one 1.2.51 → 1.2.52

package/dist/cjs/constants.cjs

@@ -36,6 +36,7 @@ __export(constants_exports, {
   isWebServer: () => isWebServer
 });
 module.exports = __toCommonJS(constants_exports);
+var import_htmlEscape = require("./utils/htmlEscape.cjs");
 const isWebClient = typeof window < "u",
   isWebServer = typeof window > "u",
   isNative = !1,
@@ -54,6 +55,6 @@ const isWebClient = typeof window < "u",
   } = {}) => `
   <script>globalThis['global'] = globalThis</script>
   <script>globalThis['__vxrnIsSPA'] = true</script>
-  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify(serverContext)}</script>
-  <script>globalThis.__oneLoadedCSS = new Set(${JSON.stringify(serverContext.css || [])})</script>
+  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${(0, import_htmlEscape.safeJsonStringify)(serverContext)}</script>
+  <script>globalThis.__oneLoadedCSS = new Set(${(0, import_htmlEscape.safeJsonStringify)(serverContext.css || [])})</script>
 `;

package/dist/cjs/constants.js

@@ -30,12 +30,13 @@ __export(constants_exports, {
   isWebServer: () => isWebServer
 });
 module.exports = __toCommonJS(constants_exports);
+var import_htmlEscape = require("./utils/htmlEscape");
 const isWebClient = typeof window < "u", isWebServer = typeof window > "u", isNative = !1, CACHE_KEY = `${process.env.ONE_CACHE_KEY ?? Math.round(Math.random() * 1e8)}`, LOADER_JS_POSTFIX_UNCACHED = "_vxrn_loader.js", LOADER_JS_POSTFIX_REGEX_STRING = `_\\d+${LOADER_JS_POSTFIX_UNCACHED}$`, LOADER_JS_POSTFIX_REGEX = new RegExp(LOADER_JS_POSTFIX_REGEX_STRING), LOADER_JS_POSTFIX = `_${CACHE_KEY}${LOADER_JS_POSTFIX_UNCACHED}`, PRELOAD_JS_POSTFIX = `_${CACHE_KEY}_preload.js`, CSS_PRELOAD_JS_POSTFIX = `_${CACHE_KEY}_preload_css.js`, VIRTUAL_SSR_CSS_ENTRY = "virtual:ssr-css.css", VIRTUAL_SSR_CSS_HREF = `/@id/__x00__${VIRTUAL_SSR_CSS_ENTRY}`, SERVER_CONTEXT_KEY = "__one_server_context__", getSpaHeaderElements = ({
   serverContext = {}
 } = {}) => `
   <script>globalThis['global'] = globalThis</script>
   <script>globalThis['__vxrnIsSPA'] = true</script>
-  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify(serverContext)}</script>
-  <script>globalThis.__oneLoadedCSS = new Set(${JSON.stringify(serverContext.css || [])})</script>
+  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${(0, import_htmlEscape.safeJsonStringify)(serverContext)}</script>
+  <script>globalThis.__oneLoadedCSS = new Set(${(0, import_htmlEscape.safeJsonStringify)(serverContext.css || [])})</script>
 `;
 //# sourceMappingURL=constants.js.map

package/dist/cjs/constants.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../src/constants.ts"],
-  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEO,MAAM,cACgC,OAAO,SAAW,KAClD,cACgC,OAAO,SAAW,KAClD,WAAW,IAEX,YAAY,GAAG,QAAQ,IAAI,iBAAiB,KAAK,MAAM,KAAK,OAAO,IAAI,GAAW,CAAC,IAEnF,6BAA6B,mBAC7B,iCAAiC,QAAQ,0BAA0B,KACnE,0BAA0B,IAAI,OAAO,8BAA8B,GACnE,oBAAoB,IAAI,SAAS,GAAG,0BAA0B,IAE9D,qBAAqB,IAAI,SAAS,eAClC,yBAAyB,IAAI,SAAS,mBAGtC,wBAAwB,uBACxB,uBAAuB,eAAe,qBAAqB,IAE3D,qBAAqB,0BAErB,uBAAuB,CAAC;AAAA,EACnC,gBAAgB,CAAC;AACnB,IAEI,CAAC,MAAM;AAAA;AAAA;AAAA,wBAGa,kBAAkB,QAAQ,KAAK,UAAU,aAAa,CAAC;AAAA,gDAC/B,KAAK,UAAU,cAAc,OAAO,CAAC,CAAC,CAAC;AAAA;",
+  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAAkC;AAG3B,MAAM,cACgC,OAAO,SAAW,KAClD,cACgC,OAAO,SAAW,KAClD,WAAW,IAEX,YAAY,GAAG,QAAQ,IAAI,iBAAiB,KAAK,MAAM,KAAK,OAAO,IAAI,GAAW,CAAC,IAEnF,6BAA6B,mBAC7B,iCAAiC,QAAQ,0BAA0B,KACnE,0BAA0B,IAAI,OAAO,8BAA8B,GACnE,oBAAoB,IAAI,SAAS,GAAG,0BAA0B,IAE9D,qBAAqB,IAAI,SAAS,eAClC,yBAAyB,IAAI,SAAS,mBAGtC,wBAAwB,uBACxB,uBAAuB,eAAe,qBAAqB,IAE3D,qBAAqB,0BAErB,uBAAuB,CAAC;AAAA,EACnC,gBAAgB,CAAC;AACnB,IAEI,CAAC,MAAM;AAAA;AAAA;AAAA,wBAGa,kBAAkB,YAAQ,qCAAkB,aAAa,CAAC;AAAA,oDAClC,qCAAkB,cAAc,OAAO,CAAC,CAAC,CAAC;AAAA;",
   "names": []
 }

package/dist/cjs/constants.native.js

@@ -38,7 +38,8 @@ __export(constants_exports, {
   isWebServer: () => isWebServer
 });
 module.exports = __toCommonJS(constants_exports);
-var isWebClient = !1,
+var import_htmlEscape = require("./utils/htmlEscape.native.js"),
+  isWebClient = !1,
   isWebServer = !1,
   isNative = !0,
   _process_env_ONE_CACHE_KEY,
@@ -59,8 +60,8 @@ var isWebClient = !1,
     return `
   <script>globalThis['global'] = globalThis</script>
   <script>globalThis['__vxrnIsSPA'] = true</script>
-  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify(serverContext)}</script>
-  <script>globalThis.__oneLoadedCSS = new Set(${JSON.stringify(serverContext.css || [])})</script>
+  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${(0, import_htmlEscape.safeJsonStringify)(serverContext)}</script>
+  <script>globalThis.__oneLoadedCSS = new Set(${(0, import_htmlEscape.safeJsonStringify)(serverContext.css || [])})</script>
 `;
   };
 //# sourceMappingURL=constants.native.js.map

package/dist/cjs/constants.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","constants_exports","__export","CACHE_KEY","CSS_PRELOAD_JS_POSTFIX","LOADER_JS_POSTFIX","LOADER_JS_POSTFIX_REGEX","LOADER_JS_POSTFIX_REGEX_STRING","LOADER_JS_POSTFIX_UNCACHED","PRELOAD_JS_POSTFIX","SERVER_CONTEXT_KEY","VIRTUAL_SSR_CSS_ENTRY","VIRTUAL_SSR_CSS_HREF","getSpaHeaderElements","isNative","isWebClient","isWebServer","module","exports","_process_env_ONE_CACHE_KEY","process","env","ONE_CACHE_KEY","Math","round","random","RegExp","serverContext","arguments","length","JSON","stringify","css"],"sources":["../../src/constants.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,iBAAA;AAAAC,QAAA,CAAAD,iBAAA;EAAAE,SAAA,EAAAA,CAAA,KAAAA,SAAA;EAAAC,sBAAA,EAAAA,CAAA,KAAAA,sBAAA;EAAAC,iBAAA,EAAAA,CAAA,KAAAA,iBAAA;EAAAC,uBAAA,EAAAA,CAAA,KAAAA,uBAAA;EAAAC,8BAAA,EAAAA,CAAA,KAAAA,8BAAA;EAAAC,0BAAA,EAAAA,CAAA,KAAAA,0BAAA;EAAAC,kBAAA,EAAAA,CAAA,KAAAA,kBAAA;EAAAC,kBAAA,EAAAA,CAAA,KAAAA,kBAAA;EAAAC,qBAAA,EAAAA,CAAA,KAAAA,qBAAA;EAAAC,oBAAA,EAAAA,CAAA,KAAAA,oBAAA;EAAAC,oBAAA,EAAAA,CAAA,KAAAA,oBAAA;EAAAC,QAAA,EAAAA,CAAA,KAAAA,QAAA;EAAAC,WAAA,EAAAA,CAAA,KAAAA,WAAA;EAAAC,WAAA,EAAAA,CAAA,KAAAA;AAAA;AAEOC,MAAM,CAAAC,OAAA,GAAAtB,YACuC,CAAAK,iBACvC;AAoBwB,IACnCc,WAAA,GAAgB,CAAC;EAAAC,WAAA;EAAAF,QAAA;EAAAK,0BAAA;EAAAhB,SAAA,OAAAgB,0BAAA,GAAAC,OAAA,CAAAC,GAAA,CAAAC,aAAA,cAAAH,0BAAA,cAAAA,0BAAA,GAAAI,IAAA,CAAAC,KAAA,CAAAD,IAAA,CAAAE,MAAA;EAAAjB,0BAAA;EAAAD,8BAAA,WAAAC,0BAAA;EAAAF,uBAAA,OAAAoB,MAAA,CAAAnB,8BAAA;EAAAF,iBAAA,OAAAF,SAAA,GAAAK,0BAAA;EAAAC,kBAAA,OAAAN,SAAA;EAAAC,sBAAA,OAAAD,SAAA;EAAAQ,qBAAA;EAAAC,oBAAA,kBAAAD,qBAAA;EAAAD,kBAAA;EAAAG,oBAAA,YAAAA,CAAA;IACnB,IAEK;MAAAc,aAAM;IAAA,IAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,iBAAAA,SAAA;IAAA;AAAA;AAAA;AAGoE,wBAAAlB,kBAAA,QAC/BoB,IAAK,CAAAC,SAAU,CAAAJ,aAAc;AAAU,gDAAAG,IAAA,CAAAC,SAAA,CAAAJ,aAAA,CAAAK,GAAA","ignoreList":[]}
+{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","constants_exports","__export","CACHE_KEY","CSS_PRELOAD_JS_POSTFIX","LOADER_JS_POSTFIX","LOADER_JS_POSTFIX_REGEX","LOADER_JS_POSTFIX_REGEX_STRING","LOADER_JS_POSTFIX_UNCACHED","PRELOAD_JS_POSTFIX","SERVER_CONTEXT_KEY","VIRTUAL_SSR_CSS_ENTRY","VIRTUAL_SSR_CSS_HREF","getSpaHeaderElements","isNative","isWebClient","isWebServer","module","exports","import_htmlEscape","require","_process_env_ONE_CACHE_KEY","process","env","ONE_CACHE_KEY","Math","round","random","RegExp","serverContext","arguments","length","safeJsonStringify","css"],"sources":["../../src/constants.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,iBAAA;AAAAC,QAAA,CAAAD,iBAAA;EAAAE,SAAA,EAAAA,CAAA,KAAAA,SAAA;EAAAC,sBAAA,EAAAA,CAAA,KAAAA,sBAAA;EAAAC,iBAAA,EAAAA,CAAA,KAAAA,iBAAA;EAAAC,uBAAA,EAAAA,CAAA,KAAAA,uBAAA;EAAAC,8BAAA,EAAAA,CAAA,KAAAA,8BAAA;EAAAC,0BAAA,EAAAA,CAAA,KAAAA,0BAAA;EAAAC,kBAAA,EAAAA,CAAA,KAAAA,kBAAA;EAAAC,kBAAA,EAAAA,CAAA,KAAAA,kBAAA;EAAAC,qBAAA,EAAAA,CAAA,KAAAA,qBAAA;EAAAC,oBAAA,EAAAA,CAAA,KAAAA,oBAAA;EAAAC,oBAAA,EAAAA,CAAA,KAAAA,oBAAA;EAAAC,QAAA,EAAAA,CAAA,KAAAA,QAAA;EAAAC,WAAA,EAAAA,CAAA,KAAAA,WAAA;EAAAC,WAAA,EAAAA,CAAA,KAAAA;AAAA;AAAAC,MAAA,CAAAC,OAAA,GAAAtB,YAAkC,CAAAK,iBAAA;AAG3B,IAAAkB,iBACsC,GAAAC,OAAO,+BACvC;EACgCL,WAAO,KAAW;EAAAC,WAClD,GAAW;EAEXF,QAAA,IAAY;EAAGO,0BAAY;EAAAlB,SAAsB,GAAM,IAAAkB,0BAEvD,GAAAC,OAAA,CAAAC,GAAA,CAAAC,aAA6B,cAC7BH,0BAAA,UAAiC,IAAAA,0BAAQ,GAA0BI,IACnE,CAAAC,KAAA,CAAAD,IAAA,CAAAE,MAAA,QAA0B,GAAI;EAAAnB,0BAAO,oBACrC;EAAAD,8BAAoC,WAAAC,0BAEpC;EAAAF,uBAAkC,OAAAsB,MAClC,CAAArB,8BAA6B;EAAAF,iBAAS,GAGtC,IAAAF,SAAA,GAAAK,0BAAwB;EAAAC,kBACxB,OAAuBN,SAAA,aAAe;EAAAC,sBAEtC,OAAAD,SAAqB;EAAAQ,qBAErB,wBAAwB;EAAAC,oBAAA,kBAAAD,qBAAA;EAAAD,kBAAA;EAAAG,oBAAA,YAAAA,CAAA;IACnC;MAAAgB,aAAiB;IAAA,IAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,iBAAAA,SAAA;IACnB,OAEK;AAAM;AAAA;AAAA,wBAGapB,kBAAkB,YAAQS,iBAAA,CAAAa,iBAAA,EAAkBH,aAAa,CAAC;AAAA,oDAClCV,iBAAA,CAAAa,iBAAA,EAAkBH,aAAA,CAAcI,GAAA,IAAO,EAAE,CAAC;AAAA","ignoreList":[]}

package/dist/cjs/createApp.cjs

@@ -43,6 +43,7 @@ var import_setup = require("./setup.cjs"),
   import_useViteRoutes = require("./router/useViteRoutes.cjs"),
   import_useServerHeadInsertion = require("./useServerHeadInsertion.cjs"),
   import_ensureExists = require("./utils/ensureExists.cjs"),
+  import_htmlEscape = require("./utils/htmlEscape.cjs"),
   import_constants = require("./vite/constants.cjs"),
   import_one_server_only = require("./vite/one-server-only.cjs"),
   import_jsx_runtime = require("react/jsx-runtime");
@@ -112,7 +113,7 @@ function createApp(options) {
         if (!`${err}`.includes("sheet is not defined")) throw err;
       }
       const postRenderData = (0, import_one_server_only.getServerContext)()?.postRenderData;
-      return postRenderData && (html = html.replace(JSON.stringify(import_constants.SERVER_CONTEXT_POST_RENDER_STRING), JSON.stringify(postRenderData))), html;
+      return postRenderData && (html = html.replace((0, import_htmlEscape.safeJsonStringify)(import_constants.SERVER_CONTEXT_POST_RENDER_STRING), (0, import_htmlEscape.safeJsonStringify)(postRenderData))), html;
     }
   };
   const serverContext = (0, import_one_server_only.getServerContext)() || {},

package/dist/cjs/createApp.js

@@ -25,7 +25,7 @@ __export(createApp_exports, {
   createApp: () => createApp
 });
 module.exports = __toCommonJS(createApp_exports);
-var import_setup = require("./setup"), import_react = require("react"), import_react_native = require("react-native-web"), import_clientLoaderResolver = require("./clientLoaderResolver"), import_render = require("./render"), import_Root = require("./Root"), import_useViteRoutes = require("./router/useViteRoutes"), import_useServerHeadInsertion = require("./useServerHeadInsertion"), import_ensureExists = require("./utils/ensureExists"), import_constants = require("./vite/constants"), import_one_server_only = require("./vite/one-server-only"), import_jsx_runtime = require("react/jsx-runtime");
+var import_setup = require("./setup"), import_react = require("react"), import_react_native = require("react-native-web"), import_clientLoaderResolver = require("./clientLoaderResolver"), import_render = require("./render"), import_Root = require("./Root"), import_useViteRoutes = require("./router/useViteRoutes"), import_useServerHeadInsertion = require("./useServerHeadInsertion"), import_ensureExists = require("./utils/ensureExists"), import_htmlEscape = require("./utils/htmlEscape"), import_constants = require("./vite/constants"), import_one_server_only = require("./vite/one-server-only"), import_jsx_runtime = require("react/jsx-runtime");
 const import_meta = {};
 function createApp(options) {
   if (import_meta.env.SSR)
@@ -94,8 +94,8 @@ function createApp(options) {
         }
         const postRenderData = (0, import_one_server_only.getServerContext)()?.postRenderData;
         return postRenderData && (html = html.replace(
-          JSON.stringify(import_constants.SERVER_CONTEXT_POST_RENDER_STRING),
-          JSON.stringify(postRenderData)
+          (0, import_htmlEscape.safeJsonStringify)(import_constants.SERVER_CONTEXT_POST_RENDER_STRING),
+          (0, import_htmlEscape.safeJsonStringify)(postRenderData)
         )), html;
       }
     };

package/dist/cjs/createApp.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../src/createApp.tsx"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAAO,oBAEP,eAA6B,kBAC7B,sBAA4B,yBAC5B,8BAAoC,mCACpC,gBAAuB,qBACvB,cAAqB,mBACrB,uBAAuC,mCAEvC,gCAAwC,qCACxC,sBAA6B,iCAC7B,mBAAkD,6BAClD,yBAAmD,mCAiDvC;AA7DZ;AAqBO,SAAS,UAAU,SAAyB;AACjD,MAAI,YAAY,IAAI;AAClB,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,OAAO,UAA0B;AAEvC,cAAM,CAAC,gBAAgB,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,UACvD,OAAO,0BAA0B;AAAA,UACjC,OAAO,iBAAiB;AAAA,QAC1B,CAAC,GAEK,uBACJ,eAAe,wBACf,eAAe,SAAS,sBACpB,iBAAiB,aAAa;AAEpC,YAAI;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,eAAAA;AAAA,QACF,IAAI;AAEJ,qDAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,eAAAA;AAAA,QACF,CAAC;AAED,YAAI;AAEJ,cAAM,MAAM,MAER;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,QAAQ;AAAA,YACf,YAAY,CAAC,OAAO;AAClB,yBAAW;AAAA,YACb;AAAA,YACA,QAAQ,QAAQ;AAAA,YAChB,YAAY,QAAQ;AAAA,YACnB,GAAG;AAAA;AAAA,QACN;AAIJ,wCAAY,kBAAkB,OAAO,MAAM,GAAG;AAG9C,cAAM,cAAc,gCAAY,eAAe,OAAO,CAAC,CAAC,GAGlD,cAAc,YAAY,QAAQ,MAAM;AAE9C,YAAI,OAAO,MAAM,eAAe,aAAa;AAAA,UAC3C,UAAU,MAAM;AAAA,UAChB,kBAAkB,MAAM;AAAA,QAC1B,CAAC;AAED,YAAI;AACF,gBAAM,oBAA0C,CAAC,GAE3C,WAAW,YAAY,gBAAgB,EAAE,OAAO,QAAQ,IAAI,UAAU,CAAC;AAC7E,UAAI,YACF,kBAAkB,KAAK,QAAQ,OAGjC,kCAAa,QAAQ;AACrB,gBAAM,iBAAa,uDAAwB,QAAQ;AACnD,cAAI;AACF,uBAAW,aAAa,YAAY;AAClC,oBAAM,MAAM,UAAU;AACtB,cAAI,OACF,kBAAkB,KAAK,GAAG;AAAA,YAE9B;AAGF,cAAI,kBAAkB,QAAQ;AAC5B,kBAAM,gBAAgB;AAAA,cACpB,2EAAG,4BAAkB,IAAI,CAAC,GAAG,UAAM,2BAAa,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,GAAE;AAAA,YAClE;AAEA,YAAI,kBACF,OAAO,KAAK,QAAQ,WAAW,GAAG,aAAa,SAAS;AAAA,UAE5D;AAAA,QACF,SAAS,KAAK;AAGZ,cAAI,IAAG,GAAG,GAAG,SAAS,sBAAsB;AAG1C,kBAAM;AAAA,QAEV;AAGA,cAAM,qBAAiB,yCAAiB,GAAG;AAE3C,eAAI,mBACF,OAAO,KAAK;AAAA,UACV,KAAK,UAAU,kDAAiC;AAAA,UAChD,KAAK,UAAU,cAAc;AAAA,QAC/B,IAGK;AAAA,MACT;AAAA,IACF;AAGF,QAAM,oBAAgB,yCAAiB,KAAK,CAAC,GACvC,gBAAgB,cAAc,eAI9B,kBAAkB,gBACpB,OAAO,QAAQ,aAAa,EAAE,IAAI,OAAO,CAAC,UAAU,UAAU,MAAM;AAClE,UAAM,MAAM,MAAM;AAAA;AAAA,MAA0B;AAAA;AAC5C,4DAAuB,UAAU,GAAG,GAC7B;AAAA,EACT,CAAC,IACD,CAAC,QAAQ,OAAO,IAAI,QAAQ,UAAU,cAAc,IAAI,CAAC;AAE7D,SAAO,QAAQ,IAAI,eAAe,EAC/B,KAAK,UACG,iDAAoB,aAAa,CACzC,EACA,KAAK,MAAM;AACV;AAAA,MACE;AAAA,QAAC;AAAA;AAAA,UACC,UAAQ;AAAA,UACR,OAAO,QAAQ;AAAA,UACf,QAAQ,QAAQ;AAAA,UAChB,YAAY,QAAQ;AAAA,UACpB,MAAM,OAAO,SAAS;AAAA;AAAA,MACxB;AAAA,IACF;AAAA,EACF,CAAC,EACA,MAAM,CAAC,QAAQ;AACd,YAAQ,MAAM,uCAAuC,GAAG;AAAA,EAC1D,CAAC;AACL;",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAAO,oBAEP,eAA6B,kBAC7B,sBAA4B,yBAC5B,8BAAoC,mCACpC,gBAAuB,qBACvB,cAAqB,mBACrB,uBAAuC,mCAEvC,gCAAwC,qCACxC,sBAA6B,iCAC7B,oBAAkC,+BAClC,mBAAkD,6BAClD,yBAAmD,mCAiDvC;AA9DZ;AAsBO,SAAS,UAAU,SAAyB;AACjD,MAAI,YAAY,IAAI;AAClB,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,OAAO,UAA0B;AAEvC,cAAM,CAAC,gBAAgB,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,UACvD,OAAO,0BAA0B;AAAA,UACjC,OAAO,iBAAiB;AAAA,QAC1B,CAAC,GAEK,uBACJ,eAAe,wBACf,eAAe,SAAS,sBACpB,iBAAiB,aAAa;AAEpC,YAAI;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,eAAAA;AAAA,QACF,IAAI;AAEJ,qDAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,eAAAA;AAAA,QACF,CAAC;AAED,YAAI;AAEJ,cAAM,MAAM,MAER;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,QAAQ;AAAA,YACf,YAAY,CAAC,OAAO;AAClB,yBAAW;AAAA,YACb;AAAA,YACA,QAAQ,QAAQ;AAAA,YAChB,YAAY,QAAQ;AAAA,YACnB,GAAG;AAAA;AAAA,QACN;AAIJ,wCAAY,kBAAkB,OAAO,MAAM,GAAG;AAG9C,cAAM,cAAc,gCAAY,eAAe,OAAO,CAAC,CAAC,GAGlD,cAAc,YAAY,QAAQ,MAAM;AAE9C,YAAI,OAAO,MAAM,eAAe,aAAa;AAAA,UAC3C,UAAU,MAAM;AAAA,UAChB,kBAAkB,MAAM;AAAA,QAC1B,CAAC;AAED,YAAI;AACF,gBAAM,oBAA0C,CAAC,GAE3C,WAAW,YAAY,gBAAgB,EAAE,OAAO,QAAQ,IAAI,UAAU,CAAC;AAC7E,UAAI,YACF,kBAAkB,KAAK,QAAQ,OAGjC,kCAAa,QAAQ;AACrB,gBAAM,iBAAa,uDAAwB,QAAQ;AACnD,cAAI;AACF,uBAAW,aAAa,YAAY;AAClC,oBAAM,MAAM,UAAU;AACtB,cAAI,OACF,kBAAkB,KAAK,GAAG;AAAA,YAE9B;AAGF,cAAI,kBAAkB,QAAQ;AAC5B,kBAAM,gBAAgB;AAAA,cACpB,2EAAG,4BAAkB,IAAI,CAAC,GAAG,UAAM,2BAAa,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,GAAE;AAAA,YAClE;AAEA,YAAI,kBACF,OAAO,KAAK,QAAQ,WAAW,GAAG,aAAa,SAAS;AAAA,UAE5D;AAAA,QACF,SAAS,KAAK;AAGZ,cAAI,IAAG,GAAG,GAAG,SAAS,sBAAsB;AAG1C,kBAAM;AAAA,QAEV;AAGA,cAAM,qBAAiB,yCAAiB,GAAG;AAE3C,eAAI,mBACF,OAAO,KAAK;AAAA,cACV,qCAAkB,kDAAiC;AAAA,cACnD,qCAAkB,cAAc;AAAA,QAClC,IAGK;AAAA,MACT;AAAA,IACF;AAGF,QAAM,oBAAgB,yCAAiB,KAAK,CAAC,GACvC,gBAAgB,cAAc,eAI9B,kBAAkB,gBACpB,OAAO,QAAQ,aAAa,EAAE,IAAI,OAAO,CAAC,UAAU,UAAU,MAAM;AAClE,UAAM,MAAM,MAAM;AAAA;AAAA,MAA0B;AAAA;AAC5C,4DAAuB,UAAU,GAAG,GAC7B;AAAA,EACT,CAAC,IACD,CAAC,QAAQ,OAAO,IAAI,QAAQ,UAAU,cAAc,IAAI,CAAC;AAE7D,SAAO,QAAQ,IAAI,eAAe,EAC/B,KAAK,UACG,iDAAoB,aAAa,CACzC,EACA,KAAK,MAAM;AACV;AAAA,MACE;AAAA,QAAC;AAAA;AAAA,UACC,UAAQ;AAAA,UACR,OAAO,QAAQ;AAAA,UACf,QAAQ,QAAQ;AAAA,UAChB,YAAY,QAAQ;AAAA,UACpB,MAAM,OAAO,SAAS;AAAA;AAAA,MACxB;AAAA,IACF;AAAA,EACF,CAAC,EACA,MAAM,CAAC,QAAQ;AACd,YAAQ,MAAM,uCAAuC,GAAG;AAAA,EAC1D,CAAC;AACL;",
   "names": ["routePreloads"]
 }

package/dist/cjs/server/ServerContextScript.cjs

@@ -24,6 +24,7 @@ __export(ServerContextScript_exports, {
 });
 module.exports = __toCommonJS(ServerContextScript_exports);
 var import_constants = require("../constants.cjs"),
+  import_htmlEscape = require("../utils/htmlEscape.cjs"),
   import_constants2 = require("../vite/constants.cjs"),
   import_one_server_only = require("../vite/one-server-only.cjs"),
   import_jsx_runtime = require("react/jsx-runtime");
@@ -53,11 +54,11 @@ function ServerContextScript() {
       suppressHydrationWarning: !0,
       dangerouslySetInnerHTML: {
         __html: `
-              globalThis["${import_constants.SERVER_CONTEXT_KEY}"] = ${JSON.stringify({
+              globalThis["${import_constants.SERVER_CONTEXT_KEY}"] = ${(0, import_htmlEscape.safeJsonStringify)({
           ...clientContext,
           postRenderData: import_constants2.SERVER_CONTEXT_POST_RENDER_STRING
         })};
-              globalThis.__oneLoadedCSS = new Set(${JSON.stringify(cssUrls)});
+              globalThis.__oneLoadedCSS = new Set(${(0, import_htmlEscape.safeJsonStringify)(cssUrls)});
           `
       }
     });

package/dist/cjs/server/ServerContextScript.js

@@ -17,7 +17,7 @@ __export(ServerContextScript_exports, {
   ServerContextScript: () => ServerContextScript
 });
 module.exports = __toCommonJS(ServerContextScript_exports);
-var import_constants = require("../constants"), import_constants2 = require("../vite/constants"), import_one_server_only = require("../vite/one-server-only"), import_jsx_runtime = require("react/jsx-runtime");
+var import_constants = require("../constants"), import_htmlEscape = require("../utils/htmlEscape"), import_constants2 = require("../vite/constants"), import_one_server_only = require("../vite/one-server-only"), import_jsx_runtime = require("react/jsx-runtime");
 function ServerContextScript() {
   if (process.env.VITE_ENVIRONMENT === "client")
     return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
@@ -44,11 +44,11 @@ function ServerContextScript() {
         suppressHydrationWarning: !0,
         dangerouslySetInnerHTML: {
           __html: `
-              globalThis["${import_constants.SERVER_CONTEXT_KEY}"] = ${JSON.stringify({
+              globalThis["${import_constants.SERVER_CONTEXT_KEY}"] = ${(0, import_htmlEscape.safeJsonStringify)({
             ...clientContext,
             postRenderData: import_constants2.SERVER_CONTEXT_POST_RENDER_STRING
           })};
-              globalThis.__oneLoadedCSS = new Set(${JSON.stringify(cssUrls)});
+              globalThis.__oneLoadedCSS = new Set(${(0, import_htmlEscape.safeJsonStringify)(cssUrls)});
           `
         }
       }

package/dist/cjs/server/ServerContextScript.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/server/ServerContextScript.tsx"],
-  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAmC,yBACnCA,oBAAkD,8BAClD,yBAAiC,oCAK3B;AAHC,SAAS,sBAAsB;AACpC,MAAI,QAAQ,IAAI,qBAAqB;AACnC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAK;AAAA,QAEL,MAAM;AAAA,QACN,0BAAwB;AAAA,QACxB,yBAAyB;AAAA,UACvB,QAAQ;AAAA,QACV;AAAA;AAAA,IACF;AAIJ,MAAI,QAAQ,IAAI,qBAAqB,OAAO;AAC1C,UAAM,cAAU,yCAAiB,GAC3B,UAAU,SAAS,OAAO,CAAC,GAM3B,EAAE,aAAa,GAAG,YAAY,IAAI,WAAW,CAAC,GAC9C,gBAAgB;AAAA,MACpB,GAAG;AAAA,MACH,gBAAgB,aAAa,UAAU;AAAA,IACzC;AAEA,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAK;AAAA,QAEL,MAAM;AAAA,QACN,0BAAwB;AAAA,QACxB,yBAAyB;AAAA,UACvB,QAAQ;AAAA,4BACU,mCAAkB,QAAQ,KAAK,UAAU;AAAA,YACrD,GAAG;AAAA,YACH,gBAAgB;AAAA,UAClB,CAAC,CAAC;AAAA,oDACoC,KAAK,UAAU,OAAO,CAAC;AAAA;AAAA,QAEnE;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,SAAO;AACT;",
+  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAmC,yBACnC,oBAAkC,gCAClCA,oBAAkD,8BAClD,yBAAiC,oCAK3B;AAHC,SAAS,sBAAsB;AACpC,MAAI,QAAQ,IAAI,qBAAqB;AACnC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAK;AAAA,QAEL,MAAM;AAAA,QACN,0BAAwB;AAAA,QACxB,yBAAyB;AAAA,UACvB,QAAQ;AAAA,QACV;AAAA;AAAA,IACF;AAIJ,MAAI,QAAQ,IAAI,qBAAqB,OAAO;AAC1C,UAAM,cAAU,yCAAiB,GAC3B,UAAU,SAAS,OAAO,CAAC,GAM3B,EAAE,aAAa,GAAG,YAAY,IAAI,WAAW,CAAC,GAC9C,gBAAgB;AAAA,MACpB,GAAG;AAAA,MACH,gBAAgB,aAAa,UAAU;AAAA,IACzC;AAEA,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAK;AAAA,QAEL,MAAM;AAAA,QACN,0BAAwB;AAAA,QACxB,yBAAyB;AAAA,UACvB,QAAQ;AAAA,4BACU,mCAAkB,YAAQ,qCAAkB;AAAA,YACxD,GAAG;AAAA,YACH,gBAAgB;AAAA,UAClB,CAAC,CAAC;AAAA,wDACoC,qCAAkB,OAAO,CAAC;AAAA;AAAA,QAEtE;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,SAAO;AACT;",
   "names": ["import_constants"]
 }

package/dist/cjs/server/ServerContextScript.native.js

@@ -27,6 +27,7 @@ __export(ServerContextScript_exports, {
 module.exports = __toCommonJS(ServerContextScript_exports);
 var import_jsx_runtime = require("react/jsx-runtime"),
   import_constants = require("../constants.native.js"),
+  import_htmlEscape = require("../utils/htmlEscape.native.js"),
   import_constants2 = require("../vite/constants.native.js"),
   import_one_server_only = require("../vite/one-server-only.native.js");
 function ServerContextScript() {
@@ -57,11 +58,11 @@ function ServerContextScript() {
       suppressHydrationWarning: !0,
       dangerouslySetInnerHTML: {
         __html: `
-              globalThis["${import_constants.SERVER_CONTEXT_KEY}"] = ${JSON.stringify({
+              globalThis["${import_constants.SERVER_CONTEXT_KEY}"] = ${(0, import_htmlEscape.safeJsonStringify)({
           ...clientContext,
           postRenderData: import_constants2.SERVER_CONTEXT_POST_RENDER_STRING
         })};
-              globalThis.__oneLoadedCSS = new Set(${JSON.stringify(cssUrls)});
+              globalThis.__oneLoadedCSS = new Set(${(0, import_htmlEscape.safeJsonStringify)(cssUrls)});
           `
       }
     });

package/dist/cjs/server/ServerContextScript.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","ServerContextScript_exports","__export","ServerContextScript","module","exports","import_jsx_runtime","require","import_constants","import_constants2","import_one_server_only","process","env","VITE_ENVIRONMENT","jsx","async","href","SERVER_CONTEXT_KEY","suppressHydrationWarning","dangerouslySetInnerHTML","__html","context","useServerContext","cssUrls","css","cssContents","restContext","clientContext","cssInlineCount","length","JSON","stringify","postRenderData","SERVER_CONTEXT_POST_RENDER_STRING"],"sources":["../../../src/server/ServerContextScript.tsx"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,2BAAA;AAAAC,QAAA,CAAAD,2BAAA;EAAAE,mBAAA,EAAAA,CAAA,KAAAA;AAAA;AAAAC,MAAA,CAAAC,OAAA,GAAAT,YAAmC,CAAAK,2BACnC;AAGO,IAAAK,kBAAS,GAAAC,OAAsB;EAAAC,gBAAA,GAAAD,OAAA;EAAAE,iBAAA,GAAAF,OAAA;EAAAG,sBAAA,GAAAH,OAAA;AACpC,SAAIJ,mBAAYA,CAAA;EACd,IAAAQ,OACE,CAAAC,GAAA,CAAAC,gBAAA,sBAAC,mBAAAP,kBAAA,CAAAQ,GAAA;IAAAC,KAAA;IAAA;IACMC,IAEL,EAAAR,gBAAM,CAAAS,kBAAA;IAAAC,wBACN,IAAwB;IAAAC,uBACxB;MAAyBC,MACvB;IAAQ;EACV;EAAA,IACFT,OAAA,CAAAC,GAAA,CAAAC,gBAAA;IAIJ,IAAIQ,OAAQ,GAAI,IAAAX,sBAAqB,CAAAY,gBAAO;MAAAC,OAAA,GAAAF,OAAA,EAAAG,GAAA;MAAA;QAAAC,WAAA;QAAA,GAAAC;MAAA,IAAAL,OAAA;MAAAM,aAAA;QAC1C,GAAAD,WAAM;QASJE,cAAG,EAAAH,WAAA,EAAAI,MAAA;MAAA;IAEL,0BAAAvB,kBAAA,CAAAQ,GAAA;MAEAC,KACE;MAAC;MAAAC,IAAA,EAAAR,gBAAA,CAAAS,kBAAA;MAAAC,wBACM;MAAAC,uBAEC;QACNC,MAAA;AAAwB,4BACxBZ,gBAAyB,CAAAS,kBAAA,QAAAa,IAAA,CAAAC,SAAA;UACvB,GAAAJ,aAAQ;UAAAK,cAAA,EAAAvB,iBACU,CAAAwB;QAAyC;AAClD,oDACaH,IAAA,CAAAC,SAAA,CAAAR,OAAA;AAAA;MAChB;IAC2D;EAAA;EAEnE;AAAA","ignoreList":[]}
+{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","ServerContextScript_exports","__export","ServerContextScript","module","exports","import_jsx_runtime","require","import_constants","import_htmlEscape","import_constants2","import_one_server_only","process","env","VITE_ENVIRONMENT","jsx","async","href","SERVER_CONTEXT_KEY","suppressHydrationWarning","dangerouslySetInnerHTML","__html","context","useServerContext","cssUrls","css","cssContents","restContext","clientContext","cssInlineCount","length","safeJsonStringify","postRenderData","SERVER_CONTEXT_POST_RENDER_STRING"],"sources":["../../../src/server/ServerContextScript.tsx"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,2BAAA;AAAAC,QAAA,CAAAD,2BAAA;EAAAE,mBAAA,EAAAA,CAAA,KAAAA;AAAA;AAAAC,MAAA,CAAAC,OAAA,GAAAT,YAAmC,CAAAK,2BACnC;AAIO,IAAAK,kBAAS,GAAAC,OAAsB;EAAAC,gBAAA,GAAAD,OAAA;EAAAE,iBAAA,GAAAF,OAAA;EAAAG,iBAAA,GAAAH,OAAA;EAAAI,sBAAA,GAAAJ,OAAA;AACpC,SAAIJ,mBAAYA,CAAA;EACd,IAAAS,OACE,CAAAC,GAAA,CAAAC,gBAAA,sBAAC,mBAAAR,kBAAA,CAAAS,GAAA;IAAAC,KAAA;IAAA;IACMC,IAEL,EAAAT,gBAAM,CAAAU,kBAAA;IAAAC,wBACN,IAAwB;IAAAC,uBACxB;MAAyBC,MACvB;IAAQ;EACV;EAAA,IACFT,OAAA,CAAAC,GAAA,CAAAC,gBAAA;IAIJ,IAAIQ,OAAQ,GAAI,IAAAX,sBAAqB,CAAAY,gBAAO;MAAAC,OAAA,GAAAF,OAAA,EAAAG,GAAA;MAAA;QAAAC,WAAA;QAAA,GAAAC;MAAA,IAAAL,OAAA;MAAAM,aAAA;QAC1C,GAAAD,WAAM;QASJE,cAAG,EAAAH,WAAA,EAAAI,MAAA;MAAA;IAEL,0BAAAxB,kBAAA,CAAAS,GAAA;MAEAC,KACE;MAAC;MAAAC,IAAA,EAAAT,gBAAA,CAAAU,kBAAA;MAAAC,wBACM;MAAAC,uBAEC;QACNC,MAAA;AAAwB,4BACxBb,gBAAyB,CAAAU,kBAAA,YAAAT,iBAAA,CAAAsB,iBAAA;UACvB,GAAAH,aAAQ;UAAAI,cAAA,EAAAtB,iBACU,CAAAuB;QAA4C;AACrD,oDACa,IAAAxB,iBAAA,CAAAsB,iBAAA,EAAAP,OAAA;AAAA;MAChB;IAC8D;EAAA;EAEtE;AAAA","ignoreList":[]}

package/dist/cjs/utils/htmlEscape.cjs

@@ -0,0 +1,45 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+    for (var name in all) __defProp(target, name, {
+      get: all[name],
+      enumerable: !0
+    });
+  },
+  __copyProps = (to, from, except, desc) => {
+    if (from && typeof from == "object" || typeof from == "function") for (let key of __getOwnPropNames(from)) !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    });
+    return to;
+  };
+var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
+  value: !0
+}), mod);
+var htmlEscape_exports = {};
+__export(htmlEscape_exports, {
+  htmlEscapeJsonString: () => htmlEscapeJsonString,
+  safeJsonStringify: () => safeJsonStringify
+});
+module.exports = __toCommonJS(htmlEscape_exports);
+const ESCAPE_LOOKUP = {
+    "&": "\\u0026",
+    // &
+    "<": "\\u003c",
+    // <
+    ">": "\\u003e",
+    // >
+    "\u2028": "\\u2028",
+    // Line separator
+    "\u2029": "\\u2029"
+    // Paragraph separator
+  },
+  ESCAPE_REGEX = /[\u0026\u003c\u003e\u2028\u2029]/g;
+function htmlEscapeJsonString(str) {
+  return str.replace(ESCAPE_REGEX, match => ESCAPE_LOOKUP[match]);
+}
+function safeJsonStringify(value) {
+  return htmlEscapeJsonString(JSON.stringify(value));
+}

package/dist/cjs/utils/htmlEscape.js

@@ -0,0 +1,39 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: !0 });
+}, __copyProps = (to, from, except, desc) => {
+  if (from && typeof from == "object" || typeof from == "function")
+    for (let key of __getOwnPropNames(from))
+      !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: !0 }), mod);
+var htmlEscape_exports = {};
+__export(htmlEscape_exports, {
+  htmlEscapeJsonString: () => htmlEscapeJsonString,
+  safeJsonStringify: () => safeJsonStringify
+});
+module.exports = __toCommonJS(htmlEscape_exports);
+const ESCAPE_LOOKUP = {
+  "&": "\\u0026",
+  // &
+  "<": "\\u003c",
+  // <
+  ">": "\\u003e",
+  // >
+  "\u2028": "\\u2028",
+  // Line separator
+  "\u2029": "\\u2029"
+  // Paragraph separator
+}, ESCAPE_REGEX = /[\u0026\u003c\u003e\u2028\u2029]/g;
+function htmlEscapeJsonString(str) {
+  return str.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
+}
+function safeJsonStringify(value) {
+  return htmlEscapeJsonString(JSON.stringify(value));
+}
+//# sourceMappingURL=htmlEscape.js.map

package/dist/cjs/utils/htmlEscape.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/utils/htmlEscape.ts"],
+  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,MAAM,gBAAwC;AAAA,EAC5C,KAAU;AAAA;AAAA,EACV,KAAU;AAAA;AAAA,EACV,KAAU;AAAA;AAAA,EACV,UAAU;AAAA;AAAA,EACV,UAAU;AAAA;AACZ,GAEM,eAAe;AAad,SAAS,qBAAqB,KAAqB;AACxD,SAAO,IAAI,QAAQ,cAAc,CAAC,UAAU,cAAc,KAAK,CAAC;AAClE;AAKO,SAAS,kBAAkB,OAAwB;AACxD,SAAO,qBAAqB,KAAK,UAAU,KAAK,CAAC;AACnD;",
+  "names": []
+}

package/dist/cjs/utils/htmlEscape.native.js

@@ -0,0 +1,49 @@
+"use strict";
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+    for (var name in all) __defProp(target, name, {
+      get: all[name],
+      enumerable: !0
+    });
+  },
+  __copyProps = (to, from, except, desc) => {
+    if (from && typeof from == "object" || typeof from == "function") for (let key of __getOwnPropNames(from)) !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    });
+    return to;
+  };
+var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
+  value: !0
+}), mod);
+var htmlEscape_exports = {};
+__export(htmlEscape_exports, {
+  htmlEscapeJsonString: () => htmlEscapeJsonString,
+  safeJsonStringify: () => safeJsonStringify
+});
+module.exports = __toCommonJS(htmlEscape_exports);
+var ESCAPE_LOOKUP = {
+    "&": "\\u0026",
+    // &
+    "<": "\\u003c",
+    // <
+    ">": "\\u003e",
+    // >
+    "\u2028": "\\u2028",
+    // Line separator
+    "\u2029": "\\u2029"
+  },
+  ESCAPE_REGEX = /[\u0026\u003c\u003e\u2028\u2029]/g;
+function htmlEscapeJsonString(str) {
+  return str.replace(ESCAPE_REGEX, function (match) {
+    return ESCAPE_LOOKUP[match];
+  });
+}
+function safeJsonStringify(value) {
+  return htmlEscapeJsonString(JSON.stringify(value));
+}
+//# sourceMappingURL=htmlEscape.native.js.map

package/dist/cjs/utils/htmlEscape.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","htmlEscape_exports","__export","htmlEscapeJsonString","safeJsonStringify","module","exports","ESCAPE_LOOKUP","ESCAPE_REGEX","str","replace","match"],"sources":["../../../src/utils/htmlEscape.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,kBAAA;AAAAC,QAAA,CAAAD,kBAAA;EAAAE,oBAAA,EAAAA,CAAA,KAAAA,oBAAA;EAAAC,iBAAA,EAAAA,CAAA,KAAAA;AAAA;AAIAC,MAAM,CAAAC,OAAA,GAAAV,YAAwC,CAAAK,kBAAA;AAAA,IAC5CM,aAAU;IAAA;IACV;IAAU;IACV;IAAU;IACV;IAAU;IACV;IAAU;EACZ;EAEMC,YAAA,GAAe;AAad,SAASL,qBAAqBM,GAAA,EAAqB;EACxD,OAAOA,GAAA,CAAIC,OAAA,CAAQF,YAAA,EAAc,UAACG,KAAU;IAC9C,OAAAJ,aAAA,CAAAI,KAAA;EAKO;AACL;AACF,SAAAP,kBAAAJ,KAAA","ignoreList":[]}

package/dist/esm/constants.js

@@ -1,10 +1,11 @@
+import { safeJsonStringify } from "./utils/htmlEscape";
 const isWebClient = typeof window < "u", isWebServer = typeof window > "u", isNative = !1, CACHE_KEY = `${process.env.ONE_CACHE_KEY ?? Math.round(Math.random() * 1e8)}`, LOADER_JS_POSTFIX_UNCACHED = "_vxrn_loader.js", LOADER_JS_POSTFIX_REGEX_STRING = `_\\d+${LOADER_JS_POSTFIX_UNCACHED}$`, LOADER_JS_POSTFIX_REGEX = new RegExp(LOADER_JS_POSTFIX_REGEX_STRING), LOADER_JS_POSTFIX = `_${CACHE_KEY}${LOADER_JS_POSTFIX_UNCACHED}`, PRELOAD_JS_POSTFIX = `_${CACHE_KEY}_preload.js`, CSS_PRELOAD_JS_POSTFIX = `_${CACHE_KEY}_preload_css.js`, VIRTUAL_SSR_CSS_ENTRY = "virtual:ssr-css.css", VIRTUAL_SSR_CSS_HREF = `/@id/__x00__${VIRTUAL_SSR_CSS_ENTRY}`, SERVER_CONTEXT_KEY = "__one_server_context__", getSpaHeaderElements = ({
   serverContext = {}
 } = {}) => `
   <script>globalThis['global'] = globalThis</script>
   <script>globalThis['__vxrnIsSPA'] = true</script>
-  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify(serverContext)}</script>
-  <script>globalThis.__oneLoadedCSS = new Set(${JSON.stringify(serverContext.css || [])})</script>
+  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${safeJsonStringify(serverContext)}</script>
+  <script>globalThis.__oneLoadedCSS = new Set(${safeJsonStringify(serverContext.css || [])})</script>
 `;
 export {
   CACHE_KEY,

package/dist/esm/constants.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../src/constants.ts"],
-  "mappings": "AAEO,MAAM,cACgC,OAAO,SAAW,KAClD,cACgC,OAAO,SAAW,KAClD,WAAW,IAEX,YAAY,GAAG,QAAQ,IAAI,iBAAiB,KAAK,MAAM,KAAK,OAAO,IAAI,GAAW,CAAC,IAEnF,6BAA6B,mBAC7B,iCAAiC,QAAQ,0BAA0B,KACnE,0BAA0B,IAAI,OAAO,8BAA8B,GACnE,oBAAoB,IAAI,SAAS,GAAG,0BAA0B,IAE9D,qBAAqB,IAAI,SAAS,eAClC,yBAAyB,IAAI,SAAS,mBAGtC,wBAAwB,uBACxB,uBAAuB,eAAe,qBAAqB,IAE3D,qBAAqB,0BAErB,uBAAuB,CAAC;AAAA,EACnC,gBAAgB,CAAC;AACnB,IAEI,CAAC,MAAM;AAAA;AAAA;AAAA,wBAGa,kBAAkB,QAAQ,KAAK,UAAU,aAAa,CAAC;AAAA,gDAC/B,KAAK,UAAU,cAAc,OAAO,CAAC,CAAC,CAAC;AAAA;",
+  "mappings": "AAAA,SAAS,yBAAyB;AAG3B,MAAM,cACgC,OAAO,SAAW,KAClD,cACgC,OAAO,SAAW,KAClD,WAAW,IAEX,YAAY,GAAG,QAAQ,IAAI,iBAAiB,KAAK,MAAM,KAAK,OAAO,IAAI,GAAW,CAAC,IAEnF,6BAA6B,mBAC7B,iCAAiC,QAAQ,0BAA0B,KACnE,0BAA0B,IAAI,OAAO,8BAA8B,GACnE,oBAAoB,IAAI,SAAS,GAAG,0BAA0B,IAE9D,qBAAqB,IAAI,SAAS,eAClC,yBAAyB,IAAI,SAAS,mBAGtC,wBAAwB,uBACxB,uBAAuB,eAAe,qBAAqB,IAE3D,qBAAqB,0BAErB,uBAAuB,CAAC;AAAA,EACnC,gBAAgB,CAAC;AACnB,IAEI,CAAC,MAAM;AAAA;AAAA;AAAA,wBAGa,kBAAkB,QAAQ,kBAAkB,aAAa,CAAC;AAAA,gDAClC,kBAAkB,cAAc,OAAO,CAAC,CAAC,CAAC;AAAA;",
   "names": []
 }

package/dist/esm/constants.mjs

@@ -1,3 +1,4 @@
+import { safeJsonStringify } from "./utils/htmlEscape.mjs";
 const isWebClient = typeof window < "u",
   isWebServer = typeof window > "u",
   isNative = !1,
@@ -16,8 +17,8 @@ const isWebClient = typeof window < "u",
   } = {}) => `
   <script>globalThis['global'] = globalThis</script>
   <script>globalThis['__vxrnIsSPA'] = true</script>
-  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify(serverContext)}</script>
-  <script>globalThis.__oneLoadedCSS = new Set(${JSON.stringify(serverContext.css || [])})</script>
+  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${safeJsonStringify(serverContext)}</script>
+  <script>globalThis.__oneLoadedCSS = new Set(${safeJsonStringify(serverContext.css || [])})</script>
 `;
 export { CACHE_KEY, CSS_PRELOAD_JS_POSTFIX, LOADER_JS_POSTFIX, LOADER_JS_POSTFIX_REGEX, LOADER_JS_POSTFIX_REGEX_STRING, LOADER_JS_POSTFIX_UNCACHED, PRELOAD_JS_POSTFIX, SERVER_CONTEXT_KEY, VIRTUAL_SSR_CSS_ENTRY, VIRTUAL_SSR_CSS_HREF, getSpaHeaderElements, isNative, isWebClient, isWebServer };
 //# sourceMappingURL=constants.mjs.map

package/dist/esm/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"names":["isWebClient","window","isWebServer","isNative","CACHE_KEY","process","env","ONE_CACHE_KEY","Math","round","random","LOADER_JS_POSTFIX_UNCACHED","LOADER_JS_POSTFIX_REGEX_STRING","LOADER_JS_POSTFIX_REGEX","RegExp","LOADER_JS_POSTFIX","PRELOAD_JS_POSTFIX","CSS_PRELOAD_JS_POSTFIX","VIRTUAL_SSR_CSS_ENTRY","VIRTUAL_SSR_CSS_HREF","SERVER_CONTEXT_KEY","getSpaHeaderElements","serverContext","JSON","stringify","css"],"sources":["../../src/constants.ts"],"sourcesContent":[null],"mappings":"AAEO,MAAMA,WAAA,GACgC,OAAOC,MAAA,GAAW;EAClDC,WAAA,GACgC,OAAOD,MAAA,GAAW;EAClDE,QAAA,GAAW;EAEXC,SAAA,GAAY,GAAGC,OAAA,CAAQC,GAAA,CAAIC,aAAA,IAAiBC,IAAA,CAAKC,KAAA,CAAMD,IAAA,CAAKE,MAAA,CAAO,IAAI,GAAW,CAAC;EAEnFC,0BAAA,GAA6B;EAC7BC,8BAAA,GAAiC,QAAQD,0BAA0B;EACnEE,uBAAA,GAA0B,IAAIC,MAAA,CAAOF,8BAA8B;EACnEG,iBAAA,GAAoB,IAAIX,SAAS,GAAGO,0BAA0B;EAE9DK,kBAAA,GAAqB,IAAIZ,SAAS;EAClCa,sBAAA,GAAyB,IAAIb,SAAS;EAGtCc,qBAAA,GAAwB;EACxBC,oBAAA,GAAuB,eAAeD,qBAAqB;EAE3DE,kBAAA,GAAqB;EAErBC,oBAAA,GAAuBA,CAAC;IACnCC,aAAA,GAAgB,CAAC;EACnB,IAEI,CAAC,MAAM;AAAA;AAAA;AAAA,wBAGaF,kBAAkB,QAAQG,IAAA,CAAKC,SAAA,CAAUF,aAAa,CAAC;AAAA,gDAC/BC,IAAA,CAAKC,SAAA,CAAUF,aAAA,CAAcG,GAAA,IAAO,EAAE,CAAC;AAAA","ignoreList":[]}
+{"version":3,"names":["safeJsonStringify","isWebClient","window","isWebServer","isNative","CACHE_KEY","process","env","ONE_CACHE_KEY","Math","round","random","LOADER_JS_POSTFIX_UNCACHED","LOADER_JS_POSTFIX_REGEX_STRING","LOADER_JS_POSTFIX_REGEX","RegExp","LOADER_JS_POSTFIX","PRELOAD_JS_POSTFIX","CSS_PRELOAD_JS_POSTFIX","VIRTUAL_SSR_CSS_ENTRY","VIRTUAL_SSR_CSS_HREF","SERVER_CONTEXT_KEY","getSpaHeaderElements","serverContext","css"],"sources":["../../src/constants.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,iBAAA,QAAyB;AAG3B,MAAMC,WAAA,GACgC,OAAOC,MAAA,GAAW;EAClDC,WAAA,GACgC,OAAOD,MAAA,GAAW;EAClDE,QAAA,GAAW;EAEXC,SAAA,GAAY,GAAGC,OAAA,CAAQC,GAAA,CAAIC,aAAA,IAAiBC,IAAA,CAAKC,KAAA,CAAMD,IAAA,CAAKE,MAAA,CAAO,IAAI,GAAW,CAAC;EAEnFC,0BAAA,GAA6B;EAC7BC,8BAAA,GAAiC,QAAQD,0BAA0B;EACnEE,uBAAA,GAA0B,IAAIC,MAAA,CAAOF,8BAA8B;EACnEG,iBAAA,GAAoB,IAAIX,SAAS,GAAGO,0BAA0B;EAE9DK,kBAAA,GAAqB,IAAIZ,SAAS;EAClCa,sBAAA,GAAyB,IAAIb,SAAS;EAGtCc,qBAAA,GAAwB;EACxBC,oBAAA,GAAuB,eAAeD,qBAAqB;EAE3DE,kBAAA,GAAqB;EAErBC,oBAAA,GAAuBA,CAAC;IACnCC,aAAA,GAAgB,CAAC;EACnB,IAEI,CAAC,MAAM;AAAA;AAAA;AAAA,wBAGaF,kBAAkB,QAAQrB,iBAAA,CAAkBuB,aAAa,CAAC;AAAA,gDAClCvB,iBAAA,CAAkBuB,aAAA,CAAcC,GAAA,IAAO,EAAE,CAAC;AAAA","ignoreList":[]}

package/dist/esm/constants.native.js

@@ -1,3 +1,4 @@
+import { safeJsonStringify } from "./utils/htmlEscape.native.js";
 var isWebClient = !1,
   isWebServer = !1,
   isNative = !0,
@@ -19,8 +20,8 @@ var isWebClient = !1,
     return `
   <script>globalThis['global'] = globalThis</script>
   <script>globalThis['__vxrnIsSPA'] = true</script>
-  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify(serverContext)}</script>
-  <script>globalThis.__oneLoadedCSS = new Set(${JSON.stringify(serverContext.css || [])})</script>
+  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${safeJsonStringify(serverContext)}</script>
+  <script>globalThis.__oneLoadedCSS = new Set(${safeJsonStringify(serverContext.css || [])})</script>
 `;
   };
 export { CACHE_KEY, CSS_PRELOAD_JS_POSTFIX, LOADER_JS_POSTFIX, LOADER_JS_POSTFIX_REGEX, LOADER_JS_POSTFIX_REGEX_STRING, LOADER_JS_POSTFIX_UNCACHED, PRELOAD_JS_POSTFIX, SERVER_CONTEXT_KEY, VIRTUAL_SSR_CSS_ENTRY, VIRTUAL_SSR_CSS_HREF, getSpaHeaderElements, isNative, isWebClient, isWebServer };

package/dist/esm/constants.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["isWebClient","isWebServer","isNative","_process_env_ONE_CACHE_KEY","CACHE_KEY","process","env","ONE_CACHE_KEY","Math","round","random","LOADER_JS_POSTFIX_UNCACHED","LOADER_JS_POSTFIX_REGEX_STRING","LOADER_JS_POSTFIX_REGEX","RegExp","LOADER_JS_POSTFIX","PRELOAD_JS_POSTFIX","CSS_PRELOAD_JS_POSTFIX","VIRTUAL_SSR_CSS_ENTRY","VIRTUAL_SSR_CSS_HREF","SERVER_CONTEXT_KEY","getSpaHeaderElements","serverContext","arguments","length","JSON","stringify","css"],"sources":["../../src/constants.ts"],"sourcesContent":[null],"mappings":"AAEO,IAAAA,WAAM,KACgC;EAAAC,WAAO,GAAW;EAAAC,QAClD;EACgCC,0BAChC;EAAAC,SAEA,OAAAD,0BAA2B,GAAAE,OAAiB,CAAAC,GAAA,CAAKC,aAAW,MAAO,IAAI,IAAYJ,0BAEnF,UAA6B,IAAAA,0BAC7B,GAAAK,IAAA,CAAAC,KAAA,CAAAD,IAAiC,CAAAE,MAAA,CAAQ;EAAAC,0BACzC,oBAA0B;EAAAC,8BAAW,WACrCD,0BAAwB;EAAAE,uBAAY,OAAAC,MAEpC,CAAAF,8BAAyB;EAASG,iBAClC,OAAAX,SAAA,GAAAO,0BAAsC;EAAAK,kBAGtC,OAAAZ,SAAwB;EAAAa,sBACxB,OAAuBb,SAAA,iBAAe;EAAAc,qBAEtC,wBAAqB;EAAAC,oBAErB,kBAAwBD,qBAAA;EAAAE,kBAAA;EAAAC,oBAAA,YAAAA,CAAA;IACnC;MAAAC,aAAiB;IAAA,IAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,iBAAAA,SAAA;IACnB,OAEK;AAAM;AAAA;AAAA,wBAGaH,kBAAkB,QAAQK,IAAA,CAAKC,SAAA,CAAUJ,aAAa,CAAC;AAAA,gDAC/BG,IAAA,CAAKC,SAAA,CAAUJ,aAAA,CAAcK,GAAA,IAAO,EAAE,CAAC;AAAA","ignoreList":[]}
+{"version":3,"names":["safeJsonStringify","isWebClient","isWebServer","isNative","_process_env_ONE_CACHE_KEY","CACHE_KEY","process","env","ONE_CACHE_KEY","Math","round","random","LOADER_JS_POSTFIX_UNCACHED","LOADER_JS_POSTFIX_REGEX_STRING","LOADER_JS_POSTFIX_REGEX","RegExp","LOADER_JS_POSTFIX","PRELOAD_JS_POSTFIX","CSS_PRELOAD_JS_POSTFIX","VIRTUAL_SSR_CSS_ENTRY","VIRTUAL_SSR_CSS_HREF","SERVER_CONTEXT_KEY","getSpaHeaderElements","serverContext","arguments","length","css"],"sources":["../../src/constants.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,iBAAA,QAAyB;AAG3B,IAAAC,WAAM,KACgC;EAAAC,WAAO,GAAW;EAAAC,QAClD;EACgCC,0BAChC;EAAAC,SAEA,OAAAD,0BAA2B,GAAAE,OAAiB,CAAAC,GAAA,CAAKC,aAAW,MAAO,IAAI,IAAYJ,0BAEnF,UAA6B,IAAAA,0BAC7B,GAAAK,IAAA,CAAAC,KAAA,CAAAD,IAAiC,CAAAE,MAAA,CAAQ;EAAAC,0BACzC,oBAA0B;EAAAC,8BAAW,WACrCD,0BAAwB;EAAAE,uBAAY,OAAAC,MAEpC,CAAAF,8BAAyB;EAASG,iBAClC,OAAAX,SAAA,GAAAO,0BAAsC;EAAAK,kBAGtC,OAAAZ,SAAwB;EAAAa,sBACxB,OAAuBb,SAAA,iBAAe;EAAAc,qBAEtC,wBAAqB;EAAAC,oBAErB,kBAAwBD,qBAAA;EAAAE,kBAAA;EAAAC,oBAAA,YAAAA,CAAA;IACnC;MAAAC,aAAiB;IAAA,IAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,iBAAAA,SAAA;IACnB,OAEK;AAAM;AAAA;AAAA,wBAGaH,kBAAkB,QAAQrB,iBAAA,CAAkBuB,aAAa,CAAC;AAAA,gDAClCvB,iBAAA,CAAkBuB,aAAA,CAAcG,GAAA,IAAO,EAAE,CAAC;AAAA","ignoreList":[]}

package/dist/esm/createApp.js

@@ -7,6 +7,7 @@ import { Root } from "./Root";
 import { registerPreloadedRoute } from "./router/useViteRoutes";
 import { getServerHeadInsertions } from "./useServerHeadInsertion";
 import { ensureExists } from "./utils/ensureExists";
+import { safeJsonStringify } from "./utils/htmlEscape";
 import { SERVER_CONTEXT_POST_RENDER_STRING } from "./vite/constants";
 import { getServerContext, setServerContext } from "./vite/one-server-only";
 import { Fragment, jsx } from "react/jsx-runtime";
@@ -77,8 +78,8 @@ function createApp(options) {
         }
         const postRenderData = getServerContext()?.postRenderData;
         return postRenderData && (html = html.replace(
-          JSON.stringify(SERVER_CONTEXT_POST_RENDER_STRING),
-          JSON.stringify(postRenderData)
+          safeJsonStringify(SERVER_CONTEXT_POST_RENDER_STRING),
+          safeJsonStringify(postRenderData)
         )), html;
       }
     };

package/dist/esm/createApp.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../src/createApp.tsx"],
-  "mappings": "AAAA,OAAO;AAEP,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,8BAA8B;AAEvC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,yCAAyC;AAClD,SAAS,kBAAkB,wBAAwB;AAiDvC,SA8CE,UA9CF;AAxCL,SAAS,UAAU,SAAyB;AACjD,MAAI,YAAY,IAAI;AAClB,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,OAAO,UAA0B;AAEvC,cAAM,CAAC,gBAAgB,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,UACvD,OAAO,0BAA0B;AAAA,UACjC,OAAO,iBAAiB;AAAA,QAC1B,CAAC,GAEK,uBACJ,eAAe,wBACf,eAAe,SAAS,sBACpB,iBAAiB,aAAa;AAEpC,YAAI;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,eAAAA;AAAA,QACF,IAAI;AAEJ,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,eAAAA;AAAA,QACF,CAAC;AAED,YAAI;AAEJ,cAAM,MAAM,MAER;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,QAAQ;AAAA,YACf,YAAY,CAAC,OAAO;AAClB,yBAAW;AAAA,YACb;AAAA,YACA,QAAQ,QAAQ;AAAA,YAChB,YAAY,QAAQ;AAAA,YACnB,GAAG;AAAA;AAAA,QACN;AAIJ,oBAAY,kBAAkB,OAAO,MAAM,GAAG;AAG9C,cAAM,cAAc,YAAY,eAAe,OAAO,CAAC,CAAC,GAGlD,cAAc,YAAY,QAAQ,MAAM;AAE9C,YAAI,OAAO,MAAM,eAAe,aAAa;AAAA,UAC3C,UAAU,MAAM;AAAA,UAChB,kBAAkB,MAAM;AAAA,QAC1B,CAAC;AAED,YAAI;AACF,gBAAM,oBAA0C,CAAC,GAE3C,WAAW,YAAY,gBAAgB,EAAE,OAAO,QAAQ,IAAI,UAAU,CAAC;AAC7E,UAAI,YACF,kBAAkB,KAAK,QAAQ,GAGjC,aAAa,QAAQ;AACrB,gBAAM,aAAa,wBAAwB,QAAQ;AACnD,cAAI;AACF,uBAAW,aAAa,YAAY;AAClC,oBAAM,MAAM,UAAU;AACtB,cAAI,OACF,kBAAkB,KAAK,GAAG;AAAA,YAE9B;AAGF,cAAI,kBAAkB,QAAQ;AAC5B,kBAAM,gBAAgB;AAAA,cACpB,gCAAG,4BAAkB,IAAI,CAAC,GAAG,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,GAAE;AAAA,YAClE;AAEA,YAAI,kBACF,OAAO,KAAK,QAAQ,WAAW,GAAG,aAAa,SAAS;AAAA,UAE5D;AAAA,QACF,SAAS,KAAK;AAGZ,cAAI,IAAG,GAAG,GAAG,SAAS,sBAAsB;AAG1C,kBAAM;AAAA,QAEV;AAGA,cAAM,iBAAiB,iBAAiB,GAAG;AAE3C,eAAI,mBACF,OAAO,KAAK;AAAA,UACV,KAAK,UAAU,iCAAiC;AAAA,UAChD,KAAK,UAAU,cAAc;AAAA,QAC/B,IAGK;AAAA,MACT;AAAA,IACF;AAGF,QAAM,gBAAgB,iBAAiB,KAAK,CAAC,GACvC,gBAAgB,cAAc,eAI9B,kBAAkB,gBACpB,OAAO,QAAQ,aAAa,EAAE,IAAI,OAAO,CAAC,UAAU,UAAU,MAAM;AAClE,UAAM,MAAM,MAAM;AAAA;AAAA,MAA0B;AAAA;AAC5C,kCAAuB,UAAU,GAAG,GAC7B;AAAA,EACT,CAAC,IACD,CAAC,QAAQ,OAAO,IAAI,QAAQ,UAAU,cAAc,IAAI,CAAC;AAE7D,SAAO,QAAQ,IAAI,eAAe,EAC/B,KAAK,MACG,oBAAoB,aAAa,CACzC,EACA,KAAK,MAAM;AACV;AAAA,MACE;AAAA,QAAC;AAAA;AAAA,UACC,UAAQ;AAAA,UACR,OAAO,QAAQ;AAAA,UACf,QAAQ,QAAQ;AAAA,UAChB,YAAY,QAAQ;AAAA,UACpB,MAAM,OAAO,SAAS;AAAA;AAAA,MACxB;AAAA,IACF;AAAA,EACF,CAAC,EACA,MAAM,CAAC,QAAQ;AACd,YAAQ,MAAM,uCAAuC,GAAG;AAAA,EAC1D,CAAC;AACL;",
+  "mappings": "AAAA,OAAO;AAEP,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,8BAA8B;AAEvC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB;AAClC,SAAS,yCAAyC;AAClD,SAAS,kBAAkB,wBAAwB;AAiDvC,SA8CE,UA9CF;AAxCL,SAAS,UAAU,SAAyB;AACjD,MAAI,YAAY,IAAI;AAClB,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,OAAO,UAA0B;AAEvC,cAAM,CAAC,gBAAgB,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,UACvD,OAAO,0BAA0B;AAAA,UACjC,OAAO,iBAAiB;AAAA,QAC1B,CAAC,GAEK,uBACJ,eAAe,wBACf,eAAe,SAAS,sBACpB,iBAAiB,aAAa;AAEpC,YAAI;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,eAAAA;AAAA,QACF,IAAI;AAEJ,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,eAAAA;AAAA,QACF,CAAC;AAED,YAAI;AAEJ,cAAM,MAAM,MAER;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,QAAQ;AAAA,YACf,YAAY,CAAC,OAAO;AAClB,yBAAW;AAAA,YACb;AAAA,YACA,QAAQ,QAAQ;AAAA,YAChB,YAAY,QAAQ;AAAA,YACnB,GAAG;AAAA;AAAA,QACN;AAIJ,oBAAY,kBAAkB,OAAO,MAAM,GAAG;AAG9C,cAAM,cAAc,YAAY,eAAe,OAAO,CAAC,CAAC,GAGlD,cAAc,YAAY,QAAQ,MAAM;AAE9C,YAAI,OAAO,MAAM,eAAe,aAAa;AAAA,UAC3C,UAAU,MAAM;AAAA,UAChB,kBAAkB,MAAM;AAAA,QAC1B,CAAC;AAED,YAAI;AACF,gBAAM,oBAA0C,CAAC,GAE3C,WAAW,YAAY,gBAAgB,EAAE,OAAO,QAAQ,IAAI,UAAU,CAAC;AAC7E,UAAI,YACF,kBAAkB,KAAK,QAAQ,GAGjC,aAAa,QAAQ;AACrB,gBAAM,aAAa,wBAAwB,QAAQ;AACnD,cAAI;AACF,uBAAW,aAAa,YAAY;AAClC,oBAAM,MAAM,UAAU;AACtB,cAAI,OACF,kBAAkB,KAAK,GAAG;AAAA,YAE9B;AAGF,cAAI,kBAAkB,QAAQ;AAC5B,kBAAM,gBAAgB;AAAA,cACpB,gCAAG,4BAAkB,IAAI,CAAC,GAAG,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,GAAE;AAAA,YAClE;AAEA,YAAI,kBACF,OAAO,KAAK,QAAQ,WAAW,GAAG,aAAa,SAAS;AAAA,UAE5D;AAAA,QACF,SAAS,KAAK;AAGZ,cAAI,IAAG,GAAG,GAAG,SAAS,sBAAsB;AAG1C,kBAAM;AAAA,QAEV;AAGA,cAAM,iBAAiB,iBAAiB,GAAG;AAE3C,eAAI,mBACF,OAAO,KAAK;AAAA,UACV,kBAAkB,iCAAiC;AAAA,UACnD,kBAAkB,cAAc;AAAA,QAClC,IAGK;AAAA,MACT;AAAA,IACF;AAGF,QAAM,gBAAgB,iBAAiB,KAAK,CAAC,GACvC,gBAAgB,cAAc,eAI9B,kBAAkB,gBACpB,OAAO,QAAQ,aAAa,EAAE,IAAI,OAAO,CAAC,UAAU,UAAU,MAAM;AAClE,UAAM,MAAM,MAAM;AAAA;AAAA,MAA0B;AAAA;AAC5C,kCAAuB,UAAU,GAAG,GAC7B;AAAA,EACT,CAAC,IACD,CAAC,QAAQ,OAAO,IAAI,QAAQ,UAAU,cAAc,IAAI,CAAC;AAE7D,SAAO,QAAQ,IAAI,eAAe,EAC/B,KAAK,MACG,oBAAoB,aAAa,CACzC,EACA,KAAK,MAAM;AACV;AAAA,MACE;AAAA,QAAC;AAAA;AAAA,UACC,UAAQ;AAAA,UACR,OAAO,QAAQ;AAAA,UACf,QAAQ,QAAQ;AAAA,UAChB,YAAY,QAAQ;AAAA,UACpB,MAAM,OAAO,SAAS;AAAA;AAAA,MACxB;AAAA,IACF;AAAA,EACF,CAAC,EACA,MAAM,CAAC,QAAQ;AACd,YAAQ,MAAM,uCAAuC,GAAG;AAAA,EAC1D,CAAC;AACL;",
   "names": ["routePreloads"]
 }

package/dist/esm/createApp.mjs

@@ -7,6 +7,7 @@ import { Root } from "./Root.mjs";
 import { registerPreloadedRoute } from "./router/useViteRoutes.mjs";
 import { getServerHeadInsertions } from "./useServerHeadInsertion.mjs";
 import { ensureExists } from "./utils/ensureExists.mjs";
+import { safeJsonStringify } from "./utils/htmlEscape.mjs";
 import { SERVER_CONTEXT_POST_RENDER_STRING } from "./vite/constants.mjs";
 import { getServerContext, setServerContext } from "./vite/one-server-only.mjs";
 import { Fragment, jsx } from "react/jsx-runtime";
@@ -75,7 +76,7 @@ function createApp(options) {
         if (!`${err}`.includes("sheet is not defined")) throw err;
       }
       const postRenderData = getServerContext()?.postRenderData;
-      return postRenderData && (html = html.replace(JSON.stringify(SERVER_CONTEXT_POST_RENDER_STRING), JSON.stringify(postRenderData))), html;
+      return postRenderData && (html = html.replace(safeJsonStringify(SERVER_CONTEXT_POST_RENDER_STRING), safeJsonStringify(postRenderData))), html;
     }
   };
   const serverContext = getServerContext() || {},

package/dist/esm/createApp.mjs.map

@@ -1 +1 @@
-{"version":3,"names":["cloneElement","AppRegistry","resolveClientLoader","render","Root","registerPreloadedRoute","getServerHeadInsertions","ensureExists","SERVER_CONTEXT_POST_RENDER_STRING","getServerContext","setServerContext","Fragment","jsx","createApp","options","import","meta","env","SSR","props","ReactDOMServer","serverRender","Promise","all","renderToStaticMarkup","default","renderToString","loaderData","loaderProps","css","cssContents","mode","loaderServerData","routePreloads","routePreloads2","postRenderData","renderId","App","flags","onRenderId","id","routes","routerRoot","registerComponent","Application","getApplication","rootElement","element","children","html","preloads","deferredPreloads","extraHeadElements","styleTag","getStyleElement","nonce","process","ONE_NONCE","push","insertions","insertion","out","length","extraHeadHTML","map","x","i","key","replace","err","includes","JSON","stringify","serverContext","preloadPromises","Object","entries","routeKey","bundlePath","mod","then","isClient","path","window","location","href","catch","console","error"],"sources":["../../src/createApp.tsx"],"sourcesContent":[null],"mappings":"AAAA,OAAO;AAEP,SAASA,YAAA,QAAoB;AAC7B,SAASC,WAAA,QAAmB;AAC5B,SAASC,mBAAA,QAA2B;AACpC,SAASC,MAAA,QAAc;AACvB,SAASC,IAAA,QAAY;AACrB,SAASC,sBAAA,QAA8B;AAEvC,SAASC,uBAAA,QAA+B;AACxC,SAASC,YAAA,QAAoB;AAC7B,SAASC,iCAAA,QAAyC;AAClD,SAASC,gBAAA,EAAkBC,gBAAA,QAAwB;AAiDvC,SA8CEC,QAAA,EA9CFC,GAAA;AAxCL,SAASC,UAAUC,OAAA,EAAyB;EACjD,IAAIC,MAAA,CAAAC,IAAA,CAAYC,GAAA,CAAIC,GAAA,EAClB,OAAO;IACLJ,OAAA;IACAX,MAAA,EAAQ,MAAOgB,KAAA,IAA0B;MAEvC,MAAM,CAACC,cAAA,EAAgBC,YAAY,IAAI,MAAMC,OAAA,CAAQC,GAAA,CAAI,CACvD,OAAO,0BAA0B,GACjC,OAAO,qBAAiB,EACzB;QAEKC,oBAAA,GACJJ,cAAA,CAAeI,oBAAA,IACfJ,cAAA,CAAeK,OAAA,EAASD,oBAAA;QACpBE,cAAA,GAAiBL,YAAA,CAAaK,cAAA;MAEpC,IAAI;QACFC,UAAA;QACAC,WAAA;QACAC,GAAA;QACAC,WAAA;QACAC,IAAA;QACAC,gBAAA;QACAC,aAAA,EAAAC;MACF,IAAIf,KAAA;MAEJT,gBAAA,CAAiB;QACfyB,cAAA,EAAgBH,gBAAA;QAChBL,UAAA;QACAC,WAAA;QACAG,IAAA;QACAF,GAAA;QACAC,WAAA;QACAG,aAAA,EAAAC;MACF,CAAC;MAED,IAAIE,QAAA;MAEJ,MAAMC,GAAA,GAAMA,CAAA,KAER,eAAAzB,GAAA,CAACR,IAAA;QACCkC,KAAA,EAAOxB,OAAA,CAAQwB,KAAA;QACfC,UAAA,EAAaC,EAAA,IAAO;UAClBJ,QAAA,GAAWI,EAAA;QACb;QACAC,MAAA,EAAQ3B,OAAA,CAAQ2B,MAAA;QAChBC,UAAA,EAAY5B,OAAA,CAAQ4B,UAAA;QACnB,GAAGvB;MAAA,CACN;MAIJlB,WAAA,CAAY0C,iBAAA,CAAkB,OAAO,MAAMN,GAAG;MAG9C,MAAMO,WAAA,GAAc3C,WAAA,CAAY4C,cAAA,CAAe,OAAO,CAAC,CAAC;QAGlDC,WAAA,GAAcF,WAAA,CAAYG,OAAA,CAAQ5B,KAAA,CAAM6B,QAAA;MAE9C,IAAIC,IAAA,GAAO,MAAMvB,cAAA,CAAeoB,WAAA,EAAa;QAC3CI,QAAA,EAAU/B,KAAA,CAAM+B,QAAA;QAChBC,gBAAA,EAAkBhC,KAAA,CAAMgC;MAC1B,CAAC;MAED,IAAI;QACF,MAAMC,iBAAA,GAA0C,EAAC;UAE3CC,QAAA,GAAWT,WAAA,CAAYU,eAAA,CAAgB;YAAEC,KAAA,EAAOC,OAAA,CAAQvC,GAAA,CAAIwC;UAAU,CAAC;QACzEJ,QAAA,IACFD,iBAAA,CAAkBM,IAAA,CAAKL,QAAQ,GAGjC9C,YAAA,CAAa6B,QAAQ;QACrB,MAAMuB,UAAA,GAAarD,uBAAA,CAAwB8B,QAAQ;QACnD,IAAIuB,UAAA,EACF,WAAWC,SAAA,IAAaD,UAAA,EAAY;UAClC,MAAME,GAAA,GAAMD,SAAA,CAAU;UAClBC,GAAA,IACFT,iBAAA,CAAkBM,IAAA,CAAKG,GAAG;QAE9B;QAGF,IAAIT,iBAAA,CAAkBU,MAAA,EAAQ;UAC5B,MAAMC,aAAA,GAAgBvC,oBAAA,CACpB,eAAAZ,GAAA,CAAAD,QAAA;YAAGqC,QAAA,EAAAI,iBAAA,CAAkBY,GAAA,CAAI,CAACC,CAAA,EAAGC,CAAA,KAAMlE,YAAA,CAAaiE,CAAA,EAAG;cAAEE,GAAA,EAAKD;YAAE,CAAC,CAAC;UAAA,CAAE,CAClE;UAEIH,aAAA,KACFd,IAAA,GAAOA,IAAA,CAAKmB,OAAA,CAAQ,WAAW,GAAGL,aAAa,SAAS;QAE5D;MACF,SAASM,GAAA,EAAK;QAGZ,IAAI,IAAGA,GAAG,GAAGC,QAAA,CAAS,sBAAsB,GAG1C,MAAMD,GAAA;MAEV;MAGA,MAAMlC,cAAA,GAAiB1B,gBAAA,CAAiB,GAAG0B,cAAA;MAE3C,OAAIA,cAAA,KACFc,IAAA,GAAOA,IAAA,CAAKmB,OAAA,CACVG,IAAA,CAAKC,SAAA,CAAUhE,iCAAiC,GAChD+D,IAAA,CAAKC,SAAA,CAAUrC,cAAc,CAC/B,IAGKc,IAAA;IACT;EACF;EAGF,MAAMwB,aAAA,GAAgBhE,gBAAA,CAAiB,KAAK,CAAC;IACvCwB,aAAA,GAAgBwC,aAAA,CAAcxC,aAAA;IAI9ByC,eAAA,GAAkBzC,aAAA,GACpB0C,MAAA,CAAOC,OAAA,CAAQ3C,aAAa,EAAE+B,GAAA,CAAI,OAAO,CAACa,QAAA,EAAUC,UAAU,MAAM;MAClE,MAAMC,GAAA,GAAM,MAAM;MAA0BD,UAAA;MAC5C,OAAAzE,sBAAA,CAAuBwE,QAAA,EAAUE,GAAG,GAC7BA,GAAA;IACT,CAAC,IACD,CAACjE,OAAA,CAAQ2B,MAAA,CAAO,IAAI3B,OAAA,CAAQ4B,UAAU,cAAc,IAAI,CAAC;EAE7D,OAAOpB,OAAA,CAAQC,GAAA,CAAImD,eAAe,EAC/BM,IAAA,CAAK,MACG9E,mBAAA,CAAoBuE,aAAa,CACzC,EACAO,IAAA,CAAK,MAAM;IACV7E,MAAA,CACE,eAAAS,GAAA,CAACR,IAAA;MACC6E,QAAA,EAAQ;MACR3C,KAAA,EAAOxB,OAAA,CAAQwB,KAAA;MACfG,MAAA,EAAQ3B,OAAA,CAAQ2B,MAAA;MAChBC,UAAA,EAAY5B,OAAA,CAAQ4B,UAAA;MACpBwC,IAAA,EAAMC,MAAA,CAAOC,QAAA,CAASC;IAAA,CACxB,CACF;EACF,CAAC,EACAC,KAAA,CAAOjB,GAAA,IAAQ;IACdkB,OAAA,CAAQC,KAAA,CAAM,uCAAuCnB,GAAG;EAC1D,CAAC;AACL","ignoreList":[]}
+{"version":3,"names":["cloneElement","AppRegistry","resolveClientLoader","render","Root","registerPreloadedRoute","getServerHeadInsertions","ensureExists","safeJsonStringify","SERVER_CONTEXT_POST_RENDER_STRING","getServerContext","setServerContext","Fragment","jsx","createApp","options","import","meta","env","SSR","props","ReactDOMServer","serverRender","Promise","all","renderToStaticMarkup","default","renderToString","loaderData","loaderProps","css","cssContents","mode","loaderServerData","routePreloads","routePreloads2","postRenderData","renderId","App","flags","onRenderId","id","routes","routerRoot","registerComponent","Application","getApplication","rootElement","element","children","html","preloads","deferredPreloads","extraHeadElements","styleTag","getStyleElement","nonce","process","ONE_NONCE","push","insertions","insertion","out","length","extraHeadHTML","map","x","i","key","replace","err","includes","serverContext","preloadPromises","Object","entries","routeKey","bundlePath","mod","then","isClient","path","window","location","href","catch","console","error"],"sources":["../../src/createApp.tsx"],"sourcesContent":[null],"mappings":"AAAA,OAAO;AAEP,SAASA,YAAA,QAAoB;AAC7B,SAASC,WAAA,QAAmB;AAC5B,SAASC,mBAAA,QAA2B;AACpC,SAASC,MAAA,QAAc;AACvB,SAASC,IAAA,QAAY;AACrB,SAASC,sBAAA,QAA8B;AAEvC,SAASC,uBAAA,QAA+B;AACxC,SAASC,YAAA,QAAoB;AAC7B,SAASC,iBAAA,QAAyB;AAClC,SAASC,iCAAA,QAAyC;AAClD,SAASC,gBAAA,EAAkBC,gBAAA,QAAwB;AAiDvC,SA8CEC,QAAA,EA9CFC,GAAA;AAxCL,SAASC,UAAUC,OAAA,EAAyB;EACjD,IAAIC,MAAA,CAAAC,IAAA,CAAYC,GAAA,CAAIC,GAAA,EAClB,OAAO;IACLJ,OAAA;IACAZ,MAAA,EAAQ,MAAOiB,KAAA,IAA0B;MAEvC,MAAM,CAACC,cAAA,EAAgBC,YAAY,IAAI,MAAMC,OAAA,CAAQC,GAAA,CAAI,CACvD,OAAO,0BAA0B,GACjC,OAAO,qBAAiB,EACzB;QAEKC,oBAAA,GACJJ,cAAA,CAAeI,oBAAA,IACfJ,cAAA,CAAeK,OAAA,EAASD,oBAAA;QACpBE,cAAA,GAAiBL,YAAA,CAAaK,cAAA;MAEpC,IAAI;QACFC,UAAA;QACAC,WAAA;QACAC,GAAA;QACAC,WAAA;QACAC,IAAA;QACAC,gBAAA;QACAC,aAAA,EAAAC;MACF,IAAIf,KAAA;MAEJT,gBAAA,CAAiB;QACfyB,cAAA,EAAgBH,gBAAA;QAChBL,UAAA;QACAC,WAAA;QACAG,IAAA;QACAF,GAAA;QACAC,WAAA;QACAG,aAAA,EAAAC;MACF,CAAC;MAED,IAAIE,QAAA;MAEJ,MAAMC,GAAA,GAAMA,CAAA,KAER,eAAAzB,GAAA,CAACT,IAAA;QACCmC,KAAA,EAAOxB,OAAA,CAAQwB,KAAA;QACfC,UAAA,EAAaC,EAAA,IAAO;UAClBJ,QAAA,GAAWI,EAAA;QACb;QACAC,MAAA,EAAQ3B,OAAA,CAAQ2B,MAAA;QAChBC,UAAA,EAAY5B,OAAA,CAAQ4B,UAAA;QACnB,GAAGvB;MAAA,CACN;MAIJnB,WAAA,CAAY2C,iBAAA,CAAkB,OAAO,MAAMN,GAAG;MAG9C,MAAMO,WAAA,GAAc5C,WAAA,CAAY6C,cAAA,CAAe,OAAO,CAAC,CAAC;QAGlDC,WAAA,GAAcF,WAAA,CAAYG,OAAA,CAAQ5B,KAAA,CAAM6B,QAAA;MAE9C,IAAIC,IAAA,GAAO,MAAMvB,cAAA,CAAeoB,WAAA,EAAa;QAC3CI,QAAA,EAAU/B,KAAA,CAAM+B,QAAA;QAChBC,gBAAA,EAAkBhC,KAAA,CAAMgC;MAC1B,CAAC;MAED,IAAI;QACF,MAAMC,iBAAA,GAA0C,EAAC;UAE3CC,QAAA,GAAWT,WAAA,CAAYU,eAAA,CAAgB;YAAEC,KAAA,EAAOC,OAAA,CAAQvC,GAAA,CAAIwC;UAAU,CAAC;QACzEJ,QAAA,IACFD,iBAAA,CAAkBM,IAAA,CAAKL,QAAQ,GAGjC/C,YAAA,CAAa8B,QAAQ;QACrB,MAAMuB,UAAA,GAAatD,uBAAA,CAAwB+B,QAAQ;QACnD,IAAIuB,UAAA,EACF,WAAWC,SAAA,IAAaD,UAAA,EAAY;UAClC,MAAME,GAAA,GAAMD,SAAA,CAAU;UAClBC,GAAA,IACFT,iBAAA,CAAkBM,IAAA,CAAKG,GAAG;QAE9B;QAGF,IAAIT,iBAAA,CAAkBU,MAAA,EAAQ;UAC5B,MAAMC,aAAA,GAAgBvC,oBAAA,CACpB,eAAAZ,GAAA,CAAAD,QAAA;YAAGqC,QAAA,EAAAI,iBAAA,CAAkBY,GAAA,CAAI,CAACC,CAAA,EAAGC,CAAA,KAAMnE,YAAA,CAAakE,CAAA,EAAG;cAAEE,GAAA,EAAKD;YAAE,CAAC,CAAC;UAAA,CAAE,CAClE;UAEIH,aAAA,KACFd,IAAA,GAAOA,IAAA,CAAKmB,OAAA,CAAQ,WAAW,GAAGL,aAAa,SAAS;QAE5D;MACF,SAASM,GAAA,EAAK;QAGZ,IAAI,IAAGA,GAAG,GAAGC,QAAA,CAAS,sBAAsB,GAG1C,MAAMD,GAAA;MAEV;MAGA,MAAMlC,cAAA,GAAiB1B,gBAAA,CAAiB,GAAG0B,cAAA;MAE3C,OAAIA,cAAA,KACFc,IAAA,GAAOA,IAAA,CAAKmB,OAAA,CACV7D,iBAAA,CAAkBC,iCAAiC,GACnDD,iBAAA,CAAkB4B,cAAc,CAClC,IAGKc,IAAA;IACT;EACF;EAGF,MAAMsB,aAAA,GAAgB9D,gBAAA,CAAiB,KAAK,CAAC;IACvCwB,aAAA,GAAgBsC,aAAA,CAActC,aAAA;IAI9BuC,eAAA,GAAkBvC,aAAA,GACpBwC,MAAA,CAAOC,OAAA,CAAQzC,aAAa,EAAE+B,GAAA,CAAI,OAAO,CAACW,QAAA,EAAUC,UAAU,MAAM;MAClE,MAAMC,GAAA,GAAM,MAAM;MAA0BD,UAAA;MAC5C,OAAAxE,sBAAA,CAAuBuE,QAAA,EAAUE,GAAG,GAC7BA,GAAA;IACT,CAAC,IACD,CAAC/D,OAAA,CAAQ2B,MAAA,CAAO,IAAI3B,OAAA,CAAQ4B,UAAU,cAAc,IAAI,CAAC;EAE7D,OAAOpB,OAAA,CAAQC,GAAA,CAAIiD,eAAe,EAC/BM,IAAA,CAAK,MACG7E,mBAAA,CAAoBsE,aAAa,CACzC,EACAO,IAAA,CAAK,MAAM;IACV5E,MAAA,CACE,eAAAU,GAAA,CAACT,IAAA;MACC4E,QAAA,EAAQ;MACRzC,KAAA,EAAOxB,OAAA,CAAQwB,KAAA;MACfG,MAAA,EAAQ3B,OAAA,CAAQ2B,MAAA;MAChBC,UAAA,EAAY5B,OAAA,CAAQ4B,UAAA;MACpBsC,IAAA,EAAMC,MAAA,CAAOC,QAAA,CAASC;IAAA,CACxB,CACF;EACF,CAAC,EACAC,KAAA,CAAOf,GAAA,IAAQ;IACdgB,OAAA,CAAQC,KAAA,CAAM,uCAAuCjB,GAAG;EAC1D,CAAC;AACL","ignoreList":[]}

package/dist/esm/server/ServerContextScript.js

@@ -1,4 +1,5 @@
 import { SERVER_CONTEXT_KEY } from "../constants";
+import { safeJsonStringify } from "../utils/htmlEscape";
 import { SERVER_CONTEXT_POST_RENDER_STRING } from "../vite/constants";
 import { useServerContext } from "../vite/one-server-only";
 import { jsx } from "react/jsx-runtime";
@@ -28,11 +29,11 @@ function ServerContextScript() {
         suppressHydrationWarning: !0,
         dangerouslySetInnerHTML: {
           __html: `
-              globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify({
+              globalThis["${SERVER_CONTEXT_KEY}"] = ${safeJsonStringify({
             ...clientContext,
             postRenderData: SERVER_CONTEXT_POST_RENDER_STRING
           })};
-              globalThis.__oneLoadedCSS = new Set(${JSON.stringify(cssUrls)});
+              globalThis.__oneLoadedCSS = new Set(${safeJsonStringify(cssUrls)});
           `
         }
       }

package/dist/esm/server/ServerContextScript.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/server/ServerContextScript.tsx"],
-  "mappings": "AAAA,SAAS,0BAA0B;AACnC,SAAS,yCAAyC;AAClD,SAAS,wBAAwB;AAK3B;AAHC,SAAS,sBAAsB;AACpC,MAAI,QAAQ,IAAI,qBAAqB;AACnC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAK;AAAA,QAEL,MAAM;AAAA,QACN,0BAAwB;AAAA,QACxB,yBAAyB;AAAA,UACvB,QAAQ;AAAA,QACV;AAAA;AAAA,IACF;AAIJ,MAAI,QAAQ,IAAI,qBAAqB,OAAO;AAC1C,UAAM,UAAU,iBAAiB,GAC3B,UAAU,SAAS,OAAO,CAAC,GAM3B,EAAE,aAAa,GAAG,YAAY,IAAI,WAAW,CAAC,GAC9C,gBAAgB;AAAA,MACpB,GAAG;AAAA,MACH,gBAAgB,aAAa,UAAU;AAAA,IACzC;AAEA,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAK;AAAA,QAEL,MAAM;AAAA,QACN,0BAAwB;AAAA,QACxB,yBAAyB;AAAA,UACvB,QAAQ;AAAA,4BACU,kBAAkB,QAAQ,KAAK,UAAU;AAAA,YACrD,GAAG;AAAA,YACH,gBAAgB;AAAA,UAClB,CAAC,CAAC;AAAA,oDACoC,KAAK,UAAU,OAAO,CAAC;AAAA;AAAA,QAEnE;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,SAAO;AACT;",
+  "mappings": "AAAA,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC,SAAS,yCAAyC;AAClD,SAAS,wBAAwB;AAK3B;AAHC,SAAS,sBAAsB;AACpC,MAAI,QAAQ,IAAI,qBAAqB;AACnC,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAK;AAAA,QAEL,MAAM;AAAA,QACN,0BAAwB;AAAA,QACxB,yBAAyB;AAAA,UACvB,QAAQ;AAAA,QACV;AAAA;AAAA,IACF;AAIJ,MAAI,QAAQ,IAAI,qBAAqB,OAAO;AAC1C,UAAM,UAAU,iBAAiB,GAC3B,UAAU,SAAS,OAAO,CAAC,GAM3B,EAAE,aAAa,GAAG,YAAY,IAAI,WAAW,CAAC,GAC9C,gBAAgB;AAAA,MACpB,GAAG;AAAA,MACH,gBAAgB,aAAa,UAAU;AAAA,IACzC;AAEA,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAK;AAAA,QAEL,MAAM;AAAA,QACN,0BAAwB;AAAA,QACxB,yBAAyB;AAAA,UACvB,QAAQ;AAAA,4BACU,kBAAkB,QAAQ,kBAAkB;AAAA,YACxD,GAAG;AAAA,YACH,gBAAgB;AAAA,UAClB,CAAC,CAAC;AAAA,oDACoC,kBAAkB,OAAO,CAAC;AAAA;AAAA,QAEtE;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,SAAO;AACT;",
   "names": []
 }

package/dist/esm/server/ServerContextScript.mjs

@@ -1,4 +1,5 @@
 import { SERVER_CONTEXT_KEY } from "../constants.mjs";
+import { safeJsonStringify } from "../utils/htmlEscape.mjs";
 import { SERVER_CONTEXT_POST_RENDER_STRING } from "../vite/constants.mjs";
 import { useServerContext } from "../vite/one-server-only.mjs";
 import { jsx } from "react/jsx-runtime";
@@ -28,11 +29,11 @@ function ServerContextScript() {
       suppressHydrationWarning: !0,
       dangerouslySetInnerHTML: {
         __html: `
-              globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify({
+              globalThis["${SERVER_CONTEXT_KEY}"] = ${safeJsonStringify({
           ...clientContext,
           postRenderData: SERVER_CONTEXT_POST_RENDER_STRING
         })};
-              globalThis.__oneLoadedCSS = new Set(${JSON.stringify(cssUrls)});
+              globalThis.__oneLoadedCSS = new Set(${safeJsonStringify(cssUrls)});
           `
       }
     });

package/dist/esm/server/ServerContextScript.mjs.map

@@ -1 +1 @@
-{"version":3,"names":["SERVER_CONTEXT_KEY","SERVER_CONTEXT_POST_RENDER_STRING","useServerContext","jsx","ServerContextScript","process","env","VITE_ENVIRONMENT","async","href","suppressHydrationWarning","dangerouslySetInnerHTML","__html","context","cssUrls","css","cssContents","restContext","clientContext","cssInlineCount","length","JSON","stringify","postRenderData"],"sources":["../../../src/server/ServerContextScript.tsx"],"sourcesContent":[null],"mappings":"AAAA,SAASA,kBAAA,QAA0B;AACnC,SAASC,iCAAA,QAAyC;AAClD,SAASC,gBAAA,QAAwB;AAK3B,SAAAC,GAAA;AAHC,SAASC,oBAAA,EAAsB;EACpC,IAAIC,OAAA,CAAQC,GAAA,CAAIC,gBAAA,KAAqB,UACnC,OACE,eAAAJ,GAAA,CAAC;IACCK,KAAA,EAAK;IAELC,IAAA,EAAMT,kBAAA;IACNU,wBAAA,EAAwB;IACxBC,uBAAA,EAAyB;MACvBC,MAAA,EAAQ;IACV;EAAA,CACF;EAIJ,IAAIP,OAAA,CAAQC,GAAA,CAAIC,gBAAA,KAAqB,OAAO;IAC1C,MAAMM,OAAA,GAAUX,gBAAA,CAAiB;MAC3BY,OAAA,GAAUD,OAAA,EAASE,GAAA,IAAO,EAAC;MAM3B;QAAEC,WAAA;QAAa,GAAGC;MAAY,IAAIJ,OAAA,IAAW,CAAC;MAC9CK,aAAA,GAAgB;QACpB,GAAGD,WAAA;QACHE,cAAA,EAAgBH,WAAA,EAAaI,MAAA,IAAU;MACzC;IAEA,OACE,eAAAjB,GAAA,CAAC;MACCK,KAAA,EAAK;MAELC,IAAA,EAAMT,kBAAA;MACNU,wBAAA,EAAwB;MACxBC,uBAAA,EAAyB;QACvBC,MAAA,EAAQ;AAAA,4BACUZ,kBAAkB,QAAQqB,IAAA,CAAKC,SAAA,CAAU;UACrD,GAAGJ,aAAA;UACHK,cAAA,EAAgBtB;QAClB,CAAC,CAAC;AAAA,oDACoCoB,IAAA,CAAKC,SAAA,CAAUR,OAAO,CAAC;AAAA;MAEnE;IAAA,CACF;EAEJ;EAEA,OAAO;AACT","ignoreList":[]}
+{"version":3,"names":["SERVER_CONTEXT_KEY","safeJsonStringify","SERVER_CONTEXT_POST_RENDER_STRING","useServerContext","jsx","ServerContextScript","process","env","VITE_ENVIRONMENT","async","href","suppressHydrationWarning","dangerouslySetInnerHTML","__html","context","cssUrls","css","cssContents","restContext","clientContext","cssInlineCount","length","postRenderData"],"sources":["../../../src/server/ServerContextScript.tsx"],"sourcesContent":[null],"mappings":"AAAA,SAASA,kBAAA,QAA0B;AACnC,SAASC,iBAAA,QAAyB;AAClC,SAASC,iCAAA,QAAyC;AAClD,SAASC,gBAAA,QAAwB;AAK3B,SAAAC,GAAA;AAHC,SAASC,oBAAA,EAAsB;EACpC,IAAIC,OAAA,CAAQC,GAAA,CAAIC,gBAAA,KAAqB,UACnC,OACE,eAAAJ,GAAA,CAAC;IACCK,KAAA,EAAK;IAELC,IAAA,EAAMV,kBAAA;IACNW,wBAAA,EAAwB;IACxBC,uBAAA,EAAyB;MACvBC,MAAA,EAAQ;IACV;EAAA,CACF;EAIJ,IAAIP,OAAA,CAAQC,GAAA,CAAIC,gBAAA,KAAqB,OAAO;IAC1C,MAAMM,OAAA,GAAUX,gBAAA,CAAiB;MAC3BY,OAAA,GAAUD,OAAA,EAASE,GAAA,IAAO,EAAC;MAM3B;QAAEC,WAAA;QAAa,GAAGC;MAAY,IAAIJ,OAAA,IAAW,CAAC;MAC9CK,aAAA,GAAgB;QACpB,GAAGD,WAAA;QACHE,cAAA,EAAgBH,WAAA,EAAaI,MAAA,IAAU;MACzC;IAEA,OACE,eAAAjB,GAAA,CAAC;MACCK,KAAA,EAAK;MAELC,IAAA,EAAMV,kBAAA;MACNW,wBAAA,EAAwB;MACxBC,uBAAA,EAAyB;QACvBC,MAAA,EAAQ;AAAA,4BACUb,kBAAkB,QAAQC,iBAAA,CAAkB;UACxD,GAAGkB,aAAA;UACHG,cAAA,EAAgBpB;QAClB,CAAC,CAAC;AAAA,oDACoCD,iBAAA,CAAkBc,OAAO,CAAC;AAAA;MAEtE;IAAA,CACF;EAEJ;EAEA,OAAO;AACT","ignoreList":[]}

package/dist/esm/server/ServerContextScript.native.js

@@ -1,5 +1,6 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { SERVER_CONTEXT_KEY } from "../constants.native.js";
+import { safeJsonStringify } from "../utils/htmlEscape.native.js";
 import { SERVER_CONTEXT_POST_RENDER_STRING } from "../vite/constants.native.js";
 import { useServerContext } from "../vite/one-server-only.native.js";
 function ServerContextScript() {
@@ -30,11 +31,11 @@ function ServerContextScript() {
       suppressHydrationWarning: !0,
       dangerouslySetInnerHTML: {
         __html: `
-              globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify({
+              globalThis["${SERVER_CONTEXT_KEY}"] = ${safeJsonStringify({
           ...clientContext,
           postRenderData: SERVER_CONTEXT_POST_RENDER_STRING
         })};
-              globalThis.__oneLoadedCSS = new Set(${JSON.stringify(cssUrls)});
+              globalThis.__oneLoadedCSS = new Set(${safeJsonStringify(cssUrls)});
           `
       }
     });

package/dist/esm/server/ServerContextScript.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["jsx","_jsx","SERVER_CONTEXT_KEY","SERVER_CONTEXT_POST_RENDER_STRING","useServerContext","ServerContextScript","process","env","VITE_ENVIRONMENT","async","href","suppressHydrationWarning","dangerouslySetInnerHTML","__html","context","cssUrls","css","cssContents","restContext","clientContext","cssInlineCount","length","JSON","stringify","postRenderData"],"sources":["../../../src/server/ServerContextScript.tsx"],"sourcesContent":[null],"mappings":"AAAA,SAASA,GAAA,IAAAC,IAAA,2BAA0B;AACnC,SAASC,kBAAA;AACT,SAASC,iCAAwB;AAK3B,SAAAC,gBAAA;AAHC,SAASC,oBAAA,EAAsB;EACpC,IAAIC,OAAA,CAAQC,GAAA,CAAIC,gBAAA,KAAqB,UACnC,OACE,eAAAP,IAAA;IAACQ,KAAA;IAAA;IAAAC,IACC,EAAAR,kBAAK;IAAAS,wBAEC;IAAAC,uBACN;MACAC,MAAA;IAAyB;EACf;EACV,IAAAP,OAAA,CAAAC,GAAA,CAAAC,gBAAA;IACF,IAAAM,OAAA,GAAAV,gBAAA;MAAAW,OAAA,GAAAD,OAAA,EAAAE,GAAA;MAAA;QAAAC,WAAA;QAAA,GAAAC;MAAA,IAAAJ,OAAA;MAAAK,aAAA;QAIA,GAAAD,WAAY;QACdE,cAAgB,EAAAH,WAAA,EAAAI,MACV;MAOgB;IACjB,OACH,eAAgBpB,IAAA,SAAa;MAC/BQ,KAAA;MAEA;MACGC,IAAA,EAAAR,kBAAA;MAAAS,wBAAA;MAAAC,uBACM;QAELC,MAAM;AAAA,4BACNX,kBAAwB,QAAAoB,IAAA,CAAAC,SAAA;UACxB,GAAAJ,aAAA;UACEK,cAAQ,EAAArB;QAAA;AACmD,oDAClDmB,IAAA,CAAAC,SAAA,CAAAR,OAAA;AAAA;MACa;IAChB;EAC2D;EAAA,OAEnE;AAAA;AAAA,SAGNV,mBAAA","ignoreList":[]}
+{"version":3,"names":["jsx","_jsx","SERVER_CONTEXT_KEY","safeJsonStringify","SERVER_CONTEXT_POST_RENDER_STRING","useServerContext","ServerContextScript","process","env","VITE_ENVIRONMENT","async","href","suppressHydrationWarning","dangerouslySetInnerHTML","__html","context","cssUrls","css","cssContents","restContext","clientContext","cssInlineCount","length","postRenderData"],"sources":["../../../src/server/ServerContextScript.tsx"],"sourcesContent":[null],"mappings":"AAAA,SAASA,GAAA,IAAAC,IAAA,2BAA0B;AACnC,SAASC,kBAAA,QAAyB;AAClC,SAASC,iBAAA,uCAAyC;AAClD,SAASC,iCAAwB;AAK3B,SAAAC,gBAAA;AAHC,SAASC,oBAAA,EAAsB;EACpC,IAAIC,OAAA,CAAQC,GAAA,CAAIC,gBAAA,KAAqB,UACnC,OACE,eAAAR,IAAA;IAACS,KAAA;IAAA;IAAAC,IACC,EAAAT,kBAAK;IAAAU,wBAEC;IAAAC,uBACN;MACAC,MAAA;IAAyB;EACf;EACV,IAAAP,OAAA,CAAAC,GAAA,CAAAC,gBAAA;IACF,IAAAM,OAAA,GAAAV,gBAAA;MAAAW,OAAA,GAAAD,OAAA,EAAAE,GAAA;MAAA;QAAAC,WAAA;QAAA,GAAAC;MAAA,IAAAJ,OAAA;MAAAK,aAAA;QAIA,GAAAD,WAAY;QACdE,cAAgB,EAAAH,WAAA,EAAAI,MACV;MAOgB;IACjB,OACH,eAAgBrB,IAAA,SAAa;MAC/BS,KAAA;MAEA;MACGC,IAAA,EAAAT,kBAAA;MAAAU,wBAAA;MAAAC,uBACM;QAELC,MAAM;AAAA,4BACNZ,kBAAwB,QAAAC,iBAAA;UACxB,GAAAiB,aAAA;UACEG,cAAQ,EAAAnB;QAAA;AACsD,oDACrDD,iBAAA,CAAAa,OAAA;AAAA;MACa;IAChB;EAC8D;EAAA,OAEtE;AAAA;AAAA,SAGNV,mBAAA","ignoreList":[]}

package/dist/esm/utils/htmlEscape.js

@@ -0,0 +1,23 @@
+const ESCAPE_LOOKUP = {
+  "&": "\\u0026",
+  // &
+  "<": "\\u003c",
+  // <
+  ">": "\\u003e",
+  // >
+  "\u2028": "\\u2028",
+  // Line separator
+  "\u2029": "\\u2029"
+  // Paragraph separator
+}, ESCAPE_REGEX = /[\u0026\u003c\u003e\u2028\u2029]/g;
+function htmlEscapeJsonString(str) {
+  return str.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
+}
+function safeJsonStringify(value) {
+  return htmlEscapeJsonString(JSON.stringify(value));
+}
+export {
+  htmlEscapeJsonString,
+  safeJsonStringify
+};
+//# sourceMappingURL=htmlEscape.js.map

package/dist/esm/utils/htmlEscape.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/utils/htmlEscape.ts"],
+  "mappings": "AAIA,MAAM,gBAAwC;AAAA,EAC5C,KAAU;AAAA;AAAA,EACV,KAAU;AAAA;AAAA,EACV,KAAU;AAAA;AAAA,EACV,UAAU;AAAA;AAAA,EACV,UAAU;AAAA;AACZ,GAEM,eAAe;AAad,SAAS,qBAAqB,KAAqB;AACxD,SAAO,IAAI,QAAQ,cAAc,CAAC,UAAU,cAAc,KAAK,CAAC;AAClE;AAKO,SAAS,kBAAkB,OAAwB;AACxD,SAAO,qBAAqB,KAAK,UAAU,KAAK,CAAC;AACnD;",
+  "names": []
+}

package/dist/esm/utils/htmlEscape.mjs

@@ -0,0 +1,21 @@
+const ESCAPE_LOOKUP = {
+    "&": "\\u0026",
+    // &
+    "<": "\\u003c",
+    // <
+    ">": "\\u003e",
+    // >
+    "\u2028": "\\u2028",
+    // Line separator
+    "\u2029": "\\u2029"
+    // Paragraph separator
+  },
+  ESCAPE_REGEX = /[\u0026\u003c\u003e\u2028\u2029]/g;
+function htmlEscapeJsonString(str) {
+  return str.replace(ESCAPE_REGEX, match => ESCAPE_LOOKUP[match]);
+}
+function safeJsonStringify(value) {
+  return htmlEscapeJsonString(JSON.stringify(value));
+}
+export { htmlEscapeJsonString, safeJsonStringify };
+//# sourceMappingURL=htmlEscape.mjs.map

package/dist/esm/utils/htmlEscape.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["ESCAPE_LOOKUP","ESCAPE_REGEX","htmlEscapeJsonString","str","replace","match","safeJsonStringify","value","JSON","stringify"],"sources":["../../../src/utils/htmlEscape.ts"],"sourcesContent":[null],"mappings":"AAIA,MAAMA,aAAA,GAAwC;IAC5C,KAAU;IAAA;IACV,KAAU;IAAA;IACV,KAAU;IAAA;IACV,UAAU;IAAA;IACV,UAAU;IAAA;EACZ;EAEMC,YAAA,GAAe;AAad,SAASC,qBAAqBC,GAAA,EAAqB;EACxD,OAAOA,GAAA,CAAIC,OAAA,CAAQH,YAAA,EAAeI,KAAA,IAAUL,aAAA,CAAcK,KAAK,CAAC;AAClE;AAKO,SAASC,kBAAkBC,KAAA,EAAwB;EACxD,OAAOL,oBAAA,CAAqBM,IAAA,CAAKC,SAAA,CAAUF,KAAK,CAAC;AACnD","ignoreList":[]}

package/dist/esm/utils/htmlEscape.native.js

@@ -0,0 +1,22 @@
+var ESCAPE_LOOKUP = {
+    "&": "\\u0026",
+    // &
+    "<": "\\u003c",
+    // <
+    ">": "\\u003e",
+    // >
+    "\u2028": "\\u2028",
+    // Line separator
+    "\u2029": "\\u2029"
+  },
+  ESCAPE_REGEX = /[\u0026\u003c\u003e\u2028\u2029]/g;
+function htmlEscapeJsonString(str) {
+  return str.replace(ESCAPE_REGEX, function (match) {
+    return ESCAPE_LOOKUP[match];
+  });
+}
+function safeJsonStringify(value) {
+  return htmlEscapeJsonString(JSON.stringify(value));
+}
+export { htmlEscapeJsonString, safeJsonStringify };
+//# sourceMappingURL=htmlEscape.native.js.map

package/dist/esm/utils/htmlEscape.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ESCAPE_LOOKUP","ESCAPE_REGEX","htmlEscapeJsonString","str","replace","match","safeJsonStringify","value","JSON","stringify"],"sources":["../../../src/utils/htmlEscape.ts"],"sourcesContent":[null],"mappings":"AAIA,IAAAA,aAAM;IACJ,KAAU;IAAA;IACV,KAAU;IAAA;IACV,KAAU;IAAA;IACV,UAAU;IAAA;IACV,UAAU;EAAA;EAAAC,YAAA;AACZ,SAEMC,oBAAeA,CAAAC,GAAA;EAad,OAASA,GAAA,CAAAC,OAAA,CAAAH,YAAqB,EAAqB,UAAAI,KAAA;IACxD,OAAOL,aAAY,CAAAK,KAAA;EACrB;AAKO;AACL,SAAOC,kBAAAC,KAAqB;EAC9B,OAAAL,oBAAA,CAAAM,IAAA,CAAAC,SAAA,CAAAF,KAAA","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "one",
-  "version": "1.2.51",
+  "version": "1.2.52",
   "license": "BSD-3-Clause",
   "sideEffects": [
     "setup.mjs",
@@ -130,17 +130,17 @@
     "@react-navigation/routers": "~7.5.1",
     "@swc/core": "^1.14.0",
     "@ungap/structured-clone": "^1.2.0",
-    "@vxrn/color-scheme": "1.2.51",
-    "@vxrn/compiler": "1.2.51",
-    "@vxrn/resolve": "1.2.51",
-    "@vxrn/tslib-lite": "1.2.51",
-    "@vxrn/use-isomorphic-layout-effect": "1.2.51",
-    "@vxrn/vite-plugin-metro": "1.2.51",
+    "@vxrn/color-scheme": "1.2.52",
+    "@vxrn/compiler": "1.2.52",
+    "@vxrn/resolve": "1.2.52",
+    "@vxrn/tslib-lite": "1.2.52",
+    "@vxrn/use-isomorphic-layout-effect": "1.2.52",
+    "@vxrn/vite-plugin-metro": "1.2.52",
     "babel-dead-code-elimination": "^1.0.10",
     "babel-plugin-module-resolver": "^5.0.2",
     "citty": "^0.1.6",
     "core-js": "^3.38.1",
-    "create-vxrn": "1.2.51",
+    "create-vxrn": "1.2.52",
     "escape-string-regexp": "^5.0.0",
     "expo-linking": "~8.0.8",
     "expo-modules-core": "~3.0.24",
@@ -166,7 +166,7 @@
     "vite": "^7.1.12",
     "vite-plugin-barrel": "^0.4.1",
     "vite-tsconfig-paths": "^5.1.4",
-    "vxrn": "1.2.51",
+    "vxrn": "1.2.52",
     "ws": "^8.18.0",
     "xxhashjs": "^0.2.2"
   },

package/src/constants.ts

@@ -1,3 +1,4 @@
+import { safeJsonStringify } from './utils/htmlEscape'
 import type { One } from './vite/types'
 
 export const isWebClient =
@@ -29,6 +30,6 @@ export const getSpaHeaderElements = ({
 } = {}) => `
   <script>globalThis['global'] = globalThis</script>
   <script>globalThis['__vxrnIsSPA'] = true</script>
-  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify(serverContext)}</script>
-  <script>globalThis.__oneLoadedCSS = new Set(${JSON.stringify(serverContext.css || [])})</script>
+  <script>globalThis["${SERVER_CONTEXT_KEY}"] = ${safeJsonStringify(serverContext)}</script>
+  <script>globalThis.__oneLoadedCSS = new Set(${safeJsonStringify(serverContext.css || [])})</script>
 `

package/src/createApp.tsx

@@ -9,6 +9,7 @@ import { registerPreloadedRoute } from './router/useViteRoutes'
 import type { RenderAppProps } from './types'
 import { getServerHeadInsertions } from './useServerHeadInsertion'
 import { ensureExists } from './utils/ensureExists'
+import { safeJsonStringify } from './utils/htmlEscape'
 import { SERVER_CONTEXT_POST_RENDER_STRING } from './vite/constants'
 import { getServerContext, setServerContext } from './vite/one-server-only'
 import type { One } from './vite/types'
@@ -127,8 +128,8 @@ export function createApp(options: CreateAppProps) {
 
         if (postRenderData) {
           html = html.replace(
-            JSON.stringify(SERVER_CONTEXT_POST_RENDER_STRING),
-            JSON.stringify(postRenderData)
+            safeJsonStringify(SERVER_CONTEXT_POST_RENDER_STRING),
+            safeJsonStringify(postRenderData)
           )
         }
 

package/src/server/ServerContextScript.tsx

@@ -1,4 +1,5 @@
 import { SERVER_CONTEXT_KEY } from '../constants'
+import { safeJsonStringify } from '../utils/htmlEscape'
 import { SERVER_CONTEXT_POST_RENDER_STRING } from '../vite/constants'
 import { useServerContext } from '../vite/one-server-only'
 
@@ -39,11 +40,11 @@ export function ServerContextScript() {
         suppressHydrationWarning
         dangerouslySetInnerHTML={{
           __html: `
-              globalThis["${SERVER_CONTEXT_KEY}"] = ${JSON.stringify({
+              globalThis["${SERVER_CONTEXT_KEY}"] = ${safeJsonStringify({
                 ...clientContext,
                 postRenderData: SERVER_CONTEXT_POST_RENDER_STRING,
               })};
-              globalThis.__oneLoadedCSS = new Set(${JSON.stringify(cssUrls)});
+              globalThis.__oneLoadedCSS = new Set(${safeJsonStringify(cssUrls)});
           `,
         }}
       />

package/src/utils/htmlEscape.ts

@@ -0,0 +1,35 @@
+// Based on https://github.com/zertosh/htmlescape
+// Prevents XSS when embedding JSON in <script> tags
+// See: https://pragmaticwebsecurity.com/articles/spasecurity/json-stringify-xss.html
+
+const ESCAPE_LOOKUP: Record<string, string> = {
+  '\u0026': '\\u0026', // &
+  '\u003c': '\\u003c', // <
+  '\u003e': '\\u003e', // >
+  '\u2028': '\\u2028', // Line separator
+  '\u2029': '\\u2029', // Paragraph separator
+}
+
+const ESCAPE_REGEX = /[\u0026\u003c\u003e\u2028\u2029]/g
+
+/**
+ * Escapes a JSON string for safe embedding in HTML <script> tags.
+ *
+ * JSON.stringify doesn't escape characters like < and >, which means
+ * a string containing "</script>" can break out of a script tag and
+ * allow arbitrary code execution.
+ *
+ * This function escapes those characters as unicode escape sequences
+ * (e.g., < becomes \u003c) which are valid JSON but won't be parsed
+ * as HTML.
+ */
+export function htmlEscapeJsonString(str: string): string {
+  return str.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match])
+}
+
+/**
+ * Safely serializes a value to JSON for embedding in HTML <script> tags.
+ */
+export function safeJsonStringify(value: unknown): string {
+  return htmlEscapeJsonString(JSON.stringify(value))
+}

package/types/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEvC,eAAO,MAAM,WAAW,SACkD,CAAA;AAC1E,eAAO,MAAM,WAAW,SACkD,CAAA;AAC1E,eAAO,MAAM,QAAQ,SAA0C,CAAA;AAE/D,eAAO,MAAM,SAAS,QAA4E,CAAA;AAElG,eAAO,MAAM,0BAA0B,oBAAoB,CAAA;AAC3D,eAAO,MAAM,8BAA8B,0BAAwC,CAAA;AACnF,eAAO,MAAM,uBAAuB,QAA6C,CAAA;AACjF,eAAO,MAAM,iBAAiB,QAA+C,CAAA;AAE7E,eAAO,MAAM,kBAAkB,QAA6B,CAAA;AAC5D,eAAO,MAAM,sBAAsB,QAAiC,CAAA;AAGpE,eAAO,MAAM,qBAAqB,wBAAwB,CAAA;AAC1D,eAAO,MAAM,oBAAoB,oCAAyC,CAAA;AAE1E,eAAO,MAAM,kBAAkB,2BAA2B,CAAA;AAE1D,eAAO,MAAM,oBAAoB,GAAI,qBAElC;IACD,aAAa,CAAC,EAAE,GAAG,CAAC,aAAa,CAAA;CAC7B,WAKL,CAAA"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEvC,eAAO,MAAM,WAAW,SACkD,CAAA;AAC1E,eAAO,MAAM,WAAW,SACkD,CAAA;AAC1E,eAAO,MAAM,QAAQ,SAA0C,CAAA;AAE/D,eAAO,MAAM,SAAS,QAA4E,CAAA;AAElG,eAAO,MAAM,0BAA0B,oBAAoB,CAAA;AAC3D,eAAO,MAAM,8BAA8B,0BAAwC,CAAA;AACnF,eAAO,MAAM,uBAAuB,QAA6C,CAAA;AACjF,eAAO,MAAM,iBAAiB,QAA+C,CAAA;AAE7E,eAAO,MAAM,kBAAkB,QAA6B,CAAA;AAC5D,eAAO,MAAM,sBAAsB,QAAiC,CAAA;AAGpE,eAAO,MAAM,qBAAqB,wBAAwB,CAAA;AAC1D,eAAO,MAAM,oBAAoB,oCAAyC,CAAA;AAE1E,eAAO,MAAM,kBAAkB,2BAA2B,CAAA;AAE1D,eAAO,MAAM,oBAAoB,GAAI,qBAElC;IACD,aAAa,CAAC,EAAE,GAAG,CAAC,aAAa,CAAA;CAC7B,WAKL,CAAA"}

package/types/createApp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createApp.d.ts","sourceRoot":"","sources":["../src/createApp.tsx"],"names":[],"mappings":"AAAA,OAAO,SAAS,CAAA;AAQhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAK7C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEvC,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9C,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAA;CAClB,CAAA;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,cAAc;;oBAIrB,cAAc;EAiJzC"}
+{"version":3,"file":"createApp.d.ts","sourceRoot":"","sources":["../src/createApp.tsx"],"names":[],"mappings":"AAAA,OAAO,SAAS,CAAA;AAQhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAM7C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEvC,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9C,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAA;CAClB,CAAA;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,cAAc;;oBAIrB,cAAc;EAiJzC"}

package/types/server/ServerContextScript.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerContextScript.d.ts","sourceRoot":"","sources":["../../src/server/ServerContextScript.tsx"],"names":[],"mappings":"AAIA,wBAAgB,mBAAmB,mDAiDlC"}
+{"version":3,"file":"ServerContextScript.d.ts","sourceRoot":"","sources":["../../src/server/ServerContextScript.tsx"],"names":[],"mappings":"AAKA,wBAAgB,mBAAmB,mDAiDlC"}

package/types/utils/htmlEscape.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Escapes a JSON string for safe embedding in HTML <script> tags.
+ *
+ * JSON.stringify doesn't escape characters like < and >, which means
+ * a string containing "</script>" can break out of a script tag and
+ * allow arbitrary code execution.
+ *
+ * This function escapes those characters as unicode escape sequences
+ * (e.g., < becomes \u003c) which are valid JSON but won't be parsed
+ * as HTML.
+ */
+export declare function htmlEscapeJsonString(str: string): string;
+/**
+ * Safely serializes a value to JSON for embedding in HTML <script> tags.
+ */
+export declare function safeJsonStringify(value: unknown): string;
+//# sourceMappingURL=htmlEscape.d.ts.map

package/types/utils/htmlEscape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"htmlEscape.d.ts","sourceRoot":"","sources":["../../src/utils/htmlEscape.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAExD"}