@nifrajs/web 2.5.0 → 2.6.1

package/src/fonts-google.ts

@@ -212,30 +212,87 @@ export function googleFontsCssUrl(options: GoogleFontOptions): string {
   return `${CSS2_ENDPOINT}?${params.join("&")}`
 }
 
-const FACE_RE = /(?:\/\*([^*]*)\*\/\s*)?@font-face\s*\{([^}]*)\}/g
-const SRC_RE = /url\(\s*(['"]?)([^'")]+)\1\s*\)(?:\s*format\(\s*(['"]?)([^'")]+)\3\s*\))?/g
+// The stylesheet is REMOTE input (Google's CDN, but still an upstream), so the whole parse is
+// forward index scans - no unanchored regex runs on it, and no shape can backtrack polynomially on
+// an adversarial response.
+
+/** The `/* subset *​/` label immediately preceding a `@font-face` block (only whitespace between),
+ * scanned by index in the gap since the previous block. */
+function subsetLabelBefore(css: string, faceStart: number, prevEnd: number): string | undefined {
+  const between = css.slice(prevEnd, faceStart)
+  const open = between.lastIndexOf("/*")
+  if (open === -1) return undefined
+  const close = between.indexOf("*/", open + 2)
+  if (close === -1 || between.slice(close + 2).trim() !== "") return undefined
+  return between.slice(open + 2, close)
+}
 
+/** The value of `prop: value;` inside a declaration body, by case-insensitive index scan. */
 function declOf(body: string, prop: string): string | undefined {
-  const m = body.match(new RegExp(`${prop}\\s*:\\s*([^;]+);`, "i"))
-  return m?.[1]?.trim()
+  const lower = body.toLowerCase()
+  const needle = prop.toLowerCase()
+  for (let at = lower.indexOf(needle); at !== -1; at = lower.indexOf(needle, at + 1)) {
+    let i = at + needle.length
+    while (i < body.length && (body[i] === " " || body[i] === "\t" || body[i] === "\n")) i++
+    if (body[i] !== ":") continue
+    i++
+    const end = body.indexOf(";", i)
+    if (end === -1) continue // unterminated declaration - same as the semicolon-requiring regex
+    return body.slice(i, end).trim()
+  }
+  return undefined
+}
+
+/** Strip one level of matching quotes. */
+function unquote(value: string): string {
+  const first = value[0]
+  return (first === '"' || first === "'") && value.endsWith(first) && value.length > 1
+    ? value.slice(1, -1)
+    : value
+}
+
+/** Every `url(…)` (with optional trailing `format(…)`) in a declaration body, by index scan. */
+function parseSrc(body: string): { url: string; format?: string }[] {
+  const src: { url: string; format?: string }[] = []
+  for (let at = body.indexOf("url("); at !== -1; at = body.indexOf("url(", at + 1)) {
+    const close = body.indexOf(")", at + 4)
+    if (close === -1) break
+    const url = unquote(body.slice(at + 4, close).trim())
+    if (url === "") continue
+    let cursor = close + 1
+    while (cursor < body.length && (body[cursor] === " " || body[cursor] === "\t")) cursor++
+    let format: string | undefined
+    if (body.startsWith("format(", cursor)) {
+      const formatClose = body.indexOf(")", cursor + 7)
+      if (formatClose !== -1) format = unquote(body.slice(cursor + 7, formatClose).trim())
+    }
+    src.push(format === undefined || format === "" ? { url } : { url, format })
+  }
+  return src
 }
 
 /** Parse Google's stylesheet into structured faces, capturing the `/* subset *​/` label that precedes
  * each `@font-face`. Pure - exported so callers can run their own download/write pipeline. */
 export function parseGoogleFontCss(css: string): ParsedFontFace[] {
   const faces: ParsedFontFace[] = []
-  for (const match of css.matchAll(FACE_RE)) {
-    const subset = (match[1] ?? "").trim() || "default"
-    const body = match[2] ?? ""
+  let prevEnd = 0
+  // The next-`{` position is memoized: without it, a crafted response of N at-rules ahead of one
+  // late brace re-scans for that brace N times - the quadratic shape this parser exists to avoid.
+  let openMemo = -1
+  for (let at = css.indexOf("@font-face"); at !== -1; at = css.indexOf("@font-face", at + 1)) {
+    if (openMemo < at + 10) openMemo = css.indexOf("{", at + 10)
+    const open = openMemo
+    if (open === -1) break
+    if (css.slice(at + 10, open).trim() !== "") continue // not this at-rule's block
+    const closeBrace = css.indexOf("}", open + 1)
+    if (closeBrace === -1) break
+    const subset = (subsetLabelBefore(css, at, prevEnd) ?? "").trim() || "default"
+    prevEnd = closeBrace + 1
+    const body = css.slice(open + 1, closeBrace)
     const familyRaw = declOf(body, "font-family")
     if (familyRaw === undefined) continue
-    const family = familyRaw.replace(/^['"]|['"]$/g, "")
-    const src: { url: string; format?: string }[] = []
-    for (const s of body.matchAll(SRC_RE)) {
-      const url = s[2]
-      if (url === undefined) continue
-      src.push(s[4] === undefined ? { url } : { url, format: s[4] })
-    }
+    const family = unquote(familyRaw)
+    const src = parseSrc(body)
     if (src.length === 0) continue
     const unicodeRange = declOf(body, "unicode-range")
     faces.push({
@@ -316,7 +373,8 @@ export async function loadGoogleFont(
   const family = validateFamily(options.family)
   const fetchImpl = io.fetch ?? fetch
   const writeFile = io.writeFile ?? defaultWriteFile
-  const publicPath = (io.publicPath ?? "/fonts").replace(/\/+$/, "")
+  let publicPath = io.publicPath ?? "/fonts"
+  while (publicPath.endsWith("/")) publicPath = publicPath.slice(0, -1)
   const maxBytes = io.maxBytesPerFile ?? DEFAULT_MAX_FONT_BYTES
   const wantedSubsets = options.subsets?.map(validateSubset)
 

package/src/index.ts

@@ -25,6 +25,7 @@ import {
 } from "./deferred.ts"
 import { isDraftEnabled } from "./draft.ts"
 import { trustedHeadAttributes } from "./internal/head-attributes.ts"
+import { jsStringLiteral } from "./internal/js-string.ts"
 import { EXECUTABLE_SCRIPT_TYPES, INERT_SCRIPT_TYPES } from "./internal/script-types.ts"
 import { ISR_REVALIDATE_HEADER } from "./isr.ts"
 import { generateLlmsTxt } from "./llms-txt.ts"
@@ -478,6 +479,34 @@ export interface RenderPageOptions {
   readonly islandScripts?: readonly string[]
   /** CSP nonce applied to every framework-owned executable script in this document. */
   readonly nonce?: string
+  /**
+   * Advanced: a per-route slot the renderer fills with the request-invariant document pieces (shell
+   * prefix/suffix, tail statics) on the first render and reuses afterwards, skipping their re-assembly.
+   *
+   * Only pass a cache when every shell-shaping input is IDENTICAL across the requests sharing it:
+   * same `head` content (a static meta chain - never a `meta(data)` function), `title`, `styles`,
+   * `preload`, `islandScripts`, `clientEntry`, `rootId`, `hydrate`, and `prerenderedPaths`. Per-request
+   * values (`data`, `params`, `search`, `actionData`, `layoutData`, deferred state) are always assembled
+   * fresh and safe. A per-request `nonce` disables the cache automatically. `createWebApp` wires this
+   * per route, gated on the route + layout metas being static.
+   */
+  readonly assemblyCache?: RenderAssemblyCache
+}
+
+/** The mutable per-route slot {@link RenderPageOptions.assemblyCache} fills. Opaque - create as `{}`. */
+export interface RenderAssemblyCache {
+  /** Shell up to (not including) the deferred-runtime insertion point. */
+  shellPre?: string
+  /** Shell from after the deferred-runtime insertion point through the open `#root` container. */
+  shellPost?: string
+  /** Tail opener: the inline script open tag + the route-id global (before the action global). */
+  tailPre?: string
+  /** Tail mid: the prerendered-paths global (between the action and layout-data globals). */
+  tailMid?: string
+  /** Tail data prefix: the `window.<data global>=` assignment head. */
+  tailData?: string
+  /** Tail from after the serialized data through `</html>`. */
+  tailPost?: string
 }
 
 /**
@@ -554,7 +583,12 @@ export function renderPageResult(options: RenderPageInput): MaybePromise<Rendere
     actionData === undefined
       ? undefined
       : prepareDeferred(actionData, deferred.length + layoutDeferred.length)
-  const allDeferred = [...deferred, ...layoutDeferred, ...(actionSplit ? actionSplit.deferred : [])]
+  // On the common page-only path (no layout loader, no action) reuse `deferred` directly instead of
+  // allocating a fresh spread array every request.
+  const allDeferred =
+    layoutDeferred.length === 0 && actionSplit === undefined
+      ? deferred
+      : [...deferred, ...layoutDeferred, ...(actionSplit ? actionSplit.deferred : [])]
   // Omitted entirely when no layout has a loader - a page-only app emits exactly what it did before.
   const layoutTail =
     options.layoutData === undefined
@@ -568,71 +602,86 @@ export function renderPageResult(options: RenderPageInput): MaybePromise<Rendere
       : `window.${ACTION_GLOBAL}=${serializeData(actionSplit.forClient)};`
   const deferredRuntime =
     allDeferred.length > 0 ? `<script${nonceAttr}>${DEFERRED_RUNTIME}</script>` : ""
-  // Matched-route chunk preloads, concatenated directly (skip the `filter().map()`
-  // intermediate arrays - and the whole loop - on the common no-extra-preload render). De-duped
-  // against the entry, which is preloaded separately below.
-  let preloadLinks = ""
-  if (preload.length > 0) {
+  // The regex only injects the CSP nonce into the (constant) hydration head; with no nonce it's a
+  // no-op that still scans the whole script every request. Skip it on the common no-nonce path.
+  // The request-invariant document pieces. With a caller-supplied per-route cache (and no per-request
+  // nonce, which would bake into them) they're built once and reused; the per-request seams - the
+  // deferred runtime in the shell, the action/layout-data globals and the serialized loader data in
+  // the tail - are always assembled fresh. Byte-identical to building the whole document inline.
+  const slot: RenderAssemblyCache =
+    nonce === undefined && options.assemblyCache !== undefined ? options.assemblyCache : {}
+  if (slot.shellPre === undefined) {
+    // Matched-route chunk preloads, concatenated directly. De-duped against the entry, which is
+    // preloaded separately below.
+    let preloadLinks = ""
     for (const url of preload) {
       if (url !== clientEntry)
         preloadLinks += `<link rel="modulepreload" href="${escapeAttr(url)}">`
     }
+    // The matched route's stylesheets - `<link rel="stylesheet">` in `<head>` so CSS arrives with the
+    // first paint (no FOUC). Render-blocking by design, and emitted regardless of `hydrate` (a static
+    // or `_error` page still wants its styles). In dev (Vite) CSS is injected client-side instead.
+    let styleLinks = ""
+    for (const url of styles) styleLinks += `<link rel="stylesheet" href="${escapeAttr(url)}">`
+    // Island bundles are referenced only by a `<script type="module">` at the END of `<body>`, so the
+    // browser doesn't discover them until the whole page is parsed. `modulepreload` them in `<head>`
+    // so the fetch starts immediately, in parallel with parsing - regardless of `hydrate`.
+    let islandPreloads = ""
+    for (const src of islandScripts)
+      islandPreloads += `<link rel="modulepreload" href="${escapeAttr(src)}">`
+    // Runs in the first-paint→hydration window to swallow a JS-only form's broken native submit. Only
+    // on a hydrating page (a static/_error page has no client handlers, so no footgun).
+    const hydrationGuard = hydrate ? `<script${nonceAttr}>${PRE_HYDRATION_GUARD}</script>` : ""
+    // `<html>` attributes. `lang` defaults to `"en"`; `dir` is omitted entirely when unset, which IS
+    // HTML's `ltr` default. Both attribute-escaped. `client.ts`'s `applyHead` mirrors this exact
+    // defaulting on soft-nav, so a hard load and a client navigation produce the same `<html>`.
+    const htmlAttrs = ` lang="${escapeAttr(head?.lang ?? "en")}"${head?.dir === undefined ? "" : ` dir="${escapeAttr(head.dir)}"`}`
+    // Marks the container for the client entry when the id is not the one the entry falls back to.
+    const rootMarker = rootId === "root" ? "" : ` ${ROOT_ATTRIBUTE}`
+    // A non-hydrated page omits the adapter's hydration bootstrap entirely (Solid's `_$HY` registry
+    // script, etc.) - there is no client takeover to feed, so it's dead bytes on a static document.
+    // The nonce rewrite only runs when a nonce is set; with none it was a whole-string no-op scan.
+    const rawHydrationHead = hydrate ? adapter.hydrationHead(nonce) : ""
+    const hydrationHead =
+      nonce === undefined
+        ? rawHydrationHead
+        : rawHydrationHead.replace(/<script(?![^>]*\bnonce=)(?=[\s>])/g, `<script${nonceAttr}`)
+    // Shell up to the deferred-runtime seam: on a hydrating page that seam sits after the entry +
+    // route-chunk preloads; a non-hydrating page has no runtime insertion at all.
+    const entryPreloads = hydrate
+      ? `<link rel="modulepreload" href="${escapeAttr(clientEntry ?? "")}">${preloadLinks}`
+      : ""
+    slot.shellPre = `<!doctype html><html${htmlAttrs}><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">${hydrationGuard}<title>${escapeHtml(head?.title ?? title)}</title>${headTags(head)}${styleLinks}${entryPreloads}`
+    slot.shellPost = `${islandPreloads}${hydrationHead}</head><body><div id="${escapeAttr(rootId)}"${rootMarker}>`
+    // Island bundles load regardless of `hydrate` - a static page (hydrate:false) ships no framework
+    // client but can still mount no-framework islands (`@nifrajs/web/islands`).
+    let islandTags = ""
+    for (const src of islandScripts)
+      islandTags += `<script type="module" src="${escapeAttr(src)}"${nonceAttr}></script>`
+    if (hydrate) {
+      slot.tailPre = `<script${nonceAttr}>${route}`
+      slot.tailMid = prerendered
+      slot.tailData = `window.${DATA_GLOBAL}=`
+      slot.tailPost = `</script><script type="module" src="${escapeAttr(clientEntry ?? "")}"${nonceAttr}></script>${islandTags}</body></html>`
+    } else {
+      slot.tailPre = ""
+      slot.tailMid = ""
+      slot.tailData = ""
+      slot.tailPost = `${islandTags}</body></html>`
+    }
   }
-  // The matched route's stylesheets - `<link rel="stylesheet">` in `<head>` so CSS arrives with the
-  // first paint (no FOUC). Render-blocking by design, and emitted regardless of `hydrate` (a static or
-  // `_error` page still wants its styles). In dev (Vite) CSS is injected client-side instead, so
-  // `styles` is empty there.
-  let styleLinks = ""
-  for (const url of styles) styleLinks += `<link rel="stylesheet" href="${escapeAttr(url)}">`
-  // Island bundles are referenced only by a `<script type="module">` at the END of `<body>` (below), so
-  // the browser doesn't discover them until the whole page is parsed. `modulepreload` them in `<head>`
-  // so the fetch starts immediately, in parallel with parsing - regardless of `hydrate` (an island page
-  // is typically hydrate:false). Without this, a heavy island bundle on a cold first load leaves its
-  // server-rendered placeholder visible until that late, un-prefetched fetch lands ("stuck loading").
-  let islandPreloads = ""
-  for (const src of islandScripts)
-    islandPreloads += `<link rel="modulepreload" href="${escapeAttr(src)}">`
-  // Shell - flushed before the app finishes rendering: `<head>` (title, meta, hydration head) + the
-  // open container. `modulepreload` of the client entry - plus the matched route's own chunks
-  // (`preloadLinks`) - lets the JS download while the body streams. One template literal (no
-  // intermediate array + `join`) - byte-identical to the prior output.
-  // A non-hydrated page (e.g. an `_error` boundary) omits the client-entry preload, route-chunk
-  // preloads, and deferred runtime - there's no client takeover to feed.
-  const hydrationLinks = hydrate
-    ? `<link rel="modulepreload" href="${escapeAttr(clientEntry ?? "")}">${preloadLinks}${deferredRuntime}`
-    : ""
-  // Runs in the first-paint→hydration window to swallow a JS-only form's broken native submit. Only on a
-  // hydrating page (a static/_error page has no client handlers, so no footgun).
-  const hydrationGuard = hydrate ? `<script${nonceAttr}>${PRE_HYDRATION_GUARD}</script>` : ""
-  // `<html>` attributes. `lang` defaults to `"en"` (so an app that never sets it is byte-identical to
-  // before); `dir` is omitted entirely when unset, which IS HTML's `ltr` default - emitting it
-  // unconditionally would change every existing app's output for no gain. Both attribute-escaped.
-  // `client.ts`'s `applyHead` mirrors this exact defaulting on soft-nav, so a hard load and a client
-  // navigation to the same URL produce the same `<html>` (no drift on a multilingual site).
-  const htmlAttrs = ` lang="${escapeAttr(head?.lang ?? "en")}"${head?.dir === undefined ? "" : ` dir="${escapeAttr(head.dir)}"`}`
-  // Marks the container for the client entry when the id is not the one the entry falls back to. A
-  // static attribute name with no value, so `rootId` never reaches the markup twice and there is
-  // nothing here to escape. Omitted on the default so existing output is unchanged.
-  const rootMarker = rootId === "root" ? "" : ` ${ROOT_ATTRIBUTE}`
-  const hydrationHead = adapter
-    .hydrationHead(nonce)
-    .replace(/<script(?![^>]*\bnonce=)(?=[\s>])/g, `<script${nonceAttr}`)
-  const shellHtml = `<!doctype html><html${htmlAttrs}><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">${hydrationGuard}<title>${escapeHtml(head?.title ?? title)}</title>${headTags(head)}${styleLinks}${hydrationLinks}${islandPreloads}${hydrationHead}</head><body><div id="${escapeAttr(rootId)}"${rootMarker}>`
+  // The deferred runtime rides only on a hydrating page (a static page has no client takeover), and
+  // only when something actually deferred - matching the pre-cache emission exactly.
+  const runtimeSeam = hydrate && allDeferred.length > 0 ? deferredRuntime : ""
+  const shellHtml = `${slot.shellPre}${runtimeSeam}${slot.shellPost}`
   // Closes the hydration container; deferred resolve scripts go AFTER it (outside `#root`) so they
   // aren't part of the adapter's hydrated tree (an inline script inside it breaks hydration).
   const closeRootHtml = "</div>"
   // Tail - the loader-data globals + the client module. Module scripts defer (run after parse), so
   // the data global + every streamed deferred resolution are set before the entry hydrates.
-  // Island bundles load regardless of `hydrate` - a static page (hydrate:false) ships no framework
-  // client but can still mount no-framework islands (`@nifrajs/web/islands`).
-  let islandTags = ""
-  for (const src of islandScripts)
-    islandTags += `<script type="module" src="${escapeAttr(src)}"${nonceAttr}></script>`
-  const tailHtml = `${
-    hydrate
-      ? `<script${nonceAttr}>${route}${action}${prerendered}${layoutTail}window.${DATA_GLOBAL}=${serializeData(forClient)}</script><script type="module" src="${escapeAttr(clientEntry ?? "")}"${nonceAttr}></script>`
-      : ""
-  }${islandTags}</body></html>`
+  const tailHtml = hydrate
+    ? `${slot.tailPre}${action}${slot.tailMid}${layoutTail}${slot.tailData}${serializeData(forClient)}${slot.tailPost}`
+    : (slot.tailPost as string)
   const headers: Record<string, string> = { "content-type": "text/html; charset=utf-8" }
   // Caller-supplied headers (a terminal status page's `cache-control`, say). Applied before the
   // framework's own below, so `content-type` and the ISR channel stay authoritative - a caller must
@@ -1987,6 +2036,30 @@ export function createWebApp<Env = unknown>(
     // A dynamic route whose `getStaticPaths` declared `fallback: "404"` - only its prerendered paths
     // exist; anything else 404s (computed once per route, not per request).
     const is404Fallback = options.staticFallbacks?.[route.pattern] === "404"
+    // Per-route document-assembly cache (see RenderAssemblyCache): filled on the first GET render and
+    // reused while the route + layout MODULE IDENTITIES are unchanged. Attached only when every meta
+    // in the chain is static - a `meta(data)` function makes the head per-request, so those routes
+    // always assemble fresh. A module reload (dev HMR) yields new module objects, dropping the slot.
+    let assemblySlot: RenderAssemblyCache | undefined
+    let assemblySlotMod: unknown
+    let assemblySlotLayouts: LoadedLayoutModules | undefined
+    const assemblyCacheFor = (
+      mod: RouteModule,
+      lms: LoadedLayoutModules,
+    ): { assemblyCache: RenderAssemblyCache } | Record<string, never> => {
+      if (typeof mod.meta === "function") return {}
+      for (const m of lms) if (typeof m.meta === "function") return {}
+      const layoutsUnchanged =
+        assemblySlotLayouts !== undefined &&
+        assemblySlotLayouts.length === lms.length &&
+        assemblySlotLayouts.every((m, i) => m === lms[i])
+      if (assemblySlotMod !== mod || !layoutsUnchanged) {
+        assemblySlot = {}
+        assemblySlotMod = mod
+        assemblySlotLayouts = lms
+      }
+      return { assemblyCache: assemblySlot as RenderAssemblyCache }
+    }
     app.register("GET", route.pattern, undefined, async (c: RouteContext) => {
       // Enforce `fallback: "404"` before any work: an unlisted path under this route doesn't exist.
       // Covers hard navigation directly; a client soft-nav's data fetch gets the 404, throws, and the
@@ -2095,15 +2168,12 @@ export function createWebApp<Env = unknown>(
           headers: { "content-type": "application/x-ndjson; charset=utf-8" },
         })
       }
-      const { chain, head } = resolveChainAndHead(
-        layoutModules ?? (await loadLayoutModules(route)),
-        mod,
-        {
-          data,
-          params: c.params,
-          origin: originOf(c.req),
-        },
-      )
+      const chainLayoutModules = layoutModules ?? (await loadLayoutModules(route))
+      const { chain, head } = resolveChainAndHead(chainLayoutModules, mod, {
+        data,
+        params: c.params,
+        origin: originOf(c.req),
+      })
       const hydrateRoute = mod.hydrate !== false
       try {
         // `await` so a shell-render throw (renderToStream rejects before any byte) is caught here and
@@ -2130,6 +2200,7 @@ export function createWebApp<Env = unknown>(
           ...(mod.revalidate !== undefined ? { revalidate: mod.revalidate } : {}),
           ...(mod.islandScripts !== undefined ? { islandScripts: mod.islandScripts } : {}),
           ...titleOption,
+          ...assemblyCacheFor(mod, chainLayoutModules),
         })
       } catch (err) {
         // Same precedence as the loader catch above - a `meta()` may signal too.
@@ -2309,7 +2380,7 @@ export function generateClientEntry(
   const errorRouteIds: string[] = []
   // Lazy loader returns the raw modules (for both the component chain + the page's `meta` export).
   const lazyLoader = (files: readonly string[]): string => {
-    const imports = files.map((f) => `import(${JSON.stringify(resolve(f))})`).join(", ")
+    const imports = files.map((f) => `import(${jsStringLiteral(resolve(f))})`).join(", ")
     return `() => Promise.all([${imports}])`
   }
   for (const route of manifest.routes) {
@@ -2577,7 +2648,7 @@ export function generateServerManifest(
     // code-splitting bundler, loaded on first request). The map keys are the route-relative paths
     // `buildManifest` expects; the importer it builds calls the per-file loader.
     const loaders = files.map(
-      (file) => `  ${JSON.stringify(file)}: () => import(${JSON.stringify(resolve(file))}),`,
+      (file) => `  ${jsStringLiteral(file)}: () => import(${jsStringLiteral(resolve(file))}),`,
     )
     return `${[
       ...header,

package/src/internal/js-string.ts

@@ -0,0 +1,19 @@
+/**
+ * A JS string literal for embedding a runtime value in GENERATED source. `JSON.stringify` alone is
+ * not a code sanitizer: its output can still contain `<` (so a value holding `</script>` breaks out
+ * of an inline-script embedding of the generated code) and the U+2028/U+2029 line separators (legal
+ * inside JSON strings, line terminators to pre-ES2019 parsers). Escape all three so the emitted
+ * literal is inert in every context the generated source can land in.
+ */
+
+// Built with fromCharCode so this file stays pure ASCII - a literal U+2028/U+2029 in source is
+// invisible in review and one save-with-normalization away from silently vanishing.
+const LINE_SEPARATOR = String.fromCharCode(0x2028)
+const PARAGRAPH_SEPARATOR = String.fromCharCode(0x2029)
+
+export function jsStringLiteral(value: string): string {
+  return JSON.stringify(value)
+    .replaceAll("<", "\\u003C")
+    .replaceAll(LINE_SEPARATOR, "\\u2028")
+    .replaceAll(PARAGRAPH_SEPARATOR, "\\u2029")
+}

package/src/internal/server-boundary.ts

@@ -41,6 +41,8 @@ export const SERVER_FN_MODULE = /\.fn(\.[cm]?[jt]sx?)?$/
  */
 export const SERVER_ONLY_REPLACEMENT = "module.exports = new Proxy({}, { get: () => undefined })"
 
+import { jsStringLiteral } from "./js-string.ts"
+
 const EXPORTED_DECLARATION =
   /\bexport\s+(?:declare\s+)?(?:async\s+)?(?:const|let|var|function|class|enum)\s+([A-Za-z_$][\w$]*)/g
 const EXPORTED_LIST = /\bexport\s*\{([^}]*)\}(?:\s*from\s*["'][^"']+["'])?/g
@@ -57,9 +59,15 @@ export function viteServerOnlyReplacement(source: string): string {
   for (const match of source.matchAll(EXPORTED_DECLARATION)) names.add(match[1] as string)
   for (const match of source.matchAll(EXPORTED_LIST)) {
     for (const raw of (match[1] ?? "").split(",")) {
-      const item = raw.trim().replace(/^type\s+/, "")
+      // Collapse runs of whitespace first (linear), so the ` as ` split below needs no `\s+as\s+`
+      // regex - adjacent unbounded quantifiers around a literal backtrack quadratically on crafted
+      // all-whitespace input.
+      const item = raw
+        .trim()
+        .replace(/\s+/g, " ")
+        .replace(/^type /, "")
       if (item === "") continue
-      const parts = item.split(/\s+as\s+/)
+      const parts = item.split(" as ")
       const exported = (parts[1] ?? parts[0] ?? "").trim()
       if (exported === "default") hasDefault = true
       else if (/^[A-Za-z_$][\w$]*$/.test(exported)) names.add(exported)
@@ -97,8 +105,33 @@ export function viteServerOnlyReplacement(source: string): string {
 const DECLARATION = /^[\t ]*export\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*serverFn\s*\(/gm
 /** Any mention of `serverFn(` as a call, used to prove nothing was missed. */
 const ANY_CALL = /\bserverFn\s*\(/g
-/** Line comments and block comments, stripped before scanning so prose cannot register as code. */
-const COMMENTS = /\/\*[\s\S]*?\*\/|(^|[^:])\/\/.*$/gm
+/** Strip line and block comments by forward index scan, so prose cannot register as code. Not a
+ * regex: every regex shape for comment stripping either backtracks polynomially on adversarial
+ * source or is opaque enough that reviewers cannot tell. A `//` preceded by `:` is kept (URL in a
+ * string - the same heuristic the previous implementation used); an unterminated block comment
+ * swallows the rest of the source, matching a real parser. */
+function stripComments(source: string): string {
+  const parts: string[] = []
+  let keepFrom = 0
+  let i = 0
+  while (i < source.length) {
+    if (source.startsWith("/*", i)) {
+      const close = source.indexOf("*/", i + 2)
+      parts.push(source.slice(keepFrom, i))
+      i = close === -1 ? source.length : close + 2
+      keepFrom = i
+    } else if (source.startsWith("//", i) && source[i - 1] !== ":") {
+      const newline = source.indexOf("\n", i + 2)
+      parts.push(source.slice(keepFrom, i))
+      i = newline === -1 ? source.length : newline // keep the newline itself
+      keepFrom = i
+    } else {
+      i++
+    }
+  }
+  parts.push(source.slice(keepFrom))
+  return parts.join("")
+}
 
 /**
  * The namespace a `*.fn.ts` module is mounted under: its filename without the `.fn` suffix.
@@ -115,7 +148,7 @@ export function serverFnNamespace(filePath: string): string {
 
 /** The server functions a module declares, in source order. */
 export function scanServerFnExports(source: string): string[] {
-  const code = source.replaceAll(COMMENTS, "$1")
+  const code = stripComments(source)
   const names = [...code.matchAll(DECLARATION)].map((m) => m[1] as string)
   const calls = [...code.matchAll(ANY_CALL)].length
   if (calls > names.length) {
@@ -140,10 +173,10 @@ export function scanServerFnExports(source: string): string[] {
 export function generateServerFnStub(source: string, namespace: string): string {
   const names = scanServerFnExports(source)
   const calls = names
-    .map((name) => `export const ${name} = (input) => __nifraCall(${JSON.stringify(name)}, input)`)
+    .map((name) => `export const ${name} = (input) => __nifraCall(${jsStringLiteral(name)}, input)`)
     .join("\n")
   return `// Generated by @nifrajs/web: the server half of this module never reaches the browser.
-const __nifraBase = ${JSON.stringify(`/_nifra/fn/${namespace}`)}
+const __nifraBase = ${jsStringLiteral(`/_nifra/fn/${namespace}`)}
 
 async function __nifraCall(name, input) {
   const response = await fetch(\`\${__nifraBase}/\${name}\`, {

package/src/manifest.ts

@@ -320,7 +320,10 @@ const errorIdFor = (dir: string): string => (dir === "" ? "_error" : `${dir}/_er
  * the last segment.
  */
 /** Every `[…]` marker in a file segment, so a part-literal segment can be spliced into a pattern. */
-const FILE_MARKER = /\[([^\]]*)\]/g
+// `[` is excluded from the inner class as well as `]`: marker names are identifiers, and letting the
+// class swallow `[` makes a run of unclosed brackets backtrack quadratically (each start position
+// re-scans the rest of the segment before failing).
+const FILE_MARKER = /\[([^\][]*)\]/g
 const FILE_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/
 
 /**

package/src/plugins/svg.ts

@@ -77,14 +77,46 @@ export interface SvgToJsxOptions {
   readonly classProp?: string
 }
 
+/**
+ * Strip the XML declaration, comments, and DOCTYPE from an SVG source by index scan. Shared by every
+ * adapter's SVG-component transform instead of chained regex `replace`s, for two reasons: the lazy
+ * `[\s\S]*?` scans backtrack quadratically on an unterminated marker, and sequential single-pass
+ * replaces can splice removed delimiters back together (`<<!---->!DOCTYPE …>` survives them). The
+ * scan removes each block in one forward pass, so neither failure mode exists. An unterminated
+ * marker swallows the rest of the input - the correct reading, matching an XML parser.
+ */
+export function stripSvgPreamble(xml: string): string {
+  const parts: string[] = []
+  let keepFrom = 0
+  let i = 0
+  while (i < xml.length) {
+    let skipEnd = -1
+    if (xml.startsWith("<?", i)) {
+      const close = xml.indexOf("?>", i + 2)
+      skipEnd = close === -1 ? xml.length : close + 2
+    } else if (xml.startsWith("<!--", i)) {
+      const close = xml.indexOf("-->", i + 4)
+      skipEnd = close === -1 ? xml.length : close + 3
+    } else if (xml.slice(i, i + 9).toLowerCase() === "<!doctype") {
+      const close = xml.indexOf(">", i + 9)
+      skipEnd = close === -1 ? xml.length : close + 1
+    }
+    if (skipEnd === -1) {
+      i++
+    } else {
+      parts.push(xml.slice(keepFrom, i))
+      i = skipEnd
+      keepFrom = skipEnd
+    }
+  }
+  parts.push(xml.slice(keepFrom))
+  return parts.join("").trim()
+}
+
 /** Convert an SVG XML string into a JSX-safe `<svg>…</svg>` element with `{...props}` spread on the root. */
 export function svgToJsx(xml: string, options: SvgToJsxOptions = {}): string {
   const classProp = options.classProp ?? "className"
-  let out = xml
-    .replace(/<\?xml[\s\S]*?\?>/g, "") // XML declaration
-    .replace(/<!--[\s\S]*?-->/g, "") // comments
-    .replace(/<!DOCTYPE[^>]*>/gi, "")
-    .trim()
+  let out = stripSvgPreamble(xml)
 
   // Namespaced attributes → camelCase (xlink:href → xlinkHref, xmlns:xlink → xmlnsXlink).
   out = out.replace(/\b([a-z]+):([a-z]+)=/gi, (_m, ns: string, name: string) => {

package/src/prerender.ts

@@ -52,9 +52,17 @@ export interface PrerenderResult {
   readonly fallbacks: Readonly<Record<string, "ssr" | "404">>
 }
 
+/** Strip trailing `/` runs by index scan - an unanchored-start `/\/+$/` replace backtracks
+ * quadratically on a long slash run, and route patterns are input here. */
+function trimTrailingSlashes(path: string): string {
+  let end = path.length
+  while (end > 0 && path.charCodeAt(end - 1) === 47 /* '/' */) end--
+  return path.slice(0, end)
+}
+
 /** Map a route path to its output file: `/` → `index.html`, `/a/b` → `a/b/index.html`. */
 export function htmlFileFor(pattern: string): string {
-  const trimmed = pattern.replace(/^\/+/, "").replace(/\/+$/, "")
+  const trimmed = trimTrailingSlashes(pattern.replace(/^\/+/, ""))
   return trimmed === "" ? "index.html" : `${trimmed}/index.html`
 }
 
@@ -203,7 +211,7 @@ export function cloudflarePagesRoutes(
   const exclude = [...(options.staticGlobs ?? ["/assets/*"])]
   for (const path of options.prerendered) {
     exclude.push(path) // the prerendered document
-    exclude.push(path === "/" ? "/_data.json" : `${path.replace(/\/+$/, "")}/_data.json`) // its data
+    exclude.push(path === "/" ? "/_data.json" : `${trimTrailingSlashes(path)}/_data.json`) // its data
   }
   return { version: 1, include: ["/*"], exclude }
 }

package/src/router.ts

@@ -322,10 +322,18 @@ const readResponseData = (res: Response, signal?: AbortSignal): Promise<unknown>
     ? parseNdjsonData(res.body, signal)
     : res.json()
 
+// Index scan, not `/\/+$/` - the unanchored-start trailing-run replace backtracks quadratically and
+// the pathname is caller-controlled.
+const trimTrailingSlashes = (path: string): string => {
+  let end = path.length
+  while (end > 0 && path.charCodeAt(end - 1) === 47 /* '/' */) end--
+  return path.slice(0, end)
+}
+
 // The static `_data.json` URL for a prerendered path: `/` → `/_data.json`, `/users/7` →
 // `/users/7/_data.json` (mirrors the build's `dataFileFor`).
 const dataUrlFor = (pathname: string): string =>
-  pathname === "/" ? "/_data.json" : `${pathname.replace(/\/+$/, "")}/_data.json`
+  pathname === "/" ? "/_data.json" : `${trimTrailingSlashes(pathname)}/_data.json`
 
 const defaultFetchData: FetchRouteData = async (path, _match, signal, navigation) => {
   // SSG fast path: if this path was prerendered, its loader data is a static file - fetch that (no
@@ -333,7 +341,10 @@ const defaultFetchData: FetchRouteData = async (path, _match, signal, navigation
   // or a stale set), so it's always safe. Non-SSG apps have no global → the dynamic path, unchanged.
   const prerendered = (globalThis as { [PRERENDERED_GLOBAL]?: unknown })[PRERENDERED_GLOBAL]
   if (Array.isArray(prerendered)) {
-    const pathname = path.replace(/[?#].*$/, "")
+    // `search` + `slice` rather than `replace(/[?#].*$/)`: the trailing `.*$` backtracks
+    // quadratically on adversarial input, and the URL is caller-controlled.
+    const cut = path.search(/[?#]/)
+    const pathname = cut === -1 ? path : path.slice(0, cut)
     if (prerendered.includes(pathname)) {
       const staticRes = await fetch(dataUrlFor(pathname), { signal: signal ?? null })
       if (staticRes.ok) return readResponseData(staticRes, signal)

package/src/service-worker.ts

@@ -45,6 +45,8 @@ export interface ServiceWorkerOptions {
 const SW_URL = /^\/[\w\-./@%]*$/
 
 /** A precache URL has to be same-origin, rooted, and free of anything that could break out of a list. */
+import { jsStringLiteral } from "./internal/js-string.ts"
+
 function assertPrecachable(url: string, label: string): void {
   if (typeof url !== "string" || url === "") {
     throw new Error(`[nifra/service-worker] ${label} must be a non-empty string`)
@@ -161,5 +163,5 @@ self.addEventListener("fetch", (event) => {
  */
 export function serviceWorkerRegistration(scriptUrl = "/sw.js"): string {
   assertPrecachable(scriptUrl, "scriptUrl")
-  return `if("serviceWorker"in navigator){addEventListener("load",function(){navigator.serviceWorker.register(${JSON.stringify(scriptUrl)}).catch(function(){})})}`
+  return `if("serviceWorker"in navigator){addEventListener("load",function(){navigator.serviceWorker.register(${jsStringLiteral(scriptUrl)}).catch(function(){})})}`
 }