sibujs 4.10.1 → 4.12.0

package/dist/plugins.cjs

@@ -699,6 +699,9 @@ function contextualAttributeRefusal(el, name, value, origin) {
   if (SVG_ANIMATION_ELEMENTS.has(local) && el.namespaceURI === SVG_NS) return animationRefusal(name, value);
   return ContextualRefusal.None;
 }
+function isRefusedAnimationAttribute(el, name, value) {
+  return SVG_ANIMATION_ELEMENTS.has(el.localName) && el.namespaceURI === SVG_NS && animationRefusal(name, value) !== ContextualRefusal.None;
+}
 function settleAttributeProvenance(el, name, origin) {
   if (el.localName !== "link" || canonicalAttrName(name) !== "href") return;
   if (origin !== "static" && el.hasAttribute("href")) runtimeHrefLinks.add(el);
@@ -966,6 +969,140 @@ var init_ssr_context = __esm({
   }
 });
 
+// src/utils/globalSingleton.ts
+function globalSingleton(key, create) {
+  const g2 = globalThis;
+  return g2[key] ?? (g2[key] = create());
+}
+var init_globalSingleton = __esm({
+  "src/utils/globalSingleton.ts"() {
+    "use strict";
+  }
+});
+
+// src/utils/embedPolicy.ts
+function currentEmbedAllowlist() {
+  const scoped = getRequestStore()?.caches?.get(REQUEST_CACHE)?.get("allowed");
+  return scoped ?? state2.allowed;
+}
+function resolveEmbedSrc(value, allowed = currentEmbedAllowlist()) {
+  if (typeof value !== "string" || sanitizeUrl(value) === "") return null;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.username || url.password) return null;
+  if (typeof location !== "undefined" && url.origin === location.origin) return null;
+  for (const entry of allowed) {
+    if (url.origin !== entry.origin) continue;
+    const path2 = entry.path;
+    if (path2 === "" || url.pathname === path2 || url.pathname.startsWith(path2.endsWith("/") ? path2 : `${path2}/`)) {
+      return url.href;
+    }
+  }
+  return null;
+}
+function narrowEmbedSandbox(value) {
+  const out = [];
+  for (const token of value.toLowerCase().split(/[\t\n\f\r ]+/)) {
+    if (token && DEFAULT_EMBED_SANDBOX.includes(token) && !out.includes(token)) out.push(token);
+  }
+  return out.join(" ");
+}
+function narrowEmbedAllow(value) {
+  const granted = [];
+  const denied = [];
+  for (const directive of value.split(";")) {
+    const tokens = directive.trim().split(/[\t\n\f\r ]+/);
+    const feature = tokens[0];
+    if (!feature) continue;
+    const list = tokens.slice(1).map((token) => token.toLowerCase());
+    const grantsSrc = (list.length === 0 || list.includes("'src'") || list.includes("*")) && !list.includes("'none'");
+    if (!grantsSrc) denied.push(feature);
+    else if (EMBED_FEATURES.has(feature) && !granted.includes(feature)) granted.push(feature);
+  }
+  return granted.filter((feature) => !denied.includes(feature)).join("; ");
+}
+function getEmbedRecord(frame) {
+  return state2.frames.get(frame);
+}
+function intersect(current, permitted, separator) {
+  const allowed = permitted.split(separator);
+  return current.split(separator).filter((token) => token && allowed.includes(token)).join(separator);
+}
+function embedSerializedAttribute(record, seen, name, value) {
+  switch (name) {
+    case "src":
+      return resolveEmbedSrc(value, record.allowed);
+    case "title":
+      if (!value.trim()) return null;
+      seen.title = true;
+      return value;
+    case "sandbox":
+      seen.sandbox = true;
+      return intersect(narrowEmbedSandbox(value), record.sandbox, " ");
+    case "allow": {
+      const allow = intersect(narrowEmbedAllow(value), record.allow, "; ");
+      if (allow.split("; ").includes("fullscreen")) seen.fullscreen = true;
+      return allow || null;
+    }
+    case "referrerpolicy":
+      seen.referrer = true;
+      return value.trim().toLowerCase() === "no-referrer" ? "no-referrer" : record.referrer;
+    case "loading":
+      return value === "eager" ? "eager" : "lazy";
+    case "id":
+    case "class":
+    case "style":
+    case "width":
+    case "height":
+      return value;
+    default:
+      return name.startsWith("data-") || name.startsWith("aria-") ? value : null;
+  }
+}
+function embedSerializationTail(record, seen) {
+  if (!seen.title) return null;
+  let tail = "";
+  if (!seen.sandbox) tail += ` sandbox="${record.sandbox}"`;
+  if (!seen.referrer) tail += ` referrerpolicy="${record.referrer}"`;
+  if (seen.fullscreen) tail += ' allowfullscreen=""';
+  return tail;
+}
+var state2, REQUEST_CACHE, DEFAULT_EMBED_SANDBOX, EMBED_FEATURES;
+var init_embedPolicy = __esm({
+  "src/utils/embedPolicy.ts"() {
+    "use strict";
+    init_ssr_context();
+    init_globalSingleton();
+    init_sanitize();
+    state2 = globalSingleton(/* @__PURE__ */ Symbol.for("sibujs.embed.v2"), () => ({
+      allowed: [],
+      frames: /* @__PURE__ */ new WeakMap()
+    }));
+    REQUEST_CACHE = "embed";
+    DEFAULT_EMBED_SANDBOX = [
+      "allow-scripts",
+      "allow-same-origin",
+      "allow-presentation",
+      "allow-popups",
+      "allow-popups-to-escape-sandbox"
+    ];
+    EMBED_FEATURES = /* @__PURE__ */ new Set([
+      "accelerometer",
+      "autoplay",
+      "clipboard-write",
+      "encrypted-media",
+      "fullscreen",
+      "gyroscope",
+      "picture-in-picture",
+      "web-share"
+    ]);
+  }
+});
+
 // src/utils/guards.ts
 function isUnsafeKey(key) {
   return UNSAFE_KEYS.has(key);
@@ -1133,69 +1270,129 @@ function childNodesOf(node) {
 function getAttributeOf(el, name) {
   return nativeAccessors().getAttribute.call(el, name);
 }
-function serializeOpenTag(element, tag) {
+function isBreakout(lowerName, element) {
+  if (BREAKOUT_TAGS.has(lowerName)) return true;
+  return lowerName === "font" && (element.hasAttribute("color") || element.hasAttribute("face") || element.hasAttribute("size"));
+}
+function fitsParseContext(ns, lowerName, element, context) {
+  if (ns === SVG_NS4) {
+    if (context === 1 /* Svg */) return !isBreakout(lowerName, element);
+    return lowerName === "svg" && (context === 0 /* Html */ || context === 3 /* Annotation */);
+  }
+  if (ns === MATHML_NS) {
+    if (context === 2 /* Math */ || context === 3 /* Annotation */) return !isBreakout(lowerName, element);
+    return lowerName === "math" && context === 0 /* Html */;
+  }
+  return context === 0 /* Html */;
+}
+function childParseContext(ns, lowerName, element) {
+  if (ns === SVG_NS4) {
+    return lowerName === "foreignobject" || lowerName === "desc" || lowerName === "title" ? 0 /* Html */ : 1 /* Svg */;
+  }
+  if (ns === MATHML_NS) {
+    if (lowerName === "mi" || lowerName === "mo" || lowerName === "mn" || lowerName === "ms" || lowerName === "mtext") {
+      return 0 /* Html */;
+    }
+    if (lowerName === "annotation-xml") {
+      const encoding = (element.getAttribute("encoding") ?? "").toLowerCase();
+      return encoding === "text/html" || encoding === "application/xhtml+xml" ? 0 /* Html */ : 3 /* Annotation */;
+    }
+    return 2 /* Math */;
+  }
+  return 0 /* Html */;
+}
+function foreignAttrName(attr) {
+  const ns = attr.namespaceURI;
+  if (ns === XLINK_NS2) return `xlink:${attr.localName}`;
+  if (ns === XML_NS2) return `xml:${attr.localName}`;
+  if (ns === XMLNS_NS) return attr.localName === "xmlns" ? "xmlns" : `xmlns:${attr.localName}`;
+  return attr.name;
+}
+function serializeOpenTag(element, tag, foreign) {
   let html2 = `<${tag}`;
-  const meta2 = tag === "meta" ? /* @__PURE__ */ new Map() : null;
+  const meta2 = tag === "meta" && !foreign ? /* @__PURE__ */ new Map() : null;
+  const embed2 = tag === "iframe" && !foreign ? getEmbedRecord(element) : void 0;
+  const embedSeen = embed2 ? { sandbox: false, referrer: false, title: false, fullscreen: false } : null;
   const attrs = attributesOf(element);
   for (let i2 = 0; i2 < attrs.length; i2++) {
     const attr = attrs[i2];
-    const rawName = attr.name;
+    const rawName = foreign ? foreignAttrName(attr) : attr.name;
     if (!isSafeAttrName(rawName)) continue;
     if (isEventHandlerAttr(rawName)) continue;
     if (isForbiddenSsrAttr(rawName)) continue;
-    const value = resolveAttributeValue(rawName.toLowerCase(), attr.value);
+    const lowerName = rawName.toLowerCase();
+    let value = resolveAttributeValue(lowerName, attr.value);
     if (value === null) continue;
+    if (foreign && isRefusedAnimationAttribute(element, rawName, value)) continue;
+    if (embed2 && embedSeen) {
+      value = embedSerializedAttribute(embed2, embedSeen, lowerName, value);
+      if (value === null) continue;
+    }
     meta2?.set(rawName, value);
     html2 += ` ${rawName}="${escapeAttr(value)}"`;
   }
   if (meta2 && isForbiddenMetaSnapshot(meta2)) return null;
+  if (embed2 && embedSeen) {
+    const tail = embedSerializationTail(embed2, embedSeen);
+    if (tail === null) return null;
+    html2 += tail;
+  }
   if (!getAttributeOf(element, "data-sibu-hydrate")) {
     html2 += ` data-sibu-ssr="true"`;
   }
   return html2;
 }
+function serializeNode(node, context) {
+  if (node.nodeType === 3) return escapeHtml(node.textContent || "");
+  if (node.nodeType === 8) return `<!--${safeCommentText(node.textContent || "")}-->`;
+  let foreign = false;
+  if (!(node instanceof HTMLElement)) {
+    const ns2 = node.nodeType === 1 ? node.namespaceURI : null;
+    if (ns2 !== SVG_NS4 && ns2 !== MATHML_NS) return escapeHtml(node.textContent || "");
+    foreign = true;
+  }
+  const element = node;
+  const tag = foreign ? element.localName : tagNameOf(element).toLowerCase();
+  if (isCodeTextElement(tag)) return DEV ? `<!--ssr:${tag}-stripped-->` : "";
+  if (!/^[a-z][a-z0-9-]*$/i.test(tag)) return DEV ? "<!--ssr:invalid-tag-->" : "";
+  const ns = foreign ? element.namespaceURI : null;
+  const lowerName = tag.toLowerCase();
+  if (!fitsParseContext(ns, lowerName, element, context)) return DEV ? `<!--ssr:${tag}-misplaced-->` : "";
+  const openTag = serializeOpenTag(element, tag, foreign);
+  if (openTag === null) return DEV ? `<!--ssr:${tag}-stripped-->` : "";
+  const children = childNodesOf(element);
+  if (foreign ? children.length === 0 : VOID_ELEMENTS.has(tag)) return `${openTag} />`;
+  return {
+    open: `${openTag}>`,
+    close: `</${tag}>`,
+    children: Array.from(children),
+    context: childParseContext(ns, lowerName, element)
+  };
+}
 function renderToString(element) {
+  return renderNodeToString(element, 0 /* Html */);
+}
+function renderNodeToString(element, context) {
   if (element instanceof DocumentFragment) {
     return Array.from(element.childNodes).map((child) => {
       try {
-        return renderToString(child);
+        return renderNodeToString(child, context);
       } catch (err) {
         return ssrErrorComment(err);
       }
     }).join("");
   }
-  if (element.nodeType === 3) {
-    return escapeHtml(element.textContent || "");
-  }
-  if (element.nodeType === 8) {
-    return `<!--${safeCommentText(element.textContent || "")}-->`;
-  }
-  if (!(element instanceof HTMLElement)) {
-    return escapeHtml(element.textContent || "");
-  }
-  const tag = tagNameOf(element).toLowerCase();
-  if (isCodeTextElement(tag)) {
-    return DEV ? `<!--ssr:${tag}-stripped-->` : "";
-  }
-  if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    return DEV ? "<!--ssr:invalid-tag-->" : "";
-  }
-  const openTag = serializeOpenTag(element, tag);
-  if (openTag === null) return DEV ? `<!--ssr:${tag}-stripped-->` : "";
-  let html2 = openTag;
-  if (VOID_ELEMENTS.has(tag)) {
-    return `${html2} />`;
-  }
-  html2 += ">";
-  for (const child of Array.from(childNodesOf(element))) {
+  const frame = serializeNode(element, context);
+  if (typeof frame === "string") return frame;
+  let html2 = frame.open;
+  for (const child of frame.children) {
     try {
-      html2 += renderToString(child);
+      html2 += renderNodeToString(child, frame.context);
     } catch (err) {
       html2 += ssrErrorComment(err);
     }
   }
-  html2 += `</${tag}>`;
-  return html2;
+  return html2 + frame.close;
 }
 function hydrate(component, container, options = {}) {
   const clientTree = component();
@@ -1378,56 +1575,34 @@ function renderToDocument(component, options = {}) {
   </body>
 </html>`;
 }
-async function* renderToStream(element) {
+function renderToStream(element) {
+  return streamNode(element, 0 /* Html */);
+}
+async function* streamNode(element, context) {
   if (element instanceof DocumentFragment) {
     for (const child of Array.from(element.childNodes)) {
       try {
-        yield* renderToStream(child);
+        yield* streamNode(child, context);
       } catch (err) {
         yield ssrErrorComment(err);
       }
     }
     return;
   }
-  if (element.nodeType === 3) {
-    yield escapeHtml(element.textContent || "");
-    return;
-  }
-  if (element.nodeType === 8) {
-    yield `<!--${safeCommentText(element.textContent || "")}-->`;
+  const frame = serializeNode(element, context);
+  if (typeof frame === "string") {
+    if (frame) yield frame;
     return;
   }
-  if (!(element instanceof HTMLElement)) {
-    yield escapeHtml(element.textContent || "");
-    return;
-  }
-  const tag = tagNameOf(element).toLowerCase();
-  if (isCodeTextElement(tag)) {
-    if (DEV) yield `<!--ssr:${tag}-stripped-->`;
-    return;
-  }
-  if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
-    if (DEV) yield "<!--ssr:invalid-tag-->";
-    return;
-  }
-  const openTag = serializeOpenTag(element, tag);
-  if (openTag === null) {
-    if (DEV) yield `<!--ssr:${tag}-stripped-->`;
-    return;
-  }
-  if (VOID_ELEMENTS.has(tag)) {
-    yield `${openTag} />`;
-    return;
-  }
-  yield `${openTag}>`;
-  for (const child of Array.from(childNodesOf(element))) {
+  yield frame.open;
+  for (const child of frame.children) {
     try {
-      yield* renderToStream(child);
+      yield* streamNode(child, frame.context);
     } catch (err) {
       yield ssrErrorComment(err);
     }
   }
-  yield `</${tag}>`;
+  yield frame.close;
 }
 async function collectStream(stream) {
   let result = "";
@@ -1583,8 +1758,8 @@ async function* renderToSuspenseStream(element, pendingBoundaries = [], options)
 function escapeScriptJson(json) {
   return json.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
-function serializeState(state2, nonce, options) {
-  const rawJson = JSON.stringify(state2);
+function serializeState(state3, nonce, options) {
+  const rawJson = JSON.stringify(state3);
   const maxBytes = options?.maxBytes ?? DEFAULT_MAX_SSR_BYTES;
   const byteLen = typeof TextEncoder !== "undefined" ? new TextEncoder().encode(rawJson).byteLength : Buffer.byteLength(rawJson, "utf8");
   if (byteLen > maxBytes) {
@@ -1612,7 +1787,7 @@ function escapeHtml(str) {
 function escapeAttr(str) {
   return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-var SAFE_ATTR_NAME, VOID_ELEMENTS, nativeAccessorsByRealm, SAFE_ID, SAFE_SUSPENSE_ID, SSR_DATA_ATTR, DEFAULT_MAX_SSR_BYTES;
+var SAFE_ATTR_NAME, VOID_ELEMENTS, nativeAccessorsByRealm, SVG_NS4, MATHML_NS, XLINK_NS2, XML_NS2, XMLNS_NS, BREAKOUT_TAGS, SAFE_ID, SAFE_SUSPENSE_ID, SSR_DATA_ATTR, DEFAULT_MAX_SSR_BYTES;
 var init_ssr = __esm({
   "src/platform/ssr.ts"() {
     "use strict";
@@ -1620,6 +1795,7 @@ var init_ssr = __esm({
     init_dispose();
     init_ssr_context();
     init_elementPolicy();
+    init_embedPolicy();
     init_guards();
     init_headEntry();
     init_metaRefresh();
@@ -1642,6 +1818,57 @@ var init_ssr = __esm({
       "wbr"
     ]);
     nativeAccessorsByRealm = /* @__PURE__ */ new WeakMap();
+    SVG_NS4 = "http://www.w3.org/2000/svg";
+    MATHML_NS = "http://www.w3.org/1998/Math/MathML";
+    XLINK_NS2 = "http://www.w3.org/1999/xlink";
+    XML_NS2 = "http://www.w3.org/XML/1998/namespace";
+    XMLNS_NS = "http://www.w3.org/2000/xmlns/";
+    BREAKOUT_TAGS = /* @__PURE__ */ new Set([
+      "b",
+      "big",
+      "blockquote",
+      "body",
+      "br",
+      "center",
+      "code",
+      "dd",
+      "div",
+      "dl",
+      "dt",
+      "em",
+      "embed",
+      "h1",
+      "h2",
+      "h3",
+      "h4",
+      "h5",
+      "h6",
+      "head",
+      "hr",
+      "i",
+      "img",
+      "li",
+      "listing",
+      "menu",
+      "meta",
+      "nobr",
+      "ol",
+      "p",
+      "pre",
+      "ruby",
+      "s",
+      "small",
+      "span",
+      "strong",
+      "strike",
+      "sub",
+      "sup",
+      "table",
+      "tt",
+      "u",
+      "ul",
+      "var"
+    ]);
     SAFE_ID = /^[A-Za-z0-9_-]+$/;
     SAFE_SUSPENSE_ID = /^[A-Za-z0-9_-]+$/;
     SSR_DATA_ATTR = "__SIBU_SSR_DATA__";
@@ -2381,7 +2608,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.10.1" : "dev";
+var _runtimeVersion = true ? "4.12.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g2 = globalThis;
@@ -2641,6 +2868,16 @@ function bindChildNode(placeholder, getter) {
 init_elementPolicy();
 init_sanitize();
 init_dispose();
+
+// src/core/rendering/requireDocument.ts
+init_dev();
+function noDocument() {
+  throw new Error(
+    "[SibuJS] renderToString needs a DOM: register happy-dom or jsdom globals first." + (DEV ? ' There is no global `document`, and SibuJS builds live DOM nodes, on the server too. For example: import { GlobalRegistrator } from "@happy-dom/global-registrator"; GlobalRegistrator.register(); See SSR in AGENTS.md \xA710.' : "")
+  );
+}
+
+// src/core/rendering/tagFactory.ts
 var SVG_NS3 = "http://www.w3.org/2000/svg";
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
@@ -2833,6 +3070,7 @@ function tagFactory(tag, ns) {
     if (blocked) {
       throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
     }
+    if (typeof document === "undefined") noDocument();
     const el = ns ? document.createElementNS(ns, tag) : document.createElement(tag);
     if (first === void 0) return el;
     if (typeof first === "string") {
@@ -3137,7 +3375,7 @@ function emitDevtools(hook, event, payload) {
 // src/core/signals/signal.ts
 var _g = globalThis;
 function signal(initial, options) {
-  const state2 = {
+  const state3 = {
     value: initial,
     __v: 0,
     __sc: 0,
@@ -3150,71 +3388,64 @@ function signal(initial, options) {
   };
   const debugName = DEV ? options?.name : void 0;
   const equalsFn = options?.equals;
-  if (debugName) state2.__name = debugName;
+  if (debugName) state3.__name = debugName;
   function get() {
-    recordDependency2(state2);
-    return state2.value;
+    recordDependency2(state3);
+    return state3.value;
   }
-  get.__signal = state2;
+  get.__signal = state3;
   if (debugName) get.__name = debugName;
   let set;
   if (equalsFn) {
     set = (next) => {
-      const prev = state2.value;
+      const prev = state3.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (equalsFn(prev, newValue)) return;
-      state2.value = newValue;
-      state2.__v++;
+      state3.value = newValue;
+      state3.__v++;
       if (DEV) {
         const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-        if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+        if (hook) emitDevtools(hook, "signal:update", { signal: state3, name: debugName, oldValue: prev, newValue });
       }
-      if (!enqueueBatchedSignal(state2)) {
-        notifySubscribers2(state2);
+      if (!enqueueBatchedSignal(state3)) {
+        notifySubscribers2(state3);
       }
     };
   } else if (DEV) {
     set = (next) => {
-      const prev = state2.value;
+      const prev = state3.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (Object.is(newValue, prev)) return;
-      state2.value = newValue;
-      state2.__v++;
+      state3.value = newValue;
+      state3.__v++;
       const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-      if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
-      if (!enqueueBatchedSignal(state2)) {
-        notifySubscribers2(state2);
+      if (hook) emitDevtools(hook, "signal:update", { signal: state3, name: debugName, oldValue: prev, newValue });
+      if (!enqueueBatchedSignal(state3)) {
+        notifySubscribers2(state3);
       }
     };
   } else {
     set = (next) => {
-      const prev = state2.value;
+      const prev = state3.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (Object.is(newValue, prev)) return;
-      state2.value = newValue;
-      state2.__v++;
-      if (!enqueueBatchedSignal(state2)) {
-        notifySubscribers2(state2);
+      state3.value = newValue;
+      state3.__v++;
+      if (!enqueueBatchedSignal(state3)) {
+        notifySubscribers2(state3);
       }
     };
   }
   if (DEV) {
     const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (hook) emitDevtools(hook, "signal:create", { signal: state2, name: debugName, getter: get, initial });
+    if (hook) emitDevtools(hook, "signal:create", { signal: state3, name: debugName, getter: get, initial });
   }
   return [get, set];
 }
 
 // src/plugins/i18n.ts
 init_ssr_context();
-
-// src/utils/globalSingleton.ts
-function globalSingleton(key, create) {
-  const g2 = globalThis;
-  return g2[key] ?? (g2[key] = create());
-}
-
-// src/plugins/i18n.ts
+init_globalSingleton();
 var _i18n = globalSingleton(/* @__PURE__ */ Symbol.for("sibujs.i18n.v1"), () => ({
   locale: signal("en"),
   locales: /* @__PURE__ */ Object.create(null),
@@ -3458,11 +3689,28 @@ function normalizePathname(path2) {
 function parseQuery(query) {
   return Object.fromEntries(new URLSearchParams(query));
 }
+function parseQueryAll(query) {
+  const all = /* @__PURE__ */ new Map();
+  for (const [key, value] of new URLSearchParams(query)) {
+    const values = all.get(key);
+    if (values) values.push(value);
+    else all.set(key, [value]);
+  }
+  return Object.fromEntries(all);
+}
+function serializeQuery(query) {
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (Array.isArray(value)) for (const v of value) search.append(key, String(v));
+    else search.append(key, String(value));
+  }
+  return search.toString();
+}
 function paramsIdentity(params) {
   return JSON.stringify(Object.entries(params).sort(([a2], [b2]) => a2 < b2 ? -1 : a2 > b2 ? 1 : 0));
 }
 function queryIdentity(query) {
-  return paramsIdentity(typeof query === "string" ? parseQuery(query) : query);
+  return paramsIdentity(typeof query === "string" ? parseQueryAll(query) : query);
 }
 function isPathnameAncestor(target, current) {
   if (target === current) return true;
@@ -4138,6 +4386,7 @@ var _SibuRouter = class _SibuRouter {
       path: "/",
       params: {},
       query: {},
+      queryAll: {},
       hash: "",
       meta: {},
       matched: []
@@ -4164,6 +4413,7 @@ var _SibuRouter = class _SibuRouter {
   createRouteContext(fullPath) {
     const { path: path2, query: queryString, hash } = splitRouteUrl(fullPath);
     const query = parseQuery(queryString);
+    const queryAll = parseQueryAll(queryString);
     const match = this.matcher.match(path2 || "/");
     const params = match?.params || {};
     const meta2 = match?.route.meta || {};
@@ -4172,6 +4422,7 @@ var _SibuRouter = class _SibuRouter {
       path: path2 || "/",
       params,
       query,
+      queryAll,
       hash,
       meta: meta2,
       matched
@@ -4317,8 +4568,9 @@ var _SibuRouter = class _SibuRouter {
         path2 = path2.replace(new RegExp(`:${key}(?=[/?#]|$)`, "g"), encodeURIComponent(value));
       }
     }
-    if (to.query && Object.keys(to.query).length > 0) {
-      path2 += `?${new URLSearchParams(to.query).toString()}`;
+    const search = to.query ? serializeQuery(to.query) : "";
+    if (search) {
+      path2 += `?${search}`;
     }
     if (to.hash) {
       path2 += `#${to.hash}`;
@@ -4327,10 +4579,13 @@ var _SibuRouter = class _SibuRouter {
   }
   isSameRoute(from, to) {
     if (from.matched.length === 0 && to.matched.length > 0) return false;
-    return from.path === to.path && paramsIdentity(from.params) === paramsIdentity(to.params) && queryIdentity(from.query) === queryIdentity(to.query) && from.hash === to.hash;
+    return from.path === to.path && paramsIdentity(from.params) === paramsIdentity(to.params) && queryIdentity(from.queryAll) === queryIdentity(to.queryAll) && from.hash === to.hash;
   }
   updateHistory(to, options) {
-    const fullPath = this.options.base + to.path + (Object.keys(to.query).length ? `?${new URLSearchParams(to.query).toString()}` : "") + (to.hash ? `#${to.hash}` : "");
+    const search = serializeQuery(to.queryAll);
+    const routeUrl = to.path + (search ? `?${search}` : "") + (to.hash ? `#${to.hash}` : "");
+    const loc = globalThis.location;
+    const fullPath = this.options.mode === "hash" ? `${loc ? loc.pathname + loc.search : ""}#${routeUrl}` : this.options.base + routeUrl;
     const h = globalThis.history;
     if (!h) return;
     if (options.replace) {
@@ -4513,6 +4768,65 @@ function abortReasonOf(signal2) {
 }
 var ROUTER_KEY = /* @__PURE__ */ Symbol.for("sibujs.router.v1");
 var _routerRef = globalThis[ROUTER_KEY] ?? (globalThis[ROUTER_KEY] = { current: null });
+var [routerRevision, setRouterRevision] = signal(0);
+var awaitingParent = /* @__PURE__ */ new Map();
+var parentObserver = null;
+function stopParentObserverIfIdle() {
+  if (parentObserver && awaitingParent.size === 0) {
+    parentObserver.disconnect();
+    parentObserver = null;
+  }
+}
+function whenAnchorAttached(anchor, run) {
+  let cancelled = false;
+  queueMicrotask(() => {
+    if (cancelled) return;
+    if (anchor.parentNode) {
+      cancelled = true;
+      run();
+      return;
+    }
+    if (typeof MutationObserver === "undefined" || typeof document === "undefined") return;
+    awaitingParent.set(anchor, () => {
+      cancelled = true;
+      run();
+    });
+    if (!parentObserver) {
+      parentObserver = new MutationObserver(() => {
+        for (const [node, cb] of awaitingParent) {
+          if (!node.parentNode) continue;
+          awaitingParent.delete(node);
+          cb();
+        }
+        stopParentObserverIfIdle();
+      });
+      parentObserver.observe(document, { childList: true, subtree: true });
+    }
+  });
+  return () => {
+    if (cancelled) return;
+    cancelled = true;
+    awaitingParent.delete(anchor);
+    stopParentObserverIfIdle();
+  };
+}
+function attachRetry(anchor, rerun) {
+  const run = bindOwnerScope2(rerun);
+  let cancelWait = null;
+  return {
+    request: () => {
+      if (cancelWait) return;
+      cancelWait = whenAnchorAttached(anchor, () => {
+        cancelWait = null;
+        run();
+      });
+    },
+    cancel: () => {
+      cancelWait?.();
+      cancelWait = null;
+    }
+  };
+}
 function normalizeRoutes(routes) {
   return routes.map((route2) => {
     const normalizedChildren = route2.children && route2.children.length > 0 ? normalizeRoutes(route2.children) : route2.children;
@@ -4544,6 +4858,7 @@ function createRouter(routesOrOptions, options = {}) {
   }
   _routerRef.current = new SibuRouter(routes, options);
   ensureRouterPagehide();
+  setRouterRevision((n) => n + 1);
   return _routerRef.current;
 }
 function setRoutes(routes) {
@@ -4699,6 +5014,9 @@ function Route() {
   let currentKey = null;
   let routeTorn = false;
   const commitTarget = (seq) => routeTorn || seq !== navSeq ? null : anchor.parentNode;
+  const retryIfDetached = (seq) => {
+    if (!routeTorn && seq === navSeq && !anchor.parentNode) attachWait.request();
+  };
   const release = (node) => {
     if (!node) return;
     disposeOwned(node);
@@ -4781,6 +5099,7 @@ function Route() {
     anchor.parentNode.insertBefore(errorNode, anchor.nextSibling);
   };
   const update = async () => {
+    routerRevision();
     if (routeTorn || !_routerRef.current) return;
     const seq = ++navSeq;
     const route2 = scopedRoute(_routerRef.current);
@@ -4814,11 +5133,15 @@ function Route() {
             showLoading();
           }
           const plan = await _routerRef.current.loadPlan(routeDef, route2.path);
-          if (!commitTarget(seq)) return;
+          if (!commitTarget(seq)) {
+            retryIfDetached(seq);
+            return;
+          }
           const node = await instantiateScoped(_routerRef.current, plan, routeDef, route2.path, route2);
           const parent = commitTarget(seq);
           if (!parent) {
             release(node);
+            retryIfDetached(seq);
             return;
           }
           if (node) {
@@ -4832,15 +5155,31 @@ function Route() {
           if (routeTorn || seq !== navSeq) return;
           hideLoading();
           console.error("[Route] Component error:", error);
-          showError(error instanceof Error ? error : new Error(String(error)), routeDef);
+          fail(seq, error, routeDef);
         }
       }
     } catch (error) {
       if (seq !== navSeq) return;
       if (routeTorn) return;
       console.error("[Route] Update failed:", error);
-      showError(error instanceof Error ? error : new Error(String(error)));
+      fail(seq, error);
+    }
+  };
+  let unshownFailure = null;
+  const fail = (seq, error, routeDef) => {
+    const err = error instanceof Error ? error : new Error(String(error));
+    if (anchor.parentNode) {
+      showError(err, routeDef);
+      return;
     }
+    unshownFailure = { seq, error: err, routeDef };
+    attachWait.request();
+  };
+  const onAttached = () => {
+    const failure = unshownFailure;
+    unshownFailure = null;
+    if (failure && failure.seq === navSeq) showError(failure.error, failure.routeDef);
+    else update();
   };
   let routeInitialized = false;
   const originalUpdate = update;
@@ -4848,6 +5187,7 @@ function Route() {
     await originalUpdate();
     routeInitialized = true;
   };
+  const attachWait = attachRetry(anchor, onAttached);
   const routeTeardown = track2(wrappedUpdate);
   if (!routeInitialized) {
     queueMicrotask(
@@ -4861,6 +5201,8 @@ function Route() {
     routeTorn = true;
     navSeq++;
     routeTeardown();
+    attachWait.cancel();
+    unshownFailure = null;
     cleanupNodes();
     currentTopRoute = null;
     currentKey = null;
@@ -4884,6 +5226,7 @@ function KeepAliveRoute(options) {
   let updateSeq = 0;
   let kaTorn = false;
   const update = async () => {
+    routerRevision();
     if (kaTorn || !_routerRef.current) return;
     const seq = ++updateSeq;
     const router2 = _routerRef.current;
@@ -4901,13 +5244,16 @@ function KeepAliveRoute(options) {
       return;
     }
     if (!("component" in routeDef)) return;
-    const cacheKey = JSON.stringify([route2.path, queryIdentity(route2.query), route2.hash]);
+    const cacheKey = JSON.stringify([route2.path, queryIdentity(route2.queryAll), route2.hash]);
     const shouldCache = !includeNames || routeDef.name != null && includeNames.includes(routeDef.name);
     if (cacheKey === currentKey && currentNode) {
       updateInstanceRoute(currentNode, route2);
       return;
     }
-    if (!anchor.parentNode) return;
+    if (!anchor.parentNode) {
+      attachWait.request();
+      return;
+    }
     let node = null;
     let fromCache = false;
     if (shouldCache && cache.has(cacheKey)) {
@@ -4932,6 +5278,7 @@ function KeepAliveRoute(options) {
     const parent = anchor.parentNode;
     if (!parent) {
       if (!fromCache) disposeOwned(node);
+      attachWait.request();
       return;
     }
     if (currentNode && currentNode !== node) {
@@ -4970,6 +5317,7 @@ function KeepAliveRoute(options) {
     await update();
     initialized = true;
   };
+  const attachWait = attachRetry(anchor, update);
   const kaTeardown = track2(wrappedUpdate);
   if (!initialized) {
     queueMicrotask(
@@ -4983,6 +5331,7 @@ function KeepAliveRoute(options) {
     kaTorn = true;
     updateSeq++;
     kaTeardown();
+    attachWait.cancel();
     for (const node of cache.values()) {
       disposeOwned(node);
       if (node.parentNode) node.parentNode.removeChild(node);
@@ -5011,7 +5360,7 @@ function RouterLink(props, children) {
   const targetPath = normalizePathname(hrefPathRaw);
   const targetQuery = queryIdentity(hrefQueryRaw);
   const link2 = document.createElement("a");
-  link2.href = href;
+  link2.href = kind === "internal" && _routerRef.current["options"].mode === "hash" ? `#${href}` : href;
   if (target) {
     link2.target = target;
     if (target === "_blank") {
@@ -5027,7 +5376,7 @@ function RouterLink(props, children) {
     const route2 = routeGetter();
     const currentPath = normalizePathname(route2.path);
     const isActive = kind === "internal" && isPathnameAncestor(targetPath, currentPath);
-    const isExactActive = kind === "internal" && currentPath === targetPath && queryIdentity(route2.query) === targetQuery && route2.hash === hrefHash;
+    const isExactActive = kind === "internal" && currentPath === targetPath && queryIdentity(route2.queryAll) === targetQuery && route2.hash === hrefHash;
     const classes = [];
     if (isActive) {
       if (activeClass) classes.push(activeClass);
@@ -5222,12 +5571,16 @@ function Outlet() {
     currentKey = null;
   };
   const commitTarget = (seq) => outletTorn || seq !== navSeq ? null : anchor.parentNode;
+  const retryIfDetached = (seq) => {
+    if (!outletTorn && seq === navSeq && !anchor.parentNode) attachWait.request();
+  };
   const release = (node) => {
     if (!node) return;
     disposeOwned(node);
     node.parentNode?.removeChild(node);
   };
   const update = async () => {
+    routerRevision();
     if (outletTorn || !_routerRef.current) return;
     const seq = ++navSeq;
     const route2 = scopedRoute(_routerRef.current);
@@ -5248,11 +5601,15 @@ function Outlet() {
     try {
       const cacheKey = `${route2.path}\0${childRoute.path}`;
       const plan = await _routerRef.current.loadPlan(childRoute, cacheKey);
-      if (!commitTarget(seq)) return;
+      if (!commitTarget(seq)) {
+        retryIfDetached(seq);
+        return;
+      }
       const node = await instantiateScoped(_routerRef.current, plan, childRoute, cacheKey, route2);
       const parent = commitTarget(seq);
       if (!parent) {
         release(node);
+        retryIfDetached(seq);
         return;
       }
       if (!node) return;
@@ -5266,6 +5623,7 @@ function Outlet() {
       console.error("[Outlet] Failed to render child route:", error);
     }
   };
+  const attachWait = attachRetry(anchor, update);
   const outletTeardown = track2(update);
   if (!anchor.parentNode) {
     queueMicrotask(
@@ -5279,6 +5637,7 @@ function Outlet() {
     outletTorn = true;
     navSeq++;
     outletTeardown();
+    attachWait.cancel();
     if (currentNode) {
       disposeOwned(currentNode);
       if (currentNode.parentNode) currentNode.parentNode.removeChild(currentNode);
@@ -5306,6 +5665,7 @@ function routerState() {
     currentPath: () => scopedRoute(router2).path,
     params: () => scopedRoute(router2).params,
     query: () => scopedRoute(router2).query,
+    queryAll: () => scopedRoute(router2).queryAll,
     hash: () => scopedRoute(router2).hash,
     meta: () => scopedRoute(router2).meta,
     isNavigating: () => router2.isNavigating,
@@ -5548,7 +5908,7 @@ function renderRouteToString(url, routes, _options) {
   };
 }
 function renderRouteToDocument(url, routes, options) {
-  const { html: html2, state: state2 } = renderRouteToString(url, routes, options);
+  const { html: html2, state: state3 } = renderRouteToString(url, routes, options);
   const opts = options || {};
   const metaTags = (opts.meta || []).map((attrs) => serializeHeadEntry("meta", attrs)).filter(Boolean).join("\n    ");
   const linkTags = (opts.links || []).map((attrs) => serializeHeadEntry("link", attrs)).filter(Boolean).join("\n    ");
@@ -5557,7 +5917,7 @@ function renderRouteToDocument(url, routes, options) {
     if (!safe) return "";
     return `<script src="${escapeAttrLocal(safe)}"></script>`;
   }).filter(Boolean).join("\n    ");
-  const stateScript = serializeRouteState(state2, opts.nonce);
+  const stateScript = serializeRouteState(state3, opts.nonce);
   return `<!DOCTYPE html>
 <html>
   <head>
@@ -5575,8 +5935,8 @@ function renderRouteToDocument(url, routes, options) {
   </body>
 </html>`;
 }
-function serializeRouteState(state2, nonce) {
-  const json = escapeScriptJson(JSON.stringify(state2));
+function serializeRouteState(state3, nonce) {
+  const json = escapeScriptJson(JSON.stringify(state3));
   const nonceAttr = nonce ? ` nonce="${escapeAttrLocal(nonce)}"` : "";
   return `<script${nonceAttr}>window.${SSR_ROUTE_STATE_KEY}=${json}</script>`;
 }
@@ -5655,6 +6015,7 @@ function adoptThenable(value) {
 }
 
 // src/plugins/plugin.ts
+init_globalSingleton();
 var CANCELLED_BRAND = /* @__PURE__ */ Symbol.for("sibujs.plugins.installCancelled.v1");
 var _a;
 var PluginInstallCancelledError = class extends Error {
@@ -6021,7 +6382,7 @@ var CDN_ENTRY_POINTS = {
 };
 var packageInfo = {
   name: "sibujs",
-  version: true ? "4.10.1" : "dev",
+  version: true ? "4.12.0" : "dev",
   entryPoints: MODULE_ENTRY_POINTS,
   /**
    * Generate the package.json `exports` map. Module entries resolve to the
@@ -6166,7 +6527,8 @@ var env = {
 };
 
 // src/plugins/versioning.ts
-var VERSION = true ? "4.10.1" : "dev";
+init_globalSingleton();
+var VERSION = true ? "4.12.0" : "dev";
 var NUM = "(?:0|[1-9]\\d*)";
 var PRE_ID = `(?:${NUM}|\\d*[a-zA-Z-][0-9a-zA-Z-]*)`;
 var BUILD_ID = "[0-9a-zA-Z-]+";