sibujs 1.0.0 → 1.0.2

package/dist/patterns.cjs

@@ -414,10 +414,13 @@ function persisted(key, initial, options = {}) {
   const storage = options.session ? sessionStorage : localStorage;
   const serialize = options.serialize || JSON.stringify;
   const deserialize = options.deserialize || JSON.parse;
+  const encrypt = options.encrypt;
+  const decrypt = options.decrypt;
   let restored = initial;
   try {
-    const raw = storage.getItem(key);
+    let raw = storage.getItem(key);
     if (raw !== null) {
+      if (decrypt) raw = decrypt(raw);
       const parsed = deserialize(raw);
       restored = options.validate && !options.validate(parsed) ? initial : parsed;
     }
@@ -427,7 +430,9 @@ function persisted(key, initial, options = {}) {
   effect(() => {
     const current = value();
     try {
-      storage.setItem(key, serialize(current));
+      let serialized = serialize(current);
+      if (encrypt) serialized = encrypt(serialized);
+      storage.setItem(key, serialized);
     } catch {
     }
   });

package/dist/patterns.d.cts

@@ -54,6 +54,21 @@ interface PersistOptions<T = unknown> {
     deserialize?: (raw: string) => unknown;
     /** Optional type guard to validate deserialized data. Falls back to initial on failure. */
     validate?: (value: unknown) => value is T;
+    /**
+     * Encrypt the serialized value before writing to storage.
+     * Paired with `decrypt` for reading. Use for sensitive data.
+     *
+     * @example
+     * ```ts
+     * persisted("token", "", {
+     *   encrypt: (v) => btoa(v),   // or use Web Crypto API
+     *   decrypt: (v) => atob(v),
+     * });
+     * ```
+     */
+    encrypt?: (value: string) => string;
+    /** Decrypt the stored value before deserialization. Required if `encrypt` is set. */
+    decrypt?: (value: string) => string;
 }
 declare function persisted<T>(key: string, initial: T, options?: PersistOptions<T>): [() => T, (next: T | ((prev: T) => T)) => void];
 

package/dist/patterns.d.ts

@@ -54,6 +54,21 @@ interface PersistOptions<T = unknown> {
     deserialize?: (raw: string) => unknown;
     /** Optional type guard to validate deserialized data. Falls back to initial on failure. */
     validate?: (value: unknown) => value is T;
+    /**
+     * Encrypt the serialized value before writing to storage.
+     * Paired with `decrypt` for reading. Use for sensitive data.
+     *
+     * @example
+     * ```ts
+     * persisted("token", "", {
+     *   encrypt: (v) => btoa(v),   // or use Web Crypto API
+     *   decrypt: (v) => atob(v),
+     * });
+     * ```
+     */
+    encrypt?: (value: string) => string;
+    /** Decrypt the stored value before deserialization. Required if `encrypt` is set. */
+    decrypt?: (value: string) => string;
 }
 declare function persisted<T>(key: string, initial: T, options?: PersistOptions<T>): [() => T, (next: T | ((prev: T) => T)) => void];
 

package/dist/patterns.js

@@ -8,7 +8,7 @@ import {
   optimisticList,
   persisted,
   timeline
-} from "./chunk-BWBWJYBK.js";
+} from "./chunk-Y6GP4QGG.js";
 import {
   RenderProp,
   assertType,
@@ -26,10 +26,11 @@ import {
   withProps,
   withWrapper
 } from "./chunk-XYU6TZOW.js";
-import "./chunk-SU63HSUU.js";
-import "./chunk-OZS4YOOP.js";
+import "./chunk-FGOEVHY3.js";
+import "./chunk-PZEGYCF5.js";
 import "./chunk-CHJ27IGK.js";
-import "./chunk-KKUV25KB.js";
+import "./chunk-YECR7UIA.js";
+import "./chunk-4MYMUBRS.js";
 import "./chunk-MLKGABMK.js";
 export {
   RenderProp,

package/dist/performance.js

@@ -33,8 +33,9 @@ import {
   transitionState,
   uniqueId,
   yieldToMain
-} from "./chunk-DGUYCZJH.js";
-import "./chunk-KKUV25KB.js";
+} from "./chunk-HGMJFBC7.js";
+import "./chunk-YECR7UIA.js";
+import "./chunk-4MYMUBRS.js";
 import "./chunk-MLKGABMK.js";
 export {
   DOMPool,

package/dist/plugins.cjs

@@ -20,6 +20,28 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/core/dev.ts
+function isDev() {
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : true;
+}
+function devAssert(condition, message) {
+  if (_isDev && !condition) {
+    throw new Error(`[Sibu] ${message}`);
+  }
+}
+function devWarn(message) {
+  if (_isDev) {
+    console.warn(`[Sibu] ${message}`);
+  }
+}
+var _isDev;
+var init_dev = __esm({
+  "src/core/dev.ts"() {
+    "use strict";
+    _isDev = isDev();
+  }
+});
+
 // src/platform/ssr.ts
 var ssr_exports = {};
 __export(ssr_exports, {
@@ -39,13 +61,19 @@ __export(ssr_exports, {
   ssrSuspense: () => ssrSuspense,
   suspenseSwapScript: () => suspenseSwapScript
 });
+function ssrErrorComment(err) {
+  if (_isDev7) {
+    return `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+  }
+  return "<!--SSR error-->";
+}
 function renderToString(element) {
   if (element instanceof DocumentFragment) {
     return Array.from(element.childNodes).map((child) => {
       try {
         return renderToString(child);
       } catch (err) {
-        return `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+        return ssrErrorComment(err);
       }
     }).join("");
   }
@@ -75,7 +103,7 @@ function renderToString(element) {
     try {
       html2 += renderToString(child);
     } catch (err) {
-      html2 += `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+      html2 += ssrErrorComment(err);
     }
   }
   html2 += `</${tag}>`;
@@ -99,7 +127,7 @@ function renderToDocument(component, options = {}) {
   try {
     content = renderToString(component());
   } catch (err) {
-    content = `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+    content = ssrErrorComment(err);
   }
   const metaTags = (options.meta || []).map(
     (attrs) => `<meta ${Object.entries(attrs).map(([k, v]) => `${k}="${escapeAttr(v)}"`).join(" ")} />`
@@ -131,7 +159,7 @@ async function* renderToStream(element) {
       try {
         yield* renderToStream(child);
       } catch (err) {
-        yield `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+        yield ssrErrorComment(err);
       }
     }
     return;
@@ -163,7 +191,7 @@ async function* renderToStream(element) {
     try {
       yield* renderToStream(child);
     } catch (err) {
-      yield `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+      yield ssrErrorComment(err);
     }
   }
   yield `</${tag}>`;
@@ -252,9 +280,10 @@ function ssrSuspense(props) {
   }));
   return { element: wrapper, promise };
 }
-function suspenseSwapScript(id) {
+function suspenseSwapScript(id, nonce) {
   const safeId = id.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
-  return `<script>(function(){var t=document.getElementById("sibu-resolved-${safeId}");var f=document.querySelector('[data-sibu-suspense-id="${safeId}"]');if(t&&f){while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
+  const nonceAttr = nonce ? ` nonce="${escapeAttr(nonce)}"` : "";
+  return `<script${nonceAttr}>(function(){var t=document.getElementById("sibu-resolved-${safeId}");var f=document.querySelector('[data-sibu-suspense-id="${safeId}"]');if(t&&f){while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
 }
 async function* renderToSuspenseStream(element, pendingBoundaries = []) {
   yield* renderToStream(element);
@@ -266,13 +295,17 @@ async function* renderToSuspenseStream(element, pendingBoundaries = []) {
     }
   }
 }
-function serializeState(state) {
+function serializeState(state, nonce) {
   const json = JSON.stringify(state).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026");
-  return `<script>window.${SSR_DATA_ATTR}=${json}</script>`;
+  const nonceAttr = nonce ? ` nonce="${escapeAttr(nonce)}"` : "";
+  return `<script${nonceAttr}>window.${SSR_DATA_ATTR}=${json}</script>`;
 }
-function deserializeState() {
+function deserializeState(validate) {
   if (typeof window === "undefined") return void 0;
-  return window[SSR_DATA_ATTR];
+  const raw = window[SSR_DATA_ATTR];
+  if (raw === void 0) return void 0;
+  if (validate && !validate(raw)) return void 0;
+  return raw;
 }
 function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -280,10 +313,12 @@ function escapeHtml(str) {
 function escapeAttr(str) {
   return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-var VOID_ELEMENTS, suspenseIdCounter, SSR_DATA_ATTR;
+var _isDev7, VOID_ELEMENTS, suspenseIdCounter, SSR_DATA_ATTR;
 var init_ssr = __esm({
   "src/platform/ssr.ts"() {
     "use strict";
+    init_dev();
+    _isDev7 = isDev();
     VOID_ELEMENTS = /* @__PURE__ */ new Set([
       "area",
       "base",
@@ -382,21 +417,8 @@ __export(plugins_exports, {
 });
 module.exports = __toCommonJS(plugins_exports);
 
-// src/core/dev.ts
-function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : true;
-}
-var _isDev = isDev();
-function devAssert(condition, message) {
-  if (_isDev && !condition) {
-    throw new Error(`[Sibu] ${message}`);
-  }
-}
-function devWarn(message) {
-  if (_isDev) {
-    console.warn(`[Sibu] ${message}`);
-  }
-}
+// src/reactivity/bindAttribute.ts
+init_dev();
 
 // src/utils/sanitize.ts
 function sanitizeUrl(url) {
@@ -408,12 +430,20 @@ function sanitizeUrl(url) {
   }
   return trimmed;
 }
+function sanitizeCSSValue(value) {
+  const lower = value.toLowerCase().replace(/\s+/g, "");
+  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("-moz-binding")) {
+    return "";
+  }
+  return value;
+}
 var URL_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "cite", "poster", "background", "srcset"]);
 function isUrlAttribute(attr) {
   return URL_ATTRIBUTES.has(attr);
 }
 
 // src/reactivity/track.ts
+init_dev();
 var _isDev2 = isDev();
 var subscriberStack = new Array(32);
 var stackCapacity = 32;
@@ -652,6 +682,7 @@ function bindAttribute(el, attr, getter) {
 }
 
 // src/reactivity/bindChildNode.ts
+init_dev();
 var _isDev4 = isDev();
 function bindChildNode(placeholder, getter) {
   let lastNodes = [];
@@ -698,6 +729,7 @@ function bindChildNode(placeholder, getter) {
 }
 
 // src/core/rendering/dispose.ts
+init_dev();
 var elementDisposers = /* @__PURE__ */ new WeakMap();
 var _isDev5 = isDev();
 var activeBindingCount = 0;
@@ -740,11 +772,11 @@ function applyStyle(el, style2) {
     if (typeof val === "function") {
       const getter = val;
       const teardown = track(() => {
-        htmlEl.style.setProperty(name, String(getter()));
+        htmlEl.style.setProperty(name, sanitizeCSSValue(String(getter())));
       });
       registerDisposer(el, teardown);
     } else {
-      htmlEl.style.setProperty(name, String(val));
+      htmlEl.style.setProperty(name, sanitizeCSSValue(String(val)));
     }
   }
 }
@@ -1047,6 +1079,7 @@ function enqueueBatchedSignal(signal2) {
 }
 
 // src/core/signals/signal.ts
+init_dev();
 var _g = globalThis;
 var _isDev6 = isDev();
 function signal(initial, options) {
@@ -1114,6 +1147,9 @@ function getAvailableLocales() {
   return Object.keys(locales);
 }
 
+// src/core/signals/effect.ts
+init_dev();
+
 // src/core/ssr-context.ts
 var ssrMode = false;
 function isSSR() {

package/dist/plugins.js

@@ -18,10 +18,10 @@ import {
   preloadCritical,
   prerenderRoutes,
   satisfies
-} from "./chunk-ANRSGGFC.js";
+} from "./chunk-DTCOOBMX.js";
 import {
   renderToString
-} from "./chunk-UATXXETW.js";
+} from "./chunk-7TQKR4PP.js";
 import {
   createPlugin,
   inject,
@@ -33,19 +33,20 @@ import {
 } from "./chunk-K5ZUMYVS.js";
 import {
   span
-} from "./chunk-MGYRVG2A.js";
+} from "./chunk-OWLQ4HZI.js";
 import {
   registerDisposer
-} from "./chunk-LHNJSLC6.js";
-import "./chunk-NMTRH4Q3.js";
+} from "./chunk-QVKGGB2S.js";
+import "./chunk-SDLZDHKP.js";
 import {
   effect
-} from "./chunk-OZS4YOOP.js";
+} from "./chunk-PZEGYCF5.js";
 import "./chunk-CHJ27IGK.js";
 import {
   signal,
   track
-} from "./chunk-KKUV25KB.js";
+} from "./chunk-YECR7UIA.js";
+import "./chunk-4MYMUBRS.js";
 import "./chunk-MLKGABMK.js";
 
 // src/plugins/i18n.ts
@@ -1473,7 +1474,7 @@ function hydrateRouter(routes, options) {
   if (container && serverState.path) {
     const resolved = resolveServerRoute(serverState.path, routes);
     if (resolved.component) {
-      import("./ssr-GEOEYQV7.js").then(({ hydrate }) => {
+      import("./ssr-WKUPVSSK.js").then(({ hydrate }) => {
         if (resolved.component) {
           hydrate(resolved.component, container);
         }

package/dist/ssr-WKUPVSSK.js

@@ -0,0 +1,36 @@
+import {
+  collectStream,
+  deserializeState,
+  hydrate,
+  hydrateIslands,
+  hydrateProgressively,
+  island,
+  renderToDocument,
+  renderToReadableStream,
+  renderToStream,
+  renderToString,
+  renderToSuspenseStream,
+  resetSSRState,
+  serializeState,
+  ssrSuspense,
+  suspenseSwapScript
+} from "./chunk-7TQKR4PP.js";
+import "./chunk-4MYMUBRS.js";
+import "./chunk-MLKGABMK.js";
+export {
+  collectStream,
+  deserializeState,
+  hydrate,
+  hydrateIslands,
+  hydrateProgressively,
+  island,
+  renderToDocument,
+  renderToReadableStream,
+  renderToStream,
+  renderToString,
+  renderToSuspenseStream,
+  resetSSRState,
+  serializeState,
+  ssrSuspense,
+  suspenseSwapScript
+};

package/dist/ssr.cjs

@@ -61,7 +61,30 @@ __export(ssr_exports, {
 });
 module.exports = __toCommonJS(ssr_exports);
 
+// src/core/dev.ts
+function isDev() {
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : true;
+}
+var _isDev = isDev();
+function devAssert(condition, message) {
+  if (_isDev && !condition) {
+    throw new Error(`[Sibu] ${message}`);
+  }
+}
+function devWarn(message) {
+  if (_isDev) {
+    console.warn(`[Sibu] ${message}`);
+  }
+}
+
 // src/platform/ssr.ts
+var _isDev2 = isDev();
+function ssrErrorComment(err) {
+  if (_isDev2) {
+    return `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+  }
+  return "<!--SSR error-->";
+}
 var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "area",
   "base",
@@ -84,7 +107,7 @@ function renderToString(element) {
       try {
         return renderToString(child);
       } catch (err) {
-        return `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+        return ssrErrorComment(err);
       }
     }).join("");
   }
@@ -114,7 +137,7 @@ function renderToString(element) {
     try {
       html2 += renderToString(child);
     } catch (err) {
-      html2 += `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+      html2 += ssrErrorComment(err);
     }
   }
   html2 += `</${tag}>`;
@@ -138,7 +161,7 @@ function renderToDocument(component, options = {}) {
   try {
     content = renderToString(component());
   } catch (err) {
-    content = `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+    content = ssrErrorComment(err);
   }
   const metaTags = (options.meta || []).map(
     (attrs) => `<meta ${Object.entries(attrs).map(([k, v]) => `${k}="${escapeAttr(v)}"`).join(" ")} />`
@@ -170,7 +193,7 @@ async function* renderToStream(element) {
       try {
         yield* renderToStream(child);
       } catch (err) {
-        yield `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+        yield ssrErrorComment(err);
       }
     }
     return;
@@ -202,7 +225,7 @@ async function* renderToStream(element) {
     try {
       yield* renderToStream(child);
     } catch (err) {
-      yield `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+      yield ssrErrorComment(err);
     }
   }
   yield `</${tag}>`;
@@ -292,9 +315,10 @@ function ssrSuspense(props) {
   }));
   return { element: wrapper, promise };
 }
-function suspenseSwapScript(id) {
+function suspenseSwapScript(id, nonce) {
   const safeId = id.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
-  return `<script>(function(){var t=document.getElementById("sibu-resolved-${safeId}");var f=document.querySelector('[data-sibu-suspense-id="${safeId}"]');if(t&&f){while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
+  const nonceAttr = nonce ? ` nonce="${escapeAttr(nonce)}"` : "";
+  return `<script${nonceAttr}>(function(){var t=document.getElementById("sibu-resolved-${safeId}");var f=document.querySelector('[data-sibu-suspense-id="${safeId}"]');if(t&&f){while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
 }
 async function* renderToSuspenseStream(element, pendingBoundaries = []) {
   yield* renderToStream(element);
@@ -307,13 +331,17 @@ async function* renderToSuspenseStream(element, pendingBoundaries = []) {
   }
 }
 var SSR_DATA_ATTR = "__SIBU_SSR_DATA__";
-function serializeState(state) {
+function serializeState(state, nonce) {
   const json = JSON.stringify(state).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026");
-  return `<script>window.${SSR_DATA_ATTR}=${json}</script>`;
+  const nonceAttr = nonce ? ` nonce="${escapeAttr(nonce)}"` : "";
+  return `<script${nonceAttr}>window.${SSR_DATA_ATTR}=${json}</script>`;
 }
-function deserializeState() {
+function deserializeState(validate) {
   if (typeof window === "undefined") return void 0;
-  return window[SSR_DATA_ATTR];
+  const raw = window[SSR_DATA_ATTR];
+  if (raw === void 0) return void 0;
+  if (validate && !validate(raw)) return void 0;
+  return raw;
 }
 function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -322,24 +350,8 @@ function escapeAttr(str) {
   return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 
-// src/core/dev.ts
-function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : true;
-}
-var _isDev = isDev();
-function devAssert(condition, message) {
-  if (_isDev && !condition) {
-    throw new Error(`[Sibu] ${message}`);
-  }
-}
-function devWarn(message) {
-  if (_isDev) {
-    console.warn(`[Sibu] ${message}`);
-  }
-}
-
 // src/reactivity/track.ts
-var _isDev2 = isDev();
+var _isDev3 = isDev();
 var subscriberStack = new Array(32);
 var stackCapacity = 32;
 var stackTop = -1;
@@ -353,7 +365,7 @@ function safeInvoke(sub2) {
   try {
     sub2();
   } catch (err) {
-    if (_isDev2) devWarn(`Subscriber threw during notification: ${err instanceof Error ? err.message : String(err)}`);
+    if (_isDev3) devWarn(`Subscriber threw during notification: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 function track(effectFn, subscriber) {
@@ -616,6 +628,13 @@ function sanitizeUrl(url) {
   }
   return trimmed;
 }
+function sanitizeCSSValue(value) {
+  const lower = value.toLowerCase().replace(/\s+/g, "");
+  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("-moz-binding")) {
+    return "";
+  }
+  return value;
+}
 var URL_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "cite", "poster", "background", "srcset"]);
 function isUrlAttribute(attr) {
   return URL_ATTRIBUTES.has(attr);
@@ -768,10 +787,10 @@ function flushBatch() {
 
 // src/core/signals/signal.ts
 var _g2 = globalThis;
-var _isDev3 = isDev();
+var _isDev4 = isDev();
 function signal(initial, options) {
   const state = { value: initial };
-  const debugName = _isDev3 ? options?.name : void 0;
+  const debugName = _isDev4 ? options?.name : void 0;
   const equalsFn = options?.equals;
   if (debugName) {
     state.__name = debugName;
@@ -785,7 +804,7 @@ function signal(initial, options) {
   function set(next) {
     const newValue = typeof next === "function" ? next(state.value) : next;
     if (equalsFn ? equalsFn(state.value, newValue) : Object.is(newValue, state.value)) return;
-    if (_isDev3) {
+    if (_isDev4) {
       const oldValue = state.value;
       state.value = newValue;
       const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
@@ -797,7 +816,7 @@ function signal(initial, options) {
       notifySubscribers(state);
     }
   }
-  if (_isDev3) {
+  if (_isDev4) {
     const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
     if (hook) hook.emit("signal:create", { signal: state, name: debugName, getter: get, initial });
   }
@@ -933,14 +952,14 @@ function createMiddlewareChain() {
 }
 
 // src/reactivity/bindAttribute.ts
-var _isDev4 = isDev();
+var _isDev5 = isDev();
 function bindAttribute(el, attr, getter) {
   function commit() {
     let value;
     try {
       value = getter();
     } catch (err) {
-      if (_isDev4)
+      if (_isDev5)
         devWarn(`bindAttribute: getter for "${attr}" threw: ${err instanceof Error ? err.message : String(err)}`);
       return;
     }
@@ -966,7 +985,7 @@ function bindAttribute(el, attr, getter) {
 }
 
 // src/reactivity/bindChildNode.ts
-var _isDev5 = isDev();
+var _isDev6 = isDev();
 function bindChildNode(placeholder, getter) {
   let lastNodes = [];
   function commit() {
@@ -974,7 +993,7 @@ function bindChildNode(placeholder, getter) {
     try {
       result = getter();
     } catch (err) {
-      if (_isDev5) devWarn(`bindChildNode: getter threw: ${err instanceof Error ? err.message : String(err)}`);
+      if (_isDev6) devWarn(`bindChildNode: getter threw: ${err instanceof Error ? err.message : String(err)}`);
       return;
     }
     for (let i2 = 0; i2 < lastNodes.length; i2++) {
@@ -1013,7 +1032,7 @@ function bindChildNode(placeholder, getter) {
 
 // src/core/rendering/dispose.ts
 var elementDisposers = /* @__PURE__ */ new WeakMap();
-var _isDev6 = isDev();
+var _isDev7 = isDev();
 var activeBindingCount = 0;
 function registerDisposer(node, teardown) {
   let disposers = elementDisposers.get(node);
@@ -1022,7 +1041,7 @@ function registerDisposer(node, teardown) {
     elementDisposers.set(node, disposers);
   }
   disposers.push(teardown);
-  if (_isDev6) activeBindingCount++;
+  if (_isDev7) activeBindingCount++;
 }
 
 // src/core/rendering/tagFactory.ts
@@ -1054,11 +1073,11 @@ function applyStyle(el, style2) {
     if (typeof val === "function") {
       const getter = val;
       const teardown = track(() => {
-        htmlEl.style.setProperty(name, String(getter()));
+        htmlEl.style.setProperty(name, sanitizeCSSValue(String(getter())));
       });
       registerDisposer(el, teardown);
     } else {
-      htmlEl.style.setProperty(name, String(val));
+      htmlEl.style.setProperty(name, sanitizeCSSValue(String(val)));
     }
   }
 }