@webjsdev/core 0.7.46 → 0.7.48

package/src/render-server.js

@@ -1,7 +1,14 @@
 import { html, isTemplate } from './html.js';
 import { BINDING_PREFIXES } from './binding-prefixes.js';
 import { escapeText, escapeAttr } from './escape.js';
-import { assertNotFunctionActionAttr, assertNotFunctionReflectedActionProp } from './form-action.js';
+import {
+  assertNotFunctionActionAttr, assertNotFunctionReflectedActionProp,
+  assertIdentifiableAction, bindFormActionStartTag, isBoundFormAction, resolveFormActionId,
+  assertConvergentBoundForm, assertSubmitterHasNoName, assertSubmitterHasNoValue,
+  assertSubmitterHasNoFormAttribute,
+  assertSingleSubmitterAction, bindSubmitterStartTag, parseStartTagAttrs,
+  isSubmitterReflectedProp, FORM_ACTION_FIELD,
+} from './form-action.js';
 import { lookup, lookupModuleUrl, allTags } from './registry.js';
 import { stylesToString, isCSS } from './css.js';
 import { isRepeat } from './repeat.js';
@@ -26,8 +33,16 @@ import { cspNonce } from './csp-nonce.js';
  *
  * @typedef {{ pending: {id: string, promise: Promise<unknown>}[], nextId: number }} SuspenseCtx
  *
+ * A boundary's enclosing form scope used to be recorded here and threaded back
+ * in (#1207), because the page pipeline in `@webjsdev/server` drains
+ * `ctx.pending` and re-renders each resolved child through a FRESH scan with no
+ * view of the shell it belongs to, so a `<button formaction=${fn}>` inside a
+ * bound form's Suspense boundary read as form-less and was refused. Gone with
+ * #1307: a bound submitter carries its own `formmethod` and enctype, so no
+ * renderer needs to know what encloses it and there is nothing left to thread.
+ *
  * @param {unknown} value
- * @param {{ ssr?: boolean, suspenseCtx?: SuspenseCtx }} [opts]
+ * @param {{ ssr?: boolean, suspenseCtx?: SuspenseCtx, dev?: boolean }} [opts]
  * @returns {Promise<string>}
  */
 export async function renderToString(value, opts = { ssr: true }) {
@@ -152,6 +167,117 @@ async function renderTemplate(tr, ctx) {
   let commentDashes = 0;
   let currentTag = '';   // lowercased tag name currently being parsed
   let rawTail = '';      // rolling lowercased tail, tracks </script>/</style>
+  let tagStart = -1;     // index in `out` of the `<` opening the current tag
+  /** @type {string | null} */
+  let pendingActionId = null;  // identity of a bound form action, until the tag closes
+  /** @type {string | null} */
+  let pendingSubmitterTag = null;  // tag of a bound submitter, until it closes
+  // Shapes on the CURRENT start tag that a bound form may not carry (#1155).
+  // Collected as the tag is scanned and judged at its `>`, because the action
+  // hole may come after them.
+  let pendingActionCount = 0;
+  /** @type {string[]} */
+  let pendingPropAttrs = [];
+  /** @type {string[]} */
+  let pendingSubmitterProps = [];
+  // Whether the tag stream is currently inside a form that BOUND an action
+  // (#1207), as THIS scan can see it. Three states, and the third is the point:
+  //   'bound'   an enclosing <form> opened here and bound an action
+  //   'unbound' an enclosing <form> opened here and bound nothing
+  //   'none'    there is conclusively no enclosing <form>
+  //   'unknown' there may be one, but this scan cannot see it
+  //
+  // The last two look alike and must not be merged, which is what a boolean did.
+  // A component's template is rendered by a SEPARATE pass (`injectDSD` calls
+  // `render` on it), so a `<button formaction=${fn}>` inside a component inside
+  // a bound form read as "no form", was refused, and in production vanished
+  // from a page that still returned 200. That pass now says 'unknown' and the
+  // boundness question is skipped, exactly as the client skips it when it
+  // cannot reach the form, so both renderers are best effort in the same place
+  // and for the same reason. A top-level scan that simply contains no form
+  // stays 'none' and is still refused, because there the answer IS known.
+  //
+  let isCloseTag = false;
+
+  // A bound `action=${fn}` is committed at its hole, but the edits it implies
+  // (forcing `method` / `enctype`, and the hidden identity field) are only
+  // possible once the whole start tag is known: an attribute the author wrote
+  // AFTER the action hole still counts, and the hidden field belongs INSIDE
+  // the form, after the `>`. So the hole records the identity and this runs at
+  // the `>`, rewriting the start tag that was just emitted.
+  const closeBoundFormTag = () => {
+    // Reset per tag whether or not this one was bound, so a later form is never
+    // judged on an earlier tag's shapes.
+    const propAttrs = pendingPropAttrs;
+    const submitterProps = pendingSubmitterProps;
+    const duplicateAction = pendingActionCount > 1;
+    const submitterTag = pendingSubmitterTag;
+    pendingPropAttrs = [];
+    pendingSubmitterProps = [];
+    pendingActionCount = 0;
+    pendingSubmitterTag = null;
+    if (pendingActionId != null) {
+      assertConvergentBoundForm({ duplicateAction, propAttrs });
+      const bound = bindFormActionStartTag(out.slice(tagStart), pendingActionId);
+      out = out.slice(0, tagStart) + bound.tag + bound.hidden;
+      pendingActionId = null;
+    }
+    if (submitterTag != null) {
+      // #1307: a bound submitter carries its WHOLE submission, so `formmethod`
+      // and the enctype are injected onto the button here rather than inherited
+      // from a form this scan may not even be able to see. That is what removed
+      // the enclosing-form question, and with it the four-state scope tracking
+      // that could never answer it for a button inside a component.
+      out = out.slice(0, tagStart)
+        + bindSubmitterStartTag(out.slice(tagStart), submitterTag, { duplicateAction, propAttrs: submitterProps });
+    }
+  };
+  // #1155: a `.method` / `.enctype` / `.encoding` prop on a form is dropped
+  // here but applied for real in the browser, where all three are reflected IDL
+  // attributes, so a bound form carrying one submits differently with JS than
+  // without it. Recorded and refused at the `>`, once the tag's action hole is
+  // known.
+  const notePropAttr = (name, tag) => {
+    const t = String(tag).toLowerCase();
+    if (t === 'button' || t === 'input') {
+      // #1207: the submitter twin. `name` / `value` / `formAction` / `formMethod`
+      // / `formEnctype` all reflect on a submitter, so a `.prop` spelling is
+      // dropped here and written to the attribute in the browser.
+      if (isSubmitterReflectedProp(name)) pendingSubmitterProps.push(String(name));
+      return;
+    }
+    if (t !== 'form') return;
+    let n = String(name).toLowerCase();
+    if (n === 'encoding') n = 'enctype';
+    if (n === 'method' || n === 'enctype') pendingPropAttrs.push(String(name));
+  };
+  const noteActionHole = (name, tag) => {
+    const t = String(tag).toLowerCase();
+    const n = String(name).toLowerCase();
+    if ((t === 'form' && n === 'action') ||
+        ((t === 'button' || t === 'input') && n === 'formaction')) {
+      pendingActionCount += 1;
+    }
+  };
+
+  // Every `>` in a tag state funnels through here, so the bound-form bookkeeping
+  // stays in one place rather than at five call sites.
+  //
+  // `allowRawtext` is NOT a preference. Only two of those five call sites ever
+  // entered rawtext: the `tag-name` and `in-tag` exits. The three attribute
+  // exits (`attr-name`, `after-eq`, `attr-unquoted`) always forced `text`, so
+  // `<script defer>` and `<style media=print>`, whose start tags end on a bare
+  // or unquoted attribute, escaped their bodies. Switching them to rawtext here
+  // would silently turn `<script defer>${userInput}</script>` from escaped into
+  // raw script, which is an XSS mitigation this change has no business
+  // touching. Whether that escaping is the RIGHT behaviour is a separate
+  // question from #1207; this preserves it exactly.
+  const handleTagEnd = (allowRawtext) => {
+    closeBoundFormTag();
+    isCloseTag = false;
+    state = allowRawtext && isRawtextTag(currentTag) ? 'rawtext' : 'text';
+    if (state === 'rawtext') rawTail = '';
+  };
 
   for (let i = 0; i < strings.length; i++) {
     const s = strings[i];
@@ -160,12 +286,12 @@ async function renderTemplate(tr, ctx) {
       switch (state) {
         case 'text':
           out += c;
-          if (c === '<') state = 'tag-open';
+          if (c === '<') { state = 'tag-open'; tagStart = out.length - 1; isCloseTag = false; }
           break;
         case 'tag-open':
           out += c;
           if (c === '!') state = 'bang-1';
-          else if (c === '/') { state = 'tag-name'; currentTag = ''; }
+          else if (c === '/') { state = 'tag-name'; currentTag = ''; isCloseTag = true; }
           else if (/[a-zA-Z]/.test(c)) { state = 'tag-name'; currentTag = c.toLowerCase(); }
           else state = 'text';
           break;
@@ -187,16 +313,14 @@ async function renderTemplate(tr, ctx) {
         case 'tag-name':
           out += c;
           if (c === '>') {
-            state = isRawtextTag(currentTag) ? 'rawtext' : 'text';
-            if (state === 'rawtext') rawTail = '';
+            handleTagEnd(true);
           } else if (/\s/.test(c)) state = 'in-tag';
           else currentTag += c.toLowerCase();
           break;
         case 'in-tag':
           out += c;
           if (c === '>') {
-            state = isRawtextTag(currentTag) ? 'rawtext' : 'text';
-            if (state === 'rawtext') rawTail = '';
+            handleTagEnd(true);
           } else if (!/\s/.test(c) && c !== '/') {
             state = 'attr-name';
             attrName = c;
@@ -215,18 +339,18 @@ async function renderTemplate(tr, ctx) {
         case 'attr-name':
           if (c === '=') { state = 'after-eq'; out += c; }
           else if (/\s/.test(c)) { state = 'in-tag'; attrName = ''; out += c; }
-          else if (c === '>') { state = 'text'; attrName = ''; out += c; }
+          else if (c === '>') { state = 'text'; attrName = ''; out += c; handleTagEnd(false); }
           else { attrName += c; out += c; }
           break;
         case 'after-eq':
           if (c === '"' || c === "'") { state = 'attr-quoted'; attrQuote = c; out += c; }
           else if (/\s/.test(c)) { state = 'in-tag'; attrName = ''; out += c; }
-          else if (c === '>') { state = 'text'; attrName = ''; out += c; }
+          else if (c === '>') { state = 'text'; attrName = ''; out += c; handleTagEnd(false); }
           else { state = 'attr-unquoted'; out += c; }
           break;
         case 'attr-unquoted':
           if (/\s/.test(c)) { state = 'in-tag'; attrName = ''; out += c; }
-          else if (c === '>') { state = 'text'; attrName = ''; out += c; }
+          else if (c === '>') { state = 'text'; attrName = ''; out += c; handleTagEnd(false); }
           else out += c;
           break;
         case 'attr-quoted':
@@ -301,6 +425,7 @@ async function renderTemplate(tr, ctx) {
             // property is a plain expando that reflects nothing, so refusing
             // it would be a false positive.
             assertNotFunctionReflectedActionProp(val, name, currentTag);
+            notePropAttr(name, currentTag);
             state = 'in-tag';
             attrName = '';
             continue;
@@ -338,7 +463,50 @@ async function renderTemplate(tr, ctx) {
           if (val) out += `${name}=""`;
           state = 'in-tag';
           attrName = '';
+        } else if (isBoundFormAction(val, attrName, currentTag)) {
+          noteActionHole(attrName, currentTag);
+          if (currentTag === 'form') {
+            // #1155: the form-level binding. Drop the `action=` attribute
+            // entirely so the form posts to the page's own url (an omitted
+            // attribute, not `action=""`, which the spec calls a conformance
+            // error), and remember the identity so the `>` can force the
+            // submission attributes and emit the hidden field.
+            pendingActionId = assertIdentifiableAction(await resolveFormActionId(val), currentTag);
+            // Trailing whitespace goes with the attribute: every injected
+            // attribute carries its own leading space, so keeping the old one
+            // would double it in the emitted tag.
+            out = out.slice(0, attrStart).replace(/\s+$/, '');
+          } else {
+            // #1207: the submitter binding. The identity replaces the
+            // `formaction=` hole IN PLACE with the button's own name/value
+            // pair, the one channel a browser submits for the pressed button
+            // alone. No `formaction` url is emitted, so the submission still
+            // targets the page and the form-level identity is simply overridden
+            // by this later entry.
+            //
+            // Refused here rather than at the `>` only where the answer cannot
+            // change later: boundness of the ENCLOSING form is already decided
+            // (its start tag is emitted), and an attribute written BEFORE the
+            // hole is already in `out`. Everything else waits for the close,
+            // where `assertSubmitterStartTag` sees the whole tag.
+            // A second binding hole on this same tag, refused here so the
+            // author gets the duplicate message rather than a confusing
+            // complaint about the `name` the FIRST hole just injected.
+            assertSingleSubmitterAction(pendingSubmitterTag != null, currentTag);
+            const attrs = parseStartTagAttrs(out.slice(tagStart));
+            if (attrs.has('name')) assertSubmitterHasNoName(attrs.get('name') || '', currentTag, false);
+            if (attrs.has('value')) assertSubmitterHasNoValue(currentTag);
+            if (attrs.has('form')) assertSubmitterHasNoFormAttribute(currentTag);
+            const subId = assertIdentifiableAction(await resolveFormActionId(val), currentTag);
+            pendingSubmitterTag = currentTag;
+            out = out.slice(0, attrStart) + `name="${FORM_ACTION_FIELD}" value="${escapeAttr(subId)}"`;
+          }
+          state = 'in-tag';
+          attrName = '';
         } else {
+          // A second `action` hole that resolved to a plain url still COUNTS,
+          // so the duplicate refusal fires whatever the values happen to be.
+          noteActionHole(attrName, currentTag);
           // #1154: never stringify a function into action=/formaction= (it
           // would serialize a server action's source into the served HTML).
           assertNotFunctionActionAttr(val, attrName, currentTag);
@@ -864,7 +1032,14 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
       // Render the template to HTML. injectDSD recurses on the result so
       // nested custom elements (e.g. <theme-toggle> inside <blog-shell>)
       // get their own DSD pass.
-      const rawInner = await render(tpl, ctx);
+      // 'unknown' for the form scope (#1207): this is a SEPARATE render pass
+      // over one component's own template, driven by walking the already-emitted
+      // HTML, so it has no idea whether the host tag sits inside a bound
+      // `<form>`. Passing the default 'none' claimed there was no form at all,
+      // which refused a perfectly good `<button formaction=${fn}>` in a
+      // component inside a bound form and, because component SSR errors are
+      // isolated, made the button vanish from a page that still returned 200.
+      const rawInner = await render(tpl, ctx, 'unknown');
 
       if (isShadow) {
         // Shadow DOM: native <slot> stays as-is in the DSD template. The
@@ -1657,7 +1832,7 @@ export function renderToStream(value, opts = { ssr: true }) {
       try {
         if (opts && opts.ssr === false) {
           // No DSD injection: just stream the raw rendered chunks.
-          await streamRender(value, ctx, controller);
+          await streamRender(value, ctx, controller, 'none');
         } else {
           // Render to string first to run DSD injection (which operates on
           // the full HTML), then enqueue the result. This matches the
@@ -1790,6 +1965,87 @@ async function streamTemplate(tr, ctx, controller) {
   let rawTail = '';
   // Buffer used for attribute handling where we may need to backtrack.
   let buf = '';
+  let tagStart = -1;
+  /** @type {string | null} */
+  let pendingActionId = null;
+  // Shapes on the CURRENT start tag that a bound form may not carry (#1155).
+  // Collected as the tag is scanned and judged at its `>`, because the action
+  // hole may come after them.
+  let pendingActionCount = 0;
+  /** @type {string[]} */
+  let pendingPropAttrs = [];
+  /** @type {string[]} */
+  let pendingSubmitterProps = [];
+  /** @type {string | null} */
+  let pendingSubmitterTag = null;  // tag of a bound submitter, until it closes
+  // See the buffered machine: seeded from the caller so a nested template
+  // rendered into a bound form's children knows it is inside one.
+  let isCloseTag = false;
+
+  // See the buffered machine for why this runs at the `>` rather than at the
+  // hole. `tagStart` indexes into `buf`, which is safe because `buf` is only
+  // flushed on a `text`-state hole and a start tag contains none.
+  const closeBoundFormTag = () => {
+    // Reset per tag whether or not this one was bound, so a later form is never
+    // judged on an earlier tag's shapes.
+    const propAttrs = pendingPropAttrs;
+    const submitterProps = pendingSubmitterProps;
+    const duplicateAction = pendingActionCount > 1;
+    const submitterTag = pendingSubmitterTag;
+    pendingPropAttrs = [];
+    pendingSubmitterProps = [];
+    pendingActionCount = 0;
+    pendingSubmitterTag = null;
+    if (pendingActionId != null) {
+      assertConvergentBoundForm({ duplicateAction, propAttrs });
+      const bound = bindFormActionStartTag(buf.slice(tagStart), pendingActionId);
+      buf = buf.slice(0, tagStart) + bound.tag + bound.hidden;
+      pendingActionId = null;
+    }
+    if (submitterTag != null) {
+      // #1307, the SAME injection as the buffered machine, through the same
+      // helper, so this second state machine cannot drift from it.
+      buf = buf.slice(0, tagStart)
+        + bindSubmitterStartTag(buf.slice(tagStart), submitterTag, { duplicateAction, propAttrs: submitterProps });
+    }
+  };
+  // #1155: a `.method` / `.enctype` / `.encoding` prop on a form is dropped
+  // here but applied for real in the browser, where all three are reflected IDL
+  // attributes, so a bound form carrying one submits differently with JS than
+  // without it. Recorded and refused at the `>`, once the tag's action hole is
+  // known.
+  const notePropAttr = (name, tag) => {
+    const t = String(tag).toLowerCase();
+    if (t === 'button' || t === 'input') {
+      // #1207: the submitter twin. `name` / `value` / `formAction` / `formMethod`
+      // / `formEnctype` all reflect on a submitter, so a `.prop` spelling is
+      // dropped here and written to the attribute in the browser.
+      if (isSubmitterReflectedProp(name)) pendingSubmitterProps.push(String(name));
+      return;
+    }
+    if (t !== 'form') return;
+    let n = String(name).toLowerCase();
+    if (n === 'encoding') n = 'enctype';
+    if (n === 'method' || n === 'enctype') pendingPropAttrs.push(String(name));
+  };
+  const noteActionHole = (name, tag) => {
+    const t = String(tag).toLowerCase();
+    const n = String(name).toLowerCase();
+    if ((t === 'form' && n === 'action') ||
+        ((t === 'button' || t === 'input') && n === 'formaction')) {
+      pendingActionCount += 1;
+    }
+  };
+
+  // Same contract as the buffered machine, `allowRawtext` included: only the
+  // `tag-name` and `in-tag` exits ever entered rawtext here either, so a start
+  // tag ending on a bare or unquoted attribute must keep escaping its body.
+  const handleTagEnd = (allowRawtext) => {
+    closeBoundFormTag();
+    isCloseTag = false;
+    state = allowRawtext && isRawtextTag(currentTag) ? 'rawtext' : 'text';
+    if (state === 'rawtext') rawTail = '';
+  };
 
   for (let i = 0; i < strings.length; i++) {
     const s = strings[i];
@@ -1798,12 +2054,12 @@ async function streamTemplate(tr, ctx, controller) {
       switch (state) {
         case 'text':
           buf += c;
-          if (c === '<') state = 'tag-open';
+          if (c === '<') { state = 'tag-open'; tagStart = buf.length - 1; isCloseTag = false; }
           break;
         case 'tag-open':
           buf += c;
           if (c === '!') state = 'bang-1';
-          else if (c === '/') { state = 'tag-name'; currentTag = ''; }
+          else if (c === '/') { state = 'tag-name'; currentTag = ''; isCloseTag = true; }
           else if (/[a-zA-Z]/.test(c)) { state = 'tag-name'; currentTag = c.toLowerCase(); }
           else state = 'text';
           break;
@@ -1825,16 +2081,14 @@ async function streamTemplate(tr, ctx, controller) {
         case 'tag-name':
           buf += c;
           if (c === '>') {
-            state = isRawtextTag(currentTag) ? 'rawtext' : 'text';
-            if (state === 'rawtext') rawTail = '';
+            handleTagEnd(true);
           } else if (/\s/.test(c)) state = 'in-tag';
           else currentTag += c.toLowerCase();
           break;
         case 'in-tag':
           buf += c;
           if (c === '>') {
-            state = isRawtextTag(currentTag) ? 'rawtext' : 'text';
-            if (state === 'rawtext') rawTail = '';
+            handleTagEnd(true);
           } else if (!/\s/.test(c) && c !== '/') {
             state = 'attr-name';
             attrName = c;
@@ -1853,18 +2107,18 @@ async function streamTemplate(tr, ctx, controller) {
         case 'attr-name':
           if (c === '=') { state = 'after-eq'; buf += c; }
           else if (/\s/.test(c)) { state = 'in-tag'; attrName = ''; buf += c; }
-          else if (c === '>') { state = 'text'; attrName = ''; buf += c; }
+          else if (c === '>') { state = 'text'; attrName = ''; buf += c; handleTagEnd(false); }
           else { attrName += c; buf += c; }
           break;
         case 'after-eq':
           if (c === '"' || c === "'") { state = 'attr-quoted'; attrQuote = c; buf += c; }
           else if (/\s/.test(c)) { state = 'in-tag'; attrName = ''; buf += c; }
-          else if (c === '>') { state = 'text'; attrName = ''; buf += c; }
+          else if (c === '>') { state = 'text'; attrName = ''; buf += c; handleTagEnd(false); }
           else { state = 'attr-unquoted'; buf += c; }
           break;
         case 'attr-unquoted':
           if (/\s/.test(c)) { state = 'in-tag'; attrName = ''; buf += c; }
-          else if (c === '>') { state = 'text'; attrName = ''; buf += c; }
+          else if (c === '>') { state = 'text'; attrName = ''; buf += c; handleTagEnd(false); }
           else buf += c;
           break;
         case 'attr-quoted':
@@ -1905,10 +2159,25 @@ async function streamTemplate(tr, ctx, controller) {
           // (and `.formAction` on a button or input) the client assignment
           // writes the source into the DOM, so refusing at SSR keeps a page
           // from rendering clean on the server and throwing on hydration.
-          // Elsewhere, including a custom element, the property reflects
-          // nothing and a function stays legal.
+          // Elsewhere the property reflects nothing and a function stays
+          // legal, which is why the check below is gated on a hyphen-free
+          // tag. A custom element is excluded for a different reason than
+          // "it does not reflect": a prop declared `reflect: true` DOES
+          // reflect there, and used to write the source from its own setter.
+          // #1169 guards that at the setter (a function removes the
+          // attribute; an array carrying one does too, except under an
+          // Object/Array type, where JSON drops it losslessly), so it
+          // needs no commit-site check here.
+          //
+          // Unlike the buffered machine this drops EVERY prop, including
+          // `<webjs-suspense .fallback>`: there is no injectDSD pre-pass on
+          // this path (it is reached only through `renderToStream(v, { ssr:
+          // false })`), so there is no consumer for a `data-webjs-fallback`
+          // and emitting one would put an attribute in the markup that nothing
+          // reads.
           if (kind === 'prop' && !currentTag.includes('-')) {
             assertNotFunctionReflectedActionProp(val, name, currentTag);
+            notePropAttr(name, currentTag);
           }
           buf = buf.slice(0, attrStart);
           state = 'in-tag';
@@ -1923,7 +2192,28 @@ async function streamTemplate(tr, ctx, controller) {
           if (val) buf += `${name}=""`;
           state = 'in-tag';
           attrName = '';
+        } else if (isBoundFormAction(val, attrName, currentTag)) {
+          noteActionHole(attrName, currentTag);
+          // The SAME bindings as the buffered renderer (#1155, #1207), in the
+          // second machine, so `renderToStream(v, { ssr: false })` emits an
+          // identical form rather than refusing one the page renderer accepts.
+          if (currentTag === 'form') {
+            pendingActionId = assertIdentifiableAction(await resolveFormActionId(val), currentTag);
+            buf = buf.slice(0, attrStart).replace(/\s+$/, '');
+          } else {
+            assertSingleSubmitterAction(pendingSubmitterTag != null, currentTag);
+            const attrs = parseStartTagAttrs(buf.slice(tagStart));
+            if (attrs.has('name')) assertSubmitterHasNoName(attrs.get('name') || '', currentTag, false);
+            if (attrs.has('value')) assertSubmitterHasNoValue(currentTag);
+            if (attrs.has('form')) assertSubmitterHasNoFormAttribute(currentTag);
+            const subId = assertIdentifiableAction(await resolveFormActionId(val), currentTag);
+            pendingSubmitterTag = currentTag;
+            buf = buf.slice(0, attrStart) + `name="${FORM_ACTION_FIELD}" value="${escapeAttr(subId)}"`;
+          }
+          state = 'in-tag';
+          attrName = '';
         } else {
+          noteActionHole(attrName, currentTag);
           // The SAME guard as the buffered renderer above. This is a second,
           // independent state machine, so it inherits nothing from that one;
           // a change to the rule has to land in both. Reached only via