sibujs 1.2.0 → 1.3.0

package/dist/extras.cjs

@@ -32,6 +32,7 @@ __export(extras_exports, {
   VirtualList: () => VirtualList,
   accordion: () => accordion,
   animate: () => animate,
+  animationFrame: () => animationFrame,
   announce: () => announce,
   antdAdapter: () => antdAdapter,
   aria: () => aria,
@@ -44,6 +45,8 @@ __export(extras_exports, {
   block: () => block,
   bounceIn: () => bounceIn,
   bounceOut: () => bounceOut,
+  bounds: () => bounds,
+  broadcast: () => broadcast,
   bundlerMetadata: () => bundlerMetadata,
   calculateDelay: () => calculateDelay,
   chakraAdapter: () => chakraAdapter,
@@ -117,10 +120,12 @@ __export(extras_exports, {
   email: () => email,
   enableDebug: () => enableDebug,
   env: () => env,
+  escapeScriptJson: () => escapeScriptJson,
   eventBus: () => eventBus,
   executeLoader: () => executeLoader,
   fadeIn: () => fadeIn,
   fadeOut: () => fadeOut,
+  favicon: () => favicon,
   fileUpload: () => fileUpload,
   flipIn: () => flipIn,
   flushScheduler: () => flushScheduler,
@@ -129,6 +134,8 @@ __export(extras_exports, {
   formatCurrency: () => formatCurrency,
   formatError: () => formatError,
   formatNumber: () => formatNumber,
+  fullscreen: () => fullscreen,
+  gamepad: () => gamepad,
   generateStaticSite: () => generateStaticSite,
   geo: () => geo,
   getActiveDevTools: () => getActiveDevTools,
@@ -147,6 +154,7 @@ __export(extras_exports, {
   hydrateIslands: () => hydrateIslands,
   hydrateProgressively: () => hydrateProgressively,
   idle: () => idle,
+  imageLoader: () => imageLoader,
   infiniteQuery: () => infiniteQuery,
   infiniteScroll: () => infiniteScroll,
   initDevTools: () => initDevTools,
@@ -159,6 +167,7 @@ __export(extras_exports, {
   isHMRAvailable: () => isHMRAvailable,
   isWasmCached: () => isWasmCached,
   island: () => island,
+  keyboard: () => keyboard,
   lazyChunk: () => lazyChunk,
   lazyLoad: () => lazyLoad,
   lazyModule: () => lazyModule,
@@ -175,7 +184,10 @@ __export(extras_exports, {
   min: () => min,
   minLength: () => minLength,
   mobXAdapter: () => mobXAdapter,
+  mouse: () => mouse,
   mutation: () => mutation,
+  mutationObserver: () => mutationObserver,
+  network: () => network,
   noSideEffect: () => noSideEffect,
   normalize: () => normalize,
   normalizedStore: () => normalizedStore,
@@ -192,6 +204,7 @@ __export(extras_exports, {
   persisted: () => persisted,
   phoneMask: () => phoneMask,
   plugin: () => plugin,
+  pointerLock: () => pointerLock,
   popover: () => popover,
   precompile: () => precompile,
   prefetch: () => prefetch,
@@ -243,6 +256,7 @@ __export(extras_exports, {
   slideIn: () => slideIn,
   slideOut: () => slideOut,
   socket: () => socket,
+  speech: () => speech,
   spring: () => spring,
   springSignal: () => springSignal,
   ssnMask: () => ssnMask,
@@ -254,8 +268,11 @@ __export(extras_exports, {
   stream: () => stream,
   suspenseSwapScript: () => suspenseSwapScript,
   svgElement: () => svgElement,
+  svgFavicon: () => svgFavicon,
+  swipe: () => swipe,
   syncAdapter: () => syncAdapter,
   tabs: () => tabs,
+  textSelection: () => textSelection,
   throttle: () => throttle,
   timeMask: () => timeMask,
   timeline: () => timeline,
@@ -270,11 +287,16 @@ __export(extras_exports, {
   triggerPluginUnmount: () => triggerPluginUnmount,
   trustHTML: () => trustHTML,
   uniqueId: () => uniqueId,
+  urlState: () => urlState,
   validateProps: () => validateProps,
   validators: () => validators,
+  vibrate: () => vibrate,
   viewTransition: () => viewTransition,
+  visibility: () => visibility,
+  wakeLock: () => wakeLock,
   walkDependencyGraph: () => walkDependencyGraph,
   wasm: () => wasm,
+  windowSize: () => windowSize,
   withBoundary: () => withBoundary,
   withDefaults: () => withDefaults,
   withErrorTracking: () => withErrorTracking,
@@ -1512,6 +1534,13 @@ async function preloadRoute(route, context2) {
 }
 
 // src/ui/socket.ts
+function validateWsUrl(raw) {
+  const trimmed = raw.replace(/[\x00-\x20\x7f-\x9f]+/g, "").trim();
+  if (!trimmed) return null;
+  const lower = trimmed.toLowerCase();
+  if (lower.startsWith("ws://") || lower.startsWith("wss://")) return trimmed;
+  return null;
+}
 function socket(url, options) {
   const autoReconnect = options?.autoReconnect ?? false;
   const reconnectDelay = options?.reconnectDelay ?? 1e3;
@@ -1530,8 +1559,13 @@ function socket(url, options) {
   }
   function connect() {
     if (disposed) return;
+    const safeUrl = validateWsUrl(getUrl());
+    if (safeUrl === null) {
+      setStatus("closed");
+      return;
+    }
     setStatus("connecting");
-    ws = new WebSocket(getUrl(), protocols);
+    ws = new WebSocket(safeUrl, protocols);
     ws.onopen = () => {
       setStatus("open");
       reconnectCount = 0;
@@ -1592,7 +1626,34 @@ function socket(url, options) {
   return { data: data2, status, send, close, dispose };
 }
 
+// src/utils/sanitize.ts
+function sanitizeUrl(url) {
+  const trimmed = url.replace(/[\x00-\x20\x7f-\x9f]+/g, "").trim();
+  if (!trimmed) return "";
+  const lower = trimmed.toLowerCase();
+  if (lower.startsWith("javascript:") || lower.startsWith("data:") || lower.startsWith("vbscript:") || lower.startsWith("blob:")) {
+    return "";
+  }
+  return trimmed;
+}
+function sanitizeCSSValue(value) {
+  const lower = value.toLowerCase().replace(/\s+/g, "");
+  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("-moz-binding")) {
+    return "";
+  }
+  return value;
+}
+var URL_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "cite", "poster", "background", "srcset"]);
+function isUrlAttribute(attr) {
+  return URL_ATTRIBUTES.has(attr);
+}
+
 // src/ui/stream.ts
+function validateSseUrl(raw) {
+  const safe = sanitizeUrl(raw);
+  if (!safe) return null;
+  return safe;
+}
 function stream(url, options) {
   const autoReconnect = options?.autoReconnect ?? false;
   const [data2, setData] = signal(null);
@@ -1603,8 +1664,13 @@ function stream(url, options) {
   let reconnectTimer = null;
   function connect() {
     if (disposed) return;
+    const safeUrl = validateSseUrl(url);
+    if (safeUrl === null) {
+      setStatus("closed");
+      return;
+    }
     setStatus("connecting");
-    source2 = new EventSource(url, {
+    source2 = new EventSource(safeUrl, {
       withCredentials: options?.withCredentials ?? false
     });
     source2.onopen = () => {
@@ -2103,6 +2169,766 @@ function formatCurrency(value, currency, options) {
   }).format(value);
 }
 
+// src/browser/visibility.ts
+function visibility() {
+  if (typeof document === "undefined") {
+    const [visible2] = signal(true);
+    return { visible: visible2, dispose: () => {
+    } };
+  }
+  const [visible, setVisible] = signal(!document.hidden);
+  const handler = () => setVisible(!document.hidden);
+  document.addEventListener("visibilitychange", handler);
+  function dispose() {
+    document.removeEventListener("visibilitychange", handler);
+  }
+  return { visible, dispose };
+}
+
+// src/browser/network.ts
+function network() {
+  const connection = typeof navigator !== "undefined" ? navigator.connection ?? navigator.mozConnection ?? navigator.webkitConnection : void 0;
+  const [effectiveType, setEffectiveType] = signal(connection?.effectiveType ?? "unknown");
+  const [downlink, setDownlink] = signal(connection?.downlink ?? 0);
+  const [rtt, setRtt] = signal(connection?.rtt ?? 0);
+  const [saveData, setSaveData] = signal(connection?.saveData ?? false);
+  if (!connection) {
+    return { effectiveType, downlink, rtt, saveData, dispose: () => {
+    } };
+  }
+  const update = () => {
+    setEffectiveType(connection.effectiveType ?? "unknown");
+    setDownlink(connection.downlink ?? 0);
+    setRtt(connection.rtt ?? 0);
+    setSaveData(connection.saveData ?? false);
+  };
+  connection.addEventListener("change", update);
+  function dispose() {
+    connection?.removeEventListener("change", update);
+  }
+  return { effectiveType, downlink, rtt, saveData, dispose };
+}
+
+// src/browser/mouse.ts
+function mouse(options = {}) {
+  const [x, setX] = signal(0);
+  const [y, setY] = signal(0);
+  if (typeof window === "undefined") {
+    return { x, y, dispose: () => {
+    } };
+  }
+  const target = options.target ?? window;
+  const trackTouch = options.touch ?? true;
+  const onMove = (e) => {
+    setX(e.clientX);
+    setY(e.clientY);
+  };
+  const onTouchMove = (e) => {
+    if (e.touches.length === 0) return;
+    setX(e.touches[0].clientX);
+    setY(e.touches[0].clientY);
+  };
+  target.addEventListener("mousemove", onMove, { passive: true });
+  if (trackTouch) {
+    target.addEventListener("touchmove", onTouchMove, { passive: true });
+  }
+  function dispose() {
+    target.removeEventListener("mousemove", onMove);
+    if (trackTouch) {
+      target.removeEventListener("touchmove", onTouchMove);
+    }
+  }
+  return { x, y, dispose };
+}
+
+// src/browser/swipe.ts
+function swipe(target, options = {}) {
+  const threshold = options.threshold ?? 50;
+  const [direction, setDirection] = signal(null);
+  if (typeof window === "undefined") {
+    return { direction, dispose: () => {
+    } };
+  }
+  let startX = 0;
+  let startY = 0;
+  let tracking = false;
+  const onStart = (e) => {
+    if (e.touches.length === 0) return;
+    startX = e.touches[0].clientX;
+    startY = e.touches[0].clientY;
+    tracking = true;
+  };
+  const onEnd = (e) => {
+    if (!tracking) return;
+    tracking = false;
+    const touch = e.changedTouches[0];
+    if (!touch) return;
+    const dx = touch.clientX - startX;
+    const dy = touch.clientY - startY;
+    const absX = Math.abs(dx);
+    const absY = Math.abs(dy);
+    if (Math.max(absX, absY) < threshold) return;
+    let dir;
+    if (absX > absY) {
+      dir = dx > 0 ? "right" : "left";
+    } else {
+      dir = dy > 0 ? "down" : "up";
+    }
+    setDirection(dir);
+    options.onSwipe?.(dir, Math.max(absX, absY));
+  };
+  target.addEventListener("touchstart", onStart, { passive: true });
+  target.addEventListener("touchend", onEnd, { passive: true });
+  function dispose() {
+    target.removeEventListener("touchstart", onStart);
+    target.removeEventListener("touchend", onEnd);
+  }
+  return { direction, dispose };
+}
+
+// src/browser/windowSize.ts
+function windowSize() {
+  if (typeof window === "undefined") {
+    const [width2] = signal(0);
+    const [height2] = signal(0);
+    return { width: width2, height: height2, dispose: () => {
+    } };
+  }
+  const [width, setWidth] = signal(window.innerWidth);
+  const [height, setHeight] = signal(window.innerHeight);
+  const handler = () => {
+    setWidth(window.innerWidth);
+    setHeight(window.innerHeight);
+  };
+  window.addEventListener("resize", handler, { passive: true });
+  function dispose() {
+    window.removeEventListener("resize", handler);
+  }
+  return { width, height, dispose };
+}
+
+// src/browser/urlState.ts
+function urlState() {
+  if (typeof window === "undefined") {
+    const [params2] = signal(new URLSearchParams());
+    const [hash2] = signal("");
+    return {
+      params: params2,
+      hash: hash2,
+      setParams: () => {
+      },
+      setHash: () => {
+      },
+      dispose: () => {
+      }
+    };
+  }
+  const [params, setParamsSignal] = signal(new URLSearchParams(window.location.search));
+  const [hash, setHashSignal] = signal(window.location.hash);
+  const syncFromLocation = () => {
+    setParamsSignal(new URLSearchParams(window.location.search));
+    setHashSignal(window.location.hash);
+  };
+  const onPopState = () => syncFromLocation();
+  window.addEventListener("popstate", onPopState);
+  function setParams(next, opts = {}) {
+    const p2 = next instanceof URLSearchParams ? next : new URLSearchParams(next);
+    const query2 = p2.toString();
+    const newUrl = `${window.location.pathname}${query2 ? `?${query2}` : ""}${window.location.hash}`;
+    if (opts.replace) window.history.replaceState(null, "", newUrl);
+    else window.history.pushState(null, "", newUrl);
+    setParamsSignal(new URLSearchParams(p2));
+  }
+  function setHash(next, opts = {}) {
+    const normalized = next.startsWith("#") ? next : next ? `#${next}` : "";
+    const newUrl = `${window.location.pathname}${window.location.search}${normalized}`;
+    if (opts.replace) window.history.replaceState(null, "", newUrl);
+    else window.history.pushState(null, "", newUrl);
+    setHashSignal(normalized);
+  }
+  function dispose() {
+    window.removeEventListener("popstate", onPopState);
+  }
+  return { params, hash, setParams, setHash, dispose };
+}
+
+// src/browser/broadcast.ts
+function broadcast(channelName) {
+  if (typeof BroadcastChannel === "undefined") {
+    const [last2] = signal(null);
+    return { last: last2, post: () => {
+    }, dispose: () => {
+    } };
+  }
+  const [last, setLast] = signal(null);
+  const channel = new BroadcastChannel(channelName);
+  const handler = (ev) => setLast(ev.data);
+  channel.addEventListener("message", handler);
+  function post(message) {
+    channel.postMessage(message);
+  }
+  function dispose() {
+    channel.removeEventListener("message", handler);
+    channel.close();
+  }
+  return { last, post, dispose };
+}
+
+// src/browser/fullscreen.ts
+function fullscreen() {
+  if (typeof document === "undefined") {
+    const [isFullscreen2] = signal(false);
+    const [element2] = signal(null);
+    return {
+      isFullscreen: isFullscreen2,
+      element: element2,
+      enter: async () => {
+      },
+      exit: async () => {
+      },
+      toggle: async () => {
+      },
+      dispose: () => {
+      }
+    };
+  }
+  const [isFullscreen, setIsFullscreen] = signal(!!document.fullscreenElement);
+  const [element, setElement] = signal(document.fullscreenElement);
+  const handler = () => {
+    setIsFullscreen(!!document.fullscreenElement);
+    setElement(document.fullscreenElement);
+  };
+  document.addEventListener("fullscreenchange", handler);
+  async function enter(el) {
+    if (!document.fullscreenElement && el.requestFullscreen) {
+      await el.requestFullscreen();
+    }
+  }
+  async function exit() {
+    if (document.fullscreenElement && document.exitFullscreen) {
+      await document.exitFullscreen();
+    }
+  }
+  async function toggle(el) {
+    if (document.fullscreenElement) await exit();
+    else await enter(el);
+  }
+  function dispose() {
+    document.removeEventListener("fullscreenchange", handler);
+  }
+  return { isFullscreen, element, enter, exit, toggle, dispose };
+}
+
+// src/browser/wakeLock.ts
+function wakeLock() {
+  const [active, setActive] = signal(false);
+  if (typeof navigator === "undefined" || !("wakeLock" in navigator) || typeof document === "undefined") {
+    return {
+      active,
+      request: async () => {
+      },
+      release: async () => {
+      },
+      dispose: () => {
+      }
+    };
+  }
+  const api = navigator.wakeLock;
+  let sentinel = null;
+  async function request() {
+    try {
+      sentinel = await api.request("screen");
+      setActive(true);
+      sentinel.addEventListener("release", () => {
+        setActive(false);
+      });
+    } catch {
+      setActive(false);
+    }
+  }
+  async function release() {
+    if (sentinel && !sentinel.released) {
+      await sentinel.release();
+    }
+    sentinel = null;
+    setActive(false);
+  }
+  const onVisibility = () => {
+    if (sentinel?.released && !document.hidden) {
+      void request();
+    }
+  };
+  document.addEventListener("visibilitychange", onVisibility);
+  function dispose() {
+    document.removeEventListener("visibilitychange", onVisibility);
+    void release();
+  }
+  return { active, request, release, dispose };
+}
+
+// src/browser/animationFrame.ts
+function animationFrame(options = {}) {
+  const [delta, setDelta] = signal(0);
+  const [elapsed, setElapsed] = signal(0);
+  const [running, setRunning] = signal(false);
+  if (typeof requestAnimationFrame === "undefined") {
+    return {
+      delta,
+      elapsed,
+      running,
+      pause: () => {
+      },
+      resume: () => {
+      },
+      dispose: () => {
+      }
+    };
+  }
+  let id = null;
+  let prev = -1;
+  let start = -1;
+  const minFrameMs = options.fpsLimit ? 1e3 / options.fpsLimit : 0;
+  const step = (now) => {
+    if (start < 0) start = now;
+    const firstTick = prev < 0;
+    const dt2 = firstTick ? 0 : now - prev;
+    if (firstTick || dt2 >= minFrameMs) {
+      setDelta(dt2);
+      setElapsed(now - start);
+      prev = now;
+    }
+    id = requestAnimationFrame(step);
+  };
+  function resume() {
+    if (id !== null) return;
+    setRunning(true);
+    id = requestAnimationFrame(step);
+  }
+  function pause() {
+    if (id !== null) {
+      cancelAnimationFrame(id);
+      id = null;
+    }
+    setRunning(false);
+    prev = -1;
+    start = -1;
+  }
+  function dispose() {
+    pause();
+  }
+  if (options.immediate !== false) resume();
+  return { delta, elapsed, running, pause, resume, dispose };
+}
+
+// src/browser/mutationObserver.ts
+function mutationObserver(target, options = { childList: true, subtree: true }) {
+  const [records, setRecords] = signal([]);
+  if (typeof MutationObserver === "undefined") {
+    return { records, dispose: () => {
+    } };
+  }
+  const observer = new MutationObserver((batch2) => {
+    setRecords(batch2);
+  });
+  observer.observe(target, options);
+  function dispose() {
+    observer.disconnect();
+  }
+  return { records, dispose };
+}
+
+// src/browser/bounds.ts
+var ZERO = {
+  x: 0,
+  y: 0,
+  width: 0,
+  height: 0,
+  top: 0,
+  left: 0,
+  right: 0,
+  bottom: 0
+};
+function readRect(el) {
+  const r = el.getBoundingClientRect();
+  return {
+    x: r.x,
+    y: r.y,
+    width: r.width,
+    height: r.height,
+    top: r.top,
+    left: r.left,
+    right: r.right,
+    bottom: r.bottom
+  };
+}
+function bounds(target) {
+  const [rect2, setRect] = signal(ZERO);
+  if (typeof window === "undefined" || !target) {
+    return {
+      rect: rect2,
+      refresh: () => {
+      },
+      dispose: () => {
+      }
+    };
+  }
+  function refresh() {
+    setRect(readRect(target));
+  }
+  refresh();
+  let resizeObserver = null;
+  if (typeof ResizeObserver !== "undefined") {
+    resizeObserver = new ResizeObserver(refresh);
+    resizeObserver.observe(target);
+  }
+  const onScroll = () => refresh();
+  window.addEventListener("scroll", onScroll, { passive: true, capture: true });
+  function dispose() {
+    resizeObserver?.disconnect();
+    window.removeEventListener("scroll", onScroll, { capture: true });
+  }
+  return { rect: rect2, refresh, dispose };
+}
+
+// src/browser/keyboard.ts
+function keyboard(options = {}) {
+  const [pressed, setPressed] = signal(/* @__PURE__ */ new Set());
+  if (typeof window === "undefined") {
+    return {
+      pressed,
+      isPressed: () => false,
+      dispose: () => {
+      }
+    };
+  }
+  const target = options.target ?? window;
+  const filter = options.keys ? new Set(options.keys) : null;
+  const onDown = (e) => {
+    if (filter && !filter.has(e.key)) return;
+    setPressed((prev) => {
+      if (prev.has(e.key)) return prev;
+      const next = new Set(prev);
+      next.add(e.key);
+      return next;
+    });
+  };
+  const onUp = (e) => {
+    if (filter && !filter.has(e.key)) return;
+    setPressed((prev) => {
+      if (!prev.has(e.key)) return prev;
+      const next = new Set(prev);
+      next.delete(e.key);
+      return next;
+    });
+  };
+  const onBlur = () => setPressed(/* @__PURE__ */ new Set());
+  target.addEventListener("keydown", onDown);
+  target.addEventListener("keyup", onUp);
+  window.addEventListener("blur", onBlur);
+  function isPressed(key) {
+    return pressed().has(key);
+  }
+  function dispose() {
+    target.removeEventListener("keydown", onDown);
+    target.removeEventListener("keyup", onUp);
+    window.removeEventListener("blur", onBlur);
+  }
+  return { pressed, isPressed, dispose };
+}
+
+// src/browser/speech.ts
+function speech() {
+  const [speaking, setSpeaking] = signal(false);
+  const [paused, setPaused] = signal(false);
+  if (typeof window === "undefined" || typeof window.speechSynthesis === "undefined") {
+    return {
+      speaking,
+      paused,
+      speak: () => {
+      },
+      pause: () => {
+      },
+      resume: () => {
+      },
+      cancel: () => {
+      },
+      dispose: () => {
+      }
+    };
+  }
+  const synth = window.speechSynthesis;
+  const interval = setInterval(() => {
+    setSpeaking(synth.speaking);
+    setPaused(synth.paused);
+  }, 200);
+  function speak(text2, options = {}) {
+    const u2 = new SpeechSynthesisUtterance(text2);
+    if (options.lang) u2.lang = options.lang;
+    if (options.rate != null) u2.rate = options.rate;
+    if (options.pitch != null) u2.pitch = options.pitch;
+    if (options.volume != null) u2.volume = options.volume;
+    if (options.voice) {
+      const voices = synth.getVoices();
+      const match = voices.find((v) => v.name === options.voice);
+      if (match) u2.voice = match;
+    }
+    u2.addEventListener("start", () => setSpeaking(true));
+    u2.addEventListener("end", () => {
+      setSpeaking(false);
+      setPaused(false);
+    });
+    u2.addEventListener("error", () => {
+      setSpeaking(false);
+      setPaused(false);
+    });
+    synth.speak(u2);
+  }
+  function dispose() {
+    clearInterval(interval);
+    synth.cancel();
+  }
+  return {
+    speaking,
+    paused,
+    speak,
+    pause: () => synth.pause(),
+    resume: () => synth.resume(),
+    cancel: () => synth.cancel(),
+    dispose
+  };
+}
+
+// src/browser/gamepad.ts
+function gamepad() {
+  const [pads, setPads] = signal([]);
+  if (typeof window === "undefined" || typeof navigator === "undefined" || typeof navigator.getGamepads !== "function") {
+    return { pads, dispose: () => {
+    } };
+  }
+  let rafId = null;
+  function snapshot(pad) {
+    return {
+      index: pad.index,
+      id: pad.id,
+      connected: pad.connected,
+      buttons: pad.buttons.map((b2) => ({ pressed: b2.pressed, value: b2.value })),
+      axes: [...pad.axes]
+    };
+  }
+  function equal(a2, b2) {
+    if (a2.length !== b2.length) return false;
+    for (let i2 = 0; i2 < a2.length; i2++) {
+      const pa = a2[i2];
+      const pb = b2[i2];
+      if (pa.index !== pb.index || pa.connected !== pb.connected) return false;
+      if (pa.buttons.length !== pb.buttons.length) return false;
+      for (let j = 0; j < pa.buttons.length; j++) {
+        if (pa.buttons[j].pressed !== pb.buttons[j].pressed) return false;
+        if (pa.buttons[j].value !== pb.buttons[j].value) return false;
+      }
+      if (pa.axes.length !== pb.axes.length) return false;
+      for (let j = 0; j < pa.axes.length; j++) {
+        if (pa.axes[j] !== pb.axes[j]) return false;
+      }
+    }
+    return true;
+  }
+  function poll() {
+    const raw = navigator.getGamepads();
+    const snap = Array.from(raw).filter((g2) => g2 !== null).map(snapshot);
+    const current = pads();
+    if (!equal(current, snap)) setPads(snap);
+    rafId = requestAnimationFrame(poll);
+  }
+  function startPolling() {
+    if (rafId === null) poll();
+  }
+  function stopPolling() {
+    if (rafId !== null) {
+      cancelAnimationFrame(rafId);
+      rafId = null;
+    }
+  }
+  const onConnect = () => startPolling();
+  const onDisconnect = () => {
+    const raw = navigator.getGamepads();
+    const hasAny = Array.from(raw).some((g2) => g2 !== null);
+    if (!hasAny) stopPolling();
+  };
+  window.addEventListener("gamepadconnected", onConnect);
+  window.addEventListener("gamepaddisconnected", onDisconnect);
+  const initial = Array.from(navigator.getGamepads()).some((g2) => g2 !== null);
+  if (initial) startPolling();
+  function dispose() {
+    stopPolling();
+    window.removeEventListener("gamepadconnected", onConnect);
+    window.removeEventListener("gamepaddisconnected", onDisconnect);
+  }
+  return { pads, dispose };
+}
+
+// src/browser/pointerLock.ts
+function pointerLock() {
+  const [locked, setLocked] = signal(false);
+  if (typeof document === "undefined") {
+    return {
+      locked,
+      request: () => {
+      },
+      exit: () => {
+      },
+      dispose: () => {
+      }
+    };
+  }
+  const handler = () => {
+    setLocked(!!document.pointerLockElement);
+  };
+  document.addEventListener("pointerlockchange", handler);
+  function request(element) {
+    if (typeof element.requestPointerLock === "function") {
+      element.requestPointerLock();
+    }
+  }
+  function exit() {
+    if (typeof document.exitPointerLock === "function") {
+      document.exitPointerLock();
+    }
+  }
+  function dispose() {
+    document.removeEventListener("pointerlockchange", handler);
+  }
+  return { locked, request, exit, dispose };
+}
+
+// src/browser/vibrate.ts
+function vibrate(pattern2) {
+  if (typeof navigator === "undefined" || typeof navigator.vibrate !== "function") {
+    return false;
+  }
+  return navigator.vibrate(pattern2);
+}
+
+// src/browser/favicon.ts
+function favicon(url) {
+  if (typeof document === "undefined") return;
+  let link2 = document.querySelector("link[rel='icon']");
+  if (!link2) {
+    link2 = document.createElement("link");
+    link2.rel = "icon";
+    document.head.appendChild(link2);
+  }
+  link2.href = url;
+}
+function svgFavicon(svg2) {
+  return `data:image/svg+xml;charset=utf-8,${encodeURIComponent(svg2)}`;
+}
+
+// src/browser/textSelection.ts
+function textSelection() {
+  const [text2, setText] = signal("");
+  const [rect2, setRect] = signal(null);
+  if (typeof document === "undefined") {
+    return {
+      text: text2,
+      rect: rect2,
+      hasSelection: () => false,
+      clear: () => {
+      },
+      dispose: () => {
+      }
+    };
+  }
+  const handler = () => {
+    const sel = document.getSelection();
+    if (!sel || sel.rangeCount === 0 || sel.isCollapsed) {
+      setText("");
+      setRect(null);
+      return;
+    }
+    setText(sel.toString());
+    try {
+      const r = sel.getRangeAt(0).getBoundingClientRect();
+      setRect(r.width > 0 || r.height > 0 ? r : null);
+    } catch {
+      setRect(null);
+    }
+  };
+  document.addEventListener("selectionchange", handler);
+  function clear() {
+    const sel = document.getSelection();
+    sel?.removeAllRanges();
+    setText("");
+    setRect(null);
+  }
+  function dispose() {
+    document.removeEventListener("selectionchange", handler);
+  }
+  return {
+    text: text2,
+    rect: rect2,
+    hasSelection: () => text2().length > 0,
+    clear,
+    dispose
+  };
+}
+
+// src/browser/imageLoader.ts
+function imageLoader(src) {
+  const [status, setStatus] = signal("pending");
+  const [image, setImage] = signal(null);
+  const [width, setWidth] = signal(0);
+  const [height, setHeight] = signal(0);
+  if (typeof Image === "undefined") {
+    return {
+      status,
+      image,
+      width,
+      height,
+      dispose: () => {
+      }
+    };
+  }
+  let current = null;
+  let disposed = false;
+  function start(url) {
+    if (current) {
+      current.onload = null;
+      current.onerror = null;
+    }
+    setStatus("pending");
+    setImage(null);
+    const img2 = new Image();
+    current = img2;
+    img2.onload = () => {
+      if (disposed || current !== img2) return;
+      setImage(img2);
+      setWidth(img2.naturalWidth);
+      setHeight(img2.naturalHeight);
+      setStatus("loaded");
+    };
+    img2.onerror = () => {
+      if (disposed || current !== img2) return;
+      setStatus("error");
+    };
+    img2.src = url;
+  }
+  if (typeof src === "function") {
+    start(src());
+  } else {
+    start(src);
+  }
+  function dispose() {
+    disposed = true;
+    if (current) {
+      current.onload = null;
+      current.onerror = null;
+      current = null;
+    }
+  }
+  return { status, image, width, height, dispose };
+}
+
 // src/patterns/machine.ts
 function machine(config) {
   const [state, setState] = signal(config.initial);
@@ -2133,8 +2959,13 @@ function machine(config) {
       stateDef.exit(ctx);
     }
     if (action) {
-      const patch = action(ctx);
-      setContext({ ...ctx, ...patch });
+      const rawPatch = action(ctx);
+      const next = { ...ctx };
+      for (const key of Object.keys(rawPatch)) {
+        if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+        next[key] = rawPatch[key];
+      }
+      setContext(next);
     }
     setState(target);
     const targetDef = config.states[target];
@@ -2167,6 +2998,7 @@ function persisted(key, initial, options = {}) {
   const deserialize = options.deserialize || JSON.parse;
   const encrypt = options.encrypt;
   const decrypt = options.decrypt;
+  const syncTabs = options.session ? false : options.syncTabs ?? true;
   let restored = initial;
   try {
     let raw = storage.getItem(key);
@@ -2178,8 +3010,10 @@ function persisted(key, initial, options = {}) {
   } catch {
   }
   const [value, setValue] = signal(restored);
+  let applyingFromStorage = false;
   effect(() => {
     const current = value();
+    if (applyingFromStorage) return;
     try {
       let serialized = serialize(current);
       if (encrypt) serialized = encrypt(serialized);
@@ -2187,6 +3021,47 @@ function persisted(key, initial, options = {}) {
     } catch {
     }
   });
+  let storageListener = null;
+  if (syncTabs && typeof window !== "undefined") {
+    storageListener = (e) => {
+      if (e.storageArea !== storage || e.key !== key) return;
+      if (e.newValue === null) {
+        applyingFromStorage = true;
+        try {
+          setValue(initial);
+        } finally {
+          applyingFromStorage = false;
+        }
+        return;
+      }
+      try {
+        let raw = e.newValue;
+        if (decrypt) raw = decrypt(raw);
+        const parsed = deserialize(raw);
+        if (options.validate && !options.validate(parsed)) return;
+        applyingFromStorage = true;
+        try {
+          setValue(parsed);
+        } finally {
+          applyingFromStorage = false;
+        }
+      } catch {
+      }
+    };
+    window.addEventListener("storage", storageListener);
+  }
+  const dispose = () => {
+    if (storageListener && typeof window !== "undefined") {
+      window.removeEventListener("storage", storageListener);
+      storageListener = null;
+    }
+  };
+  Object.defineProperty(setValue, "dispose", {
+    value: dispose,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
   return [value, setValue];
 }
 
@@ -3375,8 +4250,25 @@ function announce(message, priority = "polite") {
 
 // src/ui/scopedStyle.ts
 var scopeCounter = 0;
+function decodeCssEscapes(css) {
+  return css.replace(/\\([0-9a-f]{1,6})[ \t\n\r\f]?|\\([^\n])/gi, (_match, hex, ch) => {
+    if (hex) {
+      const code2 = Number.parseInt(hex, 16);
+      if (Number.isFinite(code2) && code2 > 0 && code2 <= 1114111) {
+        try {
+          return String.fromCodePoint(code2);
+        } catch {
+          return "";
+        }
+      }
+      return "";
+    }
+    return ch || "";
+  });
+}
 function sanitizeCSS(css) {
-  let sanitized = css.replace(/@import\s+[^;]+;/gi, "/* @import removed */");
+  let sanitized = decodeCssEscapes(css);
+  sanitized = sanitized.replace(/@import\s+[^;]+;/gi, "/* @import removed */");
   sanitized = sanitized.replace(/url\s*\(\s*(?:"[^"]*"|'[^']*'|[^)]*)\s*\)/gi, "/* url() removed */");
   sanitized = sanitized.replace(/expression\s*\(\s*(?:"[^"]*"|'[^']*'|[^)]*)\s*\)/gi, "/* expression() removed */");
   sanitized = sanitized.replace(/-moz-binding\s*:[^;]+;/gi, "/* -moz-binding removed */");
@@ -3426,31 +4318,22 @@ function removeScopedStyle(scopeId) {
   if (el) el.remove();
 }
 
-// src/utils/sanitize.ts
-function sanitizeUrl(url) {
-  const trimmed = url.replace(/[\x00-\x20\x7f-\x9f]+/g, "").trim();
-  if (!trimmed) return "";
-  const lower = trimmed.toLowerCase();
-  if (lower.startsWith("javascript:") || lower.startsWith("data:") || lower.startsWith("vbscript:") || lower.startsWith("blob:")) {
-    return "";
-  }
-  return trimmed;
-}
-function sanitizeCSSValue(value) {
-  const lower = value.toLowerCase().replace(/\s+/g, "");
-  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("-moz-binding")) {
-    return "";
-  }
-  return value;
-}
-var URL_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "cite", "poster", "background", "srcset"]);
-function isUrlAttribute(attr) {
-  return URL_ATTRIBUTES.has(attr);
-}
-
 // src/reactivity/bindAttribute.ts
 var _isDev4 = isDev();
+function isEventHandlerAttr(name) {
+  if (name.length < 3) return false;
+  const lower = name.toLowerCase();
+  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
+}
 function bindAttribute(el, attr, getter) {
+  if (isEventHandlerAttr(attr)) {
+    if (_isDev4)
+      devWarn(
+        `bindAttribute: refusing to bind event-handler attribute "${attr}". Use on:{ ${attr.slice(2)}: fn } instead.`
+      );
+    return () => {
+    };
+  }
   function commit() {
     let value;
     try {
@@ -4374,11 +5257,34 @@ function preloadModules(urls) {
 }
 
 // src/platform/head.ts
-var HEAD_URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "content"]);
+var HEAD_URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
 function sanitizeHeadAttr(key, value) {
   if (HEAD_URL_ATTRS.has(key)) return sanitizeUrl(value);
   return value;
 }
+function isDangerousMetaRefresh(metaProps) {
+  const httpEquiv = metaProps["http-equiv"];
+  if (typeof httpEquiv !== "string") return false;
+  if (httpEquiv.toLowerCase() !== "refresh") return false;
+  const content = metaProps.content;
+  if (typeof content !== "string") return false;
+  const normalized = content.replace(/[\x00-\x20\x7f-\x9f]+/g, "").toLowerCase();
+  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
+}
+var SAFE_HEAD_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
+function isEventHandlerAttr2(name) {
+  if (name.length < 3) return false;
+  const lower = name.toLowerCase();
+  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
+}
+function isSafeHeadAttr(name) {
+  if (!SAFE_HEAD_ATTR_NAME.test(name)) return false;
+  if (isEventHandlerAttr2(name)) return false;
+  return true;
+}
+function escapeScriptJsonLocal(json) {
+  return json.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
 function Head(props) {
   const anchor = document.createComment("sibu-head");
   const managedElements = [];
@@ -4405,15 +5311,17 @@ function Head(props) {
     }
     if (props.meta) {
       for (const metaProps of props.meta) {
+        if (isDangerousMetaRefresh(metaProps)) continue;
         const el = document.createElement("meta");
         for (const [key, value] of Object.entries(metaProps)) {
+          if (!isSafeHeadAttr(key)) continue;
           if (typeof value === "function") {
             const cleanupFn = effect(() => {
-              el.setAttribute(key, value());
+              el.setAttribute(key, sanitizeHeadAttr(key, value()));
             });
             effectCleanups.push(cleanupFn);
           } else {
-            el.setAttribute(key, value);
+            el.setAttribute(key, sanitizeHeadAttr(key, value));
           }
         }
         document.head.appendChild(el);
@@ -4424,6 +5332,7 @@ function Head(props) {
       for (const linkProps of props.link) {
         const el = document.createElement("link");
         for (const [key, value] of Object.entries(linkProps)) {
+          if (!isSafeHeadAttr(key)) continue;
           el.setAttribute(key, sanitizeHeadAttr(key, value));
         }
         document.head.appendChild(el);
@@ -4434,6 +5343,7 @@ function Head(props) {
       for (const scriptProps of props.script) {
         const el = document.createElement("script");
         for (const [key, value] of Object.entries(scriptProps)) {
+          if (!isSafeHeadAttr(key)) continue;
           el.setAttribute(key, sanitizeHeadAttr(key, value));
         }
         document.head.appendChild(el);
@@ -4444,7 +5354,10 @@ function Head(props) {
       const existing = document.head.querySelector("base");
       if (existing) existing.remove();
       const el = document.createElement("base");
-      if (props.base.href) el.href = props.base.href;
+      if (props.base.href) {
+        const safeHref = sanitizeUrl(props.base.href);
+        if (safeHref) el.href = safeHref;
+      }
       if (props.base.target) el.target = props.base.target;
       document.head.appendChild(el);
       managedElements.push(el);
@@ -4459,7 +5372,7 @@ function setStructuredData(data2) {
   const script2 = document.createElement("script");
   script2.type = "application/ld+json";
   script2.setAttribute("data-sibu", "true");
-  script2.textContent = JSON.stringify(data2);
+  script2.textContent = escapeScriptJsonLocal(JSON.stringify(data2));
   document.head.appendChild(script2);
 }
 function setCanonical(url) {
@@ -4474,12 +5387,39 @@ function setCanonical(url) {
 
 // src/platform/ssr.ts
 var _isDev5 = isDev();
+var SAFE_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
+function isSafeAttrName(name) {
+  return SAFE_ATTR_NAME.test(name);
+}
+function isEventHandlerAttr3(name) {
+  if (name.length < 3) return false;
+  const lower = name.toLowerCase();
+  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
+}
+var URL_ATTRS = /* @__PURE__ */ new Set([
+  "href",
+  "src",
+  "action",
+  "formaction",
+  "cite",
+  "poster",
+  "background",
+  "srcset",
+  "ping",
+  "manifest",
+  "data",
+  "xlink:href"
+]);
 function ssrErrorComment(err) {
   if (_isDev5) {
-    return `<!--SSR error: ${escapeHtml(err instanceof Error ? err.message : String(err))}-->`;
+    const msg = escapeHtml(err instanceof Error ? err.message : String(err));
+    return `<!--SSR error: ${safeCommentText(msg)}-->`;
   }
   return "<!--SSR error-->";
 }
+function safeCommentText(text2) {
+  return text2.replace(/-->/g, "--&gt;").replace(/--!>/g, "--!&gt;").replace(/<!--/g, "&lt;!--").replace(/--$/g, "--&#45;");
+}
 var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "area",
   "base",
@@ -4510,16 +5450,30 @@ function renderToString(element) {
     return escapeHtml(element.textContent || "");
   }
   if (element.nodeType === 8) {
-    const content = (element.textContent || "").replace(/-->/g, "--&gt;");
-    return `<!--${content}-->`;
+    return `<!--${safeCommentText(element.textContent || "")}-->`;
   }
   if (!(element instanceof HTMLElement)) {
-    return element.textContent || "";
+    return escapeHtml(element.textContent || "");
   }
   const tag = element.tagName.toLowerCase();
+  if (tag === "script" || tag === "style") {
+    return _isDev5 ? `<!--ssr:${tag}-stripped-->` : "";
+  }
+  if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
+    return _isDev5 ? "<!--ssr:invalid-tag-->" : "";
+  }
   let html2 = `<${tag}`;
   for (const attr of Array.from(element.attributes)) {
-    html2 += ` ${attr.name}="${escapeAttr(attr.value)}"`;
+    const rawName = attr.name;
+    if (!isSafeAttrName(rawName)) continue;
+    if (isEventHandlerAttr3(rawName)) continue;
+    const lowerName = rawName.toLowerCase();
+    let value = attr.value;
+    if (URL_ATTRS.has(lowerName)) {
+      value = sanitizeUrl(value);
+      if (!value) continue;
+    }
+    html2 += ` ${rawName}="${escapeAttr(value)}"`;
   }
   if (element.dataset && !element.dataset.sibuHydrate) {
     html2 += ` data-sibu-ssr="true"`;
@@ -4538,8 +5492,25 @@ function renderToString(element) {
   html2 += `</${tag}>`;
   return html2;
 }
-function hydrate(component, container) {
+function hydrate(component, container, options = {}) {
   const clientTree = component();
+  if (options.diagnostics) {
+    const mismatches = [];
+    collectMismatches(container.firstElementChild, clientTree, "", mismatches);
+    if (mismatches.length > 0) {
+      const first = mismatches[0];
+      if (options.onMismatch) {
+        options.onMismatch(first);
+      } else if (_isDev5) {
+        console.warn(
+          `[Sibu hydration] ${first.message}
+  at ${first.path}
+  server: ${first.serverValue}
+  client: ${first.clientValue}`
+        );
+      }
+    }
+  }
   hydrateNode(container.firstElementChild, clientTree);
   container.setAttribute("data-sibu-hydrated", "true");
 }
@@ -4551,9 +5522,119 @@ function hydrateNode(serverNode, clientNode) {
     hydrateNode(serverChildren[i2], clientChildren[i2]);
   }
 }
+function collectMismatches(serverNode, clientNode, path2, out, max2 = 5) {
+  if (out.length >= max2) return;
+  const nodePath = path2 || clientNode?.tagName?.toLowerCase() || "(root)";
+  if (!serverNode && clientNode) {
+    out.push({
+      kind: "child-count",
+      path: nodePath,
+      serverValue: "(missing)",
+      clientValue: clientNode.tagName.toLowerCase(),
+      message: "Client rendered a node that the server did not emit."
+    });
+    return;
+  }
+  if (serverNode && !clientNode) {
+    out.push({
+      kind: "child-count",
+      path: nodePath,
+      serverValue: serverNode.tagName.toLowerCase(),
+      clientValue: "(missing)",
+      message: "Server rendered a node that the client did not produce."
+    });
+    return;
+  }
+  if (!serverNode || !clientNode) return;
+  if (serverNode.tagName !== clientNode.tagName) {
+    out.push({
+      kind: "tag",
+      path: nodePath,
+      serverValue: serverNode.tagName.toLowerCase(),
+      clientValue: clientNode.tagName.toLowerCase(),
+      message: "Element tag mismatch \u2014 server and client disagree on the element type."
+    });
+    return;
+  }
+  const skipAttrs = /* @__PURE__ */ new Set(["data-sibu-ssr", "data-sibu-hydrated", "data-sibu-island"]);
+  const serverAttrs = /* @__PURE__ */ new Map();
+  for (const a2 of Array.from(serverNode.attributes)) {
+    if (!skipAttrs.has(a2.name)) serverAttrs.set(a2.name, a2.value);
+  }
+  const clientAttrs = /* @__PURE__ */ new Map();
+  for (const a2 of Array.from(clientNode.attributes)) {
+    if (!skipAttrs.has(a2.name)) clientAttrs.set(a2.name, a2.value);
+  }
+  for (const [name, value] of serverAttrs) {
+    if (out.length >= max2) return;
+    if (!clientAttrs.has(name)) {
+      out.push({
+        kind: "attribute",
+        path: `${nodePath}[${name}]`,
+        serverValue: value,
+        clientValue: "(missing)",
+        message: `Attribute "${name}" present on server but missing on client.`
+      });
+    } else if (clientAttrs.get(name) !== value) {
+      out.push({
+        kind: "attribute",
+        path: `${nodePath}[${name}]`,
+        serverValue: value,
+        clientValue: clientAttrs.get(name) ?? "",
+        message: `Attribute "${name}" differs between server and client.`
+      });
+    }
+  }
+  for (const [name, value] of clientAttrs) {
+    if (out.length >= max2) return;
+    if (!serverAttrs.has(name)) {
+      out.push({
+        kind: "attribute",
+        path: `${nodePath}[${name}]`,
+        serverValue: "(missing)",
+        clientValue: value,
+        message: `Attribute "${name}" present on client but missing on server.`
+      });
+    }
+  }
+  const serverChildren = Array.from(serverNode.children);
+  const clientChildren = Array.from(clientNode.children);
+  const max22 = Math.max(serverChildren.length, clientChildren.length);
+  for (let i2 = 0; i2 < max22; i2++) {
+    if (out.length >= max2) return;
+    const childPath = `${nodePath} > ${clientChildren[i2]?.tagName?.toLowerCase() ?? serverChildren[i2]?.tagName?.toLowerCase() ?? "?"}:nth-child(${i2 + 1})`;
+    collectMismatches(serverChildren[i2] ?? null, clientChildren[i2] ?? null, childPath, out, max2);
+  }
+}
 function trustHTML(html2) {
   return html2;
 }
+function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
+  if (!attrs) return "";
+  const out = [];
+  for (const rawKey of Object.keys(attrs)) {
+    if (!Object.hasOwn(attrs, rawKey)) continue;
+    if (!isSafeAttrName(rawKey)) continue;
+    if (!allowEventHandlers && isEventHandlerAttr3(rawKey)) continue;
+    const lowerKey = rawKey.toLowerCase();
+    let value = String(attrs[rawKey]);
+    if (URL_ATTRS.has(lowerKey)) {
+      value = sanitizeUrl(value);
+      if (!value) continue;
+    }
+    out.push(`${rawKey}="${escapeAttr(value)}"`);
+  }
+  return out.join(" ");
+}
+function isDangerousMetaRefresh2(metaProps) {
+  const httpEquiv = metaProps["http-equiv"];
+  if (typeof httpEquiv !== "string") return false;
+  if (httpEquiv.toLowerCase() !== "refresh") return false;
+  const content = metaProps.content;
+  if (typeof content !== "string") return false;
+  const normalized = content.replace(/[\x00-\x20\x7f-\x9f]+/g, "").toLowerCase();
+  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
+}
 function renderToDocument(component, options = {}) {
   let content;
   try {
@@ -4561,14 +5642,22 @@ function renderToDocument(component, options = {}) {
   } catch (err) {
     content = ssrErrorComment(err);
   }
-  const metaTags = (options.meta || []).map(
-    (attrs) => `<meta ${Object.entries(attrs).map(([k, v]) => `${k}="${escapeAttr(v)}"`).join(" ")} />`
-  ).join("\n    ");
-  const linkTags = (options.links || []).map(
-    (attrs) => `<link ${Object.entries(attrs).map(([k, v]) => `${k}="${escapeAttr(v)}"`).join(" ")} />`
-  ).join("\n    ");
-  const scriptTags = (options.scripts || []).map((src) => `<script src="${escapeAttr(src)}"></script>`).join("\n    ");
-  const bodyAttrs = options.bodyAttrs ? " " + Object.entries(options.bodyAttrs).map(([k, v]) => `${k}="${escapeAttr(v)}"`).join(" ") : "";
+  const metaTags = (options.meta || []).map((attrs) => {
+    if (isDangerousMetaRefresh2(attrs)) return "";
+    const pairs = buildAttrString(attrs);
+    return pairs ? `<meta ${pairs} />` : "";
+  }).filter(Boolean).join("\n    ");
+  const linkTags = (options.links || []).map((attrs) => {
+    const pairs = buildAttrString(attrs);
+    return pairs ? `<link ${pairs} />` : "";
+  }).filter(Boolean).join("\n    ");
+  const scriptTags = (options.scripts || []).map((src) => {
+    const safe = sanitizeUrl(String(src));
+    if (!safe) return "";
+    return `<script src="${escapeAttr(safe)}"></script>`;
+  }).filter(Boolean).join("\n    ");
+  const bodyAttrPairs = buildAttrString(options.bodyAttrs);
+  const bodyAttrs = bodyAttrPairs ? ` ${bodyAttrPairs}` : "";
   return `<!DOCTYPE html>
 <html>
   <head>
@@ -4601,18 +5690,34 @@ async function* renderToStream(element) {
     return;
   }
   if (element.nodeType === 8) {
-    const content = (element.textContent || "").replace(/-->/g, "--&gt;");
-    yield `<!--${content}-->`;
+    yield `<!--${safeCommentText(element.textContent || "")}-->`;
     return;
   }
   if (!(element instanceof HTMLElement)) {
-    yield element.textContent || "";
+    yield escapeHtml(element.textContent || "");
     return;
   }
   const tag = element.tagName.toLowerCase();
+  if (tag === "script" || tag === "style") {
+    if (_isDev5) yield `<!--ssr:${tag}-stripped-->`;
+    return;
+  }
+  if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
+    if (_isDev5) yield "<!--ssr:invalid-tag-->";
+    return;
+  }
   let openTag = `<${tag}`;
   for (const attr of Array.from(element.attributes)) {
-    openTag += ` ${attr.name}="${escapeAttr(attr.value)}"`;
+    const rawName = attr.name;
+    if (!isSafeAttrName(rawName)) continue;
+    if (isEventHandlerAttr3(rawName)) continue;
+    const lowerName = rawName.toLowerCase();
+    let value = attr.value;
+    if (URL_ATTRS.has(lowerName)) {
+      value = sanitizeUrl(value);
+      if (!value) continue;
+    }
+    openTag += ` ${rawName}="${escapeAttr(value)}"`;
   }
   if (VOID_ELEMENTS.has(tag)) {
     yield `${openTag} />`;
@@ -4660,8 +5765,9 @@ function hydrateIslands(container, islands) {
   const markers = container.querySelectorAll("[data-sibu-island]");
   for (const marker2 of Array.from(markers)) {
     const id = marker2.getAttribute("data-sibu-island") ?? "";
+    if (!Object.hasOwn(islands, id)) continue;
     const factory = islands[id];
-    if (!factory) continue;
+    if (typeof factory !== "function") continue;
     const clientTree = factory();
     hydrateNode(marker2, clientTree);
     marker2.setAttribute("data-sibu-hydrated", "true");
@@ -4673,8 +5779,9 @@ function hydrateProgressively(container, islands, options) {
   const cleanups = [];
   for (const marker2 of Array.from(markers)) {
     const id = marker2.getAttribute("data-sibu-island") ?? "";
+    if (!Object.hasOwn(islands, id)) continue;
     const factory = islands[id];
-    if (!factory) continue;
+    if (typeof factory !== "function") continue;
     const observer = new IntersectionObserver(
       (entries) => {
         for (const entry of entries) {
@@ -4713,24 +5820,33 @@ function ssrSuspense(props) {
   }));
   return { element: wrapper, promise };
 }
+var SAFE_SUSPENSE_ID = /^[A-Za-z0-9_-]+$/;
 function suspenseSwapScript(id, nonce) {
-  const safeId = id.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
+  if (!SAFE_SUSPENSE_ID.test(id)) {
+    throw new Error(
+      `[SibuJS SSR] suspenseSwapScript: id must match [A-Za-z0-9_-]+ (got: ${JSON.stringify(id.slice(0, 32))})`
+    );
+  }
   const nonceAttr = nonce ? ` nonce="${escapeAttr(nonce)}"` : "";
-  return `<script${nonceAttr}>(function(){var t=document.getElementById("sibu-resolved-${safeId}");var f=document.querySelector('[data-sibu-suspense-id="${safeId}"]');if(t&&f){while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
+  return `<script${nonceAttr}>(function(){var t=document.getElementById("sibu-resolved-${id}");var f=document.querySelector('[data-sibu-suspense-id="${id}"]');if(t&&f){while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
 }
-async function* renderToSuspenseStream(element, pendingBoundaries = []) {
+async function* renderToSuspenseStream(element, pendingBoundaries = [], options) {
   yield* renderToStream(element);
   if (pendingBoundaries.length > 0) {
     const resolved = await Promise.all(pendingBoundaries);
     for (const { id, html: html2 } of resolved) {
-      yield `<div hidden id="sibu-resolved-${escapeAttr(id)}">${html2}</div>`;
-      yield suspenseSwapScript(id);
+      if (!SAFE_SUSPENSE_ID.test(id)) continue;
+      yield `<div hidden id="sibu-resolved-${id}">${html2}</div>`;
+      yield suspenseSwapScript(id, options?.nonce);
     }
   }
 }
 var SSR_DATA_ATTR = "__SIBU_SSR_DATA__";
+function escapeScriptJson(json) {
+  return json.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
 function serializeState(state, nonce) {
-  const json = JSON.stringify(state).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026");
+  const json = escapeScriptJson(JSON.stringify(state));
   const nonceAttr = nonce ? ` nonce="${escapeAttr(nonce)}"` : "";
   return `<script${nonceAttr}>window.${SSR_DATA_ATTR}=${json}</script>`;
 }
@@ -4745,7 +5861,7 @@ function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 function escapeAttr(str) {
-  return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 
 // src/platform/customElement.ts
@@ -5300,16 +6416,20 @@ function appendChildren(el, nodes) {
 var tagFactory = (tag, ns) => (first, second) => {
   const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
   if (first === void 0) return el;
-  if (second === void 0 && typeof first === "string") {
+  if (typeof first === "string") {
+    if (second !== void 0) {
+      el.setAttribute("class", first);
+      appendChildren(el, second);
+      return el;
+    }
     el.textContent = first;
     return el;
   }
-  if (second !== void 0) {
-    el.setAttribute("class", first);
-    appendChildren(el, second);
+  if (typeof first === "number") {
+    el.textContent = String(first);
     return el;
   }
-  if (Array.isArray(first) || first instanceof Node) {
+  if (Array.isArray(first) || first instanceof Node || typeof first === "function") {
     appendChildren(el, first);
     return el;
   }
@@ -5318,7 +6438,7 @@ var tagFactory = (tag, ns) => (first, second) => {
   if (pClass != null) applyClass(el, pClass);
   const pId = props.id;
   if (pId != null) el.id = pId;
-  const pNodes = props.nodes;
+  const pNodes = second !== void 0 ? second : props.nodes;
   if (pNodes != null) appendChildren(el, pNodes);
   const pOn = props.on;
   if (pOn) {
@@ -8619,6 +9739,7 @@ var materialAdapter = componentAdapter(materialConfig);
   VirtualList,
   accordion,
   animate,
+  animationFrame,
   announce,
   antdAdapter,
   aria,
@@ -8631,6 +9752,8 @@ var materialAdapter = componentAdapter(materialConfig);
   block,
   bounceIn,
   bounceOut,
+  bounds,
+  broadcast,
   bundlerMetadata,
   calculateDelay,
   chakraAdapter,
@@ -8704,10 +9827,12 @@ var materialAdapter = componentAdapter(materialConfig);
   email,
   enableDebug,
   env,
+  escapeScriptJson,
   eventBus,
   executeLoader,
   fadeIn,
   fadeOut,
+  favicon,
   fileUpload,
   flipIn,
   flushScheduler,
@@ -8716,6 +9841,8 @@ var materialAdapter = componentAdapter(materialConfig);
   formatCurrency,
   formatError,
   formatNumber,
+  fullscreen,
+  gamepad,
   generateStaticSite,
   geo,
   getActiveDevTools,
@@ -8734,6 +9861,7 @@ var materialAdapter = componentAdapter(materialConfig);
   hydrateIslands,
   hydrateProgressively,
   idle,
+  imageLoader,
   infiniteQuery,
   infiniteScroll,
   initDevTools,
@@ -8746,6 +9874,7 @@ var materialAdapter = componentAdapter(materialConfig);
   isHMRAvailable,
   isWasmCached,
   island,
+  keyboard,
   lazyChunk,
   lazyLoad,
   lazyModule,
@@ -8762,7 +9891,10 @@ var materialAdapter = componentAdapter(materialConfig);
   min,
   minLength,
   mobXAdapter,
+  mouse,
   mutation,
+  mutationObserver,
+  network,
   noSideEffect,
   normalize,
   normalizedStore,
@@ -8779,6 +9911,7 @@ var materialAdapter = componentAdapter(materialConfig);
   persisted,
   phoneMask,
   plugin,
+  pointerLock,
   popover,
   precompile,
   prefetch,
@@ -8830,6 +9963,7 @@ var materialAdapter = componentAdapter(materialConfig);
   slideIn,
   slideOut,
   socket,
+  speech,
   spring,
   springSignal,
   ssnMask,
@@ -8841,8 +9975,11 @@ var materialAdapter = componentAdapter(materialConfig);
   stream,
   suspenseSwapScript,
   svgElement,
+  svgFavicon,
+  swipe,
   syncAdapter,
   tabs,
+  textSelection,
   throttle,
   timeMask,
   timeline,
@@ -8857,11 +9994,16 @@ var materialAdapter = componentAdapter(materialConfig);
   triggerPluginUnmount,
   trustHTML,
   uniqueId,
+  urlState,
   validateProps,
   validators,
+  vibrate,
   viewTransition,
+  visibility,
+  wakeLock,
   walkDependencyGraph,
   wasm,
+  windowSize,
   withBoundary,
   withDefaults,
   withErrorTracking,