@wular/pnext 0.0.1

package/src/compat/next/root-params.ts

@@ -0,0 +1,142 @@
+import { currentParams, currentRequest, getWorkUnit } from '../../request/context';
+import {
+  cacheComponents,
+  hangingPromise,
+  isPrerendering,
+  isRuntimePrefetchPrerender,
+} from '../../ppr';
+import { currentRenderCacheMeta, insideUnstableCacheProducer } from '../cache/revalidate';
+import { insideUseCacheProducer, recordUseCacheRootParamRead } from '../cache/use-cache';
+import { generateStaticParamsScope } from '../static-params';
+import { accumulateRootVaryParam } from '../segment/vary-params';
+
+function currentRoutePattern(): string {
+  let pathname: string;
+  try {
+    pathname = new URL(currentRequest()?.url ?? '').pathname;
+  } catch {
+    return '';
+  }
+  const paramNamesByValue = new Map<string, string>();
+  for (const [name, value] of Object.entries(currentParams())) {
+    if (typeof value === 'string') paramNamesByValue.set(value, name);
+  }
+  return pathname
+    .split('/')
+    .map(segment => {
+      try {
+        const name = paramNamesByValue.get(decodeURIComponent(segment));
+        return name ? `[${name}]` : segment;
+      } catch {
+        return segment;
+      }
+    })
+    .join('/');
+}
+
+function rootParamContextError(name: string): Error | undefined {
+  const unit = getWorkUnit();
+  // Keep the module specifier out of a literal source string: the static
+  // compat-import rewrite must not rewrite this user-facing diagnostic.
+  const specifier = ['next', 'root-params'].join('/');
+  const call = `\`import('${specifier}').${name}()\``;
+  const route = currentRoutePattern();
+
+  const inUseCache = insideUseCacheProducer();
+  const inUnstableCache = insideUnstableCacheProducer();
+
+  if (inUseCache && inUnstableCache) {
+    return Object.assign(
+      new Error(
+        `Route ${route} used ${call} inside \`"use cache"\` nested within \`unstable_cache\`. Root params are not available in this context.`,
+      ),
+      { digest: 'E1140' },
+    );
+  }
+
+  if (inUseCache) {
+    recordUseCacheRootParamRead(name);
+    return undefined;
+  }
+
+  if (inUnstableCache) {
+    return Object.assign(
+      new Error(
+        `Route ${route} used ${call} inside \`unstable_cache\`. This is not supported. Use \`"use cache"\` instead.`,
+      ),
+      { digest: 'E1141' },
+    );
+  }
+
+  if (!unit) return undefined;
+
+  if (unit.phase === 'action') {
+    return new Error(
+      `${call} was used inside a Server Action. This is not supported. ` +
+        `Functions from '${specifier}' can only be called in the context of a route.`,
+    );
+  }
+
+  if (unit.phase !== 'after' && unit.routeKind === 'route-handler') {
+    return new Error(
+      `Route ${route} used ${call} inside a Route Handler. ` +
+        `Support for this API in Route Handlers is planned for a future version of Next.js.`,
+    );
+  }
+
+  return undefined;
+}
+
+export function rootParam<T = string | string[] | undefined>(name: string): Promise<T> {
+  // Inside generateStaticParams, a root param resolves only when a PARENT
+  // generateStaticParams already provided it; reading the param in the very
+  // call that defines it is a build error (Next E394).
+  const gsp = generateStaticParamsScope();
+  if (gsp) {
+    if (name in gsp.provided) return Promise.resolve(gsp.provided[name] as T);
+    const route = (currentRenderCacheMeta()?.route ?? '')
+      .replace(/:\.\.\.([^/*]+)\*?/g, '[...$1]')
+      .replace(/:([^/*]+)\*/g, '[...$1]')
+      .replace(/:([^/*]+)/g, '[$1]');
+    return Promise.reject(
+      new Error(
+        `Route ${route} used \`import('${['next', 'root-params'].join('/')}').${name}()\` inside \`generateStaticParams\`, ` +
+          `but the \`${name}\` parameter was not provided by a parent \`generateStaticParams\`. ` +
+          `In \`generateStaticParams\`, root params are only available for segments nested below the segment that provides them.`,
+      ),
+    );
+  }
+  // Segment-M2: a root param read varies EVERY segment of the response (Next
+  // merges the rootParams set into each segment accumulator).
+  accumulateRootVaryParam(name);
+  const error = rootParamContextError(name);
+  if (error) return Promise.reject(error);
+  // A runtime-prefetch prerender renders against the REAL sampled request, so root params are concrete
+  // there (root params are always available in a static prerender, so a runtime prefetch has them too).
+  // Hanging them would postpone the ROOT LAYOUT itself - the whole document, not a boundary - so the
+  // render would produce no shell at all.
+  if (
+    !insideUseCacheProducer() &&
+    cacheComponents() &&
+    isPrerendering() &&
+    !isRuntimePrefetchPrerender()
+  ) {
+    return hangingPromise<T>(`rootParam(${name})`);
+  }
+  const value = currentParams()[name];
+  return Promise.resolve((Array.isArray(value) && value.length === 0 ? undefined : value) as T);
+}
+
+const rootParamsModule = new Proxy(
+  {},
+  {
+    get(_target, prop: string | symbol): unknown {
+      if (typeof prop !== 'string') return undefined;
+      if (prop === '__esModule') return true;
+      if (prop === 'default') return undefined;
+      return () => rootParam(prop);
+    },
+  },
+) as Record<string, () => Promise<unknown>>;
+
+export default rootParamsModule;

package/src/compat/next/router.cjs

@@ -0,0 +1,49 @@
+// Pages-router surface for the server layers (pages islands SSR with the
+// pages/pages-edge condition targets — see serverRequireAlias). The
+// materialized page wrapper stashes the request's router state (route pattern,
+// canonical asPath, merged query) on the globalThis-anchored request scope;
+// useRouter() here returns it so pages components SSR the same values Next's
+// pages router would. isReady stays false during SSR (Next semantics).
+const noop = () => undefined
+const events = { on: noop, off: noop, emit: noop }
+
+function state() {
+  try {
+    const anchored = /** @type {Record<PropertyKey, any>} */ (globalThis)
+    const storage = anchored[Symbol.for('pnext.requestStorage')]
+    const scope = storage && storage.getStore ? storage.getStore() : undefined
+    return (scope && scope[Symbol.for('pnext.pagesRouterState')]) || undefined
+  } catch {
+    return undefined
+  }
+}
+
+function currentRouter() {
+  const s = state()
+  const pathname = (s && s.pathname) || '/'
+  return {
+    pathname,
+    route: pathname,
+    query: (s && s.query) || {},
+    asPath: (s && s.asPath) || '/',
+    basePath: '',
+    isReady: false,
+    isFallback: false,
+    isPreview: false,
+    events,
+    push: async () => true,
+    replace: async () => true,
+    prefetch: async () => {},
+    back: noop,
+    forward: noop,
+    reload: noop,
+  }
+}
+
+exports.Router = { events }
+exports.default = exports.Router
+exports.useRouter = () => currentRouter()
+/** @param {(props: object) => unknown} Component */
+exports.withRouter = Component =>
+  /** @param {object} props */
+  props => Component({ ...props, router: currentRouter() })

package/src/compat/next/router.ts

@@ -0,0 +1,143 @@
+import { useEffect, useState } from 'preact/hooks';
+import { blockJavascriptUrl } from '../../api/router';
+
+/**
+ * Pages-router surface, present so shared components importing next/router
+ * still build. pnext is app-router only; navigation maps to the pnext router
+ * where it can and no-ops where pages-router concepts don't exist.
+ */
+
+type RouterEventHandler = (...args: unknown[]) => void;
+
+const noop = () => undefined;
+
+const routerEvents = {
+  on: noop as (event: string, handler: RouterEventHandler) => void,
+  off: noop as (event: string, handler: RouterEventHandler) => void,
+  emit: noop as (event: string, ...args: unknown[]) => void,
+};
+
+export interface PagesRouter {
+  pathname: string;
+  route: string;
+  query: Record<string, string | string[]>;
+  asPath: string;
+  basePath: string;
+  isReady: boolean;
+  isFallback: boolean;
+  isPreview: boolean;
+  events: typeof routerEvents;
+  push(url: string): Promise<boolean>;
+  replace(url: string): Promise<boolean>;
+  prefetch(url: string): Promise<void>;
+  back(): void;
+  forward(): void;
+  reload(): void;
+}
+
+interface PagesRouterState {
+  pathname?: string;
+  asPath?: string;
+  query?: Record<string, string | string[]>;
+}
+
+// The pages-router state the materialized page wrapper emits: SSR reads the
+// per-request scope (anchored on globalThis — this module is bundled per
+// layer), the browser reads the inline __PNEXT_PAGES_DATA__ JSON node that
+// ships with (and is swapped along with) the page HTML.
+function pagesRouterState(browser: boolean): PagesRouterState | undefined {
+  if (!browser) {
+    const storage = (globalThis as Record<PropertyKey, unknown>)[
+      Symbol.for('pnext.requestStorage')
+    ] as { getStore(): Record<PropertyKey, unknown> | undefined } | undefined;
+    return storage?.getStore?.()?.[Symbol.for('pnext.pagesRouterState')] as
+      | PagesRouterState
+      | undefined;
+  }
+  const node = document.getElementById('__PNEXT_PAGES_DATA__');
+  if (!node?.textContent) return undefined;
+  try {
+    return JSON.parse(node.textContent) as PagesRouterState;
+  } catch {
+    return undefined;
+  }
+}
+
+function browserQuery(url: URL): Record<string, string> {
+  const query: Record<string, string> = {};
+  for (const [key, value] of url.searchParams) {
+    if (key !== '_rsc') query[key] = value;
+  }
+  return query;
+}
+
+function currentRouter(ready: boolean): PagesRouter {
+  const browser = process.browser || typeof window !== 'undefined';
+  const url = browser ? new URL(window.location.href) : undefined;
+  const state = pagesRouterState(browser);
+  const pathname = state?.pathname ?? url?.pathname ?? '/';
+  return {
+    pathname,
+    route: pathname,
+    // In the browser the address bar's own search params overlay the
+    // server-computed query (they are the live values after shallow/query-only
+    // history updates); on the server the state already merged them. The
+    // router-fetch cache key (`_rsc`) is never part of the page's query.
+    query: url
+      ? { ...(state?.query ?? {}), ...browserQuery(url) }
+      : (state?.query ?? {}),
+    asPath: url ? `${url.pathname}${url.search}` : (state?.asPath ?? '/'),
+    basePath: '',
+    isReady: browser && ready,
+    isFallback: false,
+    isPreview: false,
+    events: routerEvents,
+    push(target: string) {
+      if (blockJavascriptUrl(target)) return Promise.resolve(false);
+      if (browser) window.location.href = target;
+      return Promise.resolve(true);
+    },
+    replace(target: string) {
+      if (blockJavascriptUrl(target)) return Promise.resolve(false);
+      if (browser) window.location.replace(target);
+      return Promise.resolve(true);
+    },
+    prefetch(target: string) {
+      blockJavascriptUrl(target);
+      return Promise.resolve();
+    },
+    back() {
+      if (browser) window.history.back();
+    },
+    forward() {
+      if (browser) window.history.forward();
+    },
+    reload() {
+      if (browser) window.location.reload();
+    },
+  };
+}
+
+// Next semantics: isReady is FALSE during the hydration render (matching the SSR markup - preact
+// hydrate adopts DOM without patching mismatches, so a true-at-hydration value would never reach
+// attributes) and flips via a post-hydration re-render. Once flipped, later mounts see true immediately.
+let pagesRouterReady = false;
+
+export function useRouter(): PagesRouter {
+  const [ready, setReady] = useState(pagesRouterReady);
+  useEffect(() => {
+    pagesRouterReady = true;
+    setReady(true);
+  }, []);
+  return currentRouter(ready);
+}
+
+export const Router = { events: routerEvents };
+export default Router;
+
+export function withRouter<Props extends { router?: PagesRouter }>(
+  Component: (props: Props) => unknown,
+) {
+  return (props: Omit<Props, 'router'>) =>
+    Component({ ...props, router: currentRouter(pagesRouterReady) } as Props);
+}

package/src/compat/next/script.tsx

@@ -0,0 +1,355 @@
+import type { JSX } from 'preact';
+import { escapeHtml } from '../../utils/html';
+import { getNextConfig } from './config-loader';
+import { registerResourceHint } from '../../render/resource-hints';
+
+export type ScriptStrategy = 'beforeInteractive' | 'afterInteractive' | 'lazyOnload' | 'worker';
+
+export type ScriptProps = Omit<JSX.ScriptHTMLAttributes<HTMLScriptElement>, 'src'> & {
+  src?: string;
+  strategy?: ScriptStrategy;
+  onLoad?: (event: Event) => void;
+  onReady?: () => void;
+  onError?: (event: Event) => void;
+  children?: string;
+  /** Stylesheets the script depends on; Next preloads these alongside the script itself. */
+  stylesheets?: string[];
+};
+
+/**
+ * Server-renderable approximation of next/script. onLoad/onReady/onError are unserializable across a
+ * Server-to-Client boundary (this module has no 'use client' pragma of its own) and never fire from
+ * here; they land in `scriptProps` and are filtered out wherever attrs get serialized. A `<Script>`
+ * rendered from an actual client component hydrates through client-script.tsx instead, where those
+ * callbacks do fire.
+ */
+export default function Script({
+  strategy = 'afterInteractive',
+  children,
+  stylesheets,
+  ...scriptProps
+}: ScriptProps) {
+  const src = typeof scriptProps.src === 'string' ? scriptProps.src : undefined;
+
+  // Dedup on Next's cache key (`id ?? src`): two `<Script id="x">` must be serialized to the document
+  // exactly once. The executed-set is scoped to the current render (tied to the per-request
+  // resource-hints buffer) so it never leaks across requests.
+  const dedupKey = (typeof scriptProps.id === 'string' && scriptProps.id) || src;
+  if (dedupKey) {
+    const keys = executedScriptKeys();
+    if (keys.has(dedupKey)) return null;
+    keys.add(dedupKey);
+  }
+
+  // A manually-passed `nonce` prop always wins, matching Next. The CSP-detected case has no per-Script
+  // signal to read here - it is stamped uniformly, after the whole document is assembled, by the
+  // renderer's stampDocumentNonce - so only the explicit override needs threading through this module.
+  const manualNonce = typeof scriptProps.nonce === 'string' ? scriptProps.nonce : undefined;
+
+  // lazyOnload scripts load well after hydration on a browser idle callback;
+  // Next doesn't preload them (a preload hint for something fetched minutes
+  // later just wastes bandwidth budget), so skip the hint for that strategy.
+  if (src && strategy !== 'lazyOnload') {
+    registerResourceHint({
+      rel: 'preload',
+      url: src,
+      as: 'script',
+      ...(manualNonce ? { nonce: manualNonce } : {}),
+      ...(typeof scriptProps.crossOrigin === 'string'
+        ? { crossOrigin: scriptProps.crossOrigin }
+        : {}),
+    });
+  }
+
+  if (stylesheets) {
+    for (const url of stylesheets) {
+      registerResourceHint({ rel: 'stylesheet', url });
+    }
+  }
+
+  if (strategy === 'beforeInteractive') {
+    // Next injects beforeInteractive scripts straight into the SSR document
+    // `<head>` (or the very top of `<body>`) with a `data-nscript` marker so its
+    // client bootstrapper can skip re-executing them. We collect into the shared
+    // head-script buffer the renderer flushes into `<head>`; the marker rides
+    // along as a normal prop so the core head-script serializer emits it.
+    headScripts().push({
+      props: { 'data-nscript': 'beforeInteractive', ...scriptProps },
+      content: inlineScriptContent(scriptProps, children),
+    });
+    return null;
+  }
+
+  if (strategy === 'worker' && nextScriptWorkersEnabled()) {
+    // experimental.nextScriptWorkers: run the script off-main-thread via
+    // Partytown. Next rewrites the tag to `type="text/partytown"` (Partytown's
+    // library, served under /_next/static/~partytown/, hijacks these on load).
+    const partytownProps: Record<string, unknown> = {
+      ...scriptProps,
+      type: 'text/partytown',
+      'data-nscript': 'worker',
+    };
+    const workerInline =
+      typeof children === 'string' ? { dangerouslySetInnerHTML: { __html: children } } : {};
+    return <script {...partytownProps} {...workerInline} />;
+  }
+
+  // afterInteractive / lazyOnload: Next never SSRs the actual tag for these - only the preload hint
+  // above - because the real element is inserted client-side once its own hydration bootstrap has run,
+  // so a script that mutates shared state lands after earlier client-component effects rather than
+  // racing them. A bare `<Script>` usage inside a Server Component tree hydrates nothing here, so SSRing
+  // the tag inline would execute it immediately during HTML parse. Queue a descriptor instead; the
+  // renderer flushes one shared bootstrap that creates and appends the real elements at the right time.
+  const deferredContent = inlineScriptContent(scriptProps, children);
+  deferredScripts().push({
+    strategy: strategy === 'lazyOnload' ? 'lazyOnload' : 'afterInteractive',
+    attrs: deferredAttrs({ ...scriptProps, ...(manualNonce ? { nonce: manualNonce } : {}) }),
+    ...(typeof scriptProps.id === 'string' ? { id: scriptProps.id } : {}),
+    ...(src ? { src } : {}),
+    ...(deferredContent !== undefined ? { content: deferredContent } : {}),
+  });
+  return null;
+}
+
+export { Script };
+
+/**
+ * `experimental.nextScriptWorkers` gate. When on, `strategy="worker"` scripts
+ * are rewritten to Partytown (`type="text/partytown"`).
+ */
+function nextScriptWorkersEnabled(): boolean {
+  const experimental = getNextConfig().experimental as { nextScriptWorkers?: boolean } | undefined;
+  return experimental?.nextScriptWorkers === true;
+}
+
+/**
+ * The Partytown loader path Next serves the library from. Copied verbatim by the
+ * asset pipeline; the injected snippet points the worker sandbox here.
+ */
+export const PARTYTOWN_LIB_PATH = '/_next/static/~partytown/';
+
+/**
+ * Partytown config plus the inline snippet Next injects into <head> once when any `worker` script is
+ * present. `partytownSnippet()` returns the loader IIFE; users override config via a
+ * `data-partytown-config` block, mirrored here as a `window.partytown` seed.
+ */
+export function partytownHeadScripts(): HeadScript[] {
+  const config = getNextConfig() as {
+    experimental?: { nextScriptWorkers?: boolean };
+    partytown?: Record<string, unknown>;
+  };
+  if (config.experimental?.nextScriptWorkers !== true) return [];
+  const partytownConfig = {
+    lib: PARTYTOWN_LIB_PATH,
+    ...(config.partytown ?? {}),
+  };
+  return [
+    {
+      props: { 'data-partytown-config': '' },
+      content: `partytown = ${JSON.stringify(partytownConfig)};`,
+    },
+    {
+      props: { 'data-partytown': '' },
+      content: partytownSnippet(partytownConfig.lib),
+    },
+  ];
+}
+
+/**
+ * Render the Partytown head scripts (config seed + loader snippet) to an HTML string for injection via
+ * the render seam. Returns '' when nextScriptWorkers is disabled - a no-op for every other app.
+ */
+export function renderPartytownHeadScripts(): string {
+  return partytownHeadScripts().map(renderHeadScript).join('');
+}
+
+/**
+ * Minimal Partytown bootstrap snippet: registers the forwarding queue and lazily
+ * loads `partytown.js` from the configured lib path. Matches the shape Next
+ * emits closely enough for the `type="text/partytown"` rewrite + lib-path
+ * assertions; the full vendored snippet is copied by the asset pipeline.
+ */
+function partytownSnippet(lib: string): string {
+  return (
+    `!(function(w,p,f,c){` +
+    `c=w[p]=Object.assign(w[p]||{},{lib:${JSON.stringify(lib)}});` +
+    `c.forward=c.forward||[];` +
+    `f=document.createElement('script');` +
+    `f.async=!0;f.src=c.lib+'partytown.js';` +
+    `document.head.appendChild(f);` +
+    `})(window,'partytown');`
+  );
+}
+
+// afterInteractive/lazyOnload descriptors (§ deferred bootstrap). Consumed by
+// src/render/renderer.ts's renderDeferredScriptRuntime, which owns its own
+// copy of this shape (core may not import compat) keyed off the same global —
+// mirrors the ResourceHint/HeadScript protocol above.
+export interface DeferredScript {
+  strategy: 'afterInteractive' | 'lazyOnload';
+  attrs: Record<string, string>;
+  id?: string;
+  src?: string;
+  content?: string;
+}
+
+function deferredScripts() {
+  const holder = globalThis as { __PNEXT_DEFERRED_SCRIPTS__?: DeferredScript[] };
+  holder.__PNEXT_DEFERRED_SCRIPTS__ ??= [];
+  return holder.__PNEXT_DEFERRED_SCRIPTS__;
+}
+
+export function clearDeferredScripts() {
+  (globalThis as { __PNEXT_DEFERRED_SCRIPTS__?: DeferredScript[] }).__PNEXT_DEFERRED_SCRIPTS__ = [];
+}
+
+export function takeDeferredScripts() {
+  const holder = globalThis as { __PNEXT_DEFERRED_SCRIPTS__?: DeferredScript[] };
+  const scripts = holder.__PNEXT_DEFERRED_SCRIPTS__ ?? [];
+  holder.__PNEXT_DEFERRED_SCRIPTS__ = [];
+  return scripts;
+}
+
+// Like scriptAttrs, but building a raw name -> value map (for
+// `element.setAttribute(name, value)` client-side) instead of an
+// HTML-escaped string — the deferred bootstrap reconstructs real elements via
+// the DOM, never via innerHTML.
+const DEFERRED_SKIP_PROPS = new Set(['src', 'strategy', 'dangerouslysetinnerhtml', 'id']);
+
+function deferredAttrs(props: Record<string, unknown>): Record<string, string> {
+  const attrs: Record<string, string> = {};
+  for (const [key, value] of Object.entries(props)) {
+    const name = attrName(key);
+    if (!isAttrName(name) || DEFERRED_SKIP_PROPS.has(name) || name.startsWith('on')) continue;
+    if (value == null || value === false || typeof value === 'function') continue;
+    if (value === true) {
+      attrs[name] = '';
+      continue;
+    }
+    if (name === 'class' && Array.isArray(value)) {
+      const className = value
+        .filter(
+          (item): item is string | number => typeof item === 'string' || typeof item === 'number',
+        )
+        .join(' ');
+      if (className) attrs[name] = className;
+      continue;
+    }
+    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'bigint') {
+      attrs[name] = String(value);
+    }
+  }
+  return attrs;
+}
+
+export interface HeadScript {
+  props: Record<string, unknown>;
+  content?: string;
+}
+
+// The renderer replaces the resource-hints array with a fresh `[]` at the start
+// of every render (clearResourceHints). Keying the executed-set off that array
+// via a WeakMap gives us a dedup scope that lives exactly one render and is
+// garbage-collected with it — no cross-request leakage.
+const scriptDedupRegistry = new WeakMap<object, Set<string>>();
+
+function executedScriptKeys(): Set<string> {
+  const holder = globalThis as { __PNEXT_RESOURCE_HINTS__?: object };
+  holder.__PNEXT_RESOURCE_HINTS__ ??= [];
+  const arr = holder.__PNEXT_RESOURCE_HINTS__;
+  let keys = scriptDedupRegistry.get(arr);
+  if (!keys) {
+    keys = new Set<string>();
+    scriptDedupRegistry.set(arr, keys);
+  }
+  return keys;
+}
+
+function headScripts() {
+  const holder = globalThis as { __PNEXT_HEAD_SCRIPTS__?: HeadScript[] };
+  holder.__PNEXT_HEAD_SCRIPTS__ ??= [];
+  return holder.__PNEXT_HEAD_SCRIPTS__;
+}
+
+export function clearHeadScripts() {
+  (globalThis as { __PNEXT_HEAD_SCRIPTS__?: HeadScript[] }).__PNEXT_HEAD_SCRIPTS__ = [];
+}
+
+export function takeHeadScripts() {
+  const holder = globalThis as { __PNEXT_HEAD_SCRIPTS__?: HeadScript[] };
+  const scripts = holder.__PNEXT_HEAD_SCRIPTS__ ?? [];
+  holder.__PNEXT_HEAD_SCRIPTS__ = [];
+  return scripts;
+}
+
+export function renderHeadScripts() {
+  return takeHeadScripts().map(renderHeadScript).join('\n    ');
+}
+
+function renderHeadScript(script: HeadScript) {
+  const attrs = scriptAttrs(script.props);
+  const open = attrs ? `<script ${attrs}>` : '<script>';
+  return script.content === undefined
+    ? `${open}</script>`
+    : `${open}${escapeScriptText(script.content)}</script>`;
+}
+
+function inlineScriptContent(
+  props: Record<string, unknown>,
+  children: string | undefined,
+): string | undefined {
+  if (typeof children === 'string') return children;
+  const dangerous = props.dangerouslySetInnerHTML;
+  if (
+    dangerous &&
+    typeof dangerous === 'object' &&
+    typeof (dangerous as { __html?: unknown }).__html === 'string'
+  ) {
+    return (dangerous as { __html: string }).__html;
+  }
+  return undefined;
+}
+
+function scriptAttrs(props: Record<string, unknown>) {
+  const attrs = Object.entries(props).flatMap(([key, value]) => scriptAttr(attrName(key), value));
+  return attrs.join(' ');
+}
+
+function scriptAttr(name: string, value: unknown): string[] {
+  if (!isAttrName(name)) return [];
+  if (value == null || value === false || typeof value === 'function') return [];
+  if (name === 'strategy' || name === 'dangerouslysetinnerhtml' || name.startsWith('on')) return [];
+  if (value === true) return [name];
+  if (name === 'class' && Array.isArray(value)) {
+    const className = value
+      .filter(
+        (item): item is string | number => typeof item === 'string' || typeof item === 'number',
+      )
+      .join(' ');
+    return className ? [`class="${escapeHtml(className)}"`] : [];
+  }
+  if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'bigint') {
+    return [];
+  }
+  return [`${name}="${escapeHtml(value)}"`];
+}
+
+function attrName(key: string) {
+  if (key === 'className') return 'class';
+  if (key === 'htmlFor') return 'for';
+  return key.toLowerCase();
+}
+
+function isAttrName(name: string) {
+  return /^[a-zA-Z_:][a-zA-Z0-9:._-]*$/.test(name);
+}
+
+const scriptTerminator = /(<\/|<)(s)(cript)/gi;
+
+function escapeScriptText(text: string) {
+  return text.replace(
+    scriptTerminator,
+    (_, prefix: string, s: string, suffix: string) =>
+      `${prefix}${s === 's' ? '\\u0073' : '\\u0053'}${suffix}`,
+  );
+}

package/src/compat/next/server-only.ts

@@ -0,0 +1,3 @@
+// server-only import marker: valid in server modules (react-server condition
+// equivalent); the client bundler keeps the real package error path.
+export {};