@pyreon/runtime-server 0.12.3 → 0.12.5

package/lib/analysis/index.js.html

@@ -5386,7 +5386,7 @@ var drawChart = (function (exports) {
   </script>
   <script>
     /*<!--*/
-    const data = {"version":2,"tree":{"name":"root","children":[{"name":"index.js","children":[{"name":"src/index.ts","uid":"5125f9bd-1"}]}],"isRoot":true},"nodeParts":{"5125f9bd-1":{"renderedLength":11630,"gzipLength":3793,"brotliLength":0,"metaUid":"5125f9bd-0"}},"nodeMetas":{"5125f9bd-0":{"id":"/src/index.ts","moduleParts":{"index.js":"5125f9bd-1"},"imported":[{"uid":"5125f9bd-2"},{"uid":"5125f9bd-3"}],"importedBy":[],"isEntry":true},"5125f9bd-2":{"id":"node:async_hooks","moduleParts":{},"imported":[],"importedBy":[{"uid":"5125f9bd-0"}]},"5125f9bd-3":{"id":"@pyreon/core","moduleParts":{},"imported":[],"importedBy":[{"uid":"5125f9bd-0"}]}},"env":{"rollup":"4.23.0"},"options":{"gzip":true,"brotli":false,"sourcemap":false}};
+    const data = {"version":2,"tree":{"name":"root","children":[{"name":"index.js","children":[{"name":"src/index.ts","uid":"b9d3bcae-1"}]}],"isRoot":true},"nodeParts":{"b9d3bcae-1":{"renderedLength":12118,"gzipLength":3978,"brotliLength":0,"metaUid":"b9d3bcae-0"}},"nodeMetas":{"b9d3bcae-0":{"id":"/src/index.ts","moduleParts":{"index.js":"b9d3bcae-1"},"imported":[{"uid":"b9d3bcae-2"},{"uid":"b9d3bcae-3"}],"importedBy":[],"isEntry":true},"b9d3bcae-2":{"id":"node:async_hooks","moduleParts":{},"imported":[],"importedBy":[{"uid":"b9d3bcae-0"}]},"b9d3bcae-3":{"id":"@pyreon/core","moduleParts":{},"imported":[],"importedBy":[{"uid":"b9d3bcae-0"}]}},"env":{"rollup":"4.23.0"},"options":{"gzip":true,"brotli":false,"sourcemap":false}};
 
     const run = () => {
       const width = window.innerWidth;

package/lib/index.js

@@ -89,9 +89,12 @@ async function streamVNode(vnode, enqueue) {
 		return;
 	}
 	if (vnode.type === ForSymbol) {
-		const { each, children } = vnode.props;
+		const { each, children, by } = vnode.props;
 		enqueue("<!--pyreon-for-->");
-		for (const item of each()) await streamNode(children(item), enqueue);
+		for (const item of each()) {
+			enqueue(`<!--k:${by(item)}-->`);
+			await streamNode(children(item), enqueue);
+		}
 		enqueue("<!--/pyreon-for-->");
 		return;
 	}
@@ -178,12 +181,16 @@ async function streamSuspenseBoundary(vnode, enqueue) {
 	await streamNode(fallback ?? null, enqueue);
 	mainEnqueue("</div>");
 	const ctxStore = _contextAls.getStore() ?? [];
+	const SUSPENSE_TIMEOUT_MS = 3e4;
 	ctx.pending.push(_contextAls.run(ctxStore, async () => {
 		try {
 			ctx.suspenseDepth++;
 			const buf = [];
-			await streamNode(children ?? null, (s) => buf.push(s));
-			mainEnqueue(`<template id="pyreon-t-${id}">${buf.join("")}</template>`);
+			if (await Promise.race([streamNode(children ?? null, (s) => buf.push(s)).then(() => "resolved"), new Promise((resolve) => setTimeout(() => resolve("timeout"), SUSPENSE_TIMEOUT_MS))]) === "timeout") {
+				if (__DEV__) console.warn(`[Pyreon SSR] Suspense boundary timed out after ${SUSPENSE_TIMEOUT_MS}ms — fallback will remain.`);
+				return;
+			}
+			mainEnqueue(`<template id="pyreon-t-${id}">${buf.join("").replace(/<\/template/gi, "<\\/template")}</template>`);
 			mainEnqueue(`<script>__NS("pyreon-s-${id}","pyreon-t-${id}")<\/script>`);
 		} catch (err) {
 			if (__DEV__) console.error(`[Pyreon SSR] Suspense boundary caught an error — fallback will remain:`, err);
@@ -205,9 +212,13 @@ async function renderNode(node) {
 	const vnode = node;
 	if (vnode.type === Fragment) return renderChildren(vnode.children);
 	if (vnode.type === ForSymbol) {
-		const { each, children } = vnode.props;
+		const { each, children, by } = vnode.props;
 		let forHtml = "<!--pyreon-for-->";
-		for (const item of each()) forHtml += await renderNode(children(item));
+		for (const item of each()) {
+			const key = by(item);
+			forHtml += `<!--k:${key}-->`;
+			forHtml += await renderNode(children(item));
+		}
 		forHtml += "<!--/pyreon-for-->";
 		return forHtml;
 	}

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @pyreon/runtime-server — SSR/SSG renderer for Pyreon.\n *\n * Walks a VNode tree and produces HTML strings.\n * Signal accessors (reactive getters `() => value`) are called synchronously\n * to snapshot their current value — no effects are set up on the server.\n *\n * Async components (`async function Component()`) are fully supported:\n * renderToString will await them before continuing the tree walk.\n *\n * API:\n *   renderToString(vnode)   → Promise<string>\n *   renderToStream(vnode)   → ReadableStream<string>\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks'\nimport type { ClassValue, ComponentFn, ForProps, VNode, VNodeChild } from '@pyreon/core'\nimport {\n  cx,\n  ForSymbol,\n  Fragment,\n  normalizeStyleValue,\n  runWithHooks,\n  Suspense,\n  setContextStackProvider,\n} from '@pyreon/core'\n\nconst __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'\n\n// ─── Streaming Suspense context ───────────────────────────────────────────────\n// Tracks in-flight async Suspense boundary resolutions within a single stream.\n\ninterface StreamCtx {\n  pending: Promise<void>[]\n  nextId: () => number\n  mainEnqueue: (s: string) => void\n  /** Depth counter — non-zero when rendering inside a Suspense child resolution. */\n  suspenseDepth: number\n}\n\nconst _streamCtxAls = new AsyncLocalStorage<StreamCtx>()\n\n// ─── Concurrent SSR context isolation ────────────────────────────────────────\n// Each renderToString call runs in its own ALS store (a fresh empty stack[]).\n// Concurrent requests never share context frames.\n\nconst _contextAls = new AsyncLocalStorage<Map<symbol, unknown>[]>()\nconst _fallbackStack: Map<symbol, unknown>[] = []\n\nsetContextStackProvider(() => _contextAls.getStore() ?? _fallbackStack)\n\n// ─── Store isolation (optional) ───────────────────────────────────────────────\n// A second ALS isolates store registries between concurrent requests.\n// Activated only when the user calls configureStoreIsolation().\n\nconst _storeAls = new AsyncLocalStorage<Map<string, unknown>>()\nlet _storeIsolationActive = false\n\n/**\n * Wire up per-request store isolation.\n * Call once at server startup, passing a `setStoreRegistryProvider` function.\n *\n * @example\n * import { configureStoreIsolation } from \"@pyreon/runtime-server\"\n * configureStoreIsolation(setStoreRegistryProvider)\n */\nexport function configureStoreIsolation(\n  setStoreRegistryProvider: (fn: () => Map<string, unknown>) => void,\n): void {\n  setStoreRegistryProvider(() => _storeAls.getStore() ?? new Map())\n  _storeIsolationActive = true\n}\n\n/** Wrap a function call in a fresh store registry (no-op if isolation not configured). */\nfunction withStoreContext<T>(fn: () => T): T {\n  if (!_storeIsolationActive) return fn()\n  return _storeAls.run(new Map(), fn)\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/** Render a VNode tree to an HTML string. Supports async component functions. */\nexport async function renderToString(root: VNode | null): Promise<string> {\n  if (root === null) return ''\n  // Each call gets a fresh isolated context stack and (optionally) store registry\n  return withStoreContext(() => _contextAls.run([], () => renderNode(root)))\n}\n\n/**\n * Run an async function with a fresh, isolated context stack and store registry.\n * Useful when you need to call Pyreon APIs (e.g. useHead, prefetchLoaderData)\n * outside of renderToString but still want per-request isolation.\n */\nexport function runWithRequestContext<T>(fn: () => Promise<T>): Promise<T> {\n  return withStoreContext(() => _contextAls.run([], fn))\n}\n\n/**\n * Render a VNode tree to a Web-standard ReadableStream of HTML chunks.\n *\n * True progressive streaming: HTML is flushed to the client as soon as each\n * node is ready. Synchronous subtrees are enqueued immediately; async component\n * boundaries are awaited in-order and their output is enqueued as it resolves.\n *\n * Suspense boundaries are streamed out-of-order: the fallback is emitted\n * immediately, and the resolved children are sent as a `<template>` + inline\n * swap script once ready — without blocking the rest of the page.\n *\n * Each renderToStream call gets its own isolated ALS context stack.\n */\nexport function renderToStream(root: VNode | null): ReadableStream<string> {\n  return new ReadableStream<string>({\n    start(controller) {\n      const enqueue = (chunk: string) => controller.enqueue(chunk)\n      let bid = 0\n      const ctx: StreamCtx = {\n        pending: [],\n        nextId: () => bid++,\n        mainEnqueue: enqueue,\n        suspenseDepth: 0,\n      }\n      return withStoreContext(() =>\n        _contextAls.run([], () =>\n          _streamCtxAls\n            .run(ctx, async () => {\n              await streamNode(root, enqueue)\n              // Drain all pending Suspense resolutions (may spawn nested ones)\n              while (ctx.pending.length > 0) {\n                await Promise.all(ctx.pending.splice(0))\n              }\n              controller.close()\n            })\n            .catch((err) => controller.error(err)),\n        ),\n      )\n    },\n  })\n}\n\n// ─── Streaming renderer ───────────────────────────────────────────────────────\n\nasync function streamVNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  if (vnode.type === Fragment) {\n    for (const child of vnode.children) await streamNode(child, enqueue)\n    return\n  }\n\n  if (vnode.type === (ForSymbol as unknown as string)) {\n    const { each, children } = vnode.props as unknown as ForProps<unknown>\n    enqueue('<!--pyreon-for-->')\n    for (const item of each()) await streamNode(children(item) as VNodeChild, enqueue)\n    enqueue('<!--/pyreon-for-->')\n    return\n  }\n\n  if (typeof vnode.type === 'function') {\n    await streamComponentNode(vnode, enqueue)\n    return\n  }\n\n  await streamElementNode(vnode, enqueue)\n}\n\nasync function streamComponentNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  if (vnode.type === Suspense) {\n    await streamSuspenseBoundary(vnode, enqueue)\n    return\n  }\n  try {\n    const { vnode: output } = runWithHooks(vnode.type as ComponentFn, mergeChildrenIntoProps(vnode))\n    const resolved = output instanceof Promise ? await output : output\n    if (resolved !== null) await streamNode(resolved, enqueue)\n  } catch (err) {\n    if (__DEV__) {\n      const name = (vnode.type as ComponentFn).name || 'Anonymous'\n      console.error(`[Pyreon SSR] Error rendering <${name}>:`, err)\n    }\n    // Inside a Suspense child resolution, re-throw so the boundary can catch and\n    // suppress the swap (fallback stays visible). Outside Suspense, swallow the\n    // error and emit a marker so the stream can continue.\n    const ctx = _streamCtxAls.getStore()\n    if (ctx && ctx.suspenseDepth > 0) throw err\n    enqueue('<!--pyreon-error-->')\n  }\n}\n\nasync function streamElementNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  const tag = vnode.type as string\n  let open = `<${tag}`\n  const props = vnode.props as Record<string, unknown>\n  for (const key in props) {\n    const attr = renderProp(key, props[key])\n    if (attr) open += ` ${attr}`\n  }\n  if (isVoidElement(tag)) {\n    enqueue(`${open} />`)\n    return\n  }\n  enqueue(`${open}>`)\n  const dangerous = props.dangerouslySetInnerHTML as { __html: string } | undefined\n  if (dangerous?.__html) {\n    enqueue(dangerous.__html)\n  } else {\n    for (const child of vnode.children) await streamNode(child, enqueue)\n  }\n  enqueue(`</${tag}>`)\n}\n\nasync function streamNode(\n  node: VNodeChild | null | (() => VNodeChild),\n  enqueue: (s: string) => void,\n): Promise<void> {\n  if (typeof node === 'function') {\n    return streamNode((node as () => VNodeChild)(), enqueue)\n  }\n  if (node == null || node === false) return\n  if (typeof node === 'string') {\n    enqueue(escapeHtml(node))\n    return\n  }\n  if (typeof node === 'number' || typeof node === 'boolean') {\n    enqueue(String(node))\n    return\n  }\n  if (Array.isArray(node)) {\n    for (const child of node) await streamNode(child, enqueue)\n    return\n  }\n\n  await streamVNode(node as VNode, enqueue)\n}\n\n// Inline swap helper emitted once per stream, before the first <template>\nconst SUSPENSE_SWAP_FN =\n  '<script>function __NS(s,t){var e=document.getElementById(s),l=document.getElementById(t);' +\n  'if(e&&l){e.replaceWith(l.content.cloneNode(!0));l.remove()}}</script>'\n\n/**\n * Stream a Suspense boundary: emit fallback immediately, then resolve children\n * asynchronously and emit them as a `<template>` + client-side swap.\n *\n * The actual children HTML is buffered until fully resolved, then emitted to the\n * main stream enqueue so it always arrives after the fallback placeholder.\n */\nasync function streamSuspenseBoundary(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  const ctx = _streamCtxAls.getStore()\n  const { fallback, children } = vnode.props as { fallback: VNodeChild; children?: VNodeChild }\n\n  // No streaming context (e.g. called from renderToString) — render children inline\n  if (!ctx) {\n    const { vnode: output } = runWithHooks(Suspense as ComponentFn, vnode.props)\n    if (output !== null) await streamNode(output, enqueue)\n    return\n  }\n\n  const id = ctx.nextId()\n  const { mainEnqueue } = ctx\n\n  // Emit the swap helper function once (before first use)\n  if (id === 0) mainEnqueue(SUSPENSE_SWAP_FN)\n\n  // Stream the fallback synchronously (no await on children)\n  mainEnqueue(`<div id=\"pyreon-s-${id}\">`)\n  await streamNode(fallback ?? null, enqueue)\n  mainEnqueue('</div>')\n\n  // Capture the context store for the async resolution so it inherits context\n  const ctxStore = _contextAls.getStore() ?? []\n\n  // Queue async resolution — runs in parallel, emits to main stream when done\n  // Errors are caught per-boundary so one failing Suspense doesn't abort the stream.\n  ctx.pending.push(\n    _contextAls.run(ctxStore, async () => {\n      try {\n        ctx.suspenseDepth++\n        const buf: string[] = []\n        await streamNode(children ?? null, (s) => buf.push(s))\n        mainEnqueue(`<template id=\"pyreon-t-${id}\">${buf.join('')}</template>`)\n        mainEnqueue(`<script>__NS(\"pyreon-s-${id}\",\"pyreon-t-${id}\")</script>`)\n      } catch (err) {\n        if (__DEV__) {\n          console.error(\n            `[Pyreon SSR] Suspense boundary caught an error — fallback will remain:`,\n            err,\n          )\n        }\n        // Fallback stays visible — no swap script emitted\n      } finally {\n        ctx.suspenseDepth--\n      }\n    }),\n  )\n}\n\n// ─── Core renderer ───────────────────────────────────────────────────────────\n\nasync function renderNode(node: VNodeChild | (() => VNodeChild)): Promise<string> {\n  // Reactive accessor — call it synchronously (snapshot)\n  if (typeof node === 'function') {\n    return renderNode((node as () => VNodeChild)())\n  }\n\n  if (node == null || node === false) return ''\n\n  if (typeof node === 'string') return escapeHtml(node)\n  if (typeof node === 'number' || typeof node === 'boolean') return String(node)\n\n  if (Array.isArray(node)) {\n    let html = ''\n    for (const child of node) html += await renderNode(child)\n    return html\n  }\n\n  const vnode = node as VNode\n\n  if (vnode.type === Fragment) {\n    return renderChildren(vnode.children)\n  }\n\n  if (vnode.type === (ForSymbol as unknown as string)) {\n    const { each, children } = vnode.props as unknown as ForProps<unknown>\n    let forHtml = '<!--pyreon-for-->'\n    for (const item of each()) forHtml += await renderNode(children(item) as VNodeChild)\n    forHtml += '<!--/pyreon-for-->'\n    return forHtml\n  }\n\n  if (typeof vnode.type === 'function') {\n    return renderComponent(vnode as VNode & { type: ComponentFn })\n  }\n\n  return renderElement(vnode)\n}\n\nasync function renderChildren(children: VNodeChild[]): Promise<string> {\n  let html = ''\n  for (const child of children) html += await renderNode(child)\n  return html\n}\n\nasync function renderComponent(vnode: VNode & { type: ComponentFn }): Promise<string> {\n  const { vnode: output } = runWithHooks(vnode.type, mergeChildrenIntoProps(vnode))\n\n  // Async component function (async function Component()) — await the promise\n  if (output instanceof Promise) {\n    const resolved = await output\n    if (resolved === null) return ''\n    return renderNode(resolved)\n  }\n\n  if (output === null) return ''\n  return renderNode(output)\n}\n\nasync function renderElement(vnode: VNode): Promise<string> {\n  const tag = vnode.type as string\n  let html = `<${tag}`\n\n  const props = vnode.props as Record<string, unknown>\n  for (const key in props) {\n    const attr = renderProp(key, props[key])\n    if (attr) html += ` ${attr}`\n  }\n\n  if (isVoidElement(tag)) {\n    html += ' />'\n    return html\n  }\n\n  html += '>'\n\n  // dangerouslySetInnerHTML — inject raw HTML, skip children\n  const dangerous = props.dangerouslySetInnerHTML as { __html: string } | undefined\n  if (dangerous?.__html) {\n    html += dangerous.__html\n  } else {\n    for (const child of vnode.children) {\n      html += await renderNode(child)\n    }\n  }\n\n  html += `</${tag}>`\n  return html\n}\n\nconst SSR_URL_ATTRS = new Set(['href', 'src', 'action', 'formaction', 'poster', 'cite', 'data'])\nconst SSR_UNSAFE_URL_RE = /^\\s*(?:javascript|data):/i\n\nfunction renderPropSkipped(key: string): boolean {\n  if (key === 'key' || key === 'ref' || key === 'dangerouslySetInnerHTML') return true\n  if (/^on[A-Z]/.test(key)) return true\n  return false\n}\n\nfunction renderPropValue(key: string, value: unknown): string | null {\n  if (value === null || value === undefined || value === false) return null\n  if (value === true) return escapeHtml(toAttrName(key))\n\n  if (key === 'class') {\n    const cls = cx(value as ClassValue)\n    return cls ? `class=\"${escapeHtml(cls)}\"` : null\n  }\n\n  if (key === 'style') {\n    const style = normalizeStyle(value)\n    return style ? `style=\"${escapeHtml(style)}\"` : null\n  }\n\n  return `${escapeHtml(toAttrName(key))}=\"${escapeHtml(String(value))}\"`\n}\n\nfunction renderProp(key: string, value: unknown): string | null {\n  if (renderPropSkipped(key)) return null\n\n  if (typeof value === 'function') {\n    return renderProp(key, (value as () => unknown)())\n  }\n\n  if (SSR_URL_ATTRS.has(key) && typeof value === 'string' && SSR_UNSAFE_URL_RE.test(value)) {\n    return null\n  }\n\n  return renderPropValue(key, value)\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\nconst VOID_ELEMENTS = new Set([\n  'area',\n  'base',\n  'br',\n  'col',\n  'embed',\n  'hr',\n  'img',\n  'input',\n  'link',\n  'meta',\n  'param',\n  'source',\n  'track',\n  'wbr',\n])\n\nfunction isVoidElement(tag: string): boolean {\n  return VOID_ELEMENTS.has(tag.toLowerCase())\n}\n\n/** camelCase prop → kebab-case HTML attribute (e.g. className → class, htmlFor → for) */\nfunction toAttrName(key: string): string {\n  if (key === 'className') return 'class'\n  if (key === 'htmlFor') return 'for'\n  return key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)\n}\n\nfunction isStyleObject(value: unknown): value is Record<string, unknown> {\n  if (!value) return false\n  return typeof value === 'object'\n}\n\nfunction normalizeStyle(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (isStyleObject(value)) {\n    const proto = Object.getPrototypeOf(value)\n    if (proto === Object.prototype || proto === null) {\n      return Object.entries(value)\n        .map(([k, v]) => `${toKebab(k)}: ${normalizeStyleValue(k, v)}`)\n        .join('; ')\n    }\n  }\n  return ''\n}\n\nfunction toKebab(str: string): string {\n  return str.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)\n}\n\nconst ESCAPE_MAP: Record<string, string> = {\n  '&': '&amp;',\n  '<': '&lt;',\n  '>': '&gt;',\n  '\"': '&quot;',\n  \"'\": '&#39;',\n}\n\n// Fast test — most strings in SSR have no special chars (tag names, class names, etc.)\nconst NEEDS_ESCAPE_RE = /[&<>\"']/\n\nfunction escapeHtml(str: string): string {\n  if (!NEEDS_ESCAPE_RE.test(str)) return str\n  return str.replace(/[&<>\"']/g, (c) => ESCAPE_MAP[c] ?? c)\n}\n\n/**\n * Merge vnode.children into props.children for component rendering.\n * Matches the behavior of mount.ts and hydrate.ts so components can\n * access children passed via h(Comp, props, child1, child2).\n */\nfunction mergeChildrenIntoProps(vnode: VNode): Record<string, unknown> {\n  if (\n    vnode.children.length > 0 &&\n    (vnode.props as Record<string, unknown>).children === undefined\n  ) {\n    return {\n      ...vnode.props,\n      children: vnode.children.length === 1 ? vnode.children[0] : vnode.children,\n    }\n  }\n  return vnode.props as Record<string, unknown>\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA2BA,MAAM,UAAU,OAAO,YAAY,eAAe,QAAQ,IAAI,aAAa;AAa3E,MAAM,gBAAgB,IAAI,mBAA8B;AAMxD,MAAM,cAAc,IAAI,mBAA2C;AACnE,MAAM,iBAAyC,EAAE;AAEjD,8BAA8B,YAAY,UAAU,IAAI,eAAe;AAMvE,MAAM,YAAY,IAAI,mBAAyC;AAC/D,IAAI,wBAAwB;;;;;;;;;AAU5B,SAAgB,wBACd,0BACM;AACN,gCAA+B,UAAU,UAAU,oBAAI,IAAI,KAAK,CAAC;AACjE,yBAAwB;;;AAI1B,SAAS,iBAAoB,IAAgB;AAC3C,KAAI,CAAC,sBAAuB,QAAO,IAAI;AACvC,QAAO,UAAU,oBAAI,IAAI,KAAK,EAAE,GAAG;;;AAMrC,eAAsB,eAAe,MAAqC;AACxE,KAAI,SAAS,KAAM,QAAO;AAE1B,QAAO,uBAAuB,YAAY,IAAI,EAAE,QAAQ,WAAW,KAAK,CAAC,CAAC;;;;;;;AAQ5E,SAAgB,sBAAyB,IAAkC;AACzE,QAAO,uBAAuB,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC;;;;;;;;;;;;;;;AAgBxD,SAAgB,eAAe,MAA4C;AACzE,QAAO,IAAI,eAAuB,EAChC,MAAM,YAAY;EAChB,MAAM,WAAW,UAAkB,WAAW,QAAQ,MAAM;EAC5D,IAAI,MAAM;EACV,MAAM,MAAiB;GACrB,SAAS,EAAE;GACX,cAAc;GACd,aAAa;GACb,eAAe;GAChB;AACD,SAAO,uBACL,YAAY,IAAI,EAAE,QAChB,cACG,IAAI,KAAK,YAAY;AACpB,SAAM,WAAW,MAAM,QAAQ;AAE/B,UAAO,IAAI,QAAQ,SAAS,EAC1B,OAAM,QAAQ,IAAI,IAAI,QAAQ,OAAO,EAAE,CAAC;AAE1C,cAAW,OAAO;IAClB,CACD,OAAO,QAAQ,WAAW,MAAM,IAAI,CAAC,CACzC,CACF;IAEJ,CAAC;;AAKJ,eAAe,YAAY,OAAc,SAA6C;AACpF,KAAI,MAAM,SAAS,UAAU;AAC3B,OAAK,MAAM,SAAS,MAAM,SAAU,OAAM,WAAW,OAAO,QAAQ;AACpE;;AAGF,KAAI,MAAM,SAAU,WAAiC;EACnD,MAAM,EAAE,MAAM,aAAa,MAAM;AACjC,UAAQ,oBAAoB;AAC5B,OAAK,MAAM,QAAQ,MAAM,CAAE,OAAM,WAAW,SAAS,KAAK,EAAgB,QAAQ;AAClF,UAAQ,qBAAqB;AAC7B;;AAGF,KAAI,OAAO,MAAM,SAAS,YAAY;AACpC,QAAM,oBAAoB,OAAO,QAAQ;AACzC;;AAGF,OAAM,kBAAkB,OAAO,QAAQ;;AAGzC,eAAe,oBAAoB,OAAc,SAA6C;AAC5F,KAAI,MAAM,SAAS,UAAU;AAC3B,QAAM,uBAAuB,OAAO,QAAQ;AAC5C;;AAEF,KAAI;EACF,MAAM,EAAE,OAAO,WAAW,aAAa,MAAM,MAAqB,uBAAuB,MAAM,CAAC;EAChG,MAAM,WAAW,kBAAkB,UAAU,MAAM,SAAS;AAC5D,MAAI,aAAa,KAAM,OAAM,WAAW,UAAU,QAAQ;UACnD,KAAK;AACZ,MAAI,SAAS;GACX,MAAM,OAAQ,MAAM,KAAqB,QAAQ;AACjD,WAAQ,MAAM,iCAAiC,KAAK,KAAK,IAAI;;EAK/D,MAAM,MAAM,cAAc,UAAU;AACpC,MAAI,OAAO,IAAI,gBAAgB,EAAG,OAAM;AACxC,UAAQ,sBAAsB;;;AAIlC,eAAe,kBAAkB,OAAc,SAA6C;CAC1F,MAAM,MAAM,MAAM;CAClB,IAAI,OAAO,IAAI;CACf,MAAM,QAAQ,MAAM;AACpB,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,WAAW,KAAK,MAAM,KAAK;AACxC,MAAI,KAAM,SAAQ,IAAI;;AAExB,KAAI,cAAc,IAAI,EAAE;AACtB,UAAQ,GAAG,KAAK,KAAK;AACrB;;AAEF,SAAQ,GAAG,KAAK,GAAG;CACnB,MAAM,YAAY,MAAM;AACxB,KAAI,WAAW,OACb,SAAQ,UAAU,OAAO;KAEzB,MAAK,MAAM,SAAS,MAAM,SAAU,OAAM,WAAW,OAAO,QAAQ;AAEtE,SAAQ,KAAK,IAAI,GAAG;;AAGtB,eAAe,WACb,MACA,SACe;AACf,KAAI,OAAO,SAAS,WAClB,QAAO,WAAY,MAA2B,EAAE,QAAQ;AAE1D,KAAI,QAAQ,QAAQ,SAAS,MAAO;AACpC,KAAI,OAAO,SAAS,UAAU;AAC5B,UAAQ,WAAW,KAAK,CAAC;AACzB;;AAEF,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;AACzD,UAAQ,OAAO,KAAK,CAAC;AACrB;;AAEF,KAAI,MAAM,QAAQ,KAAK,EAAE;AACvB,OAAK,MAAM,SAAS,KAAM,OAAM,WAAW,OAAO,QAAQ;AAC1D;;AAGF,OAAM,YAAY,MAAe,QAAQ;;AAI3C,MAAM,mBACJ;;;;;;;;AAUF,eAAe,uBAAuB,OAAc,SAA6C;CAC/F,MAAM,MAAM,cAAc,UAAU;CACpC,MAAM,EAAE,UAAU,aAAa,MAAM;AAGrC,KAAI,CAAC,KAAK;EACR,MAAM,EAAE,OAAO,WAAW,aAAa,UAAyB,MAAM,MAAM;AAC5E,MAAI,WAAW,KAAM,OAAM,WAAW,QAAQ,QAAQ;AACtD;;CAGF,MAAM,KAAK,IAAI,QAAQ;CACvB,MAAM,EAAE,gBAAgB;AAGxB,KAAI,OAAO,EAAG,aAAY,iBAAiB;AAG3C,aAAY,qBAAqB,GAAG,IAAI;AACxC,OAAM,WAAW,YAAY,MAAM,QAAQ;AAC3C,aAAY,SAAS;CAGrB,MAAM,WAAW,YAAY,UAAU,IAAI,EAAE;AAI7C,KAAI,QAAQ,KACV,YAAY,IAAI,UAAU,YAAY;AACpC,MAAI;AACF,OAAI;GACJ,MAAM,MAAgB,EAAE;AACxB,SAAM,WAAW,YAAY,OAAO,MAAM,IAAI,KAAK,EAAE,CAAC;AACtD,eAAY,0BAA0B,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,aAAa;AACvE,eAAY,0BAA0B,GAAG,cAAc,GAAG,cAAa;WAChE,KAAK;AACZ,OAAI,QACF,SAAQ,MACN,0EACA,IACD;YAGK;AACR,OAAI;;GAEN,CACH;;AAKH,eAAe,WAAW,MAAwD;AAEhF,KAAI,OAAO,SAAS,WAClB,QAAO,WAAY,MAA2B,CAAC;AAGjD,KAAI,QAAQ,QAAQ,SAAS,MAAO,QAAO;AAE3C,KAAI,OAAO,SAAS,SAAU,QAAO,WAAW,KAAK;AACrD,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,UAAW,QAAO,OAAO,KAAK;AAE9E,KAAI,MAAM,QAAQ,KAAK,EAAE;EACvB,IAAI,OAAO;AACX,OAAK,MAAM,SAAS,KAAM,SAAQ,MAAM,WAAW,MAAM;AACzD,SAAO;;CAGT,MAAM,QAAQ;AAEd,KAAI,MAAM,SAAS,SACjB,QAAO,eAAe,MAAM,SAAS;AAGvC,KAAI,MAAM,SAAU,WAAiC;EACnD,MAAM,EAAE,MAAM,aAAa,MAAM;EACjC,IAAI,UAAU;AACd,OAAK,MAAM,QAAQ,MAAM,CAAE,YAAW,MAAM,WAAW,SAAS,KAAK,CAAe;AACpF,aAAW;AACX,SAAO;;AAGT,KAAI,OAAO,MAAM,SAAS,WACxB,QAAO,gBAAgB,MAAuC;AAGhE,QAAO,cAAc,MAAM;;AAG7B,eAAe,eAAe,UAAyC;CACrE,IAAI,OAAO;AACX,MAAK,MAAM,SAAS,SAAU,SAAQ,MAAM,WAAW,MAAM;AAC7D,QAAO;;AAGT,eAAe,gBAAgB,OAAuD;CACpF,MAAM,EAAE,OAAO,WAAW,aAAa,MAAM,MAAM,uBAAuB,MAAM,CAAC;AAGjF,KAAI,kBAAkB,SAAS;EAC7B,MAAM,WAAW,MAAM;AACvB,MAAI,aAAa,KAAM,QAAO;AAC9B,SAAO,WAAW,SAAS;;AAG7B,KAAI,WAAW,KAAM,QAAO;AAC5B,QAAO,WAAW,OAAO;;AAG3B,eAAe,cAAc,OAA+B;CAC1D,MAAM,MAAM,MAAM;CAClB,IAAI,OAAO,IAAI;CAEf,MAAM,QAAQ,MAAM;AACpB,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,WAAW,KAAK,MAAM,KAAK;AACxC,MAAI,KAAM,SAAQ,IAAI;;AAGxB,KAAI,cAAc,IAAI,EAAE;AACtB,UAAQ;AACR,SAAO;;AAGT,SAAQ;CAGR,MAAM,YAAY,MAAM;AACxB,KAAI,WAAW,OACb,SAAQ,UAAU;KAElB,MAAK,MAAM,SAAS,MAAM,SACxB,SAAQ,MAAM,WAAW,MAAM;AAInC,SAAQ,KAAK,IAAI;AACjB,QAAO;;AAGT,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAU;CAAc;CAAU;CAAQ;CAAO,CAAC;AAChG,MAAM,oBAAoB;AAE1B,SAAS,kBAAkB,KAAsB;AAC/C,KAAI,QAAQ,SAAS,QAAQ,SAAS,QAAQ,0BAA2B,QAAO;AAChF,KAAI,WAAW,KAAK,IAAI,CAAE,QAAO;AACjC,QAAO;;AAGT,SAAS,gBAAgB,KAAa,OAA+B;AACnE,KAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,MAAO,QAAO;AACrE,KAAI,UAAU,KAAM,QAAO,WAAW,WAAW,IAAI,CAAC;AAEtD,KAAI,QAAQ,SAAS;EACnB,MAAM,MAAM,GAAG,MAAoB;AACnC,SAAO,MAAM,UAAU,WAAW,IAAI,CAAC,KAAK;;AAG9C,KAAI,QAAQ,SAAS;EACnB,MAAM,QAAQ,eAAe,MAAM;AACnC,SAAO,QAAQ,UAAU,WAAW,MAAM,CAAC,KAAK;;AAGlD,QAAO,GAAG,WAAW,WAAW,IAAI,CAAC,CAAC,IAAI,WAAW,OAAO,MAAM,CAAC,CAAC;;AAGtE,SAAS,WAAW,KAAa,OAA+B;AAC9D,KAAI,kBAAkB,IAAI,CAAE,QAAO;AAEnC,KAAI,OAAO,UAAU,WACnB,QAAO,WAAW,KAAM,OAAyB,CAAC;AAGpD,KAAI,cAAc,IAAI,IAAI,IAAI,OAAO,UAAU,YAAY,kBAAkB,KAAK,MAAM,CACtF,QAAO;AAGT,QAAO,gBAAgB,KAAK,MAAM;;AAKpC,MAAM,gBAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAS,cAAc,KAAsB;AAC3C,QAAO,cAAc,IAAI,IAAI,aAAa,CAAC;;;AAI7C,SAAS,WAAW,KAAqB;AACvC,KAAI,QAAQ,YAAa,QAAO;AAChC,KAAI,QAAQ,UAAW,QAAO;AAC9B,QAAO,IAAI,QAAQ,WAAW,MAAM,IAAI,EAAE,aAAa,GAAG;;AAG5D,SAAS,cAAc,OAAkD;AACvE,KAAI,CAAC,MAAO,QAAO;AACnB,QAAO,OAAO,UAAU;;AAG1B,SAAS,eAAe,OAAwB;AAC9C,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,cAAc,MAAM,EAAE;EACxB,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,MAAI,UAAU,OAAO,aAAa,UAAU,KAC1C,QAAO,OAAO,QAAQ,MAAM,CACzB,KAAK,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC,IAAI,oBAAoB,GAAG,EAAE,GAAG,CAC9D,KAAK,KAAK;;AAGjB,QAAO;;AAGT,SAAS,QAAQ,KAAqB;AACpC,QAAO,IAAI,QAAQ,WAAW,MAAM,IAAI,EAAE,aAAa,GAAG;;AAG5D,MAAM,aAAqC;CACzC,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAK;CACL,KAAK;CACN;AAGD,MAAM,kBAAkB;AAExB,SAAS,WAAW,KAAqB;AACvC,KAAI,CAAC,gBAAgB,KAAK,IAAI,CAAE,QAAO;AACvC,QAAO,IAAI,QAAQ,aAAa,MAAM,WAAW,MAAM,EAAE;;;;;;;AAQ3D,SAAS,uBAAuB,OAAuC;AACrE,KACE,MAAM,SAAS,SAAS,KACvB,MAAM,MAAkC,aAAa,OAEtD,QAAO;EACL,GAAG,MAAM;EACT,UAAU,MAAM,SAAS,WAAW,IAAI,MAAM,SAAS,KAAK,MAAM;EACnE;AAEH,QAAO,MAAM"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @pyreon/runtime-server — SSR/SSG renderer for Pyreon.\n *\n * Walks a VNode tree and produces HTML strings.\n * Signal accessors (reactive getters `() => value`) are called synchronously\n * to snapshot their current value — no effects are set up on the server.\n *\n * Async components (`async function Component()`) are fully supported:\n * renderToString will await them before continuing the tree walk.\n *\n * API:\n *   renderToString(vnode)   → Promise<string>\n *   renderToStream(vnode)   → ReadableStream<string>\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks'\nimport type { ClassValue, ComponentFn, ForProps, VNode, VNodeChild } from '@pyreon/core'\nimport {\n  cx,\n  ForSymbol,\n  Fragment,\n  normalizeStyleValue,\n  runWithHooks,\n  Suspense,\n  setContextStackProvider,\n} from '@pyreon/core'\n\nconst __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'\n\n// ─── Streaming Suspense context ───────────────────────────────────────────────\n// Tracks in-flight async Suspense boundary resolutions within a single stream.\n\ninterface StreamCtx {\n  pending: Promise<void>[]\n  nextId: () => number\n  mainEnqueue: (s: string) => void\n  /** Depth counter — non-zero when rendering inside a Suspense child resolution. */\n  suspenseDepth: number\n}\n\nconst _streamCtxAls = new AsyncLocalStorage<StreamCtx>()\n\n// ─── Concurrent SSR context isolation ────────────────────────────────────────\n// Each renderToString call runs in its own ALS store (a fresh empty stack[]).\n// Concurrent requests never share context frames.\n\nconst _contextAls = new AsyncLocalStorage<Map<symbol, unknown>[]>()\nconst _fallbackStack: Map<symbol, unknown>[] = []\n\nsetContextStackProvider(() => _contextAls.getStore() ?? _fallbackStack)\n\n// ─── Store isolation (optional) ───────────────────────────────────────────────\n// A second ALS isolates store registries between concurrent requests.\n// Activated only when the user calls configureStoreIsolation().\n\nconst _storeAls = new AsyncLocalStorage<Map<string, unknown>>()\nlet _storeIsolationActive = false\n\n/**\n * Wire up per-request store isolation.\n * Call once at server startup, passing a `setStoreRegistryProvider` function.\n *\n * @example\n * import { configureStoreIsolation } from \"@pyreon/runtime-server\"\n * configureStoreIsolation(setStoreRegistryProvider)\n */\nexport function configureStoreIsolation(\n  setStoreRegistryProvider: (fn: () => Map<string, unknown>) => void,\n): void {\n  setStoreRegistryProvider(() => _storeAls.getStore() ?? new Map())\n  _storeIsolationActive = true\n}\n\n/** Wrap a function call in a fresh store registry (no-op if isolation not configured). */\nfunction withStoreContext<T>(fn: () => T): T {\n  if (!_storeIsolationActive) return fn()\n  return _storeAls.run(new Map(), fn)\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/** Render a VNode tree to an HTML string. Supports async component functions. */\nexport async function renderToString(root: VNode | null): Promise<string> {\n  if (root === null) return ''\n  // Each call gets a fresh isolated context stack and (optionally) store registry\n  return withStoreContext(() => _contextAls.run([], () => renderNode(root)))\n}\n\n/**\n * Run an async function with a fresh, isolated context stack and store registry.\n * Useful when you need to call Pyreon APIs (e.g. useHead, prefetchLoaderData)\n * outside of renderToString but still want per-request isolation.\n */\nexport function runWithRequestContext<T>(fn: () => Promise<T>): Promise<T> {\n  return withStoreContext(() => _contextAls.run([], fn))\n}\n\n/**\n * Render a VNode tree to a Web-standard ReadableStream of HTML chunks.\n *\n * True progressive streaming: HTML is flushed to the client as soon as each\n * node is ready. Synchronous subtrees are enqueued immediately; async component\n * boundaries are awaited in-order and their output is enqueued as it resolves.\n *\n * Suspense boundaries are streamed out-of-order: the fallback is emitted\n * immediately, and the resolved children are sent as a `<template>` + inline\n * swap script once ready — without blocking the rest of the page.\n *\n * Each renderToStream call gets its own isolated ALS context stack.\n */\nexport function renderToStream(root: VNode | null): ReadableStream<string> {\n  return new ReadableStream<string>({\n    start(controller) {\n      const enqueue = (chunk: string) => controller.enqueue(chunk)\n      let bid = 0\n      const ctx: StreamCtx = {\n        pending: [],\n        nextId: () => bid++,\n        mainEnqueue: enqueue,\n        suspenseDepth: 0,\n      }\n      return withStoreContext(() =>\n        _contextAls.run([], () =>\n          _streamCtxAls\n            .run(ctx, async () => {\n              await streamNode(root, enqueue)\n              // Drain all pending Suspense resolutions (may spawn nested ones)\n              while (ctx.pending.length > 0) {\n                await Promise.all(ctx.pending.splice(0))\n              }\n              controller.close()\n            })\n            .catch((err) => controller.error(err)),\n        ),\n      )\n    },\n  })\n}\n\n// ─── Streaming renderer ───────────────────────────────────────────────────────\n\nasync function streamVNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  if (vnode.type === Fragment) {\n    for (const child of vnode.children) await streamNode(child, enqueue)\n    return\n  }\n\n  if (vnode.type === (ForSymbol as unknown as string)) {\n    const { each, children, by } = vnode.props as unknown as ForProps<unknown>\n    enqueue('<!--pyreon-for-->')\n    for (const item of each()) {\n      const key = by(item)\n      enqueue(`<!--k:${key}-->`)\n      await streamNode(children(item) as VNodeChild, enqueue)\n    }\n    enqueue('<!--/pyreon-for-->')\n    return\n  }\n\n  if (typeof vnode.type === 'function') {\n    await streamComponentNode(vnode, enqueue)\n    return\n  }\n\n  await streamElementNode(vnode, enqueue)\n}\n\nasync function streamComponentNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  if (vnode.type === Suspense) {\n    await streamSuspenseBoundary(vnode, enqueue)\n    return\n  }\n  try {\n    const { vnode: output } = runWithHooks(vnode.type as ComponentFn, mergeChildrenIntoProps(vnode))\n    const resolved = output instanceof Promise ? await output : output\n    if (resolved !== null) await streamNode(resolved, enqueue)\n  } catch (err) {\n    if (__DEV__) {\n      const name = (vnode.type as ComponentFn).name || 'Anonymous'\n      console.error(`[Pyreon SSR] Error rendering <${name}>:`, err)\n    }\n    // Inside a Suspense child resolution, re-throw so the boundary can catch and\n    // suppress the swap (fallback stays visible). Outside Suspense, swallow the\n    // error and emit a marker so the stream can continue.\n    const ctx = _streamCtxAls.getStore()\n    if (ctx && ctx.suspenseDepth > 0) throw err\n    enqueue('<!--pyreon-error-->')\n  }\n}\n\nasync function streamElementNode(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  const tag = vnode.type as string\n  let open = `<${tag}`\n  const props = vnode.props as Record<string, unknown>\n  for (const key in props) {\n    const attr = renderProp(key, props[key])\n    if (attr) open += ` ${attr}`\n  }\n  if (isVoidElement(tag)) {\n    enqueue(`${open} />`)\n    return\n  }\n  enqueue(`${open}>`)\n  const dangerous = props.dangerouslySetInnerHTML as { __html: string } | undefined\n  if (dangerous?.__html) {\n    enqueue(dangerous.__html)\n  } else {\n    for (const child of vnode.children) await streamNode(child, enqueue)\n  }\n  enqueue(`</${tag}>`)\n}\n\nasync function streamNode(\n  node: VNodeChild | null | (() => VNodeChild),\n  enqueue: (s: string) => void,\n): Promise<void> {\n  if (typeof node === 'function') {\n    return streamNode((node as () => VNodeChild)(), enqueue)\n  }\n  if (node == null || node === false) return\n  if (typeof node === 'string') {\n    enqueue(escapeHtml(node))\n    return\n  }\n  if (typeof node === 'number' || typeof node === 'boolean') {\n    enqueue(String(node))\n    return\n  }\n  if (Array.isArray(node)) {\n    for (const child of node) await streamNode(child, enqueue)\n    return\n  }\n\n  await streamVNode(node as VNode, enqueue)\n}\n\n// Inline swap helper emitted once per stream, before the first <template>\nconst SUSPENSE_SWAP_FN =\n  '<script>function __NS(s,t){var e=document.getElementById(s),l=document.getElementById(t);' +\n  'if(e&&l){e.replaceWith(l.content.cloneNode(!0));l.remove()}}</script>'\n\n/**\n * Stream a Suspense boundary: emit fallback immediately, then resolve children\n * asynchronously and emit them as a `<template>` + client-side swap.\n *\n * The actual children HTML is buffered until fully resolved, then emitted to the\n * main stream enqueue so it always arrives after the fallback placeholder.\n */\nasync function streamSuspenseBoundary(vnode: VNode, enqueue: (s: string) => void): Promise<void> {\n  const ctx = _streamCtxAls.getStore()\n  const { fallback, children } = vnode.props as { fallback: VNodeChild; children?: VNodeChild }\n\n  // No streaming context (e.g. called from renderToString) — render children inline\n  if (!ctx) {\n    const { vnode: output } = runWithHooks(Suspense as ComponentFn, vnode.props)\n    if (output !== null) await streamNode(output, enqueue)\n    return\n  }\n\n  const id = ctx.nextId()\n  const { mainEnqueue } = ctx\n\n  // Emit the swap helper function once (before first use)\n  if (id === 0) mainEnqueue(SUSPENSE_SWAP_FN)\n\n  // Stream the fallback synchronously (no await on children)\n  mainEnqueue(`<div id=\"pyreon-s-${id}\">`)\n  await streamNode(fallback ?? null, enqueue)\n  mainEnqueue('</div>')\n\n  // Capture the context store for the async resolution so it inherits context\n  const ctxStore = _contextAls.getStore() ?? []\n\n  // Queue async resolution — runs in parallel, emits to main stream when done.\n  // Errors are caught per-boundary so one failing Suspense doesn't abort the stream.\n  // Timeout prevents hung async children from keeping the stream open forever.\n  const SUSPENSE_TIMEOUT_MS = 30_000\n\n  ctx.pending.push(\n    _contextAls.run(ctxStore, async () => {\n      try {\n        ctx.suspenseDepth++\n        const buf: string[] = []\n\n        // Race the async children against a timeout\n        const result = await Promise.race([\n          streamNode(children ?? null, (s) => buf.push(s)).then(() => 'resolved' as const),\n          new Promise<'timeout'>((resolve) => setTimeout(() => resolve('timeout'), SUSPENSE_TIMEOUT_MS)),\n        ])\n\n        if (result === 'timeout') {\n          if (__DEV__) {\n            console.warn(\n              `[Pyreon SSR] Suspense boundary timed out after ${SUSPENSE_TIMEOUT_MS}ms — fallback will remain.`,\n            )\n          }\n          // Fallback stays visible — no swap\n          return\n        }\n\n        // Escape </template> in buffered content to prevent early close + XSS\n        const content = buf.join('').replace(/<\\/template/gi, '<\\\\/template')\n        mainEnqueue(`<template id=\"pyreon-t-${id}\">${content}</template>`)\n        mainEnqueue(`<script>__NS(\"pyreon-s-${id}\",\"pyreon-t-${id}\")</script>`)\n      } catch (err) {\n        if (__DEV__) {\n          console.error(\n            `[Pyreon SSR] Suspense boundary caught an error — fallback will remain:`,\n            err,\n          )\n        }\n        // Fallback stays visible — no swap script emitted\n      } finally {\n        ctx.suspenseDepth--\n      }\n    }),\n  )\n}\n\n// ─── Core renderer ───────────────────────────────────────────────────────────\n\nasync function renderNode(node: VNodeChild | (() => VNodeChild)): Promise<string> {\n  // Reactive accessor — call it synchronously (snapshot)\n  if (typeof node === 'function') {\n    return renderNode((node as () => VNodeChild)())\n  }\n\n  if (node == null || node === false) return ''\n\n  if (typeof node === 'string') return escapeHtml(node)\n  if (typeof node === 'number' || typeof node === 'boolean') return String(node)\n\n  if (Array.isArray(node)) {\n    let html = ''\n    for (const child of node) html += await renderNode(child)\n    return html\n  }\n\n  const vnode = node as VNode\n\n  if (vnode.type === Fragment) {\n    return renderChildren(vnode.children)\n  }\n\n  if (vnode.type === (ForSymbol as unknown as string)) {\n    const { each, children, by } = vnode.props as unknown as ForProps<unknown>\n    let forHtml = '<!--pyreon-for-->'\n    for (const item of each()) {\n      const key = by(item)\n      forHtml += `<!--k:${key}-->`\n      forHtml += await renderNode(children(item) as VNodeChild)\n    }\n    forHtml += '<!--/pyreon-for-->'\n    return forHtml\n  }\n\n  if (typeof vnode.type === 'function') {\n    return renderComponent(vnode as VNode & { type: ComponentFn })\n  }\n\n  return renderElement(vnode)\n}\n\nasync function renderChildren(children: VNodeChild[]): Promise<string> {\n  let html = ''\n  for (const child of children) html += await renderNode(child)\n  return html\n}\n\nasync function renderComponent(vnode: VNode & { type: ComponentFn }): Promise<string> {\n  const { vnode: output } = runWithHooks(vnode.type, mergeChildrenIntoProps(vnode))\n\n  // Async component function (async function Component()) — await the promise\n  if (output instanceof Promise) {\n    const resolved = await output\n    if (resolved === null) return ''\n    return renderNode(resolved)\n  }\n\n  if (output === null) return ''\n  return renderNode(output)\n}\n\nasync function renderElement(vnode: VNode): Promise<string> {\n  const tag = vnode.type as string\n  let html = `<${tag}`\n\n  const props = vnode.props as Record<string, unknown>\n  for (const key in props) {\n    const attr = renderProp(key, props[key])\n    if (attr) html += ` ${attr}`\n  }\n\n  if (isVoidElement(tag)) {\n    html += ' />'\n    return html\n  }\n\n  html += '>'\n\n  // dangerouslySetInnerHTML — inject raw HTML, skip children\n  const dangerous = props.dangerouslySetInnerHTML as { __html: string } | undefined\n  if (dangerous?.__html) {\n    html += dangerous.__html\n  } else {\n    for (const child of vnode.children) {\n      html += await renderNode(child)\n    }\n  }\n\n  html += `</${tag}>`\n  return html\n}\n\nconst SSR_URL_ATTRS = new Set(['href', 'src', 'action', 'formaction', 'poster', 'cite', 'data'])\nconst SSR_UNSAFE_URL_RE = /^\\s*(?:javascript|data):/i\n\nfunction renderPropSkipped(key: string): boolean {\n  if (key === 'key' || key === 'ref' || key === 'dangerouslySetInnerHTML') return true\n  if (/^on[A-Z]/.test(key)) return true\n  return false\n}\n\nfunction renderPropValue(key: string, value: unknown): string | null {\n  if (value === null || value === undefined || value === false) return null\n  if (value === true) return escapeHtml(toAttrName(key))\n\n  if (key === 'class') {\n    const cls = cx(value as ClassValue)\n    return cls ? `class=\"${escapeHtml(cls)}\"` : null\n  }\n\n  if (key === 'style') {\n    const style = normalizeStyle(value)\n    return style ? `style=\"${escapeHtml(style)}\"` : null\n  }\n\n  return `${escapeHtml(toAttrName(key))}=\"${escapeHtml(String(value))}\"`\n}\n\nfunction renderProp(key: string, value: unknown): string | null {\n  if (renderPropSkipped(key)) return null\n\n  if (typeof value === 'function') {\n    return renderProp(key, (value as () => unknown)())\n  }\n\n  if (SSR_URL_ATTRS.has(key) && typeof value === 'string' && SSR_UNSAFE_URL_RE.test(value)) {\n    return null\n  }\n\n  return renderPropValue(key, value)\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\nconst VOID_ELEMENTS = new Set([\n  'area',\n  'base',\n  'br',\n  'col',\n  'embed',\n  'hr',\n  'img',\n  'input',\n  'link',\n  'meta',\n  'param',\n  'source',\n  'track',\n  'wbr',\n])\n\nfunction isVoidElement(tag: string): boolean {\n  return VOID_ELEMENTS.has(tag.toLowerCase())\n}\n\n/** camelCase prop → kebab-case HTML attribute (e.g. className → class, htmlFor → for) */\nfunction toAttrName(key: string): string {\n  if (key === 'className') return 'class'\n  if (key === 'htmlFor') return 'for'\n  return key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)\n}\n\nfunction isStyleObject(value: unknown): value is Record<string, unknown> {\n  if (!value) return false\n  return typeof value === 'object'\n}\n\nfunction normalizeStyle(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (isStyleObject(value)) {\n    const proto = Object.getPrototypeOf(value)\n    if (proto === Object.prototype || proto === null) {\n      return Object.entries(value)\n        .map(([k, v]) => `${toKebab(k)}: ${normalizeStyleValue(k, v)}`)\n        .join('; ')\n    }\n  }\n  return ''\n}\n\nfunction toKebab(str: string): string {\n  return str.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)\n}\n\nconst ESCAPE_MAP: Record<string, string> = {\n  '&': '&amp;',\n  '<': '&lt;',\n  '>': '&gt;',\n  '\"': '&quot;',\n  \"'\": '&#39;',\n}\n\n// Fast test — most strings in SSR have no special chars (tag names, class names, etc.)\nconst NEEDS_ESCAPE_RE = /[&<>\"']/\n\nfunction escapeHtml(str: string): string {\n  if (!NEEDS_ESCAPE_RE.test(str)) return str\n  return str.replace(/[&<>\"']/g, (c) => ESCAPE_MAP[c] ?? c)\n}\n\n/**\n * Merge vnode.children into props.children for component rendering.\n * Matches the behavior of mount.ts and hydrate.ts so components can\n * access children passed via h(Comp, props, child1, child2).\n */\nfunction mergeChildrenIntoProps(vnode: VNode): Record<string, unknown> {\n  if (\n    vnode.children.length > 0 &&\n    (vnode.props as Record<string, unknown>).children === undefined\n  ) {\n    return {\n      ...vnode.props,\n      children: vnode.children.length === 1 ? vnode.children[0] : vnode.children,\n    }\n  }\n  return vnode.props as Record<string, unknown>\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA2BA,MAAM,UAAU,OAAO,YAAY,eAAe,QAAQ,IAAI,aAAa;AAa3E,MAAM,gBAAgB,IAAI,mBAA8B;AAMxD,MAAM,cAAc,IAAI,mBAA2C;AACnE,MAAM,iBAAyC,EAAE;AAEjD,8BAA8B,YAAY,UAAU,IAAI,eAAe;AAMvE,MAAM,YAAY,IAAI,mBAAyC;AAC/D,IAAI,wBAAwB;;;;;;;;;AAU5B,SAAgB,wBACd,0BACM;AACN,gCAA+B,UAAU,UAAU,oBAAI,IAAI,KAAK,CAAC;AACjE,yBAAwB;;;AAI1B,SAAS,iBAAoB,IAAgB;AAC3C,KAAI,CAAC,sBAAuB,QAAO,IAAI;AACvC,QAAO,UAAU,oBAAI,IAAI,KAAK,EAAE,GAAG;;;AAMrC,eAAsB,eAAe,MAAqC;AACxE,KAAI,SAAS,KAAM,QAAO;AAE1B,QAAO,uBAAuB,YAAY,IAAI,EAAE,QAAQ,WAAW,KAAK,CAAC,CAAC;;;;;;;AAQ5E,SAAgB,sBAAyB,IAAkC;AACzE,QAAO,uBAAuB,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC;;;;;;;;;;;;;;;AAgBxD,SAAgB,eAAe,MAA4C;AACzE,QAAO,IAAI,eAAuB,EAChC,MAAM,YAAY;EAChB,MAAM,WAAW,UAAkB,WAAW,QAAQ,MAAM;EAC5D,IAAI,MAAM;EACV,MAAM,MAAiB;GACrB,SAAS,EAAE;GACX,cAAc;GACd,aAAa;GACb,eAAe;GAChB;AACD,SAAO,uBACL,YAAY,IAAI,EAAE,QAChB,cACG,IAAI,KAAK,YAAY;AACpB,SAAM,WAAW,MAAM,QAAQ;AAE/B,UAAO,IAAI,QAAQ,SAAS,EAC1B,OAAM,QAAQ,IAAI,IAAI,QAAQ,OAAO,EAAE,CAAC;AAE1C,cAAW,OAAO;IAClB,CACD,OAAO,QAAQ,WAAW,MAAM,IAAI,CAAC,CACzC,CACF;IAEJ,CAAC;;AAKJ,eAAe,YAAY,OAAc,SAA6C;AACpF,KAAI,MAAM,SAAS,UAAU;AAC3B,OAAK,MAAM,SAAS,MAAM,SAAU,OAAM,WAAW,OAAO,QAAQ;AACpE;;AAGF,KAAI,MAAM,SAAU,WAAiC;EACnD,MAAM,EAAE,MAAM,UAAU,OAAO,MAAM;AACrC,UAAQ,oBAAoB;AAC5B,OAAK,MAAM,QAAQ,MAAM,EAAE;AAEzB,WAAQ,SADI,GAAG,KAAK,CACC,KAAK;AAC1B,SAAM,WAAW,SAAS,KAAK,EAAgB,QAAQ;;AAEzD,UAAQ,qBAAqB;AAC7B;;AAGF,KAAI,OAAO,MAAM,SAAS,YAAY;AACpC,QAAM,oBAAoB,OAAO,QAAQ;AACzC;;AAGF,OAAM,kBAAkB,OAAO,QAAQ;;AAGzC,eAAe,oBAAoB,OAAc,SAA6C;AAC5F,KAAI,MAAM,SAAS,UAAU;AAC3B,QAAM,uBAAuB,OAAO,QAAQ;AAC5C;;AAEF,KAAI;EACF,MAAM,EAAE,OAAO,WAAW,aAAa,MAAM,MAAqB,uBAAuB,MAAM,CAAC;EAChG,MAAM,WAAW,kBAAkB,UAAU,MAAM,SAAS;AAC5D,MAAI,aAAa,KAAM,OAAM,WAAW,UAAU,QAAQ;UACnD,KAAK;AACZ,MAAI,SAAS;GACX,MAAM,OAAQ,MAAM,KAAqB,QAAQ;AACjD,WAAQ,MAAM,iCAAiC,KAAK,KAAK,IAAI;;EAK/D,MAAM,MAAM,cAAc,UAAU;AACpC,MAAI,OAAO,IAAI,gBAAgB,EAAG,OAAM;AACxC,UAAQ,sBAAsB;;;AAIlC,eAAe,kBAAkB,OAAc,SAA6C;CAC1F,MAAM,MAAM,MAAM;CAClB,IAAI,OAAO,IAAI;CACf,MAAM,QAAQ,MAAM;AACpB,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,WAAW,KAAK,MAAM,KAAK;AACxC,MAAI,KAAM,SAAQ,IAAI;;AAExB,KAAI,cAAc,IAAI,EAAE;AACtB,UAAQ,GAAG,KAAK,KAAK;AACrB;;AAEF,SAAQ,GAAG,KAAK,GAAG;CACnB,MAAM,YAAY,MAAM;AACxB,KAAI,WAAW,OACb,SAAQ,UAAU,OAAO;KAEzB,MAAK,MAAM,SAAS,MAAM,SAAU,OAAM,WAAW,OAAO,QAAQ;AAEtE,SAAQ,KAAK,IAAI,GAAG;;AAGtB,eAAe,WACb,MACA,SACe;AACf,KAAI,OAAO,SAAS,WAClB,QAAO,WAAY,MAA2B,EAAE,QAAQ;AAE1D,KAAI,QAAQ,QAAQ,SAAS,MAAO;AACpC,KAAI,OAAO,SAAS,UAAU;AAC5B,UAAQ,WAAW,KAAK,CAAC;AACzB;;AAEF,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;AACzD,UAAQ,OAAO,KAAK,CAAC;AACrB;;AAEF,KAAI,MAAM,QAAQ,KAAK,EAAE;AACvB,OAAK,MAAM,SAAS,KAAM,OAAM,WAAW,OAAO,QAAQ;AAC1D;;AAGF,OAAM,YAAY,MAAe,QAAQ;;AAI3C,MAAM,mBACJ;;;;;;;;AAUF,eAAe,uBAAuB,OAAc,SAA6C;CAC/F,MAAM,MAAM,cAAc,UAAU;CACpC,MAAM,EAAE,UAAU,aAAa,MAAM;AAGrC,KAAI,CAAC,KAAK;EACR,MAAM,EAAE,OAAO,WAAW,aAAa,UAAyB,MAAM,MAAM;AAC5E,MAAI,WAAW,KAAM,OAAM,WAAW,QAAQ,QAAQ;AACtD;;CAGF,MAAM,KAAK,IAAI,QAAQ;CACvB,MAAM,EAAE,gBAAgB;AAGxB,KAAI,OAAO,EAAG,aAAY,iBAAiB;AAG3C,aAAY,qBAAqB,GAAG,IAAI;AACxC,OAAM,WAAW,YAAY,MAAM,QAAQ;AAC3C,aAAY,SAAS;CAGrB,MAAM,WAAW,YAAY,UAAU,IAAI,EAAE;CAK7C,MAAM,sBAAsB;AAE5B,KAAI,QAAQ,KACV,YAAY,IAAI,UAAU,YAAY;AACpC,MAAI;AACF,OAAI;GACJ,MAAM,MAAgB,EAAE;AAQxB,OALe,MAAM,QAAQ,KAAK,CAChC,WAAW,YAAY,OAAO,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,WAAW,WAAoB,EAChF,IAAI,SAAoB,YAAY,iBAAiB,QAAQ,UAAU,EAAE,oBAAoB,CAAC,CAC/F,CAAC,KAEa,WAAW;AACxB,QAAI,QACF,SAAQ,KACN,kDAAkD,oBAAoB,4BACvE;AAGH;;AAKF,eAAY,0BAA0B,GAAG,IADzB,IAAI,KAAK,GAAG,CAAC,QAAQ,iBAAiB,eAAe,CAChB,aAAa;AAClE,eAAY,0BAA0B,GAAG,cAAc,GAAG,cAAa;WAChE,KAAK;AACZ,OAAI,QACF,SAAQ,MACN,0EACA,IACD;YAGK;AACR,OAAI;;GAEN,CACH;;AAKH,eAAe,WAAW,MAAwD;AAEhF,KAAI,OAAO,SAAS,WAClB,QAAO,WAAY,MAA2B,CAAC;AAGjD,KAAI,QAAQ,QAAQ,SAAS,MAAO,QAAO;AAE3C,KAAI,OAAO,SAAS,SAAU,QAAO,WAAW,KAAK;AACrD,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,UAAW,QAAO,OAAO,KAAK;AAE9E,KAAI,MAAM,QAAQ,KAAK,EAAE;EACvB,IAAI,OAAO;AACX,OAAK,MAAM,SAAS,KAAM,SAAQ,MAAM,WAAW,MAAM;AACzD,SAAO;;CAGT,MAAM,QAAQ;AAEd,KAAI,MAAM,SAAS,SACjB,QAAO,eAAe,MAAM,SAAS;AAGvC,KAAI,MAAM,SAAU,WAAiC;EACnD,MAAM,EAAE,MAAM,UAAU,OAAO,MAAM;EACrC,IAAI,UAAU;AACd,OAAK,MAAM,QAAQ,MAAM,EAAE;GACzB,MAAM,MAAM,GAAG,KAAK;AACpB,cAAW,SAAS,IAAI;AACxB,cAAW,MAAM,WAAW,SAAS,KAAK,CAAe;;AAE3D,aAAW;AACX,SAAO;;AAGT,KAAI,OAAO,MAAM,SAAS,WACxB,QAAO,gBAAgB,MAAuC;AAGhE,QAAO,cAAc,MAAM;;AAG7B,eAAe,eAAe,UAAyC;CACrE,IAAI,OAAO;AACX,MAAK,MAAM,SAAS,SAAU,SAAQ,MAAM,WAAW,MAAM;AAC7D,QAAO;;AAGT,eAAe,gBAAgB,OAAuD;CACpF,MAAM,EAAE,OAAO,WAAW,aAAa,MAAM,MAAM,uBAAuB,MAAM,CAAC;AAGjF,KAAI,kBAAkB,SAAS;EAC7B,MAAM,WAAW,MAAM;AACvB,MAAI,aAAa,KAAM,QAAO;AAC9B,SAAO,WAAW,SAAS;;AAG7B,KAAI,WAAW,KAAM,QAAO;AAC5B,QAAO,WAAW,OAAO;;AAG3B,eAAe,cAAc,OAA+B;CAC1D,MAAM,MAAM,MAAM;CAClB,IAAI,OAAO,IAAI;CAEf,MAAM,QAAQ,MAAM;AACpB,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,WAAW,KAAK,MAAM,KAAK;AACxC,MAAI,KAAM,SAAQ,IAAI;;AAGxB,KAAI,cAAc,IAAI,EAAE;AACtB,UAAQ;AACR,SAAO;;AAGT,SAAQ;CAGR,MAAM,YAAY,MAAM;AACxB,KAAI,WAAW,OACb,SAAQ,UAAU;KAElB,MAAK,MAAM,SAAS,MAAM,SACxB,SAAQ,MAAM,WAAW,MAAM;AAInC,SAAQ,KAAK,IAAI;AACjB,QAAO;;AAGT,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAU;CAAc;CAAU;CAAQ;CAAO,CAAC;AAChG,MAAM,oBAAoB;AAE1B,SAAS,kBAAkB,KAAsB;AAC/C,KAAI,QAAQ,SAAS,QAAQ,SAAS,QAAQ,0BAA2B,QAAO;AAChF,KAAI,WAAW,KAAK,IAAI,CAAE,QAAO;AACjC,QAAO;;AAGT,SAAS,gBAAgB,KAAa,OAA+B;AACnE,KAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,MAAO,QAAO;AACrE,KAAI,UAAU,KAAM,QAAO,WAAW,WAAW,IAAI,CAAC;AAEtD,KAAI,QAAQ,SAAS;EACnB,MAAM,MAAM,GAAG,MAAoB;AACnC,SAAO,MAAM,UAAU,WAAW,IAAI,CAAC,KAAK;;AAG9C,KAAI,QAAQ,SAAS;EACnB,MAAM,QAAQ,eAAe,MAAM;AACnC,SAAO,QAAQ,UAAU,WAAW,MAAM,CAAC,KAAK;;AAGlD,QAAO,GAAG,WAAW,WAAW,IAAI,CAAC,CAAC,IAAI,WAAW,OAAO,MAAM,CAAC,CAAC;;AAGtE,SAAS,WAAW,KAAa,OAA+B;AAC9D,KAAI,kBAAkB,IAAI,CAAE,QAAO;AAEnC,KAAI,OAAO,UAAU,WACnB,QAAO,WAAW,KAAM,OAAyB,CAAC;AAGpD,KAAI,cAAc,IAAI,IAAI,IAAI,OAAO,UAAU,YAAY,kBAAkB,KAAK,MAAM,CACtF,QAAO;AAGT,QAAO,gBAAgB,KAAK,MAAM;;AAKpC,MAAM,gBAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAS,cAAc,KAAsB;AAC3C,QAAO,cAAc,IAAI,IAAI,aAAa,CAAC;;;AAI7C,SAAS,WAAW,KAAqB;AACvC,KAAI,QAAQ,YAAa,QAAO;AAChC,KAAI,QAAQ,UAAW,QAAO;AAC9B,QAAO,IAAI,QAAQ,WAAW,MAAM,IAAI,EAAE,aAAa,GAAG;;AAG5D,SAAS,cAAc,OAAkD;AACvE,KAAI,CAAC,MAAO,QAAO;AACnB,QAAO,OAAO,UAAU;;AAG1B,SAAS,eAAe,OAAwB;AAC9C,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,cAAc,MAAM,EAAE;EACxB,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,MAAI,UAAU,OAAO,aAAa,UAAU,KAC1C,QAAO,OAAO,QAAQ,MAAM,CACzB,KAAK,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC,IAAI,oBAAoB,GAAG,EAAE,GAAG,CAC9D,KAAK,KAAK;;AAGjB,QAAO;;AAGT,SAAS,QAAQ,KAAqB;AACpC,QAAO,IAAI,QAAQ,WAAW,MAAM,IAAI,EAAE,aAAa,GAAG;;AAG5D,MAAM,aAAqC;CACzC,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAK;CACL,KAAK;CACN;AAGD,MAAM,kBAAkB;AAExB,SAAS,WAAW,KAAqB;AACvC,KAAI,CAAC,gBAAgB,KAAK,IAAI,CAAE,QAAO;AACvC,QAAO,IAAI,QAAQ,aAAa,MAAM,WAAW,MAAM,EAAE;;;;;;;AAQ3D,SAAS,uBAAuB,OAAuC;AACrE,KACE,MAAM,SAAS,SAAS,KACvB,MAAM,MAAkC,aAAa,OAEtD,QAAO;EACL,GAAG,MAAM;EACT,UAAU,MAAM,SAAS,WAAW,IAAI,MAAM,SAAS,KAAK,MAAM;EACnE;AAEH,QAAO,MAAM"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pyreon/runtime-server",
-  "version": "0.12.3",
+  "version": "0.12.5",
   "description": "SSR/SSG renderer for Pyreon — streaming HTML + static generation",
   "homepage": "https://github.com/pyreon/pyreon/tree/main/packages/runtime-server#readme",
   "bugs": {
@@ -42,7 +42,7 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@pyreon/core": "^0.12.3",
-    "@pyreon/reactivity": "^0.12.3"
+    "@pyreon/core": "^0.12.5",
+    "@pyreon/reactivity": "^0.12.5"
   }
 }

package/src/index.ts

@@ -146,9 +146,13 @@ async function streamVNode(vnode: VNode, enqueue: (s: string) => void): Promise<
   }
 
   if (vnode.type === (ForSymbol as unknown as string)) {
-    const { each, children } = vnode.props as unknown as ForProps<unknown>
+    const { each, children, by } = vnode.props as unknown as ForProps<unknown>
     enqueue('<!--pyreon-for-->')
-    for (const item of each()) await streamNode(children(item) as VNodeChild, enqueue)
+    for (const item of each()) {
+      const key = by(item)
+      enqueue(`<!--k:${key}-->`)
+      await streamNode(children(item) as VNodeChild, enqueue)
+    }
     enqueue('<!--/pyreon-for-->')
     return
   }
@@ -267,15 +271,36 @@ async function streamSuspenseBoundary(vnode: VNode, enqueue: (s: string) => void
   // Capture the context store for the async resolution so it inherits context
   const ctxStore = _contextAls.getStore() ?? []
 
-  // Queue async resolution — runs in parallel, emits to main stream when done
+  // Queue async resolution — runs in parallel, emits to main stream when done.
   // Errors are caught per-boundary so one failing Suspense doesn't abort the stream.
+  // Timeout prevents hung async children from keeping the stream open forever.
+  const SUSPENSE_TIMEOUT_MS = 30_000
+
   ctx.pending.push(
     _contextAls.run(ctxStore, async () => {
       try {
         ctx.suspenseDepth++
         const buf: string[] = []
-        await streamNode(children ?? null, (s) => buf.push(s))
-        mainEnqueue(`<template id="pyreon-t-${id}">${buf.join('')}</template>`)
+
+        // Race the async children against a timeout
+        const result = await Promise.race([
+          streamNode(children ?? null, (s) => buf.push(s)).then(() => 'resolved' as const),
+          new Promise<'timeout'>((resolve) => setTimeout(() => resolve('timeout'), SUSPENSE_TIMEOUT_MS)),
+        ])
+
+        if (result === 'timeout') {
+          if (__DEV__) {
+            console.warn(
+              `[Pyreon SSR] Suspense boundary timed out after ${SUSPENSE_TIMEOUT_MS}ms — fallback will remain.`,
+            )
+          }
+          // Fallback stays visible — no swap
+          return
+        }
+
+        // Escape </template> in buffered content to prevent early close + XSS
+        const content = buf.join('').replace(/<\/template/gi, '<\\/template')
+        mainEnqueue(`<template id="pyreon-t-${id}">${content}</template>`)
         mainEnqueue(`<script>__NS("pyreon-s-${id}","pyreon-t-${id}")</script>`)
       } catch (err) {
         if (__DEV__) {
@@ -318,9 +343,13 @@ async function renderNode(node: VNodeChild | (() => VNodeChild)): Promise<string
   }
 
   if (vnode.type === (ForSymbol as unknown as string)) {
-    const { each, children } = vnode.props as unknown as ForProps<unknown>
+    const { each, children, by } = vnode.props as unknown as ForProps<unknown>
     let forHtml = '<!--pyreon-for-->'
-    for (const item of each()) forHtml += await renderNode(children(item) as VNodeChild)
+    for (const item of each()) {
+      const key = by(item)
+      forHtml += `<!--k:${key}-->`
+      forHtml += await renderNode(children(item) as VNodeChild)
+    }
     forHtml += '<!--/pyreon-for-->'
     return forHtml
   }

package/src/tests/ssr.test.ts

@@ -988,3 +988,96 @@ describe('renderToStream — Suspense error fallback', () => {
     expect(html).not.toContain('__NS("pyreon-s-')
   })
 })
+
+// ─── Suspense XSS — </template> escaping ─────────────────────────────────────
+
+describe('renderToStream — Suspense XSS escape', () => {
+  test('escapes </template> inside Suspense async content', async () => {
+    async function XSSChild(): Promise<ReturnType<typeof h>> {
+      await new Promise<void>((r) => setTimeout(r, 5))
+      return h('div', { dangerouslySetInnerHTML: { __html: '</template><script>alert(1)</script>' } })
+    }
+
+    const vnode = h(Suspense, {
+      fallback: h('span', null, 'loading'),
+      children: h(XSSChild as unknown as ComponentFn, null),
+    })
+
+    const html = await collectStream(renderToStream(vnode))
+    // The raw </template> should be escaped to <\/template in the buffered content
+    expect(html).not.toContain('</template><script>alert')
+    // The escaped version should be present instead
+    expect(html).toContain('<\\/template')
+  })
+})
+
+// ─── For SSR — key markers ───────────────────────────────────────────────────
+
+describe('renderToString — For key markers', () => {
+  test('emits key markers for each item', async () => {
+    const items = [
+      { id: 1, name: 'a' },
+      { id: 2, name: 'b' },
+    ]
+    const vnode = h(For, {
+      each: () => items,
+      by: (r: { id: number }) => r.id,
+      children: (item: { id: number; name: string }) => h('li', null, item.name),
+    })
+    const html = await renderToString(vnode)
+    expect(html).toContain('<!--k:1-->')
+    expect(html).toContain('<!--k:2-->')
+    expect(html).toContain('<!--pyreon-for-->')
+    expect(html).toContain('<!--/pyreon-for-->')
+    expect(html).toContain('<li>a</li>')
+    expect(html).toContain('<li>b</li>')
+  })
+
+  test('For markers appear in correct order', async () => {
+    const items = [
+      { id: 10, name: 'first' },
+      { id: 20, name: 'second' },
+      { id: 30, name: 'third' },
+    ]
+    const vnode = h(For, {
+      each: () => items,
+      by: (r: { id: number }) => r.id,
+      children: (item: { id: number; name: string }) => h('span', null, item.name),
+    })
+    const html = await renderToString(vnode)
+    const idx10 = html.indexOf('<!--k:10-->')
+    const idx20 = html.indexOf('<!--k:20-->')
+    const idx30 = html.indexOf('<!--k:30-->')
+    expect(idx10).toBeLessThan(idx20)
+    expect(idx20).toBeLessThan(idx30)
+  })
+
+  test('For with empty array emits boundary markers only', async () => {
+    const vnode = h(For, {
+      each: () => [],
+      by: (r: unknown) => r,
+      children: () => h('li', null, 'nope'),
+    })
+    const html = await renderToString(vnode)
+    expect(html).toBe('<!--pyreon-for--><!--/pyreon-for-->')
+  })
+})
+
+// ─── For SSR — key markers in stream ─────────────────────────────────────────
+
+describe('renderToStream — For key markers', () => {
+  test('emits key markers for each item in stream', async () => {
+    const items = [
+      { id: 1, name: 'x' },
+      { id: 2, name: 'y' },
+    ]
+    const vnode = h(For, {
+      each: () => items,
+      by: (r: { id: number }) => r.id,
+      children: (item: { id: number; name: string }) => h('li', null, item.name),
+    })
+    const html = await collectStream(renderToStream(vnode))
+    expect(html).toContain('<!--k:1-->')
+    expect(html).toContain('<!--k:2-->')
+  })
+})