tungsten 0.3.2 → 0.3.3

package/dist/rawHtml/filterContentNode.js

@@ -0,0 +1,96 @@
+import { ContentNodeIsComponent } from "../ContentNode.js";
+import { $props, $type } from "../contentNodeSymbols.js";
+import { StringIsHtmlEvent } from "../htmlEvents.js";
+import { blockedUrl, makeAllowCheck, removalFor, urlAttributes } from "./parseHtml.js";
+// The NodeProps equivalent of parseHtml's class->className, style->css
+// rename: the allow list is written in terms of the HTML attribute name, but
+// a content tree already carries Tungsten's prop names for these two.
+const attributeCheckName = {
+  className: 'class',
+  css: 'style'
+};
+function filterProps(tag, props, allow) {
+  const filtered = {};
+  for (const key in props) {
+    if (key === 'children') continue;
+    const value = props[key];
+    // Tungsten reads these as event listeners, not attributes - same rule
+    // parseHtml applies to on* HTML attributes, expressed for prop names.
+    if (StringIsHtmlEvent(key)) continue;
+    // Raw markup that bypasses tree filtering entirely: parseHtml never
+    // produces this prop, so a tree in its shape should not carry it either.
+    if (key === 'dangerouslySetInnerHTML') continue;
+    if (key === 'ref') continue;
+    const checkName = (attributeCheckName[key] ?? key).toLowerCase();
+    if (!allow.attribute(tag, checkName)) continue;
+    if (checkName in urlAttributes && typeof value === 'string' && blockedUrl(checkName, value)) continue;
+    filtered[key] = value;
+  }
+  return filtered;
+}
+// Matches toContentNode() in parseHtml.ts: zero children omits the prop,
+// one is the value directly (not wrapped in an array), two or more is an
+// array. Without this, an element that loses every child to filtering ends
+// up with an empty-array `children` instead of no `children` prop at all -
+// a shape parseHtml itself would never produce.
+function normalizeChildren(children) {
+  if (!Array.isArray(children)) return children;
+  if (children.length === 0) return null;
+  if (children.length === 1) return children[0] ?? null;
+  return children;
+}
+function filter(node, allow) {
+  if (node === undefined || node === null || node === true || node === false) return node;
+  if (typeof node === 'string' || typeof node === 'number') return node;
+  if (Array.isArray(node)) {
+    const out = [];
+    for (const child of node) {
+      const filteredChild = filter(child, allow);
+      // Non-rendered values, whether the child already was one or
+      // filtering made it one (an unwrapped or dropped element that
+      // left nothing behind), contribute nothing to the array - never
+      // a stray null placeholder in a dropped element's place.
+      if (filteredChild === undefined || filteredChild === null || filteredChild === true || filteredChild === false) continue;
+      if (Array.isArray(filteredChild)) out.push(...filteredChild);else out.push(filteredChild);
+    }
+    return out;
+  }
+  // Not authored markup - parseHtml never produces a component node, so a
+  // tree in its shape should not carry one either, but this is defensive
+  // rather than reachable: nothing that round-trips through storage (JSON)
+  // can carry a class or function reference.
+  if (ContentNodeIsComponent(node)) return node;
+  const tag = node[$type];
+  const removal = removalFor(tag, true, allow);
+  if (removal === 'drop') return null;
+  const children = normalizeChildren(filter(node[$props].children ?? null, allow));
+  if (removal === 'unwrap') return children ?? [];
+  return {
+    [$type]: tag,
+    [$props]: {
+      ...filterProps(tag, node[$props], allow),
+      ...(children === null ? {} : {
+        children
+      })
+    }
+  };
+}
+/**
+ * Applies an allow list to a content tree that already exists, rather than
+ * one being built - the same decisions `parseHtml(html, { allowList })` makes
+ * while parsing, for a tree that did not come from parsing HTML at all (one
+ * rebuilt from storage, for instance) and so never had the chance to.
+ *
+ * A disallowed element is unwrapped, keeping its children in its place, so
+ * filtering a tag never costs the reader the words inside it - the same rule
+ * `parseHtml` applies. An element holding program text rather than prose
+ * (`<script>`, and anything on the same footing as `<script>` even under a
+ * permissive allow list) is dropped whole instead. `on*` props, `ref`, and
+ * `dangerouslySetInnerHTML` are always stripped - the tree-shape equivalent
+ * of what `parseHtml` refuses to produce in the first place - and a `href`/
+ * `src`/... value using an executable scheme (`javascript:`, `vbscript:`) or,
+ * on a navigating attribute, `data:` is dropped the same way.
+ */
+export function filterContentNode(node, allowList) {
+  return filter(node, makeAllowCheck(allowList));
+}

package/dist/rawHtml/parseHtml.d.ts

@@ -18,6 +18,20 @@ export type ParseHtmlOptions = {
      */
     allowList?: HtmlAllowList | undefined;
 };
+export type AllowCheck = {
+    tag: (name: string) => boolean;
+    attribute: (tag: string, name: string) => boolean;
+};
+export declare function makeAllowCheck(allowList: HtmlAllowList | undefined): AllowCheck;
+export declare const urlAttributes: Record<string, true>;
+export declare function blockedUrl(attributeName: string, value: string): boolean;
+/**
+ * Whether an element survives, and if not, how it goes.
+ *
+ * Elements holding program text rather than prose are dropped whole — there is
+ * no reader's content inside them to preserve. Everything else is unwrapped.
+ */
+export declare function removalFor(name: string, sanitize: boolean, allow: AllowCheck): 'drop' | 'unwrap' | undefined;
 /**
  * Parses raw HTML into a Tungsten content tree.
  *

package/dist/rawHtml/parseHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parseHtml.d.ts","sourceRoot":"","sources":["../../src/rawHtml/parseHtml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAA8B,MAAM,mBAAmB,CAAA;AAKhF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,MAAM,gBAAgB,GAAG;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;CACxC,CAAA;AAsID;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,WAAW,CAqGnF"}
+{"version":3,"file":"parseHtml.d.ts","sourceRoot":"","sources":["../../src/rawHtml/parseHtml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAA8B,MAAM,mBAAmB,CAAA;AAKhF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,MAAM,gBAAgB,GAAG;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACrB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAC9B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpD,CAAA;AAID,wBAAgB,cAAc,CAAC,SAAS,EAAE,aAAa,GAAG,SAAS,GAAG,UAAU,CAe/E;AAiBD,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAE9C,CAAA;AA2BD,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAOxE;AAgCD;;;;;GAKG;AACH,wBAAgB,UAAU,CACtB,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,GACnD,MAAM,GAAG,QAAQ,GAAG,SAAS,CAK/B;AAYD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,WAAW,CAqGnF"}

package/dist/rawHtml/parseHtml.js

@@ -6,7 +6,7 @@ const allowEverything = {
   tag: () => true,
   attribute: () => true
 };
-function makeAllowCheck(allowList) {
+export function makeAllowCheck(allowList) {
   if (allowList === undefined) return allowEverything;
   const tags = new Set(allowList.tags);
   const attributes = new Set(allowList.attributes);
@@ -21,7 +21,7 @@ function makeAllowCheck(allowList) {
 }
 // REGEX: on followed by at least one letter, e.g. onclick, onerror
 const eventAttribute = /^on[a-z]/i;
-const urlAttributes = {
+export const urlAttributes = {
   href: true,
   src: true,
   action: true,
@@ -56,7 +56,7 @@ function urlScheme(url) {
   }
   return '';
 }
-function blockedUrl(attributeName, value) {
+export function blockedUrl(attributeName, value) {
   const scheme = urlScheme(value);
   if (scheme in executableSchemes) return true;
   // data: URLs can carry a whole HTML document, so they are barred from
@@ -87,7 +87,7 @@ function attributesToProps(tag, attributes, sanitize, allow) {
  * Elements holding program text rather than prose are dropped whole — there is
  * no reader's content inside them to preserve. Everything else is unwrapped.
  */
-function removalFor(name, sanitize, allow) {
+export function removalFor(name, sanitize, allow) {
   if (sanitize && name === 'script') return 'drop';
   if (allow.tag(name)) return undefined;
   return name in htmlRawTextTags ? 'drop' : 'unwrap';

package/dist/rawHtml/sanitizeHtml.d.ts

@@ -0,0 +1,17 @@
+import type { HtmlAllowList } from './HtmlAllowList.js';
+export type SanitizeHtmlOptions = {
+    /** Defaults to `safeHtmlAllowList`. Pass your own list to allow more or less. */
+    allowList?: HtmlAllowList;
+};
+/**
+ * Cleans untrusted HTML and returns it as a string, synchronously.
+ *
+ * `parseHtml()` already does the cleaning - this only adds the return trip,
+ * for a caller that needs the result as a string rather than a content tree:
+ * a paste handler cleaning a clipboard payload before it is inserted, or an
+ * editor cleaning its content before it is stored. Both happen at a rate
+ * `renderingNodeToHtml` (the async, component-aware server renderer) is the
+ * wrong shape for.
+ */
+export declare function sanitizeHtml(html: string, options?: SanitizeHtmlOptions): string;
+//# sourceMappingURL=sanitizeHtml.d.ts.map

package/dist/rawHtml/sanitizeHtml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../../src/rawHtml/sanitizeHtml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,MAAM,MAAM,mBAAmB,GAAG;IAC9B,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAA;CAC5B,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAGpF"}

package/dist/rawHtml/sanitizeHtml.js

@@ -0,0 +1,19 @@
+import { contentNodeToHtml } from "../render/contentNodeToHtml.js";
+import { parseHtml } from "./parseHtml.js";
+import { safeHtmlAllowList } from "./safeHtmlAllowList.js";
+/**
+ * Cleans untrusted HTML and returns it as a string, synchronously.
+ *
+ * `parseHtml()` already does the cleaning - this only adds the return trip,
+ * for a caller that needs the result as a string rather than a content tree:
+ * a paste handler cleaning a clipboard payload before it is inserted, or an
+ * editor cleaning its content before it is stored. Both happen at a rate
+ * `renderingNodeToHtml` (the async, component-aware server renderer) is the
+ * wrong shape for.
+ */
+export function sanitizeHtml(html, options = {}) {
+  const allowList = options.allowList ?? safeHtmlAllowList;
+  return contentNodeToHtml(parseHtml(html, {
+    allowList
+  }));
+}

package/dist/render/HeadData.d.ts

@@ -12,5 +12,6 @@ export type HeadData = {
     tungstenPublicEnv: TungstenEnvOrUndefined;
     siteBasePath: SiteBasePath;
     hmr: boolean | 'reload';
+    csr: boolean;
 };
 //# sourceMappingURL=HeadData.d.ts.map

package/dist/render/HeadData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HeadData.d.ts","sourceRoot":"","sources":["../../src/render/HeadData.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAE9D,MAAM,MAAM,YAAY,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,CAAA;AAE5C,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,mBAAmB,EAAE,aAAa,CAAC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,YAAY,EAAE,YAAY,CAAC;IAC3B,GAAG,EAAE,OAAO,GAAG,QAAQ,CAAA;CAC1B,CAAA"}
+{"version":3,"file":"HeadData.d.ts","sourceRoot":"","sources":["../../src/render/HeadData.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAE9D,MAAM,MAAM,YAAY,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,CAAA;AAE5C,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,mBAAmB,EAAE,aAAa,CAAC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,YAAY,EAAE,YAAY,CAAC;IAC3B,GAAG,EAAE,OAAO,GAAG,QAAQ,CAAA;IACvB,GAAG,EAAE,OAAO,CAAA;CACf,CAAA"}

package/dist/render/contentNodeToHtml.d.ts

@@ -0,0 +1,18 @@
+import type { ContentNode } from '../ContentNode.js';
+/**
+ * Serialises a content tree to HTML, synchronously.
+ *
+ * `renderingNodeToHtml` (the server's real renderer) covers the general case -
+ * components, async data, `<head>` - and is async and internal because of it.
+ * This covers the subset that never needs any of that: plain HTML elements,
+ * text and arrays, the exact shape `parseHtml()` produces. Given a component
+ * node it throws rather than silently rendering nothing, since a caller
+ * reaching for the synchronous path has nothing that could resolve one.
+ *
+ * Attribute values are escaped, unlike `renderingNodeToHtml`'s - that renderer
+ * trusts values from application-authored JSX; this one exists specifically to
+ * round-trip untrusted markup back out as a string, so a value carrying `"`
+ * must not be able to break out of its attribute.
+ */
+export declare function contentNodeToHtml(node: ContentNode): string;
+//# sourceMappingURL=contentNodeToHtml.d.ts.map

package/dist/render/contentNodeToHtml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contentNodeToHtml.d.ts","sourceRoot":"","sources":["../../src/render/contentNodeToHtml.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CA+C3D"}

package/dist/render/contentNodeToHtml.js

@@ -0,0 +1,66 @@
+import { ContentNodeIsComponent } from "../ContentNode.js";
+import { booleanAttributeValue } from "../booleanAttributeValue.js";
+import { $props, $type } from "../contentNodeSymbols.js";
+import { htmlEntities } from "../htmlEntities.js";
+import { innerHtmlFromProps } from "../innerHtmlFromProps.js";
+import { throwError } from "../throwError.js";
+import { validChildren } from "../validChildren.js";
+import { htmlMonoTags } from "./htmlMonoTags.js";
+import { htmlSelfClosableTags } from "./htmlSelfClosableTags.js";
+import { htmlVoidTags } from "./htmlVoidTags.js";
+import { processProps } from "./processProps.js";
+/**
+ * Serialises a content tree to HTML, synchronously.
+ *
+ * `renderingNodeToHtml` (the server's real renderer) covers the general case -
+ * components, async data, `<head>` - and is async and internal because of it.
+ * This covers the subset that never needs any of that: plain HTML elements,
+ * text and arrays, the exact shape `parseHtml()` produces. Given a component
+ * node it throws rather than silently rendering nothing, since a caller
+ * reaching for the synchronous path has nothing that could resolve one.
+ *
+ * Attribute values are escaped, unlike `renderingNodeToHtml`'s - that renderer
+ * trusts values from application-authored JSX; this one exists specifically to
+ * round-trip untrusted markup back out as a string, so a value carrying `"`
+ * must not be able to break out of its attribute.
+ */
+export function contentNodeToHtml(node) {
+  if (node === undefined || node === null || node === false || node === true) return '';
+  if (Array.isArray(node)) return node.map(contentNodeToHtml).join('');
+  if (typeof node === 'string' || typeof node === 'number') return htmlEntities(node.toString());
+  if (ContentNodeIsComponent(node)) {
+    throwError('contentNodeToHtml', `component nodes are not supported - encountered one of type ` + `${String(typeof node[$type] === 'string' ? node[$type] : node[$type].name)}.`);
+  }
+  const type = node[$type];
+  const {
+    children,
+    ...restProps
+  } = node[$props];
+  const attribProps = processProps(restProps);
+  let attributes = '';
+  for (const key in attribProps) {
+    const value = attribProps[key];
+    if (typeof value === 'boolean') {
+      const attrValue = booleanAttributeValue(key, value);
+      if (attrValue !== null) attributes += attrValue === '' ? ` ${key}` : ` ${key}="${attrValue}"`;
+    } else if (value !== undefined && value !== null) {
+      attributes += ` ${key}="${htmlEntities(String(value))}"`;
+    }
+  }
+  const innerHtml = innerHtmlFromProps(type, node[$props], validChildren(children));
+  if (innerHtml !== null) {
+    if (type in htmlVoidTags) {
+      throwError('contentNodeToHtml', `<${type}> is an HTML void type (cannot have children), but the node has dangerouslySetInnerHTML.`);
+    }
+    return `<${type}${attributes}>${innerHtml}</${type}>`;
+  }
+  if (validChildren(children)) {
+    if (type in htmlVoidTags) {
+      throwError('contentNodeToHtml', `<${type}> is an HTML void type (cannot have children), but the node has children.`);
+    }
+    return `<${type}${attributes}>${contentNodeToHtml(children)}</${type}>`;
+  }
+  if (type in htmlMonoTags) return `<${type}${attributes}>`;
+  if (type in htmlSelfClosableTags) return `<${type}${attributes} />`;
+  return `<${type}${attributes}></${type}>`;
+}

package/dist/render/contentToHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contentToHtml.d.ts","sourceRoot":"","sources":["../../src/render/contentToHtml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,KAAK,EAAY,YAAY,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAMvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAI9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AAGrE,wBAAsB,aAAa,CAC/B,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EACpE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EACxC,MAAM,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,YAAY,EACnE,iBAAiB,GAAE,sBAAkC,EAAE,GAAG,UAAQ,GACnE,OAAO,CAAC,MAAM,CAAC,CAqDjB"}
+{"version":3,"file":"contentToHtml.d.ts","sourceRoot":"","sources":["../../src/render/contentToHtml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,KAAK,EAAY,YAAY,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAMvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAI9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AAGrE,wBAAsB,aAAa,CAC/B,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EACpE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EACxC,MAAM,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,YAAY,EACnE,iBAAiB,GAAE,sBAAkC,EAAE,GAAG,UAAQ,GACnE,OAAO,CAAC,MAAM,CAAC,CAsDjB"}

package/dist/render/contentToHtml.js

@@ -23,7 +23,8 @@ export async function contentToHtml(compilationInfo, clientImportAliases, conten
     dev,
     tungstenPublicEnv,
     siteBasePath: siteBasePathOverride,
-    hmr: config.hmr
+    hmr: config.hmr,
+    csr: config.csr
   };
   //console.log('rendering tree', inspect(tree, { depth: 99 } ))
   let html = await renderingNodeToHtml(tree, false, headData, null);

package/dist/render/processHead.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"processHead.d.ts","sourceRoot":"","sources":["../../src/render/processHead.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAK7C,OAAO,EAAE,oBAAoB,EAAqB,MAAM,qBAAqB,CAAA;AAS7E,wBAAgB,WAAW,CACvB,QAAQ,EAAE,oBAAoB,EAC9B,QAAQ,EAAE,QAAQ,QAwLrB"}
+{"version":3,"file":"processHead.d.ts","sourceRoot":"","sources":["../../src/render/processHead.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAK7C,OAAO,EAAE,oBAAoB,EAAqB,MAAM,qBAAqB,CAAA;AAS7E,wBAAgB,WAAW,CACvB,QAAQ,EAAE,oBAAoB,EAC9B,QAAQ,EAAE,QAAQ,QA6MrB"}

package/dist/render/processHead.js

@@ -86,10 +86,16 @@ export function processHead(headNode, headData) {
     // Tier 1 (hmr: 'reload', or nothing left for Tier 2 to do): always full-reload. A
     // simple, independent branch from Tier 2's logic - restored as an explicit config value
     // so it's available as a one-line escape hatch if Tier 2 itself is misbehaving.
-    const tier1OnlyScript = `(function(){` + `var es=new EventSource('${siteBasePath}/__tungsten_live_reload__');` + `es.addEventListener('css',function(){location.reload()});` + `es.addEventListener('js',function(){location.reload()});` + `})();`;
+    // The server sends its bootId as the first event on every connection (see
+    // handleLiveReloadStream). If sessionStorage already holds a different one, this
+    // connection is a reconnect to a process that restarted since the page loaded (e.g. via
+    // tungsten devmon on a framework rebuild) - EventSource retries silently on its own, so
+    // this is the only reliable signal that the page is now stale and needs reloading.
+    const bootIdReloadSnippet = `es.addEventListener('boot',function(ev){` + `var bootId=JSON.parse(ev.data).bootId;` + `var key='__tungsten_boot_id__';` + `var prev=sessionStorage.getItem(key);` + `sessionStorage.setItem(key,bootId);` + `if(prev!==null&&prev!==bootId){location.reload()}` + `});`;
+    const tier1OnlyScript = `(function(){` + `var es=new EventSource('${siteBasePath}/__tungsten_live_reload__');` + bootIdReloadSnippet + `es.addEventListener('css',function(){location.reload()});` + `es.addEventListener('js',function(){location.reload()});` + `})();`;
     // Tier 2: attempt an in-place component/CSS hot-swap before falling back to a full
     // reload. See tungsten/docs/hmr.md.
-    const tier2Script = `(function(){` + `var es=new EventSource('${siteBasePath}/__tungsten_live_reload__');` + `function fullReload(reason){console.info('[tungsten-hmr] full reload:',reason);location.reload()}` + `function loadHmr(){return import('${frameworkDestLocation}/hmr/applyHmrModule.js')}`
+    const tier2Script = `(function(){` + `var es=new EventSource('${siteBasePath}/__tungsten_live_reload__');` + `function fullReload(reason){console.info('[tungsten-hmr] full reload:',reason);location.reload()}` + `es.addEventListener('boot',function(ev){` + `var bootId=JSON.parse(ev.data).bootId;` + `var key='__tungsten_boot_id__';` + `var prev=sessionStorage.getItem(key);` + `sessionStorage.setItem(key,bootId);` + `if(prev!==null&&prev!==bootId){fullReload('dev server restarted')}` + `});` + `function loadHmr(){return import('${frameworkDestLocation}/hmr/applyHmrModule.js')}`
     // CSS has no state to preserve, so re-applying it is always safe: refreshStylesheets()
     // inserts the new link and only removes the old one once it's loaded, so there's no
     // gap where nothing is applied (a plain href swap can produce a visible flash).

package/dist/render/renderingTreeToHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renderingTreeToHtml.d.ts","sourceRoot":"","sources":["../../src/render/renderingTreeToHtml.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAY7C,OAAO,EACH,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAG7C,MAAM,qBAAqB,CAAA;AAU5B,wBAAsB,mBAAmB,CACrC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAC1D,UAAU,EAAE,iBAAiB,GAAG,IAAI,GACrC,OAAO,CAAC,MAAM,CAAC,CAwJjB"}
+{"version":3,"file":"renderingTreeToHtml.d.ts","sourceRoot":"","sources":["../../src/render/renderingTreeToHtml.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAY7C,OAAO,EACH,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAG7C,MAAM,qBAAqB,CAAA;AAU5B,wBAAsB,mBAAmB,CACrC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAC1D,UAAU,EAAE,iBAAiB,GAAG,IAAI,GACrC,OAAO,CAAC,MAAM,CAAC,CA8JjB"}

package/dist/render/renderingTreeToHtml.js

@@ -1,4 +1,5 @@
 import { reduce as objectReduce } from 'sxy-lib/objects.js';
+import { booleanAttributeValue } from "../booleanAttributeValue.js";
 import { processProps } from "./processProps.js";
 import { htmlVoidTags } from "./htmlVoidTags.js";
 import { validRenderingChildren } from "../validChildren.js";
@@ -77,7 +78,9 @@ export async function renderingNodeToHtml(node, noEscape, headData, lastSelect)
     const attribs = objectReduce(processProps(attribProps), (string, key, value) => {
       //debug('reducing attr', key, value)
       if (typeof value === 'boolean') {
-        if (value) return string + ` ${key}`;else return string;
+        const attrValue = booleanAttributeValue(key, value);
+        if (attrValue === null) return string;
+        return attrValue === '' ? string + ` ${key}` : string + ` ${key}="${attrValue}"`;
       } else if (value === undefined || value === null) {
         return string;
       } else {
@@ -86,6 +89,10 @@ export async function renderingNodeToHtml(node, noEscape, headData, lastSelect)
     }, '');
     //   : ''
     debug('attribs', attribs);
+    // CSR: body's own attributes render, its children don't - see FrameworkConfig.ts.
+    if (type === 'body' && headData.csr) {
+      return html + `<${type}${attribs}></${type}>`;
+    }
     if (typeof node[$props].__zoneHtml === 'string') {
       return html + `<${type}${attribs}>${node[$props].__zoneHtml}</${type}>`;
     }

package/dist/routing/ErrorRouteType.d.ts

@@ -0,0 +1,6 @@
+import type { RouteContentFunction } from './RouteContentFunction.js';
+import type { TungstenErrorInfo } from './TungstenErrorInfo.js';
+export type ErrorRouteType = {
+    content: RouteContentFunction<object, TungstenErrorInfo>;
+};
+//# sourceMappingURL=ErrorRouteType.d.ts.map

package/dist/routing/ErrorRouteType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ErrorRouteType.d.ts","sourceRoot":"","sources":["../../src/routing/ErrorRouteType.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAM/D,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,EAAE,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;CAC3D,CAAA"}

package/dist/routing/ErrorRouteType.js

@@ -0,0 +1 @@
+export {};

package/dist/routing/RouteTypes.d.ts

@@ -1,6 +1,7 @@
 import type { Routes } from './Routes.js';
 export type Path = `/${string}`;
-export type RouteKey = Path | 'default' | '404' | 'error';
+export type SpecialRoute = 'default' | '404' | 'error';
+export type RouteKey = Path | SpecialRoute;
 export declare function StringIsValidRouteKey(string: string, routes: Routes): string is RouteKey;
 export declare function StringIsPath(string: string): string is Path;
 export declare function RouteKeyIsPath(path: RouteKey): path is Path;

package/dist/routing/RouteTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RouteTypes.d.ts","sourceRoot":"","sources":["../../src/routing/RouteTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,MAAM,IAAI,GAAG,IAAI,MAAM,EAAE,CAAA;AAC/B,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,CAAA;AACzD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,QAAQ,CAExF;AACD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,IAAI,CAE3D;AACD,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,IAAI,IAAI,CAE3D"}
+{"version":3,"file":"RouteTypes.d.ts","sourceRoot":"","sources":["../../src/routing/RouteTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,MAAM,IAAI,GAAG,IAAI,MAAM,EAAE,CAAA;AAC/B,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,CAAA;AACtD,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,YAAY,CAAA;AAE1C,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,QAAQ,CAExF;AACD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,IAAI,CAE3D;AACD,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,IAAI,IAAI,CAE3D"}

package/dist/routing/Routes.d.ts

@@ -1,5 +1,6 @@
 import type { Path } from './RouteTypes.js';
 import type { RouteType } from './RouteType.js';
+import type { ErrorRouteType } from './ErrorRouteType.js';
 export type MinimumRoutes = {
     default: RouteType<any, any>;
 } | {
@@ -7,6 +8,8 @@ export type MinimumRoutes = {
 };
 export type Routes = {
     [key in Path]: RouteType<any, any>;
+} & {
+    'error'?: ErrorRouteType;
 } & ({
     'default': RouteType<any, any>;
 } | {
@@ -14,6 +17,8 @@ export type Routes = {
 });
 export type CustomRoutes<Route extends RouteType<any, any>> = {
     [key in Path]: Route;
+} & {
+    error: ErrorRouteType;
 } & ({
     'default': Route;
 } | {

package/dist/routing/Routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Routes.d.ts","sourceRoot":"","sources":["../../src/routing/Routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAY,MAAM,iBAAiB,CAAA;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,MAAM,aAAa,GACnB;IAAE,OAAO,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,GAChC;IAAE,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,CAAA;AAEpC,MAAM,MAAM,MAAM,GAAG;KAAG,GAAG,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;CAAE,GACzD,CACE;IAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,GAChC;IAAE,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,CACnC,CAAA;AAED,MAAM,MAAM,YAAY,CAAC,KAAK,SAAS,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI;KAAG,GAAG,IAAI,IAAI,GAAG,KAAK;CAAE,GACpF,CACE;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,GAClB;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CACrB,CAAA"}
+{"version":3,"file":"Routes.d.ts","sourceRoot":"","sources":["../../src/routing/Routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,MAAM,MAAM,aAAa,GACnB;IAAE,OAAO,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,GAChC;IAAE,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,CAAA;AAEpC,MAAM,MAAM,MAAM,GAAG;KAAG,GAAG,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;CAAE,GACzD;IAAE,OAAO,CAAC,EAAE,cAAc,CAAA;CAAE,GAC5B,CACE;IAAE,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,GAChC;IAAE,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,CACnC,CAAA;AAED,MAAM,MAAM,YAAY,CAAC,KAAK,SAAS,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI;KAAG,GAAG,IAAI,IAAI,GAAG,KAAK;CAAE,GACpF;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,GACzB,CACE;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,GAClB;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CACrB,CAAA"}

package/dist/routing/TungstenErrorInfo.d.ts

@@ -0,0 +1,6 @@
+export type TungstenErrorInfo = {
+    error: unknown;
+    message: string;
+};
+export declare function makeTungstenErrorInfo(error: unknown): TungstenErrorInfo;
+//# sourceMappingURL=TungstenErrorInfo.d.ts.map

package/dist/routing/TungstenErrorInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TungstenErrorInfo.d.ts","sourceRoot":"","sources":["../../src/routing/TungstenErrorInfo.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,iBAAiB,GAAG;IAC5B,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAEvE"}

package/dist/routing/TungstenErrorInfo.js

@@ -0,0 +1,6 @@
+export function makeTungstenErrorInfo(error) {
+  return {
+    error,
+    message: error instanceof Error ? error.message : String(error)
+  };
+}

package/dist/style/styleContentSxy.js

@@ -121,6 +121,27 @@ function processItem(element, styles, usage) {
   }
   newClassName = newClassName.trim();
   if (newClassName !== '') element[$props].className = newClassName;
+  // Any other *ClassName prop (e.g. messageClassName, handed to a child component to apply
+  // to one of its own elements) gets the same local-stylesheet lookup applied in place, so a
+  // classname threaded down through props can still be scoped against this component's own
+  // stylesheet, even though the child's own render tree is outside this walk - see
+  // styleContentSxy() above.
+  for (const key in element[$props]) {
+    if (key === 'className' || !key.endsWith('ClassName')) continue;
+    const value = element[$props][key];
+    if (value === undefined || value === null) continue;
+    if (typeof value !== 'string') {
+      throw new TungstenError(`styleContentSxy() error: ${ContentNodeElementIsHtml(element) ? element[$type] : getComponentName(element)}` + ` ${key} prop should be a string. Received ${typeof value}`);
+    }
+    let newValue = value;
+    for (const cn of value.split(' ')) {
+      if (cn in styles.classes) {
+        newValue += ` ${styles.classes[cn]}`;
+        usage?.usedClasses.add(cn);
+      }
+    }
+    if (newValue !== value) element[$props][key] = newValue;
+  }
   debug('element after mods', tagName, element);
   // apply this to both fragment and elements
   if (element[$props].children !== undefined) {

package/dist/testing/hydrateTestApp.d.ts

@@ -0,0 +1,38 @@
+import type { ConstructPackage, TungstenBaseComponent, TungstenComponentPropsBase } from '../Components.jsx';
+import type { TaggedAttributeMismatch } from '../hydrate/renderHydrationMismatchBanner.js';
+import type { TestAppOptions } from './index.js';
+export type HydrateTestAppOptions<Props extends object> = TestAppOptions<Props> & {
+    serverProps?: Props;
+    csr?: boolean;
+};
+type HydrateTestAppArgs<Props extends object> = object extends Props ? [options?: HydrateTestAppOptions<Props>] : keyof Props extends never ? [options?: HydrateTestAppOptions<Props>] : [options: HydrateTestAppOptions<Props> & {
+    props: Props;
+}];
+export type HydrateTestApp<Component extends TungstenBaseComponent> = {
+    readonly document: Document;
+    readonly container: HTMLElement;
+    readonly component: Component;
+    readonly html: string;
+    readonly mismatches: readonly TaggedAttributeMismatch[];
+    resolved(): Promise<void>;
+    setProps(props: Component['props']): Promise<void>;
+    unmount(): Promise<void>;
+};
+/**
+ * The hydration round trip createTestApp() deliberately doesn't cover: render a component to
+ * HTML the way a real server would, parse it with a real HTML parser, hydrate a fresh client
+ * instance against the result, and hand back the live, hydrated component - still fully usable
+ * via setProps()/resolved(), exactly like createTestApp()'s result.
+ *
+ * By default `props` renders on both sides, so a passing test proves an ordinary page hydrates
+ * clean (`mismatches` empty). Pass `serverProps` to diverge the two passes on purpose and assert
+ * on the resulting `mismatches` - the case a one-off "does the reconciler still agree with real
+ * served pages" script never could, because nothing fed it markup that didn't already match.
+ *
+ * A structural mismatch (a different tag, a different number of children) is not something
+ * reconcileHydratedAttributes() can fix - hydrateRootComponent() throws, exactly as the real
+ * client hydrator does, so a caller reproducing that class of bug should assert on the rejection.
+ */
+export declare function hydrateTestApp<Props extends TungstenComponentPropsBase, Component extends TungstenBaseComponent<any, any>, RouteData = undefined>(RootComponent: new (pkg: ConstructPackage<NoInfer<Props>, RouteData>) => Component, ...args: HydrateTestAppArgs<Props>): Promise<HydrateTestApp<Component>>;
+export {};
+//# sourceMappingURL=hydrateTestApp.d.ts.map

package/dist/testing/hydrateTestApp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hydrateTestApp.d.ts","sourceRoot":"","sources":["../../src/testing/hydrateTestApp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,gBAAgB,EAChB,qBAAqB,EACrB,0BAA0B,EAC7B,MAAM,mBAAmB,CAAA;AAO1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AAa1F,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAA;AAEnE,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG;IAM9E,WAAW,CAAC,EAAE,KAAK,CAAA;IAEnB,GAAG,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED,KAAK,kBAAkB,CAAC,KAAK,SAAS,MAAM,IAAI,MAAM,SAAS,KAAK,GAC9D,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,GACxC,MAAM,KAAK,SAAS,KAAK,GACrB,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,GACxC,CAAC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC,CAAA;AAEpE,MAAM,MAAM,cAAc,CAAC,SAAS,SAAS,qBAAqB,IAAI;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAG7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAIrB,QAAQ,CAAC,UAAU,EAAE,SAAS,uBAAuB,EAAE,CAAA;IAEvD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAkGD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAChC,KAAK,SAAS,0BAA0B,EACxC,SAAS,SAAS,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,EACjD,SAAS,GAAG,SAAS,EAErB,aAAa,EAAE,KAAK,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,KAAK,SAAS,EAClF,GAAG,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,GACnC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CA6HpC"}