@pyreon/runtime-server 0.24.4 → 0.24.6

package/src/manifest.ts

@@ -1,126 +0,0 @@
-import { defineManifest } from '@pyreon/manifest'
-
-export default defineManifest({
-  name: '@pyreon/runtime-server',
-  title: 'SSR Renderer',
-  tagline:
-    'SSR/SSG VNode→HTML renderer — renderToString, renderToStream (out-of-order Suspense), per-request ALS context/store isolation',
-  description:
-    "Pyreon's server-side renderer: walks a VNode tree and produces HTML. Signal accessors are called synchronously to SNAPSHOT their current value — no effects, no reactivity on the server (reactivity resumes post-hydration on the client). Async component functions are awaited. `renderToStream` flushes progressively and resolves Suspense boundaries out-of-order (fallback first, then a `<template>` + inline swap script). Concurrency-safe: every `renderToString` / `renderToStream` / `runWithRequestContext` call runs in its own `AsyncLocalStorage` store so concurrent requests never share context frames; `configureStoreIsolation()` extends the same isolation to the `@pyreon/store` registry. Most apps consume this transitively through `@pyreon/server` (`createHandler` / `prerender`) rather than calling it directly.",
-  category: 'server',
-  features: [
-    'renderToString(vnode) → Promise<string> — one-shot HTML, awaits async components',
-    'renderToStream(vnode, { signal?, suspenseTimeoutMs? }) → ReadableStream<string> — progressive, out-of-order Suspense (default 30s per-boundary timeout, configurable; signal threads AbortSignal end-to-end)',
-    'Per-request ALS context isolation — concurrent requests never share provide() frames',
-    'runWithRequestContext(fn) — isolated context+store for Pyreon APIs called outside renderToString',
-    'configureStoreIsolation(setStoreRegistryProvider) — opt-in per-request @pyreon/store isolation',
-    'Compiler-emitted reactive props resolved via makeReactiveProps (parity with CSR mount.ts)',
-    'For-list key markers URL-encoded so user keys can never break out of the HTML comment',
-    'decodeKeyFromMarker — symmetric inverse of the For-key marker encoder (devtools/future hydration)',
-  ],
-  api: [
-    {
-      name: 'renderToString',
-      kind: 'function',
-      signature: 'renderToString(root: VNode | null): Promise<string>',
-      summary:
-        'Render a VNode tree to a single HTML string. Each call runs in a fresh isolated ALS context stack (and store registry if `configureStoreIsolation` was called) so concurrent requests never bleed `provide()` frames into each other. Signal accessors are invoked synchronously to snapshot their CURRENT value — there is no reactivity on the server, so a `<div>{count()}</div>` renders the value at render time and only becomes live after client hydration. Async component functions (`async function C()`) are awaited before the walk continues. Returns the empty string for a `null` root.',
-      example: `import { renderToString } from "@pyreon/runtime-server"
-
-const html = await renderToString(<App />)`,
-      mistakes: [
-        'Expecting signal writes after `renderToString` to change the output — SSR is one-shot; the string is already produced. Reactivity is a post-hydration (client) concern',
-        "Calling Pyreon context APIs (`useHead`, loaders) OUTSIDE `renderToString` and expecting per-request isolation — use `runWithRequestContext` for that; bare calls share the fallback stack across concurrent requests",
-        'Reaching for `renderToString` directly when you have an HTTP handler — the `createHandler` in `@pyreon/server` wraps it with template precompilation, middleware, and loader-data injection; prefer that for request handling',
-      ],
-      seeAlso: ['renderToStream', 'runWithRequestContext'],
-    },
-    {
-      name: 'renderToStream',
-      kind: 'function',
-      signature: 'renderToStream(root: VNode | null, options?: { signal?: AbortSignal; suspenseTimeoutMs?: number }): ReadableStream<string>',
-      summary:
-        'Render to a Web-standard `ReadableStream<string>` with true progressive flushing — synchronous subtrees enqueue immediately, async component boundaries are awaited in order. Suspense boundaries stream OUT OF ORDER: the fallback is emitted inline at once, and the resolved children arrive later as a `<template>` + a tiny inline swap `<script>` that replaces the placeholder client-side — without blocking the rest of the page. Each call gets its own isolated ALS context stack. A Suspense boundary that does not resolve within the per-boundary timeout (default 30_000 ms, configurable via `options.suspenseTimeoutMs`; pass `Infinity` to disable) leaves its fallback in place and a dev-mode warning fires; a boundary that throws also leaves the fallback (no swap script emitted). Pass `options.signal` (e.g. `Request.signal`) to abort pending Suspense work when the consumer disconnects.',
-      example: `import { renderToStream } from "@pyreon/runtime-server"
-
-return new Response(renderToStream(<App />, {
-  signal: req.signal,
-  suspenseTimeoutMs: 5_000, // ops-controlled per-boundary cap
-}), {
-  headers: { "content-type": "text/html" },
-})`,
-      mistakes: [
-        'Assuming Suspense children arrive in source order — they are swapped in as each boundary resolves; the fallback ships first, resolved content can arrive in any order',
-        'Expecting `@pyreon/head` tags registered inside a Suspense child to reach the document `<head>` — the head is flushed in the shell BEFORE any boundary resolves, so async-loaded data does not contribute to it',
-        'Treating a timed-out boundary as an error — by design the fallback simply stays; only a dev-mode `console.warn` signals it. Tune `options.suspenseTimeoutMs` to match your SLA (5_000–10_000 typical for user-facing apps; `Infinity` to disable entirely for export jobs / reports)',
-        'Buffering the whole stream before responding — that throws away the progressive-flush benefit; pass the stream straight into the `Response`',
-        'Forgetting `signal: req.signal` — without it, in-flight Suspense work keeps running (and tries to write to a closed stream) after the consumer disconnects',
-      ],
-      seeAlso: ['renderToString'],
-    },
-    {
-      name: 'runWithRequestContext',
-      kind: 'function',
-      signature: 'runWithRequestContext<T>(fn: () => Promise<T>): Promise<T>',
-      summary:
-        'Run an async function inside a fresh, isolated ALS context stack (and store registry, if `configureStoreIsolation` was called). Use this when you need to call Pyreon context-aware APIs — `useHead`, `prefetchLoaderData`, router resolution — OUTSIDE a `renderToString` / `renderToStream` call but still want per-request isolation. Without it those calls land on a process-global fallback stack shared by every concurrent request.',
-      example: `import { runWithRequestContext } from "@pyreon/runtime-server"
-
-const data = await runWithRequestContext(async () => {
-  await prefetchLoaderData(router, url.pathname, request)
-  return renderToString(<App />)
-})`,
-      mistakes: [
-        'Calling `prefetchLoaderData` / `useHead` before `renderToString` WITHOUT wrapping the whole sequence in one `runWithRequestContext` — the prefetch lands in a different (or the shared fallback) context than the render, so the render sees no loader data',
-        'Wrapping a synchronous function — the signature is `() => Promise<T>`; return the promise (or make the fn `async`) so the ALS scope spans the awaited work',
-      ],
-      seeAlso: ['renderToString', 'configureStoreIsolation'],
-    },
-    {
-      name: 'configureStoreIsolation',
-      kind: 'function',
-      signature:
-        'configureStoreIsolation(setStoreRegistryProvider: (fn: () => Map<string, unknown>) => void): void',
-      summary:
-        "Opt in to per-request `@pyreon/store` isolation. Call ONCE at server startup, passing `@pyreon/store`'s `setStoreRegistryProvider`. After this, every `renderToString` / `renderToStream` / `runWithRequestContext` call gets its own fresh store registry via ALS. WITHOUT calling it, store isolation is a no-op and all concurrent requests share ONE process-global store registry — request A's `defineStore` state is visible to request B (SSR state bleed across users).",
-      example: `import { configureStoreIsolation } from "@pyreon/runtime-server"
-import { setStoreRegistryProvider } from "@pyreon/store"
-
-// once, at server startup:
-configureStoreIsolation(setStoreRegistryProvider)`,
-      mistakes: [
-        'Not calling it at all in an SSR app that uses `@pyreon/store` — concurrent requests share one global registry, so one request’s store state leaks into another request’s render',
-        'Calling it per request instead of once at startup — it only needs to wire the provider once; the per-request fresh `Map` is handled internally by the ALS run',
-        'Passing something other than the `setStoreRegistryProvider` exported by `@pyreon/store` — the contract is specifically that provider-setter shape',
-      ],
-      seeAlso: ['runWithRequestContext', 'renderToString'],
-    },
-    {
-      name: 'decodeKeyFromMarker',
-      kind: 'function',
-      signature: 'decodeKeyFromMarker(encoded: string): string',
-      summary:
-        "Inverse of the internal For-list key encoder. `<For>` SSR emits per-item `<!--k:KEY-->` markers; the encoder URL-encodes the key and replaces every `-` with `%2D` so a user-supplied key can never form `-->` and break out of the HTML comment (an injection vector). `decodeKeyFromMarker` reverses that. Not used by the runtime today (hydration does not read per-item markers) — shipped alongside the encoder so future hydration or devtools consumers decode symmetrically without re-deriving the scheme.",
-      example: `import { decodeKeyFromMarker } from "@pyreon/runtime-server"
-
-decodeKeyFromMarker("a%2Db") // "a-b"`,
-      mistakes: [
-        'Assuming the runtime consumes this — it does not yet; it exists for forward-compat / devtools symmetry with the marker encoder',
-      ],
-    },
-  ],
-  gotchas: [
-    {
-      label: 'No reactivity on the server',
-      note: 'Signal accessors are called synchronously to snapshot their value — no effects are created. A `{count()}` expression renders the value at render time; it only becomes live after client hydration. SSR is one-shot.',
-    },
-    {
-      label: 'Usually consumed via @pyreon/server',
-      note: '`createHandler` (SSR HTTP) and `prerender` (SSG) in `@pyreon/server` wrap this renderer with template precompilation, middleware, and loader-data injection. Call `renderToString` / `renderToStream` directly only for custom integrations; for request handling prefer `@pyreon/server`.',
-    },
-    {
-      label: 'Server dev-gate convention',
-      note: 'As a server package, `@pyreon/runtime-server` correctly uses `typeof process !== "undefined" && process.env.NODE_ENV !== "production"` for its dev-mode perf-counter sink — NOT the browser `import.meta.env.DEV` form. It always runs in Node/Bun where `process` is real.',
-    },
-  ],
-})

package/src/tests/for-key-marker.test.ts

@@ -1,86 +0,0 @@
-import { For, h } from '@pyreon/core'
-import { signal } from '@pyreon/reactivity'
-import { decodeKeyFromMarker, renderToString } from '../index'
-
-// For list SSR emits <!--k:KEY--> markers between items. The key is
-// user-supplied (derived from `by`) and must not be able to break out
-// of the HTML comment. A naive inline of `-->` would terminate the
-// comment and inject arbitrary markup. This suite locks the fix.
-
-describe('For SSR — key marker safety', () => {
-  it('emits one marker per item with the expected key for normal ids', async () => {
-    type Row = { id: number; label: string }
-    const items = signal<Row[]>([
-      { id: 1, label: 'a' },
-      { id: 2, label: 'b' },
-      { id: 3, label: 'c' },
-    ])
-    const html = await renderToString(
-      h(For, {
-        each: () => items(),
-        by: (r: Row) => r.id,
-        children: (r: Row) => h('li', null, r.label),
-      }),
-    )
-
-    const markers = html.match(/<!--k:[^>]*-->/g) ?? []
-    expect(markers).toHaveLength(3)
-    // Numeric keys are URL-encoded predictably (digits survive).
-    expect(markers[0]).toBe('<!--k:1-->')
-    expect(markers[1]).toBe('<!--k:2-->')
-    expect(markers[2]).toBe('<!--k:3-->')
-  })
-
-  it('prevents comment-breakout via `-->` in the key (XSS guard)', async () => {
-    // Adversarial: a key that would, unsanitized, close the comment and
-    // inject a <script> tag.
-    const attackKey = '--><script>alert(1)</script><!--'
-    type Row = { id: string }
-    const items = signal<Row[]>([{ id: attackKey }])
-    const html = await renderToString(
-      h(For, {
-        each: () => items(),
-        by: (r: Row) => r.id,
-        children: () => h('li', null, 'x'),
-      }),
-    )
-
-    // The raw attacker string must NOT appear verbatim.
-    expect(html).not.toContain('<script>alert(1)</script>')
-    // The `-->` terminator must not appear anywhere but at the very end
-    // of the marker (after the encoded key).
-    const markerMatch = html.match(/<!--k:([^-]*)-->/)
-    expect(markerMatch).not.toBeNull()
-    // No literal `-` survives inside the encoded key (defense-in-depth
-    // against any future HTML-comment parsing quirk).
-    expect(markerMatch![1]).not.toMatch(/-/)
-  })
-
-  it('URL-encodes keys with special chars safely', async () => {
-    type Row = { id: string }
-    const items = signal<Row[]>([{ id: 'a&b=c d' }])
-    const html = await renderToString(
-      h(For, {
-        each: () => items(),
-        by: (r: Row) => r.id,
-        children: () => h('li', null, 'x'),
-      }),
-    )
-
-    const marker = html.match(/<!--k:([^>]*)-->/)
-    expect(marker).not.toBeNull()
-    // `&`, `=`, ` `, and `-` all URL-encoded.
-    expect(marker![1]).toBe('a%26b%3Dc%20d')
-    // decodeKeyFromMarker round-trips back to the original string.
-    expect(decodeKeyFromMarker(marker![1]!)).toBe('a&b=c d')
-  })
-
-  it('decodeKeyFromMarker round-trips adversarial keys', () => {
-    // Directly round-trip the adversarial case that motivated the fix.
-    const attackKey = '--><script>alert(1)</script><!--'
-    // Produce what SSR would emit (safeKeyForMarker is private; use
-    // the inverse on a value we know was encoded from it).
-    const encoded = encodeURIComponent(attackKey).replace(/-/g, '%2D')
-    expect(decodeKeyFromMarker(encoded)).toBe(attackKey)
-  })
-})

package/src/tests/integration.test.ts

@@ -1,310 +0,0 @@
-import type { ComponentFn, VNode } from '@pyreon/core'
-import {
-  createContext,
-  For,
-  h,
-  pushContext,
-  Show,
-  Suspense,
-  useContext,
-} from '@pyreon/core'
-import { signal } from '@pyreon/reactivity'
-import { renderToStream, renderToString, runWithRequestContext } from '../index'
-
-async function collectStream(stream: ReadableStream<string>): Promise<string> {
-  const reader = stream.getReader()
-  const chunks: string[] = []
-  while (true) {
-    const { done, value } = await reader.read()
-    if (done) break
-    chunks.push(value)
-  }
-  return chunks.join('')
-}
-
-// ─── SSR integration — renderToString ─────────────────────────────────────────
-
-describe('SSR integration — renderToString', () => {
-  test('simple component renders valid HTML string', async () => {
-    const Greeting = () => h('div', { class: 'greeting' }, 'Hello world')
-    const html = await renderToString(h(Greeting, null))
-    expect(html).toBe('<div class="greeting">Hello world</div>')
-  })
-
-  test('component with signal initial value renders correct value in HTML', async () => {
-    const count = signal(42)
-    const Counter = () => h('span', null, () => count())
-    const html = await renderToString(h(Counter, null))
-    expect(html).toBe('<span>42</span>')
-  })
-
-  test('nested components render correct nesting in output', async () => {
-    const Inner = (props: { label: string }) => h('span', null, props.label)
-    const Outer = () =>
-      h('div', { class: 'outer' }, h(Inner, { label: 'A' }), h(Inner, { label: 'B' }))
-    const html = await renderToString(h(Outer, null))
-    expect(html).toBe('<div class="outer"><span>A</span><span>B</span></div>')
-  })
-
-  test('Show when=true renders children', async () => {
-    const vnode = h(Show, {
-      when: () => true,
-      children: h('p', null, 'visible'),
-    })
-    const html = await renderToString(vnode)
-    expect(html).toContain('visible')
-  })
-
-  test('Show when=false renders nothing', async () => {
-    const vnode = h(Show, {
-      when: () => false,
-      children: h('p', null, 'hidden'),
-    })
-    const html = await renderToString(vnode)
-    expect(html).not.toContain('hidden')
-  })
-
-  test('For list renders all items with key markers', async () => {
-    const items = signal([
-      { id: 1, name: 'A' },
-      { id: 2, name: 'B' },
-      { id: 3, name: 'C' },
-    ])
-    const vnode = For({
-      each: items,
-      by: (r: { id: number }) => r.id,
-      children: (r: { id: number; name: string }) => h('li', null, r.name),
-    })
-    const html = await renderToString(vnode)
-    expect(html).toContain('<!--pyreon-for-->')
-    expect(html).toContain('<!--/pyreon-for-->')
-    expect(html).toContain('<li>A</li>')
-    expect(html).toContain('<li>B</li>')
-    expect(html).toContain('<li>C</li>')
-  })
-
-  test('component that throws rejects the renderToString promise', async () => {
-    const Broken = () => {
-      throw new Error('test error')
-    }
-    await expect(
-      renderToString(h(Broken as unknown as ComponentFn, null)),
-    ).rejects.toThrow('test error')
-  })
-})
-
-// ─── SSR integration — renderToStream ─────────────────────────────────────────
-
-describe('SSR integration — renderToStream', () => {
-  test('simple component streams correct HTML', async () => {
-    const Comp = () => h('div', { id: 'streamed' }, 'hello stream')
-    const html = await collectStream(renderToStream(h(Comp, null)))
-    expect(html).toContain('<div id="streamed">hello stream</div>')
-  })
-
-  test('Suspense with async component streams fallback first, then content', async () => {
-    async function AsyncComp(): Promise<ReturnType<typeof h>> {
-      await new Promise<void>((r) => setTimeout(r, 10))
-      return h('div', null, 'loaded')
-    }
-
-    const vnode = h(Suspense, {
-      fallback: h('span', null, 'loading...'),
-      children: h(AsyncComp as unknown as ComponentFn, null),
-    })
-
-    const html = await collectStream(renderToStream(vnode))
-    // Fallback was emitted
-    expect(html).toContain('loading...')
-    // Resolved content was emitted
-    expect(html).toContain('loaded')
-  })
-
-  test('AbortSignal: upstream abort skips post-resolve enqueue (client disconnected)', async () => {
-    // 50ms-deferred async component; we abort after 5ms, well before
-    // resolution. The fallback IS emitted (it runs synchronously during
-    // the initial stream pass, BEFORE the signal aborts). The
-    // post-resolve swap (`<template>` + `__NS()` script) MUST be skipped
-    // because the consumer (browser fetch reader) hung up.
-    async function SlowComp(): Promise<ReturnType<typeof h>> {
-      await new Promise<void>((r) => setTimeout(r, 50))
-      return h('div', null, 'loaded-too-late')
-    }
-    const vnode = h(Suspense, {
-      fallback: h('span', null, 'loading-shown'),
-      children: h(SlowComp as unknown as ComponentFn, null),
-    })
-
-    const ac = new AbortController()
-    const stream = renderToStream(vnode, { signal: ac.signal })
-    setTimeout(() => ac.abort(), 5)
-
-    const html = await collectStream(stream)
-    // Fallback streamed before the abort fired
-    expect(html).toContain('loading-shown')
-    // Post-resolve enqueue was skipped — the template + swap script never
-    // landed. (`__NS` FUNCTION DEFINITION ships at the head of every
-    // stream as the swap-script preamble; the per-boundary swap CALLS
-    // it as `__NS("pyreon-s-<id>",...)`. We check for the CALL, not the
-    // definition.)
-    expect(html).not.toContain('loaded-too-late')
-    expect(html).not.toMatch(/__NS\(\s*["']pyreon-s-/)
-  })
-
-  test('AbortSignal: pre-aborted signal still emits the synchronous portion', async () => {
-    // Edge case — signal already aborted at renderToStream call time.
-    // Synchronous portion still emits (the abort doesn't STOP rendering,
-    // it only suppresses post-resolve enqueues), but the stream closes
-    // promptly without waiting for any pending boundaries.
-    const ac = new AbortController()
-    ac.abort()
-    const html = await collectStream(
-      renderToStream(h('div', { id: 'sync' }, 'sync-content'), { signal: ac.signal }),
-    )
-    // Sync output was emitted before the abort propagated through the
-    // first enqueue check.
-    expect(html.length).toBeGreaterThanOrEqual(0)
-  })
-
-  test('ReadableStream.cancel() aborts in-flight Suspense work', async () => {
-    async function SlowComp(): Promise<ReturnType<typeof h>> {
-      await new Promise<void>((r) => setTimeout(r, 200))
-      return h('div', null, 'never-streamed')
-    }
-    const vnode = h(Suspense, {
-      fallback: h('span', null, 'fallback-shown'),
-      children: h(SlowComp as unknown as ComponentFn, null),
-    })
-
-    const stream = renderToStream(vnode)
-    const reader = stream.getReader()
-
-    // Drain chunks until we see the fallback (the `__NS` setup script
-    // is emitted first, then the per-boundary fallback HTML). Then
-    // cancel — this MUST propagate to the internal abort signal so the
-    // drain loop exits without waiting for SlowComp's 200ms timer.
-    let collected = ''
-    const start = Date.now()
-    while (!collected.includes('fallback-shown') && Date.now() - start < 1000) {
-      const chunk = await reader.read()
-      if (chunk.done) break
-      collected += String(chunk.value)
-    }
-    expect(collected).toContain('fallback-shown')
-
-    await reader.cancel('client-disconnect')
-    // After cancellation, the stream MUST close promptly (well before
-    // SlowComp's 200ms timer). The next read returns done=true.
-    const beforeRead = Date.now()
-    const done = await reader.read()
-    const elapsed = Date.now() - beforeRead
-    expect(done.done).toBe(true)
-    // Generous bound: 100ms is plenty to detect "promptly" vs "waited
-    // for the 200ms timer". On a slow CI box even 100ms is well below
-    // the cancelled boundary's pending work.
-    expect(elapsed).toBeLessThan(100)
-  })
-
-  test('collecting all chunks produces valid complete HTML', async () => {
-    const Header = () => h('header', null, 'Header')
-    const Main = () => h('main', null, 'Content')
-    const Footer = () => h('footer', null, 'Footer')
-
-    const App = () =>
-      h(
-        'div',
-        { id: 'app' },
-        h(Header, null),
-        h(Main, null),
-        h(Footer, null),
-      )
-
-    const stream = renderToStream(h(App, null))
-    const reader = stream.getReader()
-    const chunks: string[] = []
-    while (true) {
-      const { done, value } = await reader.read()
-      if (done) break
-      chunks.push(value)
-    }
-
-    const html = chunks.join('')
-    expect(html).toContain('<header>Header</header>')
-    expect(html).toContain('<main>Content</main>')
-    expect(html).toContain('<footer>Footer</footer>')
-    // Overall structure is valid
-    expect(html).toContain('<div id="app">')
-    expect(html).toContain('</div>')
-  })
-})
-
-// ─── SSR integration — context isolation ──────────────────────────────────────
-
-describe('SSR integration — context isolation', () => {
-  test('two concurrent renderToString calls do not leak context', async () => {
-    const Ctx = createContext('default')
-
-    function makeApp(value: string): ComponentFn {
-      return function App() {
-        pushContext(new Map([[Ctx.id, value]]))
-        return h('span', null, () => useContext(Ctx))
-      }
-    }
-
-    const [html1, html2] = await Promise.all([
-      renderToString(h(makeApp('request-1'), null)),
-      renderToString(h(makeApp('request-2'), null)),
-    ])
-
-    expect(html1).toBe('<span>request-1</span>')
-    expect(html2).toBe('<span>request-2</span>')
-  })
-
-  test('concurrent renders with async components stay isolated', async () => {
-    const Ctx = createContext('none')
-
-    async function AsyncReader(props: { delay: number }): Promise<VNode> {
-      await new Promise<void>((r) => setTimeout(r, props.delay))
-      return h('span', null, useContext(Ctx))
-    }
-
-    function RequestApp(props: { reqId: string; delay: number }): VNode {
-      pushContext(new Map([[Ctx.id, props.reqId]]))
-      return h(AsyncReader as unknown as ComponentFn, { delay: props.delay })
-    }
-
-    const N = 10
-    const results = await Promise.all(
-      Array.from({ length: N }, (_, i) =>
-        renderToString(
-          h(RequestApp as unknown as ComponentFn, {
-            reqId: `req-${i}`,
-            delay: Math.floor(Math.random() * 15),
-          }),
-        ),
-      ),
-    )
-
-    results.forEach((html, i) => {
-      expect(html).toBe(`<span>req-${i}</span>`)
-    })
-  })
-
-  test('runWithRequestContext isolates two concurrent calls', async () => {
-    const Ctx = createContext('none')
-    const [r1, r2] = await Promise.all([
-      runWithRequestContext(async () => {
-        pushContext(new Map([[Ctx.id, 'isolated-A']]))
-        await new Promise<void>((r) => setTimeout(r, 10))
-        return useContext(Ctx)
-      }),
-      runWithRequestContext(async () => {
-        pushContext(new Map([[Ctx.id, 'isolated-B']]))
-        await new Promise<void>((r) => setTimeout(r, 10))
-        return useContext(Ctx)
-      }),
-    ])
-    expect(r1).toBe('isolated-A')
-    expect(r2).toBe('isolated-B')
-  })
-})

package/src/tests/manifest-snapshot.test.ts

@@ -1,39 +0,0 @@
-import {
-  renderApiReferenceEntries,
-  renderLlmsFullSection,
-  renderLlmsTxtLine,
-} from '@pyreon/manifest'
-import manifest from '../manifest'
-
-describe('gen-docs — runtime-server snapshot', () => {
-  it('renders a llms.txt bullet starting with the package prefix', () => {
-    const line = renderLlmsTxtLine(manifest)
-    expect(line.startsWith('- @pyreon/runtime-server —')).toBe(true)
-  })
-
-  it('renders a llms-full.txt section with the right header', () => {
-    const section = renderLlmsFullSection(manifest)
-    expect(section.startsWith('## @pyreon/runtime-server —')).toBe(true)
-    expect(section).toContain('```typescript')
-  })
-
-  it('renders MCP api-reference entries for every api[] item', () => {
-    const record = renderApiReferenceEntries(manifest)
-    expect(Object.keys(record).sort()).toEqual([
-      'runtime-server/configureStoreIsolation',
-      'runtime-server/decodeKeyFromMarker',
-      'runtime-server/renderToStream',
-      'runtime-server/renderToString',
-      'runtime-server/runWithRequestContext',
-    ])
-  })
-
-  it('carries the SSR foot-gun catalog into MCP mistakes for the flagship APIs', () => {
-    const r = renderApiReferenceEntries(manifest)
-    expect(r['runtime-server/renderToString']?.mistakes).toContain('one-shot')
-    expect(r['runtime-server/renderToStream']?.mistakes).toContain('Suspense')
-    expect(r['runtime-server/configureStoreIsolation']?.mistakes).toContain(
-      'global registry',
-    )
-  })
-})

package/src/tests/reactive-props.test.ts

@@ -1,95 +0,0 @@
-import type { ComponentFn, Props } from '@pyreon/core'
-import { _rp, For, h } from '@pyreon/core'
-import { describe, expect, it } from 'vitest'
-import { renderToString } from '..'
-
-// Regression for the SSR `_rp`/`makeReactiveProps` gap.
-//
-// The compiler wraps `<Comp prop={signalRead}>` as
-// `h(Comp, { prop: _rp(() => signalRead) })`. mount.ts (CSR) calls
-// `makeReactiveProps` on the raw vnode props before invoking the component, so
-// inside the body `props.prop` invokes the getter and returns the resolved
-// value. Pre-fix, `runtime-server` skipped that step — components received raw
-// `_rp` functions, so `${props.prop}` stringified the function source and any
-// downstream attribute / template-literal interpolation embedded code into the
-// HTML (e.g. `<a href="() => props.path">` from the fundamentals layout).
-//
-// hydrate.ts had the same gap; lock-in lives in the runtime-dom suite.
-
-describe('SSR — _rp-wrapped component props are resolved (makeReactiveProps wired into runtime-server)', () => {
-  it('resolves `_rp(() => string)` to the string when interpolated in component-emitted HTML', async () => {
-    const Link = (props: { to: string }) => h('a', { href: `#${props.to}` }, 'go')
-    const html = await renderToString(
-      h(Link, { to: _rp(() => '/about') as unknown as string }),
-    )
-    expect(html).toBe('<a href="#/about">go</a>')
-    expect(html).not.toContain('=>')
-  })
-
-  it('resolves `_rp` chain when a parent reads its own getter and forwards through another `_rp`', async () => {
-    // Layout-shape: outer passes `_rp(() => '/store')` as `path`; NavItem
-    // reads `props.path` (which is now a getter) and re-wraps as
-    // `_rp(() => props.path)` for the child. SSR must traverse BOTH layers.
-    const Inner = (props: { to: string }) => h('a', { href: props.to }, 'x')
-    const Outer = (props: { path: string }) =>
-      h(Inner, { to: _rp(() => props.path) as unknown as string })
-    const html = await renderToString(
-      h(Outer, { path: _rp(() => '/store') as unknown as string }),
-    )
-    expect(html).toBe('<a href="/store">x</a>')
-  })
-
-  it('`<For each={items()}>` from a component renders correctly under SSR', async () => {
-    // Regression: PR #410's `makeReactiveProps` in `mergeChildrenIntoProps`
-    // converts `_rp(() => arr)` props to getters that RESOLVE the array. The
-    // `<For>` function is a component (its body returns a ForSymbol vnode),
-    // so it goes through that path. Result: the re-emitted ForSymbol vnode
-    // has `props.each` as the resolved array, not the function. SSR's For
-    // handler used to call `each()` unconditionally → TypeError. Defensive
-    // normalization (typeof === 'function' ? each() : each) fixes both shapes.
-    type Item = { id: number; name: string }
-    const Page = () => {
-      const items = () => [
-        { id: 1, name: 'a' },
-        { id: 2, name: 'b' },
-      ] as Item[]
-      const forProps = {
-        each: _rp(items) as unknown as () => Item[],
-        by: (r: Item) => r.id,
-        children: (r: Item) => h('span', null, r.name),
-      }
-      return h(For as unknown as ComponentFn, forProps as unknown as Props)
-    }
-    const html = await renderToString(h(Page, null))
-    expect(html).toContain('a')
-    expect(html).toContain('b')
-    expect(html).not.toContain('SSR Error')
-  })
-
-  it('`<For each={arr}>` (already-array form) still renders correctly under SSR', async () => {
-    // When `each` is a plain array (not a function), the defensive shape must
-    // still iterate. `<For each={[1,2,3]}>` is the typical hand-coded form.
-    type Item = { id: number; name: string }
-    const forProps = {
-      each: [{ id: 1, name: 'plain' }] as unknown as () => Item[],
-      by: (r: Item) => r.id,
-      children: (r: Item) => h('span', null, r.name),
-    }
-    const html = await renderToString(
-      h(For as unknown as ComponentFn, forProps as unknown as Props),
-    )
-    expect(html).toContain('plain')
-  })
-
-  it('non-`_rp` function props (user-written accessors) still pass through to elements', async () => {
-    // `class={() => 'foo'}` is NOT `_rp`-wrapped (it's a user-written
-    // accessor, not a compiler emission). makeReactiveProps must leave it as
-    // a plain function on `props.class` so the runtime can call it. The SSR
-    // attribute renderer already invokes function-typed attribute values, so
-    // the result still hits the rendered HTML — but we lock the contract in.
-    const Wrapper = (props: { class: () => string }) =>
-      h('div', { class: props.class }, 'x')
-    const html = await renderToString(h(Wrapper, { class: () => 'foo' }))
-    expect(html).toBe('<div class="foo">x</div>')
-  })
-})