release: WRNexusJS 0.8.0

2026-08-02 23:18:51 +05:30
parent 87507edf59
commit 586a6db8ff
625 changed files with 243608 additions and 11210 deletions
@@ -1,5 +1,30 @@
 import { expect, test } from "bun:test";
-import { renderDocument, renderDocumentStream } from "../src/index.ts";
+import { renderDocument, renderDocumentStream, renderStoreHydration } from "../src/index.ts";
+import type { StoreContainer } from "@wrnexus/store";
+
+test("store hydration is HTML-safe, bounded, redacted, and JSON-compatible", () => {
+  const container = {
+    serialize: () => ({
+      ProfileStore: {
+        display: "</script><script>alert(1)</script>",
+        accessToken: "never-render-this",
+      },
+    }),
+  } as unknown as StoreContainer;
+  const html = renderStoreHydration(container, 'safe" onload="bad');
+  expect(html).not.toContain("</script><script>");
+  expect(html).not.toContain("never-render-this");
+  expect(html).toContain('nonce="safe&quot; onload=&quot;bad"');
+  const payload = html.match(/>(.*)<\/script>$/)?.[1];
+  expect(JSON.parse(payload!)).toEqual({
+    ProfileStore: { display: "</script><script>alert(1)</script>", accessToken: "[REDACTED]" },
+  });
+
+  const oversized = {
+    serialize: () => ({ value: "x".repeat(300_000) }),
+  } as unknown as StoreContainer;
+  expect(() => renderStoreHydration(oversized)).toThrow("exceeds 262144 bytes");
+});

 test("escapes metadata and script URLs while preserving trusted rendered body", () => {
  const html = renderDocument({