@tanstack/redact 0.0.1

package/src/react/jsx-runtime.ts

@@ -0,0 +1,16 @@
+import { REACT_ELEMENT_TYPE, type ReactElement } from '../core'
+
+export { Fragment } from './element'
+
+export function jsx(type: any, props: any, key?: any): ReactElement {
+  return {
+    $$typeof: REACT_ELEMENT_TYPE,
+    type,
+    key: key == null ? null : '' + key,
+    ref: props?.ref ?? null,
+    props,
+  }
+}
+
+export const jsxs = jsx
+export const jsxDEV = jsx

package/src/react/memo.ts

@@ -0,0 +1,45 @@
+export const REACT_MEMO_TYPE = Symbol.for('react.memo')
+export const REACT_FORWARD_REF_TYPE = Symbol.for('react.forward_ref')
+export const REACT_LAZY_TYPE = Symbol.for('react.lazy')
+
+export function memo<P>(
+  type: (props: P) => any,
+  areEqual?: (prev: Readonly<P>, next: Readonly<P>) => boolean,
+) {
+  return { $$typeof: REACT_MEMO_TYPE, type, compare: areEqual ?? null }
+}
+
+export function forwardRef<R, P = {}>(
+  render: (props: P, ref: { current: R | null } | ((r: R | null) => void) | null) => any,
+) {
+  return { $$typeof: REACT_FORWARD_REF_TYPE, render }
+}
+
+export function lazy<T extends { default: any }>(ctor: () => Promise<T>) {
+  const payload = {
+    status: -1 as -1 | 0 | 1 | 2,
+    result: undefined as any,
+  }
+  return {
+    $$typeof: REACT_LAZY_TYPE,
+    _payload: payload,
+    _init: (p: typeof payload): any => {
+      if (p.status === 1) return p.result
+      if (p.status === 2) throw p.result
+      if (p.status === 0) throw p.result // pending promise
+      const thenable = ctor().then(
+        (mod) => {
+          p.status = 1
+          p.result = mod.default
+        },
+        (err) => {
+          p.status = 2
+          p.result = err
+        },
+      )
+      p.status = 0
+      p.result = thenable
+      throw thenable
+    },
+  }
+}

package/src/react/portal.ts

@@ -0,0 +1 @@
+export const REACT_PORTAL_TYPE = Symbol.for('react.portal')

package/src/react/shared-internals.ts

@@ -0,0 +1,79 @@
+import type { Fiber, FiberRoot, Hook } from '../core'
+
+export interface Dispatcher {
+  useState<S>(initial: S | (() => S)): [S, (s: S | ((p: S) => S)) => void]
+  useReducer<S, A>(
+    reducer: (s: S, a: A) => S,
+    initial: S | any,
+    init?: (a: any) => S,
+  ): [S, (a: A) => void]
+  useEffect(create: () => any, deps?: ReadonlyArray<unknown>): void
+  useLayoutEffect(create: () => any, deps?: ReadonlyArray<unknown>): void
+  useInsertionEffect(create: () => any, deps?: ReadonlyArray<unknown>): void
+  useRef<T>(initial: T): { current: T }
+  useMemo<T>(factory: () => T, deps?: ReadonlyArray<unknown>): T
+  useCallback<T extends Function>(fn: T, deps?: ReadonlyArray<unknown>): T
+  useContext<T>(ctx: any): T
+  useImperativeHandle<T>(ref: any, factory: () => T, deps?: ReadonlyArray<unknown>): void
+  useDebugValue<T>(value: T, formatter?: (v: T) => any): void
+  useId(): string
+  useTransition(): [boolean, (fn: () => void) => void]
+  useDeferredValue<T>(v: T): T
+  useSyncExternalStore<T>(
+    subscribe: (cb: () => void) => () => void,
+    getSnapshot: () => T,
+    getServerSnapshot?: () => T,
+  ): T
+  use<T>(promiseOrContext: any): T
+}
+
+interface SharedInternals {
+  H: Dispatcher | null
+  T: any
+  S: ((fn: () => void) => void) | null
+  currentFiber: Fiber | null
+  currentRoot: FiberRoot | null
+  currentHook: Hook | null
+  hookIndex: number
+}
+
+// Stash the singleton on `globalThis` under a registered symbol. Module-scoped
+// state goes wrong fast in environments that end up with multiple copies of
+// `@tanstack/redact` in flight — most notably Cloudflare's `vite-plugin` dev
+// mode, where the worker entry inlines `@tanstack/redact` once via `noExternal`
+// while user code reaches a separate pre-bundled `deps_ssr/redact.js` copy.
+// Each copy would otherwise have its own `ReactSharedInternals.H`, so the SSR
+// dispatcher installed by one would be invisible to hooks called through the
+// other and `useContext` would explode with "Hooks can only be called inside a
+// function component". `Symbol.for` survives module re-evaluation and isolate
+// boundaries, giving every copy the same backing object.
+const KEY = Symbol.for('@tanstack/redact.ReactSharedInternals')
+const g = globalThis as unknown as { [k: symbol]: SharedInternals | undefined }
+
+export const ReactSharedInternals: SharedInternals =
+  g[KEY] ??
+  (g[KEY] = {
+    H: null,
+    T: null,
+    S: null,
+    currentFiber: null,
+    currentRoot: null,
+    currentHook: null,
+    hookIndex: 0,
+  })
+
+export function getDispatcher(): Dispatcher {
+  const d = ReactSharedInternals.H
+  if (!d) {
+    if (process.env.NODE_ENV !== 'production') {
+      throw new Error(
+        'Hooks can only be called inside a function component. ' +
+          'If this fires during SSR/RSC, the most common cause is a component that uses client-only hooks ' +
+          '(useState, useContext, useRouter, etc.) being rendered in the RSC server environment without a ' +
+          '"use client" directive at the top of its file.',
+      )
+    }
+    throw new Error('Hooks can only be called inside a function component.')
+  }
+  return d
+}

package/src/react/suspense.ts

@@ -0,0 +1,18 @@
+export const REACT_SUSPENSE_TYPE = Symbol.for('react.suspense')
+export const REACT_STRICT_MODE_TYPE = Symbol.for('react.strict_mode')
+export const REACT_PROFILER_TYPE = Symbol.for('react.profiler')
+
+export const Suspense = REACT_SUSPENSE_TYPE as any as (props: {
+  children?: any
+  fallback?: any
+}) => any
+
+export const StrictMode = REACT_STRICT_MODE_TYPE as any as (props: {
+  children?: any
+}) => any
+
+export const Profiler = REACT_PROFILER_TYPE as any as (props: {
+  id: string
+  onRender?: any
+  children?: any
+}) => any

package/src/scheduler/index.ts

@@ -0,0 +1,124 @@
+// Minimal `scheduler` package surface — enough for React-ecosystem libraries
+// (react-three/fiber, react-query's older scheduler calls, some devtools) to
+// resolve the import without crashing. We don't implement priority lanes or
+// interruptible work; everything runs on microtask or the next task.
+
+const PRIORITY_IMMEDIATE = 1
+const PRIORITY_USER_BLOCKING = 2
+const PRIORITY_NORMAL = 3
+const PRIORITY_LOW = 4
+const PRIORITY_IDLE = 5
+
+type Callback = () => unknown
+
+interface Task {
+  id: number
+  callback: Callback | null
+  priority: number
+  cancelled: boolean
+}
+
+let nextId = 0
+
+export function unstable_scheduleCallback(priority: number, cb: Callback): Task {
+  const task: Task = {
+    id: ++nextId,
+    callback: cb,
+    priority,
+    cancelled: false,
+  }
+  const run = () => {
+    if (task.cancelled || !task.callback) return
+    const fn = task.callback
+    task.callback = null
+    try {
+      fn()
+    } catch (e) {
+      // Re-throw on next task so the host sees it
+      setTimeout(() => {
+        throw e
+      }, 0)
+    }
+  }
+  // Immediate → microtask so ordering is predictable; everything else → next task.
+  if (priority <= PRIORITY_IMMEDIATE) {
+    queueMicrotask(run)
+  } else {
+    setTimeout(run, 0)
+  }
+  return task
+}
+
+export function unstable_cancelCallback(task: Task): void {
+  task.cancelled = true
+  task.callback = null
+}
+
+export function unstable_shouldYield(): boolean {
+  // We never yield — work runs to completion on whichever task schedules it.
+  return false
+}
+
+export function unstable_requestPaint(): void {
+  // no-op
+}
+
+export function unstable_now(): number {
+  return typeof performance !== 'undefined' ? performance.now() : Date.now()
+}
+
+export function unstable_getCurrentPriorityLevel(): number {
+  return PRIORITY_NORMAL
+}
+
+export function unstable_runWithPriority<T>(_priority: number, fn: () => T): T {
+  return fn()
+}
+
+export function unstable_next<T>(fn: () => T): T {
+  return fn()
+}
+
+export function unstable_wrapCallback<T extends (...args: any[]) => any>(fn: T): T {
+  return fn
+}
+
+export function unstable_continueExecution(): void {
+  // no-op
+}
+
+export function unstable_pauseExecution(): void {
+  // no-op
+}
+
+export function unstable_getFirstCallbackNode(): Task | null {
+  return null
+}
+
+export const unstable_IdlePriority = PRIORITY_IDLE
+export const unstable_ImmediatePriority = PRIORITY_IMMEDIATE
+export const unstable_LowPriority = PRIORITY_LOW
+export const unstable_NormalPriority = PRIORITY_NORMAL
+export const unstable_UserBlockingPriority = PRIORITY_USER_BLOCKING
+
+// Some libraries (e.g. @react-three/fiber) import `scheduler` with a default
+// binding expecting the namespace object. Provide one.
+export default {
+  unstable_scheduleCallback,
+  unstable_cancelCallback,
+  unstable_shouldYield,
+  unstable_requestPaint,
+  unstable_now,
+  unstable_getCurrentPriorityLevel,
+  unstable_runWithPriority,
+  unstable_next,
+  unstable_wrapCallback,
+  unstable_continueExecution,
+  unstable_pauseExecution,
+  unstable_getFirstCallbackNode,
+  unstable_IdlePriority,
+  unstable_ImmediatePriority,
+  unstable_LowPriority,
+  unstable_NormalPriority,
+  unstable_UserBlockingPriority,
+}

package/src/server/bootstrap-script.ts

@@ -0,0 +1,52 @@
+/**
+ * Inline client runtime injected into the streamed HTML. Two jobs:
+ *
+ *  1. Reveal suspense boundaries as their resolved chunks arrive ($RC).
+ *  2. Capture interaction events from the moment the shell is visible so the
+ *     main bundle can replay them against un-hydrated subtrees ($RE_q buffer).
+ *
+ * Wire format:
+ *   Fallback:  <!--$?ID--><div hidden id="B:ID">fallback</div><!--/$-->
+ *   Resolved:  emits <div hidden id="S:ID">real</div><script>$RC(ID)</script>
+ *              which splices real into place and rewrites the comment to <!--$ID-->.
+ *
+ * Client hydration calls $RH(ID, cb) to register a callback invoked once the
+ * boundary has been revealed (or immediately, if it was already revealed).
+ *
+ * Early-event buffering: before the main bundle is parsed, we attach capture
+ * listeners for a small set of interactive events and push them into a buffer.
+ * The bundle drains and replays them via the replay code in @tanstack/redact/dom.
+ */
+export const BOUNDARY_REVEAL_RUNTIME =
+  `(function(){` +
+    `var c={};` +
+    `window.$RH=function(i,f){` +
+      `if(!document.getElementById("B:"+i))f();` +
+      `else c[i]=f;` +
+    `};` +
+    `window.$RC=function(i){` +
+      `var s=document.getElementById("S:"+i),b=document.getElementById("B:"+i);` +
+      `if(!s||!b)return;` +
+      `var p=b.parentNode,m=b.previousSibling;` +
+      `while(s.firstChild)p.insertBefore(s.firstChild,b);` +
+      `s.parentNode.removeChild(s);` +
+      `p.removeChild(b);` +
+      `if(m&&m.nodeType===8)m.data="$"+i;` +
+      `if(c[i]){var f=c[i];delete c[i];f()}` +
+    `};` +
+    `var q=[];window.$RE_q=q;` +
+    `var evs=["click","submit","input","change","keydown"];` +
+    `function h(e){q.push([e.type,e.target,e.timeStamp])}` +
+    `for(var j=0;j<evs.length;j++)document.addEventListener(evs[j],h,true);` +
+    `window.$RE_stop=function(){for(var j=0;j<evs.length;j++)document.removeEventListener(evs[j],h,true)};` +
+  `})();`
+
+export function injectBootstrapScript(nonce?: string): string {
+  const n = nonce ? ` nonce="${nonce}"` : ''
+  return `<script${n}>${BOUNDARY_REVEAL_RUNTIME}</script>`
+}
+
+export function revealScript(id: number, nonce?: string): string {
+  const n = nonce ? ` nonce="${nonce}"` : ''
+  return `<script${n}>$RC(${id})</script>`
+}

package/src/server/dispatcher.ts

@@ -0,0 +1,158 @@
+import { ReactSharedInternals, REACT_CONTEXT_TYPE } from '../react'
+
+interface SSRFrame {
+  idCounter: number
+  identifierPrefix: string
+  contextStack: Array<{ context: any; prev: any }>
+}
+
+let frame: SSRFrame | null = null
+
+export function beginSSR(identifierPrefix = ':R'): void {
+  frame = { idCounter: 0, identifierPrefix, contextStack: [] }
+}
+
+export function endSSR(): void {
+  // Restore any remaining pushed contexts (defensive)
+  if (frame) {
+    for (let i = frame.contextStack.length - 1; i >= 0; i--) {
+      const { context, prev } = frame.contextStack[i]!
+      context._currentValue = prev
+    }
+  }
+  frame = null
+}
+
+export function pushContext(context: any, value: any): void {
+  if (!frame) throw new Error('pushContext called outside SSR')
+  frame.contextStack.push({ context, prev: context._currentValue })
+  context._currentValue = value
+}
+
+export function popContext(context: any): void {
+  if (!frame) return
+  const top = frame.contextStack.pop()
+  if (top && top.context === context) context._currentValue = top.prev
+}
+
+export type ContextSnapshot = Array<{ context: any; value: any }>
+
+export function snapshotContexts(): ContextSnapshot {
+  if (!frame) return []
+  const out: ContextSnapshot = []
+  for (const entry of frame.contextStack) {
+    out.push({ context: entry.context, value: entry.context._currentValue })
+  }
+  return out
+}
+
+/**
+ * Push snapshot values and return a function that pops them.
+ * Called when we re-render a suspended boundary so it sees the same provider
+ * values that were active at suspension time.
+ */
+export function applyContextSnapshot(snapshot: ContextSnapshot): () => void {
+  for (const { context, value } of snapshot) pushContext(context, value)
+  return () => {
+    for (let i = snapshot.length - 1; i >= 0; i--) popContext(snapshot[i]!.context)
+  }
+}
+
+export const ssrDispatcher = {
+  useState<S>(initial: S | (() => S)) {
+    const v = typeof initial === 'function' ? (initial as () => S)() : initial
+    return [v, (() => {}) as any] as [S, any]
+  },
+  useReducer<S, A>(_reducer: (s: S, a: A) => S, initialArg: any, init?: (a: any) => S) {
+    const v = init ? init(initialArg) : initialArg
+    return [v, (() => {}) as any]
+  },
+  useEffect() {
+    // noop on server
+  },
+  useLayoutEffect() {
+    // noop on server
+  },
+  useInsertionEffect() {
+    // noop on server
+  },
+  useRef<T>(initial: T) {
+    return { current: initial }
+  },
+  useMemo<T>(factory: () => T) {
+    return factory()
+  },
+  useCallback<T extends Function>(fn: T) {
+    return fn
+  },
+  useContext<T>(ctx: any): T {
+    return ctx._currentValue
+  },
+  useImperativeHandle() {
+    // noop on server
+  },
+  useDebugValue() {
+    // noop
+  },
+  useId(): string {
+    if (!frame) return ':r0:'
+    return `${frame.identifierPrefix}${(frame.idCounter++).toString(36)}`
+  },
+  useTransition(): [boolean, (fn: () => void) => void] {
+    return [false, (fn) => fn()]
+  },
+  useDeferredValue<T>(v: T): T {
+    return v
+  },
+  useSyncExternalStore<T>(
+    _subscribe: (cb: () => void) => () => void,
+    getSnapshot: () => T,
+    getServerSnapshot?: () => T,
+  ): T {
+    return getServerSnapshot ? getServerSnapshot() : getSnapshot()
+  },
+  use<T>(resource: any): T {
+    if (resource == null) throw new Error('use() received null or undefined')
+    if (resource.$$typeof === REACT_CONTEXT_TYPE) {
+      return resource._currentValue
+    }
+    if (typeof resource.then === 'function') {
+      const thenable = resource
+      switch (thenable.status) {
+        case 'fulfilled':
+          return thenable.value
+        case 'rejected':
+          throw thenable.reason
+        default: {
+          if (thenable.status === undefined) {
+            thenable.status = 'pending'
+            thenable.then(
+              (v: any) => {
+                if (thenable.status === 'pending') {
+                  thenable.status = 'fulfilled'
+                  thenable.value = v
+                }
+              },
+              (e: any) => {
+                if (thenable.status === 'pending') {
+                  thenable.status = 'rejected'
+                  thenable.reason = e
+                }
+              },
+            )
+          }
+          throw thenable
+        }
+      }
+    }
+    throw new Error('use() expected a Promise or Context')
+  },
+}
+
+export function installSSRDispatcher(): void {
+  ReactSharedInternals.H = ssrDispatcher as any
+}
+
+export function uninstallSSRDispatcher(): void {
+  ReactSharedInternals.H = null
+}

package/src/server/escape.ts

@@ -0,0 +1,187 @@
+const ATTR_MAP: Record<string, string> = {
+  '&': '&amp;',
+  '"': '&quot;',
+  '<': '&lt;',
+  '>': '&gt;',
+}
+const TEXT_MAP: Record<string, string> = {
+  '&': '&amp;',
+  '<': '&lt;',
+  '>': '&gt;',
+}
+
+export function escapeAttr(value: string): string {
+  return value.replace(/[&"<>]/g, (c) => ATTR_MAP[c]!)
+}
+
+export function escapeText(value: string): string {
+  return value.replace(/[&<>]/g, (c) => TEXT_MAP[c]!)
+}
+
+// Raw-text element body escaping: prevent any closing tag for the raw-text
+// elements (<script>, <style>) from terminating the element early, plus
+// `<!--` (which would start an HTML comment that survives even inside
+// raw-text bodies and can be exploited to alter following script content).
+// React's serializer follows the same approach.
+export function escapeScript(value: string): string {
+  return value
+    .replace(/<\/(script|style)/gi, '<\\/$1')
+    .replace(/<!--/g, '<\\!--')
+}
+
+export const VOID_ELEMENTS = new Set([
+  'area',
+  'base',
+  'br',
+  'col',
+  'embed',
+  'hr',
+  'img',
+  'input',
+  'link',
+  'meta',
+  'param',
+  'source',
+  'track',
+  'wbr',
+])
+
+export const RAW_TEXT_ELEMENTS = new Set(['script', 'style'])
+
+// Map JSX prop names to HTML attribute names where they differ
+export const ATTR_ALIASES: Record<string, string> = {
+  className: 'class',
+  htmlFor: 'for',
+  httpEquiv: 'http-equiv',
+  acceptCharset: 'accept-charset',
+  crossOrigin: 'crossorigin',
+  viewBox: 'viewBox', // SVG keeps camelCase
+  noModule: 'nomodule',
+}
+
+const BOOLEAN_ATTRS = new Set([
+  'allowfullscreen',
+  'async',
+  'autofocus',
+  'autoplay',
+  'checked',
+  'controls',
+  'default',
+  'defer',
+  'disabled',
+  'formnovalidate',
+  'hidden',
+  'inert',
+  'ismap',
+  'itemscope',
+  'loop',
+  'multiple',
+  'muted',
+  'nomodule',
+  'novalidate',
+  'open',
+  'playsinline',
+  'readonly',
+  'required',
+  'reversed',
+  'selected',
+])
+
+export function attrToHtml(name: string, value: unknown): string {
+  if (
+    name === 'children' ||
+    name === 'key' ||
+    name === 'ref' ||
+    name === 'dangerouslySetInnerHTML' ||
+    name === 'defaultValue' ||
+    name === 'defaultChecked' ||
+    name === 'suppressHydrationWarning' ||
+    name === 'suppressContentEditableWarning'
+  ) {
+    return ''
+  }
+  if (name[0] === 'o' && name[1] === 'n' && typeof value === 'function') return ''
+  if (value == null) return ''
+
+  const htmlName = ATTR_ALIASES[name] ?? name.toLowerCase()
+
+  // aria-* and data-* stringify booleans to `"true"`/`"false"` rather than
+  // using boolean-attribute presence semantics — matches React and the ARIA
+  // spec. Must branch before the general `value === false` / BOOLEAN_ATTRS
+  // path, which would drop them.
+  if (name.startsWith('aria-') || name.startsWith('data-')) {
+    return ` ${htmlName}="${escapeAttr(String(value))}"`
+  }
+
+  if (value === false) return ''
+
+  if (value === true || BOOLEAN_ATTRS.has(htmlName)) {
+    return value ? ` ${htmlName}=""` : ''
+  }
+
+  if (name === 'style' && typeof value === 'object' && value !== null) {
+    return ` style="${escapeAttr(styleToString(value as Record<string, unknown>))}"`
+  }
+
+  return ` ${htmlName}="${escapeAttr(String(value))}"`
+}
+
+const UNITLESS_STYLE = new Set([
+  'animationIterationCount',
+  'borderImageOutset',
+  'borderImageSlice',
+  'borderImageWidth',
+  'boxFlex',
+  'boxFlexGroup',
+  'boxOrdinalGroup',
+  'columnCount',
+  'columns',
+  'flex',
+  'flexGrow',
+  'flexPositive',
+  'flexShrink',
+  'flexNegative',
+  'flexOrder',
+  'gridArea',
+  'gridRow',
+  'gridRowEnd',
+  'gridRowSpan',
+  'gridRowStart',
+  'gridColumn',
+  'gridColumnEnd',
+  'gridColumnSpan',
+  'gridColumnStart',
+  'fontWeight',
+  'lineClamp',
+  'lineHeight',
+  'opacity',
+  'order',
+  'orphans',
+  'tabSize',
+  'widows',
+  'zIndex',
+  'zoom',
+  'fillOpacity',
+  'floodOpacity',
+  'stopOpacity',
+  'strokeDasharray',
+  'strokeDashoffset',
+  'strokeMiterlimit',
+  'strokeOpacity',
+  'strokeWidth',
+])
+
+function styleToString(style: Record<string, unknown>): string {
+  let out = ''
+  for (const key in style) {
+    const v = style[key]
+    if (v == null || v === false) continue
+    const kebab = key.startsWith('--')
+      ? key
+      : key.replace(/[A-Z]/g, (m) => '-' + m.toLowerCase())
+    const value =
+      typeof v === 'number' && !UNITLESS_STYLE.has(key) && v !== 0 ? v + 'px' : v
+    out += `${kebab}:${value};`
+  }
+  return out
+}