sibujs 3.2.2 → 3.3.1

package/dist/extras.cjs

@@ -145,7 +145,7 @@ __export(extras_exports, {
   getPerformanceReport: () => getPerformanceReport,
   getQueryData: () => getQueryData,
   getSignalName: () => getSignalName,
-  getSubscriberCount: () => getSubscriberCount2,
+  getSubscriberCount: () => getSubscriberCount3,
   globalStore: () => globalStore,
   healthCheck: () => healthCheck,
   hmrState: () => hmrState,
@@ -317,7 +317,13 @@ module.exports = __toCommonJS(extras_exports);
 
 // src/core/dev.ts
 function isDev() {
-  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production";
+  return typeof globalThis.__SIBU_DEV__ !== "undefined" ? !!globalThis.__SIBU_DEV__ : (
+    // The bare `__SIBU_DEV__` is a bundler define that only exists in
+    // production builds; under the test runner it is always undefined, so
+    // this branch is unreachable here.
+    /* v8 ignore next 2 */
+    typeof __SIBU_DEV__ !== "undefined" ? __SIBU_DEV__ : typeof process !== "undefined" && process.env?.NODE_ENV !== "production"
+  );
 }
 var _isDev = isDev();
 function devAssert(condition, message) {
@@ -331,7 +337,7 @@ function devWarn(message) {
   }
 }
 
-// src/reactivity/track.ts
+// src/reactivity/track-core.ts
 var _isDev2 = isDev();
 var POOL_MAX = 4096;
 var nodePool = [];
@@ -415,6 +421,7 @@ function unlinkSub(node) {
   else sub2.depsTail = prev;
 }
 var currentSubscriber = null;
+var suspendSavedSub = null;
 var notifyDepth = 0;
 var pendingQueue = [];
 var pendingSet = /* @__PURE__ */ new Set();
@@ -426,7 +433,35 @@ function safeInvoke(sub2) {
     if (_isDev2) devWarn(`Subscriber threw during notification: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+var suspendDepth = 0;
 var trackingSuspended = false;
+function suspendTracking() {
+  if (suspendDepth === 0) {
+    suspendSavedSub = currentSubscriber;
+    currentSubscriber = null;
+    trackingSuspended = true;
+  }
+  suspendDepth++;
+}
+function resumeTracking() {
+  suspendDepth--;
+  if (suspendDepth === 0) {
+    currentSubscriber = suspendSavedSub;
+    suspendSavedSub = null;
+    trackingSuspended = false;
+  }
+}
+function isTrackingSuspended() {
+  return trackingSuspended;
+}
+function untracked(fn) {
+  suspendTracking();
+  try {
+    return fn();
+  } finally {
+    resumeTracking();
+  }
+}
 var subscriberEpochCounter = 0;
 function retrack(effectFn, subscriber) {
   const prev = currentSubscriber;
@@ -536,6 +571,16 @@ function cleanup(subscriber) {
 var maxSubscriberRepeats = 50;
 var maxDrainIterations = 1e6;
 var drainEpoch = 0;
+function setMaxSubscriberRepeats(n) {
+  const prev = maxSubscriberRepeats;
+  if (Number.isFinite(n) && n > 0) maxSubscriberRepeats = Math.floor(n);
+  return prev;
+}
+function setMaxDrainIterations(n) {
+  const prev = maxDrainIterations;
+  if (Number.isFinite(n) && n > 0) maxDrainIterations = Math.floor(n);
+  return prev;
+}
 function tickRepeat(sub2) {
   const s2 = sub2;
   if (s2._runEpoch !== drainEpoch) {
@@ -706,6 +751,64 @@ function forEachSubscriber(signal2, visit) {
   }
 }
 
+// src/reactivity/track.ts
+var _isDev3 = isDev();
+var _runtimeVersion = typeof __SIBU_VERSION__ !== "undefined" ? __SIBU_VERSION__ : "dev";
+var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
+function resolveReactiveApi() {
+  const g2 = globalThis;
+  const existing = g2[REGISTRY_KEY];
+  if (existing) {
+    if (_isDev3 && !existing.__dupWarned) {
+      existing.__dupWarned = true;
+      devWarn(
+        `Multiple instances of the reactive runtime detected on this page (active: ${existing.version}, duplicate: ${_runtimeVersion}). Reactivity still works \u2014 all copies share the first one \u2014 but de-duplicate sibujs in your bundler (e.g. Vite optimizeDeps.exclude: ['sibujs'] or resolve.dedupe: ['sibujs']).`
+      );
+    }
+    return existing;
+  }
+  const local = {
+    suspendTracking,
+    resumeTracking,
+    isTrackingSuspended,
+    untracked,
+    retrack,
+    track,
+    reactiveBinding,
+    recordDependency,
+    cleanup,
+    setMaxSubscriberRepeats,
+    setMaxDrainIterations,
+    drainNotificationQueue,
+    queueSignalNotification,
+    notifySubscribers,
+    getSubscriberCount,
+    getSubscriberDeps,
+    forEachSubscriber,
+    version: _runtimeVersion
+  };
+  g2[REGISTRY_KEY] = local;
+  return local;
+}
+var API = resolveReactiveApi();
+var suspendTracking2 = API.suspendTracking;
+var resumeTracking2 = API.resumeTracking;
+var isTrackingSuspended2 = API.isTrackingSuspended;
+var untracked2 = API.untracked;
+var retrack2 = API.retrack;
+var track2 = API.track;
+var reactiveBinding2 = API.reactiveBinding;
+var recordDependency2 = API.recordDependency;
+var cleanup2 = API.cleanup;
+var setMaxSubscriberRepeats2 = API.setMaxSubscriberRepeats;
+var setMaxDrainIterations2 = API.setMaxDrainIterations;
+var drainNotificationQueue2 = API.drainNotificationQueue;
+var queueSignalNotification2 = API.queueSignalNotification;
+var notifySubscribers2 = API.notifySubscribers;
+var getSubscriberCount2 = API.getSubscriberCount;
+var getSubscriberDeps2 = API.getSubscriberDeps;
+var forEachSubscriber2 = API.forEachSubscriber;
+
 // src/core/signals/derived.ts
 function derived(getter, options) {
   devAssert(typeof getter === "function", "derived: argument must be a getter function.");
@@ -728,7 +831,7 @@ function derived(getter, options) {
     cs._d = false;
     cs._init = true;
   };
-  track(() => {
+  track2(() => {
     let threw = true;
     try {
       cs._v = getter();
@@ -747,12 +850,12 @@ function derived(getter, options) {
         `[SibuJS] Circular dependency detected in derived${debugName ? ` "${debugName}"` : ""}. A derived signal cannot read itself (directly or through a chain).`
       );
     }
-    if (trackingSuspended) {
+    if (isTrackingSuspended2()) {
       if (cs._d) {
         const prev = cs._v;
         evaluating = true;
         try {
-          retrack(recompute, markDirty);
+          retrack2(recompute, markDirty);
           if (!Object.is(prev, cs._v)) cs.__v++;
         } finally {
           evaluating = false;
@@ -760,12 +863,12 @@ function derived(getter, options) {
       }
       return cs._v;
     }
-    recordDependency(cs);
+    recordDependency2(cs);
     if (cs._d) {
       const oldValue = cs._v;
       evaluating = true;
       try {
-        retrack(recompute, markDirty);
+        retrack2(recompute, markDirty);
         if (!Object.is(oldValue, cs._v)) cs.__v++;
       } finally {
         evaluating = false;
@@ -845,7 +948,7 @@ function drainReruns(ctx) {
   do {
     ctx.rerunPending = false;
     if (ctx.userCleanups.length > 0) flushUserCleanups(ctx);
-    retrack(ctx.bodyFn, ctx.subscriber);
+    retrack2(ctx.bodyFn, ctx.subscriber);
   } while (ctx.rerunPending && ++reruns <= MAX_RERUNS);
   if (ctx.rerunPending) {
     ctx.rerunPending = false;
@@ -874,7 +977,7 @@ function disposeEffect(ctx) {
     }
   }
   try {
-    cleanup(ctx.subscriber);
+    cleanup2(ctx.subscriber);
   } catch (err) {
     if (typeof console !== "undefined") {
       console.warn("[SibuJS effect] dispose threw:", err);
@@ -919,7 +1022,7 @@ function effect(effectFn, options) {
     try {
       ctx.rerunPending = false;
       if (ctx.userCleanups.length > 0) flushUserCleanups(ctx);
-      retrack(ctx.bodyFn, sub2);
+      retrack2(ctx.bodyFn, sub2);
       if (ctx.rerunPending) drainReruns(ctx);
     } finally {
       ctx.running = false;
@@ -935,7 +1038,7 @@ function effect(effectFn, options) {
   ctx.subscriber = sub2;
   ctx.running = true;
   try {
-    retrack(ctx.bodyFn, ctx.subscriber);
+    retrack2(ctx.bodyFn, ctx.subscriber);
     if (ctx.rerunPending) drainReruns(ctx);
   } finally {
     ctx.running = false;
@@ -949,7 +1052,7 @@ function effect(effectFn, options) {
 // src/reactivity/batch.ts
 var batchDepth = 0;
 var pendingSignals = /* @__PURE__ */ new Set();
-function batch(fn) {
+function batchImpl(fn) {
   batchDepth++;
   try {
     return fn();
@@ -960,25 +1063,45 @@ function batch(fn) {
     }
   }
 }
-function enqueueBatchedSignal(signal2) {
+function enqueueBatchedSignalImpl(signal2) {
   if (batchDepth === 0) return false;
   pendingSignals.add(signal2);
   return true;
 }
+function isBatchingImpl() {
+  return batchDepth > 0;
+}
 function flushBatch() {
   try {
     for (const signal2 of pendingSignals) {
-      queueSignalNotification(signal2);
+      queueSignalNotification2(signal2);
     }
   } finally {
     pendingSignals.clear();
   }
-  drainNotificationQueue();
+  drainNotificationQueue2();
+}
+var BATCH_REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.batch.v1");
+function resolveBatchApi() {
+  const g2 = globalThis;
+  const existing = g2[BATCH_REGISTRY_KEY];
+  if (existing) return existing;
+  const local = {
+    batch: batchImpl,
+    enqueueBatchedSignal: enqueueBatchedSignalImpl,
+    isBatching: isBatchingImpl
+  };
+  g2[BATCH_REGISTRY_KEY] = local;
+  return local;
 }
+var API2 = resolveBatchApi();
+var batch = API2.batch;
+var enqueueBatchedSignal = API2.enqueueBatchedSignal;
+var isBatching = API2.isBatching;
 
 // src/core/signals/signal.ts
 var _g2 = globalThis;
-var _isDev3 = isDev();
+var _isDev4 = isDev();
 function signal(initial, options) {
   const state = {
     value: initial,
@@ -989,11 +1112,11 @@ function signal(initial, options) {
     __activeNode: null,
     __name: void 0
   };
-  const debugName = _isDev3 ? options?.name : void 0;
+  const debugName = _isDev4 ? options?.name : void 0;
   const equalsFn = options?.equals;
   if (debugName) state.__name = debugName;
   function get() {
-    recordDependency(state);
+    recordDependency2(state);
     return state.value;
   }
   get.__signal = state;
@@ -1006,15 +1129,15 @@ function signal(initial, options) {
       if (equalsFn(prev, newValue)) return;
       state.value = newValue;
       state.__v++;
-      if (_isDev3) {
+      if (_isDev4) {
         const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
         if (hook) hook.emit("signal:update", { signal: state, name: debugName, oldValue: prev, newValue });
       }
       if (!enqueueBatchedSignal(state)) {
-        notifySubscribers(state);
+        notifySubscribers2(state);
       }
     };
-  } else if (_isDev3) {
+  } else if (_isDev4) {
     set = (next) => {
       const prev = state.value;
       const newValue = typeof next === "function" ? next(prev) : next;
@@ -1024,7 +1147,7 @@ function signal(initial, options) {
       const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
       if (hook) hook.emit("signal:update", { signal: state, name: debugName, oldValue: prev, newValue });
       if (!enqueueBatchedSignal(state)) {
-        notifySubscribers(state);
+        notifySubscribers2(state);
       }
     };
   } else {
@@ -1035,11 +1158,11 @@ function signal(initial, options) {
       state.value = newValue;
       state.__v++;
       if (!enqueueBatchedSignal(state)) {
-        notifySubscribers(state);
+        notifySubscribers2(state);
       }
     };
   }
-  if (_isDev3) {
+  if (_isDev4) {
     const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
     if (hook) hook.emit("signal:create", { signal: state, name: debugName, getter: get, initial });
   }
@@ -2247,7 +2370,9 @@ function sanitizeSrcset(value) {
   }
   return out.join(", ");
 }
+var CSS_DANGER_GATE = /[(:@\\]/;
 function sanitizeCSSValue(value) {
+  if (!CSS_DANGER_GATE.test(value)) return value;
   const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
     const code2 = Number.parseInt(hex, 16);
     if (!Number.isFinite(code2) || code2 < 0 || code2 > 1114111) return "";
@@ -2293,8 +2418,11 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "ping",
   "data"
 ]);
-function isUrlAttribute(attr) {
-  return URL_ATTRIBUTES.has(attr.toLowerCase());
+function sanitizeAttributeString(attr, value) {
+  const lower = attr.toLowerCase();
+  if (lower === "srcset") return sanitizeSrcset(value);
+  if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  return value;
 }
 
 // src/ui/stream.ts
@@ -2401,7 +2529,7 @@ function resize(target) {
     } };
   }
   const getter = resolveTarget(target);
-  const cleanup2 = effect(() => {
+  const cleanup3 = effect(() => {
     const el = getter();
     if (observer) {
       observer.disconnect();
@@ -2420,7 +2548,7 @@ function resize(target) {
     observer.observe(el);
   });
   function dispose2() {
-    cleanup2();
+    cleanup3();
     if (observer) {
       observer.disconnect();
       observer = null;
@@ -2704,7 +2832,7 @@ function draggable(element, data2) {
   let onDragStart = null;
   let onDragEnd = null;
   const getter = resolveTarget2(element);
-  const cleanup2 = effect(() => {
+  const cleanup3 = effect(() => {
     if (currentEl && onDragStart && onDragEnd) {
       currentEl.removeEventListener("dragstart", onDragStart);
       currentEl.removeEventListener("dragend", onDragEnd);
@@ -2726,7 +2854,7 @@ function draggable(element, data2) {
     el.addEventListener("dragend", onDragEnd);
   });
   function dispose2() {
-    cleanup2();
+    cleanup3();
     if (currentEl && onDragStart && onDragEnd) {
       currentEl.removeEventListener("dragstart", onDragStart);
       currentEl.removeEventListener("dragend", onDragEnd);
@@ -2747,7 +2875,7 @@ function dropZone(element, options) {
   let onDragLeave = null;
   let onDrop = null;
   const getter = resolveTarget2(element);
-  const cleanup2 = effect(() => {
+  const cleanup3 = effect(() => {
     if (currentEl && onDragOver && onDragEnter && onDragLeave && onDrop) {
       currentEl.removeEventListener("dragover", onDragOver);
       currentEl.removeEventListener("dragenter", onDragEnter);
@@ -2789,7 +2917,7 @@ function dropZone(element, options) {
     el.addEventListener("drop", onDrop);
   });
   function dispose2() {
-    cleanup2();
+    cleanup3();
     if (currentEl && onDragOver && onDragEnter && onDragLeave && onDrop) {
       currentEl.removeEventListener("dragover", onDragOver);
       currentEl.removeEventListener("dragenter", onDragEnter);
@@ -2809,11 +2937,11 @@ function title(value) {
   }
   const previousTitle = document.title;
   if (typeof value === "function") {
-    const cleanup2 = effect(() => {
+    const cleanup3 = effect(() => {
       document.title = value();
     });
     return () => {
-      cleanup2();
+      cleanup3();
       document.title = previousTitle;
     };
   }
@@ -4506,7 +4634,7 @@ function TransitionGroup(options) {
     }
     setElements((prev) => prev.filter((e) => e !== el));
   }
-  function track3(newElements) {
+  function track4(newElements) {
     const oldPositions = /* @__PURE__ */ new Map();
     for (const el of elements()) {
       if (typeof el.getBoundingClientRect === "function") {
@@ -4548,7 +4676,7 @@ function TransitionGroup(options) {
       }
     }
   }
-  return { add, remove, track: track3 };
+  return { add, remove, track: track4 };
 }
 
 // src/ui/viewTransition.ts
@@ -4852,7 +4980,7 @@ function form(config) {
 
 // src/core/rendering/dispose.ts
 var elementDisposers = /* @__PURE__ */ new WeakMap();
-var _isDev4 = isDev();
+var _isDev5 = isDev();
 var activeBindingCount = 0;
 function registerDisposer(node, teardown) {
   let disposers = elementDisposers.get(node);
@@ -4861,7 +4989,7 @@ function registerDisposer(node, teardown) {
     elementDisposers.set(node, disposers);
   }
   disposers.push(teardown);
-  if (_isDev4) activeBindingCount++;
+  if (_isDev5) activeBindingCount++;
 }
 function dispose(node) {
   const stack = [node];
@@ -4880,12 +5008,12 @@ function dispose(node) {
     if (disposers) {
       const snapshot = disposers.slice();
       elementDisposers.delete(current);
-      if (_isDev4) activeBindingCount -= snapshot.length;
+      if (_isDev5) activeBindingCount -= snapshot.length;
       for (const d of snapshot) {
         try {
           d();
         } catch (err) {
-          if (_isDev4 && typeof console !== "undefined") {
+          if (_isDev5 && typeof console !== "undefined") {
             console.warn("[SibuJS] Disposer threw during cleanup:", err);
           }
         }
@@ -4896,12 +5024,12 @@ function dispose(node) {
         if (!added || added.length === 0) break;
         const moreSnapshot = added.slice();
         elementDisposers.delete(current);
-        if (_isDev4) activeBindingCount -= moreSnapshot.length;
+        if (_isDev5) activeBindingCount -= moreSnapshot.length;
         for (const d of moreSnapshot) {
           try {
             d();
           } catch (err) {
-            if (_isDev4 && typeof console !== "undefined") {
+            if (_isDev5 && typeof console !== "undefined") {
               console.warn("[SibuJS] Disposer threw during cleanup:", err);
             }
           }
@@ -5139,7 +5267,7 @@ function aria(element, attrs) {
       const getter = value;
       registerDisposer(
         element,
-        track(() => {
+        track2(() => {
           element.setAttribute(ariaKey, String(getter()));
         })
       );
@@ -5412,13 +5540,13 @@ function removeScopedStyle(scopeId) {
 }
 
 // src/reactivity/bindAttribute.ts
-var _isDev5 = isDev();
+var _isDev6 = isDev();
 function setProp(el, key, val) {
   el[key] = val;
 }
 function bindAttribute(el, attr, getter) {
   if (isEventHandlerAttr(attr)) {
-    if (_isDev5)
+    if (_isDev6)
       devWarn(
         `bindAttribute: refusing to bind event-handler attribute "${attr}". Use on:{ ${attr.slice(2)}: fn } instead.`
       );
@@ -5430,7 +5558,7 @@ function bindAttribute(el, attr, getter) {
     try {
       value = getter();
     } catch (err) {
-      if (_isDev5)
+      if (_isDev6)
         devWarn(`bindAttribute: getter for "${attr}" threw: ${err instanceof Error ? err.message : String(err)}`);
       return;
     }
@@ -5448,10 +5576,10 @@ function bindAttribute(el, attr, getter) {
     if ((attr === "value" || attr === "checked") && attr in el) {
       setProp(el, attr, attr === "checked" ? Boolean(value) : str);
     } else {
-      el.setAttribute(attr, isUrlAttribute(attr) ? sanitizeUrl(str) : str);
+      el.setAttribute(attr, sanitizeAttributeString(attr, str));
     }
   }
-  return reactiveBinding(commit);
+  return reactiveBinding2(commit);
 }
 
 // src/ui/reactiveAttr.ts
@@ -5501,7 +5629,7 @@ function bindBoolAttr(el, attr, getter) {
       el.removeAttribute(attr);
     }
   }
-  const teardown = track(commit);
+  const teardown = track2(commit);
   return teardown;
 }
 function bindData(el, key, getter) {
@@ -5962,7 +6090,7 @@ function uniqueId(suffix) {
 }
 
 // src/performance/domRecycler.ts
-var _isDev6 = isDev();
+var _isDev7 = isDev();
 var DOMPool = class {
   constructor(maxSize = 50) {
     this.pools = /* @__PURE__ */ new Map();
@@ -5989,7 +6117,7 @@ var DOMPool = class {
    * is almost certainly a bug.
    */
   release(element) {
-    if (_isDev6 && element.isConnected) {
+    if (_isDev7 && element.isConnected) {
       devWarn(
         "DOMPool.release() called on a still-connected element. Detach it from the DOM first (remove() / dispose())."
       );
@@ -6036,11 +6164,13 @@ function getDOMPool() {
 }
 var preloadedResources = /* @__PURE__ */ new Set();
 function preloadResource(url, type = "fetch") {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link2 = document.createElement("link");
   link2.rel = "preload";
-  link2.href = url;
+  link2.href = safe;
   switch (type) {
     case "script":
       link2.setAttribute("as", "script");
@@ -6058,11 +6188,13 @@ function preloadResource(url, type = "fetch") {
   document.head.appendChild(link2);
 }
 function prefetch(url) {
-  if (preloadedResources.has(url)) return;
-  preloadedResources.add(url);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  if (preloadedResources.has(safe)) return;
+  preloadedResources.add(safe);
   const link2 = document.createElement("link");
   link2.rel = "prefetch";
-  link2.href = url;
+  link2.href = safe;
   document.head.appendChild(link2);
 }
 function preloadImage(src) {
@@ -6100,7 +6232,7 @@ function noSideEffect(fn) {
 function sanitizeUrlAttr(name, value) {
   return name === "srcset" ? sanitizeSrcset(value) : sanitizeUrl(value);
 }
-var _isDev7 = isDev();
+var _isDev8 = isDev();
 var SAFE_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
 function isSafeAttrName(name) {
   return SAFE_ATTR_NAME.test(name);
@@ -6120,7 +6252,7 @@ var URL_ATTRS = /* @__PURE__ */ new Set([
   "xlink:href"
 ]);
 function ssrErrorComment(err) {
-  if (_isDev7) {
+  if (_isDev8) {
     const msg = escapeHtml(err instanceof Error ? err.message : String(err));
     return `<!--SSR error: ${safeCommentText(msg)}-->`;
   }
@@ -6166,10 +6298,10 @@ function renderToString(element) {
   }
   const tag = element.tagName.toLowerCase();
   if (tag === "script" || tag === "style") {
-    return _isDev7 ? `<!--ssr:${tag}-stripped-->` : "";
+    return _isDev8 ? `<!--ssr:${tag}-stripped-->` : "";
   }
   if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    return _isDev7 ? "<!--ssr:invalid-tag-->" : "";
+    return _isDev8 ? "<!--ssr:invalid-tag-->" : "";
   }
   let html2 = `<${tag}`;
   for (const attr of Array.from(element.attributes)) {
@@ -6210,7 +6342,7 @@ function hydrate(component, container, options = {}) {
       const first = mismatches[0];
       if (options.onMismatch) {
         options.onMismatch(first);
-      } else if (_isDev7) {
+      } else if (_isDev8) {
         console.warn(
           `[SibuJS hydration] ${first.message}
   at ${first.path}
@@ -6405,11 +6537,11 @@ async function* renderToStream(element) {
   }
   const tag = element.tagName.toLowerCase();
   if (tag === "script" || tag === "style") {
-    if (_isDev7) yield `<!--ssr:${tag}-stripped-->`;
+    if (_isDev8) yield `<!--ssr:${tag}-stripped-->`;
     return;
   }
   if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    if (_isDev7) yield "<!--ssr:invalid-tag-->";
+    if (_isDev8) yield "<!--ssr:invalid-tag-->";
     return;
   }
   let openTag = `<${tag}`;
@@ -6513,7 +6645,7 @@ function hydrateProgressively(container, islands, options) {
   }
   container.setAttribute("data-sibu-hydrated", "progressive");
   return () => {
-    for (const cleanup2 of cleanups) cleanup2();
+    for (const cleanup3 of cleanups) cleanup3();
   };
 }
 function resetSSRState() {
@@ -6542,7 +6674,7 @@ function ssrSuspense(props) {
     },
     (err) => {
       if (timer) clearTimeout(timer);
-      if (_isDev7) console.warn("[SibuJS SSR] ssrSuspense rejected:", err);
+      if (_isDev8) console.warn("[SibuJS SSR] ssrSuspense rejected:", err);
       return { id, html: fallbackHtml };
     }
   );
@@ -6588,7 +6720,7 @@ function serializeState(state, nonce, options) {
 }
 function deserializeState(validate) {
   if (typeof window === "undefined") return void 0;
-  if (_isDev7 && !validate) {
+  if (_isDev8 && !validate) {
     console.warn(
       "[SibuJS SSR] deserializeState() called without a validate guard \u2014 tampered SSR payloads will not be detected."
     );
@@ -6941,11 +7073,14 @@ function lazyChunk(id, loader, registry, fallback) {
 }
 function preloadModule(url) {
   if (typeof document === "undefined") return;
-  const existing = document.querySelector(`link[href="${url}"][rel="modulepreload"]`);
+  const safe = sanitizeUrl(url);
+  if (!safe) return;
+  const safeHref = typeof CSS !== "undefined" && typeof CSS.escape === "function" ? CSS.escape(safe) : safe.replace(/["\\]/g, "\\$&");
+  const existing = document.querySelector(`link[rel="modulepreload"][href="${safeHref}"]`);
   if (existing) return;
   const link2 = document.createElement("link");
   link2.rel = "modulepreload";
-  link2.href = url;
+  link2.href = safe;
   document.head.appendChild(link2);
 }
 function preloadModules(urls) {
@@ -6989,7 +7124,7 @@ function Head(props) {
   const anchor = document.createComment("sibu-head");
   const managedElements = [];
   const effectCleanups = [];
-  const cleanup2 = () => {
+  const cleanup3 = () => {
     for (const el of managedElements) {
       if (el.parentNode) el.parentNode.removeChild(el);
     }
@@ -6998,7 +7133,7 @@ function Head(props) {
     effectCleanups.length = 0;
   };
   const apply = () => {
-    cleanup2();
+    cleanup3();
     if (props.title) {
       if (typeof props.title === "function") {
         const cleanupFn = effect(() => {
@@ -7552,7 +7687,7 @@ function isWasmCached(key) {
 }
 
 // src/reactivity/bindChildNode.ts
-var _isDev8 = isDev();
+var _isDev9 = isDev();
 function bindChildNode(placeholder, getter) {
   let lastNodes = [];
   function commit() {
@@ -7560,7 +7695,7 @@ function bindChildNode(placeholder, getter) {
     try {
       result = getter();
     } catch (err) {
-      if (_isDev8) devWarn(`bindChildNode: getter threw: ${err instanceof Error ? err.message : String(err)}`);
+      if (_isDev9) devWarn(`bindChildNode: getter threw: ${err instanceof Error ? err.message : String(err)}`);
       return;
     }
     if (result == null || typeof result === "boolean") {
@@ -7586,7 +7721,7 @@ function bindChildNode(placeholder, getter) {
         if (item == null || typeof item === "boolean") continue;
         const node = item instanceof Node ? item : document.createTextNode(String(item));
         if (seen.has(node)) {
-          if (_isDev8)
+          if (_isDev9)
             devWarn("bindChildNode: duplicate node reference in array \u2014 only the first occurrence is rendered.");
           continue;
         }
@@ -7621,18 +7756,15 @@ function bindChildNode(placeholder, getter) {
     }
     lastNodes = newNodes;
   }
-  return reactiveBinding(commit);
+  return reactiveBinding2(commit);
 }
 
 // src/core/rendering/tagFactory.ts
 var SVG_NS = "http://www.w3.org/2000/svg";
-var _isDev9 = isDev();
+var _isDev10 = isDev();
 var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
-function validateTagName(tag) {
-  const lower = tag.toLowerCase();
-  if (BLOCKED_TAGS.has(lower)) {
-    throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
-  }
+function isBlockedTag(tag) {
+  return BLOCKED_TAGS.has(tag.toLowerCase());
 }
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
@@ -7672,7 +7804,7 @@ function toKebab(prop) {
 }
 function applyStyle(el, style2) {
   if (typeof style2 === "function") {
-    const teardown = track(() => {
+    const teardown = track2(() => {
       el.setAttribute("style", style2());
     });
     registerDisposer(el, teardown);
@@ -7688,7 +7820,7 @@ function applyStyle(el, style2) {
     const name = toKebab(prop);
     if (typeof val === "function") {
       const getter = val;
-      const teardown = track(() => {
+      const teardown = track2(() => {
         htmlEl.style.setProperty(name, sanitizeCSSValue(String(getter())));
       });
       registerDisposer(el, teardown);
@@ -7703,7 +7835,7 @@ function applyClass(el, cls) {
     return;
   }
   if (typeof cls === "function") {
-    const teardown = track(() => {
+    const teardown = track2(() => {
       el.setAttribute("class", cls());
     });
     registerDisposer(el, teardown);
@@ -7730,7 +7862,7 @@ function applyClass(el, cls) {
       }
       el.setAttribute("class", r);
     };
-    const teardown = track(update);
+    const teardown = track2(update);
     registerDisposer(el, teardown);
   } else {
     el.setAttribute("class", result);
@@ -7787,8 +7919,11 @@ function appendChildren(el, nodes) {
   }
 }
 var tagFactory = (tag, ns) => {
+  const blocked = isBlockedTag(tag);
   return (first, second) => {
-    validateTagName(tag);
+    if (blocked) {
+      throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
     if (first === void 0) return el;
     if (typeof first === "string") {
@@ -7797,7 +7932,7 @@ var tagFactory = (tag, ns) => {
         appendChildren(el, second);
         return el;
       }
-      if (_isDev9 && looksLikeClassList(first)) {
+      if (_isDev10 && looksLikeClassList(first)) {
         devWarn(
           `tagFactory: lone string "${first}" looks like a class list but is being rendered as TEXT. For a class, use ${tag}({ class: "${first}" }) \u2014 or ${tag}("${first}", children) to set the class AND add children.`
         );
@@ -7818,7 +7953,7 @@ var tagFactory = (tag, ns) => {
     if (pClass != null) applyClass(el, pClass);
     const pId = props.id;
     if (pId != null) {
-      if (_isDev9 && typeof pId === "string" && CLOBBER_RISKY_IDS.has(pId.toLowerCase())) {
+      if (_isDev10 && typeof pId === "string" && CLOBBER_RISKY_IDS.has(pId.toLowerCase())) {
         devWarn(
           `tagFactory: element id="${pId}" matches a common global and may cause DOM clobbering. Avoid setting ids from untrusted input.`
         );
@@ -7833,7 +7968,7 @@ var tagFactory = (tag, ns) => {
         const handler = pOn[ev];
         if (typeof handler === "function") {
           el.addEventListener(ev, handler);
-        } else if (_isDev9) {
+        } else if (_isDev10) {
           devWarn(
             `tagFactory: on.${ev} handler is not a function (got ${typeof handler}). Event listener was not attached.`
           );
@@ -7858,7 +7993,6 @@ var tagFactory = (tag, ns) => {
         default: {
           const value = props[key];
           if (value == null) continue;
-          const lkey = key.toLowerCase();
           if (isEventHandlerAttr(key)) continue;
           if (typeof value === "function") {
             registerDisposer(el, bindAttribute(el, key, value));
@@ -7871,14 +8005,7 @@ var tagFactory = (tag, ns) => {
               el.removeAttribute(key);
             }
           } else {
-            const str = String(value);
-            if (lkey === "srcset") {
-              el.setAttribute(key, sanitizeSrcset(str));
-            } else if (isUrlAttribute(lkey)) {
-              el.setAttribute(key, sanitizeUrl(str));
-            } else {
-              el.setAttribute(key, str);
-            }
+            el.setAttribute(key, sanitizeAttributeString(key, String(value)));
           }
         }
       }
@@ -7954,7 +8081,7 @@ var area = tagFactory("area");
 var audio = tagFactory("audio");
 var img = tagFactory("img");
 var map = tagFactory("map");
-var track2 = tagFactory("track");
+var track3 = tagFactory("track");
 var video = tagFactory("video");
 var embed = tagFactory("embed");
 var iframe = tagFactory("iframe");
@@ -9286,18 +9413,18 @@ function clearPerformanceData() {
   perfMarks.clear();
 }
 var trackedCleanups = /* @__PURE__ */ new Map();
-function trackCleanup(component, cleanup2) {
+function trackCleanup(component, cleanup3) {
   if (!trackedCleanups.has(component)) {
     trackedCleanups.set(component, []);
   }
-  trackedCleanups.get(component)?.push(cleanup2);
+  trackedCleanups.get(component)?.push(cleanup3);
 }
 function runCleanups(component) {
   const cleanups = trackedCleanups.get(component);
   if (cleanups) {
-    for (const cleanup2 of cleanups) {
+    for (const cleanup3 of cleanups) {
       try {
-        cleanup2();
+        cleanup3();
       } catch (err) {
         if (typeof console !== "undefined") {
           console.warn("[SibuJS debug] cleanup threw:", err);
@@ -10304,13 +10431,13 @@ function startMeasure(profiler) {
 function getSignalName(getter) {
   return getter.__name;
 }
-function getSubscriberCount2(getter) {
+function getSubscriberCount3(getter) {
   const signal2 = getter.__signal;
   if (!signal2) return 0;
-  return getSubscriberCount(signal2);
+  return getSubscriberCount2(signal2);
 }
 function getDependencies(subscriberFn) {
-  return getSubscriberDeps(subscriberFn);
+  return getSubscriberDeps2(subscriberFn);
 }
 function inspectSignal(getter) {
   const signal2 = getter.__signal;
@@ -10318,7 +10445,7 @@ function inspectSignal(getter) {
   return {
     name: getter.__name,
     signal: signal2,
-    subscriberCount: getSubscriberCount(signal2)
+    subscriberCount: getSubscriberCount2(signal2)
   };
 }
 function walkDependencyGraph(getter, maxDepth = 10, visited = /* @__PURE__ */ new WeakSet()) {
@@ -10328,7 +10455,7 @@ function walkDependencyGraph(getter, maxDepth = 10, visited = /* @__PURE__ */ ne
   }
   visited.add(signal2);
   const downstream = [];
-  forEachSubscriber(signal2, (sub2) => {
+  forEachSubscriber2(signal2, (sub2) => {
     const subSig = sub2._sig;
     if (subSig && !visited.has(subSig)) {
       const subName = subSig.__name;
@@ -10341,7 +10468,7 @@ function walkDependencyGraph(getter, maxDepth = 10, visited = /* @__PURE__ */ ne
   });
   return {
     name: getSignalName(getter),
-    subscribers: getSubscriberCount(signal2),
+    subscribers: getSubscriberCount2(signal2),
     downstream
   };
 }
@@ -10396,11 +10523,17 @@ function watch(getter, callback) {
       return;
     }
     if (!Object.is(newValue, oldValue)) {
-      callback(newValue, oldValue);
+      const prev = oldValue;
       oldValue = newValue;
+      suspendTracking2();
+      try {
+        callback(newValue, prev);
+      } finally {
+        resumeTracking2();
+      }
     }
   };
-  const teardown = track(subscriber);
+  const teardown = track2(subscriber);
   return teardown;
 }