sibujs 1.4.0 → 2.0.0

package/dist/plugins.cjs

@@ -26,12 +26,12 @@ function isDev() {
 }
 function devAssert(condition, message) {
   if (_isDev && !condition) {
-    throw new Error(`[Sibu] ${message}`);
+    throw new Error(`[SibuJS] ${message}`);
   }
 }
 function devWarn(message) {
   if (_isDev) {
-    console.warn(`[Sibu] ${message}`);
+    console.warn(`[SibuJS] ${message}`);
   }
 }
 var _isDev;
@@ -47,14 +47,47 @@ function sanitizeUrl(url) {
   const trimmed = url.replace(/[\x00-\x20\x7f-\x9f]+/g, "").trim();
   if (!trimmed) return "";
   const lower = trimmed.toLowerCase();
-  if (lower.startsWith("javascript:") || lower.startsWith("data:") || lower.startsWith("vbscript:") || lower.startsWith("blob:")) {
-    return "";
+  let schemeEnd = -1;
+  for (let i2 = 0; i2 < lower.length; i2++) {
+    const ch = lower.charCodeAt(i2);
+    if (ch === 58) {
+      schemeEnd = i2;
+      break;
+    }
+    if (ch === 47 || ch === 63 || ch === 35) break;
   }
+  if (schemeEnd === -1) return trimmed;
+  const scheme = lower.slice(0, schemeEnd + 1);
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return trimmed;
+  if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
   return trimmed;
 }
+function sanitizeSrcset(value) {
+  const parts = value.split(",");
+  const out = [];
+  for (let i2 = 0; i2 < parts.length; i2++) {
+    const part = parts[i2].trim();
+    if (!part) continue;
+    const m = part.match(/^(\S+)(\s+.+)?$/);
+    if (!m) continue;
+    const safe = sanitizeUrl(m[1]);
+    if (!safe) continue;
+    out.push(m[2] ? `${safe}${m[2]}` : safe);
+  }
+  return out.join(", ");
+}
 function sanitizeCSSValue(value) {
-  const lower = value.toLowerCase().replace(/\s+/g, "");
-  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("-moz-binding")) {
+  const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
+    const code2 = Number.parseInt(hex, 16);
+    if (!Number.isFinite(code2) || code2 < 0 || code2 > 1114111) return "";
+    try {
+      return String.fromCodePoint(code2);
+    } catch {
+      return "";
+    }
+  });
+  const lower = decoded.toLowerCase().replace(/\s+/g, "");
+  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("vbscript:") || lower.includes("-moz-binding") || lower.includes("behavior:") || lower.includes("@import") || lower.includes("image-set(") || lower.includes("filter:progid")) {
     return "";
   }
   return value;
@@ -62,11 +95,56 @@ function sanitizeCSSValue(value) {
 function isUrlAttribute(attr) {
   return URL_ATTRIBUTES.has(attr);
 }
-var URL_ATTRIBUTES;
+var SAFE_URL_PROTOCOLS, URL_ATTRIBUTES;
 var init_sanitize = __esm({
   "src/utils/sanitize.ts"() {
     "use strict";
-    URL_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "cite", "poster", "background", "srcset"]);
+    SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+    URL_ATTRIBUTES = /* @__PURE__ */ new Set([
+      "href",
+      "xlink:href",
+      "src",
+      "action",
+      "formaction",
+      "formtarget",
+      "cite",
+      "poster",
+      "background",
+      "srcset",
+      "ping",
+      "data"
+    ]);
+  }
+});
+
+// src/core/ssr-context.ts
+function getSSRStore() {
+  if (als) {
+    const s2 = als.getStore();
+    if (s2) return s2;
+  }
+  return fallbackStore;
+}
+function isSSR() {
+  return getSSRStore().ssr;
+}
+var als, fallbackStore;
+var init_ssr_context = __esm({
+  "src/core/ssr-context.ts"() {
+    "use strict";
+    als = null;
+    try {
+      if (typeof process !== "undefined" && process.versions && process.versions.node) {
+        const req = Function("return typeof require==='function'?require:null")();
+        if (req) {
+          const mod = req("node:async_hooks");
+          als = new mod.AsyncLocalStorage();
+        }
+      }
+    } catch {
+      als = null;
+    }
+    fallbackStore = { ssr: false, suspenseIdCounter: 0 };
   }
 });
 
@@ -100,7 +178,7 @@ function isEventHandlerAttr2(name) {
   return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
 }
 function ssrErrorComment(err) {
-  if (_isDev7) {
+  if (_isDev8) {
     const msg = escapeHtml(err instanceof Error ? err.message : String(err));
     return `<!--SSR error: ${safeCommentText(msg)}-->`;
   }
@@ -130,10 +208,10 @@ function renderToString(element) {
   }
   const tag = element.tagName.toLowerCase();
   if (tag === "script" || tag === "style") {
-    return _isDev7 ? `<!--ssr:${tag}-stripped-->` : "";
+    return _isDev8 ? `<!--ssr:${tag}-stripped-->` : "";
   }
   if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    return _isDev7 ? "<!--ssr:invalid-tag-->" : "";
+    return _isDev8 ? "<!--ssr:invalid-tag-->" : "";
   }
   let html2 = `<${tag}`;
   for (const attr of Array.from(element.attributes)) {
@@ -174,9 +252,9 @@ function hydrate(component, container, options = {}) {
       const first = mismatches[0];
       if (options.onMismatch) {
         options.onMismatch(first);
-      } else if (_isDev7) {
+      } else if (_isDev8) {
         console.warn(
-          `[Sibu hydration] ${first.message}
+          `[SibuJS hydration] ${first.message}
   at ${first.path}
   server: ${first.serverValue}
   client: ${first.clientValue}`
@@ -184,17 +262,9 @@ function hydrate(component, container, options = {}) {
       }
     }
   }
-  hydrateNode(container.firstElementChild, clientTree);
+  container.replaceChildren(clientTree);
   container.setAttribute("data-sibu-hydrated", "true");
 }
-function hydrateNode(serverNode, clientNode) {
-  if (!serverNode) return;
-  const serverChildren = Array.from(serverNode.children);
-  const clientChildren = Array.from(clientNode.children);
-  for (let i2 = 0; i2 < Math.min(serverChildren.length, clientChildren.length); i2++) {
-    hydrateNode(serverChildren[i2], clientChildren[i2]);
-  }
-}
 function collectMismatches(serverNode, clientNode, path2, out, max = 5) {
   if (out.length >= max) return;
   const nodePath = path2 || clientNode?.tagName?.toLowerCase() || "(root)";
@@ -372,11 +442,11 @@ async function* renderToStream(element) {
   }
   const tag = element.tagName.toLowerCase();
   if (tag === "script" || tag === "style") {
-    if (_isDev7) yield `<!--ssr:${tag}-stripped-->`;
+    if (_isDev8) yield `<!--ssr:${tag}-stripped-->`;
     return;
   }
   if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    if (_isDev7) yield "<!--ssr:invalid-tag-->";
+    if (_isDev8) yield "<!--ssr:invalid-tag-->";
     return;
   }
   let openTag = `<${tag}`;
@@ -424,12 +494,15 @@ function renderToReadableStream(element) {
         controller.enqueue(value);
       }
     },
-    cancel() {
-      generator.return(void 0);
+    async cancel() {
+      await generator.return(void 0);
     }
   });
 }
 function island(id, component) {
+  if (!SAFE_ID.test(id)) {
+    throw new Error(`[SibuJS SSR] island: id must match [A-Za-z0-9_-]+ (got: ${JSON.stringify(id.slice(0, 32))})`);
+  }
   const el = component();
   el.setAttribute("data-sibu-island", id);
   return el;
@@ -442,8 +515,9 @@ function hydrateIslands(container, islands) {
     const factory = islands[id];
     if (typeof factory !== "function") continue;
     const clientTree = factory();
-    hydrateNode(marker2, clientTree);
-    marker2.setAttribute("data-sibu-hydrated", "true");
+    clientTree.setAttribute("data-sibu-island", id);
+    clientTree.setAttribute("data-sibu-hydrated", "true");
+    marker2.replaceWith(clientTree);
   }
   container.setAttribute("data-sibu-hydrated", "partial");
 }
@@ -460,8 +534,9 @@ function hydrateProgressively(container, islands, options) {
         for (const entry of entries) {
           if (entry.isIntersecting) {
             const clientTree = factory();
-            hydrateNode(marker2, clientTree);
-            marker2.setAttribute("data-sibu-hydrated", "true");
+            clientTree.setAttribute("data-sibu-island", id);
+            clientTree.setAttribute("data-sibu-hydrated", "true");
+            marker2.replaceWith(clientTree);
             observer.disconnect();
             break;
           }
@@ -478,18 +553,36 @@ function hydrateProgressively(container, islands, options) {
   };
 }
 function resetSSRState() {
-  suspenseIdCounter = 0;
+  getSSRStore().suspenseIdCounter = 0;
+}
+function noop() {
 }
 function ssrSuspense(props) {
-  const id = `sibu-sus-${suspenseIdCounter++}`;
+  const store = getSSRStore();
+  const id = `sibu-sus-${store.suspenseIdCounter++}`;
+  const timeoutMs = props.timeoutMs ?? 3e4;
   const fallbackEl = props.fallback();
   const wrapper = document.createElement("div");
   wrapper.setAttribute("data-sibu-suspense-id", id);
   wrapper.appendChild(fallbackEl);
-  const promise = props.content().then((resolvedEl) => ({
-    id,
-    html: renderToString(resolvedEl)
-  }));
+  const fallbackHtml = renderToString(fallbackEl);
+  let timer;
+  const timeoutPromise = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`[SibuJS SSR] ssrSuspense timed out after ${timeoutMs}ms`)), timeoutMs);
+  });
+  const raced = Promise.race([props.content(), timeoutPromise]);
+  const promise = raced.then(
+    (resolvedEl) => {
+      if (timer) clearTimeout(timer);
+      return { id, html: renderToString(resolvedEl) };
+    },
+    (err) => {
+      if (timer) clearTimeout(timer);
+      if (_isDev8) console.warn("[SibuJS SSR] ssrSuspense rejected:", err);
+      return { id, html: fallbackHtml };
+    }
+  );
+  promise.catch(noop);
   return { element: wrapper, promise };
 }
 function suspenseSwapScript(id, nonce) {
@@ -515,14 +608,26 @@ async function* renderToSuspenseStream(element, pendingBoundaries = [], options)
 function escapeScriptJson(json) {
   return json.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
-function serializeState(state, nonce) {
-  const json = escapeScriptJson(JSON.stringify(state));
+function serializeState(state, nonce, options) {
+  const rawJson = JSON.stringify(state);
+  const maxBytes = options?.maxBytes ?? DEFAULT_MAX_SSR_BYTES;
+  const byteLen = typeof TextEncoder !== "undefined" ? new TextEncoder().encode(rawJson).byteLength : Buffer.byteLength(rawJson, "utf8");
+  if (byteLen > maxBytes) {
+    throw new Error(`[SibuJS SSR] serializeState: payload (${byteLen} bytes) exceeds maxBytes (${maxBytes})`);
+  }
+  const json = escapeScriptJson(rawJson);
   const nonceAttr = nonce ? ` nonce="${escapeAttr(nonce)}"` : "";
   return `<script${nonceAttr}>window.${SSR_DATA_ATTR}=${json}</script>`;
 }
 function deserializeState(validate) {
   if (typeof window === "undefined") return void 0;
-  const raw = window[SSR_DATA_ATTR];
+  if (_isDev8 && !validate) {
+    console.warn(
+      "[SibuJS SSR] deserializeState() called without a validate guard \u2014 tampered SSR payloads will not be detected."
+    );
+  }
+  const w = window;
+  const raw = w[SSR_DATA_ATTR];
   if (raw === void 0) return void 0;
   if (validate && !validate(raw)) return void 0;
   return raw;
@@ -533,13 +638,14 @@ function escapeHtml(str) {
 function escapeAttr(str) {
   return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-var _isDev7, SAFE_ATTR_NAME, URL_ATTRS, VOID_ELEMENTS, suspenseIdCounter, SAFE_SUSPENSE_ID, SSR_DATA_ATTR;
+var _isDev8, SAFE_ATTR_NAME, URL_ATTRS, VOID_ELEMENTS, SAFE_ID, SAFE_SUSPENSE_ID, SSR_DATA_ATTR, DEFAULT_MAX_SSR_BYTES;
 var init_ssr = __esm({
   "src/platform/ssr.ts"() {
     "use strict";
     init_dev();
+    init_ssr_context();
     init_sanitize();
-    _isDev7 = isDev();
+    _isDev8 = isDev();
     SAFE_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
     URL_ATTRS = /* @__PURE__ */ new Set([
       "href",
@@ -571,9 +677,10 @@ var init_ssr = __esm({
       "track",
       "wbr"
     ]);
-    suspenseIdCounter = 0;
+    SAFE_ID = /^[A-Za-z0-9_-]+$/;
     SAFE_SUSPENSE_ID = /^[A-Za-z0-9_-]+$/;
     SSR_DATA_ATTR = "__SIBU_SSR_DATA__";
+    DEFAULT_MAX_SSR_BYTES = 1024 * 1024;
   }
 });
 
@@ -588,6 +695,7 @@ __export(plugins_exports, {
   Suspense: () => Suspense,
   Trans: () => Trans,
   VERSION: () => VERSION,
+  __removeRouterPagehideHandler: () => __removeRouterPagehideHandler,
   addRoute: () => addRoute,
   afterEach: () => afterEach,
   back: () => back,
@@ -603,6 +711,7 @@ __export(plugins_exports, {
   createMigrationRunner: () => createMigrationRunner,
   createModuleRegistry: () => createModuleRegistry,
   createPlugin: () => createPlugin,
+  createPluginRegistry: () => createPluginRegistry,
   createRouter: () => createRouter,
   createSSRCache: () => createSSRCache,
   createSSRRouter: () => createSSRRouter,
@@ -645,6 +754,7 @@ __export(plugins_exports, {
   routerState: () => routerState,
   satisfies: () => satisfies,
   serializeRouteState: () => serializeRouteState,
+  setDefaultPluginRegistry: () => setDefaultPluginRegistry,
   setLocale: () => setLocale,
   setRouteTransition: () => setRouteTransition,
   setRoutes: () => setRoutes,
@@ -655,6 +765,9 @@ __export(plugins_exports, {
 });
 module.exports = __toCommonJS(plugins_exports);
 
+// src/core/rendering/tagFactory.ts
+init_dev();
+
 // src/reactivity/bindAttribute.ts
 init_dev();
 init_sanitize();
@@ -666,11 +779,11 @@ var subscriberStack = new Array(32);
 var stackCapacity = 32;
 var stackTop = -1;
 var currentSubscriber = null;
-var signalSubscribers = /* @__PURE__ */ new WeakMap();
 var SUBS = "__s";
 var notifyDepth = 0;
 var pendingQueue = [];
 var pendingSet = /* @__PURE__ */ new Set();
+var propagateStack = [];
 function safeInvoke(sub2) {
   try {
     sub2();
@@ -716,7 +829,6 @@ function recordDependency(signal2) {
   let subs = signal2[SUBS];
   if (!subs) {
     subs = /* @__PURE__ */ new Set();
-    signalSubscribers.set(signal2, subs);
     signal2[SUBS] = subs;
   }
   subs.add(currentSubscriber);
@@ -726,42 +838,46 @@ function recordDependency(signal2) {
     signal2.__f = void 0;
   }
 }
+var maxDrainIterations = 1e5;
 function propagateDirty(sub2) {
   sub2();
-  let sig = sub2._sig;
-  while (sig) {
+  const rootSig = sub2._sig;
+  if (!rootSig) return;
+  const stack = propagateStack;
+  const baseLen = stack.length;
+  stack.push(rootSig);
+  while (stack.length > baseLen) {
+    const sig = stack.pop();
     const first = sig.__f;
     if (first) {
       if (first._c) {
         const nSig = first._sig;
-        nSig._d = true;
-        sig = nSig;
-        continue;
-      }
-      if (!pendingSet.has(first)) {
+        if (!nSig._d) {
+          nSig._d = true;
+          stack.push(nSig);
+        }
+      } else if (!pendingSet.has(first)) {
         pendingSet.add(first);
         pendingQueue.push(first);
       }
-      break;
+      continue;
     }
     const subs = sig[SUBS];
-    if (!subs) break;
-    let nextSig;
+    if (!subs) continue;
     for (const s2 of subs) {
       if (s2._c) {
-        s2();
         const nSig = s2._sig;
-        if (nSig && !nextSig) {
-          nextSig = nSig;
-        } else if (nSig) {
-          propagateDirty(s2);
+        if (nSig && !nSig._d) {
+          nSig._d = true;
+          stack.push(nSig);
+        } else if (!nSig) {
+          s2();
         }
       } else if (!pendingSet.has(s2)) {
         pendingSet.add(s2);
         pendingQueue.push(s2);
       }
     }
-    sig = nextSig;
   }
 }
 function notifySubscribers(signal2) {
@@ -785,13 +901,23 @@ function notifySubscribers(signal2) {
       }
       let i2 = 0;
       while (i2 < pendingQueue.length) {
+        if (i2 >= maxDrainIterations) {
+          if (typeof console !== "undefined") {
+            console.error(
+              `[SibuJS] Notification queue exceeded ${maxDrainIterations} iterations \u2014 likely an effect that writes to a signal it reads. Breaking to prevent infinite loop.`
+            );
+          }
+          break;
+        }
         safeInvoke(pendingQueue[i2]);
         i2++;
       }
     } finally {
-      pendingQueue.length = 0;
-      pendingSet.clear();
       notifyDepth--;
+      if (notifyDepth === 0) {
+        pendingQueue.length = 0;
+        pendingSet.clear();
+      }
     }
     return;
   }
@@ -811,30 +937,48 @@ function notifySubscribers(signal2) {
   notifyDepth++;
   try {
     let directCount = 0;
+    let hasComputedSub = false;
     for (const sub2 of subs) {
+      if (sub2._c) hasComputedSub = true;
       pendingQueue[directCount++] = sub2;
     }
-    for (let i3 = 0; i3 < directCount; i3++) {
-      if (pendingQueue[i3]._c) {
-        propagateDirty(pendingQueue[i3]);
+    if (!hasComputedSub) {
+      for (let i3 = 0; i3 < directCount; i3++) {
+        safeInvoke(pendingQueue[i3]);
       }
-    }
-    for (let i3 = 0; i3 < directCount; i3++) {
-      if (!pendingQueue[i3]._c) {
-        if (!pendingSet.has(pendingQueue[i3])) {
-          safeInvoke(pendingQueue[i3]);
+    } else {
+      for (let i3 = 0; i3 < directCount; i3++) {
+        if (pendingQueue[i3]._c) {
+          propagateDirty(pendingQueue[i3]);
+        }
+      }
+      for (let i3 = 0; i3 < directCount; i3++) {
+        const sub2 = pendingQueue[i3];
+        if (!sub2._c && !pendingSet.has(sub2)) {
+          pendingSet.add(sub2);
+          safeInvoke(sub2);
         }
       }
     }
     let i2 = directCount;
     while (i2 < pendingQueue.length) {
+      if (i2 - directCount >= maxDrainIterations) {
+        if (typeof console !== "undefined") {
+          console.error(
+            `[SibuJS] Notification queue exceeded ${maxDrainIterations} iterations \u2014 likely an effect that writes to a signal it reads. Breaking to prevent infinite loop.`
+          );
+        }
+        break;
+      }
       safeInvoke(pendingQueue[i2]);
       i2++;
     }
   } finally {
-    pendingQueue.length = 0;
-    pendingSet.clear();
     notifyDepth--;
+    if (notifyDepth === 0) {
+      pendingQueue.length = 0;
+      pendingSet.clear();
+    }
   }
 }
 function cleanup(subscriber) {
@@ -845,7 +989,9 @@ function cleanup(subscriber) {
     if (subs) {
       subs.delete(subscriber);
       if (singleDep.__f === subscriber) {
-        singleDep.__f = void 0;
+        singleDep.__f = subs.size === 1 ? subs.values().next().value : void 0;
+      } else if (subs.size === 1 && singleDep.__f === void 0) {
+        singleDep.__f = subs.values().next().value;
       }
     }
     sub2._dep = void 0;
@@ -858,7 +1004,9 @@ function cleanup(subscriber) {
     if (subs) {
       subs.delete(subscriber);
       if (signal2.__f === subscriber) {
-        signal2.__f = void 0;
+        signal2.__f = subs.size === 1 ? subs.values().next().value : void 0;
+      } else if (subs.size === 1 && signal2.__f === void 0) {
+        signal2.__f = subs.values().next().value;
       }
     }
   }
@@ -867,6 +1015,9 @@ function cleanup(subscriber) {
 
 // src/reactivity/bindAttribute.ts
 var _isDev3 = isDev();
+function setProp(el, key, val) {
+  el[key] = val;
+}
 function isEventHandlerAttr(name) {
   if (name.length < 3) return false;
   const lower = name.toLowerCase();
@@ -892,7 +1043,7 @@ function bindAttribute(el, attr, getter) {
     }
     if (typeof value === "boolean") {
       if (attr in el && (attr === "checked" || attr === "disabled" || attr === "selected")) {
-        el[attr] = value;
+        setProp(el, attr, value);
       } else if (value) {
         el.setAttribute(attr, "");
       } else {
@@ -902,7 +1053,7 @@ function bindAttribute(el, attr, getter) {
     }
     const str = String(value);
     if ((attr === "value" || attr === "checked") && attr in el) {
-      el[attr] = attr === "checked" ? Boolean(value) : str;
+      setProp(el, attr, attr === "checked" ? Boolean(value) : str);
     } else {
       el.setAttribute(attr, isUrlAttribute(attr) ? sanitizeUrl(str) : str);
     }
@@ -940,24 +1091,29 @@ function bindChildNode(placeholder, getter) {
     let newNodes;
     if (Array.isArray(result)) {
       newNodes = [];
+      const seen = /* @__PURE__ */ new Set();
       for (let i2 = 0; i2 < result.length; i2++) {
         const item = result[i2];
         if (item == null || typeof item === "boolean") continue;
-        newNodes.push(item instanceof Node ? item : document.createTextNode(String(item)));
+        const node = item instanceof Node ? item : document.createTextNode(String(item));
+        if (seen.has(node)) {
+          if (_isDev4)
+            devWarn("bindChildNode: duplicate node reference in array \u2014 only the first occurrence is rendered.");
+          continue;
+        }
+        seen.add(node);
+        newNodes.push(node);
       }
     } else {
       const node = result instanceof Node ? result : document.createTextNode(String(result));
       newNodes = [node];
     }
-    const reused = lastNodes.length > 0 && newNodes.length > 0 ? /* @__PURE__ */ new Set() : void 0;
-    if (reused) {
+    let reused;
+    if (lastNodes.length > 0 && newNodes.length > 0) {
+      const lastSet = new Set(lastNodes);
+      reused = /* @__PURE__ */ new Set();
       for (let i2 = 0; i2 < newNodes.length; i2++) {
-        for (let j = 0; j < lastNodes.length; j++) {
-          if (newNodes[i2] === lastNodes[j]) {
-            reused.add(newNodes[i2]);
-            break;
-          }
-        }
+        if (lastSet.has(newNodes[i2])) reused.add(newNodes[i2]);
       }
     }
     for (let i2 = 0; i2 < lastNodes.length; i2++) {
@@ -1004,7 +1160,7 @@ function dispose(node) {
   while (stack.length > 0) {
     const current = stack.pop();
     order.push(current);
-    const children = current.childNodes;
+    const children = Array.from(current.childNodes);
     for (let i2 = 0; i2 < children.length; i2++) {
       stack.push(children[i2]);
     }
@@ -1013,15 +1169,65 @@ function dispose(node) {
     const current = order[i2];
     const disposers = elementDisposers.get(current);
     if (disposers) {
-      if (_isDev5) activeBindingCount -= disposers.length;
-      for (const d of disposers) d();
+      const snapshot = disposers.slice();
       elementDisposers.delete(current);
+      if (_isDev5) activeBindingCount -= snapshot.length;
+      for (const d of snapshot) {
+        try {
+          d();
+        } catch (err) {
+          if (_isDev5 && typeof console !== "undefined") {
+            console.warn("[SibuJS] Disposer threw during cleanup:", err);
+          }
+        }
+      }
+      let extraPasses = 0;
+      while (extraPasses++ < 8) {
+        const added = elementDisposers.get(current);
+        if (!added || added.length === 0) break;
+        const moreSnapshot = added.slice();
+        elementDisposers.delete(current);
+        if (_isDev5) activeBindingCount -= moreSnapshot.length;
+        for (const d of moreSnapshot) {
+          try {
+            d();
+          } catch (err) {
+            if (_isDev5 && typeof console !== "undefined") {
+              console.warn("[SibuJS] Disposer threw during cleanup:", err);
+            }
+          }
+        }
+      }
     }
   }
 }
 
 // src/core/rendering/tagFactory.ts
 var SVG_NS = "http://www.w3.org/2000/svg";
+var _isDev6 = isDev();
+var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
+function validateTagName(tag) {
+  const lower = tag.toLowerCase();
+  if (BLOCKED_TAGS.has(lower)) {
+    throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+  }
+}
+var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
+  "config",
+  "location",
+  "history",
+  "document",
+  "window",
+  "navigator",
+  "name",
+  "top",
+  "parent",
+  "self",
+  "frames"
+]);
+function setProp2(el, key, val) {
+  el[key] = val;
+}
 var kebabCache = /* @__PURE__ */ new Map();
 function toKebab(prop) {
   let cached = kebabCache.get(prop);
@@ -1146,79 +1352,103 @@ function appendChildren(el, nodes) {
     }
   }
 }
-var tagFactory = (tag, ns) => (first, second) => {
-  const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
-  if (first === void 0) return el;
-  if (typeof first === "string") {
-    if (second !== void 0) {
-      el.setAttribute("class", first);
-      appendChildren(el, second);
+var tagFactory = (tag, ns) => {
+  return (first, second) => {
+    validateTagName(tag);
+    const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
+    if (first === void 0) return el;
+    if (typeof first === "string") {
+      if (second !== void 0) {
+        el.setAttribute("class", first);
+        appendChildren(el, second);
+        return el;
+      }
+      el.textContent = first;
       return el;
     }
-    el.textContent = first;
-    return el;
-  }
-  if (typeof first === "number") {
-    el.textContent = String(first);
-    return el;
-  }
-  if (Array.isArray(first) || first instanceof Node || typeof first === "function") {
-    appendChildren(el, first);
-    return el;
-  }
-  const props = first;
-  const pClass = props.class;
-  if (pClass != null) applyClass(el, pClass);
-  const pId = props.id;
-  if (pId != null) el.id = pId;
-  const pNodes = second !== void 0 ? second : props.nodes;
-  if (pNodes != null) appendChildren(el, pNodes);
-  const pOn = props.on;
-  if (pOn) {
-    for (const ev in pOn) {
-      el.addEventListener(ev, pOn[ev]);
-    }
-  }
-  const pStyle = props.style;
-  if (pStyle != null) applyStyle(el, pStyle);
-  const pRef = props.ref;
-  if (pRef) pRef.current = el;
-  for (const key in props) {
-    switch (key) {
-      case "class":
-      case "id":
-      case "nodes":
-      case "on":
-      case "style":
-      case "ref":
-      case "onElement":
-        continue;
-      // already handled above / below
-      default: {
-        const value = props[key];
-        if (value == null) continue;
-        if (key[0] === "o" && key[1] === "n") continue;
-        if (typeof value === "function") {
-          registerDisposer(el, bindAttribute(el, key, value));
-        } else if (typeof value === "boolean") {
-          if (key in el && (key === "checked" || key === "disabled" || key === "selected")) {
-            el[key] = value;
-          } else if (value) {
-            el.setAttribute(key, "");
+    if (typeof first === "number") {
+      el.textContent = String(first);
+      return el;
+    }
+    if (Array.isArray(first) || first instanceof Node || typeof first === "function") {
+      appendChildren(el, first);
+      return el;
+    }
+    const props = first;
+    const pClass = props.class;
+    if (pClass != null) applyClass(el, pClass);
+    const pId = props.id;
+    if (pId != null) {
+      if (_isDev6 && typeof pId === "string" && CLOBBER_RISKY_IDS.has(pId.toLowerCase())) {
+        devWarn(
+          `tagFactory: element id="${pId}" matches a common global and may cause DOM clobbering. Avoid setting ids from untrusted input.`
+        );
+      }
+      el.id = pId;
+    }
+    const pNodes = second !== void 0 ? second : props.nodes;
+    if (pNodes != null) appendChildren(el, pNodes);
+    const pOn = props.on;
+    if (pOn) {
+      for (const ev in pOn) {
+        const handler = pOn[ev];
+        if (typeof handler === "function") {
+          el.addEventListener(ev, handler);
+        } else if (_isDev6) {
+          devWarn(
+            `tagFactory: on.${ev} handler is not a function (got ${typeof handler}). Event listener was not attached.`
+          );
+        }
+      }
+    }
+    const pStyle = props.style;
+    if (pStyle != null) applyStyle(el, pStyle);
+    const pRef = props.ref;
+    if (pRef) pRef.current = el;
+    for (const key in props) {
+      switch (key) {
+        case "class":
+        case "id":
+        case "nodes":
+        case "on":
+        case "style":
+        case "ref":
+        case "onElement":
+          continue;
+        // already handled above / below
+        default: {
+          const value = props[key];
+          if (value == null) continue;
+          const lkey = key.toLowerCase();
+          if (lkey[0] === "o" && lkey[1] === "n") continue;
+          if (typeof value === "function") {
+            registerDisposer(el, bindAttribute(el, key, value));
+          } else if (typeof value === "boolean") {
+            if (key in el && (key === "checked" || key === "disabled" || key === "selected")) {
+              setProp2(el, key, value);
+            } else if (value) {
+              el.setAttribute(key, "");
+            } else {
+              el.removeAttribute(key);
+            }
           } else {
-            el.removeAttribute(key);
+            const str = String(value);
+            if (lkey === "srcset") {
+              el.setAttribute(key, sanitizeSrcset(str));
+            } else if (isUrlAttribute(lkey)) {
+              el.setAttribute(key, sanitizeUrl(str));
+            } else {
+              el.setAttribute(key, str);
+            }
           }
-        } else {
-          const str = String(value);
-          el.setAttribute(key, isUrlAttribute(key) ? sanitizeUrl(str) : str);
         }
       }
     }
-  }
-  if (props.onElement && typeof props.onElement === "function") {
-    props.onElement(el);
-  }
-  return el;
+    if (props.onElement && typeof props.onElement === "function") {
+      props.onElement(el);
+    }
+    return el;
+  };
 };
 
 // src/core/rendering/html.ts
@@ -1371,10 +1601,10 @@ function enqueueBatchedSignal(signal2) {
 // src/core/signals/signal.ts
 init_dev();
 var _g = globalThis;
-var _isDev6 = isDev();
+var _isDev7 = isDev();
 function signal(initial, options) {
   const state = { value: initial };
-  const debugName = _isDev6 ? options?.name : void 0;
+  const debugName = _isDev7 ? options?.name : void 0;
   const equalsFn = options?.equals;
   if (debugName) {
     state.__name = debugName;
@@ -1388,7 +1618,7 @@ function signal(initial, options) {
   function set(next) {
     const newValue = typeof next === "function" ? next(state.value) : next;
     if (equalsFn ? equalsFn(state.value, newValue) : Object.is(newValue, state.value)) return;
-    if (_isDev6) {
+    if (_isDev7) {
       const oldValue = state.value;
       state.value = newValue;
       const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
@@ -1400,7 +1630,7 @@ function signal(initial, options) {
       notifySubscribers(state);
     }
   }
-  if (_isDev6) {
+  if (_isDev7) {
     const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
     if (hook) hook.emit("signal:create", { signal: state, name: debugName, getter: get, initial });
   }
@@ -1425,9 +1655,7 @@ function t(key, params) {
   return params ? message.replace(/\{(\w+)\}/g, (_, p2) => String(params[p2] ?? "")) : message;
 }
 function Trans(key, params) {
-  return span({
-    nodes: () => t(key, params)
-  });
+  return span(() => t(key, params));
 }
 function hasTranslation(key) {
   const locale = currentLocale();
@@ -1439,40 +1667,93 @@ function getAvailableLocales() {
 
 // src/core/signals/effect.ts
 init_dev();
-
-// src/core/ssr-context.ts
-var ssrMode = false;
-function isSSR() {
-  return ssrMode;
-}
-
-// src/core/signals/effect.ts
+init_ssr_context();
 var _g2 = globalThis;
 function effect(effectFn, options) {
   devAssert(typeof effectFn === "function", "effect: argument must be a function.");
   if (isSSR()) return () => {
   };
   const onError = options?.onError;
+  let userCleanups = [];
+  const onCleanup = (fn) => {
+    userCleanups.push(fn);
+  };
+  const runUserCleanups = () => {
+    if (userCleanups.length === 0) return;
+    const list = userCleanups;
+    userCleanups = [];
+    for (let i2 = list.length - 1; i2 >= 0; i2--) {
+      try {
+        list[i2]();
+      } catch (err) {
+        if (typeof console !== "undefined") {
+          console.warn("[SibuJS effect] onCleanup threw:", err);
+        }
+      }
+    }
+  };
+  const invokeBody = () => effectFn(onCleanup);
   const wrappedFn = onError ? () => {
     try {
-      effectFn();
+      invokeBody();
     } catch (err) {
       onError(err);
     }
-  } : effectFn;
+  } : invokeBody;
   let cleanupHandle = () => {
   };
+  let running = false;
   const subscriber = () => {
-    cleanupHandle();
-    cleanupHandle = track(wrappedFn, subscriber);
+    if (running) {
+      if (_g2.__SIBU_DEV_WARN__ !== false && typeof console !== "undefined") {
+        console.warn(
+          "[SibuJS] effect re-entered itself while running \u2014 the triggering update will be ignored. Wrap mutual writes in `batch()` or split the effect to avoid this."
+        );
+      }
+      return;
+    }
+    running = true;
+    try {
+      runUserCleanups();
+      cleanupHandle();
+      cleanupHandle = track(wrappedFn, subscriber);
+    } finally {
+      running = false;
+    }
   };
-  cleanupHandle = track(wrappedFn, subscriber);
+  running = true;
+  try {
+    cleanupHandle = track(wrappedFn, subscriber);
+  } finally {
+    running = false;
+  }
   const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
   if (hook) hook.emit("effect:create", { effectFn });
+  let disposed = false;
   return () => {
+    if (disposed) return;
+    disposed = true;
     const h = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (h) h.emit("effect:destroy", { effectFn });
-    cleanupHandle();
+    if (h) {
+      try {
+        h.emit("effect:destroy", { effectFn });
+      } catch {
+      }
+    }
+    try {
+      runUserCleanups();
+    } catch (err) {
+      if (typeof console !== "undefined") {
+        console.warn("[SibuJS effect] onCleanup threw during dispose:", err);
+      }
+    }
+    try {
+      cleanupHandle();
+    } catch (err) {
+      if (typeof console !== "undefined") {
+        console.warn("[SibuJS effect] dispose threw:", err);
+      }
+    }
   };
 }
 
@@ -1598,9 +1879,12 @@ var RouteMatcher = class {
     return this.namedRoutes.get(name) || null;
   }
   matchPattern(path2, routePath) {
-    if (routePath === "*" || routePath.endsWith("/*")) {
+    if (routePath === "*") {
+      return { params: { pathMatch: path2 } };
+    }
+    if (routePath.endsWith("/*")) {
       const basePath = routePath.slice(0, -2);
-      if (path2.startsWith(basePath)) {
+      if (path2 === basePath || path2.startsWith(`${basePath}/`)) {
         return { params: { pathMatch: path2.slice(basePath.length) } };
       }
       return null;
@@ -1719,6 +2003,8 @@ var GuardManager = class {
       const next = (result) => {
         if (resolved || signal2.aborted) return;
         resolved = true;
+        clearTimeout(timeoutId);
+        signal2.removeEventListener("abort", abortHandler);
         if (result instanceof Error) {
           reject(result);
         } else if (result === false) {
@@ -1732,10 +2018,10 @@ var GuardManager = class {
       const abortHandler = () => {
         if (!resolved) {
           resolved = true;
+          clearTimeout(timeoutId);
           reject(new Error("Navigation aborted"));
         }
       };
-      signal2.addEventListener("abort", abortHandler);
       const timeoutId = setTimeout(() => {
         if (!resolved) {
           resolved = true;
@@ -1743,6 +2029,7 @@ var GuardManager = class {
           reject(new Error("Guard timeout"));
         }
       }, this.timeout);
+      signal2.addEventListener("abort", abortHandler);
       try {
         guard(to, from, next);
       } catch (error) {
@@ -1753,12 +2040,6 @@ var GuardManager = class {
           reject(error instanceof Error ? error : new Error(String(error)));
         }
       }
-      Promise.resolve().then(() => {
-        if (resolved) {
-          clearTimeout(timeoutId);
-          signal2.removeEventListener("abort", abortHandler);
-        }
-      });
     });
   }
   addBeforeEach(guard) {
@@ -1843,9 +2124,11 @@ var ComponentLoader = class {
       }
       return component;
     } catch (error) {
-      throw new Error(
+      const wrapped = new Error(
         `Failed to load component for route "${routePath}": ${error instanceof Error ? error.message : String(error)}`
       );
+      wrapped.cause = error;
+      throw wrapped;
     }
   }
   isAsyncComponent(comp) {
@@ -2031,10 +2314,13 @@ var _SibuRouter = class _SibuRouter {
       }
       if ("redirect" in route2) {
         const redirectPath = typeof route2.redirect === "function" ? route2.redirect(to) : route2.redirect;
-        if (typeof redirectPath === "string" && /^https?:\/\/|^\/\//i.test(redirectPath)) {
-          console.warn(
-            `[SibuJS Router] Redirect to absolute URL "${redirectPath}" detected. Use relative paths for safer redirects.`
-          );
+        if (typeof redirectPath === "string" && /^(https?:)?\/\//i.test(redirectPath)) {
+          if (typeof console !== "undefined") {
+            console.error(
+              `[SibuJS Router] Refusing absolute/protocol-relative redirect "${redirectPath}" \u2014 open-redirect risk.`
+            );
+          }
+          throw new NavigationFailureError("aborted", from, to);
         }
         if (typeof redirectPath === "string" && !isSafeNavigationTarget(redirectPath)) {
           throw new NavigationFailureError("aborted", from, to);
@@ -2237,6 +2523,7 @@ function createRouter(routesOrOptions, options = {}) {
     routes = [];
   }
   globalRouter = new SibuRouter(routes, options);
+  ensureRouterPagehide();
   return globalRouter;
 }
 function setRoutes(routes) {
@@ -2310,7 +2597,9 @@ function Route() {
   let currentTopRoute = null;
   const cleanupNodes = () => {
     [currentNode, loadingNode, errorNode].forEach((node) => {
-      if (node?.parentNode) {
+      if (!node) return;
+      dispose(node);
+      if (node.parentNode) {
         node.parentNode.removeChild(node);
       }
     });
@@ -2341,13 +2630,24 @@ function Route() {
       loadingNode = null;
     }
   };
-  const showError = (error) => {
+  const showError = (error, routeDef) => {
     if (!anchor.parentNode) return;
     cleanupNodes();
     errorNode = document.createElement("div");
     errorNode.className = "route-error";
     errorNode.setAttribute("role", "alert");
     errorNode.setAttribute("aria-live", "assertive");
+    if (routeDef && "component" in routeDef) {
+      const src = routeDef.component.toString();
+      const importMatch = src.match(/import\(["']([^"']+)["']\)/);
+      if (importMatch) {
+        errorNode.setAttribute("data-component-source", importMatch[1]);
+      }
+      if (routeDef.component.name) {
+        errorNode.setAttribute("data-component-name", routeDef.component.name);
+      }
+    }
+    errorNode.__routeError = error;
     const title2 = document.createElement("h3");
     title2.textContent = "Route Error";
     title2.className = "route-error-title";
@@ -2358,12 +2658,14 @@ function Route() {
     retryButton.textContent = "Retry";
     retryButton.className = "route-error-retry";
     retryButton.type = "button";
-    retryButton.addEventListener("click", () => {
+    const onRetryClick = () => {
       if (globalRouter) {
         globalRouter.clearErrorCache();
         update();
       }
-    });
+    };
+    retryButton.addEventListener("click", onRetryClick);
+    registerDisposer(retryButton, () => retryButton.removeEventListener("click", onRetryClick));
     errorNode.appendChild(title2);
     errorNode.appendChild(message);
     errorNode.appendChild(retryButton);
@@ -2395,7 +2697,11 @@ function Route() {
       currentTopRoute = routeDef;
       if ("redirect" in routeDef) {
         const redirectPath = typeof routeDef.redirect === "function" ? routeDef.redirect(route2) : routeDef.redirect;
-        queueMicrotask(() => globalRouter?.navigate(redirectPath));
+        queueMicrotask(() => {
+          globalRouter?.navigate(redirectPath).catch((err) => {
+            if (typeof console !== "undefined") console.error("[router] redirect failed:", err);
+          });
+        });
         return;
       }
       if ("component" in routeDef) {
@@ -2414,7 +2720,7 @@ function Route() {
         } catch (error) {
           hideLoading();
           console.error("[Route] Component error:", error);
-          showError(error instanceof Error ? error : new Error(String(error)));
+          showError(error instanceof Error ? error : new Error(String(error)), routeDef);
         }
       }
     } catch (error) {
@@ -2434,13 +2740,16 @@ function Route() {
     await originalUpdate();
     routeInitialized = true;
   };
-  track(wrappedUpdate);
+  const routeTeardown = track(wrappedUpdate);
   if (!routeInitialized) {
     queueMicrotask(() => {
       if (!routeInitialized && anchor.parentNode) wrappedUpdate();
     });
   }
-  routeCleanups.push(cleanupNodes);
+  routeCleanups.push(() => {
+    routeTeardown();
+    cleanupNodes();
+  });
   return anchor;
 }
 function KeepAliveRoute(options) {
@@ -2469,7 +2778,11 @@ function KeepAliveRoute(options) {
     const { route: routeDef } = match;
     if ("redirect" in routeDef) {
       const redirectPath = typeof routeDef.redirect === "function" ? routeDef.redirect(route2) : routeDef.redirect;
-      queueMicrotask(() => globalRouter?.navigate(redirectPath));
+      queueMicrotask(() => {
+        globalRouter?.navigate(redirectPath).catch((err) => {
+          if (typeof console !== "undefined") console.error("[router] redirect failed:", err);
+        });
+      });
       return;
     }
     if (!("component" in routeDef)) return;
@@ -2539,13 +2852,14 @@ function KeepAliveRoute(options) {
     await update();
     initialized = true;
   };
-  track(wrappedUpdate);
+  const kaTeardown = track(wrappedUpdate);
   if (!initialized) {
     queueMicrotask(() => {
       if (!initialized && anchor.parentNode) wrappedUpdate();
     });
   }
   routeCleanups.push(() => {
+    kaTeardown();
     for (const node of cache.values()) {
       dispose(node);
       if (node.parentNode) node.parentNode.removeChild(node);
@@ -2612,12 +2926,18 @@ function RouterLink(props) {
       }
     });
   }
-  link2.addEventListener("click", (e) => {
+  const onLinkClick = (e) => {
     if (target || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey || e.button !== 0) {
       return;
     }
     e.preventDefault();
-    globalRouter?.navigate(to, { replace: replace2 });
+    globalRouter?.navigate(to, { replace: replace2 }).catch((err) => {
+      if (typeof console !== "undefined") console.error("[router] link navigate failed:", err);
+    });
+  };
+  link2.addEventListener("click", onLinkClick);
+  registerDisposer(link2, () => {
+    link2.removeEventListener("click", onLinkClick);
   });
   return link2;
 }
@@ -2728,10 +3048,21 @@ function destroyRouter() {
     globalRouter = null;
   }
 }
-if (typeof window !== "undefined") {
-  window.addEventListener("beforeunload", () => {
-    destroyRouter();
-  });
+var _routerPagehideHandler = null;
+function ensureRouterPagehide() {
+  if (_routerPagehideHandler || typeof window === "undefined") return;
+  _routerPagehideHandler = (event) => {
+    if (event.persisted === false) {
+      destroyRouter();
+    }
+  };
+  window.addEventListener("pagehide", _routerPagehideHandler);
+}
+function __removeRouterPagehideHandler() {
+  if (_routerPagehideHandler && typeof window !== "undefined") {
+    window.removeEventListener("pagehide", _routerPagehideHandler);
+    _routerPagehideHandler = null;
+  }
 }
 function Outlet() {
   const anchor = document.createComment("route-outlet-nested");
@@ -2757,12 +3088,20 @@ function Outlet() {
       console.error("[Outlet] Failed to render child route:", error);
     }
   };
-  track(update);
+  const outletTeardown = track(update);
   if (!anchor.parentNode) {
     queueMicrotask(() => {
       if (anchor.parentNode) update();
     });
   }
+  routeCleanups.push(() => {
+    outletTeardown();
+    if (currentNode) {
+      dispose(currentNode);
+      if (currentNode.parentNode) currentNode.parentNode.removeChild(currentNode);
+      currentNode = null;
+    }
+  });
   return anchor;
 }
 function addRoute(route2, parentPath) {
@@ -3080,6 +3419,10 @@ function hydrateRouter(routes, options) {
         if (resolved.component) {
           hydrate2(resolved.component, container);
         }
+      }).catch((err) => {
+        if (typeof console !== "undefined") {
+          console.error("[SibuJS routerSSR] failed to load hydrate:", err);
+        }
       });
     }
   }
@@ -3153,83 +3496,117 @@ function escapeAttrLocal(str) {
 }
 
 // src/plugins/plugin.ts
-var installedPlugins = /* @__PURE__ */ new Set();
-var hooks = {
-  init: [],
-  mount: [],
-  unmount: [],
-  error: []
-};
-var provided = /* @__PURE__ */ new Map();
+function createPluginRegistry() {
+  const installedPlugins = /* @__PURE__ */ new Set();
+  const hooks = { init: [], mount: [], unmount: [], error: [] };
+  const provided = /* @__PURE__ */ new Map();
+  const registry = {
+    installedPlugins,
+    hooks,
+    provided,
+    plugin(p2, options) {
+      if (installedPlugins.has(p2.name)) {
+        console.warn(`[Plugin] "${p2.name}" is already installed.`);
+        return;
+      }
+      const ctx = {
+        onInit: (cb) => hooks.init.push(cb),
+        onMount: (cb) => hooks.mount.push(cb),
+        onUnmount: (cb) => hooks.unmount.push(cb),
+        onError: (cb) => hooks.error.push(cb),
+        provide: (key, value) => provided.set(key, value)
+      };
+      const initHooksBefore = hooks.init.length;
+      p2.install(ctx, options);
+      installedPlugins.add(p2.name);
+      const justAdded = hooks.init.slice(initHooksBefore);
+      for (const cb of justAdded) {
+        try {
+          cb();
+        } catch (e) {
+          console.error(`[Plugin] "${p2.name}" init error:`, e);
+        }
+      }
+    },
+    inject(key, defaultValue) {
+      if (provided.has(key)) return provided.get(key);
+      if (defaultValue !== void 0) return defaultValue;
+      throw new Error(`[Plugin] No provider found for key "${key}"`);
+    },
+    triggerMount(element) {
+      const snapshot = hooks.mount.slice();
+      for (const hook of snapshot) {
+        try {
+          hook(element);
+        } catch (e) {
+          console.error("[Plugin] Mount hook error:", e);
+        }
+      }
+    },
+    triggerUnmount(element) {
+      const snapshot = hooks.unmount.slice();
+      for (const hook of snapshot) {
+        try {
+          hook(element);
+        } catch (e) {
+          console.error("[Plugin] Unmount hook error:", e);
+        }
+      }
+    },
+    triggerError(error) {
+      const snapshot = hooks.error.slice();
+      for (const hook of snapshot) {
+        try {
+          hook(error);
+        } catch (e) {
+          console.error("[Plugin] Error hook error:", e);
+        }
+      }
+    },
+    reset() {
+      installedPlugins.clear();
+      hooks.init.length = 0;
+      hooks.mount.length = 0;
+      hooks.unmount.length = 0;
+      hooks.error.length = 0;
+      provided.clear();
+    }
+  };
+  return registry;
+}
+var defaultRegistry = createPluginRegistry();
+var defaultRegistryTouched = false;
 function createPlugin(name, install) {
   return { name, install };
 }
 function plugin(plugin2, options) {
-  if (installedPlugins.has(plugin2.name)) {
-    console.warn(`[Plugin] "${plugin2.name}" is already installed.`);
-    return;
-  }
-  const ctx = {
-    onInit: (cb) => hooks.init.push(cb),
-    onMount: (cb) => hooks.mount.push(cb),
-    onUnmount: (cb) => hooks.unmount.push(cb),
-    onError: (cb) => hooks.error.push(cb),
-    provide: (key, value) => provided.set(key, value)
-  };
-  const initHooksBefore = hooks.init.length;
-  plugin2.install(ctx, options);
-  installedPlugins.add(plugin2.name);
-  for (let i2 = initHooksBefore; i2 < hooks.init.length; i2++) {
-    try {
-      hooks.init[i2]();
-    } catch (e) {
-      console.error(`[Plugin] "${plugin2.name}" init error:`, e);
-    }
-  }
+  defaultRegistryTouched = true;
+  defaultRegistry.plugin(plugin2, options);
 }
 function inject(key, defaultValue) {
-  if (provided.has(key)) {
-    return provided.get(key);
-  }
-  if (defaultValue !== void 0) {
-    return defaultValue;
-  }
-  throw new Error(`[Plugin] No provider found for key "${key}"`);
+  return defaultRegistry.inject(key, defaultValue);
 }
 function triggerPluginMount(element) {
-  for (const hook of hooks.mount) {
-    try {
-      hook(element);
-    } catch (e) {
-      console.error("[Plugin] Mount hook error:", e);
-    }
-  }
+  defaultRegistry.triggerMount(element);
 }
 function triggerPluginUnmount(element) {
-  for (const hook of hooks.unmount) {
-    try {
-      hook(element);
-    } catch (e) {
-      console.error("[Plugin] Unmount hook error:", e);
-    }
-  }
+  defaultRegistry.triggerUnmount(element);
 }
 function triggerPluginError(error) {
-  for (const hook of hooks.error) {
-    try {
-      hook(error);
-    } catch (e) {
-      console.error("[Plugin] Error hook error:", e);
-    }
-  }
+  defaultRegistry.triggerError(error);
 }
 function resetPlugins() {
-  installedPlugins.clear();
-  hooks.init.length = 0;
-  hooks.mount.length = 0;
-  hooks.unmount.length = 0;
-  hooks.error.length = 0;
-  provided.clear();
+  defaultRegistry.reset();
+  defaultRegistryTouched = false;
+}
+function setDefaultPluginRegistry(registry) {
+  if (defaultRegistryTouched && defaultRegistry.installedPlugins.size > 0) {
+    console.warn(
+      "[Plugin] Replacing default plugin registry while plugins are already installed on the singleton. This may indicate mixed singleton/registry usage."
+    );
+  }
+  defaultRegistry = registry;
+  defaultRegistryTouched = true;
 }
 
 // src/plugins/modular.ts
@@ -3707,7 +4084,8 @@ init_ssr();
 function preloadCritical(resources) {
   if (typeof document === "undefined") return;
   for (const resource of resources) {
-    const existing = document.querySelector(`link[rel="preload"][href="${resource.href}"]`);
+    const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(resource.href) : resource.href.replace(/["\\]/g, "\\$&");
+    const existing = document.querySelector(`link[rel="preload"][href="${safeHref}"]`);
     if (existing) continue;
     const link2 = document.createElement("link");
     link2.rel = "preload";
@@ -3942,6 +4320,7 @@ function createBootSequence() {
   Suspense,
   Trans,
   VERSION,
+  __removeRouterPagehideHandler,
   addRoute,
   afterEach,
   back,
@@ -3957,6 +4336,7 @@ function createBootSequence() {
   createMigrationRunner,
   createModuleRegistry,
   createPlugin,
+  createPluginRegistry,
   createRouter,
   createSSRCache,
   createSSRRouter,
@@ -3999,6 +4379,7 @@ function createBootSequence() {
   routerState,
   satisfies,
   serializeRouteState,
+  setDefaultPluginRegistry,
   setLocale,
   setRouteTransition,
   setRoutes,