8193,7 @@ function isPropsReference(expr: string, ctx: TransformContext, visited?: Set<str
 function forwardsCallerRestProps(attrs: IRAttribute[], ctx: TransformContext): boolean {
   for (const attr of attrs) {
     if (attr.value.kind !== 'spread') continue
-    const constants = restSpreadConstantValues(ctx)
+    const constants = constantValuesByName(ctx)
     for (const name of new Set([attr.value.expr, attr.value.templateExpr])) {
       if (!name) continue
       if (resolveRestSpreadOriginCore(ctx.analyzer, constants, name) !== null) return true
@@ -7949,14 +8202,25 @@ function forwardsCallerRestProps(attrs: IRAttribute[], ctx: TransformContext): b
   return false
 }
 
-/** `ctx.analyzer.localConstants` indexed by name, memoized per component walk. */
-function restSpreadConstantValues(ctx: TransformContext): ReadonlyMap<string, string | undefined> {
-  if (ctx._restSpreadConstantValues) return ctx._restSpreadConstantValues
+/** `ctx.analyzer.localConstants` indexed by name → value text, memoized per component walk. */
+function constantValuesByName(ctx: TransformContext): ReadonlyMap<string, string | undefined> {
+  if (ctx._constantValuesByName) return ctx._constantValuesByName
   const byName = new Map<string, string | undefined>()
   for (const constant of ctx.analyzer.localConstants) {
     if (!byName.has(constant.name)) byName.set(constant.name, constant.value)
   }
-  ctx._restSpreadConstantValues = byName
+  ctx._constantValuesByName = byName
+  return byName
+}
+
+/** `ctx.analyzer.localConstants` indexed by name → full `ConstantInfo`, memoized per component walk. */
+function constantsByName(ctx: TransformContext): ReadonlyMap<string, ConstantInfo> {
+  if (ctx._constantsByName) return ctx._constantsByName
+  const byName = new Map<string, ConstantInfo>()
+  for (const constant of ctx.analyzer.localConstants) {
+    if (!byName.has(constant.name)) byName.set(constant.name, constant)
+  }
+  ctx._constantsByName = byName
   return byName
 }