Resumen
') }, { name: 'activity', module: renderHtml(() => 'Actividad
') }, ]); console.log(result.errors); ``` Reference: `src/server/wu-server-render.js`. ## renderStateScript Serializes state into a script the client can retrieve during hydration. `renderStateScript(state, options?): string` - **Parameters:** Serializable state; varName JavaScript identifier, merge boolean, optional nonce. - **Returns:** Complete script tag. - **Errors:** Rejects invalid varName, invalid nonce, or values that JSON.stringify cannot serialize. - **Permissions:** Does not use browser grants; the server application controls modules, data, and headers. - **Cleanup:** Creates no listeners or persistent client runtime. ```js import { renderStateScript } from 'wu-framework/server'; const script = renderStateScript({ card: { title: 'Resumen' } }, { merge: true }); ``` Do not include secrets: this state is visible in the response HTML. Reference: `src/server/wu-server-render.js`. ## declarativeShadowDomPolyfill Generates a compatibility script for templates with shadowrootmode when native support is unavailable. `declarativeShadowDomPolyfill(options?): string` - **Parameters:** Optional options.nonce. - **Returns:** Script HTML; calling the helper does not execute it. - **Errors:** An invalid nonce fails during attribute construction. - **Permissions:** Does not use browser grants; the server application controls modules, data, and headers. - **Cleanup:** Creates no listeners or persistent client runtime. ```js import { declarativeShadowDomPolyfill } from 'wu-framework/server'; const script = declarativeShadowDomPolyfill({ nonce }); ``` Emit the script after the content it must convert; it does not observe future templates. Reference: `src/server/wu-server-render.js`. ## escapeHtml Escapes ampersands, tag delimiters, and quotes for HTML text or attributes. `escapeHtml(value): string` - **Parameters:** Any value; null and undefined become an empty string. - **Returns:** Escaped string. - **Errors:** String coercion may propagate an error from the value itself. - **Permissions:** Does not use browser grants; the server application controls modules, data, and headers. - **Cleanup:** Creates no listeners or persistent client runtime. ```js import { escapeHtml } from 'wu-framework/server'; escapeHtml('Listo
`, { headers: { 'Content-Type': 'text/html' } }); }); ``` Reference: `src/server/wu-security-headers.js`. ## renderReact Adapts the React renderer to the renderApp contract. `renderReact(ComponentOrFn, options?): { render(props): Promise${Number(count)}
`); const result = await renderApp('card', { module, props: { count: 2 } }); ``` Returned HTML is not sanitized. Escape external content before interpolating it. Reference: `src/server/adapters.js`. ## createServerRequest `createServerRequest(options?): WuServerRequest` Creates a private per-request context with `signal`, `locals`, `renderApp`, `renderApps`, `stream` and `dispose`. It accepts batch options, including `request`, and combines its signal with `options.signal`. Do not create this object at module scope. `dispose(reason)` aborts, releases listeners and clears `locals`. ```js import { createServerRequest, renderStateScript, escapeHtml, withSecurityHeaders } from 'wu-framework/server'; export const GET = withSecurityHeaders(async (request, { nonce }) => { const scope = createServerRequest({ request, nonce, timeout: 2000, concurrency: 2 }); try { scope.locals.set('requestId', crypto.randomUUID()); const rendered = await scope.renderApps([{ name: 'greeting', load: async ({ signal }) => { signal.throwIfAborted(); return { props: { label: 'Hello' }, publicState: { label: 'Hello' } }; }, module: { render: props => '' + escapeHtml(props.label) + '
' }, }]); return new Response(rendered.html + renderStateScript(rendered.state, { nonce }), { headers: { 'Content-Type': 'text/html; charset=utf-8' }, }); } finally { scope.dispose(); } }); ``` `load(context)` receives `{ appName, signal, request, locals }` and returns `{ props?, publicState? }`. With a loader, only `publicState` becomes hydration state; neither private props nor the renderer’s returned `state` is published automatically. Without a loader, the renderer’s `state` is retained. This does not prevent the renderer itself from writing a secret into HTML. ## SSR cancellation, deadlines and concurrency `renderApp`, `renderApps` and `renderAppsStream` accept `signal` and per-app `timeout`, including the loader; `timeout: 0` disables the deadline. Batches and streams accept `concurrency`, unbounded by default. Aborting preserves `signal.reason`; without a supplied reason it uses `WU_SSR_ABORTED`. An expired deadline produces `WU_SSR_TIMEOUT`. Renderers and loaders must cooperate with `context.signal` to stop their work. Without `failFast`, an app failure allows partial degradation; with `failFast: true`, the batch is aborted. Canceling the stream propagates an abort to pending work. When returning an HTTP stream, retain the context until consumption finishes or is canceled; do not call `dispose()` immediately after constructing the response. ```js // Reusable wrappers: a function generates a new nonce for each request. wuSecurityMiddleware({ nonce: () => createNonce() }); withSecurityHeaders(handler, { nonce: () => createNonce() }); // Low-level helpers still accept the nonce of this response. const nonce = createNonce(); const headers = securityHeaders({ nonce }); ```