@craft-ts/component 0.7.0-beta.13 → 0.7.0-beta.15

package/src/lib/render/interpreter.js

@@ -1,18 +1,19 @@
-import { CRAFT_SERVICE_PROVIDER_BRAND, CRAFT_DOM_EVENT_HOOK, CRAFT_NODE_DIRECTIVE, CRAFT_NODE_EFFECT_FACTORY, CRAFT_FIELD_EXCEPTION_BOUNDARY, CRAFT_FIELD_EXCEPTION_SOURCE, CRAFT_TEMPORAL_RUNTIME, COMPONENT_REGISTER, craftEffect, craftLazy, createBrowserDomAdapter, registerCraftSyncTemplateFlush, executeYieldable, HOST_TAG_LIST, executeTemplateTrace, isCraftException, isCraftGenShortCircuit, isCraftNotSettled, ɵwithSettledReadObserver, isGeneratorFunction, isCraftField, isGenerator, markYieldableValue, markYieldableMethod, isYieldableValue, isYieldableMethod, isYieldableReactiveValue, DEEP_YIELDABLE, provideHostName, rawReactiveFacade, rawReactiveValue, toYieldable, yieldableInvocation, ɵfallbackComponentRegister, ɵregisterCraftTarget, ɵcraftInjectorFromHost, fieldExceptionVisibilityMatches, YIELDABLE_VALUE, RealCraftTemporalRuntime, CRAFT_HYDRATION_ID, childCraftRenderIdentity, createCraftRenderIdentity, CRAFT_SSR_POLICY, CRAFT_MATCH, } from '@craft-ts/core';
-import { executeCraftComponentFactory } from '../factory-runtime';
-import { computed, createEnvironmentInjector, ElementRef, EnvironmentInjector, Injector, runInInjectionContext, signal, untracked, } from '../host-runtime';
-import { CRAFT_COMPONENT, CRAFT_DIRECTIVE, CONTENT_DECLARATION_CONTEXT, } from '../types';
-import { cssVarStyles } from '../css-vars';
-import { normalizeChildren, mergeHostProps, withCraftRenderContext, CRAFT_NODE_DIRECTIVES, } from './vnode';
-import { CraftUnhandledPendingError, resolvePendingBlockHandler, } from '../pending-block';
-import { CraftUnhandledExceptionError, resolveCatchBlockHandler, } from '../block';
-import { EACH_SCHEDULER, createEachScheduler, } from '../each-scheduling';
-import { executeCraftComponentFactoryAsync } from '../factory-runtime';
-import { CRAFT_STYLE_REGISTRY, ɵfallbackCraftStyleRegistry, } from './style-registry';
-import { scopeCss, scopeIdFor, validateStyleScope } from './style-scope';
-import { CRAFT_LOCATOR_CONTENT_NAMES, directCraftContentNames, findCraftTemplateLocator, } from '../locator';
-import { HydrationMismatchError } from './hydration';
-import { setNodeHydrationKey } from './hydration-metadata';
+import { CRAFT_SERVICE_PROVIDER_BRAND, CRAFT_DOM_EVENT_HOOK, CRAFT_NODE_DIRECTIVE, CRAFT_NODE_EFFECT_FACTORY, CRAFT_FIELD_EXCEPTION_BOUNDARY, CRAFT_FIELD_EXCEPTION_SOURCE, CRAFT_TEMPORAL_RUNTIME, COMPONENT_REGISTER, craftEffect, craftLazy, createBrowserDomAdapter, registerCraftSyncTemplateFlush, executeYieldable, HOST_TAG_LIST, executeTemplateTrace, isCraftException, isCraftGenShortCircuit, isCraftNotSettled, ɵwithSettledReadObserver, isGeneratorFunction, isCraftField, isGenerator, markYieldableValue, markYieldableMethod, isYieldableValue, isYieldableMethod, isYieldableReactiveValue, DEEP_YIELDABLE, provideHostName, rawReactiveFacade, rawReactiveValue, toYieldable, yieldableInvocation, ɵfallbackComponentRegister, ɵregisterCraftTarget, ɵcraftInjectorFromHost, fieldExceptionVisibilityMatches, YIELDABLE_VALUE, RealCraftTemporalRuntime, CRAFT_HYDRATION_ID, childCraftRenderIdentity, createCraftRenderIdentity, CRAFT_SSR_POLICY, CRAFT_SECURITY_POLICY, CraftCspNonce, CRAFT_MATCH, } from '@craft-ts/core';
+import { executeCraftComponentFactory } from '../factory-runtime.js';
+import { computed, createEnvironmentInjector, ElementRef, EnvironmentInjector, Injector, runInInjectionContext, signal, untracked, } from '../host-runtime.js';
+import { CRAFT_COMPONENT, CRAFT_DIRECTIVE, CONTENT_DECLARATION_CONTEXT, } from '../types.js';
+import { cssVarStyles } from '../css-vars.js';
+import { normalizeChildren, mergeHostProps, withCraftRenderContext, CRAFT_NODE_DIRECTIVES, } from './vnode.js';
+import { CraftUnhandledPendingError, resolvePendingHandler, } from '../pending-node.js';
+import { CraftUnhandledExceptionError, resolveCatchHandler, } from '../catch-node.js';
+import { FOR_SCHEDULER, createForScheduler, } from '../for-scheduling.js';
+import { executeCraftComponentFactoryAsync } from '../factory-runtime.js';
+import { CRAFT_STYLE_REGISTRY, createCraftStyleRegistry, } from './style-registry.js';
+import { isCraftMultiUrlAttribute, isCraftResourceUrlAttribute, isCraftSafeHtml, isCraftUnsafeHtml, isCraftUrlAttribute, safeResourceUrl, safeUrl, safeUrlList, CraftDomSecurityError, } from '../security.js';
+import { scopeCss, scopeIdFor, validateStyleScope } from './style-scope.js';
+import { CRAFT_LOCATOR_CONTENT_NAMES, directCraftContentNames, findCraftTemplateLocator, } from '../locator.js';
+import { HydrationMismatchError } from './hydration.js';
+import { setNodeHydrationKey } from './hydration-metadata.js';
 let templateGeneratorDepth = 0;
 function childContext(context, overrides = {}) {
     return { ...context, ...overrides };
@@ -20,8 +21,8 @@ function childContext(context, overrides = {}) {
 function childNodeContext(context, node, index) {
     const segments = node.kind === 'component'
         ? [node.component[CRAFT_COMPONENT].name, index]
-        : node.kind === 'each'
-            ? [`each:${node.sourceName ?? index}`]
+        : node.kind === 'for'
+            ? [`for:${node.sourceName ?? index}`]
             : node.kind === 'if'
                 ? [`if:${node.conditionName}`]
                 : [index];
@@ -251,7 +252,7 @@ function createRenderEffect(context, name, effectFn) {
             if (!isCraftGenShortCircuit(error))
                 throw error;
             // A settled read whose source carries a business exception: route it to
-            // the nearest catchBlock, exactly like a component initialization one.
+            // the nearest catchNode, exactly like a component initialization one.
             context.pendingBoundary?.resume(token);
             if (!context.exceptionBoundary?.(error.exception, token)) {
                 throw new CraftUnhandledExceptionError(error.exception);
@@ -447,7 +448,10 @@ function sameCraftNodeDirectives(left, right) {
         left.every((descriptor, index) => descriptor.directive === right[index]?.directive));
 }
 function insertBefore(renderer, parent, node, before) {
-    renderer.insertBefore(parent, node, before);
+    // A route replacement can resolve after its previous view was torn down.
+    // Ignore a stale anchor and append instead of forwarding an invalid DOM
+    // reference to insertBefore.
+    renderer.insertBefore(parent, node, before && before.parentNode === parent ? before : null);
 }
 function removeNode(renderer, node) {
     const parent = node.parentNode;
@@ -740,6 +744,7 @@ const PROPERTY_NAMES = new Set([
     'multiple',
     'selected',
     'value',
+    'innerHTML',
 ]);
 function eventNameFor(key, value) {
     if (typeof value !== 'function') {
@@ -858,6 +863,8 @@ function sameStyleValue(left, right) {
 }
 function setStyleValue(_renderer, element, key, value, context) {
     value = resolveTemplateValue(value, context);
+    ɵassertSafeStyleValue(value, context.injector.get(CRAFT_SECURITY_POLICY, null)?.dom
+        .allowedResourceOrigins ?? []);
     const style = element
         .style;
     if (value === null || value === undefined || value === false) {
@@ -889,6 +896,8 @@ function applyStyles(renderer, element, previous, next, context) {
         renderer.removeAttribute(element, 'style');
     }
     if (typeof next === 'string') {
+        ɵassertSafeStyleValue(next, context.injector.get(CRAFT_SECURITY_POLICY, null)?.dom
+            .allowedResourceOrigins ?? []);
         renderer.setAttribute(element, 'style', next);
     }
     else if (typeof next === 'object' && next !== null) {
@@ -921,6 +930,36 @@ function flattenAttributes(props) {
 }
 function applyAttribute(renderer, element, key, value, context) {
     value = resolveTemplateValue(value, context);
+    const normalizedKey = key.toLowerCase();
+    if (value === null || value === undefined) {
+        if (normalizedKey === 'srcdoc' || normalizedKey.startsWith('on')) {
+            renderer.removeAttribute(element, key);
+            return;
+        }
+        if (key === 'innerHTML') {
+            renderer.setProperty(element, key, '');
+            return;
+        }
+    }
+    if (normalizedKey === 'srcdoc') {
+        throw new CraftDomSecurityError('CRAFT_DOM_SRCDOC_BLOCKED', 'srcdoc is not supported by the secure renderer.');
+    }
+    if (normalizedKey.startsWith('on')) {
+        throw new CraftDomSecurityError('CRAFT_DOM_EVENT_ATTRIBUTE_BLOCKED', `Inline event attribute "${key}" is not allowed.`);
+    }
+    if (isCraftUrlAttribute(normalizedKey) && value !== null && value !== undefined) {
+        const policy = context.injector.get(CRAFT_SECURITY_POLICY, null);
+        const urlOptions = {
+            allowedOrigins: policy?.dom.allowedResourceOrigins ?? [],
+            allowedSchemes: policy?.dom.allowedUrlSchemes ?? undefined,
+        };
+        const resource = isCraftResourceUrlAttribute(normalizedKey);
+        value = isCraftMultiUrlAttribute(normalizedKey)
+            ? safeUrlList(value, resource, urlOptions)
+            : resource
+                ? safeResourceUrl(value, urlOptions)
+                : safeUrl(value, urlOptions);
+    }
     if (key.startsWith('data-craft-')) {
         const dev = typeof ngDevMode === 'undefined' || ngDevMode;
         if (dev) {
@@ -934,6 +973,19 @@ function applyAttribute(renderer, element, key, value, context) {
         }
         return;
     }
+    if (key === 'innerHTML') {
+        const security = context.injector.get(CRAFT_SECURITY_POLICY, null);
+        if (isCraftSafeHtml(value)) {
+            renderer.setProperty(element, key, value.value);
+        }
+        else if (isCraftUnsafeHtml(value) && security?.dom.allowUnsafeHtml) {
+            renderer.setProperty(element, key, value.value);
+        }
+        else {
+            throw new CraftDomSecurityError('CRAFT_DOM_RAW_HTML_BLOCKED', 'Use sanitizedHtml(...) or an explicit, audited unsafeHtml(...) policy.');
+        }
+        return;
+    }
     if (PROPERTY_NAMES.has(key)) {
         renderer.setProperty(element, key, value ?? false);
         if (value === null || value === undefined || value === false) {
@@ -954,6 +1006,26 @@ function applyAttribute(renderer, element, key, value, context) {
         renderer.setAttribute(element, key, value === true ? '' : String(value));
     }
 }
+/** Exporté pour la suite de non-régression sécurité. */
+export function ɵassertSafeStyleValue(value, resourceOrigins = []) {
+    if (value === null || value === undefined || value === false)
+        return;
+    if (typeof value !== 'string' && typeof value !== 'number') {
+        throw new CraftDomSecurityError('CRAFT_DOM_STYLE_INVALID', 'Style values must be strings or numbers.');
+    }
+    const text = String(value);
+    if (/expression\s*\(|behaviou?r\s*:|-moz-binding|@import|<\s*\/style/i.test(text)) {
+        throw new CraftDomSecurityError('CRAFT_DOM_STYLE_BLOCKED', 'Potentially executable CSS is not allowed.');
+    }
+    // Chaque url() passe par le même garde-fou que les attributs d'URL, ce qui
+    // écarte les schémas exécutables comme les chargements protocol-relative.
+    for (const match of text.matchAll(/url\s*\(\s*(?:"([^"]*)"|'([^']*)'|([^)]*))\)/gi)) {
+        const url = (match[1] ?? match[2] ?? match[3] ?? '').trim();
+        if (url === '')
+            continue;
+        safeResourceUrl(url, { allowedOrigins: resourceOrigins });
+    }
+}
 class ElementRenderedNode {
     kind = 'element';
     children = [];
@@ -1407,8 +1479,8 @@ function createFragment(parent, before, context, children, label) {
     const end = mountComment(parent, `${label}:end`, before, context);
     return new FragmentRenderedNode(parent, start, end, context, children);
 }
-class EachRenderedNode {
-    kind = 'each';
+class ForRenderedNode {
+    kind = 'for';
     entries = new Map();
     ordered = [];
     emptyView;
@@ -1431,14 +1503,14 @@ class EachRenderedNode {
         this.start = start;
         this.end = end;
         this.context = context;
-        this.scheduler = createEachScheduler({
+        this.scheduler = createForScheduler({
             enabled: false,
             strategy: 'sync',
             frameBudgetMs: 4,
         });
         this.configureScheduler(node.schedule);
         this.descriptor = signal(node);
-        this.effectRef = createRenderEffect(context, 'each-block', () => {
+        this.effectRef = createRenderEffect(context, 'for-node', () => {
             const previousItemTemplate = this.node.itemTemplate;
             this.node = this.descriptor();
             this.configureScheduler(this.node.schedule);
@@ -1452,7 +1524,7 @@ class EachRenderedNode {
         return this.end;
     }
     patch(node) {
-        if (node.kind !== 'each') {
+        if (node.kind !== 'for') {
             return false;
         }
         this.descriptor.set(node);
@@ -1465,7 +1537,7 @@ class EachRenderedNode {
         const seenKeys = new Set();
         keys.forEach((key) => {
             if (seenKeys.has(key)) {
-                throw new Error(`each() received the duplicate key "${String(key)}".`);
+                throw new Error(`forNode() received the duplicate key "${String(key)}".`);
             }
             seenKeys.add(key);
         });
@@ -1525,7 +1597,7 @@ class EachRenderedNode {
                     index,
                     traceState,
                     rendered: false,
-                    view: createFragment(this.parent, this.end, entryContext, [], `craft-each:${String(key)}`),
+                    view: createFragment(this.parent, this.end, entryContext, [], `craft-for:${String(key)}`),
                 };
                 entriesToRender.push(entry);
             }
@@ -1558,13 +1630,13 @@ class EachRenderedNode {
         this.schedulePolicy = policy;
         this.schedulerConfigured = true;
         this.cancelPendingTasks();
-        const injected = this.context.injector.get(EACH_SCHEDULER, null);
+        const injected = this.context.injector.get(FOR_SCHEDULER, null);
         if (injected) {
             this.scheduler = injected;
             this.ownsScheduler = false;
             return;
         }
-        this.scheduler = createEachScheduler(policy ?? { enabled: false, strategy: 'sync', frameBudgetMs: 4 });
+        this.scheduler = createForScheduler(policy ?? { enabled: false, strategy: 'sync', frameBudgetMs: 4 });
         this.ownsScheduler = true;
     }
     scheduleEntryRender(entry) {
@@ -1581,7 +1653,7 @@ class EachRenderedNode {
                 return;
             }
             entry.renderEffect?.destroy();
-            entry.renderEffect = createRenderEffect(this.context, 'each-item', () => entry.view.patchChildren(this.renderItem(entry.traceState, entry.item, entry.index, entry.key)));
+            entry.renderEffect = createRenderEffect(this.context, 'for-item', () => entry.view.patchChildren(this.renderItem(entry.traceState, entry.item, entry.index, entry.key)));
             entry.rendered = true;
         });
         scheduled.handle = handle;
@@ -1597,7 +1669,7 @@ class EachRenderedNode {
         return renderBlockChildren(childContext(this.context, {
             traceState,
             identity: childCraftRenderIdentity(this.context.identity, `item:${String(key)}`),
-        }), 'each', this.node.itemTemplate, [
+        }), 'for', this.node.itemTemplate, [
             function* () {
                 return item;
             },
@@ -1619,7 +1691,7 @@ class EachRenderedNode {
         removeNode(this.context.renderer, this.end);
     }
 }
-class IfBlockRenderedNode {
+class IfRenderedNode {
     kind = 'if';
     view;
     active;
@@ -1632,7 +1704,7 @@ class IfBlockRenderedNode {
         this.context = context;
         this.descriptor = signal(node);
         this.view = createFragment(parent, before, context, [], `craft-if:${node.conditionName}`);
-        this.effectRef = createRenderEffect(context, 'if-block', () => {
+        this.effectRef = createRenderEffect(context, 'if-node', () => {
             this.node = this.descriptor();
             this.active = this.isTrue();
             this.view.patchChildren(this.children());
@@ -1666,8 +1738,8 @@ class IfBlockRenderedNode {
         this.view.destroy();
     }
 }
-class MatchBlockRenderedNode {
-    kind = 'match-block';
+class MatchRenderedNode {
+    kind = 'match';
     view;
     handledExceptionCode;
     descriptor;
@@ -1678,8 +1750,8 @@ class MatchBlockRenderedNode {
         this.node = node;
         this.context = context;
         this.descriptor = signal(node);
-        this.view = createFragment(parent, before, context, [], 'craft-match-block');
-        this.effectRef = createRenderEffect(context, 'match-block', () => {
+        this.view = createFragment(parent, before, context, [], 'craft-match-node');
+        this.effectRef = createRenderEffect(context, 'match-node', () => {
             this.node = this.descriptor();
             this.view.patchChildren(this.children());
         });
@@ -1691,7 +1763,7 @@ class MatchBlockRenderedNode {
         return this.view.lastNode();
     }
     patch(node) {
-        if (node.kind !== 'match-block' || node.key !== this.node.key) {
+        if (node.kind !== 'match' || node.key !== this.node.key) {
             return false;
         }
         this.descriptor.set(node);
@@ -1763,8 +1835,8 @@ function reattachRange(renderer, holder, anchor, fallbackParent) {
 }
 /** Stands in for reporters that do not identify themselves (component renders). */
 const ANONYMOUS_EXCEPTION_REPORTER = {};
-class CatchBlockRenderedNode {
-    kind = 'catch-block';
+class CatchRenderedNode {
+    kind = 'catch';
     start;
     end;
     sourceView;
@@ -1783,8 +1855,8 @@ class CatchBlockRenderedNode {
         this.parent = parent;
         this.context = context;
         this.fallbackPosition = node.position;
-        this.start = mountComment(parent, 'craft-catch-block:start', before, context);
-        this.end = mountComment(parent, 'craft-catch-block:end', before, context);
+        this.start = mountComment(parent, 'craft-catch-node:start', before, context);
+        this.end = mountComment(parent, 'craft-catch-node:end', before, context);
         // The fallback renders in the OUTER context: an exception thrown by a
         // fallback belongs to the next boundary up, never to this one.
         const createFallback = () => createFragment(parent, this.end, this.context, [], 'craft-catch-fallback');
@@ -1813,7 +1885,7 @@ class CatchBlockRenderedNode {
         return this.end;
     }
     patch(node) {
-        if (node.kind !== 'catch-block' || node.position !== this.node.position) {
+        if (node.kind !== 'catch' || node.position !== this.node.position) {
             return false;
         }
         this.node = node;
@@ -1852,7 +1924,7 @@ class CatchBlockRenderedNode {
         this.handling = true;
         this.fallbackVisible = true;
         try {
-            const resolved = resolveCatchBlockHandler(handler, exception, true, this.node.position);
+            const resolved = resolveCatchHandler(handler, exception, true, this.node.position);
             this.applyPosition(resolved.position);
             this.fallbackView.patchChildren(hasLiveRegion(resolved.children)
                 ? resolved.children
@@ -1995,7 +2067,7 @@ function hasLiveRegion(children) {
         live === 'assertive');
 }
 /**
- * The `pendingBlock` boundary.
+ * The `pendingNode` boundary.
  *
  * Layout is fixed at construction — a fallback fragment and a source fragment,
  * ordered by `position` — so showing or hiding the fallback never reconciles
@@ -2007,8 +2079,8 @@ function hasLiveRegion(children) {
  * the suspended bindings stay subscribed to their source's `status`, so they
  * re-run — and release their token — the moment the data arrives.
  */
-class PendingBlockRenderedNode {
-    kind = 'pending-block';
+class PendingRenderedNode {
+    kind = 'pending';
     start;
     end;
     sourceView;
@@ -2037,7 +2109,7 @@ class PendingBlockRenderedNode {
             node.ssr === 'client' &&
             !node.handlers &&
             !node.fallback) {
-            throw new Error('pendingBlock({ ssr: "client" }) requires an explicit fallback or shell.');
+            throw new Error('pendingNode({ ssr: "client" }) requires an explicit fallback or shell.');
         }
         this.start = mountComment(parent, 'craft-pending:start', before, context);
         this.end = mountComment(parent, 'craft-pending:end', before, context);
@@ -2085,7 +2157,7 @@ class PendingBlockRenderedNode {
         return this.end;
     }
     patch(node) {
-        if (node.kind !== 'pending-block') {
+        if (node.kind !== 'pending') {
             return false;
         }
         const next = node;
@@ -2205,7 +2277,7 @@ class PendingBlockRenderedNode {
         }
         const handler = handlers[source];
         const inner = handler
-            ? resolvePendingBlockHandler(handler, suspended ? 'pending' : 'reloading')
+            ? resolvePendingHandler(handler, suspended ? 'pending' : 'reloading')
             : [];
         return this.announceFallback(inner, true);
     }
@@ -2284,8 +2356,8 @@ class PendingBlockRenderedNode {
         this.focused = undefined;
     }
 }
-class FieldExceptionBlockRenderedNode {
-    kind = 'field-exception-block';
+class FieldErrorRenderedNode {
+    kind = 'field-error';
     boundaryId = nextFieldExceptionBoundaryId++;
     descriptor;
     sourcesVersion = signal(0);
@@ -2299,9 +2371,9 @@ class FieldExceptionBlockRenderedNode {
         this.node = node;
         this.context = context;
         this.descriptor = signal(node);
-        this.view = createFragment(parent, before, this.boundaryContext(), [node.source], 'craft-field-exception-block');
+        this.view = createFragment(parent, before, this.boundaryContext(), [node.source], 'craft-field-error-node');
         this.componentSourceCleanups = componentFieldExceptionSources(context.componentContext).map((source) => this.register(source));
-        this.effectRef = createRenderEffect(context, 'field-exception-block', () => {
+        this.effectRef = createRenderEffect(context, 'field-error-node', () => {
             this.node = this.descriptor();
             this.sourcesVersion();
             const fallbacks = this.renderFallbacks();
@@ -2317,7 +2389,7 @@ class FieldExceptionBlockRenderedNode {
         return this.view.lastNode();
     }
     patch(node) {
-        if (node.kind !== 'field-exception-block')
+        if (node.kind !== 'field-error')
             return false;
         this.descriptor.set(node);
         return true;
@@ -2693,7 +2765,7 @@ class ComponentRenderedNode {
             typeof factoryContext === 'object' &&
             factoryContext !== null &&
             'then' in factoryContext) {
-            throw new Error('Async component factories are not renderable directly. Move asynchronous work behind defer().');
+            throw new Error('Async component factories are not renderable directly. Move asynchronous work behind deferNode().');
         }
         this.factoryContext = factoryContext;
         if (!composition) {
@@ -2798,7 +2870,7 @@ class ComponentRenderedNode {
         let factoryContext;
         let renderContext;
         const handledResourceExceptionCodes = new Set();
-        const componentBoundary = composition.catchBlockPosition
+        const componentBoundary = composition.catchNodePosition
             ? (exception) => {
                 if (!composition.catchHandlers?.[exception._tag]) {
                     return context.exceptionBoundary?.(exception) ?? false;
@@ -2840,7 +2912,7 @@ class ComponentRenderedNode {
             if (typeof factoryContext === 'object' &&
                 factoryContext !== null &&
                 'then' in factoryContext) {
-                throw new Error('Async component factories are not renderable directly. Move asynchronous work behind defer().');
+                throw new Error('Async component factories are not renderable directly. Move asynchronous work behind deferNode().');
             }
             this.registerRuntimeTargets(definition, factoryContext, renderInjector);
         }
@@ -2860,7 +2932,7 @@ class ComponentRenderedNode {
         }
         this.composedTemplateEffect = untracked(() => runInInjectionContext(renderInjector, () => craftEffect('component-template', () => {
             this.renderComposedTemplate(definition, factoryContext, renderInjector, renderContext, context, hostTarget);
-            if (composition.catchBlockPosition &&
+            if (composition.catchNodePosition &&
                 !this.componentExceptionEffect) {
                 this.installComponentExceptionEffect(definition, factoryContext, renderInjector, renderContext, context, hostTarget);
             }
@@ -2871,7 +2943,7 @@ class ComponentRenderedNode {
         });
     }
     installComponentExceptionEffect(definition, factoryContext, renderInjector, renderContext, context, hostTarget) {
-        this.componentExceptionEffect = untracked(() => runInInjectionContext(renderInjector, () => craftEffect('component-catch-block-resource-exceptions', () => {
+        this.componentExceptionEffect = untracked(() => runInInjectionContext(renderInjector, () => craftEffect('component-catch-node-resource-exceptions', () => {
             const exception = findResourceException(factoryContext);
             if (exception) {
                 if (renderContext.handledResourceExceptionCodes?.has(exception._tag)) {
@@ -2914,7 +2986,7 @@ class ComponentRenderedNode {
         try {
             this.traceState.renderCount += 1;
             const rendered = this.composedTemplateChildren(definition, factoryContext, renderContext);
-            const children = this.withComponentFieldExceptionBlock(definition, rendered.children);
+            const children = this.withComponentFieldError(definition, rendered.children);
             this.latestTemplate = children;
             this.view.patchChildren(children);
             this.hostBindings?.patch(rendered.hostProps);
@@ -2939,13 +3011,13 @@ class ComponentRenderedNode {
             hostProps,
         };
     }
-    withComponentFieldExceptionBlock(definition, children) {
+    withComponentFieldError(definition, children) {
         const handlers = definition.composition?.fieldExceptionHandlers;
         const options = definition.composition?.fieldExceptionOptions;
         if (!handlers || !options)
             return children;
         return {
-            kind: 'field-exception-block',
+            kind: 'field-error',
             source: children,
             handlers,
             options,
@@ -2981,17 +3053,17 @@ class ComponentRenderedNode {
             this.view.patchChildren([]);
         }
         else {
-            const resolved = runInInjectionContext(environmentInjector, () => resolveCatchBlockHandler(blockHandler, exception, false, definition.composition?.catchBlockPosition ?? 'after'));
+            const resolved = runInInjectionContext(environmentInjector, () => resolveCatchHandler(blockHandler, exception, false, definition.composition?.catchNodePosition ?? 'after'));
             if (preserveFactoryContext && resolved.showSource) {
                 try {
                     const source = untracked(() => this.composedTemplateChildren(definition, this.factoryContext, renderContext));
                     const children = resolved.position === 'before'
                         ? [
                             resolved.children,
-                            this.withComponentFieldExceptionBlock(definition, source.children),
+                            this.withComponentFieldError(definition, source.children),
                         ]
                         : [
-                            this.withComponentFieldExceptionBlock(definition, source.children),
+                            this.withComponentFieldError(definition, source.children),
                             resolved.children,
                         ];
                     this.view.patchChildren(children);
@@ -3365,13 +3437,13 @@ function mountNode(node, parent, before, context) {
                 : context, undefined, undefined, [], node.declarationContext);
         case 'directive':
             return new CraftDirectiveRenderedNode(node, parent, before, context);
-        case 'each': {
-            const start = mountComment(parent, 'craft-each:start', before, context);
-            const end = mountComment(parent, 'craft-each:end', before, context);
-            return new EachRenderedNode(node, parent, start, end, context);
+        case 'for': {
+            const start = mountComment(parent, 'craft-for:start', before, context);
+            const end = mountComment(parent, 'craft-for:end', before, context);
+            return new ForRenderedNode(node, parent, start, end, context);
         }
         case 'if': {
-            return new IfBlockRenderedNode(node, parent, before, context);
+            return new IfRenderedNode(node, parent, before, context);
         }
         case 'heading': {
             return new HeadingRenderedNode(node, parent, before, context);
@@ -3379,17 +3451,17 @@ function mountNode(node, parent, before, context) {
         case 'heading-section': {
             return new HeadingSectionRenderedNode(node, parent, before, context);
         }
-        case 'pending-block': {
-            return new PendingBlockRenderedNode(node, parent, before, context);
+        case 'pending': {
+            return new PendingRenderedNode(node, parent, before, context);
         }
-        case 'catch-block': {
-            return new CatchBlockRenderedNode(node, parent, before, context);
+        case 'catch': {
+            return new CatchRenderedNode(node, parent, before, context);
         }
-        case 'field-exception-block': {
-            return new FieldExceptionBlockRenderedNode(node, parent, before, context);
+        case 'field-error': {
+            return new FieldErrorRenderedNode(node, parent, before, context);
         }
-        case 'match-block': {
-            return new MatchBlockRenderedNode(node, parent, before, context);
+        case 'match': {
+            return new MatchRenderedNode(node, parent, before, context);
         }
         case 'defer':
             return new DeferRenderedNode(node, parent, before, context);
@@ -3507,7 +3579,9 @@ export function mountInterpretedComponent(component, host, injector, props) {
         (typeof ShadowRoot !== 'undefined' && rootNode instanceof ShadowRoot)
         ? rootNode
         : (host.ownerDocument ?? document);
-    const styles = craftInjector.get(CRAFT_STYLE_REGISTRY, ɵfallbackCraftStyleRegistry);
+    const styles = craftInjector.get(CRAFT_STYLE_REGISTRY, createCraftStyleRegistry({
+        nonce: craftInjector.get(CraftCspNonce, null) ?? undefined,
+    }));
     return mountInterpretedComponentWithOptions(component, host, craftInjector, props, { renderer, styleRoot, styles });
 }
 export function mountInterpretedComponentWithOptions(component, host, injector, props, options) {
@@ -3552,7 +3626,9 @@ export function mountInterpretedComponentTemplate(component, host, injector, con
         (typeof ShadowRoot !== 'undefined' && rootNode instanceof ShadowRoot)
         ? rootNode
         : (host.ownerDocument ?? document);
-    const styles = craftInjector.get(CRAFT_STYLE_REGISTRY, ɵfallbackCraftStyleRegistry);
+    const styles = craftInjector.get(CRAFT_STYLE_REGISTRY, createCraftStyleRegistry({
+        nonce: craftInjector.get(CraftCspNonce, null) ?? undefined,
+    }));
     let instance;
     try {
         instance = new ComponentRenderedNode(component, {}, host, null, {
@@ -3585,4 +3661,3 @@ export function mountInterpretedComponentTemplate(component, host, injector, con
         },
     };
 }
-//# sourceMappingURL=interpreter.js.map

package/src/lib/render/server-style-collector.d.ts

@@ -3,4 +3,3 @@ export type CraftServerStyleCollector = Readonly<{
     cssText(): string;
 }>;
 export declare function createServerStyleCollector(): CraftServerStyleCollector;
-//# sourceMappingURL=server-style-collector.d.ts.map

package/src/lib/render/server-style-collector.js

@@ -20,4 +20,3 @@ export function createServerStyleCollector() {
             .join('\n'),
     };
 }
-//# sourceMappingURL=server-style-collector.js.map

package/src/lib/render/ssr-coordinator.d.ts

@@ -4,7 +4,8 @@ export declare class CraftSsrCoordinator implements CraftSsrRuntime {
     private readonly listeners;
     private failure;
     private readonly decideResource;
-    constructor(decideResource?: (source: string, mode: SsrMode) => void);
+    private readonly defaultTimeoutMs;
+    constructor(decideResource?: (source: string, mode: SsrMode) => void, defaultTimeoutMs?: number);
     suspend(token: object, source: string, mode: SsrMode | undefined, options?: Readonly<{
         route?: string;
         timeoutMs?: number;
@@ -14,7 +15,8 @@ export declare class CraftSsrCoordinator implements CraftSsrRuntime {
     unhandled(source: string, route?: string): never;
     untilSettled(timeoutMs: number, signal?: AbortSignal): Promise<void>;
     sources(): readonly string[];
+    /** Releases source timers and waiters when the request is aborted. */
+    dispose(): void;
     private throwFailure;
     private nextChange;
 }
-//# sourceMappingURL=ssr-coordinator.d.ts.map