GeezerVison

Summary

Fixes #167 (Medium; High where templates can carry untrusted content).

The DOM-backed evaluateSSR (active whenever a global/configured DOMParser exists) had two problems:

1. It fell back to new Function(...keys, return (${expr});) for any non-trivial expression — unsafe-eval on a path whose sibling expression.ts was written specifically to avoid it.
2. Its dot-notation fast-lane didn't call isPrototypePollutionKey, so constructor.constructor walked the prototype chain and returned the Function constructor.

Fix

evaluateSSR now delegates to the shared, CSP-safe evaluateExpression (Pratt parser in expression.ts) already used by the pure renderer. This removes the new Function fallback and the proto-lookup gap in one step, and unifies evaluator behaviour across both backends. The dead unwrap/isSignal/isComputed imports are dropped (unwrapping lives in the shared evaluator).

Verification

• New test: constructor.constructor on the DOM backend yields no Function (fails on the old code, passes now).
• New test: complex arithmetic (a + b) still evaluates via the safe parser.
• Grep confirms no new Function remains in src/ssr.
• Full suite: 2988 pass / 0 fail. tsc --noEmit + eslint clean.

🤖 Generated with Claude Code