{"version":3,"file":"html.js","names":[],"sources":["../../src/server/html.ts"],"sourcesContent":["/**\n * HTML-safe JSON serialization for embedding data in <script> tags.\n *\n * JSON.stringify does NOT escape characters that are meaningful to the\n * HTML parser. If a JSON string value contains \"</script>\", the browser\n * closes the script tag early — anything after it executes as HTML.\n * This is a well-known stored XSS vector in SSR frameworks.\n *\n * Next.js mitigates this with htmlEscapeJsonString(). We do the same.\n *\n * Characters escaped:\n *   <   → \\u003c   (prevents </script> and <!-- breakout)\n *   >   → \\u003e   (prevents --> and other HTML close sequences)\n *   &   → \\u0026   (prevents &lt; entity interpretation in XHTML)\n *   \\u2028 → \\\\u2028 (line separator — invalid in JS string literals pre-ES2019)\n *   \\u2029 → \\\\u2029 (paragraph separator — same)\n *\n * The result is valid JSON that is also safe to embed in any HTML context\n * without additional escaping.\n */\nexport function safeJsonStringify(data: unknown): string {\n  return JSON.stringify(data)\n    .replace(/</g, \"\\\\u003c\")\n    .replace(/>/g, \"\\\\u003e\")\n    .replace(/&/g, \"\\\\u0026\")\n    .replace(/\\u2028/g, \"\\\\u2028\")\n    .replace(/\\u2029/g, \"\\\\u2029\");\n}\n\nexport function escapeHtmlAttr(value: string): string {\n  return value.replace(/&/g, \"&amp;\").replace(/\"/g, \"&quot;\");\n}\n\nexport function createNonceAttribute(nonce?: string): string {\n  if (!nonce) {\n    return \"\";\n  }\n\n  return ` nonce=\"${escapeHtmlAttr(nonce)}\"`;\n}\n\nexport function createInlineScriptTag(content: string, nonce?: string): string {\n  return `<script${createNonceAttribute(nonce)}>${content}</script>`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,kBAAkB,MAAuB;CACvD,OAAO,KAAK,UAAU,KAAK,CACxB,QAAQ,MAAM,UAAU,CACxB,QAAQ,MAAM,UAAU,CACxB,QAAQ,MAAM,UAAU,CACxB,QAAQ,WAAW,UAAU,CAC7B,QAAQ,WAAW,UAAU;;AAGlC,SAAgB,eAAe,OAAuB;CACpD,OAAO,MAAM,QAAQ,MAAM,QAAQ,CAAC,QAAQ,MAAM,SAAS;;AAG7D,SAAgB,qBAAqB,OAAwB;CAC3D,IAAI,CAAC,OACH,OAAO;CAGT,OAAO,WAAW,eAAe,MAAM,CAAC;;AAG1C,SAAgB,sBAAsB,SAAiB,OAAwB;CAC7E,OAAO,UAAU,qBAAqB,MAAM,CAAC,GAAG,QAAQ"}