@renderify/runtime 0.1.0

package/dist/runtime.cjs.js

@@ -0,0 +1,3701 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  BabelRuntimeSourceTranspiler: () => BabelRuntimeSourceTranspiler,
+  DefaultRuntimeManager: () => DefaultRuntimeManager,
+  DefaultUIRenderer: () => DefaultUIRenderer,
+  JspmModuleLoader: () => JspmModuleLoader,
+  RuntimeSecurityViolationError: () => RuntimeSecurityViolationError,
+  renderPlanInBrowser: () => renderPlanInBrowser
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/embed.ts
+var import_security = require("@renderify/security");
+
+// src/jspm-module-loader.ts
+var import_ir = require("@renderify/ir");
+var NODE_BUILTIN_MODULE_NAMES = /* @__PURE__ */ new Set([
+  "assert",
+  "buffer",
+  "child_process",
+  "cluster",
+  "console",
+  "constants",
+  "crypto",
+  "dgram",
+  "diagnostics_channel",
+  "dns",
+  "domain",
+  "events",
+  "fs",
+  "http",
+  "http2",
+  "https",
+  "inspector",
+  "module",
+  "net",
+  "os",
+  "path",
+  "perf_hooks",
+  "process",
+  "punycode",
+  "querystring",
+  "readline",
+  "repl",
+  "stream",
+  "string_decoder",
+  "sys",
+  "timers",
+  "tls",
+  "tty",
+  "url",
+  "util",
+  "v8",
+  "vm",
+  "wasi",
+  "worker_threads",
+  "zlib"
+]);
+function hasSystemImport(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const maybeSystem = value;
+  return typeof maybeSystem.import === "function";
+}
+var JspmModuleLoader = class {
+  cdnBaseUrl;
+  importMap;
+  cache = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    this.cdnBaseUrl = this.normalizeCdnBaseUrl(options.cdnBaseUrl);
+    this.importMap = options.importMap ?? {};
+  }
+  async load(specifier) {
+    const resolved = this.resolveSpecifier(specifier);
+    if (this.cache.has(resolved)) {
+      return this.cache.get(resolved);
+    }
+    const loaded = await this.importWithBestEffort(resolved);
+    this.cache.set(resolved, loaded);
+    return loaded;
+  }
+  async unload(specifier) {
+    const resolved = this.resolveSpecifier(specifier);
+    this.cache.delete(resolved);
+  }
+  resolveSpecifier(specifier) {
+    const normalized = specifier.trim();
+    if (normalized.length === 0) {
+      throw new Error("Empty module specifier is not supported");
+    }
+    const mapped = this.importMap[normalized];
+    if (mapped) {
+      return mapped;
+    }
+    if (this.isUrl(normalized)) {
+      return normalized;
+    }
+    if (this.isNodeBuiltinSpecifier(normalized)) {
+      throw new Error(
+        `Node.js builtin modules are not supported in JSPM runtime: ${normalized}`
+      );
+    }
+    if (this.hasUnsupportedScheme(normalized)) {
+      const scheme = normalized.slice(0, normalized.indexOf(":"));
+      throw new Error(
+        `Unsupported module scheme "${scheme}" in specifier: ${normalized}`
+      );
+    }
+    if (normalized.startsWith("npm:")) {
+      return this.resolveNpmSpecifier(normalized.slice(4));
+    }
+    if (this.isBareNpmSpecifier(normalized)) {
+      return this.resolveNpmSpecifier(normalized);
+    }
+    throw new Error(`Unsupported JSPM specifier: ${normalized}`);
+  }
+  async importWithBestEffort(resolved) {
+    const globalValue = globalThis;
+    const maybeSystem = typeof globalValue === "object" && globalValue !== null ? globalValue.System : void 0;
+    if (hasSystemImport(maybeSystem)) {
+      return maybeSystem.import(resolved);
+    }
+    return import(
+      /* webpackIgnore: true */
+      resolved
+    );
+  }
+  isUrl(value) {
+    try {
+      const parsed = new URL(value);
+      return parsed.protocol === "http:" || parsed.protocol === "https:";
+    } catch {
+      return false;
+    }
+  }
+  hasUnsupportedScheme(specifier) {
+    const schemeMatch = /^([a-zA-Z][a-zA-Z\d+\-.]*):/.exec(specifier);
+    if (!schemeMatch) {
+      return false;
+    }
+    const scheme = schemeMatch[1].toLowerCase();
+    return scheme !== "http" && scheme !== "https" && scheme !== "npm";
+  }
+  isBareNpmSpecifier(specifier) {
+    if (specifier.startsWith("./") || specifier.startsWith("../") || specifier.startsWith("/")) {
+      return false;
+    }
+    if (/\s/.test(specifier)) {
+      return false;
+    }
+    return /^[@a-zA-Z0-9][@a-zA-Z0-9._/-]*(?:@[a-zA-Z0-9._-]+)?$/.test(
+      specifier
+    );
+  }
+  isNodeBuiltinSpecifier(specifier) {
+    if (specifier.startsWith("node:")) {
+      const name = specifier.slice(5).split("/")[0];
+      return name.length > 0;
+    }
+    const target = specifier.startsWith("npm:") ? specifier.slice(4) : specifier;
+    const topLevel = this.extractTopLevelPackageName(target);
+    return NODE_BUILTIN_MODULE_NAMES.has(topLevel);
+  }
+  extractTopLevelPackageName(specifier) {
+    if (specifier.startsWith("@")) {
+      const segments = specifier.split("/");
+      if (segments.length < 2) {
+        return specifier;
+      }
+      const scopedName = segments[1].split("@")[0];
+      return `${segments[0]}/${scopedName}`;
+    }
+    const firstSegment = specifier.split("/")[0];
+    return firstSegment.split("@")[0];
+  }
+  resolveNpmSpecifier(specifier) {
+    const normalized = specifier.trim();
+    if (normalized.length === 0) {
+      throw new Error("Empty npm specifier is not supported");
+    }
+    const override = import_ir.DEFAULT_JSPM_SPECIFIER_OVERRIDES[normalized];
+    if (override) {
+      return override;
+    }
+    return `${this.cdnBaseUrl}/npm:${normalized}`;
+  }
+  normalizeCdnBaseUrl(input) {
+    const raw = input?.trim() || "https://ga.jspm.io";
+    const normalized = raw.replace(/\/$/, "");
+    return normalized.endsWith("/npm") ? normalized.slice(0, normalized.length - 4) : normalized;
+  }
+};
+
+// src/manager.ts
+var import_ir9 = require("@renderify/ir");
+
+// src/module-fetch.ts
+var import_ir2 = require("@renderify/ir");
+var DEFAULT_ESM_CDN_BASE = "https://esm.sh";
+function buildRemoteModuleAttemptUrls(url, fallbackCdnBases) {
+  const candidates = /* @__PURE__ */ new Set();
+  candidates.add(url);
+  for (const fallbackBase of fallbackCdnBases) {
+    const fallback = toConfiguredFallbackUrl(url, fallbackBase);
+    if (fallback) {
+      candidates.add(fallback);
+    }
+  }
+  return [...candidates];
+}
+function toConfiguredFallbackUrl(url, cdnBase) {
+  const normalizedBase = cdnBase.trim().replace(/\/$/, "");
+  const specifier = extractJspmNpmSpecifier(url);
+  if (!specifier || normalizedBase.length === 0) {
+    return void 0;
+  }
+  if (normalizedBase.includes("esm.sh")) {
+    return toEsmFallbackUrl(url, normalizedBase);
+  }
+  if (normalizedBase.includes("jsdelivr.net")) {
+    return `${normalizedBase}/npm/${specifier}`;
+  }
+  if (normalizedBase.includes("unpkg.com")) {
+    const separator = specifier.includes("?") ? "&" : "?";
+    return `${normalizedBase}/${specifier}${separator}module`;
+  }
+  if (normalizedBase.includes("jspm.io")) {
+    const root = normalizedBase.endsWith("/npm") ? normalizedBase.slice(0, normalizedBase.length - 4) : normalizedBase;
+    return `${root}/npm:${specifier}`;
+  }
+  return void 0;
+}
+function toEsmFallbackUrl(url, cdnBase = DEFAULT_ESM_CDN_BASE) {
+  const specifier = extractJspmNpmSpecifier(url);
+  if (!specifier) {
+    return void 0;
+  }
+  const normalizedBase = cdnBase.trim().replace(/\/$/, "");
+  if (normalizedBase.length === 0) {
+    return void 0;
+  }
+  const aliasQuery = [
+    "alias=react:preact/compat,react-dom:preact/compat,react-dom/client:preact/compat,react/jsx-runtime:preact/jsx-runtime,react/jsx-dev-runtime:preact/jsx-runtime",
+    "target=es2022"
+  ].join("&");
+  const separator = specifier.includes("?") ? "&" : "?";
+  return `${normalizedBase}/${specifier}${separator}${aliasQuery}`;
+}
+function extractJspmNpmSpecifier(url) {
+  const prefix = "https://ga.jspm.io/npm:";
+  if (!url.startsWith(prefix)) {
+    return void 0;
+  }
+  const specifier = url.slice(prefix.length).trim();
+  if (specifier.length === 0) {
+    return void 0;
+  }
+  return specifier;
+}
+function isCssModuleResponse(fetched) {
+  return fetched.contentType.includes("text/css") || isCssUrl(fetched.url);
+}
+function isJsonModuleResponse(fetched) {
+  return fetched.contentType.includes("application/json") || fetched.contentType.includes("text/json") || isJsonUrl(fetched.url);
+}
+function isJavaScriptModuleResponse(fetched) {
+  if (isJavaScriptLikeContentType(fetched.contentType)) {
+    return true;
+  }
+  return isJavaScriptUrl(fetched.url);
+}
+function isJavaScriptLikeContentType(contentType) {
+  return contentType.includes("javascript") || contentType.includes("ecmascript") || contentType.includes("typescript") || contentType.includes("module");
+}
+function isBinaryLikeContentType(contentType) {
+  return contentType.includes("application/wasm") || contentType.includes("image/") || contentType.includes("font/");
+}
+function isJavaScriptUrl(url) {
+  const pathname = toUrlPathname(url);
+  return /\.(?:m?js|cjs|jsx|ts|tsx)$/i.test(pathname);
+}
+function isCssUrl(url) {
+  const pathname = toUrlPathname(url);
+  return /\.css$/i.test(pathname);
+}
+function isJsonUrl(url) {
+  const pathname = toUrlPathname(url);
+  return /\.json$/i.test(pathname);
+}
+function createCssProxyModuleSource(cssText, sourceUrl) {
+  const styleId = `renderify-css-${(0, import_ir2.hashStringFNV1a32Base36)(sourceUrl)}`;
+  const cssLiteral = JSON.stringify(cssText);
+  const styleIdLiteral = JSON.stringify(styleId);
+  return [
+    "const __css = " + cssLiteral + ";",
+    "const __styleId = " + styleIdLiteral + ";",
+    'if (typeof document !== "undefined") {',
+    "  let __style = null;",
+    '  const __styles = document.querySelectorAll("style[data-renderify-style-id]");',
+    "  for (const __candidate of __styles) {",
+    '    if (__candidate.getAttribute("data-renderify-style-id") === __styleId) {',
+    "      __style = __candidate;",
+    "      break;",
+    "    }",
+    "  }",
+    "  if (!__style) {",
+    '    __style = document.createElement("style");',
+    '    __style.setAttribute("data-renderify-style-id", __styleId);',
+    "    __style.textContent = __css;",
+    "    document.head.appendChild(__style);",
+    "  }",
+    "}",
+    "export default __css;",
+    "export const cssText = __css;"
+  ].join("\n");
+}
+function createJsonProxyModuleSource(value) {
+  return [
+    `const __json = ${JSON.stringify(value)};`,
+    "export default __json;"
+  ].join("\n");
+}
+function createTextProxyModuleSource(text) {
+  return [
+    `const __text = ${JSON.stringify(text)};`,
+    "export default __text;",
+    "export const text = __text;"
+  ].join("\n");
+}
+function createUrlProxyModuleSource(url) {
+  return [
+    `const __assetUrl = ${JSON.stringify(url)};`,
+    "export default __assetUrl;",
+    "export const assetUrl = __assetUrl;"
+  ].join("\n");
+}
+async function fetchWithTimeout(url, timeoutMs) {
+  if (typeof AbortController === "undefined") {
+    return fetch(url);
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
+  try {
+    return await fetch(url, {
+      signal: controller.signal
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function delay(ms) {
+  if (ms <= 0) {
+    return;
+  }
+  await new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+function toUrlPathname(url) {
+  try {
+    return new URL(url).pathname;
+  } catch {
+    return url;
+  }
+}
+
+// src/runtime-environment.ts
+function nowMs() {
+  if (typeof performance !== "undefined" && typeof performance.now === "function") {
+    return performance.now();
+  }
+  return Date.now();
+}
+function isBrowserRuntime() {
+  return typeof window !== "undefined" && typeof document !== "undefined" && typeof navigator !== "undefined";
+}
+function hasVmScript(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.Script === "function";
+}
+function hasPreactFactory(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.h === "function";
+}
+function getVmSpecifier() {
+  return "node:vm";
+}
+function getPreactSpecifier() {
+  return "preact";
+}
+
+// src/runtime-budget.ts
+function hasExceededBudget(frame) {
+  return nowMs() - frame.startedAt > frame.maxExecutionMs;
+}
+function isAborted(signal) {
+  return Boolean(signal?.aborted);
+}
+function createAbortError(message) {
+  const error = new Error(message);
+  error.name = "AbortError";
+  return error;
+}
+function throwIfAborted(signal) {
+  if (isAborted(signal)) {
+    throw createAbortError("Runtime execution aborted");
+  }
+}
+function isAbortError(error) {
+  return error instanceof Error && error.name === "AbortError";
+}
+async function withRemainingBudget(operation, frame, timeoutMessage) {
+  throwIfAborted(frame.signal);
+  const remainingMs = frame.maxExecutionMs - (nowMs() - frame.startedAt);
+  if (remainingMs <= 0) {
+    throw new Error(timeoutMessage);
+  }
+  let timer;
+  let onAbort;
+  const timeoutPromise = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error(timeoutMessage));
+    }, remainingMs);
+  });
+  const signal = frame.signal;
+  const abortPromise = signal && new Promise((_resolve, reject) => {
+    onAbort = () => {
+      reject(createAbortError("Runtime execution aborted"));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    const pending = abortPromise ? [operation(), timeoutPromise, abortPromise] : [operation(), timeoutPromise];
+    return await Promise.race(pending);
+  } finally {
+    if (timer !== void 0) {
+      clearTimeout(timer);
+    }
+    if (signal && onAbort) {
+      signal.removeEventListener("abort", onAbort);
+    }
+  }
+}
+
+// src/runtime-component-runtime.ts
+var import_ir3 = require("@renderify/ir");
+async function createPreactRenderArtifact(input) {
+  const preact = await loadPreactModule();
+  if (!preact) {
+    input.diagnostics.push({
+      level: "error",
+      code: "RUNTIME_PREACT_UNAVAILABLE",
+      message: "source.runtime=preact requested but preact runtime is unavailable"
+    });
+    return void 0;
+  }
+  if (isPreactLikeVNode(input.sourceExport)) {
+    return {
+      mode: "preact-vnode",
+      payload: input.sourceExport
+    };
+  }
+  if (typeof input.sourceExport !== "function") {
+    input.diagnostics.push({
+      level: "error",
+      code: "RUNTIME_PREACT_EXPORT_INVALID",
+      message: "source.runtime=preact requires a component export function"
+    });
+    return void 0;
+  }
+  try {
+    const vnode = preact.h(
+      input.sourceExport,
+      input.runtimeInput
+    );
+    return {
+      mode: "preact-vnode",
+      payload: vnode
+    };
+  } catch (error) {
+    input.diagnostics.push({
+      level: "error",
+      code: "RUNTIME_PREACT_VNODE_FAILED",
+      message: errorToMessage(error)
+    });
+    return void 0;
+  }
+}
+async function executeComponentFactory(input) {
+  if (input.executionProfile !== "isolated-vm") {
+    return input.withRemainingBudget(
+      async () => input.componentFactory(input.props, input.context, input.children),
+      input.timeoutMessage
+    );
+  }
+  const isolated = await executeComponentInVm(input);
+  if (isolated.mode === "isolation-unavailable") {
+    if (!input.allowIsolationFallback) {
+      throw new Error(
+        "isolated-vm profile requested but node:vm is unavailable; fallback is disabled"
+      );
+    }
+    input.diagnostics.push({
+      level: "warning",
+      code: "RUNTIME_SANDBOX_UNAVAILABLE",
+      message: "isolated-vm profile requested but node:vm is unavailable; falling back to standard execution"
+    });
+    return input.withRemainingBudget(
+      async () => input.componentFactory(input.props, input.context, input.children),
+      input.timeoutMessage
+    );
+  }
+  return isolated.value;
+}
+async function executeComponentInVm(input) {
+  const vmModule = await loadVmModule();
+  if (!vmModule) {
+    return { mode: "isolation-unavailable" };
+  }
+  const remainingMs = input.maxExecutionMs - (nowMs() - input.startedAt);
+  if (remainingMs <= 0) {
+    throw new Error("Component execution timed out before sandbox start");
+  }
+  const serializedFactory = input.componentFactory.toString();
+  const sandboxData = {
+    props: (0, import_ir3.cloneJsonValue)(input.props),
+    context: (0, import_ir3.cloneJsonValue)((0, import_ir3.asJsonValue)(input.context)),
+    children: (0, import_ir3.cloneJsonValue)((0, import_ir3.asJsonValue)(input.children))
+  };
+  const script = new vmModule.Script(
+    `'use strict';
+const __component = (${serializedFactory});
+const __result = __component(__input.props, __input.context, __input.children);
+if (__result && typeof __result.then === "function") {
+  throw new Error("Async component is not supported in isolated-vm profile");
+}
+__result;`
+  );
+  const output = script.runInNewContext(
+    {
+      __input: sandboxData
+    },
+    {
+      timeout: Math.max(1, Math.floor(remainingMs))
+    }
+  );
+  if (typeof output === "string") {
+    return {
+      mode: "isolated",
+      value: output
+    };
+  }
+  if ((0, import_ir3.isRuntimeNode)(output)) {
+    return {
+      mode: "isolated",
+      value: output
+    };
+  }
+  throw new Error("Sandboxed component returned unsupported output");
+}
+function isPreactLikeVNode(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  return "type" in record && "props" in record;
+}
+async function loadPreactModule() {
+  try {
+    const maybePreact = await import(getPreactSpecifier());
+    if (!hasPreactFactory(maybePreact)) {
+      return void 0;
+    }
+    return maybePreact;
+  } catch {
+    return void 0;
+  }
+}
+async function loadVmModule() {
+  if (typeof process === "undefined" || typeof process.versions !== "object" || process.versions === null || typeof process.versions.node !== "string") {
+    return void 0;
+  }
+  try {
+    const maybeVm = await import(getVmSpecifier());
+    if (!hasVmScript(maybeVm)) {
+      return void 0;
+    }
+    return maybeVm;
+  } catch {
+    return void 0;
+  }
+}
+function errorToMessage(error) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
+}
+
+// src/runtime-defaults.ts
+var import_ir4 = require("@renderify/ir");
+var FALLBACK_MAX_IMPORTS = 50;
+var FALLBACK_MAX_COMPONENT_INVOCATIONS = 200;
+var FALLBACK_MAX_EXECUTION_MS = 1500;
+var FALLBACK_EXECUTION_PROFILE = "standard";
+var FALLBACK_JSPM_CDN_BASE = "https://ga.jspm.io/npm";
+var FALLBACK_ESM_CDN_BASE = DEFAULT_ESM_CDN_BASE;
+var FALLBACK_ENABLE_DEPENDENCY_PREFLIGHT = true;
+var FALLBACK_FAIL_ON_DEPENDENCY_PREFLIGHT_ERROR = false;
+var FALLBACK_REMOTE_FETCH_TIMEOUT_MS = 12e3;
+var FALLBACK_REMOTE_FETCH_RETRIES = 2;
+var FALLBACK_REMOTE_FETCH_BACKOFF_MS = 150;
+var FALLBACK_REMOTE_FALLBACK_CDN_BASES = [FALLBACK_ESM_CDN_BASE];
+var FALLBACK_SUPPORTED_SPEC_VERSIONS = [
+  import_ir4.DEFAULT_RUNTIME_PLAN_SPEC_VERSION
+];
+var FALLBACK_ENFORCE_MODULE_MANIFEST = true;
+var FALLBACK_ALLOW_ISOLATION_FALLBACK = false;
+var FALLBACK_BROWSER_SOURCE_SANDBOX_TIMEOUT_MS = 4e3;
+var FALLBACK_BROWSER_SOURCE_SANDBOX_FAIL_CLOSED = true;
+function normalizeSupportedSpecVersions(versions) {
+  const normalized = /* @__PURE__ */ new Set();
+  const input = versions && versions.length > 0 ? versions : FALLBACK_SUPPORTED_SPEC_VERSIONS;
+  for (const entry of input) {
+    if (typeof entry !== "string") {
+      continue;
+    }
+    const trimmed = entry.trim();
+    if (trimmed.length > 0) {
+      normalized.add(trimmed);
+    }
+  }
+  if (normalized.size === 0) {
+    normalized.add(import_ir4.DEFAULT_RUNTIME_PLAN_SPEC_VERSION);
+  }
+  return normalized;
+}
+function normalizeSourceSandboxMode(mode) {
+  if (mode === "none" || mode === "worker" || mode === "iframe") {
+    return mode;
+  }
+  return isBrowserRuntime() ? "worker" : "none";
+}
+function normalizeFallbackCdnBases(input) {
+  const explicitInput = input !== void 0;
+  const candidates = explicitInput ? input : FALLBACK_REMOTE_FALLBACK_CDN_BASES;
+  const normalized = /* @__PURE__ */ new Set();
+  for (const entry of candidates) {
+    if (typeof entry !== "string") {
+      continue;
+    }
+    const trimmed = entry.trim().replace(/\/$/, "");
+    if (trimmed.length > 0) {
+      normalized.add(trimmed);
+    }
+  }
+  if (normalized.size === 0) {
+    return explicitInput ? [] : [FALLBACK_ESM_CDN_BASE];
+  }
+  return [...normalized];
+}
+function normalizePositiveInteger(value, fallback) {
+  if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value <= 0) {
+    return fallback;
+  }
+  return value;
+}
+function normalizeNonNegativeInteger(value, fallback) {
+  if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
+    return fallback;
+  }
+  return value;
+}
+
+// src/runtime-node-resolver.ts
+var import_ir6 = require("@renderify/ir");
+
+// src/template.ts
+var import_ir5 = require("@renderify/ir");
+var TEMPLATE_STRINGIFY_MAX_DEPTH = 8;
+var TEMPLATE_STRINGIFY_MAX_NODES = 256;
+var TEMPLATE_STRINGIFY_MAX_LENGTH = 4096;
+var TEMPLATE_TRUNCATED_MARKER = "[Truncated]";
+var TEMPLATE_CIRCULAR = /* @__PURE__ */ Symbol("renderify-template-circular");
+function resolveProps(props, context, state, event) {
+  if (!props) {
+    return void 0;
+  }
+  const resolved = {};
+  for (const [key, value] of Object.entries(props)) {
+    resolved[key] = resolveJsonValue(value, context, state, event);
+  }
+  return resolved;
+}
+function resolveJsonValue(value, context, state, event) {
+  return resolveJsonValueInternal(value, context, state, event, /* @__PURE__ */ new WeakSet());
+}
+function resolveJsonValueInternal(value, context, state, event, seen) {
+  if (typeof value === "string") {
+    return interpolateTemplate(value, context, state, event);
+  }
+  if (Array.isArray(value)) {
+    if (seen.has(value)) {
+      return null;
+    }
+    seen.add(value);
+    const resolved = value.map(
+      (item) => resolveJsonValueInternal(item, context, state, event, seen)
+    );
+    seen.delete(value);
+    return resolved;
+  }
+  if (value !== null && typeof value === "object") {
+    if (seen.has(value)) {
+      return null;
+    }
+    seen.add(value);
+    const resolved = {};
+    for (const [key, item] of Object.entries(value)) {
+      resolved[key] = resolveJsonValueInternal(
+        item,
+        context,
+        state,
+        event,
+        seen
+      );
+    }
+    seen.delete(value);
+    return resolved;
+  }
+  return value;
+}
+function interpolateTemplate(template, context, state, event) {
+  return template.replace(/{{\s*([^}]+)\s*}}/g, (_match, expression) => {
+    const resolved = resolveExpression(expression, context, state, event);
+    if (resolved === void 0 || resolved === null) {
+      return "";
+    }
+    if (typeof resolved === "object") {
+      return serializeTemplateObject(resolved);
+    }
+    return String(resolved);
+  });
+}
+function serializeTemplateObject(value) {
+  const normalized = toTemplateSerializable(value, 0, /* @__PURE__ */ new WeakSet(), {
+    nodes: 0
+  });
+  if (normalized === TEMPLATE_CIRCULAR || normalized === void 0) {
+    return "";
+  }
+  try {
+    const serialized = JSON.stringify(normalized);
+    if (typeof serialized !== "string") {
+      return "";
+    }
+    if (serialized.length > TEMPLATE_STRINGIFY_MAX_LENGTH) {
+      return `${serialized.slice(0, TEMPLATE_STRINGIFY_MAX_LENGTH)}...`;
+    }
+    return serialized;
+  } catch {
+    return "";
+  }
+}
+function toTemplateSerializable(value, depth, seen, budget) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return value;
+  }
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? value : null;
+  }
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  if (typeof value === "function" || typeof value === "symbol") {
+    return String(value);
+  }
+  if (typeof value !== "object") {
+    return String(value);
+  }
+  if (seen.has(value)) {
+    return TEMPLATE_CIRCULAR;
+  }
+  if (depth >= TEMPLATE_STRINGIFY_MAX_DEPTH || budget.nodes >= TEMPLATE_STRINGIFY_MAX_NODES) {
+    return TEMPLATE_TRUNCATED_MARKER;
+  }
+  seen.add(value);
+  budget.nodes += 1;
+  if (Array.isArray(value)) {
+    const normalizedArray = [];
+    for (const entry of value) {
+      const normalized = toTemplateSerializable(entry, depth + 1, seen, budget);
+      if (normalized === TEMPLATE_CIRCULAR) {
+        seen.delete(value);
+        return TEMPLATE_CIRCULAR;
+      }
+      normalizedArray.push(normalized === void 0 ? null : normalized);
+    }
+    seen.delete(value);
+    return normalizedArray;
+  }
+  const normalizedRecord = {};
+  for (const [key, entry] of Object.entries(value)) {
+    const normalized = toTemplateSerializable(entry, depth + 1, seen, budget);
+    if (normalized === TEMPLATE_CIRCULAR) {
+      seen.delete(value);
+      return TEMPLATE_CIRCULAR;
+    }
+    if (normalized !== void 0) {
+      normalizedRecord[key] = normalized;
+    }
+  }
+  seen.delete(value);
+  return normalizedRecord;
+}
+function resolveExpression(expression, context, state, event) {
+  const path = expression.trim();
+  if (path.startsWith("state.")) {
+    return (0, import_ir5.getValueByPath)(state, path.slice(6));
+  }
+  if (path.startsWith("event.")) {
+    return (0, import_ir5.getValueByPath)(event, path.slice(6));
+  }
+  if (path.startsWith("context.")) {
+    return (0, import_ir5.getValueByPath)(context, path.slice(8));
+  }
+  if (path.startsWith("vars.")) {
+    return (0, import_ir5.getValueByPath)(context.variables, path.slice(5));
+  }
+  return (0, import_ir5.getValueByPath)(state, path);
+}
+
+// src/runtime-node-resolver.ts
+async function resolveRuntimeNode(input) {
+  const {
+    node,
+    moduleManifest,
+    context,
+    state,
+    event,
+    diagnostics,
+    frame,
+    resolver
+  } = input;
+  if (node.type === "text") {
+    return (0, import_ir6.createTextNode)(
+      interpolateTemplate(node.value, context, state, event)
+    );
+  }
+  const resolvedChildren = await resolveChildren(
+    node.children ?? [],
+    resolver.resolveNode
+  );
+  if (node.type === "element") {
+    return {
+      ...node,
+      props: resolveProps(node.props, context, state, event),
+      children: resolvedChildren
+    };
+  }
+  if (frame.componentInvocations >= frame.maxComponentInvocations) {
+    diagnostics.push({
+      level: "error",
+      code: "RUNTIME_COMPONENT_LIMIT_EXCEEDED",
+      message: `Component invocation limit exceeded: ${frame.maxComponentInvocations}`
+    });
+    return (0, import_ir6.createElementNode)(
+      "div",
+      { "data-renderify-component-limit": node.module },
+      [(0, import_ir6.createTextNode)("Component invocation limit exceeded")]
+    );
+  }
+  frame.componentInvocations += 1;
+  const resolvedComponentSpecifier = resolver.resolveRuntimeSpecifier(
+    node.module,
+    moduleManifest,
+    diagnostics,
+    "component"
+  );
+  if (!resolvedComponentSpecifier) {
+    return (0, import_ir6.createElementNode)(
+      "div",
+      { "data-renderify-component-error": node.module },
+      [(0, import_ir6.createTextNode)("Missing module manifest entry for component")]
+    );
+  }
+  if (!resolver.moduleLoader) {
+    diagnostics.push({
+      level: "warning",
+      code: "RUNTIME_COMPONENT_SKIPPED",
+      message: `Component ${resolvedComponentSpecifier} skipped because module loader is missing`
+    });
+    return (0, import_ir6.createElementNode)(
+      "div",
+      { "data-renderify-missing-module": node.module },
+      resolvedChildren
+    );
+  }
+  try {
+    const loaded = await resolver.withRemainingBudget(
+      () => resolver.moduleLoader.load(resolvedComponentSpecifier),
+      `Component module timed out: ${resolvedComponentSpecifier}`
+    );
+    const exportName = node.exportName ?? "default";
+    const target = selectExportFromNamespace(loaded, exportName);
+    if (typeof target !== "function") {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_COMPONENT_INVALID",
+        message: `Export ${exportName} from ${resolvedComponentSpecifier} is not callable`
+      });
+      return (0, import_ir6.createElementNode)(
+        "div",
+        { "data-renderify-component-error": `${node.module}:${exportName}` },
+        [(0, import_ir6.createTextNode)("Component export is not callable")]
+      );
+    }
+    const runtimeContext = {
+      ...context,
+      variables: {
+        ...context.variables ?? {},
+        state,
+        event: event ? (0, import_ir6.asJsonValue)(event) : null
+      }
+    };
+    const produced = await executeComponentFactory({
+      componentFactory: target,
+      props: resolveProps(node.props, context, state, event) ?? {},
+      context: runtimeContext,
+      children: resolvedChildren,
+      executionProfile: frame.executionProfile,
+      maxExecutionMs: frame.maxExecutionMs,
+      startedAt: frame.startedAt,
+      timeoutMessage: `Component execution timed out: ${node.module}`,
+      allowIsolationFallback: resolver.allowIsolationFallback,
+      diagnostics,
+      withRemainingBudget: resolver.withRemainingBudget
+    });
+    if (typeof produced === "string") {
+      return (0, import_ir6.createTextNode)(
+        interpolateTemplate(produced, context, state, event)
+      );
+    }
+    if ((0, import_ir6.isRuntimeNode)(produced)) {
+      return resolver.resolveNode(produced);
+    }
+    diagnostics.push({
+      level: "error",
+      code: "RUNTIME_COMPONENT_OUTPUT_INVALID",
+      message: `Component ${resolvedComponentSpecifier} produced unsupported output`
+    });
+    return (0, import_ir6.createElementNode)(
+      "div",
+      { "data-renderify-component-error": node.module },
+      [(0, import_ir6.createTextNode)("Unsupported component output")]
+    );
+  } catch (error) {
+    diagnostics.push({
+      level: "error",
+      code: "RUNTIME_COMPONENT_EXEC_FAILED",
+      message: `${resolvedComponentSpecifier}: ${resolver.errorToMessage(error)}`
+    });
+    return (0, import_ir6.createElementNode)(
+      "div",
+      { "data-renderify-component-error": node.module },
+      [(0, import_ir6.createTextNode)("Component execution failed")]
+    );
+  }
+}
+async function resolveChildren(nodes, resolveNode) {
+  const resolved = [];
+  for (const child of nodes) {
+    resolved.push(await resolveNode(child));
+  }
+  return resolved;
+}
+function selectExportFromNamespace(moduleNamespace, exportName) {
+  if (typeof moduleNamespace !== "object" || moduleNamespace === null) {
+    return void 0;
+  }
+  const record = moduleNamespace;
+  return record[exportName];
+}
+
+// src/runtime-plan-imports.ts
+async function resolveRuntimePlanImports(input) {
+  const { imports, maxImports, moduleManifest, diagnostics } = input;
+  for (let i = 0; i < imports.length; i += 1) {
+    if (input.isAborted()) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_ABORTED",
+        message: "Execution aborted before import resolution"
+      });
+      break;
+    }
+    const specifier = imports[i];
+    const resolvedSpecifier = input.resolveRuntimeSpecifier(
+      specifier,
+      moduleManifest,
+      diagnostics
+    );
+    if (!resolvedSpecifier) {
+      continue;
+    }
+    if (i >= maxImports) {
+      diagnostics.push({
+        level: "warning",
+        code: "RUNTIME_IMPORT_LIMIT_EXCEEDED",
+        message: `Import skipped because maxImports=${maxImports}: ${specifier}`
+      });
+      continue;
+    }
+    if (!input.moduleLoader) {
+      diagnostics.push({
+        level: "warning",
+        code: "RUNTIME_LOADER_MISSING",
+        message: `Import skipped because no module loader is configured: ${resolvedSpecifier}`
+      });
+      continue;
+    }
+    if (input.hasExceededBudget()) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_TIMEOUT",
+        message: `Execution time budget exceeded before importing: ${specifier}`
+      });
+      break;
+    }
+    try {
+      await input.withRemainingBudget(
+        () => input.moduleLoader.load(resolvedSpecifier),
+        `Import timed out: ${resolvedSpecifier}`
+      );
+    } catch (error) {
+      if (input.isAbortError(error)) {
+        diagnostics.push({
+          level: "error",
+          code: "RUNTIME_ABORTED",
+          message: `Execution aborted during import: ${resolvedSpecifier}`
+        });
+        break;
+      }
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_IMPORT_FAILED",
+        message: `${resolvedSpecifier}: ${input.errorToMessage(error)}`
+      });
+    }
+  }
+}
+
+// src/runtime-preflight.ts
+var import_ir7 = require("@renderify/ir");
+async function collectDependencyProbes(plan, parseSourceImportSpecifiers2) {
+  const probes = [];
+  const seen = /* @__PURE__ */ new Set();
+  const pushProbe = (usage, specifier) => {
+    const trimmed = specifier.trim();
+    if (trimmed.length === 0) {
+      return;
+    }
+    const key = `${usage}:${trimmed}`;
+    if (seen.has(key)) {
+      return;
+    }
+    seen.add(key);
+    probes.push({
+      usage,
+      specifier: trimmed
+    });
+  };
+  for (const specifier of plan.imports ?? []) {
+    pushProbe("import", specifier);
+  }
+  for (const specifier of (0, import_ir7.collectComponentModules)(plan.root)) {
+    pushProbe("component", specifier);
+  }
+  if (plan.source) {
+    const sourceImports = await parseSourceImportSpecifiers2(plan.source.code);
+    for (const specifier of sourceImports) {
+      pushProbe("source-import", specifier);
+    }
+  }
+  return probes;
+}
+async function runDependencyPreflight(probes, diagnostics, probeExecutor, options) {
+  const statuses = [];
+  for (const probe of probes) {
+    if (options.isAborted()) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_ABORTED",
+        message: `Execution aborted during dependency preflight (${probe.usage}:${probe.specifier})`
+      });
+      statuses.push({
+        usage: probe.usage,
+        specifier: probe.specifier,
+        ok: false,
+        message: "Dependency preflight aborted"
+      });
+      return statuses;
+    }
+    if (options.hasExceededBudget()) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_TIMEOUT",
+        message: `Execution time budget exceeded during dependency preflight (${probe.usage}:${probe.specifier})`
+      });
+      statuses.push({
+        usage: probe.usage,
+        specifier: probe.specifier,
+        ok: false,
+        message: "Dependency preflight timed out"
+      });
+      return statuses;
+    }
+    statuses.push(await probeExecutor(probe));
+  }
+  return statuses;
+}
+async function executeDependencyProbe(probe, moduleManifest, diagnostics, executor) {
+  if (probe.usage === "source-import") {
+    const resolved2 = executor.resolveRuntimeSourceSpecifier(
+      probe.specifier,
+      moduleManifest,
+      diagnostics,
+      false
+    );
+    if (resolved2.startsWith("./") || resolved2.startsWith("../") || resolved2.startsWith("/")) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_PREFLIGHT_SOURCE_IMPORT_RELATIVE_UNRESOLVED",
+        message: `Runtime source entry import must resolve to URL or bare package alias: ${probe.specifier}`
+      });
+      return {
+        usage: probe.usage,
+        specifier: probe.specifier,
+        resolvedSpecifier: resolved2,
+        ok: false,
+        message: "Relative source import could not be resolved"
+      };
+    }
+    const timeoutMessage = `Dependency preflight timed out: ${probe.specifier}`;
+    const loaderCandidate = executor.resolveSourceImportLoaderCandidate(
+      probe.specifier,
+      moduleManifest
+    );
+    try {
+      if (executor.moduleLoader && loaderCandidate) {
+        await executor.withRemainingBudget(
+          () => executor.moduleLoader.load(loaderCandidate),
+          timeoutMessage
+        );
+        return {
+          usage: probe.usage,
+          specifier: probe.specifier,
+          resolvedSpecifier: loaderCandidate,
+          ok: true
+        };
+      }
+      if (executor.isHttpUrl(resolved2)) {
+        await executor.withRemainingBudget(async () => {
+          if (executor.canMaterializeBrowserModules()) {
+            await executor.materializeBrowserRemoteModule(
+              resolved2,
+              moduleManifest,
+              diagnostics
+            );
+          } else {
+            await executor.fetchRemoteModuleCodeWithFallback(
+              resolved2,
+              diagnostics
+            );
+          }
+        }, timeoutMessage);
+        return {
+          usage: probe.usage,
+          specifier: probe.specifier,
+          resolvedSpecifier: resolved2,
+          ok: true
+        };
+      }
+      if (!executor.moduleLoader) {
+        diagnostics.push({
+          level: "warning",
+          code: "RUNTIME_PREFLIGHT_SKIPPED",
+          message: `Dependency preflight skipped (no module loader): ${probe.usage}:${resolved2}`
+        });
+        return {
+          usage: probe.usage,
+          specifier: probe.specifier,
+          resolvedSpecifier: resolved2,
+          ok: false,
+          message: "Dependency preflight skipped because source import is not loadable without module loader"
+        };
+      }
+      await executor.withRemainingBudget(
+        () => executor.moduleLoader.load(resolved2),
+        timeoutMessage
+      );
+      return {
+        usage: probe.usage,
+        specifier: probe.specifier,
+        resolvedSpecifier: resolved2,
+        ok: true
+      };
+    } catch (error) {
+      if (executor.isAbortError(error)) {
+        diagnostics.push({
+          level: "error",
+          code: "RUNTIME_ABORTED",
+          message: `${probe.specifier}: dependency preflight aborted`
+        });
+        return {
+          usage: probe.usage,
+          specifier: probe.specifier,
+          resolvedSpecifier: resolved2,
+          ok: false,
+          message: "Dependency preflight aborted"
+        };
+      }
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_PREFLIGHT_SOURCE_IMPORT_FAILED",
+        message: `${probe.specifier}: ${executor.errorToMessage(error)}`
+      });
+      return {
+        usage: probe.usage,
+        specifier: probe.specifier,
+        resolvedSpecifier: resolved2,
+        ok: false,
+        message: executor.errorToMessage(error)
+      };
+    }
+  }
+  const resolved = executor.resolveRuntimeSpecifier(
+    probe.specifier,
+    moduleManifest,
+    diagnostics,
+    probe.usage
+  );
+  if (!resolved) {
+    return {
+      usage: probe.usage,
+      specifier: probe.specifier,
+      ok: false,
+      message: "Module manifest resolution failed"
+    };
+  }
+  if (!executor.moduleLoader) {
+    diagnostics.push({
+      level: "warning",
+      code: "RUNTIME_PREFLIGHT_SKIPPED",
+      message: `Dependency preflight skipped (no module loader): ${probe.usage}:${resolved}`
+    });
+    return {
+      usage: probe.usage,
+      specifier: probe.specifier,
+      resolvedSpecifier: resolved,
+      ok: false,
+      message: "Dependency preflight skipped because module loader is missing"
+    };
+  }
+  try {
+    await executor.withRemainingBudget(
+      () => executor.moduleLoader.load(resolved),
+      `Dependency preflight timed out: ${resolved}`
+    );
+    return {
+      usage: probe.usage,
+      specifier: probe.specifier,
+      resolvedSpecifier: resolved,
+      ok: true
+    };
+  } catch (error) {
+    if (executor.isAbortError(error)) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_ABORTED",
+        message: `${resolved}: dependency preflight aborted`
+      });
+      return {
+        usage: probe.usage,
+        specifier: probe.specifier,
+        resolvedSpecifier: resolved,
+        ok: false,
+        message: "Dependency preflight aborted"
+      };
+    }
+    diagnostics.push({
+      level: "error",
+      code: probe.usage === "component" ? "RUNTIME_PREFLIGHT_COMPONENT_FAILED" : "RUNTIME_PREFLIGHT_IMPORT_FAILED",
+      message: `${resolved}: ${executor.errorToMessage(error)}`
+    });
+    return {
+      usage: probe.usage,
+      specifier: probe.specifier,
+      resolvedSpecifier: resolved,
+      ok: false,
+      message: executor.errorToMessage(error)
+    };
+  }
+}
+
+// src/runtime-source-utils.ts
+var import_ir8 = require("@renderify/ir");
+function canMaterializeBrowserModules() {
+  return typeof URL !== "undefined" && typeof URL.createObjectURL === "function" && typeof Blob !== "undefined" && typeof fetch === "function";
+}
+async function rewriteImportsAsync(code, resolver) {
+  const imports = await parseImportSpecifiersFromSource(code);
+  if (imports.length === 0) {
+    return code;
+  }
+  let rewritten = "";
+  let cursor = 0;
+  for (const item of imports) {
+    rewritten += code.slice(cursor, item.start);
+    rewritten += await resolver(item.specifier);
+    cursor = item.end;
+  }
+  rewritten += code.slice(cursor);
+  return rewritten;
+}
+async function parseImportSpecifiersFromSource(source) {
+  return (0, import_ir8.parseRuntimeSourceImportRanges)(source);
+}
+function createBrowserBlobModuleUrl(code, browserBlobUrls) {
+  const blobUrl = URL.createObjectURL(
+    new Blob([code], { type: "text/javascript" })
+  );
+  browserBlobUrls.add(blobUrl);
+  return blobUrl;
+}
+function revokeBrowserBlobUrls(browserBlobUrls) {
+  if (typeof URL === "undefined" || typeof URL.revokeObjectURL !== "function") {
+    browserBlobUrls.clear();
+    return;
+  }
+  for (const blobUrl of browserBlobUrls) {
+    URL.revokeObjectURL(blobUrl);
+  }
+  browserBlobUrls.clear();
+}
+function normalizeRuntimeSourceOutput(output) {
+  if ((0, import_ir8.isRuntimeNode)(output)) {
+    return output;
+  }
+  if (typeof output === "string" || typeof output === "number") {
+    return (0, import_ir8.createTextNode)(String(output));
+  }
+  if (Array.isArray(output)) {
+    const normalizedChildren = output.map((entry) => normalizeRuntimeSourceOutput(entry)).filter((entry) => entry !== void 0);
+    return (0, import_ir8.createElementNode)(
+      "div",
+      { "data-renderify-fragment": "true" },
+      normalizedChildren
+    );
+  }
+  return void 0;
+}
+
+// src/runtime-specifier.ts
+function resolveRuntimeSourceSpecifier(input) {
+  const trimmed = input.specifier.trim();
+  const manifestResolved = resolveOptionalManifestSpecifier(
+    trimmed,
+    input.moduleManifest
+  );
+  if (manifestResolved && manifestResolved !== trimmed) {
+    return resolveSourceSpecifierWithLoader(
+      manifestResolved,
+      input.moduleLoader
+    );
+  }
+  if (!shouldRewriteSpecifier(trimmed)) {
+    return manifestResolved ?? trimmed;
+  }
+  const resolvedFromPolicy = input.requireManifest !== false ? resolveRuntimeSpecifier({
+    specifier: trimmed,
+    moduleManifest: input.moduleManifest,
+    diagnostics: input.diagnostics,
+    usage: "source-import",
+    enforceModuleManifest: input.enforceModuleManifest
+  }) : manifestResolved;
+  if (!resolvedFromPolicy) {
+    return trimmed;
+  }
+  const loaderResolved = resolveSourceSpecifierWithLoader(
+    resolvedFromPolicy,
+    input.moduleLoader
+  );
+  if (loaderResolved !== resolvedFromPolicy) {
+    return loaderResolved;
+  }
+  const jspmBase = (input.jspmCdnBase ?? FALLBACK_JSPM_CDN_BASE).replace(
+    /\/$/,
+    ""
+  );
+  if (resolvedFromPolicy.startsWith("npm:")) {
+    return `${jspmBase}/${resolvedFromPolicy.slice(4)}`;
+  }
+  if (isDirectSpecifier(resolvedFromPolicy)) {
+    return resolvedFromPolicy;
+  }
+  if (isBareSpecifier(resolvedFromPolicy)) {
+    return `${jspmBase}/npm:${resolvedFromPolicy}`;
+  }
+  return `${jspmBase}/${resolvedFromPolicy}`;
+}
+function resolveRuntimeSpecifier(input) {
+  const trimmed = input.specifier.trim();
+  if (trimmed.length === 0) {
+    input.diagnostics.push({
+      level: "error",
+      code: "RUNTIME_MANIFEST_INVALID",
+      message: `Empty ${input.usage} specifier`
+    });
+    return void 0;
+  }
+  const descriptor = input.moduleManifest?.[trimmed];
+  if (descriptor) {
+    const resolved = descriptor.resolvedUrl.trim();
+    if (resolved.length === 0) {
+      input.diagnostics.push({
+        level: "error",
+        code: "RUNTIME_MANIFEST_INVALID",
+        message: `Manifest entry has empty resolvedUrl for ${trimmed}`
+      });
+      return void 0;
+    }
+    return resolved;
+  }
+  if (!input.enforceModuleManifest || isDirectSpecifier(trimmed)) {
+    return trimmed;
+  }
+  input.diagnostics.push({
+    level: "error",
+    code: "RUNTIME_MANIFEST_MISSING",
+    message: `Missing moduleManifest entry for ${input.usage}: ${trimmed}`
+  });
+  return void 0;
+}
+function resolveSourceImportLoaderCandidate(specifier, moduleManifest, moduleLoader) {
+  const manifestResolved = resolveOptionalManifestSpecifier(
+    specifier,
+    moduleManifest
+  );
+  const candidate = (manifestResolved ?? specifier).trim();
+  if (candidate.length === 0) {
+    return void 0;
+  }
+  if (candidate.startsWith("./") || candidate.startsWith("../") || candidate.startsWith("/")) {
+    return void 0;
+  }
+  return resolveSourceSpecifierWithLoader(candidate, moduleLoader);
+}
+function resolveOptionalManifestSpecifier(specifier, moduleManifest) {
+  const descriptor = moduleManifest?.[specifier];
+  if (!descriptor) {
+    return specifier;
+  }
+  const resolved = descriptor.resolvedUrl.trim();
+  if (resolved.length === 0) {
+    return void 0;
+  }
+  return resolved;
+}
+function resolveSourceSpecifierWithLoader(specifier, loader) {
+  if (loader && hasResolveSpecifier(loader)) {
+    try {
+      return loader.resolveSpecifier(specifier);
+    } catch {
+      return specifier;
+    }
+  }
+  return specifier;
+}
+function shouldRewriteSpecifier(specifier) {
+  return !isDirectSpecifier(specifier);
+}
+function isDirectSpecifier(specifier) {
+  return specifier.startsWith("./") || specifier.startsWith("../") || specifier.startsWith("/") || specifier.startsWith("http://") || specifier.startsWith("https://") || specifier.startsWith("blob:") || specifier.startsWith("data:");
+}
+function isHttpUrl(specifier) {
+  return specifier.startsWith("http://") || specifier.startsWith("https://");
+}
+function isBareSpecifier(specifier) {
+  return !isDirectSpecifier(specifier) && !specifier.startsWith("npm:");
+}
+function hasResolveSpecifier(loader) {
+  if (typeof loader !== "object" || loader === null) {
+    return false;
+  }
+  return "resolveSpecifier" in loader && typeof loader.resolveSpecifier === "function";
+}
+
+// src/runtime-plan-preflight.ts
+async function preflightRuntimePlanDependencies(input) {
+  const probes = await collectDependencyProbes(
+    input.plan,
+    parseSourceImportSpecifiers
+  );
+  return runDependencyPreflight(
+    probes,
+    input.diagnostics,
+    (probe) => executeDependencyProbe(
+      probe,
+      input.plan.moduleManifest,
+      input.diagnostics,
+      {
+        moduleLoader: input.moduleLoader,
+        withRemainingBudget: (operation, timeoutMessage) => input.withRemainingBudget(operation, timeoutMessage),
+        resolveRuntimeSourceSpecifier: (specifier, manifest, diagnostics, requireManifest) => input.resolveRuntimeSourceSpecifier(
+          specifier,
+          manifest,
+          diagnostics,
+          requireManifest
+        ),
+        resolveSourceImportLoaderCandidate: (specifier, manifest) => input.resolveSourceImportLoaderCandidate(specifier, manifest),
+        resolveRuntimeSpecifier: (specifier, manifest, diagnostics, usage) => input.resolveRuntimeSpecifier(
+          specifier,
+          manifest,
+          diagnostics,
+          usage
+        ),
+        isHttpUrl,
+        canMaterializeBrowserModules: () => canMaterializeBrowserModules(),
+        materializeBrowserRemoteModule: (url, manifest, diagnostics) => input.materializeBrowserRemoteModule(url, manifest, diagnostics),
+        fetchRemoteModuleCodeWithFallback: (url, diagnostics) => input.fetchRemoteModuleCodeWithFallback(url, diagnostics),
+        isAbortError: (error) => input.isAbortError(error),
+        errorToMessage: (error) => input.errorToMessage(error)
+      }
+    ),
+    {
+      isAborted: () => input.isAborted(),
+      hasExceededBudget: () => input.hasExceededBudget()
+    }
+  );
+}
+async function parseSourceImportSpecifiers(code) {
+  if (code.trim().length === 0) {
+    return [];
+  }
+  const imports = /* @__PURE__ */ new Set();
+  const parsedSpecifiers = await parseImportSpecifiersFromSource(code);
+  for (const entry of parsedSpecifiers) {
+    imports.add(entry.specifier);
+  }
+  return [...imports];
+}
+
+// src/sandbox.ts
+async function executeSourceInBrowserSandbox(options) {
+  throwIfAborted2(options.signal);
+  if (options.mode === "worker") {
+    return executeSourceInWorkerSandbox(options);
+  }
+  if (options.mode === "iframe") {
+    return executeSourceInIframeSandbox(options);
+  }
+  throw new Error(`Unsupported runtime source sandbox mode: ${options.mode}`);
+}
+async function executeSourceInWorkerSandbox(options) {
+  if (typeof Worker === "undefined" || typeof Blob === "undefined" || typeof URL === "undefined" || typeof URL.createObjectURL !== "function" || typeof URL.revokeObjectURL !== "function") {
+    throw new Error("Worker sandbox is unavailable in this runtime");
+  }
+  const workerSource = [
+    "const CHANNEL = 'runtime-source';",
+    "self.onmessage = async (event) => {",
+    "  const request = event.data;",
+    "  if (!request || request.renderifySandbox !== CHANNEL) {",
+    "    return;",
+    "  }",
+    "  const safeSend = (payload) => {",
+    "    try {",
+    "      self.postMessage({ renderifySandbox: CHANNEL, id: request.id, ...payload });",
+    "      return true;",
+    "    } catch (postError) {",
+    "      try {",
+    "        const postMessageError = postError && typeof postError === 'object' && 'message' in postError",
+    "          ? String(postError.message)",
+    "          : String(postError);",
+    "        self.postMessage({",
+    "          renderifySandbox: CHANNEL,",
+    "          id: request.id,",
+    "          ok: false,",
+    "          error: `Sandbox response is not serializable: ${postMessageError}`,",
+    "        });",
+    "      } catch {",
+    "        // Ignore terminal postMessage failures.",
+    "      }",
+    "      return false;",
+    "    }",
+    "  };",
+    "  try {",
+    "    const moduleUrl = URL.createObjectURL(new Blob([String(request.code ?? '')], { type: 'text/javascript' }));",
+    "    try {",
+    "      const namespace = await import(moduleUrl);",
+    "      const exportName = typeof request.exportName === 'string' && request.exportName.trim().length > 0",
+    "        ? request.exportName.trim()",
+    "        : 'default';",
+    "      const selected = namespace[exportName];",
+    "      if (selected === undefined) {",
+    '        throw new Error(`Runtime source export "${exportName}" is missing`);',
+    "      }",
+    "      const output = typeof selected === 'function'",
+    "        ? await selected(request.runtimeInput ?? {})",
+    "        : selected;",
+    "      safeSend({ ok: true, output });",
+    "    } finally {",
+    "      URL.revokeObjectURL(moduleUrl);",
+    "    }",
+    "  } catch (error) {",
+    "    const message = error && typeof error === 'object' && 'message' in error",
+    "      ? String(error.message)",
+    "      : String(error);",
+    "    safeSend({ ok: false, error: message });",
+    "  }",
+    "};"
+  ].join("\n");
+  const workerUrl = URL.createObjectURL(
+    new Blob([workerSource], {
+      type: "text/javascript"
+    })
+  );
+  const worker = new Worker(workerUrl, {
+    type: "module",
+    name: "renderify-runtime-source-sandbox"
+  });
+  URL.revokeObjectURL(workerUrl);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let onAbort;
+    const cleanup = () => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timer);
+      if (options.signal && onAbort) {
+        options.signal.removeEventListener("abort", onAbort);
+      }
+      worker.removeEventListener("message", onMessage);
+      worker.removeEventListener("error", onError);
+    };
+    const timer = setTimeout(() => {
+      cleanup();
+      worker.terminate();
+      reject(new Error("Worker sandbox timed out"));
+    }, options.timeoutMs);
+    const onMessage = (event) => {
+      const payload = event.data;
+      if (!isRuntimeSandboxResponse(payload, options.request.id)) {
+        return;
+      }
+      cleanup();
+      worker.terminate();
+      if (!payload.ok) {
+        reject(new Error(payload.error ?? "Worker sandbox execution failed"));
+        return;
+      }
+      resolve({
+        output: payload.output
+      });
+    };
+    const onError = (event) => {
+      cleanup();
+      worker.terminate();
+      reject(
+        new Error(
+          event.message || "Worker sandbox terminated with an unknown error"
+        )
+      );
+    };
+    worker.addEventListener("message", onMessage);
+    worker.addEventListener("error", onError);
+    if (options.signal) {
+      if (options.signal.aborted) {
+        cleanup();
+        worker.terminate();
+        reject(createAbortError2("Worker sandbox execution aborted"));
+        return;
+      }
+      onAbort = () => {
+        cleanup();
+        worker.terminate();
+        reject(createAbortError2("Worker sandbox execution aborted"));
+      };
+      options.signal.addEventListener("abort", onAbort, { once: true });
+    }
+    worker.postMessage(options.request);
+  });
+}
+async function executeSourceInIframeSandbox(options) {
+  if (typeof document === "undefined" || typeof window === "undefined" || typeof Blob === "undefined" || typeof URL === "undefined" || typeof URL.createObjectURL !== "function" || typeof URL.revokeObjectURL !== "function") {
+    throw new Error("Iframe sandbox is unavailable in this runtime");
+  }
+  const iframe = document.createElement("iframe");
+  iframe.setAttribute("sandbox", "allow-scripts");
+  iframe.style.display = "none";
+  const channel = `renderify-runtime-source-${options.request.id}`;
+  const channelLiteral = JSON.stringify(channel);
+  iframe.srcdoc = [
+    "<!doctype html><html><body><script>",
+    `const CHANNEL = ${channelLiteral};`,
+    "window.addEventListener('message', async (event) => {",
+    "  const data = event.data;",
+    "  if (!data || data.channel !== CHANNEL) {",
+    "    return;",
+    "  }",
+    "  const request = data.request || {};",
+    "  const safeSend = (payload) => {",
+    "    try {",
+    "      parent.postMessage({ channel: CHANNEL, ...payload }, '*');",
+    "      return true;",
+    "    } catch (postError) {",
+    "      try {",
+    "        const postMessageError = postError && typeof postError === 'object' && 'message' in postError",
+    "          ? String(postError.message)",
+    "          : String(postError);",
+    "        parent.postMessage({",
+    "          channel: CHANNEL,",
+    "          ok: false,",
+    "          error: `Sandbox response is not serializable: ${postMessageError}`,",
+    "        }, '*');",
+    "      } catch {",
+    "        // Ignore terminal postMessage failures.",
+    "      }",
+    "      return false;",
+    "    }",
+    "  };",
+    "  try {",
+    "    const moduleUrl = URL.createObjectURL(new Blob([String(request.code ?? '')], { type: 'text/javascript' }));",
+    "    try {",
+    "      const namespace = await import(moduleUrl);",
+    "      const exportName = typeof request.exportName === 'string' && request.exportName.trim().length > 0",
+    "        ? request.exportName.trim()",
+    "        : 'default';",
+    "      const selected = namespace[exportName];",
+    "      if (selected === undefined) {",
+    '        throw new Error(`Runtime source export "${exportName}" is missing`);',
+    "      }",
+    "      const output = typeof selected === 'function'",
+    "        ? await selected(request.runtimeInput ?? {})",
+    "        : selected;",
+    "      safeSend({ ok: true, output });",
+    "    } finally {",
+    "      URL.revokeObjectURL(moduleUrl);",
+    "    }",
+    "  } catch (error) {",
+    "    const message = error && typeof error === 'object' && 'message' in error",
+    "      ? String(error.message)",
+    "      : String(error);",
+    "    safeSend({ ok: false, error: message });",
+    "  }",
+    "});",
+    "</script></body></html>"
+  ].join("");
+  document.body.appendChild(iframe);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let onAbort;
+    const cleanup = () => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timer);
+      if (options.signal && onAbort) {
+        options.signal.removeEventListener("abort", onAbort);
+      }
+      window.removeEventListener("message", onMessage);
+      iframe.removeEventListener("load", onLoad);
+      iframe.remove();
+    };
+    const timer = setTimeout(() => {
+      cleanup();
+      reject(new Error("Iframe sandbox timed out"));
+    }, options.timeoutMs);
+    const onMessage = (event) => {
+      if (event.source !== iframe.contentWindow) {
+        return;
+      }
+      const data = event.data;
+      if (!data || data.channel !== channel) {
+        return;
+      }
+      cleanup();
+      if (!data.ok) {
+        reject(new Error(data.error ?? "Iframe sandbox execution failed"));
+        return;
+      }
+      resolve({
+        output: data.output
+      });
+    };
+    const onLoad = () => {
+      iframe.contentWindow?.postMessage(
+        { channel, request: options.request },
+        "*"
+      );
+    };
+    window.addEventListener("message", onMessage);
+    iframe.addEventListener("load", onLoad, { once: true });
+    if (options.signal) {
+      if (options.signal.aborted) {
+        cleanup();
+        reject(createAbortError2("Iframe sandbox execution aborted"));
+        return;
+      }
+      onAbort = () => {
+        cleanup();
+        reject(createAbortError2("Iframe sandbox execution aborted"));
+      };
+      options.signal.addEventListener("abort", onAbort, { once: true });
+    }
+  });
+}
+function isRuntimeSandboxResponse(value, expectedId) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const candidate = value;
+  return candidate.renderifySandbox === "runtime-source" && candidate.id === expectedId && typeof candidate.ok === "boolean";
+}
+function throwIfAborted2(signal) {
+  if (!signal?.aborted) {
+    return;
+  }
+  throw createAbortError2("Runtime sandbox execution aborted");
+}
+function createAbortError2(message) {
+  const error = new Error(message);
+  error.name = "AbortError";
+  return error;
+}
+
+// src/runtime-source-execution.ts
+async function executeRuntimeSourceRoot(input) {
+  const {
+    plan,
+    source,
+    context,
+    state,
+    event,
+    diagnostics,
+    frame,
+    browserSourceSandboxTimeoutMs,
+    browserSourceSandboxFailClosed
+  } = input;
+  try {
+    const exportName = source.exportName ?? "default";
+    const runtimeInput = {
+      context: input.cloneJsonValue(input.asJsonValue(context)),
+      state: input.cloneJsonValue(state),
+      event: event ? input.cloneJsonValue(input.asJsonValue(event)) : null
+    };
+    const transpiled = await input.withRemainingBudget(
+      () => input.transpileRuntimeSource(source),
+      "Runtime source transpilation timed out"
+    );
+    const rewritten = await input.rewriteSourceImports(
+      transpiled,
+      plan.moduleManifest,
+      diagnostics
+    );
+    const sandboxMode = input.resolveSourceSandboxMode(
+      source,
+      frame.executionProfile
+    );
+    if (sandboxMode !== "none") {
+      try {
+        const sandboxResult = await input.withRemainingBudget(
+          () => executeSourceInBrowserSandbox({
+            mode: sandboxMode,
+            timeoutMs: browserSourceSandboxTimeoutMs,
+            signal: frame.signal,
+            request: {
+              renderifySandbox: "runtime-source",
+              id: `sandbox_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`,
+              code: rewritten,
+              exportName,
+              runtimeInput
+            }
+          }),
+          `Runtime source sandbox (${sandboxMode}) timed out`
+        );
+        const normalized2 = input.normalizeSourceOutput(sandboxResult.output);
+        if (!normalized2) {
+          diagnostics.push({
+            level: "error",
+            code: "RUNTIME_SOURCE_OUTPUT_INVALID",
+            message: "Runtime source output from sandbox is not a supported RuntimeNode payload"
+          });
+          return void 0;
+        }
+        diagnostics.push({
+          level: "info",
+          code: "RUNTIME_SOURCE_SANDBOX_EXECUTED",
+          message: `Runtime source executed in ${sandboxMode} sandbox`
+        });
+        return {
+          root: normalized2
+        };
+      } catch (error) {
+        if (input.isAbortError(error)) {
+          throw error;
+        }
+        const message = input.errorToMessage(error);
+        diagnostics.push({
+          level: browserSourceSandboxFailClosed ? "error" : "warning",
+          code: browserSourceSandboxFailClosed ? "RUNTIME_SOURCE_SANDBOX_FAILED" : "RUNTIME_SOURCE_SANDBOX_FALLBACK",
+          message
+        });
+        if (browserSourceSandboxFailClosed) {
+          throw new Error(
+            `Runtime source sandbox (${sandboxMode}) failed: ${message}`
+          );
+        }
+      }
+    }
+    const namespace = await input.withRemainingBudget(
+      () => input.importSourceModuleFromCode(
+        rewritten,
+        plan.moduleManifest,
+        diagnostics
+      ),
+      "Runtime source module loading timed out"
+    );
+    const selected = selectExportFromNamespace(namespace, exportName);
+    if (selected === void 0) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_SOURCE_EXPORT_MISSING",
+        message: `Runtime source export "${exportName}" is missing`
+      });
+      return void 0;
+    }
+    if (input.shouldUsePreactSourceRuntime(source)) {
+      const preactArtifact = await input.createPreactRenderArtifact({
+        sourceExport: selected,
+        runtimeInput,
+        diagnostics
+      });
+      if (preactArtifact) {
+        return {
+          renderArtifact: preactArtifact
+        };
+      }
+    }
+    const produced = typeof selected === "function" ? await input.withRemainingBudget(
+      async () => selected(runtimeInput),
+      "Runtime source export execution timed out"
+    ) : selected;
+    const normalized = input.normalizeSourceOutput(produced);
+    if (!normalized) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_SOURCE_OUTPUT_INVALID",
+        message: "Runtime source output is not a supported RuntimeNode payload"
+      });
+      return void 0;
+    }
+    return {
+      root: normalized
+    };
+  } catch (error) {
+    if (input.isAbortError(error)) {
+      throw error;
+    }
+    diagnostics.push({
+      level: "error",
+      code: "RUNTIME_SOURCE_EXEC_FAILED",
+      message: input.errorToMessage(error)
+    });
+    return void 0;
+  }
+}
+
+// src/runtime-source-module-loader.ts
+var RuntimeSourceModuleLoader = class {
+  moduleManifest;
+  diagnostics;
+  browserModuleUrlCache;
+  browserModuleInflight;
+  remoteFallbackCdnBases;
+  remoteFetchTimeoutMs;
+  remoteFetchRetries;
+  remoteFetchBackoffMs;
+  canMaterializeBrowserModulesFn;
+  rewriteImportsAsyncFn;
+  createBrowserBlobModuleUrlFn;
+  resolveRuntimeSourceSpecifierFn;
+  constructor(options) {
+    this.moduleManifest = options.moduleManifest;
+    this.diagnostics = options.diagnostics;
+    this.browserModuleUrlCache = options.browserModuleUrlCache;
+    this.browserModuleInflight = options.browserModuleInflight;
+    this.remoteFallbackCdnBases = options.remoteFallbackCdnBases;
+    this.remoteFetchTimeoutMs = options.remoteFetchTimeoutMs;
+    this.remoteFetchRetries = options.remoteFetchRetries;
+    this.remoteFetchBackoffMs = options.remoteFetchBackoffMs;
+    this.canMaterializeBrowserModulesFn = options.canMaterializeBrowserModules;
+    this.rewriteImportsAsyncFn = options.rewriteImportsAsync;
+    this.createBrowserBlobModuleUrlFn = options.createBrowserBlobModuleUrl;
+    this.resolveRuntimeSourceSpecifierFn = options.resolveRuntimeSourceSpecifier;
+  }
+  async importSourceModuleFromCode(code) {
+    const isNodeRuntime = typeof process !== "undefined" && process !== null && typeof process.versions === "object" && process.versions !== null && typeof process.versions.node === "string";
+    if (isNodeRuntime && typeof Buffer !== "undefined") {
+      const encoded = Buffer.from(code, "utf8").toString("base64");
+      const dataUrl = `data:text/javascript;base64,${encoded}`;
+      return import(
+        /* webpackIgnore: true */
+        dataUrl
+      );
+    }
+    if (this.canMaterializeBrowserModulesFn()) {
+      const rewrittenEntry = await this.rewriteImportsAsyncFn(
+        code,
+        async (specifier) => this.resolveBrowserImportSpecifier(specifier, void 0)
+      );
+      const entryUrl = this.createBrowserBlobModuleUrlFn(rewrittenEntry);
+      return import(
+        /* webpackIgnore: true */
+        entryUrl
+      );
+    }
+    if (typeof Buffer !== "undefined") {
+      const encoded = Buffer.from(code, "utf8").toString("base64");
+      const dataUrl = `data:text/javascript;base64,${encoded}`;
+      return import(
+        /* webpackIgnore: true */
+        dataUrl
+      );
+    }
+    throw new Error("No runtime module import strategy is available");
+  }
+  async resolveBrowserImportSpecifier(specifier, parentUrl) {
+    const trimmed = specifier.trim();
+    if (trimmed.length === 0) {
+      return trimmed;
+    }
+    if (trimmed.startsWith("data:") || trimmed.startsWith("blob:")) {
+      return trimmed;
+    }
+    if (isHttpUrl(trimmed)) {
+      return this.materializeBrowserRemoteModule(trimmed);
+    }
+    if (trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith("/")) {
+      if (!parentUrl || !isHttpUrl(parentUrl)) {
+        this.diagnostics.push({
+          level: "warning",
+          code: "RUNTIME_SOURCE_IMPORT_UNRESOLVED",
+          message: `Cannot resolve relative source import without parent URL: ${trimmed}`
+        });
+        return trimmed;
+      }
+      const absolute = new URL(trimmed, parentUrl).toString();
+      if (!isHttpUrl(absolute)) {
+        return absolute;
+      }
+      return this.materializeBrowserRemoteModule(absolute);
+    }
+    const resolved = this.resolveRuntimeSourceSpecifierFn(
+      trimmed,
+      this.moduleManifest,
+      this.diagnostics,
+      false
+    );
+    if (isHttpUrl(resolved)) {
+      return this.materializeBrowserRemoteModule(resolved);
+    }
+    if ((resolved.startsWith("./") || resolved.startsWith("../") || resolved.startsWith("/")) && parentUrl && isHttpUrl(parentUrl)) {
+      const absolute = new URL(resolved, parentUrl).toString();
+      if (!isHttpUrl(absolute)) {
+        return absolute;
+      }
+      return this.materializeBrowserRemoteModule(absolute);
+    }
+    return resolved;
+  }
+  async materializeBrowserRemoteModule(url) {
+    const normalizedUrl = url.trim();
+    if (normalizedUrl.length === 0) {
+      return normalizedUrl;
+    }
+    const cachedUrl = this.browserModuleUrlCache.get(normalizedUrl);
+    if (cachedUrl) {
+      return cachedUrl;
+    }
+    const inflight = this.browserModuleInflight.get(normalizedUrl);
+    if (inflight) {
+      return inflight;
+    }
+    const loading = (async () => {
+      const fetched = await this.fetchRemoteModuleCodeWithFallback(normalizedUrl);
+      const rewritten = await this.materializeFetchedModuleSource(fetched);
+      const blobUrl = this.createBrowserBlobModuleUrlFn(rewritten);
+      this.browserModuleUrlCache.set(normalizedUrl, blobUrl);
+      this.browserModuleUrlCache.set(fetched.url, blobUrl);
+      return blobUrl;
+    })();
+    this.browserModuleInflight.set(normalizedUrl, loading);
+    try {
+      return await loading;
+    } finally {
+      this.browserModuleInflight.delete(normalizedUrl);
+    }
+  }
+  async materializeFetchedModuleSource(fetched) {
+    if (isCssModuleResponse(fetched)) {
+      return createCssProxyModuleSource(fetched.code, fetched.url);
+    }
+    if (isJsonModuleResponse(fetched)) {
+      return this.createJsonProxyModuleSource(fetched);
+    }
+    if (!isJavaScriptModuleResponse(fetched)) {
+      this.diagnostics.push({
+        level: "warning",
+        code: "RUNTIME_SOURCE_ASSET_PROXY",
+        message: `Treating non-JS module as proxied asset: ${fetched.url} (${fetched.contentType || "unknown"})`
+      });
+      if (isBinaryLikeContentType(fetched.contentType)) {
+        return createUrlProxyModuleSource(fetched.url);
+      }
+      return createTextProxyModuleSource(fetched.code);
+    }
+    return this.rewriteImportsAsyncFn(
+      fetched.code,
+      async (childSpecifier) => this.resolveBrowserImportSpecifier(childSpecifier, fetched.url)
+    );
+  }
+  async fetchRemoteModuleCodeWithFallback(url) {
+    const attempts = buildRemoteModuleAttemptUrls(
+      url,
+      this.remoteFallbackCdnBases
+    );
+    if (attempts.length === 0) {
+      throw new Error(`Failed to load module: ${url}`);
+    }
+    const hedgeDelayMs = Math.max(
+      50,
+      Math.min(300, this.remoteFetchBackoffMs || 100)
+    );
+    const fetchTasks = attempts.map(
+      (attempt, index) => this.fetchRemoteModuleAttemptWithRetries(
+        attempt,
+        url,
+        index === 0 ? 0 : hedgeDelayMs * index
+      )
+    );
+    try {
+      return await Promise.any(fetchTasks);
+    } catch (error) {
+      if (error instanceof AggregateError && error.errors.length > 0) {
+        throw error.errors[error.errors.length - 1];
+      }
+      throw error;
+    }
+  }
+  async fetchRemoteModuleAttemptWithRetries(attempt, originalUrl, startDelayMs) {
+    if (startDelayMs > 0) {
+      await delay(startDelayMs);
+    }
+    let lastError;
+    for (let retry = 0; retry <= this.remoteFetchRetries; retry += 1) {
+      try {
+        const response = await fetchWithTimeout(
+          attempt,
+          this.remoteFetchTimeoutMs
+        );
+        if (!response.ok) {
+          throw new Error(
+            `Failed to load module ${attempt}: HTTP ${response.status}`
+          );
+        }
+        if (attempt !== originalUrl) {
+          this.diagnostics.push({
+            level: "warning",
+            code: "RUNTIME_SOURCE_IMPORT_FALLBACK_USED",
+            message: `Loaded module via fallback URL: ${originalUrl} -> ${attempt}`
+          });
+        }
+        if (retry > 0) {
+          this.diagnostics.push({
+            level: "warning",
+            code: "RUNTIME_SOURCE_IMPORT_RETRY_SUCCEEDED",
+            message: `Recovered remote module after retry ${retry}: ${attempt}`
+          });
+        }
+        return {
+          url: response.url || attempt,
+          code: await response.text(),
+          contentType: response.headers.get("content-type")?.toLowerCase() ?? "",
+          requestUrl: attempt
+        };
+      } catch (error) {
+        lastError = error;
+        if (retry >= this.remoteFetchRetries) {
+          break;
+        }
+        await delay(this.remoteFetchBackoffMs * Math.max(1, retry + 1));
+      }
+    }
+    throw lastError ?? new Error(`Failed to load module: ${attempt}`);
+  }
+  createJsonProxyModuleSource(fetched) {
+    try {
+      const parsed = JSON.parse(fetched.code);
+      return createJsonProxyModuleSource(parsed);
+    } catch (error) {
+      this.diagnostics.push({
+        level: "warning",
+        code: "RUNTIME_SOURCE_JSON_PARSE_FAILED",
+        message: `${fetched.requestUrl}: ${this.errorToMessage(error)}`
+      });
+      return createTextProxyModuleSource(fetched.code);
+    }
+  }
+  errorToMessage(error) {
+    if (error instanceof Error) {
+      return error.message;
+    }
+    return String(error);
+  }
+};
+
+// src/transpiler.ts
+var RUNTIME_JSX_HELPERS = `
+function __renderify_runtime_to_nodes(value) {
+  if (value === null || value === undefined || value === false || value === true) {
+    return [];
+  }
+  if (Array.isArray(value)) {
+    const flattened = [];
+    for (const entry of value) {
+      flattened.push(...__renderify_runtime_to_nodes(entry));
+    }
+    return flattened;
+  }
+  if (typeof value === "string" || typeof value === "number") {
+    return [{ type: "text", value: String(value) }];
+  }
+  if (
+    typeof value === "object" &&
+    value !== null &&
+    typeof value.type === "string"
+  ) {
+    return [value];
+  }
+  return [{ type: "text", value: String(value) }];
+}
+
+function __renderify_runtime_h(type, props, ...children) {
+  const normalizedChildren = __renderify_runtime_to_nodes(children);
+  if (typeof type === "function") {
+    const output = type({ ...(props || {}), children: normalizedChildren });
+    const functionNodes = __renderify_runtime_to_nodes(output);
+    if (functionNodes.length === 1) {
+      return functionNodes[0];
+    }
+    return { type: "element", tag: "div", children: functionNodes };
+  }
+  if (typeof type === "string") {
+    return {
+      type: "element",
+      tag: type,
+      props: props || undefined,
+      children: normalizedChildren,
+    };
+  }
+  return { type: "text", value: "Unsupported JSX node type" };
+}
+
+function __renderify_runtime_fragment(...children) {
+  return __renderify_runtime_to_nodes(children);
+}
+`.trim();
+var BabelRuntimeSourceTranspiler = class {
+  async transpile(input) {
+    if (input.language === "js") {
+      return input.code;
+    }
+    const babel = this.resolveBabel();
+    const presets = [];
+    if (input.language === "ts" || input.language === "tsx") {
+      presets.push("typescript");
+    }
+    if (input.language === "jsx" || input.language === "tsx") {
+      if (input.runtime === "preact") {
+        presets.push([
+          "react",
+          {
+            runtime: "automatic",
+            importSource: "preact"
+          }
+        ]);
+      } else {
+        presets.push([
+          "react",
+          {
+            runtime: "classic",
+            pragma: "__renderify_runtime_h",
+            pragmaFrag: "__renderify_runtime_fragment"
+          }
+        ]);
+      }
+    }
+    const transformed = babel.transform(input.code, {
+      sourceType: "module",
+      presets,
+      filename: input.filename,
+      babelrc: false,
+      configFile: false,
+      comments: false
+    });
+    if (!transformed.code) {
+      throw new Error("Babel returned empty output");
+    }
+    return transformed.code;
+  }
+  resolveBabel() {
+    const root = globalThis;
+    if (root.Babel && typeof root.Babel.transform === "function") {
+      return root.Babel;
+    }
+    throw new Error(
+      "Babel standalone is not available. Load @babel/standalone in browser or provide sourceTranspiler."
+    );
+  }
+  static mergeRuntimeHelpers(source, runtime) {
+    if (runtime === "preact") {
+      return source;
+    }
+    return `${source}
+
+${RUNTIME_JSX_HELPERS}`;
+  }
+};
+
+// src/runtime-source-runtime.ts
+function shouldUsePreactSourceRuntime(source) {
+  return source.runtime === "preact";
+}
+function executionProfileToSourceSandboxMode(executionProfile) {
+  if (executionProfile === "sandbox-worker") {
+    return "worker";
+  }
+  if (executionProfile === "sandbox-iframe") {
+    return "iframe";
+  }
+  return void 0;
+}
+function resolveSourceSandboxMode(input) {
+  const requested = executionProfileToSourceSandboxMode(input.executionProfile);
+  const mode = requested ?? input.defaultMode;
+  if (mode === "none") {
+    return "none";
+  }
+  if (!input.isBrowserRuntime) {
+    return "none";
+  }
+  if (shouldUsePreactSourceRuntime(input.source)) {
+    if (requested) {
+      throw new Error(
+        `${requested} executionProfile is not supported with source.runtime=preact`
+      );
+    }
+    return "none";
+  }
+  return mode;
+}
+async function transpileRuntimeSource(source, sourceTranspiler) {
+  const mergedSource = BabelRuntimeSourceTranspiler.mergeRuntimeHelpers(
+    source.code,
+    source.runtime
+  );
+  return sourceTranspiler.transpile({
+    code: mergedSource,
+    language: source.language,
+    filename: `renderify-runtime-source.${source.language}`,
+    runtime: source.runtime
+  });
+}
+
+// src/manager.ts
+var DefaultRuntimeManager = class {
+  moduleLoader;
+  sourceTranspiler;
+  states = /* @__PURE__ */ new Map();
+  defaultMaxImports;
+  defaultMaxComponentInvocations;
+  defaultMaxExecutionMs;
+  defaultExecutionProfile;
+  supportedPlanSpecVersions;
+  enforceModuleManifest;
+  allowIsolationFallback;
+  browserSourceSandboxMode;
+  browserSourceSandboxTimeoutMs;
+  browserSourceSandboxFailClosed;
+  enableDependencyPreflight;
+  failOnDependencyPreflightError;
+  remoteFetchTimeoutMs;
+  remoteFetchRetries;
+  remoteFetchBackoffMs;
+  remoteFallbackCdnBases;
+  browserModuleUrlCache = /* @__PURE__ */ new Map();
+  browserModuleInflight = /* @__PURE__ */ new Map();
+  browserBlobUrls = /* @__PURE__ */ new Set();
+  initialized = false;
+  constructor(options = {}) {
+    this.moduleLoader = options.moduleLoader;
+    this.sourceTranspiler = options.sourceTranspiler ?? new BabelRuntimeSourceTranspiler();
+    this.defaultMaxImports = options.defaultMaxImports ?? FALLBACK_MAX_IMPORTS;
+    this.defaultMaxComponentInvocations = options.defaultMaxComponentInvocations ?? FALLBACK_MAX_COMPONENT_INVOCATIONS;
+    this.defaultMaxExecutionMs = options.defaultMaxExecutionMs ?? FALLBACK_MAX_EXECUTION_MS;
+    this.defaultExecutionProfile = options.defaultExecutionProfile ?? FALLBACK_EXECUTION_PROFILE;
+    this.supportedPlanSpecVersions = normalizeSupportedSpecVersions(
+      options.supportedPlanSpecVersions
+    );
+    this.enforceModuleManifest = options.enforceModuleManifest ?? FALLBACK_ENFORCE_MODULE_MANIFEST;
+    this.allowIsolationFallback = options.allowIsolationFallback ?? FALLBACK_ALLOW_ISOLATION_FALLBACK;
+    this.browserSourceSandboxMode = normalizeSourceSandboxMode(
+      options.browserSourceSandboxMode
+    );
+    this.browserSourceSandboxTimeoutMs = normalizePositiveInteger(
+      options.browserSourceSandboxTimeoutMs,
+      FALLBACK_BROWSER_SOURCE_SANDBOX_TIMEOUT_MS
+    );
+    this.browserSourceSandboxFailClosed = options.browserSourceSandboxFailClosed ?? FALLBACK_BROWSER_SOURCE_SANDBOX_FAIL_CLOSED;
+    this.enableDependencyPreflight = options.enableDependencyPreflight ?? FALLBACK_ENABLE_DEPENDENCY_PREFLIGHT;
+    this.failOnDependencyPreflightError = options.failOnDependencyPreflightError ?? FALLBACK_FAIL_ON_DEPENDENCY_PREFLIGHT_ERROR;
+    this.remoteFetchTimeoutMs = normalizePositiveInteger(
+      options.remoteFetchTimeoutMs,
+      FALLBACK_REMOTE_FETCH_TIMEOUT_MS
+    );
+    this.remoteFetchRetries = normalizeNonNegativeInteger(
+      options.remoteFetchRetries,
+      FALLBACK_REMOTE_FETCH_RETRIES
+    );
+    this.remoteFetchBackoffMs = normalizeNonNegativeInteger(
+      options.remoteFetchBackoffMs,
+      FALLBACK_REMOTE_FETCH_BACKOFF_MS
+    );
+    this.remoteFallbackCdnBases = normalizeFallbackCdnBases(
+      options.remoteFallbackCdnBases
+    );
+  }
+  async initialize() {
+    if (this.initialized) {
+      return;
+    }
+    this.initialized = true;
+  }
+  async terminate() {
+    this.initialized = false;
+    this.states.clear();
+    this.browserModuleUrlCache.clear();
+    this.browserModuleInflight.clear();
+    this.revokeBrowserBlobUrls();
+  }
+  async execute(input) {
+    return this.executePlan(
+      input.plan,
+      input.context,
+      input.event,
+      input.stateOverride,
+      input.signal
+    );
+  }
+  async probePlan(plan) {
+    this.ensureInitialized();
+    const diagnostics = [];
+    const specVersion = (0, import_ir9.resolveRuntimePlanSpecVersion)(plan.specVersion);
+    if (!this.supportedPlanSpecVersions.has(specVersion)) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_SPEC_VERSION_UNSUPPORTED",
+        message: `Unsupported plan specVersion "${specVersion}". Supported: ${[
+          ...this.supportedPlanSpecVersions
+        ].join(", ")}`
+      });
+      return {
+        planId: plan.id,
+        diagnostics,
+        dependencies: []
+      };
+    }
+    const frame = {
+      startedAt: nowMs(),
+      maxExecutionMs: plan.capabilities.maxExecutionMs ?? this.defaultMaxExecutionMs,
+      maxComponentInvocations: plan.capabilities.maxComponentInvocations ?? this.defaultMaxComponentInvocations,
+      componentInvocations: 0,
+      executionProfile: plan.capabilities.executionProfile ?? this.defaultExecutionProfile
+    };
+    const dependencies = await this.preflightPlanDependencies(
+      plan,
+      diagnostics,
+      frame
+    );
+    return {
+      planId: plan.id,
+      diagnostics,
+      dependencies
+    };
+  }
+  async executePlan(plan, context = {}, event, stateOverride, signal) {
+    this.ensureInitialized();
+    throwIfAborted(signal);
+    const specVersion = (0, import_ir9.resolveRuntimePlanSpecVersion)(plan.specVersion);
+    const diagnostics = [];
+    if (!this.supportedPlanSpecVersions.has(specVersion)) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_SPEC_VERSION_UNSUPPORTED",
+        message: `Unsupported plan specVersion "${specVersion}". Supported: ${[
+          ...this.supportedPlanSpecVersions
+        ].join(", ")}`
+      });
+      return {
+        planId: plan.id,
+        root: plan.root,
+        diagnostics,
+        state: (0, import_ir9.cloneJsonValue)(this.resolveState(plan, stateOverride)),
+        handledEvent: event,
+        appliedActions: []
+      };
+    }
+    const state = this.resolveState(plan, stateOverride);
+    const appliedActions = [];
+    const frame = {
+      startedAt: nowMs(),
+      maxExecutionMs: plan.capabilities.maxExecutionMs ?? this.defaultMaxExecutionMs,
+      maxComponentInvocations: plan.capabilities.maxComponentInvocations ?? this.defaultMaxComponentInvocations,
+      componentInvocations: 0,
+      executionProfile: plan.capabilities.executionProfile ?? this.defaultExecutionProfile,
+      signal
+    };
+    const maxImports = plan.capabilities.maxImports ?? this.defaultMaxImports;
+    const imports = plan.imports ?? [];
+    if (this.enableDependencyPreflight) {
+      await this.preflightPlanDependencies(plan, diagnostics, frame);
+      if (this.failOnDependencyPreflightError && diagnostics.some(
+        (item) => item.level === "error" && item.code.startsWith("RUNTIME_PREFLIGHT_")
+      )) {
+        return {
+          planId: plan.id,
+          root: plan.root,
+          diagnostics,
+          state: (0, import_ir9.cloneJsonValue)(state),
+          handledEvent: event,
+          appliedActions
+        };
+      }
+    }
+    await resolveRuntimePlanImports({
+      imports,
+      maxImports,
+      moduleManifest: plan.moduleManifest,
+      diagnostics,
+      moduleLoader: this.moduleLoader,
+      resolveRuntimeSpecifier: (specifier, moduleManifest, runtimeDiagnostics) => this.resolveRuntimeSpecifier(
+        specifier,
+        moduleManifest,
+        runtimeDiagnostics,
+        "import"
+      ),
+      isAborted: () => isAborted(frame.signal),
+      hasExceededBudget: () => hasExceededBudget(frame),
+      withRemainingBudget: (operation, timeoutMessage) => withRemainingBudget(operation, frame, timeoutMessage),
+      isAbortError: (error) => isAbortError(error),
+      errorToMessage: (error) => this.errorToMessage(error)
+    });
+    const sourceRoot = plan.source ? await this.resolveSourceRoot(
+      plan,
+      plan.source,
+      context,
+      state,
+      event,
+      diagnostics,
+      frame
+    ) : void 0;
+    const sourceRenderArtifact = sourceRoot?.renderArtifact;
+    const resolvedRoot = sourceRoot?.root ? await this.resolveNode(
+      sourceRoot.root,
+      plan.moduleManifest,
+      context,
+      state,
+      event,
+      diagnostics,
+      frame
+    ) : await this.resolveNode(
+      plan.root,
+      plan.moduleManifest,
+      context,
+      state,
+      event,
+      diagnostics,
+      frame
+    );
+    return {
+      planId: plan.id,
+      root: resolvedRoot,
+      diagnostics,
+      state: (0, import_ir9.cloneJsonValue)(state),
+      handledEvent: event,
+      appliedActions,
+      ...sourceRenderArtifact ? { renderArtifact: sourceRenderArtifact } : {}
+    };
+  }
+  async compile(plan, options = {}) {
+    const indent = options.pretty ? 2 : 0;
+    return JSON.stringify(plan, null, indent);
+  }
+  getPlanState(planId) {
+    const snapshot = this.states.get(planId);
+    if (!snapshot) {
+      return void 0;
+    }
+    return (0, import_ir9.cloneJsonValue)(snapshot);
+  }
+  setPlanState(planId, snapshot) {
+    this.states.set(planId, (0, import_ir9.cloneJsonValue)(snapshot));
+  }
+  clearPlanState(planId) {
+    this.states.delete(planId);
+  }
+  resolveState(plan, stateOverride) {
+    if (stateOverride) {
+      return (0, import_ir9.cloneJsonValue)(stateOverride);
+    }
+    if (plan.state?.initial) {
+      return (0, import_ir9.cloneJsonValue)(plan.state.initial);
+    }
+    return {};
+  }
+  async preflightPlanDependencies(plan, diagnostics, frame) {
+    return preflightRuntimePlanDependencies({
+      plan,
+      diagnostics,
+      moduleLoader: this.moduleLoader,
+      withRemainingBudget: (operation, timeoutMessage) => withRemainingBudget(operation, frame, timeoutMessage),
+      resolveRuntimeSourceSpecifier: (specifier, manifest, runtimeDiagnostics, requireManifest) => this.resolveRuntimeSourceSpecifier(
+        specifier,
+        manifest,
+        runtimeDiagnostics,
+        requireManifest
+      ),
+      resolveSourceImportLoaderCandidate: (specifier, manifest) => this.resolveSourceImportLoaderCandidate(specifier, manifest),
+      resolveRuntimeSpecifier: (specifier, manifest, runtimeDiagnostics, usage) => this.resolveRuntimeSpecifier(
+        specifier,
+        manifest,
+        runtimeDiagnostics,
+        usage
+      ),
+      materializeBrowserRemoteModule: (url, manifest, runtimeDiagnostics) => this.createSourceModuleLoader(
+        manifest,
+        runtimeDiagnostics
+      ).materializeBrowserRemoteModule(url),
+      fetchRemoteModuleCodeWithFallback: (url, runtimeDiagnostics) => this.createSourceModuleLoader(
+        void 0,
+        runtimeDiagnostics
+      ).fetchRemoteModuleCodeWithFallback(url),
+      isAbortError: (error) => isAbortError(error),
+      errorToMessage: (error) => this.errorToMessage(error),
+      isAborted: () => isAborted(frame.signal),
+      hasExceededBudget: () => hasExceededBudget(frame)
+    });
+  }
+  async resolveSourceRoot(plan, source, context, state, event, diagnostics, frame) {
+    return executeRuntimeSourceRoot({
+      plan,
+      source,
+      context,
+      state,
+      event,
+      diagnostics,
+      frame: {
+        executionProfile: frame.executionProfile,
+        signal: frame.signal
+      },
+      browserSourceSandboxTimeoutMs: this.browserSourceSandboxTimeoutMs,
+      browserSourceSandboxFailClosed: this.browserSourceSandboxFailClosed,
+      withRemainingBudget: (operation, timeoutMessage) => withRemainingBudget(operation, frame, timeoutMessage),
+      transpileRuntimeSource: (runtimeSource) => transpileRuntimeSource(runtimeSource, this.sourceTranspiler),
+      rewriteSourceImports: async (code, manifest, runtimeDiagnostics) => this.rewriteImportsAsync(
+        code,
+        async (specifier) => this.resolveRuntimeSourceSpecifier(
+          specifier,
+          manifest,
+          runtimeDiagnostics
+        )
+      ),
+      resolveSourceSandboxMode: (runtimeSource, executionProfile) => resolveSourceSandboxMode({
+        source: runtimeSource,
+        executionProfile,
+        defaultMode: this.browserSourceSandboxMode,
+        isBrowserRuntime: isBrowserRuntime()
+      }),
+      importSourceModuleFromCode: (code, manifest, runtimeDiagnostics) => this.createSourceModuleLoader(
+        manifest,
+        runtimeDiagnostics
+      ).importSourceModuleFromCode(code),
+      normalizeSourceOutput: (output) => this.normalizeSourceOutput(output),
+      shouldUsePreactSourceRuntime,
+      createPreactRenderArtifact: ({
+        sourceExport,
+        runtimeInput,
+        diagnostics: diagnostics2
+      }) => createPreactRenderArtifact({
+        sourceExport,
+        runtimeInput,
+        diagnostics: diagnostics2
+      }),
+      isAbortError: (error) => isAbortError(error),
+      errorToMessage: (error) => this.errorToMessage(error),
+      cloneJsonValue: import_ir9.cloneJsonValue,
+      asJsonValue: import_ir9.asJsonValue
+    });
+  }
+  resolveRuntimeSourceSpecifier(specifier, moduleManifest, diagnostics, requireManifest = true) {
+    return resolveRuntimeSourceSpecifier({
+      specifier,
+      moduleManifest,
+      diagnostics,
+      requireManifest,
+      enforceModuleManifest: this.enforceModuleManifest,
+      moduleLoader: this.moduleLoader,
+      jspmCdnBase: FALLBACK_JSPM_CDN_BASE
+    });
+  }
+  resolveSourceImportLoaderCandidate(specifier, moduleManifest) {
+    return resolveSourceImportLoaderCandidate(
+      specifier,
+      moduleManifest,
+      this.moduleLoader
+    );
+  }
+  resolveRuntimeSpecifier(specifier, moduleManifest, diagnostics, usage) {
+    return resolveRuntimeSpecifier({
+      specifier,
+      moduleManifest,
+      diagnostics,
+      usage,
+      enforceModuleManifest: this.enforceModuleManifest
+    });
+  }
+  createSourceModuleLoader(moduleManifest, diagnostics) {
+    return new RuntimeSourceModuleLoader({
+      moduleManifest,
+      diagnostics,
+      browserModuleUrlCache: this.browserModuleUrlCache,
+      browserModuleInflight: this.browserModuleInflight,
+      remoteFallbackCdnBases: this.remoteFallbackCdnBases,
+      remoteFetchTimeoutMs: this.remoteFetchTimeoutMs,
+      remoteFetchRetries: this.remoteFetchRetries,
+      remoteFetchBackoffMs: this.remoteFetchBackoffMs,
+      canMaterializeBrowserModules: () => canMaterializeBrowserModules(),
+      rewriteImportsAsync: (code, resolver) => this.rewriteImportsAsync(code, resolver),
+      createBrowserBlobModuleUrl: (code) => this.createBrowserBlobModuleUrl(code),
+      resolveRuntimeSourceSpecifier: (specifier, manifest, runtimeDiagnostics, requireManifest) => this.resolveRuntimeSourceSpecifier(
+        specifier,
+        manifest,
+        runtimeDiagnostics,
+        requireManifest
+      )
+    });
+  }
+  async materializeFetchedModuleSource(fetched, moduleManifest, diagnostics) {
+    return this.createSourceModuleLoader(
+      moduleManifest,
+      diagnostics
+    ).materializeFetchedModuleSource(fetched);
+  }
+  toConfiguredFallbackUrl(url, cdnBase) {
+    return toConfiguredFallbackUrl(url, cdnBase);
+  }
+  toEsmFallbackUrl(url, cdnBase = FALLBACK_ESM_CDN_BASE) {
+    return toEsmFallbackUrl(url, cdnBase);
+  }
+  async rewriteImportsAsync(code, resolver) {
+    return rewriteImportsAsync(code, resolver);
+  }
+  createBrowserBlobModuleUrl(code) {
+    return createBrowserBlobModuleUrl(code, this.browserBlobUrls);
+  }
+  revokeBrowserBlobUrls() {
+    revokeBrowserBlobUrls(this.browserBlobUrls);
+  }
+  normalizeSourceOutput(output) {
+    return normalizeRuntimeSourceOutput(output);
+  }
+  async resolveNode(node, moduleManifest, context, state, event, diagnostics, frame) {
+    throwIfAborted(frame.signal);
+    if (hasExceededBudget(frame)) {
+      diagnostics.push({
+        level: "error",
+        code: "RUNTIME_TIMEOUT",
+        message: "Execution time budget exceeded during node resolution"
+      });
+      return (0, import_ir9.createElementNode)("div", { "data-renderify-timeout": "true" }, [
+        (0, import_ir9.createTextNode)("Runtime execution timed out")
+      ]);
+    }
+    return resolveRuntimeNode({
+      node,
+      moduleManifest,
+      context,
+      state,
+      event,
+      diagnostics,
+      frame,
+      resolver: {
+        moduleLoader: this.moduleLoader,
+        allowIsolationFallback: this.allowIsolationFallback,
+        resolveRuntimeSpecifier: (specifier, manifest, runtimeDiagnostics, usage) => this.resolveRuntimeSpecifier(
+          specifier,
+          manifest,
+          runtimeDiagnostics,
+          usage
+        ),
+        withRemainingBudget: (operation, timeoutMessage) => withRemainingBudget(operation, frame, timeoutMessage),
+        resolveNode: (nextNode) => this.resolveNode(
+          nextNode,
+          moduleManifest,
+          context,
+          state,
+          event,
+          diagnostics,
+          frame
+        ),
+        errorToMessage: (error) => this.errorToMessage(error)
+      }
+    });
+  }
+  ensureInitialized() {
+    if (!this.initialized) {
+      throw new Error("RuntimeManager is not initialized");
+    }
+  }
+  errorToMessage(error) {
+    if (error instanceof Error) {
+      return error.message;
+    }
+    return String(error);
+  }
+};
+
+// src/runtime-manager.types.ts
+var RuntimeSecurityViolationError = class extends Error {
+  result;
+  constructor(result) {
+    super(`Security policy rejected runtime plan: ${result.issues.join("; ")}`);
+    this.name = "RuntimeSecurityViolationError";
+    this.result = result;
+  }
+};
+
+// src/ui-renderer.ts
+var DefaultUIRenderer = class {
+  mountSessions = /* @__PURE__ */ new WeakMap();
+  async render(result, target) {
+    if (result.renderArtifact?.mode === "preact-vnode") {
+      return this.renderPreactArtifact(result.renderArtifact.payload, target);
+    }
+    const serialized = this.renderNodeWithBindings(result.root);
+    if (typeof document === "undefined") {
+      return serialized.html;
+    }
+    if (!target) {
+      return serialized.html;
+    }
+    const resolvedTarget = this.resolveRenderTarget(target);
+    if (!resolvedTarget) {
+      throw new Error(
+        `Render target not found: ${this.stringifyTarget(target)}`
+      );
+    }
+    const { mountPoint, onRuntimeEvent } = resolvedTarget;
+    this.patchMountPoint(mountPoint, serialized.html);
+    this.syncMountSession(
+      mountPoint,
+      result.planId,
+      serialized.eventBindings,
+      onRuntimeEvent
+    );
+    return mountPoint.innerHTML;
+  }
+  async renderPreactArtifact(payload, target) {
+    if (typeof document !== "undefined" && target) {
+      const resolvedTarget = this.resolveRenderTarget(target);
+      if (!resolvedTarget) {
+        throw new Error(
+          `Render target not found: ${this.stringifyTarget(target)}`
+        );
+      }
+      const preact = await this.loadPreactRenderer();
+      preact.render(payload, resolvedTarget.mountPoint);
+      return resolvedTarget.mountPoint.innerHTML;
+    }
+    const renderToString = await this.loadPreactRenderToString();
+    return renderToString(payload);
+  }
+  renderNode(node) {
+    return this.renderNodeWithBindings(node).html;
+  }
+  renderNodeWithBindings(node) {
+    const context = {
+      nextBindingId: 0,
+      eventBindings: []
+    };
+    return {
+      html: this.renderNodeInternal(node, context),
+      eventBindings: context.eventBindings
+    };
+  }
+  renderNodeInternal(node, context) {
+    if (node.type === "text") {
+      return escapeHtml(node.value);
+    }
+    if (node.type === "component") {
+      return `<div data-renderify-unresolved-component="${escapeHtml(node.module)}"></div>`;
+    }
+    const children = (node.children ?? []).map((child) => this.renderNodeInternal(child, context)).join("");
+    const normalizedTag = normalizeTagName(node.tag);
+    if (!normalizedTag) {
+      return `<div data-renderify-sanitized-tag="${escapeHtml(node.tag)}">${children}</div>`;
+    }
+    if (BLOCKED_TAG_NAMES.has(normalizedTag)) {
+      return `<div data-renderify-sanitized-tag="${escapeHtml(node.tag)}"></div>`;
+    }
+    const attributes = serializeProps(node.props, context);
+    return `<${normalizedTag}${attributes}>${children}</${normalizedTag}>`;
+  }
+  resolveRenderTarget(target) {
+    if (isInteractiveRenderTarget(target)) {
+      const mountPoint2 = this.resolveTargetElement(target.element);
+      if (!mountPoint2) {
+        return null;
+      }
+      return {
+        mountPoint: mountPoint2,
+        onRuntimeEvent: target.onRuntimeEvent
+      };
+    }
+    const mountPoint = this.resolveTargetElement(target);
+    if (!mountPoint) {
+      return null;
+    }
+    return {
+      mountPoint
+    };
+  }
+  resolveTargetElement(target) {
+    if (typeof target !== "string") {
+      return target;
+    }
+    return document.querySelector(target);
+  }
+  patchMountPoint(mountPoint, nextHtml) {
+    const sanitizedHtml = this.sanitizeHtmlForMount(nextHtml);
+    const session = this.mountSessions.get(mountPoint);
+    if (!session) {
+      mountPoint.innerHTML = sanitizedHtml;
+      return;
+    }
+    if (session.html === sanitizedHtml) {
+      return;
+    }
+    const scrollTop = mountPoint.scrollTop;
+    const scrollLeft = mountPoint.scrollLeft;
+    const template = document.createElement("template");
+    template.innerHTML = sanitizedHtml;
+    this.reconcileChildren(mountPoint, template.content);
+    mountPoint.scrollTop = scrollTop;
+    mountPoint.scrollLeft = scrollLeft;
+  }
+  sanitizeHtmlForMount(html) {
+    const template = document.createElement("template");
+    template.innerHTML = html;
+    sanitizeRenderedFragment(template.content);
+    return template.innerHTML;
+  }
+  reconcileChildren(currentParent, nextParent) {
+    const currentChildren = Array.from(currentParent.childNodes);
+    const nextChildren = Array.from(nextParent.childNodes);
+    if (this.shouldUseKeyedReconcile(currentChildren, nextChildren)) {
+      this.reconcileKeyedChildren(currentParent, currentChildren, nextChildren);
+      return;
+    }
+    const commonLength = Math.min(currentChildren.length, nextChildren.length);
+    for (let i = 0; i < commonLength; i += 1) {
+      this.reconcileNode(currentChildren[i], nextChildren[i]);
+    }
+    for (let i = currentChildren.length - 1; i >= nextChildren.length; i -= 1) {
+      currentChildren[i].remove();
+    }
+    for (let i = commonLength; i < nextChildren.length; i += 1) {
+      currentParent.appendChild(nextChildren[i].cloneNode(true));
+    }
+  }
+  shouldUseKeyedReconcile(currentChildren, nextChildren) {
+    return currentChildren.some((node) => this.getNodeKey(node) !== null) || nextChildren.some((node) => this.getNodeKey(node) !== null);
+  }
+  reconcileKeyedChildren(currentParent, currentChildren, nextChildren) {
+    const currentByKey = /* @__PURE__ */ new Map();
+    for (const node of currentChildren) {
+      const key = this.getNodeKey(node);
+      if (!key || currentByKey.has(key)) {
+        continue;
+      }
+      currentByKey.set(key, node);
+    }
+    const consumed = /* @__PURE__ */ new Set();
+    const desiredNodes = [];
+    for (let index = 0; index < nextChildren.length; index += 1) {
+      const nextChild = nextChildren[index];
+      const nextKey = this.getNodeKey(nextChild);
+      let candidate;
+      if (nextKey) {
+        const keyed = currentByKey.get(nextKey);
+        if (keyed && !consumed.has(keyed) && this.areNodesCompatible(keyed, nextChild)) {
+          candidate = keyed;
+        }
+      } else {
+        const positional = currentChildren[index];
+        if (positional && !consumed.has(positional) && this.getNodeKey(positional) === null && this.areNodesCompatible(positional, nextChild)) {
+          candidate = positional;
+        }
+      }
+      if (candidate) {
+        this.reconcileNode(candidate, nextChild);
+        consumed.add(candidate);
+        desiredNodes.push(candidate);
+        continue;
+      }
+      desiredNodes.push(nextChild.cloneNode(true));
+    }
+    this.applyDesiredChildren(currentParent, desiredNodes);
+  }
+  applyDesiredChildren(currentParent, desiredNodes) {
+    const desiredSet = new Set(desiredNodes);
+    for (const child of Array.from(currentParent.childNodes)) {
+      if (!desiredSet.has(child)) {
+        child.remove();
+      }
+    }
+    for (let index = 0; index < desiredNodes.length; index += 1) {
+      const desiredNode = desiredNodes[index];
+      const nodeAtIndex = currentParent.childNodes[index] ?? null;
+      if (desiredNode.parentNode !== currentParent) {
+        currentParent.insertBefore(desiredNode, nodeAtIndex);
+        continue;
+      }
+      if (nodeAtIndex !== desiredNode) {
+        currentParent.insertBefore(desiredNode, nodeAtIndex);
+      }
+    }
+  }
+  getNodeKey(node) {
+    if (typeof Element === "undefined" || !(node instanceof Element)) {
+      return null;
+    }
+    const key = node.getAttribute("data-renderify-key") ?? node.getAttribute("key");
+    if (!key || key.trim().length === 0) {
+      return null;
+    }
+    return key;
+  }
+  areNodesCompatible(currentNode, nextNode) {
+    if (currentNode.nodeType !== nextNode.nodeType) {
+      return false;
+    }
+    if (typeof Element === "undefined" || !(currentNode instanceof Element) || !(nextNode instanceof Element)) {
+      return true;
+    }
+    return currentNode.tagName === nextNode.tagName;
+  }
+  reconcileNode(currentNode, nextNode) {
+    if (currentNode.nodeType !== nextNode.nodeType) {
+      currentNode.replaceWith(nextNode.cloneNode(true));
+      return;
+    }
+    if (currentNode.nodeType === Node.TEXT_NODE) {
+      if (currentNode.textContent !== nextNode.textContent) {
+        currentNode.textContent = nextNode.textContent;
+      }
+      return;
+    }
+    if (!(currentNode instanceof Element) || !(nextNode instanceof Element)) {
+      if (currentNode.textContent !== nextNode.textContent) {
+        currentNode.textContent = nextNode.textContent;
+      }
+      return;
+    }
+    if (currentNode.tagName !== nextNode.tagName) {
+      currentNode.replaceWith(nextNode.cloneNode(true));
+      return;
+    }
+    this.reconcileAttributes(currentNode, nextNode);
+    this.reconcileChildren(currentNode, nextNode);
+  }
+  reconcileAttributes(currentElement, nextElement) {
+    const activeElement = typeof document !== "undefined" ? document.activeElement : void 0;
+    for (const attribute of Array.from(currentElement.attributes)) {
+      if (!nextElement.hasAttribute(attribute.name)) {
+        currentElement.removeAttribute(attribute.name);
+      }
+    }
+    for (const attribute of Array.from(nextElement.attributes)) {
+      if (this.shouldSkipInteractivePropertySync(
+        currentElement,
+        activeElement,
+        attribute.name
+      )) {
+        continue;
+      }
+      if (currentElement.getAttribute(attribute.name) !== attribute.value) {
+        currentElement.setAttribute(attribute.name, attribute.value);
+      }
+    }
+  }
+  shouldSkipInteractivePropertySync(element, activeElement, attributeName) {
+    if (!activeElement || element !== activeElement) {
+      return false;
+    }
+    if (!(element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement)) {
+      return false;
+    }
+    return attributeName === "value" || attributeName === "checked";
+  }
+  syncMountSession(mountPoint, planId, eventBindings, onRuntimeEvent) {
+    const existing = this.mountSessions.get(mountPoint);
+    const runtimeEvents = /* @__PURE__ */ new Map();
+    const delegatedEventTypes = /* @__PURE__ */ new Set();
+    for (const binding of eventBindings) {
+      runtimeEvents.set(binding.bindingId, binding.runtimeEvent);
+      delegatedEventTypes.add(binding.domEvent);
+    }
+    const session = existing ?? {
+      html: "",
+      planId,
+      runtimeEvents,
+      listeners: /* @__PURE__ */ new Map(),
+      onRuntimeEvent
+    };
+    session.html = mountPoint.innerHTML;
+    session.planId = planId;
+    session.runtimeEvents = runtimeEvents;
+    session.onRuntimeEvent = onRuntimeEvent;
+    this.syncDelegatedListeners(mountPoint, session, delegatedEventTypes);
+    this.mountSessions.set(mountPoint, session);
+  }
+  syncDelegatedListeners(mountPoint, session, delegatedEventTypes) {
+    for (const [eventType, listener] of session.listeners.entries()) {
+      if (!delegatedEventTypes.has(eventType)) {
+        mountPoint.removeEventListener(eventType, listener);
+        session.listeners.delete(eventType);
+      }
+    }
+    for (const eventType of delegatedEventTypes) {
+      if (session.listeners.has(eventType)) {
+        continue;
+      }
+      const listener = (event) => {
+        this.handleDelegatedRuntimeEvent(mountPoint, session, eventType, event);
+      };
+      mountPoint.addEventListener(eventType, listener);
+      session.listeners.set(eventType, listener);
+    }
+  }
+  handleDelegatedRuntimeEvent(mountPoint, session, domEvent, event) {
+    const eventTarget = event.target;
+    if (!eventTarget || !(eventTarget instanceof Element)) {
+      return;
+    }
+    const bindingAttribute = getBindingAttributeName(domEvent);
+    const matched = eventTarget.closest(`[${bindingAttribute}]`);
+    if (!matched || !(matched instanceof Element) || !mountPoint.contains(matched)) {
+      return;
+    }
+    const bindingId = matched.getAttribute(bindingAttribute);
+    if (!bindingId) {
+      return;
+    }
+    const runtimeEvent = session.runtimeEvents.get(bindingId);
+    if (!runtimeEvent) {
+      return;
+    }
+    const dispatchRequest = {
+      planId: session.planId,
+      event: runtimeEvent
+    };
+    if (typeof CustomEvent === "function") {
+      mountPoint.dispatchEvent(
+        new CustomEvent(
+          "renderify:runtime-event",
+          {
+            bubbles: true,
+            composed: true,
+            detail: dispatchRequest
+          }
+        )
+      );
+    }
+    if (session.onRuntimeEvent) {
+      void Promise.resolve(session.onRuntimeEvent(dispatchRequest)).catch(
+        () => {
+        }
+      );
+    }
+  }
+  async loadPreactRenderer() {
+    const loaded = await import(getPreactSpecifier2());
+    if (!isPreactRendererLike(loaded)) {
+      throw new Error("Failed to load preact renderer from `preact` package");
+    }
+    return loaded;
+  }
+  async loadPreactRenderToString() {
+    const loaded = await import(getPreactRenderToStringSpecifier());
+    if (!isPreactRenderToStringLike(loaded)) {
+      throw new Error(
+        "Failed to load preact-render-to-string from `preact-render-to-string` package"
+      );
+    }
+    if (typeof loaded === "function") {
+      return loaded;
+    }
+    if (typeof loaded.default === "function") {
+      return loaded.default;
+    }
+    return loaded.render;
+  }
+  stringifyTarget(target) {
+    if (typeof target === "string") {
+      return target;
+    }
+    if (isInteractiveRenderTarget(target)) {
+      if (typeof target.element === "string") {
+        return target.element;
+      }
+      return "[interactive-target-element]";
+    }
+    return "[target-element]";
+  }
+};
+function isPreactRendererLike(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.render === "function";
+}
+function isPreactRenderToStringLike(value) {
+  if (typeof value === "function") {
+    return true;
+  }
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.default === "function" || typeof candidate.render === "function";
+}
+function isInteractiveRenderTarget(value) {
+  if (typeof value === "string") {
+    return false;
+  }
+  if (typeof HTMLElement !== "undefined" && value instanceof HTMLElement) {
+    return false;
+  }
+  return typeof value === "object" && value !== null && "element" in value && (typeof value.element === "string" || typeof HTMLElement !== "undefined" && value.element instanceof HTMLElement);
+}
+function getPreactSpecifier2() {
+  return "preact";
+}
+function getPreactRenderToStringSpecifier() {
+  return "preact-render-to-string";
+}
+function getBindingAttributeName(domEvent) {
+  return `data-renderify-event-${domEvent}`;
+}
+var BLOCKED_TAG_NAMES = /* @__PURE__ */ new Set([
+  "script",
+  "style",
+  "iframe",
+  "object",
+  "embed",
+  "link",
+  "meta",
+  "base",
+  "form"
+]);
+var BLOCKED_ATTRIBUTE_NAMES = /* @__PURE__ */ new Set([
+  "srcdoc",
+  "innerhtml",
+  "dangerouslysetinnerhtml"
+]);
+var URL_ATTRIBUTE_NAMES = /* @__PURE__ */ new Set([
+  "href",
+  "src",
+  "xlink:href",
+  "action",
+  "formaction",
+  "poster"
+]);
+var SAFE_URL_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
+var UNSAFE_STYLE_PATTERNS = [
+  /\bexpression\s*\(/i,
+  /\burl\s*\(/i,
+  /\bjavascript\s*:/i,
+  /\bdata\s*:/i,
+  /@import/i,
+  /\bbehavior\s*:/i,
+  /-moz-binding/i
+];
+function sanitizeTagName(tag) {
+  const normalized = normalizeTagName(tag);
+  if (!normalized) {
+    return void 0;
+  }
+  if (BLOCKED_TAG_NAMES.has(normalized)) {
+    return void 0;
+  }
+  return normalized;
+}
+function normalizeTagName(tag) {
+  const normalized = tag.trim().toLowerCase();
+  if (!/^[a-z][a-z0-9-]*$/.test(normalized)) {
+    return void 0;
+  }
+  return normalized;
+}
+function isSafeAttributeName(attributeName) {
+  return /^[A-Za-z_:][A-Za-z0-9:._-]*$/.test(attributeName);
+}
+function isSafeAttributeUrl(value) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    return false;
+  }
+  if (trimmed.startsWith("#") || trimmed.startsWith("/") || trimmed.startsWith("./") || trimmed.startsWith("../")) {
+    return true;
+  }
+  const lowered = trimmed.toLowerCase();
+  if (lowered.startsWith("javascript:") || lowered.startsWith("vbscript:") || lowered.startsWith("data:")) {
+    return false;
+  }
+  if (/^[a-z][a-z0-9+.-]*:/.test(lowered)) {
+    try {
+      const parsed = new URL(trimmed);
+      return SAFE_URL_PROTOCOLS.has(parsed.protocol);
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+function serializeProps(props, context) {
+  if (!props) {
+    return "";
+  }
+  const attributes = [];
+  let targetIsBlank = false;
+  let relProvided = false;
+  for (const [key, rawValue] of Object.entries(props)) {
+    if (!isSafeAttributeName(key)) {
+      continue;
+    }
+    const normalizedKey = key.toLowerCase();
+    if (BLOCKED_ATTRIBUTE_NAMES.has(normalizedKey)) {
+      continue;
+    }
+    if (key === "key") {
+      if (typeof rawValue === "string" || typeof rawValue === "number") {
+        attributes.push(
+          ` data-renderify-key="${escapeHtml(String(rawValue))}"`
+        );
+      }
+      continue;
+    }
+    const eventSpec = parseRuntimeEventProp(key, rawValue);
+    if (eventSpec) {
+      const bindingId = `evt_${String(++context.nextBindingId)}`;
+      context.eventBindings.push({
+        bindingId,
+        domEvent: eventSpec.domEvent,
+        runtimeEvent: eventSpec.runtimeEvent
+      });
+      attributes.push(
+        ` ${getBindingAttributeName(eventSpec.domEvent)}="${escapeHtml(bindingId)}"`
+      );
+      continue;
+    }
+    if (URL_ATTRIBUTE_NAMES.has(normalizedKey)) {
+      if (typeof rawValue !== "string" || !isSafeAttributeUrl(rawValue)) {
+        continue;
+      }
+    }
+    if (normalizedKey === "style") {
+      if (typeof rawValue !== "string") {
+        continue;
+      }
+      const sanitizedStyle = sanitizeInlineStyle(rawValue);
+      if (!sanitizedStyle) {
+        continue;
+      }
+      attributes.push(` style="${escapeHtml(sanitizedStyle)}"`);
+      continue;
+    }
+    if (key.startsWith("on")) {
+      continue;
+    }
+    if (normalizedKey === "target" && String(rawValue).trim() === "_blank") {
+      targetIsBlank = true;
+    }
+    if (normalizedKey === "rel") {
+      relProvided = true;
+    }
+    if (typeof rawValue === "boolean") {
+      if (rawValue) {
+        attributes.push(` ${key}`);
+      }
+      continue;
+    }
+    if (rawValue === null || typeof rawValue === "object") {
+      attributes.push(` ${key}='${escapeHtml(JSON.stringify(rawValue))}'`);
+      continue;
+    }
+    attributes.push(` ${key}="${escapeHtml(String(rawValue))}"`);
+  }
+  if (targetIsBlank && !relProvided) {
+    attributes.push(' rel="noopener noreferrer"');
+  }
+  return attributes.join("");
+}
+function sanitizeInlineStyle(style) {
+  const normalized = style.trim();
+  if (normalized.length === 0) {
+    return void 0;
+  }
+  const inspected = normalizeStyleForSecurityInspection(normalized);
+  if (inspected.length === 0) {
+    return void 0;
+  }
+  for (const pattern of UNSAFE_STYLE_PATTERNS) {
+    if (pattern.test(inspected)) {
+      return void 0;
+    }
+  }
+  return normalized;
+}
+function normalizeStyleForSecurityInspection(style) {
+  const withoutComments = style.replace(/\/\*[\s\S]*?\*\//g, "");
+  const decodedEscapes = decodeCssEscapes(withoutComments).replace(/\0/g, "");
+  return decodedEscapes.replace(/\s+/g, " ").trim().toLowerCase();
+}
+function decodeCssEscapes(input) {
+  return input.replace(
+    /\\(?:([0-9a-fA-F]{1,6})(?:\r\n|[ \t\r\n\f])?|(.))/g,
+    (_match, hexCodePoint, escapedChar) => {
+      if (hexCodePoint) {
+        const parsed = Number.parseInt(hexCodePoint, 16);
+        if (!Number.isFinite(parsed) || parsed < 0 || parsed > 1114111) {
+          return "";
+        }
+        return String.fromCodePoint(parsed);
+      }
+      return escapedChar;
+    }
+  );
+}
+function sanitizeRenderedFragment(fragment) {
+  sanitizeRenderedSubtree(fragment);
+}
+function sanitizeRenderedSubtree(root) {
+  const elements = Array.from(root.querySelectorAll("*"));
+  for (const element of elements) {
+    if (!element.isConnected) {
+      continue;
+    }
+    const tagName = element.tagName.toLowerCase();
+    if (!sanitizeTagName(tagName)) {
+      replaceBlockedElement(element, tagName);
+      continue;
+    }
+    sanitizeElementAttributes(element);
+    const shadowRoot = element.shadowRoot;
+    if (shadowRoot) {
+      sanitizeRenderedSubtree(shadowRoot);
+    }
+  }
+}
+function replaceBlockedElement(element, tagName) {
+  const replacement = element.ownerDocument.createElement("div");
+  replacement.setAttribute("data-renderify-sanitized-tag", tagName);
+  element.replaceWith(replacement);
+}
+function sanitizeElementAttributes(element) {
+  let targetIsBlank = false;
+  let relProvided = false;
+  for (const attribute of Array.from(element.attributes)) {
+    const key = attribute.name;
+    const value = attribute.value;
+    const normalizedKey = key.toLowerCase();
+    if (!isSafeAttributeName(key) || BLOCKED_ATTRIBUTE_NAMES.has(normalizedKey)) {
+      element.removeAttribute(key);
+      continue;
+    }
+    if (normalizedKey.startsWith("on")) {
+      element.removeAttribute(key);
+      continue;
+    }
+    if (URL_ATTRIBUTE_NAMES.has(normalizedKey) && !isSafeAttributeUrl(value)) {
+      element.removeAttribute(key);
+      continue;
+    }
+    if (normalizedKey === "style") {
+      const sanitizedStyle = sanitizeInlineStyle(value);
+      if (!sanitizedStyle) {
+        element.removeAttribute(key);
+        continue;
+      }
+      if (sanitizedStyle !== value) {
+        element.setAttribute(key, sanitizedStyle);
+      }
+    }
+    if (normalizedKey === "target" && value.trim() === "_blank") {
+      targetIsBlank = true;
+    }
+    if (normalizedKey === "rel") {
+      relProvided = true;
+    }
+  }
+  if (targetIsBlank && !relProvided) {
+    element.setAttribute("rel", "noopener noreferrer");
+  }
+}
+function parseRuntimeEventProp(propName, value) {
+  if (!/^on[A-Z]/.test(propName)) {
+    return void 0;
+  }
+  const domEvent = propName.slice(2).toLowerCase();
+  if (!/^[a-z][a-z0-9_-]*$/.test(domEvent)) {
+    return void 0;
+  }
+  if (typeof value === "string" && value.trim().length > 0) {
+    return {
+      domEvent,
+      runtimeEvent: {
+        type: value.trim()
+      }
+    };
+  }
+  if (!isJsonObject(value)) {
+    return void 0;
+  }
+  const eventType = value.type;
+  if (typeof eventType !== "string" || eventType.trim().length === 0) {
+    return void 0;
+  }
+  const payload = value.payload;
+  const runtimeEvent = {
+    type: eventType.trim()
+  };
+  if (isJsonObject(payload)) {
+    runtimeEvent.payload = payload;
+  }
+  return {
+    domEvent,
+    runtimeEvent
+  };
+}
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+
+// src/embed.ts
+var EMBED_TARGET_RENDER_LOCKS = /* @__PURE__ */ new WeakMap();
+async function renderPlanInBrowser(plan, options = {}) {
+  const renderOperation = async () => {
+    const ui = options.ui ?? new DefaultUIRenderer();
+    const runtime = options.runtime ?? new DefaultRuntimeManager({
+      moduleLoader: new JspmModuleLoader(),
+      ...options.runtimeOptions ?? {}
+    });
+    const security = options.security ?? new import_security.DefaultSecurityChecker();
+    const shouldInitializeRuntime = options.autoInitializeRuntime !== false || options.runtime === void 0;
+    const shouldTerminateRuntime = options.autoTerminateRuntime !== false && options.runtime === void 0;
+    security.initialize(options.securityInitialization);
+    if (shouldInitializeRuntime) {
+      await runtime.initialize();
+    }
+    try {
+      const securityResult = await security.checkPlan(plan);
+      if (!securityResult.safe) {
+        throw new RuntimeSecurityViolationError(securityResult);
+      }
+      const execution = await runtime.execute({
+        plan,
+        context: options.context,
+        signal: options.signal
+      });
+      const html = await ui.render(execution, options.target);
+      return {
+        html,
+        execution,
+        security: securityResult,
+        runtime
+      };
+    } finally {
+      if (shouldTerminateRuntime) {
+        await runtime.terminate();
+      }
+    }
+  };
+  const shouldSerialize = options.serializeTargetRenders !== false;
+  const targetElement = shouldSerialize ? resolveEmbedRenderTargetElement(options.target) : void 0;
+  if (targetElement) {
+    return withEmbedTargetRenderLock(targetElement, renderOperation);
+  }
+  return renderOperation();
+}
+async function withEmbedTargetRenderLock(target, operation) {
+  const previousLock = EMBED_TARGET_RENDER_LOCKS.get(target) ?? Promise.resolve();
+  let releaseCurrentLock;
+  const currentLock = new Promise((resolve) => {
+    releaseCurrentLock = resolve;
+  });
+  const queuedLock = previousLock.catch(() => void 0).then(() => currentLock);
+  EMBED_TARGET_RENDER_LOCKS.set(target, queuedLock);
+  await previousLock.catch(() => void 0);
+  try {
+    return await operation();
+  } finally {
+    releaseCurrentLock?.();
+    if (EMBED_TARGET_RENDER_LOCKS.get(target) === queuedLock) {
+      EMBED_TARGET_RENDER_LOCKS.delete(target);
+    }
+  }
+}
+function resolveEmbedRenderTargetElement(target) {
+  if (typeof document === "undefined" || !target) {
+    return void 0;
+  }
+  if (typeof target === "string") {
+    return document.querySelector(target) ?? void 0;
+  }
+  if (typeof HTMLElement !== "undefined" && target instanceof HTMLElement) {
+    return target;
+  }
+  if (isInteractiveRenderTargetValue(target)) {
+    if (typeof target.element === "string") {
+      return document.querySelector(target.element) ?? void 0;
+    }
+    return target.element;
+  }
+  return void 0;
+}
+function isInteractiveRenderTargetValue(target) {
+  return typeof target === "object" && target !== null && "element" in target && (typeof target.element === "string" || typeof HTMLElement !== "undefined" && target.element instanceof HTMLElement);
+}
+//# sourceMappingURL=runtime.cjs.js.map