@pyreon/runtime-server 0.12.13 → 0.12.14

package/lib/analysis/index.js.html

@@ -5386,7 +5386,7 @@ var drawChart = (function (exports) {
   </script>
   <script>
     /*<!--*/
-    const data = {"version":2,"tree":{"name":"root","children":[{"name":"index.js","children":[{"name":"src/index.ts","uid":"b9d3bcae-1"}]}],"isRoot":true},"nodeParts":{"b9d3bcae-1":{"renderedLength":12118,"gzipLength":3978,"brotliLength":0,"metaUid":"b9d3bcae-0"}},"nodeMetas":{"b9d3bcae-0":{"id":"/src/index.ts","moduleParts":{"index.js":"b9d3bcae-1"},"imported":[{"uid":"b9d3bcae-2"},{"uid":"b9d3bcae-3"}],"importedBy":[],"isEntry":true},"b9d3bcae-2":{"id":"node:async_hooks","moduleParts":{},"imported":[],"importedBy":[{"uid":"b9d3bcae-0"}]},"b9d3bcae-3":{"id":"@pyreon/core","moduleParts":{},"imported":[],"importedBy":[{"uid":"b9d3bcae-0"}]}},"env":{"rollup":"4.23.0"},"options":{"gzip":true,"brotli":false,"sourcemap":false}};
+    const data = {"version":2,"tree":{"name":"root","children":[{"name":"index.js","children":[{"name":"src/index.ts","uid":"ed1e39d6-1"}]}],"isRoot":true},"nodeParts":{"ed1e39d6-1":{"renderedLength":13660,"gzipLength":4634,"brotliLength":0,"metaUid":"ed1e39d6-0"}},"nodeMetas":{"ed1e39d6-0":{"id":"/src/index.ts","moduleParts":{"index.js":"ed1e39d6-1"},"imported":[{"uid":"ed1e39d6-2"},{"uid":"ed1e39d6-3"}],"importedBy":[],"isEntry":true},"ed1e39d6-2":{"id":"node:async_hooks","moduleParts":{},"imported":[],"importedBy":[{"uid":"ed1e39d6-0"}]},"ed1e39d6-3":{"id":"@pyreon/core","moduleParts":{},"imported":[],"importedBy":[{"uid":"ed1e39d6-0"}]}},"env":{"rollup":"4.23.0"},"options":{"gzip":true,"brotli":false,"sourcemap":false}};
 
     const run = () => {
       const width = window.innerWidth;

package/lib/index.js

@@ -92,7 +92,7 @@ async function streamVNode(vnode, enqueue) {
 		const { each, children, by } = vnode.props;
 		enqueue("<!--pyreon-for-->");
 		for (const item of each()) {
-			enqueue(`<!--k:${by(item)}-->`);
+			enqueue(`<!--k:${safeKeyForMarker(by(item))}-->`);
 			await streamNode(children(item), enqueue);
 		}
 		enqueue("<!--/pyreon-for-->");
@@ -125,6 +125,7 @@ async function streamComponentNode(vnode, enqueue) {
 }
 async function streamElementNode(vnode, enqueue) {
 	const tag = vnode.type;
+	warnIfUnsafeTag(tag);
 	let open = `<${tag}`;
 	const props = vnode.props;
 	for (const key in props) {
@@ -216,7 +217,7 @@ async function renderNode(node) {
 		let forHtml = "<!--pyreon-for-->";
 		for (const item of each()) {
 			const key = by(item);
-			forHtml += `<!--k:${key}-->`;
+			forHtml += `<!--k:${safeKeyForMarker(key)}-->`;
 			forHtml += await renderNode(children(item));
 		}
 		forHtml += "<!--/pyreon-for-->";
@@ -242,6 +243,7 @@ async function renderComponent(vnode) {
 }
 async function renderElement(vnode) {
 	const tag = vnode.type;
+	warnIfUnsafeTag(tag);
 	let html = `<${tag}`;
 	const props = vnode.props;
 	for (const key in props) {
@@ -340,6 +342,35 @@ const ESCAPE_MAP = {
 	"\"": "&quot;",
 	"'": "&#39;"
 };
+/**
+* Encode a For-list key so it's safe to inline inside an HTML comment
+* marker `<!--k:KEY-->`. If a user-supplied key contains `-->` the naive
+* form breaks out of the comment and may inject markup. Per-byte URL
+* encoding with an extra `-` substitution makes `-->` impossible in the
+* output: `%2D%2D>` no longer terminates the comment. Client-side
+* hydration does not read the marker body today, so any reversible-or-
+* irreversible encoding works; this one is predictable enough for a
+* future consumer to decode if needed.
+*/
+function safeKeyForMarker(key) {
+	return encodeURIComponent(String(key)).replace(/-/g, "%2D");
+}
+/**
+* Inverse of `safeKeyForMarker` — decode a marker-safe key back to the
+* original string. Not used by runtime today (hydration does not read
+* per-item `<!--k:KEY-->` markers) but shipped alongside the encoder so
+* future hydration or devtools consumers decode symmetrically without
+* having to re-derive the encoding from source.
+*/
+function decodeKeyFromMarker(encoded) {
+	return decodeURIComponent(encoded.replace(/%2D/gi, "-"));
+}
+const SAFE_TAG_RE = /^[a-zA-Z][a-zA-Z0-9-]*$/;
+function warnIfUnsafeTag(tag) {
+	if (!__DEV__) return;
+	if (SAFE_TAG_RE.test(tag)) return;
+	console.warn(`[Pyreon SSR] Tag name "${tag}" contains characters that could break HTML structure. Tag names must match /^[a-zA-Z][a-zA-Z0-9-]*$/. If user-supplied data drives a tag name, validate it against an allowlist before passing to h().`);
+}
 const NEEDS_ESCAPE_RE = /[&<>"']/;
 function escapeHtml(str) {
 	if (!NEEDS_ESCAPE_RE.test(str)) return str;
@@ -359,5 +390,5 @@ function mergeChildrenIntoProps(vnode) {
 }
 
 //#endregion
-export { configureStoreIsolation, renderToStream, renderToString, runWithRequestContext };
+export { configureStoreIsolation, decodeKeyFromMarker, renderToStream, renderToString, runWithRequestContext };
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @pyreon/runtime-server — SSR/SSG renderer for Pyreon.\n *\n * Walks a VNode tree and produces HTML strings.\n * Signal accessors (reactive getters `() => value`) are called synchronously\n * to snapshot their current value — no effects are set up on the server.\n *\n * Async components (`async function Component()`) are fully supported:\n * renderToString will await them before continuing the tree walk.\n *\n * API:\n *   renderToString(vnode)   → Promise<string>\n *   renderToStream(vnode)   → ReadableStream<string>\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks'\nimport type { ClassValue, ComponentFn, ForProps, VNode, VNodeChild } from '@pyreon/core'\nimport {\n  cx,\n  ForSymbol,\n  Fragment,\n  normalizeStyleValue,\n  runWithHooks,\n  Suspense,\n  setContextStackProvider,\n} from '@pyreon/core'\n\nconst __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'\n\n// ─── Streaming Suspense context ───────────────────────────────────────────────\n// Tracks in-flight async Suspense boundary resolutions within a single stream.\n\ninterface StreamCtx {\n  pending: Promise<void>[]\n  nextId: () => number\n  mainEnqueue: (s: string) => void\n  /** Depth counter — non-zero when rendering inside a Suspense child resolution. */\n  suspenseDepth: number\n}\n\nconst _streamCtxAls = new AsyncLocalStorage<StreamCtx>()\n\n// ─── Concurrent SSR context isolation ────────────────────────────────────────\n// Each renderToString call runs in its own ALS store (a fresh empty stack[]).\n// Concurrent requests never share context frames.\n\nconst _contextAls = new AsyncLocalStorage<Map<symbol, unknown>[]>()\nconst _fallbackStack: Map<symbol, unknown>[] = []\n\nsetContextStackProvider(() => _contextAls.getStore() ?? _fallbackStack)\n\n// ─── Store isolation (optional) ───────────────────────────────────────────────\n// A second ALS isolates store registries between concurrent requests.\n// Activated only when the user calls configureStoreIsolation().\n\nconst _storeAls = new AsyncLocalStorage<Map<string, unknown>>()\nlet _storeIsolationActive = false\n\n/**\n * Wire up per-request store isolation.\n * Call once at server startup, passing a `setStoreRegistryProvider` function.\n *\n * @example\n * import { configureStoreIsolation } from \"@pyreon/runtime-server\"\n * configureStoreIsolation(setStoreRegistryProvider)\n */\nexport function configureStoreIsolation(\n  setStoreRegistryProvider: (fn: () => Map<string, unknown>) => void,\n): void {\n  setStoreRegistryProvider(() => _storeAls.getStore() ?? new Map())\n  _storeIsolationActive = true\n}\n\n/** Wrap a function call in a fresh store registry (no-op if isolation not configured). */\nfunction withStoreContext<T>(fn: () => T): T {\n  if (!_storeIsolationActive) return fn()\n  return _storeAls.run(new Map(), fn)\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/** Render a VNode tree to an HTML string. Supports async component functions. */\nexport async function renderToString(root: VNode | null): Promise<string> {\n  if (root === null) return ''\n  // Each call gets a fresh isolated context stack and (optionally) store registry\n  return withStoreContext(() => _contextAls.run([], () => renderNode(root)))\n}\n\n/**\n * Run an async function with a fresh, isolated context stack and store registry.\n * Useful when you need to call Pyreon APIs (e.g. useHead, prefetchLoaderData)\n * outside of renderToString but still want per-request isolation.\n */\nexport function runWithRequestContext<T>(fn: () => Promise<T>): Promise<T> {\n  return withStoreContext(() => _contextAls.run([], fn))\n}\n\n/**\n * Render a VNode tree to a Web-standard ReadableStream of HTML chunks.\n *\n * True progressive streaming: HTML is flushed to the client as soon as each\n * node is ready. Synchronous subtrees are enqueued immediately; async component\n * boundaries are awaited in-order and their output is enqueued as it resolves.\n *\n * Suspense boundaries are streamed out-of-order: the fallback is emitted\n * immediately, and the resolved children are sent as a `<template>` + inline\n * swap script once ready — without blocking the rest of the page.\n *\n * Each renderToStream call gets its own isolated ALS context stack.\n */\nexport function renderToStream(root: VNode | null): ReadableStream<string> {\n  return new ReadableStream<string>({\n    start(controller) {\n      const enqueue = (chunk: string) => controller.enqueue(chunk)\n      let bid = 0\n      const ctx: StreamCtx = {\n        pending: [],\n        nextId: () => bid++,\n        mainEnqueue: enqueue,\n        suspenseDepth: 0,\n      }\n      return withStoreContext(() =>\n        _contextAls.run([], () =>\n          _streamCtxAls\n            .run(ctx, async () => {\n              await streamNode(root, enqueue)\n              // Drain all pending Suspense resolutions (may spawn nested ones)\n              while (ctx.pending.length > 0) {\n                await Promise.all(ctx.pending.splice(0))\n              }\n              controller.close()\n            })\n            .catch((err) => controller.error(err)),\n        ),\n      )\n    },\n  })\n}\n\n// ─── Streaming renderer ───────────────────────────────────────────────────────\n\nasync function streamVNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  if (vnode.type === Fragment) {\n    for (const child of vnode.children) await streamNode(child, enqueue)\n    return\n  }\n\n  if (vnode.type === (ForSymbol as unknown as string)) {\n    const { each, children, by } = vnode.props as unknown as ForProps<unknown>\n    enqueue('<!--pyreon-for-->')\n    for (const item of each()) {\n      const key = by(item)\n      enqueue(`<!--k:${key}-->`)\n      await streamNode(children(item) as VNodeChild, enqueue)\n    }\n    enqueue('<!--/pyreon-for-->')\n    return\n  }\n\n  if (typeof vnode.type === 'function') {\n    await streamComponentNode(vnode, enqueue)\n    return\n  }\n\n  await streamElementNode(vnode, enqueue)\n}\n\nasync function streamComponentNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  if (vnode.type === Suspense) {\n    await streamSuspenseBoundary(vnode, enqueue)\n    return\n  }\n  try {\n    const { vnode: output } = runWithHooks(vnode.type as ComponentFn, mergeChildrenIntoProps(vnode))\n    const resolved = output instanceof Promise ? await output : output\n    if (resolved !== null) await streamNode(resolved, enqueue)\n  } catch (err) {\n    if (__DEV__) {\n      const name = (vnode.type as ComponentFn).name || 'Anonymous'\n      console.error(`[Pyreon SSR] Error rendering <${name}>:`, err)\n    }\n    // Inside a Suspense child resolution, re-throw so the boundary can catch and\n    // suppress the swap (fallback stays visible). Outside Suspense, swallow the\n    // error and emit a marker so the stream can continue.\n    const ctx = _streamCtxAls.getStore()\n    if (ctx && ctx.suspenseDepth > 0) throw err\n    enqueue('<!--pyreon-error-->')\n  }\n}\n\nasync function streamElementNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  const tag = vnode.type as string\n  let open = `<${tag}`\n  const props = vnode.props as Record<string, unknown>\n  for (const key in props) {\n    const attr = renderProp(key, props[key])\n    if (attr) open += ` ${attr}`\n  }\n  if (isVoidElement(tag)) {\n    enqueue(`${open} />`)\n    return\n  }\n  enqueue(`${open}>`)\n  const dangerous = props.dangerouslySetInnerHTML as { __html: string } | undefined\n  if (dangerous?.__html) {\n    enqueue(dangerous.__html)\n  } else {\n    for (const child of vnode.children) await streamNode(child, enqueue)\n  }\n  enqueue(`</${tag}>`)\n}\n\nasync function streamNode(\n  node: VNodeChild | null | (() => VNodeChild),\n  enqueue: (s: string) => void,\n): Promise<void> {\n  if (typeof node === 'function') {\n    return streamNode((node as () => VNodeChild)(), enqueue)\n  }\n  if (node == null || node === false) return\n  if (typeof node === 'string') {\n    enqueue(escapeHtml(node))\n    return\n  }\n  if (typeof node === 'number' || typeof node === 'boolean') {\n    enqueue(String(node))\n    return\n  }\n  if (Array.isArray(node)) {\n    for (const child of node) await streamNode(child, enqueue)\n    return\n  }\n\n  await streamVNode(node as VNode, enqueue)\n}\n\n// Inline swap helper emitted once per stream, before the first <template>\nconst SUSPENSE_SWAP_FN =\n  '<script>function __NS(s,t){var e=document.getElementById(s),l=document.getElementById(t);' +\n  'if(e&&l){e.replaceWith(l.content.cloneNode(!0));l.remove()}}</script>'\n\n/**\n * Stream a Suspense boundary: emit fallback immediately, then resolve children\n * asynchronously and emit them as a `<template>` + client-side swap.\n *\n * The actual children HTML is buffered until fully resolved, then emitted to the\n * main stream enqueue so it always arrives after the fallback placeholder.\n */\nasync function streamSuspenseBoundary(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  const ctx = _streamCtxAls.getStore()\n  const { fallback, children } = vnode.props as { fallback: VNodeChild; children?: VNodeChild }\n\n  // No streaming context (e.g. called from renderToString) — render children inline\n  if (!ctx) {\n    const { vnode: output } = runWithHooks(Suspense as ComponentFn, vnode.props)\n    if (output !== null) await streamNode(output, enqueue)\n    return\n  }\n\n  const id = ctx.nextId()\n  const { mainEnqueue } = ctx\n\n  // Emit the swap helper function once (before first use)\n  if (id === 0) mainEnqueue(SUSPENSE_SWAP_FN)\n\n  // Stream the fallback synchronously (no await on children)\n  mainEnqueue(`<div id=\"pyreon-s-${id}\">`)\n  await streamNode(fallback ?? null, enqueue)\n  mainEnqueue('</div>')\n\n  // Capture the context store for the async resolution so it inherits context\n  const ctxStore = _contextAls.getStore() ?? []\n\n  // Queue async resolution — runs in parallel, emits to main stream when done.\n  // Errors are caught per-boundary so one failing Suspense doesn't abort the stream.\n  // Timeout prevents hung async children from keeping the stream open forever.\n  const SUSPENSE_TIMEOUT_MS = 30_000\n\n  ctx.pending.push(\n    _contextAls.run(ctxStore, async () => {\n      try {\n        ctx.suspenseDepth++\n        const buf: string[] = []\n\n        // Race the async children against a timeout\n        const result = await Promise.race([\n          streamNode(children ?? null, (s) => buf.push(s)).then(() => 'resolved' as const),\n          new Promise<'timeout'>((resolve) => setTimeout(() => resolve('timeout'), SUSPENSE_TIMEOUT_MS)),\n        ])\n\n        if (result === 'timeout') {\n          if (__DEV__) {\n            console.warn(\n              `[Pyreon SSR] Suspense boundary timed out after ${SUSPENSE_TIMEOUT_MS}ms — fallback will remain.`,\n            )\n          }\n          // Fallback stays visible — no swap\n          return\n        }\n\n        // Escape </template> in buffered content to prevent early close + XSS\n        const content = buf.join('').replace(/<\\/template/gi, '<\\\\/template')\n        mainEnqueue(`<template id=\"pyreon-t-${id}\">${content}</template>`)\n        mainEnqueue(`<script>__NS(\"pyreon-s-${id}\",\"pyreon-t-${id}\")</script>`)\n      } catch (err) {\n        if (__DEV__) {\n          console.error(\n            `[Pyreon SSR] Suspense boundary caught an error — fallback will remain:`,\n            err,\n          )\n        }\n        // Fallback stays visible — no swap script emitted\n      } finally {\n        ctx.suspenseDepth--\n      }\n    }),\n  )\n}\n\n// ─── Core renderer ───────────────────────────────────────────────────────────\n\nasync function renderNode(node: VNodeChild | (() => VNodeChild)): Promise<string> {\n  // Reactive accessor — call it synchronously (snapshot)\n  if (typeof node === 'function') {\n    return renderNode((node as () => VNodeChild)())\n  }\n\n  if (node == null || node === false) return ''\n\n  if (typeof node === 'string') return escapeHtml(node)\n  if (typeof node === 'number' || typeof node === 'boolean') return String(node)\n\n  if (Array.isArray(node)) {\n    let html = ''\n    for (const child of node) html += await renderNode(child)\n    return html\n  }\n\n  const vnode = node as VNode\n\n  if (vnode.type === Fragment) {\n    return renderChildren(vnode.children)\n  }\n\n  if (vnode.type === (ForSymbol as unknown as string)) {\n    const { each, children, by } = vnode.props as unknown as ForProps<unknown>\n    let forHtml = '<!--pyreon-for-->'\n    for (const item of each()) {\n      const key = by(item)\n      forHtml += `<!--k:${key}-->`\n      forHtml += await renderNode(children(item) as VNodeChild)\n    }\n    forHtml += '<!--/pyreon-for-->'\n    return forHtml\n  }\n\n  if (typeof vnode.type === 'function') {\n    return renderComponent(vnode as VNode & { type: ComponentFn })\n  }\n\n  return renderElement(vnode)\n}\n\nasync function renderChildren(children: VNodeChild[]): Promise<string> {\n  let html = ''\n  for (const child of children) html += await renderNode(child)\n  return html\n}\n\nasync function renderComponent(vnode: VNode & { type: ComponentFn }): Promise<string> {\n  const { vnode: output } = runWithHooks(vnode.type, mergeChildrenIntoProps(vnode))\n\n  // Async component function (async function Component()) — await the promise\n  if (output instanceof Promise) {\n    const resolved = await output\n    if (resolved === null) return ''\n    return renderNode(resolved)\n  }\n\n  if (output === null) return ''\n  return renderNode(output)\n}\n\nasync function renderElement(vnode: VNode): Promise<string> {\n  const tag = vnode.type as string\n  let html = `<${tag}`\n\n  const props = vnode.props as Record<string, unknown>\n  for (const key in props) {\n    const attr = renderProp(key, props[key])\n    if (attr) html += ` ${attr}`\n  }\n\n  if (isVoidElement(tag)) {\n    html += ' />'\n    return html\n  }\n\n  html += '>'\n\n  // dangerouslySetInnerHTML — inject raw HTML, skip children\n  const dangerous = props.dangerouslySetInnerHTML as { __html: string } | undefined\n  if (dangerous?.__html) {\n    html += dangerous.__html\n  } else {\n    for (const child of vnode.children) {\n      html += await renderNode(child)\n    }\n  }\n\n  html += `</${tag}>`\n  return html\n}\n\nconst SSR_URL_ATTRS = new Set(['href', 'src', 'action', 'formaction', 'poster', 'cite', 'data'])\nconst SSR_UNSAFE_URL_RE = /^\\s*(?:javascript|data):/i\n\nfunction renderPropSkipped(key: string): boolean {\n  if (key === 'key' || key === 'ref' || key === 'dangerouslySetInnerHTML') return true\n  if (/^on[A-Z]/.test(key)) return true\n  return false\n}\n\nfunction renderPropValue(key: string, value: unknown): string | null {\n  if (value === null || value === undefined || value === false) return null\n  if (value === true) return escapeHtml(toAttrName(key))\n\n  if (key === 'class') {\n    const cls = cx(value as ClassValue)\n    return cls ? `class=\"${escapeHtml(cls)}\"` : null\n  }\n\n  if (key === 'style') {\n    const style = normalizeStyle(value)\n    return style ? `style=\"${escapeHtml(style)}\"` : null\n  }\n\n  return `${escapeHtml(toAttrName(key))}=\"${escapeHtml(String(value))}\"`\n}\n\nfunction renderProp(key: string, value: unknown): string | null {\n  if (renderPropSkipped(key)) return null\n\n  if (typeof value === 'function') {\n    return renderProp(key, (value as () => unknown)())\n  }\n\n  if (SSR_URL_ATTRS.has(key) && typeof value === 'string' && SSR_UNSAFE_URL_RE.test(value)) {\n    return null\n  }\n\n  return renderPropValue(key, value)\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\nconst VOID_ELEMENTS = new Set([\n  'area',\n  'base',\n  'br',\n  'col',\n  'embed',\n  'hr',\n  'img',\n  'input',\n  'link',\n  'meta',\n  'param',\n  'source',\n  'track',\n  'wbr',\n])\n\nfunction isVoidElement(tag: string): boolean {\n  return VOID_ELEMENTS.has(tag.toLowerCase())\n}\n\n/** camelCase prop → kebab-case HTML attribute (e.g. className → class, htmlFor → for) */\nfunction toAttrName(key: string): string {\n  if (key === 'className') return 'class'\n  if (key === 'htmlFor') return 'for'\n  return key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)\n}\n\nfunction isStyleObject(value: unknown): value is Record<string, unknown> {\n  if (!value) return false\n  return typeof value === 'object'\n}\n\nfunction normalizeStyle(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (isStyleObject(value)) {\n    const proto = Object.getPrototypeOf(value)\n    if (proto === Object.prototype || proto === null) {\n      return Object.entries(value)\n        .map(([k, v]) => `${toKebab(k)}: ${normalizeStyleValue(k, v)}`)\n        .join('; ')\n    }\n  }\n  return ''\n}\n\nfunction toKebab(str: string): string {\n  return str.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)\n}\n\nconst ESCAPE_MAP: Record<string, string> = {\n  '&': '&amp;',\n  '<': '&lt;',\n  '>': '&gt;',\n  '\"': '&quot;',\n  \"'\": '&#39;',\n}\n\n// Fast test — most strings in SSR have no special chars (tag names, class names, etc.)\nconst NEEDS_ESCAPE_RE = /[&<>\"']/\n\nfunction escapeHtml(str: string): string {\n  if (!NEEDS_ESCAPE_RE.test(str)) return str\n  return str.replace(/[&<>\"']/g, (c) => ESCAPE_MAP[c] ?? c)\n}\n\n/**\n * Merge vnode.children into props.children for component rendering.\n * Matches the behavior of mount.ts and hydrate.ts so components can\n * access children passed via h(Comp, props, child1, child2).\n */\nfunction mergeChildrenIntoProps(vnode: VNode): Record<string, unknown> {\n  if (\n    vnode.children.length > 0 &&\n    (vnode.props as Record<string, unknown>).children === undefined\n  ) {\n    return {\n      ...vnode.props,\n      children: vnode.children.length === 1 ? vnode.children[0] : vnode.children,\n    }\n  }\n  return vnode.props as Record<string, unknown>\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA2BA,MAAM,UAAU,OAAO,YAAY,eAAe,QAAQ,IAAI,aAAa;AAa3E,MAAM,gBAAgB,IAAI,mBAA8B;AAMxD,MAAM,cAAc,IAAI,mBAA2C;AACnE,MAAM,iBAAyC,EAAE;AAEjD,8BAA8B,YAAY,UAAU,IAAI,eAAe;AAMvE,MAAM,YAAY,IAAI,mBAAyC;AAC/D,IAAI,wBAAwB;;;;;;;;;AAU5B,SAAgB,wBACd,0BACM;AACN,gCAA+B,UAAU,UAAU,oBAAI,IAAI,KAAK,CAAC;AACjE,yBAAwB;;;AAI1B,SAAS,iBAAoB,IAAgB;AAC3C,KAAI,CAAC,sBAAuB,QAAO,IAAI;AACvC,QAAO,UAAU,oBAAI,IAAI,KAAK,EAAE,GAAG;;;AAMrC,eAAsB,eAAe,MAAqC;AACxE,KAAI,SAAS,KAAM,QAAO;AAE1B,QAAO,uBAAuB,YAAY,IAAI,EAAE,QAAQ,WAAW,KAAK,CAAC,CAAC;;;;;;;AAQ5E,SAAgB,sBAAyB,IAAkC;AACzE,QAAO,uBAAuB,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC;;;;;;;;;;;;;;;AAgBxD,SAAgB,eAAe,MAA4C;AACzE,QAAO,IAAI,eAAuB,EAChC,MAAM,YAAY;EAChB,MAAM,WAAW,UAAkB,WAAW,QAAQ,MAAM;EAC5D,IAAI,MAAM;EACV,MAAM,MAAiB;GACrB,SAAS,EAAE;GACX,cAAc;GACd,aAAa;GACb,eAAe;GAChB;AACD,SAAO,uBACL,YAAY,IAAI,EAAE,QAChB,cACG,IAAI,KAAK,YAAY;AACpB,SAAM,WAAW,MAAM,QAAQ;AAE/B,UAAO,IAAI,QAAQ,SAAS,EAC1B,OAAM,QAAQ,IAAI,IAAI,QAAQ,OAAO,EAAE,CAAC;AAE1C,cAAW,OAAO;IAClB,CACD,OAAO,QAAQ,WAAW,MAAM,IAAI,CAAC,CACzC,CACF;IAEJ,CAAC;;AAKJ,eAAe,YAAY,OAAc,SAA6C;AACpF,KAAI,MAAM,SAAS,UAAU;AAC3B,OAAK,MAAM,SAAS,MAAM,SAAU,OAAM,WAAW,OAAO,QAAQ;AACpE;;AAGF,KAAI,MAAM,SAAU,WAAiC;EACnD,MAAM,EAAE,MAAM,UAAU,OAAO,MAAM;AACrC,UAAQ,oBAAoB;AAC5B,OAAK,MAAM,QAAQ,MAAM,EAAE;AAEzB,WAAQ,SADI,GAAG,KAAK,CACC,KAAK;AAC1B,SAAM,WAAW,SAAS,KAAK,EAAgB,QAAQ;;AAEzD,UAAQ,qBAAqB;AAC7B;;AAGF,KAAI,OAAO,MAAM,SAAS,YAAY;AACpC,QAAM,oBAAoB,OAAO,QAAQ;AACzC;;AAGF,OAAM,kBAAkB,OAAO,QAAQ;;AAGzC,eAAe,oBAAoB,OAAc,SAA6C;AAC5F,KAAI,MAAM,SAAS,UAAU;AAC3B,QAAM,uBAAuB,OAAO,QAAQ;AAC5C;;AAEF,KAAI;EACF,MAAM,EAAE,OAAO,WAAW,aAAa,MAAM,MAAqB,uBAAuB,MAAM,CAAC;EAChG,MAAM,WAAW,kBAAkB,UAAU,MAAM,SAAS;AAC5D,MAAI,aAAa,KAAM,OAAM,WAAW,UAAU,QAAQ;UACnD,KAAK;AACZ,MAAI,SAAS;GACX,MAAM,OAAQ,MAAM,KAAqB,QAAQ;AACjD,WAAQ,MAAM,iCAAiC,KAAK,KAAK,IAAI;;EAK/D,MAAM,MAAM,cAAc,UAAU;AACpC,MAAI,OAAO,IAAI,gBAAgB,EAAG,OAAM;AACxC,UAAQ,sBAAsB;;;AAIlC,eAAe,kBAAkB,OAAc,SAA6C;CAC1F,MAAM,MAAM,MAAM;CAClB,IAAI,OAAO,IAAI;CACf,MAAM,QAAQ,MAAM;AACpB,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,WAAW,KAAK,MAAM,KAAK;AACxC,MAAI,KAAM,SAAQ,IAAI;;AAExB,KAAI,cAAc,IAAI,EAAE;AACtB,UAAQ,GAAG,KAAK,KAAK;AACrB;;AAEF,SAAQ,GAAG,KAAK,GAAG;CACnB,MAAM,YAAY,MAAM;AACxB,KAAI,WAAW,OACb,SAAQ,UAAU,OAAO;KAEzB,MAAK,MAAM,SAAS,MAAM,SAAU,OAAM,WAAW,OAAO,QAAQ;AAEtE,SAAQ,KAAK,IAAI,GAAG;;AAGtB,eAAe,WACb,MACA,SACe;AACf,KAAI,OAAO,SAAS,WAClB,QAAO,WAAY,MAA2B,EAAE,QAAQ;AAE1D,KAAI,QAAQ,QAAQ,SAAS,MAAO;AACpC,KAAI,OAAO,SAAS,UAAU;AAC5B,UAAQ,WAAW,KAAK,CAAC;AACzB;;AAEF,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;AACzD,UAAQ,OAAO,KAAK,CAAC;AACrB;;AAEF,KAAI,MAAM,QAAQ,KAAK,EAAE;AACvB,OAAK,MAAM,SAAS,KAAM,OAAM,WAAW,OAAO,QAAQ;AAC1D;;AAGF,OAAM,YAAY,MAAe,QAAQ;;AAI3C,MAAM,mBACJ;;;;;;;;AAUF,eAAe,uBAAuB,OAAc,SAA6C;CAC/F,MAAM,MAAM,cAAc,UAAU;CACpC,MAAM,EAAE,UAAU,aAAa,MAAM;AAGrC,KAAI,CAAC,KAAK;EACR,MAAM,EAAE,OAAO,WAAW,aAAa,UAAyB,MAAM,MAAM;AAC5E,MAAI,WAAW,KAAM,OAAM,WAAW,QAAQ,QAAQ;AACtD;;CAGF,MAAM,KAAK,IAAI,QAAQ;CACvB,MAAM,EAAE,gBAAgB;AAGxB,KAAI,OAAO,EAAG,aAAY,iBAAiB;AAG3C,aAAY,qBAAqB,GAAG,IAAI;AACxC,OAAM,WAAW,YAAY,MAAM,QAAQ;AAC3C,aAAY,SAAS;CAGrB,MAAM,WAAW,YAAY,UAAU,IAAI,EAAE;CAK7C,MAAM,sBAAsB;AAE5B,KAAI,QAAQ,KACV,YAAY,IAAI,UAAU,YAAY;AACpC,MAAI;AACF,OAAI;GACJ,MAAM,MAAgB,EAAE;AAQxB,OALe,MAAM,QAAQ,KAAK,CAChC,WAAW,YAAY,OAAO,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,WAAW,WAAoB,EAChF,IAAI,SAAoB,YAAY,iBAAiB,QAAQ,UAAU,EAAE,oBAAoB,CAAC,CAC/F,CAAC,KAEa,WAAW;AACxB,QAAI,QACF,SAAQ,KACN,kDAAkD,oBAAoB,4BACvE;AAGH;;AAKF,eAAY,0BAA0B,GAAG,IADzB,IAAI,KAAK,GAAG,CAAC,QAAQ,iBAAiB,eAAe,CAChB,aAAa;AAClE,eAAY,0BAA0B,GAAG,cAAc,GAAG,cAAa;WAChE,KAAK;AACZ,OAAI,QACF,SAAQ,MACN,0EACA,IACD;YAGK;AACR,OAAI;;GAEN,CACH;;AAKH,eAAe,WAAW,MAAwD;AAEhF,KAAI,OAAO,SAAS,WAClB,QAAO,WAAY,MAA2B,CAAC;AAGjD,KAAI,QAAQ,QAAQ,SAAS,MAAO,QAAO;AAE3C,KAAI,OAAO,SAAS,SAAU,QAAO,WAAW,KAAK;AACrD,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,UAAW,QAAO,OAAO,KAAK;AAE9E,KAAI,MAAM,QAAQ,KAAK,EAAE;EACvB,IAAI,OAAO;AACX,OAAK,MAAM,SAAS,KAAM,SAAQ,MAAM,WAAW,MAAM;AACzD,SAAO;;CAGT,MAAM,QAAQ;AAEd,KAAI,MAAM,SAAS,SACjB,QAAO,eAAe,MAAM,SAAS;AAGvC,KAAI,MAAM,SAAU,WAAiC;EACnD,MAAM,EAAE,MAAM,UAAU,OAAO,MAAM;EACrC,IAAI,UAAU;AACd,OAAK,MAAM,QAAQ,MAAM,EAAE;GACzB,MAAM,MAAM,GAAG,KAAK;AACpB,cAAW,SAAS,IAAI;AACxB,cAAW,MAAM,WAAW,SAAS,KAAK,CAAe;;AAE3D,aAAW;AACX,SAAO;;AAGT,KAAI,OAAO,MAAM,SAAS,WACxB,QAAO,gBAAgB,MAAuC;AAGhE,QAAO,cAAc,MAAM;;AAG7B,eAAe,eAAe,UAAyC;CACrE,IAAI,OAAO;AACX,MAAK,MAAM,SAAS,SAAU,SAAQ,MAAM,WAAW,MAAM;AAC7D,QAAO;;AAGT,eAAe,gBAAgB,OAAuD;CACpF,MAAM,EAAE,OAAO,WAAW,aAAa,MAAM,MAAM,uBAAuB,MAAM,CAAC;AAGjF,KAAI,kBAAkB,SAAS;EAC7B,MAAM,WAAW,MAAM;AACvB,MAAI,aAAa,KAAM,QAAO;AAC9B,SAAO,WAAW,SAAS;;AAG7B,KAAI,WAAW,KAAM,QAAO;AAC5B,QAAO,WAAW,OAAO;;AAG3B,eAAe,cAAc,OAA+B;CAC1D,MAAM,MAAM,MAAM;CAClB,IAAI,OAAO,IAAI;CAEf,MAAM,QAAQ,MAAM;AACpB,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,WAAW,KAAK,MAAM,KAAK;AACxC,MAAI,KAAM,SAAQ,IAAI;;AAGxB,KAAI,cAAc,IAAI,EAAE;AACtB,UAAQ;AACR,SAAO;;AAGT,SAAQ;CAGR,MAAM,YAAY,MAAM;AACxB,KAAI,WAAW,OACb,SAAQ,UAAU;KAElB,MAAK,MAAM,SAAS,MAAM,SACxB,SAAQ,MAAM,WAAW,MAAM;AAInC,SAAQ,KAAK,IAAI;AACjB,QAAO;;AAGT,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAU;CAAc;CAAU;CAAQ;CAAO,CAAC;AAChG,MAAM,oBAAoB;AAE1B,SAAS,kBAAkB,KAAsB;AAC/C,KAAI,QAAQ,SAAS,QAAQ,SAAS,QAAQ,0BAA2B,QAAO;AAChF,KAAI,WAAW,KAAK,IAAI,CAAE,QAAO;AACjC,QAAO;;AAGT,SAAS,gBAAgB,KAAa,OAA+B;AACnE,KAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,MAAO,QAAO;AACrE,KAAI,UAAU,KAAM,QAAO,WAAW,WAAW,IAAI,CAAC;AAEtD,KAAI,QAAQ,SAAS;EACnB,MAAM,MAAM,GAAG,MAAoB;AACnC,SAAO,MAAM,UAAU,WAAW,IAAI,CAAC,KAAK;;AAG9C,KAAI,QAAQ,SAAS;EACnB,MAAM,QAAQ,eAAe,MAAM;AACnC,SAAO,QAAQ,UAAU,WAAW,MAAM,CAAC,KAAK;;AAGlD,QAAO,GAAG,WAAW,WAAW,IAAI,CAAC,CAAC,IAAI,WAAW,OAAO,MAAM,CAAC,CAAC;;AAGtE,SAAS,WAAW,KAAa,OAA+B;AAC9D,KAAI,kBAAkB,IAAI,CAAE,QAAO;AAEnC,KAAI,OAAO,UAAU,WACnB,QAAO,WAAW,KAAM,OAAyB,CAAC;AAGpD,KAAI,cAAc,IAAI,IAAI,IAAI,OAAO,UAAU,YAAY,kBAAkB,KAAK,MAAM,CACtF,QAAO;AAGT,QAAO,gBAAgB,KAAK,MAAM;;AAKpC,MAAM,gBAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAS,cAAc,KAAsB;AAC3C,QAAO,cAAc,IAAI,IAAI,aAAa,CAAC;;;AAI7C,SAAS,WAAW,KAAqB;AACvC,KAAI,QAAQ,YAAa,QAAO;AAChC,KAAI,QAAQ,UAAW,QAAO;AAC9B,QAAO,IAAI,QAAQ,WAAW,MAAM,IAAI,EAAE,aAAa,GAAG;;AAG5D,SAAS,cAAc,OAAkD;AACvE,KAAI,CAAC,MAAO,QAAO;AACnB,QAAO,OAAO,UAAU;;AAG1B,SAAS,eAAe,OAAwB;AAC9C,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,cAAc,MAAM,EAAE;EACxB,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,MAAI,UAAU,OAAO,aAAa,UAAU,KAC1C,QAAO,OAAO,QAAQ,MAAM,CACzB,KAAK,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC,IAAI,oBAAoB,GAAG,EAAE,GAAG,CAC9D,KAAK,KAAK;;AAGjB,QAAO;;AAGT,SAAS,QAAQ,KAAqB;AACpC,QAAO,IAAI,QAAQ,WAAW,MAAM,IAAI,EAAE,aAAa,GAAG;;AAG5D,MAAM,aAAqC;CACzC,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAK;CACL,KAAK;CACN;AAGD,MAAM,kBAAkB;AAExB,SAAS,WAAW,KAAqB;AACvC,KAAI,CAAC,gBAAgB,KAAK,IAAI,CAAE,QAAO;AACvC,QAAO,IAAI,QAAQ,aAAa,MAAM,WAAW,MAAM,EAAE;;;;;;;AAQ3D,SAAS,uBAAuB,OAAuC;AACrE,KACE,MAAM,SAAS,SAAS,KACvB,MAAM,MAAkC,aAAa,OAEtD,QAAO;EACL,GAAG,MAAM;EACT,UAAU,MAAM,SAAS,WAAW,IAAI,MAAM,SAAS,KAAK,MAAM;EACnE;AAEH,QAAO,MAAM"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @pyreon/runtime-server — SSR/SSG renderer for Pyreon.\n *\n * Walks a VNode tree and produces HTML strings.\n * Signal accessors (reactive getters `() => value`) are called synchronously\n * to snapshot their current value — no effects are set up on the server.\n *\n * Async components (`async function Component()`) are fully supported:\n * renderToString will await them before continuing the tree walk.\n *\n * API:\n *   renderToString(vnode)   → Promise<string>\n *   renderToStream(vnode)   → ReadableStream<string>\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks'\nimport type { ClassValue, ComponentFn, ForProps, VNode, VNodeChild } from '@pyreon/core'\nimport {\n  cx,\n  ForSymbol,\n  Fragment,\n  normalizeStyleValue,\n  runWithHooks,\n  Suspense,\n  setContextStackProvider,\n} from '@pyreon/core'\n\nconst __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'\n\n// ─── Streaming Suspense context ───────────────────────────────────────────────\n// Tracks in-flight async Suspense boundary resolutions within a single stream.\n\ninterface StreamCtx {\n  pending: Promise<void>[]\n  nextId: () => number\n  mainEnqueue: (s: string) => void\n  /** Depth counter — non-zero when rendering inside a Suspense child resolution. */\n  suspenseDepth: number\n}\n\nconst _streamCtxAls = new AsyncLocalStorage<StreamCtx>()\n\n// ─── Concurrent SSR context isolation ────────────────────────────────────────\n// Each renderToString call runs in its own ALS store (a fresh empty stack[]).\n// Concurrent requests never share context frames.\n\nconst _contextAls = new AsyncLocalStorage<Map<symbol, unknown>[]>()\nconst _fallbackStack: Map<symbol, unknown>[] = []\n\nsetContextStackProvider(() => _contextAls.getStore() ?? _fallbackStack)\n\n// ─── Store isolation (optional) ───────────────────────────────────────────────\n// A second ALS isolates store registries between concurrent requests.\n// Activated only when the user calls configureStoreIsolation().\n\nconst _storeAls = new AsyncLocalStorage<Map<string, unknown>>()\nlet _storeIsolationActive = false\n\n/**\n * Wire up per-request store isolation.\n * Call once at server startup, passing a `setStoreRegistryProvider` function.\n *\n * @example\n * import { configureStoreIsolation } from \"@pyreon/runtime-server\"\n * configureStoreIsolation(setStoreRegistryProvider)\n */\nexport function configureStoreIsolation(\n  setStoreRegistryProvider: (fn: () => Map<string, unknown>) => void,\n): void {\n  setStoreRegistryProvider(() => _storeAls.getStore() ?? new Map())\n  _storeIsolationActive = true\n}\n\n/** Wrap a function call in a fresh store registry (no-op if isolation not configured). */\nfunction withStoreContext<T>(fn: () => T): T {\n  if (!_storeIsolationActive) return fn()\n  return _storeAls.run(new Map(), fn)\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/** Render a VNode tree to an HTML string. Supports async component functions. */\nexport async function renderToString(root: VNode | null): Promise<string> {\n  if (root === null) return ''\n  // Each call gets a fresh isolated context stack and (optionally) store registry\n  return withStoreContext(() => _contextAls.run([], () => renderNode(root)))\n}\n\n/**\n * Run an async function with a fresh, isolated context stack and store registry.\n * Useful when you need to call Pyreon APIs (e.g. useHead, prefetchLoaderData)\n * outside of renderToString but still want per-request isolation.\n */\nexport function runWithRequestContext<T>(fn: () => Promise<T>): Promise<T> {\n  return withStoreContext(() => _contextAls.run([], fn))\n}\n\n/**\n * Render a VNode tree to a Web-standard ReadableStream of HTML chunks.\n *\n * True progressive streaming: HTML is flushed to the client as soon as each\n * node is ready. Synchronous subtrees are enqueued immediately; async component\n * boundaries are awaited in-order and their output is enqueued as it resolves.\n *\n * Suspense boundaries are streamed out-of-order: the fallback is emitted\n * immediately, and the resolved children are sent as a `<template>` + inline\n * swap script once ready — without blocking the rest of the page.\n *\n * Each renderToStream call gets its own isolated ALS context stack.\n */\nexport function renderToStream(root: VNode | null): ReadableStream<string> {\n  return new ReadableStream<string>({\n    start(controller) {\n      const enqueue = (chunk: string) => controller.enqueue(chunk)\n      let bid = 0\n      const ctx: StreamCtx = {\n        pending: [],\n        nextId: () => bid++,\n        mainEnqueue: enqueue,\n        suspenseDepth: 0,\n      }\n      return withStoreContext(() =>\n        _contextAls.run([], () =>\n          _streamCtxAls\n            .run(ctx, async () => {\n              await streamNode(root, enqueue)\n              // Drain all pending Suspense resolutions (may spawn nested ones)\n              while (ctx.pending.length > 0) {\n                await Promise.all(ctx.pending.splice(0))\n              }\n              controller.close()\n            })\n            .catch((err) => controller.error(err)),\n        ),\n      )\n    },\n  })\n}\n\n// ─── Streaming renderer ───────────────────────────────────────────────────────\n\nasync function streamVNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  if (vnode.type === Fragment) {\n    for (const child of vnode.children) await streamNode(child, enqueue)\n    return\n  }\n\n  if (vnode.type === (ForSymbol as unknown as string)) {\n    const { each, children, by } = vnode.props as unknown as ForProps<unknown>\n    enqueue('<!--pyreon-for-->')\n    for (const item of each()) {\n      const key = by(item)\n      enqueue(`<!--k:${safeKeyForMarker(key)}-->`)\n      await streamNode(children(item) as VNodeChild, enqueue)\n    }\n    enqueue('<!--/pyreon-for-->')\n    return\n  }\n\n  if (typeof vnode.type === 'function') {\n    await streamComponentNode(vnode, enqueue)\n    return\n  }\n\n  await streamElementNode(vnode, enqueue)\n}\n\nasync function streamComponentNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  if (vnode.type === Suspense) {\n    await streamSuspenseBoundary(vnode, enqueue)\n    return\n  }\n  try {\n    const { vnode: output } = runWithHooks(vnode.type as ComponentFn, mergeChildrenIntoProps(vnode))\n    const resolved = output instanceof Promise ? await output : output\n    if (resolved !== null) await streamNode(resolved, enqueue)\n  } catch (err) {\n    if (__DEV__) {\n      const name = (vnode.type as ComponentFn).name || 'Anonymous'\n      console.error(`[Pyreon SSR] Error rendering <${name}>:`, err)\n    }\n    // Inside a Suspense child resolution, re-throw so the boundary can catch and\n    // suppress the swap (fallback stays visible). Outside Suspense, swallow the\n    // error and emit a marker so the stream can continue.\n    const ctx = _streamCtxAls.getStore()\n    if (ctx && ctx.suspenseDepth > 0) throw err\n    enqueue('<!--pyreon-error-->')\n  }\n}\n\nasync function streamElementNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  const tag = vnode.type as string\n  warnIfUnsafeTag(tag)\n  let open = `<${tag}`\n  const props = vnode.props as Record<string, unknown>\n  for (const key in props) {\n    const attr = renderProp(key, props[key])\n    if (attr) open += ` ${attr}`\n  }\n  if (isVoidElement(tag)) {\n    enqueue(`${open} />`)\n    return\n  }\n  enqueue(`${open}>`)\n  const dangerous = props.dangerouslySetInnerHTML as { __html: string } | undefined\n  if (dangerous?.__html) {\n    enqueue(dangerous.__html)\n  } else {\n    for (const child of vnode.children) await streamNode(child, enqueue)\n  }\n  enqueue(`</${tag}>`)\n}\n\nasync function streamNode(\n  node: VNodeChild | null | (() => VNodeChild),\n  enqueue: (s: string) => void,\n): Promise<void> {\n  if (typeof node === 'function') {\n    return streamNode((node as () => VNodeChild)(), enqueue)\n  }\n  if (node == null || node === false) return\n  if (typeof node === 'string') {\n    enqueue(escapeHtml(node))\n    return\n  }\n  if (typeof node === 'number' || typeof node === 'boolean') {\n    enqueue(String(node))\n    return\n  }\n  if (Array.isArray(node)) {\n    for (const child of node) await streamNode(child, enqueue)\n    return\n  }\n\n  await streamVNode(node as VNode, enqueue)\n}\n\n// Inline swap helper emitted once per stream, before the first <template>\nconst SUSPENSE_SWAP_FN =\n  '<script>function __NS(s,t){var e=document.getElementById(s),l=document.getElementById(t);' +\n  'if(e&&l){e.replaceWith(l.content.cloneNode(!0));l.remove()}}</script>'\n\n/**\n * Stream a Suspense boundary: emit fallback immediately, then resolve children\n * asynchronously and emit them as a `<template>` + client-side swap.\n *\n * The actual children HTML is buffered until fully resolved, then emitted to the\n * main stream enqueue so it always arrives after the fallback placeholder.\n */\nasync function streamSuspenseBoundary(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  const ctx = _streamCtxAls.getStore()\n  const { fallback, children } = vnode.props as { fallback: VNodeChild; children?: VNodeChild }\n\n  // No streaming context (e.g. called from renderToString) — render children inline\n  if (!ctx) {\n    const { vnode: output } = runWithHooks(Suspense as ComponentFn, vnode.props)\n    if (output !== null) await streamNode(output, enqueue)\n    return\n  }\n\n  const id = ctx.nextId()\n  const { mainEnqueue } = ctx\n\n  // Emit the swap helper function once (before first use)\n  if (id === 0) mainEnqueue(SUSPENSE_SWAP_FN)\n\n  // Stream the fallback synchronously (no await on children)\n  mainEnqueue(`<div id=\"pyreon-s-${id}\">`)\n  await streamNode(fallback ?? null, enqueue)\n  mainEnqueue('</div>')\n\n  // Capture the context store for the async resolution so it inherits context\n  const ctxStore = _contextAls.getStore() ?? []\n\n  // Queue async resolution — runs in parallel, emits to main stream when done.\n  // Errors are caught per-boundary so one failing Suspense doesn't abort the stream.\n  // Timeout prevents hung async children from keeping the stream open forever.\n  const SUSPENSE_TIMEOUT_MS = 30_000\n\n  ctx.pending.push(\n    _contextAls.run(ctxStore, async () => {\n      try {\n        ctx.suspenseDepth++\n        const buf: string[] = []\n\n        // Race the async children against a timeout\n        const result = await Promise.race([\n          streamNode(children ?? null, (s) => buf.push(s)).then(() => 'resolved' as const),\n          new Promise<'timeout'>((resolve) => setTimeout(() => resolve('timeout'), SUSPENSE_TIMEOUT_MS)),\n        ])\n\n        if (result === 'timeout') {\n          if (__DEV__) {\n            console.warn(\n              `[Pyreon SSR] Suspense boundary timed out after ${SUSPENSE_TIMEOUT_MS}ms — fallback will remain.`,\n            )\n          }\n          // Fallback stays visible — no swap\n          return\n        }\n\n        // Escape </template> in buffered content to prevent early close + XSS\n        const content = buf.join('').replace(/<\\/template/gi, '<\\\\/template')\n        mainEnqueue(`<template id=\"pyreon-t-${id}\">${content}</template>`)\n        mainEnqueue(`<script>__NS(\"pyreon-s-${id}\",\"pyreon-t-${id}\")</script>`)\n      } catch (err) {\n        if (__DEV__) {\n          console.error(\n            `[Pyreon SSR] Suspense boundary caught an error — fallback will remain:`,\n            err,\n          )\n        }\n        // Fallback stays visible — no swap script emitted\n      } finally {\n        ctx.suspenseDepth--\n      }\n    }),\n  )\n}\n\n// ─── Core renderer ───────────────────────────────────────────────────────────\n\nasync function renderNode(node: VNodeChild | (() => VNodeChild)): Promise<string> {\n  // Reactive accessor — call it synchronously (snapshot)\n  if (typeof node === 'function') {\n    return renderNode((node as () => VNodeChild)())\n  }\n\n  if (node == null || node === false) return ''\n\n  if (typeof node === 'string') return escapeHtml(node)\n  if (typeof node === 'number' || typeof node === 'boolean') return String(node)\n\n  if (Array.isArray(node)) {\n    let html = ''\n    for (const child of node) html += await renderNode(child)\n    return html\n  }\n\n  const vnode = node as VNode\n\n  if (vnode.type === Fragment) {\n    return renderChildren(vnode.children)\n  }\n\n  if (vnode.type === (ForSymbol as unknown as string)) {\n    const { each, children, by } = vnode.props as unknown as ForProps<unknown>\n    let forHtml = '<!--pyreon-for-->'\n    for (const item of each()) {\n      const key = by(item)\n      forHtml += `<!--k:${safeKeyForMarker(key)}-->`\n      forHtml += await renderNode(children(item) as VNodeChild)\n    }\n    forHtml += '<!--/pyreon-for-->'\n    return forHtml\n  }\n\n  if (typeof vnode.type === 'function') {\n    return renderComponent(vnode as VNode & { type: ComponentFn })\n  }\n\n  return renderElement(vnode)\n}\n\nasync function renderChildren(children: VNodeChild[]): Promise<string> {\n  let html = ''\n  for (const child of children) html += await renderNode(child)\n  return html\n}\n\nasync function renderComponent(vnode: VNode & { type: ComponentFn }): Promise<string> {\n  const { vnode: output } = runWithHooks(vnode.type, mergeChildrenIntoProps(vnode))\n\n  // Async component function (async function Component()) — await the promise\n  if (output instanceof Promise) {\n    const resolved = await output\n    if (resolved === null) return ''\n    return renderNode(resolved)\n  }\n\n  if (output === null) return ''\n  return renderNode(output)\n}\n\nasync function renderElement(vnode: VNode): Promise<string> {\n  const tag = vnode.type as string\n  warnIfUnsafeTag(tag)\n  let html = `<${tag}`\n\n  const props = vnode.props as Record<string, unknown>\n  for (const key in props) {\n    const attr = renderProp(key, props[key])\n    if (attr) html += ` ${attr}`\n  }\n\n  if (isVoidElement(tag)) {\n    html += ' />'\n    return html\n  }\n\n  html += '>'\n\n  // dangerouslySetInnerHTML — inject raw HTML, skip children\n  const dangerous = props.dangerouslySetInnerHTML as { __html: string } | undefined\n  if (dangerous?.__html) {\n    html += dangerous.__html\n  } else {\n    for (const child of vnode.children) {\n      html += await renderNode(child)\n    }\n  }\n\n  html += `</${tag}>`\n  return html\n}\n\nconst SSR_URL_ATTRS = new Set(['href', 'src', 'action', 'formaction', 'poster', 'cite', 'data'])\nconst SSR_UNSAFE_URL_RE = /^\\s*(?:javascript|data):/i\n\nfunction renderPropSkipped(key: string): boolean {\n  if (key === 'key' || key === 'ref' || key === 'dangerouslySetInnerHTML') return true\n  if (/^on[A-Z]/.test(key)) return true\n  return false\n}\n\nfunction renderPropValue(key: string, value: unknown): string | null {\n  if (value === null || value === undefined || value === false) return null\n  if (value === true) return escapeHtml(toAttrName(key))\n\n  if (key === 'class') {\n    const cls = cx(value as ClassValue)\n    return cls ? `class=\"${escapeHtml(cls)}\"` : null\n  }\n\n  if (key === 'style') {\n    const style = normalizeStyle(value)\n    return style ? `style=\"${escapeHtml(style)}\"` : null\n  }\n\n  return `${escapeHtml(toAttrName(key))}=\"${escapeHtml(String(value))}\"`\n}\n\nfunction renderProp(key: string, value: unknown): string | null {\n  if (renderPropSkipped(key)) return null\n\n  if (typeof value === 'function') {\n    return renderProp(key, (value as () => unknown)())\n  }\n\n  if (SSR_URL_ATTRS.has(key) && typeof value === 'string' && SSR_UNSAFE_URL_RE.test(value)) {\n    return null\n  }\n\n  return renderPropValue(key, value)\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\nconst VOID_ELEMENTS = new Set([\n  'area',\n  'base',\n  'br',\n  'col',\n  'embed',\n  'hr',\n  'img',\n  'input',\n  'link',\n  'meta',\n  'param',\n  'source',\n  'track',\n  'wbr',\n])\n\nfunction isVoidElement(tag: string): boolean {\n  return VOID_ELEMENTS.has(tag.toLowerCase())\n}\n\n/** camelCase prop → kebab-case HTML attribute (e.g. className → class, htmlFor → for) */\nfunction toAttrName(key: string): string {\n  if (key === 'className') return 'class'\n  if (key === 'htmlFor') return 'for'\n  return key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)\n}\n\nfunction isStyleObject(value: unknown): value is Record<string, unknown> {\n  if (!value) return false\n  return typeof value === 'object'\n}\n\nfunction normalizeStyle(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (isStyleObject(value)) {\n    const proto = Object.getPrototypeOf(value)\n    if (proto === Object.prototype || proto === null) {\n      return Object.entries(value)\n        .map(([k, v]) => `${toKebab(k)}: ${normalizeStyleValue(k, v)}`)\n        .join('; ')\n    }\n  }\n  return ''\n}\n\nfunction toKebab(str: string): string {\n  return str.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)\n}\n\nconst ESCAPE_MAP: Record<string, string> = {\n  '&': '&amp;',\n  '<': '&lt;',\n  '>': '&gt;',\n  '\"': '&quot;',\n  \"'\": '&#39;',\n}\n\n/**\n * Encode a For-list key so it's safe to inline inside an HTML comment\n * marker `<!--k:KEY-->`. If a user-supplied key contains `-->` the naive\n * form breaks out of the comment and may inject markup. Per-byte URL\n * encoding with an extra `-` substitution makes `-->` impossible in the\n * output: `%2D%2D>` no longer terminates the comment. Client-side\n * hydration does not read the marker body today, so any reversible-or-\n * irreversible encoding works; this one is predictable enough for a\n * future consumer to decode if needed.\n */\nfunction safeKeyForMarker(key: unknown): string {\n  return encodeURIComponent(String(key)).replace(/-/g, '%2D')\n}\n\n/**\n * Inverse of `safeKeyForMarker` — decode a marker-safe key back to the\n * original string. Not used by runtime today (hydration does not read\n * per-item `<!--k:KEY-->` markers) but shipped alongside the encoder so\n * future hydration or devtools consumers decode symmetrically without\n * having to re-derive the encoding from source.\n */\nexport function decodeKeyFromMarker(encoded: string): string {\n  return decodeURIComponent(encoded.replace(/%2D/gi, '-'))\n}\n\n// Detect tag names that would break out of the `<TAG>` or `</TAG>` form\n// and inject HTML. If user data ever feeds `h(userTag, ...)` the attack\n// `userTag = 'div><script>alert(1)</script><div'` yields executable\n// markup. Framework doesn't HTML-escape tag names (React/Vue/Solid\n// match) — responsibility is on the caller — but a dev-mode warning\n// catches the mistake before it reaches prod. Safe tag pattern covers\n// HTML element names and custom elements (letter start, then\n// alphanumerics + hyphens).\nconst SAFE_TAG_RE = /^[a-zA-Z][a-zA-Z0-9-]*$/\nfunction warnIfUnsafeTag(tag: string): void {\n  if (!__DEV__) return\n  if (SAFE_TAG_RE.test(tag)) return\n  // oxlint-disable-next-line no-console\n  console.warn(\n    `[Pyreon SSR] Tag name \"${tag}\" contains characters that could break HTML structure. ` +\n      `Tag names must match /^[a-zA-Z][a-zA-Z0-9-]*$/. ` +\n      `If user-supplied data drives a tag name, validate it against an allowlist before passing to h().`,\n  )\n}\n\n// Fast test — most strings in SSR have no special chars (tag names, class names, etc.)\nconst NEEDS_ESCAPE_RE = /[&<>\"']/\n\nfunction escapeHtml(str: string): string {\n  if (!NEEDS_ESCAPE_RE.test(str)) return str\n  return str.replace(/[&<>\"']/g, (c) => ESCAPE_MAP[c] ?? c)\n}\n\n/**\n * Merge vnode.children into props.children for component rendering.\n * Matches the behavior of mount.ts and hydrate.ts so components can\n * access children passed via h(Comp, props, child1, child2).\n */\nfunction mergeChildrenIntoProps(vnode: VNode): Record<string, unknown> {\n  if (\n    vnode.children.length > 0 &&\n    (vnode.props as Record<string, unknown>).children === undefined\n  ) {\n    return {\n      ...vnode.props,\n      children: vnode.children.length === 1 ? vnode.children[0] : vnode.children,\n    }\n  }\n  return vnode.props as Record<string, unknown>\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA2BA,MAAM,UAAU,OAAO,YAAY,eAAe,QAAQ,IAAI,aAAa;AAa3E,MAAM,gBAAgB,IAAI,mBAA8B;AAMxD,MAAM,cAAc,IAAI,mBAA2C;AACnE,MAAM,iBAAyC,EAAE;AAEjD,8BAA8B,YAAY,UAAU,IAAI,eAAe;AAMvE,MAAM,YAAY,IAAI,mBAAyC;AAC/D,IAAI,wBAAwB;;;;;;;;;AAU5B,SAAgB,wBACd,0BACM;AACN,gCAA+B,UAAU,UAAU,oBAAI,IAAI,KAAK,CAAC;AACjE,yBAAwB;;;AAI1B,SAAS,iBAAoB,IAAgB;AAC3C,KAAI,CAAC,sBAAuB,QAAO,IAAI;AACvC,QAAO,UAAU,oBAAI,IAAI,KAAK,EAAE,GAAG;;;AAMrC,eAAsB,eAAe,MAAqC;AACxE,KAAI,SAAS,KAAM,QAAO;AAE1B,QAAO,uBAAuB,YAAY,IAAI,EAAE,QAAQ,WAAW,KAAK,CAAC,CAAC;;;;;;;AAQ5E,SAAgB,sBAAyB,IAAkC;AACzE,QAAO,uBAAuB,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC;;;;;;;;;;;;;;;AAgBxD,SAAgB,eAAe,MAA4C;AACzE,QAAO,IAAI,eAAuB,EAChC,MAAM,YAAY;EAChB,MAAM,WAAW,UAAkB,WAAW,QAAQ,MAAM;EAC5D,IAAI,MAAM;EACV,MAAM,MAAiB;GACrB,SAAS,EAAE;GACX,cAAc;GACd,aAAa;GACb,eAAe;GAChB;AACD,SAAO,uBACL,YAAY,IAAI,EAAE,QAChB,cACG,IAAI,KAAK,YAAY;AACpB,SAAM,WAAW,MAAM,QAAQ;AAE/B,UAAO,IAAI,QAAQ,SAAS,EAC1B,OAAM,QAAQ,IAAI,IAAI,QAAQ,OAAO,EAAE,CAAC;AAE1C,cAAW,OAAO;IAClB,CACD,OAAO,QAAQ,WAAW,MAAM,IAAI,CAAC,CACzC,CACF;IAEJ,CAAC;;AAKJ,eAAe,YAAY,OAAc,SAA6C;AACpF,KAAI,MAAM,SAAS,UAAU;AAC3B,OAAK,MAAM,SAAS,MAAM,SAAU,OAAM,WAAW,OAAO,QAAQ;AACpE;;AAGF,KAAI,MAAM,SAAU,WAAiC;EACnD,MAAM,EAAE,MAAM,UAAU,OAAO,MAAM;AACrC,UAAQ,oBAAoB;AAC5B,OAAK,MAAM,QAAQ,MAAM,EAAE;AAEzB,WAAQ,SAAS,iBADL,GAAG,KAAK,CACkB,CAAC,KAAK;AAC5C,SAAM,WAAW,SAAS,KAAK,EAAgB,QAAQ;;AAEzD,UAAQ,qBAAqB;AAC7B;;AAGF,KAAI,OAAO,MAAM,SAAS,YAAY;AACpC,QAAM,oBAAoB,OAAO,QAAQ;AACzC;;AAGF,OAAM,kBAAkB,OAAO,QAAQ;;AAGzC,eAAe,oBAAoB,OAAc,SAA6C;AAC5F,KAAI,MAAM,SAAS,UAAU;AAC3B,QAAM,uBAAuB,OAAO,QAAQ;AAC5C;;AAEF,KAAI;EACF,MAAM,EAAE,OAAO,WAAW,aAAa,MAAM,MAAqB,uBAAuB,MAAM,CAAC;EAChG,MAAM,WAAW,kBAAkB,UAAU,MAAM,SAAS;AAC5D,MAAI,aAAa,KAAM,OAAM,WAAW,UAAU,QAAQ;UACnD,KAAK;AACZ,MAAI,SAAS;GACX,MAAM,OAAQ,MAAM,KAAqB,QAAQ;AACjD,WAAQ,MAAM,iCAAiC,KAAK,KAAK,IAAI;;EAK/D,MAAM,MAAM,cAAc,UAAU;AACpC,MAAI,OAAO,IAAI,gBAAgB,EAAG,OAAM;AACxC,UAAQ,sBAAsB;;;AAIlC,eAAe,kBAAkB,OAAc,SAA6C;CAC1F,MAAM,MAAM,MAAM;AAClB,iBAAgB,IAAI;CACpB,IAAI,OAAO,IAAI;CACf,MAAM,QAAQ,MAAM;AACpB,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,WAAW,KAAK,MAAM,KAAK;AACxC,MAAI,KAAM,SAAQ,IAAI;;AAExB,KAAI,cAAc,IAAI,EAAE;AACtB,UAAQ,GAAG,KAAK,KAAK;AACrB;;AAEF,SAAQ,GAAG,KAAK,GAAG;CACnB,MAAM,YAAY,MAAM;AACxB,KAAI,WAAW,OACb,SAAQ,UAAU,OAAO;KAEzB,MAAK,MAAM,SAAS,MAAM,SAAU,OAAM,WAAW,OAAO,QAAQ;AAEtE,SAAQ,KAAK,IAAI,GAAG;;AAGtB,eAAe,WACb,MACA,SACe;AACf,KAAI,OAAO,SAAS,WAClB,QAAO,WAAY,MAA2B,EAAE,QAAQ;AAE1D,KAAI,QAAQ,QAAQ,SAAS,MAAO;AACpC,KAAI,OAAO,SAAS,UAAU;AAC5B,UAAQ,WAAW,KAAK,CAAC;AACzB;;AAEF,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;AACzD,UAAQ,OAAO,KAAK,CAAC;AACrB;;AAEF,KAAI,MAAM,QAAQ,KAAK,EAAE;AACvB,OAAK,MAAM,SAAS,KAAM,OAAM,WAAW,OAAO,QAAQ;AAC1D;;AAGF,OAAM,YAAY,MAAe,QAAQ;;AAI3C,MAAM,mBACJ;;;;;;;;AAUF,eAAe,uBAAuB,OAAc,SAA6C;CAC/F,MAAM,MAAM,cAAc,UAAU;CACpC,MAAM,EAAE,UAAU,aAAa,MAAM;AAGrC,KAAI,CAAC,KAAK;EACR,MAAM,EAAE,OAAO,WAAW,aAAa,UAAyB,MAAM,MAAM;AAC5E,MAAI,WAAW,KAAM,OAAM,WAAW,QAAQ,QAAQ;AACtD;;CAGF,MAAM,KAAK,IAAI,QAAQ;CACvB,MAAM,EAAE,gBAAgB;AAGxB,KAAI,OAAO,EAAG,aAAY,iBAAiB;AAG3C,aAAY,qBAAqB,GAAG,IAAI;AACxC,OAAM,WAAW,YAAY,MAAM,QAAQ;AAC3C,aAAY,SAAS;CAGrB,MAAM,WAAW,YAAY,UAAU,IAAI,EAAE;CAK7C,MAAM,sBAAsB;AAE5B,KAAI,QAAQ,KACV,YAAY,IAAI,UAAU,YAAY;AACpC,MAAI;AACF,OAAI;GACJ,MAAM,MAAgB,EAAE;AAQxB,OALe,MAAM,QAAQ,KAAK,CAChC,WAAW,YAAY,OAAO,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,WAAW,WAAoB,EAChF,IAAI,SAAoB,YAAY,iBAAiB,QAAQ,UAAU,EAAE,oBAAoB,CAAC,CAC/F,CAAC,KAEa,WAAW;AACxB,QAAI,QACF,SAAQ,KACN,kDAAkD,oBAAoB,4BACvE;AAGH;;AAKF,eAAY,0BAA0B,GAAG,IADzB,IAAI,KAAK,GAAG,CAAC,QAAQ,iBAAiB,eAAe,CAChB,aAAa;AAClE,eAAY,0BAA0B,GAAG,cAAc,GAAG,cAAa;WAChE,KAAK;AACZ,OAAI,QACF,SAAQ,MACN,0EACA,IACD;YAGK;AACR,OAAI;;GAEN,CACH;;AAKH,eAAe,WAAW,MAAwD;AAEhF,KAAI,OAAO,SAAS,WAClB,QAAO,WAAY,MAA2B,CAAC;AAGjD,KAAI,QAAQ,QAAQ,SAAS,MAAO,QAAO;AAE3C,KAAI,OAAO,SAAS,SAAU,QAAO,WAAW,KAAK;AACrD,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,UAAW,QAAO,OAAO,KAAK;AAE9E,KAAI,MAAM,QAAQ,KAAK,EAAE;EACvB,IAAI,OAAO;AACX,OAAK,MAAM,SAAS,KAAM,SAAQ,MAAM,WAAW,MAAM;AACzD,SAAO;;CAGT,MAAM,QAAQ;AAEd,KAAI,MAAM,SAAS,SACjB,QAAO,eAAe,MAAM,SAAS;AAGvC,KAAI,MAAM,SAAU,WAAiC;EACnD,MAAM,EAAE,MAAM,UAAU,OAAO,MAAM;EACrC,IAAI,UAAU;AACd,OAAK,MAAM,QAAQ,MAAM,EAAE;GACzB,MAAM,MAAM,GAAG,KAAK;AACpB,cAAW,SAAS,iBAAiB,IAAI,CAAC;AAC1C,cAAW,MAAM,WAAW,SAAS,KAAK,CAAe;;AAE3D,aAAW;AACX,SAAO;;AAGT,KAAI,OAAO,MAAM,SAAS,WACxB,QAAO,gBAAgB,MAAuC;AAGhE,QAAO,cAAc,MAAM;;AAG7B,eAAe,eAAe,UAAyC;CACrE,IAAI,OAAO;AACX,MAAK,MAAM,SAAS,SAAU,SAAQ,MAAM,WAAW,MAAM;AAC7D,QAAO;;AAGT,eAAe,gBAAgB,OAAuD;CACpF,MAAM,EAAE,OAAO,WAAW,aAAa,MAAM,MAAM,uBAAuB,MAAM,CAAC;AAGjF,KAAI,kBAAkB,SAAS;EAC7B,MAAM,WAAW,MAAM;AACvB,MAAI,aAAa,KAAM,QAAO;AAC9B,SAAO,WAAW,SAAS;;AAG7B,KAAI,WAAW,KAAM,QAAO;AAC5B,QAAO,WAAW,OAAO;;AAG3B,eAAe,cAAc,OAA+B;CAC1D,MAAM,MAAM,MAAM;AAClB,iBAAgB,IAAI;CACpB,IAAI,OAAO,IAAI;CAEf,MAAM,QAAQ,MAAM;AACpB,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,WAAW,KAAK,MAAM,KAAK;AACxC,MAAI,KAAM,SAAQ,IAAI;;AAGxB,KAAI,cAAc,IAAI,EAAE;AACtB,UAAQ;AACR,SAAO;;AAGT,SAAQ;CAGR,MAAM,YAAY,MAAM;AACxB,KAAI,WAAW,OACb,SAAQ,UAAU;KAElB,MAAK,MAAM,SAAS,MAAM,SACxB,SAAQ,MAAM,WAAW,MAAM;AAInC,SAAQ,KAAK,IAAI;AACjB,QAAO;;AAGT,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAU;CAAc;CAAU;CAAQ;CAAO,CAAC;AAChG,MAAM,oBAAoB;AAE1B,SAAS,kBAAkB,KAAsB;AAC/C,KAAI,QAAQ,SAAS,QAAQ,SAAS,QAAQ,0BAA2B,QAAO;AAChF,KAAI,WAAW,KAAK,IAAI,CAAE,QAAO;AACjC,QAAO;;AAGT,SAAS,gBAAgB,KAAa,OAA+B;AACnE,KAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,MAAO,QAAO;AACrE,KAAI,UAAU,KAAM,QAAO,WAAW,WAAW,IAAI,CAAC;AAEtD,KAAI,QAAQ,SAAS;EACnB,MAAM,MAAM,GAAG,MAAoB;AACnC,SAAO,MAAM,UAAU,WAAW,IAAI,CAAC,KAAK;;AAG9C,KAAI,QAAQ,SAAS;EACnB,MAAM,QAAQ,eAAe,MAAM;AACnC,SAAO,QAAQ,UAAU,WAAW,MAAM,CAAC,KAAK;;AAGlD,QAAO,GAAG,WAAW,WAAW,IAAI,CAAC,CAAC,IAAI,WAAW,OAAO,MAAM,CAAC,CAAC;;AAGtE,SAAS,WAAW,KAAa,OAA+B;AAC9D,KAAI,kBAAkB,IAAI,CAAE,QAAO;AAEnC,KAAI,OAAO,UAAU,WACnB,QAAO,WAAW,KAAM,OAAyB,CAAC;AAGpD,KAAI,cAAc,IAAI,IAAI,IAAI,OAAO,UAAU,YAAY,kBAAkB,KAAK,MAAM,CACtF,QAAO;AAGT,QAAO,gBAAgB,KAAK,MAAM;;AAKpC,MAAM,gBAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAS,cAAc,KAAsB;AAC3C,QAAO,cAAc,IAAI,IAAI,aAAa,CAAC;;;AAI7C,SAAS,WAAW,KAAqB;AACvC,KAAI,QAAQ,YAAa,QAAO;AAChC,KAAI,QAAQ,UAAW,QAAO;AAC9B,QAAO,IAAI,QAAQ,WAAW,MAAM,IAAI,EAAE,aAAa,GAAG;;AAG5D,SAAS,cAAc,OAAkD;AACvE,KAAI,CAAC,MAAO,QAAO;AACnB,QAAO,OAAO,UAAU;;AAG1B,SAAS,eAAe,OAAwB;AAC9C,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,cAAc,MAAM,EAAE;EACxB,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,MAAI,UAAU,OAAO,aAAa,UAAU,KAC1C,QAAO,OAAO,QAAQ,MAAM,CACzB,KAAK,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC,IAAI,oBAAoB,GAAG,EAAE,GAAG,CAC9D,KAAK,KAAK;;AAGjB,QAAO;;AAGT,SAAS,QAAQ,KAAqB;AACpC,QAAO,IAAI,QAAQ,WAAW,MAAM,IAAI,EAAE,aAAa,GAAG;;AAG5D,MAAM,aAAqC;CACzC,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAK;CACL,KAAK;CACN;;;;;;;;;;;AAYD,SAAS,iBAAiB,KAAsB;AAC9C,QAAO,mBAAmB,OAAO,IAAI,CAAC,CAAC,QAAQ,MAAM,MAAM;;;;;;;;;AAU7D,SAAgB,oBAAoB,SAAyB;AAC3D,QAAO,mBAAmB,QAAQ,QAAQ,SAAS,IAAI,CAAC;;AAW1D,MAAM,cAAc;AACpB,SAAS,gBAAgB,KAAmB;AAC1C,KAAI,CAAC,QAAS;AACd,KAAI,YAAY,KAAK,IAAI,CAAE;AAE3B,SAAQ,KACN,0BAA0B,IAAI,yMAG/B;;AAIH,MAAM,kBAAkB;AAExB,SAAS,WAAW,KAAqB;AACvC,KAAI,CAAC,gBAAgB,KAAK,IAAI,CAAE,QAAO;AACvC,QAAO,IAAI,QAAQ,aAAa,MAAM,WAAW,MAAM,EAAE;;;;;;;AAQ3D,SAAS,uBAAuB,OAAuC;AACrE,KACE,MAAM,SAAS,SAAS,KACvB,MAAM,MAAkC,aAAa,OAEtD,QAAO;EACL,GAAG,MAAM;EACT,UAAU,MAAM,SAAS,WAAW,IAAI,MAAM,SAAS,KAAK,MAAM;EACnE;AAEH,QAAO,MAAM"}

package/lib/types/index.d.ts

@@ -32,6 +32,14 @@ declare function runWithRequestContext<T>(fn: () => Promise<T>): Promise<T>;
  * Each renderToStream call gets its own isolated ALS context stack.
  */
 declare function renderToStream(root: VNode | null): ReadableStream<string>;
+/**
+ * Inverse of `safeKeyForMarker` — decode a marker-safe key back to the
+ * original string. Not used by runtime today (hydration does not read
+ * per-item `<!--k:KEY-->` markers) but shipped alongside the encoder so
+ * future hydration or devtools consumers decode symmetrically without
+ * having to re-derive the encoding from source.
+ */
+declare function decodeKeyFromMarker(encoded: string): string;
 //#endregion
-export { configureStoreIsolation, renderToStream, renderToString, runWithRequestContext };
+export { configureStoreIsolation, decodeKeyFromMarker, renderToStream, renderToString, runWithRequestContext };
 //# sourceMappingURL=index2.d.ts.map

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index2.d.ts","names":[],"sources":["../../../src/index.ts"],"mappings":";;;;;;;;;AA6FA;;iBA3BgB,uBAAA,CACd,wBAAA,GAA2B,EAAA,QAAU,GAAA;;iBAejB,cAAA,CAAe,IAAA,EAAM,KAAA,UAAe,OAAA;;;;;;iBAW1C,qBAAA,GAAA,CAAyB,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;;;;;;;AAiBxE;;;;;;;iBAAgB,cAAA,CAAe,IAAA,EAAM,KAAA,UAAe,cAAA"}
+{"version":3,"file":"index2.d.ts","names":[],"sources":["../../../src/index.ts"],"mappings":";;;;;;;;;AA6FA;;iBA3BgB,uBAAA,CACd,wBAAA,GAA2B,EAAA,QAAU,GAAA;;iBAejB,cAAA,CAAe,IAAA,EAAM,KAAA,UAAe,OAAA;;;;;;iBAW1C,qBAAA,GAAA,CAAyB,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;;;;;;;AAiBxE;;;;;;;iBAAgB,cAAA,CAAe,IAAA,EAAM,KAAA,UAAe,cAAA;;AA2apD;;;;;;iBAAgB,mBAAA,CAAoB,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pyreon/runtime-server",
-  "version": "0.12.13",
+  "version": "0.12.14",
   "description": "SSR/SSG renderer for Pyreon — streaming HTML + static generation",
   "homepage": "https://github.com/pyreon/pyreon/tree/main/packages/runtime-server#readme",
   "bugs": {
@@ -42,7 +42,7 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@pyreon/core": "^0.12.13",
-    "@pyreon/reactivity": "^0.12.13"
+    "@pyreon/core": "^0.12.14",
+    "@pyreon/reactivity": "^0.12.14"
   }
 }

package/src/index.ts

@@ -150,7 +150,7 @@ async function streamVNode(vnode: VNode, enqueue: (s: string) => void): Promise<
     enqueue('<!--pyreon-for-->')
     for (const item of each()) {
       const key = by(item)
-      enqueue(`<!--k:${key}-->`)
+      enqueue(`<!--k:${safeKeyForMarker(key)}-->`)
       await streamNode(children(item) as VNodeChild, enqueue)
     }
     enqueue('<!--/pyreon-for-->')
@@ -190,6 +190,7 @@ async function streamComponentNode(vnode: VNode, enqueue: (s: string) => void):
 
 async function streamElementNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {
   const tag = vnode.type as string
+  warnIfUnsafeTag(tag)
   let open = `<${tag}`
   const props = vnode.props as Record<string, unknown>
   for (const key in props) {
@@ -347,7 +348,7 @@ async function renderNode(node: VNodeChild | (() => VNodeChild)): Promise<string
     let forHtml = '<!--pyreon-for-->'
     for (const item of each()) {
       const key = by(item)
-      forHtml += `<!--k:${key}-->`
+      forHtml += `<!--k:${safeKeyForMarker(key)}-->`
       forHtml += await renderNode(children(item) as VNodeChild)
     }
     forHtml += '<!--/pyreon-for-->'
@@ -383,6 +384,7 @@ async function renderComponent(vnode: VNode & { type: ComponentFn }): Promise<st
 
 async function renderElement(vnode: VNode): Promise<string> {
   const tag = vnode.type as string
+  warnIfUnsafeTag(tag)
   let html = `<${tag}`
 
   const props = vnode.props as Record<string, unknown>
@@ -512,6 +514,51 @@ const ESCAPE_MAP: Record<string, string> = {
   "'": '&#39;',
 }
 
+/**
+ * Encode a For-list key so it's safe to inline inside an HTML comment
+ * marker `<!--k:KEY-->`. If a user-supplied key contains `-->` the naive
+ * form breaks out of the comment and may inject markup. Per-byte URL
+ * encoding with an extra `-` substitution makes `-->` impossible in the
+ * output: `%2D%2D>` no longer terminates the comment. Client-side
+ * hydration does not read the marker body today, so any reversible-or-
+ * irreversible encoding works; this one is predictable enough for a
+ * future consumer to decode if needed.
+ */
+function safeKeyForMarker(key: unknown): string {
+  return encodeURIComponent(String(key)).replace(/-/g, '%2D')
+}
+
+/**
+ * Inverse of `safeKeyForMarker` — decode a marker-safe key back to the
+ * original string. Not used by runtime today (hydration does not read
+ * per-item `<!--k:KEY-->` markers) but shipped alongside the encoder so
+ * future hydration or devtools consumers decode symmetrically without
+ * having to re-derive the encoding from source.
+ */
+export function decodeKeyFromMarker(encoded: string): string {
+  return decodeURIComponent(encoded.replace(/%2D/gi, '-'))
+}
+
+// Detect tag names that would break out of the `<TAG>` or `</TAG>` form
+// and inject HTML. If user data ever feeds `h(userTag, ...)` the attack
+// `userTag = 'div><script>alert(1)</script><div'` yields executable
+// markup. Framework doesn't HTML-escape tag names (React/Vue/Solid
+// match) — responsibility is on the caller — but a dev-mode warning
+// catches the mistake before it reaches prod. Safe tag pattern covers
+// HTML element names and custom elements (letter start, then
+// alphanumerics + hyphens).
+const SAFE_TAG_RE = /^[a-zA-Z][a-zA-Z0-9-]*$/
+function warnIfUnsafeTag(tag: string): void {
+  if (!__DEV__) return
+  if (SAFE_TAG_RE.test(tag)) return
+  // oxlint-disable-next-line no-console
+  console.warn(
+    `[Pyreon SSR] Tag name "${tag}" contains characters that could break HTML structure. ` +
+      `Tag names must match /^[a-zA-Z][a-zA-Z0-9-]*$/. ` +
+      `If user-supplied data drives a tag name, validate it against an allowlist before passing to h().`,
+  )
+}
+
 // Fast test — most strings in SSR have no special chars (tag names, class names, etc.)
 const NEEDS_ESCAPE_RE = /[&<>"']/
 

package/src/tests/for-key-marker.test.ts

@@ -0,0 +1,86 @@
+import { For, h } from '@pyreon/core'
+import { signal } from '@pyreon/reactivity'
+import { decodeKeyFromMarker, renderToString } from '../index'
+
+// For list SSR emits <!--k:KEY--> markers between items. The key is
+// user-supplied (derived from `by`) and must not be able to break out
+// of the HTML comment. A naive inline of `-->` would terminate the
+// comment and inject arbitrary markup. This suite locks the fix.
+
+describe('For SSR — key marker safety', () => {
+  it('emits one marker per item with the expected key for normal ids', async () => {
+    type Row = { id: number; label: string }
+    const items = signal<Row[]>([
+      { id: 1, label: 'a' },
+      { id: 2, label: 'b' },
+      { id: 3, label: 'c' },
+    ])
+    const html = await renderToString(
+      h(For, {
+        each: () => items(),
+        by: (r: Row) => r.id,
+        children: (r: Row) => h('li', null, r.label),
+      }),
+    )
+
+    const markers = html.match(/<!--k:[^>]*-->/g) ?? []
+    expect(markers).toHaveLength(3)
+    // Numeric keys are URL-encoded predictably (digits survive).
+    expect(markers[0]).toBe('<!--k:1-->')
+    expect(markers[1]).toBe('<!--k:2-->')
+    expect(markers[2]).toBe('<!--k:3-->')
+  })
+
+  it('prevents comment-breakout via `-->` in the key (XSS guard)', async () => {
+    // Adversarial: a key that would, unsanitized, close the comment and
+    // inject a <script> tag.
+    const attackKey = '--><script>alert(1)</script><!--'
+    type Row = { id: string }
+    const items = signal<Row[]>([{ id: attackKey }])
+    const html = await renderToString(
+      h(For, {
+        each: () => items(),
+        by: (r: Row) => r.id,
+        children: () => h('li', null, 'x'),
+      }),
+    )
+
+    // The raw attacker string must NOT appear verbatim.
+    expect(html).not.toContain('<script>alert(1)</script>')
+    // The `-->` terminator must not appear anywhere but at the very end
+    // of the marker (after the encoded key).
+    const markerMatch = html.match(/<!--k:([^-]*)-->/)
+    expect(markerMatch).not.toBeNull()
+    // No literal `-` survives inside the encoded key (defense-in-depth
+    // against any future HTML-comment parsing quirk).
+    expect(markerMatch![1]).not.toMatch(/-/)
+  })
+
+  it('URL-encodes keys with special chars safely', async () => {
+    type Row = { id: string }
+    const items = signal<Row[]>([{ id: 'a&b=c d' }])
+    const html = await renderToString(
+      h(For, {
+        each: () => items(),
+        by: (r: Row) => r.id,
+        children: () => h('li', null, 'x'),
+      }),
+    )
+
+    const marker = html.match(/<!--k:([^>]*)-->/)
+    expect(marker).not.toBeNull()
+    // `&`, `=`, ` `, and `-` all URL-encoded.
+    expect(marker![1]).toBe('a%26b%3Dc%20d')
+    // decodeKeyFromMarker round-trips back to the original string.
+    expect(decodeKeyFromMarker(marker![1]!)).toBe('a&b=c d')
+  })
+
+  it('decodeKeyFromMarker round-trips adversarial keys', () => {
+    // Directly round-trip the adversarial case that motivated the fix.
+    const attackKey = '--><script>alert(1)</script><!--'
+    // Produce what SSR would emit (safeKeyForMarker is private; use
+    // the inverse on a value we know was encoded from it).
+    const encoded = encodeURIComponent(attackKey).replace(/-/g, '%2D')
+    expect(decodeKeyFromMarker(encoded)).toBe(attackKey)
+  })
+})

package/src/tests/suspense-stream-error.test.ts

@@ -0,0 +1,83 @@
+import { h, Suspense } from '@pyreon/core'
+import type { ComponentFn } from '@pyreon/core'
+import { renderToStream } from '../index'
+
+async function collectStream(stream: ReadableStream<string>): Promise<string> {
+  const reader = stream.getReader()
+  let out = ''
+  while (true) {
+    const { value, done } = await reader.read()
+    if (done) break
+    out += value
+  }
+  return out
+}
+
+// PR #233 follow-up: when an async child inside a Suspense boundary
+// rejects mid-stream, what happens? The fallback should stay visible,
+// the swap must NOT be emitted, and the stream must close (not hang
+// waiting for a resolution that will never come).
+
+describe('renderToStream — Suspense boundary rejection', () => {
+  test('keeps fallback visible and closes stream when async child rejects', async () => {
+    async function Rejects(): Promise<ReturnType<typeof h>> {
+      await new Promise<void>((r) => setTimeout(r, 5))
+      throw new Error('deliberate test failure')
+    }
+
+    const vnode = h(Suspense, {
+      fallback: h('p', { id: 'fallback' }, 'loading...'),
+      children: h(Rejects as unknown as ComponentFn, null),
+    })
+
+    // If the stream hangs, this test will time out. Passing means it
+    // closed cleanly via controller.close().
+    const html = await collectStream(renderToStream(vnode))
+
+    // Fallback placeholder + content are present
+    expect(html).toContain('id="pyreon-s-0"')
+    expect(html).toContain('loading...')
+
+    // NO swap template or __NS invocation for this boundary — those only
+    // emit on successful resolution. The __NS helper FUNCTION is always
+    // inlined once per stream; distinguish definition vs call.
+    expect(html).not.toContain('id="pyreon-t-0"')
+    expect(html).not.toContain('__NS("pyreon-s-0"')
+  })
+
+  test('one rejecting boundary does not abort siblings — other content still streams', async () => {
+    async function Rejects(): Promise<ReturnType<typeof h>> {
+      await new Promise<void>((r) => setTimeout(r, 5))
+      throw new Error('sibling rejection')
+    }
+    async function Resolves(): Promise<ReturnType<typeof h>> {
+      await new Promise<void>((r) => setTimeout(r, 10))
+      return h('span', { id: 'ok' }, 'ok')
+    }
+
+    const vnode = h(
+      'div',
+      null,
+      h(Suspense, {
+        fallback: h('span', { id: 'fb-a' }, 'fb-a'),
+        children: h(Rejects as unknown as ComponentFn, null),
+      }),
+      h(Suspense, {
+        fallback: h('span', { id: 'fb-b' }, 'fb-b'),
+        children: h(Resolves as unknown as ComponentFn, null),
+      }),
+    )
+
+    const html = await collectStream(renderToStream(vnode))
+
+    // Both fallbacks shipped
+    expect(html).toContain('id="fb-a"')
+    expect(html).toContain('id="fb-b"')
+    // The resolving sibling's swap still went through. The rejecting
+    // sibling (boundary id 0) must NOT swap; the resolving one (id 1)
+    // must. Assert the specific invocations.
+    expect(html).toContain('id="ok"')
+    expect(html).not.toContain('__NS("pyreon-s-0"')
+    expect(html).toContain('__NS("pyreon-s-1"')
+  })
+})

package/src/tests/unsafe-tag-warning.test.ts

@@ -0,0 +1,55 @@
+import { h } from '@pyreon/core'
+import { renderToString } from '../index'
+
+// Security sweep follow-up to #233/#235. `vnode.type` is interpolated
+// into `<TAG>` and `</TAG>` unescaped (matching React/Vue/Solid — the
+// framework trusts callers not to feed user-controlled strings as tag
+// names). Defense-in-depth: dev-mode warning when the tag contains
+// characters that would break HTML structure, so the mistake surfaces
+// before it ships.
+
+describe('SSR — dev warning for unsafe tag names', () => {
+  let originalNodeEnv: string | undefined
+  let warnSpy: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    originalNodeEnv = process.env.NODE_ENV
+    // Ensure __DEV__ is true for the duration of these tests
+    process.env.NODE_ENV = 'development'
+    warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    if (originalNodeEnv === undefined) delete process.env.NODE_ENV
+    else process.env.NODE_ENV = originalNodeEnv
+    warnSpy.mockRestore()
+  })
+
+  it('does not warn for a normal HTML tag', async () => {
+    await renderToString(h('div', null, 'ok'))
+    expect(warnSpy).not.toHaveBeenCalled()
+  })
+
+  it('does not warn for custom elements with hyphens', async () => {
+    await renderToString(h('my-element', null, 'ok'))
+    expect(warnSpy).not.toHaveBeenCalled()
+  })
+
+  it('warns when the tag contains > (HTML breakout attempt)', async () => {
+    await renderToString(h('div><script>alert(1)</script><div', null, 'x'))
+    expect(warnSpy).toHaveBeenCalled()
+    const msg = warnSpy.mock.calls[0]?.[0] as string
+    expect(msg).toContain('[Pyreon SSR]')
+    expect(msg).toContain('break HTML structure')
+  })
+
+  it('warns when the tag contains a space (attribute-smuggling attempt)', async () => {
+    await renderToString(h('div onerror=alert(1)', null, 'x'))
+    expect(warnSpy).toHaveBeenCalled()
+  })
+
+  it('warns when the tag starts with a non-letter', async () => {
+    await renderToString(h('123-bad', null, 'x'))
+    expect(warnSpy).toHaveBeenCalled()
+  })
+})

package/src/tests/xss-attribute-escape.test.ts

@@ -0,0 +1,40 @@
+import { h } from '@pyreon/core'
+import { renderToString } from '../index'
+
+// Lock-in regression suite for attribute-value escaping. Flagged as
+// PR #233 follow-up: would a user-supplied string with embedded
+// HTML-significant characters break out of an attribute value and
+// inject arbitrary markup? Verified: escapeHtml covers all five
+// critical characters (& < > " '); this suite locks the invariant.
+
+describe('renderToString — attribute value escaping', () => {
+  it('escapes double quotes in attribute values (breakout prevention)', async () => {
+    const html = await renderToString(h('div', { 'data-x': 'he said "hi"' }))
+    expect(html).toContain('data-x="he said &quot;hi&quot;"')
+  })
+
+  it('escapes single quotes in attribute values', async () => {
+    const html = await renderToString(h('div', { 'data-x': "it's fine" }))
+    expect(html).toContain('data-x="it&#39;s fine"')
+  })
+
+  it('escapes ampersands (prevent entity confusion)', async () => {
+    const html = await renderToString(h('a', { href: 'https://x.test?a=1&b=2' }))
+    expect(html).toContain('href="https://x.test?a=1&amp;b=2"')
+  })
+
+  it('escapes < and > (prevent tag injection via attribute)', async () => {
+    const html = await renderToString(h('div', { 'data-x': '<script>bad</script>' }))
+    expect(html).toContain('data-x="&lt;script&gt;bad&lt;/script&gt;"')
+  })
+
+  it('escapes all five critical characters in a single value', async () => {
+    const html = await renderToString(h('div', { title: `&<>"'` }))
+    expect(html).toContain('title="&amp;&lt;&gt;&quot;&#39;"')
+  })
+
+  it('escapes text children containing HTML-significant chars', async () => {
+    const html = await renderToString(h('p', null, 'a & b < c > "d"'))
+    expect(html).toContain('a &amp; b &lt; c &gt; &quot;d&quot;')
+  })
+})