sibujs 3.4.0 → 4.0.0

package/dist/ssr.cjs

@@ -43,6 +43,7 @@ __export(ssr_exports, {
   island: () => island,
   loadRemoteModule: () => loadRemoteModule,
   loadWasmModule: () => loadWasmModule,
+  loadWasmModuleWithOptions: () => loadWasmModuleWithOptions,
   preloadWasm: () => preloadWasm,
   renderToDocument: () => renderToDocument,
   renderToReadableStream: () => renderToReadableStream,
@@ -86,6 +87,170 @@ function devWarn(message) {
   }
 }
 
+// src/core/errors.ts
+var ERROR_STATE_KEY = /* @__PURE__ */ Symbol.for("sibujs.runtime-errors.v1");
+function state() {
+  const g2 = globalThis;
+  const existing = g2[ERROR_STATE_KEY];
+  if (existing) return existing;
+  const created = { handler: null, handlerDepth: 0 };
+  g2[ERROR_STATE_KEY] = created;
+  return created;
+}
+function normalizeError(value) {
+  if (value instanceof Error) return value;
+  const message = typeof value === "string" ? value : `Non-Error value thrown: ${safeStringify(value)}`;
+  return new Error(message, { cause: value });
+}
+function safeStringify(value) {
+  if (typeof value === "symbol") return value.toString();
+  try {
+    return typeof value === "object" && value !== null ? JSON.stringify(value) : String(value);
+  } catch {
+    return Object.prototype.toString.call(value);
+  }
+}
+function describe(context) {
+  return context.name ? `${context.phase} "${context.name}"` : context.phase;
+}
+var REACTIVE_REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
+function untrackedRun(fn) {
+  const api = globalThis[REACTIVE_REGISTRY_KEY];
+  return api?.untracked ? api.untracked(fn) : fn();
+}
+var PROPAGATE_EVENT = "sibu:error-propagate";
+function claimedByBoundary(error, context) {
+  const raw = context.node;
+  if (!raw || typeof CustomEvent === "undefined") return false;
+  const target = resolveEventTarget(raw);
+  if (!target) return false;
+  try {
+    const event = new CustomEvent(PROPAGATE_EVENT, {
+      bubbles: true,
+      cancelable: true,
+      detail: { error, context }
+    });
+    return target.dispatchEvent(event) === false;
+  } catch {
+    return false;
+  }
+}
+function resolveEventTarget(node) {
+  const ELEMENT_NODE = 1;
+  let current = node;
+  while (current) {
+    if (current.nodeType === ELEMENT_NODE && typeof current.dispatchEvent === "function") {
+      return current;
+    }
+    current = current.parentNode;
+  }
+  const self = node;
+  return typeof self.dispatchEvent === "function" ? self : null;
+}
+function defaultReport(error, context) {
+  if (typeof console === "undefined") return;
+  console.error(`[SibuJS] Uncaught error during ${describe(context)}: ${error.message}`, error);
+}
+function reportError(error, context) {
+  const err = normalizeError(error);
+  untrackedRun(() => {
+    if (claimedByBoundary(err, context)) return;
+    const s2 = state();
+    const handler = s2.handler;
+    if (handler && s2.handlerDepth === 0) {
+      s2.handlerDepth++;
+      try {
+        handler(error instanceof Error ? error : err, context);
+        return;
+      } catch (handlerError) {
+        if (typeof console !== "undefined") {
+          const detail = handlerError instanceof Error ? handlerError.message : String(handlerError);
+          console.error(`[SibuJS] runtime error handler itself threw: ${detail}`, handlerError);
+        }
+      } finally {
+        s2.handlerDepth--;
+      }
+    }
+    defaultReport(err, context);
+  });
+}
+
+// src/core/rendering/dispose.ts
+var elementDisposers = /* @__PURE__ */ new WeakMap();
+var MAX_DRAIN_TEARDOWNS = 1e4;
+function reportDrainRunaway(label2, executed, remaining) {
+  if (typeof console === "undefined") return;
+  console.error(
+    `[SibuJS ${label2}] runaway cleanup: stopped after running ${executed} teardowns with ${remaining} still queued. Cleanup production did not stabilize before the teardown safety ceiling was reached \u2014 the remaining work was NOT run.`,
+    { executed, remaining }
+  );
+}
+var _isDev2 = isDev();
+var activeBindingCount = 0;
+function registerDisposer(node, teardown) {
+  let disposers = elementDisposers.get(node);
+  if (!disposers) {
+    disposers = [];
+    elementDisposers.set(node, disposers);
+  }
+  disposers.push(teardown);
+  if (_isDev2) activeBindingCount++;
+}
+function dispose(node) {
+  const stack = [node];
+  const order = [];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    order.push(current);
+    const children = Array.from(current.childNodes);
+    for (let i2 = 0; i2 < children.length; i2++) {
+      stack.push(children[i2]);
+    }
+  }
+  for (let i2 = order.length - 1; i2 >= 0; i2--) {
+    const current = order[i2];
+    if (elementDisposers.has(current)) {
+      let executed = 0;
+      let runaway = false;
+      while (!runaway) {
+        const pending = elementDisposers.get(current);
+        if (!pending || pending.length === 0) break;
+        const snapshot = pending.slice();
+        elementDisposers.delete(current);
+        if (_isDev2) activeBindingCount -= snapshot.length;
+        for (let i3 = 0; i3 < snapshot.length; i3++) {
+          if (executed >= MAX_DRAIN_TEARDOWNS) {
+            const rest = snapshot.slice(i3);
+            const added = elementDisposers.get(current);
+            elementDisposers.set(current, added ? rest.concat(added) : rest);
+            if (_isDev2) activeBindingCount += rest.length;
+            reportDrainRunaway("dispose", executed, rest.length + (added?.length ?? 0));
+            runaway = true;
+            break;
+          }
+          executed++;
+          try {
+            snapshot[i3]();
+          } catch (err) {
+            reportError(err, { phase: "cleanup", name: "disposer" });
+          }
+        }
+      }
+    }
+  }
+}
+function replaceChildrenSafely(parent, ...next) {
+  for (let i2 = 0; i2 < next.length; i2++) {
+    const node = next[i2];
+    node.parentNode?.removeChild(node);
+  }
+  const current = Array.from(parent.childNodes);
+  for (let i2 = 0; i2 < current.length; i2++) {
+    dispose(current[i2]);
+  }
+  parent.replaceChildren(...next);
+}
+
 // src/core/ssr-context.ts
 var SSR_KEY = /* @__PURE__ */ Symbol.for("sibujs.ssr.v1");
 function detectSSRShared() {
@@ -96,20 +261,24 @@ function detectSSRShared() {
       const getBuiltin = process.getBuiltinModule;
       if (typeof getBuiltin === "function") {
         mod = getBuiltin("node:async_hooks");
-      } else {
-        const req = Function("return typeof require==='function'?require:null")();
-        if (req) mod = req("node:async_hooks");
+      } else if (typeof require === "function") {
+        mod = require("async_hooks");
       }
       if (mod) detected = new mod.AsyncLocalStorage();
     }
   } catch {
     detected = null;
   }
-  return { als: detected, fallbackStore: { ssr: false, suspenseIdCounter: 0 } };
+  return {
+    als: detected,
+    fallbackStore: { ssr: false, suspenseIdCounter: 0, locale: void 0 },
+    fallbackDepth: 0
+  };
 }
 var _shared = globalThis[SSR_KEY] ?? (globalThis[SSR_KEY] = detectSSRShared());
 var als = _shared.als;
 var fallbackStore = _shared.fallbackStore;
+_shared.fallbackDepth ?? (_shared.fallbackDepth = 0);
 function getSSRStore() {
   if (als) {
     const s2 = als.getStore();
@@ -125,16 +294,21 @@ function isSSR() {
 function stripControlChars(value) {
   return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
 }
+function canonicalAttrName(name) {
+  return name.replace(/[A-Z]/g, (ch) => String.fromCharCode(ch.charCodeAt(0) + 32));
+}
 function isEventHandlerAttr(name) {
   if (name.length < 3) return false;
   const lower = name.toLowerCase();
   return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
 }
 var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+var OUTER_TRIM = /^[\x00-\x20\x7f-\x9f]+|[\x00-\x20\x7f-\x9f]+$/g;
 function sanitizeUrl(url) {
-  const trimmed = stripControlChars(url).trim();
-  if (!trimmed) return "";
-  const lower = trimmed.toLowerCase();
+  const probe = stripControlChars(url).trim();
+  if (!probe) return "";
+  const output2 = url.replace(OUTER_TRIM, "");
+  const lower = probe.toLowerCase();
   let schemeEnd = -1;
   for (let i2 = 0; i2 < lower.length; i2++) {
     const ch = lower.charCodeAt(i2);
@@ -144,12 +318,13 @@ function sanitizeUrl(url) {
     }
     if (ch === 47 || ch === 63 || ch === 35) break;
   }
-  if (schemeEnd === -1) return trimmed;
+  if (schemeEnd === -1) return output2;
   const scheme = lower.slice(0, schemeEnd + 1);
-  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return trimmed;
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(scheme)) return output2;
   if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
-  return trimmed;
+  return output2;
 }
+var SRCSET_DESCRIPTOR = /^\s+\d+(\.\d+)?[wx]$/;
 function sanitizeSrcset(value) {
   const parts = value.split(",");
   const out = [];
@@ -158,6 +333,7 @@ function sanitizeSrcset(value) {
     if (!part) continue;
     const m = part.match(/^(\S+)(\s+.+)?$/);
     if (!m) continue;
+    if (m[2] !== void 0 && !SRCSET_DESCRIPTOR.test(m[2])) continue;
     const safe = sanitizeUrl(m[1]);
     if (!safe) continue;
     out.push(m[2] ? `${safe}${m[2]}` : safe);
@@ -165,23 +341,83 @@ function sanitizeSrcset(value) {
   return out.join(", ");
 }
 var CSS_DANGER_GATE = /[(:@\\]/;
+function isCssWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
+function isHexDigit(ch) {
+  return ch >= "0" && ch <= "9" || ch >= "a" && ch <= "f" || ch >= "A" && ch <= "F";
+}
+function decodeCssEscapes(value) {
+  let out = "";
+  for (let i2 = 0; i2 < value.length; i2++) {
+    const ch = value[i2];
+    if (ch !== "\\") {
+      out += ch;
+      continue;
+    }
+    if (i2 + 1 >= value.length) break;
+    const next = value[i2 + 1];
+    if (next === "\n" || next === "\f") {
+      i2 += 1;
+      continue;
+    }
+    if (next === "\r") {
+      i2 += value[i2 + 2] === "\n" ? 2 : 1;
+      continue;
+    }
+    if (isHexDigit(next)) {
+      let hex = "";
+      let j = i2 + 1;
+      while (j < value.length && hex.length < 6 && isHexDigit(value[j])) {
+        hex += value[j];
+        j++;
+      }
+      if (j < value.length && isCssWhitespace(value[j])) {
+        j += value[j] === "\r" && value[j + 1] === "\n" ? 2 : 1;
+      }
+      const code2 = Number.parseInt(hex, 16);
+      const invalid = code2 === 0 || code2 > 1114111 || code2 >= 55296 && code2 <= 57343;
+      out += invalid ? "\uFFFD" : String.fromCodePoint(code2);
+      i2 = j - 1;
+      continue;
+    }
+    out += next;
+    i2 += 1;
+  }
+  return out;
+}
 function sanitizeCSSValue(value) {
   if (!CSS_DANGER_GATE.test(value)) return value;
-  const decoded = value.replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
-    const code2 = Number.parseInt(hex, 16);
-    if (!Number.isFinite(code2) || code2 < 0 || code2 > 1114111) return "";
-    try {
-      return String.fromCodePoint(code2);
-    } catch {
-      return "";
-    }
-  });
-  const lower = decoded.toLowerCase().replace(/\s+/g, "");
+  const normalized = value.includes("\\") ? decodeCssEscapes(value) : value;
+  const lower = normalized.toLowerCase().replace(/\s+/g, "");
   if (lower.includes("url(") || lower.includes("expression(") || lower.includes("javascript:") || lower.includes("vbscript:") || lower.includes("-moz-binding") || lower.includes("behavior:") || lower.includes("@import") || lower.includes("image-set(") || lower.includes("filter:progid")) {
     return "";
   }
   return value;
 }
+function sanitizeStyleAttribute(cssText) {
+  const input2 = String(cssText);
+  if (input2.trim() === "") return "";
+  if (typeof document === "undefined") {
+    return sanitizeCSSValue(input2) === "" ? "" : input2;
+  }
+  const probe = document.createElement("div");
+  try {
+    probe.style.cssText = input2;
+  } catch {
+    return "";
+  }
+  const declarations = [];
+  for (let i2 = 0; i2 < probe.style.length; i2++) {
+    const property = probe.style[i2];
+    const value = probe.style.getPropertyValue(property);
+    if (sanitizeCSSValue(value) === "") continue;
+    if (sanitizeCSSValue(`${property}:${value}`) === "") continue;
+    const priority = probe.style.getPropertyPriority(property);
+    declarations.push(`${property}: ${value}${priority ? ` !${priority}` : ""}`);
+  }
+  return declarations.join("; ");
+}
 var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "href",
   "xlink:href",
@@ -194,40 +430,202 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "background",
   "srcset",
   "ping",
-  "data"
+  "data",
+  // `<html manifest>` is a URL sink too. It was carried only by the SSR
+  // serializers' private copy of this set; folding that copy into this one would
+  // otherwise have silently dropped its coverage.
+  "manifest"
 ]);
+var HTML_CONTENT_ATTRIBUTES = /* @__PURE__ */ new Set(["srcdoc"]);
+function isHtmlContentAttribute(name) {
+  return HTML_CONTENT_ATTRIBUTES.has(name.toLowerCase());
+}
+function isPolicyAttribute(name) {
+  const lower = name.toLowerCase();
+  return lower === "style" || URL_ATTRIBUTES.has(lower);
+}
 function sanitizeAttributeString(attr, value) {
   const lower = attr.toLowerCase();
   if (lower === "srcset") return sanitizeSrcset(value);
   if (URL_ATTRIBUTES.has(lower)) return sanitizeUrl(value);
+  if (lower === "style") return sanitizeStyleAttribute(value);
   return value;
 }
 
+// src/utils/metaRefresh.ts
+function isAsciiWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
+function trimAsciiWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && isAsciiWhitespace(value[start])) start++;
+  while (end > start && isAsciiWhitespace(value[end - 1])) end--;
+  return value.slice(start, end);
+}
+var forbidden = (reason) => ({ kind: "forbidden", reason });
+function parseMetaRefreshContent(content) {
+  const raw = trimAsciiWhitespace(stripControlChars(content));
+  if (raw === "") return forbidden("empty content");
+  let i2 = 0;
+  while (i2 < raw.length && raw[i2] >= "0" && raw[i2] <= "9") i2++;
+  if (i2 === 0) return forbidden("missing or non-numeric delay");
+  const delay = Number.parseInt(raw.slice(0, i2), 10);
+  if (!Number.isFinite(delay)) return forbidden("unparseable delay");
+  while (i2 < raw.length && isAsciiWhitespace(raw[i2])) i2++;
+  if (i2 === raw.length) return { kind: "delay-only", delay };
+  if (raw[i2] !== ";" && raw[i2] !== ",") return forbidden("unexpected text after delay");
+  i2++;
+  while (i2 < raw.length && isAsciiWhitespace(raw[i2])) i2++;
+  const keyStart = i2;
+  while (i2 < raw.length && !isAsciiWhitespace(raw[i2]) && raw[i2] !== "=") i2++;
+  const key = raw.slice(keyStart, i2).toLowerCase();
+  if (key !== "url") return forbidden(`unsupported refresh key ${JSON.stringify(key)}`);
+  while (i2 < raw.length && isAsciiWhitespace(raw[i2])) i2++;
+  if (raw[i2] !== "=") return forbidden("missing '=' after url");
+  i2++;
+  while (i2 < raw.length && isAsciiWhitespace(raw[i2])) i2++;
+  let destination;
+  const quote = raw[i2];
+  if (quote === '"' || quote === "'") {
+    const close = raw.indexOf(quote, i2 + 1);
+    if (close === -1) return forbidden("unterminated quoted destination");
+    destination = raw.slice(i2 + 1, close);
+    const rest = trimAsciiWhitespace(raw.slice(close + 1));
+    if (rest !== "") return forbidden("trailing text after quoted destination");
+  } else {
+    destination = trimAsciiWhitespace(raw.slice(i2));
+    if (/[;,]/.test(destination)) return forbidden("multiple refresh assignments");
+  }
+  if (destination === "") return forbidden("empty destination");
+  const sanitizedDestination = sanitizeUrl(destination);
+  if (sanitizedDestination === "") return forbidden("destination uses a disallowed protocol");
+  return { kind: "allowed", delay, destination, sanitizedDestination };
+}
+function resolveMetaRefreshPolicy(attributes) {
+  let httpEquiv;
+  let content;
+  let duplicateName;
+  const seen = /* @__PURE__ */ new Set();
+  for (const [key, value] of attributes) {
+    const canonical = canonicalAttrName(key);
+    if (seen.has(canonical)) duplicateName = canonical;
+    seen.add(canonical);
+    if (canonical === "http-equiv") httpEquiv = value;
+    else if (canonical === "content") content = value;
+  }
+  if (duplicateName !== void 0) {
+    return forbidden(`duplicate case-insensitive attribute ${JSON.stringify(duplicateName)}`);
+  }
+  if (typeof httpEquiv !== "string") return { kind: "not-refresh" };
+  if (trimAsciiWhitespace(stripControlChars(httpEquiv)).toLowerCase() !== "refresh") {
+    return { kind: "not-refresh" };
+  }
+  if (typeof content !== "string") return { kind: "not-refresh" };
+  return parseMetaRefreshContent(content);
+}
+function normalizeMetaAttributes(props) {
+  const out = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(props)) {
+    const canonical = canonicalAttrName(key);
+    if (seen.has(canonical)) return null;
+    seen.add(canonical);
+    out.set(key, props[key]);
+  }
+  return out;
+}
+function isForbiddenMetaEntry(props) {
+  const normalized = normalizeMetaAttributes(props);
+  if (normalized === null) return true;
+  return resolveMetaRefreshPolicy(normalized).kind === "forbidden";
+}
+
+// src/utils/headEntry.ts
+var SAFE_HEAD_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
+function isEmittableHeadAttrName(name) {
+  if (!SAFE_HEAD_ATTR_NAME.test(name)) return false;
+  const canonical = canonicalAttrName(name);
+  if (isEventHandlerAttr(canonical)) return false;
+  if (isHtmlContentAttribute(canonical)) return false;
+  return true;
+}
+function sanitizeHeadAttrValue(canonical, value) {
+  if (!isPolicyAttribute(canonical)) return value;
+  const safe = sanitizeAttributeString(canonical, value);
+  return safe === "" ? null : safe;
+}
+function findDuplicateAttributeName(names) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of names) {
+    const canonical = canonicalAttrName(name);
+    if (seen.has(canonical)) return canonical;
+    seen.add(canonical);
+  }
+  return null;
+}
+function planEntry(props, resolver, applyRefreshPolicy) {
+  const rawNames = Object.keys(props);
+  const duplicate = findDuplicateAttributeName(rawNames);
+  if (duplicate !== null) {
+    return { kind: "drop", reason: `duplicate case-insensitive attribute ${JSON.stringify(duplicate)}` };
+  }
+  const attributes = /* @__PURE__ */ new Map();
+  let reactive = false;
+  for (const name of rawNames) {
+    if (!Object.hasOwn(props, name)) continue;
+    if (!isEmittableHeadAttrName(name)) continue;
+    const authored = props[name];
+    if (resolver.isReactiveValue?.(authored)) reactive = true;
+    const canonical = canonicalAttrName(name);
+    const sanitized = sanitizeHeadAttrValue(canonical, resolver.resolveValue(name, authored));
+    if (sanitized === null) continue;
+    attributes.set(canonical, sanitized);
+  }
+  if (attributes.size === 0) return { kind: "drop", reason: "no effective attributes remain" };
+  const refresh = applyRefreshPolicy ? resolveMetaRefreshPolicy(attributes) : { kind: "not-refresh" };
+  if (refresh.kind === "forbidden") return { kind: "drop", reason: refresh.reason };
+  if (reactive && (refresh.kind === "allowed" || refresh.kind === "delay-only")) {
+    return { kind: "drop", reason: "a reactive meta entry may not publish a native refresh directive" };
+  }
+  return { kind: "publish", attributes, refresh };
+}
+function planMetaEntry(props, resolver) {
+  return planEntry(props, resolver, true);
+}
+function planHeadElementEntry(props, resolver) {
+  return planEntry(props, resolver, false);
+}
+var STATIC_VALUE_RESOLVER = {
+  resolveValue: (_name, value) => String(value)
+};
+function escapeHeadAttrValue(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function serializeHeadEntry(tag, attrs) {
+  const plan = tag === "meta" ? planMetaEntry(attrs, STATIC_VALUE_RESOLVER) : planHeadElementEntry(attrs, STATIC_VALUE_RESOLVER);
+  if (plan.kind === "drop") return "";
+  const pairs = Array.from(plan.attributes, ([name, value]) => `${name}="${escapeHeadAttrValue(value)}"`).join(" ");
+  return `<${tag} ${pairs} />`;
+}
+
 // src/platform/ssr.ts
-function sanitizeUrlAttr(name, value) {
-  return name === "srcset" ? sanitizeSrcset(value) : sanitizeUrl(value);
+function isPolicyAttr(lowerName) {
+  return isPolicyAttribute(lowerName);
 }
-var _isDev2 = isDev();
+function isForbiddenSsrAttr(lowerName) {
+  return isHtmlContentAttribute(lowerName);
+}
+function sanitizeSsrAttributeValue(lowerName, value) {
+  return sanitizeAttributeString(lowerName, value);
+}
+var _isDev3 = isDev();
 var SAFE_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
 function isSafeAttrName(name) {
   return SAFE_ATTR_NAME.test(name);
 }
-var URL_ATTRS = /* @__PURE__ */ new Set([
-  "href",
-  "src",
-  "action",
-  "formaction",
-  "cite",
-  "poster",
-  "background",
-  "srcset",
-  "ping",
-  "manifest",
-  "data",
-  "xlink:href"
-]);
 function ssrErrorComment(err) {
-  if (_isDev2) {
+  if (_isDev3) {
     const msg = escapeHtml(err instanceof Error ? err.message : String(err));
     return `<!--SSR error: ${safeCommentText(msg)}-->`;
   }
@@ -273,20 +671,21 @@ function renderToString(element) {
   }
   const tag = element.tagName.toLowerCase();
   if (tag === "script" || tag === "style") {
-    return _isDev2 ? `<!--ssr:${tag}-stripped-->` : "";
+    return _isDev3 ? `<!--ssr:${tag}-stripped-->` : "";
   }
   if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    return _isDev2 ? "<!--ssr:invalid-tag-->" : "";
+    return _isDev3 ? "<!--ssr:invalid-tag-->" : "";
   }
   let html2 = `<${tag}`;
   for (const attr of Array.from(element.attributes)) {
     const rawName = attr.name;
     if (!isSafeAttrName(rawName)) continue;
     if (isEventHandlerAttr(rawName)) continue;
+    if (isForbiddenSsrAttr(rawName)) continue;
     const lowerName = rawName.toLowerCase();
     let value = attr.value;
-    if (URL_ATTRS.has(lowerName)) {
-      value = sanitizeUrlAttr(lowerName, value);
+    if (isPolicyAttr(lowerName)) {
+      value = sanitizeSsrAttributeValue(lowerName, value);
       if (!value) continue;
     }
     html2 += ` ${rawName}="${escapeAttr(value)}"`;
@@ -317,7 +716,7 @@ function hydrate(component, container, options = {}) {
       const first = mismatches[0];
       if (options.onMismatch) {
         options.onMismatch(first);
-      } else if (_isDev2) {
+      } else if (_isDev3) {
         console.warn(
           `[SibuJS hydration] ${first.message}
   at ${first.path}
@@ -327,9 +726,20 @@ function hydrate(component, container, options = {}) {
       }
     }
   }
-  container.replaceChildren(clientTree);
+  replaceChildrenSafely(container, clientTree);
   container.setAttribute("data-sibu-hydrated", "true");
 }
+function directTextOf(node) {
+  let out = "";
+  for (const child of Array.from(node.childNodes)) {
+    if (child.nodeType === 3) out += child.nodeValue ?? "";
+  }
+  return out.replace(/\s+/g, " ").trim();
+}
+function disposeAndReplace(outgoing, next) {
+  dispose(outgoing);
+  outgoing.replaceWith(next);
+}
 function collectMismatches(serverNode, clientNode, path2, out, max = 5) {
   if (out.length >= max) return;
   const nodePath = path2 || clientNode?.tagName?.toLowerCase() || "(root)";
@@ -405,6 +815,18 @@ function collectMismatches(serverNode, clientNode, path2, out, max = 5) {
       });
     }
   }
+  const serverText = directTextOf(serverNode);
+  const clientText = directTextOf(clientNode);
+  if (serverText !== clientText) {
+    out.push({
+      kind: "text",
+      path: nodePath,
+      serverValue: serverText,
+      clientValue: clientText,
+      message: "Text content differs between server and client."
+    });
+    if (out.length >= max) return;
+  }
   const serverChildren = Array.from(serverNode.children);
   const clientChildren = Array.from(clientNode.children);
   const max2 = Math.max(serverChildren.length, clientChildren.length);
@@ -424,10 +846,11 @@ function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
     if (!Object.hasOwn(attrs, rawKey)) continue;
     if (!isSafeAttrName(rawKey)) continue;
     if (!allowEventHandlers && isEventHandlerAttr(rawKey)) continue;
+    if (isForbiddenSsrAttr(rawKey)) continue;
     const lowerKey = rawKey.toLowerCase();
     let value = String(attrs[rawKey]);
-    if (URL_ATTRS.has(lowerKey)) {
-      value = sanitizeUrlAttr(lowerKey, value);
+    if (isPolicyAttr(lowerKey)) {
+      value = sanitizeSsrAttributeValue(lowerKey, value);
       if (!value) continue;
     }
     out.push(`${rawKey}="${escapeAttr(value)}"`);
@@ -435,18 +858,7 @@ function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
   return out.join(" ");
 }
 function isDangerousMetaRefresh(metaProps) {
-  let httpEquiv;
-  let content;
-  for (const k in metaProps) {
-    const lk = k.toLowerCase();
-    if (lk === "http-equiv") httpEquiv = metaProps[k];
-    else if (lk === "content") content = metaProps[k];
-  }
-  if (typeof httpEquiv !== "string") return false;
-  if (httpEquiv.toLowerCase() !== "refresh") return false;
-  if (typeof content !== "string") return false;
-  const normalized = stripControlChars(content).toLowerCase();
-  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
+  return isForbiddenMetaEntry(metaProps);
 }
 function renderToDocument(component, options = {}) {
   let content;
@@ -455,15 +867,8 @@ function renderToDocument(component, options = {}) {
   } catch (err) {
     content = ssrErrorComment(err);
   }
-  const metaTags = (options.meta || []).map((attrs) => {
-    if (isDangerousMetaRefresh(attrs)) return "";
-    const pairs = buildAttrString(attrs);
-    return pairs ? `<meta ${pairs} />` : "";
-  }).filter(Boolean).join("\n    ");
-  const linkTags = (options.links || []).map((attrs) => {
-    const pairs = buildAttrString(attrs);
-    return pairs ? `<link ${pairs} />` : "";
-  }).filter(Boolean).join("\n    ");
+  const metaTags = (options.meta || []).map((attrs) => serializeHeadEntry("meta", attrs)).filter(Boolean).join("\n    ");
+  const linkTags = (options.links || []).map((attrs) => serializeHeadEntry("link", attrs)).filter(Boolean).join("\n    ");
   const scriptTags = (options.scripts || []).map((src) => {
     const safe = sanitizeUrl(String(src));
     if (!safe) return "";
@@ -512,11 +917,11 @@ async function* renderToStream(element) {
   }
   const tag = element.tagName.toLowerCase();
   if (tag === "script" || tag === "style") {
-    if (_isDev2) yield `<!--ssr:${tag}-stripped-->`;
+    if (_isDev3) yield `<!--ssr:${tag}-stripped-->`;
     return;
   }
   if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    if (_isDev2) yield "<!--ssr:invalid-tag-->";
+    if (_isDev3) yield "<!--ssr:invalid-tag-->";
     return;
   }
   let openTag = `<${tag}`;
@@ -524,14 +929,18 @@ async function* renderToStream(element) {
     const rawName = attr.name;
     if (!isSafeAttrName(rawName)) continue;
     if (isEventHandlerAttr(rawName)) continue;
+    if (isForbiddenSsrAttr(rawName)) continue;
     const lowerName = rawName.toLowerCase();
     let value = attr.value;
-    if (URL_ATTRS.has(lowerName)) {
-      value = sanitizeUrlAttr(lowerName, value);
+    if (isPolicyAttr(lowerName)) {
+      value = sanitizeSsrAttributeValue(lowerName, value);
       if (!value) continue;
     }
     openTag += ` ${rawName}="${escapeAttr(value)}"`;
   }
+  if (element.dataset && !element.dataset.sibuHydrate) {
+    openTag += ` data-sibu-ssr="true"`;
+  }
   if (VOID_ELEMENTS.has(tag)) {
     yield `${openTag} />`;
     return;
@@ -578,9 +987,13 @@ function island(id, component) {
   el.setAttribute("data-sibu-island", id);
   return el;
 }
+function isAlreadyHydrated(element) {
+  return element.hasAttribute("data-sibu-hydrated");
+}
 function hydrateIslands(container, islands) {
   const markers = container.querySelectorAll("[data-sibu-island]");
   for (const marker2 of Array.from(markers)) {
+    if (isAlreadyHydrated(marker2)) continue;
     const id = marker2.getAttribute("data-sibu-island") ?? "";
     if (!Object.hasOwn(islands, id)) continue;
     const factory = islands[id];
@@ -588,7 +1001,7 @@ function hydrateIslands(container, islands) {
     const clientTree = factory();
     clientTree.setAttribute("data-sibu-island", id);
     clientTree.setAttribute("data-sibu-hydrated", "true");
-    marker2.replaceWith(clientTree);
+    disposeAndReplace(marker2, clientTree);
   }
   container.setAttribute("data-sibu-hydrated", "partial");
 }
@@ -596,6 +1009,7 @@ function hydrateProgressively(container, islands, options) {
   const markers = container.querySelectorAll("[data-sibu-island]");
   const cleanups = [];
   for (const marker2 of Array.from(markers)) {
+    if (isAlreadyHydrated(marker2)) continue;
     const id = marker2.getAttribute("data-sibu-island") ?? "";
     if (!Object.hasOwn(islands, id)) continue;
     const factory = islands[id];
@@ -605,10 +1019,11 @@ function hydrateProgressively(container, islands, options) {
         for (const entry of entries) {
           if (entry.isIntersecting) {
             observer.disconnect();
+            if (isAlreadyHydrated(marker2) || marker2.parentNode === null) break;
             const clientTree = factory();
             clientTree.setAttribute("data-sibu-island", id);
             clientTree.setAttribute("data-sibu-hydrated", "true");
-            marker2.replaceWith(clientTree);
+            disposeAndReplace(marker2, clientTree);
             break;
           }
         }
@@ -649,7 +1064,7 @@ function ssrSuspense(props) {
     },
     (err) => {
       if (timer) clearTimeout(timer);
-      if (_isDev2) console.warn("[SibuJS SSR] ssrSuspense rejected:", err);
+      if (_isDev3) console.warn("[SibuJS SSR] ssrSuspense rejected:", err);
       return { id, html: fallbackHtml };
     }
   );
@@ -664,7 +1079,7 @@ function suspenseSwapScript(id, nonce) {
     );
   }
   const nonceAttr = nonce ? ` nonce="${escapeAttr(nonce)}"` : "";
-  return `<script${nonceAttr}>(function(){var t=document.getElementById("sibu-resolved-${id}");var f=document.querySelector('[data-sibu-suspense-id="${id}"]');if(t&&f){while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
+  return `<script${nonceAttr}>(function(){var t=document.getElementById("sibu-resolved-${id}");var f=document.querySelector('[data-sibu-suspense-id="${id}"]');if(t&&f){while(f.firstChild)f.removeChild(f.firstChild);while(t.firstChild)f.appendChild(t.firstChild);t.remove();f.removeAttribute("data-sibu-suspense-id");}})()</script>`;
 }
 async function* renderToSuspenseStream(element, pendingBoundaries = [], options) {
   yield* renderToStream(element);
@@ -682,8 +1097,8 @@ function escapeScriptJson(json) {
   return json.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
 var DEFAULT_MAX_SSR_BYTES = 1024 * 1024;
-function serializeState(state, nonce, options) {
-  const rawJson = JSON.stringify(state);
+function serializeState(state2, nonce, options) {
+  const rawJson = JSON.stringify(state2);
   const maxBytes = options?.maxBytes ?? DEFAULT_MAX_SSR_BYTES;
   const byteLen = typeof TextEncoder !== "undefined" ? new TextEncoder().encode(rawJson).byteLength : Buffer.byteLength(rawJson, "utf8");
   if (byteLen > maxBytes) {
@@ -695,7 +1110,7 @@ function serializeState(state, nonce, options) {
 }
 function deserializeState(validate) {
   if (typeof window === "undefined") return void 0;
-  if (_isDev2 && !validate) {
+  if (_isDev3 && !validate) {
     console.warn(
       "[SibuJS SSR] deserializeState() called without a validate guard \u2014 tampered SSR payloads will not be detected."
     );
@@ -713,69 +1128,7 @@ function escapeAttr(str) {
   return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 
-// src/core/rendering/dispose.ts
-var elementDisposers = /* @__PURE__ */ new WeakMap();
-var _isDev3 = isDev();
-var activeBindingCount = 0;
-function registerDisposer(node, teardown) {
-  let disposers = elementDisposers.get(node);
-  if (!disposers) {
-    disposers = [];
-    elementDisposers.set(node, disposers);
-  }
-  disposers.push(teardown);
-  if (_isDev3) activeBindingCount++;
-}
-function dispose(node) {
-  const stack = [node];
-  const order = [];
-  while (stack.length > 0) {
-    const current = stack.pop();
-    order.push(current);
-    const children = Array.from(current.childNodes);
-    for (let i2 = 0; i2 < children.length; i2++) {
-      stack.push(children[i2]);
-    }
-  }
-  for (let i2 = order.length - 1; i2 >= 0; i2--) {
-    const current = order[i2];
-    const disposers = elementDisposers.get(current);
-    if (disposers) {
-      const snapshot = disposers.slice();
-      elementDisposers.delete(current);
-      if (_isDev3) activeBindingCount -= snapshot.length;
-      for (const d of snapshot) {
-        try {
-          d();
-        } catch (err) {
-          if (_isDev3 && typeof console !== "undefined") {
-            console.warn("[SibuJS] Disposer threw during cleanup:", err);
-          }
-        }
-      }
-      let extraPasses = 0;
-      while (extraPasses++ < 8) {
-        const added = elementDisposers.get(current);
-        if (!added || added.length === 0) break;
-        const moreSnapshot = added.slice();
-        elementDisposers.delete(current);
-        if (_isDev3) activeBindingCount -= moreSnapshot.length;
-        for (const d of moreSnapshot) {
-          try {
-            d();
-          } catch (err) {
-            if (_isDev3 && typeof console !== "undefined") {
-              console.warn("[SibuJS] Disposer threw during cleanup:", err);
-            }
-          }
-        }
-      }
-    }
-  }
-}
-
 // src/reactivity/track-core.ts
-var _isDev4 = isDev();
 var POOL_MAX = 4096;
 var nodePool = [];
 function createNode() {
@@ -783,6 +1136,7 @@ function createNode() {
     sig: null,
     sub: null,
     epoch: 0,
+    depVersion: 0,
     sigPrev: null,
     sigNext: null,
     subPrev: null,
@@ -867,8 +1221,27 @@ function safeInvoke(sub2) {
   try {
     sub2();
   } catch (err) {
-    if (_isDev4) devWarn(`Subscriber threw during notification: ${err instanceof Error ? err.message : String(err)}`);
+    const s2 = sub2;
+    reportError(err, { phase: s2._errorPhase ?? "effect", name: s2.__name, node: s2._errorNode });
+  }
+}
+function depsChanged(sub2) {
+  let node = sub2.depsHead ?? null;
+  if (node === null) return true;
+  while (node !== null) {
+    const sig = node.sig;
+    if (sig === null) return true;
+    if (sig._d === true && sig._validate !== void 0) {
+      try {
+        sig._validate();
+      } catch {
+        return true;
+      }
+    }
+    if (node.depVersion !== sig.__v) return true;
+    node = node.subNext;
   }
+  return false;
 }
 var suspendDepth = 0;
 var trackingSuspended = false;
@@ -950,7 +1323,7 @@ function track(effectFn, subscriber) {
   const sub2 = subscriber;
   return sub2._dispose ?? (sub2._dispose = () => cleanup(subscriber));
 }
-function reactiveBinding(commit) {
+function reactiveBinding(commit, ownerNode) {
   const run = () => {
     const s2 = subscriber;
     if (s2._disposed || s2._reentrant) return;
@@ -966,13 +1339,17 @@ function reactiveBinding(commit) {
   subscriber.depsTail = null;
   subscriber._epoch = 0;
   subscriber._structDirty = false;
+  subscriber._hasComputedDep = false;
   subscriber._runEpoch = 0;
   subscriber._runs = 0;
   subscriber._reentrant = false;
   subscriber._disposed = false;
+  subscriber._errorPhase = "binding";
+  subscriber._errorNode = ownerNode;
   run();
   return subscriber._dispose ?? (subscriber._dispose = () => {
     subscriber._disposed = true;
+    subscriber._errorNode = void 0;
     cleanup(subscriber);
   });
 }
@@ -984,9 +1361,12 @@ function recordDependency(signal2) {
   const active = sig.__activeNode ?? null;
   if (active !== null && active.sub === sub2) {
     active.epoch = epoch;
+    active.depVersion = sig.__v ?? Number.NaN;
     return;
   }
+  if (sig._validate !== void 0) sub2._hasComputedDep = true;
   const node = allocNode(signal2, sub2, epoch);
+  node.depVersion = sig.__v ?? Number.NaN;
   node.prevActive = active;
   sig.__activeNode = node;
   linkSub(sub2, node);
@@ -1005,9 +1385,10 @@ function cleanup(subscriber) {
     node = next;
   }
 }
-var maxSubscriberRepeats = 50;
+var maxSubscriberRepeats = 1e3;
 var maxDrainIterations = 1e6;
 var drainEpoch = 0;
+var quarantined = /* @__PURE__ */ new Set();
 function setMaxSubscriberRepeats(n) {
   const prev = maxSubscriberRepeats;
   if (Number.isFinite(n) && n > 0) maxSubscriberRepeats = Math.floor(n);
@@ -1029,19 +1410,21 @@ function tickRepeat(sub2) {
   return s2._runs > maxSubscriberRepeats;
 }
 function cycleError(sub2) {
-  if (typeof console !== "undefined") {
-    const name = sub2.__name ?? "<unnamed>";
-    console.error(
-      `[SibuJS] subscriber "${name}" fired more than ${maxSubscriberRepeats} times \u2014 likely a write-reads-self cycle between effects/signals. Breaking to prevent infinite loop.`
-    );
-  }
+  const name = sub2.__name ?? "<unnamed>";
+  reportError(
+    new Error(
+      `subscriber "${name}" fired more than ${maxSubscriberRepeats} times \u2014 likely a write-reads-self cycle between effects/signals. This subscriber is quarantined for the rest of this update; other pending work still runs.`
+    ),
+    { phase: "scheduler", name }
+  );
 }
 function absoluteDrainError() {
-  if (typeof console !== "undefined") {
-    console.error(
-      `[SibuJS] Notification drain exceeded ${maxDrainIterations} iterations \u2014 absolute safety net tripped. Breaking to prevent infinite loop.`
-    );
-  }
+  reportError(
+    new Error(
+      `Notification drain exceeded ${maxDrainIterations} iterations \u2014 absolute safety net tripped. Breaking to prevent infinite loop.`
+    ),
+    { phase: "scheduler" }
+  );
 }
 function drainQueue() {
   let i2 = 0;
@@ -1051,11 +1434,14 @@ function drainQueue() {
       break;
     }
     const sub2 = pendingQueue[i2++];
+    pendingSet.delete(sub2);
+    if (quarantined.size > 0 && quarantined.has(sub2)) continue;
+    if (sub2._hasComputedDep === true && !depsChanged(sub2)) continue;
     if (tickRepeat(sub2)) {
       cycleError(sub2);
-      break;
+      quarantined.add(sub2);
+      continue;
     }
-    pendingSet.delete(sub2);
     safeInvoke(sub2);
   }
 }
@@ -1070,6 +1456,7 @@ function drainNotificationQueue() {
     if (notifyDepth === 0) {
       pendingQueue.length = 0;
       pendingSet.clear();
+      if (quarantined.size > 0) quarantined.clear();
     }
   }
 }
@@ -1163,6 +1550,7 @@ function notifySubscribers(signal2) {
     if (notifyDepth === 0) {
       pendingQueue.length = 0;
       pendingSet.clear();
+      if (quarantined.size > 0) quarantined.clear();
     }
   }
 }
@@ -1189,14 +1577,14 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _isDev5 = isDev();
-var _runtimeVersion = true ? "3.4.0" : "dev";
+var _isDev4 = isDev();
+var _runtimeVersion = true ? "4.0.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g2 = globalThis;
   const existing = g2[REGISTRY_KEY];
   if (existing) {
-    if (_isDev5 && !existing.__dupWarned) {
+    if (_isDev4 && !existing.__dupWarned) {
       existing.__dupWarned = true;
       devWarn(
         `Multiple instances of the reactive runtime detected on this page (active: ${existing.version}, duplicate: ${_runtimeVersion}). Reactivity still works \u2014 all copies share the first one \u2014 but de-duplicate sibujs in your bundler (e.g. Vite optimizeDeps.exclude: ['sibujs'] or resolve.dedupe: ['sibujs']).`
@@ -1257,7 +1645,7 @@ function flushUserCleanups(ctx) {
     try {
       list[i2]();
     } catch (err) {
-      if (typeof console !== "undefined") console.warn("[SibuJS effect] onCleanup threw:", err);
+      reportError(err, { phase: "cleanup" });
     }
   }
 }
@@ -1270,11 +1658,12 @@ function drainReruns(ctx) {
   } while (ctx.rerunPending && ++reruns <= MAX_RERUNS);
   if (ctx.rerunPending) {
     ctx.rerunPending = false;
-    if (_g.__SIBU_DEV_WARN__ !== false && typeof console !== "undefined") {
-      console.error(
-        `[SibuJS] effect re-requested itself ${MAX_RERUNS}+ times \u2014 likely a write-reads-self cycle. Breaking to prevent infinite loop.`
-      );
-    }
+    reportError(
+      new Error(
+        `effect re-requested itself ${MAX_RERUNS}+ times \u2014 likely a write-reads-self cycle. Breaking to prevent infinite loop.`
+      ),
+      { phase: "effect" }
+    );
   }
 }
 function disposeEffect(ctx) {
@@ -1351,6 +1740,8 @@ function effect(effectFn, options) {
   sub2.depsTail = null;
   sub2._epoch = 0;
   sub2._structDirty = false;
+  sub2._hasComputedDep = false;
+  sub2._errorPhase = "effect";
   sub2._runEpoch = 0;
   sub2._runs = 0;
   ctx.subscriber = sub2;
@@ -1367,39 +1758,178 @@ function effect(effectFn, options) {
   return () => disposeEffect(ctx);
 }
 
-// src/platform/head.ts
-var HEAD_URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
-function sanitizeHeadAttr(key, value) {
-  if (HEAD_URL_ATTRS.has(key)) return sanitizeUrl(value);
-  return value;
+// src/utils/globalSingleton.ts
+function globalSingleton(key, create) {
+  const g2 = globalThis;
+  return g2[key] ?? (g2[key] = create());
 }
-function isDangerousRefreshContent(content) {
-  const normalized = stripControlChars(content).toLowerCase();
-  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
+
+// src/utils/singletonResource.ts
+function singletonResource(io) {
+  let original = null;
+  let captured = false;
+  const stack = [];
+  function apply() {
+    if (stack.length > 0) {
+      io.write(stack[stack.length - 1].value);
+      return;
+    }
+    if (captured) {
+      io.write(original);
+      captured = false;
+      original = null;
+    }
+  }
+  return {
+    acquire(value) {
+      if (!captured) {
+        original = io.read();
+        captured = true;
+      }
+      const entry = { value, released: false };
+      stack.push(entry);
+      apply();
+      return {
+        set(next) {
+          if (entry.released) return;
+          entry.value = next;
+          apply();
+        },
+        release() {
+          if (entry.released) return;
+          entry.released = true;
+          const index = stack.indexOf(entry);
+          if (index !== -1) stack.splice(index, 1);
+          apply();
+        }
+      };
+    },
+    ownerCount() {
+      return stack.length;
+    }
+  };
+}
+
+// src/utils/documentResources.ts
+var INERT_LEASE = {
+  set() {
+  },
+  release() {
+  }
+};
+function inertLease() {
+  return INERT_LEASE;
 }
-function getMetaAttr(metaProps, name) {
-  for (const k in metaProps) {
-    if (k.toLowerCase() === name) return metaProps[k];
+var titleResource = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.documentTitle.v1"),
+  () => singletonResource({
+    read: () => document.title,
+    write: (value) => {
+      document.title = value;
+    }
+  })
+);
+var baseResource = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.documentBase.v1"),
+  () => singletonResource({
+    read: () => {
+      const el = document.head.querySelector("base");
+      if (!el) return null;
+      return {
+        href: el.getAttribute("href") ?? void 0,
+        target: el.getAttribute("target") ?? void 0
+      };
+    },
+    write: (spec) => {
+      const existing = document.head.querySelector("base");
+      if (spec === null) {
+        existing?.remove();
+        return;
+      }
+      const el = existing ?? document.head.appendChild(document.createElement("base"));
+      if (spec.href === void 0) el.removeAttribute("href");
+      else el.setAttribute("href", spec.href);
+      if (spec.target === void 0) el.removeAttribute("target");
+      else el.setAttribute("target", spec.target);
+    }
+  })
+);
+var scrollRestorationResource = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.historyScrollRestoration.v1"),
+  () => singletonResource({
+    read: () => history.scrollRestoration,
+    write: (mode) => {
+      history.scrollRestoration = mode;
+    }
+  })
+);
+function acquireScrollRestorationMode(mode) {
+  if (typeof history === "undefined" || !("scrollRestoration" in history)) {
+    return inertLease();
   }
-  return void 0;
+  return scrollRestorationResource.acquire(mode);
 }
-function isDangerousMetaRefresh2(metaProps) {
-  const httpEquiv = getMetaAttr(metaProps, "http-equiv");
-  if (typeof httpEquiv !== "string") return false;
-  if (httpEquiv.toLowerCase() !== "refresh") return false;
-  const content = getMetaAttr(metaProps, "content");
-  if (typeof content !== "string") return false;
-  return isDangerousRefreshContent(content);
+function acquireTitle(value) {
+  if (typeof document === "undefined") return inertLease();
+  return titleResource.acquire(value);
 }
-var SAFE_HEAD_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
-function isSafeHeadAttr(name) {
-  if (!SAFE_HEAD_ATTR_NAME.test(name)) return false;
-  if (isEventHandlerAttr(name)) return false;
-  return true;
+function acquireBase(spec) {
+  if (typeof document === "undefined") return inertLease();
+  return baseResource.acquire(spec);
 }
+
+// src/platform/head.ts
 function escapeScriptJsonLocal(json) {
   return json.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
+var CLIENT_RESOLVER = {
+  resolveValue: (_name, value) => typeof value === "function" ? String(value()) : String(value),
+  isReactiveValue: (value) => typeof value === "function"
+};
+function applyMetaEntry(metaProps, managedElements) {
+  let current = null;
+  const retract = () => {
+    if (!current) return;
+    const index = managedElements.indexOf(current);
+    if (index !== -1) managedElements.splice(index, 1);
+    current.remove();
+    current = null;
+  };
+  const alreadyPublished = (attributes) => {
+    if (!current || current.attributes.length !== attributes.size) return false;
+    for (const [name, value] of attributes) {
+      if (current.getAttribute(name) !== value) return false;
+    }
+    return true;
+  };
+  const publish = (attributes) => {
+    if (alreadyPublished(attributes)) return;
+    const next = document.createElement("meta");
+    for (const [name, value] of attributes) next.setAttribute(name, value);
+    const index = current ? managedElements.indexOf(current) : -1;
+    if (current?.parentNode) {
+      current.replaceWith(next);
+    } else {
+      current?.remove();
+      document.head.appendChild(next);
+    }
+    if (index !== -1) managedElements[index] = next;
+    else managedElements.push(next);
+    current = next;
+  };
+  const stopEffect = effect(() => {
+    const plan = planMetaEntry(metaProps, CLIENT_RESOLVER);
+    if (plan.kind === "drop") {
+      retract();
+      return;
+    }
+    publish(plan.attributes);
+  });
+  return () => {
+    stopEffect();
+    retract();
+  };
+}
 function Head(props) {
   const anchor = document.createComment("sibu-head");
   const managedElements = [];
@@ -1416,78 +1946,52 @@ function Head(props) {
     cleanup3();
     if (props.title) {
       if (typeof props.title === "function") {
-        const cleanupFn = effect(() => {
-          document.title = props.title();
+        const getter = props.title;
+        let lease = null;
+        const stopEffect = effect(() => {
+          const next = getter();
+          if (lease) lease.set(next);
+          else lease = acquireTitle(next);
+        });
+        effectCleanups.push(() => {
+          stopEffect();
+          lease?.release();
+          lease = null;
         });
-        effectCleanups.push(cleanupFn);
       } else {
-        document.title = props.title;
+        const lease = acquireTitle(props.title);
+        effectCleanups.push(() => lease.release());
       }
     }
     if (props.meta) {
       for (const metaProps of props.meta) {
-        if (isDangerousMetaRefresh2(metaProps)) continue;
-        const httpEquiv = getMetaAttr(metaProps, "http-equiv");
-        const isRefreshNow = () => {
-          const eq = typeof httpEquiv === "function" ? httpEquiv() : httpEquiv;
-          return typeof eq === "string" && eq.toLowerCase() === "refresh";
-        };
-        const el = document.createElement("meta");
-        for (const [key, value] of Object.entries(metaProps)) {
-          if (!isSafeHeadAttr(key)) continue;
-          const isContent = key.toLowerCase() === "content";
-          if (typeof value === "function") {
-            const cleanupFn = effect(() => {
-              const resolved = value();
-              if (isContent && isRefreshNow() && isDangerousRefreshContent(resolved)) {
-                el.removeAttribute(key);
-                return;
-              }
-              el.setAttribute(key, sanitizeHeadAttr(key, resolved));
-            });
-            effectCleanups.push(cleanupFn);
-          } else {
-            if (isContent && isRefreshNow() && isDangerousRefreshContent(value)) continue;
-            el.setAttribute(key, sanitizeHeadAttr(key, value));
-          }
-        }
-        document.head.appendChild(el);
-        managedElements.push(el);
+        const stop2 = applyMetaEntry(metaProps, managedElements);
+        effectCleanups.push(stop2);
       }
     }
-    if (props.link) {
-      for (const linkProps of props.link) {
-        const el = document.createElement("link");
-        for (const [key, value] of Object.entries(linkProps)) {
-          if (!isSafeHeadAttr(key)) continue;
-          el.setAttribute(key, sanitizeHeadAttr(key, value));
-        }
-        document.head.appendChild(el);
-        managedElements.push(el);
-      }
-    }
-    if (props.script) {
-      for (const scriptProps of props.script) {
-        const el = document.createElement("script");
-        for (const [key, value] of Object.entries(scriptProps)) {
-          if (!isSafeHeadAttr(key)) continue;
-          el.setAttribute(key, sanitizeHeadAttr(key, value));
-        }
+    for (const [tag, entries] of [
+      ["link", props.link],
+      ["script", props.script]
+    ]) {
+      if (!entries) continue;
+      for (const entryProps of entries) {
+        const plan = planHeadElementEntry(entryProps, STATIC_VALUE_RESOLVER);
+        if (plan.kind === "drop") continue;
+        const el = document.createElement(tag);
+        for (const [name, value] of plan.attributes) el.setAttribute(name, value);
         document.head.appendChild(el);
         managedElements.push(el);
       }
     }
     if (props.base) {
-      const existing = document.head.querySelector("base");
-      if (existing) existing.remove();
-      const el = document.createElement("base");
+      const spec = {};
       if (props.base.href) {
         const safeHref = sanitizeUrl(props.base.href);
-        if (safeHref) el.href = safeHref;
+        if (safeHref) spec.href = safeHref;
       }
-      if (props.base.target) el.target = props.base.target;
-      document.head.appendChild(el);
-      managedElements.push(el);
+      if (props.base.target) spec.target = props.base.target;
+      const lease = acquireBase(spec);
+      effectCleanups.push(() => lease.release());
     }
   };
   apply();
@@ -1510,7 +2014,9 @@ function setCanonical(url) {
     link2.rel = "canonical";
     document.head.appendChild(link2);
   }
-  link2.href = sanitizeUrl(url);
+  const safe = sanitizeUrl(url);
+  if (safe) link2.setAttribute("href", safe);
+  else link2.removeAttribute("href");
 }
 
 // src/platform/staticSiteGenerator.ts
@@ -1584,70 +2090,72 @@ var isBatching = API2.isBatching;
 
 // src/core/signals/signal.ts
 var _g2 = globalThis;
-var _isDev6 = isDev();
+var _isDev5 = isDev();
 function signal(initial, options) {
-  const state = {
+  const state2 = {
     value: initial,
     __v: 0,
     __sc: 0,
     subsHead: null,
     subsTail: null,
     __activeNode: null,
-    __name: void 0
+    __name: void 0,
+    _d: false,
+    _validate: void 0
   };
-  const debugName = _isDev6 ? options?.name : void 0;
+  const debugName = _isDev5 ? options?.name : void 0;
   const equalsFn = options?.equals;
-  if (debugName) state.__name = debugName;
+  if (debugName) state2.__name = debugName;
   function get() {
-    recordDependency2(state);
-    return state.value;
+    recordDependency2(state2);
+    return state2.value;
   }
-  get.__signal = state;
+  get.__signal = state2;
   if (debugName) get.__name = debugName;
   let set;
   if (equalsFn) {
     set = (next) => {
-      const prev = state.value;
+      const prev = state2.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (equalsFn(prev, newValue)) return;
-      state.value = newValue;
-      state.__v++;
-      if (_isDev6) {
+      state2.value = newValue;
+      state2.__v++;
+      if (_isDev5) {
         const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-        if (hook) hook.emit("signal:update", { signal: state, name: debugName, oldValue: prev, newValue });
+        if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       }
-      if (!enqueueBatchedSignal(state)) {
-        notifySubscribers2(state);
+      if (!enqueueBatchedSignal(state2)) {
+        notifySubscribers2(state2);
       }
     };
-  } else if (_isDev6) {
+  } else if (_isDev5) {
     set = (next) => {
-      const prev = state.value;
+      const prev = state2.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (Object.is(newValue, prev)) return;
-      state.value = newValue;
-      state.__v++;
+      state2.value = newValue;
+      state2.__v++;
       const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-      if (hook) hook.emit("signal:update", { signal: state, name: debugName, oldValue: prev, newValue });
-      if (!enqueueBatchedSignal(state)) {
-        notifySubscribers2(state);
+      if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+      if (!enqueueBatchedSignal(state2)) {
+        notifySubscribers2(state2);
       }
     };
   } else {
     set = (next) => {
-      const prev = state.value;
+      const prev = state2.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (Object.is(newValue, prev)) return;
-      state.value = newValue;
-      state.__v++;
-      if (!enqueueBatchedSignal(state)) {
-        notifySubscribers2(state);
+      state2.value = newValue;
+      state2.__v++;
+      if (!enqueueBatchedSignal(state2)) {
+        notifySubscribers2(state2);
       }
     };
   }
-  if (_isDev6) {
+  if (_isDev5) {
     const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (hook) hook.emit("signal:create", { signal: state, name: debugName, getter: get, initial });
+    if (hook) hook.emit("signal:create", { signal: state2, name: debugName, getter: get, initial });
   }
   return [get, set];
 }
@@ -1733,17 +2241,39 @@ function createAction(actionFn) {
 }
 
 // src/platform/scrollRestoration.ts
+var DEFAULT_STATE_KEY = "__sibuScrollKey";
 function scrollRestoration(options) {
   const mode = options?.mode ?? "auto";
+  const stateKey = options?.stateKey ?? DEFAULT_STATE_KEY;
   const positions = /* @__PURE__ */ new Map();
   let popstateHandler = null;
   let currentKey = null;
-  const save = (key) => {
+  if (options?.getKey) {
+    try {
+      currentKey = options.getKey();
+    } catch {
+      currentKey = null;
+    }
+  }
+  const record = (key) => {
     if (typeof window !== "undefined") {
       positions.set(key, { x: window.scrollX, y: window.scrollY });
     }
     currentKey = key;
   };
+  const tagCurrentEntry = (key) => {
+    if (typeof window === "undefined" || typeof history === "undefined") return;
+    try {
+      const existing = history.state ?? {};
+      if (existing[stateKey] === key) return;
+      history.replaceState({ ...existing, [stateKey]: key }, "");
+    } catch {
+    }
+  };
+  const save = (key) => {
+    record(key);
+    if (mode === "auto") tagCurrentEntry(key);
+  };
   const restore = (key) => {
     const pos = positions.get(key);
     if (pos && typeof window !== "undefined") {
@@ -1754,11 +2284,32 @@ function scrollRestoration(options) {
   const getPosition = (key) => {
     return positions.get(key);
   };
+  const onNavigation = (key) => {
+    if (mode !== "auto") return;
+    if (currentKey !== null && currentKey !== key) record(currentKey);
+    currentKey = key;
+    tagCurrentEntry(key);
+  };
+  let nativeModeLease = null;
   if (mode === "auto" && typeof window !== "undefined") {
-    popstateHandler = () => {
-      if (currentKey) {
-        save(currentKey);
+    nativeModeLease = acquireScrollRestorationMode("manual");
+    if (currentKey !== null) tagCurrentEntry(currentKey);
+    popstateHandler = (event) => {
+      const state2 = event.state ?? null;
+      const rawDestination = state2 ? state2[stateKey] : void 0;
+      const destination = typeof rawDestination === "string" ? rawDestination : null;
+      let outgoing = currentKey;
+      if (outgoing === null && options?.getKey) {
+        try {
+          outgoing = options.getKey();
+        } catch {
+          outgoing = null;
+        }
+      }
+      if (outgoing !== null && outgoing !== destination) {
+        record(outgoing);
       }
+      if (destination !== null) restore(destination);
     };
     window.addEventListener("popstate", popstateHandler);
   }
@@ -1767,9 +2318,11 @@ function scrollRestoration(options) {
       window.removeEventListener("popstate", popstateHandler);
       popstateHandler = null;
     }
+    nativeModeLease?.release();
+    nativeModeLease = null;
     positions.clear();
   };
-  return { save, restore, getPosition, dispose: dispose2 };
+  return { save, restore, onNavigation, getPosition, dispose: dispose2 };
 }
 
 // src/platform/routeMiddleware.ts
@@ -1803,17 +2356,86 @@ function createMiddlewareChain() {
   return { use: use2, run };
 }
 
-// src/reactivity/bindAttribute.ts
-var _isDev7 = isDev();
+// src/utils/setSafeAttribute.ts
+var _isDev6 = isDev();
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+var SVG_NS = "http://www.w3.org/2000/svg";
+var XLINK_NS = "http://www.w3.org/1999/xlink";
+var XML_NS = "http://www.w3.org/XML/1998/namespace";
+var BOOLEAN_IDL_ATTRS = /* @__PURE__ */ new Set(["checked", "disabled", "selected"]);
+function isHtmlElement(el) {
+  return el.namespaceURI === null || el.namespaceURI === HTML_NS;
+}
 function setProp(el, key, val) {
   el[key] = val;
 }
-function bindAttribute(el, attr, getter) {
-  if (isEventHandlerAttr(attr)) {
-    if (_isDev7)
+function namespaceFor(el, name) {
+  if (el.namespaceURI !== SVG_NS) return null;
+  const lower = name.toLowerCase();
+  if (lower.startsWith("xlink:")) return XLINK_NS;
+  if (lower.startsWith("xml:")) return XML_NS;
+  return null;
+}
+function setSafeAttribute(el, name, value, options = {}) {
+  const ns = namespaceFor(el, name);
+  const localName = ns ? name.slice(name.indexOf(":") + 1) : name;
+  if (isEventHandlerAttr(name)) {
+    if (_isDev6) {
       devWarn(
-        `bindAttribute: refusing to bind event-handler attribute "${attr}". Use on:{ ${attr.slice(2)}: fn } instead.`
+        `${options.label ?? "setSafeAttribute"}: refusing to set event-handler attribute "${name}". Its value would be evaluated as JavaScript. Use on:{ ${name.slice(2)}: fn } instead.`
       );
+    }
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return false;
+  }
+  if (value == null) {
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return true;
+  }
+  if (isHtmlContentAttribute(name)) {
+    if (_isDev6) {
+      devWarn(
+        `${options.label ?? "setSafeAttribute"}: refusing to set "${name}". The browser parses this attribute as a nested HTML document, so a generic string value cannot be made safe \u2014 attribute escaping is undone before the parse. Build the frame's content another way.`
+      );
+    }
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return false;
+  }
+  const html2 = isHtmlElement(el);
+  const idlName = html2 ? name.toLowerCase() : name;
+  if (typeof value === "boolean") {
+    if (html2 && BOOLEAN_IDL_ATTRS.has(idlName) && idlName in el) {
+      setProp(el, idlName, value);
+    } else if (value) {
+      if (ns) el.setAttributeNS(ns, name, "");
+      else el.setAttribute(name, "");
+    } else if (ns) {
+      el.removeAttributeNS(ns, localName);
+    } else {
+      el.removeAttribute(name);
+    }
+    return true;
+  }
+  const str = String(value);
+  if (options.syncValueProperty !== false && html2 && (idlName === "value" || idlName === "checked") && idlName in el) {
+    setProp(el, idlName, idlName === "checked" ? Boolean(value) : str);
+    return true;
+  }
+  const safe = sanitizeAttributeString(name, str);
+  const current = ns ? el.getAttributeNS(ns, localName) : el.getAttribute(name);
+  if (current === safe) return true;
+  if (ns) el.setAttributeNS(ns, name, safe);
+  else el.setAttribute(name, safe);
+  return true;
+}
+
+// src/reactivity/bindAttribute.ts
+function bindAttribute(el, attr, getter) {
+  if (isEventHandlerAttr(attr)) {
+    setSafeAttribute(el, attr, "", { label: `bindAttribute("${attr}")` });
     return () => {
     };
   }
@@ -1822,32 +2444,16 @@ function bindAttribute(el, attr, getter) {
     try {
       value = getter();
     } catch (err) {
-      if (_isDev7)
-        devWarn(`bindAttribute: getter for "${attr}" threw: ${err instanceof Error ? err.message : String(err)}`);
+      reportError(err, { phase: "binding", name: `bindAttribute("${attr}")`, node: el });
       return;
     }
-    if (typeof value === "boolean") {
-      if (attr in el && (attr === "checked" || attr === "disabled" || attr === "selected")) {
-        setProp(el, attr, value);
-      } else if (value) {
-        el.setAttribute(attr, "");
-      } else {
-        el.removeAttribute(attr);
-      }
-      return;
-    }
-    const str = String(value);
-    if ((attr === "value" || attr === "checked") && attr in el) {
-      setProp(el, attr, attr === "checked" ? Boolean(value) : str);
-    } else {
-      el.setAttribute(attr, sanitizeAttributeString(attr, str));
-    }
+    setSafeAttribute(el, attr, value, { label: `bindAttribute("${attr}")` });
   }
-  return reactiveBinding2(commit);
+  return reactiveBinding2(commit, el);
 }
 
 // src/reactivity/bindChildNode.ts
-var _isDev8 = isDev();
+var _isDev7 = isDev();
 function bindChildNode(placeholder, getter) {
   let lastNodes = [];
   function commit() {
@@ -1855,7 +2461,7 @@ function bindChildNode(placeholder, getter) {
     try {
       result = getter();
     } catch (err) {
-      if (_isDev8) devWarn(`bindChildNode: getter threw: ${err instanceof Error ? err.message : String(err)}`);
+      reportError(err, { phase: "binding", name: "bindChildNode", node: placeholder });
       return;
     }
     if (result == null || typeof result === "boolean") {
@@ -1881,7 +2487,7 @@ function bindChildNode(placeholder, getter) {
         if (item == null || typeof item === "boolean") continue;
         const node = item instanceof Node ? item : document.createTextNode(String(item));
         if (seen.has(node)) {
-          if (_isDev8)
+          if (_isDev7)
             devWarn("bindChildNode: duplicate node reference in array \u2014 only the first occurrence is rendered.");
           continue;
         }
@@ -1916,12 +2522,12 @@ function bindChildNode(placeholder, getter) {
     }
     lastNodes = newNodes;
   }
-  return reactiveBinding2(commit);
+  return reactiveBinding2(commit, placeholder);
 }
 
 // src/core/rendering/tagFactory.ts
-var SVG_NS = "http://www.w3.org/2000/svg";
-var _isDev9 = isDev();
+var SVG_NS2 = "http://www.w3.org/2000/svg";
+var _isDev8 = isDev();
 var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
 function isBlockedTag(tag) {
   return BLOCKED_TAGS.has(tag.toLowerCase());
@@ -1939,9 +2545,6 @@ var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "self",
   "frames"
 ]);
-function setProp2(el, key, val) {
-  el[key] = val;
-}
 function looksLikeClassList(s2) {
   const t = s2.trim();
   if (!t) return false;
@@ -1965,13 +2568,13 @@ function toKebab(prop) {
 function applyStyle(el, style2) {
   if (typeof style2 === "function") {
     const teardown = track2(() => {
-      el.setAttribute("style", style2());
+      el.setAttribute("style", sanitizeStyleAttribute(String(style2())));
     });
     registerDisposer(el, teardown);
     return;
   }
   if (typeof style2 === "string") {
-    el.setAttribute("style", style2);
+    el.setAttribute("style", sanitizeStyleAttribute(style2));
     return;
   }
   const htmlEl = el;
@@ -2092,7 +2695,7 @@ var tagFactory = (tag, ns) => {
         appendChildren(el, second);
         return el;
       }
-      if (_isDev9 && looksLikeClassList(first)) {
+      if (_isDev8 && looksLikeClassList(first)) {
         devWarn(
           `tagFactory: lone string "${first}" looks like a class list but is being rendered as TEXT. For a class, use ${tag}({ class: "${first}" }) \u2014 or ${tag}("${first}", children) to set the class AND add children.`
         );
@@ -2113,7 +2716,7 @@ var tagFactory = (tag, ns) => {
     if (pClass != null) applyClass(el, pClass);
     const pId = props.id;
     if (pId != null) {
-      if (_isDev9 && typeof pId === "string" && CLOBBER_RISKY_IDS.has(pId.toLowerCase())) {
+      if (_isDev8 && typeof pId === "string" && CLOBBER_RISKY_IDS.has(pId.toLowerCase())) {
         devWarn(
           `tagFactory: element id="${pId}" matches a common global and may cause DOM clobbering. Avoid setting ids from untrusted input.`
         );
@@ -2128,7 +2731,7 @@ var tagFactory = (tag, ns) => {
         const handler = pOn[ev];
         if (typeof handler === "function") {
           el.addEventListener(ev, handler);
-        } else if (_isDev9) {
+        } else if (_isDev8) {
           devWarn(
             `tagFactory: on.${ev} handler is not a function (got ${typeof handler}). Event listener was not attached.`
           );
@@ -2156,16 +2759,8 @@ var tagFactory = (tag, ns) => {
           if (isEventHandlerAttr(key)) continue;
           if (typeof value === "function") {
             registerDisposer(el, bindAttribute(el, key, value));
-          } else if (typeof value === "boolean") {
-            if (key in el && (key === "checked" || key === "disabled" || key === "selected")) {
-              setProp2(el, key, value);
-            } else if (value) {
-              el.setAttribute(key, "");
-            } else {
-              el.removeAttribute(key);
-            }
           } else {
-            el.setAttribute(key, sanitizeAttributeString(key, String(value)));
+            setSafeAttribute(el, key, value, { syncValueProperty: false, label: "tagFactory" });
           }
         }
       }
@@ -2250,7 +2845,7 @@ var param = tagFactory("param");
 var picture = tagFactory("picture");
 var portal = tagFactory("portal");
 var source = tagFactory("source");
-var svg = tagFactory("svg", SVG_NS);
+var svg = tagFactory("svg", SVG_NS2);
 var math = tagFactory("math");
 var canvas = tagFactory("canvas");
 var noscript = tagFactory("noscript");
@@ -2291,36 +2886,30 @@ var base = tagFactory("base");
 var link = tagFactory("link");
 var meta = tagFactory("meta");
 var style = tagFactory("style");
-var circle = tagFactory("circle", SVG_NS);
-var ellipse = tagFactory("ellipse", SVG_NS);
-var g = tagFactory("g", SVG_NS);
-var line = tagFactory("line", SVG_NS);
-var path = tagFactory("path", SVG_NS);
-var polygon = tagFactory("polygon", SVG_NS);
-var polyline = tagFactory("polyline", SVG_NS);
-var rect = tagFactory("rect", SVG_NS);
-var text = tagFactory("text", SVG_NS);
-var tspan = tagFactory("tspan", SVG_NS);
-var defs = tagFactory("defs", SVG_NS);
-var clipPath = tagFactory("clipPath", SVG_NS);
-var mask = tagFactory("mask", SVG_NS);
-var pattern = tagFactory("pattern", SVG_NS);
-var linearGradient = tagFactory("linearGradient", SVG_NS);
-var radialGradient = tagFactory("radialGradient", SVG_NS);
-var stop = tagFactory("stop", SVG_NS);
-var use = tagFactory("use", SVG_NS);
-var symbol = tagFactory("symbol", SVG_NS);
-var marker = tagFactory("marker", SVG_NS);
+var circle = tagFactory("circle", SVG_NS2);
+var ellipse = tagFactory("ellipse", SVG_NS2);
+var g = tagFactory("g", SVG_NS2);
+var line = tagFactory("line", SVG_NS2);
+var path = tagFactory("path", SVG_NS2);
+var polygon = tagFactory("polygon", SVG_NS2);
+var polyline = tagFactory("polyline", SVG_NS2);
+var rect = tagFactory("rect", SVG_NS2);
+var text = tagFactory("text", SVG_NS2);
+var tspan = tagFactory("tspan", SVG_NS2);
+var defs = tagFactory("defs", SVG_NS2);
+var clipPath = tagFactory("clipPath", SVG_NS2);
+var mask = tagFactory("mask", SVG_NS2);
+var pattern = tagFactory("pattern", SVG_NS2);
+var linearGradient = tagFactory("linearGradient", SVG_NS2);
+var radialGradient = tagFactory("radialGradient", SVG_NS2);
+var stop = tagFactory("stop", SVG_NS2);
+var use = tagFactory("use", SVG_NS2);
+var symbol = tagFactory("symbol", SVG_NS2);
+var marker = tagFactory("marker", SVG_NS2);
 var center = tagFactory("center");
 var font = tagFactory("font");
 var marquee = tagFactory("marquee");
 
-// src/utils/globalSingleton.ts
-function globalSingleton(key, create) {
-  const g2 = globalThis;
-  return g2[key] ?? (g2[key] = create());
-}
-
 // src/platform/microfrontend.ts
 var moduleCache = globalSingleton(
   /* @__PURE__ */ Symbol.for("sibujs.microfrontend.moduleCache.v1"),
@@ -2337,14 +2926,13 @@ function createMicroApp(config) {
   }
   let mounted = false;
   function mount(component) {
-    root.replaceChildren();
     const el = component();
-    root.appendChild(el);
+    replaceChildrenSafely(root, el);
     mounted = true;
   }
   function unmount() {
     if (!mounted) return;
-    root.replaceChildren();
+    replaceChildrenSafely(root);
     mounted = false;
   }
   return { mount, unmount, element: host };
@@ -2391,18 +2979,21 @@ function defineRemoteComponent(name, loader) {
       class: "sibu-remote",
       "data-remote-component": name
     });
-    container.appendChild(span({ class: "sibu-remote-loading", nodes: "Loading..." }));
+    container.appendChild(span({ class: "sibu-remote-loading" }, "Loading..."));
+    let disposed = false;
+    registerDisposer(container, () => {
+      disposed = true;
+    });
     loader().then((mod) => {
       cached = mod.default;
-      const rendered = cached();
-      container.replaceChildren(rendered);
+      if (disposed) return;
+      replaceChildrenSafely(container, cached());
     }).catch((err) => {
+      if (disposed) return;
       const message = err instanceof Error ? err.message : String(err);
-      container.replaceChildren(
-        div({
-          class: "sibu-remote-error",
-          nodes: `Failed to load remote component "${name}": ${message}`
-        })
+      replaceChildrenSafely(
+        container,
+        div({ class: "sibu-remote-error" }, `Failed to load remote component "${name}": ${message}`)
       );
     });
     return container;
@@ -2458,11 +3049,16 @@ function serviceWorker(scriptUrl, options) {
   const [isReady, setIsReady] = signal(false);
   const [isUpdateAvailable, setIsUpdateAvailable] = signal(false);
   const [error, setError] = signal(null);
-  let disposed = false;
+  let unregistered = false;
+  let unregisterRequested = false;
+  let registrationPromise = null;
+  let arrivedRegistration = null;
+  let pendingUnregister = null;
   let updateFoundHandler = null;
   let stateChangeHandler = null;
   let trackedWorker = null;
   let trackedReg = null;
+  const supported = typeof navigator !== "undefined" && !!navigator.serviceWorker;
   function detachListeners() {
     if (trackedReg && updateFoundHandler) {
       trackedReg.removeEventListener("updatefound", updateFoundHandler);
@@ -2475,33 +3071,53 @@ function serviceWorker(scriptUrl, options) {
     trackedWorker = null;
     trackedReg = null;
   }
-  if ("serviceWorker" in navigator) {
-    navigator.serviceWorker.register(scriptUrl, options).then((reg) => {
-      if (disposed) return;
-      setRegistration(reg);
-      setIsReady(true);
-      trackedReg = reg;
-      updateFoundHandler = () => {
-        if (disposed) return;
-        const newWorker = reg.installing;
-        if (newWorker) {
-          if (trackedWorker && stateChangeHandler) {
-            trackedWorker.removeEventListener("statechange", stateChangeHandler);
-          }
-          trackedWorker = newWorker;
-          stateChangeHandler = () => {
-            if (disposed) return;
-            if (newWorker.state === "installed" && navigator.serviceWorker.controller) {
-              setIsUpdateAvailable(true);
-            }
-          };
-          newWorker.addEventListener("statechange", stateChangeHandler);
+  function attachListeners(reg) {
+    trackedReg = reg;
+    updateFoundHandler = () => {
+      if (unregistered) return;
+      const newWorker = reg.installing;
+      if (newWorker) {
+        if (trackedWorker && stateChangeHandler) {
+          trackedWorker.removeEventListener("statechange", stateChangeHandler);
         }
-      };
-      reg.addEventListener("updatefound", updateFoundHandler);
-    }).catch((err) => {
-      if (disposed) return;
-      setError(err instanceof Error ? err : new Error(String(err)));
+        trackedWorker = newWorker;
+        stateChangeHandler = () => {
+          if (unregistered) return;
+          if (newWorker.state === "installed" && navigator.serviceWorker.controller) {
+            setIsUpdateAvailable(true);
+          }
+        };
+        newWorker.addEventListener("statechange", stateChangeHandler);
+      }
+    };
+    reg.addEventListener("updatefound", updateFoundHandler);
+  }
+  function activate(reg) {
+    setRegistration(reg);
+    setIsReady(true);
+    attachListeners(reg);
+  }
+  function recoverFailedUnregister() {
+    unregisterRequested = false;
+    if (!registration() && arrivedRegistration) {
+      activate(arrivedRegistration);
+      arrivedRegistration = null;
+    }
+  }
+  function adopt(reg) {
+    if (unregisterRequested) {
+      arrivedRegistration = reg;
+      return null;
+    }
+    activate(reg);
+    return reg;
+  }
+  if (supported) {
+    registrationPromise = navigator.serviceWorker.register(scriptUrl, options).then(adopt).catch((err) => {
+      if (!unregistered) {
+        setError(err instanceof Error ? err : new Error(String(err)));
+      }
+      return null;
     });
   }
   async function update() {
@@ -2510,19 +3126,43 @@ function serviceWorker(scriptUrl, options) {
       await reg.update();
     }
   }
-  async function unregister() {
-    disposed = true;
-    detachListeners();
-    const reg = registration();
-    if (reg) {
-      const result = await reg.unregister();
-      if (result) {
-        setRegistration(null);
-        setIsReady(false);
-      }
-      return result;
+  async function performUnregister() {
+    unregisterRequested = true;
+    if (registrationPromise) await registrationPromise.catch(() => null);
+    const reg = registration() ?? arrivedRegistration;
+    if (!reg) {
+      unregisterRequested = false;
+      return false;
     }
-    return false;
+    let result;
+    try {
+      result = await reg.unregister();
+    } catch (err) {
+      recoverFailedUnregister();
+      throw err;
+    }
+    if (result) {
+      detachListeners();
+      setRegistration(null);
+      setIsReady(false);
+      setIsUpdateAvailable(false);
+      arrivedRegistration = null;
+      unregistered = true;
+    } else {
+      recoverFailedUnregister();
+    }
+    return result;
+  }
+  async function unregister() {
+    if (!supported || unregistered) return false;
+    if (pendingUnregister) return pendingUnregister;
+    const request = performUnregister();
+    pendingUnregister = request;
+    void request.catch(() => {
+    }).then(() => {
+      if (pendingUnregister === request) pendingUnregister = null;
+    });
+    return request;
   }
   return { registration, isReady, isUpdateAvailable, error, update, unregister };
 }
@@ -2750,22 +3390,34 @@ var instanceCache = globalSingleton(
   /* @__PURE__ */ Symbol.for("sibujs.wasm.instanceCache.v1"),
   () => /* @__PURE__ */ new Map()
 );
+var inFlightCache = globalSingleton(
+  /* @__PURE__ */ Symbol.for("sibujs.wasm.inFlightCache.v1"),
+  () => /* @__PURE__ */ new Map()
+);
+var cacheState = globalSingleton(/* @__PURE__ */ Symbol.for("sibujs.wasm.cacheState.v1"), () => ({ generation: 0 }));
+function isCurrentGeneration(generation) {
+  return generation === cacheState.generation;
+}
 function wasm(source2, config = {}) {
   const [instance, setInstance] = signal(null);
   const [loading, setLoading] = signal(true);
   const [error, setError] = signal(null);
   const cacheKey = config.cacheKey || (typeof source2 === "string" ? source2 : void 0);
+  let runId = 0;
   async function load() {
+    const myRun = ++runId;
     setLoading(true);
     setError(null);
     setInstance(null);
     try {
-      const wasmInstance = await loadWasmModule(source2, config.imports, cacheKey);
+      const wasmInstance = await loadWasmModuleWithOptions(source2, { ...config, cacheKey });
+      if (myRun !== runId) return;
       setInstance(wasmInstance.exports);
     } catch (err) {
+      if (myRun !== runId) return;
       setError(err instanceof Error ? err : new Error(String(err)));
     } finally {
-      setLoading(false);
+      if (myRun === runId) setLoading(false);
     }
   }
   load();
@@ -2778,9 +3430,9 @@ function wasm(source2, config = {}) {
   };
 }
 async function loadWasmModule(source2, imports, cacheKey) {
-  const isOptionsBag = !!(imports && ("allowedOrigins" in imports || "unsafelyAllowAnyOrigin" in imports));
-  const opts = isOptionsBag ? imports : { imports, cacheKey };
-  const wasmImports = opts.imports;
+  return loadWasmModuleWithOptions(source2, { imports, cacheKey });
+}
+async function loadWasmModuleWithOptions(source2, opts = {}) {
   const key = opts.cacheKey || (typeof source2 === "string" ? source2 : void 0);
   if (typeof source2 === "string") {
     const allowed = opts.allowedOrigins ?? [];
@@ -2800,44 +3452,50 @@ async function loadWasmModule(source2, imports, cacheKey) {
       );
     }
   }
-  if (key) {
-    const cachedInstance = instanceCache.get(key);
-    if (cachedInstance) {
-      return cachedInstance;
-    }
-  }
-  let module2;
+  const generation = cacheState.generation;
+  if (!key) return instantiateWasm(source2, opts.imports, void 0, generation);
+  const cachedInstance = instanceCache.get(key);
+  if (cachedInstance) return cachedInstance;
+  const inFlight = inFlightCache.get(key);
+  if (inFlight) return inFlight;
+  const pending = instantiateWasm(source2, opts.imports, key, generation).then((instance) => {
+    if (isCurrentGeneration(generation)) instanceCache.set(key, instance);
+    return instance;
+  });
+  inFlightCache.set(key, pending);
+  void pending.catch(() => {
+  }).then(() => {
+    if (inFlightCache.get(key) === pending) inFlightCache.delete(key);
+  });
+  return pending;
+}
+async function instantiateWasm(source2, wasmImports, key, generation) {
   const cachedModule = key ? moduleCache2.get(key) : void 0;
   if (cachedModule) {
-    module2 = cachedModule;
+    return WebAssembly.instantiate(cachedModule, wasmImports || {});
+  }
+  let bytes;
+  if (typeof source2 === "string") {
+    if (typeof WebAssembly.instantiateStreaming === "function") {
+      const response2 = fetch(source2);
+      const result = await WebAssembly.instantiateStreaming(response2, wasmImports || {});
+      if (key && isCurrentGeneration(generation)) moduleCache2.set(key, result.module);
+      return result.instance;
+    }
+    const response = await fetch(source2);
+    bytes = await response.arrayBuffer();
+  } else if (source2 instanceof Uint8Array) {
+    bytes = source2.buffer.slice(source2.byteOffset, source2.byteOffset + source2.byteLength);
   } else {
-    let bytes;
-    if (typeof source2 === "string") {
-      if (typeof WebAssembly.instantiateStreaming === "function") {
-        const response2 = fetch(source2);
-        const result = await WebAssembly.instantiateStreaming(response2, wasmImports || {});
-        if (key) {
-          moduleCache2.set(key, result.module);
-          instanceCache.set(key, result.instance);
-        }
-        return result.instance;
-      }
-      const response = await fetch(source2);
-      bytes = await response.arrayBuffer();
-    } else if (source2 instanceof Uint8Array) {
-      bytes = source2.buffer.slice(source2.byteOffset, source2.byteOffset + source2.byteLength);
-    } else {
-      bytes = source2;
-    }
-    module2 = await WebAssembly.compile(bytes);
-    if (key) moduleCache2.set(key, module2);
+    bytes = source2;
   }
-  const instance = await WebAssembly.instantiate(module2, wasmImports || {});
-  if (key) instanceCache.set(key, instance);
-  return instance;
+  const module2 = await WebAssembly.compile(bytes);
+  if (key && isCurrentGeneration(generation)) moduleCache2.set(key, module2);
+  return WebAssembly.instantiate(module2, wasmImports || {});
 }
 async function preloadWasm(url, options = {}) {
   if (moduleCache2.has(url)) return;
+  const generation = cacheState.generation;
   const allowed = options.allowedOrigins ?? [];
   if (allowed.length > 0) {
     let parsed;
@@ -2862,7 +3520,7 @@ async function preloadWasm(url, options = {}) {
     const bytes = await response.arrayBuffer();
     module2 = await WebAssembly.compile(bytes);
   }
-  moduleCache2.set(url, module2);
+  if (isCurrentGeneration(generation)) moduleCache2.set(url, module2);
 }
 function createWasmBridge(instance) {
   const exports2 = instance.exports;
@@ -2902,8 +3560,10 @@ function createWasmBridge(instance) {
   };
 }
 function clearWasmCache() {
+  cacheState.generation++;
   moduleCache2.clear();
   instanceCache.clear();
+  inFlightCache.clear();
 }
 function isWasmCached(key) {
   return moduleCache2.has(key);
@@ -2933,6 +3593,7 @@ function isWasmCached(key) {
   island,
   loadRemoteModule,
   loadWasmModule,
+  loadWasmModuleWithOptions,
   preloadWasm,
   renderToDocument,
   renderToReadableStream,