@barefootjs/jsx 0.5.1 → 0.5.3

package/src/ir-to-client-js/control-flow/stringify/event-delegation.ts

@@ -32,7 +32,7 @@
  * sentinel before destructuring (#951 TDZ-safe).
  */
 
-import { toDomEventName, varSlotId, substituteLoopBindings, DATA_KEY, keyAttrName } from '../../utils'
+import { toDomEventName, varSlotId, substituteLoopBindings, buildLoopChildIndexSubtraction, DATA_KEY, keyAttrName } from '../../utils'
 import type {
   EventDelegationPlan,
   KeyedItemLookup,
@@ -187,11 +187,11 @@ function emitStaticIndexLookup(
   lookup: StaticIndexItemLookup,
   containerVar: string,
 ): void {
-  const { arrayExpr, param, mapPreamble, siblingOffset } = lookup
+  const { arrayExpr, param, mapPreamble, offset } = lookup
   ls.push(`      let __el = ${varSlotId(ev.childSlotId)}El`)
   ls.push(`      while (__el.parentElement && __el.parentElement !== ${containerVar}) __el = __el.parentElement`)
   ls.push(`      if (__el.parentElement === ${containerVar}) {`)
-  const idxOffset = siblingOffset ? ` - ${siblingOffset}` : ''
+  const idxOffset = buildLoopChildIndexSubtraction(offset ?? undefined)
   ls.push(`        const __idx = Array.from(${containerVar}.children).indexOf(__el)${idxOffset}`)
   ls.push(`        const ${param} = ${arrayExpr}[__idx]`)
   if (mapPreamble) ls.push(`        ${mapPreamble}`)

package/src/ir-to-client-js/emit-reactive.ts

@@ -17,6 +17,15 @@ import { createTemplateAwareStringProtector } from './html-template'
  */
 export function emitAttrUpdate(target: string, attrName: string, expression: string, meta: AttrMeta): string[] {
   const htmlName = toHtmlAttrName(attrName)
+  if (attrName === 'dangerouslySetInnerHTML' || htmlName === 'dangerouslySetInnerHTML') {
+    // `{ __html }` is not an attribute — it replaces the element's content.
+    // Assign `innerHTML` (raw, intentional escape hatch) to mirror the SSR
+    // adapters' native `dangerouslySetInnerHTML` handling instead of
+    // stringifying the object into a bogus attribute.
+    return [
+      `{ const __v = ${expression}; ${target}.innerHTML = __v != null && __v.__html != null ? String(__v.__html) : '' }`,
+    ]
+  }
   if (htmlName === 'style') {
     return [
       `{ const __v = styleToCss(${expression}); if (__v != null) ${target}.setAttribute('style', __v); else ${target}.removeAttribute('style') }`,

package/src/ir-to-client-js/html-template.ts

@@ -192,11 +192,16 @@ const UNSAFE_TEMPLATE_EXPR = 'undefined'
  * @param attr - Attribute metadata (only presenceOrUndefined flag is used)
  */
 function templateAttrExpr(attrName: string, valExpr: string, presenceOrUndefined?: boolean): string {
+  // `dangerouslySetInnerHTML={{ __html }}` is not an attribute — its value
+  // becomes the element's raw innerHTML (emitted as element content). Never
+  // serialise the `{ __html }` object into a `dangerouslySetInnerHTML="…"`
+  // attribute.
+  if (attrName === 'dangerouslySetInnerHTML') return ''
   if (isBooleanAttr(attrName) || presenceOrUndefined) {
     return `\${${valExpr} ? '${attrName}' : ''}`
   }
   if (attrName === 'style') {
-    return `\${((v) => v != null ? 'style="' + v + '"' : '')(styleToCss(${valExpr}))}`
+    return `\${((v) => v != null ? 'style="' + ${escapeAttrValueExpr('v')} + '"' : '')(styleToCss(${valExpr}))}`
   }
   // `data-key` / `data-key-N` is a reconciliation contract — every loop item
   // must carry one. Emit unconditionally; if the user passes `key={undefined}`
@@ -205,7 +210,60 @@ function templateAttrExpr(attrName: string, valExpr: string, presenceOrUndefined
   if (attrName === 'data-key' || attrName.startsWith('data-key-')) {
     return `${attrName}="\${${valExpr}}"`
   }
-  return `\${(${valExpr}) != null ? '${attrName}="' + (${valExpr}) + '"' : ''}`
+  return `\${(${valExpr}) != null ? '${attrName}="' + ${escapeAttrValueExpr(valExpr)} + '"' : ''}`
+}
+
+/**
+ * Build a runtime expression that HTML-escapes an interpolated attribute
+ * value, matching the SSR adapters' attribute escaping (Hono escapes
+ * `& " ' < >`) via the `escapeAttr` runtime helper. The client template
+ * assembles an HTML string inserted via `innerHTML`, so an unescaped `"`
+ * / `<` / `>` in a value — e.g. UnoCSS arbitrary variants like
+ * `[class*="size-"]` or `has-[>svg]` — corrupts attribute parsing (and
+ * diverges from the SSR-rendered bytes). Escaping at interpolation time
+ * is the only correct layer: a post-assembly pass can't tell a delimiter
+ * `"` from a value `"`.
+ */
+function escapeAttrValueExpr(valExpr: string): string {
+  return `escapeAttr(${valExpr})`
+}
+
+/**
+ * Build a runtime expression that HTML-escapes an interpolated **text
+ * content** slot, via the `escapeText` runtime helper. Only the
+ * `<!--bf:sN-->${expr}<!--/-->` text-marker form is text content: the
+ * runtime treats whatever sits between the markers as the slot's text, so
+ * a string value containing `<` / `&` (e.g. `{user.name}`) must be escaped
+ * to parse correctly under `innerHTML` and to match the SSR-rendered
+ * bytes. Bare `${...}` interpolations — `{children}` passthrough and
+ * `renderChild(...)` output — are pre-rendered HTML and must NOT be
+ * escaped, so this is applied only at the four text-marker emit sites.
+ * Hono escapes text content with the same set as attribute values
+ * (`& " ' < >`), so `escapeText` delegates to the same operation.
+ */
+function escapeTextSlotExpr(innerExpr: string): string {
+  return `escapeText(${innerExpr})`
+}
+
+/**
+ * `dangerouslySetInnerHTML={{ __html: E }}` makes the element's content its
+ * raw innerHTML — the intentional, React-style escape hatch. Returns the
+ * raw-content template expression to use *instead of* the element's normal
+ * children (emitted UNescaped by design, mirroring the SSR adapters'
+ * native handling), or `null` when the element carries no such attribute.
+ * The attribute itself is suppressed in `templateAttrExpr`, and the
+ * matching reactive update is emitted by `emitAttrUpdate` (assigns
+ * `innerHTML`). `toExpr` is the walker's value transform (`wrapExpr` /
+ * `transformExpr`) so the `{ __html }` object is lowered the same way an
+ * attribute value would be.
+ */
+function dangerouslyHtmlChildren(
+  attrs: ReadonlyArray<IRAttribute>,
+  toExpr: (v: { expr: string; templateExpr?: string }) => string,
+): string | null {
+  const attr = attrs.find(a => a.name === 'dangerouslySetInnerHTML')
+  if (!attr || attr.value.kind !== 'expression') return null
+  return `\${((${toExpr(attr.value)}) ?? {}).__html ?? ''}`
 }
 
 /**
@@ -322,6 +380,12 @@ export interface MergeContext {
 function isMergeableAttr(a: IRAttribute, ctx: MergeContext): boolean {
   if (ctx.honorClientOnly && a.clientOnly) return false
   if (a.name === 'key') return false
+  // `dangerouslySetInnerHTML` is not an attribute — its `{ __html }` value
+  // becomes the element's raw innerHTML (emitted as content, set via
+  // `innerHTML` in init). Keep it out of the `spreadAttrs({...})` merge so
+  // it isn't serialised back into a bogus `dangerouslySetInnerHTML="…"`
+  // attribute when the element also carries a spread.
+  if (a.name === 'dangerouslySetInnerHTML') return false
   const v = a.value
   if (v.kind === 'jsx-children') return false
   if (v.kind === 'boolean-shorthand') return false
@@ -476,7 +540,7 @@ export function irToHtmlTemplate(node: IRNode, restSpreadNames?: Set<string>, lo
 
       const attrs = attrParts.join(' ')
       const childrenRecurse = (n: IRNode): string => irToHtmlTemplate(n, restSpreadNames, loopDepth, loopParams, branchSlotsVar, insideLoop, false)
-      const children = node.children.map(childrenRecurse).join('')
+      const children = dangerouslyHtmlChildren(node.attrs, v => wrapExpr(v.expr)) ?? node.children.map(childrenRecurse).join('')
 
       // Non-void elements must use open+close tags (HTML parsers ignore self-closing on div, span, etc.)
       if (children || !VOID_ELEMENTS.has(node.tag)) {
@@ -491,7 +555,15 @@ export function irToHtmlTemplate(node: IRNode, restSpreadNames?: Set<string>, lo
     case 'expression':
       if (node.expr === 'null' || node.expr === 'undefined') return ''
       if (node.slotId) {
-        return `<!--bf:${node.slotId}-->\${${wrapInterpolation(wrapExpr(node.expr))}}<!--/-->`
+        const inner = wrapInterpolation(wrapExpr(node.expr))
+        // In branch-slot context `wrapInterpolation` routes the value
+        // through `__bfSlot`, which returns raw `<!--bf-slot:N-->` markers
+        // for live `Node` values (spliced back by `insert()`). Escaping
+        // would corrupt those markers and drop slotted content (#1694
+        // regression). `__bfSlot` owns coercion of its own value, so the
+        // text-escape applies only to the non-slot (plain text) form.
+        const slotted = branchSlotsVar ? inner : escapeTextSlotExpr(inner)
+        return `<!--bf:${node.slotId}-->\${${slotted}}<!--/-->`
       }
       return `\${${wrapInterpolation(wrapExpr(node.expr))}}`
 
@@ -656,7 +728,7 @@ export function irToPlaceholderTemplate(node: IRNode, restSpreadNames?: Set<stri
       }
 
       const attrs = attrParts.join(' ')
-      const children = node.children.map(recurse).join('')
+      const children = dangerouslyHtmlChildren(node.attrs, v => wrapExpr(v.expr)) ?? node.children.map(recurse).join('')
 
       if (children || !VOID_ELEMENTS.has(node.tag)) {
         return `<${node.tag}${attrs ? ' ' + attrs : ''}>${children}</${node.tag}>`
@@ -670,7 +742,7 @@ export function irToPlaceholderTemplate(node: IRNode, restSpreadNames?: Set<stri
     case 'expression':
       if (node.expr === 'null' || node.expr === 'undefined') return ''
       if (node.slotId) {
-        return `<!--bf:${node.slotId}-->\${${wrapExpr(node.expr)}}<!--/-->`
+        return `<!--bf:${node.slotId}-->\${${escapeTextSlotExpr(wrapExpr(node.expr))}}<!--/-->`
       }
       return `\${${wrapExpr(node.expr)}}`
 
@@ -1041,7 +1113,7 @@ function irToComponentTemplateWithOpts(node: IRNode, opts: TemplateOptions): str
       }
 
       const attrs = attrParts.join(' ')
-      const children = node.children.map(childrenRecurse).join('')
+      const children = dangerouslyHtmlChildren(node.attrs, v => transformExpr(v.expr, v.templateExpr)) ?? node.children.map(childrenRecurse).join('')
 
       if (children || !VOID_ELEMENTS.has(node.tag)) {
         return `<${node.tag}${attrs ? ' ' + attrs : ''}>${children}</${node.tag}>`
@@ -1055,7 +1127,7 @@ function irToComponentTemplateWithOpts(node: IRNode, opts: TemplateOptions): str
     case 'expression':
       if (node.expr === 'null' || node.expr === 'undefined') return ''
       if (node.slotId) {
-        return `<!--bf:${node.slotId}-->\${${transformExpr(node.expr, node.templateExpr)}}<!--/-->`
+        return `<!--bf:${node.slotId}-->\${${escapeTextSlotExpr(transformExpr(node.expr, node.templateExpr))}}<!--/-->`
       }
       return `\${${transformExpr(node.expr, node.templateExpr)}}`
 
@@ -1417,7 +1489,7 @@ function generateCsrTemplateWithOpts(node: IRNode, opts: TemplateOptions): strin
       }
 
       const attrs = attrParts.join(' ')
-      const children = node.children.map(childrenRecurse).join('')
+      const children = dangerouslyHtmlChildren(node.attrs, v => transformExpr(v.expr, v.templateExpr)) ?? node.children.map(childrenRecurse).join('')
 
       if (children || !VOID_ELEMENTS.has(node.tag)) {
         return `<${node.tag}${attrs ? ' ' + attrs : ''}>${children}</${node.tag}>`
@@ -1440,7 +1512,7 @@ function generateCsrTemplateWithOpts(node: IRNode, opts: TemplateOptions): strin
         // an empty placeholder instead.
         const expr = transformed === UNSAFE_TEMPLATE_EXPR ? "''" : transformed
         if (node.slotId) {
-          return `<!--bf:${node.slotId}-->\${${expr}}<!--/-->`
+          return `<!--bf:${node.slotId}-->\${${escapeTextSlotExpr(expr)}}<!--/-->`
         }
         return `\${${expr}}`
       }

package/src/ir-to-client-js/imports.ts

@@ -11,7 +11,7 @@ export const RUNTIME_IMPORT_CANDIDATES = [
   'createComponent', 'renderChild', 'registerComponent', 'registerTemplate', 'initChild', 'upsertChild', 'updateClientMarker',
   'createPortal',
   'provideContext', 'createContext', 'useContext',
-  'forwardProps', 'applyRestAttrs', 'splitProps', 'spreadAttrs', 'styleToCss',
+  'forwardProps', 'applyRestAttrs', 'splitProps', 'spreadAttrs', 'styleToCss', 'escapeAttr', 'escapeText',
   'qsa', 'qsaItem', 'qsaChildScope', 'qsaChildScopes', 'upsertChildItem', '__slot', '__bfSlot', '__bfText',
 ] as const
 

package/src/ir-to-client-js/plan/build-static-array-child-init.ts

@@ -16,7 +16,7 @@
 import type { IRLoopChildComponent } from '../../types'
 import type { NestedLoop, TopLevelLoop } from '../types'
 import type { ClientJsContext } from '../types'
-import { quotePropName, varSlotId, attrValueToString } from '../utils'
+import { quotePropName, varSlotId, attrValueToString, buildLoopChildIndexExpr } from '../utils'
 import { irChildrenToJsExpr } from '../html-template'
 import { buildCompSelector } from '../control-flow/shared'
 
@@ -98,7 +98,7 @@ function buildOuterNestedPlan(
     arrayExpr: elem.array,
     param: elem.param,
     indexParam,
-    offsetExpr: elem.siblingOffset ? `${indexParam} + ${elem.siblingOffset}` : indexParam,
+    offsetExpr: buildLoopChildIndexExpr(indexParam, elem.offset),
     outerPreludeStatements: elem.mapPreamble ? [elem.mapPreamble] : [],
     propsExpr: buildStaticPropsExpr(comp.props),
   }
@@ -122,16 +122,12 @@ function buildInnerLoopNestedPlan(
     outerArrayExpr: elem.array,
     outerParam: elem.param,
     outerIndexParam,
-    outerOffsetExpr: elem.siblingOffset
-      ? `${outerIndexParam} + ${elem.siblingOffset}`
-      : outerIndexParam,
+    outerOffsetExpr: buildLoopChildIndexExpr(outerIndexParam, elem.offset),
     outerPreludeStatements: elem.mapPreamble ? [elem.mapPreamble] : [],
     innerContainerSlotId: innerLoop.containerSlotId ?? null,
     innerArrayExpr: innerLoop.array,
     innerParam: innerLoop.param,
-    innerOffsetExpr: innerLoop.siblingOffset
-      ? `__innerIdx + ${innerLoop.siblingOffset}`
-      : '__innerIdx',
+    innerOffsetExpr: buildLoopChildIndexExpr('__innerIdx', innerLoop.offset),
     innerPreludeStatements: innerLoop.mapPreamble ? [innerLoop.mapPreamble] : [],
     depth: innerLoop.depth,
     comps,

package/src/ir-to-client-js/plan/static-array-child-init.ts

@@ -75,7 +75,7 @@ export interface OuterNestedInitPlan {
   arrayExpr: string
   param: string
   indexParam: string
-  /** `indexParam` or `${indexParam} + ${siblingOffset}` — already substituted. */
+  /** `indexParam` plus any sibling-offset terms (`+ 1 + (arr).length`) — already substituted. */
   offsetExpr: string
   /**
    * Outer `.map()` callback preamble locals (#1064), emitted inside the
@@ -99,7 +99,7 @@ export interface InnerLoopNestedInitPlan {
   outerArrayExpr: string
   outerParam: string
   outerIndexParam: string
-  /** Outer offset — `outerIndexParam` or `${outerIndexParam} + ${siblingOffset}`. */
+  /** Outer offset — `outerIndexParam` plus any sibling-offset terms. */
   outerOffsetExpr: string
   /**
    * Outer `.map()` callback preamble locals, emitted after the
@@ -115,7 +115,7 @@ export interface InnerLoopNestedInitPlan {
   innerContainerSlotId: string | null
   innerArrayExpr: string
   innerParam: string
-  /** Inner offset — `__innerIdx` or `__innerIdx + ${siblingOffset}`. */
+  /** Inner offset — `__innerIdx` plus any sibling-offset terms. */
   innerOffsetExpr: string
   /**
    * Inner `.map()` callback preamble locals, emitted after the

package/src/ir-to-client-js/types.ts

@@ -166,6 +166,29 @@ export interface ConditionalBranchReactiveAttr extends AttrMeta {
   expression: string
 }
 
+/**
+ * How many element children precede a loop's items in its container — the
+ * offset applied to `container.children[idx]` so each item resolves to the
+ * right element during hydration.
+ *
+ * Two contributions, kept distinct because they codegen differently:
+ *   - `staticCount`: siblings of statically-known element count, folded to a
+ *     compile-time integer (`+ 1`).
+ *   - `dynamicTerms`: one JS expression per sibling whose element count is
+ *     only known at runtime — a preceding `.map()` (`(arr).length`) or a
+ *     preceding conditional (`(cond ? 1 : 0)`) — each added as `+ <term>`.
+ *
+ * Carried as one value object end-to-end (collect → IR loop → plan → codegen)
+ * so a future offset contributor is added in one place, not threaded as a new
+ * field through every layer (#1693).
+ */
+export interface LoopOffset {
+  /** Folded element count of statically-sized preceding siblings. `0` = none. */
+  staticCount: number
+  /** Runtime element-count expressions of dynamic preceding siblings; `[]` = none. */
+  dynamicTerms: readonly string[]
+}
+
 /**
  * Fields shared by every flavour of collected loop (top-level, branch-scoped, nested).
  * The three loop-info variants (`TopLevelLoop`, `BranchLoop`, `NestedLoop`) each extend
@@ -363,8 +386,8 @@ export interface NestedLoop extends LoopCore {
   childComponents?: import('../types').IRLoopChildComponent[]
   /** True when this loop is inside a conditional branch (handled by insert() bindEvents instead) */
   insideConditional?: boolean
-  /** Number of non-loop DOM siblings before this loop in its container element */
-  siblingOffset?: number
+  /** Offset of this loop's items past its preceding container siblings (#1693). */
+  offset?: LoopOffset
   // Per-item bindings (events / reactiveAttrs / reactiveTexts / refs / conditionals)
   // now live on `LoopCore.bindings` — see issue #1244 §B.
 }
@@ -468,8 +491,8 @@ export interface TopLevelLoop extends LoopCore {
   useElementReconciliation?: boolean // True: reconcileElements + composite rendering (native root with child components)
   /** Inner loop metadata for composite element reconciliation (array, param, key, container) */
   innerLoops?: NestedLoop[]
-  /** Number of non-loop DOM siblings before this loop in its parent element. Used to offset children[idx] access. */
-  siblingOffset?: number
+  /** Offset of this loop's items past its preceding container siblings (#1693). */
+  offset?: LoopOffset
   filterPredicate?: {
     param: string
     raw: string  // Original filter predicate expression or block body

package/src/ir-to-client-js/utils.ts

@@ -5,7 +5,7 @@
 
 import ts from 'typescript'
 import type { AttrValue, IRTemplatePart, LoopParamBinding, FreeReference, IRNode } from '../types'
-import type { TopLevelLoop, BranchLoop } from './types'
+import type { TopLevelLoop, BranchLoop, LoopOffset } from './types'
 import { buildLoopChainExpr } from '../loop-chain'
 import {
   iterateJsTokens,
@@ -145,6 +145,46 @@ export function buildChainedArrayExpr(elem: TopLevelLoop | BranchLoop): string {
   })
 }
 
+/**
+ * The single source of truth for what contributes to a loop's child-index
+ * offset: the static sibling count (a folded integer) followed by one
+ * `(arr).length` term per preceding sibling loop. The additive and
+ * subtractive forms below are thin projections over this list, so they can
+ * never drift in which terms they include, and a new offset contributor is
+ * added here once rather than in every consumer (#1693).
+ */
+function loopOffsetTerms(offset: LoopOffset | undefined): string[] {
+  if (!offset) return []
+  const terms: string[] = []
+  if (offset.staticCount) terms.push(String(offset.staticCount))
+  terms.push(...offset.dynamicTerms)
+  return terms
+}
+
+/**
+ * Build the additive `children[idx]` access expression for a loop's items —
+ * `indexParam` plus every offset term.
+ *
+ * Examples:
+ *   - no offset                  → `__idx`
+ *   - one static sibling         → `__idx + 1`
+ *   - one preceding `.map()`     → `__idx + (arr).length`
+ *   - static sibling + 2 `.map()`→ `__idx + 1 + (a).length + (b).length`
+ */
+export function buildLoopChildIndexExpr(indexParam: string, offset: LoopOffset | undefined): string {
+  return [indexParam, ...loopOffsetTerms(offset)].join(' + ')
+}
+
+/**
+ * Build the subtractive counterpart of `buildLoopChildIndexExpr` — used by
+ * event delegation to recover a loop item's array index from its DOM child
+ * index. Returns the trailing `` - <static> - (arr).length …`` suffix (empty
+ * when there is no offset) appended after `…indexOf(__el)`.
+ */
+export function buildLoopChildIndexSubtraction(offset: LoopOffset | undefined): string {
+  return loopOffsetTerms(offset).map(term => ` - ${term}`).join('')
+}
+
 /**
  * Map of JSX event names to DOM event property names.
  * JSX uses React-style naming (e.g., onDoubleClick) which gets converted to

package/src/scanner/__tests__/js-scanner.fuzz.test.ts

@@ -0,0 +1,202 @@
+import { describe, test, expect } from 'bun:test'
+import {
+  replaceInExprContexts,
+  findInterpolationEnd,
+  findTopLevelTemplateLiterals,
+} from '../js-scanner'
+import { tokenContainsIdent, wrapLoopParamAsAccessor } from '../../ir-to-client-js/utils'
+
+/**
+ * Fuzz harness for the shared `ts.createScanner`-based JS-text scanner (#1370).
+ *
+ * The bug class this issue targets — hand-rolled char-by-char scanners that
+ * disagree about where "code context" ends — only shows up on inputs that mix
+ * quotes, comments, escapes and regex tokens in adversarial ways. The
+ * example-based suite in `js-scanner.test.ts` pins specific known cases; this
+ * file generates random combinations and asserts that *every* consumer of the
+ * shared lexer honours the same invariant:
+ *
+ *   a bare `MARK` identifier is a real code reference **iff** it sits in
+ *   expression context — never when it appears inside a string, template
+ *   string body, comment or regex literal.
+ *
+ * Each generated input is paired with an exact oracle computed from the atoms
+ * it was assembled from, so the assertions are precise (not just "didn't
+ * throw"). Generation is seeded per-iteration with a deterministic PRNG, and
+ * the seed + input are surfaced on failure so any regression reproduces.
+ */
+
+// --- deterministic PRNG (mulberry32) ---------------------------------------
+function mulberry32(seed: number): () => number {
+  let a = seed >>> 0
+  return () => {
+    a = (a + 0x6d2b79f5) | 0
+    let t = Math.imul(a ^ (a >>> 15), 1 | a)
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296
+  }
+}
+
+const pick = <T>(rng: () => number, arr: readonly T[]): T => arr[Math.floor(rng() * arr.length)]!
+
+// Alphabet deliberately loaded with the delimiters that fooled the old
+// per-consumer scanners: every quote flavour, comment markers, regex slashes,
+// braces, escapes and the marker letters themselves.
+const NOISE_ALPHABET = [
+  'a', 'M', 'A', 'R', 'K', 'q', 'z', ' ',
+  "'", '"', '`', '/', '*', '{', '}', '$', '\\', ';', '(', ')', '[', ']',
+] as const
+
+function randNoise(rng: () => number, maxLen = 10): string {
+  const len = Math.floor(rng() * (maxLen + 1))
+  let s = ''
+  for (let i = 0; i < len; i++) s += pick(rng, NOISE_ALPHABET)
+  return s
+}
+
+// --- per-context sanitizers: make `raw` safe to embed without changing how it
+//     lexes, so the embedded text round-trips byte-for-byte in the oracle. ---
+const escDouble = (raw: string) => raw.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/[\r\n]/g, '')
+const escSingle = (raw: string) => raw.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/[\r\n]/g, '')
+// No-substitution template: kill backticks and any `${` interpolation opener.
+const escTemplate = (raw: string) => raw.replace(/\\/g, '\\\\').replace(/`/g, '').replace(/\$/g, '').replace(/[\r\n]/g, '')
+const escLine = (raw: string) => raw.replace(/[\r\n]/g, '')
+const escBlock = (raw: string) => raw.replace(/[\r\n]/g, '').replace(/\*\//g, '* /')
+// Regex body: escape the delimiter and drop char-class brackets so the literal
+// always terminates at the next `/`. Prefix a literal char so it is never empty
+// (which would read as `//` line comment) nor start with `*`.
+const escRegex = (raw: string) =>
+  'x' + raw.replace(/\\/g, '\\\\').replace(/\//g, '\\/').replace(/\[/g, '\\[').replace(/\]/g, '\\]').replace(/[\r\n]/g, '')
+
+interface Atom {
+  /** Source text of the atom as it appears in the input. */
+  src: string
+  /** What this atom becomes after a `MARK` -> `MARK()` expression-context rewrite. */
+  rewritten: string
+  /** True only for a bare-identifier `MARK` sitting in code context. */
+  isCodeMarker: boolean
+}
+
+// Plain code fragments that carry no `MARK` and no structural `{`/`}` (so the
+// only top-level braces in any input come from the `${...}` wrap we add later).
+const CODE_PLAIN = ['a', 'b.c', 'foo(1)', 'arr[0]', 'n / 2', 'x + y', 'obj.prop', '1.5'] as const
+
+function makeAtom(rng: () => number): Atom {
+  const kind = pick(rng, [
+    'codeMarker', 'codeMarker', 'codePlain',
+    'dq', 'sq', 'tmpl', 'line', 'block', 'regex',
+  ] as const)
+  switch (kind) {
+    case 'codeMarker':
+      return { src: 'MARK', rewritten: 'MARK()', isCodeMarker: true }
+    case 'codePlain': {
+      const src = pick(rng, CODE_PLAIN)
+      return { src, rewritten: src, isCodeMarker: false }
+    }
+    case 'dq': {
+      const src = '"' + escDouble(randNoise(rng)) + '"'
+      return { src, rewritten: src, isCodeMarker: false }
+    }
+    case 'sq': {
+      const src = "'" + escSingle(randNoise(rng)) + "'"
+      return { src, rewritten: src, isCodeMarker: false }
+    }
+    case 'tmpl': {
+      const src = '`' + escTemplate(randNoise(rng)) + '`'
+      return { src, rewritten: src, isCodeMarker: false }
+    }
+    case 'line': {
+      // Trailing newline terminates the comment so the joining ` + ` that
+      // follows stays in code context.
+      const src = '// ' + escLine(randNoise(rng)) + '\n'
+      return { src, rewritten: src, isCodeMarker: false }
+    }
+    case 'block': {
+      const src = '/* ' + escBlock(randNoise(rng)) + ' */'
+      return { src, rewritten: src, isCodeMarker: false }
+    }
+    case 'regex': {
+      const src = '/' + escRegex(randNoise(rng)) + '/' + pick(rng, ['', 'g', 'i', 'gi', 'm'])
+      return { src, rewritten: src, isCodeMarker: false }
+    }
+  }
+}
+
+interface Generated {
+  input: string
+  /** Input after every code-context `MARK` is rewritten to `MARK()`. */
+  expected: string
+  /** Whether at least one `MARK` reference lives in code context. */
+  hasCodeMarker: boolean
+}
+
+function generate(rng: () => number): Generated {
+  const count = 1 + Math.floor(rng() * 8)
+  const atoms: Atom[] = []
+  for (let i = 0; i < count; i++) atoms.push(makeAtom(rng))
+  // ` + ` keeps the stream lexable and puts every regex atom in a
+  // regex-start position (after an operator).
+  const input = atoms.map(a => a.src).join(' + ')
+  const expected = atoms.map(a => a.rewritten).join(' + ')
+  const hasCodeMarker = atoms.some(a => a.isCodeMarker)
+  return { input, expected, hasCodeMarker }
+}
+
+const ITERATIONS = 600
+
+describe('js-scanner fuzz: code-context opacity holds across all consumers', () => {
+  test('replaceInExprContexts rewrites MARK only outside strings/comments/regex/templates', () => {
+    for (let i = 0; i < ITERATIONS; i++) {
+      const seed = (0x9e3779b9 ^ i) >>> 0
+      const { input, expected } = generate(mulberry32(seed))
+      const got = replaceInExprContexts(input, /\bMARK\b/g, 'MARK()')
+      expect(got, `seed=${seed} input=${JSON.stringify(input)}`).toBe(expected)
+    }
+  })
+
+  test('wrapLoopParamAsAccessor agrees with replaceInExprContexts on the same inputs', () => {
+    for (let i = 0; i < ITERATIONS; i++) {
+      const seed = (0x85ebca6b ^ i) >>> 0
+      const { input, expected } = generate(mulberry32(seed))
+      const got = wrapLoopParamAsAccessor(input, 'MARK')
+      expect(got, `seed=${seed} input=${JSON.stringify(input)}`).toBe(expected)
+    }
+  })
+
+  test('tokenContainsIdent reports MARK iff a code-context occurrence exists', () => {
+    for (let i = 0; i < ITERATIONS; i++) {
+      const seed = (0xc2b2ae35 ^ i) >>> 0
+      const { input, hasCodeMarker } = generate(mulberry32(seed))
+      const got = tokenContainsIdent(input, 'MARK')
+      expect(got, `seed=${seed} input=${JSON.stringify(input)}`).toBe(hasCodeMarker)
+    }
+  })
+
+  test('findInterpolationEnd finds the real closing brace despite braces in noise', () => {
+    for (let i = 0; i < ITERATIONS; i++) {
+      const seed = (0x27d4eb2f ^ i) >>> 0
+      const { input } = generate(mulberry32(seed))
+      // Braces only appear inside opaque tokens (strings/regex/comments/
+      // templates) of `input`; the wrap adds the single top-level pair.
+      const wrapped = '${' + input + '}'
+      const end = findInterpolationEnd(wrapped, 2)
+      expect(end, `seed=${seed} wrapped=${JSON.stringify(wrapped)}`).toBe(wrapped.length - 1)
+    }
+  })
+})
+
+// findTopLevelTemplateLiterals operates on a ternary shape; fuzz its branch
+// bodies with noise that must stay inside the backtick literals.
+describe('js-scanner fuzz: findTopLevelTemplateLiterals extracts noisy branches', () => {
+  test('returns both backtick branches verbatim regardless of embedded delimiters', () => {
+    for (let i = 0; i < ITERATIONS; i++) {
+      const seed = (0x165667b1 ^ i) >>> 0
+      const rng = mulberry32(seed)
+      const a = escTemplate(randNoise(rng))
+      const b = escTemplate(randNoise(rng))
+      const src = 'cond ? `' + a + '` : `' + b + '`'
+      const got = findTopLevelTemplateLiterals(src)
+      expect(got, `seed=${seed} src=${JSON.stringify(src)}`).toEqual([a, b])
+    }
+  })
+})

package/src/types.ts

@@ -1291,6 +1291,12 @@ export interface TypeDefinition {
   kind: 'interface' | 'type'
   name: string
   definition: string // Original TypeScript definition
+  /**
+   * Structured fields for object/interface shapes, so adapters can consume the
+   * field set (names + types) without re-parsing `definition`. Absent for
+   * type aliases that aren't object types (e.g. string-literal unions).
+   */
+  properties?: PropertyInfo[]
   loc: SourceLocation
 }