sibujs 1.5.0 → 2.1.0

package/dist/ecosystem.cjs

@@ -38,26 +38,39 @@ function isDev() {
 var _isDev = isDev();
 function devAssert(condition, message) {
   if (_isDev && !condition) {
-    throw new Error(`[Sibu] ${message}`);
+    throw new Error(`[SibuJS] ${message}`);
   }
 }
 function devWarn(message) {
   if (_isDev) {
-    console.warn(`[Sibu] ${message}`);
+    console.warn(`[SibuJS] ${message}`);
   }
 }
 
 // src/reactivity/track.ts
 var _isDev2 = isDev();
-var subscriberStack = new Array(32);
-var stackCapacity = 32;
+var STACK_INITIAL = 32;
+var STACK_SHRINK_THRESHOLD = 128;
+var subscriberStack = new Array(STACK_INITIAL);
+var stackCapacity = STACK_INITIAL;
 var stackTop = -1;
 var currentSubscriber = null;
-var signalSubscribers = /* @__PURE__ */ new WeakMap();
 var SUBS = "__s";
+function syncFastPath(signal2, subs) {
+  const size = subs.size;
+  if (size === 0) {
+    signal2.__f = void 0;
+    delete signal2[SUBS];
+  } else if (size === 1) {
+    signal2.__f = subs.values().next().value;
+  } else {
+    signal2.__f = void 0;
+  }
+}
 var notifyDepth = 0;
 var pendingQueue = [];
 var pendingSet = /* @__PURE__ */ new Set();
+var propagateStack = [];
 function safeInvoke(sub) {
   try {
     sub();
@@ -66,6 +79,47 @@ function safeInvoke(sub) {
   }
 }
 var trackingSuspended = false;
+var subscriberEpochCounter = 0;
+function retrack(effectFn, subscriber) {
+  const prev = currentSubscriber;
+  currentSubscriber = subscriber;
+  const sub = subscriber;
+  const epoch = ++subscriberEpochCounter;
+  sub._epoch = epoch;
+  try {
+    effectFn();
+  } finally {
+    currentSubscriber = prev;
+    pruneStaleDeps(sub, epoch);
+  }
+}
+function pruneStaleDeps(sub, currentEpoch) {
+  if (sub._dep !== void 0) {
+    if (sub._depEpoch !== currentEpoch) {
+      const sig = sub._dep;
+      const subs = sig[SUBS];
+      if (subs?.delete(sub)) syncFastPath(sig, subs);
+      sub._dep = void 0;
+      sub._depEpoch = void 0;
+    }
+    return;
+  }
+  const deps = sub._deps;
+  if (!deps || deps.size === 0) return;
+  let stales;
+  for (const [signal2, epoch] of deps) {
+    if (epoch !== currentEpoch) {
+      (stales ?? (stales = [])).push(signal2);
+    }
+  }
+  if (!stales) return;
+  for (const signal2 of stales) {
+    deps.delete(signal2);
+    const sig = signal2;
+    const subs = sig[SUBS];
+    if (subs?.delete(sub)) syncFastPath(sig, subs);
+  }
+}
 function track(effectFn, subscriber) {
   if (!subscriber) subscriber = effectFn;
   cleanup(subscriber);
@@ -81,37 +135,49 @@ function track(effectFn, subscriber) {
   } finally {
     stackTop--;
     currentSubscriber = stackTop >= 0 ? subscriberStack[stackTop] : null;
+    if (stackTop < 0 && stackCapacity > STACK_SHRINK_THRESHOLD) {
+      stackCapacity = Math.max(STACK_INITIAL, stackCapacity >>> 1);
+      subscriberStack.length = stackCapacity;
+    }
   }
   return () => cleanup(subscriber);
 }
 function recordDependency(signal2) {
   if (!currentSubscriber) return;
   const sub = currentSubscriber;
-  if (sub._dep === signal2) return;
+  const epoch = sub._epoch;
+  if (sub._dep === signal2) {
+    sub._depEpoch = epoch;
+    return;
+  }
   const deps = sub._deps;
   if (deps) {
-    if (deps.has(signal2)) return;
-    deps.add(signal2);
+    deps.set(signal2, epoch);
   } else if (sub._dep !== void 0) {
-    const set = /* @__PURE__ */ new Set();
-    set.add(sub._dep);
-    set.add(signal2);
-    sub._deps = set;
+    const map = /* @__PURE__ */ new Map();
+    map.set(sub._dep, sub._depEpoch);
+    map.set(signal2, epoch);
+    sub._deps = map;
     sub._dep = void 0;
+    sub._depEpoch = void 0;
   } else {
     sub._dep = signal2;
+    sub._depEpoch = epoch;
   }
-  let subs = signal2[SUBS];
+  const sig = signal2;
+  let subs = sig[SUBS];
   if (!subs) {
     subs = /* @__PURE__ */ new Set();
-    signalSubscribers.set(signal2, subs);
-    signal2[SUBS] = subs;
+    sig[SUBS] = subs;
   }
+  const prevSize = subs.size;
   subs.add(currentSubscriber);
-  if (subs.size === 1) {
-    signal2.__f = currentSubscriber;
-  } else if (signal2.__f !== void 0) {
-    signal2.__f = void 0;
+  if (subs.size !== prevSize) {
+    if (subs.size === 1) {
+      sig.__f = currentSubscriber;
+    } else if (sig.__f !== void 0) {
+      sig.__f = void 0;
+    }
   }
 }
 function queueSignalNotification(signal2) {
@@ -126,66 +192,102 @@ function queueSignalNotification(signal2) {
     }
   }
 }
-var MAX_DRAIN_ITERATIONS = 1e3;
+var maxSubscriberRepeats = 50;
+var maxDrainIterations = 1e6;
+var drainEpoch = 0;
+function tickRepeat(sub) {
+  const s = sub;
+  if (s._runEpoch !== drainEpoch) {
+    s._runEpoch = drainEpoch;
+    s._runs = 1;
+    return false;
+  }
+  return ++s._runs > maxSubscriberRepeats;
+}
+function cycleError(sub) {
+  if (typeof console !== "undefined") {
+    const name = sub.__name ?? "<unnamed>";
+    console.error(
+      `[SibuJS] subscriber "${name}" fired more than ${maxSubscriberRepeats} times \u2014 likely a write-reads-self cycle between effects/signals. Breaking to prevent infinite loop.`
+    );
+  }
+}
+function absoluteDrainError() {
+  if (typeof console !== "undefined") {
+    console.error(
+      `[SibuJS] Notification drain exceeded ${maxDrainIterations} iterations \u2014 absolute safety net tripped. Breaking to prevent infinite loop.`
+    );
+  }
+}
+function drainQueue() {
+  let i = 0;
+  while (i < pendingQueue.length) {
+    if (i >= maxDrainIterations) {
+      absoluteDrainError();
+      break;
+    }
+    const sub = pendingQueue[i++];
+    if (tickRepeat(sub)) {
+      cycleError(sub);
+      break;
+    }
+    pendingSet.delete(sub);
+    safeInvoke(sub);
+  }
+}
 function drainNotificationQueue() {
   if (notifyDepth > 0) return;
   notifyDepth++;
+  drainEpoch++;
   try {
-    let i = 0;
-    while (i < pendingQueue.length) {
-      if (i >= MAX_DRAIN_ITERATIONS) {
-        if (typeof console !== "undefined") {
-          console.error(
-            `[SibuJS] Notification queue exceeded ${MAX_DRAIN_ITERATIONS} iterations \u2014 likely an effect that writes to a signal it reads. Breaking to prevent infinite loop.`
-          );
-        }
-        break;
-      }
-      safeInvoke(pendingQueue[i]);
-      i++;
-    }
+    drainQueue();
   } finally {
-    pendingQueue.length = 0;
-    pendingSet.clear();
     notifyDepth--;
+    if (notifyDepth === 0) {
+      pendingQueue.length = 0;
+      pendingSet.clear();
+    }
   }
 }
 function propagateDirty(sub) {
   sub();
-  let sig = sub._sig;
-  while (sig) {
+  const rootSig = sub._sig;
+  if (!rootSig) return;
+  const stack = propagateStack;
+  const baseLen = stack.length;
+  stack.push(rootSig);
+  while (stack.length > baseLen) {
+    const sig = stack.pop();
     const first = sig.__f;
     if (first) {
       if (first._c) {
         const nSig = first._sig;
-        nSig._d = true;
-        sig = nSig;
-        continue;
-      }
-      if (!pendingSet.has(first)) {
+        if (!nSig._d) {
+          nSig._d = true;
+          stack.push(nSig);
+        }
+      } else if (!pendingSet.has(first)) {
         pendingSet.add(first);
         pendingQueue.push(first);
       }
-      break;
+      continue;
     }
     const subs = sig[SUBS];
-    if (!subs) break;
-    let nextSig;
+    if (!subs) continue;
     for (const s of subs) {
       if (s._c) {
-        s();
         const nSig = s._sig;
-        if (nSig && !nextSig) {
-          nextSig = nSig;
-        } else if (nSig) {
-          propagateDirty(s);
+        if (nSig && !nSig._d) {
+          nSig._d = true;
+          stack.push(nSig);
+        } else if (!nSig) {
+          s();
         }
       } else if (!pendingSet.has(s)) {
         pendingSet.add(s);
         pendingQueue.push(s);
       }
     }
-    sig = nextSig;
   }
 }
 function notifySubscribers(signal2) {
@@ -201,21 +303,22 @@ function notifySubscribers(signal2) {
       return;
     }
     notifyDepth++;
+    drainEpoch++;
     try {
       if (first._c) {
         propagateDirty(first);
+      } else if (tickRepeat(first)) {
+        cycleError(first);
       } else {
         safeInvoke(first);
       }
-      let i = 0;
-      while (i < pendingQueue.length) {
-        safeInvoke(pendingQueue[i]);
-        i++;
-      }
+      drainQueue();
     } finally {
-      pendingQueue.length = 0;
-      pendingSet.clear();
       notifyDepth--;
+      if (notifyDepth === 0) {
+        pendingQueue.length = 0;
+        pendingSet.clear();
+      }
     }
     return;
   }
@@ -233,66 +336,73 @@ function notifySubscribers(signal2) {
     return;
   }
   notifyDepth++;
+  drainEpoch++;
   try {
-    let directCount = 0;
     for (const sub of subs) {
-      pendingQueue[directCount++] = sub;
-    }
-    for (let i2 = 0; i2 < directCount; i2++) {
-      if (pendingQueue[i2]._c) {
-        propagateDirty(pendingQueue[i2]);
-      }
-    }
-    for (let i2 = 0; i2 < directCount; i2++) {
-      if (!pendingQueue[i2]._c) {
-        if (!pendingSet.has(pendingQueue[i2])) {
-          safeInvoke(pendingQueue[i2]);
-        }
+      if (sub._c) {
+        propagateDirty(sub);
+      } else if (!pendingSet.has(sub)) {
+        pendingSet.add(sub);
+        pendingQueue.push(sub);
       }
     }
-    let i = directCount;
-    while (i < pendingQueue.length) {
-      safeInvoke(pendingQueue[i]);
-      i++;
-    }
+    drainQueue();
   } finally {
-    pendingQueue.length = 0;
-    pendingSet.clear();
     notifyDepth--;
+    if (notifyDepth === 0) {
+      pendingQueue.length = 0;
+      pendingSet.clear();
+    }
   }
 }
 function cleanup(subscriber) {
   const sub = subscriber;
   const singleDep = sub._dep;
   if (singleDep !== void 0) {
-    const subs = singleDep[SUBS];
-    if (subs) {
-      subs.delete(subscriber);
-      if (singleDep.__f === subscriber) {
-        singleDep.__f = void 0;
-      }
+    const sig = singleDep;
+    const subs = sig[SUBS];
+    if (subs?.delete(subscriber)) {
+      syncFastPath(sig, subs);
     }
     sub._dep = void 0;
+    sub._depEpoch = void 0;
     return;
   }
   const deps = sub._deps;
   if (!deps || deps.size === 0) return;
-  for (const signal2 of deps) {
-    const subs = signal2[SUBS];
-    if (subs) {
-      subs.delete(subscriber);
-      if (signal2.__f === subscriber) {
-        signal2.__f = void 0;
-      }
+  for (const signal2 of deps.keys()) {
+    const sig = signal2;
+    const subs = sig[SUBS];
+    if (subs?.delete(subscriber)) {
+      syncFastPath(sig, subs);
     }
   }
   deps.clear();
 }
 
 // src/core/ssr-context.ts
-var ssrMode = false;
+var als = null;
+try {
+  if (typeof process !== "undefined" && process.versions && process.versions.node) {
+    const req = Function("return typeof require==='function'?require:null")();
+    if (req) {
+      const mod = req("node:async_hooks");
+      als = new mod.AsyncLocalStorage();
+    }
+  }
+} catch {
+  als = null;
+}
+var fallbackStore = { ssr: false, suspenseIdCounter: 0 };
+function getSSRStore() {
+  if (als) {
+    const s = als.getStore();
+    if (s) return s;
+  }
+  return fallbackStore;
+}
 function isSSR() {
-  return ssrMode;
+  return getSSRStore().ssr;
 }
 
 // src/core/signals/effect.ts
@@ -302,26 +412,114 @@ function effect(effectFn, options) {
   if (isSSR()) return () => {
   };
   const onError = options?.onError;
+  let userCleanups = [];
+  const onCleanup = (fn) => {
+    userCleanups.push(fn);
+  };
+  const runUserCleanups = () => {
+    if (userCleanups.length === 0) return;
+    const list = userCleanups;
+    userCleanups = [];
+    for (let i = list.length - 1; i >= 0; i--) {
+      try {
+        list[i]();
+      } catch (err) {
+        if (typeof console !== "undefined") {
+          console.warn("[SibuJS effect] onCleanup threw:", err);
+        }
+      }
+    }
+  };
+  const invokeBody = () => effectFn(onCleanup);
   const wrappedFn = onError ? () => {
     try {
-      effectFn();
+      invokeBody();
     } catch (err) {
       onError(err);
     }
-  } : effectFn;
+  } : invokeBody;
   let cleanupHandle = () => {
   };
+  let running = false;
+  let rerunPending = false;
+  const MAX_RERUNS = 100;
   const subscriber = () => {
-    cleanupHandle();
-    cleanupHandle = track(wrappedFn, subscriber);
+    if (running) {
+      rerunPending = true;
+      return;
+    }
+    running = true;
+    try {
+      let reruns = 0;
+      do {
+        rerunPending = false;
+        runUserCleanups();
+        cleanupHandle();
+        cleanupHandle = track(wrappedFn, subscriber);
+        if (++reruns > MAX_RERUNS) {
+          if (_g.__SIBU_DEV_WARN__ !== false && typeof console !== "undefined") {
+            console.error(
+              `[SibuJS] effect re-requested itself ${MAX_RERUNS}+ times \u2014 likely a write-reads-self cycle. Breaking to prevent infinite loop.`
+            );
+          }
+          rerunPending = false;
+          break;
+        }
+      } while (rerunPending);
+    } finally {
+      running = false;
+      rerunPending = false;
+    }
   };
-  cleanupHandle = track(wrappedFn, subscriber);
+  running = true;
+  try {
+    let reruns = 0;
+    do {
+      rerunPending = false;
+      runUserCleanups();
+      cleanupHandle();
+      cleanupHandle = track(wrappedFn, subscriber);
+      if (++reruns > MAX_RERUNS) {
+        if (_g.__SIBU_DEV_WARN__ !== false && typeof console !== "undefined") {
+          console.error(
+            `[SibuJS] effect re-requested itself ${MAX_RERUNS}+ times on initial run \u2014 likely a write-reads-self cycle. Breaking to prevent infinite loop.`
+          );
+        }
+        rerunPending = false;
+        break;
+      }
+    } while (rerunPending);
+  } finally {
+    running = false;
+    rerunPending = false;
+  }
   const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
   if (hook) hook.emit("effect:create", { effectFn });
+  let disposed = false;
   return () => {
+    if (disposed) return;
+    disposed = true;
     const h = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (h) h.emit("effect:destroy", { effectFn });
-    cleanupHandle();
+    if (h) {
+      try {
+        h.emit("effect:destroy", { effectFn });
+      } catch {
+      }
+    }
+    try {
+      runUserCleanups();
+    } catch (err) {
+      if (typeof console !== "undefined") {
+        console.warn("[SibuJS effect] onCleanup threw during dispose:", err);
+      }
+    }
+    try {
+      cleanupHandle();
+    } catch (err) {
+      if (typeof console !== "undefined") {
+        console.warn("[SibuJS effect] dispose threw:", err);
+      }
+    }
   };
 }
 
@@ -345,10 +543,13 @@ function enqueueBatchedSignal(signal2) {
   return true;
 }
 function flushBatch() {
-  for (const signal2 of pendingSignals) {
-    queueSignalNotification(signal2);
+  try {
+    for (const signal2 of pendingSignals) {
+      queueSignalNotification(signal2);
+    }
+  } finally {
+    pendingSignals.clear();
   }
-  pendingSignals.clear();
   drainNotificationQueue();
 }
 
@@ -391,6 +592,85 @@ function signal(initial, options) {
 }
 
 // src/plugins/plugin.ts
+function createPluginRegistry() {
+  const installedPlugins = /* @__PURE__ */ new Set();
+  const hooks = { init: [], mount: [], unmount: [], error: [] };
+  const provided = /* @__PURE__ */ new Map();
+  const registry = {
+    installedPlugins,
+    hooks,
+    provided,
+    plugin(p, options) {
+      if (installedPlugins.has(p.name)) {
+        console.warn(`[Plugin] "${p.name}" is already installed.`);
+        return;
+      }
+      const ctx = {
+        onInit: (cb) => hooks.init.push(cb),
+        onMount: (cb) => hooks.mount.push(cb),
+        onUnmount: (cb) => hooks.unmount.push(cb),
+        onError: (cb) => hooks.error.push(cb),
+        provide: (key, value) => provided.set(key, value)
+      };
+      const initHooksBefore = hooks.init.length;
+      p.install(ctx, options);
+      installedPlugins.add(p.name);
+      const justAdded = hooks.init.slice(initHooksBefore);
+      for (const cb of justAdded) {
+        try {
+          cb();
+        } catch (e) {
+          console.error(`[Plugin] "${p.name}" init error:`, e);
+        }
+      }
+    },
+    inject(key, defaultValue) {
+      if (provided.has(key)) return provided.get(key);
+      if (defaultValue !== void 0) return defaultValue;
+      throw new Error(`[Plugin] No provider found for key "${key}"`);
+    },
+    triggerMount(element) {
+      const snapshot = hooks.mount.slice();
+      for (const hook of snapshot) {
+        try {
+          hook(element);
+        } catch (e) {
+          console.error("[Plugin] Mount hook error:", e);
+        }
+      }
+    },
+    triggerUnmount(element) {
+      const snapshot = hooks.unmount.slice();
+      for (const hook of snapshot) {
+        try {
+          hook(element);
+        } catch (e) {
+          console.error("[Plugin] Unmount hook error:", e);
+        }
+      }
+    },
+    triggerError(error) {
+      const snapshot = hooks.error.slice();
+      for (const hook of snapshot) {
+        try {
+          hook(error);
+        } catch (e) {
+          console.error("[Plugin] Error hook error:", e);
+        }
+      }
+    },
+    reset() {
+      installedPlugins.clear();
+      hooks.init.length = 0;
+      hooks.mount.length = 0;
+      hooks.unmount.length = 0;
+      hooks.error.length = 0;
+      provided.clear();
+    }
+  };
+  return registry;
+}
+var defaultRegistry = createPluginRegistry();
 function createPlugin(name, install) {
   return { name, install };
 }
@@ -401,7 +681,7 @@ function mobXAdapter(options) {
     const { autorun } = options;
     const disposers = [];
     function fromMobX(expression) {
-      const [getValue, setValue] = signal(expression());
+      const [getValue, setValue] = signal(void 0);
       const disposer = autorun(() => {
         const newValue = expression();
         batch(() => {
@@ -409,7 +689,13 @@ function mobXAdapter(options) {
         });
       });
       disposers.push(disposer);
-      return getValue;
+      const getter = (() => getValue());
+      getter.dispose = () => {
+        const i = disposers.indexOf(disposer);
+        if (i >= 0) disposers.splice(i, 1);
+        disposer();
+      };
+      return getter;
     }
     function toMobX(sibuGetter, callback) {
       return effect(() => {
@@ -431,6 +717,7 @@ function mobXAdapter(options) {
 function derived(getter, options) {
   devAssert(typeof getter === "function", "derived: argument must be a getter function.");
   const debugName = options?.name;
+  const equals = options?.equals;
   const cs = {};
   cs._d = false;
   cs._g = getter;
@@ -441,8 +728,14 @@ function derived(getter, options) {
   markDirty._c = 1;
   markDirty._sig = cs;
   track(() => {
-    cs._d = false;
-    cs._v = getter();
+    let threw = true;
+    try {
+      cs._v = getter();
+      cs._d = false;
+      threw = false;
+    } finally {
+      if (threw) cs._d = true;
+    }
   }, markDirty);
   const hook = globalThis.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
   let evaluating = false;
@@ -455,11 +748,16 @@ function derived(getter, options) {
     if (trackingSuspended) {
       if (cs._d) {
         evaluating = true;
+        let threw = true;
         try {
-          cs._d = false;
-          cs._v = getter();
+          retrack(() => {
+            cs._v = getter();
+            cs._d = false;
+            threw = false;
+          }, markDirty);
         } finally {
           evaluating = false;
+          if (threw) cs._d = true;
         }
       }
       return cs._v;
@@ -468,13 +766,17 @@ function derived(getter, options) {
     if (cs._d) {
       const oldValue = cs._v;
       evaluating = true;
+      let threw = true;
       try {
-        track(() => {
+        retrack(() => {
+          const next = getter();
+          cs._v = equals && cs._v !== void 0 ? equals(cs._v, next) ? cs._v : next : next;
           cs._d = false;
-          cs._v = getter();
+          threw = false;
         }, markDirty);
       } finally {
         evaluating = false;
+        if (threw) cs._d = true;
       }
       if (hook && oldValue !== cs._v) {
         hook.emit("computed:update", { signal: cs, oldValue, newValue: cs._v });
@@ -501,12 +803,12 @@ function reduxAdapter(options) {
         setState(store.getState());
       });
     });
-    function useSelector(selector) {
+    function select(selector) {
       return derived(() => selector(getState()));
     }
     const api = {
       getState,
-      useSelector,
+      select,
       dispatch: store.dispatch.bind(store),
       destroy: unsubscribe
     };
@@ -524,12 +826,12 @@ function zustandAdapter(options) {
         setSibuState(state);
       });
     });
-    function useSelector(selector) {
+    function select(selector) {
       return derived(() => selector(getState()));
     }
     const api = {
       getState,
-      useSelector,
+      select,
       setState: store.setState.bind(store),
       destroy() {
         unsubscribe();
@@ -541,29 +843,79 @@ function zustandAdapter(options) {
 }
 
 // src/utils/sanitize.ts
+var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
 function sanitizeUrl(url) {
   const trimmed = url.replace(/[\x00-\x20\x7f-\x9f]+/g, "").trim();
   if (!trimmed) return "";
   const lower = trimmed.toLowerCase();
-  if (lower.startsWith("javascript:") || lower.startsWith("data:") || lower.startsWith("vbscript:") || lower.startsWith("blob:")) {
-    return "";
+  let schemeEnd = -1;
+  for (let i = 0; i < lower.length; i++) {
+    const ch = lower.charCodeAt(i);
+    if (ch === 58) {
+      schemeEnd = i;
+      break;
+    }
+    if (ch === 47 || ch === 63 || ch === 35) break;
   }
+  if (schemeEnd === -1) return trimmed;
+  const scheme = lower.slice(0, schemeEnd + 1);
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return trimmed;
+  if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
   return trimmed;
 }
+function sanitizeSrcset(value) {
+  const parts = value.split(",");
+  const out = [];
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i].trim();
+    if (!part) continue;
+    const m = part.match(/^(\S+)(\s+.+)?$/);
+    if (!m) continue;
+    const safe = sanitizeUrl(m[1]);
+    if (!safe) continue;
+    out.push(m[2] ? `${safe}${m[2]}` : safe);
+  }
+  return out.join(", ");
+}
 function sanitizeCSSValue(value) {
-  const lower = value.toLowerCase().replace(/\s+/g, "");
-  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("-moz-binding")) {
+  const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
+    const code = Number.parseInt(hex, 16);
+    if (!Number.isFinite(code) || code < 0 || code > 1114111) return "";
+    try {
+      return String.fromCodePoint(code);
+    } catch {
+      return "";
+    }
+  });
+  const lower = decoded.toLowerCase().replace(/\s+/g, "");
+  if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("vbscript:") || lower.includes("-moz-binding") || lower.includes("behavior:") || lower.includes("@import") || lower.includes("image-set(") || lower.includes("filter:progid")) {
     return "";
   }
   return value;
 }
-var URL_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "cite", "poster", "background", "srcset"]);
+var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "href",
+  "xlink:href",
+  "src",
+  "action",
+  "formaction",
+  "formtarget",
+  "cite",
+  "poster",
+  "background",
+  "srcset",
+  "ping",
+  "data"
+]);
 function isUrlAttribute(attr) {
   return URL_ATTRIBUTES.has(attr);
 }
 
 // src/reactivity/bindAttribute.ts
 var _isDev4 = isDev();
+function setProp(el, key, val) {
+  el[key] = val;
+}
 function isEventHandlerAttr(name) {
   if (name.length < 3) return false;
   const lower = name.toLowerCase();
@@ -589,7 +941,7 @@ function bindAttribute(el, attr, getter) {
     }
     if (typeof value === "boolean") {
       if (attr in el && (attr === "checked" || attr === "disabled" || attr === "selected")) {
-        el[attr] = value;
+        setProp(el, attr, value);
       } else if (value) {
         el.setAttribute(attr, "");
       } else {
@@ -599,7 +951,7 @@ function bindAttribute(el, attr, getter) {
     }
     const str = String(value);
     if ((attr === "value" || attr === "checked") && attr in el) {
-      el[attr] = attr === "checked" ? Boolean(value) : str;
+      setProp(el, attr, attr === "checked" ? Boolean(value) : str);
     } else {
       el.setAttribute(attr, isUrlAttribute(attr) ? sanitizeUrl(str) : str);
     }
@@ -636,24 +988,29 @@ function bindChildNode(placeholder, getter) {
     let newNodes;
     if (Array.isArray(result)) {
       newNodes = [];
+      const seen = /* @__PURE__ */ new Set();
       for (let i = 0; i < result.length; i++) {
         const item = result[i];
         if (item == null || typeof item === "boolean") continue;
-        newNodes.push(item instanceof Node ? item : document.createTextNode(String(item)));
+        const node = item instanceof Node ? item : document.createTextNode(String(item));
+        if (seen.has(node)) {
+          if (_isDev5)
+            devWarn("bindChildNode: duplicate node reference in array \u2014 only the first occurrence is rendered.");
+          continue;
+        }
+        seen.add(node);
+        newNodes.push(node);
       }
     } else {
       const node = result instanceof Node ? result : document.createTextNode(String(result));
       newNodes = [node];
     }
-    const reused = lastNodes.length > 0 && newNodes.length > 0 ? /* @__PURE__ */ new Set() : void 0;
-    if (reused) {
+    let reused;
+    if (lastNodes.length > 0 && newNodes.length > 0) {
+      const lastSet = new Set(lastNodes);
+      reused = /* @__PURE__ */ new Set();
       for (let i = 0; i < newNodes.length; i++) {
-        for (let j = 0; j < lastNodes.length; j++) {
-          if (newNodes[i] === lastNodes[j]) {
-            reused.add(newNodes[i]);
-            break;
-          }
-        }
+        if (lastSet.has(newNodes[i])) reused.add(newNodes[i]);
       }
     }
     for (let i = 0; i < lastNodes.length; i++) {
@@ -692,6 +1049,30 @@ function registerDisposer(node, teardown) {
 }
 
 // src/core/rendering/tagFactory.ts
+var _isDev7 = isDev();
+var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
+function validateTagName(tag) {
+  const lower = tag.toLowerCase();
+  if (BLOCKED_TAGS.has(lower)) {
+    throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+  }
+}
+var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
+  "config",
+  "location",
+  "history",
+  "document",
+  "window",
+  "navigator",
+  "name",
+  "top",
+  "parent",
+  "self",
+  "frames"
+]);
+function setProp2(el, key, val) {
+  el[key] = val;
+}
 var kebabCache = /* @__PURE__ */ new Map();
 function toKebab(prop) {
   let cached = kebabCache.get(prop);
@@ -816,79 +1197,103 @@ function appendChildren(el, nodes) {
     }
   }
 }
-var tagFactory = (tag, ns) => (first, second) => {
-  const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
-  if (first === void 0) return el;
-  if (typeof first === "string") {
-    if (second !== void 0) {
-      el.setAttribute("class", first);
-      appendChildren(el, second);
+var tagFactory = (tag, ns) => {
+  return (first, second) => {
+    validateTagName(tag);
+    const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
+    if (first === void 0) return el;
+    if (typeof first === "string") {
+      if (second !== void 0) {
+        el.setAttribute("class", first);
+        appendChildren(el, second);
+        return el;
+      }
+      el.textContent = first;
       return el;
     }
-    el.textContent = first;
-    return el;
-  }
-  if (typeof first === "number") {
-    el.textContent = String(first);
-    return el;
-  }
-  if (Array.isArray(first) || first instanceof Node || typeof first === "function") {
-    appendChildren(el, first);
-    return el;
-  }
-  const props = first;
-  const pClass = props.class;
-  if (pClass != null) applyClass(el, pClass);
-  const pId = props.id;
-  if (pId != null) el.id = pId;
-  const pNodes = second !== void 0 ? second : props.nodes;
-  if (pNodes != null) appendChildren(el, pNodes);
-  const pOn = props.on;
-  if (pOn) {
-    for (const ev in pOn) {
-      el.addEventListener(ev, pOn[ev]);
-    }
-  }
-  const pStyle = props.style;
-  if (pStyle != null) applyStyle(el, pStyle);
-  const pRef = props.ref;
-  if (pRef) pRef.current = el;
-  for (const key in props) {
-    switch (key) {
-      case "class":
-      case "id":
-      case "nodes":
-      case "on":
-      case "style":
-      case "ref":
-      case "onElement":
-        continue;
-      // already handled above / below
-      default: {
-        const value = props[key];
-        if (value == null) continue;
-        if (key[0] === "o" && key[1] === "n") continue;
-        if (typeof value === "function") {
-          registerDisposer(el, bindAttribute(el, key, value));
-        } else if (typeof value === "boolean") {
-          if (key in el && (key === "checked" || key === "disabled" || key === "selected")) {
-            el[key] = value;
-          } else if (value) {
-            el.setAttribute(key, "");
+    if (typeof first === "number") {
+      el.textContent = String(first);
+      return el;
+    }
+    if (Array.isArray(first) || first instanceof Node || typeof first === "function") {
+      appendChildren(el, first);
+      return el;
+    }
+    const props = first;
+    const pClass = props.class;
+    if (pClass != null) applyClass(el, pClass);
+    const pId = props.id;
+    if (pId != null) {
+      if (_isDev7 && typeof pId === "string" && CLOBBER_RISKY_IDS.has(pId.toLowerCase())) {
+        devWarn(
+          `tagFactory: element id="${pId}" matches a common global and may cause DOM clobbering. Avoid setting ids from untrusted input.`
+        );
+      }
+      el.id = pId;
+    }
+    const pNodes = second !== void 0 ? second : props.nodes;
+    if (pNodes != null) appendChildren(el, pNodes);
+    const pOn = props.on;
+    if (pOn) {
+      for (const ev in pOn) {
+        const handler = pOn[ev];
+        if (typeof handler === "function") {
+          el.addEventListener(ev, handler);
+        } else if (_isDev7) {
+          devWarn(
+            `tagFactory: on.${ev} handler is not a function (got ${typeof handler}). Event listener was not attached.`
+          );
+        }
+      }
+    }
+    const pStyle = props.style;
+    if (pStyle != null) applyStyle(el, pStyle);
+    const pRef = props.ref;
+    if (pRef) pRef.current = el;
+    for (const key in props) {
+      switch (key) {
+        case "class":
+        case "id":
+        case "nodes":
+        case "on":
+        case "style":
+        case "ref":
+        case "onElement":
+          continue;
+        // already handled above / below
+        default: {
+          const value = props[key];
+          if (value == null) continue;
+          const lkey = key.toLowerCase();
+          if (lkey[0] === "o" && lkey[1] === "n") continue;
+          if (typeof value === "function") {
+            registerDisposer(el, bindAttribute(el, key, value));
+          } else if (typeof value === "boolean") {
+            if (key in el && (key === "checked" || key === "disabled" || key === "selected")) {
+              setProp2(el, key, value);
+            } else if (value) {
+              el.setAttribute(key, "");
+            } else {
+              el.removeAttribute(key);
+            }
           } else {
-            el.removeAttribute(key);
+            const str = String(value);
+            if (lkey === "srcset") {
+              el.setAttribute(key, sanitizeSrcset(str));
+            } else if (isUrlAttribute(lkey)) {
+              el.setAttribute(key, sanitizeUrl(str));
+            } else {
+              el.setAttribute(key, str);
+            }
           }
-        } else {
-          const str = String(value);
-          el.setAttribute(key, isUrlAttribute(key) ? sanitizeUrl(str) : str);
         }
       }
     }
-  }
-  if (props.onElement && typeof props.onElement === "function") {
-    props.onElement(el);
-  }
-  return el;
+    if (props.onElement && typeof props.onElement === "function") {
+      props.onElement(el);
+    }
+    return el;
+  };
 };
 
 // src/ecosystem/ui/componentAdapter.ts