@vesk/compiler 0.1.14 → 0.2.8

package/dist/api-routes.d.ts

@@ -22,9 +22,14 @@ export type BuildWebRequestInput = {
  * `json()`/`text()` are patched accordingly. A `cookies` getter is attached
  * (NextRequest-compatible).
  */
-export declare function buildWebRequest(nodeReq: BuildWebRequestInput, url: string, body?: BodyInit | null): Request & {
+export declare function buildWebRequest(nodeReq: BuildWebRequestInput, url: string, body?: BodyInit | null, options?: {
+    maxBodyBytes?: number;
+}): Request & {
     cookies: Record<string, string>;
     query: Record<string, string>;
 };
+export declare function tooLargeError(max: number): Error & {
+    status: number;
+};
 export declare function executeApiRoute(filePath: string, method: string, request: Request, params?: Record<string, string>, locals?: Record<string, unknown>, devCache?: DevCache): Promise<Response | null>;
 //# sourceMappingURL=api-routes.d.ts.map

package/dist/api-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-routes.d.ts","sourceRoot":"","sources":["../src/api-routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAS7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CAG5D;AA+ED,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,IAAI,CAoDjI;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWhE;AAED,MAAM,WAAW,QAAS,SAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;CAAG;AAExD,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC;CAC/E,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,GACrB,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAqC9E;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACnC,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACpC,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkI1B"}
+{"version":3,"file":"api-routes.d.ts","sourceRoot":"","sources":["../src/api-routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAW7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CAG5D;AA+ED,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,IAAI,CA0DjI;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWhE;AAED,MAAM,WAAW,QAAS,SAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;CAAG;AAExD,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC;CAC/E,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CA4C9E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIrE;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACnC,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACpC,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA0J1B"}

package/dist/api-routes.js

@@ -1,5 +1,7 @@
 import { readdirSync, statSync, existsSync } from 'fs';
 import { join } from 'path';
+import { collapseSlashes } from '@vesk/compiler/src/router';
+import { assertSameOrigin, DEFAULT_MAX_BODY_BYTES } from '@vesk/compiler/src/server-utils';
 function basename(p) {
     const idx = p.lastIndexOf('/');
     return idx === -1 ? p : p.slice(idx + 1);
@@ -69,7 +71,7 @@ function scanApiDir(rootDir, dir, parentPath) {
         : (parentPath || '/');
     const node = {
         path: seg,
-        fullPath: fullPath.replace(/\/+/g, '/') || '/',
+        fullPath: collapseSlashes(fullPath) || '/',
         isDynamic,
         isCatchAll,
         filePath: hasRoute && routeFileName ? join(dir, routeFileName) : null,
@@ -95,7 +97,14 @@ function scanApiDir(rootDir, dir, parentPath) {
     return nodes;
 }
 export function matchApiUrl(tree, pathname) {
-    const normalized = (pathname.split('?')[0].split('#')[0]).replace(/^\/api(\/|$)/, '/');
+    let normalized = pathname.split('?')[0].split('#')[0];
+    // strip a leading /api segment (exact or followed by /) without regex
+    if (normalized === '/api') {
+        normalized = '/';
+    }
+    else if (normalized.startsWith('/api/') && !normalized.startsWith('//')) {
+        normalized = normalized.slice(4);
+    }
     const parts = normalized.split('/').filter(Boolean);
     const params = {};
     function matchNodes(nodes, partIndex) {
@@ -169,7 +178,7 @@ export function parseCookies(str) {
  * `json()`/`text()` are patched accordingly. A `cookies` getter is attached
  * (NextRequest-compatible).
  */
-export function buildWebRequest(nodeReq, url, body) {
+export function buildWebRequest(nodeReq, url, body, options) {
     const parsedUrl = new URL(url, `http://${nodeReq.headers?.host || 'localhost'}`);
     const method = nodeReq.method || 'GET';
     const headers = {};
@@ -183,8 +192,15 @@ export function buildWebRequest(nodeReq, url, body) {
             if (_bodyBuffer)
                 return _bodyBuffer;
             const chunks = [];
-            for await (const chunk of nodeReq)
-                chunks.push(chunk);
+            let total = 0;
+            const max = options?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+            for await (const chunk of nodeReq) {
+                const bytes = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+                total += bytes.byteLength;
+                if (total > max)
+                    throw tooLargeError(max);
+                chunks.push(bytes);
+            }
             _bodyBuffer = Buffer.concat(chunks);
             return _bodyBuffer;
         };
@@ -210,6 +226,11 @@ export function buildWebRequest(nodeReq, url, body) {
     Object.defineProperty(webRequest, 'query', { get: () => query, enumerable: true });
     return webRequest;
 }
+export function tooLargeError(max) {
+    const err = new Error(`Request body exceeds limit (${max} bytes)`);
+    err.status = 413;
+    return err;
+}
 export async function executeApiRoute(filePath, method, request, params = {}, locals = {}, devCache) {
     let mod;
     try {
@@ -224,11 +245,33 @@ export async function executeApiRoute(filePath, method, request, params = {}, lo
         }
     }
     catch (e) {
-        return new Response(JSON.stringify({ error: 'Failed to load route module', details: e.message }), {
+        // details only in dev (devCache present); prod gets a generic message
+        const body = devCache
+            ? { error: 'Failed to load route module', details: e.message }
+            : { error: 'Failed to load route module' };
+        return new Response(JSON.stringify(body), {
             status: 500, headers: { 'Content-Type': 'application/json' },
         });
     }
     const routeConfig = (mod.config || {});
+    // Default CSRF defense for mutating API calls: same-origin check unless the
+    // route opts out via `config.csrf = false`.
+    {
+        const methodUpper = method.toUpperCase();
+        if (routeConfig.csrf !== false && methodUpper !== 'GET' && methodUpper !== 'HEAD' && methodUpper !== 'OPTIONS') {
+            try {
+                assertSameOrigin({
+                    method: methodUpper,
+                    headers: Object.fromEntries([...request.headers.entries()].map(([k, v]) => [k, Array.isArray(v) ? v.join(', ') : v])),
+                });
+            }
+            catch {
+                return new Response(JSON.stringify({ error: 'Cross-origin request blocked' }), {
+                    status: 403, headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        }
+    }
     const handler = mod[method];
     if (!handler) {
         if (method === 'OPTIONS') {
@@ -326,7 +369,9 @@ export async function executeApiRoute(filePath, method, request, params = {}, lo
                 status: 404, headers: { 'Content-Type': 'application/json' },
             });
         }
-        return new Response(JSON.stringify({ error: err.message }), {
+        // never leak internal error messages in production responses
+        const body = devCache ? { error: err.message } : { error: 'Internal Server Error' };
+        return new Response(JSON.stringify(body), {
             status: 500, headers: { 'Content-Type': 'application/json' },
         });
     }

package/dist/client-codegen.d.ts

@@ -14,6 +14,21 @@ export declare function compileClient(source: string, _componentName: string | n
     forceClient?: boolean;
     hydrate?: boolean;
     includeTopLevel?: boolean;
+    sourcePath?: string;
+    mdRoots?: string[];
 }): string;
+/**
+ * Compiles a component source in BOTH client modes (plain + hydrate)
+ * sharing a single parse/IR pass. Used by the dev-server hot path, where
+ * every edit otherwise pays the full acorn+TS parse twice. Also returns
+ * the resolved component name using the exact selection order of
+ * `resolveComponentName`, so callers don't need a second full parse just
+ * to learn the name.
+ */
+export declare function compileClientBoth(source: string, _componentName: string | null): {
+    comp: string;
+    hyd: string;
+    name: string | null;
+};
 export { compileClient as compile, isStaticIR };
 //# sourceMappingURL=client-codegen.d.ts.map

package/dist/client-codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-codegen.d.ts","sourceRoot":"","sources":["../src/client-codegen.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAuB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAGL,cAAc,EAQd,gBAAgB,EAOjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAsCxD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAwGlI;AAID,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAU5E;AAqjCD,iBAAS,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAe3C;AA2HD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO9C;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CA0D1K;AAED,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"client-codegen.d.ts","sourceRoot":"","sources":["../src/client-codegen.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAuB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAGL,cAAc,EAQd,gBAAgB,EAOjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAuCxD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI1D;AAoBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAwGlI;AAID,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAU5E;AAqjCD,iBAAS,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAe3C;AA2HD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO9C;AA2DD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,MAAM,CAOnN;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAqBnI;AAED,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/client-codegen.js

@@ -1,12 +1,14 @@
 import { walk } from 'zimmerframe';
 import { print } from 'esrap';
 import ts from 'esrap/languages/ts';
+import tsx from 'esrap/languages/tsx';
 import { StaticNode, TextNode, DynamicBinding, OpaqueDynamicRegion, MapRegion, WhileLoop, SwitchBlock, TryCatch, ForLoop, TrackDecl, RuntimeStatement, ComponentRef, ComponentCall, ServerBlock, ClientBlock, HeadBlock, SlotNode, } from '@vesk/compiler/src/ir';
 import { parse } from '@vesk/compiler/src/parser';
 import { generateIR } from '@vesk/compiler/src/ir-generator';
 import { transformTopLevelForActions } from '@vesk/compiler/src/actions';
 import { extractRuntimeNames } from '@vesk/compiler/src/server-utils';
 import { stripTrackGeneric } from '@vesk/compiler/src/scan';
+import { inlineMdImportsFrom } from '@vesk/compiler/src/md-inline';
 import { stripTsTypes, hasTsSyntax } from '@vesk/compiler/src/strip-ts';
 function memberExpr(object, property) {
     return {
@@ -44,6 +46,28 @@ export function semicolonizeStatement(code) {
         return code;
     return code + ';';
 }
+function containsJsx(node, depth = 0) {
+    if (!node || typeof node !== 'object' || depth > 40)
+        return false;
+    if (Array.isArray(node)) {
+        for (const item of node) {
+            if (containsJsx(item, depth + 1))
+                return true;
+        }
+        return false;
+    }
+    if (typeof node.type === 'string' && (node.type === 'JSXElement' || node.type === 'JSXFragment'))
+        return true;
+    for (const key of Object.keys(node)) {
+        const v = node[key];
+        if (v && typeof v === 'object' && containsJsx(v, depth + 1))
+            return true;
+    }
+    return false;
+}
+function printAst(ast) {
+    return print(ast, containsJsx(ast) ? tsx() : ts()).code;
+}
 export function transformTracked(irNode, tracked) {
     const ast = irNode.ast;
     if (!ast)
@@ -51,7 +75,7 @@ export function transformTracked(irNode, tracked) {
     if (tracked.size === 0) {
         if (!hasTsSyntax(ast))
             return irNode.raw;
-        return print(stripTsTypes(ast), ts()).code;
+        return printAst(stripTsTypes(ast));
     }
     const stripped = stripTsTypes(ast);
     const transformed = walk(stripped, tracked, {
@@ -139,7 +163,7 @@ export function transformTracked(irNode, tracked) {
             return context.next();
         },
     });
-    return print(transformed, ts()).code;
+    return print(transformed, containsJsx(transformed) ? tsx() : ts()).code;
 }
 export function collectTrackedNames(body) {
     const names = new Map();
@@ -1458,15 +1482,13 @@ function hasKeyedMap(nodes) {
 }
 export function escapeHtml(str) {
     return str
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
+        .split('&').join('&amp;')
+        .split('<').join('&lt;')
+        .split('>').join('&gt;')
+        .split('"').join('&quot;')
+        .split("'").join('&#39;');
 }
-export function compileClient(source, _componentName, options = {}) {
-    const ast = parse(source);
-    const ir = generateIR(ast, source);
+function emitClientFromIR(ir, options) {
     const needsClient = ir.components.some((c) => c.isClient || !isStaticComponent(c));
     if (!options.forceClient && !needsClient) {
         return '';
@@ -1520,4 +1542,45 @@ ${exportCode}
 `;
     return moduleCode.trim();
 }
+export function compileClient(source, _componentName, options = {}) {
+    if (options.sourcePath) {
+        source = inlineMdImportsFrom(source, options.sourcePath, options.mdRoots || []);
+    }
+    const ast = parse(source);
+    const ir = generateIR(ast, source);
+    return emitClientFromIR(ir, options);
+}
+/**
+ * Compiles a component source in BOTH client modes (plain + hydrate)
+ * sharing a single parse/IR pass. Used by the dev-server hot path, where
+ * every edit otherwise pays the full acorn+TS parse twice. Also returns
+ * the resolved component name using the exact selection order of
+ * `resolveComponentName`, so callers don't need a second full parse just
+ * to learn the name.
+ */
+export function compileClientBoth(source, _componentName) {
+    const ast = parse(source);
+    // Downstream type-stripping mutates AST nodes in place (stripTsTypes),
+    // so each emit mode needs its own tree. Cloning is far cheaper than the
+    // second full acorn+TS parse this replaces.
+    const hydAst = structuredClone(ast);
+    const ir = generateIR(ast, source);
+    const irHyd = generateIR(hydAst, source);
+    const defaultComp = ir.components.find((c) => c.defaultExport);
+    let name = null;
+    if (defaultComp)
+        name = defaultComp.name;
+    else if (ir.components.length > 0)
+        name = ir.components[0].name;
+    else {
+        const exportedComp = ir.components.find((c) => c.exported);
+        if (exportedComp)
+            name = exportedComp.name;
+    }
+    return {
+        comp: emitClientFromIR(ir, { forceClient: true }),
+        hyd: emitClientFromIR(irHyd, { forceClient: true, hydrate: true, includeTopLevel: false }),
+        name,
+    };
+}
 export { compileClient as compile, isStaticIR };

package/dist/config.d.ts

@@ -1,4 +1,6 @@
 import type { VeskConfig, VeskPlugin, VeskSecurity } from '@vesk/compiler/src/types';
+/** Tags allowed by default when md.html = 'allowlist' and no allowTags given. */
+export declare const MD_DEFAULT_ALLOW_TAGS: string[];
 export declare function preset(name: string, overrides?: VeskSecurity): VeskSecurity;
 export declare function definePlugin<P extends VeskPlugin>(plugin: P): P;
 export declare function defineConfig(config: VeskConfig): VeskConfig;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAsB,MAAM,0BAA0B,CAAC;AA0BzG,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,YAAiB,GAAG,YAAY,CAY/E;AAED,wBAAgB,YAAY,CAAC,CAAC,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAQ/D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAqB3D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAkC7D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAgC,MAAM,0BAA0B,CAAC;AAGnH,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AA6CF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,YAAiB,GAAG,YAAY,CAY/E;AAED,wBAAgB,YAAY,CAAC,CAAC,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAQ/D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAuB3D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAkC7D"}

package/dist/config.js

@@ -1,4 +1,26 @@
 import { VeskError } from '@vesk/compiler/src/errors';
+/** Tags allowed by default when md.html = 'allowlist' and no allowTags given. */
+export const MD_DEFAULT_ALLOW_TAGS = [
+    'a', 'abbr', 'b', 'bdi', 'bdo', 'br', 'cite', 'code', 'data', 'del', 'dfn', 'em',
+    'i', 'ins', 'kbd', 'mark', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'small', 'span',
+    'strong', 'sub', 'sup', 'time', 'u', 'var', 'wbr',
+];
+const MD_HTML_MODES = ['escape', 'allow', 'allowlist'];
+function normalizeMdConfig(md) {
+    if (!md || typeof md !== 'object')
+        return md;
+    if (md.html !== undefined && !MD_HTML_MODES.includes(md.html)) {
+        throw VeskError.configError(`Unknown md.html mode: "${md.html}".`, MD_HTML_MODES);
+    }
+    const out = { ...md };
+    if (out.allowTags) {
+        if (!Array.isArray(out.allowTags)) {
+            throw VeskError.configError('md.allowTags must be an array of tag names.', []);
+        }
+        out.allowTags = out.allowTags.map((t) => String(t).toLowerCase().replace(/[^a-z0-9-]/g, '')).filter(Boolean);
+    }
+    return out;
+}
 const SECURITY_PRESETS = {
     strict: {
         autoEscape: true,
@@ -71,6 +93,9 @@ export function defineConfig(config) {
         sec.redactLogs = true;
     if (config.routeDataCache === undefined)
         config.routeDataCache = 0;
+    const md = normalizeMdConfig(config.md);
+    if (md !== undefined)
+        config.md = md;
     return config;
 }
 export function validateConfig(config) {

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAoBxD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,WAAW,GAAE,MAAU,GAAG,MAAM,GAAG,IAAI,CAWrG;AAWD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAeD,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEF,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB;IAYxD,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IA6BnG,MAAM,CAAC,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAmB3D,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkBvF,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkBvF,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAO3G,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAWvG,MAAM,CAAC,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkB/G,QAAQ,IAAI,MAAM;IAgBlB,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAclC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAoBxD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,WAAW,GAAE,MAAU,GAAG,MAAM,GAAG,IAAI,CAWrG;AAqCD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgBD,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEF,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB;IAYxD,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IA6BnG,MAAM,CAAC,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAmB3D,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkBvF,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkBvF,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAO3G,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAWvG,MAAM,CAAC,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkB/G,QAAQ,IAAI,MAAM;IAgBlB,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAclC"}

package/dist/errors.js

@@ -31,19 +31,48 @@ export function didYouMean(name, candidates, maxDistance = 3) {
     return best;
 }
 function extractLineColumn(message) {
-    const lineMatch = message.match(/(?:line|at\s+line)\s*(\d+)/i);
-    const colMatch = message.match(/(?:column|col)\s*(\d+)/i);
     return {
-        line: lineMatch ? parseInt(lineMatch[1]) : 0,
-        column: colMatch ? parseInt(colMatch[1]) : 0,
+        line: findKeywordNumber(message, ['at line', 'line']),
+        column: findKeywordNumber(message, ['column', 'col']),
     };
 }
+/**
+ * Finds `<keyword><whitespace>*<digits>` in `message`, trying longer keyword
+ * variants first so 'column' is not matched as 'col' + 'umn'. Char-scan only.
+ */
+function findKeywordNumber(message, keywords) {
+    const lower = message.toLowerCase();
+    for (const kw of keywords) {
+        let from = 0;
+        while (from <= lower.length - kw.length) {
+            const idx = lower.indexOf(kw, from);
+            if (idx === -1)
+                break;
+            // word boundary before the keyword
+            const before = idx > 0 ? lower[idx - 1] : ' ';
+            if (!(before >= 'a' && before <= 'z')) {
+                let j = idx + kw.length;
+                while (j < message.length && (message[j] === ' ' || message[j] === '\t'))
+                    j++;
+                if (message[j] >= '0' && message[j] <= '9') {
+                    let end = j;
+                    while (end < message.length && message[end] >= '0' && message[end] <= '9')
+                        end++;
+                    return parseInt(message.slice(j, end));
+                }
+            }
+            from = idx + 1;
+        }
+    }
+    return 0;
+}
 const VESK_BUILTINS = [
     'useFetch', 'useRouter', 'useParams', 'usePathname', 'useSearchParams',
     'useNavigate', 'useHead', 'useTitle',
     'Form', 'Field', 'Link', 'NavLink', 'Outlet',
     'Image', 'Portal',
     'Experiment',
+    'LoadingIndicator', 'useLoadingIndicator',
     'required', 'email', 'minLength', 'maxLength', 'pattern', 'custom',
     'track', 'get', 'set', 'derived', 'effect', 'batch', 'untrack',
     'cookies', 'headers', 'locals',

package/dist/ir-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ir-generator.d.ts","sourceRoot":"","sources":["../src/ir-generator.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAoBP,MAAM,uBAAuB,CAAC;AA+I/B,wBAAgB,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,cAAc,CAAC,EAAE,GAAG,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;CAAE,CAAC,GAAG,SAAS,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkCnL;AAylBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAwN3D"}
+{"version":3,"file":"ir-generator.d.ts","sourceRoot":"","sources":["../src/ir-generator.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAoBP,MAAM,uBAAuB,CAAC;AA+I/B,wBAAgB,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,cAAc,CAAC,EAAE,GAAG,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;CAAE,CAAC,GAAG,SAAS,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkCnL;AAmsBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CA0N3D"}

package/dist/ir-generator.js

@@ -238,6 +238,20 @@ function processAttribute(source, attr) {
     }
     return { name, value: '' };
 }
+/**
+ * Recognizes a statement-mode `if (cond)` opening among JSX children.
+ * Returns the condition source, or null when `text` does not open an if
+ * header (keyword + balanced parens).
+ */
+function extractIfHeader(text) {
+    if (!startsWithIdentifier(text, 'if'))
+        return null;
+    let i = skipWhitespace(text, 2);
+    if (text[i] !== '(')
+        return null;
+    const end = findBalancedEnd(text, i);
+    return text.slice(i + 1, end).trim();
+}
 function extractForHeader(text) {
     if (!startsWithIdentifier(text, 'for'))
         return null;
@@ -271,6 +285,67 @@ function processJSXChildren(source, children) {
                 i++;
                 continue;
             }
+            // ── statement-mode if / else-if / else among element children ──
+            const ifCond = extractIfHeader(trimmed);
+            const seqNext = children[i + 1];
+            if (ifCond !== null &&
+                seqNext !== undefined &&
+                seqNext.type === 'JSXExpressionContainer' &&
+                seqNext.expression.type !== 'JSXEmptyExpression') {
+                const links = [];
+                let alternate = null;
+                const containerToNodes = (container) => {
+                    const exprNode = container.expression;
+                    if (exprNode.type === 'JSXFragment') {
+                        const inner = [];
+                        for (const c of exprNode.children)
+                            inner.push(...processJSXChildren(source, [c]));
+                        return inner;
+                    }
+                    if (exprNode.type === 'JSXElement')
+                        return processJSXElement(source, exprNode);
+                    return exprToIR(source, exprNode);
+                };
+                links.push({
+                    cond: new Expression(ifCond, [], parseExprNode(ifCond), null),
+                    nodes: containerToNodes(seqNext),
+                });
+                let j = i + 2;
+                while (j < children.length) {
+                    const sep = children[j];
+                    if (sep === undefined || sep.type !== 'JSXText')
+                        break;
+                    const sv = sep.value.trim();
+                    const cont = children[j + 1];
+                    if (sv.startsWith('} else if') || sv.startsWith('else if')) {
+                        const ifIdx = sv.indexOf('if');
+                        const header = extractIfHeader(sv.slice(ifIdx));
+                        if (header === null || cont === undefined || cont.type !== 'JSXExpressionContainer')
+                            break;
+                        links.push({
+                            cond: new Expression(header, [], parseExprNode(header), null),
+                            nodes: containerToNodes(cont),
+                        });
+                        j += 2;
+                        continue;
+                    }
+                    if (sv.startsWith('} else') || sv === 'else') {
+                        if (cont === undefined || cont.type !== 'JSXExpressionContainer')
+                            break;
+                        alternate = containerToNodes(cont);
+                        j += 2;
+                    }
+                    break;
+                }
+                // Fold right-to-left: earlier conditions wrap later ones as alternate.
+                let tail = alternate || [];
+                for (let k = links.length - 1; k >= 0; k--) {
+                    tail = [new OpaqueDynamicRegion(links[k].cond, links[k].nodes, tail)];
+                }
+                result.push(...tail);
+                i = j;
+                continue;
+            }
             const forDecl = extractForHeader(trimmed);
             const nextChild = children[i + 1];
             if (forDecl !== null && nextChild !== undefined && (nextChild.type === 'JSXExpressionContainer' ||
@@ -835,6 +910,37 @@ function processEnum(node, source, exported) {
     const prefix = exported ? `export const ${name}` : `const ${name}`;
     return `${prefix} = { ${allPairs} };`;
 }
+/**
+ * Normalizes any `@vesk/runtime/<subpath>` import specifier to the bare
+ * `'@vesk/runtime'` form. The runtime resolves all subpaths onto the same
+ * module graph, and downstream consumers (client scope injection, chunk
+ * stripping) key off the canonical bare specifier. Char-scan based — no
+ * regex, per repo rule.
+ */
+function normalizeRuntimeSpecifier(stmt) {
+    const fromIdx = stmt.indexOf(' from ');
+    if (fromIdx === -1)
+        return stmt;
+    const q1 = idxOfQuote(stmt, fromIdx);
+    if (q1 === -1)
+        return stmt;
+    const quote = stmt[q1];
+    const q2 = stmt.indexOf(quote, q1 + 1);
+    if (q2 === -1)
+        return stmt;
+    const spec = stmt.slice(q1 + 1, q2);
+    if (spec === '@vesk/runtime' || !spec.startsWith('@vesk/runtime/'))
+        return stmt;
+    return stmt.slice(0, q1 + 1) + '@vesk/runtime' + stmt.slice(q2);
+}
+function idxOfQuote(s, from) {
+    for (let i = from; i < s.length; i++) {
+        const c = s[i];
+        if (c === "'" || c === '"')
+            return i;
+    }
+    return -1;
+}
 export function generateIR(ast, source) {
     __vskAnnotations = ast.__vskAnnotations ?? [];
     const components = [];
@@ -846,9 +952,10 @@ export function generateIR(ast, source) {
     for (const node of ast.body) {
         if (node.type === 'ImportDeclaration') {
             const raw = getSource(source, node);
-            const cleaned = stripTypeImport(raw);
+            let cleaned = stripTypeImport(raw);
             if (cleaned === null)
                 continue;
+            cleaned = normalizeRuntimeSpecifier(cleaned);
             imports.push(cleaned);
             for (const spec of node.specifiers) {
                 if (spec.importKind === 'type')
@@ -991,6 +1098,7 @@ export function generateIR(ast, source) {
         'Link', 'NavLink', 'Outlet', 'Redirect',
         'Image', 'Portal',
         'Experiment',
+        'LoadingIndicator', 'useLoadingIndicator',
         'JsonLd', 'ArticleSchema', 'ProductSchema', 'FAQPageSchema', 'BreadcrumbListSchema',
         'OrganizationSchema', 'LocalBusinessSchema', 'VideoSchema',
         'effect', 'derived', 'untrack', 'peek', 'tick', 'flushSync', 'on_destroy',

package/dist/md-inline.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Rewrites static `content="<file>.md"` attributes on <Md> elements into
+ * inlined constants. Returns the transformed source; when nothing matches,
+ * the original string is returned untouched.
+ *
+ * `mdRoots` are candidate project roots for absolute-style specifiers
+ * ("/x.md"); each root is tried as <root>/public<x> and <root><x>.
+ */
+export declare function inlineMdContentAttrs(source: string, importerDir: string | null, mdRoots?: string[]): string;
+/**
+ * Candidate project roots for absolute-style specifiers: walks up from
+ * `dir` collecting directories that contain a package.json (bounded).
+ */
+export declare function guessProjectRoots(dir: string | null): string[];
+/** Convenience wrapper used by pipelines that already know the file dir. */
+export declare function inlineMdImportsFrom(source: string, importerFile: string | null, mdRoots?: string[]): string;
+//# sourceMappingURL=md-inline.d.ts.map

package/dist/md-inline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"md-inline.d.ts","sourceRoot":"","sources":["../src/md-inline.ts"],"names":[],"mappings":"AA2CA;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,OAAO,GAAE,MAAM,EAAO,GACpB,MAAM,CAoDR;AAoBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAY9D;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM,CAG/G"}