@getforma/core 1.0.9 → 1.1.0

package/dist/server.cjs

@@ -1,25 +1,25 @@
 'use strict';
 
-var chunk6FW5E54W_cjs = require('./chunk-6FW5E54W.cjs');
-var chunkQLPCVK7C_cjs = require('./chunk-QLPCVK7C.cjs');
+var chunk2Y5US35K_cjs = require('./chunk-2Y5US35K.cjs');
+var chunkW7OUWVRA_cjs = require('./chunk-W7OUWVRA.cjs');
 
 // src/server/action.ts
 function createAction(serverFn, options) {
-  const [pending, setPending] = chunkQLPCVK7C_cjs.createSignal(false);
-  const [error, setError] = chunkQLPCVK7C_cjs.createSignal(void 0);
+  const [pending, setPending] = chunkW7OUWVRA_cjs.createSignal(false);
+  const [error, setError] = chunkW7OUWVRA_cjs.createSignal(void 0);
   const action = async (...args) => {
     setPending(true);
     setError(void 0);
     if (options?.optimistic) {
       try {
-        chunk6FW5E54W_cjs.batch(() => options.optimistic(...args));
+        chunk2Y5US35K_cjs.batch(() => options.optimistic(...args));
       } catch {
       }
     }
     try {
       const result = await serverFn(...args);
       if (options?.onSuccess) {
-        chunk6FW5E54W_cjs.batch(() => options.onSuccess(result, ...args));
+        chunk2Y5US35K_cjs.batch(() => options.onSuccess(result, ...args));
       }
       if (options?.invalidates) {
         for (const resource of options.invalidates) {
@@ -31,7 +31,7 @@ function createAction(serverFn, options) {
     } catch (err) {
       if (options?.onError) {
         try {
-          chunk6FW5E54W_cjs.batch(() => options.onError(err, ...args));
+          chunk2Y5US35K_cjs.batch(() => options.onError(err, ...args));
         } catch {
         }
       }

package/dist/server.d.cts

@@ -1,5 +1,5 @@
-import { R as Resource } from './resource-DeEzxUz6.cjs';
-import './signal-C9v4akyJ.cjs';
+import { R as Resource } from './resource-D6HfVgiA.cjs';
+import './signal-CRBJYQ6B.cjs';
 
 /**
  * FormaJS Server - Action

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { R as Resource } from './resource-BHsgURy0.js';
-import './signal-C9v4akyJ.js';
+import { R as Resource } from './resource-ljs2X5NM.js';
+import './signal-CRBJYQ6B.js';
 
 /**
  * FormaJS Server - Action

package/dist/server.js

@@ -1,5 +1,5 @@
-import { batch } from './chunk-3G7ET4O5.js';
-import { createSignal } from './chunk-HLM5BZZQ.js';
+import { batch } from './chunk-INNOI6TG.js';
+import { createSignal } from './chunk-XLVBYXOU.js';
 
 // src/server/action.ts
 function createAction(serverFn, options) {

package/dist/{signal-C9v4akyJ.d.cts → signal-CRBJYQ6B.d.cts}

@@ -1,11 +1,3 @@
-/**
- * Forma Reactive - Signal
- *
- * Fine-grained reactive primitive backed by alien-signals.
- * API: createSignal returns [getter, setter] tuple following SolidJS conventions.
- *
- * TC39 Signals equivalent: Signal.State
- */
 /** A function that reads the current value of a signal. */
 type SignalGetter<T> = () => T;
 /** A function that updates a signal — accepts a value or an updater function. */

package/dist/{signal-C9v4akyJ.d.ts → signal-CRBJYQ6B.d.ts}

@@ -1,11 +1,3 @@
-/**
- * Forma Reactive - Signal
- *
- * Fine-grained reactive primitive backed by alien-signals.
- * API: createSignal returns [getter, setter] tuple following SolidJS conventions.
- *
- * TC39 Signals equivalent: Signal.State
- */
 /** A function that reads the current value of a signal. */
 type SignalGetter<T> = () => T;
 /** A function that updates a signal — accepts a value or an updater function. */

package/dist/ssr/index.cjs

@@ -1,5 +1,7 @@
 'use strict';
 
+var chunk263HW3KN_cjs = require('../chunk-263HW3KN.cjs');
+
 // src/ssr/render.ts
 var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "area",
@@ -28,8 +30,15 @@ function escapeHtml(str) {
 function escapeAttr(str) {
   return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/'/g, "&#39;");
 }
-var DANGEROUS_URI_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction"]);
-var DANGEROUS_URI_RE = /^\s*(javascript|vbscript|data\s*:\s*text\/html)/i;
+function renderAttr(key, resolved) {
+  const attrName = PROP_TO_ATTR[key] ?? key;
+  if (chunk263HW3KN_cjs.isEventHandlerAttr(attrName) || !chunk263HW3KN_cjs.isSafeAttrName(attrName)) return null;
+  if (resolved === true) return " " + attrName;
+  if (resolved === false || resolved == null) return null;
+  const str = String(resolved);
+  if (chunk263HW3KN_cjs.isUrlAttr(attrName) && chunk263HW3KN_cjs.isDangerousUrl(str)) return null;
+  return " " + attrName + '="' + escapeAttr(str) + '"';
+}
 function sh(tag, props, ...children) {
   return { tag, props: props ?? null, children };
 }
@@ -61,17 +70,10 @@ function renderToBuffer(node, parts) {
     parts.push("<", tag);
     if (props) {
       for (const [key, value] of Object.entries(props)) {
-        if (key.startsWith("on") || key === "ref" || key === "dangerouslySetInnerHTML") continue;
-        const attrName = PROP_TO_ATTR[key] ?? key;
+        if (key === "ref" || key === "dangerouslySetInnerHTML") continue;
         const resolved = typeof value === "function" ? value() : value;
-        if (resolved === true) {
-          parts.push(" ", attrName);
-        } else if (resolved !== false && resolved != null) {
-          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === "string" && DANGEROUS_URI_RE.test(resolved)) {
-            continue;
-          }
-          parts.push(" ", attrName, '="', escapeAttr(String(resolved)), '"');
-        }
+        const frag = renderAttr(key, resolved);
+        if (frag !== null) parts.push(frag);
       }
     }
     if (VOID_ELEMENTS.has(tag)) {
@@ -140,17 +142,10 @@ function renderToBufferHydrated(node, parts, ctx) {
     parts.push("<", tag, ` data-forma-h="${id}"`);
     if (props) {
       for (const [key, value] of Object.entries(props)) {
-        if (key.startsWith("on") || key === "ref" || key === "dangerouslySetInnerHTML") continue;
-        const attrName = PROP_TO_ATTR[key] ?? key;
+        if (key === "ref" || key === "dangerouslySetInnerHTML") continue;
         const resolved = typeof value === "function" ? value() : value;
-        if (resolved === true) {
-          parts.push(" ", attrName);
-        } else if (resolved !== false && resolved != null) {
-          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === "string" && DANGEROUS_URI_RE.test(resolved)) {
-            continue;
-          }
-          parts.push(" ", attrName, '="', escapeAttr(String(resolved)), '"');
-        }
+        const frag = renderAttr(key, resolved);
+        if (frag !== null) parts.push(frag);
       }
     }
     if (VOID_ELEMENTS.has(tag)) {
@@ -236,17 +231,10 @@ function renderSync(node, parts) {
     parts.push("<", tag);
     if (props) {
       for (const [key, value] of Object.entries(props)) {
-        if (key.startsWith("on") || key === "ref" || key === "dangerouslySetInnerHTML") continue;
-        const attrName = PROP_TO_ATTR[key] ?? key;
+        if (key === "ref" || key === "dangerouslySetInnerHTML") continue;
         const resolved = typeof value === "function" ? value() : value;
-        if (resolved === true) {
-          parts.push(" ", attrName);
-        } else if (resolved !== false && resolved != null) {
-          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === "string" && DANGEROUS_URI_RE.test(resolved)) {
-            continue;
-          }
-          parts.push(" ", attrName, '="', escapeAttr(String(resolved)), '"');
-        }
+        const frag = renderAttr(key, resolved);
+        if (frag !== null) parts.push(frag);
       }
     }
     if (VOID_ELEMENTS.has(tag)) {
@@ -348,17 +336,10 @@ function renderStreamNode(node, parts, state) {
     if (props) {
       for (const [key, value] of Object.entries(props)) {
         if (key === "fallback") continue;
-        if (key.startsWith("on") || key === "ref" || key === "dangerouslySetInnerHTML") continue;
-        const attrName = PROP_TO_ATTR[key] ?? key;
+        if (key === "ref" || key === "dangerouslySetInnerHTML") continue;
         const resolved = typeof value === "function" ? value() : value;
-        if (resolved === true) {
-          parts.push(" ", attrName);
-        } else if (resolved !== false && resolved != null) {
-          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === "string" && DANGEROUS_URI_RE.test(resolved)) {
-            continue;
-          }
-          parts.push(" ", attrName, '="', escapeAttr(String(resolved)), '"');
-        }
+        const frag = renderAttr(key, resolved);
+        if (frag !== null) parts.push(frag);
       }
     }
     if (VOID_ELEMENTS.has(tag)) {

package/dist/ssr/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/ssr/render.ts","../../src/ssr/ssr-reactive.ts","../../src/ssr/client-script.ts","../../src/ssr/stream.ts"],"names":[],"mappings":";;;AACO,IAAM,aAAA,uBAAoB,GAAA,CAAI;AAAA,EACnC,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,IAAA;AAAA,EAAM,KAAA;AAAA,EAAO,OAAA;AAAA,EAAS,IAAA;AAAA,EAAM,KAAA;AAAA,EAAO,OAAA;AAAA,EACnD,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS;AAC9C,CAAC,CAAA;AAGM,IAAM,YAAA,GAAuC;AAAA,EAClD,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,QAAA,EAAU;AACZ,CAAA;AAGO,SAAS,WAAW,GAAA,EAAqB;AAC9C,EAAA,OAAO,IACJ,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CACrB,OAAA,CAAQ,MAAM,MAAM,CAAA,CACpB,QAAQ,IAAA,EAAM,MAAM,EACpB,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA,CACtB,OAAA,CAAQ,MAAM,QAAQ,CAAA;AAC3B;AAGO,SAAS,WAAW,GAAA,EAAqB;AAC9C,EAAA,OAAO,IACJ,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CACrB,OAAA,CAAQ,MAAM,QAAQ,CAAA,CACtB,QAAQ,IAAA,EAAM,MAAM,EACpB,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CACpB,OAAA,CAAQ,MAAM,OAAO,CAAA;AAC1B;AAGO,IAAM,mBAAA,uBAA0B,GAAA,CAAI,CAAC,QAAQ,KAAA,EAAO,QAAA,EAAU,YAAY,CAAC,CAAA;AAC3E,IAAM,gBAAA,GAAmB,kDAAA;AAWzB,SAAS,EAAA,CAAG,GAAA,EAAa,KAAA,EAAA,GAA2C,QAAA,EAA4B;AACrG,EAAA,OAAO,EAAE,GAAA,EAAK,KAAA,EAAO,KAAA,IAAS,MAAM,QAAA,EAAS;AAC/C;AAoBO,SAAS,eAAe,IAAA,EAAuB;AACpD,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,cAAA,CAAe,MAAM,KAAK,CAAA;AAC1B,EAAA,OAAO,KAAA,CAAM,KAAK,EAAE,CAAA;AACtB;AAMA,SAAS,cAAA,CAAe,MAAe,KAAA,EAAuB;AAE5D,EAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,IAAA,KAAS,IAAA,IAAQ,SAAS,KAAA,EAAO;AAGrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGtE,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGlE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAAE,IAAA,cAAA,CAAe,IAAA,IAAQ,KAAK,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGzE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,EAAM,cAAA,CAAe,KAAA,EAAO,KAAK,CAAA;AACrD,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACjB,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAO,QAAA,EAAS,GAAI,IAAA;AACjC,IAAA,KAAA,CAAM,IAAA,CAAK,KAAK,GAAG,CAAA;AAGnB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAEhD,QAAA,IAAI,IAAI,UAAA,CAAW,IAAI,KAAK,GAAA,KAAQ,KAAA,IAAS,QAAQ,yBAAA,EAA2B;AAEhF,QAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAG,CAAA,IAAK,GAAA;AAGtC,QAAA,MAAM,QAAA,GAAW,OAAO,KAAA,KAAU,UAAA,GAAa,OAAM,GAAI,KAAA;AAEzD,QAAA,IAAI,aAAa,IAAA,EAAM;AACrB,UAAA,KAAA,CAAM,IAAA,CAAK,KAAK,QAAQ,CAAA;AAAA,QAC1B,CAAA,MAAA,IAAW,QAAA,KAAa,KAAA,IAAS,QAAA,IAAY,IAAA,EAAM;AACjD,UAAA,IAAI,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,IAAK,OAAO,aAAa,QAAA,IAAY,gBAAA,CAAiB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACxG,YAAA;AAAA,UACF;AACA,UAAA,KAAA,CAAM,IAAA,CAAK,KAAK,QAAA,EAAU,IAAA,EAAM,WAAW,MAAA,CAAO,QAAQ,CAAC,CAAA,EAAG,GAAG,CAAA;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AAGA,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAG,MAAA;AAAA,IAAQ;AAEzD,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AAGd,IAAA,IAAI,KAAA,GAAQ,yBAAyB,CAAA,EAAG;AACtC,MAAA,MAAM,GAAA,GAAM,MAAM,yBAAyB,CAAA;AAC3C,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,IAAA,IAAQ,YAAY,GAAA,EAAK;AAC7D,QAAA,MAAM,OAAQ,GAAA,CAA4B,MAAA;AAC1C,QAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,UAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,QACjB,CAAA,MAAO;AACL,UAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,QAC1E;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,MAAO;AAEL,MAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,QAAA,cAAA,CAAe,OAAO,KAAK,CAAA;AAAA,MAC7B;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AACzB,IAAA;AAAA,EACF;AAGA,EAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACrC;AAEO,SAAS,QAAQ,CAAA,EAAwB;AAC9C,EAAA,OAAO,KAAK,IAAA,IAAQ,OAAO,MAAM,QAAA,IAAY,KAAA,IAAS,KAAK,UAAA,IAAc,CAAA;AAC3E;AAuCO,SAAS,4BAA4B,IAAA,EAAuB;AACjE,EAAA,MAAM,GAAA,GAAwB,EAAE,EAAA,EAAI,CAAA,EAAE;AACtC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,sBAAA,CAAuB,IAAA,EAAM,OAAO,GAAG,CAAA;AACvC,EAAA,OAAO,KAAA,CAAM,KAAK,EAAE,CAAA;AACtB;AAMA,SAAS,sBAAA,CAAuB,IAAA,EAAe,KAAA,EAAiB,GAAA,EAA6B;AAE3F,EAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,IAAA,KAAS,IAAA,IAAQ,SAAS,KAAA,EAAO;AAGrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGtE,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGlE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,KAAK,GAAA,CAAI,EAAA,EAAA;AACf,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,YAAA,EAAe,EAAE,CAAA,GAAA,CAAK,CAAA;AACjC,IAAA,sBAAA,CAAuB,IAAA,EAAK,EAAG,KAAA,EAAO,GAAG,CAAA;AACzC,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,aAAA,EAAgB,EAAE,CAAA,GAAA,CAAK,CAAA;AAClC,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,MAAM,KAAK,GAAA,CAAI,EAAA,EAAA;AACf,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,YAAA,EAAe,EAAE,CAAA,GAAA,CAAK,CAAA;AACjC,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,EAAM,sBAAA,CAAuB,KAAA,EAAO,OAAO,GAAG,CAAA;AAClE,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,aAAA,EAAgB,EAAE,CAAA,GAAA,CAAK,CAAA;AAClC,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACjB,IAAA,MAAM,KAAK,GAAA,CAAI,EAAA,EAAA;AACf,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAO,QAAA,EAAS,GAAI,IAAA;AAGjC,IAAA,KAAA,CAAM,IAAA,CAAK,GAAA,EAAK,GAAA,EAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,CAAA,CAAG,CAAA;AAG5C,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAEhD,QAAA,IAAI,IAAI,UAAA,CAAW,IAAI,KAAK,GAAA,KAAQ,KAAA,IAAS,QAAQ,yBAAA,EAA2B;AAEhF,QAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAG,CAAA,IAAK,GAAA;AAGtC,QAAA,MAAM,QAAA,GAAW,OAAO,KAAA,KAAU,UAAA,GAAa,OAAM,GAAI,KAAA;AAEzD,QAAA,IAAI,aAAa,IAAA,EAAM;AACrB,UAAA,KAAA,CAAM,IAAA,CAAK,KAAK,QAAQ,CAAA;AAAA,QAC1B,CAAA,MAAA,IAAW,QAAA,KAAa,KAAA,IAAS,QAAA,IAAY,IAAA,EAAM;AACjD,UAAA,IAAI,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,IAAK,OAAO,aAAa,QAAA,IAAY,gBAAA,CAAiB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACxG,YAAA;AAAA,UACF;AACA,UAAA,KAAA,CAAM,IAAA,CAAK,KAAK,QAAA,EAAU,IAAA,EAAM,WAAW,MAAA,CAAO,QAAQ,CAAC,CAAA,EAAG,GAAG,CAAA;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AAGA,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAG,MAAA;AAAA,IAAQ;AAEzD,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AAGd,IAAA,IAAI,KAAA,GAAQ,yBAAyB,CAAA,EAAG;AACtC,MAAA,MAAM,GAAA,GAAM,MAAM,yBAAyB,CAAA;AAC3C,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,IAAA,IAAQ,YAAY,GAAA,EAAK;AAC7D,QAAA,MAAM,OAAQ,GAAA,CAA4B,MAAA;AAC1C,QAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,UAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,QACjB,CAAA,MAAO;AACL,UAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,QAC1E;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,MAAO;AAEL,MAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,QAAA,sBAAA,CAAuB,KAAA,EAAO,OAAO,GAAG,CAAA;AAAA,MAC1C;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AACzB,IAAA;AAAA,EACF;AAGA,EAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACrC;;;ACvSO,SAAS,UAAa,OAAA,EAAiD;AAC5E,EAAA,IAAI,KAAA,GAAQ,OAAA;AACZ,EAAA,OAAO,CAAC,MAAM,KAAA,EAAO,CAAC,CAAA,KAAM;AAAE,IAAA,KAAA,GAAQ,CAAA;AAAA,EAAG,CAAC,CAAA;AAC5C;AAEO,SAAS,YAAe,EAAA,EAAsB;AACnD,EAAA,OAAO,EAAA;AACT;;;ACMO,SAAS,aAAA,GAAwB;AACtC,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAA,CAAA;AAUT;AASA,SAAS,kBAAkB,GAAA,EAAsB;AAC/C,EAAA,OAAO,KAAK,SAAA,CAAU,GAAG,EACtB,OAAA,CAAQ,IAAA,EAAM,SAAS,CAAA,CACvB,OAAA,CAAQ,IAAA,EAAM,SAAS,EACvB,OAAA,CAAQ,SAAA,EAAW,SAAS,CAAA,CAC5B,OAAA,CAAQ,WAAW,SAAS,CAAA;AACjC;AAMO,SAAS,UAAA,CAAW,IAAY,IAAA,EAAsB;AAG3D,EAAA,OAAO,uBAAuB,iBAAA,CAAkB,EAAE,CAAC,CAAA,CAAA,EAAI,iBAAA,CAAkB,IAAI,CAAC,CAAA,UAAA,CAAA;AAChF;;;AChBA,SAAS,UAAA,CAAW,MAAe,KAAA,EAAuB;AACxD,EAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,IAAA,KAAS,IAAA,IAAQ,SAAS,KAAA,EAAO;AACrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AACtE,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAClE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAAE,IAAA,UAAA,CAAW,IAAA,IAAQ,KAAK,CAAA;AAAG,IAAA;AAAA,EAAQ;AACrE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,EAAM,UAAA,CAAW,KAAA,EAAO,KAAK,CAAA;AACjD,IAAA;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACjB,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAO,QAAA,EAAS,GAAI,IAAA;AACjC,IAAA,KAAA,CAAM,IAAA,CAAK,KAAK,GAAG,CAAA;AACnB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,QAAA,IAAI,IAAI,UAAA,CAAW,IAAI,KAAK,GAAA,KAAQ,KAAA,IAAS,QAAQ,yBAAA,EAA2B;AAChF,QAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAG,CAAA,IAAK,GAAA;AACtC,QAAA,MAAM,QAAA,GAAW,OAAO,KAAA,KAAU,UAAA,GAAa,OAAM,GAAI,KAAA;AACzD,QAAA,IAAI,aAAa,IAAA,EAAM;AACrB,UAAA,KAAA,CAAM,IAAA,CAAK,KAAK,QAAQ,CAAA;AAAA,QAC1B,CAAA,MAAA,IAAW,QAAA,KAAa,KAAA,IAAS,QAAA,IAAY,IAAA,EAAM;AACjD,UAAA,IAAI,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,IAAK,OAAO,aAAa,QAAA,IAAY,gBAAA,CAAiB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACxG,YAAA;AAAA,UACF;AACA,UAAA,KAAA,CAAM,IAAA,CAAK,KAAK,QAAA,EAAU,IAAA,EAAM,WAAW,MAAA,CAAO,QAAQ,CAAC,CAAA,EAAG,GAAG,CAAA;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AACA,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAG,MAAA;AAAA,IAAQ;AACzD,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AACd,IAAA,IAAI,KAAA,GAAQ,yBAAyB,CAAA,EAAG;AACtC,MAAA,MAAM,GAAA,GAAM,MAAM,yBAAyB,CAAA;AAC3C,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,IAAA,IAAQ,EAAE,QAAA,IAAY,GAAA,CAAA,IAAQ,OAAQ,GAAA,CAA4B,MAAA,KAAW,QAAA,EAAU;AAC3H,QAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,MAC1E;AACA,MAAA,KAAA,CAAM,IAAA,CAAM,IAA2B,MAAM,CAAA;AAAA,IAC/C,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,KAAA,IAAS,QAAA,EAAU,UAAA,CAAW,KAAA,EAAO,KAAK,CAAA;AAAA,IACvD;AACA,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACrC;AAmBA,SAAS,gBAAgB,CAAA,EAAgC;AACvD,EAAA,OAAO,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,GAAA,KAAQ,gBAAA;AACjC;AAKO,SAAS,UAAA,CAAW,UAAmB,aAAA,EAAsD;AAClG,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,gBAAA;AAAA,IACL,KAAA,EAAO,EAAE,QAAA,EAAS;AAAA,IAClB,QAAA,EAAU,CAAC,aAAa;AAAA,GAC1B;AACF;AA6CA,gBAAuB,iBAAA,CACrB,MACA,OAAA,EACwB;AAExB,EAAA,MAAM,KAAA,GAAqB;AAAA,IACzB,eAAA,EAAiB,CAAA;AAAA,IACjB,mBAAmB;AAAC,GACtB;AAEA,EAAA,MAAM,UAAA,GAAa,SAAS,gBAAA,KAAqB,KAAA;AAGjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,aAAA,EAAc;AAAA,EACtB;AAGA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,gBAAA,CAAiB,IAAA,EAAM,WAAW,KAAK,CAAA;AACvC,EAAA,MAAM,SAAA,CAAU,KAAK,EAAE,CAAA;AAGvB,EAAA,IAAI,SAAS,eAAA,EAAiB;AAC5B,IAAA,MAAM,OAAA,CAAQ,eAAA;AAAA,EAChB;AAIA,EAAA,OAAO,KAAA,CAAM,iBAAA,CAAkB,MAAA,GAAS,CAAA,EAAG;AACzC,IAAA,MAAM,OAAA,GAAU,CAAC,GAAG,KAAA,CAAM,iBAAiB,CAAA;AAC3C,IAAA,KAAA,CAAM,oBAAoB,EAAC;AAG3B,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA;AAAA,MAC5B,OAAA,CAAQ,GAAA,CAAI,OAAO,QAAA,KAAa;AAC9B,QAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAA;AAC5B,QAAA,OAAO,EAAE,EAAA,EAAI,QAAA,CAAS,EAAA,EAAI,IAAA,EAAK;AAAA,MACjC,CAAC;AAAA,KACH;AAEA,IAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,MAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,QAAA,MAAM,WAAW,MAAA,CAAO,KAAA,CAAM,EAAA,EAAI,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,MACrD;AAAA,IAEF;AAAA,EACF;AACF;AAMA,SAAS,gBAAA,CAAiB,IAAA,EAAe,KAAA,EAAiB,KAAA,EAA0B;AAClF,EAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,IAAA,KAAS,IAAA,IAAQ,SAAS,KAAA,EAAO;AACrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AACtE,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAClE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAAE,IAAA,gBAAA,CAAiB,IAAA,EAAK,EAAG,KAAA,EAAO,KAAK,CAAA;AAAG,IAAA;AAAA,EAAQ;AAClF,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,EAAM,gBAAA,CAAiB,KAAA,EAAO,OAAO,KAAK,CAAA;AAC9D,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,eAAA,CAAgB,IAAI,CAAA,EAAG;AACzB,IAAA,MAAM,EAAA,GAAK,CAAA,QAAA,EAAW,KAAA,CAAM,eAAA,EAAiB,CAAA,CAAA;AAC7C,IAAA,MAAM,QAAA,GAAW,KAAK,KAAA,CAAM,QAAA;AAC5B,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,CAAC,CAAA;AAG/B,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,SAAA,EAAY,EAAE,CAAA,2BAAA,CAA6B,CAAA;AACtD,IAAA,UAAA,CAAW,UAAU,KAAK,CAAA;AAC1B,IAAA,KAAA,CAAM,KAAK,QAAQ,CAAA;AAGnB,IAAA,MAAM,OAAA,GAAU,OAAA,EAAQ,CAAE,IAAA,CAAK,CAAC,QAAA,KAAsB;AACpD,MAAA,MAAM,gBAA0B,EAAC;AACjC,MAAA,UAAA,CAAW,UAAU,aAAa,CAAA;AAClC,MAAA,OAAO,aAAA,CAAc,KAAK,EAAE,CAAA;AAAA,IAC9B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,iBAAA,CAAkB,IAAA,CAAK,EAAE,EAAA,EAAI,SAAS,CAAA;AAC5C,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACjB,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAO,QAAA,EAAS,GAAI,IAAA;AACjC,IAAA,KAAA,CAAM,IAAA,CAAK,KAAK,GAAG,CAAA;AACnB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,QAAA,IAAI,QAAQ,UAAA,EAAY;AACxB,QAAA,IAAI,IAAI,UAAA,CAAW,IAAI,KAAK,GAAA,KAAQ,KAAA,IAAS,QAAQ,yBAAA,EAA2B;AAChF,QAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAG,CAAA,IAAK,GAAA;AACtC,QAAA,MAAM,QAAA,GAAW,OAAO,KAAA,KAAU,UAAA,GAAa,OAAM,GAAI,KAAA;AACzD,QAAA,IAAI,aAAa,IAAA,EAAM;AACrB,UAAA,KAAA,CAAM,IAAA,CAAK,KAAK,QAAQ,CAAA;AAAA,QAC1B,CAAA,MAAA,IAAW,QAAA,KAAa,KAAA,IAAS,QAAA,IAAY,IAAA,EAAM;AACjD,UAAA,IAAI,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,IAAK,OAAO,aAAa,QAAA,IAAY,gBAAA,CAAiB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACxG,YAAA;AAAA,UACF;AACA,UAAA,KAAA,CAAM,IAAA,CAAK,KAAK,QAAA,EAAU,IAAA,EAAM,WAAW,MAAA,CAAO,QAAQ,CAAC,CAAA,EAAG,GAAG,CAAA;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AACA,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAG,MAAA;AAAA,IAAQ;AACzD,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AACd,IAAA,IAAI,KAAA,GAAQ,yBAAyB,CAAA,EAAG;AACtC,MAAA,MAAM,GAAA,GAAM,MAAM,yBAAyB,CAAA;AAC3C,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,IAAA,IAAQ,EAAE,QAAA,IAAY,GAAA,CAAA,IAAQ,OAAQ,GAAA,CAA4B,MAAA,KAAW,QAAA,EAAU;AAC3H,QAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,MAC1E;AACA,MAAA,KAAA,CAAM,IAAA,CAAM,IAA2B,MAAM,CAAA;AAAA,IAC/C,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,KAAA,IAAS,QAAA,EAAU,gBAAA,CAAiB,KAAA,EAAO,OAAO,KAAK,CAAA;AAAA,IACpE;AACA,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AACzB,IAAA;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACrC","file":"index.cjs","sourcesContent":["// Void elements that don't have closing tags\nexport const VOID_ELEMENTS = new Set([\n  'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input',\n  'link', 'meta', 'param', 'source', 'track', 'wbr',\n]);\n\n// Map of prop names to HTML attribute names\nexport const PROP_TO_ATTR: Record<string, string> = {\n  className: 'class',\n  htmlFor: 'for',\n  tabIndex: 'tabindex',\n};\n\n// Escape HTML entities\nexport function escapeHtml(str: string): string {\n  return str\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#x27;');\n}\n\n// Escape attribute values\nexport function escapeAttr(str: string): string {\n  return str\n    .replace(/&/g, '&amp;')\n    .replace(/\"/g, '&quot;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/'/g, '&#39;');\n}\n\n// Dangerous URI detection for href, src, action, formaction attributes\nexport const DANGEROUS_URI_ATTRS = new Set(['href', 'src', 'action', 'formaction']);\nexport const DANGEROUS_URI_RE = /^\\s*(javascript|vbscript|data\\s*:\\s*text\\/html)/i;\n\nexport interface VNode {\n  tag: string;\n  props: Record<string, unknown> | null;\n  children: unknown[];\n}\n\n/**\n * Server-side hyperscript — creates a virtual node instead of a DOM element.\n */\nexport function sh(tag: string, props?: Record<string, unknown> | null, ...children: unknown[]): VNode {\n  return { tag, props: props ?? null, children };\n}\n\n/**\n * Render a FormaJS virtual tree to an HTML string.\n *\n * Uses an array buffer internally to avoid O(n^2) string concatenation\n * for large trees, then joins once at the end.\n *\n * Usage:\n * ```ts\n * import { renderToString, sh } from '@getforma/core/ssr';\n *\n * const html = renderToString(\n *   sh('div', { class: 'app' },\n *     sh('h1', null, 'Hello SSR!'),\n *     sh('p', null, () => count()),  // signal getters resolved synchronously\n *   )\n * );\n * ```\n */\nexport function renderToString(node: unknown): string {\n  const parts: string[] = [];\n  renderToBuffer(node, parts);\n  return parts.join('');\n}\n\n/**\n * Internal: recursively render into a string array buffer.\n * Avoids O(n^2) string concatenation for large trees.\n */\nfunction renderToBuffer(node: unknown, parts: string[]): void {\n  // null/undefined/boolean → empty\n  if (node == null || node === true || node === false) return;\n\n  // String → escaped text\n  if (typeof node === 'string') { parts.push(escapeHtml(node)); return; }\n\n  // Number → stringified\n  if (typeof node === 'number') { parts.push(String(node)); return; }\n\n  // Function (signal getter) → resolve and render\n  if (typeof node === 'function') { renderToBuffer(node(), parts); return; }\n\n  // Array → render each\n  if (Array.isArray(node)) {\n    for (const child of node) renderToBuffer(child, parts);\n    return;\n  }\n\n  // VNode\n  if (isVNode(node)) {\n    const { tag, props, children } = node;\n    parts.push('<', tag);\n\n    // Render props as attributes\n    if (props) {\n      for (const [key, value] of Object.entries(props)) {\n        // Skip event handlers, refs, and internal props\n        if (key.startsWith('on') || key === 'ref' || key === 'dangerouslySetInnerHTML') continue;\n\n        const attrName = PROP_TO_ATTR[key] ?? key;\n\n        // Resolve reactive values\n        const resolved = typeof value === 'function' ? value() : value;\n\n        if (resolved === true) {\n          parts.push(' ', attrName);\n        } else if (resolved !== false && resolved != null) {\n          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === 'string' && DANGEROUS_URI_RE.test(resolved)) {\n            continue; // skip dangerous URI\n          }\n          parts.push(' ', attrName, '=\"', escapeAttr(String(resolved)), '\"');\n        }\n      }\n    }\n\n    // Void elements\n    if (VOID_ELEMENTS.has(tag)) { parts.push(' />'); return; }\n\n    parts.push('>');\n\n    // dangerouslySetInnerHTML\n    if (props?.['dangerouslySetInnerHTML']) {\n      const raw = props['dangerouslySetInnerHTML'];\n      if (typeof raw === 'object' && raw != null && '__html' in raw) {\n        const html = (raw as { __html: unknown }).__html;\n        if (typeof html === 'string') {\n          parts.push(html);\n        } else {\n          throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n        }\n      } else {\n        throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n      }\n    } else {\n      // Render children\n      for (const child of children) {\n        renderToBuffer(child, parts);\n      }\n    }\n\n    parts.push('</', tag, '>');\n    return;\n  }\n\n  // Fallback: stringify\n  parts.push(escapeHtml(String(node)));\n}\n\nexport function isVNode(v: unknown): v is VNode {\n  return v != null && typeof v === 'object' && 'tag' in v && 'children' in v;\n}\n\n// ---------------------------------------------------------------------------\n// Hydration-aware rendering\n// ---------------------------------------------------------------------------\n\n/** Per-render hydration context — avoids shared module-level counter. */\ninterface HydrationContext {\n  id: number;\n}\n\n/**\n * Render a FormaJS virtual tree to an HTML string with hydration markers.\n *\n * Like `renderToString`, but injects comment markers and `data-forma-h`\n * attributes so the client-side `hydrate()` function can adopt existing\n * DOM nodes without re-creating them.\n *\n * Each call creates its own hydration counter, so concurrent calls\n * (e.g. multiple SSR requests in the same process) produce independent,\n * non-overlapping hydration IDs.\n *\n * Marker types:\n * - `data-forma-h=\"N\"` — element boundary (attribute on the element)\n * - `<!--forma-t:N-->` / `<!--/forma-t:N-->` — reactive text boundary\n * - `<!--forma-l:N-->` / `<!--/forma-l:N-->` — list boundary\n *\n * Usage:\n * ```ts\n * import { renderToStringWithHydration, sh } from '@getforma/core/ssr';\n *\n * const html = renderToStringWithHydration(\n *   sh('div', { class: 'app' },\n *     sh('h1', null, 'Hello SSR!'),\n *     sh('p', null, () => count()),\n *   )\n * );\n * ```\n */\nexport function renderToStringWithHydration(node: unknown): string {\n  const ctx: HydrationContext = { id: 0 };\n  const parts: string[] = [];\n  renderToBufferHydrated(node, parts, ctx);\n  return parts.join('');\n}\n\n/**\n * Internal: recursively render into a string array buffer with hydration markers.\n * The `ctx` object carries the hydration counter so concurrent renders are isolated.\n */\nfunction renderToBufferHydrated(node: unknown, parts: string[], ctx: HydrationContext): void {\n  // null/undefined/boolean → empty\n  if (node == null || node === true || node === false) return;\n\n  // String → escaped text\n  if (typeof node === 'string') { parts.push(escapeHtml(node)); return; }\n\n  // Number → stringified\n  if (typeof node === 'number') { parts.push(String(node)); return; }\n\n  // Function (signal getter / reactive text) → wrap with text markers\n  if (typeof node === 'function') {\n    const id = ctx.id++;\n    parts.push(`<!--forma-t:${id}-->`);\n    renderToBufferHydrated(node(), parts, ctx);\n    parts.push(`<!--/forma-t:${id}-->`);\n    return;\n  }\n\n  // Array → wrap with list markers\n  if (Array.isArray(node)) {\n    const id = ctx.id++;\n    parts.push(`<!--forma-l:${id}-->`);\n    for (const child of node) renderToBufferHydrated(child, parts, ctx);\n    parts.push(`<!--/forma-l:${id}-->`);\n    return;\n  }\n\n  // VNode\n  if (isVNode(node)) {\n    const id = ctx.id++;\n    const { tag, props, children } = node;\n\n    // Add hydration data-attribute to element\n    parts.push('<', tag, ` data-forma-h=\"${id}\"`);\n\n    // Render props as attributes\n    if (props) {\n      for (const [key, value] of Object.entries(props)) {\n        // Skip event handlers, refs, and internal props\n        if (key.startsWith('on') || key === 'ref' || key === 'dangerouslySetInnerHTML') continue;\n\n        const attrName = PROP_TO_ATTR[key] ?? key;\n\n        // Resolve reactive values\n        const resolved = typeof value === 'function' ? value() : value;\n\n        if (resolved === true) {\n          parts.push(' ', attrName);\n        } else if (resolved !== false && resolved != null) {\n          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === 'string' && DANGEROUS_URI_RE.test(resolved)) {\n            continue; // skip dangerous URI\n          }\n          parts.push(' ', attrName, '=\"', escapeAttr(String(resolved)), '\"');\n        }\n      }\n    }\n\n    // Void elements\n    if (VOID_ELEMENTS.has(tag)) { parts.push(' />'); return; }\n\n    parts.push('>');\n\n    // dangerouslySetInnerHTML\n    if (props?.['dangerouslySetInnerHTML']) {\n      const raw = props['dangerouslySetInnerHTML'];\n      if (typeof raw === 'object' && raw != null && '__html' in raw) {\n        const html = (raw as { __html: unknown }).__html;\n        if (typeof html === 'string') {\n          parts.push(html);\n        } else {\n          throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n        }\n      } else {\n        throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n      }\n    } else {\n      // Render children\n      for (const child of children) {\n        renderToBufferHydrated(child, parts, ctx);\n      }\n    }\n\n    parts.push('</', tag, '>');\n    return;\n  }\n\n  // Fallback: stringify\n  parts.push(escapeHtml(String(node)));\n}\n\n","/**\n * SSR-only signal: just a value holder, no reactivity needed on server.\n */\nexport function ssrSignal<T>(initial: T): [get: () => T, set: (v: T) => void] {\n  let value = initial;\n  return [() => value, (v) => { value = v; }];\n}\n\nexport function ssrComputed<T>(fn: () => T): () => T {\n  return fn; // On server, just call the function directly\n}\n","/**\n * FormaJS SSR - Client Swap Script\n *\n * Tiny inline script injected into the HTML stream that handles\n * out-of-order Suspense boundary resolution.\n *\n * When the server resolves a Suspense boundary, it sends:\n *   <script>$FORMA_SWAP(\"forma-s:0\",\"<resolved html>\")</script>\n *\n * This script replaces the fallback placeholder with the resolved content.\n */\n\n/**\n * Returns the client-side swap script as a string, ready to be injected\n * into the HTML stream (typically right after <body> or before first Suspense).\n */\nexport function getSwapScript(): string {\n  return `<script>\nfunction $FORMA_SWAP(id,html){\n  var el=document.getElementById(id);\n  if(el){\n    var tpl=document.createElement('template');\n    tpl.innerHTML=html;\n    el.replaceWith(tpl.content);\n  }\n}\n</script>`;\n}\n\n/**\n * Serializes a value to a JSON string that is safe to embed inside a\n * `<script>` block. Standard `JSON.stringify` does not escape `<` or `>`,\n * so a payload containing `</script>` would prematurely close the script\n * tag, enabling an injection attack. We also escape U+2028 and U+2029\n * which are valid JSON but treated as line terminators in JavaScript source.\n */\nfunction safeJsonStringify(val: unknown): string {\n  return JSON.stringify(val)\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029');\n}\n\n/**\n * Returns a script tag that swaps a specific Suspense boundary's content.\n * Called when an async resource resolves during streaming.\n */\nexport function getSwapTag(id: string, html: string): string {\n  // safeJsonStringify escapes <, >, U+2028, and U+2029 so the serialized\n  // content cannot break out of the surrounding <script> block.\n  return `<script>$FORMA_SWAP(${safeJsonStringify(id)},${safeJsonStringify(html)})</script>`;\n}\n","/**\n * FormaJS SSR - Streaming Renderer\n *\n * Implements true chunked HTML streaming with out-of-order Suspense resolution.\n *\n * How it works:\n * 1. Yields shell HTML immediately (opening tags, head, static content)\n * 2. When a Suspense boundary is encountered:\n *    - Yields the fallback HTML with a placeholder: <div id=\"forma-s:N\" style=\"display:contents\">\n *    - Continues rendering siblings without blocking\n *    - When the async resource resolves, yields a swap script\n * 3. Suspense boundaries resolve independently in any order (out-of-order streaming)\n */\n\nimport { getSwapScript, getSwapTag } from './client-script.js';\nimport { escapeHtml, escapeAttr, isVNode, VOID_ELEMENTS, PROP_TO_ATTR, DANGEROUS_URI_ATTRS, DANGEROUS_URI_RE, type VNode } from './render.js';\n\n// ---------------------------------------------------------------------------\n// Suspense boundary tracking\n// ---------------------------------------------------------------------------\n\ninterface PendingBoundary {\n  id: string;\n  promise: Promise<string>;\n}\n\n/** Per-render mutable state, scoped to a single renderToStreamNew call. */\ninterface StreamState {\n  suspenseCounter: number;\n  pendingBoundaries: PendingBoundary[];\n}\n\n// ---------------------------------------------------------------------------\n// Synchronous render to buffer (for non-async content)\n// ---------------------------------------------------------------------------\n\nfunction renderSync(node: unknown, parts: string[]): void {\n  if (node == null || node === true || node === false) return;\n  if (typeof node === 'string') { parts.push(escapeHtml(node)); return; }\n  if (typeof node === 'number') { parts.push(String(node)); return; }\n  if (typeof node === 'function') { renderSync(node(), parts); return; }\n  if (Array.isArray(node)) {\n    for (const child of node) renderSync(child, parts);\n    return;\n  }\n  if (isVNode(node)) {\n    const { tag, props, children } = node;\n    parts.push('<', tag);\n    if (props) {\n      for (const [key, value] of Object.entries(props)) {\n        if (key.startsWith('on') || key === 'ref' || key === 'dangerouslySetInnerHTML') continue;\n        const attrName = PROP_TO_ATTR[key] ?? key;\n        const resolved = typeof value === 'function' ? value() : value;\n        if (resolved === true) {\n          parts.push(' ', attrName);\n        } else if (resolved !== false && resolved != null) {\n          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === 'string' && DANGEROUS_URI_RE.test(resolved)) {\n            continue; // skip dangerous URI\n          }\n          parts.push(' ', attrName, '=\"', escapeAttr(String(resolved)), '\"');\n        }\n      }\n    }\n    if (VOID_ELEMENTS.has(tag)) { parts.push(' />'); return; }\n    parts.push('>');\n    if (props?.['dangerouslySetInnerHTML']) {\n      const raw = props['dangerouslySetInnerHTML'];\n      if (typeof raw !== 'object' || raw == null || !('__html' in raw) || typeof (raw as { __html: unknown }).__html !== 'string') {\n        throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n      }\n      parts.push((raw as { __html: string }).__html);\n    } else {\n      for (const child of children) renderSync(child, parts);\n    }\n    parts.push('</', tag, '>');\n    return;\n  }\n  parts.push(escapeHtml(String(node)));\n}\n\n// ---------------------------------------------------------------------------\n// Suspense VNode detection\n// ---------------------------------------------------------------------------\n\n/**\n * A Suspense boundary VNode has a special shape:\n * { tag: 'forma-suspense', props: { fallback: VNode }, children: [asyncChildren] }\n *\n * Or it can be created via:\n * shSuspense(fallbackVNode, () => asyncContent)\n */\nexport interface SuspenseVNode {\n  tag: 'forma-suspense';\n  props: { fallback: unknown };\n  children: [() => Promise<unknown>];\n}\n\nfunction isSuspenseVNode(v: unknown): v is SuspenseVNode {\n  return isVNode(v) && v.tag === 'forma-suspense';\n}\n\n/**\n * Create a server-side Suspense VNode for streaming SSR.\n */\nexport function shSuspense(fallback: unknown, asyncChildren: () => Promise<unknown>): SuspenseVNode {\n  return {\n    tag: 'forma-suspense',\n    props: { fallback },\n    children: [asyncChildren],\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Streaming renderer\n// ---------------------------------------------------------------------------\n\nexport interface StreamOptions {\n  /** Script to bootstrap the client-side app (e.g. <script src=\"/app.js\"></script>) */\n  bootstrapScript?: string;\n  /** Whether to inject the $FORMA_SWAP client script (default: true) */\n  injectSwapScript?: boolean;\n}\n\n/**\n * Render a FormaJS virtual tree to a stream of HTML chunks.\n *\n * Yields HTML progressively:\n * - Static content is yielded immediately\n * - Suspense boundaries yield their fallback, then resolve later\n * - Resolved Suspense boundaries yield swap scripts\n *\n * Usage:\n * ```ts\n * import { renderToStream, shSuspense, sh } from '@getforma/core/ssr';\n *\n * const stream = renderToStream(\n *   sh('html', null,\n *     sh('body', null,\n *       sh('h1', null, 'Hello'),\n *       shSuspense(\n *         sh('div', null, 'Loading...'),\n *         async () => {\n *           const data = await fetchData();\n *           return sh('div', null, data.name);\n *         },\n *       ),\n *     ),\n *   ),\n * );\n *\n * for await (const chunk of stream) {\n *   response.write(chunk);\n * }\n * ```\n */\nexport async function* renderToStreamNew(\n  node: unknown,\n  options?: StreamOptions,\n): AsyncGenerator<string> {\n  // Per-render state — scoped to this generator invocation\n  const state: StreamState = {\n    suspenseCounter: 0,\n    pendingBoundaries: [],\n  };\n\n  const injectSwap = options?.injectSwapScript !== false;\n\n  // Inject the swap script first (if there could be Suspense boundaries)\n  if (injectSwap) {\n    yield getSwapScript();\n  }\n\n  // Render the main tree synchronously, collecting Suspense boundaries\n  const mainParts: string[] = [];\n  renderStreamNode(node, mainParts, state);\n  yield mainParts.join('');\n\n  // Yield bootstrap script if provided\n  if (options?.bootstrapScript) {\n    yield options.bootstrapScript;\n  }\n\n  // Wait for and yield all pending Suspense boundaries\n  // Each resolves independently (out-of-order)\n  while (state.pendingBoundaries.length > 0) {\n    const pending = [...state.pendingBoundaries];\n    state.pendingBoundaries = [];\n\n    // Race all pending boundaries — yield each as it resolves\n    const results = await Promise.allSettled(\n      pending.map(async (boundary) => {\n        const html = await boundary.promise;\n        return { id: boundary.id, html };\n      }),\n    );\n\n    for (const result of results) {\n      if (result.status === 'fulfilled') {\n        yield getSwapTag(result.value.id, result.value.html);\n      }\n      // On rejection, the fallback stays visible (no swap)\n    }\n  }\n}\n\n/**\n * Render a node synchronously. If a Suspense boundary is encountered,\n * render the fallback inline and queue the async resolution.\n */\nfunction renderStreamNode(node: unknown, parts: string[], state: StreamState): void {\n  if (node == null || node === true || node === false) return;\n  if (typeof node === 'string') { parts.push(escapeHtml(node)); return; }\n  if (typeof node === 'number') { parts.push(String(node)); return; }\n  if (typeof node === 'function') { renderStreamNode(node(), parts, state); return; }\n  if (Array.isArray(node)) {\n    for (const child of node) renderStreamNode(child, parts, state);\n    return;\n  }\n\n  // Suspense boundary: render fallback, queue async resolution\n  if (isSuspenseVNode(node)) {\n    const id = `forma-s:${state.suspenseCounter++}`;\n    const fallback = node.props.fallback;\n    const asyncFn = node.children[0]!;\n\n    // Render fallback inside a replaceable container\n    parts.push(`<div id=\"${id}\" style=\"display:contents\">`);\n    renderSync(fallback, parts);\n    parts.push('</div>');\n\n    // Queue the async resolution\n    const promise = asyncFn().then((resolved: unknown) => {\n      const resolvedParts: string[] = [];\n      renderSync(resolved, resolvedParts);\n      return resolvedParts.join('');\n    });\n    state.pendingBoundaries.push({ id, promise });\n    return;\n  }\n\n  // Regular VNode\n  if (isVNode(node)) {\n    const { tag, props, children } = node;\n    parts.push('<', tag);\n    if (props) {\n      for (const [key, value] of Object.entries(props)) {\n        if (key === 'fallback') continue; // skip internal suspense props\n        if (key.startsWith('on') || key === 'ref' || key === 'dangerouslySetInnerHTML') continue;\n        const attrName = PROP_TO_ATTR[key] ?? key;\n        const resolved = typeof value === 'function' ? value() : value;\n        if (resolved === true) {\n          parts.push(' ', attrName);\n        } else if (resolved !== false && resolved != null) {\n          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === 'string' && DANGEROUS_URI_RE.test(resolved)) {\n            continue; // skip dangerous URI\n          }\n          parts.push(' ', attrName, '=\"', escapeAttr(String(resolved)), '\"');\n        }\n      }\n    }\n    if (VOID_ELEMENTS.has(tag)) { parts.push(' />'); return; }\n    parts.push('>');\n    if (props?.['dangerouslySetInnerHTML']) {\n      const raw = props['dangerouslySetInnerHTML'];\n      if (typeof raw !== 'object' || raw == null || !('__html' in raw) || typeof (raw as { __html: unknown }).__html !== 'string') {\n        throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n      }\n      parts.push((raw as { __html: string }).__html);\n    } else {\n      for (const child of children) renderStreamNode(child, parts, state);\n    }\n    parts.push('</', tag, '>');\n    return;\n  }\n\n  parts.push(escapeHtml(String(node)));\n}\n"]}
+{"version":3,"sources":["../../src/ssr/render.ts","../../src/ssr/ssr-reactive.ts","../../src/ssr/client-script.ts","../../src/ssr/stream.ts"],"names":["isEventHandlerAttr","isSafeAttrName","isUrlAttr","isDangerousUrl"],"mappings":";;;;;AACO,IAAM,aAAA,uBAAoB,GAAA,CAAI;AAAA,EACnC,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,IAAA;AAAA,EAAM,KAAA;AAAA,EAAO,OAAA;AAAA,EAAS,IAAA;AAAA,EAAM,KAAA;AAAA,EAAO,OAAA;AAAA,EACnD,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS;AAC9C,CAAC,CAAA;AAGM,IAAM,YAAA,GAAuC;AAAA,EAClD,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,KAAA;AAAA,EACT,QAAA,EAAU;AACZ,CAAA;AAGO,SAAS,WAAW,GAAA,EAAqB;AAC9C,EAAA,OAAO,IACJ,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CACrB,OAAA,CAAQ,MAAM,MAAM,CAAA,CACpB,QAAQ,IAAA,EAAM,MAAM,EACpB,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA,CACtB,OAAA,CAAQ,MAAM,QAAQ,CAAA;AAC3B;AAGO,SAAS,WAAW,GAAA,EAAqB;AAC9C,EAAA,OAAO,IACJ,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CACrB,OAAA,CAAQ,MAAM,QAAQ,CAAA,CACtB,QAAQ,IAAA,EAAM,MAAM,EACpB,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CACpB,OAAA,CAAQ,MAAM,OAAO,CAAA;AAC1B;AAiBO,SAAS,UAAA,CAAW,KAAa,QAAA,EAAkC;AACxE,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAG,CAAA,IAAK,GAAA;AAItC,EAAA,IAAIA,qCAAmB,QAAQ,CAAA,IAAK,CAACC,gCAAA,CAAe,QAAQ,GAAG,OAAO,IAAA;AACtE,EAAA,IAAI,QAAA,KAAa,IAAA,EAAM,OAAO,GAAA,GAAM,QAAA;AACpC,EAAA,IAAI,QAAA,KAAa,KAAA,IAAS,QAAA,IAAY,IAAA,EAAM,OAAO,IAAA;AACnD,EAAA,MAAM,GAAA,GAAM,OAAO,QAAQ,CAAA;AAC3B,EAAA,IAAIC,4BAAU,QAAQ,CAAA,IAAKC,gCAAA,CAAe,GAAG,GAAG,OAAO,IAAA;AACvD,EAAA,OAAO,GAAA,GAAM,QAAA,GAAW,IAAA,GAAO,UAAA,CAAW,GAAG,CAAA,GAAI,GAAA;AACnD;AAWO,SAAS,EAAA,CAAG,GAAA,EAAa,KAAA,EAAA,GAA2C,QAAA,EAA4B;AACrG,EAAA,OAAO,EAAE,GAAA,EAAK,KAAA,EAAO,KAAA,IAAS,MAAM,QAAA,EAAS;AAC/C;AAoBO,SAAS,eAAe,IAAA,EAAuB;AACpD,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,cAAA,CAAe,MAAM,KAAK,CAAA;AAC1B,EAAA,OAAO,KAAA,CAAM,KAAK,EAAE,CAAA;AACtB;AAMA,SAAS,cAAA,CAAe,MAAe,KAAA,EAAuB;AAE5D,EAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,IAAA,KAAS,IAAA,IAAQ,SAAS,KAAA,EAAO;AAGrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGtE,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGlE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAAE,IAAA,cAAA,CAAe,IAAA,IAAQ,KAAK,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGzE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,EAAM,cAAA,CAAe,KAAA,EAAO,KAAK,CAAA;AACrD,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACjB,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAO,QAAA,EAAS,GAAI,IAAA;AACjC,IAAA,KAAA,CAAM,IAAA,CAAK,KAAK,GAAG,CAAA;AAGnB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAGhD,QAAA,IAAI,GAAA,KAAQ,KAAA,IAAS,GAAA,KAAQ,yBAAA,EAA2B;AAGxD,QAAA,MAAM,QAAA,GAAW,OAAO,KAAA,KAAU,UAAA,GAAa,OAAM,GAAI,KAAA;AAEzD,QAAA,MAAM,IAAA,GAAO,UAAA,CAAW,GAAA,EAAK,QAAQ,CAAA;AACrC,QAAA,IAAI,IAAA,KAAS,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAA,MACpC;AAAA,IACF;AAGA,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAG,MAAA;AAAA,IAAQ;AAEzD,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AAGd,IAAA,IAAI,KAAA,GAAQ,yBAAyB,CAAA,EAAG;AACtC,MAAA,MAAM,GAAA,GAAM,MAAM,yBAAyB,CAAA;AAC3C,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,IAAA,IAAQ,YAAY,GAAA,EAAK;AAC7D,QAAA,MAAM,OAAQ,GAAA,CAA4B,MAAA;AAC1C,QAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,UAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,QACjB,CAAA,MAAO;AACL,UAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,QAC1E;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,MAAO;AAEL,MAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,QAAA,cAAA,CAAe,OAAO,KAAK,CAAA;AAAA,MAC7B;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AACzB,IAAA;AAAA,EACF;AAGA,EAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACrC;AAEO,SAAS,QAAQ,CAAA,EAAwB;AAC9C,EAAA,OAAO,KAAK,IAAA,IAAQ,OAAO,MAAM,QAAA,IAAY,KAAA,IAAS,KAAK,UAAA,IAAc,CAAA;AAC3E;AAuCO,SAAS,4BAA4B,IAAA,EAAuB;AACjE,EAAA,MAAM,GAAA,GAAwB,EAAE,EAAA,EAAI,CAAA,EAAE;AACtC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,sBAAA,CAAuB,IAAA,EAAM,OAAO,GAAG,CAAA;AACvC,EAAA,OAAO,KAAA,CAAM,KAAK,EAAE,CAAA;AACtB;AAMA,SAAS,sBAAA,CAAuB,IAAA,EAAe,KAAA,EAAiB,GAAA,EAA6B;AAE3F,EAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,IAAA,KAAS,IAAA,IAAQ,SAAS,KAAA,EAAO;AAGrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGtE,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAGlE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,KAAK,GAAA,CAAI,EAAA,EAAA;AACf,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,YAAA,EAAe,EAAE,CAAA,GAAA,CAAK,CAAA;AACjC,IAAA,sBAAA,CAAuB,IAAA,EAAK,EAAG,KAAA,EAAO,GAAG,CAAA;AACzC,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,aAAA,EAAgB,EAAE,CAAA,GAAA,CAAK,CAAA;AAClC,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,MAAM,KAAK,GAAA,CAAI,EAAA,EAAA;AACf,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,YAAA,EAAe,EAAE,CAAA,GAAA,CAAK,CAAA;AACjC,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,EAAM,sBAAA,CAAuB,KAAA,EAAO,OAAO,GAAG,CAAA;AAClE,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,aAAA,EAAgB,EAAE,CAAA,GAAA,CAAK,CAAA;AAClC,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACjB,IAAA,MAAM,KAAK,GAAA,CAAI,EAAA,EAAA;AACf,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAO,QAAA,EAAS,GAAI,IAAA;AAGjC,IAAA,KAAA,CAAM,IAAA,CAAK,GAAA,EAAK,GAAA,EAAK,CAAA,eAAA,EAAkB,EAAE,CAAA,CAAA,CAAG,CAAA;AAG5C,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAGhD,QAAA,IAAI,GAAA,KAAQ,KAAA,IAAS,GAAA,KAAQ,yBAAA,EAA2B;AAGxD,QAAA,MAAM,QAAA,GAAW,OAAO,KAAA,KAAU,UAAA,GAAa,OAAM,GAAI,KAAA;AAEzD,QAAA,MAAM,IAAA,GAAO,UAAA,CAAW,GAAA,EAAK,QAAQ,CAAA;AACrC,QAAA,IAAI,IAAA,KAAS,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAA,MACpC;AAAA,IACF;AAGA,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAG,MAAA;AAAA,IAAQ;AAEzD,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AAGd,IAAA,IAAI,KAAA,GAAQ,yBAAyB,CAAA,EAAG;AACtC,MAAA,MAAM,GAAA,GAAM,MAAM,yBAAyB,CAAA;AAC3C,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,IAAA,IAAQ,YAAY,GAAA,EAAK;AAC7D,QAAA,MAAM,OAAQ,GAAA,CAA4B,MAAA;AAC1C,QAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,UAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,QACjB,CAAA,MAAO;AACL,UAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,QAC1E;AAAA,MACF,CAAA,MAAO;AACL,QAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA,MAAO;AAEL,MAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,QAAA,sBAAA,CAAuB,KAAA,EAAO,OAAO,GAAG,CAAA;AAAA,MAC1C;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AACzB,IAAA;AAAA,EACF;AAGA,EAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACrC;;;ACjTO,SAAS,UAAa,OAAA,EAAiD;AAC5E,EAAA,IAAI,KAAA,GAAQ,OAAA;AACZ,EAAA,OAAO,CAAC,MAAM,KAAA,EAAO,CAAC,CAAA,KAAM;AAAE,IAAA,KAAA,GAAQ,CAAA;AAAA,EAAG,CAAC,CAAA;AAC5C;AAEO,SAAS,YAAe,EAAA,EAAsB;AACnD,EAAA,OAAO,EAAA;AACT;;;ACMO,SAAS,aAAA,GAAwB;AACtC,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAA,CAAA;AAUT;AASA,SAAS,kBAAkB,GAAA,EAAsB;AAC/C,EAAA,OAAO,KAAK,SAAA,CAAU,GAAG,EACtB,OAAA,CAAQ,IAAA,EAAM,SAAS,CAAA,CACvB,OAAA,CAAQ,IAAA,EAAM,SAAS,EACvB,OAAA,CAAQ,SAAA,EAAW,SAAS,CAAA,CAC5B,OAAA,CAAQ,WAAW,SAAS,CAAA;AACjC;AAMO,SAAS,UAAA,CAAW,IAAY,IAAA,EAAsB;AAG3D,EAAA,OAAO,uBAAuB,iBAAA,CAAkB,EAAE,CAAC,CAAA,CAAA,EAAI,iBAAA,CAAkB,IAAI,CAAC,CAAA,UAAA,CAAA;AAChF;;;AChBA,SAAS,UAAA,CAAW,MAAe,KAAA,EAAuB;AACxD,EAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,IAAA,KAAS,IAAA,IAAQ,SAAS,KAAA,EAAO;AACrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AACtE,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAClE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAAE,IAAA,UAAA,CAAW,IAAA,IAAQ,KAAK,CAAA;AAAG,IAAA;AAAA,EAAQ;AACrE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,EAAM,UAAA,CAAW,KAAA,EAAO,KAAK,CAAA;AACjD,IAAA;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACjB,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAO,QAAA,EAAS,GAAI,IAAA;AACjC,IAAA,KAAA,CAAM,IAAA,CAAK,KAAK,GAAG,CAAA;AACnB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,QAAA,IAAI,GAAA,KAAQ,KAAA,IAAS,GAAA,KAAQ,yBAAA,EAA2B;AACxD,QAAA,MAAM,QAAA,GAAW,OAAO,KAAA,KAAU,UAAA,GAAa,OAAM,GAAI,KAAA;AACzD,QAAA,MAAM,IAAA,GAAO,UAAA,CAAW,GAAA,EAAK,QAAQ,CAAA;AACrC,QAAA,IAAI,IAAA,KAAS,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAA,MACpC;AAAA,IACF;AACA,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAG,MAAA;AAAA,IAAQ;AACzD,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AACd,IAAA,IAAI,KAAA,GAAQ,yBAAyB,CAAA,EAAG;AACtC,MAAA,MAAM,GAAA,GAAM,MAAM,yBAAyB,CAAA;AAC3C,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,IAAA,IAAQ,EAAE,QAAA,IAAY,GAAA,CAAA,IAAQ,OAAQ,GAAA,CAA4B,MAAA,KAAW,QAAA,EAAU;AAC3H,QAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,MAC1E;AACA,MAAA,KAAA,CAAM,IAAA,CAAM,IAA2B,MAAM,CAAA;AAAA,IAC/C,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,KAAA,IAAS,QAAA,EAAU,UAAA,CAAW,KAAA,EAAO,KAAK,CAAA;AAAA,IACvD;AACA,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACrC;AAmBA,SAAS,gBAAgB,CAAA,EAAgC;AACvD,EAAA,OAAO,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,GAAA,KAAQ,gBAAA;AACjC;AAKO,SAAS,UAAA,CAAW,UAAmB,aAAA,EAAsD;AAClG,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,gBAAA;AAAA,IACL,KAAA,EAAO,EAAE,QAAA,EAAS;AAAA,IAClB,QAAA,EAAU,CAAC,aAAa;AAAA,GAC1B;AACF;AA6CA,gBAAuB,iBAAA,CACrB,MACA,OAAA,EACwB;AAExB,EAAA,MAAM,KAAA,GAAqB;AAAA,IACzB,eAAA,EAAiB,CAAA;AAAA,IACjB,mBAAmB;AAAC,GACtB;AAEA,EAAA,MAAM,UAAA,GAAa,SAAS,gBAAA,KAAqB,KAAA;AAGjD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,aAAA,EAAc;AAAA,EACtB;AAGA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,gBAAA,CAAiB,IAAA,EAAM,WAAW,KAAK,CAAA;AACvC,EAAA,MAAM,SAAA,CAAU,KAAK,EAAE,CAAA;AAGvB,EAAA,IAAI,SAAS,eAAA,EAAiB;AAC5B,IAAA,MAAM,OAAA,CAAQ,eAAA;AAAA,EAChB;AAIA,EAAA,OAAO,KAAA,CAAM,iBAAA,CAAkB,MAAA,GAAS,CAAA,EAAG;AACzC,IAAA,MAAM,OAAA,GAAU,CAAC,GAAG,KAAA,CAAM,iBAAiB,CAAA;AAC3C,IAAA,KAAA,CAAM,oBAAoB,EAAC;AAG3B,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA;AAAA,MAC5B,OAAA,CAAQ,GAAA,CAAI,OAAO,QAAA,KAAa;AAC9B,QAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAA;AAC5B,QAAA,OAAO,EAAE,EAAA,EAAI,QAAA,CAAS,EAAA,EAAI,IAAA,EAAK;AAAA,MACjC,CAAC;AAAA,KACH;AAEA,IAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,MAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,QAAA,MAAM,WAAW,MAAA,CAAO,KAAA,CAAM,EAAA,EAAI,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,MACrD;AAAA,IAEF;AAAA,EACF;AACF;AAMA,SAAS,gBAAA,CAAiB,IAAA,EAAe,KAAA,EAAiB,KAAA,EAA0B;AAClF,EAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,IAAA,KAAS,IAAA,IAAQ,SAAS,KAAA,EAAO;AACrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AACtE,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAAE,IAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAG,IAAA;AAAA,EAAQ;AAClE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAAE,IAAA,gBAAA,CAAiB,IAAA,EAAK,EAAG,KAAA,EAAO,KAAK,CAAA;AAAG,IAAA;AAAA,EAAQ;AAClF,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,EAAM,gBAAA,CAAiB,KAAA,EAAO,OAAO,KAAK,CAAA;AAC9D,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,eAAA,CAAgB,IAAI,CAAA,EAAG;AACzB,IAAA,MAAM,EAAA,GAAK,CAAA,QAAA,EAAW,KAAA,CAAM,eAAA,EAAiB,CAAA,CAAA;AAC7C,IAAA,MAAM,QAAA,GAAW,KAAK,KAAA,CAAM,QAAA;AAC5B,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,CAAC,CAAA;AAG/B,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,SAAA,EAAY,EAAE,CAAA,2BAAA,CAA6B,CAAA;AACtD,IAAA,UAAA,CAAW,UAAU,KAAK,CAAA;AAC1B,IAAA,KAAA,CAAM,KAAK,QAAQ,CAAA;AAGnB,IAAA,MAAM,OAAA,GAAU,OAAA,EAAQ,CAAE,IAAA,CAAK,CAAC,QAAA,KAAsB;AACpD,MAAA,MAAM,gBAA0B,EAAC;AACjC,MAAA,UAAA,CAAW,UAAU,aAAa,CAAA;AAClC,MAAA,OAAO,aAAA,CAAc,KAAK,EAAE,CAAA;AAAA,IAC9B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,iBAAA,CAAkB,IAAA,CAAK,EAAE,EAAA,EAAI,SAAS,CAAA;AAC5C,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACjB,IAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAO,QAAA,EAAS,GAAI,IAAA;AACjC,IAAA,KAAA,CAAM,IAAA,CAAK,KAAK,GAAG,CAAA;AACnB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,QAAA,IAAI,QAAQ,UAAA,EAAY;AACxB,QAAA,IAAI,GAAA,KAAQ,KAAA,IAAS,GAAA,KAAQ,yBAAA,EAA2B;AACxD,QAAA,MAAM,QAAA,GAAW,OAAO,KAAA,KAAU,UAAA,GAAa,OAAM,GAAI,KAAA;AACzD,QAAA,MAAM,IAAA,GAAO,UAAA,CAAW,GAAA,EAAK,QAAQ,CAAA;AACrC,QAAA,IAAI,IAAA,KAAS,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAA,MACpC;AAAA,IACF;AACA,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAG,MAAA;AAAA,IAAQ;AACzD,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AACd,IAAA,IAAI,KAAA,GAAQ,yBAAyB,CAAA,EAAG;AACtC,MAAA,MAAM,GAAA,GAAM,MAAM,yBAAyB,CAAA;AAC3C,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,IAAA,IAAQ,EAAE,QAAA,IAAY,GAAA,CAAA,IAAQ,OAAQ,GAAA,CAA4B,MAAA,KAAW,QAAA,EAAU;AAC3H,QAAA,MAAM,IAAI,UAAU,oDAAoD,CAAA;AAAA,MAC1E;AACA,MAAA,KAAA,CAAM,IAAA,CAAM,IAA2B,MAAM,CAAA;AAAA,IAC/C,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,KAAA,IAAS,QAAA,EAAU,gBAAA,CAAiB,KAAA,EAAO,OAAO,KAAK,CAAA;AAAA,IACpE;AACA,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AACzB,IAAA;AAAA,EACF;AAEA,EAAA,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACrC","file":"index.cjs","sourcesContent":["// Void elements that don't have closing tags\nexport const VOID_ELEMENTS = new Set([\n  'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input',\n  'link', 'meta', 'param', 'source', 'track', 'wbr',\n]);\n\n// Map of prop names to HTML attribute names\nexport const PROP_TO_ATTR: Record<string, string> = {\n  className: 'class',\n  htmlFor: 'for',\n  tabIndex: 'tabindex',\n};\n\n// Escape HTML entities\nexport function escapeHtml(str: string): string {\n  return str\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#x27;');\n}\n\n// Escape attribute values\nexport function escapeAttr(str: string): string {\n  return str\n    .replace(/&/g, '&amp;')\n    .replace(/\"/g, '&quot;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/'/g, '&#39;');\n}\n\nimport { isDangerousUrl, isUrlAttr, isEventHandlerAttr, isSafeAttrName } from '../security/url-safety.js';\n\n// Dangerous URI detection for href, src, action, formaction attributes.\n// Retained for backwards compatibility with external importers; the actual\n// scheme check now goes through `isDangerousUrl`, which additionally strips the\n// control characters browsers ignore in a URL scheme (see security/url-safety).\nexport const DANGEROUS_URI_ATTRS = new Set(['href', 'src', 'action', 'formaction']);\nexport const DANGEROUS_URI_RE = /^\\s*(javascript|vbscript|data\\s*:\\s*text\\/html)/i;\n\n/**\n * Decide whether a resolved prop should be emitted as an attribute, and return\n * the escaped `name=\"value\"` fragment (or `name` for boolean `true`). Returns\n * null when the attribute must be dropped for safety. Shared by the plain and\n * hydration-aware renderers so the security rules cannot drift apart.\n */\nexport function renderAttr(key: string, resolved: unknown): string | null {\n  const attrName = PROP_TO_ATTR[key] ?? key;\n  // Never emit event-handler or malformed attribute names — an attacker who\n  // controls a prop key could otherwise inject `onload=…` or break out of the\n  // attribute entirely with whitespace/quotes.\n  if (isEventHandlerAttr(attrName) || !isSafeAttrName(attrName)) return null;\n  if (resolved === true) return ' ' + attrName;\n  if (resolved === false || resolved == null) return null;\n  const str = String(resolved);\n  if (isUrlAttr(attrName) && isDangerousUrl(str)) return null;\n  return ' ' + attrName + '=\"' + escapeAttr(str) + '\"';\n}\n\nexport interface VNode {\n  tag: string;\n  props: Record<string, unknown> | null;\n  children: unknown[];\n}\n\n/**\n * Server-side hyperscript — creates a virtual node instead of a DOM element.\n */\nexport function sh(tag: string, props?: Record<string, unknown> | null, ...children: unknown[]): VNode {\n  return { tag, props: props ?? null, children };\n}\n\n/**\n * Render a FormaJS virtual tree to an HTML string.\n *\n * Uses an array buffer internally to avoid O(n^2) string concatenation\n * for large trees, then joins once at the end.\n *\n * Usage:\n * ```ts\n * import { renderToString, sh } from '@getforma/core/ssr';\n *\n * const html = renderToString(\n *   sh('div', { class: 'app' },\n *     sh('h1', null, 'Hello SSR!'),\n *     sh('p', null, () => count()),  // signal getters resolved synchronously\n *   )\n * );\n * ```\n */\nexport function renderToString(node: unknown): string {\n  const parts: string[] = [];\n  renderToBuffer(node, parts);\n  return parts.join('');\n}\n\n/**\n * Internal: recursively render into a string array buffer.\n * Avoids O(n^2) string concatenation for large trees.\n */\nfunction renderToBuffer(node: unknown, parts: string[]): void {\n  // null/undefined/boolean → empty\n  if (node == null || node === true || node === false) return;\n\n  // String → escaped text\n  if (typeof node === 'string') { parts.push(escapeHtml(node)); return; }\n\n  // Number → stringified\n  if (typeof node === 'number') { parts.push(String(node)); return; }\n\n  // Function (signal getter) → resolve and render\n  if (typeof node === 'function') { renderToBuffer(node(), parts); return; }\n\n  // Array → render each\n  if (Array.isArray(node)) {\n    for (const child of node) renderToBuffer(child, parts);\n    return;\n  }\n\n  // VNode\n  if (isVNode(node)) {\n    const { tag, props, children } = node;\n    parts.push('<', tag);\n\n    // Render props as attributes\n    if (props) {\n      for (const [key, value] of Object.entries(props)) {\n        // Skip refs and internal props; event handlers and unsafe attribute\n        // names are dropped inside renderAttr.\n        if (key === 'ref' || key === 'dangerouslySetInnerHTML') continue;\n\n        // Resolve reactive values\n        const resolved = typeof value === 'function' ? value() : value;\n\n        const frag = renderAttr(key, resolved);\n        if (frag !== null) parts.push(frag);\n      }\n    }\n\n    // Void elements\n    if (VOID_ELEMENTS.has(tag)) { parts.push(' />'); return; }\n\n    parts.push('>');\n\n    // dangerouslySetInnerHTML\n    if (props?.['dangerouslySetInnerHTML']) {\n      const raw = props['dangerouslySetInnerHTML'];\n      if (typeof raw === 'object' && raw != null && '__html' in raw) {\n        const html = (raw as { __html: unknown }).__html;\n        if (typeof html === 'string') {\n          parts.push(html);\n        } else {\n          throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n        }\n      } else {\n        throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n      }\n    } else {\n      // Render children\n      for (const child of children) {\n        renderToBuffer(child, parts);\n      }\n    }\n\n    parts.push('</', tag, '>');\n    return;\n  }\n\n  // Fallback: stringify\n  parts.push(escapeHtml(String(node)));\n}\n\nexport function isVNode(v: unknown): v is VNode {\n  return v != null && typeof v === 'object' && 'tag' in v && 'children' in v;\n}\n\n// ---------------------------------------------------------------------------\n// Hydration-aware rendering\n// ---------------------------------------------------------------------------\n\n/** Per-render hydration context — avoids shared module-level counter. */\ninterface HydrationContext {\n  id: number;\n}\n\n/**\n * Render a FormaJS virtual tree to an HTML string with hydration markers.\n *\n * Like `renderToString`, but injects comment markers and `data-forma-h`\n * attributes so the client-side `hydrate()` function can adopt existing\n * DOM nodes without re-creating them.\n *\n * Each call creates its own hydration counter, so concurrent calls\n * (e.g. multiple SSR requests in the same process) produce independent,\n * non-overlapping hydration IDs.\n *\n * Marker types:\n * - `data-forma-h=\"N\"` — element boundary (attribute on the element)\n * - `<!--forma-t:N-->` / `<!--/forma-t:N-->` — reactive text boundary\n * - `<!--forma-l:N-->` / `<!--/forma-l:N-->` — list boundary\n *\n * Usage:\n * ```ts\n * import { renderToStringWithHydration, sh } from '@getforma/core/ssr';\n *\n * const html = renderToStringWithHydration(\n *   sh('div', { class: 'app' },\n *     sh('h1', null, 'Hello SSR!'),\n *     sh('p', null, () => count()),\n *   )\n * );\n * ```\n */\nexport function renderToStringWithHydration(node: unknown): string {\n  const ctx: HydrationContext = { id: 0 };\n  const parts: string[] = [];\n  renderToBufferHydrated(node, parts, ctx);\n  return parts.join('');\n}\n\n/**\n * Internal: recursively render into a string array buffer with hydration markers.\n * The `ctx` object carries the hydration counter so concurrent renders are isolated.\n */\nfunction renderToBufferHydrated(node: unknown, parts: string[], ctx: HydrationContext): void {\n  // null/undefined/boolean → empty\n  if (node == null || node === true || node === false) return;\n\n  // String → escaped text\n  if (typeof node === 'string') { parts.push(escapeHtml(node)); return; }\n\n  // Number → stringified\n  if (typeof node === 'number') { parts.push(String(node)); return; }\n\n  // Function (signal getter / reactive text) → wrap with text markers\n  if (typeof node === 'function') {\n    const id = ctx.id++;\n    parts.push(`<!--forma-t:${id}-->`);\n    renderToBufferHydrated(node(), parts, ctx);\n    parts.push(`<!--/forma-t:${id}-->`);\n    return;\n  }\n\n  // Array → wrap with list markers\n  if (Array.isArray(node)) {\n    const id = ctx.id++;\n    parts.push(`<!--forma-l:${id}-->`);\n    for (const child of node) renderToBufferHydrated(child, parts, ctx);\n    parts.push(`<!--/forma-l:${id}-->`);\n    return;\n  }\n\n  // VNode\n  if (isVNode(node)) {\n    const id = ctx.id++;\n    const { tag, props, children } = node;\n\n    // Add hydration data-attribute to element\n    parts.push('<', tag, ` data-forma-h=\"${id}\"`);\n\n    // Render props as attributes\n    if (props) {\n      for (const [key, value] of Object.entries(props)) {\n        // Skip refs and internal props; event handlers and unsafe attribute\n        // names are dropped inside renderAttr.\n        if (key === 'ref' || key === 'dangerouslySetInnerHTML') continue;\n\n        // Resolve reactive values\n        const resolved = typeof value === 'function' ? value() : value;\n\n        const frag = renderAttr(key, resolved);\n        if (frag !== null) parts.push(frag);\n      }\n    }\n\n    // Void elements\n    if (VOID_ELEMENTS.has(tag)) { parts.push(' />'); return; }\n\n    parts.push('>');\n\n    // dangerouslySetInnerHTML\n    if (props?.['dangerouslySetInnerHTML']) {\n      const raw = props['dangerouslySetInnerHTML'];\n      if (typeof raw === 'object' && raw != null && '__html' in raw) {\n        const html = (raw as { __html: unknown }).__html;\n        if (typeof html === 'string') {\n          parts.push(html);\n        } else {\n          throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n        }\n      } else {\n        throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n      }\n    } else {\n      // Render children\n      for (const child of children) {\n        renderToBufferHydrated(child, parts, ctx);\n      }\n    }\n\n    parts.push('</', tag, '>');\n    return;\n  }\n\n  // Fallback: stringify\n  parts.push(escapeHtml(String(node)));\n}\n\n","/**\n * SSR-only signal: just a value holder, no reactivity needed on server.\n */\nexport function ssrSignal<T>(initial: T): [get: () => T, set: (v: T) => void] {\n  let value = initial;\n  return [() => value, (v) => { value = v; }];\n}\n\nexport function ssrComputed<T>(fn: () => T): () => T {\n  return fn; // On server, just call the function directly\n}\n","/**\n * FormaJS SSR - Client Swap Script\n *\n * Tiny inline script injected into the HTML stream that handles\n * out-of-order Suspense boundary resolution.\n *\n * When the server resolves a Suspense boundary, it sends:\n *   <script>$FORMA_SWAP(\"forma-s:0\",\"<resolved html>\")</script>\n *\n * This script replaces the fallback placeholder with the resolved content.\n */\n\n/**\n * Returns the client-side swap script as a string, ready to be injected\n * into the HTML stream (typically right after <body> or before first Suspense).\n */\nexport function getSwapScript(): string {\n  return `<script>\nfunction $FORMA_SWAP(id,html){\n  var el=document.getElementById(id);\n  if(el){\n    var tpl=document.createElement('template');\n    tpl.innerHTML=html;\n    el.replaceWith(tpl.content);\n  }\n}\n</script>`;\n}\n\n/**\n * Serializes a value to a JSON string that is safe to embed inside a\n * `<script>` block. Standard `JSON.stringify` does not escape `<` or `>`,\n * so a payload containing `</script>` would prematurely close the script\n * tag, enabling an injection attack. We also escape U+2028 and U+2029\n * which are valid JSON but treated as line terminators in JavaScript source.\n */\nfunction safeJsonStringify(val: unknown): string {\n  return JSON.stringify(val)\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029');\n}\n\n/**\n * Returns a script tag that swaps a specific Suspense boundary's content.\n * Called when an async resource resolves during streaming.\n */\nexport function getSwapTag(id: string, html: string): string {\n  // safeJsonStringify escapes <, >, U+2028, and U+2029 so the serialized\n  // content cannot break out of the surrounding <script> block.\n  return `<script>$FORMA_SWAP(${safeJsonStringify(id)},${safeJsonStringify(html)})</script>`;\n}\n","/**\n * FormaJS SSR - Streaming Renderer\n *\n * Implements true chunked HTML streaming with out-of-order Suspense resolution.\n *\n * How it works:\n * 1. Yields shell HTML immediately (opening tags, head, static content)\n * 2. When a Suspense boundary is encountered:\n *    - Yields the fallback HTML with a placeholder: <div id=\"forma-s:N\" style=\"display:contents\">\n *    - Continues rendering siblings without blocking\n *    - When the async resource resolves, yields a swap script\n * 3. Suspense boundaries resolve independently in any order (out-of-order streaming)\n */\n\nimport { getSwapScript, getSwapTag } from './client-script.js';\nimport { escapeHtml, isVNode, VOID_ELEMENTS, renderAttr, type VNode } from './render.js';\n\n// ---------------------------------------------------------------------------\n// Suspense boundary tracking\n// ---------------------------------------------------------------------------\n\ninterface PendingBoundary {\n  id: string;\n  promise: Promise<string>;\n}\n\n/** Per-render mutable state, scoped to a single renderToStreamNew call. */\ninterface StreamState {\n  suspenseCounter: number;\n  pendingBoundaries: PendingBoundary[];\n}\n\n// ---------------------------------------------------------------------------\n// Synchronous render to buffer (for non-async content)\n// ---------------------------------------------------------------------------\n\nfunction renderSync(node: unknown, parts: string[]): void {\n  if (node == null || node === true || node === false) return;\n  if (typeof node === 'string') { parts.push(escapeHtml(node)); return; }\n  if (typeof node === 'number') { parts.push(String(node)); return; }\n  if (typeof node === 'function') { renderSync(node(), parts); return; }\n  if (Array.isArray(node)) {\n    for (const child of node) renderSync(child, parts);\n    return;\n  }\n  if (isVNode(node)) {\n    const { tag, props, children } = node;\n    parts.push('<', tag);\n    if (props) {\n      for (const [key, value] of Object.entries(props)) {\n        if (key === 'ref' || key === 'dangerouslySetInnerHTML') continue;\n        const resolved = typeof value === 'function' ? value() : value;\n        const frag = renderAttr(key, resolved);\n        if (frag !== null) parts.push(frag);\n      }\n    }\n    if (VOID_ELEMENTS.has(tag)) { parts.push(' />'); return; }\n    parts.push('>');\n    if (props?.['dangerouslySetInnerHTML']) {\n      const raw = props['dangerouslySetInnerHTML'];\n      if (typeof raw !== 'object' || raw == null || !('__html' in raw) || typeof (raw as { __html: unknown }).__html !== 'string') {\n        throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n      }\n      parts.push((raw as { __html: string }).__html);\n    } else {\n      for (const child of children) renderSync(child, parts);\n    }\n    parts.push('</', tag, '>');\n    return;\n  }\n  parts.push(escapeHtml(String(node)));\n}\n\n// ---------------------------------------------------------------------------\n// Suspense VNode detection\n// ---------------------------------------------------------------------------\n\n/**\n * A Suspense boundary VNode has a special shape:\n * { tag: 'forma-suspense', props: { fallback: VNode }, children: [asyncChildren] }\n *\n * Or it can be created via:\n * shSuspense(fallbackVNode, () => asyncContent)\n */\nexport interface SuspenseVNode {\n  tag: 'forma-suspense';\n  props: { fallback: unknown };\n  children: [() => Promise<unknown>];\n}\n\nfunction isSuspenseVNode(v: unknown): v is SuspenseVNode {\n  return isVNode(v) && v.tag === 'forma-suspense';\n}\n\n/**\n * Create a server-side Suspense VNode for streaming SSR.\n */\nexport function shSuspense(fallback: unknown, asyncChildren: () => Promise<unknown>): SuspenseVNode {\n  return {\n    tag: 'forma-suspense',\n    props: { fallback },\n    children: [asyncChildren],\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Streaming renderer\n// ---------------------------------------------------------------------------\n\nexport interface StreamOptions {\n  /** Script to bootstrap the client-side app (e.g. <script src=\"/app.js\"></script>) */\n  bootstrapScript?: string;\n  /** Whether to inject the $FORMA_SWAP client script (default: true) */\n  injectSwapScript?: boolean;\n}\n\n/**\n * Render a FormaJS virtual tree to a stream of HTML chunks.\n *\n * Yields HTML progressively:\n * - Static content is yielded immediately\n * - Suspense boundaries yield their fallback, then resolve later\n * - Resolved Suspense boundaries yield swap scripts\n *\n * Usage:\n * ```ts\n * import { renderToStream, shSuspense, sh } from '@getforma/core/ssr';\n *\n * const stream = renderToStream(\n *   sh('html', null,\n *     sh('body', null,\n *       sh('h1', null, 'Hello'),\n *       shSuspense(\n *         sh('div', null, 'Loading...'),\n *         async () => {\n *           const data = await fetchData();\n *           return sh('div', null, data.name);\n *         },\n *       ),\n *     ),\n *   ),\n * );\n *\n * for await (const chunk of stream) {\n *   response.write(chunk);\n * }\n * ```\n */\nexport async function* renderToStreamNew(\n  node: unknown,\n  options?: StreamOptions,\n): AsyncGenerator<string> {\n  // Per-render state — scoped to this generator invocation\n  const state: StreamState = {\n    suspenseCounter: 0,\n    pendingBoundaries: [],\n  };\n\n  const injectSwap = options?.injectSwapScript !== false;\n\n  // Inject the swap script first (if there could be Suspense boundaries)\n  if (injectSwap) {\n    yield getSwapScript();\n  }\n\n  // Render the main tree synchronously, collecting Suspense boundaries\n  const mainParts: string[] = [];\n  renderStreamNode(node, mainParts, state);\n  yield mainParts.join('');\n\n  // Yield bootstrap script if provided\n  if (options?.bootstrapScript) {\n    yield options.bootstrapScript;\n  }\n\n  // Wait for and yield all pending Suspense boundaries\n  // Each resolves independently (out-of-order)\n  while (state.pendingBoundaries.length > 0) {\n    const pending = [...state.pendingBoundaries];\n    state.pendingBoundaries = [];\n\n    // Race all pending boundaries — yield each as it resolves\n    const results = await Promise.allSettled(\n      pending.map(async (boundary) => {\n        const html = await boundary.promise;\n        return { id: boundary.id, html };\n      }),\n    );\n\n    for (const result of results) {\n      if (result.status === 'fulfilled') {\n        yield getSwapTag(result.value.id, result.value.html);\n      }\n      // On rejection, the fallback stays visible (no swap)\n    }\n  }\n}\n\n/**\n * Render a node synchronously. If a Suspense boundary is encountered,\n * render the fallback inline and queue the async resolution.\n */\nfunction renderStreamNode(node: unknown, parts: string[], state: StreamState): void {\n  if (node == null || node === true || node === false) return;\n  if (typeof node === 'string') { parts.push(escapeHtml(node)); return; }\n  if (typeof node === 'number') { parts.push(String(node)); return; }\n  if (typeof node === 'function') { renderStreamNode(node(), parts, state); return; }\n  if (Array.isArray(node)) {\n    for (const child of node) renderStreamNode(child, parts, state);\n    return;\n  }\n\n  // Suspense boundary: render fallback, queue async resolution\n  if (isSuspenseVNode(node)) {\n    const id = `forma-s:${state.suspenseCounter++}`;\n    const fallback = node.props.fallback;\n    const asyncFn = node.children[0]!;\n\n    // Render fallback inside a replaceable container\n    parts.push(`<div id=\"${id}\" style=\"display:contents\">`);\n    renderSync(fallback, parts);\n    parts.push('</div>');\n\n    // Queue the async resolution\n    const promise = asyncFn().then((resolved: unknown) => {\n      const resolvedParts: string[] = [];\n      renderSync(resolved, resolvedParts);\n      return resolvedParts.join('');\n    });\n    state.pendingBoundaries.push({ id, promise });\n    return;\n  }\n\n  // Regular VNode\n  if (isVNode(node)) {\n    const { tag, props, children } = node;\n    parts.push('<', tag);\n    if (props) {\n      for (const [key, value] of Object.entries(props)) {\n        if (key === 'fallback') continue; // skip internal suspense props\n        if (key === 'ref' || key === 'dangerouslySetInnerHTML') continue;\n        const resolved = typeof value === 'function' ? value() : value;\n        const frag = renderAttr(key, resolved);\n        if (frag !== null) parts.push(frag);\n      }\n    }\n    if (VOID_ELEMENTS.has(tag)) { parts.push(' />'); return; }\n    parts.push('>');\n    if (props?.['dangerouslySetInnerHTML']) {\n      const raw = props['dangerouslySetInnerHTML'];\n      if (typeof raw !== 'object' || raw == null || !('__html' in raw) || typeof (raw as { __html: unknown }).__html !== 'string') {\n        throw new TypeError('dangerouslySetInnerHTML must be { __html: string }');\n      }\n      parts.push((raw as { __html: string }).__html);\n    } else {\n      for (const child of children) renderStreamNode(child, parts, state);\n    }\n    parts.push('</', tag, '>');\n    return;\n  }\n\n  parts.push(escapeHtml(String(node)));\n}\n"]}

package/dist/ssr/index.js

@@ -1,3 +1,5 @@
+import { isEventHandlerAttr, isSafeAttrName, isUrlAttr, isDangerousUrl } from '../chunk-2QQBKQIF.js';
+
 // src/ssr/render.ts
 var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "area",
@@ -26,8 +28,15 @@ function escapeHtml(str) {
 function escapeAttr(str) {
   return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/'/g, "&#39;");
 }
-var DANGEROUS_URI_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction"]);
-var DANGEROUS_URI_RE = /^\s*(javascript|vbscript|data\s*:\s*text\/html)/i;
+function renderAttr(key, resolved) {
+  const attrName = PROP_TO_ATTR[key] ?? key;
+  if (isEventHandlerAttr(attrName) || !isSafeAttrName(attrName)) return null;
+  if (resolved === true) return " " + attrName;
+  if (resolved === false || resolved == null) return null;
+  const str = String(resolved);
+  if (isUrlAttr(attrName) && isDangerousUrl(str)) return null;
+  return " " + attrName + '="' + escapeAttr(str) + '"';
+}
 function sh(tag, props, ...children) {
   return { tag, props: props ?? null, children };
 }
@@ -59,17 +68,10 @@ function renderToBuffer(node, parts) {
     parts.push("<", tag);
     if (props) {
       for (const [key, value] of Object.entries(props)) {
-        if (key.startsWith("on") || key === "ref" || key === "dangerouslySetInnerHTML") continue;
-        const attrName = PROP_TO_ATTR[key] ?? key;
+        if (key === "ref" || key === "dangerouslySetInnerHTML") continue;
         const resolved = typeof value === "function" ? value() : value;
-        if (resolved === true) {
-          parts.push(" ", attrName);
-        } else if (resolved !== false && resolved != null) {
-          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === "string" && DANGEROUS_URI_RE.test(resolved)) {
-            continue;
-          }
-          parts.push(" ", attrName, '="', escapeAttr(String(resolved)), '"');
-        }
+        const frag = renderAttr(key, resolved);
+        if (frag !== null) parts.push(frag);
       }
     }
     if (VOID_ELEMENTS.has(tag)) {
@@ -138,17 +140,10 @@ function renderToBufferHydrated(node, parts, ctx) {
     parts.push("<", tag, ` data-forma-h="${id}"`);
     if (props) {
       for (const [key, value] of Object.entries(props)) {
-        if (key.startsWith("on") || key === "ref" || key === "dangerouslySetInnerHTML") continue;
-        const attrName = PROP_TO_ATTR[key] ?? key;
+        if (key === "ref" || key === "dangerouslySetInnerHTML") continue;
         const resolved = typeof value === "function" ? value() : value;
-        if (resolved === true) {
-          parts.push(" ", attrName);
-        } else if (resolved !== false && resolved != null) {
-          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === "string" && DANGEROUS_URI_RE.test(resolved)) {
-            continue;
-          }
-          parts.push(" ", attrName, '="', escapeAttr(String(resolved)), '"');
-        }
+        const frag = renderAttr(key, resolved);
+        if (frag !== null) parts.push(frag);
       }
     }
     if (VOID_ELEMENTS.has(tag)) {
@@ -234,17 +229,10 @@ function renderSync(node, parts) {
     parts.push("<", tag);
     if (props) {
       for (const [key, value] of Object.entries(props)) {
-        if (key.startsWith("on") || key === "ref" || key === "dangerouslySetInnerHTML") continue;
-        const attrName = PROP_TO_ATTR[key] ?? key;
+        if (key === "ref" || key === "dangerouslySetInnerHTML") continue;
         const resolved = typeof value === "function" ? value() : value;
-        if (resolved === true) {
-          parts.push(" ", attrName);
-        } else if (resolved !== false && resolved != null) {
-          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === "string" && DANGEROUS_URI_RE.test(resolved)) {
-            continue;
-          }
-          parts.push(" ", attrName, '="', escapeAttr(String(resolved)), '"');
-        }
+        const frag = renderAttr(key, resolved);
+        if (frag !== null) parts.push(frag);
       }
     }
     if (VOID_ELEMENTS.has(tag)) {
@@ -346,17 +334,10 @@ function renderStreamNode(node, parts, state) {
     if (props) {
       for (const [key, value] of Object.entries(props)) {
         if (key === "fallback") continue;
-        if (key.startsWith("on") || key === "ref" || key === "dangerouslySetInnerHTML") continue;
-        const attrName = PROP_TO_ATTR[key] ?? key;
+        if (key === "ref" || key === "dangerouslySetInnerHTML") continue;
         const resolved = typeof value === "function" ? value() : value;
-        if (resolved === true) {
-          parts.push(" ", attrName);
-        } else if (resolved !== false && resolved != null) {
-          if (DANGEROUS_URI_ATTRS.has(attrName) && typeof resolved === "string" && DANGEROUS_URI_RE.test(resolved)) {
-            continue;
-          }
-          parts.push(" ", attrName, '="', escapeAttr(String(resolved)), '"');
-        }
+        const frag = renderAttr(key, resolved);
+        if (frag !== null) parts.push(frag);
       }
     }
     if (VOID_ELEMENTS.has(tag)) {