sibujs 4.6.0 → 4.8.0

package/dist/index.cjs

@@ -28,8 +28,9 @@ __export(index_exports, {
   Loading: () => Loading,
   MAX_DRAIN_TEARDOWNS: () => MAX_DRAIN_TEARDOWNS,
   Portal: () => Portal,
-  SVG_NS: () => SVG_NS2,
+  SVG_NS: () => SVG_NS3,
   Suspense: () => Suspense,
+  __renderParsedTemplate: () => __renderParsedTemplate,
   __resetIdCounter: () => __resetIdCounter,
   a: () => a,
   abbr: () => abbr,
@@ -411,6 +412,49 @@ function registerDisposer(node, teardown) {
   const capture = resolveCapture(registrationCaptures[registrationCaptures.length - 1]);
   if (capture) capture.entries.push([node, teardown]);
 }
+function withDisposerRollback(build) {
+  const frame = { entries: [], closed: false };
+  const captured = frame.entries;
+  registrationCaptures.push(frame);
+  let result;
+  try {
+    result = build();
+  } catch (err) {
+    let executed = 0;
+    try {
+      while (captured.length > 0) {
+        if (executed >= MAX_DRAIN_TEARDOWNS) {
+          reportDrainRunaway("rollback", executed, captured.length);
+          break;
+        }
+        const [node, teardown] = captured.pop();
+        if (!unregisterDisposer(node, teardown)) continue;
+        executed++;
+        try {
+          teardown();
+        } catch (cleanupErr) {
+          reportError(cleanupErr, { phase: "cleanup", name: "disposer" });
+        }
+      }
+    } finally {
+      frame.closed = true;
+      captured.length = 0;
+      registrationCaptures.pop();
+    }
+    throw err;
+  }
+  frame.closed = true;
+  registrationCaptures.pop();
+  const parent = resolveCapture(registrationCaptures[registrationCaptures.length - 1]);
+  if (parent) {
+    for (const entry of captured) {
+      if (elementDisposers.get(entry[0])?.includes(entry[1])) parent.entries.push(entry);
+    }
+    frame.forwardTo = parent;
+  }
+  captured.length = 0;
+  return result;
+}
 function unregisterDisposer(node, teardown) {
   const disposers = elementDisposers.get(node);
   if (!disposers) return false;
@@ -490,6 +534,11 @@ function checkLeaks(warnThreshold = 0) {
 function stripControlChars(value) {
   return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
 }
+var ASCII_UPPER = /[A-Z]/;
+var ASCII_UPPER_G = /[A-Z]/g;
+function canonicalAttrName(name) {
+  return ASCII_UPPER.test(name) ? name.replace(ASCII_UPPER_G, (ch) => String.fromCharCode(ch.charCodeAt(0) + 32)) : name;
+}
 function isEventHandlerAttr(name) {
   if (name.length < 3) return false;
   const lower = name.toLowerCase();
@@ -501,6 +550,9 @@ function sanitizeUrl(url) {
   const probe = stripControlChars(url).trim();
   if (!probe) return "";
   const output2 = url.replace(OUTER_TRIM, "");
+  if (probe.length >= 2 && (probe[0] === "\\" || probe[0] === "/") && (probe[1] === "\\" || probe[1] === "/") && (probe[0] === "\\" || probe[1] === "\\")) {
+    return "";
+  }
   const lower = probe.toLowerCase();
   let schemeEnd = -1;
   for (let i2 = 0; i2 < lower.length; i2++) {
@@ -517,19 +569,58 @@ function sanitizeUrl(url) {
   if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
   return output2;
 }
-var SRCSET_DESCRIPTOR = /^\s+\d+(\.\d+)?[wx]$/;
+var SRCSET_DESCRIPTOR = /^\d+(\.\d+)?[wx]$/;
+function isSrcsetWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
 function sanitizeSrcset(value) {
-  const parts = value.split(",");
+  const input2 = String(value);
   const out = [];
-  for (let i2 = 0; i2 < parts.length; i2++) {
-    const part = parts[i2].trim();
-    if (!part) continue;
-    const m = part.match(/^(\S+)(\s+.+)?$/);
-    if (!m) continue;
-    if (m[2] !== void 0 && !SRCSET_DESCRIPTOR.test(m[2])) continue;
-    const safe = sanitizeUrl(m[1]);
+  let i2 = 0;
+  const n = input2.length;
+  while (i2 < n) {
+    while (i2 < n && (isSrcsetWhitespace(input2[i2]) || input2[i2] === ",")) i2++;
+    if (i2 >= n) break;
+    const urlStart = i2;
+    while (i2 < n && !isSrcsetWhitespace(input2[i2])) i2++;
+    let url = input2.slice(urlStart, i2);
+    const descriptors = [];
+    if (url.endsWith(",")) {
+      url = url.replace(/,+$/, "");
+    } else {
+      let current = "";
+      let inParens = false;
+      while (i2 < n) {
+        const ch = input2[i2];
+        if (inParens) {
+          current += ch;
+          if (ch === ")") inParens = false;
+          i2++;
+          continue;
+        }
+        if (isSrcsetWhitespace(ch)) {
+          if (current) descriptors.push(current);
+          current = "";
+          i2++;
+          continue;
+        }
+        if (ch === ",") {
+          i2++;
+          break;
+        }
+        if (ch === "(") inParens = true;
+        current += ch;
+        i2++;
+      }
+      if (current) descriptors.push(current);
+    }
+    if (url === "") continue;
+    if (descriptors.length > 1) continue;
+    if (descriptors.length === 1 && !SRCSET_DESCRIPTOR.test(descriptors[0])) continue;
+    const safe = sanitizeUrl(url);
     if (!safe) continue;
-    out.push(m[2] ? `${safe}${m[2]}` : safe);
+    if (safe.startsWith(",") || safe.endsWith(",")) continue;
+    out.push(descriptors.length === 1 ? `${safe} ${descriptors[0]}` : safe);
   }
   return out.join(", ");
 }
@@ -588,8 +679,16 @@ var BLOCKED_CSS_NEEDLES = [
   "behavior:",
   "@import",
   "image-set(",
-  "filter:progid"
+  "filter:progid",
+  // CSS Images 4 `image("…")` and CSS Values 5 `src("…")` take a URL as a
+  // plain STRING, so they fetch without ever spelling `url(`. Support is thin
+  // today, which is exactly when a blocklist should get ahead of it.
+  "image(",
+  "src("
 ];
+var CSS_REASON_MOZ_BINDING = 4;
+var CSS_REASON_BEHAVIOR = 5;
+var CSS_REASON_PROGID = 8;
 function describeElement(el) {
   if (!el) return "an element";
   let out = el.tagName.toLowerCase();
@@ -613,7 +712,9 @@ function warnDroppedDeclaration(value, reason, ctx) {
       "behavior: loads and runs a remote HTC script",
       "@import pulls in a remote stylesheet",
       "image-set() fetches remote images, the same exfiltration channel as url()",
-      "filter:progid activates legacy scriptable filters"
+      "filter:progid activates legacy scriptable filters",
+      "image() fetches its string argument as a URL, the same exfiltration channel as url()",
+      "src() fetches its string argument as a URL, the same exfiltration channel as url()"
     ];
     const declaration = ctx?.property ? `${ctx.property}: ${value}` : value;
     const where = describeElement(ctx?.element);
@@ -628,27 +729,110 @@ function warnDroppedDeclaration(value, reason, ctx) {
     return `style declaration "${declaration}" was dropped by the style sanitizer on ${where} \u2014 ${reasons[reason]}. The element renders without it, which usually looks like a missing image rather than an error. Sanctioned alternatives: for a content image use an <img> element (or a <picture>); for decoration, put the rule in a stylesheet and set a class instead \u2014 stylesheet CSS is not sanitized, only inline style attributes are. If this declaration is not yours, it came from untrusted data and the drop just prevented an exfiltration.`;
   });
 }
+function normalizeCssForScan(value) {
+  const normalized = value.includes("\\") ? decodeCssEscapes(value) : value;
+  return normalized.toLowerCase().replace(/\s+/g, "");
+}
 function blockedCssReason(value) {
   if (!CSS_DANGER_GATE.test(value)) return -1;
-  const normalized = value.includes("\\") ? decodeCssEscapes(value) : value;
-  const lower = normalized.toLowerCase().replace(/\s+/g, "");
+  const lower = normalizeCssForScan(value);
   for (let i2 = 0; i2 < BLOCKED_CSS_NEEDLES.length; i2++) {
     if (lower.includes(BLOCKED_CSS_NEEDLES[i2])) return i2;
   }
   return -1;
 }
-function sanitizeCSSValue(value, context2) {
-  const reason = blockedCssReason(value);
+function sanitizeCSSDeclaration(property, value, context2) {
+  const reason = blockedDeclarationReason(property, value);
   if (reason === -1) return value;
-  warnDroppedDeclaration(value, reason, context2);
+  warnDroppedDeclaration(value, reason, { property, element: context2?.element });
   return "";
 }
+function blockedDeclarationReason(property, value) {
+  const reason = blockedCssReason(value);
+  if (reason !== -1) return reason;
+  const name = canonicalAttrName(property);
+  if (name === "behavior") return CSS_REASON_BEHAVIOR;
+  if (name === "-moz-binding") return CSS_REASON_MOZ_BINDING;
+  if ((name === "filter" || name === "-ms-filter") && normalizeCssForScan(value).includes("progid:")) {
+    return CSS_REASON_PROGID;
+  }
+  return -1;
+}
+function parseStyleDeclarations(css) {
+  const chunks = [];
+  let buf = "";
+  let depth = 0;
+  let quote2 = "";
+  for (let i2 = 0; i2 < css.length; i2++) {
+    const ch = css[i2];
+    if (quote2) {
+      buf += ch;
+      if (ch === "\\" && i2 + 1 < css.length) buf += css[++i2];
+      else if (ch === quote2) quote2 = "";
+      continue;
+    }
+    if (ch === "\\") {
+      buf += ch;
+      if (i2 + 1 < css.length) buf += css[++i2];
+      continue;
+    }
+    if (ch === "/" && css[i2 + 1] === "*") {
+      const end = css.indexOf("*/", i2 + 2);
+      if (end === -1) return null;
+      i2 = end + 1;
+      continue;
+    }
+    if (ch === '"' || ch === "'") quote2 = ch;
+    else if (ch === "(" || ch === "[") depth++;
+    else if (ch === ")" || ch === "]") {
+      if (--depth < 0) return null;
+    } else if (ch === "{" || ch === "}") return null;
+    else if (ch === ";" && depth === 0) {
+      chunks.push(buf);
+      buf = "";
+      continue;
+    }
+    buf += ch;
+  }
+  if (quote2 || depth !== 0) return null;
+  chunks.push(buf);
+  const out = [];
+  for (const chunk of chunks) {
+    const colon = chunk.indexOf(":");
+    if (colon === -1) continue;
+    const rawName = chunk.slice(0, colon).trim();
+    if (!/^(--[\w-]+|-?[a-zA-Z_][\w-]*)$/.test(rawName)) continue;
+    let value = chunk.slice(colon + 1).trim();
+    const bang = /!\s*important\s*$/i.exec(value);
+    if (bang) value = value.slice(0, bang.index).trim();
+    if (value === "") continue;
+    const property = rawName.startsWith("--") ? rawName : canonicalAttrName(rawName);
+    out.push([property, value, bang !== null]);
+  }
+  return out;
+}
+function sanitizeStyleDeclarationList(cssText, context2) {
+  const input2 = String(cssText);
+  const declarations = parseStyleDeclarations(input2);
+  if (declarations === null) {
+    if (blockedCssReason(input2) !== -1) warnDroppedDeclaration(input2, blockedCssReason(input2), context2);
+    return "";
+  }
+  const kept = [];
+  for (const [property, value, important] of declarations) {
+    const reason = blockedDeclarationReason(property, value);
+    if (reason !== -1) {
+      warnDroppedDeclaration(value, reason, { property, element: context2?.element });
+      continue;
+    }
+    kept.push(`${property}: ${value}${important ? " !important" : ""}`);
+  }
+  return kept.join("; ");
+}
 function sanitizeStyleAttribute(cssText, context2) {
   const input2 = String(cssText);
   if (input2.trim() === "") return "";
-  if (typeof document === "undefined") {
-    return sanitizeCSSValue(input2, context2) === "" ? "" : input2;
-  }
+  if (typeof document === "undefined") return sanitizeStyleDeclarationList(input2, context2);
   const probe = document.createElement("div");
   try {
     probe.style.cssText = input2;
@@ -659,8 +843,7 @@ function sanitizeStyleAttribute(cssText, context2) {
   for (let i2 = 0; i2 < probe.style.length; i2++) {
     const property = probe.style[i2];
     const value = probe.style.getPropertyValue(property);
-    let reason = blockedCssReason(value);
-    if (reason === -1) reason = blockedCssReason(`${property}:${value}`);
+    const reason = blockedDeclarationReason(property, value);
     if (reason !== -1) {
       warnDroppedDeclaration(value, reason, { property, element: context2?.element });
       continue;
@@ -692,6 +875,13 @@ var HTML_CONTENT_ATTRIBUTES = /* @__PURE__ */ new Set(["srcdoc"]);
 function isHtmlContentAttribute(name) {
   return HTML_CONTENT_ATTRIBUTES.has(name.toLowerCase());
 }
+function isUrlAttribute(attr) {
+  return URL_ATTRIBUTES.has(attr.toLowerCase());
+}
+function isPolicyAttribute(name) {
+  const lower = name.toLowerCase();
+  return lower === "style" || URL_ATTRIBUTES.has(lower);
+}
 function sanitizeAttributeString(attr, value, context2) {
   const lower = attr.toLowerCase();
   if (lower === "srcset") return sanitizeSrcset(value);
@@ -699,27 +889,233 @@ function sanitizeAttributeString(attr, value, context2) {
   if (lower === "style") return sanitizeStyleAttribute(value, context2);
   return value;
 }
+function resolveAttributeValue(attr, value, context2) {
+  if (!isPolicyAttribute(attr)) return value;
+  const safe = sanitizeAttributeString(attr, value, context2);
+  return safe === "" ? null : safe;
+}
 
-// src/utils/setSafeAttribute.ts
+// src/utils/metaRefresh.ts
+function isAsciiWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
+function trimAsciiWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && isAsciiWhitespace(value[start])) start++;
+  while (end > start && isAsciiWhitespace(value[end - 1])) end--;
+  return value.slice(start, end);
+}
+var forbidden = (reason) => ({ kind: "forbidden", reason });
+function parseMetaRefreshContent(content) {
+  const raw = trimAsciiWhitespace(stripControlChars(content));
+  if (raw === "") return forbidden(DEV ? "empty content" : "");
+  let i2 = 0;
+  while (i2 < raw.length && raw[i2] >= "0" && raw[i2] <= "9") i2++;
+  if (i2 === 0) return forbidden(DEV ? "missing or non-numeric delay" : "");
+  const delay = Number.parseInt(raw.slice(0, i2), 10);
+  if (!Number.isFinite(delay)) return forbidden(DEV ? "unparseable delay" : "");
+  while (i2 < raw.length && isAsciiWhitespace(raw[i2])) i2++;
+  if (i2 === raw.length) return { kind: "delay-only", delay };
+  if (raw[i2] !== ";" && raw[i2] !== ",") return forbidden(DEV ? "unexpected text after delay" : "");
+  i2++;
+  while (i2 < raw.length && isAsciiWhitespace(raw[i2])) i2++;
+  const keyStart = i2;
+  while (i2 < raw.length && !isAsciiWhitespace(raw[i2]) && raw[i2] !== "=") i2++;
+  const key = raw.slice(keyStart, i2).toLowerCase();
+  if (key !== "url") return forbidden(DEV ? `unsupported refresh key ${JSON.stringify(key)}` : "");
+  while (i2 < raw.length && isAsciiWhitespace(raw[i2])) i2++;
+  if (raw[i2] !== "=") return forbidden(DEV ? "missing '=' after url" : "");
+  i2++;
+  while (i2 < raw.length && isAsciiWhitespace(raw[i2])) i2++;
+  let destination;
+  const quote2 = raw[i2];
+  if (quote2 === '"' || quote2 === "'") {
+    const close = raw.indexOf(quote2, i2 + 1);
+    if (close === -1) return forbidden(DEV ? "unterminated quoted destination" : "");
+    destination = raw.slice(i2 + 1, close);
+    const rest = trimAsciiWhitespace(raw.slice(close + 1));
+    if (rest !== "") return forbidden(DEV ? "trailing text after quoted destination" : "");
+  } else {
+    destination = trimAsciiWhitespace(raw.slice(i2));
+    if (/[;,]/.test(destination)) return forbidden(DEV ? "multiple refresh assignments" : "");
+  }
+  if (destination === "") return forbidden(DEV ? "empty destination" : "");
+  const sanitizedDestination = sanitizeUrl(destination);
+  if (sanitizedDestination === "") return forbidden(DEV ? "destination uses a disallowed protocol" : "");
+  return { kind: "allowed", delay, destination, sanitizedDestination };
+}
+function resolveMetaRefreshPolicy(attributes) {
+  let httpEquiv;
+  let content;
+  let duplicateName;
+  const seen = /* @__PURE__ */ new Set();
+  for (const [key, value] of attributes) {
+    const canonical = canonicalAttrName(key);
+    if (seen.has(canonical)) duplicateName = canonical;
+    seen.add(canonical);
+    if (canonical === "http-equiv") httpEquiv = value;
+    else if (canonical === "content") content = value;
+  }
+  if (duplicateName !== void 0) {
+    return forbidden(DEV ? `duplicate case-insensitive attribute ${JSON.stringify(duplicateName)}` : "");
+  }
+  if (typeof httpEquiv !== "string") return { kind: "not-refresh" };
+  if (trimAsciiWhitespace(stripControlChars(httpEquiv)).toLowerCase() !== "refresh") {
+    return { kind: "not-refresh" };
+  }
+  if (typeof content !== "string") return { kind: "not-refresh" };
+  return parseMetaRefreshContent(content);
+}
+
+// src/utils/elementPolicy.ts
 var HTML_NS = "http://www.w3.org/1999/xhtml";
 var SVG_NS = "http://www.w3.org/2000/svg";
+var BLOCKED_ELEMENTS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
+function canonicalTagName(tag) {
+  return canonicalAttrName(tag);
+}
+function isBlockedElement(tag) {
+  return BLOCKED_ELEMENTS.has(canonicalTagName(tag));
+}
+var CODE_TEXT_ELEMENTS = /* @__PURE__ */ new Set(["script", "style"]);
+function isCodeTextElement(tag) {
+  return CODE_TEXT_ELEMENTS.has(canonicalTagName(tag));
+}
+var ContextualRefusal = {
+  None: 0,
+  /** The element would carry a refresh directive the shared policy forbids. */
+  MetaRefreshForbidden: 1,
+  /** A `<meta>` with a reactive binding may not carry any refresh directive. */
+  MetaRefreshReactive: 2,
+  /** A runtime value may not choose which program a `<script>` runs. */
+  ScriptSource: 3,
+  /** An SVG animation may not target a URL, handler or document attribute. */
+  AnimationTarget: 4,
+  /** A runtime-written `href` may not become an applied stylesheet. */
+  StylesheetSource: 5
+};
+var SCRIPT_SOURCE_ATTRIBUTES = /* @__PURE__ */ new Set(["src", "href", "xlink:href", "type", "language"]);
+var SVG_ANIMATION_ELEMENTS = /* @__PURE__ */ new Set(["animate", "set", "animateMotion", "animateTransform", "animateColor"]);
+var reactiveMetaElements = /* @__PURE__ */ new WeakSet();
+function isHtmlNamespace(el) {
+  return el.namespaceURI === HTML_NS || el.namespaceURI === null;
+}
+function metaSnapshot(el, canonical, value) {
+  const snapshot = /* @__PURE__ */ new Map();
+  const attrs = el.attributes;
+  for (let i2 = 0; i2 < attrs.length; i2++) {
+    const attr = attrs[i2];
+    if (attr.name === canonical) continue;
+    snapshot.set(attr.name, attr.value);
+  }
+  if (canonical !== null && value !== null) snapshot.set(canonical, value);
+  return snapshot;
+}
+function claimReactiveMeta(el) {
+  if (reactiveMetaElements.has(el)) return;
+  reactiveMetaElements.add(el);
+  if (el.getAttribute("content") === null) return;
+  if (resolveMetaRefreshPolicy(metaSnapshot(el, null, null)).kind !== "not-refresh") {
+    el.removeAttribute("content");
+  }
+}
+function metaRefusal(el, name, value, origin) {
+  if (!isHtmlNamespace(el)) return ContextualRefusal.None;
+  const canonical = canonicalAttrName(name);
+  if (canonical !== "http-equiv" && canonical !== "content") return ContextualRefusal.None;
+  if (origin === "reactive") claimReactiveMeta(el);
+  if (value === null) return ContextualRefusal.None;
+  if (canonical === "content" && !el.hasAttribute("http-equiv")) return ContextualRefusal.None;
+  const decision = resolveMetaRefreshPolicy(metaSnapshot(el, canonical, value));
+  if (decision.kind === "forbidden") return ContextualRefusal.MetaRefreshForbidden;
+  if (decision.kind !== "not-refresh" && reactiveMetaElements.has(el)) return ContextualRefusal.MetaRefreshReactive;
+  return ContextualRefusal.None;
+}
+function animationRefusal(name, value) {
+  if (value === null || canonicalAttrName(name) !== "attributename") return ContextualRefusal.None;
+  const target = stripControlChars(value);
+  return isUrlAttribute(target) || isEventHandlerAttr(target) || isHtmlContentAttribute(target) ? ContextualRefusal.AnimationTarget : ContextualRefusal.None;
+}
+var runtimeHrefLinks = /* @__PURE__ */ new WeakSet();
+function relHasStylesheet(rel) {
+  if (rel === null) return false;
+  const lower = canonicalAttrName(rel);
+  if (!lower.includes("stylesheet")) return false;
+  const tokens = lower.split(/[\t\n\f\r ]+/);
+  for (let i2 = 0; i2 < tokens.length; i2++) if (tokens[i2] === "stylesheet") return true;
+  return false;
+}
+function stylesheetRefusal(el, name, value, origin) {
+  if (!isHtmlNamespace(el)) return ContextualRefusal.None;
+  const canonical = canonicalAttrName(name);
+  if (canonical === "href") {
+    if (origin === "static" || value === null) return ContextualRefusal.None;
+    if (relHasStylesheet(el.getAttribute("rel"))) return ContextualRefusal.StylesheetSource;
+    runtimeHrefLinks.add(el);
+    return ContextualRefusal.None;
+  }
+  if (canonical === "rel") {
+    if (!relHasStylesheet(value)) return ContextualRefusal.None;
+    return runtimeHrefLinks.has(el) && el.hasAttribute("href") ? ContextualRefusal.StylesheetSource : ContextualRefusal.None;
+  }
+  return ContextualRefusal.None;
+}
+function contextualAttributeRefusal(el, name, value, origin) {
+  const local = el.localName;
+  if (local === "meta") return metaRefusal(el, name, value, origin);
+  if (local === "link") return stylesheetRefusal(el, name, value, origin);
+  if (local === "script") {
+    if (origin === "static" || value === null) return ContextualRefusal.None;
+    return SCRIPT_SOURCE_ATTRIBUTES.has(canonicalAttrName(name)) ? ContextualRefusal.ScriptSource : ContextualRefusal.None;
+  }
+  if (SVG_ANIMATION_ELEMENTS.has(local) && el.namespaceURI === SVG_NS) return animationRefusal(name, value);
+  return ContextualRefusal.None;
+}
+function settleAttributeProvenance(el, name, origin) {
+  if (el.localName !== "link" || canonicalAttrName(name) !== "href") return;
+  if (origin !== "static" && el.hasAttribute("href")) runtimeHrefLinks.add(el);
+  else runtimeHrefLinks.delete(el);
+}
+
+// src/utils/setSafeAttribute.ts
+var HTML_NS2 = "http://www.w3.org/1999/xhtml";
+var SVG_NS2 = "http://www.w3.org/2000/svg";
 var XLINK_NS = "http://www.w3.org/1999/xlink";
 var XML_NS = "http://www.w3.org/XML/1998/namespace";
 var BOOLEAN_IDL_ATTRS = /* @__PURE__ */ new Set(["checked", "disabled", "selected"]);
 function isHtmlElement(el) {
-  return el.namespaceURI === null || el.namespaceURI === HTML_NS;
+  return el.namespaceURI === null || el.namespaceURI === HTML_NS2;
+}
+function warnContextualRefusal(label2, name, refusal) {
+  devWarnLazy(() => {
+    const reasons = [
+      "",
+      'the element would become a <meta http-equiv="refresh"> directive the shared refresh policy forbids (a destination outside the URL allowlist, or a directive too malformed to read unambiguously)',
+      "a <meta> whose http-equiv or content is reactive may never carry a refresh directive: a browser schedules the navigation as soon as the directive is valid, and nothing can withdraw it when the state changes back",
+      "a runtime value may not choose the program a <script> runs; name the script in static template source, or load it through Head({ script }) as an explicit trust decision",
+      "an SVG animation may not target a URL, event-handler or nested-document attribute; its to / values would be written into that attribute without passing the URL policy",
+      'a runtime-chosen href may not become an applied <link rel="stylesheet">: a well-formed URL is not a trusted stylesheet. Name the stylesheet in static template source, or load a runtime-chosen one through Head({ link }) as an explicit trust decision'
+    ];
+    return `${label2}: refusing "${name}" in this element's context \u2014 ${reasons[refusal]}. The write was not performed.`;
+  });
 }
 function setProp(el, key, val) {
   el[key] = val;
 }
 function namespaceFor(el, name) {
-  if (el.namespaceURI !== SVG_NS) return null;
+  if (el.namespaceURI !== SVG_NS2) return null;
   const lower = name.toLowerCase();
   if (lower.startsWith("xlink:")) return XLINK_NS;
   if (lower.startsWith("xml:")) return XML_NS;
   return null;
 }
 function setSafeAttribute(el, name, value, options = {}) {
+  const written = commitSafeAttribute(el, name, value, options);
+  if (el.localName === "link") settleAttributeProvenance(el, name, options.reactive ? "reactive" : "runtime");
+  return written;
+}
+function commitSafeAttribute(el, name, value, options) {
   const ns = namespaceFor(el, name);
   const localName = ns ? name.slice(name.indexOf(":") + 1) : name;
   if (isEventHandlerAttr(name)) {
@@ -732,6 +1128,14 @@ function setSafeAttribute(el, name, value, options = {}) {
     else el.removeAttribute(name);
     return false;
   }
+  const pending = value == null || value === false ? null : value === true ? "" : String(value);
+  const refusal = contextualAttributeRefusal(el, name, pending, options.reactive ? "reactive" : "runtime");
+  if (refusal !== ContextualRefusal.None) {
+    warnContextualRefusal(options.label ?? "setSafeAttribute", name, refusal);
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return false;
+  }
   if (value == null) {
     if (ns) el.removeAttributeNS(ns, localName);
     else el.removeAttribute(name);
@@ -775,13 +1179,32 @@ function setSafeAttribute(el, name, value, options = {}) {
     setProp(el, idlName, idlName === "checked" ? Boolean(value) : str);
     return true;
   }
-  const safe = sanitizeAttributeString(name, str, { element: el });
+  const safe = str === "" ? "" : resolveAttributeValue(name, str, { element: el });
+  if (safe === null) {
+    if (ns) el.removeAttributeNS(ns, localName);
+    else el.removeAttribute(name);
+    return true;
+  }
   const current = ns ? el.getAttributeNS(ns, localName) : el.getAttribute(name);
   if (current === safe) return true;
   if (ns) el.setAttributeNS(ns, name, safe);
   else el.setAttribute(name, safe);
   return true;
 }
+function setTrustedAttribute(el, name, value) {
+  if (isHtmlContentAttribute(name)) {
+    if (DEV) devWarn(`html: refusing static attribute "${name}" \u2014 the browser parses it as a nested document.`);
+    return false;
+  }
+  const refusal = contextualAttributeRefusal(el, name, value, "static");
+  if (refusal !== ContextualRefusal.None) {
+    warnContextualRefusal("html (static attribute)", name, refusal);
+    return false;
+  }
+  el.setAttribute(name, value);
+  if (el.localName === "link") settleAttributeProvenance(el, name, "static");
+  return true;
+}
 
 // src/reactivity/track-core.ts
 var POOL_MAX = 4096;
@@ -1274,7 +1697,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.6.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g2 = globalThis;
@@ -1345,7 +1768,7 @@ function bindAttribute(el, attr, getter) {
       reportError(err, { phase: "binding", name: `bindAttribute("${attr}")`, node: el });
       return;
     }
-    setSafeAttribute(el, attr, value, { label: `bindAttribute("${attr}")` });
+    setSafeAttribute(el, attr, value, { label: `bindAttribute("${attr}")`, reactive: true });
   }
   return reactiveBinding2(commit, el);
 }
@@ -1370,7 +1793,7 @@ function bindDynamic(el, nameGetter, valueGetter) {
       el.removeAttribute(prevName);
       prevName = null;
     }
-    if (!setSafeAttribute(el, name, value, { label: "bindDynamic" })) return;
+    if (!setSafeAttribute(el, name, value, { label: "bindDynamic", reactive: true })) return;
     prevName = name;
   }
   const teardown = reactiveBinding2(commit, el);
@@ -1551,11 +1974,7 @@ function bindChildNode(placeholder, getter) {
 }
 
 // src/core/rendering/tagFactory.ts
-var SVG_NS2 = "http://www.w3.org/2000/svg";
-var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
-function isBlockedTag(tag) {
-  return BLOCKED_TAGS.has(tag.toLowerCase());
-}
+var SVG_NS3 = "http://www.w3.org/2000/svg";
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
   "location",
@@ -1582,8 +2001,35 @@ function toKebab(prop) {
 }
 function applyStyle(el, style2) {
   if (typeof style2 === "function") {
+    const getter = style2;
+    let written = [];
+    let wroteString = false;
     const teardown = reactiveBinding2(() => {
-      el.setAttribute("style", sanitizeStyleAttribute(String(style2()), { element: el }));
+      const value = getter();
+      if (value === null || typeof value !== "object") {
+        written = [];
+        wroteString = true;
+        el.setAttribute("style", sanitizeStyleAttribute(String(value), { element: el }));
+        return;
+      }
+      const decl = el.style;
+      if (wroteString) {
+        el.removeAttribute("style");
+        wroteString = false;
+      }
+      const next = [];
+      for (const prop in value) {
+        if (!Object.hasOwn(value, prop)) continue;
+        const val = value[prop];
+        if (val == null) continue;
+        const name = toKebab(prop);
+        next.push(name);
+        decl.setProperty(name, sanitizeCSSDeclaration(name, String(val), { element: el }));
+      }
+      for (let i2 = 0; i2 < written.length; i2++) {
+        if (next.indexOf(written[i2]) === -1) decl.removeProperty(written[i2]);
+      }
+      written = next;
     }, el);
     registerDisposer(el, teardown);
     return;
@@ -1594,16 +2040,17 @@ function applyStyle(el, style2) {
   }
   const htmlEl = el;
   for (const prop in style2) {
+    if (!Object.hasOwn(style2, prop)) continue;
     const val = style2[prop];
     const name = toKebab(prop);
     if (typeof val === "function") {
       const getter = val;
       const teardown = reactiveBinding2(() => {
-        htmlEl.style.setProperty(name, sanitizeCSSValue(String(getter()), { property: name, element: el }));
+        htmlEl.style.setProperty(name, sanitizeCSSDeclaration(name, String(getter()), { element: el }));
       }, el);
       registerDisposer(el, teardown);
     } else {
-      htmlEl.style.setProperty(name, sanitizeCSSValue(String(val), { property: name, element: el }));
+      htmlEl.style.setProperty(name, sanitizeCSSDeclaration(name, String(val), { element: el }));
     }
   }
 }
@@ -1614,7 +2061,9 @@ function applyClass(el, cls) {
   }
   if (typeof cls === "function") {
     const teardown = reactiveBinding2(() => {
-      el.setAttribute("class", cls());
+      const value = cls();
+      if (value == null || value === false) el.removeAttribute("class");
+      else el.setAttribute("class", value);
     }, el);
     registerDisposer(el, teardown);
     return;
@@ -1623,6 +2072,7 @@ function applyClass(el, cls) {
   let hasReactive = false;
   let result = "";
   for (const name in obj) {
+    if (!Object.hasOwn(obj, name)) continue;
     const val = obj[name];
     if (typeof val === "function") {
       hasReactive = true;
@@ -1634,6 +2084,7 @@ function applyClass(el, cls) {
     const update = () => {
       let r = "";
       for (const name in obj) {
+        if (!Object.hasOwn(obj, name)) continue;
         const val = obj[name];
         const active = typeof val === "function" ? val() : val;
         if (active) r = r ? `${r} ${name}` : name;
@@ -1696,8 +2147,8 @@ function appendChildren(el, nodes) {
     }
   }
 }
-var tagFactory = (tag, ns) => {
-  const blocked = isBlockedTag(tag);
+function tagFactory(tag, ns) {
+  const blocked = isBlockedElement(tag);
   return (first, second) => {
     if (blocked) {
       throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
@@ -1745,7 +2196,9 @@ var tagFactory = (tag, ns) => {
     const pClass = props.class;
     if (pClass != null) applyClass(el, pClass);
     const pId = props.id;
-    if (pId != null) {
+    if (typeof pId === "function") {
+      registerDisposer(el, bindAttribute(el, "id", pId));
+    } else if (pId != null) {
       if (DEV && typeof pId === "string" && CLOBBER_RISKY_IDS.has(pId.toLowerCase())) {
         devWarn(
           `tagFactory: element id="${pId}" matches a common global and may cause DOM clobbering. Avoid setting ids from untrusted input.`
@@ -1758,6 +2211,7 @@ var tagFactory = (tag, ns) => {
     const pOn = props.on;
     if (pOn) {
       for (const ev in pOn) {
+        if (!Object.hasOwn(pOn, ev)) continue;
         const handler = pOn[ev];
         if (typeof handler === "function") {
           el.addEventListener(ev, handler);
@@ -1784,6 +2238,7 @@ var tagFactory = (tag, ns) => {
           continue;
         // already handled above / below
         default: {
+          if (!Object.hasOwn(props, key)) continue;
           const value = props[key];
           if (value == null) continue;
           if (isEventHandlerAttr(key)) continue;
@@ -1795,12 +2250,10 @@ var tagFactory = (tag, ns) => {
         }
       }
     }
-    if (props.onElement && typeof props.onElement === "function") {
-      props.onElement(el);
-    }
+    if (typeof props.onElement === "function") props.onElement(el);
     return el;
   };
-};
+}
 
 // src/core/rendering/html.ts
 var html = tagFactory("html");
@@ -1875,7 +2328,7 @@ var param = tagFactory("param");
 var picture = tagFactory("picture");
 var portal = tagFactory("portal");
 var source = tagFactory("source");
-var svg = tagFactory("svg", SVG_NS2);
+var svg = tagFactory("svg", SVG_NS3);
 var math = tagFactory("math");
 var canvas = tagFactory("canvas");
 var noscript = tagFactory("noscript");
@@ -1916,26 +2369,26 @@ var base = tagFactory("base");
 var link = tagFactory("link");
 var meta = tagFactory("meta");
 var style = tagFactory("style");
-var circle = tagFactory("circle", SVG_NS2);
-var ellipse = tagFactory("ellipse", SVG_NS2);
-var g = tagFactory("g", SVG_NS2);
-var line = tagFactory("line", SVG_NS2);
-var path = tagFactory("path", SVG_NS2);
-var polygon = tagFactory("polygon", SVG_NS2);
-var polyline = tagFactory("polyline", SVG_NS2);
-var rect = tagFactory("rect", SVG_NS2);
-var text = tagFactory("text", SVG_NS2);
-var tspan = tagFactory("tspan", SVG_NS2);
-var defs = tagFactory("defs", SVG_NS2);
-var clipPath = tagFactory("clipPath", SVG_NS2);
-var mask = tagFactory("mask", SVG_NS2);
-var pattern = tagFactory("pattern", SVG_NS2);
-var linearGradient = tagFactory("linearGradient", SVG_NS2);
-var radialGradient = tagFactory("radialGradient", SVG_NS2);
-var stop = tagFactory("stop", SVG_NS2);
-var use = tagFactory("use", SVG_NS2);
-var symbol = tagFactory("symbol", SVG_NS2);
-var marker = tagFactory("marker", SVG_NS2);
+var circle = tagFactory("circle", SVG_NS3);
+var ellipse = tagFactory("ellipse", SVG_NS3);
+var g = tagFactory("g", SVG_NS3);
+var line = tagFactory("line", SVG_NS3);
+var path = tagFactory("path", SVG_NS3);
+var polygon = tagFactory("polygon", SVG_NS3);
+var polyline = tagFactory("polyline", SVG_NS3);
+var rect = tagFactory("rect", SVG_NS3);
+var text = tagFactory("text", SVG_NS3);
+var tspan = tagFactory("tspan", SVG_NS3);
+var defs = tagFactory("defs", SVG_NS3);
+var clipPath = tagFactory("clipPath", SVG_NS3);
+var mask = tagFactory("mask", SVG_NS3);
+var pattern = tagFactory("pattern", SVG_NS3);
+var linearGradient = tagFactory("linearGradient", SVG_NS3);
+var radialGradient = tagFactory("radialGradient", SVG_NS3);
+var stop = tagFactory("stop", SVG_NS3);
+var use = tagFactory("use", SVG_NS3);
+var symbol = tagFactory("symbol", SVG_NS3);
+var marker = tagFactory("marker", SVG_NS3);
 var center = tagFactory("center");
 var font = tagFactory("font");
 var marquee = tagFactory("marquee");
@@ -2049,10 +2502,13 @@ function safeCall(cb, hookName) {
     return void 0;
   }
 }
-function runMountCallback(callback, hookName, element) {
+function runMountCallback(callback, hookName, element, isDisposed) {
   const cleanup3 = safeCall(callback, hookName);
-  if (typeof cleanup3 === "function" && element) {
-    registerDisposer(element, cleanup3);
+  if (typeof cleanup3 !== "function") return;
+  if (isDisposed() || !element.isConnected) {
+    safeCall(cleanup3, "onUnmount");
+  } else {
+    onUnmount(cleanup3, element);
   }
 }
 var mountWatchers = /* @__PURE__ */ new WeakMap();
@@ -2214,25 +2670,26 @@ function onMount(callback, element) {
   if (typeof document === "undefined") return;
   if (element) {
     let disposed = false;
+    const isDisposed = () => disposed;
     registerDisposer(element, () => {
       disposed = true;
     });
     if (element.isConnected) {
       queueMicrotask(() => {
         if (disposed) return;
-        runMountCallback(callback, "onMount", element);
+        runMountCallback(callback, "onMount", element, isDisposed);
       });
       return;
     }
     queueMicrotask(() => {
       if (disposed) return;
       if (element.isConnected) {
-        runMountCallback(callback, "onMount", element);
+        runMountCallback(callback, "onMount", element, isDisposed);
         return;
       }
       const unregister = registerMountWatcher(element, () => {
         if (disposed) return;
-        runMountCallback(callback, "onMount", element);
+        runMountCallback(callback, "onMount", element, isDisposed);
       });
       registerDisposer(element, unregister);
     });
@@ -2269,6 +2726,14 @@ function onCleanup(callback, element) {
   registerDisposer(element, callback);
 }
 
+// src/core/devtoolsHook.ts
+function emitDevtools(hook, event, payload) {
+  try {
+    hook.emit(event, payload);
+  } catch {
+  }
+}
+
 // src/core/ssr-context.ts
 var SSR_KEY = /* @__PURE__ */ Symbol.for("sibujs.ssr.v1");
 function detectSSRShared() {
@@ -2506,12 +2971,17 @@ function effect(effectFn, options) {
   try {
     retrack2(ctx.bodyFn, ctx.subscriber);
     if (ctx.rerunPending) drainReruns(ctx);
+  } catch (err) {
+    ctx.disposed = true;
+    if (ctx.userCleanups.length > 0) flushUserCleanups(ctx);
+    cleanup2(ctx.subscriber);
+    throw err;
   } finally {
     ctx.running = false;
     ctx.rerunPending = false;
   }
   const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-  if (hook) hook.emit("effect:create", { effectFn });
+  if (hook) emitDevtools(hook, "effect:create", { effectFn });
   return () => disposeEffect(ctx);
 }
 
@@ -2598,7 +3068,7 @@ function signal(initial, options) {
       state2.__v++;
       if (DEV) {
         const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-        if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+        if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       }
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
@@ -2612,7 +3082,7 @@ function signal(initial, options) {
       state2.value = newValue;
       state2.__v++;
       const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-      if (hook) hook.emit("signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+      if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
       if (!enqueueBatchedSignal(state2)) {
         notifySubscribers2(state2);
       }
@@ -2631,7 +3101,7 @@ function signal(initial, options) {
   }
   if (DEV) {
     const hook = _g2.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (hook) hook.emit("signal:create", { signal: state2, name: debugName, getter: get, initial });
+    if (hook) emitDevtools(hook, "signal:create", { signal: state2, name: debugName, getter: get, initial });
   }
   return [get, set];
 }
@@ -3444,36 +3914,34 @@ function Loading(props = {}) {
   const { text: text2, variant = "spinner", size = "md" } = props;
   const sizeClass = size !== "md" ? ` sibu-loading-${size}` : "";
   if (variant === "dots") {
-    return div({
+    return div(
+      {
+        class: `sibu-loading${sizeClass}`,
+        role: "status",
+        "aria-live": "polite",
+        // When there's no visible text, give the live region an accessible name
+        // so it isn't announced as an empty status.
+        "aria-label": text2 ? void 0 : "Loading"
+      },
+      [
+        div({ class: "sibu-loading-dots" }, [
+          span({ class: "sibu-loading-dot" }),
+          span({ class: "sibu-loading-dot" }),
+          span({ class: "sibu-loading-dot" })
+        ]),
+        text2 ? span({ class: "sibu-loading-text" }, text2) : null
+      ]
+    );
+  }
+  return div(
+    {
       class: `sibu-loading${sizeClass}`,
       role: "status",
       "aria-live": "polite",
-      // When there's no visible text, give the live region an accessible name
-      // so it isn't announced as an empty status.
-      "aria-label": text2 ? void 0 : "Loading",
-      nodes: [
-        div({
-          class: "sibu-loading-dots",
-          nodes: [
-            span({ class: "sibu-loading-dot" }),
-            span({ class: "sibu-loading-dot" }),
-            span({ class: "sibu-loading-dot" })
-          ]
-        }),
-        text2 ? span({ class: "sibu-loading-text", nodes: text2 }) : null
-      ].filter(Boolean)
-    });
-  }
-  return div({
-    class: `sibu-loading${sizeClass}`,
-    role: "status",
-    "aria-live": "polite",
-    "aria-label": text2 ? void 0 : "Loading",
-    nodes: [
-      div({ class: "sibu-loading-spinner" }),
-      text2 ? span({ class: "sibu-loading-text", nodes: text2 }) : null
-    ].filter(Boolean)
-  });
+      "aria-label": text2 ? void 0 : "Loading"
+    },
+    [div({ class: "sibu-loading-spinner" }), text2 ? span({ class: "sibu-loading-text" }, text2) : null]
+  );
 }
 
 // src/core/rendering/action.ts
@@ -3579,13 +4047,35 @@ registerAction("copyOnClick", copyOnClick);
 registerAction("autoResize", autoResize);
 registerAction("trapFocus", trapFocus);
 
+// src/utils/adoptThenable.ts
+function adoptThenable(value) {
+  if (value === null || typeof value !== "object" && typeof value !== "function") return null;
+  let then;
+  try {
+    then = value.then;
+  } catch (error) {
+    return Promise.reject(error);
+  }
+  if (typeof then !== "function") return null;
+  return new Promise((resolve, reject) => {
+    queueMicrotask(() => {
+      try {
+        Reflect.apply(then, value, [resolve, reject]);
+      } catch (error) {
+        reject(error);
+      }
+    });
+  });
+}
+
 // src/core/rendering/catch.ts
 var globalErrorHandler = null;
 function catchError(fn, onError) {
   try {
     const result = fn();
-    if (result && typeof result.then === "function") {
-      result.catch((err) => {
+    const adopted = adoptThenable(result);
+    if (adopted) {
+      adopted.then(void 0, (err) => {
         if (onError) {
           onError(err, "async");
         } else if (globalErrorHandler) {
@@ -3712,6 +4202,10 @@ function attachBranch(parent, anchor, branch, attachedOnce, where) {
   parent.insertBefore(node, anchor.nextSibling);
   return { node, owned };
 }
+function releaseBranchNode(node, owned) {
+  if (owned) dispose(node);
+  node.parentNode?.removeChild(node);
+}
 function when(condition, thenBranch, elseBranch) {
   const anchor = document.createComment("when");
   let currentNode = null;
@@ -3725,16 +4219,15 @@ function when(condition, thenBranch, elseBranch) {
     const show2 = condition();
     const parent = anchor.parentNode;
     if (!parent) return;
-    if (initialized && show2 === lastCondition) return;
+    if (initialized && Object.is(show2, lastCondition)) return;
     lastCondition = show2;
     const focused = currentNode ? captureFocusWithin([currentNode]) : null;
     if (currentNode?.parentNode) {
-      if (currentNodeOwned) dispose(currentNode);
-      currentNode.parentNode.removeChild(currentNode);
+      releaseBranchNode(currentNode, currentNodeOwned);
       currentNode = null;
     }
     const branch = show2 ? thenBranch : elseBranch !== void 0 ? elseBranch : null;
-    const attached = attachBranch(parent, anchor, branch, attachedOnce, "when");
+    const attached = untracked2(() => attachBranch(parent, anchor, branch, attachedOnce, "when"));
     currentNode = attached.node;
     currentNodeOwned = attached.owned;
     restoreFocusWithin(focused, currentNode ? [currentNode] : [], "when");
@@ -3744,6 +4237,8 @@ function when(condition, thenBranch, elseBranch) {
   registerDisposer(anchor, () => {
     disposed = true;
     stopBinding();
+    if (currentNode) releaseBranchNode(currentNode, currentNodeOwned);
+    currentNode = null;
   });
   if (!initialized) {
     queueMicrotask(() => {
@@ -3769,12 +4264,11 @@ function match(value, cases, fallback) {
     lastKey = key;
     const focused = currentNode ? captureFocusWithin([currentNode]) : null;
     if (currentNode?.parentNode) {
-      if (currentNodeOwned) dispose(currentNode);
-      currentNode.parentNode.removeChild(currentNode);
+      releaseBranchNode(currentNode, currentNodeOwned);
       currentNode = null;
     }
     const branch = Object.hasOwn(cases, key) ? cases[key] : fallback;
-    const attached = attachBranch(parent, anchor, branch ?? null, attachedOnce, "match");
+    const attached = untracked2(() => attachBranch(parent, anchor, branch ?? null, attachedOnce, "match"));
     currentNode = attached.node;
     currentNodeOwned = attached.owned;
     restoreFocusWithin(focused, currentNode ? [currentNode] : [], "match");
@@ -3784,6 +4278,8 @@ function match(value, cases, fallback) {
   registerDisposer(anchor, () => {
     disposed = true;
     stopBinding();
+    if (currentNode) releaseBranchNode(currentNode, currentNodeOwned);
+    currentNode = null;
   });
   if (!initialized) {
     queueMicrotask(() => {
@@ -3804,11 +4300,17 @@ var componentRegistry = globalSingleton(
   /* @__PURE__ */ Symbol.for("sibujs.components.registry.v1"),
   () => /* @__PURE__ */ new Map()
 );
+var registryVersion = globalSingleton(/* @__PURE__ */ Symbol.for("sibujs.components.registryVersion.v1"), () => signal(0));
+function bumpRegistry() {
+  const [read, write] = registryVersion;
+  write(untracked2(read) + 1);
+}
 function registerComponent(name, component) {
   componentRegistry.set(name, component);
+  bumpRegistry();
 }
 function unregisterComponent(name) {
-  componentRegistry.delete(name);
+  if (componentRegistry.delete(name)) bumpRegistry();
 }
 function resolveComponent(name) {
   const component = componentRegistry.get(name);
@@ -3819,14 +4321,21 @@ function resolveComponent(name) {
 }
 function DynamicComponent(is) {
   const container = div({ class: "sibu-dynamic" });
+  const NONE = {};
+  let shown = NONE;
   function render() {
     const target = is();
-    let el;
+    let component;
     if (typeof target === "function") {
-      el = target();
+      component = target;
     } else {
-      el = resolveComponent(target);
+      registryVersion[0]();
+      component = componentRegistry.get(target);
     }
+    const next = component ?? `missing:${target}`;
+    if (next === shown) return;
+    const el = untracked2(() => component ? component() : div(`[Component "${target}" not found]`));
+    shown = next;
     replaceChildrenSafely(container, el);
   }
   const untrack = track2(render);
@@ -4090,31 +4599,29 @@ function Fragment(nodes) {
     if (Array.isArray(child)) {
       for (const nested of child) {
         if (nested == null || typeof nested === "boolean") continue;
-        frag.appendChild(resolveChild(nested));
+        appendChild(frag, nested);
       }
     } else {
-      frag.appendChild(resolveChild(child));
+      appendChild(frag, child);
     }
   }
   return frag;
 }
-function resolveChild(child) {
-  if (child == null) {
-    return document.createTextNode("");
-  }
+function appendChild(frag, child) {
   if (child instanceof Node) {
-    return child;
+    frag.appendChild(child);
+    return;
   }
   if (typeof child === "function") {
-    const result = child();
-    if (result instanceof Node) return result;
-    return document.createTextNode(String(result ?? ""));
+    const placeholder = document.createComment("");
+    frag.appendChild(placeholder);
+    registerDisposer(placeholder, bindChildNode(placeholder, child));
+    return;
   }
-  return document.createTextNode(String(child));
+  frag.appendChild(document.createTextNode(String(child)));
 }
 
 // src/core/rendering/htm.ts
-var RAW_TEXT_TAGS = /* @__PURE__ */ new Set(["script", "style"]);
 var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "area",
   "base",
@@ -4337,7 +4844,7 @@ function parseTemplate(strings) {
           children.push({ t: 0, el: { tag, svg: SVG_TAGS.has(tag), attrs, children: [] } });
         } else {
           const inner = parseChildren();
-          if (RAW_TEXT_TAGS.has(tag.toLowerCase())) {
+          if (isCodeTextElement(tag)) {
             for (let i2 = 0; i2 < inner.length; i2++) {
               if (inner[i2].t === 2) {
                 throw new Error(
@@ -4363,12 +4870,12 @@ function parseTemplate(strings) {
   return parseChildren();
 }
 function executeElement(tmpl, values) {
-  const el = tmpl.svg ? document.createElementNS(SVG_NS2, tmpl.tag) : document.createElement(tmpl.tag);
+  const el = tmpl.svg ? document.createElementNS(SVG_NS3, tmpl.tag) : document.createElement(tmpl.tag);
   for (let i2 = 0; i2 < tmpl.attrs.length; i2++) {
     const attr = tmpl.attrs[i2];
     switch (attr.t) {
       case 0:
-        el.setAttribute(attr.name, attr.value);
+        setTrustedAttribute(el, attr.name, attr.value);
         break;
       case 1: {
         const name = attr.name;
@@ -4401,7 +4908,7 @@ function executeElement(tmpl, values) {
         break;
       }
       case 4:
-        el.setAttribute(attr.name, "");
+        setTrustedAttribute(el, attr.name, "");
         break;
     }
   }
@@ -4446,6 +4953,12 @@ function html2(strings, ...values) {
     tmpl = parseTemplate(strings);
     cache.set(strings, tmpl);
   }
+  return renderTemplate(tmpl, values);
+}
+function __renderParsedTemplate(tree, values) {
+  return renderTemplate(tree, values);
+}
+function renderTemplate(tmpl, values) {
   if (tmpl.length === 1 && tmpl[0].t === 0) {
     return executeElement(tmpl[0].el, values);
   }
@@ -4580,25 +5093,77 @@ function mount(component, container) {
     typeof component === "function" || component instanceof Node,
     "mount: first argument must be a component function or a DOM Node."
   );
-  const startTime = typeof performance !== "undefined" ? performance.now() : 0;
-  const node = typeof component === "function" ? component() : component;
-  const duration = typeof performance !== "undefined" ? performance.now() - startTime : 0;
-  container.appendChild(node);
-  const hook = globalThis.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-  if (hook) {
-    hook.emit("app:init", { rootElement: node, container, duration });
+  const now = () => typeof performance !== "undefined" ? performance.now() : 0;
+  const startTime = now();
+  let range = null;
+  const attach = (built) => {
+    if (built instanceof DocumentFragment) {
+      const start = document.createComment("");
+      const end = document.createComment("");
+      built.insertBefore(start, built.firstChild);
+      built.appendChild(end);
+      range = { start, end };
+    }
+    container.appendChild(built);
+  };
+  let node;
+  if (typeof component === "function") {
+    node = withDisposerRollback(() => {
+      const built = component();
+      attach(built);
+      return built;
+    });
+  } else {
+    node = component;
+    attach(node);
   }
+  const duration = now() - startTime;
+  const hook = globalThis.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
+  if (hook) emitDevtools(hook, "app:init", { rootElement: node, container, duration });
+  const mounted = range;
   return {
     node,
     unmount() {
-      if (hook) hook.emit("app:unmount", { rootElement: node });
-      dispose(node);
-      if (node.parentNode) {
-        node.parentNode.removeChild(node);
+      if (hook) emitDevtools(hook, "app:unmount", { rootElement: node });
+      if (mounted) {
+        unmountRange(mounted.start, mounted.end);
+        return;
       }
+      dispose(node);
+      node.parentNode?.removeChild(node);
     }
   };
 }
+function unmountRange(start, end) {
+  const parent = start.parentNode;
+  if (!parent && !end.parentNode) return;
+  let budget = MAX_DRAIN_TEARDOWNS;
+  for (let n = start.nextSibling; n && n !== end; n = n.nextSibling) budget++;
+  let before = start;
+  let after = null;
+  let intact = true;
+  for (; ; ) {
+    if (start.parentNode !== parent || end.parentNode !== parent) intact = false;
+    else if (start.previousSibling !== before || end.nextSibling !== after) {
+      before = start.previousSibling;
+      after = end.nextSibling;
+      intact = !!(start.compareDocumentPosition(end) & 4);
+    }
+    const n = start.nextSibling;
+    if (!intact || n === end) break;
+    if (budget-- <= 0) {
+      reportDrainRunaway("mount", MAX_DRAIN_TEARDOWNS, 1);
+      return;
+    }
+    dispose(n);
+    if (n.parentNode === parent) parent.removeChild(n);
+  }
+  if (!intact) {
+    reportError(new Error("[SibuJS mount] fragment markers lost"), { phase: "cleanup", name: "mount" });
+  }
+  start.parentNode?.removeChild(start);
+  end.parentNode?.removeChild(end);
+}
 
 // src/core/rendering/portal.ts
 function Portal(nodes, target) {
@@ -5034,17 +5599,17 @@ function derived(getter, options) {
     cs._d = false;
     cs._init = true;
   };
-  track2(() => {
-    let threw = true;
-    try {
+  try {
+    track2(() => {
       cs._v = getter();
       cs._d = false;
       cs._init = true;
-      threw = false;
-    } finally {
-      if (threw) cs._d = true;
-    }
-  }, markDirty);
+    }, markDirty);
+  } catch (err) {
+    disposed = true;
+    cleanup2(markDirty);
+    throw err;
+  }
   const hook = globalThis.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
   const validate = () => {
     if (!cs._d || disposed || pendingError !== void 0) return;
@@ -5063,7 +5628,7 @@ function derived(getter, options) {
       if (disposed) cleanup2(markDirty);
     }
     if (hook && !disposed && !Object.is(oldValue, cs._v)) {
-      hook.emit("computed:update", { signal: cs, oldValue, newValue: cs._v });
+      emitDevtools(hook, "computed:update", { signal: cs, oldValue, newValue: cs._v });
     }
   };
   cs._validate = validate;
@@ -5114,7 +5679,7 @@ function derived(getter, options) {
       }
     }
   };
-  if (hook) hook.emit("computed:create", { signal: cs, name: debugName, getter: computedGetter });
+  if (hook) emitDevtools(hook, "computed:create", { signal: cs, name: debugName, getter: computedGetter });
   return computedGetter;
 }
 
@@ -5482,7 +6047,7 @@ function enhance(target, setup) {
           bindNode(el, () => {
             const v = value();
             const next = v == null ? null : String(v);
-            setSafeAttribute(el, name, next, { syncValueProperty: false, label: "enhance attr()" });
+            setSafeAttribute(el, name, next, { syncValueProperty: false, label: "enhance attr()", reactive: true });
           })
         );
       });
@@ -5754,27 +6319,6 @@ function trustHTML(html3) {
 }
 var DEFAULT_MAX_SSR_BYTES = 1024 * 1024;
 
-// src/utils/adoptThenable.ts
-function adoptThenable(value) {
-  if (value === null || typeof value !== "object" && typeof value !== "function") return null;
-  let then;
-  try {
-    then = value.then;
-  } catch (error) {
-    return Promise.reject(error);
-  }
-  if (typeof then !== "function") return null;
-  return new Promise((resolve, reject) => {
-    queueMicrotask(() => {
-      try {
-        Reflect.apply(then, value, [resolve, reject]);
-      } catch (error) {
-        reject(error);
-      }
-    });
-  });
-}
-
 // src/reactivity/concurrent.ts
 function defer(getter) {
   const [value, setValue] = signal(getter());
@@ -5875,6 +6419,7 @@ function nextTick() {
   Portal,
   SVG_NS,
   Suspense,
+  __renderParsedTemplate,
   __resetIdCounter,
   a,
   abbr,