@ilha/router 0.9.2 → 0.10.0

package/dist/{src-BBsbD5vU.js → src-B5dHU24f.js}

@@ -1,4 +1,6 @@
-import { ISLAND_MOUNT_HANDLES, ISLAND_MOUNT_INTERNAL, context, html, ilha, mount } from "ilha";
+import { a as escapeHtml, c as withHeadStore, i as escapeHeadAttr, n as applyHeadEntriesToDocument, o as head, r as cssEscapeAttr, s as serializeHead, t as parseSnapshotAttr } from "./snapshot-CsEaY6h_.js";
+import { context, effect, html, ilha, mount, state } from "ilha";
+import { ISLAND_MOUNT_HANDLES, ISLAND_MOUNT_INTERNAL } from "ilha/internal";
 
 //#region src/hash.ts
 const isBrowser$1 = typeof window !== "undefined" && typeof document !== "undefined";
@@ -83,6 +85,7 @@ const hashAdapter = {
 	extractLogicalPath(anchor) {
 		const href = anchor.getAttribute("href");
 		if (!href) return null;
+		if (href.startsWith("//")) return null;
 		if (anchor.protocol && !/^(http:|https:)$/.test(anchor.protocol)) return null;
 		if (href.startsWith("#")) {
 			const inner = href.slice(1);
@@ -129,6 +132,37 @@ function getAdapter() {
 	return _adapter;
 }
 
+//#endregion
+//#region src/http.ts
+/**
+* Build an HTTP `Response` for SSR output with sensible security headers:
+* `Content-Type: text/html`, `X-Content-Type-Options: nosniff`,
+* `Referrer-Policy`, `Cache-Control: no-store`, and an optional CSP. This is
+* a low-level helper — prefer {@link RouterBuilder.respond} for the full
+* render+head+headers pipeline.
+*/
+function httpResponse(body, options = {}) {
+	const headers = new Headers(options.headers);
+	if (body != null && !headers.has("content-type")) headers.set("content-type", "text/html; charset=utf-8");
+	if (!headers.has("x-content-type-options")) headers.set("x-content-type-options", "nosniff");
+	if (!headers.has("referrer-policy")) headers.set("referrer-policy", "no-referrer");
+	if (!headers.has("cache-control")) headers.set("cache-control", "no-store");
+	const csp = options.contentSecurityPolicy ?? (options.cspNonce ? `default-src 'self'; script-src 'self' 'nonce-${options.cspNonce}'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'` : void 0);
+	if (csp) headers.set("content-security-policy", csp);
+	return new Response(body, {
+		status: options.status ?? 200,
+		headers
+	});
+}
+const EMPTY_HEAD = {
+	headTags: "",
+	htmlAttrs: "",
+	bodyAttrs: ""
+};
+/**
+* Options for {@link RouterBuilder.respond}.
+*/
+
 //#endregion
 //#region src/route-match.ts
 function parsePattern(pattern) {
@@ -247,7 +281,12 @@ function composeLoaders(loaders) {
 	if (loaders.length === 1) return loaders[0];
 	return async (ctx) => {
 		const results = await Promise.all(loaders.map((l) => l(ctx)));
-		return Object.assign({}, ...results);
+		let merged = {};
+		for (const r of results) merged = {
+			...merged,
+			...r
+		};
+		return merged;
 	};
 }
 const WRAP_LAYOUT_LEAF = Symbol.for("ilha.router.wrapLayout.leaf");
@@ -375,13 +414,21 @@ function injectKPageSlot(layoutHtml, slotInnerHtml, which) {
 	const target = which === "innermost" ? spans[spans.length - 1] : spans[0];
 	return layoutHtml.slice(0, target.openEnd) + slotInnerHtml + layoutHtml.slice(target.closeStart);
 }
+/** Branded read of ilha's optional mount-handle hook (absent on plain islands). */
+function readMountInternal(island) {
+	return island[ISLAND_MOUNT_INTERNAL];
+}
+/** Branded write of ilha's mount-handle hook — mirrors the core island contract. */
+function writeMountInternal(island, hook) {
+	island[ISLAND_MOUNT_INTERNAL] = hook;
+}
 function layoutHtmlWithEmptyKPage(wrappedLayout, props) {
 	const handler = wrappedLayout[WRAP_LAYOUT_HANDLER];
 	if (!handler) return wrappedLayout.toString(props);
 	const rawKeyed = (wrappedLayout[WRAP_LAYOUT_LEAF] ?? wrappedLayout).key("page");
 	const shellChild = ((partial) => rawKeyed({
 		...props,
-		...partial ?? {}
+		...partial
 	}));
 	Object.assign(shellChild, { toString: () => "" });
 	shellChild[ISLAND_CALL] = true;
@@ -400,7 +447,7 @@ function wrapLayout(layout, page) {
 		const merged = layoutInputRef.merged;
 		const slotProps = merged && typeof merged === "object" ? {
 			...merged,
-			...props ?? {}
+			...props
 		} : props;
 		return rawKeyedPage(slotProps);
 	});
@@ -427,33 +474,41 @@ function wrapLayout(layout, page) {
 		};
 		if (mountHost.hasAttribute("data-ilha-state")) {
 			const outerState = outer.getAttribute("data-ilha-state");
-			if (outerState) try {
-				applyOuterSnapshot(JSON.parse(outerState));
-				return;
-			} catch {}
+			if (outerState) {
+				const outerParsed = parseSnapshotAttr(outerState);
+				if (outerParsed) {
+					applyOuterSnapshot(outerParsed);
+					return;
+				}
+			}
 			const slotState = mountHost.getAttribute("data-ilha-state");
-			if (slotState) try {
-				const snapshot = JSON.parse(slotState);
-				delete snapshot._skipOnMount;
-				mountHost.setAttribute("data-ilha-state", JSON.stringify(snapshot));
-			} catch {}
+			if (slotState) {
+				const snapshot = parseSnapshotAttr(slotState);
+				if (snapshot) {
+					delete snapshot._skipOnMount;
+					mountHost.setAttribute("data-ilha-state", JSON.stringify(snapshot));
+				}
+			}
 			return;
 		}
 		const outerState = outer.getAttribute("data-ilha-state");
-		if (outerState) try {
-			applyOuterSnapshot(JSON.parse(outerState));
-			return;
-		} catch {}
-		if (mountHost.childNodes.length > 0) mountHost.setAttribute("data-ilha-state", "{}");
+		if (outerState) {
+			const outerParsed = parseSnapshotAttr(outerState);
+			if (outerParsed) {
+				applyOuterSnapshot(outerParsed);
+				return;
+			}
+		}
+		if (mountHost.childNodes.length > 0) mountHost.setAttribute("data-ilha-state", "{\"v\":2}");
 	}
 	function wrapLeafPageMountHooks(leaf) {
-		const leafInternal = leaf[ISLAND_MOUNT_INTERNAL];
+		const leafInternal = readMountInternal(leaf);
 		if (typeof leafInternal !== "function") return;
-		leaf[ISLAND_MOUNT_INTERNAL] = (host, props) => {
+		writeMountInternal(leaf, (host, props) => {
 			const outer = host.closest("[data-ilha]");
 			if (outer && outer !== host) preparePageMountHost(outer, host);
 			return leafInternal(host, props);
-		};
+		});
 		const leafMount = leaf.mount.bind(leaf);
 		leaf.mount = (host, props) => {
 			const outer = host.closest("[data-ilha]");
@@ -463,8 +518,8 @@ function wrapLayout(layout, page) {
 	}
 	wrapLeafPageMountHooks(leafPage);
 	const pageHandles = /* @__PURE__ */ new Map();
-	const pageInternalBase = page[ISLAND_MOUNT_INTERNAL];
-	if (typeof pageInternalBase === "function") page[ISLAND_MOUNT_INTERNAL] = (host, props) => {
+	const pageInternalBase = readMountInternal(page);
+	if (typeof pageInternalBase === "function") writeMountInternal(page, (host, props) => {
 		const handle = pageInternalBase(host, props);
 		const entry = {
 			handle,
@@ -481,7 +536,7 @@ function wrapLayout(layout, page) {
 				handle.updateProps(p);
 			}
 		};
-	};
+	});
 	/**
 	* In-place prop update for one mounted layout instance: refresh the
 	* merged-input ref (so any layout re-render passes fresh props to `k:page`),
@@ -494,15 +549,27 @@ function wrapLayout(layout, page) {
 	const layoutUpdateProps = (layoutHost, coreUpdate) => (p) => {
 		setLayoutMergedInput(p);
 		for (const [pageHost, entry] of pageHandles) if (layoutHost.contains(pageHost)) entry.handle.updateProps({
-			...entry.mountProps ?? {},
-			...p ?? {}
+			...entry.mountProps,
+			...p
 		});
 		coreUpdate?.(p);
 	};
 	const layoutMount = Wrapped.mount.bind(Wrapped);
-	const layoutInternal = Wrapped[ISLAND_MOUNT_INTERNAL];
+	const layoutInternal = readMountInternal(Wrapped);
 	function prepareLayoutMountHost(host) {
 		preparePageMountHost(host, pageMountHost(host));
+		const raw = host.getAttribute("data-ilha-state");
+		if (raw) {
+			const parsed = parseSnapshotAttr(raw);
+			if (parsed) {
+				const s = parsed["s"];
+				const d = parsed["d"];
+				if (!(Array.isArray(s) && s.length > 0 || Array.isArray(d) && d.length > 0) && parsed["_skipOnMount"] === true) {
+					delete parsed["_skipOnMount"];
+					host.setAttribute("data-ilha-state", JSON.stringify(parsed));
+				}
+			}
+		}
 	}
 	Wrapped.mount = (host, props) => {
 		setLayoutMergedInput(props);
@@ -515,7 +582,7 @@ function wrapLayout(layout, page) {
 		});
 		return unmount;
 	};
-	Wrapped[ISLAND_MOUNT_INTERNAL] = (host, props) => {
+	writeMountInternal(Wrapped, (host, props) => {
 		setLayoutMergedInput(props);
 		prepareLayoutMountHost(host);
 		const base = typeof layoutInternal === "function" ? layoutInternal(host, props) : {
@@ -528,7 +595,7 @@ function wrapLayout(layout, page) {
 		};
 		ISLAND_MOUNT_HANDLES.set(host, enhanced);
 		return enhanced;
-	};
+	});
 	Wrapped.hydratable = async (props, opts) => {
 		if (!opts?.name) throw new Error("wrapLayout: hydratable requires options.name");
 		const resolvedProps = props ?? {};
@@ -544,7 +611,7 @@ function wrapLayout(layout, page) {
 	return Wrapped;
 }
 function wrapError(handler, page) {
-	const Wrapper = ilha.render(() => {
+	const Wrapper = ilha(() => {
 		try {
 			return page.toString();
 		} catch (e) {
@@ -580,9 +647,9 @@ function wrapError(handler, page) {
 			return errorIsland.mount(host, props);
 		}
 	};
-	Wrapper[ISLAND_MOUNT_INTERNAL] = (host, props) => {
+	writeMountInternal(Wrapper, (host, props) => {
 		try {
-			const pageInternal = page[ISLAND_MOUNT_INTERNAL];
+			const pageInternal = readMountInternal(page);
 			if (typeof pageInternal === "function") return pageInternal(host, props);
 			return {
 				unmount: page.mount(host, props),
@@ -606,7 +673,7 @@ function wrapError(handler, page) {
 				updateProps: () => {}
 			};
 		}
-	};
+	});
 	Wrapper.hydratable = async (props, opts) => {
 		if (!opts?.name) throw new Error("wrapError: hydratable requires options.name");
 		return page.hydratable(props ?? {}, opts);
@@ -772,7 +839,7 @@ const noopRouteHandle = () => ({
 /** Mount an island keeping the full internal handle so later same-island
 * navigations can push new loader props instead of remounting. */
 function mountIslandWithHandle(island, host, props) {
-	const internal = island[ISLAND_MOUNT_INTERNAL];
+	const internal = readMountInternal(island);
 	if (typeof internal === "function") {
 		const h = internal(host, props);
 		return {
@@ -788,11 +855,12 @@ function mountIslandWithHandle(island, host, props) {
 /**
 * Same-island fast path: fetch fresh loader data and push it into the mounted
 * island via `updateProps` — ilha's fine-grained morph reconciles the DOM, so
-* focus, caret, selection, and scroll survive (the reason persistQuery-driven
-* filter inputs don't blur while typing). Returns "updated" when applied (or
-* redirected), "remount" when the caller must run the full teardown + mount
-* path (loader error / not-found need boundary DOM; the full path re-fetches,
-* accepted for these rare cases). Throws AbortError when superseded.
+* focus, caret, selection, and scroll survive (the reason same-route param
+* updates on filter inputs don't blur while typing). Returns "updated" when
+* applied (or redirected), "remount" when the caller must run the full
+* teardown + mount path (loader error / not-found need boundary DOM; the full
+* path re-fetches, accepted for these rare cases). Throws AbortError when
+* superseded.
 */
 async function updateRouteInPlace(handle, pathWithSearch, signal) {
 	if (!handle.updateProps) return "remount";
@@ -852,7 +920,7 @@ async function mountRouteWithHydration(island, host, pathWithSearch, signal, reg
 		}));
 		const escaped = escapeHtml(loaderResult.message);
 		await withViewSwap(() => {
-			host.innerHTML = `<div data-router-view data-router-error="${loaderResult.status}">${escaped}</div>`;
+			host.innerHTML = `<div data-router-view data-router-error="${escapeHtml(loaderResult.status)}">${escaped}</div>`;
 		});
 		return noopRouteHandle();
 	}
@@ -907,12 +975,12 @@ function mountLoaderErrorBoundary(boundary, host, status, message) {
 			search: routeSearch(),
 			hash: routeHash()
 		});
-		host.innerHTML = `<div data-router-view data-router-error="${status}">${errorIsland.toString()}</div>`;
+		host.innerHTML = `<div data-router-view data-router-error="${escapeHtml(status)}">${errorIsland.toString()}</div>`;
 		const ehHost = host.firstElementChild;
 		return ehHost ? errorIsland.mount(ehHost) : () => {};
 	} catch (e) {
 		console.error("[ilha-router] error boundary threw while rendering a loader error:", e);
-		host.innerHTML = `<div data-router-view data-router-error="${status}"></div>`;
+		host.innerHTML = `<div data-router-view data-router-error="${escapeHtml(status)}"></div>`;
 		return () => {};
 	}
 }
@@ -944,6 +1012,7 @@ const _routePathSig = context("router.path", "");
 const _routeParamsSig = context("router.params", {});
 const _routeSearchSig = context("router.search", "");
 const _routeHashSig = context("router.hash", "");
+/** @internal Internal reactive route-state accessor; use the aggregate `useRoute()` for the public surface. */
 function routePath(value) {
 	const store = activeRouteStore();
 	if (arguments.length > 0) {
@@ -952,6 +1021,7 @@ function routePath(value) {
 	}
 	return store ? store.path : _routePathSig();
 }
+/** @internal Internal reactive route-state accessor; use the aggregate `useRoute()` for the public surface. */
 function routeParams(value) {
 	const store = activeRouteStore();
 	if (arguments.length > 0) {
@@ -960,6 +1030,7 @@ function routeParams(value) {
 	}
 	return store ? store.params : _routeParamsSig();
 }
+/** @internal Internal reactive route-state accessor; use the aggregate `useRoute()` for the public surface. */
 function routeSearch(value) {
 	const store = activeRouteStore();
 	if (arguments.length > 0) {
@@ -968,6 +1039,7 @@ function routeSearch(value) {
 	}
 	return store ? store.search : _routeSearchSig();
 }
+/** @internal Internal reactive route-state accessor; use the aggregate `useRoute()` for the public surface. */
 function routeHash(value) {
 	const store = activeRouteStore();
 	if (arguments.length > 0) {
@@ -1276,7 +1348,7 @@ let _notFound = null;
 /** Redirect policy for browser-executed loaders — mirrors the last router's
 * `allowExternalRedirects` option (module-level for the same reason as `_notFound`). */
 let _allowExternalRedirects = false;
-const RouterView = ilha.render(() => {
+const RouterView = ilha(() => {
 	const island = activeIsland();
 	if (!island) {
 		if (_notFound) return `<div data-router-view data-router-not-found>${_notFound.toString()}</div>`;
@@ -1284,24 +1356,34 @@ const RouterView = ilha.render(() => {
 	}
 	return `<div data-router-view>${island.toString()}</div>`;
 });
-const RouterLink = ilha.state("href", "").state("label", "").on("[data-link]@click", ({ state, event }) => {
-	event.preventDefault();
-	navigate(state.href());
-}).on("[data-link]@mouseenter", ({ state }) => {
-	const href = state.href();
-	if (!href) return;
-	if (/^https?:\/\//i.test(href)) try {
-		const u = new URL(href);
-		if (u.origin !== location.origin) return;
-		prefetch(u.pathname + u.search);
-		return;
-	} catch {
-		return;
-	}
-	prefetch(href);
-}).render(({ state }) => html`<a data-link data-prefetch href="${() => getAdapter().toLinkHref(state.href())}"
-        >${state.label}</a
-      >`);
+const RouterLink = ilha(({ href = "", label = "" }) => {
+	const hrefState = state(href);
+	const labelState = state(label);
+	effect.once(({ host, signal }) => {
+		const link = host.matches("[data-link]") ? host : host.querySelector("[data-link]");
+		if (!link) return;
+		link.addEventListener("click", (event) => {
+			event.preventDefault();
+			navigate(hrefState());
+		}, { signal });
+		link.addEventListener("mouseenter", () => {
+			const href = hrefState();
+			if (!href) return;
+			if (/^https?:\/\//i.test(href)) try {
+				const u = new URL(href);
+				if (u.origin !== location.origin) return;
+				prefetch(u.pathname + u.search);
+				return;
+			} catch {
+				return;
+			}
+			prefetch(href);
+		}, { signal });
+	});
+	return html`<a data-link data-prefetch href="${() => getAdapter().toLinkHref(hrefState())}"
+    >${labelState()}</a
+  >`;
+});
 function isActive(pattern, options = {}) {
 	if (options.exact === false) {
 		const path = routePath();
@@ -1312,291 +1394,6 @@ function isActive(pattern, options = {}) {
 	if (!match) return false;
 	return match.data.pattern === pattern;
 }
-const ILHA_HEAD_ATTR = "data-ilha-head";
-const ILHA_ROUTER_HTML_ATTR = "data-ilha-router-html";
-const ILHA_ROUTER_BODY_ATTR = "data-ilha-router-body";
-/** Browser-only fallback; SSR uses AsyncLocalStorage (see `withHeadStore`). */
-let _browserHeadStore = null;
-let _headAls = null;
-let _headAlsInit = null;
-/** ESM dynamic import — Nitro/Vite SSR workers have no `require`. */
-async function getHeadAlsAsync() {
-	if (_headAls) return _headAls;
-	if (!_headAlsInit) _headAlsInit = import("node:async_hooks").then(({ AsyncLocalStorage }) => {
-		_headAls = new AsyncLocalStorage();
-		return _headAls;
-	});
-	return _headAlsInit;
-}
-function activeHeadStore() {
-	if (isBrowser) return _browserHeadStore;
-	return _headAls?.getStore() ?? null;
-}
-/**
-* Contribute `<head>` data from inside an island's `.render()` body or a
-* layout. During SSR this collects into the active render window; on the
-* client, entries are collected when the router re-renders a route inside
-* `withHeadStore` and then applied to `document`. Prefer a loader's `ctx.head`
-* for data that depends on the request.
-*/
-function head(input) {
-	const store = activeHeadStore();
-	if (!store) {
-		if (!isBrowser) console.warn("[ilha-router] head() called outside an SSR render window — ignored.");
-		return;
-	}
-	store.entries.push(input);
-}
-function cssEscapeAttr(value) {
-	if (typeof CSS !== "undefined" && typeof CSS.escape === "function") return CSS.escape(value);
-	return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-}
-function headManagedMetaSelector(tag) {
-	if ("charset" in tag) return `meta[charset][${ILHA_HEAD_ATTR}]`;
-	if ("name" in tag) return `meta[name="${cssEscapeAttr(tag.name)}"][${ILHA_HEAD_ATTR}]`;
-	if ("property" in tag) return `meta[property="${cssEscapeAttr(tag.property)}"][${ILHA_HEAD_ATTR}]`;
-	if ("http-equiv" in tag) return `meta[http-equiv="${cssEscapeAttr(tag["http-equiv"])}"][${ILHA_HEAD_ATTR}]`;
-	return null;
-}
-function headManagedLinkSelector(tag) {
-	if (tag.rel && tag.href) return `link[rel="${cssEscapeAttr(tag.rel)}"][href="${cssEscapeAttr(tag.href)}"][${ILHA_HEAD_ATTR}]`;
-	return null;
-}
-/**
-* Apply merged head entries on client navigations. Updates `document.title` and
-* managed meta/link nodes (`data-ilha-head`). Script tags from HeadInput are
-* SSR-only and are not re-injected here. Removes managed tags from the previous
-* route that are not part of this navigation's set.
-*/
-function applyHeadEntriesToDocument(entries) {
-	if (!isBrowser) return;
-	let title;
-	let titleTemplate;
-	const meta = [];
-	const link = [];
-	let htmlAttrs = {};
-	let bodyAttrs = {};
-	for (const entry of entries) {
-		if (entry.title !== void 0) title = entry.title;
-		if (entry.titleTemplate !== void 0) titleTemplate = entry.titleTemplate;
-		if (entry.meta) meta.push(...entry.meta);
-		if (entry.link) link.push(...entry.link);
-		if (entry.htmlAttrs) htmlAttrs = {
-			...htmlAttrs,
-			...entry.htmlAttrs
-		};
-		if (entry.bodyAttrs) bodyAttrs = {
-			...bodyAttrs,
-			...entry.bodyAttrs
-		};
-	}
-	const resolvedTitle = applyTitleTemplate(title, titleTemplate);
-	if (resolvedTitle !== void 0) document.title = resolvedTitle;
-	const metaTags = dedupByKey(meta, metaDedupKey);
-	const linkTags = dedupByKey(link, (t) => `${t.rel ?? ""}:${t.href ?? ""}`);
-	const keepManaged = /* @__PURE__ */ new Set();
-	for (const tag of metaTags) {
-		const selector = headManagedMetaSelector(tag);
-		if (!selector) continue;
-		let el = document.querySelector(selector);
-		if (!el) {
-			el = document.createElement("meta");
-			el.setAttribute(ILHA_HEAD_ATTR, "");
-			document.head.appendChild(el);
-		}
-		for (const [k, v] of Object.entries(tag)) el.setAttribute(k, v);
-		keepManaged.add(el);
-	}
-	for (const tag of linkTags) {
-		const selector = headManagedLinkSelector(tag);
-		let el = selector ? document.querySelector(selector) : null;
-		if (!el) {
-			el = document.createElement("link");
-			el.setAttribute(ILHA_HEAD_ATTR, "");
-			document.head.appendChild(el);
-		}
-		for (const [k, v] of Object.entries(tag)) el.setAttribute(k, v);
-		keepManaged.add(el);
-	}
-	for (const el of [...document.head.querySelectorAll(`[${ILHA_HEAD_ATTR}]`)]) if (!keepManaged.has(el)) el.remove();
-	const htmlEl = document.documentElement;
-	const prevHtmlKeys = (htmlEl.getAttribute(ILHA_ROUTER_HTML_ATTR) ?? "").split(/\s+/).filter(Boolean);
-	for (const k of prevHtmlKeys) htmlEl.removeAttribute(k);
-	const nextHtmlKeys = Object.keys(htmlAttrs);
-	for (const [k, v] of Object.entries(htmlAttrs)) htmlEl.setAttribute(k, v);
-	if (nextHtmlKeys.length) htmlEl.setAttribute(ILHA_ROUTER_HTML_ATTR, nextHtmlKeys.join(" "));
-	else htmlEl.removeAttribute(ILHA_ROUTER_HTML_ATTR);
-	const bodyEl = document.body;
-	const prevBodyKeys = (bodyEl.getAttribute(ILHA_ROUTER_BODY_ATTR) ?? "").split(/\s+/).filter(Boolean);
-	for (const k of prevBodyKeys) bodyEl.removeAttribute(k);
-	const nextBodyKeys = Object.keys(bodyAttrs);
-	for (const [k, v] of Object.entries(bodyAttrs)) bodyEl.setAttribute(k, v);
-	if (nextBodyKeys.length) bodyEl.setAttribute(ILHA_ROUTER_BODY_ATTR, nextBodyKeys.join(" "));
-	else bodyEl.removeAttribute(ILHA_ROUTER_BODY_ATTR);
-}
-async function withHeadStore(store, fn) {
-	if (isBrowser) {
-		const prev = _browserHeadStore;
-		_browserHeadStore = store;
-		try {
-			return await fn();
-		} finally {
-			_browserHeadStore = prev;
-		}
-	}
-	return await (await getHeadAlsAsync()).run(store, () => Promise.resolve(fn()));
-}
-const HEAD_ESC = {
-	"&": "&amp;",
-	"<": "&lt;",
-	">": "&gt;",
-	"\"": "&quot;",
-	"'": "&#39;"
-};
-function escapeHeadAttr(value) {
-	return String(value).replace(/[&<>"']/g, (c) => HEAD_ESC[c]);
-}
-/** Escape text content for inline HTML (loader error messages etc.). */
-function escapeHtml(value) {
-	return String(value).replace(/[&<>]/g, (c) => HEAD_ESC[c]);
-}
-function serializeAttrs(attrs) {
-	const parts = [];
-	for (const [k, v] of Object.entries(attrs)) {
-		if (!/^[A-Za-z_:][A-Za-z0-9:._-]*$/.test(k) || /^on[a-z]/i.test(k)) {
-			if (isDevEnv()) console.warn(`[ilha-router] Dropping unsafe head attribute "${k}".`);
-			continue;
-		}
-		parts.push(` ${k}="${escapeHeadAttr(v)}"`);
-	}
-	return parts.join("");
-}
-function isSafeUrl(value) {
-	const v = value.trim();
-	if (v === "") return true;
-	if (v.startsWith("//")) return false;
-	if (v.startsWith("#") || v.startsWith("/") || v.startsWith("./")) return true;
-	if (/^(?:javascript|vbscript|data):/i.test(v)) return false;
-	try {
-		const u = new URL(v, "http://localhost");
-		return u.protocol === "http:" || u.protocol === "https:";
-	} catch {
-		return false;
-	}
-}
-function metaDedupKey(tag) {
-	if ("charset" in tag) return "charset";
-	if ("name" in tag) return `name:${tag.name}`;
-	if ("property" in tag) return `property:${tag.property}`;
-	if ("http-equiv" in tag) return `http-equiv:${tag["http-equiv"]}`;
-	return JSON.stringify(tag);
-}
-function dedupByKey(tags, keyOf) {
-	const map = /* @__PURE__ */ new Map();
-	for (const tag of tags) map.set(keyOf(tag), tag);
-	return [...map.values()];
-}
-function applyTitleTemplate(title, template) {
-	if (template === void 0) return title;
-	if (typeof template === "function") return template(title);
-	return template.replace(/%s/g, title ?? "");
-}
-/**
-* Merge head entries in contribution order (loader first as the base, then
-* render-time outer→inner layouts, then the page) and serialize. Later entries
-* win on collision; the last `titleTemplate` wraps the resolved title.
-*/
-function serializeHead(entries) {
-	let title;
-	let titleTemplate;
-	const meta = [];
-	const link = [];
-	const script = [];
-	let htmlAttrs = {};
-	let bodyAttrs = {};
-	for (const entry of entries) {
-		if (entry.title !== void 0) title = entry.title;
-		if (entry.titleTemplate !== void 0) titleTemplate = entry.titleTemplate;
-		if (entry.meta) meta.push(...entry.meta);
-		if (entry.link) link.push(...entry.link);
-		if (entry.script) script.push(...entry.script);
-		if (entry.htmlAttrs) htmlAttrs = {
-			...htmlAttrs,
-			...entry.htmlAttrs
-		};
-		if (entry.bodyAttrs) bodyAttrs = {
-			...bodyAttrs,
-			...entry.bodyAttrs
-		};
-	}
-	const resolvedTitle = applyTitleTemplate(title, titleTemplate);
-	const parts = [];
-	if (resolvedTitle !== void 0) parts.push(`<title>${escapeHeadAttr(resolvedTitle)}</title>`);
-	for (const tag of dedupByKey(meta, metaDedupKey)) {
-		if (/^refresh$/i.test(tag["http-equiv"] ?? "") && !isSafeRefreshTarget(tag.content ?? "")) {
-			if (isDevEnv()) console.warn(`[ilha-router] Dropping unsafe meta refresh target "${tag.content}".`);
-			continue;
-		}
-		parts.push(`<meta${serializeAttrs({
-			...tag,
-			[ILHA_HEAD_ATTR]: ""
-		})} />`);
-	}
-	for (const tag of dedupByKey(link, (t) => `${t.rel ?? ""}:${t.href ?? ""}`)) {
-		if (tag.href !== void 0 && !isSafeUrl(tag.href)) {
-			if (isDevEnv()) console.warn(`[ilha-router] Dropping unsafe link href "${tag.href}".`);
-			continue;
-		}
-		parts.push(`<link${serializeAttrs({
-			...tag,
-			[ILHA_HEAD_ATTR]: ""
-		})} />`);
-	}
-	for (const tag of script) {
-		if (tag.src !== void 0 && !isSafeUrl(tag.src)) {
-			if (isDevEnv()) console.warn(`[ilha-router] Dropping unsafe script src "${tag.src}".`);
-			continue;
-		}
-		const { children, ...attrs } = tag;
-		const body = (children ?? "").replace(/<\/script/gi, "<\\/script");
-		parts.push(`<script${serializeAttrs(attrs)}>${body}<\/script>`);
-	}
-	return {
-		headTags: parts.join("\n  "),
-		htmlAttrs: serializeAttrs(htmlAttrs),
-		bodyAttrs: serializeAttrs(bodyAttrs)
-	};
-}
-function isSafeRefreshTarget(content) {
-	const match = /url\s*=\s*(['"]?)([^'";\s]+)\1/i.exec(content);
-	if (!match) return true;
-	return isSafeUrl(match[2] ?? "");
-}
-/**
-* Build an HTTP `Response` for SSR output with sensible security headers:
-* `Content-Type: text/html`, `X-Content-Type-Options: nosniff`,
-* `Referrer-Policy`, `Cache-Control: no-store`, and an optional CSP. This is
-* a low-level helper — prefer {@link RouterBuilder.respond} for the full
-* render+head+headers pipeline.
-*/
-function httpResponse(body, options = {}) {
-	const headers = new Headers(options.headers);
-	if (body != null && !headers.has("content-type")) headers.set("content-type", "text/html; charset=utf-8");
-	if (!headers.has("x-content-type-options")) headers.set("x-content-type-options", "nosniff");
-	if (!headers.has("referrer-policy")) headers.set("referrer-policy", "no-referrer");
-	if (!headers.has("cache-control")) headers.set("cache-control", "no-store");
-	const csp = options.contentSecurityPolicy ?? (options.cspNonce ? `default-src 'self'; script-src 'self' 'nonce-${options.cspNonce}'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'` : void 0);
-	if (csp) headers.set("content-security-policy", csp);
-	return new Response(body, {
-		status: options.status ?? 200,
-		headers
-	});
-}
-const EMPTY_HEAD = {
-	headTags: "",
-	htmlAttrs: "",
-	bodyAttrs: ""
-};
 function resolveRequestUrl(urlOrRequest, request) {
 	if (urlOrRequest instanceof Request) return {
 		url: urlOrRequest.url,
@@ -1620,15 +1417,13 @@ function isDevEnv() {
 }
 /**
 * Validate a loader redirect target. Relative paths always pass; same-origin
-* absolute URLs collapse to a path; cross-origin targets are rejected unless
-* `allowExternal`. Protocol-relative (`//host`) and unparsable targets are
-* always rejected.
+* absolute URLs collapse to a path; cross-origin targets (including
+* protocol-relative `//host` URLs) are rejected unless `allowExternal` is set.
+* Non-http(s) schemes, backslash/control-char smuggling, and unparsable
+* targets are always rejected.
 */
 function resolveRedirectTarget(to, base, allowExternal) {
-	if (to.startsWith("/") && !to.startsWith("//")) return {
-		ok: true,
-		to
-	};
+	if (/[\\\u0000-\u0020]/.test(to)) return { ok: false };
 	try {
 		const u = new URL(to, base);
 		if (!/^https?:$/.test(u.protocol)) return { ok: false };
@@ -1712,7 +1507,7 @@ async function executeLoader(loader, url, params, request, signal, onHead) {
 		console.error("[ilha-router] loader failed:", e);
 		return {
 			kind: "error",
-			status: typeof e?.status === "number" ? e.status : 500,
+			status: typeof e?.status === "number" && e.status >= 400 && e.status <= 599 ? e.status : 500,
 			message: isDevEnv() ? e?.message ?? "Loader failed" : "Internal error"
 		};
 	}
@@ -1865,7 +1660,7 @@ function router(options = {}) {
 				};
 				const reverseRegistry = registry ? buildReverseRegistry(registry) : void 0;
 				let navVersion = 0;
-				const NavHandler = ilha.render(() => {
+				const NavHandler = ilha(() => {
 					const current = activeIsland();
 					const pathWithSearch = routePath() + routeSearch();
 					if (current !== currentMountedIsland || pathWithSearch !== currentMountedPath) {
@@ -2042,7 +1837,7 @@ function router(options = {}) {
 					}
 					const escaped = escapeHtml(result.message);
 					await withViewSwap(() => {
-						viewHost.innerHTML = `<div data-router-error="${result.status}">${escaped}</div>`;
+						viewHost.innerHTML = `<div data-router-error="${escapeHtml(result.status)}">${escaped}</div>`;
 					});
 					return;
 				}
@@ -2066,7 +1861,7 @@ function router(options = {}) {
 				if (e?.name === "AbortError") return;
 				console.error("[ilha-router] initial mount failed:", e);
 			});
-			const NavHandler = ilha.render(() => {
+			const NavHandler = ilha(() => {
 				const current = activeIsland();
 				const pathWithSearch = routePath() + routeSearch();
 				if (current !== currentMountedIsland || pathWithSearch !== currentMountedPath) {
@@ -2155,7 +1950,8 @@ function router(options = {}) {
 				});
 			}
 			const head = res.head ?? EMPTY_HEAD;
-			return httpResponse(shell ? shell(head, res.html) : res.html, {
+			const body = shell ? shell(head, res.html) : res.html;
+			return httpResponse(body, {
 				status: status ?? res.status ?? 200,
 				headers,
 				cspNonce,
@@ -2296,14 +2092,14 @@ function router(options = {}) {
 						kind: "error",
 						status: result.status,
 						message: result.message,
-						html: `<div data-router-view data-router-error="${result.status}">${html}</div>`,
+						html: `<div data-router-view data-router-error="${escapeHtml(result.status)}">${html}</div>`,
 						head: serializeHead(headStore.entries)
 					};
 				} catch (e) {
 					console.error("[ilha-router] error boundary threw while rendering a loader error:", e);
 				}
 				const escapedMessage = escapeHtml(result.message);
-				const html = `<div data-router-view data-router-error="${result.status}">${escapedMessage}</div>`;
+				const html = `<div data-router-view data-router-error="${escapeHtml(result.status)}">${escapedMessage}</div>`;
 				return {
 					kind: "error",
 					status: result.status,
@@ -2362,4 +2158,4 @@ var src_default = {
 };
 
 //#endregion
-export { useContext as A, routeHash as C, router as D, routeSearch as E, parsePattern as F, safeDecode as I, getHistoryMode as L, wrapError as M, wrapLayout as N, serializeHead as O, matchSegments as P, setHistoryMode as R, resolveRedirectTarget as S, routePath as T, navigate as _, RouterView as a, prime as b, composeLoaders as c, error as d, head as f, loader as g, isActive as h, RouterLink as i, useRoute as j, src_default as k, defineLayout as l, invalidate as m, LoaderError as n, afterNavigate as o, httpResponse as p, Redirect as r, beforeNavigate as s, LOADER_ENDPOINT as t, enableLinkInterception as u, navigating as v, routeParams as w, redirect as x, prefetch as y };
+export { wrapLayout as A, routePath as C, useContext as D, src_default as E, getHistoryMode as F, setHistoryMode as I, parsePattern as M, safeDecode as N, useRoute as O, httpResponse as P, routeParams as S, router as T, prefetch as _, RouterView as a, resolveRedirectTarget as b, composeLoaders as c, error as d, invalidate as f, navigating as g, navigate as h, RouterLink as i, matchSegments as j, wrapError as k, defineLayout as l, loader as m, LoaderError as n, afterNavigate as o, isActive as p, Redirect as r, beforeNavigate as s, LOADER_ENDPOINT as t, enableLinkInterception as u, prime as v, routeSearch as w, routeHash as x, redirect as y };