@vesk/compiler 0.1.14 → 0.2.9

package/dist/api-routes.d.ts

@@ -22,9 +22,14 @@ export type BuildWebRequestInput = {
  * `json()`/`text()` are patched accordingly. A `cookies` getter is attached
  * (NextRequest-compatible).
  */
-export declare function buildWebRequest(nodeReq: BuildWebRequestInput, url: string, body?: BodyInit | null): Request & {
+export declare function buildWebRequest(nodeReq: BuildWebRequestInput, url: string, body?: BodyInit | null, options?: {
+    maxBodyBytes?: number;
+}): Request & {
     cookies: Record<string, string>;
     query: Record<string, string>;
 };
+export declare function tooLargeError(max: number): Error & {
+    status: number;
+};
 export declare function executeApiRoute(filePath: string, method: string, request: Request, params?: Record<string, string>, locals?: Record<string, unknown>, devCache?: DevCache): Promise<Response | null>;
 //# sourceMappingURL=api-routes.d.ts.map

package/dist/api-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-routes.d.ts","sourceRoot":"","sources":["../src/api-routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAS7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CAG5D;AA+ED,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,IAAI,CAoDjI;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWhE;AAED,MAAM,WAAW,QAAS,SAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;CAAG;AAExD,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC;CAC/E,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,GACrB,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAqC9E;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACnC,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACpC,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkI1B"}
+{"version":3,"file":"api-routes.d.ts","sourceRoot":"","sources":["../src/api-routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAW7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CAG5D;AA+ED,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,IAAI,CA0DjI;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWhE;AAED,MAAM,WAAW,QAAS,SAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;CAAG;AAExD,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC;CAC/E,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CA4C9E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIrE;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACnC,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACpC,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA0J1B"}

package/dist/api-routes.js

@@ -1,5 +1,7 @@
 import { readdirSync, statSync, existsSync } from 'fs';
 import { join } from 'path';
+import { collapseSlashes } from '@vesk/compiler/src/router';
+import { assertSameOrigin, DEFAULT_MAX_BODY_BYTES } from '@vesk/compiler/src/server-utils';
 function basename(p) {
     const idx = p.lastIndexOf('/');
     return idx === -1 ? p : p.slice(idx + 1);
@@ -69,7 +71,7 @@ function scanApiDir(rootDir, dir, parentPath) {
         : (parentPath || '/');
     const node = {
         path: seg,
-        fullPath: fullPath.replace(/\/+/g, '/') || '/',
+        fullPath: collapseSlashes(fullPath) || '/',
         isDynamic,
         isCatchAll,
         filePath: hasRoute && routeFileName ? join(dir, routeFileName) : null,
@@ -95,7 +97,14 @@ function scanApiDir(rootDir, dir, parentPath) {
     return nodes;
 }
 export function matchApiUrl(tree, pathname) {
-    const normalized = (pathname.split('?')[0].split('#')[0]).replace(/^\/api(\/|$)/, '/');
+    let normalized = pathname.split('?')[0].split('#')[0];
+    // strip a leading /api segment (exact or followed by /) without regex
+    if (normalized === '/api') {
+        normalized = '/';
+    }
+    else if (normalized.startsWith('/api/') && !normalized.startsWith('//')) {
+        normalized = normalized.slice(4);
+    }
     const parts = normalized.split('/').filter(Boolean);
     const params = {};
     function matchNodes(nodes, partIndex) {
@@ -169,7 +178,7 @@ export function parseCookies(str) {
  * `json()`/`text()` are patched accordingly. A `cookies` getter is attached
  * (NextRequest-compatible).
  */
-export function buildWebRequest(nodeReq, url, body) {
+export function buildWebRequest(nodeReq, url, body, options) {
     const parsedUrl = new URL(url, `http://${nodeReq.headers?.host || 'localhost'}`);
     const method = nodeReq.method || 'GET';
     const headers = {};
@@ -183,8 +192,15 @@ export function buildWebRequest(nodeReq, url, body) {
             if (_bodyBuffer)
                 return _bodyBuffer;
             const chunks = [];
-            for await (const chunk of nodeReq)
-                chunks.push(chunk);
+            let total = 0;
+            const max = options?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+            for await (const chunk of nodeReq) {
+                const bytes = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+                total += bytes.byteLength;
+                if (total > max)
+                    throw tooLargeError(max);
+                chunks.push(bytes);
+            }
             _bodyBuffer = Buffer.concat(chunks);
             return _bodyBuffer;
         };
@@ -210,6 +226,11 @@ export function buildWebRequest(nodeReq, url, body) {
     Object.defineProperty(webRequest, 'query', { get: () => query, enumerable: true });
     return webRequest;
 }
+export function tooLargeError(max) {
+    const err = new Error(`Request body exceeds limit (${max} bytes)`);
+    err.status = 413;
+    return err;
+}
 export async function executeApiRoute(filePath, method, request, params = {}, locals = {}, devCache) {
     let mod;
     try {
@@ -224,11 +245,33 @@ export async function executeApiRoute(filePath, method, request, params = {}, lo
         }
     }
     catch (e) {
-        return new Response(JSON.stringify({ error: 'Failed to load route module', details: e.message }), {
+        // details only in dev (devCache present); prod gets a generic message
+        const body = devCache
+            ? { error: 'Failed to load route module', details: e.message }
+            : { error: 'Failed to load route module' };
+        return new Response(JSON.stringify(body), {
             status: 500, headers: { 'Content-Type': 'application/json' },
         });
     }
     const routeConfig = (mod.config || {});
+    // Default CSRF defense for mutating API calls: same-origin check unless the
+    // route opts out via `config.csrf = false`.
+    {
+        const methodUpper = method.toUpperCase();
+        if (routeConfig.csrf !== false && methodUpper !== 'GET' && methodUpper !== 'HEAD' && methodUpper !== 'OPTIONS') {
+            try {
+                assertSameOrigin({
+                    method: methodUpper,
+                    headers: Object.fromEntries([...request.headers.entries()].map(([k, v]) => [k, Array.isArray(v) ? v.join(', ') : v])),
+                });
+            }
+            catch {
+                return new Response(JSON.stringify({ error: 'Cross-origin request blocked' }), {
+                    status: 403, headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        }
+    }
     const handler = mod[method];
     if (!handler) {
         if (method === 'OPTIONS') {
@@ -326,7 +369,9 @@ export async function executeApiRoute(filePath, method, request, params = {}, lo
                 status: 404, headers: { 'Content-Type': 'application/json' },
             });
         }
-        return new Response(JSON.stringify({ error: err.message }), {
+        // never leak internal error messages in production responses
+        const body = devCache ? { error: err.message } : { error: 'Internal Server Error' };
+        return new Response(JSON.stringify(body), {
             status: 500, headers: { 'Content-Type': 'application/json' },
         });
     }

package/dist/client-codegen.d.ts

@@ -14,6 +14,21 @@ export declare function compileClient(source: string, _componentName: string | n
     forceClient?: boolean;
     hydrate?: boolean;
     includeTopLevel?: boolean;
+    sourcePath?: string;
+    mdRoots?: string[];
 }): string;
+/**
+ * Compiles a component source in BOTH client modes (plain + hydrate)
+ * sharing a single parse/IR pass. Used by the dev-server hot path, where
+ * every edit otherwise pays the full acorn+TS parse twice. Also returns
+ * the resolved component name using the exact selection order of
+ * `resolveComponentName`, so callers don't need a second full parse just
+ * to learn the name.
+ */
+export declare function compileClientBoth(source: string, _componentName: string | null): {
+    comp: string;
+    hyd: string;
+    name: string | null;
+};
 export { compileClient as compile, isStaticIR };
 //# sourceMappingURL=client-codegen.d.ts.map

package/dist/client-codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-codegen.d.ts","sourceRoot":"","sources":["../src/client-codegen.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAuB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAGL,cAAc,EAQd,gBAAgB,EAOjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAsCxD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAwGlI;AAID,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAU5E;AAqjCD,iBAAS,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAe3C;AA2HD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO9C;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CA0D1K;AAED,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"client-codegen.d.ts","sourceRoot":"","sources":["../src/client-codegen.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAuB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAGL,cAAc,EAQd,gBAAgB,EAOjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAwCxD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI1D;AAoBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAwGlI;AAID,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAU5E;AAqjCD,iBAAS,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAe3C;AA2HD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO9C;AAoED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,MAAM,CAOnN;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAqBnI;AAED,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/client-codegen.js

@@ -1,12 +1,15 @@
 import { walk } from 'zimmerframe';
 import { print } from 'esrap';
 import ts from 'esrap/languages/ts';
+import tsx from 'esrap/languages/tsx';
 import { StaticNode, TextNode, DynamicBinding, OpaqueDynamicRegion, MapRegion, WhileLoop, SwitchBlock, TryCatch, ForLoop, TrackDecl, RuntimeStatement, ComponentRef, ComponentCall, ServerBlock, ClientBlock, HeadBlock, SlotNode, } from '@vesk/compiler/src/ir';
 import { parse } from '@vesk/compiler/src/parser';
 import { generateIR } from '@vesk/compiler/src/ir-generator';
 import { transformTopLevelForActions } from '@vesk/compiler/src/actions';
 import { extractRuntimeNames } from '@vesk/compiler/src/server-utils';
+import { importBindingPairs } from '@vesk/compiler/src/module-imports';
 import { stripTrackGeneric } from '@vesk/compiler/src/scan';
+import { inlineMdImportsFrom } from '@vesk/compiler/src/md-inline';
 import { stripTsTypes, hasTsSyntax } from '@vesk/compiler/src/strip-ts';
 function memberExpr(object, property) {
     return {
@@ -44,6 +47,28 @@ export function semicolonizeStatement(code) {
         return code;
     return code + ';';
 }
+function containsJsx(node, depth = 0) {
+    if (!node || typeof node !== 'object' || depth > 40)
+        return false;
+    if (Array.isArray(node)) {
+        for (const item of node) {
+            if (containsJsx(item, depth + 1))
+                return true;
+        }
+        return false;
+    }
+    if (typeof node.type === 'string' && (node.type === 'JSXElement' || node.type === 'JSXFragment'))
+        return true;
+    for (const key of Object.keys(node)) {
+        const v = node[key];
+        if (v && typeof v === 'object' && containsJsx(v, depth + 1))
+            return true;
+    }
+    return false;
+}
+function printAst(ast) {
+    return print(ast, containsJsx(ast) ? tsx() : ts()).code;
+}
 export function transformTracked(irNode, tracked) {
     const ast = irNode.ast;
     if (!ast)
@@ -51,7 +76,7 @@ export function transformTracked(irNode, tracked) {
     if (tracked.size === 0) {
         if (!hasTsSyntax(ast))
             return irNode.raw;
-        return print(stripTsTypes(ast), ts()).code;
+        return printAst(stripTsTypes(ast));
     }
     const stripped = stripTsTypes(ast);
     const transformed = walk(stripped, tracked, {
@@ -139,7 +164,7 @@ export function transformTracked(irNode, tracked) {
             return context.next();
         },
     });
-    return print(transformed, ts()).code;
+    return print(transformed, containsJsx(transformed) ? tsx() : ts()).code;
 }
 export function collectTrackedNames(body) {
     const names = new Map();
@@ -1458,15 +1483,13 @@ function hasKeyedMap(nodes) {
 }
 export function escapeHtml(str) {
     return str
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
+        .split('&').join('&amp;')
+        .split('<').join('&lt;')
+        .split('>').join('&gt;')
+        .split('"').join('&quot;')
+        .split("'").join('&#39;');
 }
-export function compileClient(source, _componentName, options = {}) {
-    const ast = parse(source);
-    const ir = generateIR(ast, source);
+function emitClientFromIR(ir, options) {
     const needsClient = ir.components.some((c) => c.isClient || !isStaticComponent(c));
     if (!options.forceClient && !needsClient) {
         return '';
@@ -1510,7 +1533,16 @@ export function compileClient(source, _componentName, options = {}) {
             runtimeNames.push(name);
         }
     }
-    const runtimeImport = `import { ${runtimeNames.join(', ')} } from '@vesk/runtime';`;
+    // A name the file already binds via its own imports (e.g. a local module that
+    // exports its own `effect`) shadows the runtime binding — never inject a
+    // duplicate `import { x } from '@vesk/runtime'`. Mirrors SSR, so the two agree.
+    const boundLocally = new Set();
+    for (const imp of ir.imports) {
+        for (const pair of importBindingPairs(imp))
+            boundLocally.add(pair.local);
+    }
+    const shadowedRuntimeNames = runtimeNames.filter(n => !boundLocally.has(n));
+    const runtimeImport = `import { ${shadowedRuntimeNames.length > 0 ? shadowedRuntimeNames.join(', ') : 'destroy_block'} } from '@vesk/runtime';`;
     const moduleCode = `
 ${runtimeImport}
 ${importLines}
@@ -1520,4 +1552,45 @@ ${exportCode}
 `;
     return moduleCode.trim();
 }
+export function compileClient(source, _componentName, options = {}) {
+    if (options.sourcePath) {
+        source = inlineMdImportsFrom(source, options.sourcePath, options.mdRoots || []);
+    }
+    const ast = parse(source);
+    const ir = generateIR(ast, source);
+    return emitClientFromIR(ir, options);
+}
+/**
+ * Compiles a component source in BOTH client modes (plain + hydrate)
+ * sharing a single parse/IR pass. Used by the dev-server hot path, where
+ * every edit otherwise pays the full acorn+TS parse twice. Also returns
+ * the resolved component name using the exact selection order of
+ * `resolveComponentName`, so callers don't need a second full parse just
+ * to learn the name.
+ */
+export function compileClientBoth(source, _componentName) {
+    const ast = parse(source);
+    // Downstream type-stripping mutates AST nodes in place (stripTsTypes),
+    // so each emit mode needs its own tree. Cloning is far cheaper than the
+    // second full acorn+TS parse this replaces.
+    const hydAst = structuredClone(ast);
+    const ir = generateIR(ast, source);
+    const irHyd = generateIR(hydAst, source);
+    const defaultComp = ir.components.find((c) => c.defaultExport);
+    let name = null;
+    if (defaultComp)
+        name = defaultComp.name;
+    else if (ir.components.length > 0)
+        name = ir.components[0].name;
+    else {
+        const exportedComp = ir.components.find((c) => c.exported);
+        if (exportedComp)
+            name = exportedComp.name;
+    }
+    return {
+        comp: emitClientFromIR(ir, { forceClient: true }),
+        hyd: emitClientFromIR(irHyd, { forceClient: true, hydrate: true, includeTopLevel: false }),
+        name,
+    };
+}
 export { compileClient as compile, isStaticIR };

package/dist/config.d.ts

@@ -1,4 +1,6 @@
 import type { VeskConfig, VeskPlugin, VeskSecurity } from '@vesk/compiler/src/types';
+/** Tags allowed by default when md.html = 'allowlist' and no allowTags given. */
+export declare const MD_DEFAULT_ALLOW_TAGS: string[];
 export declare function preset(name: string, overrides?: VeskSecurity): VeskSecurity;
 export declare function definePlugin<P extends VeskPlugin>(plugin: P): P;
 export declare function defineConfig(config: VeskConfig): VeskConfig;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAsB,MAAM,0BAA0B,CAAC;AA0BzG,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,YAAiB,GAAG,YAAY,CAY/E;AAED,wBAAgB,YAAY,CAAC,CAAC,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAQ/D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAqB3D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAkC7D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAgC,MAAM,0BAA0B,CAAC;AAGnH,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AA6CF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,YAAiB,GAAG,YAAY,CAY/E;AAED,wBAAgB,YAAY,CAAC,CAAC,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAQ/D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAuB3D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAkC7D"}

package/dist/config.js

@@ -1,4 +1,26 @@
 import { VeskError } from '@vesk/compiler/src/errors';
+/** Tags allowed by default when md.html = 'allowlist' and no allowTags given. */
+export const MD_DEFAULT_ALLOW_TAGS = [
+    'a', 'abbr', 'b', 'bdi', 'bdo', 'br', 'cite', 'code', 'data', 'del', 'dfn', 'em',
+    'i', 'ins', 'kbd', 'mark', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'small', 'span',
+    'strong', 'sub', 'sup', 'time', 'u', 'var', 'wbr',
+];
+const MD_HTML_MODES = ['escape', 'allow', 'allowlist'];
+function normalizeMdConfig(md) {
+    if (!md || typeof md !== 'object')
+        return md;
+    if (md.html !== undefined && !MD_HTML_MODES.includes(md.html)) {
+        throw VeskError.configError(`Unknown md.html mode: "${md.html}".`, MD_HTML_MODES);
+    }
+    const out = { ...md };
+    if (out.allowTags) {
+        if (!Array.isArray(out.allowTags)) {
+            throw VeskError.configError('md.allowTags must be an array of tag names.', []);
+        }
+        out.allowTags = out.allowTags.map((t) => String(t).toLowerCase().replace(/[^a-z0-9-]/g, '')).filter(Boolean);
+    }
+    return out;
+}
 const SECURITY_PRESETS = {
     strict: {
         autoEscape: true,
@@ -71,6 +93,9 @@ export function defineConfig(config) {
         sec.redactLogs = true;
     if (config.routeDataCache === undefined)
         config.routeDataCache = 0;
+    const md = normalizeMdConfig(config.md);
+    if (md !== undefined)
+        config.md = md;
     return config;
 }
 export function validateConfig(config) {

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAoBxD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,WAAW,GAAE,MAAU,GAAG,MAAM,GAAG,IAAI,CAWrG;AAWD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAeD,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEF,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB;IAYxD,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IA6BnG,MAAM,CAAC,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAmB3D,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkBvF,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkBvF,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAO3G,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAWvG,MAAM,CAAC,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkB/G,QAAQ,IAAI,MAAM;IAgBlB,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAclC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAoBxD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,WAAW,GAAE,MAAU,GAAG,MAAM,GAAG,IAAI,CAWrG;AAqCD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgBD,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEF,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB;IAYxD,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IA6BnG,MAAM,CAAC,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAmB3D,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkBvF,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkBvF,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAO3G,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAWvG,MAAM,CAAC,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS;IAkB/G,QAAQ,IAAI,MAAM;IAgBlB,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAclC"}

package/dist/errors.js

@@ -31,19 +31,48 @@ export function didYouMean(name, candidates, maxDistance = 3) {
     return best;
 }
 function extractLineColumn(message) {
-    const lineMatch = message.match(/(?:line|at\s+line)\s*(\d+)/i);
-    const colMatch = message.match(/(?:column|col)\s*(\d+)/i);
     return {
-        line: lineMatch ? parseInt(lineMatch[1]) : 0,
-        column: colMatch ? parseInt(colMatch[1]) : 0,
+        line: findKeywordNumber(message, ['at line', 'line']),
+        column: findKeywordNumber(message, ['column', 'col']),
     };
 }
+/**
+ * Finds `<keyword><whitespace>*<digits>` in `message`, trying longer keyword
+ * variants first so 'column' is not matched as 'col' + 'umn'. Char-scan only.
+ */
+function findKeywordNumber(message, keywords) {
+    const lower = message.toLowerCase();
+    for (const kw of keywords) {
+        let from = 0;
+        while (from <= lower.length - kw.length) {
+            const idx = lower.indexOf(kw, from);
+            if (idx === -1)
+                break;
+            // word boundary before the keyword
+            const before = idx > 0 ? lower[idx - 1] : ' ';
+            if (!(before >= 'a' && before <= 'z')) {
+                let j = idx + kw.length;
+                while (j < message.length && (message[j] === ' ' || message[j] === '\t'))
+                    j++;
+                if (message[j] >= '0' && message[j] <= '9') {
+                    let end = j;
+                    while (end < message.length && message[end] >= '0' && message[end] <= '9')
+                        end++;
+                    return parseInt(message.slice(j, end));
+                }
+            }
+            from = idx + 1;
+        }
+    }
+    return 0;
+}
 const VESK_BUILTINS = [
     'useFetch', 'useRouter', 'useParams', 'usePathname', 'useSearchParams',
     'useNavigate', 'useHead', 'useTitle',
     'Form', 'Field', 'Link', 'NavLink', 'Outlet',
     'Image', 'Portal',
     'Experiment',
+    'LoadingIndicator', 'useLoadingIndicator',
     'required', 'email', 'minLength', 'maxLength', 'pattern', 'custom',
     'track', 'get', 'set', 'derived', 'effect', 'batch', 'untrack',
     'cookies', 'headers', 'locals',

package/dist/ir-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ir-generator.d.ts","sourceRoot":"","sources":["../src/ir-generator.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAoBP,MAAM,uBAAuB,CAAC;AA+I/B,wBAAgB,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,cAAc,CAAC,EAAE,GAAG,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;CAAE,CAAC,GAAG,SAAS,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkCnL;AAylBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAwN3D"}
+{"version":3,"file":"ir-generator.d.ts","sourceRoot":"","sources":["../src/ir-generator.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAoBP,MAAM,uBAAuB,CAAC;AAgJ/B,wBAAgB,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,cAAc,CAAC,EAAE,GAAG,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;CAAE,CAAC,GAAG,SAAS,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkCnL;AAuxBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAiO3D"}