sibujs 3.4.0 → 4.0.0

package/dist/ecosystem.cjs

@@ -53,8 +53,95 @@ function devWarn(message) {
   }
 }
 
+// src/core/errors.ts
+var ERROR_STATE_KEY = /* @__PURE__ */ Symbol.for("sibujs.runtime-errors.v1");
+function state() {
+  const g = globalThis;
+  const existing = g[ERROR_STATE_KEY];
+  if (existing) return existing;
+  const created = { handler: null, handlerDepth: 0 };
+  g[ERROR_STATE_KEY] = created;
+  return created;
+}
+function normalizeError(value) {
+  if (value instanceof Error) return value;
+  const message = typeof value === "string" ? value : `Non-Error value thrown: ${safeStringify(value)}`;
+  return new Error(message, { cause: value });
+}
+function safeStringify(value) {
+  if (typeof value === "symbol") return value.toString();
+  try {
+    return typeof value === "object" && value !== null ? JSON.stringify(value) : String(value);
+  } catch {
+    return Object.prototype.toString.call(value);
+  }
+}
+function describe(context) {
+  return context.name ? `${context.phase} "${context.name}"` : context.phase;
+}
+var REACTIVE_REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
+function untrackedRun(fn) {
+  const api = globalThis[REACTIVE_REGISTRY_KEY];
+  return api?.untracked ? api.untracked(fn) : fn();
+}
+var PROPAGATE_EVENT = "sibu:error-propagate";
+function claimedByBoundary(error, context) {
+  const raw = context.node;
+  if (!raw || typeof CustomEvent === "undefined") return false;
+  const target = resolveEventTarget(raw);
+  if (!target) return false;
+  try {
+    const event = new CustomEvent(PROPAGATE_EVENT, {
+      bubbles: true,
+      cancelable: true,
+      detail: { error, context }
+    });
+    return target.dispatchEvent(event) === false;
+  } catch {
+    return false;
+  }
+}
+function resolveEventTarget(node) {
+  const ELEMENT_NODE = 1;
+  let current = node;
+  while (current) {
+    if (current.nodeType === ELEMENT_NODE && typeof current.dispatchEvent === "function") {
+      return current;
+    }
+    current = current.parentNode;
+  }
+  const self = node;
+  return typeof self.dispatchEvent === "function" ? self : null;
+}
+function defaultReport(error, context) {
+  if (typeof console === "undefined") return;
+  console.error(`[SibuJS] Uncaught error during ${describe(context)}: ${error.message}`, error);
+}
+function reportError(error, context) {
+  const err = normalizeError(error);
+  untrackedRun(() => {
+    if (claimedByBoundary(err, context)) return;
+    const s = state();
+    const handler = s.handler;
+    if (handler && s.handlerDepth === 0) {
+      s.handlerDepth++;
+      try {
+        handler(error instanceof Error ? error : err, context);
+        return;
+      } catch (handlerError) {
+        if (typeof console !== "undefined") {
+          const detail = handlerError instanceof Error ? handlerError.message : String(handlerError);
+          console.error(`[SibuJS] runtime error handler itself threw: ${detail}`, handlerError);
+        }
+      } finally {
+        s.handlerDepth--;
+      }
+    }
+    defaultReport(err, context);
+  });
+}
+
 // src/reactivity/track-core.ts
-var _isDev2 = isDev();
 var POOL_MAX = 4096;
 var nodePool = [];
 function createNode() {
@@ -62,6 +149,7 @@ function createNode() {
     sig: null,
     sub: null,
     epoch: 0,
+    depVersion: 0,
     sigPrev: null,
     sigNext: null,
     subPrev: null,
@@ -146,8 +234,27 @@ function safeInvoke(sub) {
   try {
     sub();
   } catch (err) {
-    if (_isDev2) devWarn(`Subscriber threw during notification: ${err instanceof Error ? err.message : String(err)}`);
+    const s = sub;
+    reportError(err, { phase: s._errorPhase ?? "effect", name: s.__name, node: s._errorNode });
+  }
+}
+function depsChanged(sub) {
+  let node = sub.depsHead ?? null;
+  if (node === null) return true;
+  while (node !== null) {
+    const sig = node.sig;
+    if (sig === null) return true;
+    if (sig._d === true && sig._validate !== void 0) {
+      try {
+        sig._validate();
+      } catch {
+        return true;
+      }
+    }
+    if (node.depVersion !== sig.__v) return true;
+    node = node.subNext;
   }
+  return false;
 }
 var suspendDepth = 0;
 var trackingSuspended = false;
@@ -229,7 +336,7 @@ function track(effectFn, subscriber) {
   const sub = subscriber;
   return sub._dispose ?? (sub._dispose = () => cleanup(subscriber));
 }
-function reactiveBinding(commit) {
+function reactiveBinding(commit, ownerNode) {
   const run = () => {
     const s = subscriber;
     if (s._disposed || s._reentrant) return;
@@ -245,13 +352,17 @@ function reactiveBinding(commit) {
   subscriber.depsTail = null;
   subscriber._epoch = 0;
   subscriber._structDirty = false;
+  subscriber._hasComputedDep = false;
   subscriber._runEpoch = 0;
   subscriber._runs = 0;
   subscriber._reentrant = false;
   subscriber._disposed = false;
+  subscriber._errorPhase = "binding";
+  subscriber._errorNode = ownerNode;
   run();
   return subscriber._dispose ?? (subscriber._dispose = () => {
     subscriber._disposed = true;
+    subscriber._errorNode = void 0;
     cleanup(subscriber);
   });
 }
@@ -263,9 +374,12 @@ function recordDependency(signal2) {
   const active = sig.__activeNode ?? null;
   if (active !== null && active.sub === sub) {
     active.epoch = epoch;
+    active.depVersion = sig.__v ?? Number.NaN;
     return;
   }
+  if (sig._validate !== void 0) sub._hasComputedDep = true;
   const node = allocNode(signal2, sub, epoch);
+  node.depVersion = sig.__v ?? Number.NaN;
   node.prevActive = active;
   sig.__activeNode = node;
   linkSub(sub, node);
@@ -284,9 +398,10 @@ function cleanup(subscriber) {
     node = next;
   }
 }
-var maxSubscriberRepeats = 50;
+var maxSubscriberRepeats = 1e3;
 var maxDrainIterations = 1e6;
 var drainEpoch = 0;
+var quarantined = /* @__PURE__ */ new Set();
 function setMaxSubscriberRepeats(n) {
   const prev = maxSubscriberRepeats;
   if (Number.isFinite(n) && n > 0) maxSubscriberRepeats = Math.floor(n);
@@ -308,19 +423,21 @@ function tickRepeat(sub) {
   return s._runs > maxSubscriberRepeats;
 }
 function cycleError(sub) {
-  if (typeof console !== "undefined") {
-    const name = sub.__name ?? "<unnamed>";
-    console.error(
-      `[SibuJS] subscriber "${name}" fired more than ${maxSubscriberRepeats} times \u2014 likely a write-reads-self cycle between effects/signals. Breaking to prevent infinite loop.`
-    );
-  }
+  const name = sub.__name ?? "<unnamed>";
+  reportError(
+    new Error(
+      `subscriber "${name}" fired more than ${maxSubscriberRepeats} times \u2014 likely a write-reads-self cycle between effects/signals. This subscriber is quarantined for the rest of this update; other pending work still runs.`
+    ),
+    { phase: "scheduler", name }
+  );
 }
 function absoluteDrainError() {
-  if (typeof console !== "undefined") {
-    console.error(
-      `[SibuJS] Notification drain exceeded ${maxDrainIterations} iterations \u2014 absolute safety net tripped. Breaking to prevent infinite loop.`
-    );
-  }
+  reportError(
+    new Error(
+      `Notification drain exceeded ${maxDrainIterations} iterations \u2014 absolute safety net tripped. Breaking to prevent infinite loop.`
+    ),
+    { phase: "scheduler" }
+  );
 }
 function drainQueue() {
   let i = 0;
@@ -330,11 +447,14 @@ function drainQueue() {
       break;
     }
     const sub = pendingQueue[i++];
+    pendingSet.delete(sub);
+    if (quarantined.size > 0 && quarantined.has(sub)) continue;
+    if (sub._hasComputedDep === true && !depsChanged(sub)) continue;
     if (tickRepeat(sub)) {
       cycleError(sub);
-      break;
+      quarantined.add(sub);
+      continue;
     }
-    pendingSet.delete(sub);
     safeInvoke(sub);
   }
 }
@@ -349,6 +469,7 @@ function drainNotificationQueue() {
     if (notifyDepth === 0) {
       pendingQueue.length = 0;
       pendingSet.clear();
+      if (quarantined.size > 0) quarantined.clear();
     }
   }
 }
@@ -442,6 +563,7 @@ function notifySubscribers(signal2) {
     if (notifyDepth === 0) {
       pendingQueue.length = 0;
       pendingSet.clear();
+      if (quarantined.size > 0) quarantined.clear();
     }
   }
 }
@@ -468,14 +590,14 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _isDev3 = isDev();
-var _runtimeVersion = true ? "3.4.0" : "dev";
+var _isDev2 = isDev();
+var _runtimeVersion = true ? "4.0.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
   const existing = g[REGISTRY_KEY];
   if (existing) {
-    if (_isDev3 && !existing.__dupWarned) {
+    if (_isDev2 && !existing.__dupWarned) {
       existing.__dupWarned = true;
       devWarn(
         `Multiple instances of the reactive runtime detected on this page (active: ${existing.version}, duplicate: ${_runtimeVersion}). Reactivity still works \u2014 all copies share the first one \u2014 but de-duplicate sibujs in your bundler (e.g. Vite optimizeDeps.exclude: ['sibujs'] or resolve.dedupe: ['sibujs']).`
@@ -535,20 +657,24 @@ function detectSSRShared() {
       const getBuiltin = process.getBuiltinModule;
       if (typeof getBuiltin === "function") {
         mod = getBuiltin("node:async_hooks");
-      } else {
-        const req = Function("return typeof require==='function'?require:null")();
-        if (req) mod = req("node:async_hooks");
+      } else if (typeof require === "function") {
+        mod = require("async_hooks");
       }
       if (mod) detected = new mod.AsyncLocalStorage();
     }
   } catch {
     detected = null;
   }
-  return { als: detected, fallbackStore: { ssr: false, suspenseIdCounter: 0 } };
+  return {
+    als: detected,
+    fallbackStore: { ssr: false, suspenseIdCounter: 0, locale: void 0 },
+    fallbackDepth: 0
+  };
 }
 var _shared = globalThis[SSR_KEY] ?? (globalThis[SSR_KEY] = detectSSRShared());
 var als = _shared.als;
 var fallbackStore = _shared.fallbackStore;
+_shared.fallbackDepth ?? (_shared.fallbackDepth = 0);
 function getSSRStore() {
   if (als) {
     const s = als.getStore();
@@ -571,7 +697,7 @@ function flushUserCleanups(ctx) {
     try {
       list[i]();
     } catch (err) {
-      if (typeof console !== "undefined") console.warn("[SibuJS effect] onCleanup threw:", err);
+      reportError(err, { phase: "cleanup" });
     }
   }
 }
@@ -584,11 +710,12 @@ function drainReruns(ctx) {
   } while (ctx.rerunPending && ++reruns <= MAX_RERUNS);
   if (ctx.rerunPending) {
     ctx.rerunPending = false;
-    if (_g.__SIBU_DEV_WARN__ !== false && typeof console !== "undefined") {
-      console.error(
-        `[SibuJS] effect re-requested itself ${MAX_RERUNS}+ times \u2014 likely a write-reads-self cycle. Breaking to prevent infinite loop.`
-      );
-    }
+    reportError(
+      new Error(
+        `effect re-requested itself ${MAX_RERUNS}+ times \u2014 likely a write-reads-self cycle. Breaking to prevent infinite loop.`
+      ),
+      { phase: "effect" }
+    );
   }
 }
 function disposeEffect(ctx) {
@@ -665,6 +792,8 @@ function effect(effectFn, options) {
   sub.depsTail = null;
   sub._epoch = 0;
   sub._structDirty = false;
+  sub._hasComputedDep = false;
+  sub._errorPhase = "effect";
   sub._runEpoch = 0;
   sub._runs = 0;
   ctx.subscriber = sub;
@@ -733,70 +862,72 @@ var isBatching = API2.isBatching;
 
 // src/core/signals/signal.ts
 var _g2 = globalThis;
-var _isDev4 = isDev();
+var _isDev3 = isDev();
 function signal(initial, options) {
-  const state = {
+  const state2 = {
     value: initial,
     __v: 0,
     __sc: 0,
     subsHead: null,
     subsTail: null,
     __activeNode: null,
-    __name: void 0
+    __name: void 0,
+    _d: false,
+    _validate: void 0
   };
-  const debugName = _isDev4 ? options?.name : void 0;
+  const debugName = _isDev3 ? options?.name : void 0;
   const equalsFn = options?.equals;
-  if (debugName) state.__name = debugName;
+  if (debugName) state2.__name = debugName;
   function get() {
-    recordDependency2(state);
-    return state.value;
+    recordDependency2(state2);
+    return state2.value;
   }
-  get.__signal = state;
+  get.__signal = state2;
   if (debugName) get.__name = debugName;
   let set;
   if (equalsFn) {
     set = (next) => {
-      const prev = state.value;
+      const prev = state2.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (equalsFn(prev, newValue)) return;
-      state.value = newValue;
-      state.__v++;
-      if (_isDev4) {
+      state2.value = newValue;
+      state2.__v++;
+      if (_isDev3) {
         const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-        if (hook) hook.emit("signal:update", { signal: state, name: debugName, oldValue: prev, newValue });
+        if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       }
-      if (!enqueueBatchedSignal(state)) {
-        notifySubscribers2(state);
+      if (!enqueueBatchedSignal(state2)) {
+        notifySubscribers2(state2);
       }
     };
-  } else if (_isDev4) {
+  } else if (_isDev3) {
     set = (next) => {
-      const prev = state.value;
+      const prev = state2.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (Object.is(newValue, prev)) return;
-      state.value = newValue;
-      state.__v++;
+      state2.value = newValue;
+      state2.__v++;
       const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-      if (hook) hook.emit("signal:update", { signal: state, name: debugName, oldValue: prev, newValue });
-      if (!enqueueBatchedSignal(state)) {
-        notifySubscribers2(state);
+      if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+      if (!enqueueBatchedSignal(state2)) {
+        notifySubscribers2(state2);
       }
     };
   } else {
     set = (next) => {
-      const prev = state.value;
+      const prev = state2.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (Object.is(newValue, prev)) return;
-      state.value = newValue;
-      state.__v++;
-      if (!enqueueBatchedSignal(state)) {
-        notifySubscribers2(state);
+      state2.value = newValue;
+      state2.__v++;
+      if (!enqueueBatchedSignal(state2)) {
+        notifySubscribers2(state2);
       }
     };
   }
-  if (_isDev4) {
+  if (_isDev3) {
     const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (hook) hook.emit("signal:create", { signal: state, name: debugName, getter: get, initial });
+    if (hook) hook.emit("signal:create", { signal: state2, name: debugName, getter: get, initial });
   }
   return [get, set];
 }
@@ -975,6 +1106,21 @@ function derived(getter, options) {
   }, markDirty);
   const hook = globalThis.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
   let evaluating = false;
+  const validate = () => {
+    if (!cs._d) return;
+    const oldValue = cs._v;
+    evaluating = true;
+    try {
+      retrack2(recompute, markDirty);
+      if (!Object.is(oldValue, cs._v)) cs.__v++;
+    } finally {
+      evaluating = false;
+    }
+    if (hook && !Object.is(oldValue, cs._v)) {
+      hook.emit("computed:update", { signal: cs, oldValue, newValue: cs._v });
+    }
+  };
+  cs._validate = validate;
   function computedGetter() {
     if (evaluating) {
       throw new Error(
@@ -982,32 +1128,11 @@ function derived(getter, options) {
       );
     }
     if (isTrackingSuspended2()) {
-      if (cs._d) {
-        const prev = cs._v;
-        evaluating = true;
-        try {
-          retrack2(recompute, markDirty);
-          if (!Object.is(prev, cs._v)) cs.__v++;
-        } finally {
-          evaluating = false;
-        }
-      }
+      if (cs._d) validate();
       return cs._v;
     }
+    if (cs._d) validate();
     recordDependency2(cs);
-    if (cs._d) {
-      const oldValue = cs._v;
-      evaluating = true;
-      try {
-        retrack2(recompute, markDirty);
-        if (!Object.is(oldValue, cs._v)) cs.__v++;
-      } finally {
-        evaluating = false;
-      }
-      if (hook && oldValue !== cs._v) {
-        hook.emit("computed:update", { signal: cs, oldValue, newValue: cs._v });
-      }
-    }
     return cs._v;
   }
   if (debugName) {
@@ -1047,9 +1172,9 @@ function zustandAdapter(options) {
   return createPlugin("sibu-zustand", (ctx) => {
     const { store } = options;
     const [getState, setSibuState] = signal(store.getState());
-    const unsubscribe = store.subscribe((state) => {
+    const unsubscribe = store.subscribe((state2) => {
       batch(() => {
-        setSibuState(state);
+        setSibuState(state2);
       });
     });
     function select(selector) {
@@ -1078,10 +1203,12 @@ function isEventHandlerAttr(name) {
   return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
 }
 var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+var OUTER_TRIM = /^[\x00-\x20\x7f-\x9f]+|[\x00-\x20\x7f-\x9f]+$/g;
 function sanitizeUrl(url) {
-  const trimmed = stripControlChars(url).trim();
-  if (!trimmed) return "";
-  const lower = trimmed.toLowerCase();
+  const probe = stripControlChars(url).trim();
+  if (!probe) return "";
+  const output = url.replace(OUTER_TRIM, "");
+  const lower = probe.toLowerCase();
   let schemeEnd = -1;
   for (let i = 0; i < lower.length; i++) {
     const ch = lower.charCodeAt(i);
@@ -1091,12 +1218,13 @@ function sanitizeUrl(url) {
     }
     if (ch === 47 || ch === 63 || ch === 35) break;
   }
-  if (schemeEnd === -1) return trimmed;
+  if (schemeEnd === -1) return output;
   const scheme = lower.slice(0, schemeEnd + 1);
-  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return trimmed;
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return output;
   if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
-  return trimmed;
+  return output;
 }
+var SRCSET_DESCRIPTOR = /^\s+\d+(\.\d+)?[wx]$/;
 function sanitizeSrcset(value) {
   const parts = value.split(",");
   const out = [];
@@ -1105,6 +1233,7 @@ function sanitizeSrcset(value) {
     if (!part) continue;
     const m = part.match(/^(\S+)(\s+.+)?$/);
     if (!m) continue;
+    if (m[2] !== void 0 && !SRCSET_DESCRIPTOR.test(m[2])) continue;
     const safe = sanitizeUrl(m[1]);
     if (!safe) continue;
     out.push(m[2] ? `${safe}${m[2]}` : safe);
@@ -1112,23 +1241,83 @@ function sanitizeSrcset(value) {
   return out.join(", ");
 }
 var CSS_DANGER_GATE = /[(:@\\]/;
+function isCssWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
+function isHexDigit(ch) {
+  return ch >= "0" && ch <= "9" || ch >= "a" && ch <= "f" || ch >= "A" && ch <= "F";
+}
+function decodeCssEscapes(value) {
+  let out = "";
+  for (let i = 0; i < value.length; i++) {
+    const ch = value[i];
+    if (ch !== "\\") {
+      out += ch;
+      continue;
+    }
+    if (i + 1 >= value.length) break;
+    const next = value[i + 1];
+    if (next === "\n" || next === "\f") {
+      i += 1;
+      continue;
+    }
+    if (next === "\r") {
+      i += value[i + 2] === "\n" ? 2 : 1;
+      continue;
+    }
+    if (isHexDigit(next)) {
+      let hex = "";
+      let j = i + 1;
+      while (j < value.length && hex.length < 6 && isHexDigit(value[j])) {
+        hex += value[j];
+        j++;
+      }
+      if (j < value.length && isCssWhitespace(value[j])) {
+        j += value[j] === "\r" && value[j + 1] === "\n" ? 2 : 1;
+      }
+      const code = Number.parseInt(hex, 16);
+      const invalid = code === 0 || code > 1114111 || code >= 55296 && code <= 57343;
+      out += invalid ? "\uFFFD" : String.fromCodePoint(code);
+      i = j - 1;
+      continue;
+    }
+    out += next;
+    i += 1;
+  }
+  return out;
+}
 function sanitizeCSSValue(value) {
   if (!CSS_DANGER_GATE.test(value)) return value;
-  const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
-    const code = Number.parseInt(hex, 16);
-    if (!Number.isFinite(code) || code < 0 || code > 1114111) return "";
-    try {
-      return String.fromCodePoint(code);
-    } catch {
-      return "";
-    }
-  });
-  const lower = decoded.toLowerCase().replace(/\s+/g, "");
+  const normalized = value.includes("\\") ? decodeCssEscapes(value) : value;
+  const lower = normalized.toLowerCase().replace(/\s+/g, "");
   if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("vbscript:") || lower.includes("-moz-binding") || lower.includes("behavior:") || lower.includes("@import") || lower.includes("image-set(") || lower.includes("filter:progid")) {
     return "";
   }
   return value;
 }
+function sanitizeStyleAttribute(cssText) {
+  const input = String(cssText);
+  if (input.trim() === "") return "";
+  if (typeof document === "undefined") {
+    return sanitizeCSSValue(input) === "" ? "" : input;
+  }
+  const probe = document.createElement("div");
+  try {
+    probe.style.cssText = input;
+  } catch {
+    return "";
+  }
+  const declarations = [];
+  for (let i = 0; i < probe.style.length; i++) {
+    const property = probe.style[i];
+    const value = probe.style.getPropertyValue(property);
+    if (sanitizeCSSValue(value) === "") continue;
+    if (sanitizeCSSValue(`${property}:${value}`) === "") continue;
+    const priority = probe.style.getPropertyPriority(property);
+    declarations.push(`${property}: ${value}${priority ? ` !${priority}` : ""}`);
+  }
+  return declarations.join("; ");
+}
 var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "href",
   "xlink:href",
@@ -1141,26 +1330,104 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "background",
   "srcset",
   "ping",
-  "data"
+  "data",
+  // `<html manifest>` is a URL sink too. It was carried only by the SSR
+  // serializers' private copy of this set; folding that copy into this one would
+  // otherwise have silently dropped its coverage.
+  "manifest"
 ]);
+var HTML_CONTENT_ATTRIBUTES = /* @__PURE__ */ new Set(["srcdoc"]);
+function isHtmlContentAttribute(name) {
+  return HTML_CONTENT_ATTRIBUTES.has(name.toLowerCase());
+}
 function sanitizeAttributeString(attr, value) {
   const lower = attr.toLowerCase();
   if (lower === "srcset") return sanitizeSrcset(value);
   if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  if (lower === "style") return sanitizeStyleAttribute(value);
   return value;
 }
 
-// src/reactivity/bindAttribute.ts
-var _isDev5 = isDev();
+// src/utils/setSafeAttribute.ts
+var _isDev4 = isDev();
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+var SVG_NS = "http://www.w3.org/2000/svg";
+var XLINK_NS = "http://www.w3.org/1999/xlink";
+var XML_NS = "http://www.w3.org/XML/1998/namespace";
+var BOOLEAN_IDL_ATTRS = /* @__PURE__ */ new Set(["checked", "disabled", "selected"]);
+function isHtmlElement(el) {
+  return el.namespaceURI === null || el.namespaceURI === HTML_NS;
+}
 function setProp(el, key, val) {
   el[key] = val;
 }
-function bindAttribute(el, attr, getter) {
-  if (isEventHandlerAttr(attr)) {
-    if (_isDev5)
+function namespaceFor(el, name) {
+  if (el.namespaceURI !== SVG_NS) return null;
+  const lower = name.toLowerCase();
+  if (lower.startsWith("xlink:")) return XLINK_NS;
+  if (lower.startsWith("xml:")) return XML_NS;
+  return null;
+}
+function setSafeAttribute(el, name, value, options = {}) {
+  const ns = namespaceFor(el, name);
+  const localName = ns ? name.slice(name.indexOf(":") + 1) : name;
+  if (isEventHandlerAttr(name)) {
+    if (_isDev4) {
+      devWarn(
+        `${options.label ?? "setSafeAttribute"}: refusing to set event-handler attribute "${name}". Its value would be evaluated as JavaScript. Use on:{ ${name.slice(2)}: fn } instead.`
+      );
+    }
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return false;
+  }
+  if (value == null) {
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return true;
+  }
+  if (isHtmlContentAttribute(name)) {
+    if (_isDev4) {
       devWarn(
-        `bindAttribute: refusing to bind event-handler attribute "${attr}". Use on:{ ${attr.slice(2)}: fn } instead.`
+        `${options.label ?? "setSafeAttribute"}: refusing to set "${name}". The browser parses this attribute as a nested HTML document, so a generic string value cannot be made safe \u2014 attribute escaping is undone before the parse. Build the frame's content another way.`
       );
+    }
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return false;
+  }
+  const html = isHtmlElement(el);
+  const idlName = html ? name.toLowerCase() : name;
+  if (typeof value === "boolean") {
+    if (html && BOOLEAN_IDL_ATTRS.has(idlName) && idlName in el) {
+      setProp(el, idlName, value);
+    } else if (value) {
+      if (ns) el.setAttributeNS(ns, name, "");
+      else el.setAttribute(name, "");
+    } else if (ns) {
+      el.removeAttributeNS(ns, localName);
+    } else {
+      el.removeAttribute(name);
+    }
+    return true;
+  }
+  const str = String(value);
+  if (options.syncValueProperty !== false && html && (idlName === "value" || idlName === "checked") && idlName in el) {
+    setProp(el, idlName, idlName === "checked" ? Boolean(value) : str);
+    return true;
+  }
+  const safe = sanitizeAttributeString(name, str);
+  const current = ns ? el.getAttributeNS(ns, localName) : el.getAttribute(name);
+  if (current === safe) return true;
+  if (ns) el.setAttributeNS(ns, name, safe);
+  else el.setAttribute(name, safe);
+  return true;
+}
+
+// src/reactivity/bindAttribute.ts
+function bindAttribute(el, attr, getter) {
+  if (isEventHandlerAttr(attr)) {
+    setSafeAttribute(el, attr, "", { label: `bindAttribute("${attr}")` });
     return () => {
     };
   }
@@ -1169,33 +1436,25 @@ function bindAttribute(el, attr, getter) {
     try {
       value = getter();
     } catch (err) {
-      if (_isDev5)
-        devWarn(`bindAttribute: getter for "${attr}" threw: ${err instanceof Error ? err.message : String(err)}`);
-      return;
-    }
-    if (typeof value === "boolean") {
-      if (attr in el && (attr === "checked" || attr === "disabled" || attr === "selected")) {
-        setProp(el, attr, value);
-      } else if (value) {
-        el.setAttribute(attr, "");
-      } else {
-        el.removeAttribute(attr);
-      }
+      reportError(err, { phase: "binding", name: `bindAttribute("${attr}")`, node: el });
       return;
     }
-    const str = String(value);
-    if ((attr === "value" || attr === "checked") && attr in el) {
-      setProp(el, attr, attr === "checked" ? Boolean(value) : str);
-    } else {
-      el.setAttribute(attr, sanitizeAttributeString(attr, str));
-    }
+    setSafeAttribute(el, attr, value, { label: `bindAttribute("${attr}")` });
   }
-  return reactiveBinding2(commit);
+  return reactiveBinding2(commit, el);
 }
 
 // src/core/rendering/dispose.ts
 var elementDisposers = /* @__PURE__ */ new WeakMap();
-var _isDev6 = isDev();
+var MAX_DRAIN_TEARDOWNS = 1e4;
+function reportDrainRunaway(label, executed, remaining) {
+  if (typeof console === "undefined") return;
+  console.error(
+    `[SibuJS ${label}] runaway cleanup: stopped after running ${executed} teardowns with ${remaining} still queued. Cleanup production did not stabilize before the teardown safety ceiling was reached \u2014 the remaining work was NOT run.`,
+    { executed, remaining }
+  );
+}
+var _isDev5 = isDev();
 var activeBindingCount = 0;
 function registerDisposer(node, teardown) {
   let disposers = elementDisposers.get(node);
@@ -1204,7 +1463,7 @@ function registerDisposer(node, teardown) {
     elementDisposers.set(node, disposers);
   }
   disposers.push(teardown);
-  if (_isDev6) activeBindingCount++;
+  if (_isDev5) activeBindingCount++;
 }
 function dispose(node) {
   const stack = [node];
@@ -1219,34 +1478,30 @@ function dispose(node) {
   }
   for (let i = order.length - 1; i >= 0; i--) {
     const current = order[i];
-    const disposers = elementDisposers.get(current);
-    if (disposers) {
-      const snapshot = disposers.slice();
-      elementDisposers.delete(current);
-      if (_isDev6) activeBindingCount -= snapshot.length;
-      for (const d of snapshot) {
-        try {
-          d();
-        } catch (err) {
-          if (_isDev6 && typeof console !== "undefined") {
-            console.warn("[SibuJS] Disposer threw during cleanup:", err);
-          }
-        }
-      }
-      let extraPasses = 0;
-      while (extraPasses++ < 8) {
-        const added = elementDisposers.get(current);
-        if (!added || added.length === 0) break;
-        const moreSnapshot = added.slice();
+    if (elementDisposers.has(current)) {
+      let executed = 0;
+      let runaway = false;
+      while (!runaway) {
+        const pending = elementDisposers.get(current);
+        if (!pending || pending.length === 0) break;
+        const snapshot = pending.slice();
         elementDisposers.delete(current);
-        if (_isDev6) activeBindingCount -= moreSnapshot.length;
-        for (const d of moreSnapshot) {
+        if (_isDev5) activeBindingCount -= snapshot.length;
+        for (let i2 = 0; i2 < snapshot.length; i2++) {
+          if (executed >= MAX_DRAIN_TEARDOWNS) {
+            const rest = snapshot.slice(i2);
+            const added = elementDisposers.get(current);
+            elementDisposers.set(current, added ? rest.concat(added) : rest);
+            if (_isDev5) activeBindingCount += rest.length;
+            reportDrainRunaway("dispose", executed, rest.length + (added?.length ?? 0));
+            runaway = true;
+            break;
+          }
+          executed++;
           try {
-            d();
+            snapshot[i2]();
           } catch (err) {
-            if (_isDev6 && typeof console !== "undefined") {
-              console.warn("[SibuJS] Disposer threw during cleanup:", err);
-            }
+            reportError(err, { phase: "cleanup", name: "disposer" });
           }
         }
       }
@@ -1255,7 +1510,7 @@ function dispose(node) {
 }
 
 // src/reactivity/bindChildNode.ts
-var _isDev7 = isDev();
+var _isDev6 = isDev();
 function bindChildNode(placeholder, getter) {
   let lastNodes = [];
   function commit() {
@@ -1263,7 +1518,7 @@ function bindChildNode(placeholder, getter) {
     try {
       result = getter();
     } catch (err) {
-      if (_isDev7) devWarn(`bindChildNode: getter threw: ${err instanceof Error ? err.message : String(err)}`);
+      reportError(err, { phase: "binding", name: "bindChildNode", node: placeholder });
       return;
     }
     if (result == null || typeof result === "boolean") {
@@ -1289,7 +1544,7 @@ function bindChildNode(placeholder, getter) {
         if (item == null || typeof item === "boolean") continue;
         const node = item instanceof Node ? item : document.createTextNode(String(item));
         if (seen.has(node)) {
-          if (_isDev7)
+          if (_isDev6)
             devWarn("bindChildNode: duplicate node reference in array \u2014 only the first occurrence is rendered.");
           continue;
         }
@@ -1324,11 +1579,11 @@ function bindChildNode(placeholder, getter) {
     }
     lastNodes = newNodes;
   }
-  return reactiveBinding2(commit);
+  return reactiveBinding2(commit, placeholder);
 }
 
 // src/core/rendering/tagFactory.ts
-var _isDev8 = isDev();
+var _isDev7 = isDev();
 var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
 function isBlockedTag(tag) {
   return BLOCKED_TAGS.has(tag.toLowerCase());
@@ -1346,9 +1601,6 @@ var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "self",
   "frames"
 ]);
-function setProp2(el, key, val) {
-  el[key] = val;
-}
 function looksLikeClassList(s) {
   const t = s.trim();
   if (!t) return false;
@@ -1372,13 +1624,13 @@ function toKebab(prop) {
 function applyStyle(el, style) {
   if (typeof style === "function") {
     const teardown = track2(() => {
-      el.setAttribute("style", style());
+      el.setAttribute("style", sanitizeStyleAttribute(String(style())));
     });
     registerDisposer(el, teardown);
     return;
   }
   if (typeof style === "string") {
-    el.setAttribute("style", style);
+    el.setAttribute("style", sanitizeStyleAttribute(style));
     return;
   }
   const htmlEl = el;
@@ -1499,7 +1751,7 @@ var tagFactory = (tag, ns) => {
         appendChildren(el, second);
         return el;
       }
-      if (_isDev8 && looksLikeClassList(first)) {
+      if (_isDev7 && looksLikeClassList(first)) {
         devWarn(
           `tagFactory: lone string "${first}" looks like a class list but is being rendered as TEXT. For a class, use ${tag}({ class: "${first}" }) \u2014 or ${tag}("${first}", children) to set the class AND add children.`
         );
@@ -1520,7 +1772,7 @@ var tagFactory = (tag, ns) => {
     if (pClass != null) applyClass(el, pClass);
     const pId = props.id;
     if (pId != null) {
-      if (_isDev8 && typeof pId === "string" && CLOBBER_RISKY_IDS.has(pId.toLowerCase())) {
+      if (_isDev7 && typeof pId === "string" && CLOBBER_RISKY_IDS.has(pId.toLowerCase())) {
         devWarn(
           `tagFactory: element id="${pId}" matches a common global and may cause DOM clobbering. Avoid setting ids from untrusted input.`
         );
@@ -1535,7 +1787,7 @@ var tagFactory = (tag, ns) => {
         const handler = pOn[ev];
         if (typeof handler === "function") {
           el.addEventListener(ev, handler);
-        } else if (_isDev8) {
+        } else if (_isDev7) {
           devWarn(
             `tagFactory: on.${ev} handler is not a function (got ${typeof handler}). Event listener was not attached.`
           );
@@ -1563,16 +1815,8 @@ var tagFactory = (tag, ns) => {
           if (isEventHandlerAttr(key)) continue;
           if (typeof value === "function") {
             registerDisposer(el, bindAttribute(el, key, value));
-          } else if (typeof value === "boolean") {
-            if (key in el && (key === "checked" || key === "disabled" || key === "selected")) {
-              setProp2(el, key, value);
-            } else if (value) {
-              el.setAttribute(key, "");
-            } else {
-              el.removeAttribute(key);
-            }
           } else {
-            el.setAttribute(key, sanitizeAttributeString(key, String(value)));
+            setSafeAttribute(el, key, value, { syncValueProperty: false, label: "tagFactory" });
           }
         }
       }