@pyreon/compiler 0.23.0 → 0.24.0

package/src/jsx.ts

@@ -404,6 +404,35 @@ export function scanCollapsibleSites(
             childrenText: site.childrenText,
             key: rocketstyleCollapseKey(tag, site.props, site.childrenText),
           })
+        } else {
+          // Dynamic-prop fallthrough: if the full detector bailed but
+          // the site matches the ternary-of-two-literals shape, expand
+          // into TWO CollapsibleSite entries — one per literal value.
+          // Each expanded site is byte-identical to a static-collapse
+          // site for that value, so the resolver pre-renders both via
+          // the existing SSR pipeline and the compiler emit looks up
+          // both by their respective keys to build the dispatcher.
+          //
+          // No-handler sites route to `__rsCollapseDyn`; handler-bearing
+          // sites route to `__rsCollapseDynH` (handlers are orthogonal
+          // to the SSR-resolved styler class — see `tryDynamicCollapse`
+          // in this file). The scan does NOT distinguish here because
+          // the resolver only cares about (componentName, props, text);
+          // handlers don't affect the resolution.
+          const dyn = detectDynamicCollapsibleShape(node, tag)
+          if (dyn) {
+            for (const value of [dyn.dynamicProp.valueTruthy, dyn.dynamicProp.valueFalsy]) {
+              const expandedProps = { ...dyn.props, [dyn.dynamicProp.name]: value }
+              out.push({
+                componentName: tag,
+                source: imp.source,
+                importedName: imp.imported,
+                props: expandedProps,
+                childrenText: dyn.childrenText,
+                key: rocketstyleCollapseKey(tag, expandedProps, dyn.childrenText),
+              })
+            }
+          }
         }
       }
     }
@@ -527,6 +556,158 @@ export function detectPartialCollapsibleShape(
   return { props, childrenText: childrenText.trim(), handlers }
 }
 
+/**
+ * A dynamic dimension prop on a collapsible call site. A ConditionalExpression
+ * (ternary) where both branches are string literals — `state={cond ? 'a' : 'b'}`
+ * is the canonical shape. Pre-resolution: the prop's value belongs to the
+ * enumerable set `[valueA, valueB]`. The compiler emits one collapsed
+ * variant per literal value + a dispatcher on the original `cond`.
+ */
+export interface DynamicCollapsibleProp {
+  /** JSX attribute name, e.g. `state`. */
+  name: string
+  /** Source span of the ternary condition (the `cond` part), re-emitted into the runtime dispatcher. */
+  condStart: number
+  condEnd: number
+  /** Literal value for the `cond === truthy` branch (consequent). */
+  valueTruthy: string
+  /** Literal value for the `cond === falsy` branch (alternate). */
+  valueFalsy: string
+}
+
+/**
+ * Dynamic-prop partial-collapse detector — PR 2 of the dynamic-prop
+ * partial-collapse build (`.claude/plans/open-work-2026-q3.md` → #1
+ * dynamic-prop bucket = 15.3% of all real-corpus sites; the next-bigger
+ * bite after the `on*`-handler partial-collapse).
+ *
+ * Mirrors `detectPartialCollapsibleShape`'s "extend the bail catalogue
+ * with ONE relaxation" pattern (see that detector's docstring + `PR 1`
+ * `_rsCollapseDyn` runtime helper, PR #765). The single relaxation: a
+ * `JSXExpressionContainer` wrapping a `ConditionalExpression` whose
+ * `consequent` AND `alternate` are BOTH `StringLiteral` is acceptable as
+ * a "ternary-of-two-literals" dynamic prop — captured as a {@link DynamicCollapsibleProp}
+ * with the cond source span + the two literal values.
+ *
+ * Constraint: **AT MOST ONE** such dynamic prop per site. Multiple
+ * ternaries would compound into a 2^N value-set per site at build time
+ * and an N-axis dispatcher at runtime — that's a separable scope
+ * (potential PR 5+), NOT this PR. Sites with 2+ ternaries bail (return
+ * null), keeping the normal mount; same conservative shape as the rest
+ * of the detector family.
+ *
+ * Constraint: the FULL `on*`-handler relaxation is also folded in — a
+ * site can have ONE ternary AND `on*` handlers in the same call. This
+ * matches the real-corpus shape (a Button with `state={cond ? 'a' : 'b'}`
+ * almost always also has an `onClick`). The two relaxations compose
+ * cleanly because they're orthogonal at the resolver layer (handlers
+ * don't change rendered CSS; the ternary picks among pre-resolved
+ * classes). PR 3's emit will use `_rsCollapseDyn` when handlers are
+ * absent and a future combined helper when both are present — for THIS
+ * PR (detector-only) the structure carries both so PR 3 can dispatch.
+ *
+ * Every OTHER non-literal shape still bails (spread, non-handler
+ * non-ternary `{expr}` prop, multi-literal ternary anywhere, computed-
+ * expression ternary, element/expression child, boolean attr) —
+ * conservative by construction, exactly like the rest of the family.
+ * Returns `null` when there are ZERO ternaries so the on*-only path
+ * (`detectPartialCollapsibleShape`) and the full-collapse path
+ * (`detectCollapsibleShape`) stay byte-unchanged and no detector both
+ * claims the same site.
+ *
+ * A consistency test (PR 3) will lock this catalogue against the
+ * plugin scan, mirroring the `detectCollapsibleShape` ↔ `scanCollapsibleSites`
+ * + `detectPartialCollapsibleShape` ↔ scan invariants — keys cannot drift.
+ */
+export function detectDynamicCollapsibleShape(
+  node: N,
+  _tag: string,
+): {
+  props: Record<string, string>
+  childrenText: string
+  handlers: CollapsibleHandler[]
+  dynamicProp: DynamicCollapsibleProp
+} | null {
+  const props: Record<string, string> = {}
+  const handlers: CollapsibleHandler[] = []
+  const dynamicProps: DynamicCollapsibleProp[] = []
+  for (const attr of jsxAttrs(node)) {
+    if (attr.type !== 'JSXAttribute') return null // spread → bail
+    const nm = attr.name?.type === 'JSXIdentifier' ? attr.name.name : null
+    if (!nm) return null
+    const v = attr.value
+    if (!v) return null // boolean attr → bail
+    const isStr =
+      v.type === 'StringLiteral' || (v.type === 'Literal' && typeof v.value === 'string')
+    if (isStr) {
+      props[nm] = String(v.value)
+      continue
+    }
+    // Non-literal in a `{expr}` container — three possible relaxations:
+    //   (a) `on[A-Z]…` handler with any expression → peeled
+    //   (b) any other prop whose expression is a ternary of two string
+    //       literals → peeled as a DynamicCollapsibleProp
+    //   (c) anything else → bail
+    if (
+      v.type === 'JSXExpressionContainer' &&
+      v.expression &&
+      typeof v.expression.start === 'number' &&
+      typeof v.expression.end === 'number'
+    ) {
+      if (/^on[A-Z]/.test(nm)) {
+        handlers.push({ name: nm, exprStart: v.expression.start, exprEnd: v.expression.end })
+        continue
+      }
+      const expr = v.expression
+      if (
+        expr.type === 'ConditionalExpression' &&
+        expr.test &&
+        typeof expr.test.start === 'number' &&
+        typeof expr.test.end === 'number' &&
+        expr.consequent &&
+        expr.alternate
+      ) {
+        // Both branches must be StringLiteral. We deliberately do NOT
+        // accept TemplateLiteral / `as`-casted literals / any other
+        // shape — keep the static-resolvable set narrow + provable.
+        const isLitStr = (n: unknown): n is { type: 'StringLiteral'; value: string } => {
+          const x = n as { type?: string; value?: unknown }
+          return (
+            x?.type === 'StringLiteral' ||
+            (x?.type === 'Literal' && typeof x.value === 'string')
+          )
+        }
+        if (isLitStr(expr.consequent) && isLitStr(expr.alternate)) {
+          dynamicProps.push({
+            name: nm,
+            condStart: expr.test.start,
+            condEnd: expr.test.end,
+            valueTruthy: String((expr.consequent as { value: string }).value),
+            valueFalsy: String((expr.alternate as { value: string }).value),
+          })
+          continue
+        }
+      }
+    }
+    return null // `{expr}` non-handler non-ternary, or non-literal ternary branch → bail
+  }
+  let childrenText = ''
+  for (const c of jsxChildren(node)) {
+    if (c.type === 'JSXText') childrenText += (c.value ?? '') as string
+    else return null // element / expression child → bail
+  }
+  // Exactly ONE dynamic prop is the scope of this PR. Zero ⇒ defer to
+  // the existing detectors (full / on*-handler partial); 2+ ⇒ bail
+  // (multi-axis combinatorics is a separable scope).
+  if (dynamicProps.length !== 1) return null
+  return {
+    props,
+    childrenText: childrenText.trim(),
+    handlers,
+    dynamicProp: dynamicProps[0]!,
+  }
+}
+
 // ─── Main transform ─────────────────────────────────────────────────────────
 
 export function transformJSX(
@@ -665,6 +846,8 @@ export function transformJSX_JS(
   // ── P0 rocketstyle-collapse state ─────────────────────────────────────────
   let needsCollapse = false
   let needsCollapseH = false
+  let needsCollapseDyn = false
+  let needsCollapseDynH = false
   const collapseRuleKeys = new Set<string>()
   const collapseRules: Array<{ ruleKey: string; rules: string[] }> = []
 
@@ -691,7 +874,11 @@ export function transformJSX_JS(
     // plugin scans with the same predicate, so its resolved `sites`
     // keys match these lookups exactly; no drift possible).
     const shape = detectCollapsibleShape(node, tag)
-    if (!shape) return tryPartialCollapse(node, tag) // PR 3: on*-handler-only fallback
+    // Fallthrough chain — same conservative discipline at each layer:
+    //   1. on*-handler-only partial (literal dim props + handlers)
+    //   2. dynamic-prop partial (ternary-of-two-literals on ≤1 dim prop,
+    //      no handlers — handler-combined dynamic is a future PR's scope)
+    if (!shape) return tryPartialCollapse(node, tag) || tryDynamicCollapse(node, tag)
     const { props, childrenText } = shape
     const key = rocketstyleCollapseKey(tag, props, childrenText)
     const site = cfg.sites.get(key)
@@ -765,6 +952,127 @@ export function transformJSX_JS(
     return true
   }
 
+  /**
+   * PR 3 of the dynamic-prop partial-collapse build (open-work #1
+   * dynamic-prop bucket = 15.3% of all real-corpus sites; the
+   * next-bigger bite after the just-shipped `on*`-handler partial).
+   * The dynamic-prop fallback `tryRocketstyleCollapse` defers to when
+   * BOTH the full and the on*-handler-partial paths bail.
+   *
+   * Same site-resolution contract as the full path — the dynamic prop
+   * is replaced with EACH literal value to compute TWO keys; the
+   * resolver pre-renders both via the existing SSR pipeline; if both
+   * lookups succeed AND the structural template is byte-identical
+   * across values, emit `__rsCollapseDyn(html, [classes...], () =>
+   * cond ? 0 : 1, () => __pyrMode() === "dark")` — the PR 1 runtime
+   * helper (#765) dispatches across `(value × mode)` with a stride-2
+   * value-major class layout.
+   *
+   * Conservative discipline:
+   *   - Either expanded key missing from sites map ⇒ bail (an
+   *     intermittent resolver failure on one value mustn't half-collapse)
+   *   - Divergent template HTML across values ⇒ bail (the dispatcher
+   *     assumes a shared template; deriveCollapseDyn cannot be done
+   *     across values that produce structurally different markup —
+   *     this is the cross-value parallel of `deriveCollapse`'s
+   *     light↔dark template-divergence bail)
+   *
+   * Handler-combined sites: when the detected dynamic site has `on*`
+   * handlers (the most common real-corpus shape — bail-census measured
+   * the no-handler subset at 0.2% of all sites; handler-combined is
+   * the bulk of the 15.4% dynamic-prop bucket), emit
+   * `__rsCollapseDynH(...)` (PR A: runtime helper) instead of
+   * `__rsCollapseDyn(...)`. Handlers are orthogonal to the SSR-
+   * resolved styler class (the resolver pre-renders both values
+   * identically regardless of handlers); the union helper just
+   * re-attaches them through the same canonical `_bindEvent` path
+   * `tryPartialCollapse` uses.
+   *
+   * Rule injection unions the rule sets across both values (each value
+   * may inject distinct CSS rules — e.g. `state="primary"` and
+   * `state="secondary"` produce different background-color rules); the
+   * union is the byte-set the dispatcher will need at runtime regardless
+   * of which value the cond resolves to. Idempotent by per-value
+   * `ruleKey` so a re-resolve / HMR is a no-op.
+   */
+  function tryDynamicCollapse(node: N, tag: string): boolean {
+    const cfg = options.collapseRocketstyle
+    if (!cfg) return false
+    const dyn = detectDynamicCollapsibleShape(node, tag)
+    if (!dyn) return false
+    const { props, childrenText, dynamicProp, handlers } = dyn
+    // Look up BOTH expanded sites (one per literal value). The scan's
+    // dynamic-prop fallthrough (above in this file) emits a CollapsibleSite
+    // for each value with identical key construction, so these lookups
+    // must succeed iff both resolved.
+    const truthyProps = { ...props, [dynamicProp.name]: dynamicProp.valueTruthy }
+    const falsyProps = { ...props, [dynamicProp.name]: dynamicProp.valueFalsy }
+    const truthyKey = rocketstyleCollapseKey(tag, truthyProps, childrenText)
+    const falsyKey = rocketstyleCollapseKey(tag, falsyProps, childrenText)
+    const truthySite = cfg.sites.get(truthyKey)
+    const falsySite = cfg.sites.get(falsyKey)
+    if (!truthySite || !falsySite) return false // half-resolved ⇒ keep normal mount
+    // Cross-value template parity — the dispatcher reuses ONE `_tpl`
+    // across both values; divergent markup means we'd silently pick
+    // the truthy variant's HTML for falsy too. Bail conservatively.
+    if (truthySite.templateHtml !== falsySite.templateHtml) return false
+
+    // Build the stride-2 value-major class array (consumed by
+    // `_rsCollapseDyn`): `[v0_light, v0_dark, v1_light, v1_dark]` where
+    // v0 = truthy (cond → 0), v1 = falsy (cond → 1).
+    const classes = [
+      truthySite.lightClass,
+      truthySite.darkClass,
+      falsySite.lightClass,
+      falsySite.darkClass,
+    ]
+    const condSrc = code.slice(dynamicProp.condStart, dynamicProp.condEnd)
+
+    // Handler-combined sites route to `__rsCollapseDynH(...)` (PR A
+    // runtime helper) — handlers re-attached after the class dispatcher
+    // via the canonical `_bindEvent` path, byte-identical to how
+    // `tryPartialCollapse` re-emits handlers via `__rsCollapseH`.
+    // No-handler sites stay on `__rsCollapseDyn(...)` (lighter — no
+    // handlers parameter, no loop allocation).
+    let call: string
+    if (handlers.length > 0) {
+      const handlerObj =
+        `{ ${handlers
+          .map((h) => `${JSON.stringify(h.name)}: (${code.slice(h.exprStart, h.exprEnd)})`)
+          .join(', ')} }`
+      call =
+        `__rsCollapseDynH(${JSON.stringify(truthySite.templateHtml)}, ` +
+        `${JSON.stringify(classes)}, ` +
+        `() => (${condSrc}) ? 0 : 1, ` +
+        `() => __pyrMode() === "dark", ` +
+        `${handlerObj})`
+      needsCollapseDynH = true
+    } else {
+      call =
+        `__rsCollapseDyn(${JSON.stringify(truthySite.templateHtml)}, ` +
+        `${JSON.stringify(classes)}, ` +
+        `() => (${condSrc}) ? 0 : 1, ` +
+        `() => __pyrMode() === "dark")`
+      needsCollapseDyn = true
+    }
+    const start = node.start as number
+    const end = node.end as number
+    const parent = findParent(node)
+    const needsBraces =
+      parent && (parent.type === 'JSXElement' || parent.type === 'JSXFragment')
+    replacements.push({ start, end, text: needsBraces ? `{${call}}` : call })
+    // Union BOTH value's rule bundles into the per-module injection.
+    // De-dupe by ruleKey (the FNV-1a hash from the resolver) so two
+    // dynamic sites sharing a value pay one injection.
+    for (const site of [truthySite, falsySite]) {
+      if (!collapseRuleKeys.has(site.ruleKey)) {
+        collapseRuleKeys.add(site.ruleKey)
+        collapseRules.push({ ruleKey: site.ruleKey, rules: site.rules })
+      }
+    }
+    return true
+  }
+
   function maybeHoist(node: N): string | null {
     if (
       (node.type === 'JSXElement' || node.type === 'JSXFragment') &&
@@ -1568,7 +1876,7 @@ export function transformJSX_JS(
     preamble = `import { ${coreImports.join(', ')} } from "@pyreon/core";\n` + preamble
   }
 
-  if (needsCollapse) {
+  if (needsCollapse || needsCollapseDyn || needsCollapseDynH) {
     const cfg = options.collapseRocketstyle!
     const rd = cfg.runtimeDomSource ?? '@pyreon/runtime-dom'
     const st = cfg.stylerSource ?? '@pyreon/styler'
@@ -1583,8 +1891,17 @@ export function transformJSX_JS(
           `__rsSheet.injectRules(${JSON.stringify(r.rules)},${JSON.stringify(r.ruleKey)});`,
       )
       .join('')
+    // Only import the helpers actually emitted into this module — keeps
+    // the bundle bytes per-feature and tree-shakable. needsCollapse
+    // (full) gates `_rsCollapse`; the partial / dynamic flags gate
+    // their respective helpers independently.
+    const rdImports: string[] = []
+    if (needsCollapse) rdImports.push('_rsCollapse as __rsCollapse')
+    if (needsCollapseH) rdImports.push('_rsCollapseH as __rsCollapseH')
+    if (needsCollapseDyn) rdImports.push('_rsCollapseDyn as __rsCollapseDyn')
+    if (needsCollapseDynH) rdImports.push('_rsCollapseDynH as __rsCollapseDynH')
     preamble =
-      `import { _rsCollapse as __rsCollapse${needsCollapseH ? ', _rsCollapseH as __rsCollapseH' : ''} } from "${rd}";\n` +
+      `import { ${rdImports.join(', ')} } from "${rd}";\n` +
       `import { sheet as __rsSheet } from "${st}";\n` +
       `import { ${cfg.mode.name} as __pyrMode } from "${cfg.mode.source}";\n` +
       `${inj}\n` +

package/src/lpih.ts

@@ -0,0 +1,270 @@
+/**
+ * Live Program Inlay Hints (LPIH) — merge runtime fire data onto static
+ * Reactivity-Lens findings.
+ *
+ * This is a PURE function. The runtime side (`@pyreon/reactivity`)
+ * captures source locations at signal/computed/effect creation and emits
+ * fire counts via `getFireSummaries()`. The editor/LSP side calls
+ * `analyzeReactivity()` to get static findings. This module bridges them:
+ * given findings + fires, produces enriched findings whose `detail` field
+ * carries the live fire count.
+ *
+ * No I/O, no devtools dependency. The LSP transport is the consumer's
+ * responsibility (read fires from a cache file, an IPC bridge, or
+ * the editor's devtools panel — whatever the editor extension wants).
+ *
+ * ## The category
+ *
+ * Editors today show STATIC errors, types, and lint warnings at the
+ * cursor. They do NOT show LIVE program data — "this signal fires 240×
+ * per second", "this effect re-runs 3× per render", "this computed has
+ * 12 downstream subscribers". That data lives in a separate devtools
+ * panel that the developer has to context-switch to.
+ *
+ * LPIH closes that gap: live runtime data appears AT THE SOURCE LINE
+ * via LSP inlay hints, like a type annotation or a TypeScript error.
+ * No category like this exists for any reactive framework today.
+ *
+ * @example
+ * import { analyzeReactivity, mergeFireDataIntoFindings } from '@pyreon/compiler'
+ * import { getFireSummaries } from '@pyreon/reactivity'
+ *
+ * const code = `const count = signal(0)\nreturn <div>{count()}</div>`
+ * const { findings } = analyzeReactivity(code, 'app.tsx')
+ * const fires = getFireSummaries().map(s => ({
+ *   file: s.loc.file, line: s.loc.line, count: s.count, kind: s.kind,
+ * }))
+ * const enriched = mergeFireDataIntoFindings(findings, fires, 'app.tsx')
+ * // enriched[0].detail might now be "live — signal fired 240×"
+ */
+
+import type { ReactivityFinding, ReactivityFindingKind } from './reactivity-lens'
+
+/**
+ * Runtime fire data carried into the merge function. Shape mirrors
+ * `@pyreon/reactivity`'s `FireSummary` but is duplicated here to keep
+ * `@pyreon/compiler` free of a runtime-package import. The consumer
+ * adapts the shape at the call site.
+ */
+export interface LPIHFireDatum {
+  /** Source file path captured from `new Error().stack`. */
+  file: string
+  /** 1-based line number (V8 stack format). */
+  line: number
+  /** Total fires recorded at this location. */
+  count: number
+  /** `performance.now()` of most recent fire, or null. */
+  lastFire?: number | null | undefined
+  /** Node kind that fired (signal / derived / effect). */
+  kind?: 'signal' | 'derived' | 'effect' | undefined
+  /**
+   * Exponentially-decayed fire rate, fires/sec (1s time constant). 0
+   * when the node has been idle longer than several time constants.
+   * Used by the default formatter to add a "12/s" suffix when active.
+   * See `@pyreon/reactivity`'s `FireSummary.rate1s` for the math.
+   */
+  rate1s?: number | undefined
+}
+
+/** Options for `mergeFireDataIntoFindings`. */
+export interface LPIHMergeOptions {
+  /**
+   * Optional file-path normalizer. Used for both the analyzed source
+   * file and each fire's `file` field. Useful when fires come from
+   * runtime stacks (absolute paths) but the source file is identified
+   * relative (e.g. workspace-rooted). Defaults to identity.
+   */
+  normalizeFile?: (path: string) => string
+  /**
+   * Optional formatter for the enriched detail. Receives the original
+   * detail + the matched fire datum. Defaults to:
+   *   `${detail} — ${kind ? kind + ' ' : ''}fired ${count}×`
+   */
+  formatDetail?: (detail: string, fire: LPIHFireDatum) => string
+}
+
+/**
+ * Threshold below which the rate suffix is omitted. A long-dormant node
+ * decays toward 0; showing "0/s" or "0.001/s" is noise. The 0.5 cutoff
+ * means "less than once every 2 seconds at steady state" — at that
+ * rate, the cumulative count is the more useful signal.
+ *
+ * @internal — exported for tests + tunability.
+ */
+export const _LPIH_RATE_VISIBLE_THRESHOLD = 0.5
+
+function _formatRate(rate1s: number): string {
+  if (rate1s < _LPIH_RATE_VISIBLE_THRESHOLD) return ''
+  // < 10/s: 1 decimal place. ≥ 10/s: rounded integer.
+  return rate1s < 10
+    ? ` (${rate1s.toFixed(1)}/s)`
+    : ` (${Math.round(rate1s)}/s)`
+}
+
+const DEFAULT_FORMAT = (detail: string, fire: LPIHFireDatum): string => {
+  const kindLabel = fire.kind ? `${fire.kind} ` : ''
+  const rate = typeof fire.rate1s === 'number' ? _formatRate(fire.rate1s) : ''
+  return `${detail} — ${kindLabel}fired ${fire.count}×${rate}`
+}
+
+/**
+ * Merge runtime fire data onto static reactivity findings. Pure function,
+ * deterministic, input not mutated.
+ *
+ * Matching rules:
+ *   - Only fires whose normalized `file` matches the analyzed source file
+ *     are considered (cross-file fires are silently skipped).
+ *   - Line-level matching only (column is ignored). V8 stack columns
+ *     differ from compiler-emitted span columns by 1+ chars in practice,
+ *     and the user-visible affordance is "this signal at this line is
+ *     firing" — line precision is sufficient.
+ *   - Multiple fires at the same `line` are summed; latest `lastFire`
+ *     and corresponding `kind` win.
+ *   - Findings of kind `footgun`, `hoisted-static`, or `static-text` are
+ *     passed through unchanged — they're not runtime-active reactive
+ *     reads, so a fire count at their location is unrelated to them.
+ */
+export function mergeFireDataIntoFindings(
+  findings: ReactivityFinding[],
+  fires: readonly LPIHFireDatum[],
+  sourceFile: string,
+  options: LPIHMergeOptions = {},
+): ReactivityFinding[] {
+  if (fires.length === 0) return findings
+  const norm = options.normalizeFile ?? ((p) => p)
+  const format = options.formatDetail ?? DEFAULT_FORMAT
+  const targetFile = norm(sourceFile)
+
+  // Build line-keyed index. Sum counts at the same line; latest wins for
+  // lastFire + kind.
+  const byLine = new Map<number, LPIHFireDatum>()
+  for (const f of fires) {
+    if (norm(f.file) !== targetFile) continue
+    const existing = byLine.get(f.line)
+    if (existing) {
+      existing.count += f.count
+      if (typeof f.rate1s === 'number') {
+        existing.rate1s = (existing.rate1s ?? 0) + f.rate1s
+      }
+      const incomingLast = f.lastFire ?? -Infinity
+      const existingLast = existing.lastFire ?? -Infinity
+      if (incomingLast > existingLast) {
+        existing.lastFire = f.lastFire
+        existing.kind = f.kind ?? existing.kind
+      }
+    } else {
+      byLine.set(f.line, { ...f })
+    }
+  }
+
+  if (byLine.size === 0) return findings
+
+  return findings.map((finding) => {
+    // Footguns + static spans are NOT enriched — fire data at those lines
+    // belongs to a SEPARATE reactive expression on the same line, and
+    // attributing it to the footgun would be misleading.
+    if (
+      finding.kind === 'footgun' ||
+      finding.kind === 'hoisted-static' ||
+      finding.kind === 'static-text'
+    ) {
+      return finding
+    }
+    const fire = byLine.get(finding.line)
+    if (!fire) return finding
+    return {
+      ...finding,
+      detail: format(finding.detail, fire),
+    }
+  })
+}
+
+/**
+ * Synthesize "creation-site" inlay-hint findings directly from fire data.
+ *
+ * `analyzeReactivity()` produces findings at REACTIVE READ sites (JSX
+ * expressions). But the runtime captures fires at CREATION sites
+ * (`signal(0)`, `computed(...)`, `effect(...)`). These are usually
+ * different source lines — so the merge function above only helps when
+ * they happen to coincide.
+ *
+ * The simpler, more useful editor surface is: show fire counts AT THE
+ * CREATION LINE. The user writes `const count = signal(0)` and sees
+ * `(signal fired 129×)` as ghost text on that line, the same way
+ * TypeScript shows the inferred type.
+ *
+ * This function turns each fire datum into a synthetic finding the LSP
+ * can serve as an inlay hint. No static analysis required — pure runtime
+ * data → editor hint.
+ *
+ * Returns findings sorted by (line, column). Files that don't match
+ * `sourceFile` (after normalization) are skipped.
+ *
+ * @example
+ * import { firesToCreationSiteFindings } from '@pyreon/compiler'
+ * import { getFireSummaries } from '@pyreon/reactivity'
+ *
+ * const fires = getFireSummaries().map(s => ({
+ *   file: s.loc.file, line: s.loc.line, count: s.count, kind: s.kind,
+ * }))
+ * const findings = firesToCreationSiteFindings(fires, 'app.tsx')
+ * // [{ kind: 'live-fire', line: 5, detail: 'signal fired 129×', ... }]
+ */
+export function firesToCreationSiteFindings(
+  fires: readonly LPIHFireDatum[],
+  sourceFile: string,
+  options: LPIHMergeOptions = {},
+): ReactivityFinding[] {
+  if (fires.length === 0) return []
+  const norm = options.normalizeFile ?? ((p) => p)
+  const targetFile = norm(sourceFile)
+
+  // Per-line aggregation (multiple nodes on the same line — rare but
+  // possible: `const [a, b] = [signal(0), signal(0)]`).
+  const byLine = new Map<number, LPIHFireDatum>()
+  for (const f of fires) {
+    if (norm(f.file) !== targetFile) continue
+    const existing = byLine.get(f.line)
+    if (existing) {
+      existing.count += f.count
+      // Sum rates at the same line (e.g. destructured signal pair).
+      if (typeof f.rate1s === 'number') {
+        existing.rate1s = (existing.rate1s ?? 0) + f.rate1s
+      }
+      const incomingLast = f.lastFire ?? -Infinity
+      const existingLast = existing.lastFire ?? -Infinity
+      if (incomingLast > existingLast) {
+        existing.lastFire = f.lastFire
+        existing.kind = f.kind ?? existing.kind
+      }
+    } else {
+      byLine.set(f.line, { ...f })
+    }
+  }
+
+  const format = options.formatDetail ?? ((_: string, fire: LPIHFireDatum) => {
+    const kindLabel = fire.kind ?? 'node'
+    const rate = typeof fire.rate1s === 'number' ? _formatRate(fire.rate1s) : ''
+    return `${kindLabel} fired ${fire.count}×${rate}`
+  })
+
+  // 'live-fire' is a new finding kind — synthetic, not produced by
+  // `analyzeReactivity()`. The LSP renders it as an inlay hint the same
+  // way as the structural kinds (reactive/static-text/etc).
+  const LIVE_KIND = 'live-fire' as ReactivityFindingKind
+
+  const out: ReactivityFinding[] = []
+  for (const [line, fire] of byLine) {
+    out.push({
+      kind: LIVE_KIND,
+      line,
+      column: 0,
+      endLine: line,
+      // 9999 = "end of line" sentinel; the LSP can clamp to actual line length.
+      endColumn: 9999,
+      detail: format('', fire),
+    })
+  }
+  out.sort((a, b) => a.line - b.line || a.column - b.column)
+  return out
+}

package/src/pyreon-intercept.ts

@@ -993,7 +993,15 @@ export function hasPyreonPatterns(code: string): boolean {
     /\.theme\s*\(\s*\{\s*\}\s*\)/.test(code) ||
     /\b(?:add|remove)EventListener\s*\(/.test(code) ||
     (/\bDate\.now\s*\(/.test(code) && /\bMath\.random\s*\(/.test(code)) ||
-    /on[A-Z]\w*\s*=\s*\{\s*undefined\s*\}/.test(code) ||
+    // Bounded `\w{0,60}` cap on the handler identifier — real `on*`
+    // names are at most ~25 chars (`onPointerLeaveCapture`); 60 leaves
+    // headroom. The unbounded `\w*` form was flagged by CodeQL
+    // `js/polynomial-redos` (alert #65) as polynomial-time on inputs
+    // like `onAAAA…` (long runs of `[A-Z]`): per starting position
+    // the greedy `\w*` consumes O(N) chars before the trailing `=`
+    // fails to match, giving O(N²) overall on N starting positions.
+    // The cap keeps the regex linear regardless of input shape.
+    /on[A-Z]\w{0,60}\s*=\s*\{\s*undefined\s*\}/.test(code) ||
     // Bounded `{0,500}` / `{1,500}` quantifiers — this is a pre-filter
     // scan before the precise AST walker, so losing detector recall on
     // a pathologically long single-line input is acceptable.